qga/main.c

   1 /*
   2  * QEMU Guest Agent
   3  *
   4  * Copyright IBM Corp. 2011
   5  *
   6  * Authors:
   7  *  Adam Litke        <aglitke@linux.vnet.ibm.com>
   8  *  Michael Roth      <mdroth@linux.vnet.ibm.com>
   9  *
  10  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  11  * See the COPYING file in the top-level directory.
  12  */
  13 #include <stdlib.h>
  14 #include <stdio.h>
  15 #include <stdbool.h>
  16 #include <glib.h>
  17 #include <getopt.h>
  18 #include <glib/gstdio.h>
  19 #ifndef _WIN32
  20 #include <syslog.h>
  21 #include <sys/wait.h>
  22 #include <sys/stat.h>
  23 #endif
  24 #include "qapi/qmp/json-streamer.h"
  25 #include "qapi/qmp/json-parser.h"
  26 #include "qapi/qmp/qint.h"
  27 #include "qapi/qmp/qjson.h"
  28 #include "qga/guest-agent-core.h"
  29 #include "qemu/module.h"
  30 #include "signal.h"
  31 #include "qapi/qmp/qerror.h"
  32 #include "qapi/qmp/dispatch.h"
  33 #include "qga/channel.h"
  34 #include "qemu/bswap.h"
  35 #ifdef _WIN32
  36 #include "qga/service-win32.h"
  37 #include <windows.h>
  38 #endif
  39 #ifdef __linux__
  40 #include <linux/fs.h>
  41 #ifdef FIFREEZE
  42 #define CONFIG_FSFREEZE
  43 #endif
  44 #endif
  45
  46 #ifndef _WIN32
  47 #define QGA_VIRTIO_PATH_DEFAULT "/dev/virtio-ports/org.qemu.guest_agent.0"
  48 #define QGA_STATE_RELATIVE_DIR  "run"
  49 #else
  50 #define QGA_VIRTIO_PATH_DEFAULT "\\\\.\\Global\\org.qemu.guest_agent.0"
  51 #define QGA_STATE_RELATIVE_DIR  "qemu-ga"
  52 #endif
  53 #ifdef CONFIG_FSFREEZE
  54 #define QGA_FSFREEZE_HOOK_DEFAULT CONFIG_QEMU_CONFDIR "/fsfreeze-hook"
  55 #endif
  56 #define QGA_SENTINEL_BYTE 0xFF
  57
  58 static struct {
  59     const char *state_dir;
  60     const char *pidfile;
  61 } dfl_pathnames;
  62
  63 typedef struct GAPersistentState {
  64 #define QGA_PSTATE_DEFAULT_FD_COUNTER 1000
  65     int64_t fd_counter;
  66 } GAPersistentState;
  67
  68 struct GAState {
  69     JSONMessageParser parser;
  70     GMainLoop *main_loop;
  71     GAChannel *channel;
  72     bool virtio; /* fastpath to check for virtio to deal with poll() quirks */
  73     GACommandState *command_state;
  74     GLogLevelFlags log_level;
  75     FILE *log_file;
  76     bool logging_enabled;
  77 #ifdef _WIN32
  78     GAService service;
  79 #endif
  80     bool delimit_response;
  81     bool frozen;
  82     GList *blacklist;
  83     const char *state_filepath_isfrozen;
  84     struct {
  85         const char *log_filepath;
  86         const char *pid_filepath;
  87     } deferred_options;
  88 #ifdef CONFIG_FSFREEZE
  89     const char *fsfreeze_hook;
  90 #endif
  91     const gchar *pstate_filepath;
  92     GAPersistentState pstate;
  93 };
  94
  95 struct GAState *ga_state;
  96
  97 /* commands that are safe to issue while filesystems are frozen */
  98 static const char *ga_freeze_whitelist[] = {
  99     "guest-ping",
 100     "guest-info",
 101     "guest-sync",
 102     "guest-sync-delimited",
 103     "guest-fsfreeze-status",
 104     "guest-fsfreeze-thaw",
 105     NULL
 106 };
 107
 108 #ifdef _WIN32
 109 DWORD WINAPI service_ctrl_handler(DWORD ctrl, DWORD type, LPVOID data,
 110                                   LPVOID ctx);
 111 VOID WINAPI service_main(DWORD argc, TCHAR *argv[]);
 112 #endif
 113
 114 static void
 115 init_dfl_pathnames(void)
 116 {
 117     g_assert(dfl_pathnames.state_dir == NULL);
 118     g_assert(dfl_pathnames.pidfile == NULL);
 119     dfl_pathnames.state_dir = qemu_get_local_state_pathname(
 120       QGA_STATE_RELATIVE_DIR);
 121     dfl_pathnames.pidfile   = qemu_get_local_state_pathname(
 122       QGA_STATE_RELATIVE_DIR G_DIR_SEPARATOR_S "qemu-ga.pid");
 123 }
 124
 125 static void quit_handler(int sig)
 126 {
 127     /* if we're frozen, don't exit unless we're absolutely forced to,
 128      * because it's basically impossible for graceful exit to complete
 129      * unless all log/pid files are on unfreezable filesystems. there's
 130      * also a very likely chance killing the agent before unfreezing
 131      * the filesystems is a mistake (or will be viewed as one later).
 132      */
 133     if (ga_is_frozen(ga_state)) {
 134         return;
 135     }
 136     g_debug("received signal num %d, quitting", sig);
 137
 138     if (g_main_loop_is_running(ga_state->main_loop)) {
 139         g_main_loop_quit(ga_state->main_loop);
 140     }
 141 }
 142
 143 #ifndef _WIN32
 144 static gboolean register_signal_handlers(void)
 145 {
 146     struct sigaction sigact;
 147     int ret;
 148
 149     memset(&sigact, 0, sizeof(struct sigaction));
 150     sigact.sa_handler = quit_handler;
 151
 152     ret = sigaction(SIGINT, &sigact, NULL);
 153     if (ret == -1) {
 154         g_error("error configuring signal handler: %s", strerror(errno));
 155     }
 156     ret = sigaction(SIGTERM, &sigact, NULL);
 157     if (ret == -1) {
 158         g_error("error configuring signal handler: %s", strerror(errno));
 159     }
 160
 161     return true;
 162 }
 163
 164 /* TODO: use this in place of all post-fork() fclose(std*) callers */
 165 void reopen_fd_to_null(int fd)
 166 {
 167     int nullfd;
 168
 169     nullfd = open("/dev/null", O_RDWR);
 170     if (nullfd < 0) {
 171         return;
 172     }
 173
 174     dup2(nullfd, fd);
 175
 176     if (nullfd != fd) {
 177         close(nullfd);
 178     }
 179 }
 180 #endif
 181
 182 static void usage(const char *cmd)
 183 {
 184     printf(
 185 "Usage: %s [-m <method> -p <path>] [<options>]\n"
 186 "QEMU Guest Agent %s\n"
 187 "\n"
 188 "  -m, --method      transport method: one of unix-listen, virtio-serial, or\n"
 189 "                    isa-serial (virtio-serial is the default)\n"
 190 "  -p, --path        device/socket path (the default for virtio-serial is:\n"
 191 "                    %s)\n"
 192 "  -l, --logfile     set logfile path, logs to stderr by default\n"
 193 "  -f, --pidfile     specify pidfile (default is %s)\n"
 194 #ifdef CONFIG_FSFREEZE
 195 "  -F, --fsfreeze-hook\n"
 196 "                    enable fsfreeze hook. Accepts an optional argument that\n"
 197 "                    specifies script to run on freeze/thaw. Script will be\n"
 198 "                    called with 'freeze'/'thaw' arguments accordingly.\n"
 199 "                    (default is %s)\n"
 200 "                    If using -F with an argument, do not follow -F with a\n"
 201 "                    space.\n"
 202 "                    (for example: -F/var/run/fsfreezehook.sh)\n"
 203 #endif
 204 "  -t, --statedir    specify dir to store state information (absolute paths\n"
 205 "                    only, default is %s)\n"
 206 "  -v, --verbose     log extra debugging information\n"
 207 "  -V, --version     print version information and exit\n"
 208 "  -d, --daemonize   become a daemon\n"
 209 #ifdef _WIN32
 210 "  -s, --service     service commands: install, uninstall\n"
 211 #endif
 212 "  -b, --blacklist   comma-separated list of RPCs to disable (no spaces, \"?\"\n"
 213 "                    to list available RPCs)\n"
 214 "  -h, --help        display this help and exit\n"
 215 "\n"
 216 "Report bugs to <mdroth@linux.vnet.ibm.com>\n"
 217     , cmd, QEMU_VERSION, QGA_VIRTIO_PATH_DEFAULT, dfl_pathnames.pidfile,
 218 #ifdef CONFIG_FSFREEZE
 219     QGA_FSFREEZE_HOOK_DEFAULT,
 220 #endif
 221     dfl_pathnames.state_dir);
 222 }
 223
 224 static const char *ga_log_level_str(GLogLevelFlags level)
 225 {
 226     switch (level & G_LOG_LEVEL_MASK) {
 227         case G_LOG_LEVEL_ERROR:
 228             return "error";
 229         case G_LOG_LEVEL_CRITICAL:
 230             return "critical";
 231         case G_LOG_LEVEL_WARNING:
 232             return "warning";
 233         case G_LOG_LEVEL_MESSAGE:
 234             return "message";
 235         case G_LOG_LEVEL_INFO:
 236             return "info";
 237         case G_LOG_LEVEL_DEBUG:
 238             return "debug";
 239         default:
 240             return "user";
 241     }
 242 }
 243
 244 bool ga_logging_enabled(GAState *s)
 245 {
 246     return s->logging_enabled;
 247 }
 248
 249 void ga_disable_logging(GAState *s)
 250 {
 251     s->logging_enabled = false;
 252 }
 253
 254 void ga_enable_logging(GAState *s)
 255 {
 256     s->logging_enabled = true;
 257 }
 258
 259 static void ga_log(const gchar *domain, GLogLevelFlags level,
 260                    const gchar *msg, gpointer opaque)
 261 {
 262     GAState *s = opaque;
 263     GTimeVal time;
 264     const char *level_str = ga_log_level_str(level);
 265
 266     if (!ga_logging_enabled(s)) {
 267         return;
 268     }
 269
 270     level &= G_LOG_LEVEL_MASK;
 271 #ifndef _WIN32
 272     if (domain && strcmp(domain, "syslog") == 0) {
 273         syslog(LOG_INFO, "%s: %s", level_str, msg);
 274     } else if (level & s->log_level) {
 275 #else
 276     if (level & s->log_level) {
 277 #endif
 278         g_get_current_time(&time);
 279         fprintf(s->log_file,
 280                 "%lu.%lu: %s: %s\n", time.tv_sec, time.tv_usec, level_str, msg);
 281         fflush(s->log_file);
 282     }
 283 }
 284
 285 void ga_set_response_delimited(GAState *s)
 286 {
 287     s->delimit_response = true;
 288 }
 289
 290 static FILE *ga_open_logfile(const char *logfile)
 291 {
 292     FILE *f;
 293
 294     f = fopen(logfile, "a");
 295     if (!f) {
 296         return NULL;
 297     }
 298
 299     qemu_set_cloexec(fileno(f));
 300     return f;
 301 }
 302
 303 #ifndef _WIN32
 304 static bool ga_open_pidfile(const char *pidfile)
 305 {
 306     int pidfd;
 307     char pidstr[32];
 308
 309     pidfd = qemu_open(pidfile, O_CREAT|O_WRONLY, S_IRUSR|S_IWUSR);
 310     if (pidfd == -1 || lockf(pidfd, F_TLOCK, 0)) {
 311         g_critical("Cannot lock pid file, %s", strerror(errno));
 312         if (pidfd != -1) {
 313             close(pidfd);
 314         }
 315         return false;
 316     }
 317
 318     if (ftruncate(pidfd, 0)) {
 319         g_critical("Failed to truncate pid file");
 320         goto fail;
 321     }
 322     snprintf(pidstr, sizeof(pidstr), "%d\n", getpid());
 323     if (write(pidfd, pidstr, strlen(pidstr)) != strlen(pidstr)) {
 324         g_critical("Failed to write pid file");
 325         goto fail;
 326     }
 327
 328     /* keep pidfile open & locked forever */
 329     return true;
 330
 331 fail:
 332     unlink(pidfile);
 333     close(pidfd);
 334     return false;
 335 }
 336 #else /* _WIN32 */
 337 static bool ga_open_pidfile(const char *pidfile)
 338 {
 339     return true;
 340 }
 341 #endif
 342
 343 static gint ga_strcmp(gconstpointer str1, gconstpointer str2)
 344 {
 345     return strcmp(str1, str2);
 346 }
 347
 348 /* disable commands that aren't safe for fsfreeze */
 349 static void ga_disable_non_whitelisted(void)
 350 {
 351     char **list_head, **list;
 352     bool whitelisted;
 353     int i;
 354
 355     list_head = list = qmp_get_command_list();
 356     while (*list != NULL) {
 357         whitelisted = false;
 358         i = 0;
 359         while (ga_freeze_whitelist[i] != NULL) {
 360             if (strcmp(*list, ga_freeze_whitelist[i]) == 0) {
 361                 whitelisted = true;
 362             }
 363             i++;
 364         }
 365         if (!whitelisted) {
 366             g_debug("disabling command: %s", *list);
 367             qmp_disable_command(*list);
 368         }
 369         g_free(*list);
 370         list++;
 371     }
 372     g_free(list_head);
 373 }
 374
 375 /* [re-]enable all commands, except those explicitly blacklisted by user */
 376 static void ga_enable_non_blacklisted(GList *blacklist)
 377 {
 378     char **list_head, **list;
 379
 380     list_head = list = qmp_get_command_list();
 381     while (*list != NULL) {
 382         if (g_list_find_custom(blacklist, *list, ga_strcmp) == NULL &&
 383             !qmp_command_is_enabled(*list)) {
 384             g_debug("enabling command: %s", *list);
 385             qmp_enable_command(*list);
 386         }
 387         g_free(*list);
 388         list++;
 389     }
 390     g_free(list_head);
 391 }
 392
 393 static bool ga_create_file(const char *path)
 394 {
 395     int fd = open(path, O_CREAT | O_WRONLY, S_IWUSR | S_IRUSR);
 396     if (fd == -1) {
 397         g_warning("unable to open/create file %s: %s", path, strerror(errno));
 398         return false;
 399     }
 400     close(fd);
 401     return true;
 402 }
 403
 404 static bool ga_delete_file(const char *path)
 405 {
 406     int ret = unlink(path);
 407     if (ret == -1) {
 408         g_warning("unable to delete file: %s: %s", path, strerror(errno));
 409         return false;
 410     }
 411
 412     return true;
 413 }
 414
 415 bool ga_is_frozen(GAState *s)
 416 {
 417     return s->frozen;
 418 }
 419
 420 void ga_set_frozen(GAState *s)
 421 {
 422     if (ga_is_frozen(s)) {
 423         return;
 424     }
 425     /* disable all non-whitelisted (for frozen state) commands */
 426     ga_disable_non_whitelisted();
 427     g_warning("disabling logging due to filesystem freeze");
 428     ga_disable_logging(s);
 429     s->frozen = true;
 430     if (!ga_create_file(s->state_filepath_isfrozen)) {
 431         g_warning("unable to create %s, fsfreeze may not function properly",
 432                   s->state_filepath_isfrozen);
 433     }
 434 }
 435
 436 void ga_unset_frozen(GAState *s)
 437 {
 438     if (!ga_is_frozen(s)) {
 439         return;
 440     }
 441
 442     /* if we delayed creation/opening of pid/log files due to being
 443      * in a frozen state at start up, do it now
 444      */
 445     if (s->deferred_options.log_filepath) {
 446         s->log_file = ga_open_logfile(s->deferred_options.log_filepath);
 447         if (!s->log_file) {
 448             s->log_file = stderr;
 449         }
 450         s->deferred_options.log_filepath = NULL;
 451     }
 452     ga_enable_logging(s);
 453     g_warning("logging re-enabled due to filesystem unfreeze");
 454     if (s->deferred_options.pid_filepath) {
 455         if (!ga_open_pidfile(s->deferred_options.pid_filepath)) {
 456             g_warning("failed to create/open pid file");
 457         }
 458         s->deferred_options.pid_filepath = NULL;
 459     }
 460
 461     /* enable all disabled, non-blacklisted commands */
 462     ga_enable_non_blacklisted(s->blacklist);
 463     s->frozen = false;
 464     if (!ga_delete_file(s->state_filepath_isfrozen)) {
 465         g_warning("unable to delete %s, fsfreeze may not function properly",
 466                   s->state_filepath_isfrozen);
 467     }
 468 }
 469
 470 #ifdef CONFIG_FSFREEZE
 471 const char *ga_fsfreeze_hook(GAState *s)
 472 {
 473     return s->fsfreeze_hook;
 474 }
 475 #endif
 476
 477 static void become_daemon(const char *pidfile)
 478 {
 479 #ifndef _WIN32
 480     pid_t pid, sid;
 481
 482     pid = fork();
 483     if (pid < 0) {
 484         exit(EXIT_FAILURE);
 485     }
 486     if (pid > 0) {
 487         exit(EXIT_SUCCESS);
 488     }
 489
 490     if (pidfile) {
 491         if (!ga_open_pidfile(pidfile)) {
 492             g_critical("failed to create pidfile");
 493             exit(EXIT_FAILURE);
 494         }
 495     }
 496
 497     umask(S_IRWXG | S_IRWXO);
 498     sid = setsid();
 499     if (sid < 0) {
 500         goto fail;
 501     }
 502     if ((chdir("/")) < 0) {
 503         goto fail;
 504     }
 505
 506     reopen_fd_to_null(STDIN_FILENO);
 507     reopen_fd_to_null(STDOUT_FILENO);
 508     reopen_fd_to_null(STDERR_FILENO);
 509     return;
 510
 511 fail:
 512     if (pidfile) {
 513         unlink(pidfile);
 514     }
 515     g_critical("failed to daemonize");
 516     exit(EXIT_FAILURE);
 517 #endif
 518 }
 519
 520 static int send_response(GAState *s, QObject *payload)
 521 {
 522     const char *buf;
 523     QString *payload_qstr, *response_qstr;
 524     GIOStatus status;
 525
 526     g_assert(payload && s->channel);
 527
 528     payload_qstr = qobject_to_json(payload);
 529     if (!payload_qstr) {
 530         return -EINVAL;
 531     }
 532
 533     if (s->delimit_response) {
 534         s->delimit_response = false;
 535         response_qstr = qstring_new();
 536         qstring_append_chr(response_qstr, QGA_SENTINEL_BYTE);
 537         qstring_append(response_qstr, qstring_get_str(payload_qstr));
 538         QDECREF(payload_qstr);
 539     } else {
 540         response_qstr = payload_qstr;
 541     }
 542
 543     qstring_append_chr(response_qstr, '\n');
 544     buf = qstring_get_str(response_qstr);
 545     status = ga_channel_write_all(s->channel, buf, strlen(buf));
 546     QDECREF(response_qstr);
 547     if (status != G_IO_STATUS_NORMAL) {
 548         return -EIO;
 549     }
 550
 551     return 0;
 552 }
 553
 554 static void process_command(GAState *s, QDict *req)
 555 {
 556     QObject *rsp = NULL;
 557     int ret;
 558
 559     g_assert(req);
 560     g_debug("processing command");
 561     rsp = qmp_dispatch(QOBJECT(req));
 562     if (rsp) {
 563         ret = send_response(s, rsp);
 564         if (ret) {
 565             g_warning("error sending response: %s", strerror(ret));
 566         }
 567         qobject_decref(rsp);
 568     }
 569 }
 570
 571 /* handle requests/control events coming in over the channel */
 572 static void process_event(JSONMessageParser *parser, QList *tokens)
 573 {
 574     GAState *s = container_of(parser, GAState, parser);
 575     QObject *obj;
 576     QDict *qdict;
 577     Error *err = NULL;
 578     int ret;
 579
 580     g_assert(s && parser);
 581
 582     g_debug("process_event: called");
 583     obj = json_parser_parse_err(tokens, NULL, &err);
 584     if (err || !obj || qobject_type(obj) != QTYPE_QDICT) {
 585         qobject_decref(obj);
 586         qdict = qdict_new();
 587         if (!err) {
 588             g_warning("failed to parse event: unknown error");
 589             error_set(&err, QERR_JSON_PARSING);
 590         } else {
 591             g_warning("failed to parse event: %s", error_get_pretty(err));
 592         }
 593         qdict_put_obj(qdict, "error", qmp_build_error_object(err));
 594         error_free(err);
 595     } else {
 596         qdict = qobject_to_qdict(obj);
 597     }
 598
 599     g_assert(qdict);
 600
 601     /* handle host->guest commands */
 602     if (qdict_haskey(qdict, "execute")) {
 603         process_command(s, qdict);
 604     } else {
 605         if (!qdict_haskey(qdict, "error")) {
 606             QDECREF(qdict);
 607             qdict = qdict_new();
 608             g_warning("unrecognized payload format");
 609             error_set(&err, QERR_UNSUPPORTED);
 610             qdict_put_obj(qdict, "error", qmp_build_error_object(err));
 611             error_free(err);
 612         }
 613         ret = send_response(s, QOBJECT(qdict));
 614         if (ret) {
 615             g_warning("error sending error response: %s", strerror(ret));
 616         }
 617     }
 618
 619     QDECREF(qdict);
 620 }
 621
 622 /* false return signals GAChannel to close the current client connection */
 623 static gboolean channel_event_cb(GIOCondition condition, gpointer data)
 624 {
 625     GAState *s = data;
 626     gchar buf[QGA_READ_COUNT_DEFAULT+1];
 627     gsize count;
 628     GError *err = NULL;
 629     GIOStatus status = ga_channel_read(s->channel, buf, QGA_READ_COUNT_DEFAULT, &count);
 630     if (err != NULL) {
 631         g_warning("error reading channel: %s", err->message);
 632         g_error_free(err);
 633         return false;
 634     }
 635     switch (status) {
 636     case G_IO_STATUS_ERROR:
 637         g_warning("error reading channel");
 638         return false;
 639     case G_IO_STATUS_NORMAL:
 640         buf[count] = 0;
 641         g_debug("read data, count: %d, data: %s", (int)count, buf);
 642         json_message_parser_feed(&s->parser, (char *)buf, (int)count);
 643         break;
 644     case G_IO_STATUS_EOF:
 645         g_debug("received EOF");
 646         if (!s->virtio) {
 647             return false;
 648         }
 649         /* fall through */
 650     case G_IO_STATUS_AGAIN:
 651         /* virtio causes us to spin here when no process is attached to
 652          * host-side chardev. sleep a bit to mitigate this
 653          */
 654         if (s->virtio) {
 655             usleep(100*1000);
 656         }
 657         return true;
 658     default:
 659         g_warning("unknown channel read status, closing");
 660         return false;
 661     }
 662     return true;
 663 }
 664
 665 static gboolean channel_init(GAState *s, const gchar *method, const gchar *path)
 666 {
 667     GAChannelMethod channel_method;
 668
 669     if (method == NULL) {
 670         method = "virtio-serial";
 671     }
 672
 673     if (path == NULL) {
 674         if (strcmp(method, "virtio-serial") != 0) {
 675             g_critical("must specify a path for this channel");
 676             return false;
 677         }
 678         /* try the default path for the virtio-serial port */
 679         path = QGA_VIRTIO_PATH_DEFAULT;
 680     }
 681
 682     if (strcmp(method, "virtio-serial") == 0) {
 683         s->virtio = true; /* virtio requires special handling in some cases */
 684         channel_method = GA_CHANNEL_VIRTIO_SERIAL;
 685     } else if (strcmp(method, "isa-serial") == 0) {
 686         channel_method = GA_CHANNEL_ISA_SERIAL;
 687     } else if (strcmp(method, "unix-listen") == 0) {
 688         channel_method = GA_CHANNEL_UNIX_LISTEN;
 689     } else {
 690         g_critical("unsupported channel method/type: %s", method);
 691         return false;
 692     }
 693
 694     s->channel = ga_channel_new(channel_method, path, channel_event_cb, s);
 695     if (!s->channel) {
 696         g_critical("failed to create guest agent channel");
 697         return false;
 698     }
 699
 700     return true;
 701 }
 702
 703 #ifdef _WIN32
 704 DWORD WINAPI service_ctrl_handler(DWORD ctrl, DWORD type, LPVOID data,
 705                                   LPVOID ctx)
 706 {
 707     DWORD ret = NO_ERROR;
 708     GAService *service = &ga_state->service;
 709
 710     switch (ctrl)
 711     {
 712         case SERVICE_CONTROL_STOP:
 713         case SERVICE_CONTROL_SHUTDOWN:
 714             quit_handler(SIGTERM);
 715             service->status.dwCurrentState = SERVICE_STOP_PENDING;
 716             SetServiceStatus(service->status_handle, &service->status);
 717             break;
 718
 719         default:
 720             ret = ERROR_CALL_NOT_IMPLEMENTED;
 721     }
 722     return ret;
 723 }
 724
 725 VOID WINAPI service_main(DWORD argc, TCHAR *argv[])
 726 {
 727     GAService *service = &ga_state->service;
 728
 729     service->status_handle = RegisterServiceCtrlHandlerEx(QGA_SERVICE_NAME,
 730         service_ctrl_handler, NULL);
 731
 732     if (service->status_handle == 0) {
 733         g_critical("Failed to register extended requests function!\n");
 734         return;
 735     }
 736
 737     service->status.dwServiceType = SERVICE_WIN32;
 738     service->status.dwCurrentState = SERVICE_RUNNING;
 739     service->status.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN;
 740     service->status.dwWin32ExitCode = NO_ERROR;
 741     service->status.dwServiceSpecificExitCode = NO_ERROR;
 742     service->status.dwCheckPoint = 0;
 743     service->status.dwWaitHint = 0;
 744     SetServiceStatus(service->status_handle, &service->status);
 745
 746     g_main_loop_run(ga_state->main_loop);
 747
 748     service->status.dwCurrentState = SERVICE_STOPPED;
 749     SetServiceStatus(service->status_handle, &service->status);
 750 }
 751 #endif
 752
 753 static void set_persistent_state_defaults(GAPersistentState *pstate)
 754 {
 755     g_assert(pstate);
 756     pstate->fd_counter = QGA_PSTATE_DEFAULT_FD_COUNTER;
 757 }
 758
 759 static void persistent_state_from_keyfile(GAPersistentState *pstate,
 760                                           GKeyFile *keyfile)
 761 {
 762     g_assert(pstate);
 763     g_assert(keyfile);
 764     /* if any fields are missing, either because the file was tampered with
 765      * by agents of chaos, or because the field wasn't present at the time the
 766      * file was created, the best we can ever do is start over with the default
 767      * values. so load them now, and ignore any errors in accessing key-value
 768      * pairs
 769      */
 770     set_persistent_state_defaults(pstate);
 771
 772     if (g_key_file_has_key(keyfile, "global", "fd_counter", NULL)) {
 773         pstate->fd_counter =
 774             g_key_file_get_integer(keyfile, "global", "fd_counter", NULL);
 775     }
 776 }
 777
 778 static void persistent_state_to_keyfile(const GAPersistentState *pstate,
 779                                         GKeyFile *keyfile)
 780 {
 781     g_assert(pstate);
 782     g_assert(keyfile);
 783
 784     g_key_file_set_integer(keyfile, "global", "fd_counter", pstate->fd_counter);
 785 }
 786
 787 static gboolean write_persistent_state(const GAPersistentState *pstate,
 788                                        const gchar *path)
 789 {
 790     GKeyFile *keyfile = g_key_file_new();
 791     GError *gerr = NULL;
 792     gboolean ret = true;
 793     gchar *data = NULL;
 794     gsize data_len;
 795
 796     g_assert(pstate);
 797
 798     persistent_state_to_keyfile(pstate, keyfile);
 799     data = g_key_file_to_data(keyfile, &data_len, &gerr);
 800     if (gerr) {
 801         g_critical("failed to convert persistent state to string: %s",
 802                    gerr->message);
 803         ret = false;
 804         goto out;
 805     }
 806
 807     g_file_set_contents(path, data, data_len, &gerr);
 808     if (gerr) {
 809         g_critical("failed to write persistent state to %s: %s",
 810                     path, gerr->message);
 811         ret = false;
 812         goto out;
 813     }
 814
 815 out:
 816     if (gerr) {
 817         g_error_free(gerr);
 818     }
 819     if (keyfile) {
 820         g_key_file_free(keyfile);
 821     }
 822     g_free(data);
 823     return ret;
 824 }
 825
 826 static gboolean read_persistent_state(GAPersistentState *pstate,
 827                                       const gchar *path, gboolean frozen)
 828 {
 829     GKeyFile *keyfile = NULL;
 830     GError *gerr = NULL;
 831     struct stat st;
 832     gboolean ret = true;
 833
 834     g_assert(pstate);
 835
 836     if (stat(path, &st) == -1) {
 837         /* it's okay if state file doesn't exist, but any other error
 838          * indicates a permissions issue or some other misconfiguration
 839          * that we likely won't be able to recover from.
 840          */
 841         if (errno != ENOENT) {
 842             g_critical("unable to access state file at path %s: %s",
 843                        path, strerror(errno));
 844             ret = false;
 845             goto out;
 846         }
 847
 848         /* file doesn't exist. initialize state to default values and
 849          * attempt to save now. (we could wait till later when we have
 850          * modified state we need to commit, but if there's a problem,
 851          * such as a missing parent directory, we want to catch it now)
 852          *
 853          * there is a potential scenario where someone either managed to
 854          * update the agent from a version that didn't use a key store
 855          * while qemu-ga thought the filesystem was frozen, or
 856          * deleted the key store prior to issuing a fsfreeze, prior
 857          * to restarting the agent. in this case we go ahead and defer
 858          * initial creation till we actually have modified state to
 859          * write, otherwise fail to recover from freeze.
 860          */
 861         set_persistent_state_defaults(pstate);
 862         if (!frozen) {
 863             ret = write_persistent_state(pstate, path);
 864             if (!ret) {
 865                 g_critical("unable to create state file at path %s", path);
 866                 ret = false;
 867                 goto out;
 868             }
 869         }
 870         ret = true;
 871         goto out;
 872     }
 873
 874     keyfile = g_key_file_new();
 875     g_key_file_load_from_file(keyfile, path, 0, &gerr);
 876     if (gerr) {
 877         g_critical("error loading persistent state from path: %s, %s",
 878                    path, gerr->message);
 879         ret = false;
 880         goto out;
 881     }
 882
 883     persistent_state_from_keyfile(pstate, keyfile);
 884
 885 out:
 886     if (keyfile) {
 887         g_key_file_free(keyfile);
 888     }
 889     if (gerr) {
 890         g_error_free(gerr);
 891     }
 892
 893     return ret;
 894 }
 895
 896 int64_t ga_get_fd_handle(GAState *s, Error **errp)
 897 {
 898     int64_t handle;
 899
 900     g_assert(s->pstate_filepath);
 901     /* we blacklist commands and avoid operations that potentially require
 902      * writing to disk when we're in a frozen state. this includes opening
 903      * new files, so we should never get here in that situation
 904      */
 905     g_assert(!ga_is_frozen(s));
 906
 907     handle = s->pstate.fd_counter++;
 908
 909     /* This should never happen on a reasonable timeframe, as guest-file-open
 910      * would have to be issued 2^63 times */
 911     if (s->pstate.fd_counter == INT64_MAX) {
 912         abort();
 913     }
 914
 915     if (!write_persistent_state(&s->pstate, s->pstate_filepath)) {
 916         error_setg(errp, "failed to commit persistent state to disk");
 917     }
 918
 919     return handle;
 920 }
 921
 922 int main(int argc, char **argv)
 923 {
 924     const char *sopt = "hVvdm:p:l:f:F::b:s:t:";
 925     const char *method = NULL, *path = NULL;
 926     const char *log_filepath = NULL;
 927     const char *pid_filepath;
 928 #ifdef CONFIG_FSFREEZE
 929     const char *fsfreeze_hook = NULL;
 930 #endif
 931     const char *state_dir;
 932 #ifdef _WIN32
 933     const char *service = NULL;
 934 #endif
 935     const struct option lopt[] = {
 936         { "help", 0, NULL, 'h' },
 937         { "version", 0, NULL, 'V' },
 938         { "logfile", 1, NULL, 'l' },
 939         { "pidfile", 1, NULL, 'f' },
 940 #ifdef CONFIG_FSFREEZE
 941         { "fsfreeze-hook", 2, NULL, 'F' },
 942 #endif
 943         { "verbose", 0, NULL, 'v' },
 944         { "method", 1, NULL, 'm' },
 945         { "path", 1, NULL, 'p' },
 946         { "daemonize", 0, NULL, 'd' },
 947         { "blacklist", 1, NULL, 'b' },
 948 #ifdef _WIN32
 949         { "service", 1, NULL, 's' },
 950 #endif
 951         { "statedir", 1, NULL, 't' },
 952         { NULL, 0, NULL, 0 }
 953     };
 954     int opt_ind = 0, ch, daemonize = 0, i, j, len;
 955     GLogLevelFlags log_level = G_LOG_LEVEL_ERROR | G_LOG_LEVEL_CRITICAL;
 956     GList *blacklist = NULL;
 957     GAState *s;
 958
 959     module_call_init(MODULE_INIT_QAPI);
 960
 961     init_dfl_pathnames();
 962     pid_filepath = dfl_pathnames.pidfile;
 963     state_dir = dfl_pathnames.state_dir;
 964
 965     while ((ch = getopt_long(argc, argv, sopt, lopt, &opt_ind)) != -1) {
 966         switch (ch) {
 967         case 'm':
 968             method = optarg;
 969             break;
 970         case 'p':
 971             path = optarg;
 972             break;
 973         case 'l':
 974             log_filepath = optarg;
 975             break;
 976         case 'f':
 977             pid_filepath = optarg;
 978             break;
 979 #ifdef CONFIG_FSFREEZE
 980         case 'F':
 981             fsfreeze_hook = optarg ? optarg : QGA_FSFREEZE_HOOK_DEFAULT;
 982             break;
 983 #endif
 984         case 't':
 985              state_dir = optarg;
 986              break;
 987         case 'v':
 988             /* enable all log levels */
 989             log_level = G_LOG_LEVEL_MASK;
 990             break;
 991         case 'V':
 992             printf("QEMU Guest Agent %s\n", QEMU_VERSION);
 993             return 0;
 994         case 'd':
 995             daemonize = 1;
 996             break;
 997         case 'b': {
 998             char **list_head, **list;
 999             if (is_help_option(optarg)) {
1000                 list_head = list = qmp_get_command_list();
1001                 while (*list != NULL) {
1002                     printf("%s\n", *list);
1003                     g_free(*list);
1004                     list++;
1005                 }
1006                 g_free(list_head);
1007                 return 0;
1008             }
1009             for (j = 0, i = 0, len = strlen(optarg); i < len; i++) {
1010                 if (optarg[i] == ',') {
1011                     optarg[i] = 0;
1012                     blacklist = g_list_append(blacklist, &optarg[j]);
1013                     j = i + 1;
1014                 }
1015             }
1016             if (j < i) {
1017                 blacklist = g_list_append(blacklist, &optarg[j]);
1018             }
1019             break;
1020         }
1021 #ifdef _WIN32
1022         case 's':
1023             service = optarg;
1024             if (strcmp(service, "install") == 0) {
1025                 const char *fixed_state_dir;
1026
1027                 /* If the user passed the "-t" option, we save that state dir
1028                  * in the service. Otherwise we let the service fetch the state
1029                  * dir from the environment when it starts.
1030                  */
1031                 fixed_state_dir = (state_dir == dfl_pathnames.state_dir) ?
1032                                   NULL :
1033                                   state_dir;
1034                 return ga_install_service(path, log_filepath, fixed_state_dir);
1035             } else if (strcmp(service, "uninstall") == 0) {
1036                 return ga_uninstall_service();
1037             } else {
1038                 printf("Unknown service command.\n");
1039                 return EXIT_FAILURE;
1040             }
1041             break;
1042 #endif
1043         case 'h':
1044             usage(argv[0]);
1045             return 0;
1046         case '?':
1047             g_print("Unknown option, try '%s --help' for more information.\n",
1048                     argv[0]);
1049             return EXIT_FAILURE;
1050         }
1051     }
1052
1053 #ifdef _WIN32
1054     /* On win32 the state directory is application specific (be it the default
1055      * or a user override). We got past the command line parsing; let's create
1056      * the directory (with any intermediate directories). If we run into an
1057      * error later on, we won't try to clean up the directory, it is considered
1058      * persistent.
1059      */
1060     if (g_mkdir_with_parents(state_dir, S_IRWXU) == -1) {
1061         g_critical("unable to create (an ancestor of) the state directory"
1062                    " '%s': %s", state_dir, strerror(errno));
1063         return EXIT_FAILURE;
1064     }
1065 #endif
1066
1067     s = g_malloc0(sizeof(GAState));
1068     s->log_level = log_level;
1069     s->log_file = stderr;
1070 #ifdef CONFIG_FSFREEZE
1071     s->fsfreeze_hook = fsfreeze_hook;
1072 #endif
1073     g_log_set_default_handler(ga_log, s);
1074     g_log_set_fatal_mask(NULL, G_LOG_LEVEL_ERROR);
1075     ga_enable_logging(s);
1076     s->state_filepath_isfrozen = g_strdup_printf("%s/qga.state.isfrozen",
1077                                                  state_dir);
1078     s->pstate_filepath = g_strdup_printf("%s/qga.state", state_dir);
1079     s->frozen = false;
1080
1081 #ifndef _WIN32
1082     /* check if a previous instance of qemu-ga exited with filesystems' state
1083      * marked as frozen. this could be a stale value (a non-qemu-ga process
1084      * or reboot may have since unfrozen them), but better to require an
1085      * uneeded unfreeze than to risk hanging on start-up
1086      */
1087     struct stat st;
1088     if (stat(s->state_filepath_isfrozen, &st) == -1) {
1089         /* it's okay if the file doesn't exist, but if we can't access for
1090          * some other reason, such as permissions, there's a configuration
1091          * that needs to be addressed. so just bail now before we get into
1092          * more trouble later
1093          */
1094         if (errno != ENOENT) {
1095             g_critical("unable to access state file at path %s: %s",
1096                        s->state_filepath_isfrozen, strerror(errno));
1097             return EXIT_FAILURE;
1098         }
1099     } else {
1100         g_warning("previous instance appears to have exited with frozen"
1101                   " filesystems. deferring logging/pidfile creation and"
1102                   " disabling non-fsfreeze-safe commands until"
1103                   " guest-fsfreeze-thaw is issued, or filesystems are"
1104                   " manually unfrozen and the file %s is removed",
1105                   s->state_filepath_isfrozen);
1106         s->frozen = true;
1107     }
1108 #endif
1109
1110     if (ga_is_frozen(s)) {
1111         if (daemonize) {
1112             /* delay opening/locking of pidfile till filesystem are unfrozen */
1113             s->deferred_options.pid_filepath = pid_filepath;
1114             become_daemon(NULL);
1115         }
1116         if (log_filepath) {
1117             /* delay opening the log file till filesystems are unfrozen */
1118             s->deferred_options.log_filepath = log_filepath;
1119         }
1120         ga_disable_logging(s);
1121         ga_disable_non_whitelisted();
1122     } else {
1123         if (daemonize) {
1124             become_daemon(pid_filepath);
1125         }
1126         if (log_filepath) {
1127             FILE *log_file = ga_open_logfile(log_filepath);
1128             if (!log_file) {
1129                 g_critical("unable to open specified log file: %s",
1130                            strerror(errno));
1131                 goto out_bad;
1132             }
1133             s->log_file = log_file;
1134         }
1135     }
1136
1137     /* load persistent state from disk */
1138     if (!read_persistent_state(&s->pstate,
1139                                s->pstate_filepath,
1140                                ga_is_frozen(s))) {
1141         g_critical("failed to load persistent state");
1142         goto out_bad;
1143     }
1144
1145     if (blacklist) {
1146         s->blacklist = blacklist;
1147         do {
1148             g_debug("disabling command: %s", (char *)blacklist->data);
1149             qmp_disable_command(blacklist->data);
1150             blacklist = g_list_next(blacklist);
1151         } while (blacklist);
1152     }
1153     s->command_state = ga_command_state_new();
1154     ga_command_state_init(s, s->command_state);
1155     ga_command_state_init_all(s->command_state);
1156     json_message_parser_init(&s->parser, process_event);
1157     ga_state = s;
1158 #ifndef _WIN32
1159     if (!register_signal_handlers()) {
1160         g_critical("failed to register signal handlers");
1161         goto out_bad;
1162     }
1163 #endif
1164
1165     s->main_loop = g_main_loop_new(NULL, false);
1166     if (!channel_init(ga_state, method, path)) {
1167         g_critical("failed to initialize guest agent channel");
1168         goto out_bad;
1169     }
1170 #ifndef _WIN32
1171     g_main_loop_run(ga_state->main_loop);
1172 #else
1173     if (daemonize) {
1174         SERVICE_TABLE_ENTRY service_table[] = {
1175             { (char *)QGA_SERVICE_NAME, service_main }, { NULL, NULL } };
1176         StartServiceCtrlDispatcher(service_table);
1177     } else {
1178         g_main_loop_run(ga_state->main_loop);
1179     }
1180 #endif
1181
1182     ga_command_state_cleanup_all(ga_state->command_state);
1183     ga_channel_free(ga_state->channel);
1184
1185     if (daemonize) {
1186         unlink(pid_filepath);
1187     }
1188     return 0;
1189
1190 out_bad:
1191     if (daemonize) {
1192         unlink(pid_filepath);
1193     }
1194     return EXIT_FAILURE;
1195 }