From a7c36ee4920ea3acc227a0248dd161693f207357 Mon Sep 17 00:00:00 2001 From: Corey Bryant Date: Thu, 26 Jan 2012 09:42:27 -0500 Subject: Add support for net bridge The most common use of -net tap is to connect a tap device to a bridge. This requires the use of a script and running qemu as root in order to allocate a tap device to pass to the script. This model is great for portability and flexibility but it's incredibly difficult to eliminate the need to run qemu as root. The only really viable mechanism is to use tunctl to create a tap device, attach it to a bridge as root, and then hand that tap device to qemu. The problem with this mechanism is that it requires administrator intervention whenever a user wants to create a guest. By essentially writing a helper that implements the most common qemu-ifup script that can be safely given cap_net_admin, we can dramatically simplify things for non-privileged users. We still support existing -net tap options as a mechanism for advanced users and backwards compatibility. Currently, this is very Linux centric but there's really no reason why it couldn't be extended for other Unixes. A typical invocation would be similar to one of the following: qemu linux.img -net bridge -net nic,model=virtio qemu linux.img -net tap,helper="/usr/local/libexec/qemu-bridge-helper" -net nic,model=virtio qemu linux.img -netdev bridge,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1 qemu linux.img -netdev tap,helper="/usr/local/libexec/qemu-bridge-helper",id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1 The default bridge that we attach to is br0. The thinking is that a distro could preconfigure such an interface to allow out-of-the-box bridged networking. Alternatively, if a user wants to use a different bridge, a typical invocation would be simliar to one of the following: qemu linux.img -net bridge,br=qemubr0 -net nic,model=virtio qemu linux.img -net tap,helper="/usr/local/libexec/qemu-bridge-helper --br=qemubr0" -net nic,model=virtio qemu linux.img -netdev bridge,br=qemubr0,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1 qemu linux.img -netdev tap,helper="/usr/local/libexec/qemu-bridge-helper --br=qemubr0",id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1 Signed-off-by: Anthony Liguori Signed-off-by: Richa Marwaha Signed-off-by: Corey Bryant Signed-off-by: Anthony Liguori --- qemu-options.hx | 73 +++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 60 insertions(+), 13 deletions(-) (limited to 'qemu-options.hx') diff --git a/qemu-options.hx b/qemu-options.hx index 3a07ae8231..19906e57e1 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1222,11 +1222,14 @@ DEF("net", HAS_ARG, QEMU_OPTION_net, "-net tap[,vlan=n][,name=str],ifname=name\n" " connect the host TAP network interface to VLAN 'n'\n" #else - "-net tap[,vlan=n][,name=str][,fd=h][,ifname=name][,script=file][,downscript=dfile][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off][,vhostfd=h][,vhostforce=on|off]\n" - " connect the host TAP network interface to VLAN 'n' and use the\n" - " network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" - " and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" + "-net tap[,vlan=n][,name=str][,fd=h][,ifname=name][,script=file][,downscript=dfile][,helper=helper][,sndbuf=nbytes][,vnet_hdr=on|off][,vhost=on|off][,vhostfd=h][,vhostforce=on|off]\n" + " connect the host TAP network interface to VLAN 'n' \n" + " use network scripts 'file' (default=" DEFAULT_NETWORK_SCRIPT ")\n" + " to configure it and 'dfile' (default=" DEFAULT_NETWORK_DOWN_SCRIPT ")\n" + " to deconfigure it\n" " use '[down]script=no' to disable script execution\n" + " use network helper 'helper' (default=" DEFAULT_BRIDGE_HELPER ") to\n" + " configure it\n" " use 'fd=h' to connect to an already opened TAP interface\n" " use 'sndbuf=nbytes' to limit the size of the send buffer (the\n" " default is disabled 'sndbuf=0' to enable flow control set 'sndbuf=1048576')\n" @@ -1236,6 +1239,10 @@ DEF("net", HAS_ARG, QEMU_OPTION_net, " (only has effect for virtio guests which use MSIX)\n" " use vhostforce=on to force vhost on for non-MSIX virtio guests\n" " use 'vhostfd=h' to connect to an already opened vhost net device\n" + "-net bridge[,vlan=n][,name=str][,br=bridge][,helper=helper]\n" + " connects a host TAP network interface to a host bridge device 'br'\n" + " (default=" DEFAULT_BRIDGE_INTERFACE ") using the program 'helper'\n" + " (default=" DEFAULT_BRIDGE_HELPER ")\n" #endif "-net socket[,vlan=n][,name=str][,fd=h][,listen=[host]:port][,connect=host:port]\n" " connect the vlan 'n' to another VLAN using a socket connection\n" @@ -1261,6 +1268,7 @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev, "user|" #endif "tap|" + "bridge|" #ifdef CONFIG_VDE "vde|" #endif @@ -1397,26 +1405,65 @@ processed and applied to -net user. Mixing them with the new configuration syntax gives undefined results. Their use for new applications is discouraged as they will be removed from future versions. -@item -net tap[,vlan=@var{n}][,name=@var{name}][,fd=@var{h}][,ifname=@var{name}] [,script=@var{file}][,downscript=@var{dfile}] -Connect the host TAP network interface @var{name} to VLAN @var{n}, use -the network script @var{file} to configure it and the network script +@item -net tap[,vlan=@var{n}][,name=@var{name}][,fd=@var{h}][,ifname=@var{name}][,script=@var{file}][,downscript=@var{dfile}][,helper=@var{helper}] +Connect the host TAP network interface @var{name} to VLAN @var{n}. + +Use the network script @var{file} to configure it and the network script @var{dfile} to deconfigure it. If @var{name} is not provided, the OS -automatically provides one. @option{fd}=@var{h} can be used to specify -the handle of an already opened host TAP interface. The default network -configure script is @file{/etc/qemu-ifup} and the default network -deconfigure script is @file{/etc/qemu-ifdown}. Use @option{script=no} -or @option{downscript=no} to disable script execution. Example: +automatically provides one. The default network configure script is +@file{/etc/qemu-ifup} and the default network deconfigure script is +@file{/etc/qemu-ifdown}. Use @option{script=no} or @option{downscript=no} +to disable script execution. + +If running QEMU as an unprivileged user, use the network helper +@var{helper} to configure the TAP interface. The default network +helper executable is @file{/usr/local/libexec/qemu-bridge-helper}. + +@option{fd}=@var{h} can be used to specify the handle of an already +opened host TAP interface. + +Examples: @example +#launch a QEMU instance with the default network script qemu linux.img -net nic -net tap @end example -More complicated example (two NICs, each one connected to a TAP device) @example +#launch a QEMU instance with two NICs, each one connected +#to a TAP device qemu linux.img -net nic,vlan=0 -net tap,vlan=0,ifname=tap0 \ -net nic,vlan=1 -net tap,vlan=1,ifname=tap1 @end example +@example +#launch a QEMU instance with the default network helper to +#connect a TAP device to bridge br0 +qemu linux.img -net nic -net tap,"helper=/usr/local/libexec/qemu-bridge-helper" +@end example + +@item -net bridge[,vlan=@var{n}][,name=@var{name}][,br=@var{bridge}][,helper=@var{helper}] +Connect a host TAP network interface to a host bridge device. + +Use the network helper @var{helper} to configure the TAP interface and +attach it to the bridge. The default network helper executable is +@file{/usr/local/libexec/qemu-bridge-helper} and the default bridge +device is @file{br0}. + +Examples: + +@example +#launch a QEMU instance with the default network helper to +#connect a TAP device to bridge br0 +qemu linux.img -net bridge -net nic,model=virtio +@end example + +@example +#launch a QEMU instance with the default network helper to +#connect a TAP device to bridge qemubr0 +qemu linux.img -net bridge,br=qemubr0 -net nic,model=virtio +@end example + @item -net socket[,vlan=@var{n}][,name=@var{name}][,fd=@var{h}] [,listen=[@var{host}]:@var{port}][,connect=@var{host}:@var{port}] Connect the VLAN @var{n} to a remote VLAN in another QEMU virtual -- cgit v1.2.3