net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for CONFIG_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include <linux/if_tun.h>
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef CONFIG_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #include "qemu-common.h"
 105 #include "net.h"
 106 #include "monitor.h"
 107 #include "sysemu.h"
 108 #include "qemu-timer.h"
 109 #include "qemu-char.h"
 110 #include "audio/audio.h"
 111 #include "qemu_socket.h"
 112 #include "qemu-log.h"
 113
 114 #include "slirp/libslirp.h"
 115 #include "qemu-queue.h"
 116
 117
 118 static VLANState *first_vlan;
 119
 120 /***********************************************************/
 121 /* network device redirectors */
 122
 123 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 124 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 125 {
 126     int len, i, j, c;
 127
 128     for(i=0;i<size;i+=16) {
 129         len = size - i;
 130         if (len > 16)
 131             len = 16;
 132         fprintf(f, "%08x ", i);
 133         for(j=0;j<16;j++) {
 134             if (j < len)
 135                 fprintf(f, " %02x", buf[i+j]);
 136             else
 137                 fprintf(f, "   ");
 138         }
 139         fprintf(f, " ");
 140         for(j=0;j<len;j++) {
 141             c = buf[i+j];
 142             if (c < ' ' || c > '~')
 143                 c = '.';
 144             fprintf(f, "%c", c);
 145         }
 146         fprintf(f, "\n");
 147     }
 148 }
 149 #endif
 150
 151 static int parse_macaddr(uint8_t *macaddr, const char *p)
 152 {
 153     int i;
 154     char *last_char;
 155     long int offset;
 156
 157     errno = 0;
 158     offset = strtol(p, &last_char, 0);
 159     if (0 == errno && '\0' == *last_char &&
 160             offset >= 0 && offset <= 0xFFFFFF) {
 161         macaddr[3] = (offset & 0xFF0000) >> 16;
 162         macaddr[4] = (offset & 0xFF00) >> 8;
 163         macaddr[5] = offset & 0xFF;
 164         return 0;
 165     } else {
 166         for(i = 0; i < 6; i++) {
 167             macaddr[i] = strtol(p, (char **)&p, 16);
 168             if (i == 5) {
 169                 if (*p != '\0')
 170                     return -1;
 171             } else {
 172                 if (*p != ':' && *p != '-')
 173                     return -1;
 174                 p++;
 175             }
 176         }
 177         return 0;
 178     }
 179
 180     return -1;
 181 }
 182
 183 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 184 {
 185     const char *p, *p1;
 186     int len;
 187     p = *pp;
 188     p1 = strchr(p, sep);
 189     if (!p1)
 190         return -1;
 191     len = p1 - p;
 192     p1++;
 193     if (buf_size > 0) {
 194         if (len > buf_size - 1)
 195             len = buf_size - 1;
 196         memcpy(buf, p, len);
 197         buf[len] = '\0';
 198     }
 199     *pp = p1;
 200     return 0;
 201 }
 202
 203 int parse_host_src_port(struct sockaddr_in *haddr,
 204                         struct sockaddr_in *saddr,
 205                         const char *input_str)
 206 {
 207     char *str = strdup(input_str);
 208     char *host_str = str;
 209     char *src_str;
 210     const char *src_str2;
 211     char *ptr;
 212
 213     /*
 214      * Chop off any extra arguments at the end of the string which
 215      * would start with a comma, then fill in the src port information
 216      * if it was provided else use the "any address" and "any port".
 217      */
 218     if ((ptr = strchr(str,',')))
 219         *ptr = '\0';
 220
 221     if ((src_str = strchr(input_str,'@'))) {
 222         *src_str = '\0';
 223         src_str++;
 224     }
 225
 226     if (parse_host_port(haddr, host_str) < 0)
 227         goto fail;
 228
 229     src_str2 = src_str;
 230     if (!src_str || *src_str == '\0')
 231         src_str2 = ":0";
 232
 233     if (parse_host_port(saddr, src_str2) < 0)
 234         goto fail;
 235
 236     free(str);
 237     return(0);
 238
 239 fail:
 240     free(str);
 241     return -1;
 242 }
 243
 244 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 245 {
 246     char buf[512];
 247     struct hostent *he;
 248     const char *p, *r;
 249     int port;
 250
 251     p = str;
 252     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 253         return -1;
 254     saddr->sin_family = AF_INET;
 255     if (buf[0] == '\0') {
 256         saddr->sin_addr.s_addr = 0;
 257     } else {
 258         if (qemu_isdigit(buf[0])) {
 259             if (!inet_aton(buf, &saddr->sin_addr))
 260                 return -1;
 261         } else {
 262             if ((he = gethostbyname(buf)) == NULL)
 263                 return - 1;
 264             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 265         }
 266     }
 267     port = strtol(p, (char **)&r, 0);
 268     if (r == p)
 269         return -1;
 270     saddr->sin_port = htons(port);
 271     return 0;
 272 }
 273
 274 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 275 {
 276     snprintf(vc->info_str, sizeof(vc->info_str),
 277              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 278              vc->model,
 279              macaddr[0], macaddr[1], macaddr[2],
 280              macaddr[3], macaddr[4], macaddr[5]);
 281 }
 282
 283 static char *assign_name(VLANClientState *vc1, const char *model)
 284 {
 285     VLANState *vlan;
 286     char buf[256];
 287     int id = 0;
 288
 289     for (vlan = first_vlan; vlan; vlan = vlan->next) {
 290         VLANClientState *vc;
 291
 292         for (vc = vlan->first_client; vc; vc = vc->next)
 293             if (vc != vc1 && strcmp(vc->model, model) == 0)
 294                 id++;
 295     }
 296
 297     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 298
 299     return qemu_strdup(buf);
 300 }
 301
 302 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 303                                       const char *model,
 304                                       const char *name,
 305                                       NetCanReceive *can_receive,
 306                                       NetReceive *receive,
 307                                       NetReceiveIOV *receive_iov,
 308                                       NetCleanup *cleanup,
 309                                       void *opaque)
 310 {
 311     VLANClientState *vc, **pvc;
 312     vc = qemu_mallocz(sizeof(VLANClientState));
 313     vc->model = qemu_strdup(model);
 314     if (name)
 315         vc->name = qemu_strdup(name);
 316     else
 317         vc->name = assign_name(vc, model);
 318     vc->can_receive = can_receive;
 319     vc->receive = receive;
 320     vc->receive_iov = receive_iov;
 321     vc->cleanup = cleanup;
 322     vc->opaque = opaque;
 323     vc->vlan = vlan;
 324
 325     vc->next = NULL;
 326     pvc = &vlan->first_client;
 327     while (*pvc != NULL)
 328         pvc = &(*pvc)->next;
 329     *pvc = vc;
 330     return vc;
 331 }
 332
 333 void qemu_del_vlan_client(VLANClientState *vc)
 334 {
 335     VLANClientState **pvc = &vc->vlan->first_client;
 336
 337     while (*pvc != NULL)
 338         if (*pvc == vc) {
 339             *pvc = vc->next;
 340             if (vc->cleanup) {
 341                 vc->cleanup(vc);
 342             }
 343             qemu_free(vc->name);
 344             qemu_free(vc->model);
 345             qemu_free(vc);
 346             break;
 347         } else
 348             pvc = &(*pvc)->next;
 349 }
 350
 351 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 352 {
 353     VLANClientState **pvc = &vlan->first_client;
 354
 355     while (*pvc != NULL)
 356         if ((*pvc)->opaque == opaque)
 357             return *pvc;
 358         else
 359             pvc = &(*pvc)->next;
 360
 361     return NULL;
 362 }
 363
 364 static VLANClientState *
 365 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 366                               const char *client_str)
 367 {
 368     VLANState *vlan;
 369     VLANClientState *vc;
 370
 371     vlan = qemu_find_vlan(vlan_id, 0);
 372     if (!vlan) {
 373         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 374         return NULL;
 375     }
 376
 377     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 378         if (!strcmp(vc->name, client_str)) {
 379             break;
 380         }
 381     }
 382     if (!vc) {
 383         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 384                        client_str, vlan_id);
 385     }
 386
 387     return vc;
 388 }
 389
 390 int qemu_can_send_packet(VLANClientState *sender)
 391 {
 392     VLANState *vlan = sender->vlan;
 393     VLANClientState *vc;
 394
 395     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 396         if (vc == sender) {
 397             continue;
 398         }
 399
 400         /* no can_receive() handler, they can always receive */
 401         if (!vc->can_receive || vc->can_receive(vc)) {
 402             return 1;
 403         }
 404     }
 405     return 0;
 406 }
 407
 408 static int
 409 qemu_deliver_packet(VLANClientState *sender, const uint8_t *buf, int size)
 410 {
 411     VLANClientState *vc;
 412     int ret = -1;
 413
 414     sender->vlan->delivering = 1;
 415
 416     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 417         ssize_t len;
 418
 419         if (vc == sender) {
 420             continue;
 421         }
 422
 423         if (vc->link_down) {
 424             ret = size;
 425             continue;
 426         }
 427
 428         len = vc->receive(vc, buf, size);
 429
 430         ret = (ret >= 0) ? ret : len;
 431     }
 432
 433     sender->vlan->delivering = 0;
 434
 435     return ret;
 436 }
 437
 438 void qemu_purge_queued_packets(VLANClientState *vc)
 439 {
 440     VLANPacket *packet, *next;
 441
 442     QTAILQ_FOREACH_SAFE(packet, &vc->vlan->send_queue, entry, next) {
 443         if (packet->sender == vc) {
 444             QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 445             qemu_free(packet);
 446         }
 447     }
 448 }
 449
 450 void qemu_flush_queued_packets(VLANClientState *vc)
 451 {
 452     while (!QTAILQ_EMPTY(&vc->vlan->send_queue)) {
 453         VLANPacket *packet;
 454         int ret;
 455
 456         packet = QTAILQ_FIRST(&vc->vlan->send_queue);
 457         QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 458
 459         ret = qemu_deliver_packet(packet->sender, packet->data, packet->size);
 460         if (ret == 0 && packet->sent_cb != NULL) {
 461             QTAILQ_INSERT_HEAD(&vc->vlan->send_queue, packet, entry);
 462             break;
 463         }
 464
 465         if (packet->sent_cb)
 466             packet->sent_cb(packet->sender, ret);
 467
 468         qemu_free(packet);
 469     }
 470 }
 471
 472 static void qemu_enqueue_packet(VLANClientState *sender,
 473                                 const uint8_t *buf, int size,
 474                                 NetPacketSent *sent_cb)
 475 {
 476     VLANPacket *packet;
 477
 478     packet = qemu_malloc(sizeof(VLANPacket) + size);
 479     packet->sender = sender;
 480     packet->size = size;
 481     packet->sent_cb = sent_cb;
 482     memcpy(packet->data, buf, size);
 483
 484     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 485 }
 486
 487 ssize_t qemu_send_packet_async(VLANClientState *sender,
 488                                const uint8_t *buf, int size,
 489                                NetPacketSent *sent_cb)
 490 {
 491     int ret;
 492
 493     if (sender->link_down) {
 494         return size;
 495     }
 496
 497 #ifdef DEBUG_NET
 498     printf("vlan %d send:\n", sender->vlan->id);
 499     hex_dump(stdout, buf, size);
 500 #endif
 501
 502     if (sender->vlan->delivering) {
 503         qemu_enqueue_packet(sender, buf, size, NULL);
 504         return size;
 505     }
 506
 507     ret = qemu_deliver_packet(sender, buf, size);
 508     if (ret == 0 && sent_cb != NULL) {
 509         qemu_enqueue_packet(sender, buf, size, sent_cb);
 510         return 0;
 511     }
 512
 513     qemu_flush_queued_packets(sender);
 514
 515     return ret;
 516 }
 517
 518 void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size)
 519 {
 520     qemu_send_packet_async(vc, buf, size, NULL);
 521 }
 522
 523 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 524                                int iovcnt)
 525 {
 526     uint8_t buffer[4096];
 527     size_t offset = 0;
 528     int i;
 529
 530     for (i = 0; i < iovcnt; i++) {
 531         size_t len;
 532
 533         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 534         memcpy(buffer + offset, iov[i].iov_base, len);
 535         offset += len;
 536     }
 537
 538     return vc->receive(vc, buffer, offset);
 539 }
 540
 541 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 542 {
 543     size_t offset = 0;
 544     int i;
 545
 546     for (i = 0; i < iovcnt; i++)
 547         offset += iov[i].iov_len;
 548     return offset;
 549 }
 550
 551 static int qemu_deliver_packet_iov(VLANClientState *sender,
 552                                    const struct iovec *iov, int iovcnt)
 553 {
 554     VLANClientState *vc;
 555     int ret = -1;
 556
 557     sender->vlan->delivering = 1;
 558
 559     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 560         ssize_t len;
 561
 562         if (vc == sender) {
 563             continue;
 564         }
 565
 566         if (vc->link_down) {
 567             ret = calc_iov_length(iov, iovcnt);
 568             continue;
 569         }
 570
 571         if (vc->receive_iov) {
 572             len = vc->receive_iov(vc, iov, iovcnt);
 573         } else {
 574             len = vc_sendv_compat(vc, iov, iovcnt);
 575         }
 576
 577         ret = (ret >= 0) ? ret : len;
 578     }
 579
 580     sender->vlan->delivering = 0;
 581
 582     return ret;
 583 }
 584
 585 static ssize_t qemu_enqueue_packet_iov(VLANClientState *sender,
 586                                        const struct iovec *iov, int iovcnt,
 587                                        NetPacketSent *sent_cb)
 588 {
 589     VLANPacket *packet;
 590     size_t max_len = 0;
 591     int i;
 592
 593     max_len = calc_iov_length(iov, iovcnt);
 594
 595     packet = qemu_malloc(sizeof(VLANPacket) + max_len);
 596     packet->sender = sender;
 597     packet->sent_cb = sent_cb;
 598     packet->size = 0;
 599
 600     for (i = 0; i < iovcnt; i++) {
 601         size_t len = iov[i].iov_len;
 602
 603         memcpy(packet->data + packet->size, iov[i].iov_base, len);
 604         packet->size += len;
 605     }
 606
 607     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 608
 609     return packet->size;
 610 }
 611
 612 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 613                                 const struct iovec *iov, int iovcnt,
 614                                 NetPacketSent *sent_cb)
 615 {
 616     int ret;
 617
 618     if (sender->link_down) {
 619         return calc_iov_length(iov, iovcnt);
 620     }
 621
 622     if (sender->vlan->delivering) {
 623         return qemu_enqueue_packet_iov(sender, iov, iovcnt, NULL);
 624     }
 625
 626     ret = qemu_deliver_packet_iov(sender, iov, iovcnt);
 627     if (ret == 0 && sent_cb != NULL) {
 628         qemu_enqueue_packet_iov(sender, iov, iovcnt, sent_cb);
 629         return 0;
 630     }
 631
 632     qemu_flush_queued_packets(sender);
 633
 634     return ret;
 635 }
 636
 637 ssize_t
 638 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 639 {
 640     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 641 }
 642
 643 #if defined(CONFIG_SLIRP)
 644
 645 /* slirp network adapter */
 646
 647 #define SLIRP_CFG_HOSTFWD 1
 648 #define SLIRP_CFG_LEGACY  2
 649
 650 struct slirp_config_str {
 651     struct slirp_config_str *next;
 652     int flags;
 653     char str[1024];
 654     int legacy_format;
 655 };
 656
 657 typedef struct SlirpState {
 658     QTAILQ_ENTRY(SlirpState) entry;
 659     VLANClientState *vc;
 660     Slirp *slirp;
 661 #ifndef _WIN32
 662     char smb_dir[128];
 663 #endif
 664 } SlirpState;
 665
 666 static struct slirp_config_str *slirp_configs;
 667 const char *legacy_tftp_prefix;
 668 const char *legacy_bootp_filename;
 669 static QTAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 670     QTAILQ_HEAD_INITIALIZER(slirp_stacks);
 671
 672 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 673                          int legacy_format);
 674 static int slirp_guestfwd(SlirpState *s, const char *config_str,
 675                           int legacy_format);
 676
 677 #ifndef _WIN32
 678 static const char *legacy_smb_export;
 679
 680 static int slirp_smb(SlirpState *s, const char *exported_dir,
 681                      struct in_addr vserver_addr);
 682 static void slirp_smb_cleanup(SlirpState *s);
 683 #else
 684 static inline void slirp_smb_cleanup(SlirpState *s) { }
 685 #endif
 686
 687 int slirp_can_output(void *opaque)
 688 {
 689     SlirpState *s = opaque;
 690
 691     return qemu_can_send_packet(s->vc);
 692 }
 693
 694 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 695 {
 696     SlirpState *s = opaque;
 697
 698 #ifdef DEBUG_SLIRP
 699     printf("slirp output:\n");
 700     hex_dump(stdout, pkt, pkt_len);
 701 #endif
 702     qemu_send_packet(s->vc, pkt, pkt_len);
 703 }
 704
 705 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 706 {
 707     SlirpState *s = vc->opaque;
 708
 709 #ifdef DEBUG_SLIRP
 710     printf("slirp input:\n");
 711     hex_dump(stdout, buf, size);
 712 #endif
 713     slirp_input(s->slirp, buf, size);
 714     return size;
 715 }
 716
 717 static void net_slirp_cleanup(VLANClientState *vc)
 718 {
 719     SlirpState *s = vc->opaque;
 720
 721     slirp_cleanup(s->slirp);
 722     slirp_smb_cleanup(s);
 723     QTAILQ_REMOVE(&slirp_stacks, s, entry);
 724     qemu_free(s);
 725 }
 726
 727 static int net_slirp_init(VLANState *vlan, const char *model,
 728                           const char *name, int restricted,
 729                           const char *vnetwork, const char *vhost,
 730                           const char *vhostname, const char *tftp_export,
 731                           const char *bootfile, const char *vdhcp_start,
 732                           const char *vnameserver, const char *smb_export,
 733                           const char *vsmbserver)
 734 {
 735     /* default settings according to historic slirp */
 736     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 737     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 738     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 739     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 740     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 741 #ifndef _WIN32
 742     struct in_addr smbsrv = { .s_addr = 0 };
 743 #endif
 744     SlirpState *s;
 745     char buf[20];
 746     uint32_t addr;
 747     int shift;
 748     char *end;
 749     struct slirp_config_str *config;
 750
 751     if (!tftp_export) {
 752         tftp_export = legacy_tftp_prefix;
 753     }
 754     if (!bootfile) {
 755         bootfile = legacy_bootp_filename;
 756     }
 757
 758     if (vnetwork) {
 759         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 760             if (!inet_aton(vnetwork, &net)) {
 761                 return -1;
 762             }
 763             addr = ntohl(net.s_addr);
 764             if (!(addr & 0x80000000)) {
 765                 mask.s_addr = htonl(0xff000000); /* class A */
 766             } else if ((addr & 0xfff00000) == 0xac100000) {
 767                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 768             } else if ((addr & 0xc0000000) == 0x80000000) {
 769                 mask.s_addr = htonl(0xffff0000); /* class B */
 770             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 771                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 772             } else if ((addr & 0xffff0000) == 0xc6120000) {
 773                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 774             } else if ((addr & 0xe0000000) == 0xe0000000) {
 775                 mask.s_addr = htonl(0xffffff00); /* class C */
 776             } else {
 777                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 778             }
 779         } else {
 780             if (!inet_aton(buf, &net)) {
 781                 return -1;
 782             }
 783             shift = strtol(vnetwork, &end, 10);
 784             if (*end != '\0') {
 785                 if (!inet_aton(vnetwork, &mask)) {
 786                     return -1;
 787                 }
 788             } else if (shift < 4 || shift > 32) {
 789                 return -1;
 790             } else {
 791                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 792             }
 793         }
 794         net.s_addr &= mask.s_addr;
 795         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 796         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 797         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 798     }
 799
 800     if (vhost && !inet_aton(vhost, &host)) {
 801         return -1;
 802     }
 803     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 804         return -1;
 805     }
 806
 807     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 808         return -1;
 809     }
 810     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 811         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 812         return -1;
 813     }
 814
 815     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 816         return -1;
 817     }
 818     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 819         dns.s_addr == host.s_addr) {
 820         return -1;
 821     }
 822
 823 #ifndef _WIN32
 824     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 825         return -1;
 826     }
 827 #endif
 828
 829     s = qemu_mallocz(sizeof(SlirpState));
 830     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 831                           tftp_export, bootfile, dhcp, dns, s);
 832     QTAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 833
 834     for (config = slirp_configs; config; config = config->next) {
 835         if (config->flags & SLIRP_CFG_HOSTFWD) {
 836             if (slirp_hostfwd(s, config->str,
 837                               config->flags & SLIRP_CFG_LEGACY) < 0)
 838                 return -1;
 839         } else {
 840             if (slirp_guestfwd(s, config->str,
 841                                config->flags & SLIRP_CFG_LEGACY) < 0)
 842                 return -1;
 843         }
 844     }
 845 #ifndef _WIN32
 846     if (!smb_export) {
 847         smb_export = legacy_smb_export;
 848     }
 849     if (smb_export) {
 850         if (slirp_smb(s, smb_export, smbsrv) < 0)
 851             return -1;
 852     }
 853 #endif
 854
 855     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive, NULL,
 856                                  net_slirp_cleanup, s);
 857     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 858              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 859     return 0;
 860 }
 861
 862 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 863                                 const char *stack)
 864 {
 865     VLANClientState *vc;
 866
 867     if (vlan) {
 868         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 869         if (!vc) {
 870             return NULL;
 871         }
 872         if (strcmp(vc->model, "user")) {
 873             monitor_printf(mon, "invalid device specified\n");
 874             return NULL;
 875         }
 876         return vc->opaque;
 877     } else {
 878         if (QTAILQ_EMPTY(&slirp_stacks)) {
 879             monitor_printf(mon, "user mode network stack not in use\n");
 880             return NULL;
 881         }
 882         return QTAILQ_FIRST(&slirp_stacks);
 883     }
 884 }
 885
 886 void net_slirp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 887 {
 888     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 889     int host_port;
 890     char buf[256] = "";
 891     const char *src_str, *p;
 892     SlirpState *s;
 893     int is_udp = 0;
 894     int err;
 895     const char *arg1 = qdict_get_str(qdict, "arg1");
 896     const char *arg2 = qdict_get_try_str(qdict, "arg2");
 897     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 898
 899     if (arg2) {
 900         s = slirp_lookup(mon, arg1, arg2);
 901         src_str = arg3;
 902     } else {
 903         s = slirp_lookup(mon, NULL, NULL);
 904         src_str = arg1;
 905     }
 906     if (!s) {
 907         return;
 908     }
 909
 910     if (!src_str || !src_str[0])
 911         goto fail_syntax;
 912
 913     p = src_str;
 914     get_str_sep(buf, sizeof(buf), &p, ':');
 915
 916     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 917         is_udp = 0;
 918     } else if (!strcmp(buf, "udp")) {
 919         is_udp = 1;
 920     } else {
 921         goto fail_syntax;
 922     }
 923
 924     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 925         goto fail_syntax;
 926     }
 927     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 928         goto fail_syntax;
 929     }
 930
 931     host_port = atoi(p);
 932
 933     err = slirp_remove_hostfwd(QTAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 934                                host_addr, host_port);
 935
 936     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 937                    err ? "removed" : "not found");
 938     return;
 939
 940  fail_syntax:
 941     monitor_printf(mon, "invalid format\n");
 942 }
 943
 944 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 945                          int legacy_format)
 946 {
 947     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 948     struct in_addr guest_addr = { .s_addr = 0 };
 949     int host_port, guest_port;
 950     const char *p;
 951     char buf[256];
 952     int is_udp;
 953     char *end;
 954
 955     p = redir_str;
 956     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 957         goto fail_syntax;
 958     }
 959     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 960         is_udp = 0;
 961     } else if (!strcmp(buf, "udp")) {
 962         is_udp = 1;
 963     } else {
 964         goto fail_syntax;
 965     }
 966
 967     if (!legacy_format) {
 968         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 969             goto fail_syntax;
 970         }
 971         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 972             goto fail_syntax;
 973         }
 974     }
 975
 976     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
 977         goto fail_syntax;
 978     }
 979     host_port = strtol(buf, &end, 0);
 980     if (*end != '\0' || host_port < 1 || host_port > 65535) {
 981         goto fail_syntax;
 982     }
 983
 984     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 985         goto fail_syntax;
 986     }
 987     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
 988         goto fail_syntax;
 989     }
 990
 991     guest_port = strtol(p, &end, 0);
 992     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
 993         goto fail_syntax;
 994     }
 995
 996     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
 997                           guest_port) < 0) {
 998         qemu_error("could not set up host forwarding rule '%s'\n",
 999                    redir_str);
1000         return -1;
1001     }
1002     return 0;
1003
1004  fail_syntax:
1005     qemu_error("invalid host forwarding rule '%s'\n", redir_str);
1006     return -1;
1007 }
1008
1009 void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict)
1010 {
1011     const char *redir_str;
1012     SlirpState *s;
1013     const char *arg1 = qdict_get_str(qdict, "arg1");
1014     const char *arg2 = qdict_get_try_str(qdict, "arg2");
1015     const char *arg3 = qdict_get_try_str(qdict, "arg3");
1016
1017     if (arg2) {
1018         s = slirp_lookup(mon, arg1, arg2);
1019         redir_str = arg3;
1020     } else {
1021         s = slirp_lookup(mon, NULL, NULL);
1022         redir_str = arg1;
1023     }
1024     if (s) {
1025         slirp_hostfwd(s, redir_str, 0);
1026     }
1027
1028 }
1029
1030 int net_slirp_redir(const char *redir_str)
1031 {
1032     struct slirp_config_str *config;
1033
1034     if (QTAILQ_EMPTY(&slirp_stacks)) {
1035         config = qemu_malloc(sizeof(*config));
1036         pstrcpy(config->str, sizeof(config->str), redir_str);
1037         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1038         config->next = slirp_configs;
1039         slirp_configs = config;
1040         return 0;
1041     }
1042
1043     return slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), redir_str, 1);
1044 }
1045
1046 #ifndef _WIN32
1047
1048 /* automatic user mode samba server configuration */
1049 static void slirp_smb_cleanup(SlirpState *s)
1050 {
1051     char cmd[128];
1052
1053     if (s->smb_dir[0] != '\0') {
1054         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1055         system(cmd);
1056         s->smb_dir[0] = '\0';
1057     }
1058 }
1059
1060 static int slirp_smb(SlirpState* s, const char *exported_dir,
1061                      struct in_addr vserver_addr)
1062 {
1063     static int instance;
1064     char smb_conf[128];
1065     char smb_cmdline[128];
1066     FILE *f;
1067
1068     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1069              (long)getpid(), instance++);
1070     if (mkdir(s->smb_dir, 0700) < 0) {
1071         qemu_error("could not create samba server dir '%s'\n", s->smb_dir);
1072         return -1;
1073     }
1074     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1075
1076     f = fopen(smb_conf, "w");
1077     if (!f) {
1078         slirp_smb_cleanup(s);
1079         qemu_error("could not create samba server configuration file '%s'\n",
1080                    smb_conf);
1081         return -1;
1082     }
1083     fprintf(f,
1084             "[global]\n"
1085             "private dir=%s\n"
1086             "smb ports=0\n"
1087             "socket address=127.0.0.1\n"
1088             "pid directory=%s\n"
1089             "lock directory=%s\n"
1090             "log file=%s/log.smbd\n"
1091             "smb passwd file=%s/smbpasswd\n"
1092             "security = share\n"
1093             "[qemu]\n"
1094             "path=%s\n"
1095             "read only=no\n"
1096             "guest ok=yes\n",
1097             s->smb_dir,
1098             s->smb_dir,
1099             s->smb_dir,
1100             s->smb_dir,
1101             s->smb_dir,
1102             exported_dir
1103             );
1104     fclose(f);
1105
1106     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1107              SMBD_COMMAND, smb_conf);
1108
1109     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1110         slirp_smb_cleanup(s);
1111         qemu_error("conflicting/invalid smbserver address\n");
1112         return -1;
1113     }
1114     return 0;
1115 }
1116
1117 /* automatic user mode samba server configuration (legacy interface) */
1118 int net_slirp_smb(const char *exported_dir)
1119 {
1120     struct in_addr vserver_addr = { .s_addr = 0 };
1121
1122     if (legacy_smb_export) {
1123         fprintf(stderr, "-smb given twice\n");
1124         return -1;
1125     }
1126     legacy_smb_export = exported_dir;
1127     if (!QTAILQ_EMPTY(&slirp_stacks)) {
1128         return slirp_smb(QTAILQ_FIRST(&slirp_stacks), exported_dir,
1129                          vserver_addr);
1130     }
1131     return 0;
1132 }
1133
1134 #endif /* !defined(_WIN32) */
1135
1136 struct GuestFwd {
1137     CharDriverState *hd;
1138     struct in_addr server;
1139     int port;
1140     Slirp *slirp;
1141 };
1142
1143 static int guestfwd_can_read(void *opaque)
1144 {
1145     struct GuestFwd *fwd = opaque;
1146     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1147 }
1148
1149 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1150 {
1151     struct GuestFwd *fwd = opaque;
1152     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1153 }
1154
1155 static int slirp_guestfwd(SlirpState *s, const char *config_str,
1156                           int legacy_format)
1157 {
1158     struct in_addr server = { .s_addr = 0 };
1159     struct GuestFwd *fwd;
1160     const char *p;
1161     char buf[128];
1162     char *end;
1163     int port;
1164
1165     p = config_str;
1166     if (legacy_format) {
1167         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1168             goto fail_syntax;
1169         }
1170     } else {
1171         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1172             goto fail_syntax;
1173         }
1174         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1175             goto fail_syntax;
1176         }
1177         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1178             goto fail_syntax;
1179         }
1180         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1181             goto fail_syntax;
1182         }
1183         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1184             goto fail_syntax;
1185         }
1186     }
1187     port = strtol(buf, &end, 10);
1188     if (*end != '\0' || port < 1 || port > 65535) {
1189         goto fail_syntax;
1190     }
1191
1192     fwd = qemu_malloc(sizeof(struct GuestFwd));
1193     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1194     fwd->hd = qemu_chr_open(buf, p, NULL);
1195     if (!fwd->hd) {
1196         qemu_error("could not open guest forwarding device '%s'\n", buf);
1197         qemu_free(fwd);
1198         return -1;
1199     }
1200
1201     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1202         qemu_error("conflicting/invalid host:port in guest forwarding "
1203                    "rule '%s'\n", config_str);
1204         qemu_free(fwd);
1205         return -1;
1206     }
1207     fwd->server = server;
1208     fwd->port = port;
1209     fwd->slirp = s->slirp;
1210
1211     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1212                           NULL, fwd);
1213     return 0;
1214
1215  fail_syntax:
1216     qemu_error("invalid guest forwarding rule '%s'\n", config_str);
1217     return -1;
1218 }
1219
1220 void do_info_usernet(Monitor *mon)
1221 {
1222     SlirpState *s;
1223
1224     QTAILQ_FOREACH(s, &slirp_stacks, entry) {
1225         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1226         slirp_connection_info(s->slirp, mon);
1227     }
1228 }
1229
1230 #endif /* CONFIG_SLIRP */
1231
1232 #if !defined(_WIN32)
1233
1234 typedef struct TAPState {
1235     VLANClientState *vc;
1236     int fd;
1237     char down_script[1024];
1238     char down_script_arg[128];
1239     uint8_t buf[4096];
1240     unsigned int read_poll : 1;
1241     unsigned int write_poll : 1;
1242 } TAPState;
1243
1244 static int launch_script(const char *setup_script, const char *ifname, int fd);
1245
1246 static int tap_can_send(void *opaque);
1247 static void tap_send(void *opaque);
1248 static void tap_writable(void *opaque);
1249
1250 static void tap_update_fd_handler(TAPState *s)
1251 {
1252     qemu_set_fd_handler2(s->fd,
1253                          s->read_poll  ? tap_can_send : NULL,
1254                          s->read_poll  ? tap_send     : NULL,
1255                          s->write_poll ? tap_writable : NULL,
1256                          s);
1257 }
1258
1259 static void tap_read_poll(TAPState *s, int enable)
1260 {
1261     s->read_poll = !!enable;
1262     tap_update_fd_handler(s);
1263 }
1264
1265 static void tap_write_poll(TAPState *s, int enable)
1266 {
1267     s->write_poll = !!enable;
1268     tap_update_fd_handler(s);
1269 }
1270
1271 static void tap_writable(void *opaque)
1272 {
1273     TAPState *s = opaque;
1274
1275     tap_write_poll(s, 0);
1276
1277     qemu_flush_queued_packets(s->vc);
1278 }
1279
1280 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1281                                int iovcnt)
1282 {
1283     TAPState *s = vc->opaque;
1284     ssize_t len;
1285
1286     do {
1287         len = writev(s->fd, iov, iovcnt);
1288     } while (len == -1 && errno == EINTR);
1289
1290     if (len == -1 && errno == EAGAIN) {
1291         tap_write_poll(s, 1);
1292         return 0;
1293     }
1294
1295     return len;
1296 }
1297
1298 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1299 {
1300     TAPState *s = vc->opaque;
1301     ssize_t len;
1302
1303     do {
1304         len = write(s->fd, buf, size);
1305     } while (len == -1 && (errno == EINTR || errno == EAGAIN));
1306
1307     return len;
1308 }
1309
1310 static int tap_can_send(void *opaque)
1311 {
1312     TAPState *s = opaque;
1313
1314     return qemu_can_send_packet(s->vc);
1315 }
1316
1317 #ifdef __sun__
1318 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1319 {
1320     struct strbuf sbuf;
1321     int f = 0;
1322
1323     sbuf.maxlen = maxlen;
1324     sbuf.buf = (char *)buf;
1325
1326     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1327 }
1328 #else
1329 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1330 {
1331     return read(tapfd, buf, maxlen);
1332 }
1333 #endif
1334
1335 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1336 {
1337     TAPState *s = vc->opaque;
1338     tap_read_poll(s, 1);
1339 }
1340
1341 static void tap_send(void *opaque)
1342 {
1343     TAPState *s = opaque;
1344     int size;
1345
1346     do {
1347         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1348         if (size <= 0) {
1349             break;
1350         }
1351
1352         size = qemu_send_packet_async(s->vc, s->buf, size, tap_send_completed);
1353         if (size == 0) {
1354             tap_read_poll(s, 0);
1355         }
1356     } while (size > 0);
1357 }
1358
1359 #ifdef TUNSETSNDBUF
1360 /* sndbuf should be set to a value lower than the tx queue
1361  * capacity of any destination network interface.
1362  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1363  * a good default, given a 1500 byte MTU.
1364  */
1365 #define TAP_DEFAULT_SNDBUF 1024*1024
1366
1367 static int tap_set_sndbuf(TAPState *s, const char *sndbuf_str)
1368 {
1369     int sndbuf = TAP_DEFAULT_SNDBUF;
1370
1371     if (sndbuf_str) {
1372         sndbuf = atoi(sndbuf_str);
1373     }
1374
1375     if (!sndbuf) {
1376         sndbuf = INT_MAX;
1377     }
1378
1379     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && sndbuf_str) {
1380         qemu_error("TUNSETSNDBUF ioctl failed: %s\n", strerror(errno));
1381         return -1;
1382     }
1383     return 0;
1384 }
1385 #else
1386 static int tap_set_sndbuf(TAPState *s, const char *sndbuf_str)
1387 {
1388     if (sndbuf_str) {
1389         qemu_error("No '-net tap,sndbuf=<nbytes>' support available\n");
1390         return -1;
1391     }
1392     return 0;
1393 }
1394 #endif /* TUNSETSNDBUF */
1395
1396 static void tap_cleanup(VLANClientState *vc)
1397 {
1398     TAPState *s = vc->opaque;
1399
1400     qemu_purge_queued_packets(vc);
1401
1402     if (s->down_script[0])
1403         launch_script(s->down_script, s->down_script_arg, s->fd);
1404
1405     tap_read_poll(s, 0);
1406     tap_write_poll(s, 0);
1407     close(s->fd);
1408     qemu_free(s);
1409 }
1410
1411 /* fd support */
1412
1413 static TAPState *net_tap_fd_init(VLANState *vlan,
1414                                  const char *model,
1415                                  const char *name,
1416                                  int fd)
1417 {
1418     TAPState *s;
1419
1420     s = qemu_mallocz(sizeof(TAPState));
1421     s->fd = fd;
1422     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
1423                                  tap_receive_iov, tap_cleanup, s);
1424     tap_read_poll(s, 1);
1425     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
1426     return s;
1427 }
1428
1429 #if defined (CONFIG_BSD) || defined (__FreeBSD_kernel__)
1430 static int tap_open(char *ifname, int ifname_size)
1431 {
1432     int fd;
1433     char *dev;
1434     struct stat s;
1435
1436     TFR(fd = open("/dev/tap", O_RDWR));
1437     if (fd < 0) {
1438         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1439         return -1;
1440     }
1441
1442     fstat(fd, &s);
1443     dev = devname(s.st_rdev, S_IFCHR);
1444     pstrcpy(ifname, ifname_size, dev);
1445
1446     fcntl(fd, F_SETFL, O_NONBLOCK);
1447     return fd;
1448 }
1449 #elif defined(__sun__)
1450 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1451 /*
1452  * Allocate TAP device, returns opened fd.
1453  * Stores dev name in the first arg(must be large enough).
1454  */
1455 static int tap_alloc(char *dev, size_t dev_size)
1456 {
1457     int tap_fd, if_fd, ppa = -1;
1458     static int ip_fd = 0;
1459     char *ptr;
1460
1461     static int arp_fd = 0;
1462     int ip_muxid, arp_muxid;
1463     struct strioctl  strioc_if, strioc_ppa;
1464     int link_type = I_PLINK;;
1465     struct lifreq ifr;
1466     char actual_name[32] = "";
1467
1468     memset(&ifr, 0x0, sizeof(ifr));
1469
1470     if( *dev ){
1471        ptr = dev;
1472        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1473        ppa = atoi(ptr);
1474     }
1475
1476     /* Check if IP device was opened */
1477     if( ip_fd )
1478        close(ip_fd);
1479
1480     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1481     if (ip_fd < 0) {
1482        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1483        return -1;
1484     }
1485
1486     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1487     if (tap_fd < 0) {
1488        syslog(LOG_ERR, "Can't open /dev/tap");
1489        return -1;
1490     }
1491
1492     /* Assign a new PPA and get its unit number. */
1493     strioc_ppa.ic_cmd = TUNNEWPPA;
1494     strioc_ppa.ic_timout = 0;
1495     strioc_ppa.ic_len = sizeof(ppa);
1496     strioc_ppa.ic_dp = (char *)&ppa;
1497     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1498        syslog (LOG_ERR, "Can't assign new interface");
1499
1500     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1501     if (if_fd < 0) {
1502        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1503        return -1;
1504     }
1505     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1506        syslog(LOG_ERR, "Can't push IP module");
1507        return -1;
1508     }
1509
1510     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1511         syslog(LOG_ERR, "Can't get flags\n");
1512
1513     snprintf (actual_name, 32, "tap%d", ppa);
1514     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1515
1516     ifr.lifr_ppa = ppa;
1517     /* Assign ppa according to the unit number returned by tun device */
1518
1519     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1520         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1521     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1522         syslog (LOG_ERR, "Can't get flags\n");
1523     /* Push arp module to if_fd */
1524     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1525         syslog (LOG_ERR, "Can't push ARP module (2)");
1526
1527     /* Push arp module to ip_fd */
1528     if (ioctl (ip_fd, I_POP, NULL) < 0)
1529         syslog (LOG_ERR, "I_POP failed\n");
1530     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1531         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1532     /* Open arp_fd */
1533     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1534     if (arp_fd < 0)
1535        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1536
1537     /* Set ifname to arp */
1538     strioc_if.ic_cmd = SIOCSLIFNAME;
1539     strioc_if.ic_timout = 0;
1540     strioc_if.ic_len = sizeof(ifr);
1541     strioc_if.ic_dp = (char *)&ifr;
1542     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1543         syslog (LOG_ERR, "Can't set ifname to arp\n");
1544     }
1545
1546     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1547        syslog(LOG_ERR, "Can't link TAP device to IP");
1548        return -1;
1549     }
1550
1551     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1552         syslog (LOG_ERR, "Can't link TAP device to ARP");
1553
1554     close (if_fd);
1555
1556     memset(&ifr, 0x0, sizeof(ifr));
1557     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1558     ifr.lifr_ip_muxid  = ip_muxid;
1559     ifr.lifr_arp_muxid = arp_muxid;
1560
1561     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1562     {
1563       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1564       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1565       syslog (LOG_ERR, "Can't set multiplexor id");
1566     }
1567
1568     snprintf(dev, dev_size, "tap%d", ppa);
1569     return tap_fd;
1570 }
1571
1572 static int tap_open(char *ifname, int ifname_size)
1573 {
1574     char  dev[10]="";
1575     int fd;
1576     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1577        fprintf(stderr, "Cannot allocate TAP device\n");
1578        return -1;
1579     }
1580     pstrcpy(ifname, ifname_size, dev);
1581     fcntl(fd, F_SETFL, O_NONBLOCK);
1582     return fd;
1583 }
1584 #elif defined (_AIX)
1585 static int tap_open(char *ifname, int ifname_size)
1586 {
1587     fprintf (stderr, "no tap on AIX\n");
1588     return -1;
1589 }
1590 #else
1591 static int tap_open(char *ifname, int ifname_size)
1592 {
1593     struct ifreq ifr;
1594     int fd, ret;
1595
1596     TFR(fd = open("/dev/net/tun", O_RDWR));
1597     if (fd < 0) {
1598         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1599         return -1;
1600     }
1601     memset(&ifr, 0, sizeof(ifr));
1602     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1603     if (ifname[0] != '\0')
1604         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1605     else
1606         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1607     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1608     if (ret != 0) {
1609         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1610         close(fd);
1611         return -1;
1612     }
1613     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1614     fcntl(fd, F_SETFL, O_NONBLOCK);
1615     return fd;
1616 }
1617 #endif
1618
1619 static int launch_script(const char *setup_script, const char *ifname, int fd)
1620 {
1621     sigset_t oldmask, mask;
1622     int pid, status;
1623     char *args[3];
1624     char **parg;
1625
1626     sigemptyset(&mask);
1627     sigaddset(&mask, SIGCHLD);
1628     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1629
1630     /* try to launch network script */
1631     pid = fork();
1632     if (pid == 0) {
1633         int open_max = sysconf(_SC_OPEN_MAX), i;
1634
1635         for (i = 0; i < open_max; i++) {
1636             if (i != STDIN_FILENO &&
1637                 i != STDOUT_FILENO &&
1638                 i != STDERR_FILENO &&
1639                 i != fd) {
1640                 close(i);
1641             }
1642         }
1643         parg = args;
1644         *parg++ = (char *)setup_script;
1645         *parg++ = (char *)ifname;
1646         *parg++ = NULL;
1647         execv(setup_script, args);
1648         _exit(1);
1649     } else if (pid > 0) {
1650         while (waitpid(pid, &status, 0) != pid) {
1651             /* loop */
1652         }
1653         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1654
1655         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1656             return 0;
1657         }
1658     }
1659     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1660     return -1;
1661 }
1662
1663 static TAPState *net_tap_init(VLANState *vlan, const char *model,
1664                               const char *name, const char *ifname1,
1665                               const char *setup_script, const char *down_script)
1666 {
1667     TAPState *s;
1668     int fd;
1669     char ifname[128];
1670
1671     if (ifname1 != NULL)
1672         pstrcpy(ifname, sizeof(ifname), ifname1);
1673     else
1674         ifname[0] = '\0';
1675     TFR(fd = tap_open(ifname, sizeof(ifname)));
1676     if (fd < 0)
1677         return NULL;
1678
1679     if (!setup_script || !strcmp(setup_script, "no"))
1680         setup_script = "";
1681     if (setup_script[0] != '\0' &&
1682         launch_script(setup_script, ifname, fd)) {
1683         return NULL;
1684     }
1685     s = net_tap_fd_init(vlan, model, name, fd);
1686     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1687              "ifname=%s,script=%s,downscript=%s",
1688              ifname, setup_script, down_script);
1689     if (down_script && strcmp(down_script, "no")) {
1690         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
1691         snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
1692     }
1693     return s;
1694 }
1695
1696 #endif /* !_WIN32 */
1697
1698 #if defined(CONFIG_VDE)
1699 typedef struct VDEState {
1700     VLANClientState *vc;
1701     VDECONN *vde;
1702 } VDEState;
1703
1704 static void vde_to_qemu(void *opaque)
1705 {
1706     VDEState *s = opaque;
1707     uint8_t buf[4096];
1708     int size;
1709
1710     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1711     if (size > 0) {
1712         qemu_send_packet(s->vc, buf, size);
1713     }
1714 }
1715
1716 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1717 {
1718     VDEState *s = vc->opaque;
1719     ssize_t ret;
1720
1721     do {
1722       ret = vde_send(s->vde, (const char *)buf, size, 0);
1723     } while (ret < 0 && errno == EINTR);
1724
1725     return ret;
1726 }
1727
1728 static void vde_cleanup(VLANClientState *vc)
1729 {
1730     VDEState *s = vc->opaque;
1731     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1732     vde_close(s->vde);
1733     qemu_free(s);
1734 }
1735
1736 static int net_vde_init(VLANState *vlan, const char *model,
1737                         const char *name, const char *sock,
1738                         int port, const char *group, int mode)
1739 {
1740     VDEState *s;
1741     char *init_group = strlen(group) ? (char *)group : NULL;
1742     char *init_sock = strlen(sock) ? (char *)sock : NULL;
1743
1744     struct vde_open_args args = {
1745         .port = port,
1746         .group = init_group,
1747         .mode = mode,
1748     };
1749
1750     s = qemu_mallocz(sizeof(VDEState));
1751     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1752     if (!s->vde){
1753         free(s);
1754         return -1;
1755     }
1756     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
1757                                  NULL, vde_cleanup, s);
1758     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1759     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1760              sock, vde_datafd(s->vde));
1761     return 0;
1762 }
1763 #endif
1764
1765 /* network connection */
1766 typedef struct NetSocketState {
1767     VLANClientState *vc;
1768     int fd;
1769     int state; /* 0 = getting length, 1 = getting data */
1770     unsigned int index;
1771     unsigned int packet_len;
1772     uint8_t buf[4096];
1773     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1774 } NetSocketState;
1775
1776 typedef struct NetSocketListenState {
1777     VLANState *vlan;
1778     char *model;
1779     char *name;
1780     int fd;
1781 } NetSocketListenState;
1782
1783 /* XXX: we consider we can send the whole packet without blocking */
1784 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1785 {
1786     NetSocketState *s = vc->opaque;
1787     uint32_t len;
1788     len = htonl(size);
1789
1790     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1791     return send_all(s->fd, buf, size);
1792 }
1793
1794 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1795 {
1796     NetSocketState *s = vc->opaque;
1797
1798     return sendto(s->fd, (const void *)buf, size, 0,
1799                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
1800 }
1801
1802 static void net_socket_send(void *opaque)
1803 {
1804     NetSocketState *s = opaque;
1805     int size, err;
1806     unsigned l;
1807     uint8_t buf1[4096];
1808     const uint8_t *buf;
1809
1810     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
1811     if (size < 0) {
1812         err = socket_error();
1813         if (err != EWOULDBLOCK)
1814             goto eoc;
1815     } else if (size == 0) {
1816         /* end of connection */
1817     eoc:
1818         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1819         closesocket(s->fd);
1820         return;
1821     }
1822     buf = buf1;
1823     while (size > 0) {
1824         /* reassemble a packet from the network */
1825         switch(s->state) {
1826         case 0:
1827             l = 4 - s->index;
1828             if (l > size)
1829                 l = size;
1830             memcpy(s->buf + s->index, buf, l);
1831             buf += l;
1832             size -= l;
1833             s->index += l;
1834             if (s->index == 4) {
1835                 /* got length */
1836                 s->packet_len = ntohl(*(uint32_t *)s->buf);
1837                 s->index = 0;
1838                 s->state = 1;
1839             }
1840             break;
1841         case 1:
1842             l = s->packet_len - s->index;
1843             if (l > size)
1844                 l = size;
1845             if (s->index + l <= sizeof(s->buf)) {
1846                 memcpy(s->buf + s->index, buf, l);
1847             } else {
1848                 fprintf(stderr, "serious error: oversized packet received,"
1849                     "connection terminated.\n");
1850                 s->state = 0;
1851                 goto eoc;
1852             }
1853
1854             s->index += l;
1855             buf += l;
1856             size -= l;
1857             if (s->index >= s->packet_len) {
1858                 qemu_send_packet(s->vc, s->buf, s->packet_len);
1859                 s->index = 0;
1860                 s->state = 0;
1861             }
1862             break;
1863         }
1864     }
1865 }
1866
1867 static void net_socket_send_dgram(void *opaque)
1868 {
1869     NetSocketState *s = opaque;
1870     int size;
1871
1872     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
1873     if (size < 0)
1874         return;
1875     if (size == 0) {
1876         /* end of connection */
1877         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1878         return;
1879     }
1880     qemu_send_packet(s->vc, s->buf, size);
1881 }
1882
1883 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
1884 {
1885     struct ip_mreq imr;
1886     int fd;
1887     int val, ret;
1888     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
1889         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
1890                 inet_ntoa(mcastaddr->sin_addr),
1891                 (int)ntohl(mcastaddr->sin_addr.s_addr));
1892         return -1;
1893
1894     }
1895     fd = socket(PF_INET, SOCK_DGRAM, 0);
1896     if (fd < 0) {
1897         perror("socket(PF_INET, SOCK_DGRAM)");
1898         return -1;
1899     }
1900
1901     val = 1;
1902     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
1903                    (const char *)&val, sizeof(val));
1904     if (ret < 0) {
1905         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
1906         goto fail;
1907     }
1908
1909     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
1910     if (ret < 0) {
1911         perror("bind");
1912         goto fail;
1913     }
1914
1915     /* Add host to multicast group */
1916     imr.imr_multiaddr = mcastaddr->sin_addr;
1917     imr.imr_interface.s_addr = htonl(INADDR_ANY);
1918
1919     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
1920                      (const char *)&imr, sizeof(struct ip_mreq));
1921     if (ret < 0) {
1922         perror("setsockopt(IP_ADD_MEMBERSHIP)");
1923         goto fail;
1924     }
1925
1926     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
1927     val = 1;
1928     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
1929                    (const char *)&val, sizeof(val));
1930     if (ret < 0) {
1931         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
1932         goto fail;
1933     }
1934
1935     socket_set_nonblock(fd);
1936     return fd;
1937 fail:
1938     if (fd >= 0)
1939         closesocket(fd);
1940     return -1;
1941 }
1942
1943 static void net_socket_cleanup(VLANClientState *vc)
1944 {
1945     NetSocketState *s = vc->opaque;
1946     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1947     close(s->fd);
1948     qemu_free(s);
1949 }
1950
1951 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
1952                                                 const char *model,
1953                                                 const char *name,
1954                                                 int fd, int is_connected)
1955 {
1956     struct sockaddr_in saddr;
1957     int newfd;
1958     socklen_t saddr_len;
1959     NetSocketState *s;
1960
1961     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
1962      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
1963      * by ONLY ONE process: we must "clone" this dgram socket --jjo
1964      */
1965
1966     if (is_connected) {
1967         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
1968             /* must be bound */
1969             if (saddr.sin_addr.s_addr==0) {
1970                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
1971                         fd);
1972                 return NULL;
1973             }
1974             /* clone dgram socket */
1975             newfd = net_socket_mcast_create(&saddr);
1976             if (newfd < 0) {
1977                 /* error already reported by net_socket_mcast_create() */
1978                 close(fd);
1979                 return NULL;
1980             }
1981             /* clone newfd to fd, close newfd */
1982             dup2(newfd, fd);
1983             close(newfd);
1984
1985         } else {
1986             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
1987                     fd, strerror(errno));
1988             return NULL;
1989         }
1990     }
1991
1992     s = qemu_mallocz(sizeof(NetSocketState));
1993     s->fd = fd;
1994
1995     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
1996                                  NULL, net_socket_cleanup, s);
1997     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
1998
1999     /* mcast: save bound address as dst */
2000     if (is_connected) s->dgram_dst=saddr;
2001
2002     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2003             "socket: fd=%d (%s mcast=%s:%d)",
2004             fd, is_connected? "cloned" : "",
2005             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2006     return s;
2007 }
2008
2009 static void net_socket_connect(void *opaque)
2010 {
2011     NetSocketState *s = opaque;
2012     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2013 }
2014
2015 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2016                                                  const char *model,
2017                                                  const char *name,
2018                                                  int fd, int is_connected)
2019 {
2020     NetSocketState *s;
2021     s = qemu_mallocz(sizeof(NetSocketState));
2022     s->fd = fd;
2023     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
2024                                  NULL, net_socket_cleanup, s);
2025     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2026              "socket: fd=%d", fd);
2027     if (is_connected) {
2028         net_socket_connect(s);
2029     } else {
2030         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2031     }
2032     return s;
2033 }
2034
2035 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2036                                           const char *model, const char *name,
2037                                           int fd, int is_connected)
2038 {
2039     int so_type = -1, optlen=sizeof(so_type);
2040
2041     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2042         (socklen_t *)&optlen)< 0) {
2043         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2044         return NULL;
2045     }
2046     switch(so_type) {
2047     case SOCK_DGRAM:
2048         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2049     case SOCK_STREAM:
2050         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2051     default:
2052         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2053         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2054         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2055     }
2056     return NULL;
2057 }
2058
2059 static void net_socket_accept(void *opaque)
2060 {
2061     NetSocketListenState *s = opaque;
2062     NetSocketState *s1;
2063     struct sockaddr_in saddr;
2064     socklen_t len;
2065     int fd;
2066
2067     for(;;) {
2068         len = sizeof(saddr);
2069         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2070         if (fd < 0 && errno != EINTR) {
2071             return;
2072         } else if (fd >= 0) {
2073             break;
2074         }
2075     }
2076     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2077     if (!s1) {
2078         closesocket(fd);
2079     } else {
2080         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2081                  "socket: connection from %s:%d",
2082                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2083     }
2084 }
2085
2086 static int net_socket_listen_init(VLANState *vlan,
2087                                   const char *model,
2088                                   const char *name,
2089                                   const char *host_str)
2090 {
2091     NetSocketListenState *s;
2092     int fd, val, ret;
2093     struct sockaddr_in saddr;
2094
2095     if (parse_host_port(&saddr, host_str) < 0)
2096         return -1;
2097
2098     s = qemu_mallocz(sizeof(NetSocketListenState));
2099
2100     fd = socket(PF_INET, SOCK_STREAM, 0);
2101     if (fd < 0) {
2102         perror("socket");
2103         return -1;
2104     }
2105     socket_set_nonblock(fd);
2106
2107     /* allow fast reuse */
2108     val = 1;
2109     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2110
2111     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2112     if (ret < 0) {
2113         perror("bind");
2114         return -1;
2115     }
2116     ret = listen(fd, 0);
2117     if (ret < 0) {
2118         perror("listen");
2119         return -1;
2120     }
2121     s->vlan = vlan;
2122     s->model = qemu_strdup(model);
2123     s->name = name ? qemu_strdup(name) : NULL;
2124     s->fd = fd;
2125     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2126     return 0;
2127 }
2128
2129 static int net_socket_connect_init(VLANState *vlan,
2130                                    const char *model,
2131                                    const char *name,
2132                                    const char *host_str)
2133 {
2134     NetSocketState *s;
2135     int fd, connected, ret, err;
2136     struct sockaddr_in saddr;
2137
2138     if (parse_host_port(&saddr, host_str) < 0)
2139         return -1;
2140
2141     fd = socket(PF_INET, SOCK_STREAM, 0);
2142     if (fd < 0) {
2143         perror("socket");
2144         return -1;
2145     }
2146     socket_set_nonblock(fd);
2147
2148     connected = 0;
2149     for(;;) {
2150         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2151         if (ret < 0) {
2152             err = socket_error();
2153             if (err == EINTR || err == EWOULDBLOCK) {
2154             } else if (err == EINPROGRESS) {
2155                 break;
2156 #ifdef _WIN32
2157             } else if (err == WSAEALREADY) {
2158                 break;
2159 #endif
2160             } else {
2161                 perror("connect");
2162                 closesocket(fd);
2163                 return -1;
2164             }
2165         } else {
2166             connected = 1;
2167             break;
2168         }
2169     }
2170     s = net_socket_fd_init(vlan, model, name, fd, connected);
2171     if (!s)
2172         return -1;
2173     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2174              "socket: connect to %s:%d",
2175              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2176     return 0;
2177 }
2178
2179 static int net_socket_mcast_init(VLANState *vlan,
2180                                  const char *model,
2181                                  const char *name,
2182                                  const char *host_str)
2183 {
2184     NetSocketState *s;
2185     int fd;
2186     struct sockaddr_in saddr;
2187
2188     if (parse_host_port(&saddr, host_str) < 0)
2189         return -1;
2190
2191
2192     fd = net_socket_mcast_create(&saddr);
2193     if (fd < 0)
2194         return -1;
2195
2196     s = net_socket_fd_init(vlan, model, name, fd, 0);
2197     if (!s)
2198         return -1;
2199
2200     s->dgram_dst = saddr;
2201
2202     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2203              "socket: mcast=%s:%d",
2204              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2205     return 0;
2206
2207 }
2208
2209 typedef struct DumpState {
2210     VLANClientState *pcap_vc;
2211     int fd;
2212     int pcap_caplen;
2213 } DumpState;
2214
2215 #define PCAP_MAGIC 0xa1b2c3d4
2216
2217 struct pcap_file_hdr {
2218     uint32_t magic;
2219     uint16_t version_major;
2220     uint16_t version_minor;
2221     int32_t thiszone;
2222     uint32_t sigfigs;
2223     uint32_t snaplen;
2224     uint32_t linktype;
2225 };
2226
2227 struct pcap_sf_pkthdr {
2228     struct {
2229         int32_t tv_sec;
2230         int32_t tv_usec;
2231     } ts;
2232     uint32_t caplen;
2233     uint32_t len;
2234 };
2235
2236 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2237 {
2238     DumpState *s = vc->opaque;
2239     struct pcap_sf_pkthdr hdr;
2240     int64_t ts;
2241     int caplen;
2242
2243     /* Early return in case of previous error. */
2244     if (s->fd < 0) {
2245         return size;
2246     }
2247
2248     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, get_ticks_per_sec());
2249     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2250
2251     hdr.ts.tv_sec = ts / 1000000;
2252     hdr.ts.tv_usec = ts % 1000000;
2253     hdr.caplen = caplen;
2254     hdr.len = size;
2255     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2256         write(s->fd, buf, caplen) != caplen) {
2257         qemu_log("-net dump write error - stop dump\n");
2258         close(s->fd);
2259         s->fd = -1;
2260     }
2261
2262     return size;
2263 }
2264
2265 static void net_dump_cleanup(VLANClientState *vc)
2266 {
2267     DumpState *s = vc->opaque;
2268
2269     close(s->fd);
2270     qemu_free(s);
2271 }
2272
2273 static int net_dump_init(VLANState *vlan, const char *device,
2274                          const char *name, const char *filename, int len)
2275 {
2276     struct pcap_file_hdr hdr;
2277     DumpState *s;
2278
2279     s = qemu_malloc(sizeof(DumpState));
2280
2281     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2282     if (s->fd < 0) {
2283         qemu_error("-net dump: can't open %s\n", filename);
2284         return -1;
2285     }
2286
2287     s->pcap_caplen = len;
2288
2289     hdr.magic = PCAP_MAGIC;
2290     hdr.version_major = 2;
2291     hdr.version_minor = 4;
2292     hdr.thiszone = 0;
2293     hdr.sigfigs = 0;
2294     hdr.snaplen = s->pcap_caplen;
2295     hdr.linktype = 1;
2296
2297     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2298         qemu_error("-net dump write error: %s\n", strerror(errno));
2299         close(s->fd);
2300         qemu_free(s);
2301         return -1;
2302     }
2303
2304     s->pcap_vc = qemu_new_vlan_client(vlan, device, name, NULL, dump_receive, NULL,
2305                                       net_dump_cleanup, s);
2306     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2307              "dump to %s (len=%d)", filename, len);
2308     return 0;
2309 }
2310
2311 /* find or alloc a new VLAN */
2312 VLANState *qemu_find_vlan(int id, int allocate)
2313 {
2314     VLANState **pvlan, *vlan;
2315     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2316         if (vlan->id == id)
2317             return vlan;
2318     }
2319     if (!allocate) {
2320         return NULL;
2321     }
2322     vlan = qemu_mallocz(sizeof(VLANState));
2323     vlan->id = id;
2324     QTAILQ_INIT(&vlan->send_queue);
2325     vlan->next = NULL;
2326     pvlan = &first_vlan;
2327     while (*pvlan != NULL)
2328         pvlan = &(*pvlan)->next;
2329     *pvlan = vlan;
2330     return vlan;
2331 }
2332
2333 static int nic_get_free_idx(void)
2334 {
2335     int index;
2336
2337     for (index = 0; index < MAX_NICS; index++)
2338         if (!nd_table[index].used)
2339             return index;
2340     return -1;
2341 }
2342
2343 int qemu_show_nic_models(const char *arg, const char *const *models)
2344 {
2345     int i;
2346
2347     if (!arg || strcmp(arg, "?"))
2348         return 0;
2349
2350     fprintf(stderr, "qemu: Supported NIC models: ");
2351     for (i = 0 ; models[i]; i++)
2352         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2353     return 1;
2354 }
2355
2356 void qemu_check_nic_model(NICInfo *nd, const char *model)
2357 {
2358     const char *models[2];
2359
2360     models[0] = model;
2361     models[1] = NULL;
2362
2363     if (qemu_show_nic_models(nd->model, models))
2364         exit(0);
2365     if (qemu_find_nic_model(nd, models, model) < 0)
2366         exit(1);
2367 }
2368
2369 int qemu_find_nic_model(NICInfo *nd, const char * const *models,
2370                         const char *default_model)
2371 {
2372     int i;
2373
2374     if (!nd->model)
2375         nd->model = qemu_strdup(default_model);
2376
2377     for (i = 0 ; models[i]; i++) {
2378         if (strcmp(nd->model, models[i]) == 0)
2379             return i;
2380     }
2381
2382     qemu_error("qemu: Unsupported NIC model: %s\n", nd->model);
2383     return -1;
2384 }
2385
2386 static int net_handle_fd_param(Monitor *mon, const char *param)
2387 {
2388     if (!qemu_isdigit(param[0])) {
2389         int fd;
2390
2391         fd = monitor_get_fd(mon, param);
2392         if (fd == -1) {
2393             qemu_error("No file descriptor named %s found", param);
2394             return -1;
2395         }
2396
2397         return fd;
2398     } else {
2399         return strtol(param, NULL, 0);
2400     }
2401 }
2402
2403 int net_client_init(Monitor *mon, const char *device, const char *p)
2404 {
2405     char buf[1024];
2406     int vlan_id, ret;
2407     VLANState *vlan;
2408     char *name = NULL;
2409
2410     vlan_id = 0;
2411     if (get_param_value(buf, sizeof(buf), "vlan", p)) {
2412         vlan_id = strtol(buf, NULL, 0);
2413     }
2414     vlan = qemu_find_vlan(vlan_id, 1);
2415
2416     if (get_param_value(buf, sizeof(buf), "name", p)) {
2417         name = qemu_strdup(buf);
2418     }
2419     if (!strcmp(device, "nic")) {
2420         static const char * const nic_params[] = {
2421             "vlan", "name", "macaddr", "model", "addr", "id", "vectors", NULL
2422         };
2423         NICInfo *nd;
2424         uint8_t *macaddr;
2425         int idx = nic_get_free_idx();
2426
2427         if (check_params(buf, sizeof(buf), nic_params, p) < 0) {
2428             qemu_error("invalid parameter '%s' in '%s'\n", buf, p);
2429             ret = -1;
2430             goto out;
2431         }
2432         if (idx == -1 || nb_nics >= MAX_NICS) {
2433             qemu_error("Too Many NICs\n");
2434             ret = -1;
2435             goto out;
2436         }
2437         nd = &nd_table[idx];
2438         memset(nd, 0, sizeof(*nd));
2439         macaddr = nd->macaddr;
2440         macaddr[0] = 0x52;
2441         macaddr[1] = 0x54;
2442         macaddr[2] = 0x00;
2443         macaddr[3] = 0x12;
2444         macaddr[4] = 0x34;
2445         macaddr[5] = 0x56 + idx;
2446
2447         if (get_param_value(buf, sizeof(buf), "macaddr", p)) {
2448             if (parse_macaddr(macaddr, buf) < 0) {
2449                 qemu_error("invalid syntax for ethernet address\n");
2450                 ret = -1;
2451                 goto out;
2452             }
2453         }
2454         if (get_param_value(buf, sizeof(buf), "model", p)) {
2455             nd->model = qemu_strdup(buf);
2456         }
2457         if (get_param_value(buf, sizeof(buf), "addr", p)) {
2458             nd->devaddr = qemu_strdup(buf);
2459         }
2460         if (get_param_value(buf, sizeof(buf), "id", p)) {
2461             nd->id = qemu_strdup(buf);
2462         }
2463         nd->nvectors = NIC_NVECTORS_UNSPECIFIED;
2464         if (get_param_value(buf, sizeof(buf), "vectors", p)) {
2465             char *endptr;
2466             long vectors = strtol(buf, &endptr, 0);
2467             if (*endptr) {
2468                 qemu_error("invalid syntax for # of vectors\n");
2469                 ret = -1;
2470                 goto out;
2471             }
2472             if (vectors < 0 || vectors > 0x7ffffff) {
2473                 qemu_error("invalid # of vectors\n");
2474                 ret = -1;
2475                 goto out;
2476             }
2477             nd->nvectors = vectors;
2478         }
2479         nd->vlan = vlan;
2480         nd->name = name;
2481         nd->used = 1;
2482         name = NULL;
2483         nb_nics++;
2484         vlan->nb_guest_devs++;
2485         ret = idx;
2486     } else
2487     if (!strcmp(device, "none")) {
2488         if (*p != '\0') {
2489             qemu_error("'none' takes no parameters\n");
2490             ret = -1;
2491             goto out;
2492         }
2493         /* does nothing. It is needed to signal that no network cards
2494            are wanted */
2495         ret = 0;
2496     } else
2497 #ifdef CONFIG_SLIRP
2498     if (!strcmp(device, "user")) {
2499         static const char * const slirp_params[] = {
2500             "vlan", "name", "hostname", "restrict", "ip", "net", "host",
2501             "tftp", "bootfile", "dhcpstart", "dns", "smb", "smbserver",
2502             "hostfwd", "guestfwd", NULL
2503         };
2504         struct slirp_config_str *config;
2505         int restricted = 0;
2506         char *vnet = NULL;
2507         char *vhost = NULL;
2508         char *vhostname = NULL;
2509         char *tftp_export = NULL;
2510         char *bootfile = NULL;
2511         char *vdhcp_start = NULL;
2512         char *vnamesrv = NULL;
2513         char *smb_export = NULL;
2514         char *vsmbsrv = NULL;
2515         const char *q;
2516
2517         if (check_params(buf, sizeof(buf), slirp_params, p) < 0) {
2518             qemu_error("invalid parameter '%s' in '%s'\n", buf, p);
2519             ret = -1;
2520             goto out;
2521         }
2522         if (get_param_value(buf, sizeof(buf), "ip", p)) {
2523             int vnet_buflen = strlen(buf) + strlen("/24") + 1;
2524             /* emulate legacy parameter */
2525             vnet = qemu_malloc(vnet_buflen);
2526             pstrcpy(vnet, vnet_buflen, buf);
2527             pstrcat(vnet, vnet_buflen, "/24");
2528         }
2529         if (get_param_value(buf, sizeof(buf), "net", p)) {
2530             vnet = qemu_strdup(buf);
2531         }
2532         if (get_param_value(buf, sizeof(buf), "host", p)) {
2533             vhost = qemu_strdup(buf);
2534         }
2535         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
2536             vhostname = qemu_strdup(buf);
2537         }
2538         if (get_param_value(buf, sizeof(buf), "restrict", p)) {
2539             restricted = (buf[0] == 'y') ? 1 : 0;
2540         }
2541         if (get_param_value(buf, sizeof(buf), "dhcpstart", p)) {
2542             vdhcp_start = qemu_strdup(buf);
2543         }
2544         if (get_param_value(buf, sizeof(buf), "dns", p)) {
2545             vnamesrv = qemu_strdup(buf);
2546         }
2547         if (get_param_value(buf, sizeof(buf), "tftp", p)) {
2548             tftp_export = qemu_strdup(buf);
2549         }
2550         if (get_param_value(buf, sizeof(buf), "bootfile", p)) {
2551             bootfile = qemu_strdup(buf);
2552         }
2553         if (get_param_value(buf, sizeof(buf), "smb", p)) {
2554             smb_export = qemu_strdup(buf);
2555             if (get_param_value(buf, sizeof(buf), "smbserver", p)) {
2556                 vsmbsrv = qemu_strdup(buf);
2557             }
2558         }
2559         q = p;
2560         while (1) {
2561             config = qemu_malloc(sizeof(*config));
2562             if (!get_next_param_value(config->str, sizeof(config->str),
2563                                       "hostfwd", &q)) {
2564                 break;
2565             }
2566             config->flags = SLIRP_CFG_HOSTFWD;
2567             config->next = slirp_configs;
2568             slirp_configs = config;
2569             config = NULL;
2570         }
2571         q = p;
2572         while (1) {
2573             config = qemu_malloc(sizeof(*config));
2574             if (!get_next_param_value(config->str, sizeof(config->str),
2575                                       "guestfwd", &q)) {
2576                 break;
2577             }
2578             config->flags = 0;
2579             config->next = slirp_configs;
2580             slirp_configs = config;
2581             config = NULL;
2582         }
2583         qemu_free(config);
2584         vlan->nb_host_devs++;
2585         ret = net_slirp_init(vlan, device, name, restricted, vnet, vhost,
2586                              vhostname, tftp_export, bootfile, vdhcp_start,
2587                              vnamesrv, smb_export, vsmbsrv);
2588         while (slirp_configs) {
2589             config = slirp_configs;
2590             slirp_configs = config->next;
2591             qemu_free(config);
2592         }
2593         qemu_free(vnet);
2594         qemu_free(vhost);
2595         qemu_free(vhostname);
2596         qemu_free(tftp_export);
2597         qemu_free(bootfile);
2598         qemu_free(vdhcp_start);
2599         qemu_free(vnamesrv);
2600         qemu_free(smb_export);
2601         qemu_free(vsmbsrv);
2602     } else if (!strcmp(device, "channel")) {
2603         if (QTAILQ_EMPTY(&slirp_stacks)) {
2604             struct slirp_config_str *config;
2605
2606             config = qemu_malloc(sizeof(*config));
2607             pstrcpy(config->str, sizeof(config->str), p);
2608             config->flags = SLIRP_CFG_LEGACY;
2609             config->next = slirp_configs;
2610             slirp_configs = config;
2611             ret = 0;
2612         } else {
2613             ret = slirp_guestfwd(QTAILQ_FIRST(&slirp_stacks), p, 1);
2614         }
2615     } else
2616 #endif
2617 #ifdef _WIN32
2618     if (!strcmp(device, "tap")) {
2619         static const char * const tap_params[] = {
2620             "vlan", "name", "ifname", NULL
2621         };
2622         char ifname[64];
2623
2624         if (check_params(buf, sizeof(buf), tap_params, p) < 0) {
2625             qemu_error("invalid parameter '%s' in '%s'\n", buf, p);
2626             ret = -1;
2627             goto out;
2628         }
2629         if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
2630             qemu_error("tap: no interface name\n");
2631             ret = -1;
2632             goto out;
2633         }
2634         vlan->nb_host_devs++;
2635         ret = tap_win32_init(vlan, device, name, ifname);
2636     } else
2637 #elif defined (_AIX)
2638 #else
2639     if (!strcmp(device, "tap")) {
2640         char ifname[64], chkbuf[64];
2641         char setup_script[1024], down_script[1024];
2642         TAPState *s;
2643         int fd;
2644         vlan->nb_host_devs++;
2645         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
2646             static const char * const fd_params[] = {
2647                 "vlan", "name", "fd", "sndbuf", NULL
2648             };
2649             ret = -1;
2650             if (check_params(chkbuf, sizeof(chkbuf), fd_params, p) < 0) {
2651                 qemu_error("invalid parameter '%s' in '%s'\n", chkbuf, p);
2652                 goto out;
2653             }
2654             fd = net_handle_fd_param(mon, buf);
2655             if (fd == -1) {
2656                 goto out;
2657             }
2658             fcntl(fd, F_SETFL, O_NONBLOCK);
2659             s = net_tap_fd_init(vlan, device, name, fd);
2660             if (!s) {
2661                 close(fd);
2662             }
2663         } else {
2664             static const char * const tap_params[] = {
2665                 "vlan", "name", "ifname", "script", "downscript", "sndbuf", NULL
2666             };
2667             if (check_params(chkbuf, sizeof(chkbuf), tap_params, p) < 0) {
2668                 qemu_error("invalid parameter '%s' in '%s'\n", chkbuf, p);
2669                 ret = -1;
2670                 goto out;
2671             }
2672             if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
2673                 ifname[0] = '\0';
2674             }
2675             if (get_param_value(setup_script, sizeof(setup_script), "script", p) == 0) {
2676                 pstrcpy(setup_script, sizeof(setup_script), DEFAULT_NETWORK_SCRIPT);
2677             }
2678             if (get_param_value(down_script, sizeof(down_script), "downscript", p) == 0) {
2679                 pstrcpy(down_script, sizeof(down_script), DEFAULT_NETWORK_DOWN_SCRIPT);
2680             }
2681             s = net_tap_init(vlan, device, name, ifname, setup_script, down_script);
2682         }
2683         if (s != NULL) {
2684             const char *sndbuf_str = NULL;
2685             if (get_param_value(buf, sizeof(buf), "sndbuf", p)) {
2686                 sndbuf_str = buf;
2687             }
2688             ret = tap_set_sndbuf(s, sndbuf_str);
2689         } else {
2690             ret = -1;
2691         }
2692     } else
2693 #endif
2694     if (!strcmp(device, "socket")) {
2695         char chkbuf[64];
2696         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
2697             static const char * const fd_params[] = {
2698                 "vlan", "name", "fd", NULL
2699             };
2700             int fd;
2701             ret = -1;
2702             if (check_params(chkbuf, sizeof(chkbuf), fd_params, p) < 0) {
2703                 qemu_error("invalid parameter '%s' in '%s'\n", chkbuf, p);
2704                 goto out;
2705             }
2706             fd = net_handle_fd_param(mon, buf);
2707             if (fd == -1) {
2708                 goto out;
2709             }
2710             if (!net_socket_fd_init(vlan, device, name, fd, 1)) {
2711                 close(fd);
2712                 goto out;
2713             }
2714             ret = 0;
2715         } else if (get_param_value(buf, sizeof(buf), "listen", p) > 0) {
2716             static const char * const listen_params[] = {
2717                 "vlan", "name", "listen", NULL
2718             };
2719             if (check_params(chkbuf, sizeof(chkbuf), listen_params, p) < 0) {
2720                 qemu_error("invalid parameter '%s' in '%s'\n", chkbuf, p);
2721                 ret = -1;
2722                 goto out;
2723             }
2724             ret = net_socket_listen_init(vlan, device, name, buf);
2725         } else if (get_param_value(buf, sizeof(buf), "connect", p) > 0) {
2726             static const char * const connect_params[] = {
2727                 "vlan", "name", "connect", NULL
2728             };
2729             if (check_params(chkbuf, sizeof(chkbuf), connect_params, p) < 0) {
2730                 qemu_error("invalid parameter '%s' in '%s'\n", chkbuf, p);
2731                 ret = -1;
2732                 goto out;
2733             }
2734             ret = net_socket_connect_init(vlan, device, name, buf);
2735         } else if (get_param_value(buf, sizeof(buf), "mcast", p) > 0) {
2736             static const char * const mcast_params[] = {
2737                 "vlan", "name", "mcast", NULL
2738             };
2739             if (check_params(chkbuf, sizeof(chkbuf), mcast_params, p) < 0) {
2740                 qemu_error("invalid parameter '%s' in '%s'\n", chkbuf, p);
2741                 ret = -1;
2742                 goto out;
2743             }
2744             ret = net_socket_mcast_init(vlan, device, name, buf);
2745         } else {
2746             qemu_error("Unknown socket options: %s\n", p);
2747             ret = -1;
2748             goto out;
2749         }
2750         vlan->nb_host_devs++;
2751     } else
2752 #ifdef CONFIG_VDE
2753     if (!strcmp(device, "vde")) {
2754         static const char * const vde_params[] = {
2755             "vlan", "name", "sock", "port", "group", "mode", NULL
2756         };
2757         char vde_sock[1024], vde_group[512];
2758         int vde_port, vde_mode;
2759
2760         if (check_params(buf, sizeof(buf), vde_params, p) < 0) {
2761             qemu_error("invalid parameter '%s' in '%s'\n", buf, p);
2762             ret = -1;
2763             goto out;
2764         }
2765         vlan->nb_host_devs++;
2766         if (get_param_value(vde_sock, sizeof(vde_sock), "sock", p) <= 0) {
2767             vde_sock[0] = '\0';
2768         }
2769         if (get_param_value(buf, sizeof(buf), "port", p) > 0) {
2770             vde_port = strtol(buf, NULL, 10);
2771         } else {
2772             vde_port = 0;
2773         }
2774         if (get_param_value(vde_group, sizeof(vde_group), "group", p) <= 0) {
2775             vde_group[0] = '\0';
2776         }
2777         if (get_param_value(buf, sizeof(buf), "mode", p) > 0) {
2778             vde_mode = strtol(buf, NULL, 8);
2779         } else {
2780             vde_mode = 0700;
2781         }
2782         ret = net_vde_init(vlan, device, name, vde_sock, vde_port, vde_group, vde_mode);
2783     } else
2784 #endif
2785     if (!strcmp(device, "dump")) {
2786         int len = 65536;
2787
2788         if (get_param_value(buf, sizeof(buf), "len", p) > 0) {
2789             len = strtol(buf, NULL, 0);
2790         }
2791         if (!get_param_value(buf, sizeof(buf), "file", p)) {
2792             snprintf(buf, sizeof(buf), "qemu-vlan%d.pcap", vlan_id);
2793         }
2794         ret = net_dump_init(vlan, device, name, buf, len);
2795     } else {
2796         qemu_error("Unknown network device: %s\n", device);
2797         ret = -1;
2798         goto out;
2799     }
2800     if (ret < 0) {
2801         qemu_error("Could not initialize device '%s'\n", device);
2802     }
2803 out:
2804     qemu_free(name);
2805     return ret;
2806 }
2807
2808 void net_client_uninit(NICInfo *nd)
2809 {
2810     nd->vlan->nb_guest_devs--;
2811     nb_nics--;
2812
2813     qemu_free(nd->model);
2814     qemu_free(nd->name);
2815     qemu_free(nd->devaddr);
2816     qemu_free(nd->id);
2817
2818     nd->used = 0;
2819 }
2820
2821 static int net_host_check_device(const char *device)
2822 {
2823     int i;
2824     const char *valid_param_list[] = { "tap", "socket", "dump"
2825 #ifdef CONFIG_SLIRP
2826                                        ,"user"
2827 #endif
2828 #ifdef CONFIG_VDE
2829                                        ,"vde"
2830 #endif
2831     };
2832     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
2833         if (!strncmp(valid_param_list[i], device,
2834                      strlen(valid_param_list[i])))
2835             return 1;
2836     }
2837
2838     return 0;
2839 }
2840
2841 void net_host_device_add(Monitor *mon, const QDict *qdict)
2842 {
2843     const char *device = qdict_get_str(qdict, "device");
2844     const char *opts = qdict_get_try_str(qdict, "opts");
2845
2846     if (!net_host_check_device(device)) {
2847         monitor_printf(mon, "invalid host network device %s\n", device);
2848         return;
2849     }
2850     if (net_client_init(mon, device, opts ? opts : "") < 0) {
2851         monitor_printf(mon, "adding host network device %s failed\n", device);
2852     }
2853 }
2854
2855 void net_host_device_remove(Monitor *mon, const QDict *qdict)
2856 {
2857     VLANClientState *vc;
2858     int vlan_id = qdict_get_int(qdict, "vlan_id");
2859     const char *device = qdict_get_str(qdict, "device");
2860
2861     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
2862     if (!vc) {
2863         return;
2864     }
2865     if (!net_host_check_device(vc->model)) {
2866         monitor_printf(mon, "invalid host network device %s\n", device);
2867         return;
2868     }
2869     qemu_del_vlan_client(vc);
2870 }
2871
2872 int net_client_parse(const char *str)
2873 {
2874     const char *p;
2875     char *q;
2876     char device[64];
2877
2878     p = str;
2879     q = device;
2880     while (*p != '\0' && *p != ',') {
2881         if ((q - device) < sizeof(device) - 1)
2882             *q++ = *p;
2883         p++;
2884     }
2885     *q = '\0';
2886     if (*p == ',')
2887         p++;
2888
2889     return net_client_init(NULL, device, p);
2890 }
2891
2892 void net_set_boot_mask(int net_boot_mask)
2893 {
2894     int i;
2895
2896     /* Only the first four NICs may be bootable */
2897     net_boot_mask = net_boot_mask & 0xF;
2898
2899     for (i = 0; i < nb_nics; i++) {
2900         if (net_boot_mask & (1 << i)) {
2901             nd_table[i].bootable = 1;
2902             net_boot_mask &= ~(1 << i);
2903         }
2904     }
2905
2906     if (net_boot_mask) {
2907         fprintf(stderr, "Cannot boot from non-existent NIC\n");
2908         exit(1);
2909     }
2910 }
2911
2912 void do_info_network(Monitor *mon)
2913 {
2914     VLANState *vlan;
2915     VLANClientState *vc;
2916
2917     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2918         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
2919         for(vc = vlan->first_client; vc != NULL; vc = vc->next)
2920             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
2921     }
2922 }
2923
2924 void do_set_link(Monitor *mon, const QDict *qdict)
2925 {
2926     VLANState *vlan;
2927     VLANClientState *vc = NULL;
2928     const char *name = qdict_get_str(qdict, "name");
2929     const char *up_or_down = qdict_get_str(qdict, "up_or_down");
2930
2931     for (vlan = first_vlan; vlan != NULL; vlan = vlan->next)
2932         for (vc = vlan->first_client; vc != NULL; vc = vc->next)
2933             if (strcmp(vc->name, name) == 0)
2934                 goto done;
2935 done:
2936
2937     if (!vc) {
2938         monitor_printf(mon, "could not find network device '%s'\n", name);
2939         return;
2940     }
2941
2942     if (strcmp(up_or_down, "up") == 0)
2943         vc->link_down = 0;
2944     else if (strcmp(up_or_down, "down") == 0)
2945         vc->link_down = 1;
2946     else
2947         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
2948                        "valid\n", up_or_down);
2949
2950     if (vc->link_status_changed)
2951         vc->link_status_changed(vc);
2952 }
2953
2954 void net_cleanup(void)
2955 {
2956     VLANState *vlan;
2957
2958     /* close network clients */
2959     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2960         VLANClientState *vc = vlan->first_client;
2961
2962         while (vc) {
2963             VLANClientState *next = vc->next;
2964
2965             qemu_del_vlan_client(vc);
2966
2967             vc = next;
2968         }
2969     }
2970 }
2971
2972 void net_client_check(void)
2973 {
2974     VLANState *vlan;
2975
2976     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2977         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
2978             continue;
2979         if (vlan->nb_guest_devs == 0)
2980             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
2981         if (vlan->nb_host_devs == 0)
2982             fprintf(stderr,
2983                     "Warning: vlan %d is not connected to host network\n",
2984                     vlan->id);
2985     }
2986 }