vl.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "hw/hw.h"
  25 #include "hw/boards.h"
  26 #include "hw/usb.h"
  27 #include "hw/pcmcia.h"
  28 #include "hw/pc.h"
  29 #include "hw/audiodev.h"
  30 #include "hw/isa.h"
  31 #include "hw/baum.h"
  32 #include "net.h"
  33 #include "console.h"
  34 #include "sysemu.h"
  35 #include "gdbstub.h"
  36 #include "qemu-timer.h"
  37 #include "qemu-char.h"
  38 #include "block.h"
  39 #include "audio/audio.h"
  40
  41 #include <unistd.h>
  42 #include <fcntl.h>
  43 #include <signal.h>
  44 #include <time.h>
  45 #include <errno.h>
  46 #include <sys/time.h>
  47 #include <zlib.h>
  48
  49 #ifndef _WIN32
  50 #include <sys/times.h>
  51 #include <sys/wait.h>
  52 #include <termios.h>
  53 #include <sys/poll.h>
  54 #include <sys/mman.h>
  55 #include <sys/ioctl.h>
  56 #include <sys/socket.h>
  57 #include <netinet/in.h>
  58 #include <dirent.h>
  59 #include <netdb.h>
  60 #include <sys/select.h>
  61 #include <arpa/inet.h>
  62 #ifdef _BSD
  63 #include <sys/stat.h>
  64 #ifndef __APPLE__
  65 #include <libutil.h>
  66 #endif
  67 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  68 #include <freebsd/stdlib.h>
  69 #else
  70 #ifndef __sun__
  71 #include <linux/if.h>
  72 #include <linux/if_tun.h>
  73 #include <pty.h>
  74 #include <malloc.h>
  75 #include <linux/rtc.h>
  76
  77 /* For the benefit of older linux systems which don't supply it,
  78    we use a local copy of hpet.h. */
  79 /* #include <linux/hpet.h> */
  80 #include "hpet.h"
  81
  82 #include <linux/ppdev.h>
  83 #include <linux/parport.h>
  84 #else
  85 #include <sys/stat.h>
  86 #include <sys/ethernet.h>
  87 #include <sys/sockio.h>
  88 #include <netinet/arp.h>
  89 #include <netinet/in.h>
  90 #include <netinet/in_systm.h>
  91 #include <netinet/ip.h>
  92 #include <netinet/ip_icmp.h> // must come after ip.h
  93 #include <netinet/udp.h>
  94 #include <netinet/tcp.h>
  95 #include <net/if.h>
  96 #include <syslog.h>
  97 #include <stropts.h>
  98 #endif
  99 #endif
 100 #else
 101 #include <winsock2.h>
 102 int inet_aton(const char *cp, struct in_addr *ia);
 103 #endif
 104
 105 #if defined(CONFIG_SLIRP)
 106 #include "libslirp.h"
 107 #endif
 108
 109 #if defined(CONFIG_VDE)
 110 #include <libvdeplug.h>
 111 #endif
 112
 113 #ifdef _WIN32
 114 #include <malloc.h>
 115 #include <sys/timeb.h>
 116 #include <mmsystem.h>
 117 #define getopt_long_only getopt_long
 118 #define memalign(align, size) malloc(size)
 119 #endif
 120
 121 #include "qemu_socket.h"
 122
 123 #ifdef CONFIG_SDL
 124 #ifdef __APPLE__
 125 #include <SDL/SDL.h>
 126 #endif
 127 #endif /* CONFIG_SDL */
 128
 129 #ifdef CONFIG_COCOA
 130 #undef main
 131 #define main qemu_main
 132 #endif /* CONFIG_COCOA */
 133
 134 #include "disas.h"
 135
 136 #include "exec-all.h"
 137
 138 #define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
 139 #define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
 140 #ifdef __sun__
 141 #define SMBD_COMMAND "/usr/sfw/sbin/smbd"
 142 #else
 143 #define SMBD_COMMAND "/usr/sbin/smbd"
 144 #endif
 145
 146 //#define DEBUG_UNUSED_IOPORT
 147 //#define DEBUG_IOPORT
 148
 149 #ifdef TARGET_PPC
 150 #define DEFAULT_RAM_SIZE 144
 151 #else
 152 #define DEFAULT_RAM_SIZE 128
 153 #endif
 154 /* in ms */
 155 #define GUI_REFRESH_INTERVAL 30
 156
 157 /* Max number of USB devices that can be specified on the commandline.  */
 158 #define MAX_USB_CMDLINE 8
 159
 160 /* XXX: use a two level table to limit memory usage */
 161 #define MAX_IOPORTS 65536
 162
 163 const char *bios_dir = CONFIG_QEMU_SHAREDIR;
 164 const char *bios_name = NULL;
 165 void *ioport_opaque[MAX_IOPORTS];
 166 IOPortReadFunc *ioport_read_table[3][MAX_IOPORTS];
 167 IOPortWriteFunc *ioport_write_table[3][MAX_IOPORTS];
 168 /* Note: drives_table[MAX_DRIVES] is a dummy block driver if none available
 169    to store the VM snapshots */
 170 DriveInfo drives_table[MAX_DRIVES+1];
 171 int nb_drives;
 172 /* point to the block driver where the snapshots are managed */
 173 BlockDriverState *bs_snapshots;
 174 int vga_ram_size;
 175 static DisplayState display_state;
 176 int nographic;
 177 int curses;
 178 const char* keyboard_layout = NULL;
 179 int64_t ticks_per_sec;
 180 ram_addr_t ram_size;
 181 int pit_min_timer_count = 0;
 182 int nb_nics;
 183 NICInfo nd_table[MAX_NICS];
 184 int vm_running;
 185 static int rtc_utc = 1;
 186 static int rtc_date_offset = -1; /* -1 means no change */
 187 int cirrus_vga_enabled = 1;
 188 int vmsvga_enabled = 0;
 189 #ifdef TARGET_SPARC
 190 int graphic_width = 1024;
 191 int graphic_height = 768;
 192 int graphic_depth = 8;
 193 #else
 194 int graphic_width = 800;
 195 int graphic_height = 600;
 196 int graphic_depth = 15;
 197 #endif
 198 int full_screen = 0;
 199 int no_frame = 0;
 200 int no_quit = 0;
 201 CharDriverState *serial_hds[MAX_SERIAL_PORTS];
 202 CharDriverState *parallel_hds[MAX_PARALLEL_PORTS];
 203 #ifdef TARGET_I386
 204 int win2k_install_hack = 0;
 205 #endif
 206 int usb_enabled = 0;
 207 static VLANState *first_vlan;
 208 int smp_cpus = 1;
 209 const char *vnc_display;
 210 #if defined(TARGET_SPARC)
 211 #define MAX_CPUS 16
 212 #elif defined(TARGET_I386)
 213 #define MAX_CPUS 255
 214 #else
 215 #define MAX_CPUS 1
 216 #endif
 217 int acpi_enabled = 1;
 218 int fd_bootchk = 1;
 219 int no_reboot = 0;
 220 int no_shutdown = 0;
 221 int cursor_hide = 1;
 222 int graphic_rotate = 0;
 223 int daemonize = 0;
 224 const char *option_rom[MAX_OPTION_ROMS];
 225 int nb_option_roms;
 226 int semihosting_enabled = 0;
 227 int autostart = 1;
 228 #ifdef TARGET_ARM
 229 int old_param = 0;
 230 #endif
 231 const char *qemu_name;
 232 int alt_grab = 0;
 233 #ifdef TARGET_SPARC
 234 unsigned int nb_prom_envs = 0;
 235 const char *prom_envs[MAX_PROM_ENVS];
 236 #endif
 237 int nb_drives_opt;
 238 struct drive_opt {
 239     const char *file;
 240     char opt[1024];
 241 } drives_opt[MAX_DRIVES];
 242
 243 static CPUState *cur_cpu;
 244 static CPUState *next_cpu;
 245 static int event_pending = 1;
 246 /* Conversion factor from emulated instructions to virtual clock ticks.  */
 247 static int icount_time_shift;
 248 /* Arbitrarily pick 1MIPS as the minimum allowable speed.  */
 249 #define MAX_ICOUNT_SHIFT 10
 250 /* Compensate for varying guest execution speed.  */
 251 static int64_t qemu_icount_bias;
 252 QEMUTimer *icount_rt_timer;
 253 QEMUTimer *icount_vm_timer;
 254
 255 #define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
 256
 257 /***********************************************************/
 258 /* x86 ISA bus support */
 259
 260 target_phys_addr_t isa_mem_base = 0;
 261 PicState2 *isa_pic;
 262
 263 static IOPortReadFunc default_ioport_readb, default_ioport_readw, default_ioport_readl;
 264 static IOPortWriteFunc default_ioport_writeb, default_ioport_writew, default_ioport_writel;
 265
 266 static uint32_t ioport_read(int index, uint32_t address)
 267 {
 268     static IOPortReadFunc *default_func[3] = {
 269         default_ioport_readb,
 270         default_ioport_readw,
 271         default_ioport_readl
 272     };
 273     IOPortReadFunc *func = ioport_read_table[index][address];
 274     if (!func)
 275         func = default_func[index];
 276     return func(ioport_opaque[address], address);
 277 }
 278
 279 static void ioport_write(int index, uint32_t address, uint32_t data)
 280 {
 281     static IOPortWriteFunc *default_func[3] = {
 282         default_ioport_writeb,
 283         default_ioport_writew,
 284         default_ioport_writel
 285     };
 286     IOPortWriteFunc *func = ioport_write_table[index][address];
 287     if (!func)
 288         func = default_func[index];
 289     func(ioport_opaque[address], address, data);
 290 }
 291
 292 static uint32_t default_ioport_readb(void *opaque, uint32_t address)
 293 {
 294 #ifdef DEBUG_UNUSED_IOPORT
 295     fprintf(stderr, "unused inb: port=0x%04x\n", address);
 296 #endif
 297     return 0xff;
 298 }
 299
 300 static void default_ioport_writeb(void *opaque, uint32_t address, uint32_t data)
 301 {
 302 #ifdef DEBUG_UNUSED_IOPORT
 303     fprintf(stderr, "unused outb: port=0x%04x data=0x%02x\n", address, data);
 304 #endif
 305 }
 306
 307 /* default is to make two byte accesses */
 308 static uint32_t default_ioport_readw(void *opaque, uint32_t address)
 309 {
 310     uint32_t data;
 311     data = ioport_read(0, address);
 312     address = (address + 1) & (MAX_IOPORTS - 1);
 313     data |= ioport_read(0, address) << 8;
 314     return data;
 315 }
 316
 317 static void default_ioport_writew(void *opaque, uint32_t address, uint32_t data)
 318 {
 319     ioport_write(0, address, data & 0xff);
 320     address = (address + 1) & (MAX_IOPORTS - 1);
 321     ioport_write(0, address, (data >> 8) & 0xff);
 322 }
 323
 324 static uint32_t default_ioport_readl(void *opaque, uint32_t address)
 325 {
 326 #ifdef DEBUG_UNUSED_IOPORT
 327     fprintf(stderr, "unused inl: port=0x%04x\n", address);
 328 #endif
 329     return 0xffffffff;
 330 }
 331
 332 static void default_ioport_writel(void *opaque, uint32_t address, uint32_t data)
 333 {
 334 #ifdef DEBUG_UNUSED_IOPORT
 335     fprintf(stderr, "unused outl: port=0x%04x data=0x%02x\n", address, data);
 336 #endif
 337 }
 338
 339 /* size is the word size in byte */
 340 int register_ioport_read(int start, int length, int size,
 341                          IOPortReadFunc *func, void *opaque)
 342 {
 343     int i, bsize;
 344
 345     if (size == 1) {
 346         bsize = 0;
 347     } else if (size == 2) {
 348         bsize = 1;
 349     } else if (size == 4) {
 350         bsize = 2;
 351     } else {
 352         hw_error("register_ioport_read: invalid size");
 353         return -1;
 354     }
 355     for(i = start; i < start + length; i += size) {
 356         ioport_read_table[bsize][i] = func;
 357         if (ioport_opaque[i] != NULL && ioport_opaque[i] != opaque)
 358             hw_error("register_ioport_read: invalid opaque");
 359         ioport_opaque[i] = opaque;
 360     }
 361     return 0;
 362 }
 363
 364 /* size is the word size in byte */
 365 int register_ioport_write(int start, int length, int size,
 366                           IOPortWriteFunc *func, void *opaque)
 367 {
 368     int i, bsize;
 369
 370     if (size == 1) {
 371         bsize = 0;
 372     } else if (size == 2) {
 373         bsize = 1;
 374     } else if (size == 4) {
 375         bsize = 2;
 376     } else {
 377         hw_error("register_ioport_write: invalid size");
 378         return -1;
 379     }
 380     for(i = start; i < start + length; i += size) {
 381         ioport_write_table[bsize][i] = func;
 382         if (ioport_opaque[i] != NULL && ioport_opaque[i] != opaque)
 383             hw_error("register_ioport_write: invalid opaque");
 384         ioport_opaque[i] = opaque;
 385     }
 386     return 0;
 387 }
 388
 389 void isa_unassign_ioport(int start, int length)
 390 {
 391     int i;
 392
 393     for(i = start; i < start + length; i++) {
 394         ioport_read_table[0][i] = default_ioport_readb;
 395         ioport_read_table[1][i] = default_ioport_readw;
 396         ioport_read_table[2][i] = default_ioport_readl;
 397
 398         ioport_write_table[0][i] = default_ioport_writeb;
 399         ioport_write_table[1][i] = default_ioport_writew;
 400         ioport_write_table[2][i] = default_ioport_writel;
 401     }
 402 }
 403
 404 /***********************************************************/
 405
 406 void cpu_outb(CPUState *env, int addr, int val)
 407 {
 408 #ifdef DEBUG_IOPORT
 409     if (loglevel & CPU_LOG_IOPORT)
 410         fprintf(logfile, "outb: %04x %02x\n", addr, val);
 411 #endif
 412     ioport_write(0, addr, val);
 413 #ifdef USE_KQEMU
 414     if (env)
 415         env->last_io_time = cpu_get_time_fast();
 416 #endif
 417 }
 418
 419 void cpu_outw(CPUState *env, int addr, int val)
 420 {
 421 #ifdef DEBUG_IOPORT
 422     if (loglevel & CPU_LOG_IOPORT)
 423         fprintf(logfile, "outw: %04x %04x\n", addr, val);
 424 #endif
 425     ioport_write(1, addr, val);
 426 #ifdef USE_KQEMU
 427     if (env)
 428         env->last_io_time = cpu_get_time_fast();
 429 #endif
 430 }
 431
 432 void cpu_outl(CPUState *env, int addr, int val)
 433 {
 434 #ifdef DEBUG_IOPORT
 435     if (loglevel & CPU_LOG_IOPORT)
 436         fprintf(logfile, "outl: %04x %08x\n", addr, val);
 437 #endif
 438     ioport_write(2, addr, val);
 439 #ifdef USE_KQEMU
 440     if (env)
 441         env->last_io_time = cpu_get_time_fast();
 442 #endif
 443 }
 444
 445 int cpu_inb(CPUState *env, int addr)
 446 {
 447     int val;
 448     val = ioport_read(0, addr);
 449 #ifdef DEBUG_IOPORT
 450     if (loglevel & CPU_LOG_IOPORT)
 451         fprintf(logfile, "inb : %04x %02x\n", addr, val);
 452 #endif
 453 #ifdef USE_KQEMU
 454     if (env)
 455         env->last_io_time = cpu_get_time_fast();
 456 #endif
 457     return val;
 458 }
 459
 460 int cpu_inw(CPUState *env, int addr)
 461 {
 462     int val;
 463     val = ioport_read(1, addr);
 464 #ifdef DEBUG_IOPORT
 465     if (loglevel & CPU_LOG_IOPORT)
 466         fprintf(logfile, "inw : %04x %04x\n", addr, val);
 467 #endif
 468 #ifdef USE_KQEMU
 469     if (env)
 470         env->last_io_time = cpu_get_time_fast();
 471 #endif
 472     return val;
 473 }
 474
 475 int cpu_inl(CPUState *env, int addr)
 476 {
 477     int val;
 478     val = ioport_read(2, addr);
 479 #ifdef DEBUG_IOPORT
 480     if (loglevel & CPU_LOG_IOPORT)
 481         fprintf(logfile, "inl : %04x %08x\n", addr, val);
 482 #endif
 483 #ifdef USE_KQEMU
 484     if (env)
 485         env->last_io_time = cpu_get_time_fast();
 486 #endif
 487     return val;
 488 }
 489
 490 /***********************************************************/
 491 void hw_error(const char *fmt, ...)
 492 {
 493     va_list ap;
 494     CPUState *env;
 495
 496     va_start(ap, fmt);
 497     fprintf(stderr, "qemu: hardware error: ");
 498     vfprintf(stderr, fmt, ap);
 499     fprintf(stderr, "\n");
 500     for(env = first_cpu; env != NULL; env = env->next_cpu) {
 501         fprintf(stderr, "CPU #%d:\n", env->cpu_index);
 502 #ifdef TARGET_I386
 503         cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU);
 504 #else
 505         cpu_dump_state(env, stderr, fprintf, 0);
 506 #endif
 507     }
 508     va_end(ap);
 509     abort();
 510 }
 511
 512 /***********************************************************/
 513 /* keyboard/mouse */
 514
 515 static QEMUPutKBDEvent *qemu_put_kbd_event;
 516 static void *qemu_put_kbd_event_opaque;
 517 static QEMUPutMouseEntry *qemu_put_mouse_event_head;
 518 static QEMUPutMouseEntry *qemu_put_mouse_event_current;
 519
 520 void qemu_add_kbd_event_handler(QEMUPutKBDEvent *func, void *opaque)
 521 {
 522     qemu_put_kbd_event_opaque = opaque;
 523     qemu_put_kbd_event = func;
 524 }
 525
 526 QEMUPutMouseEntry *qemu_add_mouse_event_handler(QEMUPutMouseEvent *func,
 527                                                 void *opaque, int absolute,
 528                                                 const char *name)
 529 {
 530     QEMUPutMouseEntry *s, *cursor;
 531
 532     s = qemu_mallocz(sizeof(QEMUPutMouseEntry));
 533     if (!s)
 534         return NULL;
 535
 536     s->qemu_put_mouse_event = func;
 537     s->qemu_put_mouse_event_opaque = opaque;
 538     s->qemu_put_mouse_event_absolute = absolute;
 539     s->qemu_put_mouse_event_name = qemu_strdup(name);
 540     s->next = NULL;
 541
 542     if (!qemu_put_mouse_event_head) {
 543         qemu_put_mouse_event_head = qemu_put_mouse_event_current = s;
 544         return s;
 545     }
 546
 547     cursor = qemu_put_mouse_event_head;
 548     while (cursor->next != NULL)
 549         cursor = cursor->next;
 550
 551     cursor->next = s;
 552     qemu_put_mouse_event_current = s;
 553
 554     return s;
 555 }
 556
 557 void qemu_remove_mouse_event_handler(QEMUPutMouseEntry *entry)
 558 {
 559     QEMUPutMouseEntry *prev = NULL, *cursor;
 560
 561     if (!qemu_put_mouse_event_head || entry == NULL)
 562         return;
 563
 564     cursor = qemu_put_mouse_event_head;
 565     while (cursor != NULL && cursor != entry) {
 566         prev = cursor;
 567         cursor = cursor->next;
 568     }
 569
 570     if (cursor == NULL) // does not exist or list empty
 571         return;
 572     else if (prev == NULL) { // entry is head
 573         qemu_put_mouse_event_head = cursor->next;
 574         if (qemu_put_mouse_event_current == entry)
 575             qemu_put_mouse_event_current = cursor->next;
 576         qemu_free(entry->qemu_put_mouse_event_name);
 577         qemu_free(entry);
 578         return;
 579     }
 580
 581     prev->next = entry->next;
 582
 583     if (qemu_put_mouse_event_current == entry)
 584         qemu_put_mouse_event_current = prev;
 585
 586     qemu_free(entry->qemu_put_mouse_event_name);
 587     qemu_free(entry);
 588 }
 589
 590 void kbd_put_keycode(int keycode)
 591 {
 592     if (qemu_put_kbd_event) {
 593         qemu_put_kbd_event(qemu_put_kbd_event_opaque, keycode);
 594     }
 595 }
 596
 597 void kbd_mouse_event(int dx, int dy, int dz, int buttons_state)
 598 {
 599     QEMUPutMouseEvent *mouse_event;
 600     void *mouse_event_opaque;
 601     int width;
 602
 603     if (!qemu_put_mouse_event_current) {
 604         return;
 605     }
 606
 607     mouse_event =
 608         qemu_put_mouse_event_current->qemu_put_mouse_event;
 609     mouse_event_opaque =
 610         qemu_put_mouse_event_current->qemu_put_mouse_event_opaque;
 611
 612     if (mouse_event) {
 613         if (graphic_rotate) {
 614             if (qemu_put_mouse_event_current->qemu_put_mouse_event_absolute)
 615                 width = 0x7fff;
 616             else
 617                 width = graphic_width - 1;
 618             mouse_event(mouse_event_opaque,
 619                                  width - dy, dx, dz, buttons_state);
 620         } else
 621             mouse_event(mouse_event_opaque,
 622                                  dx, dy, dz, buttons_state);
 623     }
 624 }
 625
 626 int kbd_mouse_is_absolute(void)
 627 {
 628     if (!qemu_put_mouse_event_current)
 629         return 0;
 630
 631     return qemu_put_mouse_event_current->qemu_put_mouse_event_absolute;
 632 }
 633
 634 void do_info_mice(void)
 635 {
 636     QEMUPutMouseEntry *cursor;
 637     int index = 0;
 638
 639     if (!qemu_put_mouse_event_head) {
 640         term_printf("No mouse devices connected\n");
 641         return;
 642     }
 643
 644     term_printf("Mouse devices available:\n");
 645     cursor = qemu_put_mouse_event_head;
 646     while (cursor != NULL) {
 647         term_printf("%c Mouse #%d: %s\n",
 648                     (cursor == qemu_put_mouse_event_current ? '*' : ' '),
 649                     index, cursor->qemu_put_mouse_event_name);
 650         index++;
 651         cursor = cursor->next;
 652     }
 653 }
 654
 655 void do_mouse_set(int index)
 656 {
 657     QEMUPutMouseEntry *cursor;
 658     int i = 0;
 659
 660     if (!qemu_put_mouse_event_head) {
 661         term_printf("No mouse devices connected\n");
 662         return;
 663     }
 664
 665     cursor = qemu_put_mouse_event_head;
 666     while (cursor != NULL && index != i) {
 667         i++;
 668         cursor = cursor->next;
 669     }
 670
 671     if (cursor != NULL)
 672         qemu_put_mouse_event_current = cursor;
 673     else
 674         term_printf("Mouse at given index not found\n");
 675 }
 676
 677 /* compute with 96 bit intermediate result: (a*b)/c */
 678 uint64_t muldiv64(uint64_t a, uint32_t b, uint32_t c)
 679 {
 680     union {
 681         uint64_t ll;
 682         struct {
 683 #ifdef WORDS_BIGENDIAN
 684             uint32_t high, low;
 685 #else
 686             uint32_t low, high;
 687 #endif
 688         } l;
 689     } u, res;
 690     uint64_t rl, rh;
 691
 692     u.ll = a;
 693     rl = (uint64_t)u.l.low * (uint64_t)b;
 694     rh = (uint64_t)u.l.high * (uint64_t)b;
 695     rh += (rl >> 32);
 696     res.l.high = rh / c;
 697     res.l.low = (((rh % c) << 32) + (rl & 0xffffffff)) / c;
 698     return res.ll;
 699 }
 700
 701 /***********************************************************/
 702 /* real time host monotonic timer */
 703
 704 #define QEMU_TIMER_BASE 1000000000LL
 705
 706 #ifdef WIN32
 707
 708 static int64_t clock_freq;
 709
 710 static void init_get_clock(void)
 711 {
 712     LARGE_INTEGER freq;
 713     int ret;
 714     ret = QueryPerformanceFrequency(&freq);
 715     if (ret == 0) {
 716         fprintf(stderr, "Could not calibrate ticks\n");
 717         exit(1);
 718     }
 719     clock_freq = freq.QuadPart;
 720 }
 721
 722 static int64_t get_clock(void)
 723 {
 724     LARGE_INTEGER ti;
 725     QueryPerformanceCounter(&ti);
 726     return muldiv64(ti.QuadPart, QEMU_TIMER_BASE, clock_freq);
 727 }
 728
 729 #else
 730
 731 static int use_rt_clock;
 732
 733 static void init_get_clock(void)
 734 {
 735     use_rt_clock = 0;
 736 #if defined(__linux__)
 737     {
 738         struct timespec ts;
 739         if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0) {
 740             use_rt_clock = 1;
 741         }
 742     }
 743 #endif
 744 }
 745
 746 static int64_t get_clock(void)
 747 {
 748 #if defined(__linux__)
 749     if (use_rt_clock) {
 750         struct timespec ts;
 751         clock_gettime(CLOCK_MONOTONIC, &ts);
 752         return ts.tv_sec * 1000000000LL + ts.tv_nsec;
 753     } else
 754 #endif
 755     {
 756         /* XXX: using gettimeofday leads to problems if the date
 757            changes, so it should be avoided. */
 758         struct timeval tv;
 759         gettimeofday(&tv, NULL);
 760         return tv.tv_sec * 1000000000LL + (tv.tv_usec * 1000);
 761     }
 762 }
 763 #endif
 764
 765 /* Return the virtual CPU time, based on the instruction counter.  */
 766 static int64_t cpu_get_icount(void)
 767 {
 768     int64_t icount;
 769     CPUState *env = cpu_single_env;;
 770     icount = qemu_icount;
 771     if (env) {
 772         if (!can_do_io(env))
 773             fprintf(stderr, "Bad clock read\n");
 774         icount -= (env->icount_decr.u16.low + env->icount_extra);
 775     }
 776     return qemu_icount_bias + (icount << icount_time_shift);
 777 }
 778
 779 /***********************************************************/
 780 /* guest cycle counter */
 781
 782 static int64_t cpu_ticks_prev;
 783 static int64_t cpu_ticks_offset;
 784 static int64_t cpu_clock_offset;
 785 static int cpu_ticks_enabled;
 786
 787 /* return the host CPU cycle counter and handle stop/restart */
 788 int64_t cpu_get_ticks(void)
 789 {
 790     if (use_icount) {
 791         return cpu_get_icount();
 792     }
 793     if (!cpu_ticks_enabled) {
 794         return cpu_ticks_offset;
 795     } else {
 796         int64_t ticks;
 797         ticks = cpu_get_real_ticks();
 798         if (cpu_ticks_prev > ticks) {
 799             /* Note: non increasing ticks may happen if the host uses
 800                software suspend */
 801             cpu_ticks_offset += cpu_ticks_prev - ticks;
 802         }
 803         cpu_ticks_prev = ticks;
 804         return ticks + cpu_ticks_offset;
 805     }
 806 }
 807
 808 /* return the host CPU monotonic timer and handle stop/restart */
 809 static int64_t cpu_get_clock(void)
 810 {
 811     int64_t ti;
 812     if (!cpu_ticks_enabled) {
 813         return cpu_clock_offset;
 814     } else {
 815         ti = get_clock();
 816         return ti + cpu_clock_offset;
 817     }
 818 }
 819
 820 /* enable cpu_get_ticks() */
 821 void cpu_enable_ticks(void)
 822 {
 823     if (!cpu_ticks_enabled) {
 824         cpu_ticks_offset -= cpu_get_real_ticks();
 825         cpu_clock_offset -= get_clock();
 826         cpu_ticks_enabled = 1;
 827     }
 828 }
 829
 830 /* disable cpu_get_ticks() : the clock is stopped. You must not call
 831    cpu_get_ticks() after that.  */
 832 void cpu_disable_ticks(void)
 833 {
 834     if (cpu_ticks_enabled) {
 835         cpu_ticks_offset = cpu_get_ticks();
 836         cpu_clock_offset = cpu_get_clock();
 837         cpu_ticks_enabled = 0;
 838     }
 839 }
 840
 841 /***********************************************************/
 842 /* timers */
 843
 844 #define QEMU_TIMER_REALTIME 0
 845 #define QEMU_TIMER_VIRTUAL  1
 846
 847 struct QEMUClock {
 848     int type;
 849     /* XXX: add frequency */
 850 };
 851
 852 struct QEMUTimer {
 853     QEMUClock *clock;
 854     int64_t expire_time;
 855     QEMUTimerCB *cb;
 856     void *opaque;
 857     struct QEMUTimer *next;
 858 };
 859
 860 struct qemu_alarm_timer {
 861     char const *name;
 862     unsigned int flags;
 863
 864     int (*start)(struct qemu_alarm_timer *t);
 865     void (*stop)(struct qemu_alarm_timer *t);
 866     void (*rearm)(struct qemu_alarm_timer *t);
 867     void *priv;
 868 };
 869
 870 #define ALARM_FLAG_DYNTICKS  0x1
 871 #define ALARM_FLAG_EXPIRED   0x2
 872
 873 static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
 874 {
 875     return t->flags & ALARM_FLAG_DYNTICKS;
 876 }
 877
 878 static void qemu_rearm_alarm_timer(struct qemu_alarm_timer *t)
 879 {
 880     if (!alarm_has_dynticks(t))
 881         return;
 882
 883     t->rearm(t);
 884 }
 885
 886 /* TODO: MIN_TIMER_REARM_US should be optimized */
 887 #define MIN_TIMER_REARM_US 250
 888
 889 static struct qemu_alarm_timer *alarm_timer;
 890
 891 #ifdef _WIN32
 892
 893 struct qemu_alarm_win32 {
 894     MMRESULT timerId;
 895     HANDLE host_alarm;
 896     unsigned int period;
 897 } alarm_win32_data = {0, NULL, -1};
 898
 899 static int win32_start_timer(struct qemu_alarm_timer *t);
 900 static void win32_stop_timer(struct qemu_alarm_timer *t);
 901 static void win32_rearm_timer(struct qemu_alarm_timer *t);
 902
 903 #else
 904
 905 static int unix_start_timer(struct qemu_alarm_timer *t);
 906 static void unix_stop_timer(struct qemu_alarm_timer *t);
 907
 908 #ifdef __linux__
 909
 910 static int dynticks_start_timer(struct qemu_alarm_timer *t);
 911 static void dynticks_stop_timer(struct qemu_alarm_timer *t);
 912 static void dynticks_rearm_timer(struct qemu_alarm_timer *t);
 913
 914 static int hpet_start_timer(struct qemu_alarm_timer *t);
 915 static void hpet_stop_timer(struct qemu_alarm_timer *t);
 916
 917 static int rtc_start_timer(struct qemu_alarm_timer *t);
 918 static void rtc_stop_timer(struct qemu_alarm_timer *t);
 919
 920 #endif /* __linux__ */
 921
 922 #endif /* _WIN32 */
 923
 924 /* Correlation between real and virtual time is always going to be
 925    fairly approximate, so ignore small variation.
 926    When the guest is idle real and virtual time will be aligned in
 927    the IO wait loop.  */
 928 #define ICOUNT_WOBBLE (QEMU_TIMER_BASE / 10)
 929
 930 static void icount_adjust(void)
 931 {
 932     int64_t cur_time;
 933     int64_t cur_icount;
 934     int64_t delta;
 935     static int64_t last_delta;
 936     /* If the VM is not running, then do nothing.  */
 937     if (!vm_running)
 938         return;
 939
 940     cur_time = cpu_get_clock();
 941     cur_icount = qemu_get_clock(vm_clock);
 942     delta = cur_icount - cur_time;
 943     /* FIXME: This is a very crude algorithm, somewhat prone to oscillation.  */
 944     if (delta > 0
 945         && last_delta + ICOUNT_WOBBLE < delta * 2
 946         && icount_time_shift > 0) {
 947         /* The guest is getting too far ahead.  Slow time down.  */
 948         icount_time_shift--;
 949     }
 950     if (delta < 0
 951         && last_delta - ICOUNT_WOBBLE > delta * 2
 952         && icount_time_shift < MAX_ICOUNT_SHIFT) {
 953         /* The guest is getting too far behind.  Speed time up.  */
 954         icount_time_shift++;
 955     }
 956     last_delta = delta;
 957     qemu_icount_bias = cur_icount - (qemu_icount << icount_time_shift);
 958 }
 959
 960 static void icount_adjust_rt(void * opaque)
 961 {
 962     qemu_mod_timer(icount_rt_timer,
 963                    qemu_get_clock(rt_clock) + 1000);
 964     icount_adjust();
 965 }
 966
 967 static void icount_adjust_vm(void * opaque)
 968 {
 969     qemu_mod_timer(icount_vm_timer,
 970                    qemu_get_clock(vm_clock) + QEMU_TIMER_BASE / 10);
 971     icount_adjust();
 972 }
 973
 974 static void init_icount_adjust(void)
 975 {
 976     /* Have both realtime and virtual time triggers for speed adjustment.
 977        The realtime trigger catches emulated time passing too slowly,
 978        the virtual time trigger catches emulated time passing too fast.
 979        Realtime triggers occur even when idle, so use them less frequently
 980        than VM triggers.  */
 981     icount_rt_timer = qemu_new_timer(rt_clock, icount_adjust_rt, NULL);
 982     qemu_mod_timer(icount_rt_timer,
 983                    qemu_get_clock(rt_clock) + 1000);
 984     icount_vm_timer = qemu_new_timer(vm_clock, icount_adjust_vm, NULL);
 985     qemu_mod_timer(icount_vm_timer,
 986                    qemu_get_clock(vm_clock) + QEMU_TIMER_BASE / 10);
 987 }
 988
 989 static struct qemu_alarm_timer alarm_timers[] = {
 990 #ifndef _WIN32
 991 #ifdef __linux__
 992     {"dynticks", ALARM_FLAG_DYNTICKS, dynticks_start_timer,
 993      dynticks_stop_timer, dynticks_rearm_timer, NULL},
 994     /* HPET - if available - is preferred */
 995     {"hpet", 0, hpet_start_timer, hpet_stop_timer, NULL, NULL},
 996     /* ...otherwise try RTC */
 997     {"rtc", 0, rtc_start_timer, rtc_stop_timer, NULL, NULL},
 998 #endif
 999     {"unix", 0, unix_start_timer, unix_stop_timer, NULL, NULL},
1000 #else
1001     {"dynticks", ALARM_FLAG_DYNTICKS, win32_start_timer,
1002      win32_stop_timer, win32_rearm_timer, &alarm_win32_data},
1003     {"win32", 0, win32_start_timer,
1004      win32_stop_timer, NULL, &alarm_win32_data},
1005 #endif
1006     {NULL, }
1007 };
1008
1009 static void show_available_alarms(void)
1010 {
1011     int i;
1012
1013     printf("Available alarm timers, in order of precedence:\n");
1014     for (i = 0; alarm_timers[i].name; i++)
1015         printf("%s\n", alarm_timers[i].name);
1016 }
1017
1018 static void configure_alarms(char const *opt)
1019 {
1020     int i;
1021     int cur = 0;
1022     int count = (sizeof(alarm_timers) / sizeof(*alarm_timers)) - 1;
1023     char *arg;
1024     char *name;
1025     struct qemu_alarm_timer tmp;
1026
1027     if (!strcmp(opt, "?")) {
1028         show_available_alarms();
1029         exit(0);
1030     }
1031
1032     arg = strdup(opt);
1033
1034     /* Reorder the array */
1035     name = strtok(arg, ",");
1036     while (name) {
1037         for (i = 0; i < count && alarm_timers[i].name; i++) {
1038             if (!strcmp(alarm_timers[i].name, name))
1039                 break;
1040         }
1041
1042         if (i == count) {
1043             fprintf(stderr, "Unknown clock %s\n", name);
1044             goto next;
1045         }
1046
1047         if (i < cur)
1048             /* Ignore */
1049             goto next;
1050
1051         /* Swap */
1052         tmp = alarm_timers[i];
1053         alarm_timers[i] = alarm_timers[cur];
1054         alarm_timers[cur] = tmp;
1055
1056         cur++;
1057 next:
1058         name = strtok(NULL, ",");
1059     }
1060
1061     free(arg);
1062
1063     if (cur) {
1064         /* Disable remaining timers */
1065         for (i = cur; i < count; i++)
1066             alarm_timers[i].name = NULL;
1067     } else {
1068         show_available_alarms();
1069         exit(1);
1070     }
1071 }
1072
1073 QEMUClock *rt_clock;
1074 QEMUClock *vm_clock;
1075
1076 static QEMUTimer *active_timers[2];
1077
1078 static QEMUClock *qemu_new_clock(int type)
1079 {
1080     QEMUClock *clock;
1081     clock = qemu_mallocz(sizeof(QEMUClock));
1082     if (!clock)
1083         return NULL;
1084     clock->type = type;
1085     return clock;
1086 }
1087
1088 QEMUTimer *qemu_new_timer(QEMUClock *clock, QEMUTimerCB *cb, void *opaque)
1089 {
1090     QEMUTimer *ts;
1091
1092     ts = qemu_mallocz(sizeof(QEMUTimer));
1093     ts->clock = clock;
1094     ts->cb = cb;
1095     ts->opaque = opaque;
1096     return ts;
1097 }
1098
1099 void qemu_free_timer(QEMUTimer *ts)
1100 {
1101     qemu_free(ts);
1102 }
1103
1104 /* stop a timer, but do not dealloc it */
1105 void qemu_del_timer(QEMUTimer *ts)
1106 {
1107     QEMUTimer **pt, *t;
1108
1109     /* NOTE: this code must be signal safe because
1110        qemu_timer_expired() can be called from a signal. */
1111     pt = &active_timers[ts->clock->type];
1112     for(;;) {
1113         t = *pt;
1114         if (!t)
1115             break;
1116         if (t == ts) {
1117             *pt = t->next;
1118             break;
1119         }
1120         pt = &t->next;
1121     }
1122 }
1123
1124 /* modify the current timer so that it will be fired when current_time
1125    >= expire_time. The corresponding callback will be called. */
1126 void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
1127 {
1128     QEMUTimer **pt, *t;
1129
1130     qemu_del_timer(ts);
1131
1132     /* add the timer in the sorted list */
1133     /* NOTE: this code must be signal safe because
1134        qemu_timer_expired() can be called from a signal. */
1135     pt = &active_timers[ts->clock->type];
1136     for(;;) {
1137         t = *pt;
1138         if (!t)
1139             break;
1140         if (t->expire_time > expire_time)
1141             break;
1142         pt = &t->next;
1143     }
1144     ts->expire_time = expire_time;
1145     ts->next = *pt;
1146     *pt = ts;
1147
1148     /* Rearm if necessary  */
1149     if (pt == &active_timers[ts->clock->type]) {
1150         if ((alarm_timer->flags & ALARM_FLAG_EXPIRED) == 0) {
1151             qemu_rearm_alarm_timer(alarm_timer);
1152         }
1153         /* Interrupt execution to force deadline recalculation.  */
1154         if (use_icount && cpu_single_env) {
1155             cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
1156         }
1157     }
1158 }
1159
1160 int qemu_timer_pending(QEMUTimer *ts)
1161 {
1162     QEMUTimer *t;
1163     for(t = active_timers[ts->clock->type]; t != NULL; t = t->next) {
1164         if (t == ts)
1165             return 1;
1166     }
1167     return 0;
1168 }
1169
1170 static inline int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)
1171 {
1172     if (!timer_head)
1173         return 0;
1174     return (timer_head->expire_time <= current_time);
1175 }
1176
1177 static void qemu_run_timers(QEMUTimer **ptimer_head, int64_t current_time)
1178 {
1179     QEMUTimer *ts;
1180
1181     for(;;) {
1182         ts = *ptimer_head;
1183         if (!ts || ts->expire_time > current_time)
1184             break;
1185         /* remove timer from the list before calling the callback */
1186         *ptimer_head = ts->next;
1187         ts->next = NULL;
1188
1189         /* run the callback (the timer list can be modified) */
1190         ts->cb(ts->opaque);
1191     }
1192 }
1193
1194 int64_t qemu_get_clock(QEMUClock *clock)
1195 {
1196     switch(clock->type) {
1197     case QEMU_TIMER_REALTIME:
1198         return get_clock() / 1000000;
1199     default:
1200     case QEMU_TIMER_VIRTUAL:
1201         if (use_icount) {
1202             return cpu_get_icount();
1203         } else {
1204             return cpu_get_clock();
1205         }
1206     }
1207 }
1208
1209 static void init_timers(void)
1210 {
1211     init_get_clock();
1212     ticks_per_sec = QEMU_TIMER_BASE;
1213     rt_clock = qemu_new_clock(QEMU_TIMER_REALTIME);
1214     vm_clock = qemu_new_clock(QEMU_TIMER_VIRTUAL);
1215 }
1216
1217 /* save a timer */
1218 void qemu_put_timer(QEMUFile *f, QEMUTimer *ts)
1219 {
1220     uint64_t expire_time;
1221
1222     if (qemu_timer_pending(ts)) {
1223         expire_time = ts->expire_time;
1224     } else {
1225         expire_time = -1;
1226     }
1227     qemu_put_be64(f, expire_time);
1228 }
1229
1230 void qemu_get_timer(QEMUFile *f, QEMUTimer *ts)
1231 {
1232     uint64_t expire_time;
1233
1234     expire_time = qemu_get_be64(f);
1235     if (expire_time != -1) {
1236         qemu_mod_timer(ts, expire_time);
1237     } else {
1238         qemu_del_timer(ts);
1239     }
1240 }
1241
1242 static void timer_save(QEMUFile *f, void *opaque)
1243 {
1244     if (cpu_ticks_enabled) {
1245         hw_error("cannot save state if virtual timers are running");
1246     }
1247     qemu_put_be64(f, cpu_ticks_offset);
1248     qemu_put_be64(f, ticks_per_sec);
1249     qemu_put_be64(f, cpu_clock_offset);
1250 }
1251
1252 static int timer_load(QEMUFile *f, void *opaque, int version_id)
1253 {
1254     if (version_id != 1 && version_id != 2)
1255         return -EINVAL;
1256     if (cpu_ticks_enabled) {
1257         return -EINVAL;
1258     }
1259     cpu_ticks_offset=qemu_get_be64(f);
1260     ticks_per_sec=qemu_get_be64(f);
1261     if (version_id == 2) {
1262         cpu_clock_offset=qemu_get_be64(f);
1263     }
1264     return 0;
1265 }
1266
1267 #ifdef _WIN32
1268 void CALLBACK host_alarm_handler(UINT uTimerID, UINT uMsg,
1269                                  DWORD_PTR dwUser, DWORD_PTR dw1, DWORD_PTR dw2)
1270 #else
1271 static void host_alarm_handler(int host_signum)
1272 #endif
1273 {
1274 #if 0
1275 #define DISP_FREQ 1000
1276     {
1277         static int64_t delta_min = INT64_MAX;
1278         static int64_t delta_max, delta_cum, last_clock, delta, ti;
1279         static int count;
1280         ti = qemu_get_clock(vm_clock);
1281         if (last_clock != 0) {
1282             delta = ti - last_clock;
1283             if (delta < delta_min)
1284                 delta_min = delta;
1285             if (delta > delta_max)
1286                 delta_max = delta;
1287             delta_cum += delta;
1288             if (++count == DISP_FREQ) {
1289                 printf("timer: min=%" PRId64 " us max=%" PRId64 " us avg=%" PRId64 " us avg_freq=%0.3f Hz\n",
1290                        muldiv64(delta_min, 1000000, ticks_per_sec),
1291                        muldiv64(delta_max, 1000000, ticks_per_sec),
1292                        muldiv64(delta_cum, 1000000 / DISP_FREQ, ticks_per_sec),
1293                        (double)ticks_per_sec / ((double)delta_cum / DISP_FREQ));
1294                 count = 0;
1295                 delta_min = INT64_MAX;
1296                 delta_max = 0;
1297                 delta_cum = 0;
1298             }
1299         }
1300         last_clock = ti;
1301     }
1302 #endif
1303     if (alarm_has_dynticks(alarm_timer) ||
1304         (!use_icount &&
1305             qemu_timer_expired(active_timers[QEMU_TIMER_VIRTUAL],
1306                                qemu_get_clock(vm_clock))) ||
1307         qemu_timer_expired(active_timers[QEMU_TIMER_REALTIME],
1308                            qemu_get_clock(rt_clock))) {
1309 #ifdef _WIN32
1310         struct qemu_alarm_win32 *data = ((struct qemu_alarm_timer*)dwUser)->priv;
1311         SetEvent(data->host_alarm);
1312 #endif
1313         CPUState *env = next_cpu;
1314
1315         alarm_timer->flags |= ALARM_FLAG_EXPIRED;
1316
1317         if (env) {
1318             /* stop the currently executing cpu because a timer occured */
1319             cpu_interrupt(env, CPU_INTERRUPT_EXIT);
1320 #ifdef USE_KQEMU
1321             if (env->kqemu_enabled) {
1322                 kqemu_cpu_interrupt(env);
1323             }
1324 #endif
1325         }
1326         event_pending = 1;
1327     }
1328 }
1329
1330 static int64_t qemu_next_deadline(void)
1331 {
1332     int64_t delta;
1333
1334     if (active_timers[QEMU_TIMER_VIRTUAL]) {
1335         delta = active_timers[QEMU_TIMER_VIRTUAL]->expire_time -
1336                      qemu_get_clock(vm_clock);
1337     } else {
1338         /* To avoid problems with overflow limit this to 2^32.  */
1339         delta = INT32_MAX;
1340     }
1341
1342     if (delta < 0)
1343         delta = 0;
1344
1345     return delta;
1346 }
1347
1348 static uint64_t qemu_next_deadline_dyntick(void)
1349 {
1350     int64_t delta;
1351     int64_t rtdelta;
1352
1353     if (use_icount)
1354         delta = INT32_MAX;
1355     else
1356         delta = (qemu_next_deadline() + 999) / 1000;
1357
1358     if (active_timers[QEMU_TIMER_REALTIME]) {
1359         rtdelta = (active_timers[QEMU_TIMER_REALTIME]->expire_time -
1360                  qemu_get_clock(rt_clock))*1000;
1361         if (rtdelta < delta)
1362             delta = rtdelta;
1363     }
1364
1365     if (delta < MIN_TIMER_REARM_US)
1366         delta = MIN_TIMER_REARM_US;
1367
1368     return delta;
1369 }
1370
1371 #ifndef _WIN32
1372
1373 #if defined(__linux__)
1374
1375 #define RTC_FREQ 1024
1376
1377 static void enable_sigio_timer(int fd)
1378 {
1379     struct sigaction act;
1380
1381     /* timer signal */
1382     sigfillset(&act.sa_mask);
1383     act.sa_flags = 0;
1384     act.sa_handler = host_alarm_handler;
1385
1386     sigaction(SIGIO, &act, NULL);
1387     fcntl(fd, F_SETFL, O_ASYNC);
1388     fcntl(fd, F_SETOWN, getpid());
1389 }
1390
1391 static int hpet_start_timer(struct qemu_alarm_timer *t)
1392 {
1393     struct hpet_info info;
1394     int r, fd;
1395
1396     fd = open("/dev/hpet", O_RDONLY);
1397     if (fd < 0)
1398         return -1;
1399
1400     /* Set frequency */
1401     r = ioctl(fd, HPET_IRQFREQ, RTC_FREQ);
1402     if (r < 0) {
1403         fprintf(stderr, "Could not configure '/dev/hpet' to have a 1024Hz timer. This is not a fatal\n"
1404                 "error, but for better emulation accuracy type:\n"
1405                 "'echo 1024 > /proc/sys/dev/hpet/max-user-freq' as root.\n");
1406         goto fail;
1407     }
1408
1409     /* Check capabilities */
1410     r = ioctl(fd, HPET_INFO, &info);
1411     if (r < 0)
1412         goto fail;
1413
1414     /* Enable periodic mode */
1415     r = ioctl(fd, HPET_EPI, 0);
1416     if (info.hi_flags && (r < 0))
1417         goto fail;
1418
1419     /* Enable interrupt */
1420     r = ioctl(fd, HPET_IE_ON, 0);
1421     if (r < 0)
1422         goto fail;
1423
1424     enable_sigio_timer(fd);
1425     t->priv = (void *)(long)fd;
1426
1427     return 0;
1428 fail:
1429     close(fd);
1430     return -1;
1431 }
1432
1433 static void hpet_stop_timer(struct qemu_alarm_timer *t)
1434 {
1435     int fd = (long)t->priv;
1436
1437     close(fd);
1438 }
1439
1440 static int rtc_start_timer(struct qemu_alarm_timer *t)
1441 {
1442     int rtc_fd;
1443     unsigned long current_rtc_freq = 0;
1444
1445     TFR(rtc_fd = open("/dev/rtc", O_RDONLY));
1446     if (rtc_fd < 0)
1447         return -1;
1448     ioctl(rtc_fd, RTC_IRQP_READ, &current_rtc_freq);
1449     if (current_rtc_freq != RTC_FREQ &&
1450         ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
1451         fprintf(stderr, "Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\n"
1452                 "error, but for better emulation accuracy either use a 2.6 host Linux kernel or\n"
1453                 "type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\n");
1454         goto fail;
1455     }
1456     if (ioctl(rtc_fd, RTC_PIE_ON, 0) < 0) {
1457     fail:
1458         close(rtc_fd);
1459         return -1;
1460     }
1461
1462     enable_sigio_timer(rtc_fd);
1463
1464     t->priv = (void *)(long)rtc_fd;
1465
1466     return 0;
1467 }
1468
1469 static void rtc_stop_timer(struct qemu_alarm_timer *t)
1470 {
1471     int rtc_fd = (long)t->priv;
1472
1473     close(rtc_fd);
1474 }
1475
1476 static int dynticks_start_timer(struct qemu_alarm_timer *t)
1477 {
1478     struct sigevent ev;
1479     timer_t host_timer;
1480     struct sigaction act;
1481
1482     sigfillset(&act.sa_mask);
1483     act.sa_flags = 0;
1484     act.sa_handler = host_alarm_handler;
1485
1486     sigaction(SIGALRM, &act, NULL);
1487
1488     ev.sigev_value.sival_int = 0;
1489     ev.sigev_notify = SIGEV_SIGNAL;
1490     ev.sigev_signo = SIGALRM;
1491
1492     if (timer_create(CLOCK_REALTIME, &ev, &host_timer)) {
1493         perror("timer_create");
1494
1495         /* disable dynticks */
1496         fprintf(stderr, "Dynamic Ticks disabled\n");
1497
1498         return -1;
1499     }
1500
1501     t->priv = (void *)host_timer;
1502
1503     return 0;
1504 }
1505
1506 static void dynticks_stop_timer(struct qemu_alarm_timer *t)
1507 {
1508     timer_t host_timer = (timer_t)t->priv;
1509
1510     timer_delete(host_timer);
1511 }
1512
1513 static void dynticks_rearm_timer(struct qemu_alarm_timer *t)
1514 {
1515     timer_t host_timer = (timer_t)t->priv;
1516     struct itimerspec timeout;
1517     int64_t nearest_delta_us = INT64_MAX;
1518     int64_t current_us;
1519
1520     if (!active_timers[QEMU_TIMER_REALTIME] &&
1521                 !active_timers[QEMU_TIMER_VIRTUAL])
1522         return;
1523
1524     nearest_delta_us = qemu_next_deadline_dyntick();
1525
1526     /* check whether a timer is already running */
1527     if (timer_gettime(host_timer, &timeout)) {
1528         perror("gettime");
1529         fprintf(stderr, "Internal timer error: aborting\n");
1530         exit(1);
1531     }
1532     current_us = timeout.it_value.tv_sec * 1000000 + timeout.it_value.tv_nsec/1000;
1533     if (current_us && current_us <= nearest_delta_us)
1534         return;
1535
1536     timeout.it_interval.tv_sec = 0;
1537     timeout.it_interval.tv_nsec = 0; /* 0 for one-shot timer */
1538     timeout.it_value.tv_sec =  nearest_delta_us / 1000000;
1539     timeout.it_value.tv_nsec = (nearest_delta_us % 1000000) * 1000;
1540     if (timer_settime(host_timer, 0 /* RELATIVE */, &timeout, NULL)) {
1541         perror("settime");
1542         fprintf(stderr, "Internal timer error: aborting\n");
1543         exit(1);
1544     }
1545 }
1546
1547 #endif /* defined(__linux__) */
1548
1549 static int unix_start_timer(struct qemu_alarm_timer *t)
1550 {
1551     struct sigaction act;
1552     struct itimerval itv;
1553     int err;
1554
1555     /* timer signal */
1556     sigfillset(&act.sa_mask);
1557     act.sa_flags = 0;
1558     act.sa_handler = host_alarm_handler;
1559
1560     sigaction(SIGALRM, &act, NULL);
1561
1562     itv.it_interval.tv_sec = 0;
1563     /* for i386 kernel 2.6 to get 1 ms */
1564     itv.it_interval.tv_usec = 999;
1565     itv.it_value.tv_sec = 0;
1566     itv.it_value.tv_usec = 10 * 1000;
1567
1568     err = setitimer(ITIMER_REAL, &itv, NULL);
1569     if (err)
1570         return -1;
1571
1572     return 0;
1573 }
1574
1575 static void unix_stop_timer(struct qemu_alarm_timer *t)
1576 {
1577     struct itimerval itv;
1578
1579     memset(&itv, 0, sizeof(itv));
1580     setitimer(ITIMER_REAL, &itv, NULL);
1581 }
1582
1583 #endif /* !defined(_WIN32) */
1584
1585 #ifdef _WIN32
1586
1587 static int win32_start_timer(struct qemu_alarm_timer *t)
1588 {
1589     TIMECAPS tc;
1590     struct qemu_alarm_win32 *data = t->priv;
1591     UINT flags;
1592
1593     data->host_alarm = CreateEvent(NULL, FALSE, FALSE, NULL);
1594     if (!data->host_alarm) {
1595         perror("Failed CreateEvent");
1596         return -1;
1597     }
1598
1599     memset(&tc, 0, sizeof(tc));
1600     timeGetDevCaps(&tc, sizeof(tc));
1601
1602     if (data->period < tc.wPeriodMin)
1603         data->period = tc.wPeriodMin;
1604
1605     timeBeginPeriod(data->period);
1606
1607     flags = TIME_CALLBACK_FUNCTION;
1608     if (alarm_has_dynticks(t))
1609         flags |= TIME_ONESHOT;
1610     else
1611         flags |= TIME_PERIODIC;
1612
1613     data->timerId = timeSetEvent(1,         // interval (ms)
1614                         data->period,       // resolution
1615                         host_alarm_handler, // function
1616                         (DWORD)t,           // parameter
1617                         flags);
1618
1619     if (!data->timerId) {
1620         perror("Failed to initialize win32 alarm timer");
1621
1622         timeEndPeriod(data->period);
1623         CloseHandle(data->host_alarm);
1624         return -1;
1625     }
1626
1627     qemu_add_wait_object(data->host_alarm, NULL, NULL);
1628
1629     return 0;
1630 }
1631
1632 static void win32_stop_timer(struct qemu_alarm_timer *t)
1633 {
1634     struct qemu_alarm_win32 *data = t->priv;
1635
1636     timeKillEvent(data->timerId);
1637     timeEndPeriod(data->period);
1638
1639     CloseHandle(data->host_alarm);
1640 }
1641
1642 static void win32_rearm_timer(struct qemu_alarm_timer *t)
1643 {
1644     struct qemu_alarm_win32 *data = t->priv;
1645     uint64_t nearest_delta_us;
1646
1647     if (!active_timers[QEMU_TIMER_REALTIME] &&
1648                 !active_timers[QEMU_TIMER_VIRTUAL])
1649         return;
1650
1651     nearest_delta_us = qemu_next_deadline_dyntick();
1652     nearest_delta_us /= 1000;
1653
1654     timeKillEvent(data->timerId);
1655
1656     data->timerId = timeSetEvent(1,
1657                         data->period,
1658                         host_alarm_handler,
1659                         (DWORD)t,
1660                         TIME_ONESHOT | TIME_PERIODIC);
1661
1662     if (!data->timerId) {
1663         perror("Failed to re-arm win32 alarm timer");
1664
1665         timeEndPeriod(data->period);
1666         CloseHandle(data->host_alarm);
1667         exit(1);
1668     }
1669 }
1670
1671 #endif /* _WIN32 */
1672
1673 static void init_timer_alarm(void)
1674 {
1675     struct qemu_alarm_timer *t;
1676     int i, err = -1;
1677
1678     for (i = 0; alarm_timers[i].name; i++) {
1679         t = &alarm_timers[i];
1680
1681         err = t->start(t);
1682         if (!err)
1683             break;
1684     }
1685
1686     if (err) {
1687         fprintf(stderr, "Unable to find any suitable alarm timer.\n");
1688         fprintf(stderr, "Terminating\n");
1689         exit(1);
1690     }
1691
1692     alarm_timer = t;
1693 }
1694
1695 static void quit_timers(void)
1696 {
1697     alarm_timer->stop(alarm_timer);
1698     alarm_timer = NULL;
1699 }
1700
1701 /***********************************************************/
1702 /* host time/date access */
1703 void qemu_get_timedate(struct tm *tm, int offset)
1704 {
1705     time_t ti;
1706     struct tm *ret;
1707
1708     time(&ti);
1709     ti += offset;
1710     if (rtc_date_offset == -1) {
1711         if (rtc_utc)
1712             ret = gmtime(&ti);
1713         else
1714             ret = localtime(&ti);
1715     } else {
1716         ti -= rtc_date_offset;
1717         ret = gmtime(&ti);
1718     }
1719
1720     memcpy(tm, ret, sizeof(struct tm));
1721 }
1722
1723 int qemu_timedate_diff(struct tm *tm)
1724 {
1725     time_t seconds;
1726
1727     if (rtc_date_offset == -1)
1728         if (rtc_utc)
1729             seconds = mktimegm(tm);
1730         else
1731             seconds = mktime(tm);
1732     else
1733         seconds = mktimegm(tm) + rtc_date_offset;
1734
1735     return seconds - time(NULL);
1736 }
1737
1738 /***********************************************************/
1739 /* character device */
1740
1741 static void qemu_chr_event(CharDriverState *s, int event)
1742 {
1743     if (!s->chr_event)
1744         return;
1745     s->chr_event(s->handler_opaque, event);
1746 }
1747
1748 static void qemu_chr_reset_bh(void *opaque)
1749 {
1750     CharDriverState *s = opaque;
1751     qemu_chr_event(s, CHR_EVENT_RESET);
1752     qemu_bh_delete(s->bh);
1753     s->bh = NULL;
1754 }
1755
1756 void qemu_chr_reset(CharDriverState *s)
1757 {
1758     if (s->bh == NULL) {
1759         s->bh = qemu_bh_new(qemu_chr_reset_bh, s);
1760         qemu_bh_schedule(s->bh);
1761     }
1762 }
1763
1764 int qemu_chr_write(CharDriverState *s, const uint8_t *buf, int len)
1765 {
1766     return s->chr_write(s, buf, len);
1767 }
1768
1769 int qemu_chr_ioctl(CharDriverState *s, int cmd, void *arg)
1770 {
1771     if (!s->chr_ioctl)
1772         return -ENOTSUP;
1773     return s->chr_ioctl(s, cmd, arg);
1774 }
1775
1776 int qemu_chr_can_read(CharDriverState *s)
1777 {
1778     if (!s->chr_can_read)
1779         return 0;
1780     return s->chr_can_read(s->handler_opaque);
1781 }
1782
1783 void qemu_chr_read(CharDriverState *s, uint8_t *buf, int len)
1784 {
1785     s->chr_read(s->handler_opaque, buf, len);
1786 }
1787
1788 void qemu_chr_accept_input(CharDriverState *s)
1789 {
1790     if (s->chr_accept_input)
1791         s->chr_accept_input(s);
1792 }
1793
1794 void qemu_chr_printf(CharDriverState *s, const char *fmt, ...)
1795 {
1796     char buf[4096];
1797     va_list ap;
1798     va_start(ap, fmt);
1799     vsnprintf(buf, sizeof(buf), fmt, ap);
1800     qemu_chr_write(s, (uint8_t *)buf, strlen(buf));
1801     va_end(ap);
1802 }
1803
1804 void qemu_chr_send_event(CharDriverState *s, int event)
1805 {
1806     if (s->chr_send_event)
1807         s->chr_send_event(s, event);
1808 }
1809
1810 void qemu_chr_add_handlers(CharDriverState *s,
1811                            IOCanRWHandler *fd_can_read,
1812                            IOReadHandler *fd_read,
1813                            IOEventHandler *fd_event,
1814                            void *opaque)
1815 {
1816     s->chr_can_read = fd_can_read;
1817     s->chr_read = fd_read;
1818     s->chr_event = fd_event;
1819     s->handler_opaque = opaque;
1820     if (s->chr_update_read_handler)
1821         s->chr_update_read_handler(s);
1822 }
1823
1824 static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
1825 {
1826     return len;
1827 }
1828
1829 static CharDriverState *qemu_chr_open_null(void)
1830 {
1831     CharDriverState *chr;
1832
1833     chr = qemu_mallocz(sizeof(CharDriverState));
1834     if (!chr)
1835         return NULL;
1836     chr->chr_write = null_chr_write;
1837     return chr;
1838 }
1839
1840 /* MUX driver for serial I/O splitting */
1841 static int term_timestamps;
1842 static int64_t term_timestamps_start;
1843 #define MAX_MUX 4
1844 #define MUX_BUFFER_SIZE 32      /* Must be a power of 2.  */
1845 #define MUX_BUFFER_MASK (MUX_BUFFER_SIZE - 1)
1846 typedef struct {
1847     IOCanRWHandler *chr_can_read[MAX_MUX];
1848     IOReadHandler *chr_read[MAX_MUX];
1849     IOEventHandler *chr_event[MAX_MUX];
1850     void *ext_opaque[MAX_MUX];
1851     CharDriverState *drv;
1852     unsigned char buffer[MUX_BUFFER_SIZE];
1853     int prod;
1854     int cons;
1855     int mux_cnt;
1856     int term_got_escape;
1857     int max_size;
1858 } MuxDriver;
1859
1860
1861 static int mux_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
1862 {
1863     MuxDriver *d = chr->opaque;
1864     int ret;
1865     if (!term_timestamps) {
1866         ret = d->drv->chr_write(d->drv, buf, len);
1867     } else {
1868         int i;
1869
1870         ret = 0;
1871         for(i = 0; i < len; i++) {
1872             ret += d->drv->chr_write(d->drv, buf+i, 1);
1873             if (buf[i] == '\n') {
1874                 char buf1[64];
1875                 int64_t ti;
1876                 int secs;
1877
1878                 ti = get_clock();
1879                 if (term_timestamps_start == -1)
1880                     term_timestamps_start = ti;
1881                 ti -= term_timestamps_start;
1882                 secs = ti / 1000000000;
1883                 snprintf(buf1, sizeof(buf1),
1884                          "[%02d:%02d:%02d.%03d] ",
1885                          secs / 3600,
1886                          (secs / 60) % 60,
1887                          secs % 60,
1888                          (int)((ti / 1000000) % 1000));
1889                 d->drv->chr_write(d->drv, (uint8_t *)buf1, strlen(buf1));
1890             }
1891         }
1892     }
1893     return ret;
1894 }
1895
1896 static char *mux_help[] = {
1897     "% h    print this help\n\r",
1898     "% x    exit emulator\n\r",
1899     "% s    save disk data back to file (if -snapshot)\n\r",
1900     "% t    toggle console timestamps\n\r"
1901     "% b    send break (magic sysrq)\n\r",
1902     "% c    switch between console and monitor\n\r",
1903     "% %  sends %\n\r",
1904     NULL
1905 };
1906
1907 static int term_escape_char = 0x01; /* ctrl-a is used for escape */
1908 static void mux_print_help(CharDriverState *chr)
1909 {
1910     int i, j;
1911     char ebuf[15] = "Escape-Char";
1912     char cbuf[50] = "\n\r";
1913
1914     if (term_escape_char > 0 && term_escape_char < 26) {
1915         sprintf(cbuf,"\n\r");
1916         sprintf(ebuf,"C-%c", term_escape_char - 1 + 'a');
1917     } else {
1918         sprintf(cbuf,"\n\rEscape-Char set to Ascii: 0x%02x\n\r\n\r",
1919             term_escape_char);
1920     }
1921     chr->chr_write(chr, (uint8_t *)cbuf, strlen(cbuf));
1922     for (i = 0; mux_help[i] != NULL; i++) {
1923         for (j=0; mux_help[i][j] != '\0'; j++) {
1924             if (mux_help[i][j] == '%')
1925                 chr->chr_write(chr, (uint8_t *)ebuf, strlen(ebuf));
1926             else
1927                 chr->chr_write(chr, (uint8_t *)&mux_help[i][j], 1);
1928         }
1929     }
1930 }
1931
1932 static int mux_proc_byte(CharDriverState *chr, MuxDriver *d, int ch)
1933 {
1934     if (d->term_got_escape) {
1935         d->term_got_escape = 0;
1936         if (ch == term_escape_char)
1937             goto send_char;
1938         switch(ch) {
1939         case '?':
1940         case 'h':
1941             mux_print_help(chr);
1942             break;
1943         case 'x':
1944             {
1945                  char *term =  "QEMU: Terminated\n\r";
1946                  chr->chr_write(chr,(uint8_t *)term,strlen(term));
1947                  exit(0);
1948                  break;
1949             }
1950         case 's':
1951             {
1952                 int i;
1953                 for (i = 0; i < nb_drives; i++) {
1954                         bdrv_commit(drives_table[i].bdrv);
1955                 }
1956             }
1957             break;
1958         case 'b':
1959             qemu_chr_event(chr, CHR_EVENT_BREAK);
1960             break;
1961         case 'c':
1962             /* Switch to the next registered device */
1963             chr->focus++;
1964             if (chr->focus >= d->mux_cnt)
1965                 chr->focus = 0;
1966             break;
1967        case 't':
1968            term_timestamps = !term_timestamps;
1969            term_timestamps_start = -1;
1970            break;
1971         }
1972     } else if (ch == term_escape_char) {
1973         d->term_got_escape = 1;
1974     } else {
1975     send_char:
1976         return 1;
1977     }
1978     return 0;
1979 }
1980
1981 static void mux_chr_accept_input(CharDriverState *chr)
1982 {
1983     int m = chr->focus;
1984     MuxDriver *d = chr->opaque;
1985
1986     while (d->prod != d->cons &&
1987            d->chr_can_read[m] &&
1988            d->chr_can_read[m](d->ext_opaque[m])) {
1989         d->chr_read[m](d->ext_opaque[m],
1990                        &d->buffer[d->cons++ & MUX_BUFFER_MASK], 1);
1991     }
1992 }
1993
1994 static int mux_chr_can_read(void *opaque)
1995 {
1996     CharDriverState *chr = opaque;
1997     MuxDriver *d = chr->opaque;
1998
1999     if ((d->prod - d->cons) < MUX_BUFFER_SIZE)
2000         return 1;
2001     if (d->chr_can_read[chr->focus])
2002         return d->chr_can_read[chr->focus](d->ext_opaque[chr->focus]);
2003     return 0;
2004 }
2005
2006 static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
2007 {
2008     CharDriverState *chr = opaque;
2009     MuxDriver *d = chr->opaque;
2010     int m = chr->focus;
2011     int i;
2012
2013     mux_chr_accept_input (opaque);
2014
2015     for(i = 0; i < size; i++)
2016         if (mux_proc_byte(chr, d, buf[i])) {
2017             if (d->prod == d->cons &&
2018                 d->chr_can_read[m] &&
2019                 d->chr_can_read[m](d->ext_opaque[m]))
2020                 d->chr_read[m](d->ext_opaque[m], &buf[i], 1);
2021             else
2022                 d->buffer[d->prod++ & MUX_BUFFER_MASK] = buf[i];
2023         }
2024 }
2025
2026 static void mux_chr_event(void *opaque, int event)
2027 {
2028     CharDriverState *chr = opaque;
2029     MuxDriver *d = chr->opaque;
2030     int i;
2031
2032     /* Send the event to all registered listeners */
2033     for (i = 0; i < d->mux_cnt; i++)
2034         if (d->chr_event[i])
2035             d->chr_event[i](d->ext_opaque[i], event);
2036 }
2037
2038 static void mux_chr_update_read_handler(CharDriverState *chr)
2039 {
2040     MuxDriver *d = chr->opaque;
2041
2042     if (d->mux_cnt >= MAX_MUX) {
2043         fprintf(stderr, "Cannot add I/O handlers, MUX array is full\n");
2044         return;
2045     }
2046     d->ext_opaque[d->mux_cnt] = chr->handler_opaque;
2047     d->chr_can_read[d->mux_cnt] = chr->chr_can_read;
2048     d->chr_read[d->mux_cnt] = chr->chr_read;
2049     d->chr_event[d->mux_cnt] = chr->chr_event;
2050     /* Fix up the real driver with mux routines */
2051     if (d->mux_cnt == 0) {
2052         qemu_chr_add_handlers(d->drv, mux_chr_can_read, mux_chr_read,
2053                               mux_chr_event, chr);
2054     }
2055     chr->focus = d->mux_cnt;
2056     d->mux_cnt++;
2057 }
2058
2059 static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
2060 {
2061     CharDriverState *chr;
2062     MuxDriver *d;
2063
2064     chr = qemu_mallocz(sizeof(CharDriverState));
2065     if (!chr)
2066         return NULL;
2067     d = qemu_mallocz(sizeof(MuxDriver));
2068     if (!d) {
2069         free(chr);
2070         return NULL;
2071     }
2072
2073     chr->opaque = d;
2074     d->drv = drv;
2075     chr->focus = -1;
2076     chr->chr_write = mux_chr_write;
2077     chr->chr_update_read_handler = mux_chr_update_read_handler;
2078     chr->chr_accept_input = mux_chr_accept_input;
2079     return chr;
2080 }
2081
2082
2083 #ifdef _WIN32
2084
2085 static void socket_cleanup(void)
2086 {
2087     WSACleanup();
2088 }
2089
2090 static int socket_init(void)
2091 {
2092     WSADATA Data;
2093     int ret, err;
2094
2095     ret = WSAStartup(MAKEWORD(2,2), &Data);
2096     if (ret != 0) {
2097         err = WSAGetLastError();
2098         fprintf(stderr, "WSAStartup: %d\n", err);
2099         return -1;
2100     }
2101     atexit(socket_cleanup);
2102     return 0;
2103 }
2104
2105 static int send_all(int fd, const uint8_t *buf, int len1)
2106 {
2107     int ret, len;
2108
2109     len = len1;
2110     while (len > 0) {
2111         ret = send(fd, buf, len, 0);
2112         if (ret < 0) {
2113             int errno;
2114             errno = WSAGetLastError();
2115             if (errno != WSAEWOULDBLOCK) {
2116                 return -1;
2117             }
2118         } else if (ret == 0) {
2119             break;
2120         } else {
2121             buf += ret;
2122             len -= ret;
2123         }
2124     }
2125     return len1 - len;
2126 }
2127
2128 void socket_set_nonblock(int fd)
2129 {
2130     unsigned long opt = 1;
2131     ioctlsocket(fd, FIONBIO, &opt);
2132 }
2133
2134 #else
2135
2136 static int unix_write(int fd, const uint8_t *buf, int len1)
2137 {
2138     int ret, len;
2139
2140     len = len1;
2141     while (len > 0) {
2142         ret = write(fd, buf, len);
2143         if (ret < 0) {
2144             if (errno != EINTR && errno != EAGAIN)
2145                 return -1;
2146         } else if (ret == 0) {
2147             break;
2148         } else {
2149             buf += ret;
2150             len -= ret;
2151         }
2152     }
2153     return len1 - len;
2154 }
2155
2156 static inline int send_all(int fd, const uint8_t *buf, int len1)
2157 {
2158     return unix_write(fd, buf, len1);
2159 }
2160
2161 void socket_set_nonblock(int fd)
2162 {
2163     int f;
2164     f = fcntl(fd, F_GETFL);
2165     fcntl(fd, F_SETFL, f | O_NONBLOCK);
2166 }
2167 #endif /* !_WIN32 */
2168
2169 #ifndef _WIN32
2170
2171 typedef struct {
2172     int fd_in, fd_out;
2173     int max_size;
2174 } FDCharDriver;
2175
2176 #define STDIO_MAX_CLIENTS 1
2177 static int stdio_nb_clients = 0;
2178
2179 static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
2180 {
2181     FDCharDriver *s = chr->opaque;
2182     return unix_write(s->fd_out, buf, len);
2183 }
2184
2185 static int fd_chr_read_poll(void *opaque)
2186 {
2187     CharDriverState *chr = opaque;
2188     FDCharDriver *s = chr->opaque;
2189
2190     s->max_size = qemu_chr_can_read(chr);
2191     return s->max_size;
2192 }
2193
2194 static void fd_chr_read(void *opaque)
2195 {
2196     CharDriverState *chr = opaque;
2197     FDCharDriver *s = chr->opaque;
2198     int size, len;
2199     uint8_t buf[1024];
2200
2201     len = sizeof(buf);
2202     if (len > s->max_size)
2203         len = s->max_size;
2204     if (len == 0)
2205         return;
2206     size = read(s->fd_in, buf, len);
2207     if (size == 0) {
2208         /* FD has been closed. Remove it from the active list.  */
2209         qemu_set_fd_handler2(s->fd_in, NULL, NULL, NULL, NULL);
2210         return;
2211     }
2212     if (size > 0) {
2213         qemu_chr_read(chr, buf, size);
2214     }
2215 }
2216
2217 static void fd_chr_update_read_handler(CharDriverState *chr)
2218 {
2219     FDCharDriver *s = chr->opaque;
2220
2221     if (s->fd_in >= 0) {
2222         if (nographic && s->fd_in == 0) {
2223         } else {
2224             qemu_set_fd_handler2(s->fd_in, fd_chr_read_poll,
2225                                  fd_chr_read, NULL, chr);
2226         }
2227     }
2228 }
2229
2230 static void fd_chr_close(struct CharDriverState *chr)
2231 {
2232     FDCharDriver *s = chr->opaque;
2233
2234     if (s->fd_in >= 0) {
2235         if (nographic && s->fd_in == 0) {
2236         } else {
2237             qemu_set_fd_handler2(s->fd_in, NULL, NULL, NULL, NULL);
2238         }
2239     }
2240
2241     qemu_free(s);
2242 }
2243
2244 /* open a character device to a unix fd */
2245 static CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)
2246 {
2247     CharDriverState *chr;
2248     FDCharDriver *s;
2249
2250     chr = qemu_mallocz(sizeof(CharDriverState));
2251     if (!chr)
2252         return NULL;
2253     s = qemu_mallocz(sizeof(FDCharDriver));
2254     if (!s) {
2255         free(chr);
2256         return NULL;
2257     }
2258     s->fd_in = fd_in;
2259     s->fd_out = fd_out;
2260     chr->opaque = s;
2261     chr->chr_write = fd_chr_write;
2262     chr->chr_update_read_handler = fd_chr_update_read_handler;
2263     chr->chr_close = fd_chr_close;
2264
2265     qemu_chr_reset(chr);
2266
2267     return chr;
2268 }
2269
2270 static CharDriverState *qemu_chr_open_file_out(const char *file_out)
2271 {
2272     int fd_out;
2273
2274     TFR(fd_out = open(file_out, O_WRONLY | O_TRUNC | O_CREAT | O_BINARY, 0666));
2275     if (fd_out < 0)
2276         return NULL;
2277     return qemu_chr_open_fd(-1, fd_out);
2278 }
2279
2280 static CharDriverState *qemu_chr_open_pipe(const char *filename)
2281 {
2282     int fd_in, fd_out;
2283     char filename_in[256], filename_out[256];
2284
2285     snprintf(filename_in, 256, "%s.in", filename);
2286     snprintf(filename_out, 256, "%s.out", filename);
2287     TFR(fd_in = open(filename_in, O_RDWR | O_BINARY));
2288     TFR(fd_out = open(filename_out, O_RDWR | O_BINARY));
2289     if (fd_in < 0 || fd_out < 0) {
2290         if (fd_in >= 0)
2291             close(fd_in);
2292         if (fd_out >= 0)
2293             close(fd_out);
2294         TFR(fd_in = fd_out = open(filename, O_RDWR | O_BINARY));
2295         if (fd_in < 0)
2296             return NULL;
2297     }
2298     return qemu_chr_open_fd(fd_in, fd_out);
2299 }
2300
2301
2302 /* for STDIO, we handle the case where several clients use it
2303    (nographic mode) */
2304
2305 #define TERM_FIFO_MAX_SIZE 1
2306
2307 static uint8_t term_fifo[TERM_FIFO_MAX_SIZE];
2308 static int term_fifo_size;
2309
2310 static int stdio_read_poll(void *opaque)
2311 {
2312     CharDriverState *chr = opaque;
2313
2314     /* try to flush the queue if needed */
2315     if (term_fifo_size != 0 && qemu_chr_can_read(chr) > 0) {
2316         qemu_chr_read(chr, term_fifo, 1);
2317         term_fifo_size = 0;
2318     }
2319     /* see if we can absorb more chars */
2320     if (term_fifo_size == 0)
2321         return 1;
2322     else
2323         return 0;
2324 }
2325
2326 static void stdio_read(void *opaque)
2327 {
2328     int size;
2329     uint8_t buf[1];
2330     CharDriverState *chr = opaque;
2331
2332     size = read(0, buf, 1);
2333     if (size == 0) {
2334         /* stdin has been closed. Remove it from the active list.  */
2335         qemu_set_fd_handler2(0, NULL, NULL, NULL, NULL);
2336         return;
2337     }
2338     if (size > 0) {
2339         if (qemu_chr_can_read(chr) > 0) {
2340             qemu_chr_read(chr, buf, 1);
2341         } else if (term_fifo_size == 0) {
2342             term_fifo[term_fifo_size++] = buf[0];
2343         }
2344     }
2345 }
2346
2347 /* init terminal so that we can grab keys */
2348 static struct termios oldtty;
2349 static int old_fd0_flags;
2350 static int term_atexit_done;
2351
2352 static void term_exit(void)
2353 {
2354     tcsetattr (0, TCSANOW, &oldtty);
2355     fcntl(0, F_SETFL, old_fd0_flags);
2356 }
2357
2358 static void term_init(void)
2359 {
2360     struct termios tty;
2361
2362     tcgetattr (0, &tty);
2363     oldtty = tty;
2364     old_fd0_flags = fcntl(0, F_GETFL);
2365
2366     tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
2367                           |INLCR|IGNCR|ICRNL|IXON);
2368     tty.c_oflag |= OPOST;
2369     tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);
2370     /* if graphical mode, we allow Ctrl-C handling */
2371     if (nographic)
2372         tty.c_lflag &= ~ISIG;
2373     tty.c_cflag &= ~(CSIZE|PARENB);
2374     tty.c_cflag |= CS8;
2375     tty.c_cc[VMIN] = 1;
2376     tty.c_cc[VTIME] = 0;
2377
2378     tcsetattr (0, TCSANOW, &tty);
2379
2380     if (!term_atexit_done++)
2381         atexit(term_exit);
2382
2383     fcntl(0, F_SETFL, O_NONBLOCK);
2384 }
2385
2386 static void qemu_chr_close_stdio(struct CharDriverState *chr)
2387 {
2388     term_exit();
2389     stdio_nb_clients--;
2390     qemu_set_fd_handler2(0, NULL, NULL, NULL, NULL);
2391     fd_chr_close(chr);
2392 }
2393
2394 static CharDriverState *qemu_chr_open_stdio(void)
2395 {
2396     CharDriverState *chr;
2397
2398     if (stdio_nb_clients >= STDIO_MAX_CLIENTS)
2399         return NULL;
2400     chr = qemu_chr_open_fd(0, 1);
2401     chr->chr_close = qemu_chr_close_stdio;
2402     qemu_set_fd_handler2(0, stdio_read_poll, stdio_read, NULL, chr);
2403     stdio_nb_clients++;
2404     term_init();
2405
2406     return chr;
2407 }
2408
2409 #ifdef __sun__
2410 /* Once Solaris has openpty(), this is going to be removed. */
2411 int openpty(int *amaster, int *aslave, char *name,
2412             struct termios *termp, struct winsize *winp)
2413 {
2414         const char *slave;
2415         int mfd = -1, sfd = -1;
2416
2417         *amaster = *aslave = -1;
2418
2419         mfd = open("/dev/ptmx", O_RDWR | O_NOCTTY);
2420         if (mfd < 0)
2421                 goto err;
2422
2423         if (grantpt(mfd) == -1 || unlockpt(mfd) == -1)
2424                 goto err;
2425
2426         if ((slave = ptsname(mfd)) == NULL)
2427                 goto err;
2428
2429         if ((sfd = open(slave, O_RDONLY | O_NOCTTY)) == -1)
2430                 goto err;
2431
2432         if (ioctl(sfd, I_PUSH, "ptem") == -1 ||
2433             (termp != NULL && tcgetattr(sfd, termp) < 0))
2434                 goto err;
2435
2436         if (amaster)
2437                 *amaster = mfd;
2438         if (aslave)
2439                 *aslave = sfd;
2440         if (winp)
2441                 ioctl(sfd, TIOCSWINSZ, winp);
2442
2443         return 0;
2444
2445 err:
2446         if (sfd != -1)
2447                 close(sfd);
2448         close(mfd);
2449         return -1;
2450 }
2451
2452 void cfmakeraw (struct termios *termios_p)
2453 {
2454         termios_p->c_iflag &=
2455                 ~(IGNBRK|BRKINT|PARMRK|ISTRIP|INLCR|IGNCR|ICRNL|IXON);
2456         termios_p->c_oflag &= ~OPOST;
2457         termios_p->c_lflag &= ~(ECHO|ECHONL|ICANON|ISIG|IEXTEN);
2458         termios_p->c_cflag &= ~(CSIZE|PARENB);
2459         termios_p->c_cflag |= CS8;
2460
2461         termios_p->c_cc[VMIN] = 0;
2462         termios_p->c_cc[VTIME] = 0;
2463 }
2464 #endif
2465
2466 #if defined(__linux__) || defined(__sun__)
2467
2468 typedef struct {
2469     int fd;
2470     int connected;
2471     int polling;
2472     int read_bytes;
2473     QEMUTimer *timer;
2474 } PtyCharDriver;
2475
2476 static void pty_chr_update_read_handler(CharDriverState *chr);
2477 static void pty_chr_state(CharDriverState *chr, int connected);
2478
2479 static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
2480 {
2481     PtyCharDriver *s = chr->opaque;
2482
2483     if (!s->connected) {
2484         /* guest sends data, check for (re-)connect */
2485         pty_chr_update_read_handler(chr);
2486         return 0;
2487     }
2488     return unix_write(s->fd, buf, len);
2489 }
2490
2491 static int pty_chr_read_poll(void *opaque)
2492 {
2493     CharDriverState *chr = opaque;
2494     PtyCharDriver *s = chr->opaque;
2495
2496     s->read_bytes = qemu_chr_can_read(chr);
2497     return s->read_bytes;
2498 }
2499
2500 static void pty_chr_read(void *opaque)
2501 {
2502     CharDriverState *chr = opaque;
2503     PtyCharDriver *s = chr->opaque;
2504     int size, len;
2505     uint8_t buf[1024];
2506
2507     len = sizeof(buf);
2508     if (len > s->read_bytes)
2509         len = s->read_bytes;
2510     if (len == 0)
2511         return;
2512     size = read(s->fd, buf, len);
2513     if ((size == -1 && errno == EIO) ||
2514         (size == 0)) {
2515         pty_chr_state(chr, 0);
2516         return;
2517     }
2518     if (size > 0) {
2519         pty_chr_state(chr, 1);
2520         qemu_chr_read(chr, buf, size);
2521     }
2522 }
2523
2524 static void pty_chr_update_read_handler(CharDriverState *chr)
2525 {
2526     PtyCharDriver *s = chr->opaque;
2527
2528     qemu_set_fd_handler2(s->fd, pty_chr_read_poll,
2529                          pty_chr_read, NULL, chr);
2530     s->polling = 1;
2531     /*
2532      * Short timeout here: just need wait long enougth that qemu makes
2533      * it through the poll loop once.  When reconnected we want a
2534      * short timeout so we notice it almost instantly.  Otherwise
2535      * read() gives us -EIO instantly, making pty_chr_state() reset the
2536      * timeout to the normal (much longer) poll interval before the
2537      * timer triggers.
2538      */
2539     qemu_mod_timer(s->timer, qemu_get_clock(rt_clock) + 10);
2540 }
2541
2542 static void pty_chr_state(CharDriverState *chr, int connected)
2543 {
2544     PtyCharDriver *s = chr->opaque;
2545
2546     if (!connected) {
2547         qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
2548         s->connected = 0;
2549         s->polling = 0;
2550         /* (re-)connect poll interval for idle guests: once per second.
2551          * We check more frequently in case the guests sends data to
2552          * the virtual device linked to our pty. */
2553         qemu_mod_timer(s->timer, qemu_get_clock(rt_clock) + 1000);
2554     } else {
2555         if (!s->connected)
2556             qemu_chr_reset(chr);
2557         s->connected = 1;
2558     }
2559 }
2560
2561 void pty_chr_timer(void *opaque)
2562 {
2563     struct CharDriverState *chr = opaque;
2564     PtyCharDriver *s = chr->opaque;
2565
2566     if (s->connected)
2567         return;
2568     if (s->polling) {
2569         /* If we arrive here without polling being cleared due
2570          * read returning -EIO, then we are (re-)connected */
2571         pty_chr_state(chr, 1);
2572         return;
2573     }
2574
2575     /* Next poll ... */
2576     pty_chr_update_read_handler(chr);
2577 }
2578
2579 static void pty_chr_close(struct CharDriverState *chr)
2580 {
2581     PtyCharDriver *s = chr->opaque;
2582
2583     qemu_set_fd_handler2(s->fd, NULL, NULL, NULL, NULL);
2584     close(s->fd);
2585     qemu_free(s);
2586 }
2587
2588 static CharDriverState *qemu_chr_open_pty(void)
2589 {
2590     CharDriverState *chr;
2591     PtyCharDriver *s;
2592     struct termios tty;
2593     int slave_fd;
2594
2595     chr = qemu_mallocz(sizeof(CharDriverState));
2596     if (!chr)
2597         return NULL;
2598     s = qemu_mallocz(sizeof(PtyCharDriver));
2599     if (!s) {
2600         qemu_free(chr);
2601         return NULL;
2602     }
2603
2604     if (openpty(&s->fd, &slave_fd, NULL, NULL, NULL) < 0) {
2605         return NULL;
2606     }
2607
2608     /* Set raw attributes on the pty. */
2609     cfmakeraw(&tty);
2610     tcsetattr(slave_fd, TCSAFLUSH, &tty);
2611     close(slave_fd);
2612
2613     fprintf(stderr, "char device redirected to %s\n", ptsname(s->fd));
2614
2615     chr->opaque = s;
2616     chr->chr_write = pty_chr_write;
2617     chr->chr_update_read_handler = pty_chr_update_read_handler;
2618     chr->chr_close = pty_chr_close;
2619
2620     s->timer = qemu_new_timer(rt_clock, pty_chr_timer, chr);
2621
2622     return chr;
2623 }
2624
2625 static void tty_serial_init(int fd, int speed,
2626                             int parity, int data_bits, int stop_bits)
2627 {
2628     struct termios tty;
2629     speed_t spd;
2630
2631 #if 0
2632     printf("tty_serial_init: speed=%d parity=%c data=%d stop=%d\n",
2633            speed, parity, data_bits, stop_bits);
2634 #endif
2635     tcgetattr (fd, &tty);
2636
2637 #define MARGIN 1.1
2638     if (speed <= 50 * MARGIN)
2639         spd = B50;
2640     else if (speed <= 75 * MARGIN)
2641         spd = B75;
2642     else if (speed <= 300 * MARGIN)
2643         spd = B300;
2644     else if (speed <= 600 * MARGIN)
2645         spd = B600;
2646     else if (speed <= 1200 * MARGIN)
2647         spd = B1200;
2648     else if (speed <= 2400 * MARGIN)
2649         spd = B2400;
2650     else if (speed <= 4800 * MARGIN)
2651         spd = B4800;
2652     else if (speed <= 9600 * MARGIN)
2653         spd = B9600;
2654     else if (speed <= 19200 * MARGIN)
2655         spd = B19200;
2656     else if (speed <= 38400 * MARGIN)
2657         spd = B38400;
2658     else if (speed <= 57600 * MARGIN)
2659         spd = B57600;
2660     else if (speed <= 115200 * MARGIN)
2661         spd = B115200;
2662     else
2663         spd = B115200;
2664
2665     cfsetispeed(&tty, spd);
2666     cfsetospeed(&tty, spd);
2667
2668     tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP
2669                           |INLCR|IGNCR|ICRNL|IXON);
2670     tty.c_oflag |= OPOST;
2671     tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN|ISIG);
2672     tty.c_cflag &= ~(CSIZE|PARENB|PARODD|CRTSCTS|CSTOPB);
2673     switch(data_bits) {
2674     default:
2675     case 8:
2676         tty.c_cflag |= CS8;
2677         break;
2678     case 7:
2679         tty.c_cflag |= CS7;
2680         break;
2681     case 6:
2682         tty.c_cflag |= CS6;
2683         break;
2684     case 5:
2685         tty.c_cflag |= CS5;
2686         break;
2687     }
2688     switch(parity) {
2689     default:
2690     case 'N':
2691         break;
2692     case 'E':
2693         tty.c_cflag |= PARENB;
2694         break;
2695     case 'O':
2696         tty.c_cflag |= PARENB | PARODD;
2697         break;
2698     }
2699     if (stop_bits == 2)
2700         tty.c_cflag |= CSTOPB;
2701
2702     tcsetattr (fd, TCSANOW, &tty);
2703 }
2704
2705 static int tty_serial_ioctl(CharDriverState *chr, int cmd, void *arg)
2706 {
2707     FDCharDriver *s = chr->opaque;
2708
2709     switch(cmd) {
2710     case CHR_IOCTL_SERIAL_SET_PARAMS:
2711         {
2712             QEMUSerialSetParams *ssp = arg;
2713             tty_serial_init(s->fd_in, ssp->speed, ssp->parity,
2714                             ssp->data_bits, ssp->stop_bits);
2715         }
2716         break;
2717     case CHR_IOCTL_SERIAL_SET_BREAK:
2718         {
2719             int enable = *(int *)arg;
2720             if (enable)
2721                 tcsendbreak(s->fd_in, 1);
2722         }
2723         break;
2724     default:
2725         return -ENOTSUP;
2726     }
2727     return 0;
2728 }
2729
2730 static CharDriverState *qemu_chr_open_tty(const char *filename)
2731 {
2732     CharDriverState *chr;
2733     int fd;
2734
2735     TFR(fd = open(filename, O_RDWR | O_NONBLOCK));
2736     tty_serial_init(fd, 115200, 'N', 8, 1);
2737     chr = qemu_chr_open_fd(fd, fd);
2738     if (!chr) {
2739         close(fd);
2740         return NULL;
2741     }
2742     chr->chr_ioctl = tty_serial_ioctl;
2743     qemu_chr_reset(chr);
2744     return chr;
2745 }
2746 #else  /* ! __linux__ && ! __sun__ */
2747 static CharDriverState *qemu_chr_open_pty(void)
2748 {
2749     return NULL;
2750 }
2751 #endif /* __linux__ || __sun__ */
2752
2753 #if defined(__linux__)
2754 typedef struct {
2755     int fd;
2756     int mode;
2757 } ParallelCharDriver;
2758
2759 static int pp_hw_mode(ParallelCharDriver *s, uint16_t mode)
2760 {
2761     if (s->mode != mode) {
2762         int m = mode;
2763         if (ioctl(s->fd, PPSETMODE, &m) < 0)
2764             return 0;
2765         s->mode = mode;
2766     }
2767     return 1;
2768 }
2769
2770 static int pp_ioctl(CharDriverState *chr, int cmd, void *arg)
2771 {
2772     ParallelCharDriver *drv = chr->opaque;
2773     int fd = drv->fd;
2774     uint8_t b;
2775
2776     switch(cmd) {
2777     case CHR_IOCTL_PP_READ_DATA:
2778         if (ioctl(fd, PPRDATA, &b) < 0)
2779             return -ENOTSUP;
2780         *(uint8_t *)arg = b;
2781         break;
2782     case CHR_IOCTL_PP_WRITE_DATA:
2783         b = *(uint8_t *)arg;
2784         if (ioctl(fd, PPWDATA, &b) < 0)
2785             return -ENOTSUP;
2786         break;
2787     case CHR_IOCTL_PP_READ_CONTROL:
2788         if (ioctl(fd, PPRCONTROL, &b) < 0)
2789             return -ENOTSUP;
2790         /* Linux gives only the lowest bits, and no way to know data
2791            direction! For better compatibility set the fixed upper
2792            bits. */
2793         *(uint8_t *)arg = b | 0xc0;
2794         break;
2795     case CHR_IOCTL_PP_WRITE_CONTROL:
2796         b = *(uint8_t *)arg;
2797         if (ioctl(fd, PPWCONTROL, &b) < 0)
2798             return -ENOTSUP;
2799         break;
2800     case CHR_IOCTL_PP_READ_STATUS:
2801         if (ioctl(fd, PPRSTATUS, &b) < 0)
2802             return -ENOTSUP;
2803         *(uint8_t *)arg = b;
2804         break;
2805     case CHR_IOCTL_PP_EPP_READ_ADDR:
2806         if (pp_hw_mode(drv, IEEE1284_MODE_EPP|IEEE1284_ADDR)) {
2807             struct ParallelIOArg *parg = arg;
2808             int n = read(fd, parg->buffer, parg->count);
2809             if (n != parg->count) {
2810                 return -EIO;
2811             }
2812         }
2813         break;
2814     case CHR_IOCTL_PP_EPP_READ:
2815         if (pp_hw_mode(drv, IEEE1284_MODE_EPP)) {
2816             struct ParallelIOArg *parg = arg;
2817             int n = read(fd, parg->buffer, parg->count);
2818             if (n != parg->count) {
2819                 return -EIO;
2820             }
2821         }
2822         break;
2823     case CHR_IOCTL_PP_EPP_WRITE_ADDR:
2824         if (pp_hw_mode(drv, IEEE1284_MODE_EPP|IEEE1284_ADDR)) {
2825             struct ParallelIOArg *parg = arg;
2826             int n = write(fd, parg->buffer, parg->count);
2827             if (n != parg->count) {
2828                 return -EIO;
2829             }
2830         }
2831         break;
2832     case CHR_IOCTL_PP_EPP_WRITE:
2833         if (pp_hw_mode(drv, IEEE1284_MODE_EPP)) {
2834             struct ParallelIOArg *parg = arg;
2835             int n = write(fd, parg->buffer, parg->count);
2836             if (n != parg->count) {
2837                 return -EIO;
2838             }
2839         }
2840         break;
2841     default:
2842         return -ENOTSUP;
2843     }
2844     return 0;
2845 }
2846
2847 static void pp_close(CharDriverState *chr)
2848 {
2849     ParallelCharDriver *drv = chr->opaque;
2850     int fd = drv->fd;
2851
2852     pp_hw_mode(drv, IEEE1284_MODE_COMPAT);
2853     ioctl(fd, PPRELEASE);
2854     close(fd);
2855     qemu_free(drv);
2856 }
2857
2858 static CharDriverState *qemu_chr_open_pp(const char *filename)
2859 {
2860     CharDriverState *chr;
2861     ParallelCharDriver *drv;
2862     int fd;
2863
2864     TFR(fd = open(filename, O_RDWR));
2865     if (fd < 0)
2866         return NULL;
2867
2868     if (ioctl(fd, PPCLAIM) < 0) {
2869         close(fd);
2870         return NULL;
2871     }
2872
2873     drv = qemu_mallocz(sizeof(ParallelCharDriver));
2874     if (!drv) {
2875         close(fd);
2876         return NULL;
2877     }
2878     drv->fd = fd;
2879     drv->mode = IEEE1284_MODE_COMPAT;
2880
2881     chr = qemu_mallocz(sizeof(CharDriverState));
2882     if (!chr) {
2883         qemu_free(drv);
2884         close(fd);
2885         return NULL;
2886     }
2887     chr->chr_write = null_chr_write;
2888     chr->chr_ioctl = pp_ioctl;
2889     chr->chr_close = pp_close;
2890     chr->opaque = drv;
2891
2892     qemu_chr_reset(chr);
2893
2894     return chr;
2895 }
2896 #endif /* __linux__ */
2897
2898 #else /* _WIN32 */
2899
2900 typedef struct {
2901     int max_size;
2902     HANDLE hcom, hrecv, hsend;
2903     OVERLAPPED orecv, osend;
2904     BOOL fpipe;
2905     DWORD len;
2906 } WinCharState;
2907
2908 #define NSENDBUF 2048
2909 #define NRECVBUF 2048
2910 #define MAXCONNECT 1
2911 #define NTIMEOUT 5000
2912
2913 static int win_chr_poll(void *opaque);
2914 static int win_chr_pipe_poll(void *opaque);
2915
2916 static void win_chr_close(CharDriverState *chr)
2917 {
2918     WinCharState *s = chr->opaque;
2919
2920     if (s->hsend) {
2921         CloseHandle(s->hsend);
2922         s->hsend = NULL;
2923     }
2924     if (s->hrecv) {
2925         CloseHandle(s->hrecv);
2926         s->hrecv = NULL;
2927     }
2928     if (s->hcom) {
2929         CloseHandle(s->hcom);
2930         s->hcom = NULL;
2931     }
2932     if (s->fpipe)
2933         qemu_del_polling_cb(win_chr_pipe_poll, chr);
2934     else
2935         qemu_del_polling_cb(win_chr_poll, chr);
2936 }
2937
2938 static int win_chr_init(CharDriverState *chr, const char *filename)
2939 {
2940     WinCharState *s = chr->opaque;
2941     COMMCONFIG comcfg;
2942     COMMTIMEOUTS cto = { 0, 0, 0, 0, 0};
2943     COMSTAT comstat;
2944     DWORD size;
2945     DWORD err;
2946
2947     s->hsend = CreateEvent(NULL, TRUE, FALSE, NULL);
2948     if (!s->hsend) {
2949         fprintf(stderr, "Failed CreateEvent\n");
2950         goto fail;
2951     }
2952     s->hrecv = CreateEvent(NULL, TRUE, FALSE, NULL);
2953     if (!s->hrecv) {
2954         fprintf(stderr, "Failed CreateEvent\n");
2955         goto fail;
2956     }
2957
2958     s->hcom = CreateFile(filename, GENERIC_READ|GENERIC_WRITE, 0, NULL,
2959                       OPEN_EXISTING, FILE_FLAG_OVERLAPPED, 0);
2960     if (s->hcom == INVALID_HANDLE_VALUE) {
2961         fprintf(stderr, "Failed CreateFile (%lu)\n", GetLastError());
2962         s->hcom = NULL;
2963         goto fail;
2964     }
2965
2966     if (!SetupComm(s->hcom, NRECVBUF, NSENDBUF)) {
2967         fprintf(stderr, "Failed SetupComm\n");
2968         goto fail;
2969     }
2970
2971     ZeroMemory(&comcfg, sizeof(COMMCONFIG));
2972     size = sizeof(COMMCONFIG);
2973     GetDefaultCommConfig(filename, &comcfg, &size);
2974     comcfg.dcb.DCBlength = sizeof(DCB);
2975     CommConfigDialog(filename, NULL, &comcfg);
2976
2977     if (!SetCommState(s->hcom, &comcfg.dcb)) {
2978         fprintf(stderr, "Failed SetCommState\n");
2979         goto fail;
2980     }
2981
2982     if (!SetCommMask(s->hcom, EV_ERR)) {
2983         fprintf(stderr, "Failed SetCommMask\n");
2984         goto fail;
2985     }
2986
2987     cto.ReadIntervalTimeout = MAXDWORD;
2988     if (!SetCommTimeouts(s->hcom, &cto)) {
2989         fprintf(stderr, "Failed SetCommTimeouts\n");
2990         goto fail;
2991     }
2992
2993     if (!ClearCommError(s->hcom, &err, &comstat)) {
2994         fprintf(stderr, "Failed ClearCommError\n");
2995         goto fail;
2996     }
2997     qemu_add_polling_cb(win_chr_poll, chr);
2998     return 0;
2999
3000  fail:
3001     win_chr_close(chr);
3002     return -1;
3003 }
3004
3005 static int win_chr_write(CharDriverState *chr, const uint8_t *buf, int len1)
3006 {
3007     WinCharState *s = chr->opaque;
3008     DWORD len, ret, size, err;
3009
3010     len = len1;
3011     ZeroMemory(&s->osend, sizeof(s->osend));
3012     s->osend.hEvent = s->hsend;
3013     while (len > 0) {
3014         if (s->hsend)
3015             ret = WriteFile(s->hcom, buf, len, &size, &s->osend);
3016         else
3017             ret = WriteFile(s->hcom, buf, len, &size, NULL);
3018         if (!ret) {
3019             err = GetLastError();
3020             if (err == ERROR_IO_PENDING) {
3021                 ret = GetOverlappedResult(s->hcom, &s->osend, &size, TRUE);
3022                 if (ret) {
3023                     buf += size;
3024                     len -= size;
3025                 } else {
3026                     break;
3027                 }
3028             } else {
3029                 break;
3030             }
3031         } else {
3032             buf += size;
3033             len -= size;
3034         }
3035     }
3036     return len1 - len;
3037 }
3038
3039 static int win_chr_read_poll(CharDriverState *chr)
3040 {
3041     WinCharState *s = chr->opaque;
3042
3043     s->max_size = qemu_chr_can_read(chr);
3044     return s->max_size;
3045 }
3046
3047 static void win_chr_readfile(CharDriverState *chr)
3048 {
3049     WinCharState *s = chr->opaque;
3050     int ret, err;
3051     uint8_t buf[1024];
3052     DWORD size;
3053
3054     ZeroMemory(&s->orecv, sizeof(s->orecv));
3055     s->orecv.hEvent = s->hrecv;
3056     ret = ReadFile(s->hcom, buf, s->len, &size, &s->orecv);
3057     if (!ret) {
3058         err = GetLastError();
3059         if (err == ERROR_IO_PENDING) {
3060             ret = GetOverlappedResult(s->hcom, &s->orecv, &size, TRUE);
3061         }
3062     }
3063
3064     if (size > 0) {
3065         qemu_chr_read(chr, buf, size);
3066     }
3067 }
3068
3069 static void win_chr_read(CharDriverState *chr)
3070 {
3071     WinCharState *s = chr->opaque;
3072
3073     if (s->len > s->max_size)
3074         s->len = s->max_size;
3075     if (s->len == 0)
3076         return;
3077
3078     win_chr_readfile(chr);
3079 }
3080
3081 static int win_chr_poll(void *opaque)
3082 {
3083     CharDriverState *chr = opaque;
3084     WinCharState *s = chr->opaque;
3085     COMSTAT status;
3086     DWORD comerr;
3087
3088     ClearCommError(s->hcom, &comerr, &status);
3089     if (status.cbInQue > 0) {
3090         s->len = status.cbInQue;
3091         win_chr_read_poll(chr);
3092         win_chr_read(chr);
3093         return 1;
3094     }
3095     return 0;
3096 }
3097
3098 static CharDriverState *qemu_chr_open_win(const char *filename)
3099 {
3100     CharDriverState *chr;
3101     WinCharState *s;
3102
3103     chr = qemu_mallocz(sizeof(CharDriverState));
3104     if (!chr)
3105         return NULL;
3106     s = qemu_mallocz(sizeof(WinCharState));
3107     if (!s) {
3108         free(chr);
3109         return NULL;
3110     }
3111     chr->opaque = s;
3112     chr->chr_write = win_chr_write;
3113     chr->chr_close = win_chr_close;
3114
3115     if (win_chr_init(chr, filename) < 0) {
3116         free(s);
3117         free(chr);
3118         return NULL;
3119     }
3120     qemu_chr_reset(chr);
3121     return chr;
3122 }
3123
3124 static int win_chr_pipe_poll(void *opaque)
3125 {
3126     CharDriverState *chr = opaque;
3127     WinCharState *s = chr->opaque;
3128     DWORD size;
3129
3130     PeekNamedPipe(s->hcom, NULL, 0, NULL, &size, NULL);
3131     if (size > 0) {
3132         s->len = size;
3133         win_chr_read_poll(chr);
3134         win_chr_read(chr);
3135         return 1;
3136     }
3137     return 0;
3138 }
3139
3140 static int win_chr_pipe_init(CharDriverState *chr, const char *filename)
3141 {
3142     WinCharState *s = chr->opaque;
3143     OVERLAPPED ov;
3144     int ret;
3145     DWORD size;
3146     char openname[256];
3147
3148     s->fpipe = TRUE;
3149
3150     s->hsend = CreateEvent(NULL, TRUE, FALSE, NULL);
3151     if (!s->hsend) {
3152         fprintf(stderr, "Failed CreateEvent\n");
3153         goto fail;
3154     }
3155     s->hrecv = CreateEvent(NULL, TRUE, FALSE, NULL);
3156     if (!s->hrecv) {
3157         fprintf(stderr, "Failed CreateEvent\n");
3158         goto fail;
3159     }
3160
3161     snprintf(openname, sizeof(openname), "\\\\.\\pipe\\%s", filename);
3162     s->hcom = CreateNamedPipe(openname, PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
3163                               PIPE_TYPE_BYTE | PIPE_READMODE_BYTE |
3164                               PIPE_WAIT,
3165                               MAXCONNECT, NSENDBUF, NRECVBUF, NTIMEOUT, NULL);
3166     if (s->hcom == INVALID_HANDLE_VALUE) {
3167         fprintf(stderr, "Failed CreateNamedPipe (%lu)\n", GetLastError());
3168         s->hcom = NULL;
3169         goto fail;
3170     }
3171
3172     ZeroMemory(&ov, sizeof(ov));
3173     ov.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
3174     ret = ConnectNamedPipe(s->hcom, &ov);
3175     if (ret) {
3176         fprintf(stderr, "Failed ConnectNamedPipe\n");
3177         goto fail;
3178     }
3179
3180     ret = GetOverlappedResult(s->hcom, &ov, &size, TRUE);
3181     if (!ret) {
3182         fprintf(stderr, "Failed GetOverlappedResult\n");
3183         if (ov.hEvent) {
3184             CloseHandle(ov.hEvent);
3185             ov.hEvent = NULL;
3186         }
3187         goto fail;
3188     }
3189
3190     if (ov.hEvent) {
3191         CloseHandle(ov.hEvent);
3192         ov.hEvent = NULL;
3193     }
3194     qemu_add_polling_cb(win_chr_pipe_poll, chr);
3195     return 0;
3196
3197  fail:
3198     win_chr_close(chr);
3199     return -1;
3200 }
3201
3202
3203 static CharDriverState *qemu_chr_open_win_pipe(const char *filename)
3204 {
3205     CharDriverState *chr;
3206     WinCharState *s;
3207
3208     chr = qemu_mallocz(sizeof(CharDriverState));
3209     if (!chr)
3210         return NULL;
3211     s = qemu_mallocz(sizeof(WinCharState));
3212     if (!s) {
3213         free(chr);
3214         return NULL;
3215     }
3216     chr->opaque = s;
3217     chr->chr_write = win_chr_write;
3218     chr->chr_close = win_chr_close;
3219
3220     if (win_chr_pipe_init(chr, filename) < 0) {
3221         free(s);
3222         free(chr);
3223         return NULL;
3224     }
3225     qemu_chr_reset(chr);
3226     return chr;
3227 }
3228
3229 static CharDriverState *qemu_chr_open_win_file(HANDLE fd_out)
3230 {
3231     CharDriverState *chr;
3232     WinCharState *s;
3233
3234     chr = qemu_mallocz(sizeof(CharDriverState));
3235     if (!chr)
3236         return NULL;
3237     s = qemu_mallocz(sizeof(WinCharState));
3238     if (!s) {
3239         free(chr);
3240         return NULL;
3241     }
3242     s->hcom = fd_out;
3243     chr->opaque = s;
3244     chr->chr_write = win_chr_write;
3245     qemu_chr_reset(chr);
3246     return chr;
3247 }
3248
3249 static CharDriverState *qemu_chr_open_win_con(const char *filename)
3250 {
3251     return qemu_chr_open_win_file(GetStdHandle(STD_OUTPUT_HANDLE));
3252 }
3253
3254 static CharDriverState *qemu_chr_open_win_file_out(const char *file_out)
3255 {
3256     HANDLE fd_out;
3257
3258     fd_out = CreateFile(file_out, GENERIC_WRITE, FILE_SHARE_READ, NULL,
3259                         OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
3260     if (fd_out == INVALID_HANDLE_VALUE)
3261         return NULL;
3262
3263     return qemu_chr_open_win_file(fd_out);
3264 }
3265 #endif /* !_WIN32 */
3266
3267 /***********************************************************/
3268 /* UDP Net console */
3269
3270 typedef struct {
3271     int fd;
3272     struct sockaddr_in daddr;
3273     uint8_t buf[1024];
3274     int bufcnt;
3275     int bufptr;
3276     int max_size;
3277 } NetCharDriver;
3278
3279 static int udp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
3280 {
3281     NetCharDriver *s = chr->opaque;
3282
3283     return sendto(s->fd, buf, len, 0,
3284                   (struct sockaddr *)&s->daddr, sizeof(struct sockaddr_in));
3285 }
3286
3287 static int udp_chr_read_poll(void *opaque)
3288 {
3289     CharDriverState *chr = opaque;
3290     NetCharDriver *s = chr->opaque;
3291
3292     s->max_size = qemu_chr_can_read(chr);
3293
3294     /* If there were any stray characters in the queue process them
3295      * first
3296      */
3297     while (s->max_size > 0 && s->bufptr < s->bufcnt) {
3298         qemu_chr_read(chr, &s->buf[s->bufptr], 1);
3299         s->bufptr++;
3300         s->max_size = qemu_chr_can_read(chr);
3301     }
3302     return s->max_size;
3303 }
3304
3305 static void udp_chr_read(void *opaque)
3306 {
3307     CharDriverState *chr = opaque;
3308     NetCharDriver *s = chr->opaque;
3309
3310     if (s->max_size == 0)
3311         return;
3312     s->bufcnt = recv(s->fd, s->buf, sizeof(s->buf), 0);
3313     s->bufptr = s->bufcnt;
3314     if (s->bufcnt <= 0)
3315         return;
3316
3317     s->bufptr = 0;
3318     while (s->max_size > 0 && s->bufptr < s->bufcnt) {
3319         qemu_chr_read(chr, &s->buf[s->bufptr], 1);
3320         s->bufptr++;
3321         s->max_size = qemu_chr_can_read(chr);
3322     }
3323 }
3324
3325 static void udp_chr_update_read_handler(CharDriverState *chr)
3326 {
3327     NetCharDriver *s = chr->opaque;
3328
3329     if (s->fd >= 0) {
3330         qemu_set_fd_handler2(s->fd, udp_chr_read_poll,
3331                              udp_chr_read, NULL, chr);
3332     }
3333 }
3334
3335 int parse_host_port(struct sockaddr_in *saddr, const char *str);
3336 #ifndef _WIN32
3337 static int parse_unix_path(struct sockaddr_un *uaddr, const char *str);
3338 #endif
3339 int parse_host_src_port(struct sockaddr_in *haddr,
3340                         struct sockaddr_in *saddr,
3341                         const char *str);
3342
3343 static CharDriverState *qemu_chr_open_udp(const char *def)
3344 {
3345     CharDriverState *chr = NULL;
3346     NetCharDriver *s = NULL;
3347     int fd = -1;
3348     struct sockaddr_in saddr;
3349
3350     chr = qemu_mallocz(sizeof(CharDriverState));
3351     if (!chr)
3352         goto return_err;
3353     s = qemu_mallocz(sizeof(NetCharDriver));
3354     if (!s)
3355         goto return_err;
3356
3357     fd = socket(PF_INET, SOCK_DGRAM, 0);
3358     if (fd < 0) {
3359         perror("socket(PF_INET, SOCK_DGRAM)");
3360         goto return_err;
3361     }
3362
3363     if (parse_host_src_port(&s->daddr, &saddr, def) < 0) {
3364         printf("Could not parse: %s\n", def);
3365         goto return_err;
3366     }
3367
3368     if (bind(fd, (struct sockaddr *)&saddr, sizeof(saddr)) < 0)
3369     {
3370         perror("bind");
3371         goto return_err;
3372     }
3373
3374     s->fd = fd;
3375     s->bufcnt = 0;
3376     s->bufptr = 0;
3377     chr->opaque = s;
3378     chr->chr_write = udp_chr_write;
3379     chr->chr_update_read_handler = udp_chr_update_read_handler;
3380     return chr;
3381
3382 return_err:
3383     if (chr)
3384         free(chr);
3385     if (s)
3386         free(s);
3387     if (fd >= 0)
3388         closesocket(fd);
3389     return NULL;
3390 }
3391
3392 /***********************************************************/
3393 /* TCP Net console */
3394
3395 typedef struct {
3396     int fd, listen_fd;
3397     int connected;
3398     int max_size;
3399     int do_telnetopt;
3400     int do_nodelay;
3401     int is_unix;
3402 } TCPCharDriver;
3403
3404 static void tcp_chr_accept(void *opaque);
3405
3406 static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len)
3407 {
3408     TCPCharDriver *s = chr->opaque;
3409     if (s->connected) {
3410         return send_all(s->fd, buf, len);
3411     } else {
3412         /* XXX: indicate an error ? */
3413         return len;
3414     }
3415 }
3416
3417 static int tcp_chr_read_poll(void *opaque)
3418 {
3419     CharDriverState *chr = opaque;
3420     TCPCharDriver *s = chr->opaque;
3421     if (!s->connected)
3422         return 0;
3423     s->max_size = qemu_chr_can_read(chr);
3424     return s->max_size;
3425 }
3426
3427 #define IAC 255
3428 #define IAC_BREAK 243
3429 static void tcp_chr_process_IAC_bytes(CharDriverState *chr,
3430                                       TCPCharDriver *s,
3431                                       uint8_t *buf, int *size)
3432 {
3433     /* Handle any telnet client's basic IAC options to satisfy char by
3434      * char mode with no echo.  All IAC options will be removed from
3435      * the buf and the do_telnetopt variable will be used to track the
3436      * state of the width of the IAC information.
3437      *
3438      * IAC commands come in sets of 3 bytes with the exception of the
3439      * "IAC BREAK" command and the double IAC.
3440      */
3441
3442     int i;
3443     int j = 0;
3444
3445     for (i = 0; i < *size; i++) {
3446         if (s->do_telnetopt > 1) {
3447             if ((unsigned char)buf[i] == IAC && s->do_telnetopt == 2) {
3448                 /* Double IAC means send an IAC */
3449                 if (j != i)
3450                     buf[j] = buf[i];
3451                 j++;
3452                 s->do_telnetopt = 1;
3453             } else {
3454                 if ((unsigned char)buf[i] == IAC_BREAK && s->do_telnetopt == 2) {
3455                     /* Handle IAC break commands by sending a serial break */
3456                     qemu_chr_event(chr, CHR_EVENT_BREAK);
3457                     s->do_telnetopt++;
3458                 }
3459                 s->do_telnetopt++;
3460             }
3461             if (s->do_telnetopt >= 4) {
3462                 s->do_telnetopt = 1;
3463             }
3464         } else {
3465             if ((unsigned char)buf[i] == IAC) {
3466                 s->do_telnetopt = 2;
3467             } else {
3468                 if (j != i)
3469                     buf[j] = buf[i];
3470                 j++;
3471             }
3472         }
3473     }
3474     *size = j;
3475 }
3476
3477 static void tcp_chr_read(void *opaque)
3478 {
3479     CharDriverState *chr = opaque;
3480     TCPCharDriver *s = chr->opaque;
3481     uint8_t buf[1024];
3482     int len, size;
3483
3484     if (!s->connected || s->max_size <= 0)
3485         return;
3486     len = sizeof(buf);
3487     if (len > s->max_size)
3488         len = s->max_size;
3489     size = recv(s->fd, buf, len, 0);
3490     if (size == 0) {
3491         /* connection closed */
3492         s->connected = 0;
3493         if (s->listen_fd >= 0) {
3494             qemu_set_fd_handler(s->listen_fd, tcp_chr_accept, NULL, chr);
3495         }
3496         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
3497         closesocket(s->fd);
3498         s->fd = -1;
3499     } else if (size > 0) {
3500         if (s->do_telnetopt)
3501             tcp_chr_process_IAC_bytes(chr, s, buf, &size);
3502         if (size > 0)
3503             qemu_chr_read(chr, buf, size);
3504     }
3505 }
3506
3507 static void tcp_chr_connect(void *opaque)
3508 {
3509     CharDriverState *chr = opaque;
3510     TCPCharDriver *s = chr->opaque;
3511
3512     s->connected = 1;
3513     qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
3514                          tcp_chr_read, NULL, chr);
3515     qemu_chr_reset(chr);
3516 }
3517
3518 #define IACSET(x,a,b,c) x[0] = a; x[1] = b; x[2] = c;
3519 static void tcp_chr_telnet_init(int fd)
3520 {
3521     char buf[3];
3522     /* Send the telnet negotion to put telnet in binary, no echo, single char mode */
3523     IACSET(buf, 0xff, 0xfb, 0x01);  /* IAC WILL ECHO */
3524     send(fd, (char *)buf, 3, 0);
3525     IACSET(buf, 0xff, 0xfb, 0x03);  /* IAC WILL Suppress go ahead */
3526     send(fd, (char *)buf, 3, 0);
3527     IACSET(buf, 0xff, 0xfb, 0x00);  /* IAC WILL Binary */
3528     send(fd, (char *)buf, 3, 0);
3529     IACSET(buf, 0xff, 0xfd, 0x00);  /* IAC DO Binary */
3530     send(fd, (char *)buf, 3, 0);
3531 }
3532
3533 static void socket_set_nodelay(int fd)
3534 {
3535     int val = 1;
3536     setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
3537 }
3538
3539 static void tcp_chr_accept(void *opaque)
3540 {
3541     CharDriverState *chr = opaque;
3542     TCPCharDriver *s = chr->opaque;
3543     struct sockaddr_in saddr;
3544 #ifndef _WIN32
3545     struct sockaddr_un uaddr;
3546 #endif
3547     struct sockaddr *addr;
3548     socklen_t len;
3549     int fd;
3550
3551     for(;;) {
3552 #ifndef _WIN32
3553         if (s->is_unix) {
3554             len = sizeof(uaddr);
3555             addr = (struct sockaddr *)&uaddr;
3556         } else
3557 #endif
3558         {
3559             len = sizeof(saddr);
3560             addr = (struct sockaddr *)&saddr;
3561         }
3562         fd = accept(s->listen_fd, addr, &len);
3563         if (fd < 0 && errno != EINTR) {
3564             return;
3565         } else if (fd >= 0) {
3566             if (s->do_telnetopt)
3567                 tcp_chr_telnet_init(fd);
3568             break;
3569         }
3570     }
3571     socket_set_nonblock(fd);
3572     if (s->do_nodelay)
3573         socket_set_nodelay(fd);
3574     s->fd = fd;
3575     qemu_set_fd_handler(s->listen_fd, NULL, NULL, NULL);
3576     tcp_chr_connect(chr);
3577 }
3578
3579 static void tcp_chr_close(CharDriverState *chr)
3580 {
3581     TCPCharDriver *s = chr->opaque;
3582     if (s->fd >= 0)
3583         closesocket(s->fd);
3584     if (s->listen_fd >= 0)
3585         closesocket(s->listen_fd);
3586     qemu_free(s);
3587 }
3588
3589 static CharDriverState *qemu_chr_open_tcp(const char *host_str,
3590                                           int is_telnet,
3591                                           int is_unix)
3592 {
3593     CharDriverState *chr = NULL;
3594     TCPCharDriver *s = NULL;
3595     int fd = -1, ret, err, val;
3596     int is_listen = 0;
3597     int is_waitconnect = 1;
3598     int do_nodelay = 0;
3599     const char *ptr;
3600     struct sockaddr_in saddr;
3601 #ifndef _WIN32
3602     struct sockaddr_un uaddr;
3603 #endif
3604     struct sockaddr *addr;
3605     socklen_t addrlen;
3606
3607 #ifndef _WIN32
3608     if (is_unix) {
3609         addr = (struct sockaddr *)&uaddr;
3610         addrlen = sizeof(uaddr);
3611         if (parse_unix_path(&uaddr, host_str) < 0)
3612             goto fail;
3613     } else
3614 #endif
3615     {
3616         addr = (struct sockaddr *)&saddr;
3617         addrlen = sizeof(saddr);
3618         if (parse_host_port(&saddr, host_str) < 0)
3619             goto fail;
3620     }
3621
3622     ptr = host_str;
3623     while((ptr = strchr(ptr,','))) {
3624         ptr++;
3625         if (!strncmp(ptr,"server",6)) {
3626             is_listen = 1;
3627         } else if (!strncmp(ptr,"nowait",6)) {
3628             is_waitconnect = 0;
3629         } else if (!strncmp(ptr,"nodelay",6)) {
3630             do_nodelay = 1;
3631         } else {
3632             printf("Unknown option: %s\n", ptr);
3633             goto fail;
3634         }
3635     }
3636     if (!is_listen)
3637         is_waitconnect = 0;
3638
3639     chr = qemu_mallocz(sizeof(CharDriverState));
3640     if (!chr)
3641         goto fail;
3642     s = qemu_mallocz(sizeof(TCPCharDriver));
3643     if (!s)
3644         goto fail;
3645
3646 #ifndef _WIN32
3647     if (is_unix)
3648         fd = socket(PF_UNIX, SOCK_STREAM, 0);
3649     else
3650 #endif
3651         fd = socket(PF_INET, SOCK_STREAM, 0);
3652
3653     if (fd < 0)
3654         goto fail;
3655
3656     if (!is_waitconnect)
3657         socket_set_nonblock(fd);
3658
3659     s->connected = 0;
3660     s->fd = -1;
3661     s->listen_fd = -1;
3662     s->is_unix = is_unix;
3663     s->do_nodelay = do_nodelay && !is_unix;
3664
3665     chr->opaque = s;
3666     chr->chr_write = tcp_chr_write;
3667     chr->chr_close = tcp_chr_close;
3668
3669     if (is_listen) {
3670         /* allow fast reuse */
3671 #ifndef _WIN32
3672         if (is_unix) {
3673             char path[109];
3674             pstrcpy(path, sizeof(path), uaddr.sun_path);
3675             unlink(path);
3676         } else
3677 #endif
3678         {
3679             val = 1;
3680             setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
3681         }
3682
3683         ret = bind(fd, addr, addrlen);
3684         if (ret < 0)
3685             goto fail;
3686
3687         ret = listen(fd, 0);
3688         if (ret < 0)
3689             goto fail;
3690
3691         s->listen_fd = fd;
3692         qemu_set_fd_handler(s->listen_fd, tcp_chr_accept, NULL, chr);
3693         if (is_telnet)
3694             s->do_telnetopt = 1;
3695     } else {
3696         for(;;) {
3697             ret = connect(fd, addr, addrlen);
3698             if (ret < 0) {
3699                 err = socket_error();
3700                 if (err == EINTR || err == EWOULDBLOCK) {
3701                 } else if (err == EINPROGRESS) {
3702                     break;
3703 #ifdef _WIN32
3704                 } else if (err == WSAEALREADY) {
3705                     break;
3706 #endif
3707                 } else {
3708                     goto fail;
3709                 }
3710             } else {
3711                 s->connected = 1;
3712                 break;
3713             }
3714         }
3715         s->fd = fd;
3716         socket_set_nodelay(fd);
3717         if (s->connected)
3718             tcp_chr_connect(chr);
3719         else
3720             qemu_set_fd_handler(s->fd, NULL, tcp_chr_connect, chr);
3721     }
3722
3723     if (is_listen && is_waitconnect) {
3724         printf("QEMU waiting for connection on: %s\n", host_str);
3725         tcp_chr_accept(chr);
3726         socket_set_nonblock(s->listen_fd);
3727     }
3728
3729     return chr;
3730  fail:
3731     if (fd >= 0)
3732         closesocket(fd);
3733     qemu_free(s);
3734     qemu_free(chr);
3735     return NULL;
3736 }
3737
3738 CharDriverState *qemu_chr_open(const char *filename)
3739 {
3740     const char *p;
3741
3742     if (!strcmp(filename, "vc")) {
3743         return text_console_init(&display_state, 0);
3744     } else if (strstart(filename, "vc:", &p)) {
3745         return text_console_init(&display_state, p);
3746     } else if (!strcmp(filename, "null")) {
3747         return qemu_chr_open_null();
3748     } else
3749     if (strstart(filename, "tcp:", &p)) {
3750         return qemu_chr_open_tcp(p, 0, 0);
3751     } else
3752     if (strstart(filename, "telnet:", &p)) {
3753         return qemu_chr_open_tcp(p, 1, 0);
3754     } else
3755     if (strstart(filename, "udp:", &p)) {
3756         return qemu_chr_open_udp(p);
3757     } else
3758     if (strstart(filename, "mon:", &p)) {
3759         CharDriverState *drv = qemu_chr_open(p);
3760         if (drv) {
3761             drv = qemu_chr_open_mux(drv);
3762             monitor_init(drv, !nographic);
3763             return drv;
3764         }
3765         printf("Unable to open driver: %s\n", p);
3766         return 0;
3767     } else
3768 #ifndef _WIN32
3769     if (strstart(filename, "unix:", &p)) {
3770         return qemu_chr_open_tcp(p, 0, 1);
3771     } else if (strstart(filename, "file:", &p)) {
3772         return qemu_chr_open_file_out(p);
3773     } else if (strstart(filename, "pipe:", &p)) {
3774         return qemu_chr_open_pipe(p);
3775     } else if (!strcmp(filename, "pty")) {
3776         return qemu_chr_open_pty();
3777     } else if (!strcmp(filename, "stdio")) {
3778         return qemu_chr_open_stdio();
3779     } else
3780 #if defined(__linux__)
3781     if (strstart(filename, "/dev/parport", NULL)) {
3782         return qemu_chr_open_pp(filename);
3783     } else
3784 #endif
3785 #if defined(__linux__) || defined(__sun__)
3786     if (strstart(filename, "/dev/", NULL)) {
3787         return qemu_chr_open_tty(filename);
3788     } else
3789 #endif
3790 #else /* !_WIN32 */
3791     if (strstart(filename, "COM", NULL)) {
3792         return qemu_chr_open_win(filename);
3793     } else
3794     if (strstart(filename, "pipe:", &p)) {
3795         return qemu_chr_open_win_pipe(p);
3796     } else
3797     if (strstart(filename, "con:", NULL)) {
3798         return qemu_chr_open_win_con(filename);
3799     } else
3800     if (strstart(filename, "file:", &p)) {
3801         return qemu_chr_open_win_file_out(p);
3802     } else
3803 #endif
3804 #ifdef CONFIG_BRLAPI
3805     if (!strcmp(filename, "braille")) {
3806         return chr_baum_init();
3807     } else
3808 #endif
3809     {
3810         return NULL;
3811     }
3812 }
3813
3814 void qemu_chr_close(CharDriverState *chr)
3815 {
3816     if (chr->chr_close)
3817         chr->chr_close(chr);
3818     qemu_free(chr);
3819 }
3820
3821 /***********************************************************/
3822 /* network device redirectors */
3823
3824 __attribute__ (( unused ))
3825 static void hex_dump(FILE *f, const uint8_t *buf, int size)
3826 {
3827     int len, i, j, c;
3828
3829     for(i=0;i<size;i+=16) {
3830         len = size - i;
3831         if (len > 16)
3832             len = 16;
3833         fprintf(f, "%08x ", i);
3834         for(j=0;j<16;j++) {
3835             if (j < len)
3836                 fprintf(f, " %02x", buf[i+j]);
3837             else
3838                 fprintf(f, "   ");
3839         }
3840         fprintf(f, " ");
3841         for(j=0;j<len;j++) {
3842             c = buf[i+j];
3843             if (c < ' ' || c > '~')
3844                 c = '.';
3845             fprintf(f, "%c", c);
3846         }
3847         fprintf(f, "\n");
3848     }
3849 }
3850
3851 static int parse_macaddr(uint8_t *macaddr, const char *p)
3852 {
3853     int i;
3854     char *last_char;
3855     long int offset;
3856
3857     errno = 0;
3858     offset = strtol(p, &last_char, 0);
3859     if (0 == errno && '\0' == *last_char &&
3860             offset >= 0 && offset <= 0xFFFFFF) {
3861         macaddr[3] = (offset & 0xFF0000) >> 16;
3862         macaddr[4] = (offset & 0xFF00) >> 8;
3863         macaddr[5] = offset & 0xFF;
3864         return 0;
3865     } else {
3866         for(i = 0; i < 6; i++) {
3867             macaddr[i] = strtol(p, (char **)&p, 16);
3868             if (i == 5) {
3869                 if (*p != '\0')
3870                     return -1;
3871             } else {
3872                 if (*p != ':' && *p != '-')
3873                     return -1;
3874                 p++;
3875             }
3876         }
3877         return 0;
3878     }
3879
3880     return -1;
3881 }
3882
3883 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
3884 {
3885     const char *p, *p1;
3886     int len;
3887     p = *pp;
3888     p1 = strchr(p, sep);
3889     if (!p1)
3890         return -1;
3891     len = p1 - p;
3892     p1++;
3893     if (buf_size > 0) {
3894         if (len > buf_size - 1)
3895             len = buf_size - 1;
3896         memcpy(buf, p, len);
3897         buf[len] = '\0';
3898     }
3899     *pp = p1;
3900     return 0;
3901 }
3902
3903 int parse_host_src_port(struct sockaddr_in *haddr,
3904                         struct sockaddr_in *saddr,
3905                         const char *input_str)
3906 {
3907     char *str = strdup(input_str);
3908     char *host_str = str;
3909     char *src_str;
3910     char *ptr;
3911
3912     /*
3913      * Chop off any extra arguments at the end of the string which
3914      * would start with a comma, then fill in the src port information
3915      * if it was provided else use the "any address" and "any port".
3916      */
3917     if ((ptr = strchr(str,',')))
3918         *ptr = '\0';
3919
3920     if ((src_str = strchr(input_str,'@'))) {
3921         *src_str = '\0';
3922         src_str++;
3923     }
3924
3925     if (parse_host_port(haddr, host_str) < 0)
3926         goto fail;
3927
3928     if (!src_str || *src_str == '\0')
3929         src_str = ":0";
3930
3931     if (parse_host_port(saddr, src_str) < 0)
3932         goto fail;
3933
3934     free(str);
3935     return(0);
3936
3937 fail:
3938     free(str);
3939     return -1;
3940 }
3941
3942 int parse_host_port(struct sockaddr_in *saddr, const char *str)
3943 {
3944     char buf[512];
3945     struct hostent *he;
3946     const char *p, *r;
3947     int port;
3948
3949     p = str;
3950     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
3951         return -1;
3952     saddr->sin_family = AF_INET;
3953     if (buf[0] == '\0') {
3954         saddr->sin_addr.s_addr = 0;
3955     } else {
3956         if (isdigit(buf[0])) {
3957             if (!inet_aton(buf, &saddr->sin_addr))
3958                 return -1;
3959         } else {
3960             if ((he = gethostbyname(buf)) == NULL)
3961                 return - 1;
3962             saddr->sin_addr = *(struct in_addr *)he->h_addr;
3963         }
3964     }
3965     port = strtol(p, (char **)&r, 0);
3966     if (r == p)
3967         return -1;
3968     saddr->sin_port = htons(port);
3969     return 0;
3970 }
3971
3972 #ifndef _WIN32
3973 static int parse_unix_path(struct sockaddr_un *uaddr, const char *str)
3974 {
3975     const char *p;
3976     int len;
3977
3978     len = MIN(108, strlen(str));
3979     p = strchr(str, ',');
3980     if (p)
3981         len = MIN(len, p - str);
3982
3983     memset(uaddr, 0, sizeof(*uaddr));
3984
3985     uaddr->sun_family = AF_UNIX;
3986     memcpy(uaddr->sun_path, str, len);
3987
3988     return 0;
3989 }
3990 #endif
3991
3992 /* find or alloc a new VLAN */
3993 VLANState *qemu_find_vlan(int id)
3994 {
3995     VLANState **pvlan, *vlan;
3996     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3997         if (vlan->id == id)
3998             return vlan;
3999     }
4000     vlan = qemu_mallocz(sizeof(VLANState));
4001     if (!vlan)
4002         return NULL;
4003     vlan->id = id;
4004     vlan->next = NULL;
4005     pvlan = &first_vlan;
4006     while (*pvlan != NULL)
4007         pvlan = &(*pvlan)->next;
4008     *pvlan = vlan;
4009     return vlan;
4010 }
4011
4012 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
4013                                       IOReadHandler *fd_read,
4014                                       IOCanRWHandler *fd_can_read,
4015                                       void *opaque)
4016 {
4017     VLANClientState *vc, **pvc;
4018     vc = qemu_mallocz(sizeof(VLANClientState));
4019     if (!vc)
4020         return NULL;
4021     vc->fd_read = fd_read;
4022     vc->fd_can_read = fd_can_read;
4023     vc->opaque = opaque;
4024     vc->vlan = vlan;
4025
4026     vc->next = NULL;
4027     pvc = &vlan->first_client;
4028     while (*pvc != NULL)
4029         pvc = &(*pvc)->next;
4030     *pvc = vc;
4031     return vc;
4032 }
4033
4034 void qemu_del_vlan_client(VLANClientState *vc)
4035 {
4036     VLANClientState **pvc = &vc->vlan->first_client;
4037
4038     while (*pvc != NULL)
4039         if (*pvc == vc) {
4040             *pvc = vc->next;
4041             free(vc);
4042             break;
4043         } else
4044             pvc = &(*pvc)->next;
4045 }
4046
4047 int qemu_can_send_packet(VLANClientState *vc1)
4048 {
4049     VLANState *vlan = vc1->vlan;
4050     VLANClientState *vc;
4051
4052     for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
4053         if (vc != vc1) {
4054             if (vc->fd_can_read && vc->fd_can_read(vc->opaque))
4055                 return 1;
4056         }
4057     }
4058     return 0;
4059 }
4060
4061 void qemu_send_packet(VLANClientState *vc1, const uint8_t *buf, int size)
4062 {
4063     VLANState *vlan = vc1->vlan;
4064     VLANClientState *vc;
4065
4066 #if 0
4067     printf("vlan %d send:\n", vlan->id);
4068     hex_dump(stdout, buf, size);
4069 #endif
4070     for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
4071         if (vc != vc1) {
4072             vc->fd_read(vc->opaque, buf, size);
4073         }
4074     }
4075 }
4076
4077 #if defined(CONFIG_SLIRP)
4078
4079 /* slirp network adapter */
4080
4081 static int slirp_inited;
4082 static VLANClientState *slirp_vc;
4083
4084 int slirp_can_output(void)
4085 {
4086     return !slirp_vc || qemu_can_send_packet(slirp_vc);
4087 }
4088
4089 void slirp_output(const uint8_t *pkt, int pkt_len)
4090 {
4091 #if 0
4092     printf("slirp output:\n");
4093     hex_dump(stdout, pkt, pkt_len);
4094 #endif
4095     if (!slirp_vc)
4096         return;
4097     qemu_send_packet(slirp_vc, pkt, pkt_len);
4098 }
4099
4100 static void slirp_receive(void *opaque, const uint8_t *buf, int size)
4101 {
4102 #if 0
4103     printf("slirp input:\n");
4104     hex_dump(stdout, buf, size);
4105 #endif
4106     slirp_input(buf, size);
4107 }
4108
4109 static int net_slirp_init(VLANState *vlan)
4110 {
4111     if (!slirp_inited) {
4112         slirp_inited = 1;
4113         slirp_init();
4114     }
4115     slirp_vc = qemu_new_vlan_client(vlan,
4116                                     slirp_receive, NULL, NULL);
4117     snprintf(slirp_vc->info_str, sizeof(slirp_vc->info_str), "user redirector");
4118     return 0;
4119 }
4120
4121 static void net_slirp_redir(const char *redir_str)
4122 {
4123     int is_udp;
4124     char buf[256], *r;
4125     const char *p;
4126     struct in_addr guest_addr;
4127     int host_port, guest_port;
4128
4129     if (!slirp_inited) {
4130         slirp_inited = 1;
4131         slirp_init();
4132     }
4133
4134     p = redir_str;
4135     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
4136         goto fail;
4137     if (!strcmp(buf, "tcp")) {
4138         is_udp = 0;
4139     } else if (!strcmp(buf, "udp")) {
4140         is_udp = 1;
4141     } else {
4142         goto fail;
4143     }
4144
4145     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
4146         goto fail;
4147     host_port = strtol(buf, &r, 0);
4148     if (r == buf)
4149         goto fail;
4150
4151     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
4152         goto fail;
4153     if (buf[0] == '\0') {
4154         pstrcpy(buf, sizeof(buf), "10.0.2.15");
4155     }
4156     if (!inet_aton(buf, &guest_addr))
4157         goto fail;
4158
4159     guest_port = strtol(p, &r, 0);
4160     if (r == p)
4161         goto fail;
4162
4163     if (slirp_redir(is_udp, host_port, guest_addr, guest_port) < 0) {
4164         fprintf(stderr, "qemu: could not set up redirection\n");
4165         exit(1);
4166     }
4167     return;
4168  fail:
4169     fprintf(stderr, "qemu: syntax: -redir [tcp|udp]:host-port:[guest-host]:guest-port\n");
4170     exit(1);
4171 }
4172
4173 #ifndef _WIN32
4174
4175 char smb_dir[1024];
4176
4177 static void erase_dir(char *dir_name)
4178 {
4179     DIR *d;
4180     struct dirent *de;
4181     char filename[1024];
4182
4183     /* erase all the files in the directory */
4184     if ((d = opendir(dir_name)) != 0) {
4185         for(;;) {
4186             de = readdir(d);
4187             if (!de)
4188                 break;
4189             if (strcmp(de->d_name, ".") != 0 &&
4190                 strcmp(de->d_name, "..") != 0) {
4191                 snprintf(filename, sizeof(filename), "%s/%s",
4192                          smb_dir, de->d_name);
4193                 if (unlink(filename) != 0)  /* is it a directory? */
4194                     erase_dir(filename);
4195             }
4196         }
4197         closedir(d);
4198         rmdir(dir_name);
4199     }
4200 }
4201
4202 /* automatic user mode samba server configuration */
4203 static void smb_exit(void)
4204 {
4205     erase_dir(smb_dir);
4206 }
4207
4208 /* automatic user mode samba server configuration */
4209 static void net_slirp_smb(const char *exported_dir)
4210 {
4211     char smb_conf[1024];
4212     char smb_cmdline[1024];
4213     FILE *f;
4214
4215     if (!slirp_inited) {
4216         slirp_inited = 1;
4217         slirp_init();
4218     }
4219
4220     /* XXX: better tmp dir construction */
4221     snprintf(smb_dir, sizeof(smb_dir), "/tmp/qemu-smb.%d", getpid());
4222     if (mkdir(smb_dir, 0700) < 0) {
4223         fprintf(stderr, "qemu: could not create samba server dir '%s'\n", smb_dir);
4224         exit(1);
4225     }
4226     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", smb_dir, "smb.conf");
4227
4228     f = fopen(smb_conf, "w");
4229     if (!f) {
4230         fprintf(stderr, "qemu: could not create samba server configuration file '%s'\n", smb_conf);
4231         exit(1);
4232     }
4233     fprintf(f,
4234             "[global]\n"
4235             "private dir=%s\n"
4236             "smb ports=0\n"
4237             "socket address=127.0.0.1\n"
4238             "pid directory=%s\n"
4239             "lock directory=%s\n"
4240             "log file=%s/log.smbd\n"
4241             "smb passwd file=%s/smbpasswd\n"
4242             "security = share\n"
4243             "[qemu]\n"
4244             "path=%s\n"
4245             "read only=no\n"
4246             "guest ok=yes\n",
4247             smb_dir,
4248             smb_dir,
4249             smb_dir,
4250             smb_dir,
4251             smb_dir,
4252             exported_dir
4253             );
4254     fclose(f);
4255     atexit(smb_exit);
4256
4257     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
4258              SMBD_COMMAND, smb_conf);
4259
4260     slirp_add_exec(0, smb_cmdline, 4, 139);
4261 }
4262
4263 #endif /* !defined(_WIN32) */
4264 void do_info_slirp(void)
4265 {
4266     slirp_stats();
4267 }
4268
4269 #endif /* CONFIG_SLIRP */
4270
4271 #if !defined(_WIN32)
4272
4273 typedef struct TAPState {
4274     VLANClientState *vc;
4275     int fd;
4276     char down_script[1024];
4277 } TAPState;
4278
4279 static void tap_receive(void *opaque, const uint8_t *buf, int size)
4280 {
4281     TAPState *s = opaque;
4282     int ret;
4283     for(;;) {
4284         ret = write(s->fd, buf, size);
4285         if (ret < 0 && (errno == EINTR || errno == EAGAIN)) {
4286         } else {
4287             break;
4288         }
4289     }
4290 }
4291
4292 static void tap_send(void *opaque)
4293 {
4294     TAPState *s = opaque;
4295     uint8_t buf[4096];
4296     int size;
4297
4298 #ifdef __sun__
4299     struct strbuf sbuf;
4300     int f = 0;
4301     sbuf.maxlen = sizeof(buf);
4302     sbuf.buf = buf;
4303     size = getmsg(s->fd, NULL, &sbuf, &f) >=0 ? sbuf.len : -1;
4304 #else
4305     size = read(s->fd, buf, sizeof(buf));
4306 #endif
4307     if (size > 0) {
4308         qemu_send_packet(s->vc, buf, size);
4309     }
4310 }
4311
4312 /* fd support */
4313
4314 static TAPState *net_tap_fd_init(VLANState *vlan, int fd)
4315 {
4316     TAPState *s;
4317
4318     s = qemu_mallocz(sizeof(TAPState));
4319     if (!s)
4320         return NULL;
4321     s->fd = fd;
4322     s->vc = qemu_new_vlan_client(vlan, tap_receive, NULL, s);
4323     qemu_set_fd_handler(s->fd, tap_send, NULL, s);
4324     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "tap: fd=%d", fd);
4325     return s;
4326 }
4327
4328 #if defined (_BSD) || defined (__FreeBSD_kernel__)
4329 static int tap_open(char *ifname, int ifname_size)
4330 {
4331     int fd;
4332     char *dev;
4333     struct stat s;
4334
4335     TFR(fd = open("/dev/tap", O_RDWR));
4336     if (fd < 0) {
4337         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
4338         return -1;
4339     }
4340
4341     fstat(fd, &s);
4342     dev = devname(s.st_rdev, S_IFCHR);
4343     pstrcpy(ifname, ifname_size, dev);
4344
4345     fcntl(fd, F_SETFL, O_NONBLOCK);
4346     return fd;
4347 }
4348 #elif defined(__sun__)
4349 #define TUNNEWPPA       (('T'<<16) | 0x0001)
4350 /*
4351  * Allocate TAP device, returns opened fd.
4352  * Stores dev name in the first arg(must be large enough).
4353  */
4354 int tap_alloc(char *dev)
4355 {
4356     int tap_fd, if_fd, ppa = -1;
4357     static int ip_fd = 0;
4358     char *ptr;
4359
4360     static int arp_fd = 0;
4361     int ip_muxid, arp_muxid;
4362     struct strioctl  strioc_if, strioc_ppa;
4363     int link_type = I_PLINK;;
4364     struct lifreq ifr;
4365     char actual_name[32] = "";
4366
4367     memset(&ifr, 0x0, sizeof(ifr));
4368
4369     if( *dev ){
4370        ptr = dev;
4371        while( *ptr && !isdigit((int)*ptr) ) ptr++;
4372        ppa = atoi(ptr);
4373     }
4374
4375     /* Check if IP device was opened */
4376     if( ip_fd )
4377        close(ip_fd);
4378
4379     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
4380     if (ip_fd < 0) {
4381        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
4382        return -1;
4383     }
4384
4385     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
4386     if (tap_fd < 0) {
4387        syslog(LOG_ERR, "Can't open /dev/tap");
4388        return -1;
4389     }
4390
4391     /* Assign a new PPA and get its unit number. */
4392     strioc_ppa.ic_cmd = TUNNEWPPA;
4393     strioc_ppa.ic_timout = 0;
4394     strioc_ppa.ic_len = sizeof(ppa);
4395     strioc_ppa.ic_dp = (char *)&ppa;
4396     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
4397        syslog (LOG_ERR, "Can't assign new interface");
4398
4399     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
4400     if (if_fd < 0) {
4401        syslog(LOG_ERR, "Can't open /dev/tap (2)");
4402        return -1;
4403     }
4404     if(ioctl(if_fd, I_PUSH, "ip") < 0){
4405        syslog(LOG_ERR, "Can't push IP module");
4406        return -1;
4407     }
4408
4409     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
4410         syslog(LOG_ERR, "Can't get flags\n");
4411
4412     snprintf (actual_name, 32, "tap%d", ppa);
4413     strncpy (ifr.lifr_name, actual_name, sizeof (ifr.lifr_name));
4414
4415     ifr.lifr_ppa = ppa;
4416     /* Assign ppa according to the unit number returned by tun device */
4417
4418     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
4419         syslog (LOG_ERR, "Can't set PPA %d", ppa);
4420     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
4421         syslog (LOG_ERR, "Can't get flags\n");
4422     /* Push arp module to if_fd */
4423     if (ioctl (if_fd, I_PUSH, "arp") < 0)
4424         syslog (LOG_ERR, "Can't push ARP module (2)");
4425
4426     /* Push arp module to ip_fd */
4427     if (ioctl (ip_fd, I_POP, NULL) < 0)
4428         syslog (LOG_ERR, "I_POP failed\n");
4429     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
4430         syslog (LOG_ERR, "Can't push ARP module (3)\n");
4431     /* Open arp_fd */
4432     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
4433     if (arp_fd < 0)
4434        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
4435
4436     /* Set ifname to arp */
4437     strioc_if.ic_cmd = SIOCSLIFNAME;
4438     strioc_if.ic_timout = 0;
4439     strioc_if.ic_len = sizeof(ifr);
4440     strioc_if.ic_dp = (char *)&ifr;
4441     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
4442         syslog (LOG_ERR, "Can't set ifname to arp\n");
4443     }
4444
4445     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
4446        syslog(LOG_ERR, "Can't link TAP device to IP");
4447        return -1;
4448     }
4449
4450     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
4451         syslog (LOG_ERR, "Can't link TAP device to ARP");
4452
4453     close (if_fd);
4454
4455     memset(&ifr, 0x0, sizeof(ifr));
4456     strncpy (ifr.lifr_name, actual_name, sizeof (ifr.lifr_name));
4457     ifr.lifr_ip_muxid  = ip_muxid;
4458     ifr.lifr_arp_muxid = arp_muxid;
4459
4460     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
4461     {
4462       ioctl (ip_fd, I_PUNLINK , arp_muxid);
4463       ioctl (ip_fd, I_PUNLINK, ip_muxid);
4464       syslog (LOG_ERR, "Can't set multiplexor id");
4465     }
4466
4467     sprintf(dev, "tap%d", ppa);
4468     return tap_fd;
4469 }
4470
4471 static int tap_open(char *ifname, int ifname_size)
4472 {
4473     char  dev[10]="";
4474     int fd;
4475     if( (fd = tap_alloc(dev)) < 0 ){
4476        fprintf(stderr, "Cannot allocate TAP device\n");
4477        return -1;
4478     }
4479     pstrcpy(ifname, ifname_size, dev);
4480     fcntl(fd, F_SETFL, O_NONBLOCK);
4481     return fd;
4482 }
4483 #else
4484 static int tap_open(char *ifname, int ifname_size)
4485 {
4486     struct ifreq ifr;
4487     int fd, ret;
4488
4489     TFR(fd = open("/dev/net/tun", O_RDWR));
4490     if (fd < 0) {
4491         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
4492         return -1;
4493     }
4494     memset(&ifr, 0, sizeof(ifr));
4495     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
4496     if (ifname[0] != '\0')
4497         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
4498     else
4499         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
4500     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
4501     if (ret != 0) {
4502         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
4503         close(fd);
4504         return -1;
4505     }
4506     pstrcpy(ifname, ifname_size, ifr.ifr_name);
4507     fcntl(fd, F_SETFL, O_NONBLOCK);
4508     return fd;
4509 }
4510 #endif
4511
4512 static int launch_script(const char *setup_script, const char *ifname, int fd)
4513 {
4514     int pid, status;
4515     char *args[3];
4516     char **parg;
4517
4518         /* try to launch network script */
4519         pid = fork();
4520         if (pid >= 0) {
4521             if (pid == 0) {
4522                 int open_max = sysconf (_SC_OPEN_MAX), i;
4523                 for (i = 0; i < open_max; i++)
4524                     if (i != STDIN_FILENO &&
4525                         i != STDOUT_FILENO &&
4526                         i != STDERR_FILENO &&
4527                         i != fd)
4528                         close(i);
4529
4530                 parg = args;
4531                 *parg++ = (char *)setup_script;
4532                 *parg++ = (char *)ifname;
4533                 *parg++ = NULL;
4534                 execv(setup_script, args);
4535                 _exit(1);
4536             }
4537             while (waitpid(pid, &status, 0) != pid);
4538             if (!WIFEXITED(status) ||
4539                 WEXITSTATUS(status) != 0) {
4540                 fprintf(stderr, "%s: could not launch network script\n",
4541                         setup_script);
4542                 return -1;
4543             }
4544         }
4545     return 0;
4546 }
4547
4548 static int net_tap_init(VLANState *vlan, const char *ifname1,
4549                         const char *setup_script, const char *down_script)
4550 {
4551     TAPState *s;
4552     int fd;
4553     char ifname[128];
4554
4555     if (ifname1 != NULL)
4556         pstrcpy(ifname, sizeof(ifname), ifname1);
4557     else
4558         ifname[0] = '\0';
4559     TFR(fd = tap_open(ifname, sizeof(ifname)));
4560     if (fd < 0)
4561         return -1;
4562
4563     if (!setup_script || !strcmp(setup_script, "no"))
4564         setup_script = "";
4565     if (setup_script[0] != '\0') {
4566         if (launch_script(setup_script, ifname, fd))
4567             return -1;
4568     }
4569     s = net_tap_fd_init(vlan, fd);
4570     if (!s)
4571         return -1;
4572     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
4573              "tap: ifname=%s setup_script=%s", ifname, setup_script);
4574     if (down_script && strcmp(down_script, "no"))
4575         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
4576     return 0;
4577 }
4578
4579 #endif /* !_WIN32 */
4580
4581 #if defined(CONFIG_VDE)
4582 typedef struct VDEState {
4583     VLANClientState *vc;
4584     VDECONN *vde;
4585 } VDEState;
4586
4587 static void vde_to_qemu(void *opaque)
4588 {
4589     VDEState *s = opaque;
4590     uint8_t buf[4096];
4591     int size;
4592
4593     size = vde_recv(s->vde, buf, sizeof(buf), 0);
4594     if (size > 0) {
4595         qemu_send_packet(s->vc, buf, size);
4596     }
4597 }
4598
4599 static void vde_from_qemu(void *opaque, const uint8_t *buf, int size)
4600 {
4601     VDEState *s = opaque;
4602     int ret;
4603     for(;;) {
4604         ret = vde_send(s->vde, buf, size, 0);
4605         if (ret < 0 && errno == EINTR) {
4606         } else {
4607             break;
4608         }
4609     }
4610 }
4611
4612 static int net_vde_init(VLANState *vlan, const char *sock, int port,
4613                         const char *group, int mode)
4614 {
4615     VDEState *s;
4616     char *init_group = strlen(group) ? (char *)group : NULL;
4617     char *init_sock = strlen(sock) ? (char *)sock : NULL;
4618
4619     struct vde_open_args args = {
4620         .port = port,
4621         .group = init_group,
4622         .mode = mode,
4623     };
4624
4625     s = qemu_mallocz(sizeof(VDEState));
4626     if (!s)
4627         return -1;
4628     s->vde = vde_open(init_sock, "QEMU", &args);
4629     if (!s->vde){
4630         free(s);
4631         return -1;
4632     }
4633     s->vc = qemu_new_vlan_client(vlan, vde_from_qemu, NULL, s);
4634     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
4635     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "vde: sock=%s fd=%d",
4636              sock, vde_datafd(s->vde));
4637     return 0;
4638 }
4639 #endif
4640
4641 /* network connection */
4642 typedef struct NetSocketState {
4643     VLANClientState *vc;
4644     int fd;
4645     int state; /* 0 = getting length, 1 = getting data */
4646     int index;
4647     int packet_len;
4648     uint8_t buf[4096];
4649     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
4650 } NetSocketState;
4651
4652 typedef struct NetSocketListenState {
4653     VLANState *vlan;
4654     int fd;
4655 } NetSocketListenState;
4656
4657 /* XXX: we consider we can send the whole packet without blocking */
4658 static void net_socket_receive(void *opaque, const uint8_t *buf, int size)
4659 {
4660     NetSocketState *s = opaque;
4661     uint32_t len;
4662     len = htonl(size);
4663
4664     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
4665     send_all(s->fd, buf, size);
4666 }
4667
4668 static void net_socket_receive_dgram(void *opaque, const uint8_t *buf, int size)
4669 {
4670     NetSocketState *s = opaque;
4671     sendto(s->fd, buf, size, 0,
4672            (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
4673 }
4674
4675 static void net_socket_send(void *opaque)
4676 {
4677     NetSocketState *s = opaque;
4678     int l, size, err;
4679     uint8_t buf1[4096];
4680     const uint8_t *buf;
4681
4682     size = recv(s->fd, buf1, sizeof(buf1), 0);
4683     if (size < 0) {
4684         err = socket_error();
4685         if (err != EWOULDBLOCK)
4686             goto eoc;
4687     } else if (size == 0) {
4688         /* end of connection */
4689     eoc:
4690         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
4691         closesocket(s->fd);
4692         return;
4693     }
4694     buf = buf1;
4695     while (size > 0) {
4696         /* reassemble a packet from the network */
4697         switch(s->state) {
4698         case 0:
4699             l = 4 - s->index;
4700             if (l > size)
4701                 l = size;
4702             memcpy(s->buf + s->index, buf, l);
4703             buf += l;
4704             size -= l;
4705             s->index += l;
4706             if (s->index == 4) {
4707                 /* got length */
4708                 s->packet_len = ntohl(*(uint32_t *)s->buf);
4709                 s->index = 0;
4710                 s->state = 1;
4711             }
4712             break;
4713         case 1:
4714             l = s->packet_len - s->index;
4715             if (l > size)
4716                 l = size;
4717             memcpy(s->buf + s->index, buf, l);
4718             s->index += l;
4719             buf += l;
4720             size -= l;
4721             if (s->index >= s->packet_len) {
4722                 qemu_send_packet(s->vc, s->buf, s->packet_len);
4723                 s->index = 0;
4724                 s->state = 0;
4725             }
4726             break;
4727         }
4728     }
4729 }
4730
4731 static void net_socket_send_dgram(void *opaque)
4732 {
4733     NetSocketState *s = opaque;
4734     int size;
4735
4736     size = recv(s->fd, s->buf, sizeof(s->buf), 0);
4737     if (size < 0)
4738         return;
4739     if (size == 0) {
4740         /* end of connection */
4741         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
4742         return;
4743     }
4744     qemu_send_packet(s->vc, s->buf, size);
4745 }
4746
4747 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
4748 {
4749     struct ip_mreq imr;
4750     int fd;
4751     int val, ret;
4752     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
4753         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
4754                 inet_ntoa(mcastaddr->sin_addr),
4755                 (int)ntohl(mcastaddr->sin_addr.s_addr));
4756         return -1;
4757
4758     }
4759     fd = socket(PF_INET, SOCK_DGRAM, 0);
4760     if (fd < 0) {
4761         perror("socket(PF_INET, SOCK_DGRAM)");
4762         return -1;
4763     }
4764
4765     val = 1;
4766     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
4767                    (const char *)&val, sizeof(val));
4768     if (ret < 0) {
4769         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
4770         goto fail;
4771     }
4772
4773     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
4774     if (ret < 0) {
4775         perror("bind");
4776         goto fail;
4777     }
4778
4779     /* Add host to multicast group */
4780     imr.imr_multiaddr = mcastaddr->sin_addr;
4781     imr.imr_interface.s_addr = htonl(INADDR_ANY);
4782
4783     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
4784                      (const char *)&imr, sizeof(struct ip_mreq));
4785     if (ret < 0) {
4786         perror("setsockopt(IP_ADD_MEMBERSHIP)");
4787         goto fail;
4788     }
4789
4790     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
4791     val = 1;
4792     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
4793                    (const char *)&val, sizeof(val));
4794     if (ret < 0) {
4795         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
4796         goto fail;
4797     }
4798
4799     socket_set_nonblock(fd);
4800     return fd;
4801 fail:
4802     if (fd >= 0)
4803         closesocket(fd);
4804     return -1;
4805 }
4806
4807 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan, int fd,
4808                                           int is_connected)
4809 {
4810     struct sockaddr_in saddr;
4811     int newfd;
4812     socklen_t saddr_len;
4813     NetSocketState *s;
4814
4815     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
4816      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
4817      * by ONLY ONE process: we must "clone" this dgram socket --jjo
4818      */
4819
4820     if (is_connected) {
4821         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
4822             /* must be bound */
4823             if (saddr.sin_addr.s_addr==0) {
4824                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
4825                         fd);
4826                 return NULL;
4827             }
4828             /* clone dgram socket */
4829             newfd = net_socket_mcast_create(&saddr);
4830             if (newfd < 0) {
4831                 /* error already reported by net_socket_mcast_create() */
4832                 close(fd);
4833                 return NULL;
4834             }
4835             /* clone newfd to fd, close newfd */
4836             dup2(newfd, fd);
4837             close(newfd);
4838
4839         } else {
4840             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
4841                     fd, strerror(errno));
4842             return NULL;
4843         }
4844     }
4845
4846     s = qemu_mallocz(sizeof(NetSocketState));
4847     if (!s)
4848         return NULL;
4849     s->fd = fd;
4850
4851     s->vc = qemu_new_vlan_client(vlan, net_socket_receive_dgram, NULL, s);
4852     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
4853
4854     /* mcast: save bound address as dst */
4855     if (is_connected) s->dgram_dst=saddr;
4856
4857     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
4858             "socket: fd=%d (%s mcast=%s:%d)",
4859             fd, is_connected? "cloned" : "",
4860             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
4861     return s;
4862 }
4863
4864 static void net_socket_connect(void *opaque)
4865 {
4866     NetSocketState *s = opaque;
4867     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
4868 }
4869
4870 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan, int fd,
4871                                           int is_connected)
4872 {
4873     NetSocketState *s;
4874     s = qemu_mallocz(sizeof(NetSocketState));
4875     if (!s)
4876         return NULL;
4877     s->fd = fd;
4878     s->vc = qemu_new_vlan_client(vlan,
4879                                  net_socket_receive, NULL, s);
4880     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
4881              "socket: fd=%d", fd);
4882     if (is_connected) {
4883         net_socket_connect(s);
4884     } else {
4885         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
4886     }
4887     return s;
4888 }
4889
4890 static NetSocketState *net_socket_fd_init(VLANState *vlan, int fd,
4891                                           int is_connected)
4892 {
4893     int so_type=-1, optlen=sizeof(so_type);
4894
4895     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
4896         (socklen_t *)&optlen)< 0) {
4897         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
4898         return NULL;
4899     }
4900     switch(so_type) {
4901     case SOCK_DGRAM:
4902         return net_socket_fd_init_dgram(vlan, fd, is_connected);
4903     case SOCK_STREAM:
4904         return net_socket_fd_init_stream(vlan, fd, is_connected);
4905     default:
4906         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
4907         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
4908         return net_socket_fd_init_stream(vlan, fd, is_connected);
4909     }
4910     return NULL;
4911 }
4912
4913 static void net_socket_accept(void *opaque)
4914 {
4915     NetSocketListenState *s = opaque;
4916     NetSocketState *s1;
4917     struct sockaddr_in saddr;
4918     socklen_t len;
4919     int fd;
4920
4921     for(;;) {
4922         len = sizeof(saddr);
4923         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
4924         if (fd < 0 && errno != EINTR) {
4925             return;
4926         } else if (fd >= 0) {
4927             break;
4928         }
4929     }
4930     s1 = net_socket_fd_init(s->vlan, fd, 1);
4931     if (!s1) {
4932         closesocket(fd);
4933     } else {
4934         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
4935                  "socket: connection from %s:%d",
4936                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
4937     }
4938 }
4939
4940 static int net_socket_listen_init(VLANState *vlan, const char *host_str)
4941 {
4942     NetSocketListenState *s;
4943     int fd, val, ret;
4944     struct sockaddr_in saddr;
4945
4946     if (parse_host_port(&saddr, host_str) < 0)
4947         return -1;
4948
4949     s = qemu_mallocz(sizeof(NetSocketListenState));
4950     if (!s)
4951         return -1;
4952
4953     fd = socket(PF_INET, SOCK_STREAM, 0);
4954     if (fd < 0) {
4955         perror("socket");
4956         return -1;
4957     }
4958     socket_set_nonblock(fd);
4959
4960     /* allow fast reuse */
4961     val = 1;
4962     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
4963
4964     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
4965     if (ret < 0) {
4966         perror("bind");
4967         return -1;
4968     }
4969     ret = listen(fd, 0);
4970     if (ret < 0) {
4971         perror("listen");
4972         return -1;
4973     }
4974     s->vlan = vlan;
4975     s->fd = fd;
4976     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
4977     return 0;
4978 }
4979
4980 static int net_socket_connect_init(VLANState *vlan, const char *host_str)
4981 {
4982     NetSocketState *s;
4983     int fd, connected, ret, err;
4984     struct sockaddr_in saddr;
4985
4986     if (parse_host_port(&saddr, host_str) < 0)
4987         return -1;
4988
4989     fd = socket(PF_INET, SOCK_STREAM, 0);
4990     if (fd < 0) {
4991         perror("socket");
4992         return -1;
4993     }
4994     socket_set_nonblock(fd);
4995
4996     connected = 0;
4997     for(;;) {
4998         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
4999         if (ret < 0) {
5000             err = socket_error();
5001             if (err == EINTR || err == EWOULDBLOCK) {
5002             } else if (err == EINPROGRESS) {
5003                 break;
5004 #ifdef _WIN32
5005             } else if (err == WSAEALREADY) {
5006                 break;
5007 #endif
5008             } else {
5009                 perror("connect");
5010                 closesocket(fd);
5011                 return -1;
5012             }
5013         } else {
5014             connected = 1;
5015             break;
5016         }
5017     }
5018     s = net_socket_fd_init(vlan, fd, connected);
5019     if (!s)
5020         return -1;
5021     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
5022              "socket: connect to %s:%d",
5023              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
5024     return 0;
5025 }
5026
5027 static int net_socket_mcast_init(VLANState *vlan, const char *host_str)
5028 {
5029     NetSocketState *s;
5030     int fd;
5031     struct sockaddr_in saddr;
5032
5033     if (parse_host_port(&saddr, host_str) < 0)
5034         return -1;
5035
5036
5037     fd = net_socket_mcast_create(&saddr);
5038     if (fd < 0)
5039         return -1;
5040
5041     s = net_socket_fd_init(vlan, fd, 0);
5042     if (!s)
5043         return -1;
5044
5045     s->dgram_dst = saddr;
5046
5047     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
5048              "socket: mcast=%s:%d",
5049              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
5050     return 0;
5051
5052 }
5053
5054 static const char *get_opt_name(char *buf, int buf_size, const char *p)
5055 {
5056     char *q;
5057
5058     q = buf;
5059     while (*p != '\0' && *p != '=') {
5060         if (q && (q - buf) < buf_size - 1)
5061             *q++ = *p;
5062         p++;
5063     }
5064     if (q)
5065         *q = '\0';
5066
5067     return p;
5068 }
5069
5070 static const char *get_opt_value(char *buf, int buf_size, const char *p)
5071 {
5072     char *q;
5073
5074     q = buf;
5075     while (*p != '\0') {
5076         if (*p == ',') {
5077             if (*(p + 1) != ',')
5078                 break;
5079             p++;
5080         }
5081         if (q && (q - buf) < buf_size - 1)
5082             *q++ = *p;
5083         p++;
5084     }
5085     if (q)
5086         *q = '\0';
5087
5088     return p;
5089 }
5090
5091 static int get_param_value(char *buf, int buf_size,
5092                            const char *tag, const char *str)
5093 {
5094     const char *p;
5095     char option[128];
5096
5097     p = str;
5098     for(;;) {
5099         p = get_opt_name(option, sizeof(option), p);
5100         if (*p != '=')
5101             break;
5102         p++;
5103         if (!strcmp(tag, option)) {
5104             (void)get_opt_value(buf, buf_size, p);
5105             return strlen(buf);
5106         } else {
5107             p = get_opt_value(NULL, 0, p);
5108         }
5109         if (*p != ',')
5110             break;
5111         p++;
5112     }
5113     return 0;
5114 }
5115
5116 static int check_params(char *buf, int buf_size,
5117                         char **params, const char *str)
5118 {
5119     const char *p;
5120     int i;
5121
5122     p = str;
5123     for(;;) {
5124         p = get_opt_name(buf, buf_size, p);
5125         if (*p != '=')
5126             return -1;
5127         p++;
5128         for(i = 0; params[i] != NULL; i++)
5129             if (!strcmp(params[i], buf))
5130                 break;
5131         if (params[i] == NULL)
5132             return -1;
5133         p = get_opt_value(NULL, 0, p);
5134         if (*p != ',')
5135             break;
5136         p++;
5137     }
5138     return 0;
5139 }
5140
5141
5142 static int net_client_init(const char *str)
5143 {
5144     const char *p;
5145     char *q;
5146     char device[64];
5147     char buf[1024];
5148     int vlan_id, ret;
5149     VLANState *vlan;
5150
5151     p = str;
5152     q = device;
5153     while (*p != '\0' && *p != ',') {
5154         if ((q - device) < sizeof(device) - 1)
5155             *q++ = *p;
5156         p++;
5157     }
5158     *q = '\0';
5159     if (*p == ',')
5160         p++;
5161     vlan_id = 0;
5162     if (get_param_value(buf, sizeof(buf), "vlan", p)) {
5163         vlan_id = strtol(buf, NULL, 0);
5164     }
5165     vlan = qemu_find_vlan(vlan_id);
5166     if (!vlan) {
5167         fprintf(stderr, "Could not create vlan %d\n", vlan_id);
5168         return -1;
5169     }
5170     if (!strcmp(device, "nic")) {
5171         NICInfo *nd;
5172         uint8_t *macaddr;
5173
5174         if (nb_nics >= MAX_NICS) {
5175             fprintf(stderr, "Too Many NICs\n");
5176             return -1;
5177         }
5178         nd = &nd_table[nb_nics];
5179         macaddr = nd->macaddr;
5180         macaddr[0] = 0x52;
5181         macaddr[1] = 0x54;
5182         macaddr[2] = 0x00;
5183         macaddr[3] = 0x12;
5184         macaddr[4] = 0x34;
5185         macaddr[5] = 0x56 + nb_nics;
5186
5187         if (get_param_value(buf, sizeof(buf), "macaddr", p)) {
5188             if (parse_macaddr(macaddr, buf) < 0) {
5189                 fprintf(stderr, "invalid syntax for ethernet address\n");
5190                 return -1;
5191             }
5192         }
5193         if (get_param_value(buf, sizeof(buf), "model", p)) {
5194             nd->model = strdup(buf);
5195         }
5196         nd->vlan = vlan;
5197         nb_nics++;
5198         vlan->nb_guest_devs++;
5199         ret = 0;
5200     } else
5201     if (!strcmp(device, "none")) {
5202         /* does nothing. It is needed to signal that no network cards
5203            are wanted */
5204         ret = 0;
5205     } else
5206 #ifdef CONFIG_SLIRP
5207     if (!strcmp(device, "user")) {
5208         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
5209             pstrcpy(slirp_hostname, sizeof(slirp_hostname), buf);
5210         }
5211         vlan->nb_host_devs++;
5212         ret = net_slirp_init(vlan);
5213     } else
5214 #endif
5215 #ifdef _WIN32
5216     if (!strcmp(device, "tap")) {
5217         char ifname[64];
5218         if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
5219             fprintf(stderr, "tap: no interface name\n");
5220             return -1;
5221         }
5222         vlan->nb_host_devs++;
5223         ret = tap_win32_init(vlan, ifname);
5224     } else
5225 #else
5226     if (!strcmp(device, "tap")) {
5227         char ifname[64];
5228         char setup_script[1024], down_script[1024];
5229         int fd;
5230         vlan->nb_host_devs++;
5231         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
5232             fd = strtol(buf, NULL, 0);
5233             fcntl(fd, F_SETFL, O_NONBLOCK);
5234             ret = -1;
5235             if (net_tap_fd_init(vlan, fd))
5236                 ret = 0;
5237         } else {
5238             if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
5239                 ifname[0] = '\0';
5240             }
5241             if (get_param_value(setup_script, sizeof(setup_script), "script", p) == 0) {
5242                 pstrcpy(setup_script, sizeof(setup_script), DEFAULT_NETWORK_SCRIPT);
5243             }
5244             if (get_param_value(down_script, sizeof(down_script), "downscript", p) == 0) {
5245                 pstrcpy(down_script, sizeof(down_script), DEFAULT_NETWORK_DOWN_SCRIPT);
5246             }
5247             ret = net_tap_init(vlan, ifname, setup_script, down_script);
5248         }
5249     } else
5250 #endif
5251     if (!strcmp(device, "socket")) {
5252         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
5253             int fd;
5254             fd = strtol(buf, NULL, 0);
5255             ret = -1;
5256             if (net_socket_fd_init(vlan, fd, 1))
5257                 ret = 0;
5258         } else if (get_param_value(buf, sizeof(buf), "listen", p) > 0) {
5259             ret = net_socket_listen_init(vlan, buf);
5260         } else if (get_param_value(buf, sizeof(buf), "connect", p) > 0) {
5261             ret = net_socket_connect_init(vlan, buf);
5262         } else if (get_param_value(buf, sizeof(buf), "mcast", p) > 0) {
5263             ret = net_socket_mcast_init(vlan, buf);
5264         } else {
5265             fprintf(stderr, "Unknown socket options: %s\n", p);
5266             return -1;
5267         }
5268         vlan->nb_host_devs++;
5269     } else
5270 #ifdef CONFIG_VDE
5271     if (!strcmp(device, "vde")) {
5272         char vde_sock[1024], vde_group[512];
5273         int vde_port, vde_mode;
5274         vlan->nb_host_devs++;
5275         if (get_param_value(vde_sock, sizeof(vde_sock), "sock", p) <= 0) {
5276             vde_sock[0] = '\0';
5277         }
5278         if (get_param_value(buf, sizeof(buf), "port", p) > 0) {
5279             vde_port = strtol(buf, NULL, 10);
5280         } else {
5281             vde_port = 0;
5282         }
5283         if (get_param_value(vde_group, sizeof(vde_group), "group", p) <= 0) {
5284             vde_group[0] = '\0';
5285         }
5286         if (get_param_value(buf, sizeof(buf), "mode", p) > 0) {
5287             vde_mode = strtol(buf, NULL, 8);
5288         } else {
5289             vde_mode = 0700;
5290         }
5291         ret = net_vde_init(vlan, vde_sock, vde_port, vde_group, vde_mode);
5292     } else
5293 #endif
5294     {
5295         fprintf(stderr, "Unknown network device: %s\n", device);
5296         return -1;
5297     }
5298     if (ret < 0) {
5299         fprintf(stderr, "Could not initialize device '%s'\n", device);
5300     }
5301
5302     return ret;
5303 }
5304
5305 void do_info_network(void)
5306 {
5307     VLANState *vlan;
5308     VLANClientState *vc;
5309
5310     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
5311         term_printf("VLAN %d devices:\n", vlan->id);
5312         for(vc = vlan->first_client; vc != NULL; vc = vc->next)
5313             term_printf("  %s\n", vc->info_str);
5314     }
5315 }
5316
5317 #define HD_ALIAS "index=%d,media=disk"
5318 #ifdef TARGET_PPC
5319 #define CDROM_ALIAS "index=1,media=cdrom"
5320 #else
5321 #define CDROM_ALIAS "index=2,media=cdrom"
5322 #endif
5323 #define FD_ALIAS "index=%d,if=floppy"
5324 #define PFLASH_ALIAS "if=pflash"
5325 #define MTD_ALIAS "if=mtd"
5326 #define SD_ALIAS "index=0,if=sd"
5327
5328 static int drive_add(const char *file, const char *fmt, ...)
5329 {
5330     va_list ap;
5331
5332     if (nb_drives_opt >= MAX_DRIVES) {
5333         fprintf(stderr, "qemu: too many drives\n");
5334         exit(1);
5335     }
5336
5337     drives_opt[nb_drives_opt].file = file;
5338     va_start(ap, fmt);
5339     vsnprintf(drives_opt[nb_drives_opt].opt,
5340               sizeof(drives_opt[0].opt), fmt, ap);
5341     va_end(ap);
5342
5343     return nb_drives_opt++;
5344 }
5345
5346 int drive_get_index(BlockInterfaceType type, int bus, int unit)
5347 {
5348     int index;
5349
5350     /* seek interface, bus and unit */
5351
5352     for (index = 0; index < nb_drives; index++)
5353         if (drives_table[index].type == type &&
5354             drives_table[index].bus == bus &&
5355             drives_table[index].unit == unit)
5356         return index;
5357
5358     return -1;
5359 }
5360
5361 int drive_get_max_bus(BlockInterfaceType type)
5362 {
5363     int max_bus;
5364     int index;
5365
5366     max_bus = -1;
5367     for (index = 0; index < nb_drives; index++) {
5368         if(drives_table[index].type == type &&
5369            drives_table[index].bus > max_bus)
5370             max_bus = drives_table[index].bus;
5371     }
5372     return max_bus;
5373 }
5374
5375 static void bdrv_format_print(void *opaque, const char *name)
5376 {
5377     fprintf(stderr, " %s", name);
5378 }
5379
5380 static int drive_init(struct drive_opt *arg, int snapshot,
5381                       QEMUMachine *machine)
5382 {
5383     char buf[128];
5384     char file[1024];
5385     char devname[128];
5386     const char *mediastr = "";
5387     BlockInterfaceType type;
5388     enum { MEDIA_DISK, MEDIA_CDROM } media;
5389     int bus_id, unit_id;
5390     int cyls, heads, secs, translation;
5391     BlockDriverState *bdrv;
5392     BlockDriver *drv = NULL;
5393     int max_devs;
5394     int index;
5395     int cache;
5396     int bdrv_flags;
5397     char *str = arg->opt;
5398     char *params[] = { "bus", "unit", "if", "index", "cyls", "heads",
5399                        "secs", "trans", "media", "snapshot", "file",
5400                        "cache", "format", NULL };
5401
5402     if (check_params(buf, sizeof(buf), params, str) < 0) {
5403          fprintf(stderr, "qemu: unknown parameter '%s' in '%s'\n",
5404                          buf, str);
5405          return -1;
5406     }
5407
5408     file[0] = 0;
5409     cyls = heads = secs = 0;
5410     bus_id = 0;
5411     unit_id = -1;
5412     translation = BIOS_ATA_TRANSLATION_AUTO;
5413     index = -1;
5414     cache = 1;
5415
5416     if (!strcmp(machine->name, "realview") ||
5417         !strcmp(machine->name, "SS-5") ||
5418         !strcmp(machine->name, "SS-10") ||
5419         !strcmp(machine->name, "SS-600MP") ||
5420         !strcmp(machine->name, "versatilepb") ||
5421         !strcmp(machine->name, "versatileab")) {
5422         type = IF_SCSI;
5423         max_devs = MAX_SCSI_DEVS;
5424         strcpy(devname, "scsi");
5425     } else {
5426         type = IF_IDE;
5427         max_devs = MAX_IDE_DEVS;
5428         strcpy(devname, "ide");
5429     }
5430     media = MEDIA_DISK;
5431
5432     /* extract parameters */
5433
5434     if (get_param_value(buf, sizeof(buf), "bus", str)) {
5435         bus_id = strtol(buf, NULL, 0);
5436         if (bus_id < 0) {
5437             fprintf(stderr, "qemu: '%s' invalid bus id\n", str);
5438             return -1;
5439         }
5440     }
5441
5442     if (get_param_value(buf, sizeof(buf), "unit", str)) {
5443         unit_id = strtol(buf, NULL, 0);
5444         if (unit_id < 0) {
5445             fprintf(stderr, "qemu: '%s' invalid unit id\n", str);
5446             return -1;
5447         }
5448     }
5449
5450     if (get_param_value(buf, sizeof(buf), "if", str)) {
5451         pstrcpy(devname, sizeof(devname), buf);
5452         if (!strcmp(buf, "ide")) {
5453             type = IF_IDE;
5454             max_devs = MAX_IDE_DEVS;
5455         } else if (!strcmp(buf, "scsi")) {
5456             type = IF_SCSI;
5457             max_devs = MAX_SCSI_DEVS;
5458         } else if (!strcmp(buf, "floppy")) {
5459             type = IF_FLOPPY;
5460             max_devs = 0;
5461         } else if (!strcmp(buf, "pflash")) {
5462             type = IF_PFLASH;
5463             max_devs = 0;
5464         } else if (!strcmp(buf, "mtd")) {
5465             type = IF_MTD;
5466             max_devs = 0;
5467         } else if (!strcmp(buf, "sd")) {
5468             type = IF_SD;
5469             max_devs = 0;
5470         } else {
5471             fprintf(stderr, "qemu: '%s' unsupported bus type '%s'\n", str, buf);
5472             return -1;
5473         }
5474     }
5475
5476     if (get_param_value(buf, sizeof(buf), "index", str)) {
5477         index = strtol(buf, NULL, 0);
5478         if (index < 0) {
5479             fprintf(stderr, "qemu: '%s' invalid index\n", str);
5480             return -1;
5481         }
5482     }
5483
5484     if (get_param_value(buf, sizeof(buf), "cyls", str)) {
5485         cyls = strtol(buf, NULL, 0);
5486     }
5487
5488     if (get_param_value(buf, sizeof(buf), "heads", str)) {
5489         heads = strtol(buf, NULL, 0);
5490     }
5491
5492     if (get_param_value(buf, sizeof(buf), "secs", str)) {
5493         secs = strtol(buf, NULL, 0);
5494     }
5495
5496     if (cyls || heads || secs) {
5497         if (cyls < 1 || cyls > 16383) {
5498             fprintf(stderr, "qemu: '%s' invalid physical cyls number\n", str);
5499             return -1;
5500         }
5501         if (heads < 1 || heads > 16) {
5502             fprintf(stderr, "qemu: '%s' invalid physical heads number\n", str);
5503             return -1;
5504         }
5505         if (secs < 1 || secs > 63) {
5506             fprintf(stderr, "qemu: '%s' invalid physical secs number\n", str);
5507             return -1;
5508         }
5509     }
5510
5511     if (get_param_value(buf, sizeof(buf), "trans", str)) {
5512         if (!cyls) {
5513             fprintf(stderr,
5514                     "qemu: '%s' trans must be used with cyls,heads and secs\n",
5515                     str);
5516             return -1;
5517         }
5518         if (!strcmp(buf, "none"))
5519             translation = BIOS_ATA_TRANSLATION_NONE;
5520         else if (!strcmp(buf, "lba"))
5521             translation = BIOS_ATA_TRANSLATION_LBA;
5522         else if (!strcmp(buf, "auto"))
5523             translation = BIOS_ATA_TRANSLATION_AUTO;
5524         else {
5525             fprintf(stderr, "qemu: '%s' invalid translation type\n", str);
5526             return -1;
5527         }
5528     }
5529
5530     if (get_param_value(buf, sizeof(buf), "media", str)) {
5531         if (!strcmp(buf, "disk")) {
5532             media = MEDIA_DISK;
5533         } else if (!strcmp(buf, "cdrom")) {
5534             if (cyls || secs || heads) {
5535                 fprintf(stderr,
5536                         "qemu: '%s' invalid physical CHS format\n", str);
5537                 return -1;
5538             }
5539             media = MEDIA_CDROM;
5540         } else {
5541             fprintf(stderr, "qemu: '%s' invalid media\n", str);
5542             return -1;
5543         }
5544     }
5545
5546     if (get_param_value(buf, sizeof(buf), "snapshot", str)) {
5547         if (!strcmp(buf, "on"))
5548             snapshot = 1;
5549         else if (!strcmp(buf, "off"))
5550             snapshot = 0;
5551         else {
5552             fprintf(stderr, "qemu: '%s' invalid snapshot option\n", str);
5553             return -1;
5554         }
5555     }
5556
5557     if (get_param_value(buf, sizeof(buf), "cache", str)) {
5558         if (!strcmp(buf, "off"))
5559             cache = 0;
5560         else if (!strcmp(buf, "on"))
5561             cache = 1;
5562         else {
5563            fprintf(stderr, "qemu: invalid cache option\n");
5564            return -1;
5565         }
5566     }
5567
5568     if (get_param_value(buf, sizeof(buf), "format", str)) {
5569        if (strcmp(buf, "?") == 0) {
5570             fprintf(stderr, "qemu: Supported formats:");
5571             bdrv_iterate_format(bdrv_format_print, NULL);
5572             fprintf(stderr, "\n");
5573             return -1;
5574         }
5575         drv = bdrv_find_format(buf);
5576         if (!drv) {
5577             fprintf(stderr, "qemu: '%s' invalid format\n", buf);
5578             return -1;
5579         }
5580     }
5581
5582     if (arg->file == NULL)
5583         get_param_value(file, sizeof(file), "file", str);
5584     else
5585         pstrcpy(file, sizeof(file), arg->file);
5586
5587     /* compute bus and unit according index */
5588
5589     if (index != -1) {
5590         if (bus_id != 0 || unit_id != -1) {
5591             fprintf(stderr,
5592                     "qemu: '%s' index cannot be used with bus and unit\n", str);
5593             return -1;
5594         }
5595         if (max_devs == 0)
5596         {
5597             unit_id = index;
5598             bus_id = 0;
5599         } else {
5600             unit_id = index % max_devs;
5601             bus_id = index / max_devs;
5602         }
5603     }
5604
5605     /* if user doesn't specify a unit_id,
5606      * try to find the first free
5607      */
5608
5609     if (unit_id == -1) {
5610        unit_id = 0;
5611        while (drive_get_index(type, bus_id, unit_id) != -1) {
5612            unit_id++;
5613            if (max_devs && unit_id >= max_devs) {
5614                unit_id -= max_devs;
5615                bus_id++;
5616            }
5617        }
5618     }
5619
5620     /* check unit id */
5621
5622     if (max_devs && unit_id >= max_devs) {
5623         fprintf(stderr, "qemu: '%s' unit %d too big (max is %d)\n",
5624                         str, unit_id, max_devs - 1);
5625         return -1;
5626     }
5627
5628     /*
5629      * ignore multiple definitions
5630      */
5631
5632     if (drive_get_index(type, bus_id, unit_id) != -1)
5633         return 0;
5634
5635     /* init */
5636
5637     if (type == IF_IDE || type == IF_SCSI)
5638         mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
5639     if (max_devs)
5640         snprintf(buf, sizeof(buf), "%s%i%s%i",
5641                  devname, bus_id, mediastr, unit_id);
5642     else
5643         snprintf(buf, sizeof(buf), "%s%s%i",
5644                  devname, mediastr, unit_id);
5645     bdrv = bdrv_new(buf);
5646     drives_table[nb_drives].bdrv = bdrv;
5647     drives_table[nb_drives].type = type;
5648     drives_table[nb_drives].bus = bus_id;
5649     drives_table[nb_drives].unit = unit_id;
5650     nb_drives++;
5651
5652     switch(type) {
5653     case IF_IDE:
5654     case IF_SCSI:
5655         switch(media) {
5656         case MEDIA_DISK:
5657             if (cyls != 0) {
5658                 bdrv_set_geometry_hint(bdrv, cyls, heads, secs);
5659                 bdrv_set_translation_hint(bdrv, translation);
5660             }
5661             break;
5662         case MEDIA_CDROM:
5663             bdrv_set_type_hint(bdrv, BDRV_TYPE_CDROM);
5664             break;
5665         }
5666         break;
5667     case IF_SD:
5668         /* FIXME: This isn't really a floppy, but it's a reasonable
5669            approximation.  */
5670     case IF_FLOPPY:
5671         bdrv_set_type_hint(bdrv, BDRV_TYPE_FLOPPY);
5672         break;
5673     case IF_PFLASH:
5674     case IF_MTD:
5675         break;
5676     }
5677     if (!file[0])
5678         return 0;
5679     bdrv_flags = 0;
5680     if (snapshot)
5681         bdrv_flags |= BDRV_O_SNAPSHOT;
5682     if (!cache)
5683         bdrv_flags |= BDRV_O_DIRECT;
5684     if (bdrv_open2(bdrv, file, bdrv_flags, drv) < 0 || qemu_key_check(bdrv, file)) {
5685         fprintf(stderr, "qemu: could not open disk image %s\n",
5686                         file);
5687         return -1;
5688     }
5689     return 0;
5690 }
5691
5692 /***********************************************************/
5693 /* USB devices */
5694
5695 static USBPort *used_usb_ports;
5696 static USBPort *free_usb_ports;
5697
5698 /* ??? Maybe change this to register a hub to keep track of the topology.  */
5699 void qemu_register_usb_port(USBPort *port, void *opaque, int index,
5700                             usb_attachfn attach)
5701 {
5702     port->opaque = opaque;
5703     port->index = index;
5704     port->attach = attach;
5705     port->next = free_usb_ports;
5706     free_usb_ports = port;
5707 }
5708
5709 static int usb_device_add(const char *devname)
5710 {
5711     const char *p;
5712     USBDevice *dev;
5713     USBPort *port;
5714
5715     if (!free_usb_ports)
5716         return -1;
5717
5718     if (strstart(devname, "host:", &p)) {
5719         dev = usb_host_device_open(p);
5720     } else if (!strcmp(devname, "mouse")) {
5721         dev = usb_mouse_init();
5722     } else if (!strcmp(devname, "tablet")) {
5723         dev = usb_tablet_init();
5724     } else if (!strcmp(devname, "keyboard")) {
5725         dev = usb_keyboard_init();
5726     } else if (strstart(devname, "disk:", &p)) {
5727         dev = usb_msd_init(p);
5728     } else if (!strcmp(devname, "wacom-tablet")) {
5729         dev = usb_wacom_init();
5730     } else if (strstart(devname, "serial:", &p)) {
5731         dev = usb_serial_init(p);
5732 #ifdef CONFIG_BRLAPI
5733     } else if (!strcmp(devname, "braille")) {
5734         dev = usb_baum_init();
5735 #endif
5736     } else if (strstart(devname, "net:", &p)) {
5737         int nicidx = strtoul(p, NULL, 0);
5738
5739         if (nicidx >= nb_nics || strcmp(nd_table[nicidx].model, "usb"))
5740             return -1;
5741         dev = usb_net_init(&nd_table[nicidx]);
5742     } else {
5743         return -1;
5744     }
5745     if (!dev)
5746         return -1;
5747
5748     /* Find a USB port to add the device to.  */
5749     port = free_usb_ports;
5750     if (!port->next) {
5751         USBDevice *hub;
5752
5753         /* Create a new hub and chain it on.  */
5754         free_usb_ports = NULL;
5755         port->next = used_usb_ports;
5756         used_usb_ports = port;
5757
5758         hub = usb_hub_init(VM_USB_HUB_SIZE);
5759         usb_attach(port, hub);
5760         port = free_usb_ports;
5761     }
5762
5763     free_usb_ports = port->next;
5764     port->next = used_usb_ports;
5765     used_usb_ports = port;
5766     usb_attach(port, dev);
5767     return 0;
5768 }
5769
5770 static int usb_device_del(const char *devname)
5771 {
5772     USBPort *port;
5773     USBPort **lastp;
5774     USBDevice *dev;
5775     int bus_num, addr;
5776     const char *p;
5777
5778     if (!used_usb_ports)
5779         return -1;
5780
5781     p = strchr(devname, '.');
5782     if (!p)
5783         return -1;
5784     bus_num = strtoul(devname, NULL, 0);
5785     addr = strtoul(p + 1, NULL, 0);
5786     if (bus_num != 0)
5787         return -1;
5788
5789     lastp = &used_usb_ports;
5790     port = used_usb_ports;
5791     while (port && port->dev->addr != addr) {
5792         lastp = &port->next;
5793         port = port->next;
5794     }
5795
5796     if (!port)
5797         return -1;
5798
5799     dev = port->dev;
5800     *lastp = port->next;
5801     usb_attach(port, NULL);
5802     dev->handle_destroy(dev);
5803     port->next = free_usb_ports;
5804     free_usb_ports = port;
5805     return 0;
5806 }
5807
5808 void do_usb_add(const char *devname)
5809 {
5810     int ret;
5811     ret = usb_device_add(devname);
5812     if (ret < 0)
5813         term_printf("Could not add USB device '%s'\n", devname);
5814 }
5815
5816 void do_usb_del(const char *devname)
5817 {
5818     int ret;
5819     ret = usb_device_del(devname);
5820     if (ret < 0)
5821         term_printf("Could not remove USB device '%s'\n", devname);
5822 }
5823
5824 void usb_info(void)
5825 {
5826     USBDevice *dev;
5827     USBPort *port;
5828     const char *speed_str;
5829
5830     if (!usb_enabled) {
5831         term_printf("USB support not enabled\n");
5832         return;
5833     }
5834
5835     for (port = used_usb_ports; port; port = port->next) {
5836         dev = port->dev;
5837         if (!dev)
5838             continue;
5839         switch(dev->speed) {
5840         case USB_SPEED_LOW:
5841             speed_str = "1.5";
5842             break;
5843         case USB_SPEED_FULL:
5844             speed_str = "12";
5845             break;
5846         case USB_SPEED_HIGH:
5847             speed_str = "480";
5848             break;
5849         default:
5850             speed_str = "?";
5851             break;
5852         }
5853         term_printf("  Device %d.%d, Speed %s Mb/s, Product %s\n",
5854                     0, dev->addr, speed_str, dev->devname);
5855     }
5856 }
5857
5858 /***********************************************************/
5859 /* PCMCIA/Cardbus */
5860
5861 static struct pcmcia_socket_entry_s {
5862     struct pcmcia_socket_s *socket;
5863     struct pcmcia_socket_entry_s *next;
5864 } *pcmcia_sockets = 0;
5865
5866 void pcmcia_socket_register(struct pcmcia_socket_s *socket)
5867 {
5868     struct pcmcia_socket_entry_s *entry;
5869
5870     entry = qemu_malloc(sizeof(struct pcmcia_socket_entry_s));
5871     entry->socket = socket;
5872     entry->next = pcmcia_sockets;
5873     pcmcia_sockets = entry;
5874 }
5875
5876 void pcmcia_socket_unregister(struct pcmcia_socket_s *socket)
5877 {
5878     struct pcmcia_socket_entry_s *entry, **ptr;
5879
5880     ptr = &pcmcia_sockets;
5881     for (entry = *ptr; entry; ptr = &entry->next, entry = *ptr)
5882         if (entry->socket == socket) {
5883             *ptr = entry->next;
5884             qemu_free(entry);
5885         }
5886 }
5887
5888 void pcmcia_info(void)
5889 {
5890     struct pcmcia_socket_entry_s *iter;
5891     if (!pcmcia_sockets)
5892         term_printf("No PCMCIA sockets\n");
5893
5894     for (iter = pcmcia_sockets; iter; iter = iter->next)
5895         term_printf("%s: %s\n", iter->socket->slot_string,
5896                     iter->socket->attached ? iter->socket->card_string :
5897                     "Empty");
5898 }
5899
5900 /***********************************************************/
5901 /* dumb display */
5902
5903 static void dumb_update(DisplayState *ds, int x, int y, int w, int h)
5904 {
5905 }
5906
5907 static void dumb_resize(DisplayState *ds, int w, int h)
5908 {
5909 }
5910
5911 static void dumb_refresh(DisplayState *ds)
5912 {
5913 #if defined(CONFIG_SDL)
5914     vga_hw_update();
5915 #endif
5916 }
5917
5918 static void dumb_display_init(DisplayState *ds)
5919 {
5920     ds->data = NULL;
5921     ds->linesize = 0;
5922     ds->depth = 0;
5923     ds->dpy_update = dumb_update;
5924     ds->dpy_resize = dumb_resize;
5925     ds->dpy_refresh = dumb_refresh;
5926 }
5927
5928 /***********************************************************/
5929 /* I/O handling */
5930
5931 #define MAX_IO_HANDLERS 64
5932
5933 typedef struct IOHandlerRecord {
5934     int fd;
5935     IOCanRWHandler *fd_read_poll;
5936     IOHandler *fd_read;
5937     IOHandler *fd_write;
5938     int deleted;
5939     void *opaque;
5940     /* temporary data */
5941     struct pollfd *ufd;
5942     struct IOHandlerRecord *next;
5943 } IOHandlerRecord;
5944
5945 static IOHandlerRecord *first_io_handler;
5946
5947 /* XXX: fd_read_poll should be suppressed, but an API change is
5948    necessary in the character devices to suppress fd_can_read(). */
5949 int qemu_set_fd_handler2(int fd,
5950                          IOCanRWHandler *fd_read_poll,
5951                          IOHandler *fd_read,
5952                          IOHandler *fd_write,
5953                          void *opaque)
5954 {
5955     IOHandlerRecord **pioh, *ioh;
5956
5957     if (!fd_read && !fd_write) {
5958         pioh = &first_io_handler;
5959         for(;;) {
5960             ioh = *pioh;
5961             if (ioh == NULL)
5962                 break;
5963             if (ioh->fd == fd) {
5964                 ioh->deleted = 1;
5965                 break;
5966             }
5967             pioh = &ioh->next;
5968         }
5969     } else {
5970         for(ioh = first_io_handler; ioh != NULL; ioh = ioh->next) {
5971             if (ioh->fd == fd)
5972                 goto found;
5973         }
5974         ioh = qemu_mallocz(sizeof(IOHandlerRecord));
5975         if (!ioh)
5976             return -1;
5977         ioh->next = first_io_handler;
5978         first_io_handler = ioh;
5979     found:
5980         ioh->fd = fd;
5981         ioh->fd_read_poll = fd_read_poll;
5982         ioh->fd_read = fd_read;
5983         ioh->fd_write = fd_write;
5984         ioh->opaque = opaque;
5985         ioh->deleted = 0;
5986     }
5987     return 0;
5988 }
5989
5990 int qemu_set_fd_handler(int fd,
5991                         IOHandler *fd_read,
5992                         IOHandler *fd_write,
5993                         void *opaque)
5994 {
5995     return qemu_set_fd_handler2(fd, NULL, fd_read, fd_write, opaque);
5996 }
5997
5998 /***********************************************************/
5999 /* Polling handling */
6000
6001 typedef struct PollingEntry {
6002     PollingFunc *func;
6003     void *opaque;
6004     struct PollingEntry *next;
6005 } PollingEntry;
6006
6007 static PollingEntry *first_polling_entry;
6008
6009 int qemu_add_polling_cb(PollingFunc *func, void *opaque)
6010 {
6011     PollingEntry **ppe, *pe;
6012     pe = qemu_mallocz(sizeof(PollingEntry));
6013     if (!pe)
6014         return -1;
6015     pe->func = func;
6016     pe->opaque = opaque;
6017     for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next);
6018     *ppe = pe;
6019     return 0;
6020 }
6021
6022 void qemu_del_polling_cb(PollingFunc *func, void *opaque)
6023 {
6024     PollingEntry **ppe, *pe;
6025     for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next) {
6026         pe = *ppe;
6027         if (pe->func == func && pe->opaque == opaque) {
6028             *ppe = pe->next;
6029             qemu_free(pe);
6030             break;
6031         }
6032     }
6033 }
6034
6035 #ifdef _WIN32
6036 /***********************************************************/
6037 /* Wait objects support */
6038 typedef struct WaitObjects {
6039     int num;
6040     HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
6041     WaitObjectFunc *func[MAXIMUM_WAIT_OBJECTS + 1];
6042     void *opaque[MAXIMUM_WAIT_OBJECTS + 1];
6043 } WaitObjects;
6044
6045 static WaitObjects wait_objects = {0};
6046
6047 int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
6048 {
6049     WaitObjects *w = &wait_objects;
6050
6051     if (w->num >= MAXIMUM_WAIT_OBJECTS)
6052         return -1;
6053     w->events[w->num] = handle;
6054     w->func[w->num] = func;
6055     w->opaque[w->num] = opaque;
6056     w->num++;
6057     return 0;
6058 }
6059
6060 void qemu_del_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)
6061 {
6062     int i, found;
6063     WaitObjects *w = &wait_objects;
6064
6065     found = 0;
6066     for (i = 0; i < w->num; i++) {
6067         if (w->events[i] == handle)
6068             found = 1;
6069         if (found) {
6070             w->events[i] = w->events[i + 1];
6071             w->func[i] = w->func[i + 1];
6072             w->opaque[i] = w->opaque[i + 1];
6073         }
6074     }
6075     if (found)
6076         w->num--;
6077 }
6078 #endif
6079
6080 /***********************************************************/
6081 /* savevm/loadvm support */
6082
6083 #define IO_BUF_SIZE 32768
6084
6085 struct QEMUFile {
6086     FILE *outfile;
6087     BlockDriverState *bs;
6088     int is_file;
6089     int is_writable;
6090     int64_t base_offset;
6091     int64_t buf_offset; /* start of buffer when writing, end of buffer
6092                            when reading */
6093     int buf_index;
6094     int buf_size; /* 0 when writing */
6095     uint8_t buf[IO_BUF_SIZE];
6096 };
6097
6098 QEMUFile *qemu_fopen(const char *filename, const char *mode)
6099 {
6100     QEMUFile *f;
6101
6102     f = qemu_mallocz(sizeof(QEMUFile));
6103     if (!f)
6104         return NULL;
6105     if (!strcmp(mode, "wb")) {
6106         f->is_writable = 1;
6107     } else if (!strcmp(mode, "rb")) {
6108         f->is_writable = 0;
6109     } else {
6110         goto fail;
6111     }
6112     f->outfile = fopen(filename, mode);
6113     if (!f->outfile)
6114         goto fail;
6115     f->is_file = 1;
6116     return f;
6117  fail:
6118     if (f->outfile)
6119         fclose(f->outfile);
6120     qemu_free(f);
6121     return NULL;
6122 }
6123
6124 static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int64_t offset, int is_writable)
6125 {
6126     QEMUFile *f;
6127
6128     f = qemu_mallocz(sizeof(QEMUFile));
6129     if (!f)
6130         return NULL;
6131     f->is_file = 0;
6132     f->bs = bs;
6133     f->is_writable = is_writable;
6134     f->base_offset = offset;
6135     return f;
6136 }
6137
6138 void qemu_fflush(QEMUFile *f)
6139 {
6140     if (!f->is_writable)
6141         return;
6142     if (f->buf_index > 0) {
6143         if (f->is_file) {
6144             fseek(f->outfile, f->buf_offset, SEEK_SET);
6145             fwrite(f->buf, 1, f->buf_index, f->outfile);
6146         } else {
6147             bdrv_pwrite(f->bs, f->base_offset + f->buf_offset,
6148                         f->buf, f->buf_index);
6149         }
6150         f->buf_offset += f->buf_index;
6151         f->buf_index = 0;
6152     }
6153 }
6154
6155 static void qemu_fill_buffer(QEMUFile *f)
6156 {
6157     int len;
6158
6159     if (f->is_writable)
6160         return;
6161     if (f->is_file) {
6162         fseek(f->outfile, f->buf_offset, SEEK_SET);
6163         len = fread(f->buf, 1, IO_BUF_SIZE, f->outfile);
6164         if (len < 0)
6165             len = 0;
6166     } else {
6167         len = bdrv_pread(f->bs, f->base_offset + f->buf_offset,
6168                          f->buf, IO_BUF_SIZE);
6169         if (len < 0)
6170             len = 0;
6171     }
6172     f->buf_index = 0;
6173     f->buf_size = len;
6174     f->buf_offset += len;
6175 }
6176
6177 void qemu_fclose(QEMUFile *f)
6178 {
6179     if (f->is_writable)
6180         qemu_fflush(f);
6181     if (f->is_file) {
6182         fclose(f->outfile);
6183     }
6184     qemu_free(f);
6185 }
6186
6187 void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size)
6188 {
6189     int l;
6190     while (size > 0) {
6191         l = IO_BUF_SIZE - f->buf_index;
6192         if (l > size)
6193             l = size;
6194         memcpy(f->buf + f->buf_index, buf, l);
6195         f->buf_index += l;
6196         buf += l;
6197         size -= l;
6198         if (f->buf_index >= IO_BUF_SIZE)
6199             qemu_fflush(f);
6200     }
6201 }
6202
6203 void qemu_put_byte(QEMUFile *f, int v)
6204 {
6205     f->buf[f->buf_index++] = v;
6206     if (f->buf_index >= IO_BUF_SIZE)
6207         qemu_fflush(f);
6208 }
6209
6210 int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size1)
6211 {
6212     int size, l;
6213
6214     size = size1;
6215     while (size > 0) {
6216         l = f->buf_size - f->buf_index;
6217         if (l == 0) {
6218             qemu_fill_buffer(f);
6219             l = f->buf_size - f->buf_index;
6220             if (l == 0)
6221                 break;
6222         }
6223         if (l > size)
6224             l = size;
6225         memcpy(buf, f->buf + f->buf_index, l);
6226         f->buf_index += l;
6227         buf += l;
6228         size -= l;
6229     }
6230     return size1 - size;
6231 }
6232
6233 int qemu_get_byte(QEMUFile *f)
6234 {
6235     if (f->buf_index >= f->buf_size) {
6236         qemu_fill_buffer(f);
6237         if (f->buf_index >= f->buf_size)
6238             return 0;
6239     }
6240     return f->buf[f->buf_index++];
6241 }
6242
6243 int64_t qemu_ftell(QEMUFile *f)
6244 {
6245     return f->buf_offset - f->buf_size + f->buf_index;
6246 }
6247
6248 int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence)
6249 {
6250     if (whence == SEEK_SET) {
6251         /* nothing to do */
6252     } else if (whence == SEEK_CUR) {
6253         pos += qemu_ftell(f);
6254     } else {
6255         /* SEEK_END not supported */
6256         return -1;
6257     }
6258     if (f->is_writable) {
6259         qemu_fflush(f);
6260         f->buf_offset = pos;
6261     } else {
6262         f->buf_offset = pos;
6263         f->buf_index = 0;
6264         f->buf_size = 0;
6265     }
6266     return pos;
6267 }
6268
6269 void qemu_put_be16(QEMUFile *f, unsigned int v)
6270 {
6271     qemu_put_byte(f, v >> 8);
6272     qemu_put_byte(f, v);
6273 }
6274
6275 void qemu_put_be32(QEMUFile *f, unsigned int v)
6276 {
6277     qemu_put_byte(f, v >> 24);
6278     qemu_put_byte(f, v >> 16);
6279     qemu_put_byte(f, v >> 8);
6280     qemu_put_byte(f, v);
6281 }
6282
6283 void qemu_put_be64(QEMUFile *f, uint64_t v)
6284 {
6285     qemu_put_be32(f, v >> 32);
6286     qemu_put_be32(f, v);
6287 }
6288
6289 unsigned int qemu_get_be16(QEMUFile *f)
6290 {
6291     unsigned int v;
6292     v = qemu_get_byte(f) << 8;
6293     v |= qemu_get_byte(f);
6294     return v;
6295 }
6296
6297 unsigned int qemu_get_be32(QEMUFile *f)
6298 {
6299     unsigned int v;
6300     v = qemu_get_byte(f) << 24;
6301     v |= qemu_get_byte(f) << 16;
6302     v |= qemu_get_byte(f) << 8;
6303     v |= qemu_get_byte(f);
6304     return v;
6305 }
6306
6307 uint64_t qemu_get_be64(QEMUFile *f)
6308 {
6309     uint64_t v;
6310     v = (uint64_t)qemu_get_be32(f) << 32;
6311     v |= qemu_get_be32(f);
6312     return v;
6313 }
6314
6315 typedef struct SaveStateEntry {
6316     char idstr[256];
6317     int instance_id;
6318     int version_id;
6319     SaveStateHandler *save_state;
6320     LoadStateHandler *load_state;
6321     void *opaque;
6322     struct SaveStateEntry *next;
6323 } SaveStateEntry;
6324
6325 static SaveStateEntry *first_se;
6326
6327 /* TODO: Individual devices generally have very little idea about the rest
6328    of the system, so instance_id should be removed/replaced.
6329    Meanwhile pass -1 as instance_id if you do not already have a clearly
6330    distinguishing id for all instances of your device class. */
6331 int register_savevm(const char *idstr,
6332                     int instance_id,
6333                     int version_id,
6334                     SaveStateHandler *save_state,
6335                     LoadStateHandler *load_state,
6336                     void *opaque)
6337 {
6338     SaveStateEntry *se, **pse;
6339
6340     se = qemu_malloc(sizeof(SaveStateEntry));
6341     if (!se)
6342         return -1;
6343     pstrcpy(se->idstr, sizeof(se->idstr), idstr);
6344     se->instance_id = (instance_id == -1) ? 0 : instance_id;
6345     se->version_id = version_id;
6346     se->save_state = save_state;
6347     se->load_state = load_state;
6348     se->opaque = opaque;
6349     se->next = NULL;
6350
6351     /* add at the end of list */
6352     pse = &first_se;
6353     while (*pse != NULL) {
6354         if (instance_id == -1
6355                 && strcmp(se->idstr, (*pse)->idstr) == 0
6356                 && se->instance_id <= (*pse)->instance_id)
6357             se->instance_id = (*pse)->instance_id + 1;
6358         pse = &(*pse)->next;
6359     }
6360     *pse = se;
6361     return 0;
6362 }
6363
6364 #define QEMU_VM_FILE_MAGIC   0x5145564d
6365 #define QEMU_VM_FILE_VERSION 0x00000002
6366
6367 static int qemu_savevm_state(QEMUFile *f)
6368 {
6369     SaveStateEntry *se;
6370     int len, ret;
6371     int64_t cur_pos, len_pos, total_len_pos;
6372
6373     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
6374     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
6375     total_len_pos = qemu_ftell(f);
6376     qemu_put_be64(f, 0); /* total size */
6377
6378     for(se = first_se; se != NULL; se = se->next) {
6379         if (se->save_state == NULL)
6380             /* this one has a loader only, for backwards compatibility */
6381             continue;
6382
6383         /* ID string */
6384         len = strlen(se->idstr);
6385         qemu_put_byte(f, len);
6386         qemu_put_buffer(f, (uint8_t *)se->idstr, len);
6387
6388         qemu_put_be32(f, se->instance_id);
6389         qemu_put_be32(f, se->version_id);
6390
6391         /* record size: filled later */
6392         len_pos = qemu_ftell(f);
6393         qemu_put_be32(f, 0);
6394         se->save_state(f, se->opaque);
6395
6396         /* fill record size */
6397         cur_pos = qemu_ftell(f);
6398         len = cur_pos - len_pos - 4;
6399         qemu_fseek(f, len_pos, SEEK_SET);
6400         qemu_put_be32(f, len);
6401         qemu_fseek(f, cur_pos, SEEK_SET);
6402     }
6403     cur_pos = qemu_ftell(f);
6404     qemu_fseek(f, total_len_pos, SEEK_SET);
6405     qemu_put_be64(f, cur_pos - total_len_pos - 8);
6406     qemu_fseek(f, cur_pos, SEEK_SET);
6407
6408     ret = 0;
6409     return ret;
6410 }
6411
6412 static SaveStateEntry *find_se(const char *idstr, int instance_id)
6413 {
6414     SaveStateEntry *se;
6415
6416     for(se = first_se; se != NULL; se = se->next) {
6417         if (!strcmp(se->idstr, idstr) &&
6418             instance_id == se->instance_id)
6419             return se;
6420     }
6421     return NULL;
6422 }
6423
6424 static int qemu_loadvm_state(QEMUFile *f)
6425 {
6426     SaveStateEntry *se;
6427     int len, ret, instance_id, record_len, version_id;
6428     int64_t total_len, end_pos, cur_pos;
6429     unsigned int v;
6430     char idstr[256];
6431
6432     v = qemu_get_be32(f);
6433     if (v != QEMU_VM_FILE_MAGIC)
6434         goto fail;
6435     v = qemu_get_be32(f);
6436     if (v != QEMU_VM_FILE_VERSION) {
6437     fail:
6438         ret = -1;
6439         goto the_end;
6440     }
6441     total_len = qemu_get_be64(f);
6442     end_pos = total_len + qemu_ftell(f);
6443     for(;;) {
6444         if (qemu_ftell(f) >= end_pos)
6445             break;
6446         len = qemu_get_byte(f);
6447         qemu_get_buffer(f, (uint8_t *)idstr, len);
6448         idstr[len] = '\0';
6449         instance_id = qemu_get_be32(f);
6450         version_id = qemu_get_be32(f);
6451         record_len = qemu_get_be32(f);
6452 #if 0
6453         printf("idstr=%s instance=0x%x version=%d len=%d\n",
6454                idstr, instance_id, version_id, record_len);
6455 #endif
6456         cur_pos = qemu_ftell(f);
6457         se = find_se(idstr, instance_id);
6458         if (!se) {
6459             fprintf(stderr, "qemu: warning: instance 0x%x of device '%s' not present in current VM\n",
6460                     instance_id, idstr);
6461         } else {
6462             ret = se->load_state(f, se->opaque, version_id);
6463             if (ret < 0) {
6464                 fprintf(stderr, "qemu: warning: error while loading state for instance 0x%x of device '%s'\n",
6465                         instance_id, idstr);
6466             }
6467         }
6468         /* always seek to exact end of record */
6469         qemu_fseek(f, cur_pos + record_len, SEEK_SET);
6470     }
6471     ret = 0;
6472  the_end:
6473     return ret;
6474 }
6475
6476 /* device can contain snapshots */
6477 static int bdrv_can_snapshot(BlockDriverState *bs)
6478 {
6479     return (bs &&
6480             !bdrv_is_removable(bs) &&
6481             !bdrv_is_read_only(bs));
6482 }
6483
6484 /* device must be snapshots in order to have a reliable snapshot */
6485 static int bdrv_has_snapshot(BlockDriverState *bs)
6486 {
6487     return (bs &&
6488             !bdrv_is_removable(bs) &&
6489             !bdrv_is_read_only(bs));
6490 }
6491
6492 static BlockDriverState *get_bs_snapshots(void)
6493 {
6494     BlockDriverState *bs;
6495     int i;
6496
6497     if (bs_snapshots)
6498         return bs_snapshots;
6499     for(i = 0; i <= nb_drives; i++) {
6500         bs = drives_table[i].bdrv;
6501         if (bdrv_can_snapshot(bs))
6502             goto ok;
6503     }
6504     return NULL;
6505  ok:
6506     bs_snapshots = bs;
6507     return bs;
6508 }
6509
6510 static int bdrv_snapshot_find(BlockDriverState *bs, QEMUSnapshotInfo *sn_info,
6511                               const char *name)
6512 {
6513     QEMUSnapshotInfo *sn_tab, *sn;
6514     int nb_sns, i, ret;
6515
6516     ret = -ENOENT;
6517     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
6518     if (nb_sns < 0)
6519         return ret;
6520     for(i = 0; i < nb_sns; i++) {
6521         sn = &sn_tab[i];
6522         if (!strcmp(sn->id_str, name) || !strcmp(sn->name, name)) {
6523             *sn_info = *sn;
6524             ret = 0;
6525             break;
6526         }
6527     }
6528     qemu_free(sn_tab);
6529     return ret;
6530 }
6531
6532 void do_savevm(const char *name)
6533 {
6534     BlockDriverState *bs, *bs1;
6535     QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
6536     int must_delete, ret, i;
6537     BlockDriverInfo bdi1, *bdi = &bdi1;
6538     QEMUFile *f;
6539     int saved_vm_running;
6540 #ifdef _WIN32
6541     struct _timeb tb;
6542 #else
6543     struct timeval tv;
6544 #endif
6545
6546     bs = get_bs_snapshots();
6547     if (!bs) {
6548         term_printf("No block device can accept snapshots\n");
6549         return;
6550     }
6551
6552     /* ??? Should this occur after vm_stop?  */
6553     qemu_aio_flush();
6554
6555     saved_vm_running = vm_running;
6556     vm_stop(0);
6557
6558     must_delete = 0;
6559     if (name) {
6560         ret = bdrv_snapshot_find(bs, old_sn, name);
6561         if (ret >= 0) {
6562             must_delete = 1;
6563         }
6564     }
6565     memset(sn, 0, sizeof(*sn));
6566     if (must_delete) {
6567         pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
6568         pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
6569     } else {
6570         if (name)
6571             pstrcpy(sn->name, sizeof(sn->name), name);
6572     }
6573
6574     /* fill auxiliary fields */
6575 #ifdef _WIN32
6576     _ftime(&tb);
6577     sn->date_sec = tb.time;
6578     sn->date_nsec = tb.millitm * 1000000;
6579 #else
6580     gettimeofday(&tv, NULL);
6581     sn->date_sec = tv.tv_sec;
6582     sn->date_nsec = tv.tv_usec * 1000;
6583 #endif
6584     sn->vm_clock_nsec = qemu_get_clock(vm_clock);
6585
6586     if (bdrv_get_info(bs, bdi) < 0 || bdi->vm_state_offset <= 0) {
6587         term_printf("Device %s does not support VM state snapshots\n",
6588                     bdrv_get_device_name(bs));
6589         goto the_end;
6590     }
6591
6592     /* save the VM state */
6593     f = qemu_fopen_bdrv(bs, bdi->vm_state_offset, 1);
6594     if (!f) {
6595         term_printf("Could not open VM state file\n");
6596         goto the_end;
6597     }
6598     ret = qemu_savevm_state(f);
6599     sn->vm_state_size = qemu_ftell(f);
6600     qemu_fclose(f);
6601     if (ret < 0) {
6602         term_printf("Error %d while writing VM\n", ret);
6603         goto the_end;
6604     }
6605
6606     /* create the snapshots */
6607
6608     for(i = 0; i < nb_drives; i++) {
6609         bs1 = drives_table[i].bdrv;
6610         if (bdrv_has_snapshot(bs1)) {
6611             if (must_delete) {
6612                 ret = bdrv_snapshot_delete(bs1, old_sn->id_str);
6613                 if (ret < 0) {
6614                     term_printf("Error while deleting snapshot on '%s'\n",
6615                                 bdrv_get_device_name(bs1));
6616                 }
6617             }
6618             ret = bdrv_snapshot_create(bs1, sn);
6619             if (ret < 0) {
6620                 term_printf("Error while creating snapshot on '%s'\n",
6621                             bdrv_get_device_name(bs1));
6622             }
6623         }
6624     }
6625
6626  the_end:
6627     if (saved_vm_running)
6628         vm_start();
6629 }
6630
6631 void do_loadvm(const char *name)
6632 {
6633     BlockDriverState *bs, *bs1;
6634     BlockDriverInfo bdi1, *bdi = &bdi1;
6635     QEMUFile *f;
6636     int i, ret;
6637     int saved_vm_running;
6638
6639     bs = get_bs_snapshots();
6640     if (!bs) {
6641         term_printf("No block device supports snapshots\n");
6642         return;
6643     }
6644
6645     /* Flush all IO requests so they don't interfere with the new state.  */
6646     qemu_aio_flush();
6647
6648     saved_vm_running = vm_running;
6649     vm_stop(0);
6650
6651     for(i = 0; i <= nb_drives; i++) {
6652         bs1 = drives_table[i].bdrv;
6653         if (bdrv_has_snapshot(bs1)) {
6654             ret = bdrv_snapshot_goto(bs1, name);
6655             if (ret < 0) {
6656                 if (bs != bs1)
6657                     term_printf("Warning: ");
6658                 switch(ret) {
6659                 case -ENOTSUP:
6660                     term_printf("Snapshots not supported on device '%s'\n",
6661                                 bdrv_get_device_name(bs1));
6662                     break;
6663                 case -ENOENT:
6664                     term_printf("Could not find snapshot '%s' on device '%s'\n",
6665                                 name, bdrv_get_device_name(bs1));
6666                     break;
6667                 default:
6668                     term_printf("Error %d while activating snapshot on '%s'\n",
6669                                 ret, bdrv_get_device_name(bs1));
6670                     break;
6671                 }
6672                 /* fatal on snapshot block device */
6673                 if (bs == bs1)
6674                     goto the_end;
6675             }
6676         }
6677     }
6678
6679     if (bdrv_get_info(bs, bdi) < 0 || bdi->vm_state_offset <= 0) {
6680         term_printf("Device %s does not support VM state snapshots\n",
6681                     bdrv_get_device_name(bs));
6682         return;
6683     }
6684
6685     /* restore the VM state */
6686     f = qemu_fopen_bdrv(bs, bdi->vm_state_offset, 0);
6687     if (!f) {
6688         term_printf("Could not open VM state file\n");
6689         goto the_end;
6690     }
6691     ret = qemu_loadvm_state(f);
6692     qemu_fclose(f);
6693     if (ret < 0) {
6694         term_printf("Error %d while loading VM state\n", ret);
6695     }
6696  the_end:
6697     if (saved_vm_running)
6698         vm_start();
6699 }
6700
6701 void do_delvm(const char *name)
6702 {
6703     BlockDriverState *bs, *bs1;
6704     int i, ret;
6705
6706     bs = get_bs_snapshots();
6707     if (!bs) {
6708         term_printf("No block device supports snapshots\n");
6709         return;
6710     }
6711
6712     for(i = 0; i <= nb_drives; i++) {
6713         bs1 = drives_table[i].bdrv;
6714         if (bdrv_has_snapshot(bs1)) {
6715             ret = bdrv_snapshot_delete(bs1, name);
6716             if (ret < 0) {
6717                 if (ret == -ENOTSUP)
6718                     term_printf("Snapshots not supported on device '%s'\n",
6719                                 bdrv_get_device_name(bs1));
6720                 else
6721                     term_printf("Error %d while deleting snapshot on '%s'\n",
6722                                 ret, bdrv_get_device_name(bs1));
6723             }
6724         }
6725     }
6726 }
6727
6728 void do_info_snapshots(void)
6729 {
6730     BlockDriverState *bs, *bs1;
6731     QEMUSnapshotInfo *sn_tab, *sn;
6732     int nb_sns, i;
6733     char buf[256];
6734
6735     bs = get_bs_snapshots();
6736     if (!bs) {
6737         term_printf("No available block device supports snapshots\n");
6738         return;
6739     }
6740     term_printf("Snapshot devices:");
6741     for(i = 0; i <= nb_drives; i++) {
6742         bs1 = drives_table[i].bdrv;
6743         if (bdrv_has_snapshot(bs1)) {
6744             if (bs == bs1)
6745                 term_printf(" %s", bdrv_get_device_name(bs1));
6746         }
6747     }
6748     term_printf("\n");
6749
6750     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
6751     if (nb_sns < 0) {
6752         term_printf("bdrv_snapshot_list: error %d\n", nb_sns);
6753         return;
6754     }
6755     term_printf("Snapshot list (from %s):\n", bdrv_get_device_name(bs));
6756     term_printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), NULL));
6757     for(i = 0; i < nb_sns; i++) {
6758         sn = &sn_tab[i];
6759         term_printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), sn));
6760     }
6761     qemu_free(sn_tab);
6762 }
6763
6764 /***********************************************************/
6765 /* ram save/restore */
6766
6767 static int ram_get_page(QEMUFile *f, uint8_t *buf, int len)
6768 {
6769     int v;
6770
6771     v = qemu_get_byte(f);
6772     switch(v) {
6773     case 0:
6774         if (qemu_get_buffer(f, buf, len) != len)
6775             return -EIO;
6776         break;
6777     case 1:
6778         v = qemu_get_byte(f);
6779         memset(buf, v, len);
6780         break;
6781     default:
6782         return -EINVAL;
6783     }
6784     return 0;
6785 }
6786
6787 static int ram_load_v1(QEMUFile *f, void *opaque)
6788 {
6789     int ret;
6790     ram_addr_t i;
6791
6792     if (qemu_get_be32(f) != phys_ram_size)
6793         return -EINVAL;
6794     for(i = 0; i < phys_ram_size; i+= TARGET_PAGE_SIZE) {
6795         ret = ram_get_page(f, phys_ram_base + i, TARGET_PAGE_SIZE);
6796         if (ret)
6797             return ret;
6798     }
6799     return 0;
6800 }
6801
6802 #define BDRV_HASH_BLOCK_SIZE 1024
6803 #define IOBUF_SIZE 4096
6804 #define RAM_CBLOCK_MAGIC 0xfabe
6805
6806 typedef struct RamCompressState {
6807     z_stream zstream;
6808     QEMUFile *f;
6809     uint8_t buf[IOBUF_SIZE];
6810 } RamCompressState;
6811
6812 static int ram_compress_open(RamCompressState *s, QEMUFile *f)
6813 {
6814     int ret;
6815     memset(s, 0, sizeof(*s));
6816     s->f = f;
6817     ret = deflateInit2(&s->zstream, 1,
6818                        Z_DEFLATED, 15,
6819                        9, Z_DEFAULT_STRATEGY);
6820     if (ret != Z_OK)
6821         return -1;
6822     s->zstream.avail_out = IOBUF_SIZE;
6823     s->zstream.next_out = s->buf;
6824     return 0;
6825 }
6826
6827 static void ram_put_cblock(RamCompressState *s, const uint8_t *buf, int len)
6828 {
6829     qemu_put_be16(s->f, RAM_CBLOCK_MAGIC);
6830     qemu_put_be16(s->f, len);
6831     qemu_put_buffer(s->f, buf, len);
6832 }
6833
6834 static int ram_compress_buf(RamCompressState *s, const uint8_t *buf, int len)
6835 {
6836     int ret;
6837
6838     s->zstream.avail_in = len;
6839     s->zstream.next_in = (uint8_t *)buf;
6840     while (s->zstream.avail_in > 0) {
6841         ret = deflate(&s->zstream, Z_NO_FLUSH);
6842         if (ret != Z_OK)
6843             return -1;
6844         if (s->zstream.avail_out == 0) {
6845             ram_put_cblock(s, s->buf, IOBUF_SIZE);
6846             s->zstream.avail_out = IOBUF_SIZE;
6847             s->zstream.next_out = s->buf;
6848         }
6849     }
6850     return 0;
6851 }
6852
6853 static void ram_compress_close(RamCompressState *s)
6854 {
6855     int len, ret;
6856
6857     /* compress last bytes */
6858     for(;;) {
6859         ret = deflate(&s->zstream, Z_FINISH);
6860         if (ret == Z_OK || ret == Z_STREAM_END) {
6861             len = IOBUF_SIZE - s->zstream.avail_out;
6862             if (len > 0) {
6863                 ram_put_cblock(s, s->buf, len);
6864             }
6865             s->zstream.avail_out = IOBUF_SIZE;
6866             s->zstream.next_out = s->buf;
6867             if (ret == Z_STREAM_END)
6868                 break;
6869         } else {
6870             goto fail;
6871         }
6872     }
6873 fail:
6874     deflateEnd(&s->zstream);
6875 }
6876
6877 typedef struct RamDecompressState {
6878     z_stream zstream;
6879     QEMUFile *f;
6880     uint8_t buf[IOBUF_SIZE];
6881 } RamDecompressState;
6882
6883 static int ram_decompress_open(RamDecompressState *s, QEMUFile *f)
6884 {
6885     int ret;
6886     memset(s, 0, sizeof(*s));
6887     s->f = f;
6888     ret = inflateInit(&s->zstream);
6889     if (ret != Z_OK)
6890         return -1;
6891     return 0;
6892 }
6893
6894 static int ram_decompress_buf(RamDecompressState *s, uint8_t *buf, int len)
6895 {
6896     int ret, clen;
6897
6898     s->zstream.avail_out = len;
6899     s->zstream.next_out = buf;
6900     while (s->zstream.avail_out > 0) {
6901         if (s->zstream.avail_in == 0) {
6902             if (qemu_get_be16(s->f) != RAM_CBLOCK_MAGIC)
6903                 return -1;
6904             clen = qemu_get_be16(s->f);
6905             if (clen > IOBUF_SIZE)
6906                 return -1;
6907             qemu_get_buffer(s->f, s->buf, clen);
6908             s->zstream.avail_in = clen;
6909             s->zstream.next_in = s->buf;
6910         }
6911         ret = inflate(&s->zstream, Z_PARTIAL_FLUSH);
6912         if (ret != Z_OK && ret != Z_STREAM_END) {
6913             return -1;
6914         }
6915     }
6916     return 0;
6917 }
6918
6919 static void ram_decompress_close(RamDecompressState *s)
6920 {
6921     inflateEnd(&s->zstream);
6922 }
6923
6924 static void ram_save(QEMUFile *f, void *opaque)
6925 {
6926     ram_addr_t i;
6927     RamCompressState s1, *s = &s1;
6928     uint8_t buf[10];
6929
6930     qemu_put_be32(f, phys_ram_size);
6931     if (ram_compress_open(s, f) < 0)
6932         return;
6933     for(i = 0; i < phys_ram_size; i+= BDRV_HASH_BLOCK_SIZE) {
6934 #if 0
6935         if (tight_savevm_enabled) {
6936             int64_t sector_num;
6937             int j;
6938
6939             /* find if the memory block is available on a virtual
6940                block device */
6941             sector_num = -1;
6942             for(j = 0; j < nb_drives; j++) {
6943                 sector_num = bdrv_hash_find(drives_table[j].bdrv,
6944                                             phys_ram_base + i,
6945                                             BDRV_HASH_BLOCK_SIZE);
6946                 if (sector_num >= 0)
6947                     break;
6948             }
6949             if (j == nb_drives)
6950                 goto normal_compress;
6951             buf[0] = 1;
6952             buf[1] = j;
6953             cpu_to_be64wu((uint64_t *)(buf + 2), sector_num);
6954             ram_compress_buf(s, buf, 10);
6955         } else
6956 #endif
6957         {
6958             //        normal_compress:
6959             buf[0] = 0;
6960             ram_compress_buf(s, buf, 1);
6961             ram_compress_buf(s, phys_ram_base + i, BDRV_HASH_BLOCK_SIZE);
6962         }
6963     }
6964     ram_compress_close(s);
6965 }
6966
6967 static int ram_load(QEMUFile *f, void *opaque, int version_id)
6968 {
6969     RamDecompressState s1, *s = &s1;
6970     uint8_t buf[10];
6971     ram_addr_t i;
6972
6973     if (version_id == 1)
6974         return ram_load_v1(f, opaque);
6975     if (version_id != 2)
6976         return -EINVAL;
6977     if (qemu_get_be32(f) != phys_ram_size)
6978         return -EINVAL;
6979     if (ram_decompress_open(s, f) < 0)
6980         return -EINVAL;
6981     for(i = 0; i < phys_ram_size; i+= BDRV_HASH_BLOCK_SIZE) {
6982         if (ram_decompress_buf(s, buf, 1) < 0) {
6983             fprintf(stderr, "Error while reading ram block header\n");
6984             goto error;
6985         }
6986         if (buf[0] == 0) {
6987             if (ram_decompress_buf(s, phys_ram_base + i, BDRV_HASH_BLOCK_SIZE) < 0) {
6988                 fprintf(stderr, "Error while reading ram block address=0x%08" PRIx64, (uint64_t)i);
6989                 goto error;
6990             }
6991         } else
6992 #if 0
6993         if (buf[0] == 1) {
6994             int bs_index;
6995             int64_t sector_num;
6996
6997             ram_decompress_buf(s, buf + 1, 9);
6998             bs_index = buf[1];
6999             sector_num = be64_to_cpupu((const uint64_t *)(buf + 2));
7000             if (bs_index >= nb_drives) {
7001                 fprintf(stderr, "Invalid block device index %d\n", bs_index);
7002                 goto error;
7003             }
7004             if (bdrv_read(drives_table[bs_index].bdrv, sector_num,
7005                           phys_ram_base + i,
7006                           BDRV_HASH_BLOCK_SIZE / 512) < 0) {
7007                 fprintf(stderr, "Error while reading sector %d:%" PRId64 "\n",
7008                         bs_index, sector_num);
7009                 goto error;
7010             }
7011         } else
7012 #endif
7013         {
7014         error:
7015             printf("Error block header\n");
7016             return -EINVAL;
7017         }
7018     }
7019     ram_decompress_close(s);
7020     return 0;
7021 }
7022
7023 /***********************************************************/
7024 /* bottom halves (can be seen as timers which expire ASAP) */
7025
7026 struct QEMUBH {
7027     QEMUBHFunc *cb;
7028     void *opaque;
7029     int scheduled;
7030     QEMUBH *next;
7031 };
7032
7033 static QEMUBH *first_bh = NULL;
7034
7035 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
7036 {
7037     QEMUBH *bh;
7038     bh = qemu_mallocz(sizeof(QEMUBH));
7039     if (!bh)
7040         return NULL;
7041     bh->cb = cb;
7042     bh->opaque = opaque;
7043     return bh;
7044 }
7045
7046 int qemu_bh_poll(void)
7047 {
7048     QEMUBH *bh, **pbh;
7049     int ret;
7050
7051     ret = 0;
7052     for(;;) {
7053         pbh = &first_bh;
7054         bh = *pbh;
7055         if (!bh)
7056             break;
7057         ret = 1;
7058         *pbh = bh->next;
7059         bh->scheduled = 0;
7060         bh->cb(bh->opaque);
7061     }
7062     return ret;
7063 }
7064
7065 void qemu_bh_schedule(QEMUBH *bh)
7066 {
7067     CPUState *env = cpu_single_env;
7068     if (bh->scheduled)
7069         return;
7070     bh->scheduled = 1;
7071     bh->next = first_bh;
7072     first_bh = bh;
7073
7074     /* stop the currently executing CPU to execute the BH ASAP */
7075     if (env) {
7076         cpu_interrupt(env, CPU_INTERRUPT_EXIT);
7077     }
7078 }
7079
7080 void qemu_bh_cancel(QEMUBH *bh)
7081 {
7082     QEMUBH **pbh;
7083     if (bh->scheduled) {
7084         pbh = &first_bh;
7085         while (*pbh != bh)
7086             pbh = &(*pbh)->next;
7087         *pbh = bh->next;
7088         bh->scheduled = 0;
7089     }
7090 }
7091
7092 void qemu_bh_delete(QEMUBH *bh)
7093 {
7094     qemu_bh_cancel(bh);
7095     qemu_free(bh);
7096 }
7097
7098 /***********************************************************/
7099 /* machine registration */
7100
7101 QEMUMachine *first_machine = NULL;
7102
7103 int qemu_register_machine(QEMUMachine *m)
7104 {
7105     QEMUMachine **pm;
7106     pm = &first_machine;
7107     while (*pm != NULL)
7108         pm = &(*pm)->next;
7109     m->next = NULL;
7110     *pm = m;
7111     return 0;
7112 }
7113
7114 static QEMUMachine *find_machine(const char *name)
7115 {
7116     QEMUMachine *m;
7117
7118     for(m = first_machine; m != NULL; m = m->next) {
7119         if (!strcmp(m->name, name))
7120             return m;
7121     }
7122     return NULL;
7123 }
7124
7125 /***********************************************************/
7126 /* main execution loop */
7127
7128 static void gui_update(void *opaque)
7129 {
7130     DisplayState *ds = opaque;
7131     ds->dpy_refresh(ds);
7132     qemu_mod_timer(ds->gui_timer,
7133         (ds->gui_timer_interval ?
7134             ds->gui_timer_interval :
7135             GUI_REFRESH_INTERVAL)
7136         + qemu_get_clock(rt_clock));
7137 }
7138
7139 struct vm_change_state_entry {
7140     VMChangeStateHandler *cb;
7141     void *opaque;
7142     LIST_ENTRY (vm_change_state_entry) entries;
7143 };
7144
7145 static LIST_HEAD(vm_change_state_head, vm_change_state_entry) vm_change_state_head;
7146
7147 VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
7148                                                      void *opaque)
7149 {
7150     VMChangeStateEntry *e;
7151
7152     e = qemu_mallocz(sizeof (*e));
7153     if (!e)
7154         return NULL;
7155
7156     e->cb = cb;
7157     e->opaque = opaque;
7158     LIST_INSERT_HEAD(&vm_change_state_head, e, entries);
7159     return e;
7160 }
7161
7162 void qemu_del_vm_change_state_handler(VMChangeStateEntry *e)
7163 {
7164     LIST_REMOVE (e, entries);
7165     qemu_free (e);
7166 }
7167
7168 static void vm_state_notify(int running)
7169 {
7170     VMChangeStateEntry *e;
7171
7172     for (e = vm_change_state_head.lh_first; e; e = e->entries.le_next) {
7173         e->cb(e->opaque, running);
7174     }
7175 }
7176
7177 /* XXX: support several handlers */
7178 static VMStopHandler *vm_stop_cb;
7179 static void *vm_stop_opaque;
7180
7181 int qemu_add_vm_stop_handler(VMStopHandler *cb, void *opaque)
7182 {
7183     vm_stop_cb = cb;
7184     vm_stop_opaque = opaque;
7185     return 0;
7186 }
7187
7188 void qemu_del_vm_stop_handler(VMStopHandler *cb, void *opaque)
7189 {
7190     vm_stop_cb = NULL;
7191 }
7192
7193 void vm_start(void)
7194 {
7195     if (!vm_running) {
7196         cpu_enable_ticks();
7197         vm_running = 1;
7198         vm_state_notify(1);
7199         qemu_rearm_alarm_timer(alarm_timer);
7200     }
7201 }
7202
7203 void vm_stop(int reason)
7204 {
7205     if (vm_running) {
7206         cpu_disable_ticks();
7207         vm_running = 0;
7208         if (reason != 0) {
7209             if (vm_stop_cb) {
7210                 vm_stop_cb(vm_stop_opaque, reason);
7211             }
7212         }
7213         vm_state_notify(0);
7214     }
7215 }
7216
7217 /* reset/shutdown handler */
7218
7219 typedef struct QEMUResetEntry {
7220     QEMUResetHandler *func;
7221     void *opaque;
7222     struct QEMUResetEntry *next;
7223 } QEMUResetEntry;
7224
7225 static QEMUResetEntry *first_reset_entry;
7226 static int reset_requested;
7227 static int shutdown_requested;
7228 static int powerdown_requested;
7229
7230 int qemu_shutdown_requested(void)
7231 {
7232     int r = shutdown_requested;
7233     shutdown_requested = 0;
7234     return r;
7235 }
7236
7237 int qemu_reset_requested(void)
7238 {
7239     int r = reset_requested;
7240     reset_requested = 0;
7241     return r;
7242 }
7243
7244 int qemu_powerdown_requested(void)
7245 {
7246     int r = powerdown_requested;
7247     powerdown_requested = 0;
7248     return r;
7249 }
7250
7251 void qemu_register_reset(QEMUResetHandler *func, void *opaque)
7252 {
7253     QEMUResetEntry **pre, *re;
7254
7255     pre = &first_reset_entry;
7256     while (*pre != NULL)
7257         pre = &(*pre)->next;
7258     re = qemu_mallocz(sizeof(QEMUResetEntry));
7259     re->func = func;
7260     re->opaque = opaque;
7261     re->next = NULL;
7262     *pre = re;
7263 }
7264
7265 void qemu_system_reset(void)
7266 {
7267     QEMUResetEntry *re;
7268
7269     /* reset all devices */
7270     for(re = first_reset_entry; re != NULL; re = re->next) {
7271         re->func(re->opaque);
7272     }
7273 }
7274
7275 void qemu_system_reset_request(void)
7276 {
7277     if (no_reboot) {
7278         shutdown_requested = 1;
7279     } else {
7280         reset_requested = 1;
7281     }
7282     if (cpu_single_env)
7283         cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
7284 }
7285
7286 void qemu_system_shutdown_request(void)
7287 {
7288     shutdown_requested = 1;
7289     if (cpu_single_env)
7290         cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
7291 }
7292
7293 void qemu_system_powerdown_request(void)
7294 {
7295     powerdown_requested = 1;
7296     if (cpu_single_env)
7297         cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
7298 }
7299
7300 void main_loop_wait(int timeout)
7301 {
7302     IOHandlerRecord *ioh;
7303     fd_set rfds, wfds, xfds;
7304     int ret, nfds;
7305 #ifdef _WIN32
7306     int ret2, i;
7307 #endif
7308     struct timeval tv;
7309     PollingEntry *pe;
7310
7311
7312     /* XXX: need to suppress polling by better using win32 events */
7313     ret = 0;
7314     for(pe = first_polling_entry; pe != NULL; pe = pe->next) {
7315         ret |= pe->func(pe->opaque);
7316     }
7317 #ifdef _WIN32
7318     if (ret == 0) {
7319         int err;
7320         WaitObjects *w = &wait_objects;
7321
7322         ret = WaitForMultipleObjects(w->num, w->events, FALSE, timeout);
7323         if (WAIT_OBJECT_0 + 0 <= ret && ret <= WAIT_OBJECT_0 + w->num - 1) {
7324             if (w->func[ret - WAIT_OBJECT_0])
7325                 w->func[ret - WAIT_OBJECT_0](w->opaque[ret - WAIT_OBJECT_0]);
7326
7327             /* Check for additional signaled events */
7328             for(i = (ret - WAIT_OBJECT_0 + 1); i < w->num; i++) {
7329
7330                 /* Check if event is signaled */
7331                 ret2 = WaitForSingleObject(w->events[i], 0);
7332                 if(ret2 == WAIT_OBJECT_0) {
7333                     if (w->func[i])
7334                         w->func[i](w->opaque[i]);
7335                 } else if (ret2 == WAIT_TIMEOUT) {
7336                 } else {
7337                     err = GetLastError();
7338                     fprintf(stderr, "WaitForSingleObject error %d %d\n", i, err);
7339                 }
7340             }
7341         } else if (ret == WAIT_TIMEOUT) {
7342         } else {
7343             err = GetLastError();
7344             fprintf(stderr, "WaitForMultipleObjects error %d %d\n", ret, err);
7345         }
7346     }
7347 #endif
7348     /* poll any events */
7349     /* XXX: separate device handlers from system ones */
7350     nfds = -1;
7351     FD_ZERO(&rfds);
7352     FD_ZERO(&wfds);
7353     FD_ZERO(&xfds);
7354     for(ioh = first_io_handler; ioh != NULL; ioh = ioh->next) {
7355         if (ioh->deleted)
7356             continue;
7357         if (ioh->fd_read &&
7358             (!ioh->fd_read_poll ||
7359              ioh->fd_read_poll(ioh->opaque) != 0)) {
7360             FD_SET(ioh->fd, &rfds);
7361             if (ioh->fd > nfds)
7362                 nfds = ioh->fd;
7363         }
7364         if (ioh->fd_write) {
7365             FD_SET(ioh->fd, &wfds);
7366             if (ioh->fd > nfds)
7367                 nfds = ioh->fd;
7368         }
7369     }
7370
7371     tv.tv_sec = 0;
7372 #ifdef _WIN32
7373     tv.tv_usec = 0;
7374 #else
7375     tv.tv_usec = timeout * 1000;
7376 #endif
7377 #if defined(CONFIG_SLIRP)
7378     if (slirp_inited) {
7379         slirp_select_fill(&nfds, &rfds, &wfds, &xfds);
7380     }
7381 #endif
7382     ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv);
7383     if (ret > 0) {
7384         IOHandlerRecord **pioh;
7385
7386         for(ioh = first_io_handler; ioh != NULL; ioh = ioh->next) {
7387             if (!ioh->deleted && ioh->fd_read && FD_ISSET(ioh->fd, &rfds)) {
7388                 ioh->fd_read(ioh->opaque);
7389             }
7390             if (!ioh->deleted && ioh->fd_write && FD_ISSET(ioh->fd, &wfds)) {
7391                 ioh->fd_write(ioh->opaque);
7392             }
7393         }
7394
7395         /* remove deleted IO handlers */
7396         pioh = &first_io_handler;
7397         while (*pioh) {
7398             ioh = *pioh;
7399             if (ioh->deleted) {
7400                 *pioh = ioh->next;
7401                 qemu_free(ioh);
7402             } else
7403                 pioh = &ioh->next;
7404         }
7405     }
7406 #if defined(CONFIG_SLIRP)
7407     if (slirp_inited) {
7408         if (ret < 0) {
7409             FD_ZERO(&rfds);
7410             FD_ZERO(&wfds);
7411             FD_ZERO(&xfds);
7412         }
7413         slirp_select_poll(&rfds, &wfds, &xfds);
7414     }
7415 #endif
7416     qemu_aio_poll();
7417
7418     if (vm_running) {
7419         if (likely(!(cur_cpu->singlestep_enabled & SSTEP_NOTIMER)))
7420         qemu_run_timers(&active_timers[QEMU_TIMER_VIRTUAL],
7421                         qemu_get_clock(vm_clock));
7422         /* run dma transfers, if any */
7423         DMA_run();
7424     }
7425
7426     /* real time timers */
7427     qemu_run_timers(&active_timers[QEMU_TIMER_REALTIME],
7428                     qemu_get_clock(rt_clock));
7429
7430     if (alarm_timer->flags & ALARM_FLAG_EXPIRED) {
7431         alarm_timer->flags &= ~(ALARM_FLAG_EXPIRED);
7432         qemu_rearm_alarm_timer(alarm_timer);
7433     }
7434
7435     /* Check bottom-halves last in case any of the earlier events triggered
7436        them.  */
7437     qemu_bh_poll();
7438
7439 }
7440
7441 static int main_loop(void)
7442 {
7443     int ret, timeout;
7444 #ifdef CONFIG_PROFILER
7445     int64_t ti;
7446 #endif
7447     CPUState *env;
7448
7449     cur_cpu = first_cpu;
7450     next_cpu = cur_cpu->next_cpu ?: first_cpu;
7451     for(;;) {
7452         if (vm_running) {
7453
7454             for(;;) {
7455                 /* get next cpu */
7456                 env = next_cpu;
7457 #ifdef CONFIG_PROFILER
7458                 ti = profile_getclock();
7459 #endif
7460                 if (use_icount) {
7461                     int64_t count;
7462                     int decr;
7463                     qemu_icount -= (env->icount_decr.u16.low + env->icount_extra);
7464                     env->icount_decr.u16.low = 0;
7465                     env->icount_extra = 0;
7466                     count = qemu_next_deadline();
7467                     count = (count + (1 << icount_time_shift) - 1)
7468                             >> icount_time_shift;
7469                     qemu_icount += count;
7470                     decr = (count > 0xffff) ? 0xffff : count;
7471                     count -= decr;
7472                     env->icount_decr.u16.low = decr;
7473                     env->icount_extra = count;
7474                 }
7475                 ret = cpu_exec(env);
7476 #ifdef CONFIG_PROFILER
7477                 qemu_time += profile_getclock() - ti;
7478 #endif
7479                 if (use_icount) {
7480                     /* Fold pending instructions back into the
7481                        instruction counter, and clear the interrupt flag.  */
7482                     qemu_icount -= (env->icount_decr.u16.low
7483                                     + env->icount_extra);
7484                     env->icount_decr.u32 = 0;
7485                     env->icount_extra = 0;
7486                 }
7487                 next_cpu = env->next_cpu ?: first_cpu;
7488                 if (event_pending && likely(ret != EXCP_DEBUG)) {
7489                     ret = EXCP_INTERRUPT;
7490                     event_pending = 0;
7491                     break;
7492                 }
7493                 if (ret == EXCP_HLT) {
7494                     /* Give the next CPU a chance to run.  */
7495                     cur_cpu = env;
7496                     continue;
7497                 }
7498                 if (ret != EXCP_HALTED)
7499                     break;
7500                 /* all CPUs are halted ? */
7501                 if (env == cur_cpu)
7502                     break;
7503             }
7504             cur_cpu = env;
7505
7506             if (shutdown_requested) {
7507                 ret = EXCP_INTERRUPT;
7508                 if (no_shutdown) {
7509                     vm_stop(0);
7510                     no_shutdown = 0;
7511                 }
7512                 else
7513                     break;
7514             }
7515             if (reset_requested) {
7516                 reset_requested = 0;
7517                 qemu_system_reset();
7518                 ret = EXCP_INTERRUPT;
7519             }
7520             if (powerdown_requested) {
7521                 powerdown_requested = 0;
7522                 qemu_system_powerdown();
7523                 ret = EXCP_INTERRUPT;
7524             }
7525             if (unlikely(ret == EXCP_DEBUG)) {
7526                 vm_stop(EXCP_DEBUG);
7527             }
7528             /* If all cpus are halted then wait until the next IRQ */
7529             /* XXX: use timeout computed from timers */
7530             if (ret == EXCP_HALTED) {
7531                 if (use_icount) {
7532                     int64_t add;
7533                     int64_t delta;
7534                     /* Advance virtual time to the next event.  */
7535                     if (use_icount == 1) {
7536                         /* When not using an adaptive execution frequency
7537                            we tend to get badly out of sync with real time,
7538                            so just delay for a reasonable amount of time.  */
7539                         delta = 0;
7540                     } else {
7541                         delta = cpu_get_icount() - cpu_get_clock();
7542                     }
7543                     if (delta > 0) {
7544                         /* If virtual time is ahead of real time then just
7545                            wait for IO.  */
7546                         timeout = (delta / 1000000) + 1;
7547                     } else {
7548                         /* Wait for either IO to occur or the next
7549                            timer event.  */
7550                         add = qemu_next_deadline();
7551                         /* We advance the timer before checking for IO.
7552                            Limit the amount we advance so that early IO
7553                            activity won't get the guest too far ahead.  */
7554                         if (add > 10000000)
7555                             add = 10000000;
7556                         delta += add;
7557                         add = (add + (1 << icount_time_shift) - 1)
7558                               >> icount_time_shift;
7559                         qemu_icount += add;
7560                         timeout = delta / 1000000;
7561                         if (timeout < 0)
7562                             timeout = 0;
7563                     }
7564                 } else {
7565                     timeout = 10;
7566                 }
7567             } else {
7568                 timeout = 0;
7569             }
7570         } else {
7571             timeout = 10;
7572         }
7573 #ifdef CONFIG_PROFILER
7574         ti = profile_getclock();
7575 #endif
7576         main_loop_wait(timeout);
7577 #ifdef CONFIG_PROFILER
7578         dev_time += profile_getclock() - ti;
7579 #endif
7580     }
7581     cpu_disable_ticks();
7582     return ret;
7583 }
7584
7585 static void help(int exitcode)
7586 {
7587     printf("QEMU PC emulator version " QEMU_VERSION ", Copyright (c) 2003-2008 Fabrice Bellard\n"
7588            "usage: %s [options] [disk_image]\n"
7589            "\n"
7590            "'disk_image' is a raw hard image image for IDE hard disk 0\n"
7591            "\n"
7592            "Standard options:\n"
7593            "-M machine      select emulated machine (-M ? for list)\n"
7594            "-cpu cpu        select CPU (-cpu ? for list)\n"
7595            "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n"
7596            "-hda/-hdb file  use 'file' as IDE hard disk 0/1 image\n"
7597            "-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image\n"
7598            "-cdrom file     use 'file' as IDE cdrom image (cdrom is ide1 master)\n"
7599            "-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]\n"
7600            "       [,cyls=c,heads=h,secs=s[,trans=t]][,snapshot=on|off]\n"
7601            "       [,cache=on|off][,format=f]\n"
7602            "                use 'file' as a drive image\n"
7603            "-mtdblock file  use 'file' as on-board Flash memory image\n"
7604            "-sd file        use 'file' as SecureDigital card image\n"
7605            "-pflash file    use 'file' as a parallel flash image\n"
7606            "-boot [a|c|d|n] boot on floppy (a), hard disk (c), CD-ROM (d), or network (n)\n"
7607            "-snapshot       write to temporary files instead of disk image files\n"
7608 #ifdef CONFIG_SDL
7609            "-no-frame       open SDL window without a frame and window decorations\n"
7610            "-alt-grab       use Ctrl-Alt-Shift to grab mouse (instead of Ctrl-Alt)\n"
7611            "-no-quit        disable SDL window close capability\n"
7612 #endif
7613 #ifdef TARGET_I386
7614            "-no-fd-bootchk  disable boot signature checking for floppy disks\n"
7615 #endif
7616            "-m megs         set virtual RAM size to megs MB [default=%d]\n"
7617            "-smp n          set the number of CPUs to 'n' [default=1]\n"
7618            "-nographic      disable graphical output and redirect serial I/Os to console\n"
7619            "-portrait       rotate graphical output 90 deg left (only PXA LCD)\n"
7620 #ifndef _WIN32
7621            "-k language     use keyboard layout (for example \"fr\" for French)\n"
7622 #endif
7623 #ifdef HAS_AUDIO
7624            "-audio-help     print list of audio drivers and their options\n"
7625            "-soundhw c1,... enable audio support\n"
7626            "                and only specified sound cards (comma separated list)\n"
7627            "                use -soundhw ? to get the list of supported cards\n"
7628            "                use -soundhw all to enable all of them\n"
7629 #endif
7630            "-localtime      set the real time clock to local time [default=utc]\n"
7631            "-full-screen    start in full screen\n"
7632 #ifdef TARGET_I386
7633            "-win2k-hack     use it when installing Windows 2000 to avoid a disk full bug\n"
7634 #endif
7635            "-usb            enable the USB driver (will be the default soon)\n"
7636            "-usbdevice name add the host or guest USB device 'name'\n"
7637 #if defined(TARGET_PPC) || defined(TARGET_SPARC)
7638            "-g WxH[xDEPTH]  Set the initial graphical resolution and depth\n"
7639 #endif
7640            "-name string    set the name of the guest\n"
7641            "\n"
7642            "Network options:\n"
7643            "-net nic[,vlan=n][,macaddr=addr][,model=type]\n"
7644            "                create a new Network Interface Card and connect it to VLAN 'n'\n"
7645 #ifdef CONFIG_SLIRP
7646            "-net user[,vlan=n][,hostname=host]\n"
7647            "                connect the user mode network stack to VLAN 'n' and send\n"
7648            "                hostname 'host' to DHCP clients\n"
7649 #endif
7650 #ifdef _WIN32
7651            "-net tap[,vlan=n],ifname=name\n"
7652            "                connect the host TAP network interface to VLAN 'n'\n"
7653 #else
7654            "-net tap[,vlan=n][,fd=h][,ifname=name][,script=file][,downscript=dfile]\n"
7655            "                connect the host TAP network interface to VLAN 'n' and use the\n"
7656            "                network scripts 'file' (default=%s)\n"
7657            "                and 'dfile' (default=%s);\n"
7658            "                use '[down]script=no' to disable script execution;\n"
7659            "                use 'fd=h' to connect to an already opened TAP interface\n"
7660 #endif
7661            "-net socket[,vlan=n][,fd=h][,listen=[host]:port][,connect=host:port]\n"
7662            "                connect the vlan 'n' to another VLAN using a socket connection\n"
7663            "-net socket[,vlan=n][,fd=h][,mcast=maddr:port]\n"
7664            "                connect the vlan 'n' to multicast maddr and port\n"
7665 #ifdef CONFIG_VDE
7666            "-net vde[,vlan=n][,sock=socketpath][,port=n][,group=groupname][,mode=octalmode]\n"
7667            "                connect the vlan 'n' to port 'n' of a vde switch running\n"
7668            "                on host and listening for incoming connections on 'socketpath'.\n"
7669            "                Use group 'groupname' and mode 'octalmode' to change default\n"
7670            "                ownership and permissions for communication port.\n"
7671 #endif
7672            "-net none       use it alone to have zero network devices; if no -net option\n"
7673            "                is provided, the default is '-net nic -net user'\n"
7674            "\n"
7675 #ifdef CONFIG_SLIRP
7676            "-tftp dir       allow tftp access to files in dir [-net user]\n"
7677            "-bootp file     advertise file in BOOTP replies\n"
7678 #ifndef _WIN32
7679            "-smb dir        allow SMB access to files in 'dir' [-net user]\n"
7680 #endif
7681            "-redir [tcp|udp]:host-port:[guest-host]:guest-port\n"
7682            "                redirect TCP or UDP connections from host to guest [-net user]\n"
7683 #endif
7684            "\n"
7685            "Linux boot specific:\n"
7686            "-kernel bzImage use 'bzImage' as kernel image\n"
7687            "-append cmdline use 'cmdline' as kernel command line\n"
7688            "-initrd file    use 'file' as initial ram disk\n"
7689            "\n"
7690            "Debug/Expert options:\n"
7691            "-monitor dev    redirect the monitor to char device 'dev'\n"
7692            "-serial dev     redirect the serial port to char device 'dev'\n"
7693            "-parallel dev   redirect the parallel port to char device 'dev'\n"
7694            "-pidfile file   Write PID to 'file'\n"
7695            "-S              freeze CPU at startup (use 'c' to start execution)\n"
7696            "-s              wait gdb connection to port\n"
7697            "-p port         set gdb connection port [default=%s]\n"
7698            "-d item1,...    output log to %s (use -d ? for a list of log items)\n"
7699            "-hdachs c,h,s[,t]  force hard disk 0 physical geometry and the optional BIOS\n"
7700            "                translation (t=none or lba) (usually qemu can guess them)\n"
7701            "-L path         set the directory for the BIOS, VGA BIOS and keymaps\n"
7702 #ifdef USE_KQEMU
7703            "-kernel-kqemu   enable KQEMU full virtualization (default is user mode only)\n"
7704            "-no-kqemu       disable KQEMU kernel module usage\n"
7705 #endif
7706 #ifdef TARGET_I386
7707            "-std-vga        simulate a standard VGA card with VESA Bochs Extensions\n"
7708            "                (default is CL-GD5446 PCI VGA)\n"
7709            "-no-acpi        disable ACPI\n"
7710 #endif
7711 #ifdef CONFIG_CURSES
7712            "-curses         use a curses/ncurses interface instead of SDL\n"
7713 #endif
7714            "-no-reboot      exit instead of rebooting\n"
7715            "-no-shutdown    stop before shutdown\n"
7716            "-loadvm [tag|id]  start right away with a saved state (loadvm in monitor)\n"
7717            "-vnc display    start a VNC server on display\n"
7718 #ifndef _WIN32
7719            "-daemonize      daemonize QEMU after initializing\n"
7720 #endif
7721            "-option-rom rom load a file, rom, into the option ROM space\n"
7722 #ifdef TARGET_SPARC
7723            "-prom-env variable=value  set OpenBIOS nvram variables\n"
7724 #endif
7725            "-clock          force the use of the given methods for timer alarm.\n"
7726            "                To see what timers are available use -clock ?\n"
7727            "-startdate      select initial date of the clock\n"
7728            "-icount [N|auto]\n"
7729            "                Enable virtual instruction counter with 2^N clock ticks per instruction\n"
7730            "\n"
7731            "During emulation, the following keys are useful:\n"
7732            "ctrl-alt-f      toggle full screen\n"
7733            "ctrl-alt-n      switch to virtual console 'n'\n"
7734            "ctrl-alt        toggle mouse and keyboard grab\n"
7735            "\n"
7736            "When using -nographic, press 'ctrl-a h' to get some help.\n"
7737            ,
7738            "qemu",
7739            DEFAULT_RAM_SIZE,
7740 #ifndef _WIN32
7741            DEFAULT_NETWORK_SCRIPT,
7742            DEFAULT_NETWORK_DOWN_SCRIPT,
7743 #endif
7744            DEFAULT_GDBSTUB_PORT,
7745            "/tmp/qemu.log");
7746     exit(exitcode);
7747 }
7748
7749 #define HAS_ARG 0x0001
7750
7751 enum {
7752     QEMU_OPTION_h,
7753
7754     QEMU_OPTION_M,
7755     QEMU_OPTION_cpu,
7756     QEMU_OPTION_fda,
7757     QEMU_OPTION_fdb,
7758     QEMU_OPTION_hda,
7759     QEMU_OPTION_hdb,
7760     QEMU_OPTION_hdc,
7761     QEMU_OPTION_hdd,
7762     QEMU_OPTION_drive,
7763     QEMU_OPTION_cdrom,
7764     QEMU_OPTION_mtdblock,
7765     QEMU_OPTION_sd,
7766     QEMU_OPTION_pflash,
7767     QEMU_OPTION_boot,
7768     QEMU_OPTION_snapshot,
7769 #ifdef TARGET_I386
7770     QEMU_OPTION_no_fd_bootchk,
7771 #endif
7772     QEMU_OPTION_m,
7773     QEMU_OPTION_nographic,
7774     QEMU_OPTION_portrait,
7775 #ifdef HAS_AUDIO
7776     QEMU_OPTION_audio_help,
7777     QEMU_OPTION_soundhw,
7778 #endif
7779
7780     QEMU_OPTION_net,
7781     QEMU_OPTION_tftp,
7782     QEMU_OPTION_bootp,
7783     QEMU_OPTION_smb,
7784     QEMU_OPTION_redir,
7785
7786     QEMU_OPTION_kernel,
7787     QEMU_OPTION_append,
7788     QEMU_OPTION_initrd,
7789
7790     QEMU_OPTION_S,
7791     QEMU_OPTION_s,
7792     QEMU_OPTION_p,
7793     QEMU_OPTION_d,
7794     QEMU_OPTION_hdachs,
7795     QEMU_OPTION_L,
7796     QEMU_OPTION_bios,
7797     QEMU_OPTION_k,
7798     QEMU_OPTION_localtime,
7799     QEMU_OPTION_cirrusvga,
7800     QEMU_OPTION_vmsvga,
7801     QEMU_OPTION_g,
7802     QEMU_OPTION_std_vga,
7803     QEMU_OPTION_echr,
7804     QEMU_OPTION_monitor,
7805     QEMU_OPTION_serial,
7806     QEMU_OPTION_parallel,
7807     QEMU_OPTION_loadvm,
7808     QEMU_OPTION_full_screen,
7809     QEMU_OPTION_no_frame,
7810     QEMU_OPTION_alt_grab,
7811     QEMU_OPTION_no_quit,
7812     QEMU_OPTION_pidfile,
7813     QEMU_OPTION_no_kqemu,
7814     QEMU_OPTION_kernel_kqemu,
7815     QEMU_OPTION_win2k_hack,
7816     QEMU_OPTION_usb,
7817     QEMU_OPTION_usbdevice,
7818     QEMU_OPTION_smp,
7819     QEMU_OPTION_vnc,
7820     QEMU_OPTION_no_acpi,
7821     QEMU_OPTION_curses,
7822     QEMU_OPTION_no_reboot,
7823     QEMU_OPTION_no_shutdown,
7824     QEMU_OPTION_show_cursor,
7825     QEMU_OPTION_daemonize,
7826     QEMU_OPTION_option_rom,
7827     QEMU_OPTION_semihosting,
7828     QEMU_OPTION_name,
7829     QEMU_OPTION_prom_env,
7830     QEMU_OPTION_old_param,
7831     QEMU_OPTION_clock,
7832     QEMU_OPTION_startdate,
7833     QEMU_OPTION_tb_size,
7834     QEMU_OPTION_icount,
7835 };
7836
7837 typedef struct QEMUOption {
7838     const char *name;
7839     int flags;
7840     int index;
7841 } QEMUOption;
7842
7843 const QEMUOption qemu_options[] = {
7844     { "h", 0, QEMU_OPTION_h },
7845     { "help", 0, QEMU_OPTION_h },
7846
7847     { "M", HAS_ARG, QEMU_OPTION_M },
7848     { "cpu", HAS_ARG, QEMU_OPTION_cpu },
7849     { "fda", HAS_ARG, QEMU_OPTION_fda },
7850     { "fdb", HAS_ARG, QEMU_OPTION_fdb },
7851     { "hda", HAS_ARG, QEMU_OPTION_hda },
7852     { "hdb", HAS_ARG, QEMU_OPTION_hdb },
7853     { "hdc", HAS_ARG, QEMU_OPTION_hdc },
7854     { "hdd", HAS_ARG, QEMU_OPTION_hdd },
7855     { "drive", HAS_ARG, QEMU_OPTION_drive },
7856     { "cdrom", HAS_ARG, QEMU_OPTION_cdrom },
7857     { "mtdblock", HAS_ARG, QEMU_OPTION_mtdblock },
7858     { "sd", HAS_ARG, QEMU_OPTION_sd },
7859     { "pflash", HAS_ARG, QEMU_OPTION_pflash },
7860     { "boot", HAS_ARG, QEMU_OPTION_boot },
7861     { "snapshot", 0, QEMU_OPTION_snapshot },
7862 #ifdef TARGET_I386
7863     { "no-fd-bootchk", 0, QEMU_OPTION_no_fd_bootchk },
7864 #endif
7865     { "m", HAS_ARG, QEMU_OPTION_m },
7866     { "nographic", 0, QEMU_OPTION_nographic },
7867     { "portrait", 0, QEMU_OPTION_portrait },
7868     { "k", HAS_ARG, QEMU_OPTION_k },
7869 #ifdef HAS_AUDIO
7870     { "audio-help", 0, QEMU_OPTION_audio_help },
7871     { "soundhw", HAS_ARG, QEMU_OPTION_soundhw },
7872 #endif
7873
7874     { "net", HAS_ARG, QEMU_OPTION_net},
7875 #ifdef CONFIG_SLIRP
7876     { "tftp", HAS_ARG, QEMU_OPTION_tftp },
7877     { "bootp", HAS_ARG, QEMU_OPTION_bootp },
7878 #ifndef _WIN32
7879     { "smb", HAS_ARG, QEMU_OPTION_smb },
7880 #endif
7881     { "redir", HAS_ARG, QEMU_OPTION_redir },
7882 #endif
7883
7884     { "kernel", HAS_ARG, QEMU_OPTION_kernel },
7885     { "append", HAS_ARG, QEMU_OPTION_append },
7886     { "initrd", HAS_ARG, QEMU_OPTION_initrd },
7887
7888     { "S", 0, QEMU_OPTION_S },
7889     { "s", 0, QEMU_OPTION_s },
7890     { "p", HAS_ARG, QEMU_OPTION_p },
7891     { "d", HAS_ARG, QEMU_OPTION_d },
7892     { "hdachs", HAS_ARG, QEMU_OPTION_hdachs },
7893     { "L", HAS_ARG, QEMU_OPTION_L },
7894     { "bios", HAS_ARG, QEMU_OPTION_bios },
7895 #ifdef USE_KQEMU
7896     { "no-kqemu", 0, QEMU_OPTION_no_kqemu },
7897     { "kernel-kqemu", 0, QEMU_OPTION_kernel_kqemu },
7898 #endif
7899 #if defined(TARGET_PPC) || defined(TARGET_SPARC)
7900     { "g", 1, QEMU_OPTION_g },
7901 #endif
7902     { "localtime", 0, QEMU_OPTION_localtime },
7903     { "std-vga", 0, QEMU_OPTION_std_vga },
7904     { "echr", HAS_ARG, QEMU_OPTION_echr },
7905     { "monitor", HAS_ARG, QEMU_OPTION_monitor },
7906     { "serial", HAS_ARG, QEMU_OPTION_serial },
7907     { "parallel", HAS_ARG, QEMU_OPTION_parallel },
7908     { "loadvm", HAS_ARG, QEMU_OPTION_loadvm },
7909     { "full-screen", 0, QEMU_OPTION_full_screen },
7910 #ifdef CONFIG_SDL
7911     { "no-frame", 0, QEMU_OPTION_no_frame },
7912     { "alt-grab", 0, QEMU_OPTION_alt_grab },
7913     { "no-quit", 0, QEMU_OPTION_no_quit },
7914 #endif
7915     { "pidfile", HAS_ARG, QEMU_OPTION_pidfile },
7916     { "win2k-hack", 0, QEMU_OPTION_win2k_hack },
7917     { "usbdevice", HAS_ARG, QEMU_OPTION_usbdevice },
7918     { "smp", HAS_ARG, QEMU_OPTION_smp },
7919     { "vnc", HAS_ARG, QEMU_OPTION_vnc },
7920 #ifdef CONFIG_CURSES
7921     { "curses", 0, QEMU_OPTION_curses },
7922 #endif
7923
7924     /* temporary options */
7925     { "usb", 0, QEMU_OPTION_usb },
7926     { "cirrusvga", 0, QEMU_OPTION_cirrusvga },
7927     { "vmwarevga", 0, QEMU_OPTION_vmsvga },
7928     { "no-acpi", 0, QEMU_OPTION_no_acpi },
7929     { "no-reboot", 0, QEMU_OPTION_no_reboot },
7930     { "no-shutdown", 0, QEMU_OPTION_no_shutdown },
7931     { "show-cursor", 0, QEMU_OPTION_show_cursor },
7932     { "daemonize", 0, QEMU_OPTION_daemonize },
7933     { "option-rom", HAS_ARG, QEMU_OPTION_option_rom },
7934 #if defined(TARGET_ARM) || defined(TARGET_M68K)
7935     { "semihosting", 0, QEMU_OPTION_semihosting },
7936 #endif
7937     { "name", HAS_ARG, QEMU_OPTION_name },
7938 #if defined(TARGET_SPARC)
7939     { "prom-env", HAS_ARG, QEMU_OPTION_prom_env },
7940 #endif
7941 #if defined(TARGET_ARM)
7942     { "old-param", 0, QEMU_OPTION_old_param },
7943 #endif
7944     { "clock", HAS_ARG, QEMU_OPTION_clock },
7945     { "startdate", HAS_ARG, QEMU_OPTION_startdate },
7946     { "tb-size", HAS_ARG, QEMU_OPTION_tb_size },
7947     { "icount", HAS_ARG, QEMU_OPTION_icount },
7948     { NULL },
7949 };
7950
7951 /* password input */
7952
7953 int qemu_key_check(BlockDriverState *bs, const char *name)
7954 {
7955     char password[256];
7956     int i;
7957
7958     if (!bdrv_is_encrypted(bs))
7959         return 0;
7960
7961     term_printf("%s is encrypted.\n", name);
7962     for(i = 0; i < 3; i++) {
7963         monitor_readline("Password: ", 1, password, sizeof(password));
7964         if (bdrv_set_key(bs, password) == 0)
7965             return 0;
7966         term_printf("invalid password\n");
7967     }
7968     return -EPERM;
7969 }
7970
7971 static BlockDriverState *get_bdrv(int index)
7972 {
7973     if (index > nb_drives)
7974         return NULL;
7975     return drives_table[index].bdrv;
7976 }
7977
7978 static void read_passwords(void)
7979 {
7980     BlockDriverState *bs;
7981     int i;
7982
7983     for(i = 0; i < 6; i++) {
7984         bs = get_bdrv(i);
7985         if (bs)
7986             qemu_key_check(bs, bdrv_get_device_name(bs));
7987     }
7988 }
7989
7990 #ifdef HAS_AUDIO
7991 struct soundhw soundhw[] = {
7992 #ifdef HAS_AUDIO_CHOICE
7993 #if defined(TARGET_I386) || defined(TARGET_MIPS)
7994     {
7995         "pcspk",
7996         "PC speaker",
7997         0,
7998         1,
7999         { .init_isa = pcspk_audio_init }
8000     },
8001 #endif
8002     {
8003         "sb16",
8004         "Creative Sound Blaster 16",
8005         0,
8006         1,
8007         { .init_isa = SB16_init }
8008     },
8009
8010 #ifdef CONFIG_CS4231A
8011     {
8012         "cs4231a",
8013         "CS4231A",
8014         0,
8015         1,
8016         { .init_isa = cs4231a_init }
8017     },
8018 #endif
8019
8020 #ifdef CONFIG_ADLIB
8021     {
8022         "adlib",
8023 #ifdef HAS_YMF262
8024         "Yamaha YMF262 (OPL3)",
8025 #else
8026         "Yamaha YM3812 (OPL2)",
8027 #endif
8028         0,
8029         1,
8030         { .init_isa = Adlib_init }
8031     },
8032 #endif
8033
8034 #ifdef CONFIG_GUS
8035     {
8036         "gus",
8037         "Gravis Ultrasound GF1",
8038         0,
8039         1,
8040         { .init_isa = GUS_init }
8041     },
8042 #endif
8043
8044 #ifdef CONFIG_AC97
8045     {
8046         "ac97",
8047         "Intel 82801AA AC97 Audio",
8048         0,
8049         0,
8050         { .init_pci = ac97_init }
8051     },
8052 #endif
8053
8054     {
8055         "es1370",
8056         "ENSONIQ AudioPCI ES1370",
8057         0,
8058         0,
8059         { .init_pci = es1370_init }
8060     },
8061 #endif
8062
8063     { NULL, NULL, 0, 0, { NULL } }
8064 };
8065
8066 static void select_soundhw (const char *optarg)
8067 {
8068     struct soundhw *c;
8069
8070     if (*optarg == '?') {
8071     show_valid_cards:
8072
8073         printf ("Valid sound card names (comma separated):\n");
8074         for (c = soundhw; c->name; ++c) {
8075             printf ("%-11s %s\n", c->name, c->descr);
8076         }
8077         printf ("\n-soundhw all will enable all of the above\n");
8078         exit (*optarg != '?');
8079     }
8080     else {
8081         size_t l;
8082         const char *p;
8083         char *e;
8084         int bad_card = 0;
8085
8086         if (!strcmp (optarg, "all")) {
8087             for (c = soundhw; c->name; ++c) {
8088                 c->enabled = 1;
8089             }
8090             return;
8091         }
8092
8093         p = optarg;
8094         while (*p) {
8095             e = strchr (p, ',');
8096             l = !e ? strlen (p) : (size_t) (e - p);
8097
8098             for (c = soundhw; c->name; ++c) {
8099                 if (!strncmp (c->name, p, l)) {
8100                     c->enabled = 1;
8101                     break;
8102                 }
8103             }
8104
8105             if (!c->name) {
8106                 if (l > 80) {
8107                     fprintf (stderr,
8108                              "Unknown sound card name (too big to show)\n");
8109                 }
8110                 else {
8111                     fprintf (stderr, "Unknown sound card name `%.*s'\n",
8112                              (int) l, p);
8113                 }
8114                 bad_card = 1;
8115             }
8116             p += l + (e != NULL);
8117         }
8118
8119         if (bad_card)
8120             goto show_valid_cards;
8121     }
8122 }
8123 #endif
8124
8125 #ifdef _WIN32
8126 static BOOL WINAPI qemu_ctrl_handler(DWORD type)
8127 {
8128     exit(STATUS_CONTROL_C_EXIT);
8129     return TRUE;
8130 }
8131 #endif
8132
8133 #define MAX_NET_CLIENTS 32
8134
8135 int main(int argc, char **argv)
8136 {
8137 #ifdef CONFIG_GDBSTUB
8138     int use_gdbstub;
8139     const char *gdbstub_port;
8140 #endif
8141     uint32_t boot_devices_bitmap = 0;
8142     int i;
8143     int snapshot, linux_boot, net_boot;
8144     const char *initrd_filename;
8145     const char *kernel_filename, *kernel_cmdline;
8146     const char *boot_devices = "";
8147     DisplayState *ds = &display_state;
8148     int cyls, heads, secs, translation;
8149     const char *net_clients[MAX_NET_CLIENTS];
8150     int nb_net_clients;
8151     int hda_index;
8152     int optind;
8153     const char *r, *optarg;
8154     CharDriverState *monitor_hd;
8155     const char *monitor_device;
8156     const char *serial_devices[MAX_SERIAL_PORTS];
8157     int serial_device_index;
8158     const char *parallel_devices[MAX_PARALLEL_PORTS];
8159     int parallel_device_index;
8160     const char *loadvm = NULL;
8161     QEMUMachine *machine;
8162     const char *cpu_model;
8163     const char *usb_devices[MAX_USB_CMDLINE];
8164     int usb_devices_index;
8165     int fds[2];
8166     int tb_size;
8167     const char *pid_file = NULL;
8168     VLANState *vlan;
8169
8170     LIST_INIT (&vm_change_state_head);
8171 #ifndef _WIN32
8172     {
8173         struct sigaction act;
8174         sigfillset(&act.sa_mask);
8175         act.sa_flags = 0;
8176         act.sa_handler = SIG_IGN;
8177         sigaction(SIGPIPE, &act, NULL);
8178     }
8179 #else
8180     SetConsoleCtrlHandler(qemu_ctrl_handler, TRUE);
8181     /* Note: cpu_interrupt() is currently not SMP safe, so we force
8182        QEMU to run on a single CPU */
8183     {
8184         HANDLE h;
8185         DWORD mask, smask;
8186         int i;
8187         h = GetCurrentProcess();
8188         if (GetProcessAffinityMask(h, &mask, &smask)) {
8189             for(i = 0; i < 32; i++) {
8190                 if (mask & (1 << i))
8191                     break;
8192             }
8193             if (i != 32) {
8194                 mask = 1 << i;
8195                 SetProcessAffinityMask(h, mask);
8196             }
8197         }
8198     }
8199 #endif
8200
8201     register_machines();
8202     machine = first_machine;
8203     cpu_model = NULL;
8204     initrd_filename = NULL;
8205     ram_size = 0;
8206     vga_ram_size = VGA_RAM_SIZE;
8207 #ifdef CONFIG_GDBSTUB
8208     use_gdbstub = 0;
8209     gdbstub_port = DEFAULT_GDBSTUB_PORT;
8210 #endif
8211     snapshot = 0;
8212     nographic = 0;
8213     curses = 0;
8214     kernel_filename = NULL;
8215     kernel_cmdline = "";
8216     cyls = heads = secs = 0;
8217     translation = BIOS_ATA_TRANSLATION_AUTO;
8218     monitor_device = "vc";
8219
8220     serial_devices[0] = "vc:80Cx24C";
8221     for(i = 1; i < MAX_SERIAL_PORTS; i++)
8222         serial_devices[i] = NULL;
8223     serial_device_index = 0;
8224
8225     parallel_devices[0] = "vc:640x480";
8226     for(i = 1; i < MAX_PARALLEL_PORTS; i++)
8227         parallel_devices[i] = NULL;
8228     parallel_device_index = 0;
8229
8230     usb_devices_index = 0;
8231
8232     nb_net_clients = 0;
8233     nb_drives = 0;
8234     nb_drives_opt = 0;
8235     hda_index = -1;
8236
8237     nb_nics = 0;
8238
8239     tb_size = 0;
8240
8241     optind = 1;
8242     for(;;) {
8243         if (optind >= argc)
8244             break;
8245         r = argv[optind];
8246         if (r[0] != '-') {
8247             hda_index = drive_add(argv[optind++], HD_ALIAS, 0);
8248         } else {
8249             const QEMUOption *popt;
8250
8251             optind++;
8252             /* Treat --foo the same as -foo.  */
8253             if (r[1] == '-')
8254                 r++;
8255             popt = qemu_options;
8256             for(;;) {
8257                 if (!popt->name) {
8258                     fprintf(stderr, "%s: invalid option -- '%s'\n",
8259                             argv[0], r);
8260                     exit(1);
8261                 }
8262                 if (!strcmp(popt->name, r + 1))
8263                     break;
8264                 popt++;
8265             }
8266             if (popt->flags & HAS_ARG) {
8267                 if (optind >= argc) {
8268                     fprintf(stderr, "%s: option '%s' requires an argument\n",
8269                             argv[0], r);
8270                     exit(1);
8271                 }
8272                 optarg = argv[optind++];
8273             } else {
8274                 optarg = NULL;
8275             }
8276
8277             switch(popt->index) {
8278             case QEMU_OPTION_M:
8279                 machine = find_machine(optarg);
8280                 if (!machine) {
8281                     QEMUMachine *m;
8282                     printf("Supported machines are:\n");
8283                     for(m = first_machine; m != NULL; m = m->next) {
8284                         printf("%-10s %s%s\n",
8285                                m->name, m->desc,
8286                                m == first_machine ? " (default)" : "");
8287                     }
8288                     exit(*optarg != '?');
8289                 }
8290                 break;
8291             case QEMU_OPTION_cpu:
8292                 /* hw initialization will check this */
8293                 if (*optarg == '?') {
8294 /* XXX: implement xxx_cpu_list for targets that still miss it */
8295 #if defined(cpu_list)
8296                     cpu_list(stdout, &fprintf);
8297 #endif
8298                     exit(0);
8299                 } else {
8300                     cpu_model = optarg;
8301                 }
8302                 break;
8303             case QEMU_OPTION_initrd:
8304                 initrd_filename = optarg;
8305                 break;
8306             case QEMU_OPTION_hda:
8307                 if (cyls == 0)
8308                     hda_index = drive_add(optarg, HD_ALIAS, 0);
8309                 else
8310                     hda_index = drive_add(optarg, HD_ALIAS
8311                              ",cyls=%d,heads=%d,secs=%d%s",
8312                              0, cyls, heads, secs,
8313                              translation == BIOS_ATA_TRANSLATION_LBA ?
8314                                  ",trans=lba" :
8315                              translation == BIOS_ATA_TRANSLATION_NONE ?
8316                                  ",trans=none" : "");
8317                  break;
8318             case QEMU_OPTION_hdb:
8319             case QEMU_OPTION_hdc:
8320             case QEMU_OPTION_hdd:
8321                 drive_add(optarg, HD_ALIAS, popt->index - QEMU_OPTION_hda);
8322                 break;
8323             case QEMU_OPTION_drive:
8324                 drive_add(NULL, "%s", optarg);
8325                 break;
8326             case QEMU_OPTION_mtdblock:
8327                 drive_add(optarg, MTD_ALIAS);
8328                 break;
8329             case QEMU_OPTION_sd:
8330                 drive_add(optarg, SD_ALIAS);
8331                 break;
8332             case QEMU_OPTION_pflash:
8333                 drive_add(optarg, PFLASH_ALIAS);
8334                 break;
8335             case QEMU_OPTION_snapshot:
8336                 snapshot = 1;
8337                 break;
8338             case QEMU_OPTION_hdachs:
8339                 {
8340                     const char *p;
8341                     p = optarg;
8342                     cyls = strtol(p, (char **)&p, 0);
8343                     if (cyls < 1 || cyls > 16383)
8344                         goto chs_fail;
8345                     if (*p != ',')
8346                         goto chs_fail;
8347                     p++;
8348                     heads = strtol(p, (char **)&p, 0);
8349                     if (heads < 1 || heads > 16)
8350                         goto chs_fail;
8351                     if (*p != ',')
8352                         goto chs_fail;
8353                     p++;
8354                     secs = strtol(p, (char **)&p, 0);
8355                     if (secs < 1 || secs > 63)
8356                         goto chs_fail;
8357                     if (*p == ',') {
8358                         p++;
8359                         if (!strcmp(p, "none"))
8360                             translation = BIOS_ATA_TRANSLATION_NONE;
8361                         else if (!strcmp(p, "lba"))
8362                             translation = BIOS_ATA_TRANSLATION_LBA;
8363                         else if (!strcmp(p, "auto"))
8364                             translation = BIOS_ATA_TRANSLATION_AUTO;
8365                         else
8366                             goto chs_fail;
8367                     } else if (*p != '\0') {
8368                     chs_fail:
8369                         fprintf(stderr, "qemu: invalid physical CHS format\n");
8370                         exit(1);
8371                     }
8372                     if (hda_index != -1)
8373                         snprintf(drives_opt[hda_index].opt,
8374                                  sizeof(drives_opt[hda_index].opt),
8375                                  HD_ALIAS ",cyls=%d,heads=%d,secs=%d%s",
8376                                  0, cyls, heads, secs,
8377                                  translation == BIOS_ATA_TRANSLATION_LBA ?
8378                                     ",trans=lba" :
8379                                  translation == BIOS_ATA_TRANSLATION_NONE ?
8380                                      ",trans=none" : "");
8381                 }
8382                 break;
8383             case QEMU_OPTION_nographic:
8384                 serial_devices[0] = "stdio";
8385                 parallel_devices[0] = "null";
8386                 monitor_device = "stdio";
8387                 nographic = 1;
8388                 break;
8389 #ifdef CONFIG_CURSES
8390             case QEMU_OPTION_curses:
8391                 curses = 1;
8392                 break;
8393 #endif
8394             case QEMU_OPTION_portrait:
8395                 graphic_rotate = 1;
8396                 break;
8397             case QEMU_OPTION_kernel:
8398                 kernel_filename = optarg;
8399                 break;
8400             case QEMU_OPTION_append:
8401                 kernel_cmdline = optarg;
8402                 break;
8403             case QEMU_OPTION_cdrom:
8404                 drive_add(optarg, CDROM_ALIAS);
8405                 break;
8406             case QEMU_OPTION_boot:
8407                 boot_devices = optarg;
8408                 /* We just do some generic consistency checks */
8409                 {
8410                     /* Could easily be extended to 64 devices if needed */
8411                     const char *p;
8412
8413                     boot_devices_bitmap = 0;
8414                     for (p = boot_devices; *p != '\0'; p++) {
8415                         /* Allowed boot devices are:
8416                          * a b     : floppy disk drives
8417                          * c ... f : IDE disk drives
8418                          * g ... m : machine implementation dependant drives
8419                          * n ... p : network devices
8420                          * It's up to each machine implementation to check
8421                          * if the given boot devices match the actual hardware
8422                          * implementation and firmware features.
8423                          */
8424                         if (*p < 'a' || *p > 'q') {
8425                             fprintf(stderr, "Invalid boot device '%c'\n", *p);
8426                             exit(1);
8427                         }
8428                         if (boot_devices_bitmap & (1 << (*p - 'a'))) {
8429                             fprintf(stderr,
8430                                     "Boot device '%c' was given twice\n",*p);
8431                             exit(1);
8432                         }
8433                         boot_devices_bitmap |= 1 << (*p - 'a');
8434                     }
8435                 }
8436                 break;
8437             case QEMU_OPTION_fda:
8438             case QEMU_OPTION_fdb:
8439                 drive_add(optarg, FD_ALIAS, popt->index - QEMU_OPTION_fda);
8440                 break;
8441 #ifdef TARGET_I386
8442             case QEMU_OPTION_no_fd_bootchk:
8443                 fd_bootchk = 0;
8444                 break;
8445 #endif
8446             case QEMU_OPTION_net:
8447                 if (nb_net_clients >= MAX_NET_CLIENTS) {
8448                     fprintf(stderr, "qemu: too many network clients\n");
8449                     exit(1);
8450                 }
8451                 net_clients[nb_net_clients] = optarg;
8452                 nb_net_clients++;
8453                 break;
8454 #ifdef CONFIG_SLIRP
8455             case QEMU_OPTION_tftp:
8456                 tftp_prefix = optarg;
8457                 break;
8458             case QEMU_OPTION_bootp:
8459                 bootp_filename = optarg;
8460                 break;
8461 #ifndef _WIN32
8462             case QEMU_OPTION_smb:
8463                 net_slirp_smb(optarg);
8464                 break;
8465 #endif
8466             case QEMU_OPTION_redir:
8467                 net_slirp_redir(optarg);
8468                 break;
8469 #endif
8470 #ifdef HAS_AUDIO
8471             case QEMU_OPTION_audio_help:
8472                 AUD_help ();
8473                 exit (0);
8474                 break;
8475             case QEMU_OPTION_soundhw:
8476                 select_soundhw (optarg);
8477                 break;
8478 #endif
8479             case QEMU_OPTION_h:
8480                 help(0);
8481                 break;
8482             case QEMU_OPTION_m: {
8483                 uint64_t value;
8484                 char *ptr;
8485
8486                 value = strtoul(optarg, &ptr, 10);
8487                 switch (*ptr) {
8488                 case 0: case 'M': case 'm':
8489                     value <<= 20;
8490                     break;
8491                 case 'G': case 'g':
8492                     value <<= 30;
8493                     break;
8494                 default:
8495                     fprintf(stderr, "qemu: invalid ram size: %s\n", optarg);
8496                     exit(1);
8497                 }
8498
8499                 /* On 32-bit hosts, QEMU is limited by virtual address space */
8500                 if (value > (2047 << 20)
8501 #ifndef USE_KQEMU
8502                     && HOST_LONG_BITS == 32
8503 #endif
8504                     ) {
8505                     fprintf(stderr, "qemu: at most 2047 MB RAM can be simulated\n");
8506                     exit(1);
8507                 }
8508                 if (value != (uint64_t)(ram_addr_t)value) {
8509                     fprintf(stderr, "qemu: ram size too large\n");
8510                     exit(1);
8511                 }
8512                 ram_size = value;
8513                 break;
8514             }
8515             case QEMU_OPTION_d:
8516                 {
8517                     int mask;
8518                     CPULogItem *item;
8519
8520                     mask = cpu_str_to_log_mask(optarg);
8521                     if (!mask) {
8522                         printf("Log items (comma separated):\n");
8523                     for(item = cpu_log_items; item->mask != 0; item++) {
8524                         printf("%-10s %s\n", item->name, item->help);
8525                     }
8526                     exit(1);
8527                     }
8528                     cpu_set_log(mask);
8529                 }
8530                 break;
8531 #ifdef CONFIG_GDBSTUB
8532             case QEMU_OPTION_s:
8533                 use_gdbstub = 1;
8534                 break;
8535             case QEMU_OPTION_p:
8536                 gdbstub_port = optarg;
8537                 break;
8538 #endif
8539             case QEMU_OPTION_L:
8540                 bios_dir = optarg;
8541                 break;
8542             case QEMU_OPTION_bios:
8543                 bios_name = optarg;
8544                 break;
8545             case QEMU_OPTION_S:
8546                 autostart = 0;
8547                 break;
8548             case QEMU_OPTION_k:
8549                 keyboard_layout = optarg;
8550                 break;
8551             case QEMU_OPTION_localtime:
8552                 rtc_utc = 0;
8553                 break;
8554             case QEMU_OPTION_cirrusvga:
8555                 cirrus_vga_enabled = 1;
8556                 vmsvga_enabled = 0;
8557                 break;
8558             case QEMU_OPTION_vmsvga:
8559                 cirrus_vga_enabled = 0;
8560                 vmsvga_enabled = 1;
8561                 break;
8562             case QEMU_OPTION_std_vga:
8563                 cirrus_vga_enabled = 0;
8564                 vmsvga_enabled = 0;
8565                 break;
8566             case QEMU_OPTION_g:
8567                 {
8568                     const char *p;
8569                     int w, h, depth;
8570                     p = optarg;
8571                     w = strtol(p, (char **)&p, 10);
8572                     if (w <= 0) {
8573                     graphic_error:
8574                         fprintf(stderr, "qemu: invalid resolution or depth\n");
8575                         exit(1);
8576                     }
8577                     if (*p != 'x')
8578                         goto graphic_error;
8579                     p++;
8580                     h = strtol(p, (char **)&p, 10);
8581                     if (h <= 0)
8582                         goto graphic_error;
8583                     if (*p == 'x') {
8584                         p++;
8585                         depth = strtol(p, (char **)&p, 10);
8586                         if (depth != 8 && depth != 15 && depth != 16 &&
8587                             depth != 24 && depth != 32)
8588                             goto graphic_error;
8589                     } else if (*p == '\0') {
8590                         depth = graphic_depth;
8591                     } else {
8592                         goto graphic_error;
8593                     }
8594
8595                     graphic_width = w;
8596                     graphic_height = h;
8597                     graphic_depth = depth;
8598                 }
8599                 break;
8600             case QEMU_OPTION_echr:
8601                 {
8602                     char *r;
8603                     term_escape_char = strtol(optarg, &r, 0);
8604                     if (r == optarg)
8605                         printf("Bad argument to echr\n");
8606                     break;
8607                 }
8608             case QEMU_OPTION_monitor:
8609                 monitor_device = optarg;
8610                 break;
8611             case QEMU_OPTION_serial:
8612                 if (serial_device_index >= MAX_SERIAL_PORTS) {
8613                     fprintf(stderr, "qemu: too many serial ports\n");
8614                     exit(1);
8615                 }
8616                 serial_devices[serial_device_index] = optarg;
8617                 serial_device_index++;
8618                 break;
8619             case QEMU_OPTION_parallel:
8620                 if (parallel_device_index >= MAX_PARALLEL_PORTS) {
8621                     fprintf(stderr, "qemu: too many parallel ports\n");
8622                     exit(1);
8623                 }
8624                 parallel_devices[parallel_device_index] = optarg;
8625                 parallel_device_index++;
8626                 break;
8627             case QEMU_OPTION_loadvm:
8628                 loadvm = optarg;
8629                 break;
8630             case QEMU_OPTION_full_screen:
8631                 full_screen = 1;
8632                 break;
8633 #ifdef CONFIG_SDL
8634             case QEMU_OPTION_no_frame:
8635                 no_frame = 1;
8636                 break;
8637             case QEMU_OPTION_alt_grab:
8638                 alt_grab = 1;
8639                 break;
8640             case QEMU_OPTION_no_quit:
8641                 no_quit = 1;
8642                 break;
8643 #endif
8644             case QEMU_OPTION_pidfile:
8645                 pid_file = optarg;
8646                 break;
8647 #ifdef TARGET_I386
8648             case QEMU_OPTION_win2k_hack:
8649                 win2k_install_hack = 1;
8650                 break;
8651 #endif
8652 #ifdef USE_KQEMU
8653             case QEMU_OPTION_no_kqemu:
8654                 kqemu_allowed = 0;
8655                 break;
8656             case QEMU_OPTION_kernel_kqemu:
8657                 kqemu_allowed = 2;
8658                 break;
8659 #endif
8660             case QEMU_OPTION_usb:
8661                 usb_enabled = 1;
8662                 break;
8663             case QEMU_OPTION_usbdevice:
8664                 usb_enabled = 1;
8665                 if (usb_devices_index >= MAX_USB_CMDLINE) {
8666                     fprintf(stderr, "Too many USB devices\n");
8667                     exit(1);
8668                 }
8669                 usb_devices[usb_devices_index] = optarg;
8670                 usb_devices_index++;
8671                 break;
8672             case QEMU_OPTION_smp:
8673                 smp_cpus = atoi(optarg);
8674                 if (smp_cpus < 1 || smp_cpus > MAX_CPUS) {
8675                     fprintf(stderr, "Invalid number of CPUs\n");
8676                     exit(1);
8677                 }
8678                 break;
8679             case QEMU_OPTION_vnc:
8680                 vnc_display = optarg;
8681                 break;
8682             case QEMU_OPTION_no_acpi:
8683                 acpi_enabled = 0;
8684                 break;
8685             case QEMU_OPTION_no_reboot:
8686                 no_reboot = 1;
8687                 break;
8688             case QEMU_OPTION_no_shutdown:
8689                 no_shutdown = 1;
8690                 break;
8691             case QEMU_OPTION_show_cursor:
8692                 cursor_hide = 0;
8693                 break;
8694             case QEMU_OPTION_daemonize:
8695                 daemonize = 1;
8696                 break;
8697             case QEMU_OPTION_option_rom:
8698                 if (nb_option_roms >= MAX_OPTION_ROMS) {
8699                     fprintf(stderr, "Too many option ROMs\n");
8700                     exit(1);
8701                 }
8702                 option_rom[nb_option_roms] = optarg;
8703                 nb_option_roms++;
8704                 break;
8705             case QEMU_OPTION_semihosting:
8706                 semihosting_enabled = 1;
8707                 break;
8708             case QEMU_OPTION_name:
8709                 qemu_name = optarg;
8710                 break;
8711 #ifdef TARGET_SPARC
8712             case QEMU_OPTION_prom_env:
8713                 if (nb_prom_envs >= MAX_PROM_ENVS) {
8714                     fprintf(stderr, "Too many prom variables\n");
8715                     exit(1);
8716                 }
8717                 prom_envs[nb_prom_envs] = optarg;
8718                 nb_prom_envs++;
8719                 break;
8720 #endif
8721 #ifdef TARGET_ARM
8722             case QEMU_OPTION_old_param:
8723                 old_param = 1;
8724                 break;
8725 #endif
8726             case QEMU_OPTION_clock:
8727                 configure_alarms(optarg);
8728                 break;
8729             case QEMU_OPTION_startdate:
8730                 {
8731                     struct tm tm;
8732                     time_t rtc_start_date;
8733                     if (!strcmp(optarg, "now")) {
8734                         rtc_date_offset = -1;
8735                     } else {
8736                         if (sscanf(optarg, "%d-%d-%dT%d:%d:%d",
8737                                &tm.tm_year,
8738                                &tm.tm_mon,
8739                                &tm.tm_mday,
8740                                &tm.tm_hour,
8741                                &tm.tm_min,
8742                                &tm.tm_sec) == 6) {
8743                             /* OK */
8744                         } else if (sscanf(optarg, "%d-%d-%d",
8745                                           &tm.tm_year,
8746                                           &tm.tm_mon,
8747                                           &tm.tm_mday) == 3) {
8748                             tm.tm_hour = 0;
8749                             tm.tm_min = 0;
8750                             tm.tm_sec = 0;
8751                         } else {
8752                             goto date_fail;
8753                         }
8754                         tm.tm_year -= 1900;
8755                         tm.tm_mon--;
8756                         rtc_start_date = mktimegm(&tm);
8757                         if (rtc_start_date == -1) {
8758                         date_fail:
8759                             fprintf(stderr, "Invalid date format. Valid format are:\n"
8760                                     "'now' or '2006-06-17T16:01:21' or '2006-06-17'\n");
8761                             exit(1);
8762                         }
8763                         rtc_date_offset = time(NULL) - rtc_start_date;
8764                     }
8765                 }
8766                 break;
8767             case QEMU_OPTION_tb_size:
8768                 tb_size = strtol(optarg, NULL, 0);
8769                 if (tb_size < 0)
8770                     tb_size = 0;
8771                 break;
8772             case QEMU_OPTION_icount:
8773                 use_icount = 1;
8774                 if (strcmp(optarg, "auto") == 0) {
8775                     icount_time_shift = -1;
8776                 } else {
8777                     icount_time_shift = strtol(optarg, NULL, 0);
8778                 }
8779                 break;
8780             }
8781         }
8782     }
8783
8784 #ifndef _WIN32
8785     if (daemonize) {
8786         pid_t pid;
8787
8788         if (pipe(fds) == -1)
8789             exit(1);
8790
8791         pid = fork();
8792         if (pid > 0) {
8793             uint8_t status;
8794             ssize_t len;
8795
8796             close(fds[1]);
8797
8798         again:
8799             len = read(fds[0], &status, 1);
8800             if (len == -1 && (errno == EINTR))
8801                 goto again;
8802
8803             if (len != 1)
8804                 exit(1);
8805             else if (status == 1) {
8806                 fprintf(stderr, "Could not acquire pidfile\n");
8807                 exit(1);
8808             } else
8809                 exit(0);
8810         } else if (pid < 0)
8811             exit(1);
8812
8813         setsid();
8814
8815         pid = fork();
8816         if (pid > 0)
8817             exit(0);
8818         else if (pid < 0)
8819             exit(1);
8820
8821         umask(027);
8822
8823         signal(SIGTSTP, SIG_IGN);
8824         signal(SIGTTOU, SIG_IGN);
8825         signal(SIGTTIN, SIG_IGN);
8826     }
8827 #endif
8828
8829     if (pid_file && qemu_create_pidfile(pid_file) != 0) {
8830         if (daemonize) {
8831             uint8_t status = 1;
8832             write(fds[1], &status, 1);
8833         } else
8834             fprintf(stderr, "Could not acquire pid file\n");
8835         exit(1);
8836     }
8837
8838 #ifdef USE_KQEMU
8839     if (smp_cpus > 1)
8840         kqemu_allowed = 0;
8841 #endif
8842     linux_boot = (kernel_filename != NULL);
8843     net_boot = (boot_devices_bitmap >> ('n' - 'a')) & 0xF;
8844
8845     /* XXX: this should not be: some embedded targets just have flash */
8846     if (!linux_boot && net_boot == 0 &&
8847         nb_drives_opt == 0)
8848         help(1);
8849
8850     if (!linux_boot && *kernel_cmdline != '\0') {
8851         fprintf(stderr, "-append only allowed with -kernel option\n");
8852         exit(1);
8853     }
8854
8855     if (!linux_boot && initrd_filename != NULL) {
8856         fprintf(stderr, "-initrd only allowed with -kernel option\n");
8857         exit(1);
8858     }
8859
8860     /* boot to floppy or the default cd if no hard disk defined yet */
8861     if (!boot_devices[0]) {
8862         boot_devices = "cad";
8863     }
8864     setvbuf(stdout, NULL, _IOLBF, 0);
8865
8866     init_timers();
8867     init_timer_alarm();
8868     qemu_aio_init();
8869     if (use_icount && icount_time_shift < 0) {
8870         use_icount = 2;
8871         /* 125MIPS seems a reasonable initial guess at the guest speed.
8872            It will be corrected fairly quickly anyway.  */
8873         icount_time_shift = 3;
8874         init_icount_adjust();
8875     }
8876
8877 #ifdef _WIN32
8878     socket_init();
8879 #endif
8880
8881     /* init network clients */
8882     if (nb_net_clients == 0) {
8883         /* if no clients, we use a default config */
8884         net_clients[0] = "nic";
8885         net_clients[1] = "user";
8886         nb_net_clients = 2;
8887     }
8888
8889     for(i = 0;i < nb_net_clients; i++) {
8890         if (net_client_init(net_clients[i]) < 0)
8891             exit(1);
8892     }
8893     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
8894         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
8895             continue;
8896         if (vlan->nb_guest_devs == 0) {
8897             fprintf(stderr, "Invalid vlan (%d) with no nics\n", vlan->id);
8898             exit(1);
8899         }
8900         if (vlan->nb_host_devs == 0)
8901             fprintf(stderr,
8902                     "Warning: vlan %d is not connected to host network\n",
8903                     vlan->id);
8904     }
8905
8906 #ifdef TARGET_I386
8907     /* XXX: this should be moved in the PC machine instantiation code */
8908     if (net_boot != 0) {
8909         int netroms = 0;
8910         for (i = 0; i < nb_nics && i < 4; i++) {
8911             const char *model = nd_table[i].model;
8912             char buf[1024];
8913             if (net_boot & (1 << i)) {
8914                 if (model == NULL)
8915                     model = "ne2k_pci";
8916                 snprintf(buf, sizeof(buf), "%s/pxe-%s.bin", bios_dir, model);
8917                 if (get_image_size(buf) > 0) {
8918                     if (nb_option_roms >= MAX_OPTION_ROMS) {
8919                         fprintf(stderr, "Too many option ROMs\n");
8920                         exit(1);
8921                     }
8922                     option_rom[nb_option_roms] = strdup(buf);
8923                     nb_option_roms++;
8924                     netroms++;
8925                 }
8926             }
8927         }
8928         if (netroms == 0) {
8929             fprintf(stderr, "No valid PXE rom found for network device\n");
8930             exit(1);
8931         }
8932     }
8933 #endif
8934
8935     /* init the memory */
8936     phys_ram_size = machine->ram_require & ~RAMSIZE_FIXED;
8937
8938     if (machine->ram_require & RAMSIZE_FIXED) {
8939         if (ram_size > 0) {
8940             if (ram_size < phys_ram_size) {
8941                 fprintf(stderr, "Machine `%s' requires %llu bytes of memory\n",
8942                                 machine->name, (unsigned long long) phys_ram_size);
8943                 exit(-1);
8944             }
8945
8946             phys_ram_size = ram_size;
8947         } else
8948             ram_size = phys_ram_size;
8949     } else {
8950         if (ram_size == 0)
8951             ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
8952
8953         phys_ram_size += ram_size;
8954     }
8955
8956     phys_ram_base = qemu_vmalloc(phys_ram_size);
8957     if (!phys_ram_base) {
8958         fprintf(stderr, "Could not allocate physical memory\n");
8959         exit(1);
8960     }
8961
8962     /* init the dynamic translator */
8963     cpu_exec_init_all(tb_size * 1024 * 1024);
8964
8965     bdrv_init();
8966
8967     /* we always create the cdrom drive, even if no disk is there */
8968
8969     if (nb_drives_opt < MAX_DRIVES)
8970         drive_add(NULL, CDROM_ALIAS);
8971
8972     /* we always create at least one floppy */
8973
8974     if (nb_drives_opt < MAX_DRIVES)
8975         drive_add(NULL, FD_ALIAS, 0);
8976
8977     /* we always create one sd slot, even if no card is in it */
8978
8979     if (nb_drives_opt < MAX_DRIVES)
8980         drive_add(NULL, SD_ALIAS);
8981
8982     /* open the virtual block devices */
8983
8984     for(i = 0; i < nb_drives_opt; i++)
8985         if (drive_init(&drives_opt[i], snapshot, machine) == -1)
8986             exit(1);
8987
8988     register_savevm("timer", 0, 2, timer_save, timer_load, NULL);
8989     register_savevm("ram", 0, 2, ram_save, ram_load, NULL);
8990
8991     /* terminal init */
8992     memset(&display_state, 0, sizeof(display_state));
8993     if (nographic) {
8994         if (curses) {
8995             fprintf(stderr, "fatal: -nographic can't be used with -curses\n");
8996             exit(1);
8997         }
8998         /* nearly nothing to do */
8999         dumb_display_init(ds);
9000     } else if (vnc_display != NULL) {
9001         vnc_display_init(ds);
9002         if (vnc_display_open(ds, vnc_display) < 0)
9003             exit(1);
9004     } else
9005 #if defined(CONFIG_CURSES)
9006     if (curses) {
9007         curses_display_init(ds, full_screen);
9008     } else
9009 #endif
9010     {
9011 #if defined(CONFIG_SDL)
9012         sdl_display_init(ds, full_screen, no_frame);
9013 #elif defined(CONFIG_COCOA)
9014         cocoa_display_init(ds, full_screen);
9015 #else
9016         dumb_display_init(ds);
9017 #endif
9018     }
9019
9020     /* Maintain compatibility with multiple stdio monitors */
9021     if (!strcmp(monitor_device,"stdio")) {
9022         for (i = 0; i < MAX_SERIAL_PORTS; i++) {
9023             const char *devname = serial_devices[i];
9024             if (devname && !strcmp(devname,"mon:stdio")) {
9025                 monitor_device = NULL;
9026                 break;
9027             } else if (devname && !strcmp(devname,"stdio")) {
9028                 monitor_device = NULL;
9029                 serial_devices[i] = "mon:stdio";
9030                 break;
9031             }
9032         }
9033     }
9034     if (monitor_device) {
9035         monitor_hd = qemu_chr_open(monitor_device);
9036         if (!monitor_hd) {
9037             fprintf(stderr, "qemu: could not open monitor device '%s'\n", monitor_device);
9038             exit(1);
9039         }
9040         monitor_init(monitor_hd, !nographic);
9041     }
9042
9043     for(i = 0; i < MAX_SERIAL_PORTS; i++) {
9044         const char *devname = serial_devices[i];
9045         if (devname && strcmp(devname, "none")) {
9046             serial_hds[i] = qemu_chr_open(devname);
9047             if (!serial_hds[i]) {
9048                 fprintf(stderr, "qemu: could not open serial device '%s'\n",
9049                         devname);
9050                 exit(1);
9051             }
9052             if (strstart(devname, "vc", 0))
9053                 qemu_chr_printf(serial_hds[i], "serial%d console\r\n", i);
9054         }
9055     }
9056
9057     for(i = 0; i < MAX_PARALLEL_PORTS; i++) {
9058         const char *devname = parallel_devices[i];
9059         if (devname && strcmp(devname, "none")) {
9060             parallel_hds[i] = qemu_chr_open(devname);
9061             if (!parallel_hds[i]) {
9062                 fprintf(stderr, "qemu: could not open parallel device '%s'\n",
9063                         devname);
9064                 exit(1);
9065             }
9066             if (strstart(devname, "vc", 0))
9067                 qemu_chr_printf(parallel_hds[i], "parallel%d console\r\n", i);
9068         }
9069     }
9070
9071     machine->init(ram_size, vga_ram_size, boot_devices, ds,
9072                   kernel_filename, kernel_cmdline, initrd_filename, cpu_model);
9073
9074     /* init USB devices */
9075     if (usb_enabled) {
9076         for(i = 0; i < usb_devices_index; i++) {
9077             if (usb_device_add(usb_devices[i]) < 0) {
9078                 fprintf(stderr, "Warning: could not add USB device %s\n",
9079                         usb_devices[i]);
9080             }
9081         }
9082     }
9083
9084     if (display_state.dpy_refresh) {
9085         display_state.gui_timer = qemu_new_timer(rt_clock, gui_update, &display_state);
9086         qemu_mod_timer(display_state.gui_timer, qemu_get_clock(rt_clock));
9087     }
9088
9089 #ifdef CONFIG_GDBSTUB
9090     if (use_gdbstub) {
9091         /* XXX: use standard host:port notation and modify options
9092            accordingly. */
9093         if (gdbserver_start(gdbstub_port) < 0) {
9094             fprintf(stderr, "qemu: could not open gdbstub device on port '%s'\n",
9095                     gdbstub_port);
9096             exit(1);
9097         }
9098     }
9099 #endif
9100
9101     if (loadvm)
9102         do_loadvm(loadvm);
9103
9104     {
9105         /* XXX: simplify init */
9106         read_passwords();
9107         if (autostart) {
9108             vm_start();
9109         }
9110     }
9111
9112     if (daemonize) {
9113         uint8_t status = 0;
9114         ssize_t len;
9115         int fd;
9116
9117     again1:
9118         len = write(fds[1], &status, 1);
9119         if (len == -1 && (errno == EINTR))
9120             goto again1;
9121
9122         if (len != 1)
9123             exit(1);
9124
9125         chdir("/");
9126         TFR(fd = open("/dev/null", O_RDWR));
9127         if (fd == -1)
9128             exit(1);
9129
9130         dup2(fd, 0);
9131         dup2(fd, 1);
9132         dup2(fd, 2);
9133
9134         close(fd);
9135     }
9136
9137     main_loop();
9138     quit_timers();
9139
9140 #if !defined(_WIN32)
9141     /* close network clients */
9142     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
9143         VLANClientState *vc;
9144
9145         for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
9146             if (vc->fd_read == tap_receive) {
9147                 char ifname[64];
9148                 TAPState *s = vc->opaque;
9149
9150                 if (sscanf(vc->info_str, "tap: ifname=%63s ", ifname) == 1 &&
9151                     s->down_script[0])
9152                     launch_script(s->down_script, ifname, s->fd);
9153             }
9154 #if defined(CONFIG_VDE)
9155             if (vc->fd_read == vde_from_qemu) {
9156                 VDEState *s = vc->opaque;
9157                 vde_close(s->vde);
9158             }
9159 #endif
9160         }
9161     }
9162 #endif
9163     return 0;
9164 }