xref: /openbmc/qemu/chardev/char-socket.c (revision d7478d42)
1 /*
2  * QEMU System Emulator
3  *
4  * Copyright (c) 2003-2008 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "chardev/char.h"
27 #include "io/channel-socket.h"
28 #include "io/channel-websock.h"
29 #include "qemu/error-report.h"
30 #include "qemu/module.h"
31 #include "qemu/option.h"
32 #include "qapi/error.h"
33 #include "qapi/clone-visitor.h"
34 #include "qapi/qapi-visit-sockets.h"
35 #include "qemu/yank.h"
36 
37 #include "chardev/char-io.h"
38 #include "chardev/char-socket.h"
39 
40 static gboolean socket_reconnect_timeout(gpointer opaque);
41 static void tcp_chr_telnet_init(Chardev *chr);
42 
43 static void tcp_chr_change_state(SocketChardev *s, TCPChardevState state)
44 {
45     switch (state) {
46     case TCP_CHARDEV_STATE_DISCONNECTED:
47         break;
48     case TCP_CHARDEV_STATE_CONNECTING:
49         assert(s->state == TCP_CHARDEV_STATE_DISCONNECTED);
50         break;
51     case TCP_CHARDEV_STATE_CONNECTED:
52         assert(s->state == TCP_CHARDEV_STATE_CONNECTING);
53         break;
54     }
55     s->state = state;
56 }
57 
58 static void tcp_chr_reconn_timer_cancel(SocketChardev *s)
59 {
60     if (s->reconnect_timer) {
61         g_source_destroy(s->reconnect_timer);
62         g_source_unref(s->reconnect_timer);
63         s->reconnect_timer = NULL;
64     }
65 }
66 
67 static void qemu_chr_socket_restart_timer(Chardev *chr)
68 {
69     SocketChardev *s = SOCKET_CHARDEV(chr);
70     char *name;
71 
72     assert(s->state == TCP_CHARDEV_STATE_DISCONNECTED);
73     assert(!s->reconnect_timer);
74     name = g_strdup_printf("chardev-socket-reconnect-%s", chr->label);
75     s->reconnect_timer = qemu_chr_timeout_add_ms(chr,
76                                                  s->reconnect_time * 1000,
77                                                  socket_reconnect_timeout,
78                                                  chr);
79     g_source_set_name(s->reconnect_timer, name);
80     g_free(name);
81 }
82 
83 static void check_report_connect_error(Chardev *chr,
84                                        Error *err)
85 {
86     SocketChardev *s = SOCKET_CHARDEV(chr);
87 
88     if (!s->connect_err_reported) {
89         error_reportf_err(err,
90                           "Unable to connect character device %s: ",
91                           chr->label);
92         s->connect_err_reported = true;
93     } else {
94         error_free(err);
95     }
96     qemu_chr_socket_restart_timer(chr);
97 }
98 
99 static void tcp_chr_accept(QIONetListener *listener,
100                            QIOChannelSocket *cioc,
101                            void *opaque);
102 
103 static int tcp_chr_read_poll(void *opaque);
104 static void tcp_chr_disconnect_locked(Chardev *chr);
105 
106 /* Called with chr_write_lock held.  */
107 static int tcp_chr_write(Chardev *chr, const uint8_t *buf, int len)
108 {
109     SocketChardev *s = SOCKET_CHARDEV(chr);
110 
111     if (s->state == TCP_CHARDEV_STATE_CONNECTED) {
112         int ret =  io_channel_send_full(s->ioc, buf, len,
113                                         s->write_msgfds,
114                                         s->write_msgfds_num);
115 
116         /* free the written msgfds in any cases
117          * other than ret < 0 && errno == EAGAIN
118          */
119         if (!(ret < 0 && EAGAIN == errno)
120             && s->write_msgfds_num) {
121             g_free(s->write_msgfds);
122             s->write_msgfds = 0;
123             s->write_msgfds_num = 0;
124         }
125 
126         if (ret < 0 && errno != EAGAIN) {
127             if (tcp_chr_read_poll(chr) <= 0) {
128                 /* Perform disconnect and return error. */
129                 tcp_chr_disconnect_locked(chr);
130             } /* else let the read handler finish it properly */
131         }
132 
133         return ret;
134     } else {
135         /* Indicate an error. */
136         errno = EIO;
137         return -1;
138     }
139 }
140 
141 static int tcp_chr_read_poll(void *opaque)
142 {
143     Chardev *chr = CHARDEV(opaque);
144     SocketChardev *s = SOCKET_CHARDEV(opaque);
145     if (s->state != TCP_CHARDEV_STATE_CONNECTED) {
146         return 0;
147     }
148     s->max_size = qemu_chr_be_can_write(chr);
149     return s->max_size;
150 }
151 
152 static void tcp_chr_process_IAC_bytes(Chardev *chr,
153                                       SocketChardev *s,
154                                       uint8_t *buf, int *size)
155 {
156     /* Handle any telnet or tn3270 client's basic IAC options.
157      * For telnet options, it satisfies char by char mode with no echo.
158      * For tn3270 options, it satisfies binary mode with EOR.
159      * All IAC options will be removed from the buf and the do_opt
160      * pointer will be used to track the state of the width of the
161      * IAC information.
162      *
163      * RFC854: "All TELNET commands consist of at least a two byte sequence.
164      * The commands dealing with option negotiation are three byte sequences,
165      * the third byte being the code for the option referenced."
166      * "IAC BREAK", "IAC IP", "IAC NOP" and the double IAC are two bytes.
167      * "IAC SB", "IAC SE" and "IAC EOR" are saved to split up data boundary
168      * for tn3270.
169      * NOP, Break and Interrupt Process(IP) might be encountered during a TN3270
170      * session, and NOP and IP need to be done later.
171      */
172 
173     int i;
174     int j = 0;
175 
176     for (i = 0; i < *size; i++) {
177         if (s->do_telnetopt > 1) {
178             if ((unsigned char)buf[i] == IAC && s->do_telnetopt == 2) {
179                 /* Double IAC means send an IAC */
180                 if (j != i) {
181                     buf[j] = buf[i];
182                 }
183                 j++;
184                 s->do_telnetopt = 1;
185             } else {
186                 if ((unsigned char)buf[i] == IAC_BREAK
187                     && s->do_telnetopt == 2) {
188                     /* Handle IAC break commands by sending a serial break */
189                     qemu_chr_be_event(chr, CHR_EVENT_BREAK);
190                     s->do_telnetopt++;
191                 } else if (s->is_tn3270 && ((unsigned char)buf[i] == IAC_EOR
192                            || (unsigned char)buf[i] == IAC_SB
193                            || (unsigned char)buf[i] == IAC_SE)
194                            && s->do_telnetopt == 2) {
195                     buf[j++] = IAC;
196                     buf[j++] = buf[i];
197                     s->do_telnetopt++;
198                 } else if (s->is_tn3270 && ((unsigned char)buf[i] == IAC_IP
199                            || (unsigned char)buf[i] == IAC_NOP)
200                            && s->do_telnetopt == 2) {
201                     /* TODO: IP and NOP need to be implemented later. */
202                     s->do_telnetopt++;
203                 }
204                 s->do_telnetopt++;
205             }
206             if (s->do_telnetopt >= 4) {
207                 s->do_telnetopt = 1;
208             }
209         } else {
210             if ((unsigned char)buf[i] == IAC) {
211                 s->do_telnetopt = 2;
212             } else {
213                 if (j != i) {
214                     buf[j] = buf[i];
215                 }
216                 j++;
217             }
218         }
219     }
220     *size = j;
221 }
222 
223 static int tcp_get_msgfds(Chardev *chr, int *fds, int num)
224 {
225     SocketChardev *s = SOCKET_CHARDEV(chr);
226 
227     int to_copy = (s->read_msgfds_num < num) ? s->read_msgfds_num : num;
228 
229     assert(num <= TCP_MAX_FDS);
230 
231     if (to_copy) {
232         int i;
233 
234         memcpy(fds, s->read_msgfds, to_copy * sizeof(int));
235 
236         /* Close unused fds */
237         for (i = to_copy; i < s->read_msgfds_num; i++) {
238             close(s->read_msgfds[i]);
239         }
240 
241         g_free(s->read_msgfds);
242         s->read_msgfds = 0;
243         s->read_msgfds_num = 0;
244     }
245 
246     return to_copy;
247 }
248 
249 static int tcp_set_msgfds(Chardev *chr, int *fds, int num)
250 {
251     SocketChardev *s = SOCKET_CHARDEV(chr);
252 
253     /* clear old pending fd array */
254     g_free(s->write_msgfds);
255     s->write_msgfds = NULL;
256     s->write_msgfds_num = 0;
257 
258     if ((s->state != TCP_CHARDEV_STATE_CONNECTED) ||
259         !qio_channel_has_feature(s->ioc,
260                                  QIO_CHANNEL_FEATURE_FD_PASS)) {
261         return -1;
262     }
263 
264     if (num) {
265         s->write_msgfds = g_new(int, num);
266         memcpy(s->write_msgfds, fds, num * sizeof(int));
267     }
268 
269     s->write_msgfds_num = num;
270 
271     return 0;
272 }
273 
274 static ssize_t tcp_chr_recv(Chardev *chr, char *buf, size_t len)
275 {
276     SocketChardev *s = SOCKET_CHARDEV(chr);
277     struct iovec iov = { .iov_base = buf, .iov_len = len };
278     int ret;
279     size_t i;
280     int *msgfds = NULL;
281     size_t msgfds_num = 0;
282 
283     if (qio_channel_has_feature(s->ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
284         ret = qio_channel_readv_full(s->ioc, &iov, 1,
285                                      &msgfds, &msgfds_num,
286                                      NULL);
287     } else {
288         ret = qio_channel_readv_full(s->ioc, &iov, 1,
289                                      NULL, NULL,
290                                      NULL);
291     }
292 
293     if (ret == QIO_CHANNEL_ERR_BLOCK) {
294         errno = EAGAIN;
295         ret = -1;
296     } else if (ret == -1) {
297         errno = EIO;
298     }
299 
300     if (msgfds_num) {
301         /* close and clean read_msgfds */
302         for (i = 0; i < s->read_msgfds_num; i++) {
303             close(s->read_msgfds[i]);
304         }
305 
306         if (s->read_msgfds_num) {
307             g_free(s->read_msgfds);
308         }
309 
310         s->read_msgfds = msgfds;
311         s->read_msgfds_num = msgfds_num;
312     }
313 
314     for (i = 0; i < s->read_msgfds_num; i++) {
315         int fd = s->read_msgfds[i];
316         if (fd < 0) {
317             continue;
318         }
319 
320         /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
321         qemu_set_block(fd);
322 
323 #ifndef MSG_CMSG_CLOEXEC
324         qemu_set_cloexec(fd);
325 #endif
326     }
327 
328     return ret;
329 }
330 
331 static GSource *tcp_chr_add_watch(Chardev *chr, GIOCondition cond)
332 {
333     SocketChardev *s = SOCKET_CHARDEV(chr);
334     if (!s->ioc) {
335         return NULL;
336     }
337     return qio_channel_create_watch(s->ioc, cond);
338 }
339 
340 static void remove_hup_source(SocketChardev *s)
341 {
342     if (s->hup_source != NULL) {
343         g_source_destroy(s->hup_source);
344         g_source_unref(s->hup_source);
345         s->hup_source = NULL;
346     }
347 }
348 
349 static void char_socket_yank_iochannel(void *opaque)
350 {
351     QIOChannel *ioc = QIO_CHANNEL(opaque);
352 
353     qio_channel_shutdown(ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
354 }
355 
356 static void tcp_chr_free_connection(Chardev *chr)
357 {
358     SocketChardev *s = SOCKET_CHARDEV(chr);
359     int i;
360 
361     if (s->read_msgfds_num) {
362         for (i = 0; i < s->read_msgfds_num; i++) {
363             close(s->read_msgfds[i]);
364         }
365         g_free(s->read_msgfds);
366         s->read_msgfds = NULL;
367         s->read_msgfds_num = 0;
368     }
369 
370     remove_hup_source(s);
371 
372     tcp_set_msgfds(chr, NULL, 0);
373     remove_fd_in_watch(chr);
374     if (s->registered_yank &&
375         (s->state == TCP_CHARDEV_STATE_CONNECTING
376         || s->state == TCP_CHARDEV_STATE_CONNECTED)) {
377         yank_unregister_function(CHARDEV_YANK_INSTANCE(chr->label),
378                                  char_socket_yank_iochannel,
379                                  QIO_CHANNEL(s->sioc));
380     }
381     object_unref(OBJECT(s->sioc));
382     s->sioc = NULL;
383     object_unref(OBJECT(s->ioc));
384     s->ioc = NULL;
385     g_free(chr->filename);
386     chr->filename = NULL;
387     tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
388 }
389 
390 static const char *qemu_chr_socket_protocol(SocketChardev *s)
391 {
392     if (s->is_telnet) {
393         return "telnet";
394     }
395     return s->is_websock ? "websocket" : "tcp";
396 }
397 
398 static char *qemu_chr_socket_address(SocketChardev *s, const char *prefix)
399 {
400     switch (s->addr->type) {
401     case SOCKET_ADDRESS_TYPE_INET:
402         return g_strdup_printf("%s%s:%s:%s%s", prefix,
403                                qemu_chr_socket_protocol(s),
404                                s->addr->u.inet.host,
405                                s->addr->u.inet.port,
406                                s->is_listen ? ",server=on" : "");
407         break;
408     case SOCKET_ADDRESS_TYPE_UNIX:
409     {
410         const char *tight = "", *abstract = "";
411         UnixSocketAddress *sa = &s->addr->u.q_unix;
412 
413 #ifdef CONFIG_LINUX
414         if (sa->has_abstract && sa->abstract) {
415             abstract = ",abstract=on";
416             if (sa->has_tight && sa->tight) {
417                 tight = ",tight=on";
418             }
419         }
420 #endif
421 
422         return g_strdup_printf("%sunix:%s%s%s%s", prefix, sa->path,
423                                abstract, tight,
424                                s->is_listen ? ",server=on" : "");
425         break;
426     }
427     case SOCKET_ADDRESS_TYPE_FD:
428         return g_strdup_printf("%sfd:%s%s", prefix, s->addr->u.fd.str,
429                                s->is_listen ? ",server=on" : "");
430         break;
431     case SOCKET_ADDRESS_TYPE_VSOCK:
432         return g_strdup_printf("%svsock:%s:%s", prefix,
433                                s->addr->u.vsock.cid,
434                                s->addr->u.vsock.port);
435     default:
436         abort();
437     }
438 }
439 
440 static void update_disconnected_filename(SocketChardev *s)
441 {
442     Chardev *chr = CHARDEV(s);
443 
444     g_free(chr->filename);
445     if (s->addr) {
446         chr->filename = qemu_chr_socket_address(s, "disconnected:");
447     } else {
448         chr->filename = g_strdup("disconnected:socket");
449     }
450 }
451 
452 /* NB may be called even if tcp_chr_connect has not been
453  * reached, due to TLS or telnet initialization failure,
454  * so can *not* assume s->state == TCP_CHARDEV_STATE_CONNECTED
455  * This must be called with chr->chr_write_lock held.
456  */
457 static void tcp_chr_disconnect_locked(Chardev *chr)
458 {
459     SocketChardev *s = SOCKET_CHARDEV(chr);
460     bool emit_close = s->state == TCP_CHARDEV_STATE_CONNECTED;
461 
462     tcp_chr_free_connection(chr);
463 
464     if (s->listener) {
465         qio_net_listener_set_client_func_full(s->listener, tcp_chr_accept,
466                                               chr, NULL, chr->gcontext);
467     }
468     update_disconnected_filename(s);
469     if (emit_close) {
470         qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
471     }
472     if (s->reconnect_time && !s->reconnect_timer) {
473         qemu_chr_socket_restart_timer(chr);
474     }
475 }
476 
477 static void tcp_chr_disconnect(Chardev *chr)
478 {
479     qemu_mutex_lock(&chr->chr_write_lock);
480     tcp_chr_disconnect_locked(chr);
481     qemu_mutex_unlock(&chr->chr_write_lock);
482 }
483 
484 static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
485 {
486     Chardev *chr = CHARDEV(opaque);
487     SocketChardev *s = SOCKET_CHARDEV(opaque);
488     uint8_t buf[CHR_READ_BUF_LEN];
489     int len, size;
490 
491     if ((s->state != TCP_CHARDEV_STATE_CONNECTED) ||
492         s->max_size <= 0) {
493         return TRUE;
494     }
495     len = sizeof(buf);
496     if (len > s->max_size) {
497         len = s->max_size;
498     }
499     size = tcp_chr_recv(chr, (void *)buf, len);
500     if (size == 0 || (size == -1 && errno != EAGAIN)) {
501         /* connection closed */
502         tcp_chr_disconnect(chr);
503     } else if (size > 0) {
504         if (s->do_telnetopt) {
505             tcp_chr_process_IAC_bytes(chr, s, buf, &size);
506         }
507         if (size > 0) {
508             qemu_chr_be_write(chr, buf, size);
509         }
510     }
511 
512     return TRUE;
513 }
514 
515 static gboolean tcp_chr_hup(QIOChannel *channel,
516                                GIOCondition cond,
517                                void *opaque)
518 {
519     Chardev *chr = CHARDEV(opaque);
520     tcp_chr_disconnect(chr);
521     return G_SOURCE_REMOVE;
522 }
523 
524 static int tcp_chr_sync_read(Chardev *chr, const uint8_t *buf, int len)
525 {
526     SocketChardev *s = SOCKET_CHARDEV(chr);
527     int size;
528 
529     if (s->state != TCP_CHARDEV_STATE_CONNECTED) {
530         return 0;
531     }
532 
533     qio_channel_set_blocking(s->ioc, true, NULL);
534     size = tcp_chr_recv(chr, (void *) buf, len);
535     if (s->state != TCP_CHARDEV_STATE_DISCONNECTED) {
536         qio_channel_set_blocking(s->ioc, false, NULL);
537     }
538     if (size == 0) {
539         /* connection closed */
540         tcp_chr_disconnect(chr);
541     }
542 
543     return size;
544 }
545 
546 static char *qemu_chr_compute_filename(SocketChardev *s)
547 {
548     struct sockaddr_storage *ss = &s->sioc->localAddr;
549     struct sockaddr_storage *ps = &s->sioc->remoteAddr;
550     socklen_t ss_len = s->sioc->localAddrLen;
551     socklen_t ps_len = s->sioc->remoteAddrLen;
552     char shost[NI_MAXHOST], sserv[NI_MAXSERV];
553     char phost[NI_MAXHOST], pserv[NI_MAXSERV];
554     const char *left = "", *right = "";
555 
556     switch (ss->ss_family) {
557 #ifndef _WIN32
558     case AF_UNIX:
559         return g_strdup_printf("unix:%s%s",
560                                ((struct sockaddr_un *)(ss))->sun_path,
561                                s->is_listen ? ",server=on" : "");
562 #endif
563     case AF_INET6:
564         left  = "[";
565         right = "]";
566         /* fall through */
567     case AF_INET:
568         getnameinfo((struct sockaddr *) ss, ss_len, shost, sizeof(shost),
569                     sserv, sizeof(sserv), NI_NUMERICHOST | NI_NUMERICSERV);
570         getnameinfo((struct sockaddr *) ps, ps_len, phost, sizeof(phost),
571                     pserv, sizeof(pserv), NI_NUMERICHOST | NI_NUMERICSERV);
572         return g_strdup_printf("%s:%s%s%s:%s%s <-> %s%s%s:%s",
573                                qemu_chr_socket_protocol(s),
574                                left, shost, right, sserv,
575                                s->is_listen ? ",server=on" : "",
576                                left, phost, right, pserv);
577 
578     default:
579         return g_strdup_printf("unknown");
580     }
581 }
582 
583 static void update_ioc_handlers(SocketChardev *s)
584 {
585     Chardev *chr = CHARDEV(s);
586 
587     if (s->state != TCP_CHARDEV_STATE_CONNECTED) {
588         return;
589     }
590 
591     remove_fd_in_watch(chr);
592     chr->gsource = io_add_watch_poll(chr, s->ioc,
593                                      tcp_chr_read_poll,
594                                      tcp_chr_read, chr,
595                                      chr->gcontext);
596 
597     remove_hup_source(s);
598     s->hup_source = qio_channel_create_watch(s->ioc, G_IO_HUP);
599     g_source_set_callback(s->hup_source, (GSourceFunc)tcp_chr_hup,
600                           chr, NULL);
601     g_source_attach(s->hup_source, chr->gcontext);
602 }
603 
604 static void tcp_chr_connect(void *opaque)
605 {
606     Chardev *chr = CHARDEV(opaque);
607     SocketChardev *s = SOCKET_CHARDEV(opaque);
608 
609     g_free(chr->filename);
610     chr->filename = qemu_chr_compute_filename(s);
611 
612     tcp_chr_change_state(s, TCP_CHARDEV_STATE_CONNECTED);
613     update_ioc_handlers(s);
614     qemu_chr_be_event(chr, CHR_EVENT_OPENED);
615 }
616 
617 static void tcp_chr_telnet_destroy(SocketChardev *s)
618 {
619     if (s->telnet_source) {
620         g_source_destroy(s->telnet_source);
621         g_source_unref(s->telnet_source);
622         s->telnet_source = NULL;
623     }
624 }
625 
626 static void tcp_chr_update_read_handler(Chardev *chr)
627 {
628     SocketChardev *s = SOCKET_CHARDEV(chr);
629 
630     if (s->listener && s->state == TCP_CHARDEV_STATE_DISCONNECTED) {
631         /*
632          * It's possible that chardev context is changed in
633          * qemu_chr_be_update_read_handlers().  Reset it for QIO net
634          * listener if there is.
635          */
636         qio_net_listener_set_client_func_full(s->listener, tcp_chr_accept,
637                                               chr, NULL, chr->gcontext);
638     }
639 
640     if (s->telnet_source) {
641         tcp_chr_telnet_init(CHARDEV(s));
642     }
643 
644     update_ioc_handlers(s);
645 }
646 
647 static gboolean tcp_chr_telnet_init_io(QIOChannel *ioc,
648                                        GIOCondition cond G_GNUC_UNUSED,
649                                        gpointer user_data)
650 {
651     SocketChardev *s = user_data;
652     Chardev *chr = CHARDEV(s);
653     TCPChardevTelnetInit *init = s->telnet_init;
654     ssize_t ret;
655 
656     assert(init);
657 
658     ret = qio_channel_write(ioc, init->buf, init->buflen, NULL);
659     if (ret < 0) {
660         if (ret == QIO_CHANNEL_ERR_BLOCK) {
661             ret = 0;
662         } else {
663             tcp_chr_disconnect(chr);
664             goto end;
665         }
666     }
667     init->buflen -= ret;
668 
669     if (init->buflen == 0) {
670         tcp_chr_connect(chr);
671         goto end;
672     }
673 
674     memmove(init->buf, init->buf + ret, init->buflen);
675 
676     return G_SOURCE_CONTINUE;
677 
678 end:
679     g_free(s->telnet_init);
680     s->telnet_init = NULL;
681     g_source_unref(s->telnet_source);
682     s->telnet_source = NULL;
683     return G_SOURCE_REMOVE;
684 }
685 
686 static void tcp_chr_telnet_init(Chardev *chr)
687 {
688     SocketChardev *s = SOCKET_CHARDEV(chr);
689     TCPChardevTelnetInit *init;
690     size_t n = 0;
691 
692     /* Destroy existing task */
693     tcp_chr_telnet_destroy(s);
694 
695     if (s->telnet_init) {
696         /* We are possibly during a handshake already */
697         goto cont;
698     }
699 
700     s->telnet_init = g_new0(TCPChardevTelnetInit, 1);
701     init = s->telnet_init;
702 
703 #define IACSET(x, a, b, c)                      \
704     do {                                        \
705         x[n++] = a;                             \
706         x[n++] = b;                             \
707         x[n++] = c;                             \
708     } while (0)
709 
710     if (!s->is_tn3270) {
711         init->buflen = 12;
712         /* Prep the telnet negotion to put telnet in binary,
713          * no echo, single char mode */
714         IACSET(init->buf, 0xff, 0xfb, 0x01);  /* IAC WILL ECHO */
715         IACSET(init->buf, 0xff, 0xfb, 0x03);  /* IAC WILL Suppress go ahead */
716         IACSET(init->buf, 0xff, 0xfb, 0x00);  /* IAC WILL Binary */
717         IACSET(init->buf, 0xff, 0xfd, 0x00);  /* IAC DO Binary */
718     } else {
719         init->buflen = 21;
720         /* Prep the TN3270 negotion based on RFC1576 */
721         IACSET(init->buf, 0xff, 0xfd, 0x19);  /* IAC DO EOR */
722         IACSET(init->buf, 0xff, 0xfb, 0x19);  /* IAC WILL EOR */
723         IACSET(init->buf, 0xff, 0xfd, 0x00);  /* IAC DO BINARY */
724         IACSET(init->buf, 0xff, 0xfb, 0x00);  /* IAC WILL BINARY */
725         IACSET(init->buf, 0xff, 0xfd, 0x18);  /* IAC DO TERMINAL TYPE */
726         IACSET(init->buf, 0xff, 0xfa, 0x18);  /* IAC SB TERMINAL TYPE */
727         IACSET(init->buf, 0x01, 0xff, 0xf0);  /* SEND IAC SE */
728     }
729 
730 #undef IACSET
731 
732 cont:
733     s->telnet_source = qio_channel_add_watch_source(s->ioc, G_IO_OUT,
734                                                     tcp_chr_telnet_init_io,
735                                                     s, NULL,
736                                                     chr->gcontext);
737 }
738 
739 
740 static void tcp_chr_websock_handshake(QIOTask *task, gpointer user_data)
741 {
742     Chardev *chr = user_data;
743     SocketChardev *s = user_data;
744 
745     if (qio_task_propagate_error(task, NULL)) {
746         tcp_chr_disconnect(chr);
747     } else {
748         if (s->do_telnetopt) {
749             tcp_chr_telnet_init(chr);
750         } else {
751             tcp_chr_connect(chr);
752         }
753     }
754 }
755 
756 
757 static void tcp_chr_websock_init(Chardev *chr)
758 {
759     SocketChardev *s = SOCKET_CHARDEV(chr);
760     QIOChannelWebsock *wioc = NULL;
761     gchar *name;
762 
763     wioc = qio_channel_websock_new_server(s->ioc);
764 
765     name = g_strdup_printf("chardev-websocket-server-%s", chr->label);
766     qio_channel_set_name(QIO_CHANNEL(wioc), name);
767     g_free(name);
768     object_unref(OBJECT(s->ioc));
769     s->ioc = QIO_CHANNEL(wioc);
770 
771     qio_channel_websock_handshake(wioc, tcp_chr_websock_handshake, chr, NULL);
772 }
773 
774 
775 static void tcp_chr_tls_handshake(QIOTask *task,
776                                   gpointer user_data)
777 {
778     Chardev *chr = user_data;
779     SocketChardev *s = user_data;
780 
781     if (qio_task_propagate_error(task, NULL)) {
782         tcp_chr_disconnect(chr);
783     } else {
784         if (s->is_websock) {
785             tcp_chr_websock_init(chr);
786         } else if (s->do_telnetopt) {
787             tcp_chr_telnet_init(chr);
788         } else {
789             tcp_chr_connect(chr);
790         }
791     }
792 }
793 
794 
795 static void tcp_chr_tls_init(Chardev *chr)
796 {
797     SocketChardev *s = SOCKET_CHARDEV(chr);
798     QIOChannelTLS *tioc;
799     gchar *name;
800 
801     if (s->is_listen) {
802         tioc = qio_channel_tls_new_server(
803             s->ioc, s->tls_creds,
804             s->tls_authz,
805             NULL);
806     } else {
807         tioc = qio_channel_tls_new_client(
808             s->ioc, s->tls_creds,
809             s->addr->u.inet.host,
810             NULL);
811     }
812     if (tioc == NULL) {
813         tcp_chr_disconnect(chr);
814         return;
815     }
816     name = g_strdup_printf("chardev-tls-%s-%s",
817                            s->is_listen ? "server" : "client",
818                            chr->label);
819     qio_channel_set_name(QIO_CHANNEL(tioc), name);
820     g_free(name);
821     object_unref(OBJECT(s->ioc));
822     s->ioc = QIO_CHANNEL(tioc);
823 
824     qio_channel_tls_handshake(tioc,
825                               tcp_chr_tls_handshake,
826                               chr,
827                               NULL,
828                               chr->gcontext);
829 }
830 
831 
832 static void tcp_chr_set_client_ioc_name(Chardev *chr,
833                                         QIOChannelSocket *sioc)
834 {
835     SocketChardev *s = SOCKET_CHARDEV(chr);
836     char *name;
837     name = g_strdup_printf("chardev-tcp-%s-%s",
838                            s->is_listen ? "server" : "client",
839                            chr->label);
840     qio_channel_set_name(QIO_CHANNEL(sioc), name);
841     g_free(name);
842 
843 }
844 
845 static int tcp_chr_new_client(Chardev *chr, QIOChannelSocket *sioc)
846 {
847     SocketChardev *s = SOCKET_CHARDEV(chr);
848 
849     if (s->state != TCP_CHARDEV_STATE_CONNECTING) {
850         return -1;
851     }
852 
853     s->ioc = QIO_CHANNEL(sioc);
854     object_ref(OBJECT(sioc));
855     s->sioc = sioc;
856     object_ref(OBJECT(sioc));
857 
858     qio_channel_set_blocking(s->ioc, false, NULL);
859 
860     if (s->do_nodelay) {
861         qio_channel_set_delay(s->ioc, false);
862     }
863     if (s->listener) {
864         qio_net_listener_set_client_func_full(s->listener, NULL, NULL,
865                                               NULL, chr->gcontext);
866     }
867 
868     if (s->tls_creds) {
869         tcp_chr_tls_init(chr);
870     } else if (s->is_websock) {
871         tcp_chr_websock_init(chr);
872     } else if (s->do_telnetopt) {
873         tcp_chr_telnet_init(chr);
874     } else {
875         tcp_chr_connect(chr);
876     }
877 
878     return 0;
879 }
880 
881 
882 static int tcp_chr_add_client(Chardev *chr, int fd)
883 {
884     int ret;
885     QIOChannelSocket *sioc;
886     SocketChardev *s = SOCKET_CHARDEV(chr);
887 
888     if (s->state != TCP_CHARDEV_STATE_DISCONNECTED) {
889         return -1;
890     }
891 
892     sioc = qio_channel_socket_new_fd(fd, NULL);
893     if (!sioc) {
894         return -1;
895     }
896     tcp_chr_change_state(s, TCP_CHARDEV_STATE_CONNECTING);
897     tcp_chr_set_client_ioc_name(chr, sioc);
898     if (s->registered_yank) {
899         yank_register_function(CHARDEV_YANK_INSTANCE(chr->label),
900                                char_socket_yank_iochannel,
901                                QIO_CHANNEL(sioc));
902     }
903     ret = tcp_chr_new_client(chr, sioc);
904     object_unref(OBJECT(sioc));
905     return ret;
906 }
907 
908 static void tcp_chr_accept(QIONetListener *listener,
909                            QIOChannelSocket *cioc,
910                            void *opaque)
911 {
912     Chardev *chr = CHARDEV(opaque);
913     SocketChardev *s = SOCKET_CHARDEV(chr);
914 
915     tcp_chr_change_state(s, TCP_CHARDEV_STATE_CONNECTING);
916     tcp_chr_set_client_ioc_name(chr, cioc);
917     if (s->registered_yank) {
918         yank_register_function(CHARDEV_YANK_INSTANCE(chr->label),
919                                char_socket_yank_iochannel,
920                                QIO_CHANNEL(cioc));
921     }
922     tcp_chr_new_client(chr, cioc);
923 }
924 
925 
926 static int tcp_chr_connect_client_sync(Chardev *chr, Error **errp)
927 {
928     SocketChardev *s = SOCKET_CHARDEV(chr);
929     QIOChannelSocket *sioc = qio_channel_socket_new();
930     tcp_chr_change_state(s, TCP_CHARDEV_STATE_CONNECTING);
931     tcp_chr_set_client_ioc_name(chr, sioc);
932     if (qio_channel_socket_connect_sync(sioc, s->addr, errp) < 0) {
933         tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
934         object_unref(OBJECT(sioc));
935         return -1;
936     }
937     if (s->registered_yank) {
938         yank_register_function(CHARDEV_YANK_INSTANCE(chr->label),
939                                char_socket_yank_iochannel,
940                                QIO_CHANNEL(sioc));
941     }
942     tcp_chr_new_client(chr, sioc);
943     object_unref(OBJECT(sioc));
944     return 0;
945 }
946 
947 
948 static void tcp_chr_accept_server_sync(Chardev *chr)
949 {
950     SocketChardev *s = SOCKET_CHARDEV(chr);
951     QIOChannelSocket *sioc;
952     info_report("QEMU waiting for connection on: %s",
953                 chr->filename);
954     tcp_chr_change_state(s, TCP_CHARDEV_STATE_CONNECTING);
955     sioc = qio_net_listener_wait_client(s->listener);
956     tcp_chr_set_client_ioc_name(chr, sioc);
957     if (s->registered_yank) {
958         yank_register_function(CHARDEV_YANK_INSTANCE(chr->label),
959                                char_socket_yank_iochannel,
960                                QIO_CHANNEL(sioc));
961     }
962     tcp_chr_new_client(chr, sioc);
963     object_unref(OBJECT(sioc));
964 }
965 
966 
967 static int tcp_chr_wait_connected(Chardev *chr, Error **errp)
968 {
969     SocketChardev *s = SOCKET_CHARDEV(chr);
970     const char *opts[] = { "telnet", "tn3270", "websock", "tls-creds" };
971     bool optset[] = { s->is_telnet, s->is_tn3270, s->is_websock, s->tls_creds };
972     size_t i;
973 
974     QEMU_BUILD_BUG_ON(G_N_ELEMENTS(opts) != G_N_ELEMENTS(optset));
975     for (i = 0; i < G_N_ELEMENTS(opts); i++) {
976         if (optset[i]) {
977             error_setg(errp,
978                        "'%s' option is incompatible with waiting for "
979                        "connection completion", opts[i]);
980             return -1;
981         }
982     }
983 
984     tcp_chr_reconn_timer_cancel(s);
985 
986     /*
987      * We expect states to be as follows:
988      *
989      *  - server
990      *    - wait   -> CONNECTED
991      *    - nowait -> DISCONNECTED
992      *  - client
993      *    - reconnect == 0 -> CONNECTED
994      *    - reconnect != 0 -> CONNECTING
995      *
996      */
997     if (s->state == TCP_CHARDEV_STATE_CONNECTING) {
998         if (!s->connect_task) {
999             error_setg(errp,
1000                        "Unexpected 'connecting' state without connect task "
1001                        "while waiting for connection completion");
1002             return -1;
1003         }
1004         /*
1005          * tcp_chr_wait_connected should only ever be run from the
1006          * main loop thread associated with chr->gcontext, otherwise
1007          * qio_task_wait_thread has a dangerous race condition with
1008          * free'ing of the s->connect_task object.
1009          *
1010          * Acquiring the main context doesn't 100% prove we're in
1011          * the main loop thread, but it does at least guarantee
1012          * that the main loop won't be executed by another thread
1013          * avoiding the race condition with the task idle callback.
1014          */
1015         g_main_context_acquire(chr->gcontext);
1016         qio_task_wait_thread(s->connect_task);
1017         g_main_context_release(chr->gcontext);
1018 
1019         /*
1020          * The completion callback (qemu_chr_socket_connected) for
1021          * s->connect_task should have set this to NULL by the time
1022          * qio_task_wait_thread has returned.
1023          */
1024         assert(!s->connect_task);
1025 
1026         /*
1027          * NB we are *not* guaranteed to have "s->state == ..CONNECTED"
1028          * at this point as this first connect may be failed, so
1029          * allow the next loop to run regardless.
1030          */
1031     }
1032 
1033     while (s->state != TCP_CHARDEV_STATE_CONNECTED) {
1034         if (s->is_listen) {
1035             tcp_chr_accept_server_sync(chr);
1036         } else {
1037             Error *err = NULL;
1038             if (tcp_chr_connect_client_sync(chr, &err) < 0) {
1039                 if (s->reconnect_time) {
1040                     error_free(err);
1041                     g_usleep(s->reconnect_time * 1000ULL * 1000ULL);
1042                 } else {
1043                     error_propagate(errp, err);
1044                     return -1;
1045                 }
1046             }
1047         }
1048     }
1049 
1050     return 0;
1051 }
1052 
1053 static void char_socket_finalize(Object *obj)
1054 {
1055     Chardev *chr = CHARDEV(obj);
1056     SocketChardev *s = SOCKET_CHARDEV(obj);
1057 
1058     tcp_chr_free_connection(chr);
1059     tcp_chr_reconn_timer_cancel(s);
1060     qapi_free_SocketAddress(s->addr);
1061     tcp_chr_telnet_destroy(s);
1062     g_free(s->telnet_init);
1063     if (s->listener) {
1064         qio_net_listener_set_client_func_full(s->listener, NULL, NULL,
1065                                               NULL, chr->gcontext);
1066         object_unref(OBJECT(s->listener));
1067     }
1068     if (s->tls_creds) {
1069         object_unref(OBJECT(s->tls_creds));
1070     }
1071     g_free(s->tls_authz);
1072     if (s->registered_yank) {
1073         /*
1074          * In the chardev-change special-case, we shouldn't unregister the yank
1075          * instance, as it still may be needed.
1076          */
1077         if (!chr->handover_yank_instance) {
1078             yank_unregister_instance(CHARDEV_YANK_INSTANCE(chr->label));
1079         }
1080     }
1081 
1082     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
1083 }
1084 
1085 static void qemu_chr_socket_connected(QIOTask *task, void *opaque)
1086 {
1087     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(qio_task_get_source(task));
1088     Chardev *chr = CHARDEV(opaque);
1089     SocketChardev *s = SOCKET_CHARDEV(chr);
1090     Error *err = NULL;
1091 
1092     s->connect_task = NULL;
1093 
1094     if (qio_task_propagate_error(task, &err)) {
1095         tcp_chr_change_state(s, TCP_CHARDEV_STATE_DISCONNECTED);
1096         if (s->registered_yank) {
1097             yank_unregister_function(CHARDEV_YANK_INSTANCE(chr->label),
1098                                      char_socket_yank_iochannel,
1099                                      QIO_CHANNEL(sioc));
1100         }
1101         check_report_connect_error(chr, err);
1102         goto cleanup;
1103     }
1104 
1105     s->connect_err_reported = false;
1106     tcp_chr_new_client(chr, sioc);
1107 
1108 cleanup:
1109     object_unref(OBJECT(sioc));
1110 }
1111 
1112 
1113 static void tcp_chr_connect_client_task(QIOTask *task,
1114                                         gpointer opaque)
1115 {
1116     QIOChannelSocket *ioc = QIO_CHANNEL_SOCKET(qio_task_get_source(task));
1117     SocketAddress *addr = opaque;
1118     Error *err = NULL;
1119 
1120     qio_channel_socket_connect_sync(ioc, addr, &err);
1121 
1122     qio_task_set_error(task, err);
1123 }
1124 
1125 
1126 static void tcp_chr_connect_client_async(Chardev *chr)
1127 {
1128     SocketChardev *s = SOCKET_CHARDEV(chr);
1129     QIOChannelSocket *sioc;
1130 
1131     tcp_chr_change_state(s, TCP_CHARDEV_STATE_CONNECTING);
1132     sioc = qio_channel_socket_new();
1133     tcp_chr_set_client_ioc_name(chr, sioc);
1134     if (s->registered_yank) {
1135         yank_register_function(CHARDEV_YANK_INSTANCE(chr->label),
1136                                char_socket_yank_iochannel,
1137                                QIO_CHANNEL(sioc));
1138     }
1139     /*
1140      * Normally code would use the qio_channel_socket_connect_async
1141      * method which uses a QIOTask + qio_task_set_error internally
1142      * to avoid blocking. The tcp_chr_wait_connected method, however,
1143      * needs a way to synchronize with completion of the background
1144      * connect task which can't be done with the QIOChannelSocket
1145      * async APIs. Thus we must use QIOTask directly to implement
1146      * the non-blocking concept locally.
1147      */
1148     s->connect_task = qio_task_new(OBJECT(sioc),
1149                                    qemu_chr_socket_connected,
1150                                    object_ref(OBJECT(chr)),
1151                                    (GDestroyNotify)object_unref);
1152     qio_task_run_in_thread(s->connect_task,
1153                            tcp_chr_connect_client_task,
1154                            s->addr,
1155                            NULL,
1156                            chr->gcontext);
1157 }
1158 
1159 static gboolean socket_reconnect_timeout(gpointer opaque)
1160 {
1161     Chardev *chr = CHARDEV(opaque);
1162     SocketChardev *s = SOCKET_CHARDEV(opaque);
1163 
1164     qemu_mutex_lock(&chr->chr_write_lock);
1165     g_source_unref(s->reconnect_timer);
1166     s->reconnect_timer = NULL;
1167     qemu_mutex_unlock(&chr->chr_write_lock);
1168 
1169     if (chr->be_open) {
1170         return false;
1171     }
1172 
1173     tcp_chr_connect_client_async(chr);
1174 
1175     return false;
1176 }
1177 
1178 
1179 static int qmp_chardev_open_socket_server(Chardev *chr,
1180                                           bool is_telnet,
1181                                           bool is_waitconnect,
1182                                           Error **errp)
1183 {
1184     SocketChardev *s = SOCKET_CHARDEV(chr);
1185     char *name;
1186     if (is_telnet) {
1187         s->do_telnetopt = 1;
1188     }
1189     s->listener = qio_net_listener_new();
1190 
1191     name = g_strdup_printf("chardev-tcp-listener-%s", chr->label);
1192     qio_net_listener_set_name(s->listener, name);
1193     g_free(name);
1194 
1195     if (s->addr->type == SOCKET_ADDRESS_TYPE_FD && !*s->addr->u.fd.str) {
1196         goto skip_listen;
1197     }
1198 
1199     if (qio_net_listener_open_sync(s->listener, s->addr, 1, errp) < 0) {
1200         object_unref(OBJECT(s->listener));
1201         s->listener = NULL;
1202         return -1;
1203     }
1204 
1205     qapi_free_SocketAddress(s->addr);
1206     s->addr = socket_local_address(s->listener->sioc[0]->fd, errp);
1207 
1208 skip_listen:
1209     update_disconnected_filename(s);
1210 
1211     if (is_waitconnect) {
1212         tcp_chr_accept_server_sync(chr);
1213     } else {
1214         qio_net_listener_set_client_func_full(s->listener,
1215                                               tcp_chr_accept,
1216                                               chr, NULL,
1217                                               chr->gcontext);
1218     }
1219 
1220     return 0;
1221 }
1222 
1223 
1224 static int qmp_chardev_open_socket_client(Chardev *chr,
1225                                           int64_t reconnect,
1226                                           Error **errp)
1227 {
1228     SocketChardev *s = SOCKET_CHARDEV(chr);
1229 
1230     if (reconnect > 0) {
1231         s->reconnect_time = reconnect;
1232         tcp_chr_connect_client_async(chr);
1233         return 0;
1234     } else {
1235         return tcp_chr_connect_client_sync(chr, errp);
1236     }
1237 }
1238 
1239 
1240 static bool qmp_chardev_validate_socket(ChardevSocket *sock,
1241                                         SocketAddress *addr,
1242                                         Error **errp)
1243 {
1244     /* Validate any options which have a dependency on address type */
1245     switch (addr->type) {
1246     case SOCKET_ADDRESS_TYPE_FD:
1247         if (sock->has_reconnect) {
1248             error_setg(errp,
1249                        "'reconnect' option is incompatible with "
1250                        "'fd' address type");
1251             return false;
1252         }
1253         if (sock->has_tls_creds &&
1254             !(sock->has_server && sock->server)) {
1255             error_setg(errp,
1256                        "'tls_creds' option is incompatible with "
1257                        "'fd' address type as client");
1258             return false;
1259         }
1260         break;
1261 
1262     case SOCKET_ADDRESS_TYPE_UNIX:
1263         if (sock->has_tls_creds) {
1264             error_setg(errp,
1265                        "'tls_creds' option is incompatible with "
1266                        "'unix' address type");
1267             return false;
1268         }
1269         break;
1270 
1271     case SOCKET_ADDRESS_TYPE_INET:
1272         break;
1273 
1274     case SOCKET_ADDRESS_TYPE_VSOCK:
1275         if (sock->has_tls_creds) {
1276             error_setg(errp,
1277                        "'tls_creds' option is incompatible with "
1278                        "'vsock' address type");
1279             return false;
1280         }
1281 
1282     default:
1283         break;
1284     }
1285 
1286     if (sock->has_tls_authz && !sock->has_tls_creds) {
1287         error_setg(errp, "'tls_authz' option requires 'tls_creds' option");
1288         return false;
1289     }
1290 
1291     /* Validate any options which have a dependancy on client vs server */
1292     if (!sock->has_server || sock->server) {
1293         if (sock->has_reconnect) {
1294             error_setg(errp,
1295                        "'reconnect' option is incompatible with "
1296                        "socket in server listen mode");
1297             return false;
1298         }
1299     } else {
1300         if (sock->has_websocket && sock->websocket) {
1301             error_setg(errp, "%s", "Websocket client is not implemented");
1302             return false;
1303         }
1304         if (sock->has_wait) {
1305             error_setg(errp, "%s",
1306                        "'wait' option is incompatible with "
1307                        "socket in client connect mode");
1308             return false;
1309         }
1310     }
1311 
1312     return true;
1313 }
1314 
1315 
1316 static void qmp_chardev_open_socket(Chardev *chr,
1317                                     ChardevBackend *backend,
1318                                     bool *be_opened,
1319                                     Error **errp)
1320 {
1321     SocketChardev *s = SOCKET_CHARDEV(chr);
1322     ChardevSocket *sock = backend->u.socket.data;
1323     bool do_nodelay     = sock->has_nodelay ? sock->nodelay : false;
1324     bool is_listen      = sock->has_server  ? sock->server  : true;
1325     bool is_telnet      = sock->has_telnet  ? sock->telnet  : false;
1326     bool is_tn3270      = sock->has_tn3270  ? sock->tn3270  : false;
1327     bool is_waitconnect = sock->has_wait    ? sock->wait    : false;
1328     bool is_websock     = sock->has_websocket ? sock->websocket : false;
1329     int64_t reconnect   = sock->has_reconnect ? sock->reconnect : 0;
1330     SocketAddress *addr;
1331 
1332     s->is_listen = is_listen;
1333     s->is_telnet = is_telnet;
1334     s->is_tn3270 = is_tn3270;
1335     s->is_websock = is_websock;
1336     s->do_nodelay = do_nodelay;
1337     if (sock->tls_creds) {
1338         Object *creds;
1339         creds = object_resolve_path_component(
1340             object_get_objects_root(), sock->tls_creds);
1341         if (!creds) {
1342             error_setg(errp, "No TLS credentials with id '%s'",
1343                        sock->tls_creds);
1344             return;
1345         }
1346         s->tls_creds = (QCryptoTLSCreds *)
1347             object_dynamic_cast(creds,
1348                                 TYPE_QCRYPTO_TLS_CREDS);
1349         if (!s->tls_creds) {
1350             error_setg(errp, "Object with id '%s' is not TLS credentials",
1351                        sock->tls_creds);
1352             return;
1353         }
1354         object_ref(OBJECT(s->tls_creds));
1355         if (!qcrypto_tls_creds_check_endpoint(s->tls_creds,
1356                                           is_listen
1357                                           ? QCRYPTO_TLS_CREDS_ENDPOINT_SERVER
1358                                           : QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
1359                                           errp)) {
1360             return;
1361         }
1362     }
1363     s->tls_authz = g_strdup(sock->tls_authz);
1364 
1365     s->addr = addr = socket_address_flatten(sock->addr);
1366 
1367     if (!qmp_chardev_validate_socket(sock, addr, errp)) {
1368         return;
1369     }
1370 
1371     qemu_chr_set_feature(chr, QEMU_CHAR_FEATURE_RECONNECTABLE);
1372     /* TODO SOCKET_ADDRESS_FD where fd has AF_UNIX */
1373     if (addr->type == SOCKET_ADDRESS_TYPE_UNIX) {
1374         qemu_chr_set_feature(chr, QEMU_CHAR_FEATURE_FD_PASS);
1375     }
1376 
1377     /*
1378      * In the chardev-change special-case, we shouldn't register a new yank
1379      * instance, as there already may be one.
1380      */
1381     if (!chr->handover_yank_instance) {
1382         if (!yank_register_instance(CHARDEV_YANK_INSTANCE(chr->label), errp)) {
1383             return;
1384         }
1385     }
1386     s->registered_yank = true;
1387 
1388     /* be isn't opened until we get a connection */
1389     *be_opened = false;
1390 
1391     update_disconnected_filename(s);
1392 
1393     if (s->is_listen) {
1394         if (qmp_chardev_open_socket_server(chr, is_telnet || is_tn3270,
1395                                            is_waitconnect, errp) < 0) {
1396             return;
1397         }
1398     } else {
1399         if (qmp_chardev_open_socket_client(chr, reconnect, errp) < 0) {
1400             return;
1401         }
1402     }
1403 }
1404 
1405 static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
1406                                   Error **errp)
1407 {
1408     const char *path = qemu_opt_get(opts, "path");
1409     const char *host = qemu_opt_get(opts, "host");
1410     const char *port = qemu_opt_get(opts, "port");
1411     const char *fd = qemu_opt_get(opts, "fd");
1412 #ifdef CONFIG_LINUX
1413     bool tight = qemu_opt_get_bool(opts, "tight", true);
1414     bool abstract = qemu_opt_get_bool(opts, "abstract", false);
1415 #endif
1416     SocketAddressLegacy *addr;
1417     ChardevSocket *sock;
1418 
1419     if ((!!path + !!fd + !!host) > 1) {
1420         error_setg(errp,
1421                    "None or one of 'path', 'fd' or 'host' option required.");
1422         return;
1423     }
1424 
1425     if (host && !port) {
1426         error_setg(errp, "chardev: socket: no port given");
1427         return;
1428     }
1429 
1430     backend->type = CHARDEV_BACKEND_KIND_SOCKET;
1431     sock = backend->u.socket.data = g_new0(ChardevSocket, 1);
1432     qemu_chr_parse_common(opts, qapi_ChardevSocket_base(sock));
1433 
1434     if (qemu_opt_get(opts, "delay") && qemu_opt_get(opts, "nodelay")) {
1435         error_setg(errp, "'delay' and 'nodelay' are mutually exclusive");
1436         return;
1437     }
1438     sock->has_nodelay =
1439         qemu_opt_get(opts, "delay") ||
1440         qemu_opt_get(opts, "nodelay");
1441     sock->nodelay =
1442         !qemu_opt_get_bool(opts, "delay", true) ||
1443         qemu_opt_get_bool(opts, "nodelay", false);
1444 
1445     /*
1446      * We have different default to QMP for 'server', hence
1447      * we can't just check for existence of 'server'
1448      */
1449     sock->has_server = true;
1450     sock->server = qemu_opt_get_bool(opts, "server", false);
1451     sock->has_telnet = qemu_opt_get(opts, "telnet");
1452     sock->telnet = qemu_opt_get_bool(opts, "telnet", false);
1453     sock->has_tn3270 = qemu_opt_get(opts, "tn3270");
1454     sock->tn3270 = qemu_opt_get_bool(opts, "tn3270", false);
1455     sock->has_websocket = qemu_opt_get(opts, "websocket");
1456     sock->websocket = qemu_opt_get_bool(opts, "websocket", false);
1457     /*
1458      * We have different default to QMP for 'wait' when 'server'
1459      * is set, hence we can't just check for existence of 'wait'
1460      */
1461     sock->has_wait = qemu_opt_find(opts, "wait") || sock->server;
1462     sock->wait = qemu_opt_get_bool(opts, "wait", true);
1463     sock->has_reconnect = qemu_opt_find(opts, "reconnect");
1464     sock->reconnect = qemu_opt_get_number(opts, "reconnect", 0);
1465     sock->has_tls_creds = qemu_opt_get(opts, "tls-creds");
1466     sock->tls_creds = g_strdup(qemu_opt_get(opts, "tls-creds"));
1467     sock->has_tls_authz = qemu_opt_get(opts, "tls-authz");
1468     sock->tls_authz = g_strdup(qemu_opt_get(opts, "tls-authz"));
1469 
1470     addr = g_new0(SocketAddressLegacy, 1);
1471     if (path) {
1472         UnixSocketAddress *q_unix;
1473         addr->type = SOCKET_ADDRESS_TYPE_UNIX;
1474         q_unix = addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
1475         q_unix->path = g_strdup(path);
1476 #ifdef CONFIG_LINUX
1477         q_unix->has_tight = true;
1478         q_unix->tight = tight;
1479         q_unix->has_abstract = true;
1480         q_unix->abstract = abstract;
1481 #endif
1482     } else if (host) {
1483         addr->type = SOCKET_ADDRESS_TYPE_INET;
1484         addr->u.inet.data = g_new(InetSocketAddress, 1);
1485         *addr->u.inet.data = (InetSocketAddress) {
1486             .host = g_strdup(host),
1487             .port = g_strdup(port),
1488             .has_to = qemu_opt_get(opts, "to"),
1489             .to = qemu_opt_get_number(opts, "to", 0),
1490             .has_ipv4 = qemu_opt_get(opts, "ipv4"),
1491             .ipv4 = qemu_opt_get_bool(opts, "ipv4", 0),
1492             .has_ipv6 = qemu_opt_get(opts, "ipv6"),
1493             .ipv6 = qemu_opt_get_bool(opts, "ipv6", 0),
1494         };
1495     } else {
1496         addr->type = SOCKET_ADDRESS_TYPE_FD;
1497         addr->u.fd.data = g_new(String, 1);
1498         addr->u.fd.data->str = g_strdup(fd);
1499     }
1500     sock->addr = addr;
1501 }
1502 
1503 static void
1504 char_socket_get_addr(Object *obj, Visitor *v, const char *name,
1505                      void *opaque, Error **errp)
1506 {
1507     SocketChardev *s = SOCKET_CHARDEV(obj);
1508 
1509     visit_type_SocketAddress(v, name, &s->addr, errp);
1510 }
1511 
1512 static bool
1513 char_socket_get_connected(Object *obj, Error **errp)
1514 {
1515     SocketChardev *s = SOCKET_CHARDEV(obj);
1516 
1517     return s->state == TCP_CHARDEV_STATE_CONNECTED;
1518 }
1519 
1520 static void char_socket_class_init(ObjectClass *oc, void *data)
1521 {
1522     ChardevClass *cc = CHARDEV_CLASS(oc);
1523 
1524     cc->supports_yank = true;
1525 
1526     cc->parse = qemu_chr_parse_socket;
1527     cc->open = qmp_chardev_open_socket;
1528     cc->chr_wait_connected = tcp_chr_wait_connected;
1529     cc->chr_write = tcp_chr_write;
1530     cc->chr_sync_read = tcp_chr_sync_read;
1531     cc->chr_disconnect = tcp_chr_disconnect;
1532     cc->get_msgfds = tcp_get_msgfds;
1533     cc->set_msgfds = tcp_set_msgfds;
1534     cc->chr_add_client = tcp_chr_add_client;
1535     cc->chr_add_watch = tcp_chr_add_watch;
1536     cc->chr_update_read_handler = tcp_chr_update_read_handler;
1537 
1538     object_class_property_add(oc, "addr", "SocketAddress",
1539                               char_socket_get_addr, NULL,
1540                               NULL, NULL);
1541 
1542     object_class_property_add_bool(oc, "connected", char_socket_get_connected,
1543                                    NULL);
1544 }
1545 
1546 static const TypeInfo char_socket_type_info = {
1547     .name = TYPE_CHARDEV_SOCKET,
1548     .parent = TYPE_CHARDEV,
1549     .instance_size = sizeof(SocketChardev),
1550     .instance_finalize = char_socket_finalize,
1551     .class_init = char_socket_class_init,
1552 };
1553 
1554 static void register_types(void)
1555 {
1556     type_register_static(&char_socket_type_info);
1557 }
1558 
1559 type_init(register_types);
1560