net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for CONFIG_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include <linux/if_tun.h>
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef CONFIG_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #include "qemu-common.h"
 105 #include "net.h"
 106 #include "monitor.h"
 107 #include "sysemu.h"
 108 #include "qemu-timer.h"
 109 #include "qemu-char.h"
 110 #include "audio/audio.h"
 111 #include "qemu_socket.h"
 112 #include "qemu-log.h"
 113 #include "qemu-config.h"
 114
 115 #include "slirp/libslirp.h"
 116 #include "qemu-queue.h"
 117
 118
 119 static VLANState *first_vlan;
 120
 121 /***********************************************************/
 122 /* network device redirectors */
 123
 124 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 125 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 126 {
 127     int len, i, j, c;
 128
 129     for(i=0;i<size;i+=16) {
 130         len = size - i;
 131         if (len > 16)
 132             len = 16;
 133         fprintf(f, "%08x ", i);
 134         for(j=0;j<16;j++) {
 135             if (j < len)
 136                 fprintf(f, " %02x", buf[i+j]);
 137             else
 138                 fprintf(f, "   ");
 139         }
 140         fprintf(f, " ");
 141         for(j=0;j<len;j++) {
 142             c = buf[i+j];
 143             if (c < ' ' || c > '~')
 144                 c = '.';
 145             fprintf(f, "%c", c);
 146         }
 147         fprintf(f, "\n");
 148     }
 149 }
 150 #endif
 151
 152 static int parse_macaddr(uint8_t *macaddr, const char *p)
 153 {
 154     int i;
 155     char *last_char;
 156     long int offset;
 157
 158     errno = 0;
 159     offset = strtol(p, &last_char, 0);
 160     if (0 == errno && '\0' == *last_char &&
 161             offset >= 0 && offset <= 0xFFFFFF) {
 162         macaddr[3] = (offset & 0xFF0000) >> 16;
 163         macaddr[4] = (offset & 0xFF00) >> 8;
 164         macaddr[5] = offset & 0xFF;
 165         return 0;
 166     } else {
 167         for(i = 0; i < 6; i++) {
 168             macaddr[i] = strtol(p, (char **)&p, 16);
 169             if (i == 5) {
 170                 if (*p != '\0')
 171                     return -1;
 172             } else {
 173                 if (*p != ':' && *p != '-')
 174                     return -1;
 175                 p++;
 176             }
 177         }
 178         return 0;
 179     }
 180
 181     return -1;
 182 }
 183
 184 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 185 {
 186     const char *p, *p1;
 187     int len;
 188     p = *pp;
 189     p1 = strchr(p, sep);
 190     if (!p1)
 191         return -1;
 192     len = p1 - p;
 193     p1++;
 194     if (buf_size > 0) {
 195         if (len > buf_size - 1)
 196             len = buf_size - 1;
 197         memcpy(buf, p, len);
 198         buf[len] = '\0';
 199     }
 200     *pp = p1;
 201     return 0;
 202 }
 203
 204 int parse_host_src_port(struct sockaddr_in *haddr,
 205                         struct sockaddr_in *saddr,
 206                         const char *input_str)
 207 {
 208     char *str = strdup(input_str);
 209     char *host_str = str;
 210     char *src_str;
 211     const char *src_str2;
 212     char *ptr;
 213
 214     /*
 215      * Chop off any extra arguments at the end of the string which
 216      * would start with a comma, then fill in the src port information
 217      * if it was provided else use the "any address" and "any port".
 218      */
 219     if ((ptr = strchr(str,',')))
 220         *ptr = '\0';
 221
 222     if ((src_str = strchr(input_str,'@'))) {
 223         *src_str = '\0';
 224         src_str++;
 225     }
 226
 227     if (parse_host_port(haddr, host_str) < 0)
 228         goto fail;
 229
 230     src_str2 = src_str;
 231     if (!src_str || *src_str == '\0')
 232         src_str2 = ":0";
 233
 234     if (parse_host_port(saddr, src_str2) < 0)
 235         goto fail;
 236
 237     free(str);
 238     return(0);
 239
 240 fail:
 241     free(str);
 242     return -1;
 243 }
 244
 245 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 246 {
 247     char buf[512];
 248     struct hostent *he;
 249     const char *p, *r;
 250     int port;
 251
 252     p = str;
 253     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 254         return -1;
 255     saddr->sin_family = AF_INET;
 256     if (buf[0] == '\0') {
 257         saddr->sin_addr.s_addr = 0;
 258     } else {
 259         if (qemu_isdigit(buf[0])) {
 260             if (!inet_aton(buf, &saddr->sin_addr))
 261                 return -1;
 262         } else {
 263             if ((he = gethostbyname(buf)) == NULL)
 264                 return - 1;
 265             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 266         }
 267     }
 268     port = strtol(p, (char **)&r, 0);
 269     if (r == p)
 270         return -1;
 271     saddr->sin_port = htons(port);
 272     return 0;
 273 }
 274
 275 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 276 {
 277     snprintf(vc->info_str, sizeof(vc->info_str),
 278              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 279              vc->model,
 280              macaddr[0], macaddr[1], macaddr[2],
 281              macaddr[3], macaddr[4], macaddr[5]);
 282 }
 283
 284 static char *assign_name(VLANClientState *vc1, const char *model)
 285 {
 286     VLANState *vlan;
 287     char buf[256];
 288     int id = 0;
 289
 290     for (vlan = first_vlan; vlan; vlan = vlan->next) {
 291         VLANClientState *vc;
 292
 293         for (vc = vlan->first_client; vc; vc = vc->next)
 294             if (vc != vc1 && strcmp(vc->model, model) == 0)
 295                 id++;
 296     }
 297
 298     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 299
 300     return qemu_strdup(buf);
 301 }
 302
 303 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 304                                       const char *model,
 305                                       const char *name,
 306                                       NetCanReceive *can_receive,
 307                                       NetReceive *receive,
 308                                       NetReceiveIOV *receive_iov,
 309                                       NetCleanup *cleanup,
 310                                       void *opaque)
 311 {
 312     VLANClientState *vc, **pvc;
 313     vc = qemu_mallocz(sizeof(VLANClientState));
 314     vc->model = qemu_strdup(model);
 315     if (name)
 316         vc->name = qemu_strdup(name);
 317     else
 318         vc->name = assign_name(vc, model);
 319     vc->can_receive = can_receive;
 320     vc->receive = receive;
 321     vc->receive_iov = receive_iov;
 322     vc->cleanup = cleanup;
 323     vc->opaque = opaque;
 324     vc->vlan = vlan;
 325
 326     vc->next = NULL;
 327     pvc = &vlan->first_client;
 328     while (*pvc != NULL)
 329         pvc = &(*pvc)->next;
 330     *pvc = vc;
 331     return vc;
 332 }
 333
 334 void qemu_del_vlan_client(VLANClientState *vc)
 335 {
 336     VLANClientState **pvc = &vc->vlan->first_client;
 337
 338     while (*pvc != NULL)
 339         if (*pvc == vc) {
 340             *pvc = vc->next;
 341             if (vc->cleanup) {
 342                 vc->cleanup(vc);
 343             }
 344             qemu_free(vc->name);
 345             qemu_free(vc->model);
 346             qemu_free(vc);
 347             break;
 348         } else
 349             pvc = &(*pvc)->next;
 350 }
 351
 352 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 353 {
 354     VLANClientState **pvc = &vlan->first_client;
 355
 356     while (*pvc != NULL)
 357         if ((*pvc)->opaque == opaque)
 358             return *pvc;
 359         else
 360             pvc = &(*pvc)->next;
 361
 362     return NULL;
 363 }
 364
 365 static VLANClientState *
 366 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 367                               const char *client_str)
 368 {
 369     VLANState *vlan;
 370     VLANClientState *vc;
 371
 372     vlan = qemu_find_vlan(vlan_id, 0);
 373     if (!vlan) {
 374         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 375         return NULL;
 376     }
 377
 378     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 379         if (!strcmp(vc->name, client_str)) {
 380             break;
 381         }
 382     }
 383     if (!vc) {
 384         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 385                        client_str, vlan_id);
 386     }
 387
 388     return vc;
 389 }
 390
 391 int qemu_can_send_packet(VLANClientState *sender)
 392 {
 393     VLANState *vlan = sender->vlan;
 394     VLANClientState *vc;
 395
 396     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 397         if (vc == sender) {
 398             continue;
 399         }
 400
 401         /* no can_receive() handler, they can always receive */
 402         if (!vc->can_receive || vc->can_receive(vc)) {
 403             return 1;
 404         }
 405     }
 406     return 0;
 407 }
 408
 409 static int
 410 qemu_deliver_packet(VLANClientState *sender, const uint8_t *buf, int size)
 411 {
 412     VLANClientState *vc;
 413     int ret = -1;
 414
 415     sender->vlan->delivering = 1;
 416
 417     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 418         ssize_t len;
 419
 420         if (vc == sender) {
 421             continue;
 422         }
 423
 424         if (vc->link_down) {
 425             ret = size;
 426             continue;
 427         }
 428
 429         len = vc->receive(vc, buf, size);
 430
 431         ret = (ret >= 0) ? ret : len;
 432     }
 433
 434     sender->vlan->delivering = 0;
 435
 436     return ret;
 437 }
 438
 439 void qemu_purge_queued_packets(VLANClientState *vc)
 440 {
 441     VLANPacket *packet, *next;
 442
 443     QTAILQ_FOREACH_SAFE(packet, &vc->vlan->send_queue, entry, next) {
 444         if (packet->sender == vc) {
 445             QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 446             qemu_free(packet);
 447         }
 448     }
 449 }
 450
 451 void qemu_flush_queued_packets(VLANClientState *vc)
 452 {
 453     while (!QTAILQ_EMPTY(&vc->vlan->send_queue)) {
 454         VLANPacket *packet;
 455         int ret;
 456
 457         packet = QTAILQ_FIRST(&vc->vlan->send_queue);
 458         QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 459
 460         ret = qemu_deliver_packet(packet->sender, packet->data, packet->size);
 461         if (ret == 0 && packet->sent_cb != NULL) {
 462             QTAILQ_INSERT_HEAD(&vc->vlan->send_queue, packet, entry);
 463             break;
 464         }
 465
 466         if (packet->sent_cb)
 467             packet->sent_cb(packet->sender, ret);
 468
 469         qemu_free(packet);
 470     }
 471 }
 472
 473 static void qemu_enqueue_packet(VLANClientState *sender,
 474                                 const uint8_t *buf, int size,
 475                                 NetPacketSent *sent_cb)
 476 {
 477     VLANPacket *packet;
 478
 479     packet = qemu_malloc(sizeof(VLANPacket) + size);
 480     packet->sender = sender;
 481     packet->size = size;
 482     packet->sent_cb = sent_cb;
 483     memcpy(packet->data, buf, size);
 484
 485     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 486 }
 487
 488 ssize_t qemu_send_packet_async(VLANClientState *sender,
 489                                const uint8_t *buf, int size,
 490                                NetPacketSent *sent_cb)
 491 {
 492     int ret;
 493
 494     if (sender->link_down) {
 495         return size;
 496     }
 497
 498 #ifdef DEBUG_NET
 499     printf("vlan %d send:\n", sender->vlan->id);
 500     hex_dump(stdout, buf, size);
 501 #endif
 502
 503     if (sender->vlan->delivering) {
 504         qemu_enqueue_packet(sender, buf, size, NULL);
 505         return size;
 506     }
 507
 508     ret = qemu_deliver_packet(sender, buf, size);
 509     if (ret == 0 && sent_cb != NULL) {
 510         qemu_enqueue_packet(sender, buf, size, sent_cb);
 511         return 0;
 512     }
 513
 514     qemu_flush_queued_packets(sender);
 515
 516     return ret;
 517 }
 518
 519 void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size)
 520 {
 521     qemu_send_packet_async(vc, buf, size, NULL);
 522 }
 523
 524 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 525                                int iovcnt)
 526 {
 527     uint8_t buffer[4096];
 528     size_t offset = 0;
 529     int i;
 530
 531     for (i = 0; i < iovcnt; i++) {
 532         size_t len;
 533
 534         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 535         memcpy(buffer + offset, iov[i].iov_base, len);
 536         offset += len;
 537     }
 538
 539     return vc->receive(vc, buffer, offset);
 540 }
 541
 542 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 543 {
 544     size_t offset = 0;
 545     int i;
 546
 547     for (i = 0; i < iovcnt; i++)
 548         offset += iov[i].iov_len;
 549     return offset;
 550 }
 551
 552 static int qemu_deliver_packet_iov(VLANClientState *sender,
 553                                    const struct iovec *iov, int iovcnt)
 554 {
 555     VLANClientState *vc;
 556     int ret = -1;
 557
 558     sender->vlan->delivering = 1;
 559
 560     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 561         ssize_t len;
 562
 563         if (vc == sender) {
 564             continue;
 565         }
 566
 567         if (vc->link_down) {
 568             ret = calc_iov_length(iov, iovcnt);
 569             continue;
 570         }
 571
 572         if (vc->receive_iov) {
 573             len = vc->receive_iov(vc, iov, iovcnt);
 574         } else {
 575             len = vc_sendv_compat(vc, iov, iovcnt);
 576         }
 577
 578         ret = (ret >= 0) ? ret : len;
 579     }
 580
 581     sender->vlan->delivering = 0;
 582
 583     return ret;
 584 }
 585
 586 static ssize_t qemu_enqueue_packet_iov(VLANClientState *sender,
 587                                        const struct iovec *iov, int iovcnt,
 588                                        NetPacketSent *sent_cb)
 589 {
 590     VLANPacket *packet;
 591     size_t max_len = 0;
 592     int i;
 593
 594     max_len = calc_iov_length(iov, iovcnt);
 595
 596     packet = qemu_malloc(sizeof(VLANPacket) + max_len);
 597     packet->sender = sender;
 598     packet->sent_cb = sent_cb;
 599     packet->size = 0;
 600
 601     for (i = 0; i < iovcnt; i++) {
 602         size_t len = iov[i].iov_len;
 603
 604         memcpy(packet->data + packet->size, iov[i].iov_base, len);
 605         packet->size += len;
 606     }
 607
 608     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 609
 610     return packet->size;
 611 }
 612
 613 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 614                                 const struct iovec *iov, int iovcnt,
 615                                 NetPacketSent *sent_cb)
 616 {
 617     int ret;
 618
 619     if (sender->link_down) {
 620         return calc_iov_length(iov, iovcnt);
 621     }
 622
 623     if (sender->vlan->delivering) {
 624         return qemu_enqueue_packet_iov(sender, iov, iovcnt, NULL);
 625     }
 626
 627     ret = qemu_deliver_packet_iov(sender, iov, iovcnt);
 628     if (ret == 0 && sent_cb != NULL) {
 629         qemu_enqueue_packet_iov(sender, iov, iovcnt, sent_cb);
 630         return 0;
 631     }
 632
 633     qemu_flush_queued_packets(sender);
 634
 635     return ret;
 636 }
 637
 638 ssize_t
 639 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 640 {
 641     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 642 }
 643
 644 #if defined(CONFIG_SLIRP)
 645
 646 /* slirp network adapter */
 647
 648 #define SLIRP_CFG_HOSTFWD 1
 649 #define SLIRP_CFG_LEGACY  2
 650
 651 struct slirp_config_str {
 652     struct slirp_config_str *next;
 653     int flags;
 654     char str[1024];
 655     int legacy_format;
 656 };
 657
 658 typedef struct SlirpState {
 659     QTAILQ_ENTRY(SlirpState) entry;
 660     VLANClientState *vc;
 661     Slirp *slirp;
 662 #ifndef _WIN32
 663     char smb_dir[128];
 664 #endif
 665 } SlirpState;
 666
 667 static struct slirp_config_str *slirp_configs;
 668 const char *legacy_tftp_prefix;
 669 const char *legacy_bootp_filename;
 670 static QTAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 671     QTAILQ_HEAD_INITIALIZER(slirp_stacks);
 672
 673 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 674                          int legacy_format);
 675 static int slirp_guestfwd(SlirpState *s, const char *config_str,
 676                           int legacy_format);
 677
 678 #ifndef _WIN32
 679 static const char *legacy_smb_export;
 680
 681 static int slirp_smb(SlirpState *s, const char *exported_dir,
 682                      struct in_addr vserver_addr);
 683 static void slirp_smb_cleanup(SlirpState *s);
 684 #else
 685 static inline void slirp_smb_cleanup(SlirpState *s) { }
 686 #endif
 687
 688 int slirp_can_output(void *opaque)
 689 {
 690     SlirpState *s = opaque;
 691
 692     return qemu_can_send_packet(s->vc);
 693 }
 694
 695 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 696 {
 697     SlirpState *s = opaque;
 698
 699 #ifdef DEBUG_SLIRP
 700     printf("slirp output:\n");
 701     hex_dump(stdout, pkt, pkt_len);
 702 #endif
 703     qemu_send_packet(s->vc, pkt, pkt_len);
 704 }
 705
 706 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 707 {
 708     SlirpState *s = vc->opaque;
 709
 710 #ifdef DEBUG_SLIRP
 711     printf("slirp input:\n");
 712     hex_dump(stdout, buf, size);
 713 #endif
 714     slirp_input(s->slirp, buf, size);
 715     return size;
 716 }
 717
 718 static void net_slirp_cleanup(VLANClientState *vc)
 719 {
 720     SlirpState *s = vc->opaque;
 721
 722     slirp_cleanup(s->slirp);
 723     slirp_smb_cleanup(s);
 724     QTAILQ_REMOVE(&slirp_stacks, s, entry);
 725     qemu_free(s);
 726 }
 727
 728 static int net_slirp_init(VLANState *vlan, const char *model,
 729                           const char *name, int restricted,
 730                           const char *vnetwork, const char *vhost,
 731                           const char *vhostname, const char *tftp_export,
 732                           const char *bootfile, const char *vdhcp_start,
 733                           const char *vnameserver, const char *smb_export,
 734                           const char *vsmbserver)
 735 {
 736     /* default settings according to historic slirp */
 737     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 738     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 739     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 740     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 741     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 742 #ifndef _WIN32
 743     struct in_addr smbsrv = { .s_addr = 0 };
 744 #endif
 745     SlirpState *s;
 746     char buf[20];
 747     uint32_t addr;
 748     int shift;
 749     char *end;
 750     struct slirp_config_str *config;
 751
 752     if (!tftp_export) {
 753         tftp_export = legacy_tftp_prefix;
 754     }
 755     if (!bootfile) {
 756         bootfile = legacy_bootp_filename;
 757     }
 758
 759     if (vnetwork) {
 760         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 761             if (!inet_aton(vnetwork, &net)) {
 762                 return -1;
 763             }
 764             addr = ntohl(net.s_addr);
 765             if (!(addr & 0x80000000)) {
 766                 mask.s_addr = htonl(0xff000000); /* class A */
 767             } else if ((addr & 0xfff00000) == 0xac100000) {
 768                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 769             } else if ((addr & 0xc0000000) == 0x80000000) {
 770                 mask.s_addr = htonl(0xffff0000); /* class B */
 771             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 772                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 773             } else if ((addr & 0xffff0000) == 0xc6120000) {
 774                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 775             } else if ((addr & 0xe0000000) == 0xe0000000) {
 776                 mask.s_addr = htonl(0xffffff00); /* class C */
 777             } else {
 778                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 779             }
 780         } else {
 781             if (!inet_aton(buf, &net)) {
 782                 return -1;
 783             }
 784             shift = strtol(vnetwork, &end, 10);
 785             if (*end != '\0') {
 786                 if (!inet_aton(vnetwork, &mask)) {
 787                     return -1;
 788                 }
 789             } else if (shift < 4 || shift > 32) {
 790                 return -1;
 791             } else {
 792                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 793             }
 794         }
 795         net.s_addr &= mask.s_addr;
 796         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 797         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 798         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 799     }
 800
 801     if (vhost && !inet_aton(vhost, &host)) {
 802         return -1;
 803     }
 804     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 805         return -1;
 806     }
 807
 808     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 809         return -1;
 810     }
 811     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 812         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 813         return -1;
 814     }
 815
 816     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 817         return -1;
 818     }
 819     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 820         dns.s_addr == host.s_addr) {
 821         return -1;
 822     }
 823
 824 #ifndef _WIN32
 825     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 826         return -1;
 827     }
 828 #endif
 829
 830     s = qemu_mallocz(sizeof(SlirpState));
 831     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 832                           tftp_export, bootfile, dhcp, dns, s);
 833     QTAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 834
 835     for (config = slirp_configs; config; config = config->next) {
 836         if (config->flags & SLIRP_CFG_HOSTFWD) {
 837             if (slirp_hostfwd(s, config->str,
 838                               config->flags & SLIRP_CFG_LEGACY) < 0)
 839                 return -1;
 840         } else {
 841             if (slirp_guestfwd(s, config->str,
 842                                config->flags & SLIRP_CFG_LEGACY) < 0)
 843                 return -1;
 844         }
 845     }
 846 #ifndef _WIN32
 847     if (!smb_export) {
 848         smb_export = legacy_smb_export;
 849     }
 850     if (smb_export) {
 851         if (slirp_smb(s, smb_export, smbsrv) < 0)
 852             return -1;
 853     }
 854 #endif
 855
 856     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive, NULL,
 857                                  net_slirp_cleanup, s);
 858     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 859              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 860     return 0;
 861 }
 862
 863 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 864                                 const char *stack)
 865 {
 866     VLANClientState *vc;
 867
 868     if (vlan) {
 869         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 870         if (!vc) {
 871             return NULL;
 872         }
 873         if (strcmp(vc->model, "user")) {
 874             monitor_printf(mon, "invalid device specified\n");
 875             return NULL;
 876         }
 877         return vc->opaque;
 878     } else {
 879         if (QTAILQ_EMPTY(&slirp_stacks)) {
 880             monitor_printf(mon, "user mode network stack not in use\n");
 881             return NULL;
 882         }
 883         return QTAILQ_FIRST(&slirp_stacks);
 884     }
 885 }
 886
 887 void net_slirp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 888 {
 889     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 890     int host_port;
 891     char buf[256] = "";
 892     const char *src_str, *p;
 893     SlirpState *s;
 894     int is_udp = 0;
 895     int err;
 896     const char *arg1 = qdict_get_str(qdict, "arg1");
 897     const char *arg2 = qdict_get_try_str(qdict, "arg2");
 898     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 899
 900     if (arg2) {
 901         s = slirp_lookup(mon, arg1, arg2);
 902         src_str = arg3;
 903     } else {
 904         s = slirp_lookup(mon, NULL, NULL);
 905         src_str = arg1;
 906     }
 907     if (!s) {
 908         return;
 909     }
 910
 911     if (!src_str || !src_str[0])
 912         goto fail_syntax;
 913
 914     p = src_str;
 915     get_str_sep(buf, sizeof(buf), &p, ':');
 916
 917     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 918         is_udp = 0;
 919     } else if (!strcmp(buf, "udp")) {
 920         is_udp = 1;
 921     } else {
 922         goto fail_syntax;
 923     }
 924
 925     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 926         goto fail_syntax;
 927     }
 928     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 929         goto fail_syntax;
 930     }
 931
 932     host_port = atoi(p);
 933
 934     err = slirp_remove_hostfwd(QTAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 935                                host_addr, host_port);
 936
 937     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 938                    err ? "removed" : "not found");
 939     return;
 940
 941  fail_syntax:
 942     monitor_printf(mon, "invalid format\n");
 943 }
 944
 945 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 946                          int legacy_format)
 947 {
 948     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 949     struct in_addr guest_addr = { .s_addr = 0 };
 950     int host_port, guest_port;
 951     const char *p;
 952     char buf[256];
 953     int is_udp;
 954     char *end;
 955
 956     p = redir_str;
 957     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 958         goto fail_syntax;
 959     }
 960     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 961         is_udp = 0;
 962     } else if (!strcmp(buf, "udp")) {
 963         is_udp = 1;
 964     } else {
 965         goto fail_syntax;
 966     }
 967
 968     if (!legacy_format) {
 969         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 970             goto fail_syntax;
 971         }
 972         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 973             goto fail_syntax;
 974         }
 975     }
 976
 977     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
 978         goto fail_syntax;
 979     }
 980     host_port = strtol(buf, &end, 0);
 981     if (*end != '\0' || host_port < 1 || host_port > 65535) {
 982         goto fail_syntax;
 983     }
 984
 985     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 986         goto fail_syntax;
 987     }
 988     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
 989         goto fail_syntax;
 990     }
 991
 992     guest_port = strtol(p, &end, 0);
 993     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
 994         goto fail_syntax;
 995     }
 996
 997     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
 998                           guest_port) < 0) {
 999         qemu_error("could not set up host forwarding rule '%s'\n",
1000                    redir_str);
1001         return -1;
1002     }
1003     return 0;
1004
1005  fail_syntax:
1006     qemu_error("invalid host forwarding rule '%s'\n", redir_str);
1007     return -1;
1008 }
1009
1010 void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict)
1011 {
1012     const char *redir_str;
1013     SlirpState *s;
1014     const char *arg1 = qdict_get_str(qdict, "arg1");
1015     const char *arg2 = qdict_get_try_str(qdict, "arg2");
1016     const char *arg3 = qdict_get_try_str(qdict, "arg3");
1017
1018     if (arg2) {
1019         s = slirp_lookup(mon, arg1, arg2);
1020         redir_str = arg3;
1021     } else {
1022         s = slirp_lookup(mon, NULL, NULL);
1023         redir_str = arg1;
1024     }
1025     if (s) {
1026         slirp_hostfwd(s, redir_str, 0);
1027     }
1028
1029 }
1030
1031 int net_slirp_redir(const char *redir_str)
1032 {
1033     struct slirp_config_str *config;
1034
1035     if (QTAILQ_EMPTY(&slirp_stacks)) {
1036         config = qemu_malloc(sizeof(*config));
1037         pstrcpy(config->str, sizeof(config->str), redir_str);
1038         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1039         config->next = slirp_configs;
1040         slirp_configs = config;
1041         return 0;
1042     }
1043
1044     return slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), redir_str, 1);
1045 }
1046
1047 #ifndef _WIN32
1048
1049 /* automatic user mode samba server configuration */
1050 static void slirp_smb_cleanup(SlirpState *s)
1051 {
1052     char cmd[128];
1053
1054     if (s->smb_dir[0] != '\0') {
1055         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1056         system(cmd);
1057         s->smb_dir[0] = '\0';
1058     }
1059 }
1060
1061 static int slirp_smb(SlirpState* s, const char *exported_dir,
1062                      struct in_addr vserver_addr)
1063 {
1064     static int instance;
1065     char smb_conf[128];
1066     char smb_cmdline[128];
1067     FILE *f;
1068
1069     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1070              (long)getpid(), instance++);
1071     if (mkdir(s->smb_dir, 0700) < 0) {
1072         qemu_error("could not create samba server dir '%s'\n", s->smb_dir);
1073         return -1;
1074     }
1075     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1076
1077     f = fopen(smb_conf, "w");
1078     if (!f) {
1079         slirp_smb_cleanup(s);
1080         qemu_error("could not create samba server configuration file '%s'\n",
1081                    smb_conf);
1082         return -1;
1083     }
1084     fprintf(f,
1085             "[global]\n"
1086             "private dir=%s\n"
1087             "smb ports=0\n"
1088             "socket address=127.0.0.1\n"
1089             "pid directory=%s\n"
1090             "lock directory=%s\n"
1091             "log file=%s/log.smbd\n"
1092             "smb passwd file=%s/smbpasswd\n"
1093             "security = share\n"
1094             "[qemu]\n"
1095             "path=%s\n"
1096             "read only=no\n"
1097             "guest ok=yes\n",
1098             s->smb_dir,
1099             s->smb_dir,
1100             s->smb_dir,
1101             s->smb_dir,
1102             s->smb_dir,
1103             exported_dir
1104             );
1105     fclose(f);
1106
1107     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1108              SMBD_COMMAND, smb_conf);
1109
1110     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1111         slirp_smb_cleanup(s);
1112         qemu_error("conflicting/invalid smbserver address\n");
1113         return -1;
1114     }
1115     return 0;
1116 }
1117
1118 /* automatic user mode samba server configuration (legacy interface) */
1119 int net_slirp_smb(const char *exported_dir)
1120 {
1121     struct in_addr vserver_addr = { .s_addr = 0 };
1122
1123     if (legacy_smb_export) {
1124         fprintf(stderr, "-smb given twice\n");
1125         return -1;
1126     }
1127     legacy_smb_export = exported_dir;
1128     if (!QTAILQ_EMPTY(&slirp_stacks)) {
1129         return slirp_smb(QTAILQ_FIRST(&slirp_stacks), exported_dir,
1130                          vserver_addr);
1131     }
1132     return 0;
1133 }
1134
1135 #endif /* !defined(_WIN32) */
1136
1137 struct GuestFwd {
1138     CharDriverState *hd;
1139     struct in_addr server;
1140     int port;
1141     Slirp *slirp;
1142 };
1143
1144 static int guestfwd_can_read(void *opaque)
1145 {
1146     struct GuestFwd *fwd = opaque;
1147     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1148 }
1149
1150 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1151 {
1152     struct GuestFwd *fwd = opaque;
1153     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1154 }
1155
1156 static int slirp_guestfwd(SlirpState *s, const char *config_str,
1157                           int legacy_format)
1158 {
1159     struct in_addr server = { .s_addr = 0 };
1160     struct GuestFwd *fwd;
1161     const char *p;
1162     char buf[128];
1163     char *end;
1164     int port;
1165
1166     p = config_str;
1167     if (legacy_format) {
1168         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1169             goto fail_syntax;
1170         }
1171     } else {
1172         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1173             goto fail_syntax;
1174         }
1175         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1176             goto fail_syntax;
1177         }
1178         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1179             goto fail_syntax;
1180         }
1181         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1182             goto fail_syntax;
1183         }
1184         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1185             goto fail_syntax;
1186         }
1187     }
1188     port = strtol(buf, &end, 10);
1189     if (*end != '\0' || port < 1 || port > 65535) {
1190         goto fail_syntax;
1191     }
1192
1193     fwd = qemu_malloc(sizeof(struct GuestFwd));
1194     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1195     fwd->hd = qemu_chr_open(buf, p, NULL);
1196     if (!fwd->hd) {
1197         qemu_error("could not open guest forwarding device '%s'\n", buf);
1198         qemu_free(fwd);
1199         return -1;
1200     }
1201
1202     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1203         qemu_error("conflicting/invalid host:port in guest forwarding "
1204                    "rule '%s'\n", config_str);
1205         qemu_free(fwd);
1206         return -1;
1207     }
1208     fwd->server = server;
1209     fwd->port = port;
1210     fwd->slirp = s->slirp;
1211
1212     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1213                           NULL, fwd);
1214     return 0;
1215
1216  fail_syntax:
1217     qemu_error("invalid guest forwarding rule '%s'\n", config_str);
1218     return -1;
1219 }
1220
1221 void do_info_usernet(Monitor *mon)
1222 {
1223     SlirpState *s;
1224
1225     QTAILQ_FOREACH(s, &slirp_stacks, entry) {
1226         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1227         slirp_connection_info(s->slirp, mon);
1228     }
1229 }
1230
1231 #endif /* CONFIG_SLIRP */
1232
1233 #if !defined(_WIN32)
1234
1235 typedef struct TAPState {
1236     VLANClientState *vc;
1237     int fd;
1238     char down_script[1024];
1239     char down_script_arg[128];
1240     uint8_t buf[4096];
1241     unsigned int read_poll : 1;
1242     unsigned int write_poll : 1;
1243 } TAPState;
1244
1245 static int launch_script(const char *setup_script, const char *ifname, int fd);
1246
1247 static int tap_can_send(void *opaque);
1248 static void tap_send(void *opaque);
1249 static void tap_writable(void *opaque);
1250
1251 static void tap_update_fd_handler(TAPState *s)
1252 {
1253     qemu_set_fd_handler2(s->fd,
1254                          s->read_poll  ? tap_can_send : NULL,
1255                          s->read_poll  ? tap_send     : NULL,
1256                          s->write_poll ? tap_writable : NULL,
1257                          s);
1258 }
1259
1260 static void tap_read_poll(TAPState *s, int enable)
1261 {
1262     s->read_poll = !!enable;
1263     tap_update_fd_handler(s);
1264 }
1265
1266 static void tap_write_poll(TAPState *s, int enable)
1267 {
1268     s->write_poll = !!enable;
1269     tap_update_fd_handler(s);
1270 }
1271
1272 static void tap_writable(void *opaque)
1273 {
1274     TAPState *s = opaque;
1275
1276     tap_write_poll(s, 0);
1277
1278     qemu_flush_queued_packets(s->vc);
1279 }
1280
1281 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1282                                int iovcnt)
1283 {
1284     TAPState *s = vc->opaque;
1285     ssize_t len;
1286
1287     do {
1288         len = writev(s->fd, iov, iovcnt);
1289     } while (len == -1 && errno == EINTR);
1290
1291     if (len == -1 && errno == EAGAIN) {
1292         tap_write_poll(s, 1);
1293         return 0;
1294     }
1295
1296     return len;
1297 }
1298
1299 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1300 {
1301     TAPState *s = vc->opaque;
1302     ssize_t len;
1303
1304     do {
1305         len = write(s->fd, buf, size);
1306     } while (len == -1 && (errno == EINTR || errno == EAGAIN));
1307
1308     return len;
1309 }
1310
1311 static int tap_can_send(void *opaque)
1312 {
1313     TAPState *s = opaque;
1314
1315     return qemu_can_send_packet(s->vc);
1316 }
1317
1318 #ifdef __sun__
1319 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1320 {
1321     struct strbuf sbuf;
1322     int f = 0;
1323
1324     sbuf.maxlen = maxlen;
1325     sbuf.buf = (char *)buf;
1326
1327     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1328 }
1329 #else
1330 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1331 {
1332     return read(tapfd, buf, maxlen);
1333 }
1334 #endif
1335
1336 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1337 {
1338     TAPState *s = vc->opaque;
1339     tap_read_poll(s, 1);
1340 }
1341
1342 static void tap_send(void *opaque)
1343 {
1344     TAPState *s = opaque;
1345     int size;
1346
1347     do {
1348         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1349         if (size <= 0) {
1350             break;
1351         }
1352
1353         size = qemu_send_packet_async(s->vc, s->buf, size, tap_send_completed);
1354         if (size == 0) {
1355             tap_read_poll(s, 0);
1356         }
1357     } while (size > 0);
1358 }
1359
1360 #ifdef TUNSETSNDBUF
1361 /* sndbuf should be set to a value lower than the tx queue
1362  * capacity of any destination network interface.
1363  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1364  * a good default, given a 1500 byte MTU.
1365  */
1366 #define TAP_DEFAULT_SNDBUF 1024*1024
1367
1368 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1369 {
1370     int sndbuf;
1371
1372     sndbuf = qemu_opt_get_size(opts, "sndbuf", TAP_DEFAULT_SNDBUF);
1373     if (!sndbuf) {
1374         sndbuf = INT_MAX;
1375     }
1376
1377     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && qemu_opt_get(opts, "sndbuf")) {
1378         qemu_error("TUNSETSNDBUF ioctl failed: %s\n", strerror(errno));
1379         return -1;
1380     }
1381     return 0;
1382 }
1383 #else
1384 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1385 {
1386     return 0;
1387 }
1388 #endif /* TUNSETSNDBUF */
1389
1390 static void tap_cleanup(VLANClientState *vc)
1391 {
1392     TAPState *s = vc->opaque;
1393
1394     qemu_purge_queued_packets(vc);
1395
1396     if (s->down_script[0])
1397         launch_script(s->down_script, s->down_script_arg, s->fd);
1398
1399     tap_read_poll(s, 0);
1400     tap_write_poll(s, 0);
1401     close(s->fd);
1402     qemu_free(s);
1403 }
1404
1405 /* fd support */
1406
1407 static TAPState *net_tap_fd_init(VLANState *vlan,
1408                                  const char *model,
1409                                  const char *name,
1410                                  int fd)
1411 {
1412     TAPState *s;
1413
1414     s = qemu_mallocz(sizeof(TAPState));
1415     s->fd = fd;
1416     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
1417                                  tap_receive_iov, tap_cleanup, s);
1418     tap_read_poll(s, 1);
1419     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
1420     return s;
1421 }
1422
1423 #if defined (CONFIG_BSD) || defined (__FreeBSD_kernel__)
1424 static int tap_open(char *ifname, int ifname_size)
1425 {
1426     int fd;
1427     char *dev;
1428     struct stat s;
1429
1430     TFR(fd = open("/dev/tap", O_RDWR));
1431     if (fd < 0) {
1432         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1433         return -1;
1434     }
1435
1436     fstat(fd, &s);
1437     dev = devname(s.st_rdev, S_IFCHR);
1438     pstrcpy(ifname, ifname_size, dev);
1439
1440     fcntl(fd, F_SETFL, O_NONBLOCK);
1441     return fd;
1442 }
1443 #elif defined(__sun__)
1444 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1445 /*
1446  * Allocate TAP device, returns opened fd.
1447  * Stores dev name in the first arg(must be large enough).
1448  */
1449 static int tap_alloc(char *dev, size_t dev_size)
1450 {
1451     int tap_fd, if_fd, ppa = -1;
1452     static int ip_fd = 0;
1453     char *ptr;
1454
1455     static int arp_fd = 0;
1456     int ip_muxid, arp_muxid;
1457     struct strioctl  strioc_if, strioc_ppa;
1458     int link_type = I_PLINK;;
1459     struct lifreq ifr;
1460     char actual_name[32] = "";
1461
1462     memset(&ifr, 0x0, sizeof(ifr));
1463
1464     if( *dev ){
1465        ptr = dev;
1466        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1467        ppa = atoi(ptr);
1468     }
1469
1470     /* Check if IP device was opened */
1471     if( ip_fd )
1472        close(ip_fd);
1473
1474     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1475     if (ip_fd < 0) {
1476        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1477        return -1;
1478     }
1479
1480     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1481     if (tap_fd < 0) {
1482        syslog(LOG_ERR, "Can't open /dev/tap");
1483        return -1;
1484     }
1485
1486     /* Assign a new PPA and get its unit number. */
1487     strioc_ppa.ic_cmd = TUNNEWPPA;
1488     strioc_ppa.ic_timout = 0;
1489     strioc_ppa.ic_len = sizeof(ppa);
1490     strioc_ppa.ic_dp = (char *)&ppa;
1491     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1492        syslog (LOG_ERR, "Can't assign new interface");
1493
1494     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1495     if (if_fd < 0) {
1496        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1497        return -1;
1498     }
1499     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1500        syslog(LOG_ERR, "Can't push IP module");
1501        return -1;
1502     }
1503
1504     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1505         syslog(LOG_ERR, "Can't get flags\n");
1506
1507     snprintf (actual_name, 32, "tap%d", ppa);
1508     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1509
1510     ifr.lifr_ppa = ppa;
1511     /* Assign ppa according to the unit number returned by tun device */
1512
1513     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1514         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1515     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1516         syslog (LOG_ERR, "Can't get flags\n");
1517     /* Push arp module to if_fd */
1518     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1519         syslog (LOG_ERR, "Can't push ARP module (2)");
1520
1521     /* Push arp module to ip_fd */
1522     if (ioctl (ip_fd, I_POP, NULL) < 0)
1523         syslog (LOG_ERR, "I_POP failed\n");
1524     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1525         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1526     /* Open arp_fd */
1527     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1528     if (arp_fd < 0)
1529        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1530
1531     /* Set ifname to arp */
1532     strioc_if.ic_cmd = SIOCSLIFNAME;
1533     strioc_if.ic_timout = 0;
1534     strioc_if.ic_len = sizeof(ifr);
1535     strioc_if.ic_dp = (char *)&ifr;
1536     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1537         syslog (LOG_ERR, "Can't set ifname to arp\n");
1538     }
1539
1540     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1541        syslog(LOG_ERR, "Can't link TAP device to IP");
1542        return -1;
1543     }
1544
1545     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1546         syslog (LOG_ERR, "Can't link TAP device to ARP");
1547
1548     close (if_fd);
1549
1550     memset(&ifr, 0x0, sizeof(ifr));
1551     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1552     ifr.lifr_ip_muxid  = ip_muxid;
1553     ifr.lifr_arp_muxid = arp_muxid;
1554
1555     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1556     {
1557       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1558       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1559       syslog (LOG_ERR, "Can't set multiplexor id");
1560     }
1561
1562     snprintf(dev, dev_size, "tap%d", ppa);
1563     return tap_fd;
1564 }
1565
1566 static int tap_open(char *ifname, int ifname_size)
1567 {
1568     char  dev[10]="";
1569     int fd;
1570     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1571        fprintf(stderr, "Cannot allocate TAP device\n");
1572        return -1;
1573     }
1574     pstrcpy(ifname, ifname_size, dev);
1575     fcntl(fd, F_SETFL, O_NONBLOCK);
1576     return fd;
1577 }
1578 #elif defined (_AIX)
1579 static int tap_open(char *ifname, int ifname_size)
1580 {
1581     fprintf (stderr, "no tap on AIX\n");
1582     return -1;
1583 }
1584 #else
1585 static int tap_open(char *ifname, int ifname_size)
1586 {
1587     struct ifreq ifr;
1588     int fd, ret;
1589
1590     TFR(fd = open("/dev/net/tun", O_RDWR));
1591     if (fd < 0) {
1592         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1593         return -1;
1594     }
1595     memset(&ifr, 0, sizeof(ifr));
1596     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1597     if (ifname[0] != '\0')
1598         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1599     else
1600         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1601     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1602     if (ret != 0) {
1603         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1604         close(fd);
1605         return -1;
1606     }
1607     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1608     fcntl(fd, F_SETFL, O_NONBLOCK);
1609     return fd;
1610 }
1611 #endif
1612
1613 static int launch_script(const char *setup_script, const char *ifname, int fd)
1614 {
1615     sigset_t oldmask, mask;
1616     int pid, status;
1617     char *args[3];
1618     char **parg;
1619
1620     sigemptyset(&mask);
1621     sigaddset(&mask, SIGCHLD);
1622     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1623
1624     /* try to launch network script */
1625     pid = fork();
1626     if (pid == 0) {
1627         int open_max = sysconf(_SC_OPEN_MAX), i;
1628
1629         for (i = 0; i < open_max; i++) {
1630             if (i != STDIN_FILENO &&
1631                 i != STDOUT_FILENO &&
1632                 i != STDERR_FILENO &&
1633                 i != fd) {
1634                 close(i);
1635             }
1636         }
1637         parg = args;
1638         *parg++ = (char *)setup_script;
1639         *parg++ = (char *)ifname;
1640         *parg++ = NULL;
1641         execv(setup_script, args);
1642         _exit(1);
1643     } else if (pid > 0) {
1644         while (waitpid(pid, &status, 0) != pid) {
1645             /* loop */
1646         }
1647         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1648
1649         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1650             return 0;
1651         }
1652     }
1653     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1654     return -1;
1655 }
1656
1657 static TAPState *net_tap_init(VLANState *vlan, const char *model,
1658                               const char *name, const char *ifname1,
1659                               const char *setup_script, const char *down_script)
1660 {
1661     TAPState *s;
1662     int fd;
1663     char ifname[128];
1664
1665     if (ifname1 != NULL)
1666         pstrcpy(ifname, sizeof(ifname), ifname1);
1667     else
1668         ifname[0] = '\0';
1669     TFR(fd = tap_open(ifname, sizeof(ifname)));
1670     if (fd < 0)
1671         return NULL;
1672
1673     if (!setup_script || !strcmp(setup_script, "no"))
1674         setup_script = "";
1675     if (setup_script[0] != '\0' &&
1676         launch_script(setup_script, ifname, fd)) {
1677         return NULL;
1678     }
1679     s = net_tap_fd_init(vlan, model, name, fd);
1680     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1681              "ifname=%s,script=%s,downscript=%s",
1682              ifname, setup_script, down_script);
1683     if (down_script && strcmp(down_script, "no")) {
1684         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
1685         snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
1686     }
1687     return s;
1688 }
1689
1690 #endif /* !_WIN32 */
1691
1692 #if defined(CONFIG_VDE)
1693 typedef struct VDEState {
1694     VLANClientState *vc;
1695     VDECONN *vde;
1696 } VDEState;
1697
1698 static void vde_to_qemu(void *opaque)
1699 {
1700     VDEState *s = opaque;
1701     uint8_t buf[4096];
1702     int size;
1703
1704     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1705     if (size > 0) {
1706         qemu_send_packet(s->vc, buf, size);
1707     }
1708 }
1709
1710 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1711 {
1712     VDEState *s = vc->opaque;
1713     ssize_t ret;
1714
1715     do {
1716       ret = vde_send(s->vde, (const char *)buf, size, 0);
1717     } while (ret < 0 && errno == EINTR);
1718
1719     return ret;
1720 }
1721
1722 static void vde_cleanup(VLANClientState *vc)
1723 {
1724     VDEState *s = vc->opaque;
1725     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1726     vde_close(s->vde);
1727     qemu_free(s);
1728 }
1729
1730 static int net_vde_init(VLANState *vlan, const char *model,
1731                         const char *name, const char *sock,
1732                         int port, const char *group, int mode)
1733 {
1734     VDEState *s;
1735     char *init_group = (char *)group;
1736     char *init_sock = (char *)sock;
1737
1738     struct vde_open_args args = {
1739         .port = port,
1740         .group = init_group,
1741         .mode = mode,
1742     };
1743
1744     s = qemu_mallocz(sizeof(VDEState));
1745     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1746     if (!s->vde){
1747         free(s);
1748         return -1;
1749     }
1750     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
1751                                  NULL, vde_cleanup, s);
1752     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1753     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1754              sock, vde_datafd(s->vde));
1755     return 0;
1756 }
1757 #endif
1758
1759 /* network connection */
1760 typedef struct NetSocketState {
1761     VLANClientState *vc;
1762     int fd;
1763     int state; /* 0 = getting length, 1 = getting data */
1764     unsigned int index;
1765     unsigned int packet_len;
1766     uint8_t buf[4096];
1767     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1768 } NetSocketState;
1769
1770 typedef struct NetSocketListenState {
1771     VLANState *vlan;
1772     char *model;
1773     char *name;
1774     int fd;
1775 } NetSocketListenState;
1776
1777 /* XXX: we consider we can send the whole packet without blocking */
1778 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1779 {
1780     NetSocketState *s = vc->opaque;
1781     uint32_t len;
1782     len = htonl(size);
1783
1784     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1785     return send_all(s->fd, buf, size);
1786 }
1787
1788 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1789 {
1790     NetSocketState *s = vc->opaque;
1791
1792     return sendto(s->fd, (const void *)buf, size, 0,
1793                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
1794 }
1795
1796 static void net_socket_send(void *opaque)
1797 {
1798     NetSocketState *s = opaque;
1799     int size, err;
1800     unsigned l;
1801     uint8_t buf1[4096];
1802     const uint8_t *buf;
1803
1804     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
1805     if (size < 0) {
1806         err = socket_error();
1807         if (err != EWOULDBLOCK)
1808             goto eoc;
1809     } else if (size == 0) {
1810         /* end of connection */
1811     eoc:
1812         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1813         closesocket(s->fd);
1814         return;
1815     }
1816     buf = buf1;
1817     while (size > 0) {
1818         /* reassemble a packet from the network */
1819         switch(s->state) {
1820         case 0:
1821             l = 4 - s->index;
1822             if (l > size)
1823                 l = size;
1824             memcpy(s->buf + s->index, buf, l);
1825             buf += l;
1826             size -= l;
1827             s->index += l;
1828             if (s->index == 4) {
1829                 /* got length */
1830                 s->packet_len = ntohl(*(uint32_t *)s->buf);
1831                 s->index = 0;
1832                 s->state = 1;
1833             }
1834             break;
1835         case 1:
1836             l = s->packet_len - s->index;
1837             if (l > size)
1838                 l = size;
1839             if (s->index + l <= sizeof(s->buf)) {
1840                 memcpy(s->buf + s->index, buf, l);
1841             } else {
1842                 fprintf(stderr, "serious error: oversized packet received,"
1843                     "connection terminated.\n");
1844                 s->state = 0;
1845                 goto eoc;
1846             }
1847
1848             s->index += l;
1849             buf += l;
1850             size -= l;
1851             if (s->index >= s->packet_len) {
1852                 qemu_send_packet(s->vc, s->buf, s->packet_len);
1853                 s->index = 0;
1854                 s->state = 0;
1855             }
1856             break;
1857         }
1858     }
1859 }
1860
1861 static void net_socket_send_dgram(void *opaque)
1862 {
1863     NetSocketState *s = opaque;
1864     int size;
1865
1866     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
1867     if (size < 0)
1868         return;
1869     if (size == 0) {
1870         /* end of connection */
1871         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1872         return;
1873     }
1874     qemu_send_packet(s->vc, s->buf, size);
1875 }
1876
1877 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
1878 {
1879     struct ip_mreq imr;
1880     int fd;
1881     int val, ret;
1882     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
1883         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
1884                 inet_ntoa(mcastaddr->sin_addr),
1885                 (int)ntohl(mcastaddr->sin_addr.s_addr));
1886         return -1;
1887
1888     }
1889     fd = socket(PF_INET, SOCK_DGRAM, 0);
1890     if (fd < 0) {
1891         perror("socket(PF_INET, SOCK_DGRAM)");
1892         return -1;
1893     }
1894
1895     val = 1;
1896     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
1897                    (const char *)&val, sizeof(val));
1898     if (ret < 0) {
1899         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
1900         goto fail;
1901     }
1902
1903     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
1904     if (ret < 0) {
1905         perror("bind");
1906         goto fail;
1907     }
1908
1909     /* Add host to multicast group */
1910     imr.imr_multiaddr = mcastaddr->sin_addr;
1911     imr.imr_interface.s_addr = htonl(INADDR_ANY);
1912
1913     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
1914                      (const char *)&imr, sizeof(struct ip_mreq));
1915     if (ret < 0) {
1916         perror("setsockopt(IP_ADD_MEMBERSHIP)");
1917         goto fail;
1918     }
1919
1920     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
1921     val = 1;
1922     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
1923                    (const char *)&val, sizeof(val));
1924     if (ret < 0) {
1925         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
1926         goto fail;
1927     }
1928
1929     socket_set_nonblock(fd);
1930     return fd;
1931 fail:
1932     if (fd >= 0)
1933         closesocket(fd);
1934     return -1;
1935 }
1936
1937 static void net_socket_cleanup(VLANClientState *vc)
1938 {
1939     NetSocketState *s = vc->opaque;
1940     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1941     close(s->fd);
1942     qemu_free(s);
1943 }
1944
1945 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
1946                                                 const char *model,
1947                                                 const char *name,
1948                                                 int fd, int is_connected)
1949 {
1950     struct sockaddr_in saddr;
1951     int newfd;
1952     socklen_t saddr_len;
1953     NetSocketState *s;
1954
1955     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
1956      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
1957      * by ONLY ONE process: we must "clone" this dgram socket --jjo
1958      */
1959
1960     if (is_connected) {
1961         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
1962             /* must be bound */
1963             if (saddr.sin_addr.s_addr==0) {
1964                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
1965                         fd);
1966                 return NULL;
1967             }
1968             /* clone dgram socket */
1969             newfd = net_socket_mcast_create(&saddr);
1970             if (newfd < 0) {
1971                 /* error already reported by net_socket_mcast_create() */
1972                 close(fd);
1973                 return NULL;
1974             }
1975             /* clone newfd to fd, close newfd */
1976             dup2(newfd, fd);
1977             close(newfd);
1978
1979         } else {
1980             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
1981                     fd, strerror(errno));
1982             return NULL;
1983         }
1984     }
1985
1986     s = qemu_mallocz(sizeof(NetSocketState));
1987     s->fd = fd;
1988
1989     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
1990                                  NULL, net_socket_cleanup, s);
1991     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
1992
1993     /* mcast: save bound address as dst */
1994     if (is_connected) s->dgram_dst=saddr;
1995
1996     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1997             "socket: fd=%d (%s mcast=%s:%d)",
1998             fd, is_connected? "cloned" : "",
1999             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2000     return s;
2001 }
2002
2003 static void net_socket_connect(void *opaque)
2004 {
2005     NetSocketState *s = opaque;
2006     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2007 }
2008
2009 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2010                                                  const char *model,
2011                                                  const char *name,
2012                                                  int fd, int is_connected)
2013 {
2014     NetSocketState *s;
2015     s = qemu_mallocz(sizeof(NetSocketState));
2016     s->fd = fd;
2017     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
2018                                  NULL, net_socket_cleanup, s);
2019     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2020              "socket: fd=%d", fd);
2021     if (is_connected) {
2022         net_socket_connect(s);
2023     } else {
2024         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2025     }
2026     return s;
2027 }
2028
2029 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2030                                           const char *model, const char *name,
2031                                           int fd, int is_connected)
2032 {
2033     int so_type = -1, optlen=sizeof(so_type);
2034
2035     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2036         (socklen_t *)&optlen)< 0) {
2037         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2038         return NULL;
2039     }
2040     switch(so_type) {
2041     case SOCK_DGRAM:
2042         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2043     case SOCK_STREAM:
2044         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2045     default:
2046         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2047         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2048         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2049     }
2050     return NULL;
2051 }
2052
2053 static void net_socket_accept(void *opaque)
2054 {
2055     NetSocketListenState *s = opaque;
2056     NetSocketState *s1;
2057     struct sockaddr_in saddr;
2058     socklen_t len;
2059     int fd;
2060
2061     for(;;) {
2062         len = sizeof(saddr);
2063         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2064         if (fd < 0 && errno != EINTR) {
2065             return;
2066         } else if (fd >= 0) {
2067             break;
2068         }
2069     }
2070     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2071     if (!s1) {
2072         closesocket(fd);
2073     } else {
2074         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2075                  "socket: connection from %s:%d",
2076                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2077     }
2078 }
2079
2080 static int net_socket_listen_init(VLANState *vlan,
2081                                   const char *model,
2082                                   const char *name,
2083                                   const char *host_str)
2084 {
2085     NetSocketListenState *s;
2086     int fd, val, ret;
2087     struct sockaddr_in saddr;
2088
2089     if (parse_host_port(&saddr, host_str) < 0)
2090         return -1;
2091
2092     s = qemu_mallocz(sizeof(NetSocketListenState));
2093
2094     fd = socket(PF_INET, SOCK_STREAM, 0);
2095     if (fd < 0) {
2096         perror("socket");
2097         return -1;
2098     }
2099     socket_set_nonblock(fd);
2100
2101     /* allow fast reuse */
2102     val = 1;
2103     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2104
2105     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2106     if (ret < 0) {
2107         perror("bind");
2108         return -1;
2109     }
2110     ret = listen(fd, 0);
2111     if (ret < 0) {
2112         perror("listen");
2113         return -1;
2114     }
2115     s->vlan = vlan;
2116     s->model = qemu_strdup(model);
2117     s->name = name ? qemu_strdup(name) : NULL;
2118     s->fd = fd;
2119     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2120     return 0;
2121 }
2122
2123 static int net_socket_connect_init(VLANState *vlan,
2124                                    const char *model,
2125                                    const char *name,
2126                                    const char *host_str)
2127 {
2128     NetSocketState *s;
2129     int fd, connected, ret, err;
2130     struct sockaddr_in saddr;
2131
2132     if (parse_host_port(&saddr, host_str) < 0)
2133         return -1;
2134
2135     fd = socket(PF_INET, SOCK_STREAM, 0);
2136     if (fd < 0) {
2137         perror("socket");
2138         return -1;
2139     }
2140     socket_set_nonblock(fd);
2141
2142     connected = 0;
2143     for(;;) {
2144         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2145         if (ret < 0) {
2146             err = socket_error();
2147             if (err == EINTR || err == EWOULDBLOCK) {
2148             } else if (err == EINPROGRESS) {
2149                 break;
2150 #ifdef _WIN32
2151             } else if (err == WSAEALREADY) {
2152                 break;
2153 #endif
2154             } else {
2155                 perror("connect");
2156                 closesocket(fd);
2157                 return -1;
2158             }
2159         } else {
2160             connected = 1;
2161             break;
2162         }
2163     }
2164     s = net_socket_fd_init(vlan, model, name, fd, connected);
2165     if (!s)
2166         return -1;
2167     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2168              "socket: connect to %s:%d",
2169              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2170     return 0;
2171 }
2172
2173 static int net_socket_mcast_init(VLANState *vlan,
2174                                  const char *model,
2175                                  const char *name,
2176                                  const char *host_str)
2177 {
2178     NetSocketState *s;
2179     int fd;
2180     struct sockaddr_in saddr;
2181
2182     if (parse_host_port(&saddr, host_str) < 0)
2183         return -1;
2184
2185
2186     fd = net_socket_mcast_create(&saddr);
2187     if (fd < 0)
2188         return -1;
2189
2190     s = net_socket_fd_init(vlan, model, name, fd, 0);
2191     if (!s)
2192         return -1;
2193
2194     s->dgram_dst = saddr;
2195
2196     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2197              "socket: mcast=%s:%d",
2198              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2199     return 0;
2200
2201 }
2202
2203 typedef struct DumpState {
2204     VLANClientState *pcap_vc;
2205     int fd;
2206     int pcap_caplen;
2207 } DumpState;
2208
2209 #define PCAP_MAGIC 0xa1b2c3d4
2210
2211 struct pcap_file_hdr {
2212     uint32_t magic;
2213     uint16_t version_major;
2214     uint16_t version_minor;
2215     int32_t thiszone;
2216     uint32_t sigfigs;
2217     uint32_t snaplen;
2218     uint32_t linktype;
2219 };
2220
2221 struct pcap_sf_pkthdr {
2222     struct {
2223         int32_t tv_sec;
2224         int32_t tv_usec;
2225     } ts;
2226     uint32_t caplen;
2227     uint32_t len;
2228 };
2229
2230 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2231 {
2232     DumpState *s = vc->opaque;
2233     struct pcap_sf_pkthdr hdr;
2234     int64_t ts;
2235     int caplen;
2236
2237     /* Early return in case of previous error. */
2238     if (s->fd < 0) {
2239         return size;
2240     }
2241
2242     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, get_ticks_per_sec());
2243     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2244
2245     hdr.ts.tv_sec = ts / 1000000;
2246     hdr.ts.tv_usec = ts % 1000000;
2247     hdr.caplen = caplen;
2248     hdr.len = size;
2249     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2250         write(s->fd, buf, caplen) != caplen) {
2251         qemu_log("-net dump write error - stop dump\n");
2252         close(s->fd);
2253         s->fd = -1;
2254     }
2255
2256     return size;
2257 }
2258
2259 static void net_dump_cleanup(VLANClientState *vc)
2260 {
2261     DumpState *s = vc->opaque;
2262
2263     close(s->fd);
2264     qemu_free(s);
2265 }
2266
2267 static int net_dump_init(VLANState *vlan, const char *device,
2268                          const char *name, const char *filename, int len)
2269 {
2270     struct pcap_file_hdr hdr;
2271     DumpState *s;
2272
2273     s = qemu_malloc(sizeof(DumpState));
2274
2275     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2276     if (s->fd < 0) {
2277         qemu_error("-net dump: can't open %s\n", filename);
2278         return -1;
2279     }
2280
2281     s->pcap_caplen = len;
2282
2283     hdr.magic = PCAP_MAGIC;
2284     hdr.version_major = 2;
2285     hdr.version_minor = 4;
2286     hdr.thiszone = 0;
2287     hdr.sigfigs = 0;
2288     hdr.snaplen = s->pcap_caplen;
2289     hdr.linktype = 1;
2290
2291     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2292         qemu_error("-net dump write error: %s\n", strerror(errno));
2293         close(s->fd);
2294         qemu_free(s);
2295         return -1;
2296     }
2297
2298     s->pcap_vc = qemu_new_vlan_client(vlan, device, name, NULL, dump_receive, NULL,
2299                                       net_dump_cleanup, s);
2300     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2301              "dump to %s (len=%d)", filename, len);
2302     return 0;
2303 }
2304
2305 /* find or alloc a new VLAN */
2306 VLANState *qemu_find_vlan(int id, int allocate)
2307 {
2308     VLANState **pvlan, *vlan;
2309     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2310         if (vlan->id == id)
2311             return vlan;
2312     }
2313     if (!allocate) {
2314         return NULL;
2315     }
2316     vlan = qemu_mallocz(sizeof(VLANState));
2317     vlan->id = id;
2318     QTAILQ_INIT(&vlan->send_queue);
2319     vlan->next = NULL;
2320     pvlan = &first_vlan;
2321     while (*pvlan != NULL)
2322         pvlan = &(*pvlan)->next;
2323     *pvlan = vlan;
2324     return vlan;
2325 }
2326
2327 static int nic_get_free_idx(void)
2328 {
2329     int index;
2330
2331     for (index = 0; index < MAX_NICS; index++)
2332         if (!nd_table[index].used)
2333             return index;
2334     return -1;
2335 }
2336
2337 int qemu_show_nic_models(const char *arg, const char *const *models)
2338 {
2339     int i;
2340
2341     if (!arg || strcmp(arg, "?"))
2342         return 0;
2343
2344     fprintf(stderr, "qemu: Supported NIC models: ");
2345     for (i = 0 ; models[i]; i++)
2346         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2347     return 1;
2348 }
2349
2350 void qemu_check_nic_model(NICInfo *nd, const char *model)
2351 {
2352     const char *models[2];
2353
2354     models[0] = model;
2355     models[1] = NULL;
2356
2357     if (qemu_show_nic_models(nd->model, models))
2358         exit(0);
2359     if (qemu_find_nic_model(nd, models, model) < 0)
2360         exit(1);
2361 }
2362
2363 int qemu_find_nic_model(NICInfo *nd, const char * const *models,
2364                         const char *default_model)
2365 {
2366     int i;
2367
2368     if (!nd->model)
2369         nd->model = qemu_strdup(default_model);
2370
2371     for (i = 0 ; models[i]; i++) {
2372         if (strcmp(nd->model, models[i]) == 0)
2373             return i;
2374     }
2375
2376     qemu_error("qemu: Unsupported NIC model: %s\n", nd->model);
2377     return -1;
2378 }
2379
2380 static int net_handle_fd_param(Monitor *mon, const char *param)
2381 {
2382     if (!qemu_isdigit(param[0])) {
2383         int fd;
2384
2385         fd = monitor_get_fd(mon, param);
2386         if (fd == -1) {
2387             qemu_error("No file descriptor named %s found", param);
2388             return -1;
2389         }
2390
2391         return fd;
2392     } else {
2393         return strtol(param, NULL, 0);
2394     }
2395 }
2396
2397 static int net_init_nic(QemuOpts *opts, Monitor *mon)
2398 {
2399     int idx;
2400     NICInfo *nd;
2401
2402     idx = nic_get_free_idx();
2403     if (idx == -1 || nb_nics >= MAX_NICS) {
2404         qemu_error("Too Many NICs\n");
2405         return -1;
2406     }
2407
2408     nd = &nd_table[idx];
2409
2410     memset(nd, 0, sizeof(*nd));
2411
2412     nd->vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2413
2414     if (qemu_opts_id(opts)) {
2415         nd->id = qemu_strdup(qemu_opts_id(opts));
2416     }
2417     if (qemu_opt_get(opts, "name")) {
2418         nd->name = qemu_strdup(qemu_opt_get(opts, "name"));
2419     }
2420     if (qemu_opt_get(opts, "model")) {
2421         nd->model = qemu_strdup(qemu_opt_get(opts, "model"));
2422     }
2423     if (qemu_opt_get(opts, "addr")) {
2424         nd->devaddr = qemu_strdup(qemu_opt_get(opts, "addr"));
2425     }
2426
2427     nd->macaddr[0] = 0x52;
2428     nd->macaddr[1] = 0x54;
2429     nd->macaddr[2] = 0x00;
2430     nd->macaddr[3] = 0x12;
2431     nd->macaddr[4] = 0x34;
2432     nd->macaddr[5] = 0x56 + idx;
2433
2434     if (qemu_opt_get(opts, "macaddr") &&
2435         parse_macaddr(nd->macaddr, qemu_opt_get(opts, "macaddr")) < 0) {
2436         qemu_error("invalid syntax for ethernet address\n");
2437         return -1;
2438     }
2439
2440     nd->nvectors = qemu_opt_get_number(opts, "vectors", NIC_NVECTORS_UNSPECIFIED);
2441     if (nd->nvectors != NIC_NVECTORS_UNSPECIFIED &&
2442         (nd->nvectors < 0 || nd->nvectors > 0x7ffffff)) {
2443         qemu_error("invalid # of vectors: %d\n", nd->nvectors);
2444         return -1;
2445     }
2446
2447     nd->used = 1;
2448     nd->vlan->nb_guest_devs++;
2449     nb_nics++;
2450
2451     return idx;
2452 }
2453
2454 static int net_init_slirp_configs(const char *name, const char *value, void *opaque)
2455 {
2456     struct slirp_config_str *config;
2457
2458     if (strcmp(name, "hostfwd") != 0 && strcmp(name, "guestfwd") != 0) {
2459         return 0;
2460     }
2461
2462     config = qemu_mallocz(sizeof(*config));
2463
2464     pstrcpy(config->str, sizeof(config->str), value);
2465
2466     if (!strcmp(name, "hostfwd")) {
2467         config->flags = SLIRP_CFG_HOSTFWD;
2468     }
2469
2470     config->next = slirp_configs;
2471     slirp_configs = config;
2472
2473     return 0;
2474 }
2475
2476 static int net_init_slirp(QemuOpts *opts, Monitor *mon)
2477 {
2478     VLANState *vlan;
2479     struct slirp_config_str *config;
2480     const char *name;
2481     const char *vhost;
2482     const char *vhostname;
2483     const char *vdhcp_start;
2484     const char *vnamesrv;
2485     const char *tftp_export;
2486     const char *bootfile;
2487     const char *smb_export;
2488     const char *vsmbsrv;
2489     char *vnet = NULL;
2490     int restricted = 0;
2491     int ret;
2492
2493     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2494
2495     name = qemu_opt_get(opts, "name");
2496
2497     vhost       = qemu_opt_get(opts, "host");
2498     vhostname   = qemu_opt_get(opts, "hostname");
2499     vdhcp_start = qemu_opt_get(opts, "dhcpstart");
2500     vnamesrv    = qemu_opt_get(opts, "dns");
2501     tftp_export = qemu_opt_get(opts, "tftp");
2502     bootfile    = qemu_opt_get(opts, "bootfile");
2503     smb_export  = qemu_opt_get(opts, "smb");
2504     vsmbsrv     = qemu_opt_get(opts, "smbserver");
2505
2506     if (qemu_opt_get(opts, "ip")) {
2507         const char *ip = qemu_opt_get(opts, "ip");
2508         int l = strlen(ip) + strlen("/24") + 1;
2509
2510         vnet = qemu_malloc(l);
2511
2512         /* emulate legacy ip= parameter */
2513         pstrcpy(vnet, l, ip);
2514         pstrcat(vnet, l, "/24");
2515     }
2516
2517     if (qemu_opt_get(opts, "net")) {
2518         if (vnet) {
2519             qemu_free(vnet);
2520         }
2521         vnet = qemu_strdup(qemu_opt_get(opts, "net"));
2522     }
2523
2524     if (qemu_opt_get(opts, "restrict") &&
2525         qemu_opt_get(opts, "restrict")[0] == 'y') {
2526         restricted = 1;
2527     }
2528
2529     qemu_opt_foreach(opts, net_init_slirp_configs, NULL, 0);
2530
2531     ret = net_slirp_init(vlan, "user", name, restricted, vnet, vhost,
2532                          vhostname, tftp_export, bootfile, vdhcp_start,
2533                          vnamesrv, smb_export, vsmbsrv);
2534
2535     while (slirp_configs) {
2536         config = slirp_configs;
2537         slirp_configs = config->next;
2538         qemu_free(config);
2539     }
2540
2541     if (ret != -1) {
2542         vlan->nb_host_devs++;
2543     }
2544
2545     qemu_free(vnet);
2546
2547     return ret;
2548 }
2549
2550 #ifdef _WIN32
2551 static int net_init_tap_win32(QemuOpts *opts, Monitor *mon)
2552 {
2553     VLANState *vlan;
2554     const char *name;
2555     const char *ifname;
2556
2557     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2558
2559     name   = qemu_opt_get(opts, "name");
2560     ifname = qemu_opt_get(opts, "ifname");
2561
2562     if (!ifname) {
2563         qemu_error("tap: no interface name\n");
2564         return -1;
2565     }
2566
2567     if (tap_win32_init(vlan, "tap", name, ifname) == -1) {
2568         return -1;
2569     }
2570
2571     vlan->nb_host_devs++;
2572
2573     return 0;
2574 }
2575 #elif !defined(_AIX)
2576 static int net_init_tap(QemuOpts *opts, Monitor *mon)
2577 {
2578     VLANState *vlan;
2579     const char *name;
2580     TAPState *s;
2581
2582     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2583
2584     name = qemu_opt_get(opts, "name");
2585
2586     if (qemu_opt_get(opts, "fd")) {
2587         int fd;
2588
2589         if (qemu_opt_get(opts, "ifname") ||
2590             qemu_opt_get(opts, "script") ||
2591             qemu_opt_get(opts, "downscript")) {
2592             qemu_error("ifname=, script= and downscript= is invalid with fd=\n");
2593             return -1;
2594         }
2595
2596         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2597         if (fd == -1) {
2598             return -1;
2599         }
2600
2601         fcntl(fd, F_SETFL, O_NONBLOCK);
2602
2603         s = net_tap_fd_init(vlan, "tap", name, fd);
2604         if (!s) {
2605             close(fd);
2606         }
2607     } else {
2608         const char *ifname, *script, *downscript;
2609
2610         ifname     = qemu_opt_get(opts, "ifname");
2611         script     = qemu_opt_get(opts, "script");
2612         downscript = qemu_opt_get(opts, "downscript");
2613
2614         if (!script) {
2615             script = DEFAULT_NETWORK_SCRIPT;
2616         }
2617         if (!downscript) {
2618             downscript = DEFAULT_NETWORK_DOWN_SCRIPT;
2619         }
2620
2621         s = net_tap_init(vlan, "tap", name, ifname, script, downscript);
2622     }
2623
2624     if (!s) {
2625         return -1;
2626     }
2627
2628     if (tap_set_sndbuf(s, opts) < 0) {
2629         return -1;
2630     }
2631
2632     vlan->nb_host_devs++;
2633
2634     return 0;
2635 }
2636 #endif
2637
2638 static int net_init_socket(QemuOpts *opts, Monitor *mon)
2639 {
2640     VLANState *vlan;
2641     const char *name;
2642
2643     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2644
2645     name = qemu_opt_get(opts, "name");
2646
2647     if (qemu_opt_get(opts, "fd")) {
2648         int fd;
2649
2650         if (qemu_opt_get(opts, "listen") ||
2651             qemu_opt_get(opts, "connect") ||
2652             qemu_opt_get(opts, "mcast")) {
2653             qemu_error("listen=, connect= and mcast= is invalid with fd=\n");
2654             return -1;
2655         }
2656
2657         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2658         if (fd == -1) {
2659             return -1;
2660         }
2661
2662         if (!net_socket_fd_init(vlan, "socket", name, fd, 1)) {
2663             close(fd);
2664             return -1;
2665         }
2666     } else if (qemu_opt_get(opts, "listen")) {
2667         const char *listen;
2668
2669         if (qemu_opt_get(opts, "fd") ||
2670             qemu_opt_get(opts, "connect") ||
2671             qemu_opt_get(opts, "mcast")) {
2672             qemu_error("fd=, connect= and mcast= is invalid with listen=\n");
2673             return -1;
2674         }
2675
2676         listen = qemu_opt_get(opts, "listen");
2677
2678         if (net_socket_listen_init(vlan, "socket", name, listen) == -1) {
2679             return -1;
2680         }
2681     } else if (qemu_opt_get(opts, "connect")) {
2682         const char *connect;
2683
2684         if (qemu_opt_get(opts, "fd") ||
2685             qemu_opt_get(opts, "listen") ||
2686             qemu_opt_get(opts, "mcast")) {
2687             qemu_error("fd=, listen= and mcast= is invalid with connect=\n");
2688             return -1;
2689         }
2690
2691         connect = qemu_opt_get(opts, "connect");
2692
2693         if (net_socket_connect_init(vlan, "socket", name, connect) == -1) {
2694             return -1;
2695         }
2696     } else if (qemu_opt_get(opts, "mcast")) {
2697         const char *mcast;
2698
2699         if (qemu_opt_get(opts, "fd") ||
2700             qemu_opt_get(opts, "connect") ||
2701             qemu_opt_get(opts, "listen")) {
2702             qemu_error("fd=, connect= and listen= is invalid with mcast=\n");
2703             return -1;
2704         }
2705
2706         mcast = qemu_opt_get(opts, "mcast");
2707
2708         if (net_socket_mcast_init(vlan, "socket", name, mcast) == -1) {
2709             return -1;
2710         }
2711     } else {
2712         qemu_error("-socket requires fd=, listen=, connect= or mcast=\n");
2713         return -1;
2714     }
2715
2716     vlan->nb_host_devs++;
2717
2718     return 0;
2719 }
2720
2721 #ifdef CONFIG_VDE
2722 static int net_init_vde(QemuOpts *opts, Monitor *mon)
2723 {
2724     VLANState *vlan;
2725     const char *name;
2726     const char *sock;
2727     const char *group;
2728     int port, mode;
2729
2730     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2731
2732     name  = qemu_opt_get(opts, "name");
2733     sock  = qemu_opt_get(opts, "sock");
2734     group = qemu_opt_get(opts, "group");
2735
2736     port = qemu_opt_get_number(opts, "port", 0);
2737     mode = qemu_opt_get_number(opts, "mode", 0700);
2738
2739     if (net_vde_init(vlan, "vde", name, sock, port, group, mode) == -1) {
2740         return -1;
2741     }
2742
2743     vlan->nb_host_devs++;
2744
2745     return 0;
2746 }
2747 #endif
2748
2749 static int net_init_dump(QemuOpts *opts, Monitor *mon)
2750 {
2751     VLANState *vlan;
2752     int len;
2753     const char *file;
2754     const char *name;
2755     char def_file[128];
2756
2757     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2758
2759     name = qemu_opt_get(opts, "name");
2760
2761     file = qemu_opt_get(opts, "file");
2762     if (!file) {
2763         snprintf(def_file, sizeof(def_file), "qemu-vlan%d.pcap", vlan->id);
2764         file = def_file;
2765     }
2766
2767     len = qemu_opt_get_size(opts, "len", 65536);
2768
2769     return net_dump_init(vlan, "dump", name, file, len);
2770 }
2771
2772 #define NET_COMMON_PARAMS_DESC                     \
2773     {                                              \
2774         .name = "type",                            \
2775         .type = QEMU_OPT_STRING,                   \
2776         .help = "net client type (nic, tap etc.)", \
2777      }, {                                          \
2778         .name = "vlan",                            \
2779         .type = QEMU_OPT_NUMBER,                   \
2780         .help = "vlan number",                     \
2781      }, {                                          \
2782         .name = "name",                            \
2783         .type = QEMU_OPT_STRING,                   \
2784         .help = "identifier for monitor commands", \
2785      }
2786
2787 typedef int (*net_client_init_func)(QemuOpts *opts, Monitor *mon);
2788
2789 /* magic number, but compiler will warn if too small */
2790 #define NET_MAX_DESC 20
2791
2792 static struct {
2793     const char *type;
2794     net_client_init_func init;
2795     QemuOptDesc desc[NET_MAX_DESC];
2796 } net_client_types[] = {
2797     {
2798         .type = "none",
2799         .desc = {
2800             NET_COMMON_PARAMS_DESC,
2801             { /* end of list */ }
2802         },
2803     }, {
2804         .type = "nic",
2805         .init = net_init_nic,
2806         .desc = {
2807             NET_COMMON_PARAMS_DESC,
2808             {
2809                 .name = "macaddr",
2810                 .type = QEMU_OPT_STRING,
2811                 .help = "MAC address",
2812             }, {
2813                 .name = "model",
2814                 .type = QEMU_OPT_STRING,
2815                 .help = "device model (e1000, rtl8139, virtio etc.)",
2816             }, {
2817                 .name = "addr",
2818                 .type = QEMU_OPT_STRING,
2819                 .help = "PCI device address",
2820             }, {
2821                 .name = "vectors",
2822                 .type = QEMU_OPT_NUMBER,
2823                 .help = "number of MSI-x vectors, 0 to disable MSI-X",
2824             },
2825             { /* end of list */ }
2826         },
2827 #ifdef CONFIG_SLIRP
2828     }, {
2829         .type = "user",
2830         .init = net_init_slirp,
2831         .desc = {
2832             NET_COMMON_PARAMS_DESC,
2833             {
2834                 .name = "hostname",
2835                 .type = QEMU_OPT_STRING,
2836                 .help = "client hostname reported by the builtin DHCP server",
2837             }, {
2838                 .name = "restrict",
2839                 .type = QEMU_OPT_STRING,
2840                 .help = "isolate the guest from the host (y|yes|n|no)",
2841             }, {
2842                 .name = "ip",
2843                 .type = QEMU_OPT_STRING,
2844                 .help = "legacy parameter, use net= instead",
2845             }, {
2846                 .name = "net",
2847                 .type = QEMU_OPT_STRING,
2848                 .help = "IP address and optional netmask",
2849             }, {
2850                 .name = "host",
2851                 .type = QEMU_OPT_STRING,
2852                 .help = "guest-visible address of the host",
2853             }, {
2854                 .name = "tftp",
2855                 .type = QEMU_OPT_STRING,
2856                 .help = "root directory of the built-in TFTP server",
2857             }, {
2858                 .name = "bootfile",
2859                 .type = QEMU_OPT_STRING,
2860                 .help = "BOOTP filename, for use with tftp=",
2861             }, {
2862                 .name = "dhcpstart",
2863                 .type = QEMU_OPT_STRING,
2864                 .help = "the first of the 16 IPs the built-in DHCP server can assign",
2865             }, {
2866                 .name = "dns",
2867                 .type = QEMU_OPT_STRING,
2868                 .help = "guest-visible address of the virtual nameserver",
2869             }, {
2870                 .name = "smb",
2871                 .type = QEMU_OPT_STRING,
2872                 .help = "root directory of the built-in SMB server",
2873             }, {
2874                 .name = "smbserver",
2875                 .type = QEMU_OPT_STRING,
2876                 .help = "IP address of the built-in SMB server",
2877             }, {
2878                 .name = "hostfwd",
2879                 .type = QEMU_OPT_STRING,
2880                 .help = "guest port number to forward incoming TCP or UDP connections",
2881             }, {
2882                 .name = "guestfwd",
2883                 .type = QEMU_OPT_STRING,
2884                 .help = "IP address and port to forward guest TCP connections",
2885             },
2886             { /* end of list */ }
2887         },
2888 #endif
2889 #ifdef _WIN32
2890     }, {
2891         .type = "tap",
2892         .init = net_init_tap_win32,
2893         .desc = {
2894             NET_COMMON_PARAMS_DESC,
2895             {
2896                 .name = "ifname",
2897                 .type = QEMU_OPT_STRING,
2898                 .help = "interface name",
2899             },
2900             { /* end of list */ }
2901         },
2902 #elif !defined(_AIX)
2903     }, {
2904         .type = "tap",
2905         .init = net_init_tap,
2906         .desc = {
2907             NET_COMMON_PARAMS_DESC,
2908             {
2909                 .name = "fd",
2910                 .type = QEMU_OPT_STRING,
2911                 .help = "file descriptor of an already opened tap",
2912             }, {
2913                 .name = "ifname",
2914                 .type = QEMU_OPT_STRING,
2915                 .help = "interface name",
2916             }, {
2917                 .name = "script",
2918                 .type = QEMU_OPT_STRING,
2919                 .help = "script to initialize the interface",
2920             }, {
2921                 .name = "downscript",
2922                 .type = QEMU_OPT_STRING,
2923                 .help = "script to shut down the interface",
2924 #ifdef TUNSETSNDBUF
2925             }, {
2926                 .name = "sndbuf",
2927                 .type = QEMU_OPT_SIZE,
2928                 .help = "send buffer limit"
2929 #endif
2930             },
2931             { /* end of list */ }
2932         },
2933 #endif
2934     }, {
2935         .type = "socket",
2936         .init = net_init_socket,
2937         .desc = {
2938             NET_COMMON_PARAMS_DESC,
2939             {
2940                 .name = "fd",
2941                 .type = QEMU_OPT_STRING,
2942                 .help = "file descriptor of an already opened socket",
2943             }, {
2944                 .name = "listen",
2945                 .type = QEMU_OPT_STRING,
2946                 .help = "port number, and optional hostname, to listen on",
2947             }, {
2948                 .name = "connect",
2949                 .type = QEMU_OPT_STRING,
2950                 .help = "port number, and optional hostname, to connect to",
2951             }, {
2952                 .name = "mcast",
2953                 .type = QEMU_OPT_STRING,
2954                 .help = "UDP multicast address and port number",
2955             },
2956             { /* end of list */ }
2957         },
2958 #ifdef CONFIG_VDE
2959     }, {
2960         .type = "vde",
2961         .init = net_init_vde,
2962         .desc = {
2963             NET_COMMON_PARAMS_DESC,
2964             {
2965                 .name = "sock",
2966                 .type = QEMU_OPT_STRING,
2967                 .help = "socket path",
2968             }, {
2969                 .name = "port",
2970                 .type = QEMU_OPT_NUMBER,
2971                 .help = "port number",
2972             }, {
2973                 .name = "group",
2974                 .type = QEMU_OPT_STRING,
2975                 .help = "group owner of socket",
2976             }, {
2977                 .name = "mode",
2978                 .type = QEMU_OPT_NUMBER,
2979                 .help = "permissions for socket",
2980             },
2981             { /* end of list */ }
2982         },
2983 #endif
2984     }, {
2985         .type = "dump",
2986         .init = net_init_dump,
2987         .desc = {
2988             NET_COMMON_PARAMS_DESC,
2989             {
2990                 .name = "len",
2991                 .type = QEMU_OPT_SIZE,
2992                 .help = "per-packet size limit (64k default)",
2993             }, {
2994                 .name = "file",
2995                 .type = QEMU_OPT_STRING,
2996                 .help = "dump file path (default is qemu-vlan0.pcap)",
2997             },
2998             { /* end of list */ }
2999         },
3000     },
3001     { /* end of list */ }
3002 };
3003
3004 static int net_client_init_from_opts(Monitor *mon, QemuOpts *opts)
3005 {
3006     const char *type;
3007     int i;
3008
3009     type = qemu_opt_get(opts, "type");
3010     if (!type) {
3011         qemu_error("No type specified for -net\n");
3012         return -1;
3013     }
3014
3015     for (i = 0; net_client_types[i].type != NULL; i++) {
3016         if (!strcmp(net_client_types[i].type, type)) {
3017             if (qemu_opts_validate(opts, &net_client_types[i].desc[0]) == -1) {
3018                 return -1;
3019             }
3020
3021             if (net_client_types[i].init) {
3022                 return net_client_types[i].init(opts, NULL);
3023             } else {
3024                 return 0;
3025             }
3026         }
3027     }
3028
3029     qemu_error("Invalid -net type '%s'\n", type);
3030     return -1;
3031 }
3032
3033 int net_client_init(Monitor *mon, const char *device, const char *p)
3034 {
3035     QemuOpts *opts;
3036
3037 #ifdef CONFIG_SLIRP
3038     if (!strcmp(device, "channel")) {
3039         int ret;
3040
3041         if (QTAILQ_EMPTY(&slirp_stacks)) {
3042             struct slirp_config_str *config;
3043
3044             config = qemu_malloc(sizeof(*config));
3045             pstrcpy(config->str, sizeof(config->str), p);
3046             config->flags = SLIRP_CFG_LEGACY;
3047             config->next = slirp_configs;
3048             slirp_configs = config;
3049             ret = 0;
3050         } else {
3051             ret = slirp_guestfwd(QTAILQ_FIRST(&slirp_stacks), p, 1);
3052         }
3053
3054         return ret;
3055     }
3056 #endif
3057
3058     opts = qemu_opts_parse(&qemu_net_opts, p, NULL);
3059     if (!opts) {
3060       return -1;
3061     }
3062
3063     qemu_opt_set(opts, "type", device);
3064
3065     return net_client_init_from_opts(mon, opts);
3066 }
3067
3068 void net_client_uninit(NICInfo *nd)
3069 {
3070     nd->vlan->nb_guest_devs--;
3071     nb_nics--;
3072
3073     qemu_free(nd->model);
3074     qemu_free(nd->name);
3075     qemu_free(nd->devaddr);
3076     qemu_free(nd->id);
3077
3078     nd->used = 0;
3079 }
3080
3081 static int net_host_check_device(const char *device)
3082 {
3083     int i;
3084     const char *valid_param_list[] = { "tap", "socket", "dump"
3085 #ifdef CONFIG_SLIRP
3086                                        ,"user"
3087 #endif
3088 #ifdef CONFIG_VDE
3089                                        ,"vde"
3090 #endif
3091     };
3092     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
3093         if (!strncmp(valid_param_list[i], device,
3094                      strlen(valid_param_list[i])))
3095             return 1;
3096     }
3097
3098     return 0;
3099 }
3100
3101 void net_host_device_add(Monitor *mon, const QDict *qdict)
3102 {
3103     const char *device = qdict_get_str(qdict, "device");
3104     const char *opts_str = qdict_get_try_str(qdict, "opts");
3105     QemuOpts *opts;
3106
3107     if (!net_host_check_device(device)) {
3108         monitor_printf(mon, "invalid host network device %s\n", device);
3109         return;
3110     }
3111
3112     opts = qemu_opts_parse(&qemu_net_opts, opts_str ? opts_str : "", NULL);
3113     if (!opts) {
3114         monitor_printf(mon, "parsing network options '%s' failed\n",
3115                        opts_str ? opts_str : "");
3116         return;
3117     }
3118
3119     qemu_opt_set(opts, "type", device);
3120
3121     if (net_client_init_from_opts(mon, opts) < 0) {
3122         monitor_printf(mon, "adding host network device %s failed\n", device);
3123     }
3124 }
3125
3126 void net_host_device_remove(Monitor *mon, const QDict *qdict)
3127 {
3128     VLANClientState *vc;
3129     int vlan_id = qdict_get_int(qdict, "vlan_id");
3130     const char *device = qdict_get_str(qdict, "device");
3131
3132     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
3133     if (!vc) {
3134         return;
3135     }
3136     if (!net_host_check_device(vc->model)) {
3137         monitor_printf(mon, "invalid host network device %s\n", device);
3138         return;
3139     }
3140     qemu_del_vlan_client(vc);
3141 }
3142
3143 int net_client_parse(const char *str)
3144 {
3145     const char *p;
3146     char *q;
3147     char device[64];
3148
3149     p = str;
3150     q = device;
3151     while (*p != '\0' && *p != ',') {
3152         if ((q - device) < sizeof(device) - 1)
3153             *q++ = *p;
3154         p++;
3155     }
3156     *q = '\0';
3157     if (*p == ',')
3158         p++;
3159
3160     return net_client_init(NULL, device, p);
3161 }
3162
3163 void net_set_boot_mask(int net_boot_mask)
3164 {
3165     int i;
3166
3167     /* Only the first four NICs may be bootable */
3168     net_boot_mask = net_boot_mask & 0xF;
3169
3170     for (i = 0; i < nb_nics; i++) {
3171         if (net_boot_mask & (1 << i)) {
3172             nd_table[i].bootable = 1;
3173             net_boot_mask &= ~(1 << i);
3174         }
3175     }
3176
3177     if (net_boot_mask) {
3178         fprintf(stderr, "Cannot boot from non-existent NIC\n");
3179         exit(1);
3180     }
3181 }
3182
3183 void do_info_network(Monitor *mon)
3184 {
3185     VLANState *vlan;
3186     VLANClientState *vc;
3187
3188     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3189         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
3190         for(vc = vlan->first_client; vc != NULL; vc = vc->next)
3191             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
3192     }
3193 }
3194
3195 void do_set_link(Monitor *mon, const QDict *qdict)
3196 {
3197     VLANState *vlan;
3198     VLANClientState *vc = NULL;
3199     const char *name = qdict_get_str(qdict, "name");
3200     const char *up_or_down = qdict_get_str(qdict, "up_or_down");
3201
3202     for (vlan = first_vlan; vlan != NULL; vlan = vlan->next)
3203         for (vc = vlan->first_client; vc != NULL; vc = vc->next)
3204             if (strcmp(vc->name, name) == 0)
3205                 goto done;
3206 done:
3207
3208     if (!vc) {
3209         monitor_printf(mon, "could not find network device '%s'\n", name);
3210         return;
3211     }
3212
3213     if (strcmp(up_or_down, "up") == 0)
3214         vc->link_down = 0;
3215     else if (strcmp(up_or_down, "down") == 0)
3216         vc->link_down = 1;
3217     else
3218         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
3219                        "valid\n", up_or_down);
3220
3221     if (vc->link_status_changed)
3222         vc->link_status_changed(vc);
3223 }
3224
3225 void net_cleanup(void)
3226 {
3227     VLANState *vlan;
3228
3229     /* close network clients */
3230     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3231         VLANClientState *vc = vlan->first_client;
3232
3233         while (vc) {
3234             VLANClientState *next = vc->next;
3235
3236             qemu_del_vlan_client(vc);
3237
3238             vc = next;
3239         }
3240     }
3241 }
3242
3243 void net_client_check(void)
3244 {
3245     VLANState *vlan;
3246
3247     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3248         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
3249             continue;
3250         if (vlan->nb_guest_devs == 0)
3251             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
3252         if (vlan->nb_host_devs == 0)
3253             fprintf(stderr,
3254                     "Warning: vlan %d is not connected to host network\n",
3255                     vlan->id);
3256     }
3257 }