/usr/src/usr.sbin/vmd/vmd.c

Bug Summary

File:	src/usr.sbin/vmd/vmd.c
Warning:	line 1167, column 2 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name vmd.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/vmd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/vmd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/vmd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/vmd/vmd.c
1/*	$OpenBSD: vmd.c,v 1.129 2022/01/04 15:18:44 claudio Exp $	*/

3/*
* Copyright (c) 2015 Reyk Floeter <reyk@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19#include <sys/types.h>
20#include <sys/queue.h>
21#include <sys/wait.h>
22#include <sys/stat.h>
23#include <sys/sysctl.h>
24#include <sys/tty.h>
25#include <sys/ttycom.h>
26#include <sys/ioctl.h>

28#include <stdio.h>
29#include <stdlib.h>
30#include <string.h>
31#include <termios.h>
32#include <errno(*__errno()).h>
33#include <event.h>
34#include <fcntl.h>
35#include <pwd.h>
36#include <signal.h>
37#include <syslog.h>
38#include <unistd.h>
39#include <util.h>
40#include <ctype.h>
41#include <pwd.h>
42#include <grp.h>

44#include <machine/specialreg.h>
45#include <machine/vmmvar.h>

47#include "proc.h"
48#include "atomicio.h"
49#include "vmd.h"

51__dead__attribute__((__noreturn__)) void usage(void);

53int	 main(int, char **);
54int	 vmd_configure(void);
55void	 vmd_sighdlr(int sig, short event, void *arg);
56void	 vmd_shutdown(void);
57int	 vmd_control_run(void);
58int	 vmd_dispatch_control(int, struct privsep_proc *, struct imsg *);
59int	 vmd_dispatch_vmm(int, struct privsep_proc *, struct imsg *);
60int	 vmd_dispatch_priv(int, struct privsep_proc *, struct imsg *);
61int	 vmd_check_vmh(struct vm_dump_header *);

63int	 vm_instance(struct privsep *, struct vmd_vm **,
   struct vmop_create_params *, uid_t);
65int	 vm_checkinsflag(struct vmop_create_params *, unsigned int, uid_t);
66int	 vm_claimid(const char *, int, uint32_t *);
67void	 start_vm_batch(int, short, void*);

69struct vmd	*env;

71static struct privsep_proc procs[] = {
/* Keep "priv" on top as procs[0] */
{ "priv",	PROC_PRIV,	vmd_dispatch_priv, priv },
{ "control",	PROC_CONTROL,	vmd_dispatch_control, control },
{ "vmm",	PROC_VMM,	vmd_dispatch_vmm, vmm, vmm_shutdown },
76};

78enum privsep_procid privsep_process;

80struct event staggered_start_timer;

82/* For the privileged process */
83static struct privsep_proc *proc_priv = &procs[0];
84static struct passwd proc_privpw;
85static const uint8_t zero_mac[ETHER_ADDR_LEN6];

87int
88vmd_dispatch_control(int fd, struct privsep_proc *p, struct imsg *imsg)
89{
struct privsep			*ps = p->p_ps;
int				 res = 0, ret = 0, cmd = 0, verbose;
unsigned int			 v = 0, flags;
struct vmop_create_params	 vmc;
struct vmop_id			 vid;
struct vmop_result		 vmr;
struct vm_dump_header		 vmh;
struct vmd_vm			*vm = NULL((void *)0);
char				*str = NULL((void *)0);
uint32_t			 id = 0;
struct control_sock		*rcs;

switch (imsg->hdr.type) {
case IMSG_VMDOP_START_VM_REQUEST:
IMSG_SIZE_CHECK(imsg, &vmc)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmc)) fatalx("bad length imsg received (%s)", "&vmc"
); } while (0);
memcpy(&vmc, imsg->data, sizeof(vmc));
ret = vm_register(ps, &vmc, &vm, 0, vmc.vmc_owner.uid);
if (vmc.vmc_flags == 0) {
	/* start an existing VM with pre-configured options */
	if (!(ret == -1 && errno(*__errno()) == EALREADY37 &&
	    !(vm->vm_state & VM_STATE_RUNNING0x01))) {
		res = errno(*__errno());
		cmd = IMSG_VMDOP_START_VM_RESPONSE;
	}
} else if (ret != 0) {
	res = errno(*__errno());
	cmd = IMSG_VMDOP_START_VM_RESPONSE;
}
if (res == 0) {
	res = config_setvm(ps, vm, imsg->hdr.peerid,
	    vm->vm_params.vmc_owner.uid);
	if (res)
		cmd = IMSG_VMDOP_START_VM_RESPONSE;
}
break;
case IMSG_VMDOP_WAIT_VM_REQUEST:
case IMSG_VMDOP_TERMINATE_VM_REQUEST:
IMSG_SIZE_CHECK(imsg, &vid)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vid)) fatalx("bad length imsg received (%s)", "&vid"
); } while (0);
memcpy(&vid, imsg->data, sizeof(vid));
flags = vid.vid_flags;
cmd = IMSG_VMDOP_TERMINATE_VM_RESPONSE;

if ((id = vid.vid_id) == 0) {
	/* Lookup vm (id) by name */
	if ((vm = vm_getbyname(vid.vid_name)) == NULL((void *)0)) {
		res = ENOENT2;
		break;
	} else if ((vm->vm_state & VM_STATE_SHUTDOWN0x04) &&
	    (flags & VMOP_FORCE0x01) == 0) {
		res = EALREADY37;
		break;
	} else if (!(vm->vm_state & VM_STATE_RUNNING0x01)) {
		res = EINVAL22;
		break;
	}
	id = vm->vm_vmid;
} else if ((vm = vm_getbyvmid(id)) == NULL((void *)0)) {
	res = ENOENT2;
	break;
}
if (vm_checkperm(vm, &vm->vm_params.vmc_owner, vid.vid_uid)) {
	res = EPERM1;
	break;
}

/* Only relay TERMINATION requests, not WAIT requests */
if (imsg->hdr.type == IMSG_VMDOP_TERMINATE_VM_REQUEST) {
	memset(&vid, 0, sizeof(vid));
	vid.vid_id = id;
	vid.vid_flags = flags;

	if (proc_compose_imsg(ps, PROC_VMM, -1, imsg->hdr.type,
		imsg->hdr.peerid, -1, &vid, sizeof(vid)) == -1)
		return (-1);
}
break;
case IMSG_VMDOP_GET_INFO_VM_REQUEST:
proc_forward_imsg(ps, imsg, PROC_VMM, -1);
break;
case IMSG_VMDOP_LOAD:
IMSG_SIZE_CHECK(imsg, str)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*str)) fatalx("bad length imsg received (%s)", "str"); } while
 (0); /* at least one byte for path */
str = get_string((uint8_t *)imsg->data,
    IMSG_DATA_SIZE(imsg)((imsg)->hdr.len - sizeof(struct imsg_hdr)));
case IMSG_VMDOP_RELOAD:
if (vmd_reload(0, str) == -1)
	cmd = IMSG_CTL_FAIL;
else
	cmd = IMSG_CTL_OK;
free(str);
break;
case IMSG_CTL_RESET:
IMSG_SIZE_CHECK(imsg, &v)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&v)) fatalx("bad length imsg received (%s)", "&v");
 } while (0);
memcpy(&v, imsg->data, sizeof(v));
if (vmd_reload(v, NULL((void *)0)) == -1)
	cmd = IMSG_CTL_FAIL;
else
	cmd = IMSG_CTL_OK;
break;
case IMSG_CTL_VERBOSE:
IMSG_SIZE_CHECK(imsg, &verbose)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&verbose)) fatalx("bad length imsg received (%s)", "&verbose"
); } while (0);
memcpy(&verbose, imsg->data, sizeof(verbose));
log_setverbose(verbose);

proc_forward_imsg(ps, imsg, PROC_VMM, -1);
proc_forward_imsg(ps, imsg, PROC_PRIV, -1);
cmd = IMSG_CTL_OK;
break;
case IMSG_VMDOP_PAUSE_VM:
case IMSG_VMDOP_UNPAUSE_VM:
IMSG_SIZE_CHECK(imsg, &vid)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vid)) fatalx("bad length imsg received (%s)", "&vid"
); } while (0);
memcpy(&vid, imsg->data, sizeof(vid));
if (vid.vid_id == 0) {
	if ((vm = vm_getbyname(vid.vid_name)) == NULL((void *)0)) {
		res = ENOENT2;
		cmd = imsg->hdr.type == IMSG_VMDOP_PAUSE_VM
		    ? IMSG_VMDOP_PAUSE_VM_RESPONSE
		    : IMSG_VMDOP_UNPAUSE_VM_RESPONSE;
		break;
	} else {
		vid.vid_id = vm->vm_vmid;
	}
} else if ((vm = vm_getbyid(vid.vid_id)) == NULL((void *)0)) {
	res = ENOENT2;
	cmd = imsg->hdr.type == IMSG_VMDOP_PAUSE_VM
	    ? IMSG_VMDOP_PAUSE_VM_RESPONSE
	    : IMSG_VMDOP_UNPAUSE_VM_RESPONSE;
	break;
}
if (vm_checkperm(vm, &vm->vm_params.vmc_owner,
    vid.vid_uid) != 0) {
	res = EPERM1;
	cmd = imsg->hdr.type == IMSG_VMDOP_PAUSE_VM
	    ? IMSG_VMDOP_PAUSE_VM_RESPONSE
	    : IMSG_VMDOP_UNPAUSE_VM_RESPONSE;
	break;
}
proc_compose_imsg(ps, PROC_VMM, -1, imsg->hdr.type,
    imsg->hdr.peerid, -1, &vid, sizeof(vid));
break;
case IMSG_VMDOP_SEND_VM_REQUEST:
IMSG_SIZE_CHECK(imsg, &vid)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vid)) fatalx("bad length imsg received (%s)", "&vid"
); } while (0);
memcpy(&vid, imsg->data, sizeof(vid));
id = vid.vid_id;
if (vid.vid_id == 0) {
	if ((vm = vm_getbyname(vid.vid_name)) == NULL((void *)0)) {
		res = ENOENT2;
		cmd = IMSG_VMDOP_SEND_VM_RESPONSE;
		close(imsg->fd);
		break;
	} else {
		vid.vid_id = vm->vm_vmid;
	}
} else if ((vm = vm_getbyvmid(vid.vid_id)) == NULL((void *)0)) {
	res = ENOENT2;
	cmd = IMSG_VMDOP_SEND_VM_RESPONSE;
	close(imsg->fd);
	break;
}
vmr.vmr_id = vid.vid_id;
log_debug("%s: sending fd to vmm", __func__);
proc_compose_imsg(ps, PROC_VMM, -1, imsg->hdr.type,
    imsg->hdr.peerid, imsg->fd, &vid, sizeof(vid));
break;
case IMSG_VMDOP_RECEIVE_VM_REQUEST:
IMSG_SIZE_CHECK(imsg, &vid)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vid)) fatalx("bad length imsg received (%s)", "&vid"
); } while (0);
memcpy(&vid, imsg->data, sizeof(vid));
if (imsg->fd == -1) {
	log_warnx("%s: invalid fd", __func__);
	return (-1);
}
if (atomicio(read, imsg->fd, &vmh, sizeof(vmh)) !=
    sizeof(vmh)) {
	log_warnx("%s: error reading vmh from received vm",
	    __func__);
	res = EIO5;
	close(imsg->fd);
	cmd = IMSG_VMDOP_START_VM_RESPONSE;
	break;
}

if (vmd_check_vmh(&vmh)) {
	res = ENOENT2;
	close(imsg->fd);
	cmd = IMSG_VMDOP_START_VM_RESPONSE;
	break;
}
if (atomicio(read, imsg->fd, &vmc, sizeof(vmc)) !=
    sizeof(vmc)) {
	log_warnx("%s: error reading vmc from received vm",
	    __func__);
	res = EIO5;
	close(imsg->fd);
	cmd = IMSG_VMDOP_START_VM_RESPONSE;
	break;
}
strlcpy(vmc.vmc_params.vcp_name, vid.vid_name,
    sizeof(vmc.vmc_params.vcp_name));
vmc.vmc_params.vcp_id = 0;

ret = vm_register(ps, &vmc, &vm, 0, vmc.vmc_owner.uid);
if (ret != 0) {
	res = errno(*__errno());
	cmd = IMSG_VMDOP_START_VM_RESPONSE;
	close(imsg->fd);
} else {
	vm->vm_state |= VM_STATE_RECEIVED0x08;
	config_setvm(ps, vm, imsg->hdr.peerid,
	    vmc.vmc_owner.uid);
	log_debug("%s: sending fd to vmm", __func__);
	proc_compose_imsg(ps, PROC_VMM, -1,
	    IMSG_VMDOP_RECEIVE_VM_END, vm->vm_vmid, imsg->fd,
	    NULL((void *)0), 0);
}
break;
case IMSG_VMDOP_DONE:
control_reset(&ps->ps_csock);
TAILQ_FOREACH(rcs, &ps->ps_rcsocks, cs_entry)for((rcs) = ((&ps->ps_rcsocks)->tqh_first); (rcs) !=
 ((void *)0); (rcs) = ((rcs)->cs_entry.tqe_next))
	control_reset(rcs);
cmd = 0;
break;
default:
return (-1);
}

switch (cmd) {
case 0:
break;
case IMSG_VMDOP_START_VM_RESPONSE:
case IMSG_VMDOP_TERMINATE_VM_RESPONSE:
memset(&vmr, 0, sizeof(vmr));
vmr.vmr_result = res;
vmr.vmr_id = id;
if (proc_compose_imsg(ps, PROC_CONTROL, -1, cmd,
    imsg->hdr.peerid, -1, &vmr, sizeof(vmr)) == -1)
	return (-1);
break;
default:
if (proc_compose_imsg(ps, PROC_CONTROL, -1, cmd,
    imsg->hdr.peerid, -1, &res, sizeof(res)) == -1)
	return (-1);
break;
}

return (0);
334}

336int
337vmd_dispatch_vmm(int fd, struct privsep_proc *p, struct imsg *imsg)
338{
struct vmop_result	 vmr;
struct privsep		*ps = p->p_ps;
int			 res = 0;
struct vmd_vm		*vm;
struct vm_create_params	*vcp;
struct vmop_info_result	 vir;

switch (imsg->hdr.type) {
case IMSG_VMDOP_PAUSE_VM_RESPONSE:
IMSG_SIZE_CHECK(imsg, &vmr)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmr)) fatalx("bad length imsg received (%s)", "&vmr"
); } while (0);
memcpy(&vmr, imsg->data, sizeof(vmr));
if ((vm = vm_getbyvmid(vmr.vmr_id)) == NULL((void *)0))
	break;
proc_compose_imsg(ps, PROC_CONTROL, -1,
    imsg->hdr.type, imsg->hdr.peerid, -1,
    imsg->data, sizeof(imsg->data));
log_info("%s: paused vm %d successfully",
    vm->vm_params.vmc_params.vcp_name,
    vm->vm_vmid);
vm->vm_state |= VM_STATE_PAUSED0x10;
break;
case IMSG_VMDOP_UNPAUSE_VM_RESPONSE:
IMSG_SIZE_CHECK(imsg, &vmr)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmr)) fatalx("bad length imsg received (%s)", "&vmr"
); } while (0);
memcpy(&vmr, imsg->data, sizeof(vmr));
if ((vm = vm_getbyvmid(vmr.vmr_id)) == NULL((void *)0))
	break;
proc_compose_imsg(ps, PROC_CONTROL, -1,
    imsg->hdr.type, imsg->hdr.peerid, -1,
    imsg->data, sizeof(imsg->data));
log_info("%s: unpaused vm %d successfully.",
    vm->vm_params.vmc_params.vcp_name,
    vm->vm_vmid);
vm->vm_state &= ~VM_STATE_PAUSED0x10;
break;
case IMSG_VMDOP_START_VM_RESPONSE:
IMSG_SIZE_CHECK(imsg, &vmr)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmr)) fatalx("bad length imsg received (%s)", "&vmr"
); } while (0);
memcpy(&vmr, imsg->data, sizeof(vmr));
if ((vm = vm_getbyvmid(imsg->hdr.peerid)) == NULL((void *)0))
	break;
vm->vm_pid = vmr.vmr_pid;
vcp = &vm->vm_params.vmc_params;
vcp->vcp_id = vmr.vmr_id;

/*
 * If the peerid is not -1, forward the response back to the
 * the control socket.  If it is -1, the request originated
 * from the parent, not the control socket.
 */
if (vm->vm_peerid != (uint32_t)-1) {
	(void)strlcpy(vmr.vmr_ttyname, vm->vm_ttyname,
	    sizeof(vmr.vmr_ttyname));
	if (proc_compose_imsg(ps, PROC_CONTROL, -1,
	    imsg->hdr.type, vm->vm_peerid, -1,
	    &vmr, sizeof(vmr)) == -1) {
		errno(*__errno()) = vmr.vmr_result;
		log_warn("%s: failed to foward vm result",
		    vcp->vcp_name);
		vm_remove(vm, __func__);
		return (-1);
	}
}

if (vmr.vmr_result) {
	errno(*__errno()) = vmr.vmr_result;
	log_warn("%s: failed to start vm", vcp->vcp_name);
	vm_remove(vm, __func__);
	break;
}

/* Now configure all the interfaces */
if (vm_priv_ifconfig(ps, vm) == -1) {
	log_warn("%s: failed to configure vm", vcp->vcp_name);
	vm_remove(vm, __func__);
	break;
}

log_info("%s: started vm %d successfully, tty %s",
    vcp->vcp_name, vm->vm_vmid, vm->vm_ttyname);
break;
case IMSG_VMDOP_TERMINATE_VM_RESPONSE:
IMSG_SIZE_CHECK(imsg, &vmr)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmr)) fatalx("bad length imsg received (%s)", "&vmr"
); } while (0);
memcpy(&vmr, imsg->data, sizeof(vmr));

if (vmr.vmr_result) {
	DPRINTF("%s: forwarding TERMINATE VM for vm id %d",do {} while(0)
	    __func__, vmr.vmr_id)do {} while(0);
	proc_forward_imsg(ps, imsg, PROC_CONTROL, -1);
} else {
	if ((vm = vm_getbyvmid(vmr.vmr_id)) == NULL((void *)0))
		break;
	/* Mark VM as shutting down */
	vm->vm_state |= VM_STATE_SHUTDOWN0x04;
}
break;
case IMSG_VMDOP_SEND_VM_RESPONSE:
IMSG_SIZE_CHECK(imsg, &vmr)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmr)) fatalx("bad length imsg received (%s)", "&vmr"
); } while (0);
memcpy(&vmr, imsg->data, sizeof(vmr));
if ((vm = vm_getbyvmid(vmr.vmr_id)) == NULL((void *)0))
	break;
if (!vmr.vmr_result) {
	log_info("%s: sent vm %d successfully.",
	    vm->vm_params.vmc_params.vcp_name,
	    vm->vm_vmid);
	if (vm->vm_from_config)
		vm_stop(vm, 0, __func__);
	else
		vm_remove(vm, __func__);
}

/* Send a response if a control client is waiting for it */
if (imsg->hdr.peerid != (uint32_t)-1) {
	/* the error is meaningless for deferred responses */
	vmr.vmr_result = 0;

	if (proc_compose_imsg(ps, PROC_CONTROL, -1,
	    IMSG_VMDOP_SEND_VM_RESPONSE,
	    imsg->hdr.peerid, -1, &vmr, sizeof(vmr)) == -1)
		return (-1);
}
break;
case IMSG_VMDOP_TERMINATE_VM_EVENT:
IMSG_SIZE_CHECK(imsg, &vmr)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vmr)) fatalx("bad length imsg received (%s)", "&vmr"
); } while (0);
memcpy(&vmr, imsg->data, sizeof(vmr));
DPRINTF("%s: handling TERMINATE_EVENT for vm id %d ret %d",do {} while(0)
    __func__, vmr.vmr_id, vmr.vmr_result)do {} while(0);
if ((vm = vm_getbyvmid(vmr.vmr_id)) == NULL((void *)0)) {
	log_debug("%s: vm %d is no longer available",
	    __func__, vmr.vmr_id);
	break;
}
if (vmr.vmr_result != EAGAIN35 ||
    vm->vm_params.vmc_bootdevice) {
	if (vm->vm_from_config)
		vm_stop(vm, 0, __func__);
	else
		vm_remove(vm, __func__);
} else {
	/* Stop VM instance but keep the tty open */
	vm_stop(vm, 1, __func__);
	config_setvm(ps, vm, (uint32_t)-1, vm->vm_uid);
}

/* The error is meaningless for deferred responses */
vmr.vmr_result = 0;

if (proc_compose_imsg(ps, PROC_CONTROL, -1,
	IMSG_VMDOP_TERMINATE_VM_EVENT,
	imsg->hdr.peerid, -1, &vmr, sizeof(vmr)) == -1)
	return (-1);
break;
case IMSG_VMDOP_GET_INFO_VM_DATA:
IMSG_SIZE_CHECK(imsg, &vir)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&vir)) fatalx("bad length imsg received (%s)", "&vir"
); } while (0);
memcpy(&vir, imsg->data, sizeof(vir));
if ((vm = vm_getbyvmid(vir.vir_info.vir_id)) != NULL((void *)0)) {
	memset(vir.vir_ttyname, 0, sizeof(vir.vir_ttyname));
	if (vm->vm_ttyname != NULL((void *)0))
		strlcpy(vir.vir_ttyname, vm->vm_ttyname,
		    sizeof(vir.vir_ttyname));
	log_debug("%s: running vm: %d, vm_state: 0x%x",
	    __func__, vm->vm_vmid, vm->vm_state);
	vir.vir_state = vm->vm_state;
	/* get the user id who started the vm */
	vir.vir_uid = vm->vm_uid;
	vir.vir_gid = vm->vm_params.vmc_owner.gid;
}
if (proc_compose_imsg(ps, PROC_CONTROL, -1, imsg->hdr.type,
    imsg->hdr.peerid, -1, &vir, sizeof(vir)) == -1) {
	log_debug("%s: GET_INFO_VM failed for vm %d, removing",
	    __func__, vm->vm_vmid);
	vm_remove(vm, __func__);
	return (-1);
}
break;
case IMSG_VMDOP_GET_INFO_VM_END_DATA:
/*
 * PROC_VMM has responded with the *running* VMs, now we
 * append the others. These use the special value 0 for their
 * kernel id to indicate that they are not running.
 */
TAILQ_FOREACH(vm, env->vmd_vms, vm_entry)for((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void *
)0); (vm) = ((vm)->vm_entry.tqe_next)) {
	if (!(vm->vm_state & VM_STATE_RUNNING0x01)) {
		memset(&vir, 0, sizeof(vir));
		vir.vir_info.vir_id = vm->vm_vmid;
		strlcpy(vir.vir_info.vir_name,
		    vm->vm_params.vmc_params.vcp_name,
		    VMM_MAX_NAME_LEN64);
		vir.vir_info.vir_memory_size =
		    vm->vm_params.vmc_params.
		    vcp_memranges[0].vmr_size;
		vir.vir_info.vir_ncpus =
		    vm->vm_params.vmc_params.vcp_ncpus;
		/* get the configured user id for this vm */
		vir.vir_uid = vm->vm_params.vmc_owner.uid;
		vir.vir_gid = vm->vm_params.vmc_owner.gid;
		log_debug("%s: vm: %d, vm_state: 0x%x",
		    __func__, vm->vm_vmid, vm->vm_state);
		vir.vir_state = vm->vm_state;
		if (proc_compose_imsg(ps, PROC_CONTROL, -1,
		    IMSG_VMDOP_GET_INFO_VM_DATA,
		    imsg->hdr.peerid, -1, &vir,
		    sizeof(vir)) == -1) {
			log_debug("%s: GET_INFO_VM_END failed",
			    __func__);
			vm_remove(vm, __func__);
			return (-1);
		}
	}
}
IMSG_SIZE_CHECK(imsg, &res)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&res)) fatalx("bad length imsg received (%s)", "&res"
); } while (0);
proc_forward_imsg(ps, imsg, PROC_CONTROL, -1);
break;
default:
return (-1);
}

return (0);
555}

557int
558vmd_dispatch_priv(int fd, struct privsep_proc *p, struct imsg *imsg)
559{
struct vmop_addr_result	 var;

switch (imsg->hdr.type) {
case IMSG_VMDOP_PRIV_GET_ADDR_RESPONSE:
IMSG_SIZE_CHECK(imsg, &var)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&var)) fatalx("bad length imsg received (%s)", "&var"
); } while (0);
memcpy(&var, imsg->data, sizeof(var));
proc_forward_imsg(p->p_ps, imsg, PROC_VMM, -1);
break;
default:
return (-1);
}

return (0);
573}

575int
576vmd_check_vmh(struct vm_dump_header *vmh)
577{
int i;
unsigned int code, leaf;
unsigned int a, b, c, d;

if (strncmp(vmh->vmh_signature, VM_DUMP_SIGNATURE"OpenBSDVMM58", strlen(VM_DUMP_SIGNATURE"OpenBSDVMM58")) != 0) {
log_warnx("%s: incompatible dump signature", __func__);
return (-1);
}

if (vmh->vmh_version != VM_DUMP_VERSION7) {
log_warnx("%s: incompatible dump version", __func__);
return (-1);
}

for (i = 0; i < VM_DUMP_HEADER_CPUID_COUNT5; i++) {
code = vmh->vmh_cpuids[i].code;
leaf = vmh->vmh_cpuids[i].leaf;
if (leaf != 0x00) {
	log_debug("%s: invalid leaf 0x%x for code 0x%x",
	    __func__, leaf, code);
	return (-1);
}

switch (code) {
case 0x00:
	CPUID_LEAF(code, leaf, a, b, c, d)__asm volatile("cpuid" : "=a" (a), "=b" (b), "=c" (c), "=d" (
d) : "a" (code), "c" (leaf));
	if (vmh->vmh_cpuids[i].a > a) {
		log_debug("%s: incompatible cpuid level",
		    __func__);
		return (-1);
	}
	if (!(vmh->vmh_cpuids[i].b == b &&
	    vmh->vmh_cpuids[i].c == c &&
	    vmh->vmh_cpuids[i].d == d)) {
		log_debug("%s: incompatible cpu brand",
		    __func__);
		return (-1);
	}
	break;

case 0x01:
	CPUID_LEAF(code, leaf, a, b, c, d)__asm volatile("cpuid" : "=a" (a), "=b" (b), "=c" (c), "=d" (
d) : "a" (code), "c" (leaf));
	if ((vmh->vmh_cpuids[i].c & c & VMM_CPUIDECX_MASK~(0x00000080 | 0x00000100 | 0x00000008 | 0x00008000 | 0x00000020
 | 0x00000004 | 0x00000010 | 0x00000040 | 0x00000400 | 0x00000800
 | 0x00004000 | 0x00020000 | 0x00040000 | 0x00200000 | 0x01000000
)) !=
	    (vmh->vmh_cpuids[i].c & VMM_CPUIDECX_MASK~(0x00000080 | 0x00000100 | 0x00000008 | 0x00008000 | 0x00000020
 | 0x00000004 | 0x00000010 | 0x00000040 | 0x00000400 | 0x00000800
 | 0x00004000 | 0x00020000 | 0x00040000 | 0x00200000 | 0x01000000
))) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: c", __func__,
		    code, leaf);
		return (-1);
	}
	if ((vmh->vmh_cpuids[i].d & d & VMM_CPUIDEDX_MASK~(0x00400000 | 0x20000000 | 0x10000000 | 0x00200000 | 0x00000200
 | 0x00040000 | 0x08000000 | 0x80000000 | 0x00001000 | 0x00000080
 | 0x00004000)) !=
	    (vmh->vmh_cpuids[i].d & VMM_CPUIDEDX_MASK~(0x00400000 | 0x20000000 | 0x10000000 | 0x00200000 | 0x00000200
 | 0x00040000 | 0x08000000 | 0x80000000 | 0x00001000 | 0x00000080
 | 0x00004000))) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: d", __func__,
		    code, leaf);
		return (-1);
	}
	break;

case 0x07:
	CPUID_LEAF(code, leaf, a, b, c, d)__asm volatile("cpuid" : "=a" (a), "=b" (b), "=c" (c), "=d" (
d) : "a" (code), "c" (leaf));
	if ((vmh->vmh_cpuids[i].b & b & VMM_SEFF0EBX_MASK~(0x00000002 | 0x00000004 | 0x00000010 | 0x00000400 | 0x00000800
 | 0x00001000 | 0x00004000 | 0x00400000 | 0x02000000 | 0x00010000
 | 0x00020000 | 0x00200000 | 0x04000000 | 0x08000000 | 0x10000000
 | 0x40000000 | 0x80000000)) !=
	    (vmh->vmh_cpuids[i].b & VMM_SEFF0EBX_MASK~(0x00000002 | 0x00000004 | 0x00000010 | 0x00000400 | 0x00000800
 | 0x00001000 | 0x00004000 | 0x00400000 | 0x02000000 | 0x00010000
 | 0x00020000 | 0x00200000 | 0x04000000 | 0x08000000 | 0x10000000
 | 0x40000000 | 0x80000000))) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: c", __func__,
		    code, leaf);
		return (-1);
	}
	if ((vmh->vmh_cpuids[i].c & c & VMM_SEFF0ECX_MASK~(0x00000002)) !=
	    (vmh->vmh_cpuids[i].c & VMM_SEFF0ECX_MASK~(0x00000002))) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: d", __func__,
		    code, leaf);
		return (-1);
	}
	break;

case 0x0d:
	CPUID_LEAF(code, leaf, a, b, c, d)__asm volatile("cpuid" : "=a" (a), "=b" (b), "=c" (c), "=d" (
d) : "a" (code), "c" (leaf));
	if (vmh->vmh_cpuids[i].b > b) {
		log_debug("%s: incompatible cpu: insufficient "
		    "max save area for enabled XCR0 features",
		    __func__);
		return (-1);
	}
	if (vmh->vmh_cpuids[i].c > c) {
		log_debug("%s: incompatible cpu: insufficient "
		    "max save area for supported XCR0 features",
		    __func__);
		return (-1);
	}
	break;

case 0x80000001:
	CPUID_LEAF(code, leaf, a, b, c, d)__asm volatile("cpuid" : "=a" (a), "=b" (b), "=c" (c), "=d" (
d) : "a" (code), "c" (leaf));
	if ((vmh->vmh_cpuids[i].a & a) !=
	    vmh->vmh_cpuids[i].a) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: a", __func__,
		    code, leaf);
		return (-1);
	}
	if ((vmh->vmh_cpuids[i].c & c) !=
	    vmh->vmh_cpuids[i].c) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: c", __func__,
		    code, leaf);
		return (-1);
	}
	if ((vmh->vmh_cpuids[i].d & d) !=
	    vmh->vmh_cpuids[i].d) {
		log_debug("%s: incompatible cpu features "
		    "code: 0x%x leaf: 0x%x  reg: d", __func__,
		    code, leaf);
		return (-1);
	}
	break;

default:
	log_debug("%s: unknown code 0x%x", __func__, code);
	return (-1);
}
}

return (0);
702}

704void
705vmd_sighdlr(int sig, short event, void *arg)
706{
if (privsep_process != PROC_PARENT)
1
Assuming 'privsep_process' is equal to PROC_PARENT→
2
←
Taking false branch→
return;
log_debug("%s: handling signal", __func__);

switch (sig) {
3
←
Control jumps to 'case 2:'  at line 728→
case SIGHUP1:
log_info("%s: reload requested with SIGHUP", __func__);

/*
 * This is safe because libevent uses async signal handlers
 * that run in the event loop and not in signal context.
 */
(void)vmd_reload(0, NULL((void *)0));
break;
case SIGPIPE13:
log_info("%s: ignoring SIGPIPE", __func__);
break;
case SIGUSR130:
log_info("%s: ignoring SIGUSR1", __func__);
break;
case SIGTERM15:
case SIGINT2:
vmd_shutdown();
4
←
Calling 'vmd_shutdown'→
break;
default:
fatalx("unexpected signal");
}
734}

736__dead__attribute__((__noreturn__)) void
737usage(void)
738{
extern char *__progname;
fprintf(stderr(&__sF[2]), "usage: %s [-dnv] [-D macro=value] [-f file]\n",
   __progname);
exit(1);
743}

745int
746main(int argc, char **argv)
747{
struct privsep		*ps;
int			 ch;
const char		*conffile = VMD_CONF"/etc/vm.conf";
enum privsep_procid	 proc_id = PROC_PARENT;
int			 proc_instance = 0;
const char		*errp, *title = NULL((void *)0);
int			 argc0 = argc;

log_init(0, LOG_DAEMON(3<<3));

if ((env = calloc(1, sizeof(*env))) == NULL((void *)0))
fatal("calloc: env");

while ((ch = getopt(argc, argv, "D:P:I:df:vn")) != -1) {
switch (ch) {
case 'D':
	if (cmdline_symset(optarg) < 0)
		log_warnx("could not parse macro definition %s",
		    optarg);
	break;
case 'd':
	env->vmd_debug = 2;
	break;
case 'f':
	conffile = optarg;
	break;
case 'v':
	env->vmd_verbose++;
	break;
case 'n':
	env->vmd_noaction = 1;
	break;
case 'P':
	title = optarg;
	proc_id = proc_getid(procs, nitems(procs)(sizeof((procs)) / sizeof((procs)[0])), title);
	if (proc_id == PROC_MAX)
		fatalx("invalid process name");
	break;
case 'I':
	proc_instance = strtonum(optarg, 0,
	    PROC_MAX_INSTANCES32, &errp);
	if (errp)
		fatalx("invalid process instance");
	break;
default:
	usage();
}
}

argc -= optind;
if (argc > 0)
usage();

if (env->vmd_noaction && !env->vmd_debug)
env->vmd_debug = 1;

log_init(env->vmd_debug, LOG_DAEMON(3<<3));
log_setverbose(env->vmd_verbose);

/* check for root privileges */
if (env->vmd_noaction == 0) {
if (geteuid())
	fatalx("need root privileges");
}

ps = &env->vmd_ps;
ps->ps_env = env;
env->vmd_fd = -1;

if (config_init(env) == -1)
fatal("failed to initialize configuration");

if ((ps->ps_pw = getpwnam(VMD_USER"_vmd")) == NULL((void *)0))
fatal("unknown user %s", VMD_USER"_vmd");

/* First proc runs as root without pledge but in default chroot */
proc_priv->p_pw = &proc_privpw; /* initialized to all 0 */
proc_priv->p_chroot = ps->ps_pw->pw_dir; /* from VMD_USER */

/* Open /dev/vmm */
if (env->vmd_noaction == 0) {
env->vmd_fd = open(VMM_NODE"/dev/vmm", O_RDWR0x0002);
if (env->vmd_fd == -1)
	fatal("%s", VMM_NODE"/dev/vmm");
}

/* Configure the control socket */
ps->ps_csock.cs_name = SOCKET_NAME"/var/run/vmd.sock";
TAILQ_INIT(&ps->ps_rcsocks)do { (&ps->ps_rcsocks)->tqh_first = ((void *)0); (&
ps->ps_rcsocks)->tqh_last = &(&ps->ps_rcsocks
)->tqh_first; } while (0);

/* Configuration will be parsed after forking the children */
env->vmd_conffile = conffile;

if (env->vmd_noaction)
ps->ps_noaction = 1;
ps->ps_instance = proc_instance;
if (title != NULL((void *)0))
ps->ps_title[proc_id] = title;

/* only the parent returns */
proc_init(ps, procs, nitems(procs)(sizeof((procs)) / sizeof((procs)[0])), env->vmd_debug, argc0, argv,
   proc_id);

log_procinit("parent");
if (!env->vmd_debug && daemon(0, 0) == -1)
fatal("can't daemonize");

if (ps->ps_noaction == 0)
log_info("startup");

event_init();

signal_set(&ps->ps_evsigint, SIGINT, vmd_sighdlr, ps)event_set(&ps->ps_evsigint, 2, 0x08|0x10, vmd_sighdlr,
 ps);
signal_set(&ps->ps_evsigterm, SIGTERM, vmd_sighdlr, ps)event_set(&ps->ps_evsigterm, 15, 0x08|0x10, vmd_sighdlr
, ps);
signal_set(&ps->ps_evsighup, SIGHUP, vmd_sighdlr, ps)event_set(&ps->ps_evsighup, 1, 0x08|0x10, vmd_sighdlr,
 ps);
signal_set(&ps->ps_evsigpipe, SIGPIPE, vmd_sighdlr, ps)event_set(&ps->ps_evsigpipe, 13, 0x08|0x10, vmd_sighdlr
, ps);
signal_set(&ps->ps_evsigusr1, SIGUSR1, vmd_sighdlr, ps)event_set(&ps->ps_evsigusr1, 30, 0x08|0x10, vmd_sighdlr
, ps);

signal_add(&ps->ps_evsigint, NULL)event_add(&ps->ps_evsigint, ((void *)0));
signal_add(&ps->ps_evsigterm, NULL)event_add(&ps->ps_evsigterm, ((void *)0));
signal_add(&ps->ps_evsighup, NULL)event_add(&ps->ps_evsighup, ((void *)0));
signal_add(&ps->ps_evsigpipe, NULL)event_add(&ps->ps_evsigpipe, ((void *)0));
signal_add(&ps->ps_evsigusr1, NULL)event_add(&ps->ps_evsigusr1, ((void *)0));

if (!env->vmd_noaction)
proc_connect(ps);

if (vmd_configure() == -1)
fatalx("configuration failed");

event_dispatch();

log_debug("parent exiting");

return (0);
883}

885void
886start_vm_batch(int fd, short type, void *args)
887{
int		i = 0;
struct vmd_vm	*vm;

log_debug("%s: starting batch of %d vms", __func__,
   env->vmd_cfg.parallelism);
TAILQ_FOREACH(vm, env->vmd_vms, vm_entry)for((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void *
)0); (vm) = ((vm)->vm_entry.tqe_next)) {
if (!(vm->vm_state & VM_STATE_WAITING0x20)) {
	log_debug("%s: not starting vm %s (disabled)",
	    __func__,
	    vm->vm_params.vmc_params.vcp_name);
	continue;
}
i++;
if (i > env->vmd_cfg.parallelism) {
	evtimer_add(&staggered_start_timer,event_add(&staggered_start_timer, &env->vmd_cfg.delay
)
	    &env->vmd_cfg.delay)event_add(&staggered_start_timer, &env->vmd_cfg.delay
);
	break;
}
vm->vm_state &= ~VM_STATE_WAITING0x20;
config_setvm(&env->vmd_ps, vm, -1, vm->vm_params.vmc_owner.uid);
}
log_debug("%s: done starting vms", __func__);
910}

912int
913vmd_configure(void)
914{
int			ncpus;
struct vmd_switch	*vsw;
int ncpu_mib[] = {CTL_HW6, HW_NCPUONLINE25};
size_t ncpus_sz = sizeof(ncpus);

if ((env->vmd_ptmfd = open(PATH_PTMDEV"/dev/ptm", O_RDWR0x0002|O_CLOEXEC0x10000)) == -1)
fatal("open %s", PATH_PTMDEV"/dev/ptm");

/*
* pledge in the parent process:
* stdio - for malloc and basic I/O including events.
* rpath - for reload to open and read the configuration files.
* wpath - for opening disk images and tap devices.
* tty - for openpty and TIOCUCNTL.
* proc - run kill to terminate its children safely.
* sendfd - for disks, interfaces and other fds.
* recvfd - for send and receive.
* getpw - lookup user or group id by name.
* chown, fattr - change tty ownership
* flock - locking disk files
*/
if (pledge("stdio rpath wpath proc tty recvfd sendfd getpw"
   " chown fattr flock", NULL((void *)0)) == -1)
fatal("pledge");

if (parse_config(env->vmd_conffile) == -1) {
proc_kill(&env->vmd_ps);
exit(1);
}

if (env->vmd_noaction) {
fprintf(stderr(&__sF[2]), "configuration OK\n");
proc_kill(&env->vmd_ps);
exit(0);
}

/* Send shared global configuration to all children */
if (config_setconfig(env) == -1)
return (-1);

TAILQ_FOREACH(vsw, env->vmd_switches, sw_entry)for((vsw) = ((env->vmd_switches)->tqh_first); (vsw) != (
(void *)0); (vsw) = ((vsw)->sw_entry.tqe_next)) {
if (vsw->sw_running)
	continue;
if (vm_priv_brconfig(&env->vmd_ps, vsw) == -1) {
	log_warn("%s: failed to create switch %s",
	    __func__, vsw->sw_name);
	switch_remove(vsw);
	return (-1);
}
}

if (!(env->vmd_cfg.cfg_flags & VMD_CFG_STAGGERED_START0x04)) {
env->vmd_cfg.delay.tv_sec = VMD_DEFAULT_STAGGERED_START_DELAY30;
if (sysctl(ncpu_mib, nitems(ncpu_mib)(sizeof((ncpu_mib)) / sizeof((ncpu_mib)[0])), &ncpus, &ncpus_sz, NULL((void *)0), 0) == -1)
	ncpus = 1;
env->vmd_cfg.parallelism = ncpus;
log_debug("%s: setting staggered start configuration to "
    "parallelism: %d and delay: %lld",
    __func__, ncpus, (long long) env->vmd_cfg.delay.tv_sec);
}

log_debug("%s: starting vms in staggered fashion", __func__);
evtimer_set(&staggered_start_timer, start_vm_batch, NULL)event_set(&staggered_start_timer, -1, 0, start_vm_batch, (
(void *)0));
/* start first batch */
start_vm_batch(0, 0, NULL((void *)0));

return (0);
982}

984int
985vmd_reload(unsigned int reset, const char *filename)
986{
struct vmd_vm		*vm, *next_vm;
struct vmd_switch	*vsw;
int			 reload = 0;

/* Switch back to the default config file */
if (filename == NULL((void *)0) || *filename == '\0') {
filename = env->vmd_conffile;
reload = 1;
}

log_debug("%s: level %d config file %s", __func__, reset, filename);

if (reset) {
/* Purge the configuration */
config_purge(env, reset);
config_setreset(env, reset);
} else {
/*
 * Load or reload the configuration.
 *
 * Reloading removes all non-running VMs before processing the
 * config file, whereas loading only adds to the existing list
 * of VMs.
 */

if (reload) {
	TAILQ_FOREACH_SAFE(vm, env->vmd_vms, vm_entry,for ((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void
 *)0) && ((next_vm) = ((vm)->vm_entry.tqe_next), 1
); (vm) = (next_vm))
	    next_vm)for ((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void
 *)0) && ((next_vm) = ((vm)->vm_entry.tqe_next), 1
); (vm) = (next_vm)) {
		if (!(vm->vm_state & VM_STATE_RUNNING0x01)) {
			DPRINTF("%s: calling vm_remove",do {} while(0)
			    __func__)do {} while(0);
			vm_remove(vm, __func__);
		}
	}
}

if (parse_config(filename) == -1) {
	log_debug("%s: failed to load config file %s",
	    __func__, filename);
	return (-1);
}

if (reload) {
	/* Update shared global configuration in all children */
	if (config_setconfig(env) == -1)
		return (-1);
}

TAILQ_FOREACH(vsw, env->vmd_switches, sw_entry)for((vsw) = ((env->vmd_switches)->tqh_first); (vsw) != (
(void *)0); (vsw) = ((vsw)->sw_entry.tqe_next)) {
	if (vsw->sw_running)
		continue;
	if (vm_priv_brconfig(&env->vmd_ps, vsw) == -1) {
		log_warn("%s: failed to create switch %s",
		    __func__, vsw->sw_name);
		switch_remove(vsw);
		return (-1);
	}
}

log_debug("%s: starting vms in staggered fashion", __func__);
evtimer_set(&staggered_start_timer, start_vm_batch, NULL)event_set(&staggered_start_timer, -1, 0, start_vm_batch, (
(void *)0));
/* start first batch */
start_vm_batch(0, 0, NULL((void *)0));

}

return (0);
1054}

1056void
1057vmd_shutdown(void)
1058{
struct vmd_vm *vm, *vm_next;

log_debug("%s: performing shutdown", __func__);

TAILQ_FOREACH_SAFE(vm, env->vmd_vms, vm_entry, vm_next)for ((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void
 *)0) && ((vm_next) = ((vm)->vm_entry.tqe_next), 1
); (vm) = (vm_next)) {
5
←
Assuming 'vm' is not equal to null→
6
←
Loop condition is true.  Entering loop body→
vm_remove(vm, __func__);
7
←
Calling 'vm_remove'→
}

proc_kill(&env->vmd_ps);
free(env);

log_warnx("parent terminating");
exit(0);
1072}

1074struct vmd_vm *
1075vm_getbyvmid(uint32_t vmid)
1076{
struct vmd_vm	*vm;

if (vmid == 0)
return (NULL((void *)0));
TAILQ_FOREACH(vm, env->vmd_vms, vm_entry)for((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void *
)0); (vm) = ((vm)->vm_entry.tqe_next)) {
if (vm->vm_vmid == vmid)
	return (vm);
}

return (NULL((void *)0));
1087}

1089struct vmd_vm *
1090vm_getbyid(uint32_t id)
1091{
struct vmd_vm	*vm;

if (id == 0)
return (NULL((void *)0));
TAILQ_FOREACH(vm, env->vmd_vms, vm_entry)for((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void *
)0); (vm) = ((vm)->vm_entry.tqe_next)) {
if (vm->vm_params.vmc_params.vcp_id == id)
	return (vm);
}

return (NULL((void *)0));
1102}

1104uint32_t
1105vm_id2vmid(uint32_t id, struct vmd_vm *vm)
1106{
if (vm == NULL((void *)0) && (vm = vm_getbyid(id)) == NULL((void *)0))
return (0);
DPRINTF("%s: vmm id %u is vmid %u", __func__,do {} while(0)
   id, vm->vm_vmid)do {} while(0);
return (vm->vm_vmid);
1112}

1114uint32_t
1115vm_vmid2id(uint32_t vmid, struct vmd_vm *vm)
1116{
if (vm == NULL((void *)0) && (vm = vm_getbyvmid(vmid)) == NULL((void *)0))
return (0);
DPRINTF("%s: vmid %u is vmm id %u", __func__,do {} while(0)
   vmid, vm->vm_params.vmc_params.vcp_id)do {} while(0);
return (vm->vm_params.vmc_params.vcp_id);
1122}

1124struct vmd_vm *
1125vm_getbyname(const char *name)
1126{
struct vmd_vm	*vm;

if (name == NULL((void *)0))
return (NULL((void *)0));
TAILQ_FOREACH(vm, env->vmd_vms, vm_entry)for((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void *
)0); (vm) = ((vm)->vm_entry.tqe_next)) {
if (strcmp(vm->vm_params.vmc_params.vcp_name, name) == 0)
	return (vm);
}

return (NULL((void *)0));
1137}

1139struct vmd_vm *
1140vm_getbypid(pid_t pid)
1141{
struct vmd_vm	*vm;

TAILQ_FOREACH(vm, env->vmd_vms, vm_entry)for((vm) = ((env->vmd_vms)->tqh_first); (vm) != ((void *
)0); (vm) = ((vm)->vm_entry.tqe_next)) {
if (vm->vm_pid == pid)
	return (vm);
}

return (NULL((void *)0));
1150}

1152void
1153vm_stop(struct vmd_vm *vm, int keeptty, const char *caller)
1154{
struct privsep	*ps = &env->vmd_ps;
unsigned int	 i, j;

if (vm23.1
'vm' is not equal to NULL
 == NULL((void *)0))
24
←
Taking false branch→
return;

log_debug("%s: %s %s stopping vm %d%s",
   __func__, ps->ps_title[privsep_process], caller,
   vm->vm_vmid, keeptty24.1
'keeptty' is 0
 ? ", keeping tty open" : "");
25
←
'?' condition is false→

vm->vm_state &= ~(VM_STATE_RUNNING0x01 | VM_STATE_SHUTDOWN0x04);

user_inc(&vm->vm_params.vmc_params, vm->vm_user, 0);
26
←
Use of memory after it is freed
user_put(vm->vm_user);

if (vm->vm_iev.ibuf.fd != -1) {
event_del(&vm->vm_iev.ev);
close(vm->vm_iev.ibuf.fd);
}
for (i = 0; i < VMM_MAX_DISKS_PER_VM4; i++) {
for (j = 0; j < VM_MAX_BASE_PER_DISK4; j++) {
	if (vm->vm_disks[i][j] != -1) {
		close(vm->vm_disks[i][j]);
		vm->vm_disks[i][j] = -1;
	}
}
}
for (i = 0; i < VMM_MAX_NICS_PER_VM4; i++) {
if (vm->vm_ifs[i].vif_fd != -1) {
	close(vm->vm_ifs[i].vif_fd);
	vm->vm_ifs[i].vif_fd = -1;
}
free(vm->vm_ifs[i].vif_name);
free(vm->vm_ifs[i].vif_switch);
free(vm->vm_ifs[i].vif_group);
vm->vm_ifs[i].vif_name = NULL((void *)0);
vm->vm_ifs[i].vif_switch = NULL((void *)0);
vm->vm_ifs[i].vif_group = NULL((void *)0);
}
if (vm->vm_kernel != -1) {
close(vm->vm_kernel);
vm->vm_kernel = -1;
}
if (vm->vm_cdrom != -1) {
close(vm->vm_cdrom);
vm->vm_cdrom = -1;
}
if (!keeptty) {
vm_closetty(vm);
vm->vm_uid = 0;
}
1206}

1208void
1209vm_remove(struct vmd_vm *vm, const char *caller)
1210{
struct privsep	*ps = &env->vmd_ps;

if (vm7.1
'vm' is not equal to NULL
 == NULL((void *)0))
8
←
Taking false branch→
return;

log_debug("%s: %s %s removing vm %d from running config",
   __func__, ps->ps_title[privsep_process], caller,
   vm->vm_vmid);

TAILQ_REMOVE(env->vmd_vms, vm, vm_entry)do { if (((vm)->vm_entry.tqe_next) != ((void *)0)) (vm)->
vm_entry.tqe_next->vm_entry.tqe_prev = (vm)->vm_entry.tqe_prev
; else (env->vmd_vms)->tqh_last = (vm)->vm_entry.tqe_prev
; *(vm)->vm_entry.tqe_prev = (vm)->vm_entry.tqe_next; ;
 ; } while (0);
9
←
Assuming field 'tqe_next' is equal to null→
10
←
Taking false branch→
11
←
Loop condition is false.  Exiting loop→

user_put(vm->vm_user);
12
←
Calling 'user_put'→
22
←
Returning; memory was released via 1st parameter→
vm_stop(vm, 0, caller);
23
←
Calling 'vm_stop'→
free(vm);
1225}

1227int
1228vm_claimid(const char *name, int uid, uint32_t *id)
1229{
struct name2id *n2i = NULL((void *)0);

TAILQ_FOREACH(n2i, env->vmd_known, entry)for((n2i) = ((env->vmd_known)->tqh_first); (n2i) != ((void
 *)0); (n2i) = ((n2i)->entry.tqe_next))
if (strcmp(n2i->name, name) == 0 && n2i->uid == uid)
	goto out;

if (++env->vmd_nvm == 0) {
log_warnx("too many vms");
return -1;
}
if ((n2i = calloc(1, sizeof(struct name2id))) == NULL((void *)0)) {
log_warnx("could not alloc vm name");
return -1;
}
n2i->id = env->vmd_nvm;
n2i->uid = uid;
if (strlcpy(n2i->name, name, sizeof(n2i->name)) >= sizeof(n2i->name)) {
log_warnx("vm name too long");
free(n2i);
return -1;
}
TAILQ_INSERT_TAIL(env->vmd_known, n2i, entry)do { (n2i)->entry.tqe_next = ((void *)0); (n2i)->entry.
tqe_prev = (env->vmd_known)->tqh_last; *(env->vmd_known
)->tqh_last = (n2i); (env->vmd_known)->tqh_last = &
(n2i)->entry.tqe_next; } while (0);

1253out:
*id = n2i->id;
return 0;
1256}

1258int
1259vm_register(struct privsep *ps, struct vmop_create_params *vmc,
  struct vmd_vm **ret_vm, uint32_t id, uid_t uid)
1261{
struct vmd_vm		*vm = NULL((void *)0), *vm_parent = NULL((void *)0);
struct vm_create_params	*vcp = &vmc->vmc_params;
struct vmop_owner	*vmo = NULL((void *)0);
struct vmd_user		*usr = NULL((void *)0);
uint32_t		 nid, rng;
unsigned int		 i, j;
struct vmd_switch	*sw;
char			*s;
int			 ret = 0;

/* Check if this is an instance of another VM */
if ((ret = vm_instance(ps, &vm_parent, vmc, uid)) != 0) {
errno(*__errno()) = ret; /* XXX might set invalid errno */
return (-1);
}

errno(*__errno()) = 0;
*ret_vm = NULL((void *)0);

if ((vm = vm_getbyname(vcp->vcp_name)) != NULL((void *)0) ||
   (vm = vm_getbyvmid(vcp->vcp_id)) != NULL((void *)0)) {
if (vm_checkperm(vm, &vm->vm_params.vmc_owner,
    uid) != 0) {
	errno(*__errno()) = EPERM1;
	goto fail;
}
*ret_vm = vm;
errno(*__errno()) = EALREADY37;
goto fail;
}

if (vm_parent != NULL((void *)0))
vmo = &vm_parent->vm_params.vmc_insowner;

/* non-root users can only start existing VMs or instances */
if (vm_checkperm(NULL((void *)0), vmo, uid) != 0) {
log_warnx("permission denied");
errno(*__errno()) = EPERM1;
goto fail;
}
if (vmc->vmc_flags == 0) {
log_warnx("invalid configuration, no devices");
errno(*__errno()) = VMD_DISK_MISSING1002;
goto fail;
}
if (vcp->vcp_ncpus == 0)
vcp->vcp_ncpus = 1;
if (vcp->vcp_memranges[0].vmr_size == 0)
vcp->vcp_memranges[0].vmr_size = VM_DEFAULT_MEMORY512;
if (vcp->vcp_ncpus > VMM_MAX_VCPUS_PER_VM64) {
log_warnx("invalid number of CPUs");
goto fail;
} else if (vcp->vcp_ndisks > VMM_MAX_DISKS_PER_VM4) {
log_warnx("invalid number of disks");
goto fail;
} else if (vcp->vcp_nnics > VMM_MAX_NICS_PER_VM4) {
log_warnx("invalid number of interfaces");
goto fail;
} else if (strlen(vcp->vcp_kernel) == 0 &&
   vcp->vcp_ndisks == 0 && strlen(vcp->vcp_cdrom) == 0) {
log_warnx("no kernel or disk/cdrom specified");
goto fail;
} else if (strlen(vcp->vcp_name) == 0) {
log_warnx("invalid VM name");
goto fail;
} else if (*vcp->vcp_name == '-' || *vcp->vcp_name == '.' ||
   *vcp->vcp_name == '_') {
log_warnx("invalid VM name");
goto fail;
} else {
for (s = vcp->vcp_name; *s != '\0'; ++s) {
	if (!(isalnum(*s) || *s == '.' || *s == '-' ||
	    *s == '_')) {
		log_warnx("invalid VM name");
		goto fail;
	}
}
}

/* track active users */
if (uid != 0 && env->vmd_users != NULL((void *)0) &&
   (usr = user_get(uid)) == NULL((void *)0)) {
log_warnx("could not add user");
goto fail;
}

if ((vm = calloc(1, sizeof(*vm))) == NULL((void *)0))
goto fail;

memcpy(&vm->vm_params, vmc, sizeof(vm->vm_params));
vmc = &vm->vm_params;
vcp = &vmc->vmc_params;
vm->vm_pid = -1;
vm->vm_tty = -1;
vm->vm_receive_fd = -1;
vm->vm_state &= ~VM_STATE_PAUSED0x10;
vm->vm_user = usr;

for (i = 0; i < VMM_MAX_DISKS_PER_VM4; i++)
for (j = 0; j < VM_MAX_BASE_PER_DISK4; j++)
	vm->vm_disks[i][j] = -1;
for (i = 0; i < VMM_MAX_NICS_PER_VM4; i++)
vm->vm_ifs[i].vif_fd = -1;
for (i = 0; i < vcp->vcp_nnics; i++) {
if ((sw = switch_getbyname(vmc->vmc_ifswitch[i])) != NULL((void *)0)) {
	/* inherit per-interface flags from the switch */
	vmc->vmc_ifflags[i] |= (sw->sw_flags & VMIFF_OPTMASK(0x02|0x04|0x08));
}

/*
 * If the MAC address is zero, always randomize it in vmd(8)
 * because we cannot rely on the guest OS to do the right
 * thing like OpenBSD does.  Based on ether_fakeaddr()
 * from the kernel, incremented by one to differentiate
 * the source.
 */
if (memcmp(zero_mac, &vcp->vcp_macs[i], ETHER_ADDR_LEN6) == 0) {
	rng = arc4random();
	vcp->vcp_macs[i][0] = 0xfe;
	vcp->vcp_macs[i][1] = 0xe1;
	vcp->vcp_macs[i][2] = 0xba + 1;
	vcp->vcp_macs[i][3] = 0xd0 | ((i + 1) & 0xf);
	vcp->vcp_macs[i][4] = rng;
	vcp->vcp_macs[i][5] = rng >> 8;
}
}
vm->vm_kernel = -1;
vm->vm_cdrom = -1;
vm->vm_iev.ibuf.fd = -1;

/*
* Assign a new internal Id if not specified and we succeed in
* claiming a new Id.
*/
if (id != 0)
vm->vm_vmid = id;
else if (vm_claimid(vcp->vcp_name, uid, &nid) == -1)
goto fail;
else
vm->vm_vmid = nid;

log_debug("%s: registering vm %d", __func__, vm->vm_vmid);
TAILQ_INSERT_TAIL(env->vmd_vms, vm, vm_entry)do { (vm)->vm_entry.tqe_next = ((void *)0); (vm)->vm_entry
.tqe_prev = (env->vmd_vms)->tqh_last; *(env->vmd_vms
)->tqh_last = (vm); (env->vmd_vms)->tqh_last = &
(vm)->vm_entry.tqe_next; } while (0);

*ret_vm = vm;
return (0);
fail:
if (errno(*__errno()) == 0)
errno(*__errno()) = EINVAL22;
return (-1);
1412}

1414int
1415vm_instance(struct privsep *ps, struct vmd_vm **vm_parent,
  struct vmop_create_params *vmc, uid_t uid)
1417{
char			*name;
struct vm_create_params	*vcp = &vmc->vmc_params;
struct vmop_create_params *vmcp;
struct vm_create_params	*vcpp;
struct vmd_vm		*vm = NULL((void *)0);
unsigned int		 i, j;

/* return without error if the parent is NULL (nothing to inherit) */
if ((vmc->vmc_flags & VMOP_CREATE_INSTANCE0x40) == 0 ||
   vmc->vmc_instance[0] == '\0')
return (0);

if ((*vm_parent = vm_getbyname(vmc->vmc_instance)) == NULL((void *)0)) {
return (VMD_PARENT_INVALID1007);
}

vmcp = &(*vm_parent)->vm_params;
vcpp = &vmcp->vmc_params;

/* Are we allowed to create an instance from this VM? */
if (vm_checkperm(NULL((void *)0), &vmcp->vmc_insowner, uid) != 0) {
log_warnx("vm \"%s\" no permission to create vm instance",
    vcpp->vcp_name);
return (ENAMETOOLONG63);
}

name = vcp->vcp_name;

if ((vm = vm_getbyname(vcp->vcp_name)) != NULL((void *)0) ||
   (vm = vm_getbyvmid(vcp->vcp_id)) != NULL((void *)0)) {
return (EPROCLIM67);
}

/* CPU */
if (vcp->vcp_ncpus == 0)
vcp->vcp_ncpus = vcpp->vcp_ncpus;
if (vm_checkinsflag(vmcp, VMOP_CREATE_CPU0x01, uid) != 0 &&
   vcp->vcp_ncpus != vcpp->vcp_ncpus) {
log_warnx("vm \"%s\" no permission to set cpus", name);
return (EPERM1);
}

/* memory */
if (vcp->vcp_memranges[0].vmr_size == 0)
vcp->vcp_memranges[0].vmr_size =
    vcpp->vcp_memranges[0].vmr_size;
if (vm_checkinsflag(vmcp, VMOP_CREATE_MEMORY0x04, uid) != 0 &&
   vcp->vcp_memranges[0].vmr_size !=
   vcpp->vcp_memranges[0].vmr_size) {
log_warnx("vm \"%s\" no permission to set memory", name);
return (EPERM1);
}

/* disks cannot be inherited */
if (vm_checkinsflag(vmcp, VMOP_CREATE_DISK0x10, uid) != 0 &&
   vcp->vcp_ndisks) {
log_warnx("vm \"%s\" no permission to set disks", name);
return (EPERM1);
}
for (i = 0; i < vcp->vcp_ndisks; i++) {
/* Check if this disk is already used in the parent */
for (j = 0; j < vcpp->vcp_ndisks; j++) {
	if (strcmp(vcp->vcp_disks[i],
	    vcpp->vcp_disks[j]) == 0) {
		log_warnx("vm \"%s\" disk %s cannot be reused",
		    name, vcp->vcp_disks[i]);
		return (EBUSY16);
	}
}
vmc->vmc_checkaccess |= VMOP_CREATE_DISK0x10;
}

/* interfaces */
if (vcp->vcp_nnics > 0 &&
   vm_checkinsflag(vmcp, VMOP_CREATE_NETWORK0x08, uid) != 0 &&
   vcp->vcp_nnics != vcpp->vcp_nnics) {
log_warnx("vm \"%s\" no permission to set interfaces", name);
return (EPERM1);
}
for (i = 0; i < vcpp->vcp_nnics; i++) {
/* Interface got overwritten */
if (i < vcp->vcp_nnics)
	continue;

/* Copy interface from parent */
vmc->vmc_ifflags[i] = vmcp->vmc_ifflags[i];
(void)strlcpy(vmc->vmc_ifnames[i], vmcp->vmc_ifnames[i],
    sizeof(vmc->vmc_ifnames[i]));
(void)strlcpy(vmc->vmc_ifswitch[i], vmcp->vmc_ifswitch[i],
    sizeof(vmc->vmc_ifswitch[i]));
(void)strlcpy(vmc->vmc_ifgroup[i], vmcp->vmc_ifgroup[i],
    sizeof(vmc->vmc_ifgroup[i]));
memcpy(vcp->vcp_macs[i], vcpp->vcp_macs[i],
    sizeof(vcp->vcp_macs[i]));
vmc->vmc_ifrdomain[i] = vmcp->vmc_ifrdomain[i];
vcp->vcp_nnics++;
}
for (i = 0; i < vcp->vcp_nnics; i++) {
for (j = 0; j < vcpp->vcp_nnics; j++) {
	if (memcmp(zero_mac, vcp->vcp_macs[i],
	    sizeof(vcp->vcp_macs[i])) != 0 &&
	    memcmp(vcpp->vcp_macs[i], vcp->vcp_macs[i],
	    sizeof(vcp->vcp_macs[i])) != 0) {
		log_warnx("vm \"%s\" lladdr cannot be reused",
		    name);
		return (EBUSY16);
	}
	if (strlen(vmc->vmc_ifnames[i]) &&
	    strcmp(vmc->vmc_ifnames[i],
	    vmcp->vmc_ifnames[j]) == 0) {
		log_warnx("vm \"%s\" %s cannot be reused",
		    vmc->vmc_ifnames[i], name);
		return (EBUSY16);
	}
}
}

/* kernel */
if (strlen(vcp->vcp_kernel) > 0) {
if (vm_checkinsflag(vmcp, VMOP_CREATE_KERNEL0x02, uid) != 0) {
	log_warnx("vm \"%s\" no permission to set boot image",
	    name);
	return (EPERM1);
}
vmc->vmc_checkaccess |= VMOP_CREATE_KERNEL0x02;
} else if (strlcpy(vcp->vcp_kernel, vcpp->vcp_kernel,
   sizeof(vcp->vcp_kernel)) >= sizeof(vcp->vcp_kernel)) {
log_warnx("vm \"%s\" kernel name too long", name);
return (EINVAL22);
}

/* cdrom */
if (strlen(vcp->vcp_cdrom) > 0) {
if (vm_checkinsflag(vmcp, VMOP_CREATE_CDROM0x20, uid) != 0) {
	log_warnx("vm \"%s\" no permission to set cdrom", name);
	return (EPERM1);
}
vmc->vmc_checkaccess |= VMOP_CREATE_CDROM0x20;
} else if (strlcpy(vcp->vcp_cdrom, vcpp->vcp_cdrom,
   sizeof(vcp->vcp_cdrom)) >= sizeof(vcp->vcp_cdrom)) {
log_warnx("vm \"%s\" cdrom name too long", name);
return (EINVAL22);
}

/* user */
if (vmc->vmc_owner.uid == 0)
vmc->vmc_owner.uid = vmcp->vmc_owner.uid;
else if (vmc->vmc_owner.uid != uid &&
   vmc->vmc_owner.uid != vmcp->vmc_owner.uid) {
log_warnx("vm \"%s\" user mismatch", name);
return (EPERM1);
}

/* group */
if (vmc->vmc_owner.gid == 0)
vmc->vmc_owner.gid = vmcp->vmc_owner.gid;
else if (vmc->vmc_owner.gid != vmcp->vmc_owner.gid) {
log_warnx("vm \"%s\" group mismatch", name);
return (EPERM1);
}

/* child instances */
if (vmc->vmc_insflags) {
log_warnx("vm \"%s\" cannot change instance permissions", name);
return (EPERM1);
}
if (vmcp->vmc_insflags & VMOP_CREATE_INSTANCE0x40) {
vmc->vmc_insowner.gid = vmcp->vmc_insowner.gid;
vmc->vmc_insowner.uid = vmcp->vmc_insowner.gid;
vmc->vmc_insflags = vmcp->vmc_insflags;
} else {
vmc->vmc_insowner.gid = 0;
vmc->vmc_insowner.uid = 0;
vmc->vmc_insflags = 0;
}

/* finished, remove instance flags */
vmc->vmc_flags &= ~VMOP_CREATE_INSTANCE0x40;

return (0);
1598}

1600/*
* vm_checkperm
*
* Checks if the user represented by the 'uid' parameter is allowed to
* manipulate the VM described by the 'vm' parameter (or connect to said VM's
* console.)
*
* Parameters:
*  vm: the VM whose permission is to be checked
*  vmo: the required uid/gid to be checked
*  uid: the user ID of the user making the request
*
* Return values:
*   0: the permission should be granted
*  -1: the permission check failed (also returned if vm == null)
*/
1616int
1617vm_checkperm(struct vmd_vm *vm, struct vmop_owner *vmo, uid_t uid)
1618{
struct group	*gr;
struct passwd	*pw;
char		**grmem;

/* root has no restrictions */
if (uid == 0)
return (0);

if (vmo == NULL((void *)0))
return (-1);

/* check user */
if (vm == NULL((void *)0)) {
if  (vmo->uid == uid)
	return (0);
} else {
/*
 * check user of running vm (the owner of a running vm can
 * be different to (or more specific than) the configured owner.
 */
if (((vm->vm_state & VM_STATE_RUNNING0x01) && vm->vm_uid == uid) ||
    (!(vm->vm_state & VM_STATE_RUNNING0x01) && vmo->uid == uid))
	return (0);
}

/* check groups */
if (vmo->gid != -1) {
if ((pw = getpwuid(uid)) == NULL((void *)0))
	return (-1);
if (pw->pw_gid == vmo->gid)
	return (0);
if ((gr = getgrgid(vmo->gid)) != NULL((void *)0)) {
	for (grmem = gr->gr_mem; *grmem; grmem++)
		if (strcmp(*grmem, pw->pw_name) == 0)
			return (0);
}
}

return (-1);
1658}

1660/*
* vm_checkinsflag
*
* Checks wheter the non-root user is allowed to set an instance option.
*
* Parameters:
*  vmc: the VM create parameters
*  flag: the flag to be checked
*  uid: the user ID of the user making the request
*
* Return values:
*   0: the permission should be granted
*  -1: the permission check failed (also returned if vm == null)
*/
1674int
1675vm_checkinsflag(struct vmop_create_params *vmc, unsigned int flag, uid_t uid)
1676{
/* root has no restrictions */
if (uid == 0)
return (0);

if ((vmc->vmc_insflags & flag) == 0)
return (-1);

return (0);
1685}

1687/*
* vm_checkaccess
*
* Checks if the user represented by the 'uid' parameter is allowed to
* access the file described by the 'path' parameter.
*
* Parameters:
*  fd: the file descriptor of the opened file
*  uflag: check if the userid has access to the file
*  uid: the user ID of the user making the request
*  amode: the access flags of R_OK and W_OK
*
* Return values:
*   0: the permission should be granted
*  -1: the permission check failed
*/
1703int
1704vm_checkaccess(int fd, unsigned int uflag, uid_t uid, int amode)
1705{
struct group	*gr;
struct passwd	*pw;
char		**grmem;
struct stat	 st;
mode_t		 mode;

if (fd == -1)
return (-1);

/*
* File has to be accessible and a regular file
*/
if (fstat(fd, &st) == -1 || !S_ISREG(st.st_mode)((st.st_mode & 0170000) == 0100000))
return (-1);

/* root has no restrictions */
if (uid == 0 || uflag == 0)
return (0);

/* check other */
mode = amode & W_OK0x02 ? S_IWOTH0000002 : 0;
mode |= amode & R_OK0x04 ? S_IROTH0000004 : 0;
if ((st.st_mode & mode) == mode)
return (0);

/* check user */
mode = amode & W_OK0x02 ? S_IWUSR0000200 : 0;
mode |= amode & R_OK0x04 ? S_IRUSR0000400 : 0;
if (uid == st.st_uid && (st.st_mode & mode) == mode)
return (0);

/* check groups */
mode = amode & W_OK0x02 ? S_IWGRP0000020 : 0;
mode |= amode & R_OK0x04 ? S_IRGRP0000040 : 0;
if ((st.st_mode & mode) != mode)
return (-1);
if ((pw = getpwuid(uid)) == NULL((void *)0))
return (-1);
if (pw->pw_gid == st.st_gid)
return (0);
if ((gr = getgrgid(st.st_gid)) != NULL((void *)0)) {
for (grmem = gr->gr_mem; *grmem; grmem++)
	if (strcmp(*grmem, pw->pw_name) == 0)
		return (0);
}

return (-1);
1753}

1755int
1756vm_opentty(struct vmd_vm *vm)
1757{
struct ptmget		 ptm;
struct stat		 st;
struct group		*gr;
uid_t			 uid;
gid_t			 gid;
mode_t			 mode;
int			 on;

/*
* Open tty with pre-opened PTM fd
*/
if ((ioctl(env->vmd_ptmfd, PTMGET((unsigned long)0x40000000 | ((sizeof(struct ptmget) & 0x1fff
) << 16) | ((('t')) << 8) | ((1))), &ptm) == -1))
return (-1);

/*
* We use user ioctl(2) mode to pass break commands.
*/
on = 1;
if (ioctl(ptm.cfd, TIOCUCNTL((unsigned long)0x80000000 | ((sizeof(int) & 0x1fff) <<
 16) | ((('t')) << 8) | ((102))), &on) == -1)
fatal("could not enable user ioctl mode");

vm->vm_tty = ptm.cfd;
close(ptm.sfd);
if ((vm->vm_ttyname = strdup(ptm.sn)) == NULL((void *)0))
goto fail;

uid = vm->vm_uid;
gid = vm->vm_params.vmc_owner.gid;

if (vm->vm_params.vmc_owner.gid != -1) {
mode = 0660;
} else if ((gr = getgrnam("tty")) != NULL((void *)0)) {
gid = gr->gr_gid;
mode = 0620;
} else {
mode = 0600;
gid = 0;
}

log_debug("%s: vm %s tty %s uid %d gid %d mode %o",
   __func__, vm->vm_params.vmc_params.vcp_name,
   vm->vm_ttyname, uid, gid, mode);

/*
* Change ownership and mode of the tty as required.
* Loosely based on the implementation of sshpty.c
*/
if (stat(vm->vm_ttyname, &st) == -1)
goto fail;

if (st.st_uid != uid || st.st_gid != gid) {
if (chown(vm->vm_ttyname, uid, gid) == -1) {
	log_warn("chown %s %d %d failed, uid %d",
	    vm->vm_ttyname, uid, gid, getuid());

	/* Ignore failure on read-only filesystems */
	if (!((errno(*__errno()) == EROFS30) &&
	    (st.st_uid == uid || st.st_uid == 0)))
		goto fail;
}
}

if ((st.st_mode & (S_IRWXU0000700|S_IRWXG0000070|S_IRWXO0000007)) != mode) {
if (chmod(vm->vm_ttyname, mode) == -1) {
	log_warn("chmod %s %o failed, uid %d",
	    vm->vm_ttyname, mode, getuid());

	/* Ignore failure on read-only filesystems */
	if (!((errno(*__errno()) == EROFS30) &&
	    (st.st_uid == uid || st.st_uid == 0)))
		goto fail;
}
}

return (0);
fail:
vm_closetty(vm);
return (-1);
1836}

1838void
1839vm_closetty(struct vmd_vm *vm)
1840{
if (vm->vm_tty != -1) {
/* Release and close the tty */
if (fchown(vm->vm_tty, 0, 0) == -1)
	log_warn("chown %s 0 0 failed", vm->vm_ttyname);
if (fchmod(vm->vm_tty, 0666) == -1)
	log_warn("chmod %s 0666 failed", vm->vm_ttyname);
close(vm->vm_tty);
vm->vm_tty = -1;
}
free(vm->vm_ttyname);
vm->vm_ttyname = NULL((void *)0);
1852}

1854void
1855switch_remove(struct vmd_switch *vsw)
1856{
if (vsw == NULL((void *)0))
return;

TAILQ_REMOVE(env->vmd_switches, vsw, sw_entry)do { if (((vsw)->sw_entry.tqe_next) != ((void *)0)) (vsw)->
sw_entry.tqe_next->sw_entry.tqe_prev = (vsw)->sw_entry.
tqe_prev; else (env->vmd_switches)->tqh_last = (vsw)->
sw_entry.tqe_prev; *(vsw)->sw_entry.tqe_prev = (vsw)->sw_entry
.tqe_next; ; ; } while (0);

free(vsw->sw_group);
free(vsw->sw_name);
free(vsw);
1865}

1867struct vmd_switch *
1868switch_getbyname(const char *name)
1869{
struct vmd_switch	*vsw;

if (name == NULL((void *)0))
return (NULL((void *)0));
TAILQ_FOREACH(vsw, env->vmd_switches, sw_entry)for((vsw) = ((env->vmd_switches)->tqh_first); (vsw) != (
(void *)0); (vsw) = ((vsw)->sw_entry.tqe_next)) {
if (strcmp(vsw->sw_name, name) == 0)
	return (vsw);
}

return (NULL((void *)0));
1880}

1882struct vmd_user *
1883user_get(uid_t uid)
1884{
struct vmd_user		*usr;

if (uid == 0)
return (NULL((void *)0));

/* first try to find an existing user */
TAILQ_FOREACH(usr, env->vmd_users, usr_entry)for((usr) = ((env->vmd_users)->tqh_first); (usr) != ((void
 *)0); (usr) = ((usr)->usr_entry.tqe_next)) {
if (usr->usr_id.uid == uid)
	goto done;
}

if ((usr = calloc(1, sizeof(*usr))) == NULL((void *)0)) {
log_warn("could not allocate user");
return (NULL((void *)0));
}

usr->usr_id.uid = uid;
usr->usr_id.gid = -1;
TAILQ_INSERT_TAIL(env->vmd_users, usr, usr_entry)do { (usr)->usr_entry.tqe_next = ((void *)0); (usr)->usr_entry
.tqe_prev = (env->vmd_users)->tqh_last; *(env->vmd_users
)->tqh_last = (usr); (env->vmd_users)->tqh_last = &
(usr)->usr_entry.tqe_next; } while (0);

done:
DPRINTF("%s: uid %d #%d +",do {} while(0)
   __func__, usr->usr_id.uid, usr->usr_refcnt + 1)do {} while(0);
usr->usr_refcnt++;

return (usr);
1911}

1913void
1914user_put(struct vmd_user *usr)
1915{
if (usr == NULL((void *)0))
13
←
Assuming 'usr' is not equal to NULL→
14
←
Taking false branch→
return;

DPRINTF("%s: uid %d #%d -",do {} while(0)
15
←
Loop condition is false.  Exiting loop→
   __func__, usr->usr_id.uid, usr->usr_refcnt - 1)do {} while(0);

if (--usr->usr_refcnt > 0)
16
←
Assuming the condition is false→
17
←
Taking false branch→
return;

TAILQ_REMOVE(env->vmd_users, usr, usr_entry)do { if (((usr)->usr_entry.tqe_next) != ((void *)0)) (usr)
->usr_entry.tqe_next->usr_entry.tqe_prev = (usr)->usr_entry
.tqe_prev; else (env->vmd_users)->tqh_last = (usr)->
usr_entry.tqe_prev; *(usr)->usr_entry.tqe_prev = (usr)->
usr_entry.tqe_next; ; ; } while (0);
18
←
Assuming field 'tqe_next' is equal to null→
19
←
Taking false branch→
20
←
Loop condition is false.  Exiting loop→
free(usr);
21
←
Memory is released→
1927}

1929void
1930user_inc(struct vm_create_params *vcp, struct vmd_user *usr, int inc)
1931{
char	 mem[FMT_SCALED_STRSIZE7];

if (usr == NULL((void *)0))
return;

/* increment or decrement counters */
inc = inc ? 1 : -1;

usr->usr_maxcpu += vcp->vcp_ncpus * inc;
usr->usr_maxmem += vcp->vcp_memranges[0].vmr_size * inc;
usr->usr_maxifs += vcp->vcp_nnics * inc;

if (log_getverbose() > 1) {
(void)fmt_scaled(usr->usr_maxmem * 1024 * 1024, mem);
log_debug("%s: %c uid %d ref %d cpu %llu mem %s ifs %llu",
    __func__, inc == 1 ? '+' : '-',
    usr->usr_id.uid, usr->usr_refcnt,
    usr->usr_maxcpu, mem, usr->usr_maxifs);
}
1951}

1953int
1954user_checklimit(struct vmd_user *usr, struct vm_create_params *vcp)
1955{
const char	*limit = "";

/* XXX make the limits configurable */
if (usr->usr_maxcpu > VM_DEFAULT_USER_MAXCPU4) {
limit = "cpu ";
goto fail;
}
if (usr->usr_maxmem > VM_DEFAULT_USER_MAXMEM2048) {
limit = "memory ";
goto fail;
}
if (usr->usr_maxifs > VM_DEFAULT_USER_MAXIFS8) {
limit = "interface ";
goto fail;
}

return (0);

fail:
log_warnx("%s: user %d %slimit reached", vcp->vcp_name,
   usr->usr_id.uid, limit);
return (-1);
1978}

1980char *
1981get_string(uint8_t *ptr, size_t len)
1982{
size_t	 i;

for (i = 0; i < len; i++)
if (!isprint(ptr[i]))
	break;

return strndup(ptr, i);
1990}

1992uint32_t
1993prefixlen2mask(uint8_t prefixlen)
1994{
if (prefixlen == 0)
return (0);

if (prefixlen > 32)
prefixlen = 32;

return (htonl(0xffffffff << (32 - prefixlen))(__uint32_t)(__builtin_constant_p(0xffffffff << (32 - prefixlen
)) ? (__uint32_t)(((__uint32_t)(0xffffffff << (32 - prefixlen
)) & 0xff) << 24 | ((__uint32_t)(0xffffffff <<
 (32 - prefixlen)) & 0xff00) << 8 | ((__uint32_t)(0xffffffff
 << (32 - prefixlen)) & 0xff0000) >> 8 | ((__uint32_t
)(0xffffffff << (32 - prefixlen)) & 0xff000000) >>
 24) : __swap32md(0xffffffff << (32 - prefixlen))));
2002}

2004void
2005prefixlen2mask6(uint8_t prefixlen, struct in6_addr *mask)
2006{
struct in6_addr	 s6;
int		 i;

if (prefixlen > 128)
prefixlen = 128;

memset(&s6, 0, sizeof(s6));
for (i = 0; i < prefixlen / 8; i++)
s6.s6_addr__u6_addr.__u6_addr8[i] = 0xff;
i = prefixlen % 8;
if (i)
s6.s6_addr__u6_addr.__u6_addr8[prefixlen / 8] = 0xff00 >> i;

memcpy(mask, &s6, sizeof(s6));
2021}

2023void
2024getmonotime(struct timeval *tv)
2025{
struct timespec	 ts;

if (clock_gettime(CLOCK_MONOTONIC3, &ts))
fatal("clock_gettime");

TIMESPEC_TO_TIMEVAL(tv, &ts)do { (tv)->tv_sec = (&ts)->tv_sec; (tv)->tv_usec
 = (&ts)->tv_nsec / 1000; } while (0);
2032}