cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

qmp.c (17490B)


      1/*
      2 * QEMU monitor
      3 *
      4 * Copyright (c) 2003-2004 Fabrice Bellard
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26
     27#include "chardev/char-io.h"
     28#include "monitor-internal.h"
     29#include "qapi/error.h"
     30#include "qapi/qapi-commands-control.h"
     31#include "qapi/qmp/qdict.h"
     32#include "qapi/qmp/qjson.h"
     33#include "qapi/qmp/qlist.h"
     34#include "trace.h"
     35
     36struct QMPRequest {
     37    /* Owner of the request */
     38    MonitorQMP *mon;
     39    /*
     40     * Request object to be handled or Error to be reported
     41     * (exactly one of them is non-null)
     42     */
     43    QObject *req;
     44    Error *err;
     45};
     46typedef struct QMPRequest QMPRequest;
     47
     48QmpCommandList qmp_commands, qmp_cap_negotiation_commands;
     49
     50static bool qmp_oob_enabled(MonitorQMP *mon)
     51{
     52    return mon->capab[QMP_CAPABILITY_OOB];
     53}
     54
     55static void monitor_qmp_caps_reset(MonitorQMP *mon)
     56{
     57    memset(mon->capab_offered, 0, sizeof(mon->capab_offered));
     58    memset(mon->capab, 0, sizeof(mon->capab));
     59    mon->capab_offered[QMP_CAPABILITY_OOB] = mon->common.use_io_thread;
     60}
     61
     62static void qmp_request_free(QMPRequest *req)
     63{
     64    qobject_unref(req->req);
     65    error_free(req->err);
     66    g_free(req);
     67}
     68
     69/* Caller must hold mon->qmp.qmp_queue_lock */
     70static void monitor_qmp_cleanup_req_queue_locked(MonitorQMP *mon)
     71{
     72    while (!g_queue_is_empty(mon->qmp_requests)) {
     73        qmp_request_free(g_queue_pop_head(mon->qmp_requests));
     74    }
     75}
     76
     77static void monitor_qmp_cleanup_queue_and_resume(MonitorQMP *mon)
     78{
     79    QEMU_LOCK_GUARD(&mon->qmp_queue_lock);
     80
     81    /*
     82     * Same condition as in monitor_qmp_dispatcher_co(), but before
     83     * removing an element from the queue (hence no `- 1`).
     84     * Also, the queue should not be empty either, otherwise the
     85     * monitor hasn't been suspended yet (or was already resumed).
     86     */
     87    bool need_resume = (!qmp_oob_enabled(mon) ||
     88        mon->qmp_requests->length == QMP_REQ_QUEUE_LEN_MAX)
     89        && !g_queue_is_empty(mon->qmp_requests);
     90
     91    monitor_qmp_cleanup_req_queue_locked(mon);
     92
     93    if (need_resume) {
     94        /*
     95         * handle_qmp_command() suspended the monitor because the
     96         * request queue filled up, to be resumed when the queue has
     97         * space again.  We just emptied it; resume the monitor.
     98         *
     99         * Without this, the monitor would remain suspended forever
    100         * when we get here while the monitor is suspended.  An
    101         * unfortunately timed CHR_EVENT_CLOSED can do the trick.
    102         */
    103        monitor_resume(&mon->common);
    104    }
    105
    106}
    107
    108void qmp_send_response(MonitorQMP *mon, const QDict *rsp)
    109{
    110    const QObject *data = QOBJECT(rsp);
    111    GString *json;
    112
    113    json = qobject_to_json_pretty(data, mon->pretty);
    114    assert(json != NULL);
    115    trace_monitor_qmp_respond(mon, json->str);
    116
    117    g_string_append_c(json, '\n');
    118    monitor_puts(&mon->common, json->str);
    119
    120    g_string_free(json, true);
    121}
    122
    123/*
    124 * Emit QMP response @rsp to @mon.
    125 * Null @rsp can only happen for commands with QCO_NO_SUCCESS_RESP.
    126 * Nothing is emitted then.
    127 */
    128static void monitor_qmp_respond(MonitorQMP *mon, QDict *rsp)
    129{
    130    if (rsp) {
    131        qmp_send_response(mon, rsp);
    132    }
    133}
    134
    135/*
    136 * Runs outside of coroutine context for OOB commands, but in
    137 * coroutine context for everything else.
    138 */
    139static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
    140{
    141    QDict *rsp;
    142    QDict *error;
    143
    144    rsp = qmp_dispatch(mon->commands, req, qmp_oob_enabled(mon),
    145                       &mon->common);
    146
    147    if (mon->commands == &qmp_cap_negotiation_commands) {
    148        error = qdict_get_qdict(rsp, "error");
    149        if (error
    150            && !g_strcmp0(qdict_get_try_str(error, "class"),
    151                    QapiErrorClass_str(ERROR_CLASS_COMMAND_NOT_FOUND))) {
    152            /* Provide a more useful error message */
    153            qdict_del(error, "desc");
    154            qdict_put_str(error, "desc", "Expecting capabilities negotiation"
    155                          " with 'qmp_capabilities'");
    156        }
    157    }
    158
    159    monitor_qmp_respond(mon, rsp);
    160    qobject_unref(rsp);
    161}
    162
    163/*
    164 * Pop a QMP request from a monitor request queue.
    165 * Return the request, or NULL all request queues are empty.
    166 * We are using round-robin fashion to pop the request, to avoid
    167 * processing commands only on a very busy monitor.  To achieve that,
    168 * when we process one request on a specific monitor, we put that
    169 * monitor to the end of mon_list queue.
    170 *
    171 * Note: if the function returned with non-NULL, then the caller will
    172 * be with qmp_mon->qmp_queue_lock held, and the caller is responsible
    173 * to release it.
    174 */
    175static QMPRequest *monitor_qmp_requests_pop_any_with_lock(void)
    176{
    177    QMPRequest *req_obj = NULL;
    178    Monitor *mon;
    179    MonitorQMP *qmp_mon;
    180
    181    QEMU_LOCK_GUARD(&monitor_lock);
    182
    183    QTAILQ_FOREACH(mon, &mon_list, entry) {
    184        if (!monitor_is_qmp(mon)) {
    185            continue;
    186        }
    187
    188        qmp_mon = container_of(mon, MonitorQMP, common);
    189        qemu_mutex_lock(&qmp_mon->qmp_queue_lock);
    190        req_obj = g_queue_pop_head(qmp_mon->qmp_requests);
    191        if (req_obj) {
    192            /* With the lock of corresponding queue held */
    193            break;
    194        }
    195        qemu_mutex_unlock(&qmp_mon->qmp_queue_lock);
    196    }
    197
    198    if (req_obj) {
    199        /*
    200         * We found one request on the monitor. Degrade this monitor's
    201         * priority to lowest by re-inserting it to end of queue.
    202         */
    203        QTAILQ_REMOVE(&mon_list, mon, entry);
    204        QTAILQ_INSERT_TAIL(&mon_list, mon, entry);
    205    }
    206
    207    return req_obj;
    208}
    209
    210void coroutine_fn monitor_qmp_dispatcher_co(void *data)
    211{
    212    QMPRequest *req_obj = NULL;
    213    QDict *rsp;
    214    bool oob_enabled;
    215    MonitorQMP *mon;
    216
    217    while (true) {
    218        assert(qatomic_mb_read(&qmp_dispatcher_co_busy) == true);
    219
    220        /*
    221         * Mark the dispatcher as not busy already here so that we
    222         * don't miss any new requests coming in the middle of our
    223         * processing.
    224         */
    225        qatomic_mb_set(&qmp_dispatcher_co_busy, false);
    226
    227        /* On shutdown, don't take any more requests from the queue */
    228        if (qmp_dispatcher_co_shutdown) {
    229            return;
    230        }
    231
    232        while (!(req_obj = monitor_qmp_requests_pop_any_with_lock())) {
    233            /*
    234             * No more requests to process.  Wait to be reentered from
    235             * handle_qmp_command() when it pushes more requests, or
    236             * from monitor_cleanup() when it requests shutdown.
    237             */
    238            if (!qmp_dispatcher_co_shutdown) {
    239                qemu_coroutine_yield();
    240
    241                /*
    242                 * busy must be set to true again by whoever
    243                 * rescheduled us to avoid double scheduling
    244                 */
    245                assert(qatomic_xchg(&qmp_dispatcher_co_busy, false) == true);
    246            }
    247
    248            /*
    249             * qmp_dispatcher_co_shutdown may have changed if we
    250             * yielded and were reentered from monitor_cleanup()
    251             */
    252            if (qmp_dispatcher_co_shutdown) {
    253                return;
    254            }
    255        }
    256
    257        trace_monitor_qmp_in_band_dequeue(req_obj,
    258                                          req_obj->mon->qmp_requests->length);
    259
    260        /*
    261         * @req_obj has a request, we hold req_obj->mon->qmp_queue_lock
    262         */
    263
    264        mon = req_obj->mon;
    265
    266        /*
    267         * We need to resume the monitor if handle_qmp_command()
    268         * suspended it.  Two cases:
    269         * 1. OOB enabled: mon->qmp_requests has no more space
    270         *    Resume right away, so that OOB commands can get executed while
    271         *    this request is being processed.
    272         * 2. OOB disabled: always
    273         *    Resume only after we're done processing the request,
    274         * We need to save qmp_oob_enabled() for later, because
    275         * qmp_qmp_capabilities() can change it.
    276         */
    277        oob_enabled = qmp_oob_enabled(mon);
    278        if (oob_enabled
    279            && mon->qmp_requests->length == QMP_REQ_QUEUE_LEN_MAX - 1) {
    280            monitor_resume(&mon->common);
    281        }
    282
    283        /*
    284         * Drop the queue mutex now, before yielding, otherwise we might
    285         * deadlock if the main thread tries to lock it.
    286         */
    287        qemu_mutex_unlock(&mon->qmp_queue_lock);
    288
    289        if (qatomic_xchg(&qmp_dispatcher_co_busy, true) == true) {
    290            /*
    291             * Someone rescheduled us (probably because a new requests
    292             * came in), but we didn't actually yield. Do that now,
    293             * only to be immediately reentered and removed from the
    294             * list of scheduled coroutines.
    295             */
    296            qemu_coroutine_yield();
    297        }
    298
    299        /*
    300         * Move the coroutine from iohandler_ctx to qemu_aio_context for
    301         * executing the command handler so that it can make progress if it
    302         * involves an AIO_WAIT_WHILE().
    303         */
    304        aio_co_schedule(qemu_get_aio_context(), qmp_dispatcher_co);
    305        qemu_coroutine_yield();
    306
    307        /* Process request */
    308        if (req_obj->req) {
    309            if (trace_event_get_state(TRACE_MONITOR_QMP_CMD_IN_BAND)) {
    310                QDict *qdict = qobject_to(QDict, req_obj->req);
    311                QObject *id = qdict ? qdict_get(qdict, "id") : NULL;
    312                GString *id_json;
    313
    314                id_json = id ? qobject_to_json(id) : g_string_new(NULL);
    315                trace_monitor_qmp_cmd_in_band(id_json->str);
    316                g_string_free(id_json, true);
    317            }
    318            monitor_qmp_dispatch(mon, req_obj->req);
    319        } else {
    320            assert(req_obj->err);
    321            trace_monitor_qmp_err_in_band(error_get_pretty(req_obj->err));
    322            rsp = qmp_error_response(req_obj->err);
    323            req_obj->err = NULL;
    324            monitor_qmp_respond(mon, rsp);
    325            qobject_unref(rsp);
    326        }
    327
    328        if (!oob_enabled) {
    329            monitor_resume(&mon->common);
    330        }
    331
    332        qmp_request_free(req_obj);
    333
    334        /*
    335         * Yield and reschedule so the main loop stays responsive.
    336         *
    337         * Move back to iohandler_ctx so that nested event loops for
    338         * qemu_aio_context don't start new monitor commands.
    339         */
    340        aio_co_schedule(iohandler_get_aio_context(), qmp_dispatcher_co);
    341        qemu_coroutine_yield();
    342    }
    343}
    344
    345static void handle_qmp_command(void *opaque, QObject *req, Error *err)
    346{
    347    MonitorQMP *mon = opaque;
    348    QDict *qdict = qobject_to(QDict, req);
    349    QMPRequest *req_obj;
    350
    351    assert(!req != !err);
    352
    353    if (req && trace_event_get_state_backends(TRACE_HANDLE_QMP_COMMAND)) {
    354        GString *req_json = qobject_to_json(req);
    355        trace_handle_qmp_command(mon, req_json->str);
    356        g_string_free(req_json, true);
    357    }
    358
    359    if (qdict && qmp_is_oob(qdict)) {
    360        /* OOB commands are executed immediately */
    361        if (trace_event_get_state(TRACE_MONITOR_QMP_CMD_OUT_OF_BAND)) {
    362            QObject *id = qdict_get(qdict, "id");
    363            GString *id_json;
    364
    365            id_json = id ? qobject_to_json(id) : g_string_new(NULL);
    366            trace_monitor_qmp_cmd_out_of_band(id_json->str);
    367            g_string_free(id_json, true);
    368        }
    369        monitor_qmp_dispatch(mon, req);
    370        qobject_unref(req);
    371        return;
    372    }
    373
    374    req_obj = g_new0(QMPRequest, 1);
    375    req_obj->mon = mon;
    376    req_obj->req = req;
    377    req_obj->err = err;
    378
    379    /* Protect qmp_requests and fetching its length. */
    380    WITH_QEMU_LOCK_GUARD(&mon->qmp_queue_lock) {
    381
    382        /*
    383         * Suspend the monitor when we can't queue more requests after
    384         * this one.  Dequeuing in monitor_qmp_dispatcher_co() or
    385         * monitor_qmp_cleanup_queue_and_resume() will resume it.
    386         * Note that when OOB is disabled, we queue at most one command,
    387         * for backward compatibility.
    388         */
    389        if (!qmp_oob_enabled(mon) ||
    390            mon->qmp_requests->length == QMP_REQ_QUEUE_LEN_MAX - 1) {
    391            monitor_suspend(&mon->common);
    392        }
    393
    394        /*
    395         * Put the request to the end of queue so that requests will be
    396         * handled in time order.  Ownership for req_obj, req,
    397         * etc. will be delivered to the handler side.
    398         */
    399        trace_monitor_qmp_in_band_enqueue(req_obj, mon,
    400                                          mon->qmp_requests->length);
    401        assert(mon->qmp_requests->length < QMP_REQ_QUEUE_LEN_MAX);
    402        g_queue_push_tail(mon->qmp_requests, req_obj);
    403    }
    404
    405    /* Kick the dispatcher routine */
    406    if (!qatomic_xchg(&qmp_dispatcher_co_busy, true)) {
    407        aio_co_wake(qmp_dispatcher_co);
    408    }
    409}
    410
    411static void monitor_qmp_read(void *opaque, const uint8_t *buf, int size)
    412{
    413    MonitorQMP *mon = opaque;
    414
    415    json_message_parser_feed(&mon->parser, (const char *) buf, size);
    416}
    417
    418static QDict *qmp_greeting(MonitorQMP *mon)
    419{
    420    QList *cap_list = qlist_new();
    421    QObject *ver = NULL;
    422    QDict *args;
    423    QMPCapability cap;
    424
    425    args = qdict_new();
    426    qmp_marshal_query_version(args, &ver, NULL);
    427    qobject_unref(args);
    428
    429    for (cap = 0; cap < QMP_CAPABILITY__MAX; cap++) {
    430        if (mon->capab_offered[cap]) {
    431            qlist_append_str(cap_list, QMPCapability_str(cap));
    432        }
    433    }
    434
    435    return qdict_from_jsonf_nofail(
    436        "{'QMP': {'version': %p, 'capabilities': %p}}",
    437        ver, cap_list);
    438}
    439
    440static void monitor_qmp_event(void *opaque, QEMUChrEvent event)
    441{
    442    QDict *data;
    443    MonitorQMP *mon = opaque;
    444
    445    switch (event) {
    446    case CHR_EVENT_OPENED:
    447        mon->commands = &qmp_cap_negotiation_commands;
    448        monitor_qmp_caps_reset(mon);
    449        data = qmp_greeting(mon);
    450        qmp_send_response(mon, data);
    451        qobject_unref(data);
    452        mon_refcount++;
    453        break;
    454    case CHR_EVENT_CLOSED:
    455        /*
    456         * Note: this is only useful when the output of the chardev
    457         * backend is still open.  For example, when the backend is
    458         * stdio, it's possible that stdout is still open when stdin
    459         * is closed.
    460         */
    461        monitor_qmp_cleanup_queue_and_resume(mon);
    462        json_message_parser_destroy(&mon->parser);
    463        json_message_parser_init(&mon->parser, handle_qmp_command,
    464                                 mon, NULL);
    465        mon_refcount--;
    466        monitor_fdsets_cleanup();
    467        break;
    468    case CHR_EVENT_BREAK:
    469    case CHR_EVENT_MUX_IN:
    470    case CHR_EVENT_MUX_OUT:
    471        /* Ignore */
    472        break;
    473    }
    474}
    475
    476void monitor_data_destroy_qmp(MonitorQMP *mon)
    477{
    478    json_message_parser_destroy(&mon->parser);
    479    qemu_mutex_destroy(&mon->qmp_queue_lock);
    480    monitor_qmp_cleanup_req_queue_locked(mon);
    481    g_queue_free(mon->qmp_requests);
    482}
    483
    484static void monitor_qmp_setup_handlers_bh(void *opaque)
    485{
    486    MonitorQMP *mon = opaque;
    487    GMainContext *context;
    488
    489    assert(mon->common.use_io_thread);
    490    context = iothread_get_g_main_context(mon_iothread);
    491    assert(context);
    492    qemu_chr_fe_set_handlers(&mon->common.chr, monitor_can_read,
    493                             monitor_qmp_read, monitor_qmp_event,
    494                             NULL, &mon->common, context, true);
    495    monitor_list_append(&mon->common);
    496}
    497
    498void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
    499{
    500    MonitorQMP *mon = g_new0(MonitorQMP, 1);
    501
    502    if (!qemu_chr_fe_init(&mon->common.chr, chr, errp)) {
    503        g_free(mon);
    504        return;
    505    }
    506    qemu_chr_fe_set_echo(&mon->common.chr, true);
    507
    508    /* Note: we run QMP monitor in I/O thread when @chr supports that */
    509    monitor_data_init(&mon->common, true, false,
    510                      qemu_chr_has_feature(chr, QEMU_CHAR_FEATURE_GCONTEXT));
    511
    512    mon->pretty = pretty;
    513
    514    qemu_mutex_init(&mon->qmp_queue_lock);
    515    mon->qmp_requests = g_queue_new();
    516
    517    json_message_parser_init(&mon->parser, handle_qmp_command, mon, NULL);
    518    if (mon->common.use_io_thread) {
    519        /*
    520         * Make sure the old iowatch is gone.  It's possible when
    521         * e.g. the chardev is in client mode, with wait=on.
    522         */
    523        remove_fd_in_watch(chr);
    524        /*
    525         * We can't call qemu_chr_fe_set_handlers() directly here
    526         * since chardev might be running in the monitor I/O
    527         * thread.  Schedule a bottom half.
    528         */
    529        aio_bh_schedule_oneshot(iothread_get_aio_context(mon_iothread),
    530                                monitor_qmp_setup_handlers_bh, mon);
    531        /* The bottom half will add @mon to @mon_list */
    532    } else {
    533        qemu_chr_fe_set_handlers(&mon->common.chr, monitor_can_read,
    534                                 monitor_qmp_read, monitor_qmp_event,
    535                                 NULL, &mon->common, NULL, true);
    536        monitor_list_append(&mon->common);
    537    }
    538}