chardev/char.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "qemu/osdep.h"
  25 #include "qemu-common.h"
  26 #include "qemu/cutils.h"
  27 #include "monitor/monitor.h"
  28 #include "sysemu/sysemu.h"
  29 #include "sysemu/block-backend.h"
  30 #include "qemu/error-report.h"
  31 #include "qemu/timer.h"
  32 #include "sysemu/char.h"
  33 #include "hw/usb.h"
  34 #include "qmp-commands.h"
  35 #include "qapi/clone-visitor.h"
  36 #include "qapi-visit.h"
  37 #include "qemu/base64.h"
  38 #include "io/channel-socket.h"
  39 #include "io/channel-file.h"
  40 #include "io/channel-tls.h"
  41 #include "sysemu/replay.h"
  42 #include "qemu/help_option.h"
  43
  44 #include <zlib.h>
  45
  46 #ifndef _WIN32
  47 #include <sys/times.h>
  48 #include <sys/wait.h>
  49 #include <termios.h>
  50 #include <sys/ioctl.h>
  51 #include <sys/resource.h>
  52 #include <sys/socket.h>
  53 #include <netinet/in.h>
  54 #include <net/if.h>
  55 #include <arpa/inet.h>
  56 #include <netdb.h>
  57 #include <sys/select.h>
  58 #ifdef CONFIG_BSD
  59 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
  60 #include <dev/ppbus/ppi.h>
  61 #include <dev/ppbus/ppbconf.h>
  62 #elif defined(__DragonFly__)
  63 #include <dev/misc/ppi/ppi.h>
  64 #include <bus/ppbus/ppbconf.h>
  65 #endif
  66 #else
  67 #ifdef __linux__
  68 #include <linux/ppdev.h>
  69 #include <linux/parport.h>
  70 #endif
  71 #ifdef __sun__
  72 #include <sys/ethernet.h>
  73 #include <sys/sockio.h>
  74 #include <netinet/arp.h>
  75 #include <netinet/in.h>
  76 #include <netinet/in_systm.h>
  77 #include <netinet/ip.h>
  78 #include <netinet/ip_icmp.h> // must come after ip.h
  79 #include <netinet/udp.h>
  80 #include <netinet/tcp.h>
  81 #endif
  82 #endif
  83 #endif
  84
  85 #include "qemu/sockets.h"
  86 #include "ui/qemu-spice.h"
  87
  88 #include "char-mux.h"
  89
  90 #define TCP_MAX_FDS 16
  91
  92 /***********************************************************/
  93 /* Socket address helpers */
  94
  95 static char *SocketAddress_to_str(const char *prefix, SocketAddress *addr,
  96                                   bool is_listen, bool is_telnet)
  97 {
  98     switch (addr->type) {
  99     case SOCKET_ADDRESS_KIND_INET:
 100         return g_strdup_printf("%s%s:%s:%s%s", prefix,
 101                                is_telnet ? "telnet" : "tcp",
 102                                addr->u.inet.data->host,
 103                                addr->u.inet.data->port,
 104                                is_listen ? ",server" : "");
 105         break;
 106     case SOCKET_ADDRESS_KIND_UNIX:
 107         return g_strdup_printf("%sunix:%s%s", prefix,
 108                                addr->u.q_unix.data->path,
 109                                is_listen ? ",server" : "");
 110         break;
 111     case SOCKET_ADDRESS_KIND_FD:
 112         return g_strdup_printf("%sfd:%s%s", prefix, addr->u.fd.data->str,
 113                                is_listen ? ",server" : "");
 114         break;
 115     default:
 116         abort();
 117     }
 118 }
 119
 120 static char *sockaddr_to_str(struct sockaddr_storage *ss, socklen_t ss_len,
 121                              struct sockaddr_storage *ps, socklen_t ps_len,
 122                              bool is_listen, bool is_telnet)
 123 {
 124     char shost[NI_MAXHOST], sserv[NI_MAXSERV];
 125     char phost[NI_MAXHOST], pserv[NI_MAXSERV];
 126     const char *left = "", *right = "";
 127
 128     switch (ss->ss_family) {
 129 #ifndef _WIN32
 130     case AF_UNIX:
 131         return g_strdup_printf("unix:%s%s",
 132                                ((struct sockaddr_un *)(ss))->sun_path,
 133                                is_listen ? ",server" : "");
 134 #endif
 135     case AF_INET6:
 136         left  = "[";
 137         right = "]";
 138         /* fall through */
 139     case AF_INET:
 140         getnameinfo((struct sockaddr *) ss, ss_len, shost, sizeof(shost),
 141                     sserv, sizeof(sserv), NI_NUMERICHOST | NI_NUMERICSERV);
 142         getnameinfo((struct sockaddr *) ps, ps_len, phost, sizeof(phost),
 143                     pserv, sizeof(pserv), NI_NUMERICHOST | NI_NUMERICSERV);
 144         return g_strdup_printf("%s:%s%s%s:%s%s <-> %s%s%s:%s",
 145                                is_telnet ? "telnet" : "tcp",
 146                                left, shost, right, sserv,
 147                                is_listen ? ",server" : "",
 148                                left, phost, right, pserv);
 149
 150     default:
 151         return g_strdup_printf("unknown");
 152     }
 153 }
 154
 155 /***********************************************************/
 156 /* character device */
 157
 158 static QTAILQ_HEAD(ChardevHead, Chardev) chardevs =
 159     QTAILQ_HEAD_INITIALIZER(chardevs);
 160
 161 void qemu_chr_be_event(Chardev *s, int event)
 162 {
 163     CharBackend *be = s->be;
 164
 165     /* Keep track if the char device is open */
 166     switch (event) {
 167         case CHR_EVENT_OPENED:
 168             s->be_open = 1;
 169             break;
 170         case CHR_EVENT_CLOSED:
 171             s->be_open = 0;
 172             break;
 173     }
 174
 175     if (!be || !be->chr_event) {
 176         return;
 177     }
 178
 179     be->chr_event(be->opaque, event);
 180 }
 181
 182 void qemu_chr_be_generic_open(Chardev *s)
 183 {
 184     qemu_chr_be_event(s, CHR_EVENT_OPENED);
 185 }
 186
 187
 188 /* Not reporting errors from writing to logfile, as logs are
 189  * defined to be "best effort" only */
 190 static void qemu_chr_fe_write_log(Chardev *s,
 191                                   const uint8_t *buf, size_t len)
 192 {
 193     size_t done = 0;
 194     ssize_t ret;
 195
 196     if (s->logfd < 0) {
 197         return;
 198     }
 199
 200     while (done < len) {
 201     retry:
 202         ret = write(s->logfd, buf + done, len - done);
 203         if (ret == -1 && errno == EAGAIN) {
 204             g_usleep(100);
 205             goto retry;
 206         }
 207
 208         if (ret <= 0) {
 209             return;
 210         }
 211         done += ret;
 212     }
 213 }
 214
 215 static int qemu_chr_fe_write_buffer(Chardev *s,
 216                                     const uint8_t *buf, int len, int *offset)
 217 {
 218     ChardevClass *cc = CHARDEV_GET_CLASS(s);
 219     int res = 0;
 220     *offset = 0;
 221
 222     qemu_mutex_lock(&s->chr_write_lock);
 223     while (*offset < len) {
 224     retry:
 225         res = cc->chr_write(s, buf + *offset, len - *offset);
 226         if (res < 0 && errno == EAGAIN) {
 227             g_usleep(100);
 228             goto retry;
 229         }
 230
 231         if (res <= 0) {
 232             break;
 233         }
 234
 235         *offset += res;
 236     }
 237     if (*offset > 0) {
 238         qemu_chr_fe_write_log(s, buf, *offset);
 239     }
 240     qemu_mutex_unlock(&s->chr_write_lock);
 241
 242     return res;
 243 }
 244
 245 static bool qemu_chr_replay(Chardev *chr)
 246 {
 247     return qemu_chr_has_feature(chr, QEMU_CHAR_FEATURE_REPLAY);
 248 }
 249
 250 int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
 251 {
 252     Chardev *s = be->chr;
 253     ChardevClass *cc;
 254     int ret;
 255
 256     if (!s) {
 257         return 0;
 258     }
 259
 260     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
 261         int offset;
 262         replay_char_write_event_load(&ret, &offset);
 263         assert(offset <= len);
 264         qemu_chr_fe_write_buffer(s, buf, offset, &offset);
 265         return ret;
 266     }
 267
 268     cc = CHARDEV_GET_CLASS(s);
 269     qemu_mutex_lock(&s->chr_write_lock);
 270     ret = cc->chr_write(s, buf, len);
 271
 272     if (ret > 0) {
 273         qemu_chr_fe_write_log(s, buf, ret);
 274     }
 275
 276     qemu_mutex_unlock(&s->chr_write_lock);
 277
 278     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
 279         replay_char_write_event_save(ret, ret < 0 ? 0 : ret);
 280     }
 281
 282     return ret;
 283 }
 284
 285 int qemu_chr_write_all(Chardev *s, const uint8_t *buf, int len)
 286 {
 287     int offset;
 288     int res;
 289
 290     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
 291         replay_char_write_event_load(&res, &offset);
 292         assert(offset <= len);
 293         qemu_chr_fe_write_buffer(s, buf, offset, &offset);
 294         return res;
 295     }
 296
 297     res = qemu_chr_fe_write_buffer(s, buf, len, &offset);
 298
 299     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
 300         replay_char_write_event_save(res, offset);
 301     }
 302
 303     if (res < 0) {
 304         return res;
 305     }
 306     return offset;
 307 }
 308
 309 int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
 310 {
 311     Chardev *s = be->chr;
 312
 313     if (!s) {
 314         return 0;
 315     }
 316
 317     return qemu_chr_write_all(s, buf, len);
 318 }
 319
 320 int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len)
 321 {
 322     Chardev *s = be->chr;
 323     int offset = 0, counter = 10;
 324     int res;
 325
 326     if (!s || !CHARDEV_GET_CLASS(s)->chr_sync_read) {
 327         return 0;
 328     }
 329
 330     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
 331         return replay_char_read_all_load(buf);
 332     }
 333
 334     while (offset < len) {
 335     retry:
 336         res = CHARDEV_GET_CLASS(s)->chr_sync_read(s, buf + offset,
 337                                                   len - offset);
 338         if (res == -1 && errno == EAGAIN) {
 339             g_usleep(100);
 340             goto retry;
 341         }
 342
 343         if (res == 0) {
 344             break;
 345         }
 346
 347         if (res < 0) {
 348             if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
 349                 replay_char_read_all_save_error(res);
 350             }
 351             return res;
 352         }
 353
 354         offset += res;
 355
 356         if (!counter--) {
 357             break;
 358         }
 359     }
 360
 361     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_RECORD) {
 362         replay_char_read_all_save_buf(buf, offset);
 363     }
 364     return offset;
 365 }
 366
 367 int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg)
 368 {
 369     Chardev *s = be->chr;
 370     int res;
 371
 372     if (!s || !CHARDEV_GET_CLASS(s)->chr_ioctl || qemu_chr_replay(s)) {
 373         res = -ENOTSUP;
 374     } else {
 375         res = CHARDEV_GET_CLASS(s)->chr_ioctl(s, cmd, arg);
 376     }
 377
 378     return res;
 379 }
 380
 381 int qemu_chr_be_can_write(Chardev *s)
 382 {
 383     CharBackend *be = s->be;
 384
 385     if (!be || !be->chr_can_read) {
 386         return 0;
 387     }
 388
 389     return be->chr_can_read(be->opaque);
 390 }
 391
 392 void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len)
 393 {
 394     CharBackend *be = s->be;
 395
 396     if (be && be->chr_read) {
 397         be->chr_read(be->opaque, buf, len);
 398     }
 399 }
 400
 401 void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len)
 402 {
 403     if (qemu_chr_replay(s)) {
 404         if (replay_mode == REPLAY_MODE_PLAY) {
 405             return;
 406         }
 407         replay_chr_be_write(s, buf, len);
 408     } else {
 409         qemu_chr_be_write_impl(s, buf, len);
 410     }
 411 }
 412
 413 int qemu_chr_fe_get_msgfd(CharBackend *be)
 414 {
 415     Chardev *s = be->chr;
 416     int fd;
 417     int res = (qemu_chr_fe_get_msgfds(be, &fd, 1) == 1) ? fd : -1;
 418     if (s && qemu_chr_replay(s)) {
 419         error_report("Replay: get msgfd is not supported "
 420                      "for serial devices yet");
 421         exit(1);
 422     }
 423     return res;
 424 }
 425
 426 int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int len)
 427 {
 428     Chardev *s = be->chr;
 429
 430     if (!s) {
 431         return -1;
 432     }
 433
 434     return CHARDEV_GET_CLASS(s)->get_msgfds ?
 435         CHARDEV_GET_CLASS(s)->get_msgfds(s, fds, len) : -1;
 436 }
 437
 438 int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num)
 439 {
 440     Chardev *s = be->chr;
 441
 442     if (!s) {
 443         return -1;
 444     }
 445
 446     return CHARDEV_GET_CLASS(s)->set_msgfds ?
 447         CHARDEV_GET_CLASS(s)->set_msgfds(s, fds, num) : -1;
 448 }
 449
 450 int qemu_chr_add_client(Chardev *s, int fd)
 451 {
 452     return CHARDEV_GET_CLASS(s)->chr_add_client ?
 453         CHARDEV_GET_CLASS(s)->chr_add_client(s, fd) : -1;
 454 }
 455
 456 void qemu_chr_fe_accept_input(CharBackend *be)
 457 {
 458     Chardev *s = be->chr;
 459
 460     if (!s) {
 461         return;
 462     }
 463
 464     if (CHARDEV_GET_CLASS(s)->chr_accept_input) {
 465         CHARDEV_GET_CLASS(s)->chr_accept_input(s);
 466     }
 467     qemu_notify_event();
 468 }
 469
 470 void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
 471 {
 472     char buf[CHR_READ_BUF_LEN];
 473     va_list ap;
 474     va_start(ap, fmt);
 475     vsnprintf(buf, sizeof(buf), fmt, ap);
 476     /* XXX this blocks entire thread. Rewrite to use
 477      * qemu_chr_fe_write and background I/O callbacks */
 478     qemu_chr_fe_write_all(be, (uint8_t *)buf, strlen(buf));
 479     va_end(ap);
 480 }
 481
 482 static void remove_fd_in_watch(Chardev *chr);
 483
 484 static void qemu_char_open(Chardev *chr, ChardevBackend *backend,
 485                            bool *be_opened, Error **errp)
 486 {
 487     ChardevClass *cc = CHARDEV_GET_CLASS(chr);
 488     /* Any ChardevCommon member would work */
 489     ChardevCommon *common = backend ? backend->u.null.data : NULL;
 490
 491     if (common && common->has_logfile) {
 492         int flags = O_WRONLY | O_CREAT;
 493         if (common->has_logappend &&
 494             common->logappend) {
 495             flags |= O_APPEND;
 496         } else {
 497             flags |= O_TRUNC;
 498         }
 499         chr->logfd = qemu_open(common->logfile, flags, 0666);
 500         if (chr->logfd < 0) {
 501             error_setg_errno(errp, errno,
 502                              "Unable to open logfile %s",
 503                              common->logfile);
 504             return;
 505         }
 506     }
 507
 508     if (cc->open) {
 509         cc->open(chr, backend, be_opened, errp);
 510     }
 511 }
 512
 513 static void char_init(Object *obj)
 514 {
 515     Chardev *chr = CHARDEV(obj);
 516
 517     chr->logfd = -1;
 518     qemu_mutex_init(&chr->chr_write_lock);
 519 }
 520
 521 static int null_chr_write(Chardev *chr, const uint8_t *buf, int len)
 522 {
 523     return len;
 524 }
 525
 526 static void char_class_init(ObjectClass *oc, void *data)
 527 {
 528     ChardevClass *cc = CHARDEV_CLASS(oc);
 529
 530     cc->chr_write = null_chr_write;
 531 }
 532
 533 static void char_finalize(Object *obj)
 534 {
 535     Chardev *chr = CHARDEV(obj);
 536
 537     if (chr->be) {
 538         chr->be->chr = NULL;
 539     }
 540     g_free(chr->filename);
 541     g_free(chr->label);
 542     if (chr->logfd != -1) {
 543         close(chr->logfd);
 544     }
 545     qemu_mutex_destroy(&chr->chr_write_lock);
 546 }
 547
 548 static const TypeInfo char_type_info = {
 549     .name = TYPE_CHARDEV,
 550     .parent = TYPE_OBJECT,
 551     .instance_size = sizeof(Chardev),
 552     .instance_init = char_init,
 553     .instance_finalize = char_finalize,
 554     .abstract = true,
 555     .class_size = sizeof(ChardevClass),
 556     .class_init = char_class_init,
 557 };
 558
 559 /**
 560  * Called after processing of default and command-line-specified
 561  * chardevs to deliver CHR_EVENT_OPENED events to any FEs attached
 562  * to a mux chardev. This is done here to ensure that
 563  * output/prompts/banners are only displayed for the FE that has
 564  * focus when initial command-line processing/machine init is
 565  * completed.
 566  *
 567  * After this point, any new FE attached to any new or existing
 568  * mux will receive CHR_EVENT_OPENED notifications for the BE
 569  * immediately.
 570  */
 571 static void muxes_realize_done(Notifier *notifier, void *unused)
 572 {
 573     Chardev *chr;
 574
 575     QTAILQ_FOREACH(chr, &chardevs, next) {
 576         if (CHARDEV_IS_MUX(chr)) {
 577             MuxChardev *d = MUX_CHARDEV(chr);
 578             int i;
 579
 580             /* send OPENED to all already-attached FEs */
 581             for (i = 0; i < d->mux_cnt; i++) {
 582                 mux_chr_send_event(d, i, CHR_EVENT_OPENED);
 583             }
 584             /* mark mux as OPENED so any new FEs will immediately receive
 585              * OPENED event
 586              */
 587             qemu_chr_be_generic_open(chr);
 588         }
 589     }
 590     muxes_realized = true;
 591 }
 592
 593 static Notifier muxes_realize_notify = {
 594     .notify = muxes_realize_done,
 595 };
 596
 597 Chardev *qemu_chr_fe_get_driver(CharBackend *be)
 598 {
 599     return be->chr;
 600 }
 601
 602 bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp)
 603 {
 604     int tag = 0;
 605
 606     if (CHARDEV_IS_MUX(s)) {
 607         MuxChardev *d = MUX_CHARDEV(s);
 608
 609         if (d->mux_cnt >= MAX_MUX) {
 610             goto unavailable;
 611         }
 612
 613         d->backends[d->mux_cnt] = b;
 614         tag = d->mux_cnt++;
 615     } else if (s->be) {
 616         goto unavailable;
 617     } else {
 618         s->be = b;
 619     }
 620
 621     b->fe_open = false;
 622     b->tag = tag;
 623     b->chr = s;
 624     return true;
 625
 626 unavailable:
 627     error_setg(errp, QERR_DEVICE_IN_USE, s->label);
 628     return false;
 629 }
 630
 631 static bool qemu_chr_is_busy(Chardev *s)
 632 {
 633     if (CHARDEV_IS_MUX(s)) {
 634         MuxChardev *d = MUX_CHARDEV(s);
 635         return d->mux_cnt >= 0;
 636     } else {
 637         return s->be != NULL;
 638     }
 639 }
 640
 641 void qemu_chr_fe_deinit(CharBackend *b)
 642 {
 643     assert(b);
 644
 645     if (b->chr) {
 646         qemu_chr_fe_set_handlers(b, NULL, NULL, NULL, NULL, NULL, true);
 647         if (b->chr->be == b) {
 648             b->chr->be = NULL;
 649         }
 650         if (CHARDEV_IS_MUX(b->chr)) {
 651             MuxChardev *d = MUX_CHARDEV(b->chr);
 652             d->backends[b->tag] = NULL;
 653         }
 654         b->chr = NULL;
 655     }
 656 }
 657
 658 void qemu_chr_fe_set_handlers(CharBackend *b,
 659                               IOCanReadHandler *fd_can_read,
 660                               IOReadHandler *fd_read,
 661                               IOEventHandler *fd_event,
 662                               void *opaque,
 663                               GMainContext *context,
 664                               bool set_open)
 665 {
 666     Chardev *s;
 667     ChardevClass *cc;
 668     int fe_open;
 669
 670     s = b->chr;
 671     if (!s) {
 672         return;
 673     }
 674
 675     cc = CHARDEV_GET_CLASS(s);
 676     if (!opaque && !fd_can_read && !fd_read && !fd_event) {
 677         fe_open = 0;
 678         remove_fd_in_watch(s);
 679     } else {
 680         fe_open = 1;
 681     }
 682     b->chr_can_read = fd_can_read;
 683     b->chr_read = fd_read;
 684     b->chr_event = fd_event;
 685     b->opaque = opaque;
 686     if (cc->chr_update_read_handler) {
 687         cc->chr_update_read_handler(s, context);
 688     }
 689
 690     if (set_open) {
 691         qemu_chr_fe_set_open(b, fe_open);
 692     }
 693
 694     if (fe_open) {
 695         qemu_chr_fe_take_focus(b);
 696         /* We're connecting to an already opened device, so let's make sure we
 697            also get the open event */
 698         if (s->be_open) {
 699             qemu_chr_be_generic_open(s);
 700         }
 701     }
 702
 703     if (CHARDEV_IS_MUX(s)) {
 704         mux_chr_set_handlers(s, context);
 705     }
 706 }
 707
 708 void qemu_chr_fe_take_focus(CharBackend *b)
 709 {
 710     if (!b->chr) {
 711         return;
 712     }
 713
 714     if (CHARDEV_IS_MUX(b->chr)) {
 715         mux_set_focus(b->chr, b->tag);
 716     }
 717 }
 718
 719 typedef struct IOWatchPoll
 720 {
 721     GSource parent;
 722
 723     QIOChannel *ioc;
 724     GSource *src;
 725
 726     IOCanReadHandler *fd_can_read;
 727     GSourceFunc fd_read;
 728     void *opaque;
 729     GMainContext *context;
 730 } IOWatchPoll;
 731
 732 static IOWatchPoll *io_watch_poll_from_source(GSource *source)
 733 {
 734     return container_of(source, IOWatchPoll, parent);
 735 }
 736
 737 static gboolean io_watch_poll_prepare(GSource *source,
 738                                       gint *timeout_)
 739 {
 740     IOWatchPoll *iwp = io_watch_poll_from_source(source);
 741     bool now_active = iwp->fd_can_read(iwp->opaque) > 0;
 742     bool was_active = iwp->src != NULL;
 743     if (was_active == now_active) {
 744         return FALSE;
 745     }
 746
 747     if (now_active) {
 748         iwp->src = qio_channel_create_watch(
 749             iwp->ioc, G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL);
 750         g_source_set_callback(iwp->src, iwp->fd_read, iwp->opaque, NULL);
 751         g_source_attach(iwp->src, iwp->context);
 752     } else {
 753         g_source_destroy(iwp->src);
 754         g_source_unref(iwp->src);
 755         iwp->src = NULL;
 756     }
 757     return FALSE;
 758 }
 759
 760 static gboolean io_watch_poll_check(GSource *source)
 761 {
 762     return FALSE;
 763 }
 764
 765 static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
 766                                        gpointer user_data)
 767 {
 768     abort();
 769 }
 770
 771 static void io_watch_poll_finalize(GSource *source)
 772 {
 773     /* Due to a glib bug, removing the last reference to a source
 774      * inside a finalize callback causes recursive locking (and a
 775      * deadlock).  This is not a problem inside other callbacks,
 776      * including dispatch callbacks, so we call io_remove_watch_poll
 777      * to remove this source.  At this point, iwp->src must
 778      * be NULL, or we would leak it.
 779      *
 780      * This would be solved much more elegantly by child sources,
 781      * but we support older glib versions that do not have them.
 782      */
 783     IOWatchPoll *iwp = io_watch_poll_from_source(source);
 784     assert(iwp->src == NULL);
 785 }
 786
 787 static GSourceFuncs io_watch_poll_funcs = {
 788     .prepare = io_watch_poll_prepare,
 789     .check = io_watch_poll_check,
 790     .dispatch = io_watch_poll_dispatch,
 791     .finalize = io_watch_poll_finalize,
 792 };
 793
 794 /* Can only be used for read */
 795 static guint io_add_watch_poll(Chardev *chr,
 796                                QIOChannel *ioc,
 797                                IOCanReadHandler *fd_can_read,
 798                                QIOChannelFunc fd_read,
 799                                gpointer user_data,
 800                                GMainContext *context)
 801 {
 802     IOWatchPoll *iwp;
 803     int tag;
 804     char *name;
 805
 806     iwp = (IOWatchPoll *) g_source_new(&io_watch_poll_funcs,
 807                                        sizeof(IOWatchPoll));
 808     iwp->fd_can_read = fd_can_read;
 809     iwp->opaque = user_data;
 810     iwp->ioc = ioc;
 811     iwp->fd_read = (GSourceFunc) fd_read;
 812     iwp->src = NULL;
 813     iwp->context = context;
 814
 815     name = g_strdup_printf("chardev-iowatch-%s", chr->label);
 816     g_source_set_name((GSource *)iwp, name);
 817     g_free(name);
 818
 819     tag = g_source_attach(&iwp->parent, context);
 820     g_source_unref(&iwp->parent);
 821     return tag;
 822 }
 823
 824 static void io_remove_watch_poll(guint tag)
 825 {
 826     GSource *source;
 827     IOWatchPoll *iwp;
 828
 829     g_return_if_fail (tag > 0);
 830
 831     source = g_main_context_find_source_by_id(NULL, tag);
 832     g_return_if_fail (source != NULL);
 833
 834     iwp = io_watch_poll_from_source(source);
 835     if (iwp->src) {
 836         g_source_destroy(iwp->src);
 837         g_source_unref(iwp->src);
 838         iwp->src = NULL;
 839     }
 840     g_source_destroy(&iwp->parent);
 841 }
 842
 843 static void remove_fd_in_watch(Chardev *chr)
 844 {
 845     if (chr->fd_in_tag) {
 846         io_remove_watch_poll(chr->fd_in_tag);
 847         chr->fd_in_tag = 0;
 848     }
 849 }
 850
 851
 852 static int io_channel_send_full(QIOChannel *ioc,
 853                                 const void *buf, size_t len,
 854                                 int *fds, size_t nfds)
 855 {
 856     size_t offset = 0;
 857
 858     while (offset < len) {
 859         ssize_t ret = 0;
 860         struct iovec iov = { .iov_base = (char *)buf + offset,
 861                              .iov_len = len - offset };
 862
 863         ret = qio_channel_writev_full(
 864             ioc, &iov, 1,
 865             fds, nfds, NULL);
 866         if (ret == QIO_CHANNEL_ERR_BLOCK) {
 867             if (offset) {
 868                 return offset;
 869             }
 870
 871             errno = EAGAIN;
 872             return -1;
 873         } else if (ret < 0) {
 874             errno = EINVAL;
 875             return -1;
 876         }
 877
 878         offset += ret;
 879     }
 880
 881     return offset;
 882 }
 883
 884
 885 #ifndef _WIN32
 886 static int io_channel_send(QIOChannel *ioc, const void *buf, size_t len)
 887 {
 888     return io_channel_send_full(ioc, buf, len, NULL, 0);
 889 }
 890
 891 typedef struct FDChardev {
 892     Chardev parent;
 893     Chardev *chr;
 894     QIOChannel *ioc_in, *ioc_out;
 895     int max_size;
 896 } FDChardev;
 897
 898 #define TYPE_CHARDEV_FD "chardev-fd"
 899 #define FD_CHARDEV(obj) OBJECT_CHECK(FDChardev, (obj), TYPE_CHARDEV_FD)
 900
 901 /* Called with chr_write_lock held.  */
 902 static int fd_chr_write(Chardev *chr, const uint8_t *buf, int len)
 903 {
 904     FDChardev *s = FD_CHARDEV(chr);
 905
 906     return io_channel_send(s->ioc_out, buf, len);
 907 }
 908
 909 static gboolean fd_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
 910 {
 911     Chardev *chr = CHARDEV(opaque);
 912     FDChardev *s = FD_CHARDEV(opaque);
 913     int len;
 914     uint8_t buf[CHR_READ_BUF_LEN];
 915     ssize_t ret;
 916
 917     len = sizeof(buf);
 918     if (len > s->max_size) {
 919         len = s->max_size;
 920     }
 921     if (len == 0) {
 922         return TRUE;
 923     }
 924
 925     ret = qio_channel_read(
 926         chan, (gchar *)buf, len, NULL);
 927     if (ret == 0) {
 928         remove_fd_in_watch(chr);
 929         qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 930         return FALSE;
 931     }
 932     if (ret > 0) {
 933         qemu_chr_be_write(chr, buf, ret);
 934     }
 935
 936     return TRUE;
 937 }
 938
 939 static int fd_chr_read_poll(void *opaque)
 940 {
 941     Chardev *chr = CHARDEV(opaque);
 942     FDChardev *s = FD_CHARDEV(opaque);
 943
 944     s->max_size = qemu_chr_be_can_write(chr);
 945     return s->max_size;
 946 }
 947
 948 static GSource *fd_chr_add_watch(Chardev *chr, GIOCondition cond)
 949 {
 950     FDChardev *s = FD_CHARDEV(chr);
 951     return qio_channel_create_watch(s->ioc_out, cond);
 952 }
 953
 954 static void fd_chr_update_read_handler(Chardev *chr,
 955                                        GMainContext *context)
 956 {
 957     FDChardev *s = FD_CHARDEV(chr);
 958
 959     remove_fd_in_watch(chr);
 960     if (s->ioc_in) {
 961         chr->fd_in_tag = io_add_watch_poll(chr, s->ioc_in,
 962                                            fd_chr_read_poll,
 963                                            fd_chr_read, chr,
 964                                            context);
 965     }
 966 }
 967
 968 static void char_fd_finalize(Object *obj)
 969 {
 970     Chardev *chr = CHARDEV(obj);
 971     FDChardev *s = FD_CHARDEV(obj);
 972
 973     remove_fd_in_watch(chr);
 974     if (s->ioc_in) {
 975         object_unref(OBJECT(s->ioc_in));
 976     }
 977     if (s->ioc_out) {
 978         object_unref(OBJECT(s->ioc_out));
 979     }
 980
 981     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
 982 }
 983
 984 /* open a character device to a unix fd */
 985 static void qemu_chr_open_fd(Chardev *chr,
 986                              int fd_in, int fd_out)
 987 {
 988     FDChardev *s = FD_CHARDEV(chr);
 989     char *name;
 990
 991     s->ioc_in = QIO_CHANNEL(qio_channel_file_new_fd(fd_in));
 992     name = g_strdup_printf("chardev-file-in-%s", chr->label);
 993     qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
 994     g_free(name);
 995     s->ioc_out = QIO_CHANNEL(qio_channel_file_new_fd(fd_out));
 996     name = g_strdup_printf("chardev-file-out-%s", chr->label);
 997     qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
 998     g_free(name);
 999     qemu_set_nonblock(fd_out);
1000     s->chr = chr;
1001 }
1002
1003 static void char_fd_class_init(ObjectClass *oc, void *data)
1004 {
1005     ChardevClass *cc = CHARDEV_CLASS(oc);
1006
1007     cc->chr_add_watch = fd_chr_add_watch;
1008     cc->chr_write = fd_chr_write;
1009     cc->chr_update_read_handler = fd_chr_update_read_handler;
1010 }
1011
1012 static const TypeInfo char_fd_type_info = {
1013     .name = TYPE_CHARDEV_FD,
1014     .parent = TYPE_CHARDEV,
1015     .instance_size = sizeof(FDChardev),
1016     .instance_finalize = char_fd_finalize,
1017     .class_init = char_fd_class_init,
1018     .abstract = true,
1019 };
1020
1021 static void qemu_chr_open_pipe(Chardev *chr,
1022                                ChardevBackend *backend,
1023                                bool *be_opened,
1024                                Error **errp)
1025 {
1026     ChardevHostdev *opts = backend->u.pipe.data;
1027     int fd_in, fd_out;
1028     char *filename_in;
1029     char *filename_out;
1030     const char *filename = opts->device;
1031
1032     filename_in = g_strdup_printf("%s.in", filename);
1033     filename_out = g_strdup_printf("%s.out", filename);
1034     TFR(fd_in = qemu_open(filename_in, O_RDWR | O_BINARY));
1035     TFR(fd_out = qemu_open(filename_out, O_RDWR | O_BINARY));
1036     g_free(filename_in);
1037     g_free(filename_out);
1038     if (fd_in < 0 || fd_out < 0) {
1039         if (fd_in >= 0)
1040             close(fd_in);
1041         if (fd_out >= 0)
1042             close(fd_out);
1043         TFR(fd_in = fd_out = qemu_open(filename, O_RDWR | O_BINARY));
1044         if (fd_in < 0) {
1045             error_setg_file_open(errp, errno, filename);
1046             return;
1047         }
1048     }
1049     qemu_chr_open_fd(chr, fd_in, fd_out);
1050 }
1051
1052 /* init terminal so that we can grab keys */
1053 static struct termios oldtty;
1054 static int old_fd0_flags;
1055 static bool stdio_in_use;
1056 static bool stdio_allow_signal;
1057 static bool stdio_echo_state;
1058
1059 static void qemu_chr_set_echo_stdio(Chardev *chr, bool echo);
1060
1061 static void term_exit(void)
1062 {
1063     tcsetattr (0, TCSANOW, &oldtty);
1064     fcntl(0, F_SETFL, old_fd0_flags);
1065 }
1066
1067 static void term_stdio_handler(int sig)
1068 {
1069     /* restore echo after resume from suspend. */
1070     qemu_chr_set_echo_stdio(NULL, stdio_echo_state);
1071 }
1072
1073 static void qemu_chr_set_echo_stdio(Chardev *chr, bool echo)
1074 {
1075     struct termios tty;
1076
1077     stdio_echo_state = echo;
1078     tty = oldtty;
1079     if (!echo) {
1080         tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
1081                           |INLCR|IGNCR|ICRNL|IXON);
1082         tty.c_oflag |= OPOST;
1083         tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);
1084         tty.c_cflag &= ~(CSIZE|PARENB);
1085         tty.c_cflag |= CS8;
1086         tty.c_cc[VMIN] = 1;
1087         tty.c_cc[VTIME] = 0;
1088     }
1089     if (!stdio_allow_signal)
1090         tty.c_lflag &= ~ISIG;
1091
1092     tcsetattr (0, TCSANOW, &tty);
1093 }
1094
1095 static void char_stdio_finalize(Object *obj)
1096 {
1097     term_exit();
1098 }
1099
1100 static void qemu_chr_open_stdio(Chardev *chr,
1101                                 ChardevBackend *backend,
1102                                 bool *be_opened,
1103                                 Error **errp)
1104 {
1105     ChardevStdio *opts = backend->u.stdio.data;
1106     struct sigaction act;
1107
1108     if (is_daemonized()) {
1109         error_setg(errp, "cannot use stdio with -daemonize");
1110         return;
1111     }
1112
1113     if (stdio_in_use) {
1114         error_setg(errp, "cannot use stdio by multiple character devices");
1115         return;
1116     }
1117
1118     stdio_in_use = true;
1119     old_fd0_flags = fcntl(0, F_GETFL);
1120     tcgetattr(0, &oldtty);
1121     qemu_set_nonblock(0);
1122     atexit(term_exit);
1123
1124     memset(&act, 0, sizeof(act));
1125     act.sa_handler = term_stdio_handler;
1126     sigaction(SIGCONT, &act, NULL);
1127
1128     qemu_chr_open_fd(chr, 0, 1);
1129
1130     if (opts->has_signal) {
1131         stdio_allow_signal = opts->signal;
1132     }
1133     qemu_chr_set_echo_stdio(chr, false);
1134 }
1135
1136 #if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__) \
1137     || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) \
1138     || defined(__GLIBC__)
1139
1140 #define HAVE_CHARDEV_SERIAL 1
1141 #define HAVE_CHARDEV_PTY 1
1142
1143 typedef struct {
1144     Chardev parent;
1145     QIOChannel *ioc;
1146     int read_bytes;
1147
1148     /* Protected by the Chardev chr_write_lock.  */
1149     int connected;
1150     guint timer_tag;
1151     guint open_tag;
1152 } PtyChardev;
1153
1154 #define PTY_CHARDEV(obj) OBJECT_CHECK(PtyChardev, (obj), TYPE_CHARDEV_PTY)
1155
1156 static void pty_chr_update_read_handler_locked(Chardev *chr);
1157 static void pty_chr_state(Chardev *chr, int connected);
1158
1159 static gboolean pty_chr_timer(gpointer opaque)
1160 {
1161     struct Chardev *chr = CHARDEV(opaque);
1162     PtyChardev *s = PTY_CHARDEV(opaque);
1163
1164     qemu_mutex_lock(&chr->chr_write_lock);
1165     s->timer_tag = 0;
1166     s->open_tag = 0;
1167     if (!s->connected) {
1168         /* Next poll ... */
1169         pty_chr_update_read_handler_locked(chr);
1170     }
1171     qemu_mutex_unlock(&chr->chr_write_lock);
1172     return FALSE;
1173 }
1174
1175 /* Called with chr_write_lock held.  */
1176 static void pty_chr_rearm_timer(Chardev *chr, int ms)
1177 {
1178     PtyChardev *s = PTY_CHARDEV(chr);
1179     char *name;
1180
1181     if (s->timer_tag) {
1182         g_source_remove(s->timer_tag);
1183         s->timer_tag = 0;
1184     }
1185
1186     if (ms == 1000) {
1187         name = g_strdup_printf("pty-timer-secs-%s", chr->label);
1188         s->timer_tag = g_timeout_add_seconds(1, pty_chr_timer, chr);
1189     } else {
1190         name = g_strdup_printf("pty-timer-ms-%s", chr->label);
1191         s->timer_tag = g_timeout_add(ms, pty_chr_timer, chr);
1192     }
1193     g_source_set_name_by_id(s->timer_tag, name);
1194     g_free(name);
1195 }
1196
1197 /* Called with chr_write_lock held.  */
1198 static void pty_chr_update_read_handler_locked(Chardev *chr)
1199 {
1200     PtyChardev *s = PTY_CHARDEV(chr);
1201     GPollFD pfd;
1202     int rc;
1203     QIOChannelFile *fioc = QIO_CHANNEL_FILE(s->ioc);
1204
1205     pfd.fd = fioc->fd;
1206     pfd.events = G_IO_OUT;
1207     pfd.revents = 0;
1208     do {
1209         rc = g_poll(&pfd, 1, 0);
1210     } while (rc == -1 && errno == EINTR);
1211     assert(rc >= 0);
1212
1213     if (pfd.revents & G_IO_HUP) {
1214         pty_chr_state(chr, 0);
1215     } else {
1216         pty_chr_state(chr, 1);
1217     }
1218 }
1219
1220 static void pty_chr_update_read_handler(Chardev *chr,
1221                                         GMainContext *context)
1222 {
1223     qemu_mutex_lock(&chr->chr_write_lock);
1224     pty_chr_update_read_handler_locked(chr);
1225     qemu_mutex_unlock(&chr->chr_write_lock);
1226 }
1227
1228 /* Called with chr_write_lock held.  */
1229 static int char_pty_chr_write(Chardev *chr, const uint8_t *buf, int len)
1230 {
1231     PtyChardev *s = PTY_CHARDEV(chr);
1232
1233     if (!s->connected) {
1234         /* guest sends data, check for (re-)connect */
1235         pty_chr_update_read_handler_locked(chr);
1236         if (!s->connected) {
1237             return 0;
1238         }
1239     }
1240     return io_channel_send(s->ioc, buf, len);
1241 }
1242
1243 static GSource *pty_chr_add_watch(Chardev *chr, GIOCondition cond)
1244 {
1245     PtyChardev *s = PTY_CHARDEV(chr);
1246     if (!s->connected) {
1247         return NULL;
1248     }
1249     return qio_channel_create_watch(s->ioc, cond);
1250 }
1251
1252 static int pty_chr_read_poll(void *opaque)
1253 {
1254     Chardev *chr = CHARDEV(opaque);
1255     PtyChardev *s = PTY_CHARDEV(opaque);
1256
1257     s->read_bytes = qemu_chr_be_can_write(chr);
1258     return s->read_bytes;
1259 }
1260
1261 static gboolean pty_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
1262 {
1263     Chardev *chr = CHARDEV(opaque);
1264     PtyChardev *s = PTY_CHARDEV(opaque);
1265     gsize len;
1266     uint8_t buf[CHR_READ_BUF_LEN];
1267     ssize_t ret;
1268
1269     len = sizeof(buf);
1270     if (len > s->read_bytes)
1271         len = s->read_bytes;
1272     if (len == 0) {
1273         return TRUE;
1274     }
1275     ret = qio_channel_read(s->ioc, (char *)buf, len, NULL);
1276     if (ret <= 0) {
1277         pty_chr_state(chr, 0);
1278         return FALSE;
1279     } else {
1280         pty_chr_state(chr, 1);
1281         qemu_chr_be_write(chr, buf, ret);
1282     }
1283     return TRUE;
1284 }
1285
1286 static gboolean qemu_chr_be_generic_open_func(gpointer opaque)
1287 {
1288     Chardev *chr = CHARDEV(opaque);
1289     PtyChardev *s = PTY_CHARDEV(opaque);
1290
1291     s->open_tag = 0;
1292     qemu_chr_be_generic_open(chr);
1293     return FALSE;
1294 }
1295
1296 /* Called with chr_write_lock held.  */
1297 static void pty_chr_state(Chardev *chr, int connected)
1298 {
1299     PtyChardev *s = PTY_CHARDEV(chr);
1300
1301     if (!connected) {
1302         if (s->open_tag) {
1303             g_source_remove(s->open_tag);
1304             s->open_tag = 0;
1305         }
1306         remove_fd_in_watch(chr);
1307         s->connected = 0;
1308         /* (re-)connect poll interval for idle guests: once per second.
1309          * We check more frequently in case the guests sends data to
1310          * the virtual device linked to our pty. */
1311         pty_chr_rearm_timer(chr, 1000);
1312     } else {
1313         if (s->timer_tag) {
1314             g_source_remove(s->timer_tag);
1315             s->timer_tag = 0;
1316         }
1317         if (!s->connected) {
1318             g_assert(s->open_tag == 0);
1319             s->connected = 1;
1320             s->open_tag = g_idle_add(qemu_chr_be_generic_open_func, chr);
1321         }
1322         if (!chr->fd_in_tag) {
1323             chr->fd_in_tag = io_add_watch_poll(chr, s->ioc,
1324                                                pty_chr_read_poll,
1325                                                pty_chr_read,
1326                                                chr, NULL);
1327         }
1328     }
1329 }
1330
1331 static void char_pty_finalize(Object *obj)
1332 {
1333     Chardev *chr = CHARDEV(obj);
1334     PtyChardev *s = PTY_CHARDEV(obj);
1335
1336     qemu_mutex_lock(&chr->chr_write_lock);
1337     pty_chr_state(chr, 0);
1338     object_unref(OBJECT(s->ioc));
1339     if (s->timer_tag) {
1340         g_source_remove(s->timer_tag);
1341         s->timer_tag = 0;
1342     }
1343     qemu_mutex_unlock(&chr->chr_write_lock);
1344     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
1345 }
1346
1347 static void char_pty_open(Chardev *chr,
1348                           ChardevBackend *backend,
1349                           bool *be_opened,
1350                           Error **errp)
1351 {
1352     PtyChardev *s;
1353     int master_fd, slave_fd;
1354     char pty_name[PATH_MAX];
1355     char *name;
1356
1357     master_fd = qemu_openpty_raw(&slave_fd, pty_name);
1358     if (master_fd < 0) {
1359         error_setg_errno(errp, errno, "Failed to create PTY");
1360         return;
1361     }
1362
1363     close(slave_fd);
1364     qemu_set_nonblock(master_fd);
1365
1366     chr->filename = g_strdup_printf("pty:%s", pty_name);
1367     error_report("char device redirected to %s (label %s)",
1368                  pty_name, chr->label);
1369
1370     s = PTY_CHARDEV(chr);
1371     s->ioc = QIO_CHANNEL(qio_channel_file_new_fd(master_fd));
1372     name = g_strdup_printf("chardev-pty-%s", chr->label);
1373     qio_channel_set_name(QIO_CHANNEL(s->ioc), name);
1374     g_free(name);
1375     s->timer_tag = 0;
1376     *be_opened = false;
1377 }
1378
1379 static void char_pty_class_init(ObjectClass *oc, void *data)
1380 {
1381     ChardevClass *cc = CHARDEV_CLASS(oc);
1382
1383     cc->open = char_pty_open;
1384     cc->chr_write = char_pty_chr_write;
1385     cc->chr_update_read_handler = pty_chr_update_read_handler;
1386     cc->chr_add_watch = pty_chr_add_watch;
1387 }
1388
1389 static const TypeInfo char_pty_type_info = {
1390     .name = TYPE_CHARDEV_PTY,
1391     .parent = TYPE_CHARDEV,
1392     .instance_size = sizeof(PtyChardev),
1393     .instance_finalize = char_pty_finalize,
1394     .class_init = char_pty_class_init,
1395 };
1396
1397 static void tty_serial_init(int fd, int speed,
1398                             int parity, int data_bits, int stop_bits)
1399 {
1400     struct termios tty;
1401     speed_t spd;
1402
1403 #if 0
1404     printf("tty_serial_init: speed=%d parity=%c data=%d stop=%d\n",
1405            speed, parity, data_bits, stop_bits);
1406 #endif
1407     tcgetattr (fd, &tty);
1408
1409 #define check_speed(val) if (speed <= val) { spd = B##val; break; }
1410     speed = speed * 10 / 11;
1411     do {
1412         check_speed(50);
1413         check_speed(75);
1414         check_speed(110);
1415         check_speed(134);
1416         check_speed(150);
1417         check_speed(200);
1418         check_speed(300);
1419         check_speed(600);
1420         check_speed(1200);
1421         check_speed(1800);
1422         check_speed(2400);
1423         check_speed(4800);
1424         check_speed(9600);
1425         check_speed(19200);
1426         check_speed(38400);
1427         /* Non-Posix values follow. They may be unsupported on some systems. */
1428         check_speed(57600);
1429         check_speed(115200);
1430 #ifdef B230400
1431         check_speed(230400);
1432 #endif
1433 #ifdef B460800
1434         check_speed(460800);
1435 #endif
1436 #ifdef B500000
1437         check_speed(500000);
1438 #endif
1439 #ifdef B576000
1440         check_speed(576000);
1441 #endif
1442 #ifdef B921600
1443         check_speed(921600);
1444 #endif
1445 #ifdef B1000000
1446         check_speed(1000000);
1447 #endif
1448 #ifdef B1152000
1449         check_speed(1152000);
1450 #endif
1451 #ifdef B1500000
1452         check_speed(1500000);
1453 #endif
1454 #ifdef B2000000
1455         check_speed(2000000);
1456 #endif
1457 #ifdef B2500000
1458         check_speed(2500000);
1459 #endif
1460 #ifdef B3000000
1461         check_speed(3000000);
1462 #endif
1463 #ifdef B3500000
1464         check_speed(3500000);
1465 #endif
1466 #ifdef B4000000
1467         check_speed(4000000);
1468 #endif
1469         spd = B115200;
1470     } while (0);
1471
1472     cfsetispeed(&tty, spd);
1473     cfsetospeed(&tty, spd);
1474
1475     tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
1476                           |INLCR|IGNCR|ICRNL|IXON);
1477     tty.c_oflag |= OPOST;
1478     tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN|ISIG);
1479     tty.c_cflag &= ~(CSIZE|PARENB|PARODD|CRTSCTS|CSTOPB);
1480     switch(data_bits) {
1481     default:
1482     case 8:
1483         tty.c_cflag |= CS8;
1484         break;
1485     case 7:
1486         tty.c_cflag |= CS7;
1487         break;
1488     case 6:
1489         tty.c_cflag |= CS6;
1490         break;
1491     case 5:
1492         tty.c_cflag |= CS5;
1493         break;
1494     }
1495     switch(parity) {
1496     default:
1497     case 'N':
1498         break;
1499     case 'E':
1500         tty.c_cflag |= PARENB;
1501         break;
1502     case 'O':
1503         tty.c_cflag |= PARENB | PARODD;
1504         break;
1505     }
1506     if (stop_bits == 2)
1507         tty.c_cflag |= CSTOPB;
1508
1509     tcsetattr (fd, TCSANOW, &tty);
1510 }
1511
1512 static int tty_serial_ioctl(Chardev *chr, int cmd, void *arg)
1513 {
1514     FDChardev *s = FD_CHARDEV(chr);
1515     QIOChannelFile *fioc = QIO_CHANNEL_FILE(s->ioc_in);
1516
1517     switch(cmd) {
1518     case CHR_IOCTL_SERIAL_SET_PARAMS:
1519         {
1520             QEMUSerialSetParams *ssp = arg;
1521             tty_serial_init(fioc->fd,
1522                             ssp->speed, ssp->parity,
1523                             ssp->data_bits, ssp->stop_bits);
1524         }
1525         break;
1526     case CHR_IOCTL_SERIAL_SET_BREAK:
1527         {
1528             int enable = *(int *)arg;
1529             if (enable) {
1530                 tcsendbreak(fioc->fd, 1);
1531             }
1532         }
1533         break;
1534     case CHR_IOCTL_SERIAL_GET_TIOCM:
1535         {
1536             int sarg = 0;
1537             int *targ = (int *)arg;
1538             ioctl(fioc->fd, TIOCMGET, &sarg);
1539             *targ = 0;
1540             if (sarg & TIOCM_CTS)
1541                 *targ |= CHR_TIOCM_CTS;
1542             if (sarg & TIOCM_CAR)
1543                 *targ |= CHR_TIOCM_CAR;
1544             if (sarg & TIOCM_DSR)
1545                 *targ |= CHR_TIOCM_DSR;
1546             if (sarg & TIOCM_RI)
1547                 *targ |= CHR_TIOCM_RI;
1548             if (sarg & TIOCM_DTR)
1549                 *targ |= CHR_TIOCM_DTR;
1550             if (sarg & TIOCM_RTS)
1551                 *targ |= CHR_TIOCM_RTS;
1552         }
1553         break;
1554     case CHR_IOCTL_SERIAL_SET_TIOCM:
1555         {
1556             int sarg = *(int *)arg;
1557             int targ = 0;
1558             ioctl(fioc->fd, TIOCMGET, &targ);
1559             targ &= ~(CHR_TIOCM_CTS | CHR_TIOCM_CAR | CHR_TIOCM_DSR
1560                      | CHR_TIOCM_RI | CHR_TIOCM_DTR | CHR_TIOCM_RTS);
1561             if (sarg & CHR_TIOCM_CTS)
1562                 targ |= TIOCM_CTS;
1563             if (sarg & CHR_TIOCM_CAR)
1564                 targ |= TIOCM_CAR;
1565             if (sarg & CHR_TIOCM_DSR)
1566                 targ |= TIOCM_DSR;
1567             if (sarg & CHR_TIOCM_RI)
1568                 targ |= TIOCM_RI;
1569             if (sarg & CHR_TIOCM_DTR)
1570                 targ |= TIOCM_DTR;
1571             if (sarg & CHR_TIOCM_RTS)
1572                 targ |= TIOCM_RTS;
1573             ioctl(fioc->fd, TIOCMSET, &targ);
1574         }
1575         break;
1576     default:
1577         return -ENOTSUP;
1578     }
1579     return 0;
1580 }
1581 #endif /* __linux__ || __sun__ */
1582
1583 #if defined(__linux__)
1584
1585 #define HAVE_CHARDEV_PARPORT 1
1586
1587 typedef struct {
1588     Chardev parent;
1589     int fd;
1590     int mode;
1591 } ParallelChardev;
1592
1593 #define PARALLEL_CHARDEV(obj) \
1594     OBJECT_CHECK(ParallelChardev, (obj), TYPE_CHARDEV_PARALLEL)
1595
1596 static int pp_hw_mode(ParallelChardev *s, uint16_t mode)
1597 {
1598     if (s->mode != mode) {
1599         int m = mode;
1600         if (ioctl(s->fd, PPSETMODE, &m) < 0)
1601             return 0;
1602         s->mode = mode;
1603     }
1604     return 1;
1605 }
1606
1607 static int pp_ioctl(Chardev *chr, int cmd, void *arg)
1608 {
1609     ParallelChardev *drv = PARALLEL_CHARDEV(chr);
1610     int fd = drv->fd;
1611     uint8_t b;
1612
1613     switch(cmd) {
1614     case CHR_IOCTL_PP_READ_DATA:
1615         if (ioctl(fd, PPRDATA, &b) < 0)
1616             return -ENOTSUP;
1617         *(uint8_t *)arg = b;
1618         break;
1619     case CHR_IOCTL_PP_WRITE_DATA:
1620         b = *(uint8_t *)arg;
1621         if (ioctl(fd, PPWDATA, &b) < 0)
1622             return -ENOTSUP;
1623         break;
1624     case CHR_IOCTL_PP_READ_CONTROL:
1625         if (ioctl(fd, PPRCONTROL, &b) < 0)
1626             return -ENOTSUP;
1627         /* Linux gives only the lowest bits, and no way to know data
1628            direction! For better compatibility set the fixed upper
1629            bits. */
1630         *(uint8_t *)arg = b | 0xc0;
1631         break;
1632     case CHR_IOCTL_PP_WRITE_CONTROL:
1633         b = *(uint8_t *)arg;
1634         if (ioctl(fd, PPWCONTROL, &b) < 0)
1635             return -ENOTSUP;
1636         break;
1637     case CHR_IOCTL_PP_READ_STATUS:
1638         if (ioctl(fd, PPRSTATUS, &b) < 0)
1639             return -ENOTSUP;
1640         *(uint8_t *)arg = b;
1641         break;
1642     case CHR_IOCTL_PP_DATA_DIR:
1643         if (ioctl(fd, PPDATADIR, (int *)arg) < 0)
1644             return -ENOTSUP;
1645         break;
1646     case CHR_IOCTL_PP_EPP_READ_ADDR:
1647         if (pp_hw_mode(drv, IEEE1284_MODE_EPP|IEEE1284_ADDR)) {
1648             struct ParallelIOArg *parg = arg;
1649             int n = read(fd, parg->buffer, parg->count);
1650             if (n != parg->count) {
1651                 return -EIO;
1652             }
1653         }
1654         break;
1655     case CHR_IOCTL_PP_EPP_READ:
1656         if (pp_hw_mode(drv, IEEE1284_MODE_EPP)) {
1657             struct ParallelIOArg *parg = arg;
1658             int n = read(fd, parg->buffer, parg->count);
1659             if (n != parg->count) {
1660                 return -EIO;
1661             }
1662         }
1663         break;
1664     case CHR_IOCTL_PP_EPP_WRITE_ADDR:
1665         if (pp_hw_mode(drv, IEEE1284_MODE_EPP|IEEE1284_ADDR)) {
1666             struct ParallelIOArg *parg = arg;
1667             int n = write(fd, parg->buffer, parg->count);
1668             if (n != parg->count) {
1669                 return -EIO;
1670             }
1671         }
1672         break;
1673     case CHR_IOCTL_PP_EPP_WRITE:
1674         if (pp_hw_mode(drv, IEEE1284_MODE_EPP)) {
1675             struct ParallelIOArg *parg = arg;
1676             int n = write(fd, parg->buffer, parg->count);
1677             if (n != parg->count) {
1678                 return -EIO;
1679             }
1680         }
1681         break;
1682     default:
1683         return -ENOTSUP;
1684     }
1685     return 0;
1686 }
1687
1688 static void qemu_chr_open_pp_fd(Chardev *chr,
1689                                 int fd,
1690                                 bool *be_opened,
1691                                 Error **errp)
1692 {
1693     ParallelChardev *drv = PARALLEL_CHARDEV(chr);
1694
1695     if (ioctl(fd, PPCLAIM) < 0) {
1696         error_setg_errno(errp, errno, "not a parallel port");
1697         close(fd);
1698         return;
1699     }
1700
1701     drv->fd = fd;
1702     drv->mode = IEEE1284_MODE_COMPAT;
1703 }
1704 #endif /* __linux__ */
1705
1706 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
1707
1708 #define HAVE_CHARDEV_PARPORT 1
1709
1710 typedef struct {
1711     Chardev parent;
1712     int fd;
1713 } ParallelChardev;
1714
1715 #define PARALLEL_CHARDEV(obj)                                   \
1716     OBJECT_CHECK(ParallelChardev, (obj), TYPE_CHARDEV_PARALLEL)
1717
1718 static int pp_ioctl(Chardev *chr, int cmd, void *arg)
1719 {
1720     ParallelChardev *drv = PARALLEL_CHARDEV(chr);
1721     uint8_t b;
1722
1723     switch (cmd) {
1724     case CHR_IOCTL_PP_READ_DATA:
1725         if (ioctl(drv->fd, PPIGDATA, &b) < 0) {
1726             return -ENOTSUP;
1727         }
1728         *(uint8_t *)arg = b;
1729         break;
1730     case CHR_IOCTL_PP_WRITE_DATA:
1731         b = *(uint8_t *)arg;
1732         if (ioctl(drv->fd, PPISDATA, &b) < 0) {
1733             return -ENOTSUP;
1734         }
1735         break;
1736     case CHR_IOCTL_PP_READ_CONTROL:
1737         if (ioctl(drv->fd, PPIGCTRL, &b) < 0) {
1738             return -ENOTSUP;
1739         }
1740         *(uint8_t *)arg = b;
1741         break;
1742     case CHR_IOCTL_PP_WRITE_CONTROL:
1743         b = *(uint8_t *)arg;
1744         if (ioctl(drv->fd, PPISCTRL, &b) < 0) {
1745             return -ENOTSUP;
1746         }
1747         break;
1748     case CHR_IOCTL_PP_READ_STATUS:
1749         if (ioctl(drv->fd, PPIGSTATUS, &b) < 0) {
1750             return -ENOTSUP;
1751         }
1752         *(uint8_t *)arg = b;
1753         break;
1754     default:
1755         return -ENOTSUP;
1756     }
1757     return 0;
1758 }
1759
1760 static void qemu_chr_open_pp_fd(Chardev *chr,
1761                                 int fd,
1762                                 bool *be_opened,
1763                                 Error **errp)
1764 {
1765     ParallelChardev *drv = PARALLEL_CHARDEV(chr);
1766     drv->fd = fd;
1767     *be_opened = false;
1768 }
1769 #endif
1770
1771 #else /* _WIN32 */
1772
1773 #define HAVE_CHARDEV_SERIAL 1
1774
1775 typedef struct {
1776     Chardev parent;
1777     int max_size;
1778     HANDLE hcom, hrecv, hsend;
1779     OVERLAPPED orecv;
1780     BOOL fpipe;
1781     DWORD len;
1782
1783     /* Protected by the Chardev chr_write_lock.  */
1784     OVERLAPPED osend;
1785     /* FIXME: file/console do not finalize */
1786     bool skip_free;
1787 } WinChardev;
1788
1789 #define TYPE_CHARDEV_WIN "chardev-win"
1790 #define WIN_CHARDEV(obj) OBJECT_CHECK(WinChardev, (obj), TYPE_CHARDEV_WIN)
1791
1792 typedef struct {
1793     Chardev parent;
1794     HANDLE  hStdIn;
1795     HANDLE  hInputReadyEvent;
1796     HANDLE  hInputDoneEvent;
1797     HANDLE  hInputThread;
1798     uint8_t win_stdio_buf;
1799 } WinStdioChardev;
1800
1801 #define TYPE_CHARDEV_WIN_STDIO "chardev-win-stdio"
1802 #define WIN_STDIO_CHARDEV(obj)                                  \
1803     OBJECT_CHECK(WinStdioChardev, (obj), TYPE_CHARDEV_WIN_STDIO)
1804
1805 #define NSENDBUF 2048
1806 #define NRECVBUF 2048
1807 #define MAXCONNECT 1
1808 #define NTIMEOUT 5000
1809
1810 static int win_chr_poll(void *opaque);
1811 static int win_chr_pipe_poll(void *opaque);
1812
1813 static void char_win_finalize(Object *obj)
1814 {
1815     Chardev *chr = CHARDEV(obj);
1816     WinChardev *s = WIN_CHARDEV(chr);
1817
1818     if (s->skip_free) {
1819         return;
1820     }
1821
1822     if (s->hsend) {
1823         CloseHandle(s->hsend);
1824     }
1825     if (s->hrecv) {
1826         CloseHandle(s->hrecv);
1827     }
1828     if (s->hcom) {
1829         CloseHandle(s->hcom);
1830     }
1831     if (s->fpipe)
1832         qemu_del_polling_cb(win_chr_pipe_poll, chr);
1833     else
1834         qemu_del_polling_cb(win_chr_poll, chr);
1835
1836     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
1837 }
1838
1839 static int win_chr_init(Chardev *chr, const char *filename, Error **errp)
1840 {
1841     WinChardev *s = WIN_CHARDEV(chr);
1842     COMMCONFIG comcfg;
1843     COMMTIMEOUTS cto = { 0, 0, 0, 0, 0};
1844     COMSTAT comstat;
1845     DWORD size;
1846     DWORD err;
1847
1848     s->hsend = CreateEvent(NULL, TRUE, FALSE, NULL);
1849     if (!s->hsend) {
1850         error_setg(errp, "Failed CreateEvent");
1851         goto fail;
1852     }
1853     s->hrecv = CreateEvent(NULL, TRUE, FALSE, NULL);
1854     if (!s->hrecv) {
1855         error_setg(errp, "Failed CreateEvent");
1856         goto fail;
1857     }
1858
1859     s->hcom = CreateFile(filename, GENERIC_READ|GENERIC_WRITE, 0, NULL,
1860                       OPEN_EXISTING, FILE_FLAG_OVERLAPPED, 0);
1861     if (s->hcom == INVALID_HANDLE_VALUE) {
1862         error_setg(errp, "Failed CreateFile (%lu)", GetLastError());
1863         s->hcom = NULL;
1864         goto fail;
1865     }
1866
1867     if (!SetupComm(s->hcom, NRECVBUF, NSENDBUF)) {
1868         error_setg(errp, "Failed SetupComm");
1869         goto fail;
1870     }
1871
1872     ZeroMemory(&comcfg, sizeof(COMMCONFIG));
1873     size = sizeof(COMMCONFIG);
1874     GetDefaultCommConfig(filename, &comcfg, &size);
1875     comcfg.dcb.DCBlength = sizeof(DCB);
1876     CommConfigDialog(filename, NULL, &comcfg);
1877
1878     if (!SetCommState(s->hcom, &comcfg.dcb)) {
1879         error_setg(errp, "Failed SetCommState");
1880         goto fail;
1881     }
1882
1883     if (!SetCommMask(s->hcom, EV_ERR)) {
1884         error_setg(errp, "Failed SetCommMask");
1885         goto fail;
1886     }
1887
1888     cto.ReadIntervalTimeout = MAXDWORD;
1889     if (!SetCommTimeouts(s->hcom, &cto)) {
1890         error_setg(errp, "Failed SetCommTimeouts");
1891         goto fail;
1892     }
1893
1894     if (!ClearCommError(s->hcom, &err, &comstat)) {
1895         error_setg(errp, "Failed ClearCommError");
1896         goto fail;
1897     }
1898     qemu_add_polling_cb(win_chr_poll, chr);
1899     return 0;
1900
1901  fail:
1902     return -1;
1903 }
1904
1905 /* Called with chr_write_lock held.  */
1906 static int win_chr_write(Chardev *chr, const uint8_t *buf, int len1)
1907 {
1908     WinChardev *s = WIN_CHARDEV(chr);
1909     DWORD len, ret, size, err;
1910
1911     len = len1;
1912     ZeroMemory(&s->osend, sizeof(s->osend));
1913     s->osend.hEvent = s->hsend;
1914     while (len > 0) {
1915         if (s->hsend)
1916             ret = WriteFile(s->hcom, buf, len, &size, &s->osend);
1917         else
1918             ret = WriteFile(s->hcom, buf, len, &size, NULL);
1919         if (!ret) {
1920             err = GetLastError();
1921             if (err == ERROR_IO_PENDING) {
1922                 ret = GetOverlappedResult(s->hcom, &s->osend, &size, TRUE);
1923                 if (ret) {
1924                     buf += size;
1925                     len -= size;
1926                 } else {
1927                     break;
1928                 }
1929             } else {
1930                 break;
1931             }
1932         } else {
1933             buf += size;
1934             len -= size;
1935         }
1936     }
1937     return len1 - len;
1938 }
1939
1940 static int win_chr_read_poll(Chardev *chr)
1941 {
1942     WinChardev *s = WIN_CHARDEV(chr);
1943
1944     s->max_size = qemu_chr_be_can_write(chr);
1945     return s->max_size;
1946 }
1947
1948 static void win_chr_readfile(Chardev *chr)
1949 {
1950     WinChardev *s = WIN_CHARDEV(chr);
1951
1952     int ret, err;
1953     uint8_t buf[CHR_READ_BUF_LEN];
1954     DWORD size;
1955
1956     ZeroMemory(&s->orecv, sizeof(s->orecv));
1957     s->orecv.hEvent = s->hrecv;
1958     ret = ReadFile(s->hcom, buf, s->len, &size, &s->orecv);
1959     if (!ret) {
1960         err = GetLastError();
1961         if (err == ERROR_IO_PENDING) {
1962             ret = GetOverlappedResult(s->hcom, &s->orecv, &size, TRUE);
1963         }
1964     }
1965
1966     if (size > 0) {
1967         qemu_chr_be_write(chr, buf, size);
1968     }
1969 }
1970
1971 static void win_chr_read(Chardev *chr)
1972 {
1973     WinChardev *s = WIN_CHARDEV(chr);
1974
1975     if (s->len > s->max_size)
1976         s->len = s->max_size;
1977     if (s->len == 0)
1978         return;
1979
1980     win_chr_readfile(chr);
1981 }
1982
1983 static int win_chr_poll(void *opaque)
1984 {
1985     Chardev *chr = CHARDEV(opaque);
1986     WinChardev *s = WIN_CHARDEV(opaque);
1987     COMSTAT status;
1988     DWORD comerr;
1989
1990     ClearCommError(s->hcom, &comerr, &status);
1991     if (status.cbInQue > 0) {
1992         s->len = status.cbInQue;
1993         win_chr_read_poll(chr);
1994         win_chr_read(chr);
1995         return 1;
1996     }
1997     return 0;
1998 }
1999
2000 static int win_chr_pipe_poll(void *opaque)
2001 {
2002     Chardev *chr = CHARDEV(opaque);
2003     WinChardev *s = WIN_CHARDEV(opaque);
2004     DWORD size;
2005
2006     PeekNamedPipe(s->hcom, NULL, 0, NULL, &size, NULL);
2007     if (size > 0) {
2008         s->len = size;
2009         win_chr_read_poll(chr);
2010         win_chr_read(chr);
2011         return 1;
2012     }
2013     return 0;
2014 }
2015
2016 static int win_chr_pipe_init(Chardev *chr, const char *filename,
2017                              Error **errp)
2018 {
2019     WinChardev *s = WIN_CHARDEV(chr);
2020     OVERLAPPED ov;
2021     int ret;
2022     DWORD size;
2023     char *openname;
2024
2025     s->fpipe = TRUE;
2026
2027     s->hsend = CreateEvent(NULL, TRUE, FALSE, NULL);
2028     if (!s->hsend) {
2029         error_setg(errp, "Failed CreateEvent");
2030         goto fail;
2031     }
2032     s->hrecv = CreateEvent(NULL, TRUE, FALSE, NULL);
2033     if (!s->hrecv) {
2034         error_setg(errp, "Failed CreateEvent");
2035         goto fail;
2036     }
2037
2038     openname = g_strdup_printf("\\\\.\\pipe\\%s", filename);
2039     s->hcom = CreateNamedPipe(openname, PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
2040                               PIPE_TYPE_BYTE | PIPE_READMODE_BYTE |
2041                               PIPE_WAIT,
2042                               MAXCONNECT, NSENDBUF, NRECVBUF, NTIMEOUT, NULL);
2043     g_free(openname);
2044     if (s->hcom == INVALID_HANDLE_VALUE) {
2045         error_setg(errp, "Failed CreateNamedPipe (%lu)", GetLastError());
2046         s->hcom = NULL;
2047         goto fail;
2048     }
2049
2050     ZeroMemory(&ov, sizeof(ov));
2051     ov.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
2052     ret = ConnectNamedPipe(s->hcom, &ov);
2053     if (ret) {
2054         error_setg(errp, "Failed ConnectNamedPipe");
2055         goto fail;
2056     }
2057
2058     ret = GetOverlappedResult(s->hcom, &ov, &size, TRUE);
2059     if (!ret) {
2060         error_setg(errp, "Failed GetOverlappedResult");
2061         if (ov.hEvent) {
2062             CloseHandle(ov.hEvent);
2063             ov.hEvent = NULL;
2064         }
2065         goto fail;
2066     }
2067
2068     if (ov.hEvent) {
2069         CloseHandle(ov.hEvent);
2070         ov.hEvent = NULL;
2071     }
2072     qemu_add_polling_cb(win_chr_pipe_poll, chr);
2073     return 0;
2074
2075  fail:
2076     return -1;
2077 }
2078
2079
2080 static void qemu_chr_open_pipe(Chardev *chr,
2081                                ChardevBackend *backend,
2082                                bool *be_opened,
2083                                Error **errp)
2084 {
2085     ChardevHostdev *opts = backend->u.pipe.data;
2086     const char *filename = opts->device;
2087
2088     if (win_chr_pipe_init(chr, filename, errp) < 0) {
2089         return;
2090     }
2091 }
2092
2093 static void qemu_chr_open_win_file(Chardev *chr, HANDLE fd_out)
2094 {
2095     WinChardev *s = WIN_CHARDEV(chr);
2096
2097     s->skip_free = true;
2098     s->hcom = fd_out;
2099 }
2100
2101 static void char_win_class_init(ObjectClass *oc, void *data)
2102 {
2103     ChardevClass *cc = CHARDEV_CLASS(oc);
2104
2105     cc->chr_write = win_chr_write;
2106 }
2107
2108 static const TypeInfo char_win_type_info = {
2109     .name = TYPE_CHARDEV_WIN,
2110     .parent = TYPE_CHARDEV,
2111     .instance_size = sizeof(WinChardev),
2112     .instance_finalize = char_win_finalize,
2113     .class_init = char_win_class_init,
2114     .abstract = true,
2115 };
2116
2117 static void qemu_chr_open_win_con(Chardev *chr,
2118                                   ChardevBackend *backend,
2119                                   bool *be_opened,
2120                                   Error **errp)
2121 {
2122     qemu_chr_open_win_file(chr, GetStdHandle(STD_OUTPUT_HANDLE));
2123 }
2124
2125 static void char_console_class_init(ObjectClass *oc, void *data)
2126 {
2127     ChardevClass *cc = CHARDEV_CLASS(oc);
2128
2129     cc->open = qemu_chr_open_win_con;
2130 }
2131
2132 static const TypeInfo char_console_type_info = {
2133     .name = TYPE_CHARDEV_CONSOLE,
2134     .parent = TYPE_CHARDEV_WIN,
2135     .class_init = char_console_class_init,
2136 };
2137
2138 static int win_stdio_write(Chardev *chr, const uint8_t *buf, int len)
2139 {
2140     HANDLE  hStdOut = GetStdHandle(STD_OUTPUT_HANDLE);
2141     DWORD   dwSize;
2142     int     len1;
2143
2144     len1 = len;
2145
2146     while (len1 > 0) {
2147         if (!WriteFile(hStdOut, buf, len1, &dwSize, NULL)) {
2148             break;
2149         }
2150         buf  += dwSize;
2151         len1 -= dwSize;
2152     }
2153
2154     return len - len1;
2155 }
2156
2157 static void win_stdio_wait_func(void *opaque)
2158 {
2159     Chardev *chr = CHARDEV(opaque);
2160     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(opaque);
2161     INPUT_RECORD       buf[4];
2162     int                ret;
2163     DWORD              dwSize;
2164     int                i;
2165
2166     ret = ReadConsoleInput(stdio->hStdIn, buf, ARRAY_SIZE(buf), &dwSize);
2167
2168     if (!ret) {
2169         /* Avoid error storm */
2170         qemu_del_wait_object(stdio->hStdIn, NULL, NULL);
2171         return;
2172     }
2173
2174     for (i = 0; i < dwSize; i++) {
2175         KEY_EVENT_RECORD *kev = &buf[i].Event.KeyEvent;
2176
2177         if (buf[i].EventType == KEY_EVENT && kev->bKeyDown) {
2178             int j;
2179             if (kev->uChar.AsciiChar != 0) {
2180                 for (j = 0; j < kev->wRepeatCount; j++) {
2181                     if (qemu_chr_be_can_write(chr)) {
2182                         uint8_t c = kev->uChar.AsciiChar;
2183                         qemu_chr_be_write(chr, &c, 1);
2184                     }
2185                 }
2186             }
2187         }
2188     }
2189 }
2190
2191 static DWORD WINAPI win_stdio_thread(LPVOID param)
2192 {
2193     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(param);
2194     int                ret;
2195     DWORD              dwSize;
2196
2197     while (1) {
2198
2199         /* Wait for one byte */
2200         ret = ReadFile(stdio->hStdIn, &stdio->win_stdio_buf, 1, &dwSize, NULL);
2201
2202         /* Exit in case of error, continue if nothing read */
2203         if (!ret) {
2204             break;
2205         }
2206         if (!dwSize) {
2207             continue;
2208         }
2209
2210         /* Some terminal emulator returns \r\n for Enter, just pass \n */
2211         if (stdio->win_stdio_buf == '\r') {
2212             continue;
2213         }
2214
2215         /* Signal the main thread and wait until the byte was eaten */
2216         if (!SetEvent(stdio->hInputReadyEvent)) {
2217             break;
2218         }
2219         if (WaitForSingleObject(stdio->hInputDoneEvent, INFINITE)
2220             != WAIT_OBJECT_0) {
2221             break;
2222         }
2223     }
2224
2225     qemu_del_wait_object(stdio->hInputReadyEvent, NULL, NULL);
2226     return 0;
2227 }
2228
2229 static void win_stdio_thread_wait_func(void *opaque)
2230 {
2231     Chardev *chr = CHARDEV(opaque);
2232     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(opaque);
2233
2234     if (qemu_chr_be_can_write(chr)) {
2235         qemu_chr_be_write(chr, &stdio->win_stdio_buf, 1);
2236     }
2237
2238     SetEvent(stdio->hInputDoneEvent);
2239 }
2240
2241 static void qemu_chr_set_echo_win_stdio(Chardev *chr, bool echo)
2242 {
2243     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(chr);
2244     DWORD              dwMode = 0;
2245
2246     GetConsoleMode(stdio->hStdIn, &dwMode);
2247
2248     if (echo) {
2249         SetConsoleMode(stdio->hStdIn, dwMode | ENABLE_ECHO_INPUT);
2250     } else {
2251         SetConsoleMode(stdio->hStdIn, dwMode & ~ENABLE_ECHO_INPUT);
2252     }
2253 }
2254
2255 static void char_win_stdio_finalize(Object *obj)
2256 {
2257     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(obj);
2258
2259     if (stdio->hInputReadyEvent != INVALID_HANDLE_VALUE) {
2260         CloseHandle(stdio->hInputReadyEvent);
2261     }
2262     if (stdio->hInputDoneEvent != INVALID_HANDLE_VALUE) {
2263         CloseHandle(stdio->hInputDoneEvent);
2264     }
2265     if (stdio->hInputThread != INVALID_HANDLE_VALUE) {
2266         TerminateThread(stdio->hInputThread, 0);
2267     }
2268 }
2269
2270 static const TypeInfo char_win_stdio_type_info = {
2271     .name = TYPE_CHARDEV_WIN_STDIO,
2272     .parent = TYPE_CHARDEV,
2273     .instance_size = sizeof(WinStdioChardev),
2274     .instance_finalize = char_win_stdio_finalize,
2275     .abstract = true,
2276 };
2277
2278 static void qemu_chr_open_stdio(Chardev *chr,
2279                                 ChardevBackend *backend,
2280                                 bool *be_opened,
2281                                 Error **errp)
2282 {
2283     WinStdioChardev *stdio = WIN_STDIO_CHARDEV(chr);
2284     DWORD              dwMode;
2285     int                is_console = 0;
2286
2287     stdio->hStdIn = GetStdHandle(STD_INPUT_HANDLE);
2288     if (stdio->hStdIn == INVALID_HANDLE_VALUE) {
2289         error_setg(errp, "cannot open stdio: invalid handle");
2290         return;
2291     }
2292
2293     is_console = GetConsoleMode(stdio->hStdIn, &dwMode) != 0;
2294
2295     if (is_console) {
2296         if (qemu_add_wait_object(stdio->hStdIn,
2297                                  win_stdio_wait_func, chr)) {
2298             error_setg(errp, "qemu_add_wait_object: failed");
2299             goto err1;
2300         }
2301     } else {
2302         DWORD   dwId;
2303
2304         stdio->hInputReadyEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
2305         stdio->hInputDoneEvent  = CreateEvent(NULL, FALSE, FALSE, NULL);
2306         if (stdio->hInputReadyEvent == INVALID_HANDLE_VALUE
2307             || stdio->hInputDoneEvent == INVALID_HANDLE_VALUE) {
2308             error_setg(errp, "cannot create event");
2309             goto err2;
2310         }
2311         if (qemu_add_wait_object(stdio->hInputReadyEvent,
2312                                  win_stdio_thread_wait_func, chr)) {
2313             error_setg(errp, "qemu_add_wait_object: failed");
2314             goto err2;
2315         }
2316         stdio->hInputThread     = CreateThread(NULL, 0, win_stdio_thread,
2317                                                chr, 0, &dwId);
2318
2319         if (stdio->hInputThread == INVALID_HANDLE_VALUE) {
2320             error_setg(errp, "cannot create stdio thread");
2321             goto err3;
2322         }
2323     }
2324
2325     dwMode |= ENABLE_LINE_INPUT;
2326
2327     if (is_console) {
2328         /* set the terminal in raw mode */
2329         /* ENABLE_QUICK_EDIT_MODE | ENABLE_EXTENDED_FLAGS */
2330         dwMode |= ENABLE_PROCESSED_INPUT;
2331     }
2332
2333     SetConsoleMode(stdio->hStdIn, dwMode);
2334
2335     qemu_chr_set_echo_win_stdio(chr, false);
2336
2337     return;
2338
2339 err3:
2340     qemu_del_wait_object(stdio->hInputReadyEvent, NULL, NULL);
2341 err2:
2342     CloseHandle(stdio->hInputReadyEvent);
2343     CloseHandle(stdio->hInputDoneEvent);
2344 err1:
2345     qemu_del_wait_object(stdio->hStdIn, NULL, NULL);
2346 }
2347 #endif /* !_WIN32 */
2348
2349 /***********************************************************/
2350 /* UDP Net console */
2351
2352 typedef struct {
2353     Chardev parent;
2354     QIOChannel *ioc;
2355     uint8_t buf[CHR_READ_BUF_LEN];
2356     int bufcnt;
2357     int bufptr;
2358     int max_size;
2359 } UdpChardev;
2360
2361 #define UDP_CHARDEV(obj) OBJECT_CHECK(UdpChardev, (obj), TYPE_CHARDEV_UDP)
2362
2363 /* Called with chr_write_lock held.  */
2364 static int udp_chr_write(Chardev *chr, const uint8_t *buf, int len)
2365 {
2366     UdpChardev *s = UDP_CHARDEV(chr);
2367
2368     return qio_channel_write(
2369         s->ioc, (const char *)buf, len, NULL);
2370 }
2371
2372 static int udp_chr_read_poll(void *opaque)
2373 {
2374     Chardev *chr = CHARDEV(opaque);
2375     UdpChardev *s = UDP_CHARDEV(opaque);
2376
2377     s->max_size = qemu_chr_be_can_write(chr);
2378
2379     /* If there were any stray characters in the queue process them
2380      * first
2381      */
2382     while (s->max_size > 0 && s->bufptr < s->bufcnt) {
2383         qemu_chr_be_write(chr, &s->buf[s->bufptr], 1);
2384         s->bufptr++;
2385         s->max_size = qemu_chr_be_can_write(chr);
2386     }
2387     return s->max_size;
2388 }
2389
2390 static gboolean udp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
2391 {
2392     Chardev *chr = CHARDEV(opaque);
2393     UdpChardev *s = UDP_CHARDEV(opaque);
2394     ssize_t ret;
2395
2396     if (s->max_size == 0) {
2397         return TRUE;
2398     }
2399     ret = qio_channel_read(
2400         s->ioc, (char *)s->buf, sizeof(s->buf), NULL);
2401     if (ret <= 0) {
2402         remove_fd_in_watch(chr);
2403         return FALSE;
2404     }
2405     s->bufcnt = ret;
2406
2407     s->bufptr = 0;
2408     while (s->max_size > 0 && s->bufptr < s->bufcnt) {
2409         qemu_chr_be_write(chr, &s->buf[s->bufptr], 1);
2410         s->bufptr++;
2411         s->max_size = qemu_chr_be_can_write(chr);
2412     }
2413
2414     return TRUE;
2415 }
2416
2417 static void udp_chr_update_read_handler(Chardev *chr,
2418                                         GMainContext *context)
2419 {
2420     UdpChardev *s = UDP_CHARDEV(chr);
2421
2422     remove_fd_in_watch(chr);
2423     if (s->ioc) {
2424         chr->fd_in_tag = io_add_watch_poll(chr, s->ioc,
2425                                            udp_chr_read_poll,
2426                                            udp_chr_read, chr,
2427                                            context);
2428     }
2429 }
2430
2431 static void char_udp_finalize(Object *obj)
2432 {
2433     Chardev *chr = CHARDEV(obj);
2434     UdpChardev *s = UDP_CHARDEV(obj);
2435
2436     remove_fd_in_watch(chr);
2437     if (s->ioc) {
2438         object_unref(OBJECT(s->ioc));
2439     }
2440     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
2441 }
2442
2443 /***********************************************************/
2444 /* TCP Net console */
2445
2446 typedef struct {
2447     Chardev parent;
2448     QIOChannel *ioc; /* Client I/O channel */
2449     QIOChannelSocket *sioc; /* Client master channel */
2450     QIOChannelSocket *listen_ioc;
2451     guint listen_tag;
2452     QCryptoTLSCreds *tls_creds;
2453     int connected;
2454     int max_size;
2455     int do_telnetopt;
2456     int do_nodelay;
2457     int is_unix;
2458     int *read_msgfds;
2459     size_t read_msgfds_num;
2460     int *write_msgfds;
2461     size_t write_msgfds_num;
2462
2463     SocketAddress *addr;
2464     bool is_listen;
2465     bool is_telnet;
2466
2467     guint reconnect_timer;
2468     int64_t reconnect_time;
2469     bool connect_err_reported;
2470 } SocketChardev;
2471
2472 #define SOCKET_CHARDEV(obj)                                     \
2473     OBJECT_CHECK(SocketChardev, (obj), TYPE_CHARDEV_SOCKET)
2474
2475 static gboolean socket_reconnect_timeout(gpointer opaque);
2476
2477 static void qemu_chr_socket_restart_timer(Chardev *chr)
2478 {
2479     SocketChardev *s = SOCKET_CHARDEV(chr);
2480     char *name;
2481
2482     assert(s->connected == 0);
2483     s->reconnect_timer = g_timeout_add_seconds(s->reconnect_time,
2484                                                socket_reconnect_timeout, chr);
2485     name = g_strdup_printf("chardev-socket-reconnect-%s", chr->label);
2486     g_source_set_name_by_id(s->reconnect_timer, name);
2487     g_free(name);
2488 }
2489
2490 static void check_report_connect_error(Chardev *chr,
2491                                        Error *err)
2492 {
2493     SocketChardev *s = SOCKET_CHARDEV(chr);
2494
2495     if (!s->connect_err_reported) {
2496         error_report("Unable to connect character device %s: %s",
2497                      chr->label, error_get_pretty(err));
2498         s->connect_err_reported = true;
2499     }
2500     qemu_chr_socket_restart_timer(chr);
2501 }
2502
2503 static gboolean tcp_chr_accept(QIOChannel *chan,
2504                                GIOCondition cond,
2505                                void *opaque);
2506
2507 /* Called with chr_write_lock held.  */
2508 static int tcp_chr_write(Chardev *chr, const uint8_t *buf, int len)
2509 {
2510     SocketChardev *s = SOCKET_CHARDEV(chr);
2511
2512     if (s->connected) {
2513         int ret =  io_channel_send_full(s->ioc, buf, len,
2514                                         s->write_msgfds,
2515                                         s->write_msgfds_num);
2516
2517         /* free the written msgfds, no matter what */
2518         if (s->write_msgfds_num) {
2519             g_free(s->write_msgfds);
2520             s->write_msgfds = 0;
2521             s->write_msgfds_num = 0;
2522         }
2523
2524         return ret;
2525     } else {
2526         /* XXX: indicate an error ? */
2527         return len;
2528     }
2529 }
2530
2531 static int tcp_chr_read_poll(void *opaque)
2532 {
2533     Chardev *chr = CHARDEV(opaque);
2534     SocketChardev *s = SOCKET_CHARDEV(opaque);
2535     if (!s->connected)
2536         return 0;
2537     s->max_size = qemu_chr_be_can_write(chr);
2538     return s->max_size;
2539 }
2540
2541 #define IAC 255
2542 #define IAC_BREAK 243
2543 static void tcp_chr_process_IAC_bytes(Chardev *chr,
2544                                       SocketChardev *s,
2545                                       uint8_t *buf, int *size)
2546 {
2547     /* Handle any telnet client's basic IAC options to satisfy char by
2548      * char mode with no echo.  All IAC options will be removed from
2549      * the buf and the do_telnetopt variable will be used to track the
2550      * state of the width of the IAC information.
2551      *
2552      * IAC commands come in sets of 3 bytes with the exception of the
2553      * "IAC BREAK" command and the double IAC.
2554      */
2555
2556     int i;
2557     int j = 0;
2558
2559     for (i = 0; i < *size; i++) {
2560         if (s->do_telnetopt > 1) {
2561             if ((unsigned char)buf[i] == IAC && s->do_telnetopt == 2) {
2562                 /* Double IAC means send an IAC */
2563                 if (j != i)
2564                     buf[j] = buf[i];
2565                 j++;
2566                 s->do_telnetopt = 1;
2567             } else {
2568                 if ((unsigned char)buf[i] == IAC_BREAK && s->do_telnetopt == 2) {
2569                     /* Handle IAC break commands by sending a serial break */
2570                     qemu_chr_be_event(chr, CHR_EVENT_BREAK);
2571                     s->do_telnetopt++;
2572                 }
2573                 s->do_telnetopt++;
2574             }
2575             if (s->do_telnetopt >= 4) {
2576                 s->do_telnetopt = 1;
2577             }
2578         } else {
2579             if ((unsigned char)buf[i] == IAC) {
2580                 s->do_telnetopt = 2;
2581             } else {
2582                 if (j != i)
2583                     buf[j] = buf[i];
2584                 j++;
2585             }
2586         }
2587     }
2588     *size = j;
2589 }
2590
2591 static int tcp_get_msgfds(Chardev *chr, int *fds, int num)
2592 {
2593     SocketChardev *s = SOCKET_CHARDEV(chr);
2594
2595     int to_copy = (s->read_msgfds_num < num) ? s->read_msgfds_num : num;
2596
2597     assert(num <= TCP_MAX_FDS);
2598
2599     if (to_copy) {
2600         int i;
2601
2602         memcpy(fds, s->read_msgfds, to_copy * sizeof(int));
2603
2604         /* Close unused fds */
2605         for (i = to_copy; i < s->read_msgfds_num; i++) {
2606             close(s->read_msgfds[i]);
2607         }
2608
2609         g_free(s->read_msgfds);
2610         s->read_msgfds = 0;
2611         s->read_msgfds_num = 0;
2612     }
2613
2614     return to_copy;
2615 }
2616
2617 static int tcp_set_msgfds(Chardev *chr, int *fds, int num)
2618 {
2619     SocketChardev *s = SOCKET_CHARDEV(chr);
2620
2621     /* clear old pending fd array */
2622     g_free(s->write_msgfds);
2623     s->write_msgfds = NULL;
2624     s->write_msgfds_num = 0;
2625
2626     if (!s->connected ||
2627         !qio_channel_has_feature(s->ioc,
2628                                  QIO_CHANNEL_FEATURE_FD_PASS)) {
2629         return -1;
2630     }
2631
2632     if (num) {
2633         s->write_msgfds = g_new(int, num);
2634         memcpy(s->write_msgfds, fds, num * sizeof(int));
2635     }
2636
2637     s->write_msgfds_num = num;
2638
2639     return 0;
2640 }
2641
2642 static ssize_t tcp_chr_recv(Chardev *chr, char *buf, size_t len)
2643 {
2644     SocketChardev *s = SOCKET_CHARDEV(chr);
2645     struct iovec iov = { .iov_base = buf, .iov_len = len };
2646     int ret;
2647     size_t i;
2648     int *msgfds = NULL;
2649     size_t msgfds_num = 0;
2650
2651     if (qio_channel_has_feature(s->ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
2652         ret = qio_channel_readv_full(s->ioc, &iov, 1,
2653                                      &msgfds, &msgfds_num,
2654                                      NULL);
2655     } else {
2656         ret = qio_channel_readv_full(s->ioc, &iov, 1,
2657                                      NULL, NULL,
2658                                      NULL);
2659     }
2660
2661     if (ret == QIO_CHANNEL_ERR_BLOCK) {
2662         errno = EAGAIN;
2663         ret = -1;
2664     } else if (ret == -1) {
2665         errno = EIO;
2666     }
2667
2668     if (msgfds_num) {
2669         /* close and clean read_msgfds */
2670         for (i = 0; i < s->read_msgfds_num; i++) {
2671             close(s->read_msgfds[i]);
2672         }
2673
2674         if (s->read_msgfds_num) {
2675             g_free(s->read_msgfds);
2676         }
2677
2678         s->read_msgfds = msgfds;
2679         s->read_msgfds_num = msgfds_num;
2680     }
2681
2682     for (i = 0; i < s->read_msgfds_num; i++) {
2683         int fd = s->read_msgfds[i];
2684         if (fd < 0) {
2685             continue;
2686         }
2687
2688         /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
2689         qemu_set_block(fd);
2690
2691 #ifndef MSG_CMSG_CLOEXEC
2692         qemu_set_cloexec(fd);
2693 #endif
2694     }
2695
2696     return ret;
2697 }
2698
2699 static GSource *tcp_chr_add_watch(Chardev *chr, GIOCondition cond)
2700 {
2701     SocketChardev *s = SOCKET_CHARDEV(chr);
2702     return qio_channel_create_watch(s->ioc, cond);
2703 }
2704
2705 static void tcp_chr_free_connection(Chardev *chr)
2706 {
2707     SocketChardev *s = SOCKET_CHARDEV(chr);
2708     int i;
2709
2710     if (!s->connected) {
2711         return;
2712     }
2713
2714     if (s->read_msgfds_num) {
2715         for (i = 0; i < s->read_msgfds_num; i++) {
2716             close(s->read_msgfds[i]);
2717         }
2718         g_free(s->read_msgfds);
2719         s->read_msgfds = NULL;
2720         s->read_msgfds_num = 0;
2721     }
2722
2723     tcp_set_msgfds(chr, NULL, 0);
2724     remove_fd_in_watch(chr);
2725     object_unref(OBJECT(s->sioc));
2726     s->sioc = NULL;
2727     object_unref(OBJECT(s->ioc));
2728     s->ioc = NULL;
2729     g_free(chr->filename);
2730     chr->filename = NULL;
2731     s->connected = 0;
2732 }
2733
2734 static void tcp_chr_disconnect(Chardev *chr)
2735 {
2736     SocketChardev *s = SOCKET_CHARDEV(chr);
2737
2738     if (!s->connected) {
2739         return;
2740     }
2741
2742     tcp_chr_free_connection(chr);
2743
2744     if (s->listen_ioc) {
2745         s->listen_tag = qio_channel_add_watch(
2746             QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr, NULL);
2747     }
2748     chr->filename = SocketAddress_to_str("disconnected:", s->addr,
2749                                          s->is_listen, s->is_telnet);
2750     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
2751     if (s->reconnect_time) {
2752         qemu_chr_socket_restart_timer(chr);
2753     }
2754 }
2755
2756 static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
2757 {
2758     Chardev *chr = CHARDEV(opaque);
2759     SocketChardev *s = SOCKET_CHARDEV(opaque);
2760     uint8_t buf[CHR_READ_BUF_LEN];
2761     int len, size;
2762
2763     if (!s->connected || s->max_size <= 0) {
2764         return TRUE;
2765     }
2766     len = sizeof(buf);
2767     if (len > s->max_size)
2768         len = s->max_size;
2769     size = tcp_chr_recv(chr, (void *)buf, len);
2770     if (size == 0 || size == -1) {
2771         /* connection closed */
2772         tcp_chr_disconnect(chr);
2773     } else if (size > 0) {
2774         if (s->do_telnetopt)
2775             tcp_chr_process_IAC_bytes(chr, s, buf, &size);
2776         if (size > 0)
2777             qemu_chr_be_write(chr, buf, size);
2778     }
2779
2780     return TRUE;
2781 }
2782
2783 static int tcp_chr_sync_read(Chardev *chr, const uint8_t *buf, int len)
2784 {
2785     SocketChardev *s = SOCKET_CHARDEV(chr);
2786     int size;
2787
2788     if (!s->connected) {
2789         return 0;
2790     }
2791
2792     size = tcp_chr_recv(chr, (void *) buf, len);
2793     if (size == 0) {
2794         /* connection closed */
2795         tcp_chr_disconnect(chr);
2796     }
2797
2798     return size;
2799 }
2800
2801 static void tcp_chr_connect(void *opaque)
2802 {
2803     Chardev *chr = CHARDEV(opaque);
2804     SocketChardev *s = SOCKET_CHARDEV(opaque);
2805
2806     g_free(chr->filename);
2807     chr->filename = sockaddr_to_str(
2808         &s->sioc->localAddr, s->sioc->localAddrLen,
2809         &s->sioc->remoteAddr, s->sioc->remoteAddrLen,
2810         s->is_listen, s->is_telnet);
2811
2812     s->connected = 1;
2813     if (s->ioc) {
2814         chr->fd_in_tag = io_add_watch_poll(chr, s->ioc,
2815                                            tcp_chr_read_poll,
2816                                            tcp_chr_read,
2817                                            chr, NULL);
2818     }
2819     qemu_chr_be_generic_open(chr);
2820 }
2821
2822 static void tcp_chr_update_read_handler(Chardev *chr,
2823                                         GMainContext *context)
2824 {
2825     SocketChardev *s = SOCKET_CHARDEV(chr);
2826
2827     if (!s->connected) {
2828         return;
2829     }
2830
2831     remove_fd_in_watch(chr);
2832     if (s->ioc) {
2833         chr->fd_in_tag = io_add_watch_poll(chr, s->ioc,
2834                                            tcp_chr_read_poll,
2835                                            tcp_chr_read, chr,
2836                                            context);
2837     }
2838 }
2839
2840 typedef struct {
2841     Chardev *chr;
2842     char buf[12];
2843     size_t buflen;
2844 } TCPChardevTelnetInit;
2845
2846 static gboolean tcp_chr_telnet_init_io(QIOChannel *ioc,
2847                                        GIOCondition cond G_GNUC_UNUSED,
2848                                        gpointer user_data)
2849 {
2850     TCPChardevTelnetInit *init = user_data;
2851     ssize_t ret;
2852
2853     ret = qio_channel_write(ioc, init->buf, init->buflen, NULL);
2854     if (ret < 0) {
2855         if (ret == QIO_CHANNEL_ERR_BLOCK) {
2856             ret = 0;
2857         } else {
2858             tcp_chr_disconnect(init->chr);
2859             return FALSE;
2860         }
2861     }
2862     init->buflen -= ret;
2863
2864     if (init->buflen == 0) {
2865         tcp_chr_connect(init->chr);
2866         return FALSE;
2867     }
2868
2869     memmove(init->buf, init->buf + ret, init->buflen);
2870
2871     return TRUE;
2872 }
2873
2874 static void tcp_chr_telnet_init(Chardev *chr)
2875 {
2876     SocketChardev *s = SOCKET_CHARDEV(chr);
2877     TCPChardevTelnetInit *init = g_new0(TCPChardevTelnetInit, 1);
2878     size_t n = 0;
2879
2880     init->chr = chr;
2881     init->buflen = 12;
2882
2883 #define IACSET(x, a, b, c)                      \
2884     do {                                        \
2885         x[n++] = a;                             \
2886         x[n++] = b;                             \
2887         x[n++] = c;                             \
2888     } while (0)
2889
2890     /* Prep the telnet negotion to put telnet in binary,
2891      * no echo, single char mode */
2892     IACSET(init->buf, 0xff, 0xfb, 0x01);  /* IAC WILL ECHO */
2893     IACSET(init->buf, 0xff, 0xfb, 0x03);  /* IAC WILL Suppress go ahead */
2894     IACSET(init->buf, 0xff, 0xfb, 0x00);  /* IAC WILL Binary */
2895     IACSET(init->buf, 0xff, 0xfd, 0x00);  /* IAC DO Binary */
2896
2897 #undef IACSET
2898
2899     qio_channel_add_watch(
2900         s->ioc, G_IO_OUT,
2901         tcp_chr_telnet_init_io,
2902         init, NULL);
2903 }
2904
2905
2906 static void tcp_chr_tls_handshake(QIOTask *task,
2907                                   gpointer user_data)
2908 {
2909     Chardev *chr = user_data;
2910     SocketChardev *s = user_data;
2911
2912     if (qio_task_propagate_error(task, NULL)) {
2913         tcp_chr_disconnect(chr);
2914     } else {
2915         if (s->do_telnetopt) {
2916             tcp_chr_telnet_init(chr);
2917         } else {
2918             tcp_chr_connect(chr);
2919         }
2920     }
2921 }
2922
2923
2924 static void tcp_chr_tls_init(Chardev *chr)
2925 {
2926     SocketChardev *s = SOCKET_CHARDEV(chr);
2927     QIOChannelTLS *tioc;
2928     Error *err = NULL;
2929     gchar *name;
2930
2931     if (s->is_listen) {
2932         tioc = qio_channel_tls_new_server(
2933             s->ioc, s->tls_creds,
2934             NULL, /* XXX Use an ACL */
2935             &err);
2936     } else {
2937         tioc = qio_channel_tls_new_client(
2938             s->ioc, s->tls_creds,
2939             s->addr->u.inet.data->host,
2940             &err);
2941     }
2942     if (tioc == NULL) {
2943         error_free(err);
2944         tcp_chr_disconnect(chr);
2945         return;
2946     }
2947     name = g_strdup_printf("chardev-tls-%s-%s",
2948                            s->is_listen ? "server" : "client",
2949                            chr->label);
2950     qio_channel_set_name(QIO_CHANNEL(tioc), name);
2951     g_free(name);
2952     object_unref(OBJECT(s->ioc));
2953     s->ioc = QIO_CHANNEL(tioc);
2954
2955     qio_channel_tls_handshake(tioc,
2956                               tcp_chr_tls_handshake,
2957                               chr,
2958                               NULL);
2959 }
2960
2961
2962 static void tcp_chr_set_client_ioc_name(Chardev *chr,
2963                                         QIOChannelSocket *sioc)
2964 {
2965     SocketChardev *s = SOCKET_CHARDEV(chr);
2966     char *name;
2967     name = g_strdup_printf("chardev-tcp-%s-%s",
2968                            s->is_listen ? "server" : "client",
2969                            chr->label);
2970     qio_channel_set_name(QIO_CHANNEL(sioc), name);
2971     g_free(name);
2972
2973 }
2974
2975 static int tcp_chr_new_client(Chardev *chr, QIOChannelSocket *sioc)
2976 {
2977     SocketChardev *s = SOCKET_CHARDEV(chr);
2978
2979     if (s->ioc != NULL) {
2980         return -1;
2981     }
2982
2983     s->ioc = QIO_CHANNEL(sioc);
2984     object_ref(OBJECT(sioc));
2985     s->sioc = sioc;
2986     object_ref(OBJECT(sioc));
2987
2988     qio_channel_set_blocking(s->ioc, false, NULL);
2989
2990     if (s->do_nodelay) {
2991         qio_channel_set_delay(s->ioc, false);
2992     }
2993     if (s->listen_tag) {
2994         g_source_remove(s->listen_tag);
2995         s->listen_tag = 0;
2996     }
2997
2998     if (s->tls_creds) {
2999         tcp_chr_tls_init(chr);
3000     } else {
3001         if (s->do_telnetopt) {
3002             tcp_chr_telnet_init(chr);
3003         } else {
3004             tcp_chr_connect(chr);
3005         }
3006     }
3007
3008     return 0;
3009 }
3010
3011
3012 static int tcp_chr_add_client(Chardev *chr, int fd)
3013 {
3014     int ret;
3015     QIOChannelSocket *sioc;
3016
3017     sioc = qio_channel_socket_new_fd(fd, NULL);
3018     if (!sioc) {
3019         return -1;
3020     }
3021     tcp_chr_set_client_ioc_name(chr, sioc);
3022     ret = tcp_chr_new_client(chr, sioc);
3023     object_unref(OBJECT(sioc));
3024     return ret;
3025 }
3026
3027 static gboolean tcp_chr_accept(QIOChannel *channel,
3028                                GIOCondition cond,
3029                                void *opaque)
3030 {
3031     Chardev *chr = CHARDEV(opaque);
3032     QIOChannelSocket *sioc;
3033
3034     sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(channel),
3035                                      NULL);
3036     if (!sioc) {
3037         return TRUE;
3038     }
3039
3040     tcp_chr_new_client(chr, sioc);
3041
3042     object_unref(OBJECT(sioc));
3043
3044     return TRUE;
3045 }
3046
3047 static int tcp_chr_wait_connected(Chardev *chr, Error **errp)
3048 {
3049     SocketChardev *s = SOCKET_CHARDEV(chr);
3050     QIOChannelSocket *sioc;
3051
3052     /* It can't wait on s->connected, since it is set asynchronously
3053      * in TLS and telnet cases, only wait for an accepted socket */
3054     while (!s->ioc) {
3055         if (s->is_listen) {
3056             error_report("QEMU waiting for connection on: %s",
3057                          chr->filename);
3058             qio_channel_set_blocking(QIO_CHANNEL(s->listen_ioc), true, NULL);
3059             tcp_chr_accept(QIO_CHANNEL(s->listen_ioc), G_IO_IN, chr);
3060             qio_channel_set_blocking(QIO_CHANNEL(s->listen_ioc), false, NULL);
3061         } else {
3062             sioc = qio_channel_socket_new();
3063             tcp_chr_set_client_ioc_name(chr, sioc);
3064             if (qio_channel_socket_connect_sync(sioc, s->addr, errp) < 0) {
3065                 object_unref(OBJECT(sioc));
3066                 return -1;
3067             }
3068             tcp_chr_new_client(chr, sioc);
3069             object_unref(OBJECT(sioc));
3070         }
3071     }
3072
3073     return 0;
3074 }
3075
3076 static int qemu_chr_wait_connected(Chardev *chr, Error **errp)
3077 {
3078     ChardevClass *cc = CHARDEV_GET_CLASS(chr);
3079
3080     if (cc->chr_wait_connected) {
3081         return cc->chr_wait_connected(chr, errp);
3082     }
3083
3084     return 0;
3085 }
3086
3087 int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp)
3088 {
3089     if (!be->chr) {
3090         error_setg(errp, "missing associated backend");
3091         return -1;
3092     }
3093
3094     return qemu_chr_wait_connected(be->chr, errp);
3095 }
3096
3097 static void char_socket_finalize(Object *obj)
3098 {
3099     Chardev *chr = CHARDEV(obj);
3100     SocketChardev *s = SOCKET_CHARDEV(obj);
3101
3102     tcp_chr_free_connection(chr);
3103
3104     if (s->reconnect_timer) {
3105         g_source_remove(s->reconnect_timer);
3106         s->reconnect_timer = 0;
3107     }
3108     qapi_free_SocketAddress(s->addr);
3109     if (s->listen_tag) {
3110         g_source_remove(s->listen_tag);
3111         s->listen_tag = 0;
3112     }
3113     if (s->listen_ioc) {
3114         object_unref(OBJECT(s->listen_ioc));
3115     }
3116     if (s->tls_creds) {
3117         object_unref(OBJECT(s->tls_creds));
3118     }
3119
3120     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
3121 }
3122
3123
3124 static void qemu_chr_socket_connected(QIOTask *task, void *opaque)
3125 {
3126     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(qio_task_get_source(task));
3127     Chardev *chr = CHARDEV(opaque);
3128     SocketChardev *s = SOCKET_CHARDEV(chr);
3129     Error *err = NULL;
3130
3131     if (qio_task_propagate_error(task, &err)) {
3132         check_report_connect_error(chr, err);
3133         error_free(err);
3134         goto cleanup;
3135     }
3136
3137     s->connect_err_reported = false;
3138     tcp_chr_new_client(chr, sioc);
3139
3140  cleanup:
3141     object_unref(OBJECT(sioc));
3142 }
3143
3144
3145 QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename)
3146 {
3147     char host[65], port[33], width[8], height[8];
3148     int pos;
3149     const char *p;
3150     QemuOpts *opts;
3151     Error *local_err = NULL;
3152
3153     opts = qemu_opts_create(qemu_find_opts("chardev"), label, 1, &local_err);
3154     if (local_err) {
3155         error_report_err(local_err);
3156         return NULL;
3157     }
3158
3159     if (strstart(filename, "mon:", &p)) {
3160         filename = p;
3161         qemu_opt_set(opts, "mux", "on", &error_abort);
3162         if (strcmp(filename, "stdio") == 0) {
3163             /* Monitor is muxed to stdio: do not exit on Ctrl+C by default
3164              * but pass it to the guest.  Handle this only for compat syntax,
3165              * for -chardev syntax we have special option for this.
3166              * This is what -nographic did, redirecting+muxing serial+monitor
3167              * to stdio causing Ctrl+C to be passed to guest. */
3168             qemu_opt_set(opts, "signal", "off", &error_abort);
3169         }
3170     }
3171
3172     if (strcmp(filename, "null")    == 0 ||
3173         strcmp(filename, "pty")     == 0 ||
3174         strcmp(filename, "msmouse") == 0 ||
3175         strcmp(filename, "braille") == 0 ||
3176         strcmp(filename, "testdev") == 0 ||
3177         strcmp(filename, "stdio")   == 0) {
3178         qemu_opt_set(opts, "backend", filename, &error_abort);
3179         return opts;
3180     }
3181     if (strstart(filename, "vc", &p)) {
3182         qemu_opt_set(opts, "backend", "vc", &error_abort);
3183         if (*p == ':') {
3184             if (sscanf(p+1, "%7[0-9]x%7[0-9]", width, height) == 2) {
3185                 /* pixels */
3186                 qemu_opt_set(opts, "width", width, &error_abort);
3187                 qemu_opt_set(opts, "height", height, &error_abort);
3188             } else if (sscanf(p+1, "%7[0-9]Cx%7[0-9]C", width, height) == 2) {
3189                 /* chars */
3190                 qemu_opt_set(opts, "cols", width, &error_abort);
3191                 qemu_opt_set(opts, "rows", height, &error_abort);
3192             } else {
3193                 goto fail;
3194             }
3195         }
3196         return opts;
3197     }
3198     if (strcmp(filename, "con:") == 0) {
3199         qemu_opt_set(opts, "backend", "console", &error_abort);
3200         return opts;
3201     }
3202     if (strstart(filename, "COM", NULL)) {
3203         qemu_opt_set(opts, "backend", "serial", &error_abort);
3204         qemu_opt_set(opts, "path", filename, &error_abort);
3205         return opts;
3206     }
3207     if (strstart(filename, "file:", &p)) {
3208         qemu_opt_set(opts, "backend", "file", &error_abort);
3209         qemu_opt_set(opts, "path", p, &error_abort);
3210         return opts;
3211     }
3212     if (strstart(filename, "pipe:", &p)) {
3213         qemu_opt_set(opts, "backend", "pipe", &error_abort);
3214         qemu_opt_set(opts, "path", p, &error_abort);
3215         return opts;
3216     }
3217     if (strstart(filename, "tcp:", &p) ||
3218         strstart(filename, "telnet:", &p)) {
3219         if (sscanf(p, "%64[^:]:%32[^,]%n", host, port, &pos) < 2) {
3220             host[0] = 0;
3221             if (sscanf(p, ":%32[^,]%n", port, &pos) < 1)
3222                 goto fail;
3223         }
3224         qemu_opt_set(opts, "backend", "socket", &error_abort);
3225         qemu_opt_set(opts, "host", host, &error_abort);
3226         qemu_opt_set(opts, "port", port, &error_abort);
3227         if (p[pos] == ',') {
3228             qemu_opts_do_parse(opts, p+pos+1, NULL, &local_err);
3229             if (local_err) {
3230                 error_report_err(local_err);
3231                 goto fail;
3232             }
3233         }
3234         if (strstart(filename, "telnet:", &p))
3235             qemu_opt_set(opts, "telnet", "on", &error_abort);
3236         return opts;
3237     }
3238     if (strstart(filename, "udp:", &p)) {
3239         qemu_opt_set(opts, "backend", "udp", &error_abort);
3240         if (sscanf(p, "%64[^:]:%32[^@,]%n", host, port, &pos) < 2) {
3241             host[0] = 0;
3242             if (sscanf(p, ":%32[^@,]%n", port, &pos) < 1) {
3243                 goto fail;
3244             }
3245         }
3246         qemu_opt_set(opts, "host", host, &error_abort);
3247         qemu_opt_set(opts, "port", port, &error_abort);
3248         if (p[pos] == '@') {
3249             p += pos + 1;
3250             if (sscanf(p, "%64[^:]:%32[^,]%n", host, port, &pos) < 2) {
3251                 host[0] = 0;
3252                 if (sscanf(p, ":%32[^,]%n", port, &pos) < 1) {
3253                     goto fail;
3254                 }
3255             }
3256             qemu_opt_set(opts, "localaddr", host, &error_abort);
3257             qemu_opt_set(opts, "localport", port, &error_abort);
3258         }
3259         return opts;
3260     }
3261     if (strstart(filename, "unix:", &p)) {
3262         qemu_opt_set(opts, "backend", "socket", &error_abort);
3263         qemu_opts_do_parse(opts, p, "path", &local_err);
3264         if (local_err) {
3265             error_report_err(local_err);
3266             goto fail;
3267         }
3268         return opts;
3269     }
3270     if (strstart(filename, "/dev/parport", NULL) ||
3271         strstart(filename, "/dev/ppi", NULL)) {
3272         qemu_opt_set(opts, "backend", "parport", &error_abort);
3273         qemu_opt_set(opts, "path", filename, &error_abort);
3274         return opts;
3275     }
3276     if (strstart(filename, "/dev/", NULL)) {
3277         qemu_opt_set(opts, "backend", "tty", &error_abort);
3278         qemu_opt_set(opts, "path", filename, &error_abort);
3279         return opts;
3280     }
3281
3282 fail:
3283     qemu_opts_del(opts);
3284     return NULL;
3285 }
3286
3287 void qemu_chr_parse_common(QemuOpts *opts, ChardevCommon *backend)
3288 {
3289     const char *logfile = qemu_opt_get(opts, "logfile");
3290
3291     backend->has_logfile = logfile != NULL;
3292     backend->logfile = logfile ? g_strdup(logfile) : NULL;
3293
3294     backend->has_logappend = true;
3295     backend->logappend = qemu_opt_get_bool(opts, "logappend", false);
3296 }
3297
3298
3299 static void qemu_chr_parse_file_out(QemuOpts *opts, ChardevBackend *backend,
3300                                     Error **errp)
3301 {
3302     const char *path = qemu_opt_get(opts, "path");
3303     ChardevFile *file;
3304
3305     backend->type = CHARDEV_BACKEND_KIND_FILE;
3306     if (path == NULL) {
3307         error_setg(errp, "chardev: file: no filename given");
3308         return;
3309     }
3310     file = backend->u.file.data = g_new0(ChardevFile, 1);
3311     qemu_chr_parse_common(opts, qapi_ChardevFile_base(file));
3312     file->out = g_strdup(path);
3313
3314     file->has_append = true;
3315     file->append = qemu_opt_get_bool(opts, "append", false);
3316 }
3317
3318 static void qemu_chr_parse_stdio(QemuOpts *opts, ChardevBackend *backend,
3319                                  Error **errp)
3320 {
3321     ChardevStdio *stdio;
3322
3323     backend->type = CHARDEV_BACKEND_KIND_STDIO;
3324     stdio = backend->u.stdio.data = g_new0(ChardevStdio, 1);
3325     qemu_chr_parse_common(opts, qapi_ChardevStdio_base(stdio));
3326     stdio->has_signal = true;
3327     stdio->signal = qemu_opt_get_bool(opts, "signal", true);
3328 }
3329
3330 static void char_stdio_class_init(ObjectClass *oc, void *data)
3331 {
3332     ChardevClass *cc = CHARDEV_CLASS(oc);
3333
3334     cc->parse = qemu_chr_parse_stdio;
3335     cc->open = qemu_chr_open_stdio;
3336 #ifdef _WIN32
3337     cc->chr_write = win_stdio_write;
3338     cc->chr_set_echo = qemu_chr_set_echo_win_stdio;
3339 #else
3340     cc->chr_set_echo = qemu_chr_set_echo_stdio;
3341 #endif
3342 }
3343
3344 static const TypeInfo char_stdio_type_info = {
3345     .name = TYPE_CHARDEV_STDIO,
3346 #ifdef _WIN32
3347     .parent = TYPE_CHARDEV_WIN_STDIO,
3348 #else
3349     .parent = TYPE_CHARDEV_FD,
3350     .instance_finalize = char_stdio_finalize,
3351 #endif
3352     .class_init = char_stdio_class_init,
3353 };
3354
3355 #ifdef HAVE_CHARDEV_SERIAL
3356 static void qemu_chr_parse_serial(QemuOpts *opts, ChardevBackend *backend,
3357                                   Error **errp)
3358 {
3359     const char *device = qemu_opt_get(opts, "path");
3360     ChardevHostdev *serial;
3361
3362     backend->type = CHARDEV_BACKEND_KIND_SERIAL;
3363     if (device == NULL) {
3364         error_setg(errp, "chardev: serial/tty: no device path given");
3365         return;
3366     }
3367     serial = backend->u.serial.data = g_new0(ChardevHostdev, 1);
3368     qemu_chr_parse_common(opts, qapi_ChardevHostdev_base(serial));
3369     serial->device = g_strdup(device);
3370 }
3371 #endif
3372
3373 #ifdef HAVE_CHARDEV_PARPORT
3374 static void qemu_chr_parse_parallel(QemuOpts *opts, ChardevBackend *backend,
3375                                     Error **errp)
3376 {
3377     const char *device = qemu_opt_get(opts, "path");
3378     ChardevHostdev *parallel;
3379
3380     backend->type = CHARDEV_BACKEND_KIND_PARALLEL;
3381     if (device == NULL) {
3382         error_setg(errp, "chardev: parallel: no device path given");
3383         return;
3384     }
3385     parallel = backend->u.parallel.data = g_new0(ChardevHostdev, 1);
3386     qemu_chr_parse_common(opts, qapi_ChardevHostdev_base(parallel));
3387     parallel->device = g_strdup(device);
3388 }
3389 #endif
3390
3391 static void qemu_chr_parse_pipe(QemuOpts *opts, ChardevBackend *backend,
3392                                 Error **errp)
3393 {
3394     const char *device = qemu_opt_get(opts, "path");
3395     ChardevHostdev *dev;
3396
3397     backend->type = CHARDEV_BACKEND_KIND_PIPE;
3398     if (device == NULL) {
3399         error_setg(errp, "chardev: pipe: no device path given");
3400         return;
3401     }
3402     dev = backend->u.pipe.data = g_new0(ChardevHostdev, 1);
3403     qemu_chr_parse_common(opts, qapi_ChardevHostdev_base(dev));
3404     dev->device = g_strdup(device);
3405 }
3406
3407 static void char_pipe_class_init(ObjectClass *oc, void *data)
3408 {
3409     ChardevClass *cc = CHARDEV_CLASS(oc);
3410
3411     cc->parse = qemu_chr_parse_pipe;
3412     cc->open = qemu_chr_open_pipe;
3413 }
3414
3415 static const TypeInfo char_pipe_type_info = {
3416     .name = TYPE_CHARDEV_PIPE,
3417 #ifdef _WIN32
3418     .parent = TYPE_CHARDEV_WIN,
3419 #else
3420     .parent = TYPE_CHARDEV_FD,
3421 #endif
3422     .class_init = char_pipe_class_init,
3423 };
3424
3425 static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
3426                                   Error **errp)
3427 {
3428     bool is_listen      = qemu_opt_get_bool(opts, "server", false);
3429     bool is_waitconnect = is_listen && qemu_opt_get_bool(opts, "wait", true);
3430     bool is_telnet      = qemu_opt_get_bool(opts, "telnet", false);
3431     bool do_nodelay     = !qemu_opt_get_bool(opts, "delay", true);
3432     int64_t reconnect   = qemu_opt_get_number(opts, "reconnect", 0);
3433     const char *path = qemu_opt_get(opts, "path");
3434     const char *host = qemu_opt_get(opts, "host");
3435     const char *port = qemu_opt_get(opts, "port");
3436     const char *tls_creds = qemu_opt_get(opts, "tls-creds");
3437     SocketAddress *addr;
3438     ChardevSocket *sock;
3439
3440     backend->type = CHARDEV_BACKEND_KIND_SOCKET;
3441     if (!path) {
3442         if (!host) {
3443             error_setg(errp, "chardev: socket: no host given");
3444             return;
3445         }
3446         if (!port) {
3447             error_setg(errp, "chardev: socket: no port given");
3448             return;
3449         }
3450     } else {
3451         if (tls_creds) {
3452             error_setg(errp, "TLS can only be used over TCP socket");
3453             return;
3454         }
3455     }
3456
3457     sock = backend->u.socket.data = g_new0(ChardevSocket, 1);
3458     qemu_chr_parse_common(opts, qapi_ChardevSocket_base(sock));
3459
3460     sock->has_nodelay = true;
3461     sock->nodelay = do_nodelay;
3462     sock->has_server = true;
3463     sock->server = is_listen;
3464     sock->has_telnet = true;
3465     sock->telnet = is_telnet;
3466     sock->has_wait = true;
3467     sock->wait = is_waitconnect;
3468     sock->has_reconnect = true;
3469     sock->reconnect = reconnect;
3470     sock->tls_creds = g_strdup(tls_creds);
3471
3472     addr = g_new0(SocketAddress, 1);
3473     if (path) {
3474         UnixSocketAddress *q_unix;
3475         addr->type = SOCKET_ADDRESS_KIND_UNIX;
3476         q_unix = addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
3477         q_unix->path = g_strdup(path);
3478     } else {
3479         addr->type = SOCKET_ADDRESS_KIND_INET;
3480         addr->u.inet.data = g_new(InetSocketAddress, 1);
3481         *addr->u.inet.data = (InetSocketAddress) {
3482             .host = g_strdup(host),
3483             .port = g_strdup(port),
3484             .has_to = qemu_opt_get(opts, "to"),
3485             .to = qemu_opt_get_number(opts, "to", 0),
3486             .has_ipv4 = qemu_opt_get(opts, "ipv4"),
3487             .ipv4 = qemu_opt_get_bool(opts, "ipv4", 0),
3488             .has_ipv6 = qemu_opt_get(opts, "ipv6"),
3489             .ipv6 = qemu_opt_get_bool(opts, "ipv6", 0),
3490         };
3491     }
3492     sock->addr = addr;
3493 }
3494
3495 static void qemu_chr_parse_udp(QemuOpts *opts, ChardevBackend *backend,
3496                                Error **errp)
3497 {
3498     const char *host = qemu_opt_get(opts, "host");
3499     const char *port = qemu_opt_get(opts, "port");
3500     const char *localaddr = qemu_opt_get(opts, "localaddr");
3501     const char *localport = qemu_opt_get(opts, "localport");
3502     bool has_local = false;
3503     SocketAddress *addr;
3504     ChardevUdp *udp;
3505
3506     backend->type = CHARDEV_BACKEND_KIND_UDP;
3507     if (host == NULL || strlen(host) == 0) {
3508         host = "localhost";
3509     }
3510     if (port == NULL || strlen(port) == 0) {
3511         error_setg(errp, "chardev: udp: remote port not specified");
3512         return;
3513     }
3514     if (localport == NULL || strlen(localport) == 0) {
3515         localport = "0";
3516     } else {
3517         has_local = true;
3518     }
3519     if (localaddr == NULL || strlen(localaddr) == 0) {
3520         localaddr = "";
3521     } else {
3522         has_local = true;
3523     }
3524
3525     udp = backend->u.udp.data = g_new0(ChardevUdp, 1);
3526     qemu_chr_parse_common(opts, qapi_ChardevUdp_base(udp));
3527
3528     addr = g_new0(SocketAddress, 1);
3529     addr->type = SOCKET_ADDRESS_KIND_INET;
3530     addr->u.inet.data = g_new(InetSocketAddress, 1);
3531     *addr->u.inet.data = (InetSocketAddress) {
3532         .host = g_strdup(host),
3533         .port = g_strdup(port),
3534         .has_ipv4 = qemu_opt_get(opts, "ipv4"),
3535         .ipv4 = qemu_opt_get_bool(opts, "ipv4", 0),
3536         .has_ipv6 = qemu_opt_get(opts, "ipv6"),
3537         .ipv6 = qemu_opt_get_bool(opts, "ipv6", 0),
3538     };
3539     udp->remote = addr;
3540
3541     if (has_local) {
3542         udp->has_local = true;
3543         addr = g_new0(SocketAddress, 1);
3544         addr->type = SOCKET_ADDRESS_KIND_INET;
3545         addr->u.inet.data = g_new(InetSocketAddress, 1);
3546         *addr->u.inet.data = (InetSocketAddress) {
3547             .host = g_strdup(localaddr),
3548             .port = g_strdup(localport),
3549         };
3550         udp->local = addr;
3551     }
3552 }
3553
3554 static const ChardevClass *char_get_class(const char *driver, Error **errp)
3555 {
3556     ObjectClass *oc;
3557     const ChardevClass *cc;
3558     char *typename = g_strdup_printf("chardev-%s", driver);
3559
3560     oc = object_class_by_name(typename);
3561     g_free(typename);
3562
3563     if (!object_class_dynamic_cast(oc, TYPE_CHARDEV)) {
3564         error_setg(errp, "'%s' is not a valid char driver name", driver);
3565         return NULL;
3566     }
3567
3568     if (object_class_is_abstract(oc)) {
3569         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "driver",
3570                    "abstract device type");
3571         return NULL;
3572     }
3573
3574     cc = CHARDEV_CLASS(oc);
3575     if (cc->internal) {
3576         error_setg(errp, "'%s' is not a valid char driver name", driver);
3577         return NULL;
3578     }
3579
3580     return cc;
3581 }
3582
3583 static Chardev *qemu_chardev_add(const char *id, const char *typename,
3584                                  ChardevBackend *backend, Error **errp)
3585 {
3586     Chardev *chr;
3587
3588     chr = qemu_chr_find(id);
3589     if (chr) {
3590         error_setg(errp, "Chardev '%s' already exists", id);
3591         return NULL;
3592     }
3593
3594     chr = qemu_chardev_new(id, typename, backend, errp);
3595     if (!chr) {
3596         return NULL;
3597     }
3598
3599     QTAILQ_INSERT_TAIL(&chardevs, chr, next);
3600     return chr;
3601 }
3602
3603 static const struct ChardevAlias {
3604     const char *typename;
3605     const char *alias;
3606 } chardev_alias_table[] = {
3607 #ifdef HAVE_CHARDEV_PARPORT
3608     { "parallel", "parport" },
3609 #endif
3610 #ifdef HAVE_CHARDEV_SERIAL
3611     { "serial", "tty" },
3612 #endif
3613 };
3614
3615 typedef struct ChadevClassFE {
3616     void (*fn)(const char *name, void *opaque);
3617     void *opaque;
3618 } ChadevClassFE;
3619
3620 static void
3621 chardev_class_foreach(ObjectClass *klass, void *opaque)
3622 {
3623     ChadevClassFE *fe = opaque;
3624
3625     assert(g_str_has_prefix(object_class_get_name(klass), "chardev-"));
3626     if (CHARDEV_CLASS(klass)->internal) {
3627         return;
3628     }
3629
3630     fe->fn(object_class_get_name(klass) + 8, fe->opaque);
3631 }
3632
3633 static void
3634 chardev_name_foreach(void (*fn)(const char *name, void *opaque), void *opaque)
3635 {
3636     ChadevClassFE fe = { .fn = fn, .opaque = opaque };
3637     int i;
3638
3639     object_class_foreach(chardev_class_foreach, TYPE_CHARDEV, false, &fe);
3640
3641     for (i = 0; i < ARRAY_SIZE(chardev_alias_table); i++) {
3642         fn(chardev_alias_table[i].alias, opaque);
3643     }
3644 }
3645
3646 static void
3647 help_string_append(const char *name, void *opaque)
3648 {
3649     GString *str = opaque;
3650
3651     g_string_append_printf(str, "\n%s", name);
3652 }
3653
3654 Chardev *qemu_chr_new_from_opts(QemuOpts *opts,
3655                                 Error **errp)
3656 {
3657     Error *local_err = NULL;
3658     const ChardevClass *cc;
3659     Chardev *chr;
3660     int i;
3661     ChardevBackend *backend = NULL;
3662     const char *name = qemu_opt_get(opts, "backend");
3663     const char *id = qemu_opts_id(opts);
3664     char *bid = NULL;
3665
3666     if (name == NULL) {
3667         error_setg(errp, "chardev: \"%s\" missing backend",
3668                    qemu_opts_id(opts));
3669         return NULL;
3670     }
3671
3672     if (is_help_option(name)) {
3673         GString *str = g_string_new("");
3674
3675         chardev_name_foreach(help_string_append, str);
3676
3677         error_report("Available chardev backend types: %s", str->str);
3678         g_string_free(str, true);
3679         exit(0);
3680     }
3681
3682     if (id == NULL) {
3683         error_setg(errp, "chardev: no id specified");
3684         return NULL;
3685     }
3686
3687     for (i = 0; i < ARRAY_SIZE(chardev_alias_table); i++) {
3688         if (g_strcmp0(chardev_alias_table[i].alias, name) == 0) {
3689             name = chardev_alias_table[i].typename;
3690             break;
3691         }
3692     }
3693
3694     cc = char_get_class(name, errp);
3695     if (cc == NULL) {
3696         return NULL;
3697     }
3698
3699     backend = g_new0(ChardevBackend, 1);
3700     backend->type = CHARDEV_BACKEND_KIND_NULL;
3701
3702     if (qemu_opt_get_bool(opts, "mux", 0)) {
3703         bid = g_strdup_printf("%s-base", id);
3704     }
3705
3706     chr = NULL;
3707     if (cc->parse) {
3708         cc->parse(opts, backend, &local_err);
3709         if (local_err) {
3710             error_propagate(errp, local_err);
3711             goto out;
3712         }
3713     } else {
3714         ChardevCommon *ccom = g_new0(ChardevCommon, 1);
3715         qemu_chr_parse_common(opts, ccom);
3716         backend->u.null.data = ccom; /* Any ChardevCommon member would work */
3717     }
3718
3719     chr = qemu_chardev_add(bid ? bid : id,
3720                            object_class_get_name(OBJECT_CLASS(cc)),
3721                            backend, errp);
3722     if (chr == NULL) {
3723         goto out;
3724     }
3725
3726     if (bid) {
3727         Chardev *mux;
3728         qapi_free_ChardevBackend(backend);
3729         backend = g_new0(ChardevBackend, 1);
3730         backend->type = CHARDEV_BACKEND_KIND_MUX;
3731         backend->u.mux.data = g_new0(ChardevMux, 1);
3732         backend->u.mux.data->chardev = g_strdup(bid);
3733         mux = qemu_chardev_add(id, TYPE_CHARDEV_MUX, backend, errp);
3734         if (mux == NULL) {
3735             qemu_chr_delete(chr);
3736             chr = NULL;
3737             goto out;
3738         }
3739         chr = mux;
3740     }
3741
3742 out:
3743     qapi_free_ChardevBackend(backend);
3744     g_free(bid);
3745     return chr;
3746 }
3747
3748 Chardev *qemu_chr_new_noreplay(const char *label, const char *filename)
3749 {
3750     const char *p;
3751     Chardev *chr;
3752     QemuOpts *opts;
3753     Error *err = NULL;
3754
3755     if (strstart(filename, "chardev:", &p)) {
3756         return qemu_chr_find(p);
3757     }
3758
3759     opts = qemu_chr_parse_compat(label, filename);
3760     if (!opts)
3761         return NULL;
3762
3763     chr = qemu_chr_new_from_opts(opts, &err);
3764     if (err) {
3765         error_report_err(err);
3766     }
3767     if (chr && qemu_opt_get_bool(opts, "mux", 0)) {
3768         monitor_init(chr, MONITOR_USE_READLINE);
3769     }
3770     qemu_opts_del(opts);
3771     return chr;
3772 }
3773
3774 Chardev *qemu_chr_new(const char *label, const char *filename)
3775 {
3776     Chardev *chr;
3777     chr = qemu_chr_new_noreplay(label, filename);
3778     if (chr) {
3779         if (replay_mode != REPLAY_MODE_NONE) {
3780             qemu_chr_set_feature(chr, QEMU_CHAR_FEATURE_REPLAY);
3781         }
3782         if (qemu_chr_replay(chr) && CHARDEV_GET_CLASS(chr)->chr_ioctl) {
3783             error_report("Replay: ioctl is not supported "
3784                          "for serial devices yet");
3785         }
3786         replay_register_char_driver(chr);
3787     }
3788     return chr;
3789 }
3790
3791 void qemu_chr_fe_set_echo(CharBackend *be, bool echo)
3792 {
3793     Chardev *chr = be->chr;
3794
3795     if (chr && CHARDEV_GET_CLASS(chr)->chr_set_echo) {
3796         CHARDEV_GET_CLASS(chr)->chr_set_echo(chr, echo);
3797     }
3798 }
3799
3800 void qemu_chr_fe_set_open(CharBackend *be, int fe_open)
3801 {
3802     Chardev *chr = be->chr;
3803
3804     if (!chr) {
3805         return;
3806     }
3807
3808     if (be->fe_open == fe_open) {
3809         return;
3810     }
3811     be->fe_open = fe_open;
3812     if (CHARDEV_GET_CLASS(chr)->chr_set_fe_open) {
3813         CHARDEV_GET_CLASS(chr)->chr_set_fe_open(chr, fe_open);
3814     }
3815 }
3816
3817 guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
3818                             GIOFunc func, void *user_data)
3819 {
3820     Chardev *s = be->chr;
3821     GSource *src;
3822     guint tag;
3823
3824     if (!s || CHARDEV_GET_CLASS(s)->chr_add_watch == NULL) {
3825         return 0;
3826     }
3827
3828     src = CHARDEV_GET_CLASS(s)->chr_add_watch(s, cond);
3829     if (!src) {
3830         return 0;
3831     }
3832
3833     g_source_set_callback(src, (GSourceFunc)func, user_data, NULL);
3834     tag = g_source_attach(src, NULL);
3835     g_source_unref(src);
3836
3837     return tag;
3838 }
3839
3840 void qemu_chr_fe_disconnect(CharBackend *be)
3841 {
3842     Chardev *chr = be->chr;
3843
3844     if (chr && CHARDEV_GET_CLASS(chr)->chr_disconnect) {
3845         CHARDEV_GET_CLASS(chr)->chr_disconnect(chr);
3846     }
3847 }
3848
3849 void qemu_chr_delete(Chardev *chr)
3850 {
3851     QTAILQ_REMOVE(&chardevs, chr, next);
3852     object_unref(OBJECT(chr));
3853 }
3854
3855 ChardevInfoList *qmp_query_chardev(Error **errp)
3856 {
3857     ChardevInfoList *chr_list = NULL;
3858     Chardev *chr;
3859
3860     QTAILQ_FOREACH(chr, &chardevs, next) {
3861         ChardevInfoList *info = g_malloc0(sizeof(*info));
3862         info->value = g_malloc0(sizeof(*info->value));
3863         info->value->label = g_strdup(chr->label);
3864         info->value->filename = g_strdup(chr->filename);
3865         info->value->frontend_open = chr->be && chr->be->fe_open;
3866
3867         info->next = chr_list;
3868         chr_list = info;
3869     }
3870
3871     return chr_list;
3872 }
3873
3874 static void
3875 qmp_prepend_backend(const char *name, void *opaque)
3876 {
3877     ChardevBackendInfoList **list = opaque;
3878     ChardevBackendInfoList *info = g_malloc0(sizeof(*info));
3879
3880     info->value = g_malloc0(sizeof(*info->value));
3881     info->value->name = g_strdup(name);
3882     info->next = *list;
3883     *list = info;
3884 }
3885
3886 ChardevBackendInfoList *qmp_query_chardev_backends(Error **errp)
3887 {
3888     ChardevBackendInfoList *backend_list = NULL;
3889
3890     chardev_name_foreach(qmp_prepend_backend, &backend_list);
3891
3892     return backend_list;
3893 }
3894
3895 Chardev *qemu_chr_find(const char *name)
3896 {
3897     Chardev *chr;
3898
3899     QTAILQ_FOREACH(chr, &chardevs, next) {
3900         if (strcmp(chr->label, name) != 0)
3901             continue;
3902         return chr;
3903     }
3904     return NULL;
3905 }
3906
3907 QemuOptsList qemu_chardev_opts = {
3908     .name = "chardev",
3909     .implied_opt_name = "backend",
3910     .head = QTAILQ_HEAD_INITIALIZER(qemu_chardev_opts.head),
3911     .desc = {
3912         {
3913             .name = "backend",
3914             .type = QEMU_OPT_STRING,
3915         },{
3916             .name = "path",
3917             .type = QEMU_OPT_STRING,
3918         },{
3919             .name = "host",
3920             .type = QEMU_OPT_STRING,
3921         },{
3922             .name = "port",
3923             .type = QEMU_OPT_STRING,
3924         },{
3925             .name = "localaddr",
3926             .type = QEMU_OPT_STRING,
3927         },{
3928             .name = "localport",
3929             .type = QEMU_OPT_STRING,
3930         },{
3931             .name = "to",
3932             .type = QEMU_OPT_NUMBER,
3933         },{
3934             .name = "ipv4",
3935             .type = QEMU_OPT_BOOL,
3936         },{
3937             .name = "ipv6",
3938             .type = QEMU_OPT_BOOL,
3939         },{
3940             .name = "wait",
3941             .type = QEMU_OPT_BOOL,
3942         },{
3943             .name = "server",
3944             .type = QEMU_OPT_BOOL,
3945         },{
3946             .name = "delay",
3947             .type = QEMU_OPT_BOOL,
3948         },{
3949             .name = "reconnect",
3950             .type = QEMU_OPT_NUMBER,
3951         },{
3952             .name = "telnet",
3953             .type = QEMU_OPT_BOOL,
3954         },{
3955             .name = "tls-creds",
3956             .type = QEMU_OPT_STRING,
3957         },{
3958             .name = "width",
3959             .type = QEMU_OPT_NUMBER,
3960         },{
3961             .name = "height",
3962             .type = QEMU_OPT_NUMBER,
3963         },{
3964             .name = "cols",
3965             .type = QEMU_OPT_NUMBER,
3966         },{
3967             .name = "rows",
3968             .type = QEMU_OPT_NUMBER,
3969         },{
3970             .name = "mux",
3971             .type = QEMU_OPT_BOOL,
3972         },{
3973             .name = "signal",
3974             .type = QEMU_OPT_BOOL,
3975         },{
3976             .name = "name",
3977             .type = QEMU_OPT_STRING,
3978         },{
3979             .name = "debug",
3980             .type = QEMU_OPT_NUMBER,
3981         },{
3982             .name = "size",
3983             .type = QEMU_OPT_SIZE,
3984         },{
3985             .name = "chardev",
3986             .type = QEMU_OPT_STRING,
3987         },{
3988             .name = "append",
3989             .type = QEMU_OPT_BOOL,
3990         },{
3991             .name = "logfile",
3992             .type = QEMU_OPT_STRING,
3993         },{
3994             .name = "logappend",
3995             .type = QEMU_OPT_BOOL,
3996         },
3997         { /* end of list */ }
3998     },
3999 };
4000
4001 #ifdef _WIN32
4002
4003 static void qmp_chardev_open_file(Chardev *chr,
4004                                   ChardevBackend *backend,
4005                                   bool *be_opened,
4006                                   Error **errp)
4007 {
4008     ChardevFile *file = backend->u.file.data;
4009     HANDLE out;
4010     DWORD accessmode;
4011     DWORD flags;
4012
4013     if (file->has_in) {
4014         error_setg(errp, "input file not supported");
4015         return;
4016     }
4017
4018     if (file->has_append && file->append) {
4019         /* Append to file if it already exists. */
4020         accessmode = FILE_GENERIC_WRITE & ~FILE_WRITE_DATA;
4021         flags = OPEN_ALWAYS;
4022     } else {
4023         /* Truncate file if it already exists. */
4024         accessmode = GENERIC_WRITE;
4025         flags = CREATE_ALWAYS;
4026     }
4027
4028     out = CreateFile(file->out, accessmode, FILE_SHARE_READ, NULL, flags,
4029                      FILE_ATTRIBUTE_NORMAL, NULL);
4030     if (out == INVALID_HANDLE_VALUE) {
4031         error_setg(errp, "open %s failed", file->out);
4032         return;
4033     }
4034
4035     qemu_chr_open_win_file(chr, out);
4036 }
4037
4038 static void qmp_chardev_open_serial(Chardev *chr,
4039                                     ChardevBackend *backend,
4040                                     bool *be_opened,
4041                                     Error **errp)
4042 {
4043     ChardevHostdev *serial = backend->u.serial.data;
4044
4045     win_chr_init(chr, serial->device, errp);
4046 }
4047
4048 #else /* WIN32 */
4049
4050 static int qmp_chardev_open_file_source(char *src, int flags,
4051                                         Error **errp)
4052 {
4053     int fd = -1;
4054
4055     TFR(fd = qemu_open(src, flags, 0666));
4056     if (fd == -1) {
4057         error_setg_file_open(errp, errno, src);
4058     }
4059     return fd;
4060 }
4061
4062 static void qmp_chardev_open_file(Chardev *chr,
4063                                   ChardevBackend *backend,
4064                                   bool *be_opened,
4065                                   Error **errp)
4066 {
4067     ChardevFile *file = backend->u.file.data;
4068     int flags, in = -1, out;
4069
4070     flags = O_WRONLY | O_CREAT | O_BINARY;
4071     if (file->has_append && file->append) {
4072         flags |= O_APPEND;
4073     } else {
4074         flags |= O_TRUNC;
4075     }
4076
4077     out = qmp_chardev_open_file_source(file->out, flags, errp);
4078     if (out < 0) {
4079         return;
4080     }
4081
4082     if (file->has_in) {
4083         flags = O_RDONLY;
4084         in = qmp_chardev_open_file_source(file->in, flags, errp);
4085         if (in < 0) {
4086             qemu_close(out);
4087             return;
4088         }
4089     }
4090
4091     qemu_chr_open_fd(chr, in, out);
4092 }
4093
4094 #ifdef HAVE_CHARDEV_SERIAL
4095 static void qmp_chardev_open_serial(Chardev *chr,
4096                                     ChardevBackend *backend,
4097                                     bool *be_opened,
4098                                     Error **errp)
4099 {
4100     ChardevHostdev *serial = backend->u.serial.data;
4101     int fd;
4102
4103     fd = qmp_chardev_open_file_source(serial->device, O_RDWR, errp);
4104     if (fd < 0) {
4105         return;
4106     }
4107     qemu_set_nonblock(fd);
4108     tty_serial_init(fd, 115200, 'N', 8, 1);
4109
4110     qemu_chr_open_fd(chr, fd, fd);
4111 }
4112 #endif
4113
4114 #ifdef HAVE_CHARDEV_PARPORT
4115 static void qmp_chardev_open_parallel(Chardev *chr,
4116                                       ChardevBackend *backend,
4117                                       bool *be_opened,
4118                                       Error **errp)
4119 {
4120     ChardevHostdev *parallel = backend->u.parallel.data;
4121     int fd;
4122
4123     fd = qmp_chardev_open_file_source(parallel->device, O_RDWR, errp);
4124     if (fd < 0) {
4125         return;
4126     }
4127     qemu_chr_open_pp_fd(chr, fd, be_opened, errp);
4128 }
4129
4130 static void char_parallel_class_init(ObjectClass *oc, void *data)
4131 {
4132     ChardevClass *cc = CHARDEV_CLASS(oc);
4133
4134     cc->parse = qemu_chr_parse_parallel;
4135     cc->open = qmp_chardev_open_parallel;
4136 #if defined(__linux__)
4137     cc->chr_ioctl = pp_ioctl;
4138 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
4139     cc->chr_ioctl = pp_ioctl;
4140 #endif
4141 }
4142
4143 static void char_parallel_finalize(Object *obj)
4144 {
4145 #if defined(__linux__)
4146     Chardev *chr = CHARDEV(obj);
4147     ParallelChardev *drv = PARALLEL_CHARDEV(chr);
4148     int fd = drv->fd;
4149
4150     pp_hw_mode(drv, IEEE1284_MODE_COMPAT);
4151     ioctl(fd, PPRELEASE);
4152     close(fd);
4153     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
4154 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
4155     /* FIXME: close fd? */
4156 #endif
4157 }
4158
4159 static const TypeInfo char_parallel_type_info = {
4160     .name = TYPE_CHARDEV_PARALLEL,
4161     .parent = TYPE_CHARDEV,
4162     .instance_size = sizeof(ParallelChardev),
4163     .instance_finalize = char_parallel_finalize,
4164     .class_init = char_parallel_class_init,
4165 };
4166 #endif
4167
4168 #endif /* WIN32 */
4169
4170 static void char_file_class_init(ObjectClass *oc, void *data)
4171 {
4172     ChardevClass *cc = CHARDEV_CLASS(oc);
4173
4174     cc->parse = qemu_chr_parse_file_out;
4175     cc->open = qmp_chardev_open_file;
4176 }
4177
4178 static const TypeInfo char_file_type_info = {
4179     .name = TYPE_CHARDEV_FILE,
4180 #ifdef _WIN32
4181     .parent = TYPE_CHARDEV_WIN,
4182 #else
4183     .parent = TYPE_CHARDEV_FD,
4184 #endif
4185     .class_init = char_file_class_init,
4186 };
4187
4188 #ifdef HAVE_CHARDEV_SERIAL
4189
4190 static void char_serial_class_init(ObjectClass *oc, void *data)
4191 {
4192     ChardevClass *cc = CHARDEV_CLASS(oc);
4193
4194     cc->parse = qemu_chr_parse_serial;
4195     cc->open = qmp_chardev_open_serial;
4196 #ifndef _WIN32
4197     cc->chr_ioctl = tty_serial_ioctl;
4198 #endif
4199 }
4200
4201 static const TypeInfo char_serial_type_info = {
4202     .name = TYPE_CHARDEV_SERIAL,
4203 #ifdef _WIN32
4204     .parent = TYPE_CHARDEV_WIN,
4205 #else
4206     .parent = TYPE_CHARDEV_FD,
4207 #endif
4208     .class_init = char_serial_class_init,
4209 };
4210 #endif
4211
4212 static gboolean socket_reconnect_timeout(gpointer opaque)
4213 {
4214     Chardev *chr = CHARDEV(opaque);
4215     SocketChardev *s = SOCKET_CHARDEV(opaque);
4216     QIOChannelSocket *sioc;
4217
4218     s->reconnect_timer = 0;
4219
4220     if (chr->be_open) {
4221         return false;
4222     }
4223
4224     sioc = qio_channel_socket_new();
4225     tcp_chr_set_client_ioc_name(chr, sioc);
4226     qio_channel_socket_connect_async(sioc, s->addr,
4227                                      qemu_chr_socket_connected,
4228                                      chr, NULL);
4229
4230     return false;
4231 }
4232
4233 static void qmp_chardev_open_socket(Chardev *chr,
4234                                     ChardevBackend *backend,
4235                                     bool *be_opened,
4236                                     Error **errp)
4237 {
4238     SocketChardev *s = SOCKET_CHARDEV(chr);
4239     ChardevSocket *sock = backend->u.socket.data;
4240     SocketAddress *addr = sock->addr;
4241     bool do_nodelay     = sock->has_nodelay ? sock->nodelay : false;
4242     bool is_listen      = sock->has_server  ? sock->server  : true;
4243     bool is_telnet      = sock->has_telnet  ? sock->telnet  : false;
4244     bool is_waitconnect = sock->has_wait    ? sock->wait    : false;
4245     int64_t reconnect   = sock->has_reconnect ? sock->reconnect : 0;
4246     QIOChannelSocket *sioc = NULL;
4247
4248     s->is_unix = addr->type == SOCKET_ADDRESS_KIND_UNIX;
4249     s->is_listen = is_listen;
4250     s->is_telnet = is_telnet;
4251     s->do_nodelay = do_nodelay;
4252     if (sock->tls_creds) {
4253         Object *creds;
4254         creds = object_resolve_path_component(
4255             object_get_objects_root(), sock->tls_creds);
4256         if (!creds) {
4257             error_setg(errp, "No TLS credentials with id '%s'",
4258                        sock->tls_creds);
4259             goto error;
4260         }
4261         s->tls_creds = (QCryptoTLSCreds *)
4262             object_dynamic_cast(creds,
4263                                 TYPE_QCRYPTO_TLS_CREDS);
4264         if (!s->tls_creds) {
4265             error_setg(errp, "Object with id '%s' is not TLS credentials",
4266                        sock->tls_creds);
4267             goto error;
4268         }
4269         object_ref(OBJECT(s->tls_creds));
4270         if (is_listen) {
4271             if (s->tls_creds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
4272                 error_setg(errp, "%s",
4273                            "Expected TLS credentials for server endpoint");
4274                 goto error;
4275             }
4276         } else {
4277             if (s->tls_creds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
4278                 error_setg(errp, "%s",
4279                            "Expected TLS credentials for client endpoint");
4280                 goto error;
4281             }
4282         }
4283     }
4284
4285     s->addr = QAPI_CLONE(SocketAddress, sock->addr);
4286
4287     qemu_chr_set_feature(chr, QEMU_CHAR_FEATURE_RECONNECTABLE);
4288     if (s->is_unix) {
4289         qemu_chr_set_feature(chr, QEMU_CHAR_FEATURE_FD_PASS);
4290     }
4291
4292     /* be isn't opened until we get a connection */
4293     *be_opened = false;
4294
4295     chr->filename = SocketAddress_to_str("disconnected:",
4296                                          addr, is_listen, is_telnet);
4297
4298     if (is_listen) {
4299         if (is_telnet) {
4300             s->do_telnetopt = 1;
4301         }
4302     } else if (reconnect > 0) {
4303         s->reconnect_time = reconnect;
4304     }
4305
4306     if (s->reconnect_time) {
4307         sioc = qio_channel_socket_new();
4308         tcp_chr_set_client_ioc_name(chr, sioc);
4309         qio_channel_socket_connect_async(sioc, s->addr,
4310                                          qemu_chr_socket_connected,
4311                                          chr, NULL);
4312     } else {
4313         if (s->is_listen) {
4314             char *name;
4315             sioc = qio_channel_socket_new();
4316
4317             name = g_strdup_printf("chardev-tcp-listener-%s", chr->label);
4318             qio_channel_set_name(QIO_CHANNEL(sioc), name);
4319             g_free(name);
4320
4321             if (qio_channel_socket_listen_sync(sioc, s->addr, errp) < 0) {
4322                 goto error;
4323             }
4324             s->listen_ioc = sioc;
4325             if (is_waitconnect &&
4326                 qemu_chr_wait_connected(chr, errp) < 0) {
4327                 return;
4328             }
4329             if (!s->ioc) {
4330                 s->listen_tag = qio_channel_add_watch(
4331                     QIO_CHANNEL(s->listen_ioc), G_IO_IN,
4332                     tcp_chr_accept, chr, NULL);
4333             }
4334         } else if (qemu_chr_wait_connected(chr, errp) < 0) {
4335             goto error;
4336         }
4337     }
4338
4339     return;
4340
4341 error:
4342     if (sioc) {
4343         object_unref(OBJECT(sioc));
4344     }
4345 }
4346
4347 static void char_socket_class_init(ObjectClass *oc, void *data)
4348 {
4349     ChardevClass *cc = CHARDEV_CLASS(oc);
4350
4351     cc->parse = qemu_chr_parse_socket;
4352     cc->open = qmp_chardev_open_socket;
4353     cc->chr_wait_connected = tcp_chr_wait_connected;
4354     cc->chr_write = tcp_chr_write;
4355     cc->chr_sync_read = tcp_chr_sync_read;
4356     cc->chr_disconnect = tcp_chr_disconnect;
4357     cc->get_msgfds = tcp_get_msgfds;
4358     cc->set_msgfds = tcp_set_msgfds;
4359     cc->chr_add_client = tcp_chr_add_client;
4360     cc->chr_add_watch = tcp_chr_add_watch;
4361     cc->chr_update_read_handler = tcp_chr_update_read_handler;
4362 }
4363
4364 static const TypeInfo char_socket_type_info = {
4365     .name = TYPE_CHARDEV_SOCKET,
4366     .parent = TYPE_CHARDEV,
4367     .instance_size = sizeof(SocketChardev),
4368     .instance_finalize = char_socket_finalize,
4369     .class_init = char_socket_class_init,
4370 };
4371
4372 static void qmp_chardev_open_udp(Chardev *chr,
4373                                  ChardevBackend *backend,
4374                                  bool *be_opened,
4375                                  Error **errp)
4376 {
4377     ChardevUdp *udp = backend->u.udp.data;
4378     QIOChannelSocket *sioc = qio_channel_socket_new();
4379     char *name;
4380     UdpChardev *s = UDP_CHARDEV(chr);
4381
4382     if (qio_channel_socket_dgram_sync(sioc,
4383                                       udp->local, udp->remote,
4384                                       errp) < 0) {
4385         object_unref(OBJECT(sioc));
4386         return;
4387     }
4388
4389     name = g_strdup_printf("chardev-udp-%s", chr->label);
4390     qio_channel_set_name(QIO_CHANNEL(sioc), name);
4391     g_free(name);
4392
4393     s->ioc = QIO_CHANNEL(sioc);
4394     /* be isn't opened until we get a connection */
4395     *be_opened = false;
4396 }
4397
4398 static void char_udp_class_init(ObjectClass *oc, void *data)
4399 {
4400     ChardevClass *cc = CHARDEV_CLASS(oc);
4401
4402     cc->parse = qemu_chr_parse_udp;
4403     cc->open = qmp_chardev_open_udp;
4404     cc->chr_write = udp_chr_write;
4405     cc->chr_update_read_handler = udp_chr_update_read_handler;
4406 }
4407
4408 static const TypeInfo char_udp_type_info = {
4409     .name = TYPE_CHARDEV_UDP,
4410     .parent = TYPE_CHARDEV,
4411     .instance_size = sizeof(UdpChardev),
4412     .instance_finalize = char_udp_finalize,
4413     .class_init = char_udp_class_init,
4414 };
4415
4416 bool qemu_chr_has_feature(Chardev *chr,
4417                           ChardevFeature feature)
4418 {
4419     return test_bit(feature, chr->features);
4420 }
4421
4422 void qemu_chr_set_feature(Chardev *chr,
4423                            ChardevFeature feature)
4424 {
4425     return set_bit(feature, chr->features);
4426 }
4427
4428 Chardev *qemu_chardev_new(const char *id, const char *typename,
4429                           ChardevBackend *backend, Error **errp)
4430 {
4431     Chardev *chr = NULL;
4432     Error *local_err = NULL;
4433     bool be_opened = true;
4434
4435     assert(g_str_has_prefix(typename, "chardev-"));
4436
4437     chr = CHARDEV(object_new(typename));
4438     chr->label = g_strdup(id);
4439
4440     qemu_char_open(chr, backend, &be_opened, &local_err);
4441     if (local_err) {
4442         error_propagate(errp, local_err);
4443         object_unref(OBJECT(chr));
4444         return NULL;
4445     }
4446
4447     if (!chr->filename) {
4448         chr->filename = g_strdup(typename + 8);
4449     }
4450     if (be_opened) {
4451         qemu_chr_be_event(chr, CHR_EVENT_OPENED);
4452     }
4453
4454     return chr;
4455 }
4456
4457 ChardevReturn *qmp_chardev_add(const char *id, ChardevBackend *backend,
4458                                Error **errp)
4459 {
4460     const ChardevClass *cc;
4461     ChardevReturn *ret;
4462     Chardev *chr;
4463
4464     cc = char_get_class(ChardevBackendKind_lookup[backend->type], errp);
4465     if (!cc) {
4466         return NULL;
4467     }
4468
4469     chr = qemu_chardev_add(id, object_class_get_name(OBJECT_CLASS(cc)),
4470                            backend, errp);
4471     if (!chr) {
4472         return NULL;
4473     }
4474
4475     ret = g_new0(ChardevReturn, 1);
4476     if (CHARDEV_IS_PTY(chr)) {
4477         ret->pty = g_strdup(chr->filename + 4);
4478         ret->has_pty = true;
4479     }
4480
4481     return ret;
4482 }
4483
4484 void qmp_chardev_remove(const char *id, Error **errp)
4485 {
4486     Chardev *chr;
4487
4488     chr = qemu_chr_find(id);
4489     if (chr == NULL) {
4490         error_setg(errp, "Chardev '%s' not found", id);
4491         return;
4492     }
4493     if (qemu_chr_is_busy(chr)) {
4494         error_setg(errp, "Chardev '%s' is busy", id);
4495         return;
4496     }
4497     if (qemu_chr_replay(chr)) {
4498         error_setg(errp,
4499             "Chardev '%s' cannot be unplugged in record/replay mode", id);
4500         return;
4501     }
4502     qemu_chr_delete(chr);
4503 }
4504
4505 void qemu_chr_cleanup(void)
4506 {
4507     Chardev *chr, *tmp;
4508
4509     QTAILQ_FOREACH_SAFE(chr, &chardevs, next, tmp) {
4510         qemu_chr_delete(chr);
4511     }
4512 }
4513
4514 static void register_types(void)
4515 {
4516     type_register_static(&char_type_info);
4517 #ifndef _WIN32
4518     type_register_static(&char_fd_type_info);
4519 #else
4520     type_register_static(&char_win_type_info);
4521     type_register_static(&char_win_stdio_type_info);
4522 #endif
4523     type_register_static(&char_socket_type_info);
4524     type_register_static(&char_udp_type_info);
4525     type_register_static(&char_file_type_info);
4526     type_register_static(&char_stdio_type_info);
4527 #ifdef HAVE_CHARDEV_SERIAL
4528     type_register_static(&char_serial_type_info);
4529 #endif
4530 #ifdef HAVE_CHARDEV_PARPORT
4531     type_register_static(&char_parallel_type_info);
4532 #endif
4533 #ifdef HAVE_CHARDEV_PTY
4534     type_register_static(&char_pty_type_info);
4535 #endif
4536 #ifdef _WIN32
4537     type_register_static(&char_console_type_info);
4538 #endif
4539     type_register_static(&char_pipe_type_info);
4540
4541     /* this must be done after machine init, since we register FEs with muxes
4542      * as part of realize functions like serial_isa_realizefn when -nographic
4543      * is specified
4544      */
4545     qemu_add_machine_init_done_notifier(&muxes_realize_notify);
4546 }
4547
4548 type_init(register_types);