net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for HOST_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include <linux/if_tun.h>
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef HOST_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #ifdef _WIN32
 105 #include <windows.h>
 106 #include <malloc.h>
 107 #include <sys/timeb.h>
 108 #include <mmsystem.h>
 109 #define getopt_long_only getopt_long
 110 #define memalign(align, size) malloc(size)
 111 #endif
 112
 113 // FIXME: #include "qemu-kvm.h"
 114 #include "qemu-common.h"
 115 #include "net.h"
 116 #include "monitor.h"
 117 #include "sysemu.h"
 118 #include "qemu-timer.h"
 119 #include "qemu-char.h"
 120 #include "audio/audio.h"
 121 #include "qemu_socket.h"
 122 #include "qemu-log.h"
 123
 124 #include "slirp/libslirp.h"
 125
 126
 127 static VLANState *first_vlan;
 128
 129 /***********************************************************/
 130 /* network device redirectors */
 131
 132 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 133 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 134 {
 135     int len, i, j, c;
 136
 137     for(i=0;i<size;i+=16) {
 138         len = size - i;
 139         if (len > 16)
 140             len = 16;
 141         fprintf(f, "%08x ", i);
 142         for(j=0;j<16;j++) {
 143             if (j < len)
 144                 fprintf(f, " %02x", buf[i+j]);
 145             else
 146                 fprintf(f, "   ");
 147         }
 148         fprintf(f, " ");
 149         for(j=0;j<len;j++) {
 150             c = buf[i+j];
 151             if (c < ' ' || c > '~')
 152                 c = '.';
 153             fprintf(f, "%c", c);
 154         }
 155         fprintf(f, "\n");
 156     }
 157 }
 158 #endif
 159
 160 static int parse_macaddr(uint8_t *macaddr, const char *p)
 161 {
 162     int i;
 163     char *last_char;
 164     long int offset;
 165
 166     errno = 0;
 167     offset = strtol(p, &last_char, 0);
 168     if (0 == errno && '\0' == *last_char &&
 169             offset >= 0 && offset <= 0xFFFFFF) {
 170         macaddr[3] = (offset & 0xFF0000) >> 16;
 171         macaddr[4] = (offset & 0xFF00) >> 8;
 172         macaddr[5] = offset & 0xFF;
 173         return 0;
 174     } else {
 175         for(i = 0; i < 6; i++) {
 176             macaddr[i] = strtol(p, (char **)&p, 16);
 177             if (i == 5) {
 178                 if (*p != '\0')
 179                     return -1;
 180             } else {
 181                 if (*p != ':' && *p != '-')
 182                     return -1;
 183                 p++;
 184             }
 185         }
 186         return 0;
 187     }
 188
 189     return -1;
 190 }
 191
 192 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 193 {
 194     const char *p, *p1;
 195     int len;
 196     p = *pp;
 197     p1 = strchr(p, sep);
 198     if (!p1)
 199         return -1;
 200     len = p1 - p;
 201     p1++;
 202     if (buf_size > 0) {
 203         if (len > buf_size - 1)
 204             len = buf_size - 1;
 205         memcpy(buf, p, len);
 206         buf[len] = '\0';
 207     }
 208     *pp = p1;
 209     return 0;
 210 }
 211
 212 int parse_host_src_port(struct sockaddr_in *haddr,
 213                         struct sockaddr_in *saddr,
 214                         const char *input_str)
 215 {
 216     char *str = strdup(input_str);
 217     char *host_str = str;
 218     char *src_str;
 219     const char *src_str2;
 220     char *ptr;
 221
 222     /*
 223      * Chop off any extra arguments at the end of the string which
 224      * would start with a comma, then fill in the src port information
 225      * if it was provided else use the "any address" and "any port".
 226      */
 227     if ((ptr = strchr(str,',')))
 228         *ptr = '\0';
 229
 230     if ((src_str = strchr(input_str,'@'))) {
 231         *src_str = '\0';
 232         src_str++;
 233     }
 234
 235     if (parse_host_port(haddr, host_str) < 0)
 236         goto fail;
 237
 238     src_str2 = src_str;
 239     if (!src_str || *src_str == '\0')
 240         src_str2 = ":0";
 241
 242     if (parse_host_port(saddr, src_str2) < 0)
 243         goto fail;
 244
 245     free(str);
 246     return(0);
 247
 248 fail:
 249     free(str);
 250     return -1;
 251 }
 252
 253 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 254 {
 255     char buf[512];
 256     struct hostent *he;
 257     const char *p, *r;
 258     int port;
 259
 260     p = str;
 261     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 262         return -1;
 263     saddr->sin_family = AF_INET;
 264     if (buf[0] == '\0') {
 265         saddr->sin_addr.s_addr = 0;
 266     } else {
 267         if (qemu_isdigit(buf[0])) {
 268             if (!inet_aton(buf, &saddr->sin_addr))
 269                 return -1;
 270         } else {
 271             if ((he = gethostbyname(buf)) == NULL)
 272                 return - 1;
 273             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 274         }
 275     }
 276     port = strtol(p, (char **)&r, 0);
 277     if (r == p)
 278         return -1;
 279     saddr->sin_port = htons(port);
 280     return 0;
 281 }
 282
 283 #if !defined(_WIN32) && 0
 284 static int parse_unix_path(struct sockaddr_un *uaddr, const char *str)
 285 {
 286     const char *p;
 287     int len;
 288
 289     len = MIN(108, strlen(str));
 290     p = strchr(str, ',');
 291     if (p)
 292         len = MIN(len, p - str);
 293
 294     memset(uaddr, 0, sizeof(*uaddr));
 295
 296     uaddr->sun_family = AF_UNIX;
 297     memcpy(uaddr->sun_path, str, len);
 298
 299     return 0;
 300 }
 301 #endif
 302
 303 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 304 {
 305     snprintf(vc->info_str, sizeof(vc->info_str),
 306              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 307              vc->model,
 308              macaddr[0], macaddr[1], macaddr[2],
 309              macaddr[3], macaddr[4], macaddr[5]);
 310 }
 311
 312 static char *assign_name(VLANClientState *vc1, const char *model)
 313 {
 314     VLANState *vlan;
 315     char buf[256];
 316     int id = 0;
 317
 318     for (vlan = first_vlan; vlan; vlan = vlan->next) {
 319         VLANClientState *vc;
 320
 321         for (vc = vlan->first_client; vc; vc = vc->next)
 322             if (vc != vc1 && strcmp(vc->model, model) == 0)
 323                 id++;
 324     }
 325
 326     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 327
 328     return strdup(buf);
 329 }
 330
 331 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 332                                       const char *model,
 333                                       const char *name,
 334                                       NetCanReceive *can_receive,
 335                                       NetReceive *receive,
 336                                       NetReceiveIOV *receive_iov,
 337                                       NetCleanup *cleanup,
 338                                       void *opaque)
 339 {
 340     VLANClientState *vc, **pvc;
 341     vc = qemu_mallocz(sizeof(VLANClientState));
 342     vc->model = strdup(model);
 343     if (name)
 344         vc->name = strdup(name);
 345     else
 346         vc->name = assign_name(vc, model);
 347     vc->can_receive = can_receive;
 348     vc->receive = receive;
 349     vc->receive_iov = receive_iov;
 350     vc->cleanup = cleanup;
 351     vc->opaque = opaque;
 352     vc->vlan = vlan;
 353
 354     vc->next = NULL;
 355     pvc = &vlan->first_client;
 356     while (*pvc != NULL)
 357         pvc = &(*pvc)->next;
 358     *pvc = vc;
 359     return vc;
 360 }
 361
 362 void qemu_del_vlan_client(VLANClientState *vc)
 363 {
 364     VLANClientState **pvc = &vc->vlan->first_client;
 365
 366     while (*pvc != NULL)
 367         if (*pvc == vc) {
 368             *pvc = vc->next;
 369             if (vc->cleanup) {
 370                 vc->cleanup(vc);
 371             }
 372             free(vc->name);
 373             free(vc->model);
 374             qemu_free(vc);
 375             break;
 376         } else
 377             pvc = &(*pvc)->next;
 378 }
 379
 380 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 381 {
 382     VLANClientState **pvc = &vlan->first_client;
 383
 384     while (*pvc != NULL)
 385         if ((*pvc)->opaque == opaque)
 386             return *pvc;
 387         else
 388             pvc = &(*pvc)->next;
 389
 390     return NULL;
 391 }
 392
 393 static VLANClientState *
 394 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 395                               const char *client_str)
 396 {
 397     VLANState *vlan;
 398     VLANClientState *vc;
 399
 400     vlan = qemu_find_vlan(vlan_id, 0);
 401     if (!vlan) {
 402         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 403         return NULL;
 404     }
 405
 406     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 407         if (!strcmp(vc->name, client_str)) {
 408             break;
 409         }
 410     }
 411     if (!vc) {
 412         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 413                        client_str, vlan_id);
 414     }
 415
 416     return vc;
 417 }
 418
 419 int qemu_can_send_packet(VLANClientState *sender)
 420 {
 421     VLANState *vlan = sender->vlan;
 422     VLANClientState *vc;
 423
 424     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 425         if (vc == sender) {
 426             continue;
 427         }
 428
 429         /* no can_receive() handler, they can always receive */
 430         if (!vc->can_receive || vc->can_receive(vc)) {
 431             return 1;
 432         }
 433     }
 434     return 0;
 435 }
 436
 437 static int
 438 qemu_deliver_packet(VLANClientState *sender, const uint8_t *buf, int size, int raw)
 439 {
 440     VLANClientState *vc;
 441     int ret = -1;
 442
 443     sender->vlan->delivering = 1;
 444
 445     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 446         ssize_t len;
 447
 448         if (vc == sender) {
 449             continue;
 450         }
 451
 452         if (vc->link_down) {
 453             ret = size;
 454             continue;
 455         }
 456
 457         if (raw && vc->receive_raw) {
 458             len = vc->receive_raw(vc, buf, size);
 459         } else {
 460             len = vc->receive(vc, buf, size);
 461         }
 462
 463         ret = (ret >= 0) ? ret : len;
 464     }
 465
 466     sender->vlan->delivering = 0;
 467
 468     return ret;
 469 }
 470
 471 void qemu_purge_queued_packets(VLANClientState *vc)
 472 {
 473     VLANPacket *packet, *next;
 474
 475     TAILQ_FOREACH_SAFE(packet, &vc->vlan->send_queue, entry, next) {
 476         if (packet->sender == vc) {
 477             TAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 478             qemu_free(packet);
 479         }
 480     }
 481 }
 482
 483 void qemu_flush_queued_packets(VLANClientState *vc)
 484 {
 485     while (!TAILQ_EMPTY(&vc->vlan->send_queue)) {
 486         VLANPacket *packet;
 487         int ret;
 488
 489         packet = TAILQ_FIRST(&vc->vlan->send_queue);
 490         TAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 491
 492         ret = qemu_deliver_packet(packet->sender, packet->data,
 493                                   packet->size, packet->raw);
 494         if (ret == 0 && packet->sent_cb != NULL) {
 495             TAILQ_INSERT_HEAD(&vc->vlan->send_queue, packet, entry);
 496             break;
 497         }
 498
 499         if (packet->sent_cb)
 500             packet->sent_cb(packet->sender, ret);
 501
 502         qemu_free(packet);
 503     }
 504 }
 505
 506 static void qemu_enqueue_packet(VLANClientState *sender,
 507                                 const uint8_t *buf, int size, int raw,
 508                                 NetPacketSent *sent_cb)
 509 {
 510     VLANPacket *packet;
 511
 512     packet = qemu_malloc(sizeof(VLANPacket) + size);
 513     packet->sender = sender;
 514     packet->size = size;
 515     packet->raw = raw;
 516     packet->sent_cb = sent_cb;
 517     memcpy(packet->data, buf, size);
 518
 519     TAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 520 }
 521
 522 static ssize_t qemu_send_packet_async2(VLANClientState *sender,
 523                                        const uint8_t *buf, int size, int raw,
 524                                        NetPacketSent *sent_cb)
 525 {
 526     int ret;
 527
 528     if (sender->link_down) {
 529         return size;
 530     }
 531
 532 #ifdef DEBUG_NET
 533     printf("vlan %d send:\n", sender->vlan->id);
 534     hex_dump(stdout, buf, size);
 535 #endif
 536
 537     if (sender->vlan->delivering) {
 538         qemu_enqueue_packet(sender, buf, size, raw, NULL);
 539         return size;
 540     }
 541
 542     ret = qemu_deliver_packet(sender, buf, size, raw);
 543     if (ret == 0 && sent_cb != NULL) {
 544         qemu_enqueue_packet(sender, buf, size, raw, sent_cb);
 545         return 0;
 546     }
 547
 548     qemu_flush_queued_packets(sender);
 549
 550     return ret;
 551 }
 552
 553 ssize_t qemu_send_packet_async(VLANClientState *sender,
 554                                const uint8_t *buf, int size,
 555                                NetPacketSent *sent_cb)
 556 {
 557     return qemu_send_packet_async2(sender, buf, size, 0, sent_cb);
 558 }
 559
 560 ssize_t qemu_send_packet(VLANClientState *sender, const uint8_t *buf, int size)
 561 {
 562     return qemu_send_packet_async2(sender, buf, size, 0, NULL);
 563 }
 564
 565 ssize_t qemu_send_packet_raw(VLANClientState *sender, const uint8_t *buf, int size)
 566 {
 567     return qemu_send_packet_async2(sender, buf, size, 1, NULL);
 568 }
 569
 570 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 571                                int iovcnt)
 572 {
 573     uint8_t buffer[4096];
 574     size_t offset = 0;
 575     int i;
 576
 577     for (i = 0; i < iovcnt; i++) {
 578         size_t len;
 579
 580         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 581         memcpy(buffer + offset, iov[i].iov_base, len);
 582         offset += len;
 583     }
 584
 585     return vc->receive(vc, buffer, offset);
 586 }
 587
 588 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 589 {
 590     size_t offset = 0;
 591     int i;
 592
 593     for (i = 0; i < iovcnt; i++)
 594         offset += iov[i].iov_len;
 595     return offset;
 596 }
 597
 598 static int qemu_deliver_packet_iov(VLANClientState *sender,
 599                                    const struct iovec *iov, int iovcnt)
 600 {
 601     VLANClientState *vc;
 602     int ret = -1;
 603
 604     sender->vlan->delivering = 1;
 605
 606     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 607         ssize_t len;
 608
 609         if (vc == sender) {
 610             continue;
 611         }
 612
 613         if (vc->link_down) {
 614             ret = calc_iov_length(iov, iovcnt);
 615             continue;
 616         }
 617
 618         if (vc->receive_iov) {
 619             len = vc->receive_iov(vc, iov, iovcnt);
 620         } else {
 621             len = vc_sendv_compat(vc, iov, iovcnt);
 622         }
 623
 624         ret = (ret >= 0) ? ret : len;
 625     }
 626
 627     sender->vlan->delivering = 0;
 628
 629     return ret;
 630 }
 631
 632 static ssize_t qemu_enqueue_packet_iov(VLANClientState *sender,
 633                                        const struct iovec *iov, int iovcnt,
 634                                        NetPacketSent *sent_cb)
 635 {
 636     VLANPacket *packet;
 637     size_t max_len = 0;
 638     int i;
 639
 640     max_len = calc_iov_length(iov, iovcnt);
 641
 642     packet = qemu_malloc(sizeof(VLANPacket) + max_len);
 643     packet->sender = sender;
 644     packet->sent_cb = sent_cb;
 645     packet->size = 0;
 646     packet->raw = 0;
 647
 648     for (i = 0; i < iovcnt; i++) {
 649         size_t len = iov[i].iov_len;
 650
 651         memcpy(packet->data + packet->size, iov[i].iov_base, len);
 652         packet->size += len;
 653     }
 654
 655     TAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 656
 657     return packet->size;
 658 }
 659
 660 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 661                                 const struct iovec *iov, int iovcnt,
 662                                 NetPacketSent *sent_cb)
 663 {
 664     int ret;
 665
 666     if (sender->link_down) {
 667         return calc_iov_length(iov, iovcnt);
 668     }
 669
 670     if (sender->vlan->delivering) {
 671         return qemu_enqueue_packet_iov(sender, iov, iovcnt, NULL);
 672     }
 673
 674     ret = qemu_deliver_packet_iov(sender, iov, iovcnt);
 675     if (ret == 0 && sent_cb != NULL) {
 676         qemu_enqueue_packet_iov(sender, iov, iovcnt, sent_cb);
 677         return 0;
 678     }
 679
 680     qemu_flush_queued_packets(sender);
 681
 682     return ret;
 683 }
 684
 685 ssize_t
 686 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 687 {
 688     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 689 }
 690
 691 static void config_error(Monitor *mon, const char *fmt, ...)
 692 {
 693     va_list ap;
 694
 695     va_start(ap, fmt);
 696     if (mon) {
 697         monitor_vprintf(mon, fmt, ap);
 698     } else {
 699         fprintf(stderr, "qemu: ");
 700         vfprintf(stderr, fmt, ap);
 701         exit(1);
 702     }
 703     va_end(ap);
 704 }
 705
 706 #if defined(CONFIG_SLIRP)
 707
 708 /* slirp network adapter */
 709
 710 #define SLIRP_CFG_HOSTFWD 1
 711 #define SLIRP_CFG_LEGACY  2
 712
 713 struct slirp_config_str {
 714     struct slirp_config_str *next;
 715     int flags;
 716     char str[1024];
 717     int legacy_format;
 718 };
 719
 720 typedef struct SlirpState {
 721     TAILQ_ENTRY(SlirpState) entry;
 722     VLANClientState *vc;
 723     Slirp *slirp;
 724 #ifndef _WIN32
 725     char smb_dir[128];
 726 #endif
 727 } SlirpState;
 728
 729 static struct slirp_config_str *slirp_configs;
 730 const char *legacy_tftp_prefix;
 731 const char *legacy_bootp_filename;
 732 static TAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 733     TAILQ_HEAD_INITIALIZER(slirp_stacks);
 734
 735 static void slirp_hostfwd(SlirpState *s, Monitor *mon, const char *redir_str,
 736                           int legacy_format);
 737 static void slirp_guestfwd(SlirpState *s, Monitor *mon, const char *config_str,
 738                            int legacy_format);
 739
 740 #ifndef _WIN32
 741 static const char *legacy_smb_export;
 742
 743 static void slirp_smb(SlirpState *s, Monitor *mon, const char *exported_dir,
 744                       struct in_addr vserver_addr);
 745 static void slirp_smb_cleanup(SlirpState *s);
 746 #else
 747 static inline void slirp_smb_cleanup(SlirpState *s) { }
 748 #endif
 749
 750 int slirp_can_output(void *opaque)
 751 {
 752     SlirpState *s = opaque;
 753
 754     return qemu_can_send_packet(s->vc);
 755 }
 756
 757 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 758 {
 759     SlirpState *s = opaque;
 760
 761 #ifdef DEBUG_SLIRP
 762     printf("slirp output:\n");
 763     hex_dump(stdout, pkt, pkt_len);
 764 #endif
 765     qemu_send_packet(s->vc, pkt, pkt_len);
 766 }
 767
 768 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 769 {
 770     SlirpState *s = vc->opaque;
 771
 772 #ifdef DEBUG_SLIRP
 773     printf("slirp input:\n");
 774     hex_dump(stdout, buf, size);
 775 #endif
 776     slirp_input(s->slirp, buf, size);
 777     return size;
 778 }
 779
 780 static void net_slirp_cleanup(VLANClientState *vc)
 781 {
 782     SlirpState *s = vc->opaque;
 783
 784     slirp_cleanup(s->slirp);
 785     slirp_smb_cleanup(s);
 786     TAILQ_REMOVE(&slirp_stacks, s, entry);
 787     qemu_free(s);
 788 }
 789
 790 static int net_slirp_init(Monitor *mon, VLANState *vlan, const char *model,
 791                           const char *name, int restricted,
 792                           const char *vnetwork, const char *vhost,
 793                           const char *vhostname, const char *tftp_export,
 794                           const char *bootfile, const char *vdhcp_start,
 795                           const char *vnameserver, const char *smb_export,
 796                           const char *vsmbserver)
 797 {
 798     /* default settings according to historic slirp */
 799     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 800     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 801     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 802     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 803     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 804 #ifndef _WIN32
 805     struct in_addr smbsrv = { .s_addr = 0 };
 806 #endif
 807     SlirpState *s;
 808     char buf[20];
 809     uint32_t addr;
 810     int shift;
 811     char *end;
 812
 813     if (!tftp_export) {
 814         tftp_export = legacy_tftp_prefix;
 815     }
 816     if (!bootfile) {
 817         bootfile = legacy_bootp_filename;
 818     }
 819
 820     if (vnetwork) {
 821         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 822             if (!inet_aton(vnetwork, &net)) {
 823                 return -1;
 824             }
 825             addr = ntohl(net.s_addr);
 826             if (!(addr & 0x80000000)) {
 827                 mask.s_addr = htonl(0xff000000); /* class A */
 828             } else if ((addr & 0xfff00000) == 0xac100000) {
 829                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 830             } else if ((addr & 0xc0000000) == 0x80000000) {
 831                 mask.s_addr = htonl(0xffff0000); /* class B */
 832             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 833                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 834             } else if ((addr & 0xffff0000) == 0xc6120000) {
 835                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 836             } else if ((addr & 0xe0000000) == 0xe0000000) {
 837                 mask.s_addr = htonl(0xffffff00); /* class C */
 838             } else {
 839                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 840             }
 841         } else {
 842             if (!inet_aton(buf, &net)) {
 843                 return -1;
 844             }
 845             shift = strtol(vnetwork, &end, 10);
 846             if (*end != '\0') {
 847                 if (!inet_aton(vnetwork, &mask)) {
 848                     return -1;
 849                 }
 850             } else if (shift < 4 || shift > 32) {
 851                 return -1;
 852             } else {
 853                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 854             }
 855         }
 856         net.s_addr &= mask.s_addr;
 857         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 858         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 859         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 860     }
 861
 862     if (vhost && !inet_aton(vhost, &host)) {
 863         return -1;
 864     }
 865     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 866         return -1;
 867     }
 868
 869     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 870         return -1;
 871     }
 872     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 873         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 874         return -1;
 875     }
 876
 877     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 878         return -1;
 879     }
 880     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 881         dns.s_addr == host.s_addr) {
 882         return -1;
 883     }
 884
 885 #ifndef _WIN32
 886     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 887         return -1;
 888     }
 889 #endif
 890
 891     s = qemu_mallocz(sizeof(SlirpState));
 892     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 893                           tftp_export, bootfile, dhcp, dns, s);
 894     TAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 895
 896     while (slirp_configs) {
 897         struct slirp_config_str *config = slirp_configs;
 898
 899         if (config->flags & SLIRP_CFG_HOSTFWD) {
 900             slirp_hostfwd(s, mon, config->str,
 901                           config->flags & SLIRP_CFG_LEGACY);
 902         } else {
 903             slirp_guestfwd(s, mon, config->str,
 904                            config->flags & SLIRP_CFG_LEGACY);
 905         }
 906         slirp_configs = config->next;
 907         qemu_free(config);
 908     }
 909 #ifndef _WIN32
 910     if (!smb_export) {
 911         smb_export = legacy_smb_export;
 912     }
 913     if (smb_export) {
 914         slirp_smb(s, mon, smb_export, smbsrv);
 915     }
 916 #endif
 917
 918     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive, NULL,
 919                                  net_slirp_cleanup, s);
 920     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 921              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 922     return 0;
 923 }
 924
 925 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 926                                 const char *stack)
 927 {
 928     VLANClientState *vc;
 929
 930     if (vlan) {
 931         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 932         if (!vc) {
 933             return NULL;
 934         }
 935         if (strcmp(vc->model, "user")) {
 936             monitor_printf(mon, "invalid device specified\n");
 937             return NULL;
 938         }
 939         return vc->opaque;
 940     } else {
 941         if (TAILQ_EMPTY(&slirp_stacks)) {
 942             monitor_printf(mon, "user mode network stack not in use\n");
 943             return NULL;
 944         }
 945         return TAILQ_FIRST(&slirp_stacks);
 946     }
 947 }
 948
 949 void net_slirp_hostfwd_remove(Monitor *mon, const char *arg1,
 950                               const char *arg2, const char *arg3)
 951 {
 952     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 953     int host_port;
 954     char buf[256] = "";
 955     const char *src_str, *p;
 956     SlirpState *s;
 957     int is_udp = 0;
 958     int err;
 959
 960     if (arg2) {
 961         s = slirp_lookup(mon, arg1, arg2);
 962         src_str = arg3;
 963     } else {
 964         s = slirp_lookup(mon, NULL, NULL);
 965         src_str = arg1;
 966     }
 967     if (!s) {
 968         return;
 969     }
 970
 971     if (!src_str || !src_str[0])
 972         goto fail_syntax;
 973
 974     p = src_str;
 975     get_str_sep(buf, sizeof(buf), &p, ':');
 976
 977     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 978         is_udp = 0;
 979     } else if (!strcmp(buf, "udp")) {
 980         is_udp = 1;
 981     } else {
 982         goto fail_syntax;
 983     }
 984
 985     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 986         goto fail_syntax;
 987     }
 988     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 989         goto fail_syntax;
 990     }
 991
 992     host_port = atoi(p);
 993
 994     err = slirp_remove_hostfwd(TAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 995                                host_addr, host_port);
 996
 997     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 998                    err ? "removed" : "not found");
 999     return;
1000
1001  fail_syntax:
1002     monitor_printf(mon, "invalid format\n");
1003 }
1004
1005 static void slirp_hostfwd(SlirpState *s, Monitor *mon, const char *redir_str,
1006                           int legacy_format)
1007 {
1008     struct in_addr host_addr = { .s_addr = INADDR_ANY };
1009     struct in_addr guest_addr = { .s_addr = 0 };
1010     int host_port, guest_port;
1011     const char *p;
1012     char buf[256];
1013     int is_udp;
1014     char *end;
1015
1016     p = redir_str;
1017     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1018         goto fail_syntax;
1019     }
1020     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
1021         is_udp = 0;
1022     } else if (!strcmp(buf, "udp")) {
1023         is_udp = 1;
1024     } else {
1025         goto fail_syntax;
1026     }
1027
1028     if (!legacy_format) {
1029         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1030             goto fail_syntax;
1031         }
1032         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
1033             goto fail_syntax;
1034         }
1035     }
1036
1037     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
1038         goto fail_syntax;
1039     }
1040     host_port = strtol(buf, &end, 0);
1041     if (*end != '\0' || host_port < 1 || host_port > 65535) {
1042         goto fail_syntax;
1043     }
1044
1045     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1046         goto fail_syntax;
1047     }
1048     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
1049         goto fail_syntax;
1050     }
1051
1052     guest_port = strtol(p, &end, 0);
1053     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
1054         goto fail_syntax;
1055     }
1056
1057     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
1058                           guest_port) < 0) {
1059         config_error(mon, "could not set up host forwarding rule '%s'\n",
1060                      redir_str);
1061     }
1062     return;
1063
1064  fail_syntax:
1065     config_error(mon, "invalid host forwarding rule '%s'\n", redir_str);
1066 }
1067
1068 void net_slirp_hostfwd_add(Monitor *mon, const char *arg1,
1069                            const char *arg2, const char *arg3)
1070 {
1071     const char *redir_str;
1072     SlirpState *s;
1073
1074     if (arg2) {
1075         s = slirp_lookup(mon, arg1, arg2);
1076         redir_str = arg3;
1077     } else {
1078         s = slirp_lookup(mon, NULL, NULL);
1079         redir_str = arg1;
1080     }
1081     if (s) {
1082         slirp_hostfwd(s, mon, redir_str, 0);
1083     }
1084
1085 }
1086
1087 void net_slirp_redir(const char *redir_str)
1088 {
1089     struct slirp_config_str *config;
1090
1091     if (TAILQ_EMPTY(&slirp_stacks)) {
1092         config = qemu_malloc(sizeof(*config));
1093         pstrcpy(config->str, sizeof(config->str), redir_str);
1094         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1095         config->next = slirp_configs;
1096         slirp_configs = config;
1097         return;
1098     }
1099
1100     slirp_hostfwd(TAILQ_FIRST(&slirp_stacks), NULL, redir_str, 1);
1101 }
1102
1103 #ifndef _WIN32
1104
1105 /* automatic user mode samba server configuration */
1106 static void slirp_smb_cleanup(SlirpState *s)
1107 {
1108     char cmd[128];
1109
1110     if (s->smb_dir[0] != '\0') {
1111         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1112         system(cmd);
1113         s->smb_dir[0] = '\0';
1114     }
1115 }
1116
1117 static void slirp_smb(SlirpState* s, Monitor *mon, const char *exported_dir,
1118                       struct in_addr vserver_addr)
1119 {
1120     static int instance;
1121     char smb_conf[128];
1122     char smb_cmdline[128];
1123     FILE *f;
1124
1125     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1126              (long)getpid(), instance++);
1127     if (mkdir(s->smb_dir, 0700) < 0) {
1128         config_error(mon, "could not create samba server dir '%s'\n",
1129                      s->smb_dir);
1130         return;
1131     }
1132     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1133
1134     f = fopen(smb_conf, "w");
1135     if (!f) {
1136         slirp_smb_cleanup(s);
1137         config_error(mon, "could not create samba server "
1138                      "configuration file '%s'\n", smb_conf);
1139         return;
1140     }
1141     fprintf(f,
1142             "[global]\n"
1143             "private dir=%s\n"
1144             "smb ports=0\n"
1145             "socket address=127.0.0.1\n"
1146             "pid directory=%s\n"
1147             "lock directory=%s\n"
1148             "log file=%s/log.smbd\n"
1149             "smb passwd file=%s/smbpasswd\n"
1150             "security = share\n"
1151             "[qemu]\n"
1152             "path=%s\n"
1153             "read only=no\n"
1154             "guest ok=yes\n",
1155             s->smb_dir,
1156             s->smb_dir,
1157             s->smb_dir,
1158             s->smb_dir,
1159             s->smb_dir,
1160             exported_dir
1161             );
1162     fclose(f);
1163
1164     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1165              SMBD_COMMAND, smb_conf);
1166
1167     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1168         slirp_smb_cleanup(s);
1169         config_error(mon, "conflicting/invalid smbserver address\n");
1170     }
1171 }
1172
1173 /* automatic user mode samba server configuration (legacy interface) */
1174 void net_slirp_smb(const char *exported_dir)
1175 {
1176     struct in_addr vserver_addr = { .s_addr = 0 };
1177
1178     if (legacy_smb_export) {
1179         fprintf(stderr, "-smb given twice\n");
1180         exit(1);
1181     }
1182     legacy_smb_export = exported_dir;
1183     if (!TAILQ_EMPTY(&slirp_stacks)) {
1184         slirp_smb(TAILQ_FIRST(&slirp_stacks), NULL, exported_dir,
1185                   vserver_addr);
1186     }
1187 }
1188
1189 #endif /* !defined(_WIN32) */
1190
1191 struct GuestFwd {
1192     CharDriverState *hd;
1193     struct in_addr server;
1194     int port;
1195     Slirp *slirp;
1196 };
1197
1198 static int guestfwd_can_read(void *opaque)
1199 {
1200     struct GuestFwd *fwd = opaque;
1201     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1202 }
1203
1204 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1205 {
1206     struct GuestFwd *fwd = opaque;
1207     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1208 }
1209
1210 static void slirp_guestfwd(SlirpState *s, Monitor *mon, const char *config_str,
1211                            int legacy_format)
1212 {
1213     struct in_addr server = { .s_addr = 0 };
1214     struct GuestFwd *fwd;
1215     const char *p;
1216     char buf[128];
1217     char *end;
1218     int port;
1219
1220     p = config_str;
1221     if (legacy_format) {
1222         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1223             goto fail_syntax;
1224         }
1225     } else {
1226         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1227             goto fail_syntax;
1228         }
1229         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1230             goto fail_syntax;
1231         }
1232         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1233             goto fail_syntax;
1234         }
1235         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1236             goto fail_syntax;
1237         }
1238         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1239             goto fail_syntax;
1240         }
1241     }
1242     port = strtol(buf, &end, 10);
1243     if (*end != '\0' || port < 1 || port > 65535) {
1244         goto fail_syntax;
1245     }
1246
1247     fwd = qemu_malloc(sizeof(struct GuestFwd));
1248     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1249     fwd->hd = qemu_chr_open(buf, p, NULL);
1250     if (!fwd->hd) {
1251         config_error(mon, "could not open guest forwarding device '%s'\n",
1252                      buf);
1253         qemu_free(fwd);
1254         return;
1255     }
1256
1257     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1258         config_error(mon, "conflicting/invalid host:port in guest forwarding "
1259                      "rule '%s'\n", config_str);
1260         qemu_free(fwd);
1261         return;
1262     }
1263     fwd->server = server;
1264     fwd->port = port;
1265     fwd->slirp = s->slirp;
1266
1267     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1268                           NULL, fwd);
1269     return;
1270
1271  fail_syntax:
1272     config_error(mon, "invalid guest forwarding rule '%s'\n", config_str);
1273 }
1274
1275 void do_info_usernet(Monitor *mon)
1276 {
1277     SlirpState *s;
1278
1279     TAILQ_FOREACH(s, &slirp_stacks, entry) {
1280         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1281         slirp_connection_info(s->slirp, mon);
1282     }
1283 }
1284
1285 #endif /* CONFIG_SLIRP */
1286
1287 #ifdef _WIN32
1288
1289 int tap_has_vnet_hdr(void *opaque)
1290 {
1291     return 0;
1292 }
1293
1294 void tap_using_vnet_hdr(void *opaque, int using_vnet_hdr)
1295 {
1296 }
1297
1298 #else /* !defined(_WIN32) */
1299
1300 /* Maximum GSO packet size (64k) plus plenty of room for
1301  * the ethernet and virtio_net headers
1302  */
1303 #define TAP_BUFSIZE (4096 + 65536)
1304
1305 #ifdef IFF_VNET_HDR
1306 #include <linux/virtio_net.h>
1307 #endif
1308
1309 typedef struct TAPState {
1310     VLANClientState *vc;
1311     int fd;
1312     char down_script[1024];
1313     char down_script_arg[128];
1314     uint8_t buf[TAP_BUFSIZE];
1315     unsigned int read_poll : 1;
1316     unsigned int write_poll : 1;
1317     unsigned int has_vnet_hdr : 1;
1318     unsigned int using_vnet_hdr : 1;
1319 } TAPState;
1320
1321 static int launch_script(const char *setup_script, const char *ifname, int fd);
1322
1323 static int tap_can_send(void *opaque);
1324 static void tap_send(void *opaque);
1325 static void tap_writable(void *opaque);
1326
1327 static void tap_update_fd_handler(TAPState *s)
1328 {
1329     qemu_set_fd_handler2(s->fd,
1330                          s->read_poll  ? tap_can_send : NULL,
1331                          s->read_poll  ? tap_send     : NULL,
1332                          s->write_poll ? tap_writable : NULL,
1333                          s);
1334 }
1335
1336 static void tap_read_poll(TAPState *s, int enable)
1337 {
1338     s->read_poll = !!enable;
1339     tap_update_fd_handler(s);
1340 }
1341
1342 static void tap_write_poll(TAPState *s, int enable)
1343 {
1344     s->write_poll = !!enable;
1345     tap_update_fd_handler(s);
1346 }
1347
1348 static void tap_writable(void *opaque)
1349 {
1350     TAPState *s = opaque;
1351
1352     tap_write_poll(s, 0);
1353
1354     qemu_flush_queued_packets(s->vc);
1355 }
1356
1357 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1358                                int iovcnt)
1359 {
1360     TAPState *s = vc->opaque;
1361     ssize_t len;
1362
1363     do {
1364         len = writev(s->fd, iov, iovcnt);
1365     } while (len == -1 && errno == EINTR);
1366
1367     if (len == -1 && errno == EAGAIN) {
1368         tap_write_poll(s, 1);
1369         return 0;
1370     }
1371
1372     return len;
1373 }
1374
1375 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1376 {
1377     struct iovec iov[2];
1378     int i = 0;
1379
1380 #ifdef IFF_VNET_HDR
1381     TAPState *s = vc->opaque;
1382     struct virtio_net_hdr hdr = { 0, };
1383
1384     if (s->has_vnet_hdr && !s->using_vnet_hdr) {
1385         iov[i].iov_base = &hdr;
1386         iov[i].iov_len  = sizeof(hdr);
1387         i++;
1388     }
1389 #endif
1390
1391     iov[i].iov_base = (char *) buf;
1392     iov[i].iov_len  = size;
1393     i++;
1394
1395     return tap_receive_iov(vc, iov, i);
1396 }
1397
1398 static ssize_t tap_receive_raw(VLANClientState *vc, const uint8_t *buf, size_t size)
1399 {
1400     struct iovec iov[2];
1401     int i = 0;
1402
1403 #ifdef IFF_VNET_HDR
1404     TAPState *s = vc->opaque;
1405     struct virtio_net_hdr hdr = { 0, };
1406
1407     if (s->has_vnet_hdr && s->using_vnet_hdr) {
1408         iov[i].iov_base = &hdr;
1409         iov[i].iov_len  = sizeof(hdr);
1410         i++;
1411     }
1412 #endif
1413
1414     iov[i].iov_base = (char *) buf;
1415     iov[i].iov_len  = size;
1416     i++;
1417
1418     return tap_receive_iov(vc, iov, i);
1419 }
1420
1421 static int tap_can_send(void *opaque)
1422 {
1423     TAPState *s = opaque;
1424
1425     return qemu_can_send_packet(s->vc);
1426 }
1427
1428 #ifdef __sun__
1429 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1430 {
1431     struct strbuf sbuf;
1432     int f = 0;
1433
1434     sbuf.maxlen = maxlen;
1435     sbuf.buf = (char *)buf;
1436
1437     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1438 }
1439 #else
1440 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1441 {
1442     return read(tapfd, buf, maxlen);
1443 }
1444 #endif
1445
1446 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1447 {
1448     TAPState *s = vc->opaque;
1449     tap_read_poll(s, 1);
1450 }
1451
1452 static void tap_send(void *opaque)
1453 {
1454     TAPState *s = opaque;
1455     int size;
1456     uint8_t *buf = s->buf;
1457
1458     size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1459     if (size <= 0) {
1460         return;
1461     }
1462
1463 #ifdef IFF_VNET_HDR
1464     if (s->has_vnet_hdr && !s->using_vnet_hdr) {
1465         buf += sizeof(struct virtio_net_hdr);
1466         size -= sizeof(struct virtio_net_hdr);
1467     }
1468 #endif
1469
1470     size = qemu_send_packet_async(s->vc, buf, size, tap_send_completed);
1471     if (size == 0) {
1472         tap_read_poll(s, 0);
1473     }
1474 }
1475
1476 #ifdef TUNSETSNDBUF
1477 /* sndbuf should be set to a value lower than the tx queue
1478  * capacity of any destination network interface.
1479  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1480  * a good default, given a 1500 byte MTU.
1481  */
1482 #define TAP_DEFAULT_SNDBUF 1024*1024
1483
1484 static void tap_set_sndbuf(TAPState *s, const char *sndbuf_str, Monitor *mon)
1485 {
1486     int sndbuf = TAP_DEFAULT_SNDBUF;
1487
1488     if (sndbuf_str) {
1489         sndbuf = atoi(sndbuf_str);
1490     }
1491
1492     if (!sndbuf) {
1493         sndbuf = INT_MAX;
1494     }
1495
1496     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && sndbuf_str) {
1497         config_error(mon, "TUNSETSNDBUF ioctl failed: %s\n",
1498                      strerror(errno));
1499     }
1500 }
1501 #else
1502 static void tap_set_sndbuf(TAPState *s, const char *sndbuf_str, Monitor *mon)
1503 {
1504     if (sndbuf_str) {
1505         config_error(mon, "No '-net tap,sndbuf=<nbytes>' support available\n");
1506     }
1507 }
1508 #endif /* TUNSETSNDBUF */
1509
1510 int tap_has_vnet_hdr(void *opaque)
1511 {
1512     VLANClientState *vc = opaque;
1513     TAPState *s = vc->opaque;
1514
1515     if (vc->receive != tap_receive)
1516         return 0;
1517
1518     return s ? s->has_vnet_hdr : 0;
1519 }
1520
1521 void tap_using_vnet_hdr(void *opaque, int using_vnet_hdr)
1522 {
1523     VLANClientState *vc = opaque;
1524     TAPState *s = vc->opaque;
1525
1526     if (vc->receive != tap_receive)
1527         return;
1528
1529     if (!s || !s->has_vnet_hdr)
1530         return;
1531
1532     s->using_vnet_hdr = using_vnet_hdr != 0;
1533 }
1534
1535 static int tap_probe_vnet_hdr(int fd)
1536 {
1537 #if defined(TUNGETIFF) && defined(IFF_VNET_HDR)
1538     struct ifreq ifr;
1539
1540     if (ioctl(fd, TUNGETIFF, &ifr) != 0) {
1541         fprintf(stderr, "TUNGETIFF ioctl() failed: %s\n", strerror(errno));
1542         return 0;
1543     }
1544
1545     return ifr.ifr_flags & IFF_VNET_HDR;
1546 #else
1547     return 0;
1548 #endif
1549 }
1550
1551 #ifdef TUNSETOFFLOAD
1552 static void tap_set_offload(VLANClientState *vc, int csum, int tso4, int tso6,
1553                             int ecn)
1554 {
1555     TAPState *s = vc->opaque;
1556     unsigned int offload = 0;
1557
1558     if (csum) {
1559         offload |= TUN_F_CSUM;
1560         if (tso4)
1561             offload |= TUN_F_TSO4;
1562         if (tso6)
1563             offload |= TUN_F_TSO6;
1564         if ((tso4 || tso6) && ecn)
1565             offload |= TUN_F_TSO_ECN;
1566     }
1567
1568     if (ioctl(s->fd, TUNSETOFFLOAD, offload) != 0)
1569         fprintf(stderr, "TUNSETOFFLOAD ioctl() failed: %s\n",
1570                 strerror(errno));
1571 }
1572 #endif /* TUNSETOFFLOAD */
1573
1574 static void tap_cleanup(VLANClientState *vc)
1575 {
1576     TAPState *s = vc->opaque;
1577
1578     qemu_purge_queued_packets(vc);
1579
1580     if (s->down_script[0])
1581         launch_script(s->down_script, s->down_script_arg, s->fd);
1582
1583     tap_read_poll(s, 0);
1584     tap_write_poll(s, 0);
1585     close(s->fd);
1586     qemu_free(s);
1587 }
1588
1589 /* fd support */
1590
1591 static TAPState *net_tap_fd_init(VLANState *vlan,
1592                                  const char *model,
1593                                  const char *name,
1594                                  int fd,
1595                                  int vnet_hdr)
1596 {
1597     TAPState *s;
1598
1599     s = qemu_mallocz(sizeof(TAPState));
1600     s->fd = fd;
1601     s->has_vnet_hdr = vnet_hdr != 0;
1602     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
1603                                  tap_receive_iov, tap_cleanup, s);
1604     s->vc->receive_raw = tap_receive_raw;
1605 #ifdef TUNSETOFFLOAD
1606     s->vc->set_offload = tap_set_offload;
1607     tap_set_offload(s->vc, 0, 0, 0, 0);
1608 #endif
1609     tap_read_poll(s, 1);
1610     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
1611     return s;
1612 }
1613
1614 #if defined (HOST_BSD) || defined (__FreeBSD_kernel__)
1615 static int tap_open(char *ifname, int ifname_size)
1616 {
1617     int fd;
1618     char *dev;
1619     struct stat s;
1620
1621     TFR(fd = open("/dev/tap", O_RDWR));
1622     if (fd < 0) {
1623         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1624         return -1;
1625     }
1626
1627     fstat(fd, &s);
1628     dev = devname(s.st_rdev, S_IFCHR);
1629     pstrcpy(ifname, ifname_size, dev);
1630
1631     fcntl(fd, F_SETFL, O_NONBLOCK);
1632     return fd;
1633 }
1634 #elif defined(__sun__)
1635 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1636 /*
1637  * Allocate TAP device, returns opened fd.
1638  * Stores dev name in the first arg(must be large enough).
1639  */
1640 static int tap_alloc(char *dev, size_t dev_size)
1641 {
1642     int tap_fd, if_fd, ppa = -1;
1643     static int ip_fd = 0;
1644     char *ptr;
1645
1646     static int arp_fd = 0;
1647     int ip_muxid, arp_muxid;
1648     struct strioctl  strioc_if, strioc_ppa;
1649     int link_type = I_PLINK;;
1650     struct lifreq ifr;
1651     char actual_name[32] = "";
1652
1653     memset(&ifr, 0x0, sizeof(ifr));
1654
1655     if( *dev ){
1656        ptr = dev;
1657        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1658        ppa = atoi(ptr);
1659     }
1660
1661     /* Check if IP device was opened */
1662     if( ip_fd )
1663        close(ip_fd);
1664
1665     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1666     if (ip_fd < 0) {
1667        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1668        return -1;
1669     }
1670
1671     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1672     if (tap_fd < 0) {
1673        syslog(LOG_ERR, "Can't open /dev/tap");
1674        return -1;
1675     }
1676
1677     /* Assign a new PPA and get its unit number. */
1678     strioc_ppa.ic_cmd = TUNNEWPPA;
1679     strioc_ppa.ic_timout = 0;
1680     strioc_ppa.ic_len = sizeof(ppa);
1681     strioc_ppa.ic_dp = (char *)&ppa;
1682     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1683        syslog (LOG_ERR, "Can't assign new interface");
1684
1685     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1686     if (if_fd < 0) {
1687        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1688        return -1;
1689     }
1690     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1691        syslog(LOG_ERR, "Can't push IP module");
1692        return -1;
1693     }
1694
1695     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1696         syslog(LOG_ERR, "Can't get flags\n");
1697
1698     snprintf (actual_name, 32, "tap%d", ppa);
1699     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1700
1701     ifr.lifr_ppa = ppa;
1702     /* Assign ppa according to the unit number returned by tun device */
1703
1704     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1705         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1706     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1707         syslog (LOG_ERR, "Can't get flags\n");
1708     /* Push arp module to if_fd */
1709     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1710         syslog (LOG_ERR, "Can't push ARP module (2)");
1711
1712     /* Push arp module to ip_fd */
1713     if (ioctl (ip_fd, I_POP, NULL) < 0)
1714         syslog (LOG_ERR, "I_POP failed\n");
1715     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1716         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1717     /* Open arp_fd */
1718     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1719     if (arp_fd < 0)
1720        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1721
1722     /* Set ifname to arp */
1723     strioc_if.ic_cmd = SIOCSLIFNAME;
1724     strioc_if.ic_timout = 0;
1725     strioc_if.ic_len = sizeof(ifr);
1726     strioc_if.ic_dp = (char *)&ifr;
1727     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1728         syslog (LOG_ERR, "Can't set ifname to arp\n");
1729     }
1730
1731     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1732        syslog(LOG_ERR, "Can't link TAP device to IP");
1733        return -1;
1734     }
1735
1736     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1737         syslog (LOG_ERR, "Can't link TAP device to ARP");
1738
1739     close (if_fd);
1740
1741     memset(&ifr, 0x0, sizeof(ifr));
1742     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1743     ifr.lifr_ip_muxid  = ip_muxid;
1744     ifr.lifr_arp_muxid = arp_muxid;
1745
1746     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1747     {
1748       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1749       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1750       syslog (LOG_ERR, "Can't set multiplexor id");
1751     }
1752
1753     snprintf(dev, dev_size, "tap%d", ppa);
1754     return tap_fd;
1755 }
1756
1757 static int tap_open(char *ifname, int ifname_size, int *vnet_hdr)
1758 {
1759     char  dev[10]="";
1760     int fd;
1761     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1762        fprintf(stderr, "Cannot allocate TAP device\n");
1763        return -1;
1764     }
1765     pstrcpy(ifname, ifname_size, dev);
1766     fcntl(fd, F_SETFL, O_NONBLOCK);
1767     return fd;
1768 }
1769 #elif defined (_AIX)
1770 static int tap_open(char *ifname, int ifname_size)
1771 {
1772     fprintf (stderr, "no tap on AIX\n");
1773     return -1;
1774 }
1775 #else
1776 static int tap_open(char *ifname, int ifname_size, int *vnet_hdr)
1777 {
1778     struct ifreq ifr;
1779     int fd, ret;
1780
1781     TFR(fd = open("/dev/net/tun", O_RDWR));
1782     if (fd < 0) {
1783         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1784         return -1;
1785     }
1786     memset(&ifr, 0, sizeof(ifr));
1787     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1788
1789 #if defined(TUNGETFEATURES) && defined(IFF_VNET_HDR)
1790     {
1791         unsigned int features;
1792
1793         if (ioctl(fd, TUNGETFEATURES, &features) == 0 &&
1794             features & IFF_VNET_HDR) {
1795             *vnet_hdr = 1;
1796             ifr.ifr_flags |= IFF_VNET_HDR;
1797         }
1798     }
1799 #endif
1800
1801     if (ifname[0] != '\0')
1802         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1803     else
1804         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1805     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1806     if (ret != 0) {
1807         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1808         close(fd);
1809         return -1;
1810     }
1811     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1812     fcntl(fd, F_SETFL, O_NONBLOCK);
1813     return fd;
1814 }
1815 #endif
1816
1817 static int launch_script(const char *setup_script, const char *ifname, int fd)
1818 {
1819     sigset_t oldmask, mask;
1820     int pid, status;
1821     char *args[3];
1822     char **parg;
1823
1824     sigemptyset(&mask);
1825     sigaddset(&mask, SIGCHLD);
1826     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1827
1828     /* try to launch network script */
1829     pid = fork();
1830     if (pid == 0) {
1831         int open_max = sysconf(_SC_OPEN_MAX), i;
1832
1833         for (i = 0; i < open_max; i++) {
1834             if (i != STDIN_FILENO &&
1835                 i != STDOUT_FILENO &&
1836                 i != STDERR_FILENO &&
1837                 i != fd) {
1838                 close(i);
1839             }
1840         }
1841         parg = args;
1842         *parg++ = (char *)setup_script;
1843         *parg++ = (char *)ifname;
1844         *parg++ = NULL;
1845         execv(setup_script, args);
1846         _exit(1);
1847     } else if (pid > 0) {
1848         while (waitpid(pid, &status, 0) != pid) {
1849             /* loop */
1850         }
1851         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1852
1853         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1854             return 0;
1855         }
1856     }
1857     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1858     return -1;
1859 }
1860
1861 static TAPState *net_tap_init(VLANState *vlan, const char *model,
1862                               const char *name, const char *ifname1,
1863                               const char *setup_script, const char *down_script)
1864 {
1865     TAPState *s;
1866     int fd;
1867     int vnet_hdr;
1868     char ifname[128];
1869
1870     if (ifname1 != NULL)
1871         pstrcpy(ifname, sizeof(ifname), ifname1);
1872     else
1873         ifname[0] = '\0';
1874     vnet_hdr = 0;
1875     TFR(fd = tap_open(ifname, sizeof(ifname), &vnet_hdr));
1876     if (fd < 0)
1877         return NULL;
1878
1879     if (!setup_script || !strcmp(setup_script, "no"))
1880         setup_script = "";
1881     if (setup_script[0] != '\0' &&
1882         launch_script(setup_script, ifname, fd)) {
1883         return NULL;
1884     }
1885     s = net_tap_fd_init(vlan, model, name, fd, vnet_hdr);
1886     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1887              "ifname=%s,script=%s,downscript=%s",
1888              ifname, setup_script, down_script);
1889     if (down_script && strcmp(down_script, "no")) {
1890         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
1891         snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
1892     }
1893     return s;
1894 }
1895
1896 #endif /* !_WIN32 */
1897
1898 #if defined(CONFIG_VDE)
1899 typedef struct VDEState {
1900     VLANClientState *vc;
1901     VDECONN *vde;
1902 } VDEState;
1903
1904 static void vde_to_qemu(void *opaque)
1905 {
1906     VDEState *s = opaque;
1907     uint8_t buf[4096];
1908     int size;
1909
1910     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1911     if (size > 0) {
1912         qemu_send_packet(s->vc, buf, size);
1913     }
1914 }
1915
1916 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1917 {
1918     VDEState *s = vc->opaque;
1919     ssize_t ret;
1920
1921     do {
1922       ret = vde_send(s->vde, (const char *)buf, size, 0);
1923     } while (ret < 0 && errno == EINTR);
1924
1925     return ret;
1926 }
1927
1928 static void vde_cleanup(VLANClientState *vc)
1929 {
1930     VDEState *s = vc->opaque;
1931     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1932     vde_close(s->vde);
1933     qemu_free(s);
1934 }
1935
1936 static int net_vde_init(VLANState *vlan, const char *model,
1937                         const char *name, const char *sock,
1938                         int port, const char *group, int mode)
1939 {
1940     VDEState *s;
1941     char *init_group = strlen(group) ? (char *)group : NULL;
1942     char *init_sock = strlen(sock) ? (char *)sock : NULL;
1943
1944     struct vde_open_args args = {
1945         .port = port,
1946         .group = init_group,
1947         .mode = mode,
1948     };
1949
1950     s = qemu_mallocz(sizeof(VDEState));
1951     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1952     if (!s->vde){
1953         free(s);
1954         return -1;
1955     }
1956     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
1957                                  NULL, vde_cleanup, s);
1958     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1959     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1960              sock, vde_datafd(s->vde));
1961     return 0;
1962 }
1963 #endif
1964
1965 /* network connection */
1966 typedef struct NetSocketState {
1967     VLANClientState *vc;
1968     int fd;
1969     int state; /* 0 = getting length, 1 = getting data */
1970     unsigned int index;
1971     unsigned int packet_len;
1972     uint8_t buf[4096];
1973     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1974 } NetSocketState;
1975
1976 typedef struct NetSocketListenState {
1977     VLANState *vlan;
1978     char *model;
1979     char *name;
1980     int fd;
1981 } NetSocketListenState;
1982
1983 /* XXX: we consider we can send the whole packet without blocking */
1984 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1985 {
1986     NetSocketState *s = vc->opaque;
1987     uint32_t len;
1988     len = htonl(size);
1989
1990     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1991     return send_all(s->fd, buf, size);
1992 }
1993
1994 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1995 {
1996     NetSocketState *s = vc->opaque;
1997
1998     return sendto(s->fd, (const void *)buf, size, 0,
1999                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
2000 }
2001
2002 static void net_socket_send(void *opaque)
2003 {
2004     NetSocketState *s = opaque;
2005     int size, err;
2006     unsigned l;
2007     uint8_t buf1[4096];
2008     const uint8_t *buf;
2009
2010     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
2011     if (size < 0) {
2012         err = socket_error();
2013         if (err != EWOULDBLOCK)
2014             goto eoc;
2015     } else if (size == 0) {
2016         /* end of connection */
2017     eoc:
2018         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
2019         closesocket(s->fd);
2020         return;
2021     }
2022     buf = buf1;
2023     while (size > 0) {
2024         /* reassemble a packet from the network */
2025         switch(s->state) {
2026         case 0:
2027             l = 4 - s->index;
2028             if (l > size)
2029                 l = size;
2030             memcpy(s->buf + s->index, buf, l);
2031             buf += l;
2032             size -= l;
2033             s->index += l;
2034             if (s->index == 4) {
2035                 /* got length */
2036                 s->packet_len = ntohl(*(uint32_t *)s->buf);
2037                 s->index = 0;
2038                 s->state = 1;
2039             }
2040             break;
2041         case 1:
2042             l = s->packet_len - s->index;
2043             if (l > size)
2044                 l = size;
2045             if (s->index + l <= sizeof(s->buf)) {
2046                 memcpy(s->buf + s->index, buf, l);
2047             } else {
2048                 fprintf(stderr, "serious error: oversized packet received,"
2049                     "connection terminated.\n");
2050                 s->state = 0;
2051                 goto eoc;
2052             }
2053
2054             s->index += l;
2055             buf += l;
2056             size -= l;
2057             if (s->index >= s->packet_len) {
2058                 qemu_send_packet(s->vc, s->buf, s->packet_len);
2059                 s->index = 0;
2060                 s->state = 0;
2061             }
2062             break;
2063         }
2064     }
2065 }
2066
2067 static void net_socket_send_dgram(void *opaque)
2068 {
2069     NetSocketState *s = opaque;
2070     int size;
2071
2072     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
2073     if (size < 0)
2074         return;
2075     if (size == 0) {
2076         /* end of connection */
2077         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
2078         return;
2079     }
2080     qemu_send_packet(s->vc, s->buf, size);
2081 }
2082
2083 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
2084 {
2085     struct ip_mreq imr;
2086     int fd;
2087     int val, ret;
2088     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
2089         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
2090                 inet_ntoa(mcastaddr->sin_addr),
2091                 (int)ntohl(mcastaddr->sin_addr.s_addr));
2092         return -1;
2093
2094     }
2095     fd = socket(PF_INET, SOCK_DGRAM, 0);
2096     if (fd < 0) {
2097         perror("socket(PF_INET, SOCK_DGRAM)");
2098         return -1;
2099     }
2100
2101     val = 1;
2102     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
2103                    (const char *)&val, sizeof(val));
2104     if (ret < 0) {
2105         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
2106         goto fail;
2107     }
2108
2109     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
2110     if (ret < 0) {
2111         perror("bind");
2112         goto fail;
2113     }
2114
2115     /* Add host to multicast group */
2116     imr.imr_multiaddr = mcastaddr->sin_addr;
2117     imr.imr_interface.s_addr = htonl(INADDR_ANY);
2118
2119     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
2120                      (const char *)&imr, sizeof(struct ip_mreq));
2121     if (ret < 0) {
2122         perror("setsockopt(IP_ADD_MEMBERSHIP)");
2123         goto fail;
2124     }
2125
2126     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
2127     val = 1;
2128     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
2129                    (const char *)&val, sizeof(val));
2130     if (ret < 0) {
2131         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
2132         goto fail;
2133     }
2134
2135     socket_set_nonblock(fd);
2136     return fd;
2137 fail:
2138     if (fd >= 0)
2139         closesocket(fd);
2140     return -1;
2141 }
2142
2143 static void net_socket_cleanup(VLANClientState *vc)
2144 {
2145     NetSocketState *s = vc->opaque;
2146     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
2147     close(s->fd);
2148     qemu_free(s);
2149 }
2150
2151 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
2152                                                 const char *model,
2153                                                 const char *name,
2154                                                 int fd, int is_connected)
2155 {
2156     struct sockaddr_in saddr;
2157     int newfd;
2158     socklen_t saddr_len;
2159     NetSocketState *s;
2160
2161     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
2162      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
2163      * by ONLY ONE process: we must "clone" this dgram socket --jjo
2164      */
2165
2166     if (is_connected) {
2167         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
2168             /* must be bound */
2169             if (saddr.sin_addr.s_addr==0) {
2170                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
2171                         fd);
2172                 return NULL;
2173             }
2174             /* clone dgram socket */
2175             newfd = net_socket_mcast_create(&saddr);
2176             if (newfd < 0) {
2177                 /* error already reported by net_socket_mcast_create() */
2178                 close(fd);
2179                 return NULL;
2180             }
2181             /* clone newfd to fd, close newfd */
2182             dup2(newfd, fd);
2183             close(newfd);
2184
2185         } else {
2186             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
2187                     fd, strerror(errno));
2188             return NULL;
2189         }
2190     }
2191
2192     s = qemu_mallocz(sizeof(NetSocketState));
2193     s->fd = fd;
2194
2195     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
2196                                  NULL, net_socket_cleanup, s);
2197     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
2198
2199     /* mcast: save bound address as dst */
2200     if (is_connected) s->dgram_dst=saddr;
2201
2202     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2203             "socket: fd=%d (%s mcast=%s:%d)",
2204             fd, is_connected? "cloned" : "",
2205             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2206     return s;
2207 }
2208
2209 static void net_socket_connect(void *opaque)
2210 {
2211     NetSocketState *s = opaque;
2212     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2213 }
2214
2215 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2216                                                  const char *model,
2217                                                  const char *name,
2218                                                  int fd, int is_connected)
2219 {
2220     NetSocketState *s;
2221     s = qemu_mallocz(sizeof(NetSocketState));
2222     s->fd = fd;
2223     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
2224                                  NULL, net_socket_cleanup, s);
2225     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2226              "socket: fd=%d", fd);
2227     if (is_connected) {
2228         net_socket_connect(s);
2229     } else {
2230         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2231     }
2232     return s;
2233 }
2234
2235 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2236                                           const char *model, const char *name,
2237                                           int fd, int is_connected)
2238 {
2239     int so_type=-1, optlen=sizeof(so_type);
2240
2241     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2242         (socklen_t *)&optlen)< 0) {
2243         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2244         return NULL;
2245     }
2246     switch(so_type) {
2247     case SOCK_DGRAM:
2248         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2249     case SOCK_STREAM:
2250         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2251     default:
2252         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2253         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2254         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2255     }
2256     return NULL;
2257 }
2258
2259 static void net_socket_accept(void *opaque)
2260 {
2261     NetSocketListenState *s = opaque;
2262     NetSocketState *s1;
2263     struct sockaddr_in saddr;
2264     socklen_t len;
2265     int fd;
2266
2267     for(;;) {
2268         len = sizeof(saddr);
2269         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2270         if (fd < 0 && errno != EINTR) {
2271             return;
2272         } else if (fd >= 0) {
2273             break;
2274         }
2275     }
2276     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2277     if (!s1) {
2278         closesocket(fd);
2279     } else {
2280         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2281                  "socket: connection from %s:%d",
2282                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2283     }
2284 }
2285
2286 static int net_socket_listen_init(VLANState *vlan,
2287                                   const char *model,
2288                                   const char *name,
2289                                   const char *host_str)
2290 {
2291     NetSocketListenState *s;
2292     int fd, val, ret;
2293     struct sockaddr_in saddr;
2294
2295     if (parse_host_port(&saddr, host_str) < 0)
2296         return -1;
2297
2298     s = qemu_mallocz(sizeof(NetSocketListenState));
2299
2300     fd = socket(PF_INET, SOCK_STREAM, 0);
2301     if (fd < 0) {
2302         perror("socket");
2303         return -1;
2304     }
2305     socket_set_nonblock(fd);
2306
2307     /* allow fast reuse */
2308     val = 1;
2309     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2310
2311     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2312     if (ret < 0) {
2313         perror("bind");
2314         return -1;
2315     }
2316     ret = listen(fd, 0);
2317     if (ret < 0) {
2318         perror("listen");
2319         return -1;
2320     }
2321     s->vlan = vlan;
2322     s->model = strdup(model);
2323     s->name = name ? strdup(name) : NULL;
2324     s->fd = fd;
2325     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2326     return 0;
2327 }
2328
2329 static int net_socket_connect_init(VLANState *vlan,
2330                                    const char *model,
2331                                    const char *name,
2332                                    const char *host_str)
2333 {
2334     NetSocketState *s;
2335     int fd, connected, ret, err;
2336     struct sockaddr_in saddr;
2337
2338     if (parse_host_port(&saddr, host_str) < 0)
2339         return -1;
2340
2341     fd = socket(PF_INET, SOCK_STREAM, 0);
2342     if (fd < 0) {
2343         perror("socket");
2344         return -1;
2345     }
2346     socket_set_nonblock(fd);
2347
2348     connected = 0;
2349     for(;;) {
2350         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2351         if (ret < 0) {
2352             err = socket_error();
2353             if (err == EINTR || err == EWOULDBLOCK) {
2354             } else if (err == EINPROGRESS) {
2355                 break;
2356 #ifdef _WIN32
2357             } else if (err == WSAEALREADY) {
2358                 break;
2359 #endif
2360             } else {
2361                 perror("connect");
2362                 closesocket(fd);
2363                 return -1;
2364             }
2365         } else {
2366             connected = 1;
2367             break;
2368         }
2369     }
2370     s = net_socket_fd_init(vlan, model, name, fd, connected);
2371     if (!s)
2372         return -1;
2373     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2374              "socket: connect to %s:%d",
2375              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2376     return 0;
2377 }
2378
2379 static int net_socket_mcast_init(VLANState *vlan,
2380                                  const char *model,
2381                                  const char *name,
2382                                  const char *host_str)
2383 {
2384     NetSocketState *s;
2385     int fd;
2386     struct sockaddr_in saddr;
2387
2388     if (parse_host_port(&saddr, host_str) < 0)
2389         return -1;
2390
2391
2392     fd = net_socket_mcast_create(&saddr);
2393     if (fd < 0)
2394         return -1;
2395
2396     s = net_socket_fd_init(vlan, model, name, fd, 0);
2397     if (!s)
2398         return -1;
2399
2400     s->dgram_dst = saddr;
2401
2402     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2403              "socket: mcast=%s:%d",
2404              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2405     return 0;
2406
2407 }
2408
2409 typedef struct DumpState {
2410     VLANClientState *pcap_vc;
2411     int fd;
2412     int pcap_caplen;
2413 } DumpState;
2414
2415 #define PCAP_MAGIC 0xa1b2c3d4
2416
2417 struct pcap_file_hdr {
2418     uint32_t magic;
2419     uint16_t version_major;
2420     uint16_t version_minor;
2421     int32_t thiszone;
2422     uint32_t sigfigs;
2423     uint32_t snaplen;
2424     uint32_t linktype;
2425 };
2426
2427 struct pcap_sf_pkthdr {
2428     struct {
2429         int32_t tv_sec;
2430         int32_t tv_usec;
2431     } ts;
2432     uint32_t caplen;
2433     uint32_t len;
2434 };
2435
2436 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2437 {
2438     DumpState *s = vc->opaque;
2439     struct pcap_sf_pkthdr hdr;
2440     int64_t ts;
2441     int caplen;
2442
2443     /* Early return in case of previous error. */
2444     if (s->fd < 0) {
2445         return size;
2446     }
2447
2448     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, ticks_per_sec);
2449     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2450
2451     hdr.ts.tv_sec = ts / 1000000;
2452     hdr.ts.tv_usec = ts % 1000000;
2453     hdr.caplen = caplen;
2454     hdr.len = size;
2455     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2456         write(s->fd, buf, caplen) != caplen) {
2457         qemu_log("-net dump write error - stop dump\n");
2458         close(s->fd);
2459         s->fd = -1;
2460     }
2461
2462     return size;
2463 }
2464
2465 static void net_dump_cleanup(VLANClientState *vc)
2466 {
2467     DumpState *s = vc->opaque;
2468
2469     close(s->fd);
2470     qemu_free(s);
2471 }
2472
2473 static int net_dump_init(Monitor *mon, VLANState *vlan, const char *device,
2474                          const char *name, const char *filename, int len)
2475 {
2476     struct pcap_file_hdr hdr;
2477     DumpState *s;
2478
2479     s = qemu_malloc(sizeof(DumpState));
2480
2481     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2482     if (s->fd < 0) {
2483         config_error(mon, "-net dump: can't open %s\n", filename);
2484         return -1;
2485     }
2486
2487     s->pcap_caplen = len;
2488
2489     hdr.magic = PCAP_MAGIC;
2490     hdr.version_major = 2;
2491     hdr.version_minor = 4;
2492     hdr.thiszone = 0;
2493     hdr.sigfigs = 0;
2494     hdr.snaplen = s->pcap_caplen;
2495     hdr.linktype = 1;
2496
2497     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2498         config_error(mon, "-net dump write error: %s\n", strerror(errno));
2499         close(s->fd);
2500         qemu_free(s);
2501         return -1;
2502     }
2503
2504     s->pcap_vc = qemu_new_vlan_client(vlan, device, name, NULL, dump_receive, NULL,
2505                                       net_dump_cleanup, s);
2506     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2507              "dump to %s (len=%d)", filename, len);
2508     return 0;
2509 }
2510
2511 /* find or alloc a new VLAN */
2512 VLANState *qemu_find_vlan(int id, int allocate)
2513 {
2514     VLANState **pvlan, *vlan;
2515     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2516         if (vlan->id == id)
2517             return vlan;
2518     }
2519     if (!allocate) {
2520         return NULL;
2521     }
2522     vlan = qemu_mallocz(sizeof(VLANState));
2523     vlan->id = id;
2524     TAILQ_INIT(&vlan->send_queue);
2525     vlan->next = NULL;
2526     pvlan = &first_vlan;
2527     while (*pvlan != NULL)
2528         pvlan = &(*pvlan)->next;
2529     *pvlan = vlan;
2530     return vlan;
2531 }
2532
2533 static int nic_get_free_idx(void)
2534 {
2535     int index;
2536
2537     for (index = 0; index < MAX_NICS; index++)
2538         if (!nd_table[index].used)
2539             return index;
2540     return -1;
2541 }
2542
2543 int qemu_show_nic_models(const char *arg, const char *const *models)
2544 {
2545     int i;
2546
2547     if (!arg || strcmp(arg, "?"))
2548         return 0;
2549
2550     fprintf(stderr, "qemu: Supported NIC models: ");
2551     for (i = 0 ; models[i]; i++)
2552         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2553     return 1;
2554 }
2555
2556 void qemu_check_nic_model(NICInfo *nd, const char *model)
2557 {
2558     const char *models[2];
2559
2560     models[0] = model;
2561     models[1] = NULL;
2562
2563     if (qemu_show_nic_models(nd->model, models))
2564         exit(0);
2565     if (qemu_find_nic_model(nd, models, model) < 0)
2566         exit(1);
2567 }
2568
2569 int qemu_find_nic_model(NICInfo *nd, const char * const *models,
2570                         const char *default_model)
2571 {
2572     int i;
2573
2574     if (!nd->model)
2575         nd->model = qemu_strdup(default_model);
2576
2577     for (i = 0 ; models[i]; i++) {
2578         if (strcmp(nd->model, models[i]) == 0)
2579             return i;
2580     }
2581
2582     fprintf(stderr, "qemu: Unsupported NIC model: %s\n", nd->model);
2583     return -1;
2584 }
2585
2586 static int net_handle_fd_param(Monitor *mon, const char *param)
2587 {
2588     if (!qemu_isdigit(param[0])) {
2589         int fd;
2590
2591         fd = monitor_get_fd(mon, param);
2592         if (fd == -1) {
2593             config_error(mon, "No file descriptor named %s found", param);
2594             return -1;
2595         }
2596
2597         return fd;
2598     } else {
2599         return strtol(param, NULL, 0);
2600     }
2601 }
2602
2603 int net_client_init(Monitor *mon, const char *device, const char *p)
2604 {
2605     char buf[1024];
2606     int vlan_id, ret;
2607     VLANState *vlan;
2608     char *name = NULL;
2609
2610     vlan_id = 0;
2611     if (get_param_value(buf, sizeof(buf), "vlan", p)) {
2612         vlan_id = strtol(buf, NULL, 0);
2613     }
2614     vlan = qemu_find_vlan(vlan_id, 1);
2615
2616     if (get_param_value(buf, sizeof(buf), "name", p)) {
2617         name = qemu_strdup(buf);
2618     }
2619     if (!strcmp(device, "nic")) {
2620         static const char * const nic_params[] = {
2621             "vlan", "name", "macaddr", "model", "addr", "id", "vectors", NULL
2622         };
2623         NICInfo *nd;
2624         uint8_t *macaddr;
2625         int idx = nic_get_free_idx();
2626
2627         if (check_params(buf, sizeof(buf), nic_params, p) < 0) {
2628             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2629             ret = -1;
2630             goto out;
2631         }
2632         if (idx == -1 || nb_nics >= MAX_NICS) {
2633             config_error(mon, "Too Many NICs\n");
2634             ret = -1;
2635             goto out;
2636         }
2637         nd = &nd_table[idx];
2638         memset(nd, 0, sizeof(*nd));
2639         macaddr = nd->macaddr;
2640         macaddr[0] = 0x52;
2641         macaddr[1] = 0x54;
2642         macaddr[2] = 0x00;
2643         macaddr[3] = 0x12;
2644         macaddr[4] = 0x34;
2645         macaddr[5] = 0x56 + idx;
2646
2647         if (get_param_value(buf, sizeof(buf), "macaddr", p)) {
2648             if (parse_macaddr(macaddr, buf) < 0) {
2649                 config_error(mon, "invalid syntax for ethernet address\n");
2650                 ret = -1;
2651                 goto out;
2652             }
2653         }
2654         if (get_param_value(buf, sizeof(buf), "model", p)) {
2655             nd->model = qemu_strdup(buf);
2656         }
2657         if (get_param_value(buf, sizeof(buf), "addr", p)) {
2658             nd->devaddr = qemu_strdup(buf);
2659         }
2660         if (get_param_value(buf, sizeof(buf), "id", p)) {
2661             nd->id = qemu_strdup(buf);
2662         }
2663         nd->nvectors = NIC_NVECTORS_UNSPECIFIED;
2664         if (get_param_value(buf, sizeof(buf), "vectors", p)) {
2665             char *endptr;
2666             long vectors = strtol(buf, &endptr, 0);
2667             if (*endptr) {
2668                 config_error(mon, "invalid syntax for # of vectors\n");
2669                 ret = -1;
2670                 goto out;
2671             }
2672             if (vectors < 0 || vectors > 0x7ffffff) {
2673                 config_error(mon, "invalid # of vectors\n");
2674                 ret = -1;
2675                 goto out;
2676             }
2677             nd->nvectors = vectors;
2678         }
2679         nd->vlan = vlan;
2680         nd->name = name;
2681         nd->used = 1;
2682         name = NULL;
2683         nb_nics++;
2684         vlan->nb_guest_devs++;
2685         ret = idx;
2686     } else
2687     if (!strcmp(device, "none")) {
2688         if (*p != '\0') {
2689             config_error(mon, "'none' takes no parameters\n");
2690             ret = -1;
2691             goto out;
2692         }
2693         /* does nothing. It is needed to signal that no network cards
2694            are wanted */
2695         ret = 0;
2696     } else
2697 #ifdef CONFIG_SLIRP
2698     if (!strcmp(device, "user")) {
2699         static const char * const slirp_params[] = {
2700             "vlan", "name", "hostname", "restrict", "ip", "net", "host",
2701             "tftp", "bootfile", "dhcpstart", "dns", "smb", "smbserver",
2702             "hostfwd", "guestfwd", NULL
2703         };
2704         struct slirp_config_str *config;
2705         int restricted = 0;
2706         char *vnet = NULL;
2707         char *vhost = NULL;
2708         char *vhostname = NULL;
2709         char *tftp_export = NULL;
2710         char *bootfile = NULL;
2711         char *vdhcp_start = NULL;
2712         char *vnamesrv = NULL;
2713         char *smb_export = NULL;
2714         char *vsmbsrv = NULL;
2715         const char *q;
2716
2717         if (check_params(buf, sizeof(buf), slirp_params, p) < 0) {
2718             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2719             ret = -1;
2720             goto out;
2721         }
2722         if (get_param_value(buf, sizeof(buf), "ip", p)) {
2723             int vnet_buflen = strlen(buf) + strlen("/24") + 1;
2724             /* emulate legacy parameter */
2725             vnet = qemu_malloc(vnet_buflen);
2726             pstrcpy(vnet, vnet_buflen, buf);
2727             pstrcat(vnet, vnet_buflen, "/24");
2728         }
2729         if (get_param_value(buf, sizeof(buf), "net", p)) {
2730             vnet = qemu_strdup(buf);
2731         }
2732         if (get_param_value(buf, sizeof(buf), "host", p)) {
2733             vhost = qemu_strdup(buf);
2734         }
2735         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
2736             vhostname = qemu_strdup(buf);
2737         }
2738         if (get_param_value(buf, sizeof(buf), "restrict", p)) {
2739             restricted = (buf[0] == 'y') ? 1 : 0;
2740         }
2741         if (get_param_value(buf, sizeof(buf), "dhcpstart", p)) {
2742             vdhcp_start = qemu_strdup(buf);
2743         }
2744         if (get_param_value(buf, sizeof(buf), "dns", p)) {
2745             vnamesrv = qemu_strdup(buf);
2746         }
2747         if (get_param_value(buf, sizeof(buf), "tftp", p)) {
2748             tftp_export = qemu_strdup(buf);
2749         }
2750         if (get_param_value(buf, sizeof(buf), "bootfile", p)) {
2751             bootfile = qemu_strdup(buf);
2752         }
2753         if (get_param_value(buf, sizeof(buf), "smb", p)) {
2754             smb_export = qemu_strdup(buf);
2755             if (get_param_value(buf, sizeof(buf), "smbserver", p)) {
2756                 vsmbsrv = qemu_strdup(buf);
2757             }
2758         }
2759         q = p;
2760         while (1) {
2761             config = qemu_malloc(sizeof(*config));
2762             if (!get_next_param_value(config->str, sizeof(config->str),
2763                                       "hostfwd", &q)) {
2764                 break;
2765             }
2766             config->flags = SLIRP_CFG_HOSTFWD;
2767             config->next = slirp_configs;
2768             slirp_configs = config;
2769             config = NULL;
2770         }
2771         q = p;
2772         while (1) {
2773             config = qemu_malloc(sizeof(*config));
2774             if (!get_next_param_value(config->str, sizeof(config->str),
2775                                       "guestfwd", &q)) {
2776                 break;
2777             }
2778             config->flags = 0;
2779             config->next = slirp_configs;
2780             slirp_configs = config;
2781             config = NULL;
2782         }
2783         qemu_free(config);
2784         vlan->nb_host_devs++;
2785         ret = net_slirp_init(mon, vlan, device, name, restricted, vnet, vhost,
2786                              vhostname, tftp_export, bootfile, vdhcp_start,
2787                              vnamesrv, smb_export, vsmbsrv);
2788         qemu_free(vnet);
2789         qemu_free(vhost);
2790         qemu_free(vhostname);
2791         qemu_free(tftp_export);
2792         qemu_free(bootfile);
2793         qemu_free(vdhcp_start);
2794         qemu_free(vnamesrv);
2795         qemu_free(smb_export);
2796         qemu_free(vsmbsrv);
2797     } else if (!strcmp(device, "channel")) {
2798         if (TAILQ_EMPTY(&slirp_stacks)) {
2799             struct slirp_config_str *config;
2800
2801             config = qemu_malloc(sizeof(*config));
2802             pstrcpy(config->str, sizeof(config->str), p);
2803             config->flags = SLIRP_CFG_LEGACY;
2804             config->next = slirp_configs;
2805             slirp_configs = config;
2806         } else {
2807             slirp_guestfwd(TAILQ_FIRST(&slirp_stacks), mon, p, 1);
2808         }
2809         ret = 0;
2810     } else
2811 #endif
2812 #ifdef _WIN32
2813     if (!strcmp(device, "tap")) {
2814         static const char * const tap_params[] = {
2815             "vlan", "name", "ifname", NULL
2816         };
2817         char ifname[64];
2818
2819         if (check_params(buf, sizeof(buf), tap_params, p) < 0) {
2820             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2821             ret = -1;
2822             goto out;
2823         }
2824         if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
2825             config_error(mon, "tap: no interface name\n");
2826             ret = -1;
2827             goto out;
2828         }
2829         vlan->nb_host_devs++;
2830         ret = tap_win32_init(vlan, device, name, ifname);
2831     } else
2832 #elif defined (_AIX)
2833 #else
2834     if (!strcmp(device, "tap")) {
2835         char ifname[64], chkbuf[64];
2836         char setup_script[1024], down_script[1024];
2837         TAPState *s;
2838         int fd;
2839         vlan->nb_host_devs++;
2840         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
2841             static const char * const fd_params[] = {
2842                 "vlan", "name", "fd", "sndbuf", NULL
2843             };
2844             ret = -1;
2845             if (check_params(chkbuf, sizeof(chkbuf), fd_params, p) < 0) {
2846                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2847                 goto out;
2848             }
2849             fd = net_handle_fd_param(mon, buf);
2850             if (fd == -1) {
2851                 goto out;
2852             }
2853             fcntl(fd, F_SETFL, O_NONBLOCK);
2854             s = net_tap_fd_init(vlan, device, name, fd, tap_probe_vnet_hdr(fd));
2855             if (!s) {
2856                 close(fd);
2857             }
2858         } else {
2859             static const char * const tap_params[] = {
2860                 "vlan", "name", "ifname", "script", "downscript", "sndbuf", NULL
2861             };
2862             if (check_params(chkbuf, sizeof(chkbuf), tap_params, p) < 0) {
2863                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2864                 ret = -1;
2865                 goto out;
2866             }
2867             if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
2868                 ifname[0] = '\0';
2869             }
2870             if (get_param_value(setup_script, sizeof(setup_script), "script", p) == 0) {
2871                 pstrcpy(setup_script, sizeof(setup_script), DEFAULT_NETWORK_SCRIPT);
2872             }
2873             if (get_param_value(down_script, sizeof(down_script), "downscript", p) == 0) {
2874                 pstrcpy(down_script, sizeof(down_script), DEFAULT_NETWORK_DOWN_SCRIPT);
2875             }
2876             s = net_tap_init(vlan, device, name, ifname, setup_script, down_script);
2877         }
2878         if (s != NULL) {
2879             const char *sndbuf_str = NULL;
2880             if (get_param_value(buf, sizeof(buf), "sndbuf", p)) {
2881                 sndbuf_str = buf;
2882             }
2883             tap_set_sndbuf(s, sndbuf_str, mon);
2884             ret = 0;
2885         } else {
2886             ret = -1;
2887         }
2888     } else
2889 #endif
2890     if (!strcmp(device, "socket")) {
2891         char chkbuf[64];
2892         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
2893             static const char * const fd_params[] = {
2894                 "vlan", "name", "fd", NULL
2895             };
2896             int fd;
2897             ret = -1;
2898             if (check_params(chkbuf, sizeof(chkbuf), fd_params, p) < 0) {
2899                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2900                 goto out;
2901             }
2902             fd = net_handle_fd_param(mon, buf);
2903             if (fd == -1) {
2904                 goto out;
2905             }
2906             if (!net_socket_fd_init(vlan, device, name, fd, 1)) {
2907                 close(fd);
2908                 goto out;
2909             }
2910             ret = 0;
2911         } else if (get_param_value(buf, sizeof(buf), "listen", p) > 0) {
2912             static const char * const listen_params[] = {
2913                 "vlan", "name", "listen", NULL
2914             };
2915             if (check_params(chkbuf, sizeof(chkbuf), listen_params, p) < 0) {
2916                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2917                 ret = -1;
2918                 goto out;
2919             }
2920             ret = net_socket_listen_init(vlan, device, name, buf);
2921         } else if (get_param_value(buf, sizeof(buf), "connect", p) > 0) {
2922             static const char * const connect_params[] = {
2923                 "vlan", "name", "connect", NULL
2924             };
2925             if (check_params(chkbuf, sizeof(chkbuf), connect_params, p) < 0) {
2926                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2927                 ret = -1;
2928                 goto out;
2929             }
2930             ret = net_socket_connect_init(vlan, device, name, buf);
2931         } else if (get_param_value(buf, sizeof(buf), "mcast", p) > 0) {
2932             static const char * const mcast_params[] = {
2933                 "vlan", "name", "mcast", NULL
2934             };
2935             if (check_params(chkbuf, sizeof(chkbuf), mcast_params, p) < 0) {
2936                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2937                 ret = -1;
2938                 goto out;
2939             }
2940             ret = net_socket_mcast_init(vlan, device, name, buf);
2941         } else {
2942             config_error(mon, "Unknown socket options: %s\n", p);
2943             ret = -1;
2944             goto out;
2945         }
2946         vlan->nb_host_devs++;
2947     } else
2948 #ifdef CONFIG_VDE
2949     if (!strcmp(device, "vde")) {
2950         static const char * const vde_params[] = {
2951             "vlan", "name", "sock", "port", "group", "mode", NULL
2952         };
2953         char vde_sock[1024], vde_group[512];
2954         int vde_port, vde_mode;
2955
2956         if (check_params(buf, sizeof(buf), vde_params, p) < 0) {
2957             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2958             ret = -1;
2959             goto out;
2960         }
2961         vlan->nb_host_devs++;
2962         if (get_param_value(vde_sock, sizeof(vde_sock), "sock", p) <= 0) {
2963             vde_sock[0] = '\0';
2964         }
2965         if (get_param_value(buf, sizeof(buf), "port", p) > 0) {
2966             vde_port = strtol(buf, NULL, 10);
2967         } else {
2968             vde_port = 0;
2969         }
2970         if (get_param_value(vde_group, sizeof(vde_group), "group", p) <= 0) {
2971             vde_group[0] = '\0';
2972         }
2973         if (get_param_value(buf, sizeof(buf), "mode", p) > 0) {
2974             vde_mode = strtol(buf, NULL, 8);
2975         } else {
2976             vde_mode = 0700;
2977         }
2978         ret = net_vde_init(vlan, device, name, vde_sock, vde_port, vde_group, vde_mode);
2979     } else
2980 #endif
2981     if (!strcmp(device, "dump")) {
2982         int len = 65536;
2983
2984         if (get_param_value(buf, sizeof(buf), "len", p) > 0) {
2985             len = strtol(buf, NULL, 0);
2986         }
2987         if (!get_param_value(buf, sizeof(buf), "file", p)) {
2988             snprintf(buf, sizeof(buf), "qemu-vlan%d.pcap", vlan_id);
2989         }
2990         ret = net_dump_init(mon, vlan, device, name, buf, len);
2991     } else {
2992         config_error(mon, "Unknown network device: %s\n", device);
2993         ret = -1;
2994         goto out;
2995     }
2996     if (ret < 0) {
2997         config_error(mon, "Could not initialize device '%s'\n", device);
2998     }
2999 out:
3000     qemu_free(name);
3001     return ret;
3002 }
3003
3004 void net_client_uninit(NICInfo *nd)
3005 {
3006     nd->vlan->nb_guest_devs--;
3007     nb_nics--;
3008
3009     qemu_free(nd->model);
3010     qemu_free(nd->name);
3011     qemu_free(nd->devaddr);
3012     qemu_free(nd->id);
3013
3014     nd->used = 0;
3015 }
3016
3017 static int net_host_check_device(const char *device)
3018 {
3019     int i;
3020     const char *valid_param_list[] = { "tap", "socket", "dump"
3021 #ifdef CONFIG_SLIRP
3022                                        ,"user"
3023 #endif
3024 #ifdef CONFIG_VDE
3025                                        ,"vde"
3026 #endif
3027     };
3028     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
3029         if (!strncmp(valid_param_list[i], device,
3030                      strlen(valid_param_list[i])))
3031             return 1;
3032     }
3033
3034     return 0;
3035 }
3036
3037 void net_host_device_add(Monitor *mon, const char *device, const char *opts)
3038 {
3039     if (!net_host_check_device(device)) {
3040         monitor_printf(mon, "invalid host network device %s\n", device);
3041         return;
3042     }
3043     if (net_client_init(mon, device, opts ? opts : "") < 0) {
3044         monitor_printf(mon, "adding host network device %s failed\n", device);
3045     }
3046 }
3047
3048 void net_host_device_remove(Monitor *mon, int vlan_id, const char *device)
3049 {
3050     VLANClientState *vc;
3051
3052     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
3053     if (!vc) {
3054         return;
3055     }
3056     if (!net_host_check_device(vc->model)) {
3057         monitor_printf(mon, "invalid host network device %s\n", device);
3058         return;
3059     }
3060     qemu_del_vlan_client(vc);
3061 }
3062
3063 int net_client_parse(const char *str)
3064 {
3065     const char *p;
3066     char *q;
3067     char device[64];
3068
3069     p = str;
3070     q = device;
3071     while (*p != '\0' && *p != ',') {
3072         if ((q - device) < sizeof(device) - 1)
3073             *q++ = *p;
3074         p++;
3075     }
3076     *q = '\0';
3077     if (*p == ',')
3078         p++;
3079
3080     return net_client_init(NULL, device, p);
3081 }
3082
3083 void net_set_boot_mask(int net_boot_mask)
3084 {
3085     int i;
3086
3087     /* Only the first four NICs may be bootable */
3088     net_boot_mask = net_boot_mask & 0xF;
3089
3090     for (i = 0; i < nb_nics; i++) {
3091         if (net_boot_mask & (1 << i)) {
3092             nd_table[i].bootable = 1;
3093             net_boot_mask &= ~(1 << i);
3094         }
3095     }
3096
3097     if (net_boot_mask) {
3098         fprintf(stderr, "Cannot boot from non-existent NIC\n");
3099         exit(1);
3100     }
3101 }
3102
3103 void do_info_network(Monitor *mon)
3104 {
3105     VLANState *vlan;
3106     VLANClientState *vc;
3107
3108     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3109         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
3110         for(vc = vlan->first_client; vc != NULL; vc = vc->next)
3111             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
3112     }
3113 }
3114
3115 void do_set_link(Monitor *mon, const char *name, const char *up_or_down)
3116 {
3117     VLANState *vlan;
3118     VLANClientState *vc = NULL;
3119
3120     for (vlan = first_vlan; vlan != NULL; vlan = vlan->next)
3121         for (vc = vlan->first_client; vc != NULL; vc = vc->next)
3122             if (strcmp(vc->name, name) == 0)
3123                 goto done;
3124 done:
3125
3126     if (!vc) {
3127         monitor_printf(mon, "could not find network device '%s'\n", name);
3128         return;
3129     }
3130
3131     if (strcmp(up_or_down, "up") == 0)
3132         vc->link_down = 0;
3133     else if (strcmp(up_or_down, "down") == 0)
3134         vc->link_down = 1;
3135     else
3136         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
3137                        "valid\n", up_or_down);
3138
3139     if (vc->link_status_changed)
3140         vc->link_status_changed(vc);
3141 }
3142
3143 void net_cleanup(void)
3144 {
3145     VLANState *vlan;
3146
3147     /* close network clients */
3148     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3149         VLANClientState *vc = vlan->first_client;
3150
3151         while (vc) {
3152             VLANClientState *next = vc->next;
3153
3154             qemu_del_vlan_client(vc);
3155
3156             vc = next;
3157         }
3158     }
3159 }
3160
3161 void net_client_check(void)
3162 {
3163     VLANState *vlan;
3164
3165     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
3166         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
3167             continue;
3168         if (vlan->nb_guest_devs == 0)
3169             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
3170         if (vlan->nb_host_devs == 0)
3171             fprintf(stderr,
3172                     "Warning: vlan %d is not connected to host network\n",
3173                     vlan->id);
3174     }
3175 }