qemu/qapi/qmp-dispatch.c
Markus Armbruster dbb675c19a qapi: New -compat deprecated-input=crash
Policy "crash" calls abort() when deprecated input is received.

Bugs in integration tests may mask the error from policy "reject".
Provide a larger hammer: crash outright.  Masking that seems unlikely.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20210318155519.1224118-12-armbru@redhat.com>
2021-03-19 16:05:11 +01:00

287 lines
7.8 KiB
C

/*
* Core Definitions for QAPI/QMP Dispatch
*
* Copyright IBM, Corp. 2011
*
* Authors:
* Anthony Liguori <aliguori@us.ibm.com>
*
* This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
* See the COPYING.LIB file in the top-level directory.
*
*/
#include "qemu/osdep.h"
#include "block/aio.h"
#include "qapi/compat-policy.h"
#include "qapi/error.h"
#include "qapi/qmp/dispatch.h"
#include "qapi/qmp/qdict.h"
#include "qapi/qmp/qjson.h"
#include "qapi/qobject-input-visitor.h"
#include "qapi/qobject-output-visitor.h"
#include "sysemu/runstate.h"
#include "qapi/qmp/qbool.h"
#include "qemu/coroutine.h"
#include "qemu/main-loop.h"
CompatPolicy compat_policy;
Visitor *qobject_input_visitor_new_qmp(QObject *obj)
{
Visitor *v = qobject_input_visitor_new(obj);
qobject_input_visitor_set_policy(v, compat_policy.deprecated_input);
return v;
}
Visitor *qobject_output_visitor_new_qmp(QObject **result)
{
Visitor *v = qobject_output_visitor_new(result);
qobject_output_visitor_set_policy(v, compat_policy.deprecated_output);
return v;
}
static QDict *qmp_dispatch_check_obj(QDict *dict, bool allow_oob,
Error **errp)
{
const char *exec_key = NULL;
const QDictEntry *ent;
const char *arg_name;
const QObject *arg_obj;
for (ent = qdict_first(dict); ent;
ent = qdict_next(dict, ent)) {
arg_name = qdict_entry_key(ent);
arg_obj = qdict_entry_value(ent);
if (!strcmp(arg_name, "execute")
|| (!strcmp(arg_name, "exec-oob") && allow_oob)) {
if (qobject_type(arg_obj) != QTYPE_QSTRING) {
error_setg(errp, "QMP input member '%s' must be a string",
arg_name);
return NULL;
}
if (exec_key) {
error_setg(errp, "QMP input member '%s' clashes with '%s'",
arg_name, exec_key);
return NULL;
}
exec_key = arg_name;
} else if (!strcmp(arg_name, "arguments")) {
if (qobject_type(arg_obj) != QTYPE_QDICT) {
error_setg(errp,
"QMP input member 'arguments' must be an object");
return NULL;
}
} else if (!strcmp(arg_name, "id")) {
continue;
} else {
error_setg(errp, "QMP input member '%s' is unexpected",
arg_name);
return NULL;
}
}
if (!exec_key) {
error_setg(errp, "QMP input lacks member 'execute'");
return NULL;
}
return dict;
}
QDict *qmp_error_response(Error *err)
{
QDict *rsp;
rsp = qdict_from_jsonf_nofail("{ 'error': { 'class': %s, 'desc': %s } }",
QapiErrorClass_str(error_get_class(err)),
error_get_pretty(err));
error_free(err);
return rsp;
}
/*
* Does @qdict look like a command to be run out-of-band?
*/
bool qmp_is_oob(const QDict *dict)
{
return qdict_haskey(dict, "exec-oob")
&& !qdict_haskey(dict, "execute");
}
typedef struct QmpDispatchBH {
const QmpCommand *cmd;
Monitor *cur_mon;
QDict *args;
QObject **ret;
Error **errp;
Coroutine *co;
} QmpDispatchBH;
static void do_qmp_dispatch_bh(void *opaque)
{
QmpDispatchBH *data = opaque;
assert(monitor_cur() == NULL);
monitor_set_cur(qemu_coroutine_self(), data->cur_mon);
data->cmd->fn(data->args, data->ret, data->errp);
monitor_set_cur(qemu_coroutine_self(), NULL);
aio_co_wake(data->co);
}
/*
* Runs outside of coroutine context for OOB commands, but in coroutine
* context for everything else.
*/
QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
bool allow_oob, Monitor *cur_mon)
{
Error *err = NULL;
bool oob;
const char *command;
QDict *args;
const QmpCommand *cmd;
QDict *dict;
QObject *id;
QObject *ret = NULL;
QDict *rsp = NULL;
dict = qobject_to(QDict, request);
if (!dict) {
id = NULL;
error_setg(&err, "QMP input must be a JSON object");
goto out;
}
id = qdict_get(dict, "id");
if (!qmp_dispatch_check_obj(dict, allow_oob, &err)) {
goto out;
}
command = qdict_get_try_str(dict, "execute");
oob = false;
if (!command) {
assert(allow_oob);
command = qdict_get_str(dict, "exec-oob");
oob = true;
}
cmd = qmp_find_command(cmds, command);
if (cmd == NULL) {
error_set(&err, ERROR_CLASS_COMMAND_NOT_FOUND,
"The command %s has not been found", command);
goto out;
}
if (cmd->options & QCO_DEPRECATED) {
switch (compat_policy.deprecated_input) {
case COMPAT_POLICY_INPUT_ACCEPT:
break;
case COMPAT_POLICY_INPUT_REJECT:
error_set(&err, ERROR_CLASS_COMMAND_NOT_FOUND,
"Deprecated command %s disabled by policy",
command);
goto out;
case COMPAT_POLICY_INPUT_CRASH:
default:
abort();
}
}
if (!cmd->enabled) {
error_set(&err, ERROR_CLASS_COMMAND_NOT_FOUND,
"Command %s has been disabled%s%s",
command,
cmd->disable_reason ? ": " : "",
cmd->disable_reason ?: "");
goto out;
}
if (oob && !(cmd->options & QCO_ALLOW_OOB)) {
error_setg(&err, "The command %s does not support OOB",
command);
goto out;
}
if (!qmp_command_available(cmd, &err)) {
goto out;
}
if (!qdict_haskey(dict, "arguments")) {
args = qdict_new();
} else {
args = qdict_get_qdict(dict, "arguments");
qobject_ref(args);
}
assert(!(oob && qemu_in_coroutine()));
assert(monitor_cur() == NULL);
if (!!(cmd->options & QCO_COROUTINE) == qemu_in_coroutine()) {
monitor_set_cur(qemu_coroutine_self(), cur_mon);
cmd->fn(args, &ret, &err);
monitor_set_cur(qemu_coroutine_self(), NULL);
} else {
/*
* Actual context doesn't match the one the command needs.
*
* Case 1: we are in coroutine context, but command does not
* have QCO_COROUTINE. We need to drop out of coroutine
* context for executing it.
*
* Case 2: we are outside coroutine context, but command has
* QCO_COROUTINE. Can't actually happen, because we get here
* outside coroutine context only when executing a command
* out of band, and OOB commands never have QCO_COROUTINE.
*/
assert(!oob && qemu_in_coroutine() && !(cmd->options & QCO_COROUTINE));
QmpDispatchBH data = {
.cur_mon = cur_mon,
.cmd = cmd,
.args = args,
.ret = &ret,
.errp = &err,
.co = qemu_coroutine_self(),
};
aio_bh_schedule_oneshot(qemu_get_aio_context(), do_qmp_dispatch_bh,
&data);
qemu_coroutine_yield();
}
qobject_unref(args);
if (err) {
/* or assert(!ret) after reviewing all handlers: */
qobject_unref(ret);
goto out;
}
if (cmd->options & QCO_NO_SUCCESS_RESP) {
g_assert(!ret);
return NULL;
} else if (!ret) {
/*
* When the command's schema has no 'returns', cmd->fn()
* leaves @ret null. The QMP spec calls for an empty object
* then; supply it.
*/
ret = QOBJECT(qdict_new());
}
rsp = qdict_new();
qdict_put_obj(rsp, "return", ret);
out:
if (err) {
assert(!rsp);
rsp = qmp_error_response(err);
}
assert(rsp);
if (id) {
qdict_put_obj(rsp, "id", qobject_ref(id));
}
return rsp;
}