net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for CONFIG_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include "tap-linux.h"
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef CONFIG_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #include "qemu-common.h"
 105 #include "net.h"
 106 #include "monitor.h"
 107 #include "sysemu.h"
 108 #include "qemu-timer.h"
 109 #include "qemu-char.h"
 110 #include "audio/audio.h"
 111 #include "qemu_socket.h"
 112 #include "qemu-log.h"
 113 #include "qemu-config.h"
 114
 115 #include "slirp/libslirp.h"
 116
 117 static QTAILQ_HEAD(, VLANState) vlans;
 118 static QTAILQ_HEAD(, VLANClientState) non_vlan_clients;
 119
 120 /***********************************************************/
 121 /* network device redirectors */
 122
 123 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 124 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 125 {
 126     int len, i, j, c;
 127
 128     for(i=0;i<size;i+=16) {
 129         len = size - i;
 130         if (len > 16)
 131             len = 16;
 132         fprintf(f, "%08x ", i);
 133         for(j=0;j<16;j++) {
 134             if (j < len)
 135                 fprintf(f, " %02x", buf[i+j]);
 136             else
 137                 fprintf(f, "   ");
 138         }
 139         fprintf(f, " ");
 140         for(j=0;j<len;j++) {
 141             c = buf[i+j];
 142             if (c < ' ' || c > '~')
 143                 c = '.';
 144             fprintf(f, "%c", c);
 145         }
 146         fprintf(f, "\n");
 147     }
 148 }
 149 #endif
 150
 151 static int parse_macaddr(uint8_t *macaddr, const char *p)
 152 {
 153     int i;
 154     char *last_char;
 155     long int offset;
 156
 157     errno = 0;
 158     offset = strtol(p, &last_char, 0);
 159     if (0 == errno && '\0' == *last_char &&
 160             offset >= 0 && offset <= 0xFFFFFF) {
 161         macaddr[3] = (offset & 0xFF0000) >> 16;
 162         macaddr[4] = (offset & 0xFF00) >> 8;
 163         macaddr[5] = offset & 0xFF;
 164         return 0;
 165     } else {
 166         for(i = 0; i < 6; i++) {
 167             macaddr[i] = strtol(p, (char **)&p, 16);
 168             if (i == 5) {
 169                 if (*p != '\0')
 170                     return -1;
 171             } else {
 172                 if (*p != ':' && *p != '-')
 173                     return -1;
 174                 p++;
 175             }
 176         }
 177         return 0;
 178     }
 179
 180     return -1;
 181 }
 182
 183 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 184 {
 185     const char *p, *p1;
 186     int len;
 187     p = *pp;
 188     p1 = strchr(p, sep);
 189     if (!p1)
 190         return -1;
 191     len = p1 - p;
 192     p1++;
 193     if (buf_size > 0) {
 194         if (len > buf_size - 1)
 195             len = buf_size - 1;
 196         memcpy(buf, p, len);
 197         buf[len] = '\0';
 198     }
 199     *pp = p1;
 200     return 0;
 201 }
 202
 203 int parse_host_src_port(struct sockaddr_in *haddr,
 204                         struct sockaddr_in *saddr,
 205                         const char *input_str)
 206 {
 207     char *str = strdup(input_str);
 208     char *host_str = str;
 209     char *src_str;
 210     const char *src_str2;
 211     char *ptr;
 212
 213     /*
 214      * Chop off any extra arguments at the end of the string which
 215      * would start with a comma, then fill in the src port information
 216      * if it was provided else use the "any address" and "any port".
 217      */
 218     if ((ptr = strchr(str,',')))
 219         *ptr = '\0';
 220
 221     if ((src_str = strchr(input_str,'@'))) {
 222         *src_str = '\0';
 223         src_str++;
 224     }
 225
 226     if (parse_host_port(haddr, host_str) < 0)
 227         goto fail;
 228
 229     src_str2 = src_str;
 230     if (!src_str || *src_str == '\0')
 231         src_str2 = ":0";
 232
 233     if (parse_host_port(saddr, src_str2) < 0)
 234         goto fail;
 235
 236     free(str);
 237     return(0);
 238
 239 fail:
 240     free(str);
 241     return -1;
 242 }
 243
 244 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 245 {
 246     char buf[512];
 247     struct hostent *he;
 248     const char *p, *r;
 249     int port;
 250
 251     p = str;
 252     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 253         return -1;
 254     saddr->sin_family = AF_INET;
 255     if (buf[0] == '\0') {
 256         saddr->sin_addr.s_addr = 0;
 257     } else {
 258         if (qemu_isdigit(buf[0])) {
 259             if (!inet_aton(buf, &saddr->sin_addr))
 260                 return -1;
 261         } else {
 262             if ((he = gethostbyname(buf)) == NULL)
 263                 return - 1;
 264             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 265         }
 266     }
 267     port = strtol(p, (char **)&r, 0);
 268     if (r == p)
 269         return -1;
 270     saddr->sin_port = htons(port);
 271     return 0;
 272 }
 273
 274 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 275 {
 276     snprintf(vc->info_str, sizeof(vc->info_str),
 277              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 278              vc->model,
 279              macaddr[0], macaddr[1], macaddr[2],
 280              macaddr[3], macaddr[4], macaddr[5]);
 281 }
 282
 283 void qemu_macaddr_default_if_unset(MACAddr *macaddr)
 284 {
 285     static int index = 0;
 286     static const MACAddr zero = { .a = { 0,0,0,0,0,0 } };
 287
 288     if (memcmp(macaddr, &zero, sizeof(zero)) != 0)
 289         return;
 290     macaddr->a[0] = 0x52;
 291     macaddr->a[1] = 0x54;
 292     macaddr->a[2] = 0x00;
 293     macaddr->a[3] = 0x12;
 294     macaddr->a[4] = 0x34;
 295     macaddr->a[5] = 0x56 + index++;
 296 }
 297
 298 static char *assign_name(VLANClientState *vc1, const char *model)
 299 {
 300     VLANState *vlan;
 301     char buf[256];
 302     int id = 0;
 303
 304     QTAILQ_FOREACH(vlan, &vlans, next) {
 305         VLANClientState *vc;
 306
 307         QTAILQ_FOREACH(vc, &vlan->clients, next) {
 308             if (vc != vc1 && strcmp(vc->model, model) == 0) {
 309                 id++;
 310             }
 311         }
 312     }
 313
 314     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 315
 316     return qemu_strdup(buf);
 317 }
 318
 319 static ssize_t qemu_deliver_packet(VLANClientState *sender,
 320                                    const uint8_t *data,
 321                                    size_t size,
 322                                    void *opaque);
 323 static ssize_t qemu_deliver_packet_iov(VLANClientState *sender,
 324                                        const struct iovec *iov,
 325                                        int iovcnt,
 326                                        void *opaque);
 327
 328 VLANClientState *qemu_new_vlan_client(net_client_type type,
 329                                       VLANState *vlan,
 330                                       VLANClientState *peer,
 331                                       const char *model,
 332                                       const char *name,
 333                                       NetCanReceive *can_receive,
 334                                       NetReceive *receive,
 335                                       NetReceiveIOV *receive_iov,
 336                                       NetCleanup *cleanup,
 337                                       void *opaque)
 338 {
 339     VLANClientState *vc;
 340
 341     vc = qemu_mallocz(sizeof(VLANClientState));
 342
 343     vc->type = type;
 344     vc->model = qemu_strdup(model);
 345     if (name)
 346         vc->name = qemu_strdup(name);
 347     else
 348         vc->name = assign_name(vc, model);
 349     vc->can_receive = can_receive;
 350     vc->receive = receive;
 351     vc->receive_iov = receive_iov;
 352     vc->cleanup = cleanup;
 353     vc->opaque = opaque;
 354
 355     if (vlan) {
 356         assert(!peer);
 357         vc->vlan = vlan;
 358         QTAILQ_INSERT_TAIL(&vc->vlan->clients, vc, next);
 359     } else {
 360         if (peer) {
 361             vc->peer = peer;
 362             peer->peer = vc;
 363         }
 364         QTAILQ_INSERT_TAIL(&non_vlan_clients, vc, next);
 365
 366         vc->send_queue = qemu_new_net_queue(qemu_deliver_packet,
 367                                             qemu_deliver_packet_iov,
 368                                             vc);
 369     }
 370
 371     return vc;
 372 }
 373
 374 void qemu_del_vlan_client(VLANClientState *vc)
 375 {
 376     if (vc->vlan) {
 377         QTAILQ_REMOVE(&vc->vlan->clients, vc, next);
 378     } else {
 379         if (vc->send_queue) {
 380             qemu_del_net_queue(vc->send_queue);
 381         }
 382         QTAILQ_REMOVE(&non_vlan_clients, vc, next);
 383         if (vc->peer) {
 384             vc->peer->peer = NULL;
 385         }
 386     }
 387
 388     if (vc->cleanup) {
 389         vc->cleanup(vc);
 390     }
 391
 392     qemu_free(vc->name);
 393     qemu_free(vc->model);
 394     qemu_free(vc);
 395 }
 396
 397 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 398 {
 399     VLANClientState *vc;
 400
 401     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 402         if (vc->opaque == opaque) {
 403             return vc;
 404         }
 405     }
 406
 407     return NULL;
 408 }
 409
 410 static VLANClientState *
 411 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 412                               const char *client_str)
 413 {
 414     VLANState *vlan;
 415     VLANClientState *vc;
 416
 417     vlan = qemu_find_vlan(vlan_id, 0);
 418     if (!vlan) {
 419         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 420         return NULL;
 421     }
 422
 423     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 424         if (!strcmp(vc->name, client_str)) {
 425             break;
 426         }
 427     }
 428     if (!vc) {
 429         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 430                        client_str, vlan_id);
 431     }
 432
 433     return vc;
 434 }
 435
 436 int qemu_can_send_packet(VLANClientState *sender)
 437 {
 438     VLANState *vlan = sender->vlan;
 439     VLANClientState *vc;
 440
 441     if (sender->peer) {
 442         if (!sender->peer->can_receive ||
 443             sender->peer->can_receive(sender->peer)) {
 444             return 1;
 445         } else {
 446             return 0;
 447         }
 448     }
 449
 450     if (!sender->vlan) {
 451         return 1;
 452     }
 453
 454     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 455         if (vc == sender) {
 456             continue;
 457         }
 458
 459         /* no can_receive() handler, they can always receive */
 460         if (!vc->can_receive || vc->can_receive(vc)) {
 461             return 1;
 462         }
 463     }
 464     return 0;
 465 }
 466
 467 static ssize_t qemu_deliver_packet(VLANClientState *sender,
 468                                    const uint8_t *data,
 469                                    size_t size,
 470                                    void *opaque)
 471 {
 472     VLANClientState *vc = opaque;
 473
 474     if (vc->link_down) {
 475         return size;
 476     }
 477
 478     return vc->receive(vc, data, size);
 479 }
 480
 481 static ssize_t qemu_vlan_deliver_packet(VLANClientState *sender,
 482                                         const uint8_t *buf,
 483                                         size_t size,
 484                                         void *opaque)
 485 {
 486     VLANState *vlan = opaque;
 487     VLANClientState *vc;
 488     int ret = -1;
 489
 490     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 491         ssize_t len;
 492
 493         if (vc == sender) {
 494             continue;
 495         }
 496
 497         if (vc->link_down) {
 498             ret = size;
 499             continue;
 500         }
 501
 502         len = vc->receive(vc, buf, size);
 503
 504         ret = (ret >= 0) ? ret : len;
 505     }
 506
 507     return ret;
 508 }
 509
 510 void qemu_purge_queued_packets(VLANClientState *vc)
 511 {
 512     NetQueue *queue;
 513
 514     if (!vc->peer && !vc->vlan) {
 515         return;
 516     }
 517
 518     if (vc->peer) {
 519         queue = vc->peer->send_queue;
 520     } else {
 521         queue = vc->vlan->send_queue;
 522     }
 523
 524     qemu_net_queue_purge(queue, vc);
 525 }
 526
 527 void qemu_flush_queued_packets(VLANClientState *vc)
 528 {
 529     NetQueue *queue;
 530
 531     if (vc->vlan) {
 532         queue = vc->vlan->send_queue;
 533     } else {
 534         queue = vc->send_queue;
 535     }
 536
 537     qemu_net_queue_flush(queue);
 538 }
 539
 540 ssize_t qemu_send_packet_async(VLANClientState *sender,
 541                                const uint8_t *buf, int size,
 542                                NetPacketSent *sent_cb)
 543 {
 544     NetQueue *queue;
 545
 546 #ifdef DEBUG_NET
 547     printf("qemu_send_packet_async:\n");
 548     hex_dump(stdout, buf, size);
 549 #endif
 550
 551     if (sender->link_down || (!sender->peer && !sender->vlan)) {
 552         return size;
 553     }
 554
 555     if (sender->peer) {
 556         queue = sender->peer->send_queue;
 557     } else {
 558         queue = sender->vlan->send_queue;
 559     }
 560
 561     return qemu_net_queue_send(queue, sender, buf, size, sent_cb);
 562 }
 563
 564 void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size)
 565 {
 566     qemu_send_packet_async(vc, buf, size, NULL);
 567 }
 568
 569 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 570                                int iovcnt)
 571 {
 572     uint8_t buffer[4096];
 573     size_t offset = 0;
 574     int i;
 575
 576     for (i = 0; i < iovcnt; i++) {
 577         size_t len;
 578
 579         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 580         memcpy(buffer + offset, iov[i].iov_base, len);
 581         offset += len;
 582     }
 583
 584     return vc->receive(vc, buffer, offset);
 585 }
 586
 587 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 588 {
 589     size_t offset = 0;
 590     int i;
 591
 592     for (i = 0; i < iovcnt; i++)
 593         offset += iov[i].iov_len;
 594     return offset;
 595 }
 596
 597 static ssize_t qemu_deliver_packet_iov(VLANClientState *sender,
 598                                        const struct iovec *iov,
 599                                        int iovcnt,
 600                                        void *opaque)
 601 {
 602     VLANClientState *vc = opaque;
 603
 604     if (vc->link_down) {
 605         return calc_iov_length(iov, iovcnt);
 606     }
 607
 608     if (vc->receive_iov) {
 609         return vc->receive_iov(vc, iov, iovcnt);
 610     } else {
 611         return vc_sendv_compat(vc, iov, iovcnt);
 612     }
 613 }
 614
 615 static ssize_t qemu_vlan_deliver_packet_iov(VLANClientState *sender,
 616                                             const struct iovec *iov,
 617                                             int iovcnt,
 618                                             void *opaque)
 619 {
 620     VLANState *vlan = opaque;
 621     VLANClientState *vc;
 622     ssize_t ret = -1;
 623
 624     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 625         ssize_t len;
 626
 627         if (vc == sender) {
 628             continue;
 629         }
 630
 631         if (vc->link_down) {
 632             ret = calc_iov_length(iov, iovcnt);
 633             continue;
 634         }
 635
 636         if (vc->receive_iov) {
 637             len = vc->receive_iov(vc, iov, iovcnt);
 638         } else {
 639             len = vc_sendv_compat(vc, iov, iovcnt);
 640         }
 641
 642         ret = (ret >= 0) ? ret : len;
 643     }
 644
 645     return ret;
 646 }
 647
 648 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 649                                 const struct iovec *iov, int iovcnt,
 650                                 NetPacketSent *sent_cb)
 651 {
 652     NetQueue *queue;
 653
 654     if (sender->link_down || (!sender->peer && !sender->vlan)) {
 655         return calc_iov_length(iov, iovcnt);
 656     }
 657
 658     if (sender->peer) {
 659         queue = sender->peer->send_queue;
 660     } else {
 661         queue = sender->vlan->send_queue;
 662     }
 663
 664     return qemu_net_queue_send_iov(queue, sender, iov, iovcnt, sent_cb);
 665 }
 666
 667 ssize_t
 668 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 669 {
 670     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 671 }
 672
 673 #if defined(CONFIG_SLIRP)
 674
 675 /* slirp network adapter */
 676
 677 #define SLIRP_CFG_HOSTFWD 1
 678 #define SLIRP_CFG_LEGACY  2
 679
 680 struct slirp_config_str {
 681     struct slirp_config_str *next;
 682     int flags;
 683     char str[1024];
 684     int legacy_format;
 685 };
 686
 687 typedef struct SlirpState {
 688     QTAILQ_ENTRY(SlirpState) entry;
 689     VLANClientState *vc;
 690     Slirp *slirp;
 691 #ifndef _WIN32
 692     char smb_dir[128];
 693 #endif
 694 } SlirpState;
 695
 696 static struct slirp_config_str *slirp_configs;
 697 const char *legacy_tftp_prefix;
 698 const char *legacy_bootp_filename;
 699 static QTAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 700     QTAILQ_HEAD_INITIALIZER(slirp_stacks);
 701
 702 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 703                          int legacy_format);
 704 static int slirp_guestfwd(SlirpState *s, const char *config_str,
 705                           int legacy_format);
 706
 707 #ifndef _WIN32
 708 static const char *legacy_smb_export;
 709
 710 static int slirp_smb(SlirpState *s, const char *exported_dir,
 711                      struct in_addr vserver_addr);
 712 static void slirp_smb_cleanup(SlirpState *s);
 713 #else
 714 static inline void slirp_smb_cleanup(SlirpState *s) { }
 715 #endif
 716
 717 int slirp_can_output(void *opaque)
 718 {
 719     SlirpState *s = opaque;
 720
 721     return qemu_can_send_packet(s->vc);
 722 }
 723
 724 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 725 {
 726     SlirpState *s = opaque;
 727
 728 #ifdef DEBUG_SLIRP
 729     printf("slirp output:\n");
 730     hex_dump(stdout, pkt, pkt_len);
 731 #endif
 732     qemu_send_packet(s->vc, pkt, pkt_len);
 733 }
 734
 735 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 736 {
 737     SlirpState *s = vc->opaque;
 738
 739 #ifdef DEBUG_SLIRP
 740     printf("slirp input:\n");
 741     hex_dump(stdout, buf, size);
 742 #endif
 743     slirp_input(s->slirp, buf, size);
 744     return size;
 745 }
 746
 747 static void net_slirp_cleanup(VLANClientState *vc)
 748 {
 749     SlirpState *s = vc->opaque;
 750
 751     slirp_cleanup(s->slirp);
 752     slirp_smb_cleanup(s);
 753     QTAILQ_REMOVE(&slirp_stacks, s, entry);
 754     qemu_free(s);
 755 }
 756
 757 static int net_slirp_init(VLANState *vlan, const char *model,
 758                           const char *name, int restricted,
 759                           const char *vnetwork, const char *vhost,
 760                           const char *vhostname, const char *tftp_export,
 761                           const char *bootfile, const char *vdhcp_start,
 762                           const char *vnameserver, const char *smb_export,
 763                           const char *vsmbserver)
 764 {
 765     /* default settings according to historic slirp */
 766     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 767     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 768     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 769     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 770     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 771 #ifndef _WIN32
 772     struct in_addr smbsrv = { .s_addr = 0 };
 773 #endif
 774     SlirpState *s;
 775     char buf[20];
 776     uint32_t addr;
 777     int shift;
 778     char *end;
 779     struct slirp_config_str *config;
 780
 781     if (!tftp_export) {
 782         tftp_export = legacy_tftp_prefix;
 783     }
 784     if (!bootfile) {
 785         bootfile = legacy_bootp_filename;
 786     }
 787
 788     if (vnetwork) {
 789         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 790             if (!inet_aton(vnetwork, &net)) {
 791                 return -1;
 792             }
 793             addr = ntohl(net.s_addr);
 794             if (!(addr & 0x80000000)) {
 795                 mask.s_addr = htonl(0xff000000); /* class A */
 796             } else if ((addr & 0xfff00000) == 0xac100000) {
 797                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 798             } else if ((addr & 0xc0000000) == 0x80000000) {
 799                 mask.s_addr = htonl(0xffff0000); /* class B */
 800             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 801                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 802             } else if ((addr & 0xffff0000) == 0xc6120000) {
 803                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 804             } else if ((addr & 0xe0000000) == 0xe0000000) {
 805                 mask.s_addr = htonl(0xffffff00); /* class C */
 806             } else {
 807                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 808             }
 809         } else {
 810             if (!inet_aton(buf, &net)) {
 811                 return -1;
 812             }
 813             shift = strtol(vnetwork, &end, 10);
 814             if (*end != '\0') {
 815                 if (!inet_aton(vnetwork, &mask)) {
 816                     return -1;
 817                 }
 818             } else if (shift < 4 || shift > 32) {
 819                 return -1;
 820             } else {
 821                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 822             }
 823         }
 824         net.s_addr &= mask.s_addr;
 825         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 826         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 827         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 828     }
 829
 830     if (vhost && !inet_aton(vhost, &host)) {
 831         return -1;
 832     }
 833     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 834         return -1;
 835     }
 836
 837     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 838         return -1;
 839     }
 840     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 841         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 842         return -1;
 843     }
 844
 845     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 846         return -1;
 847     }
 848     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 849         dns.s_addr == host.s_addr) {
 850         return -1;
 851     }
 852
 853 #ifndef _WIN32
 854     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 855         return -1;
 856     }
 857 #endif
 858
 859     s = qemu_mallocz(sizeof(SlirpState));
 860     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 861                           tftp_export, bootfile, dhcp, dns, s);
 862     QTAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 863
 864     for (config = slirp_configs; config; config = config->next) {
 865         if (config->flags & SLIRP_CFG_HOSTFWD) {
 866             if (slirp_hostfwd(s, config->str,
 867                               config->flags & SLIRP_CFG_LEGACY) < 0)
 868                 return -1;
 869         } else {
 870             if (slirp_guestfwd(s, config->str,
 871                                config->flags & SLIRP_CFG_LEGACY) < 0)
 872                 return -1;
 873         }
 874     }
 875 #ifndef _WIN32
 876     if (!smb_export) {
 877         smb_export = legacy_smb_export;
 878     }
 879     if (smb_export) {
 880         if (slirp_smb(s, smb_export, smbsrv) < 0)
 881             return -1;
 882     }
 883 #endif
 884
 885     s->vc = qemu_new_vlan_client(NET_CLIENT_TYPE_SLIRP,
 886                                  vlan, NULL, model, name, NULL,
 887                                  slirp_receive, NULL,
 888                                  net_slirp_cleanup, s);
 889     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 890              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 891     return 0;
 892 }
 893
 894 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 895                                 const char *stack)
 896 {
 897     VLANClientState *vc;
 898
 899     if (vlan) {
 900         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 901         if (!vc) {
 902             return NULL;
 903         }
 904         if (strcmp(vc->model, "user")) {
 905             monitor_printf(mon, "invalid device specified\n");
 906             return NULL;
 907         }
 908         return vc->opaque;
 909     } else {
 910         if (QTAILQ_EMPTY(&slirp_stacks)) {
 911             monitor_printf(mon, "user mode network stack not in use\n");
 912             return NULL;
 913         }
 914         return QTAILQ_FIRST(&slirp_stacks);
 915     }
 916 }
 917
 918 void net_slirp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 919 {
 920     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 921     int host_port;
 922     char buf[256] = "";
 923     const char *src_str, *p;
 924     SlirpState *s;
 925     int is_udp = 0;
 926     int err;
 927     const char *arg1 = qdict_get_str(qdict, "arg1");
 928     const char *arg2 = qdict_get_try_str(qdict, "arg2");
 929     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 930
 931     if (arg2) {
 932         s = slirp_lookup(mon, arg1, arg2);
 933         src_str = arg3;
 934     } else {
 935         s = slirp_lookup(mon, NULL, NULL);
 936         src_str = arg1;
 937     }
 938     if (!s) {
 939         return;
 940     }
 941
 942     if (!src_str || !src_str[0])
 943         goto fail_syntax;
 944
 945     p = src_str;
 946     get_str_sep(buf, sizeof(buf), &p, ':');
 947
 948     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 949         is_udp = 0;
 950     } else if (!strcmp(buf, "udp")) {
 951         is_udp = 1;
 952     } else {
 953         goto fail_syntax;
 954     }
 955
 956     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 957         goto fail_syntax;
 958     }
 959     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 960         goto fail_syntax;
 961     }
 962
 963     host_port = atoi(p);
 964
 965     err = slirp_remove_hostfwd(QTAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 966                                host_addr, host_port);
 967
 968     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 969                    err ? "removed" : "not found");
 970     return;
 971
 972  fail_syntax:
 973     monitor_printf(mon, "invalid format\n");
 974 }
 975
 976 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 977                          int legacy_format)
 978 {
 979     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 980     struct in_addr guest_addr = { .s_addr = 0 };
 981     int host_port, guest_port;
 982     const char *p;
 983     char buf[256];
 984     int is_udp;
 985     char *end;
 986
 987     p = redir_str;
 988     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 989         goto fail_syntax;
 990     }
 991     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 992         is_udp = 0;
 993     } else if (!strcmp(buf, "udp")) {
 994         is_udp = 1;
 995     } else {
 996         goto fail_syntax;
 997     }
 998
 999     if (!legacy_format) {
1000         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1001             goto fail_syntax;
1002         }
1003         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
1004             goto fail_syntax;
1005         }
1006     }
1007
1008     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
1009         goto fail_syntax;
1010     }
1011     host_port = strtol(buf, &end, 0);
1012     if (*end != '\0' || host_port < 1 || host_port > 65535) {
1013         goto fail_syntax;
1014     }
1015
1016     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1017         goto fail_syntax;
1018     }
1019     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
1020         goto fail_syntax;
1021     }
1022
1023     guest_port = strtol(p, &end, 0);
1024     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
1025         goto fail_syntax;
1026     }
1027
1028     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
1029                           guest_port) < 0) {
1030         qemu_error("could not set up host forwarding rule '%s'\n",
1031                    redir_str);
1032         return -1;
1033     }
1034     return 0;
1035
1036  fail_syntax:
1037     qemu_error("invalid host forwarding rule '%s'\n", redir_str);
1038     return -1;
1039 }
1040
1041 void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict)
1042 {
1043     const char *redir_str;
1044     SlirpState *s;
1045     const char *arg1 = qdict_get_str(qdict, "arg1");
1046     const char *arg2 = qdict_get_try_str(qdict, "arg2");
1047     const char *arg3 = qdict_get_try_str(qdict, "arg3");
1048
1049     if (arg2) {
1050         s = slirp_lookup(mon, arg1, arg2);
1051         redir_str = arg3;
1052     } else {
1053         s = slirp_lookup(mon, NULL, NULL);
1054         redir_str = arg1;
1055     }
1056     if (s) {
1057         slirp_hostfwd(s, redir_str, 0);
1058     }
1059
1060 }
1061
1062 int net_slirp_redir(const char *redir_str)
1063 {
1064     struct slirp_config_str *config;
1065
1066     if (QTAILQ_EMPTY(&slirp_stacks)) {
1067         config = qemu_malloc(sizeof(*config));
1068         pstrcpy(config->str, sizeof(config->str), redir_str);
1069         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1070         config->next = slirp_configs;
1071         slirp_configs = config;
1072         return 0;
1073     }
1074
1075     return slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), redir_str, 1);
1076 }
1077
1078 #ifndef _WIN32
1079
1080 /* automatic user mode samba server configuration */
1081 static void slirp_smb_cleanup(SlirpState *s)
1082 {
1083     char cmd[128];
1084
1085     if (s->smb_dir[0] != '\0') {
1086         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1087         system(cmd);
1088         s->smb_dir[0] = '\0';
1089     }
1090 }
1091
1092 static int slirp_smb(SlirpState* s, const char *exported_dir,
1093                      struct in_addr vserver_addr)
1094 {
1095     static int instance;
1096     char smb_conf[128];
1097     char smb_cmdline[128];
1098     FILE *f;
1099
1100     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1101              (long)getpid(), instance++);
1102     if (mkdir(s->smb_dir, 0700) < 0) {
1103         qemu_error("could not create samba server dir '%s'\n", s->smb_dir);
1104         return -1;
1105     }
1106     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1107
1108     f = fopen(smb_conf, "w");
1109     if (!f) {
1110         slirp_smb_cleanup(s);
1111         qemu_error("could not create samba server configuration file '%s'\n",
1112                    smb_conf);
1113         return -1;
1114     }
1115     fprintf(f,
1116             "[global]\n"
1117             "private dir=%s\n"
1118             "smb ports=0\n"
1119             "socket address=127.0.0.1\n"
1120             "pid directory=%s\n"
1121             "lock directory=%s\n"
1122             "log file=%s/log.smbd\n"
1123             "smb passwd file=%s/smbpasswd\n"
1124             "security = share\n"
1125             "[qemu]\n"
1126             "path=%s\n"
1127             "read only=no\n"
1128             "guest ok=yes\n",
1129             s->smb_dir,
1130             s->smb_dir,
1131             s->smb_dir,
1132             s->smb_dir,
1133             s->smb_dir,
1134             exported_dir
1135             );
1136     fclose(f);
1137
1138     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1139              SMBD_COMMAND, smb_conf);
1140
1141     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1142         slirp_smb_cleanup(s);
1143         qemu_error("conflicting/invalid smbserver address\n");
1144         return -1;
1145     }
1146     return 0;
1147 }
1148
1149 /* automatic user mode samba server configuration (legacy interface) */
1150 int net_slirp_smb(const char *exported_dir)
1151 {
1152     struct in_addr vserver_addr = { .s_addr = 0 };
1153
1154     if (legacy_smb_export) {
1155         fprintf(stderr, "-smb given twice\n");
1156         return -1;
1157     }
1158     legacy_smb_export = exported_dir;
1159     if (!QTAILQ_EMPTY(&slirp_stacks)) {
1160         return slirp_smb(QTAILQ_FIRST(&slirp_stacks), exported_dir,
1161                          vserver_addr);
1162     }
1163     return 0;
1164 }
1165
1166 #endif /* !defined(_WIN32) */
1167
1168 struct GuestFwd {
1169     CharDriverState *hd;
1170     struct in_addr server;
1171     int port;
1172     Slirp *slirp;
1173 };
1174
1175 static int guestfwd_can_read(void *opaque)
1176 {
1177     struct GuestFwd *fwd = opaque;
1178     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1179 }
1180
1181 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1182 {
1183     struct GuestFwd *fwd = opaque;
1184     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1185 }
1186
1187 static int slirp_guestfwd(SlirpState *s, const char *config_str,
1188                           int legacy_format)
1189 {
1190     struct in_addr server = { .s_addr = 0 };
1191     struct GuestFwd *fwd;
1192     const char *p;
1193     char buf[128];
1194     char *end;
1195     int port;
1196
1197     p = config_str;
1198     if (legacy_format) {
1199         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1200             goto fail_syntax;
1201         }
1202     } else {
1203         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1204             goto fail_syntax;
1205         }
1206         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1207             goto fail_syntax;
1208         }
1209         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1210             goto fail_syntax;
1211         }
1212         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1213             goto fail_syntax;
1214         }
1215         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1216             goto fail_syntax;
1217         }
1218     }
1219     port = strtol(buf, &end, 10);
1220     if (*end != '\0' || port < 1 || port > 65535) {
1221         goto fail_syntax;
1222     }
1223
1224     fwd = qemu_malloc(sizeof(struct GuestFwd));
1225     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1226     fwd->hd = qemu_chr_open(buf, p, NULL);
1227     if (!fwd->hd) {
1228         qemu_error("could not open guest forwarding device '%s'\n", buf);
1229         qemu_free(fwd);
1230         return -1;
1231     }
1232
1233     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1234         qemu_error("conflicting/invalid host:port in guest forwarding "
1235                    "rule '%s'\n", config_str);
1236         qemu_free(fwd);
1237         return -1;
1238     }
1239     fwd->server = server;
1240     fwd->port = port;
1241     fwd->slirp = s->slirp;
1242
1243     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1244                           NULL, fwd);
1245     return 0;
1246
1247  fail_syntax:
1248     qemu_error("invalid guest forwarding rule '%s'\n", config_str);
1249     return -1;
1250 }
1251
1252 void do_info_usernet(Monitor *mon)
1253 {
1254     SlirpState *s;
1255
1256     QTAILQ_FOREACH(s, &slirp_stacks, entry) {
1257         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1258         slirp_connection_info(s->slirp, mon);
1259     }
1260 }
1261
1262 #endif /* CONFIG_SLIRP */
1263
1264 #if defined(_WIN32)
1265 int tap_has_vnet_hdr(VLANClientState *vc)
1266 {
1267     return 0;
1268 }
1269 void tap_using_vnet_hdr(VLANClientState *vc, int using_vnet_hdr)
1270 {
1271 }
1272 #else /* !defined(_WIN32) */
1273
1274 /* Maximum GSO packet size (64k) plus plenty of room for
1275  * the ethernet and virtio_net headers
1276  */
1277 #define TAP_BUFSIZE (4096 + 65536)
1278
1279 typedef struct TAPState {
1280     VLANClientState *vc;
1281     int fd;
1282     char down_script[1024];
1283     char down_script_arg[128];
1284     uint8_t buf[TAP_BUFSIZE];
1285     unsigned int read_poll : 1;
1286     unsigned int write_poll : 1;
1287     unsigned int has_vnet_hdr : 1;
1288     unsigned int using_vnet_hdr : 1;
1289 } TAPState;
1290
1291 static int launch_script(const char *setup_script, const char *ifname, int fd);
1292
1293 static int tap_can_send(void *opaque);
1294 static void tap_send(void *opaque);
1295 static void tap_writable(void *opaque);
1296
1297 static void tap_update_fd_handler(TAPState *s)
1298 {
1299     qemu_set_fd_handler2(s->fd,
1300                          s->read_poll  ? tap_can_send : NULL,
1301                          s->read_poll  ? tap_send     : NULL,
1302                          s->write_poll ? tap_writable : NULL,
1303                          s);
1304 }
1305
1306 static void tap_read_poll(TAPState *s, int enable)
1307 {
1308     s->read_poll = !!enable;
1309     tap_update_fd_handler(s);
1310 }
1311
1312 static void tap_write_poll(TAPState *s, int enable)
1313 {
1314     s->write_poll = !!enable;
1315     tap_update_fd_handler(s);
1316 }
1317
1318 static void tap_writable(void *opaque)
1319 {
1320     TAPState *s = opaque;
1321
1322     tap_write_poll(s, 0);
1323
1324     qemu_flush_queued_packets(s->vc);
1325 }
1326
1327 static ssize_t tap_write_packet(TAPState *s, const struct iovec *iov, int iovcnt)
1328 {
1329     ssize_t len;
1330
1331     do {
1332         len = writev(s->fd, iov, iovcnt);
1333     } while (len == -1 && errno == EINTR);
1334
1335     if (len == -1 && errno == EAGAIN) {
1336         tap_write_poll(s, 1);
1337         return 0;
1338     }
1339
1340     return len;
1341 }
1342
1343 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1344                                int iovcnt)
1345 {
1346     TAPState *s = vc->opaque;
1347     const struct iovec *iovp = iov;
1348     struct iovec iov_copy[iovcnt + 1];
1349     struct virtio_net_hdr hdr = { 0, };
1350
1351     if (s->has_vnet_hdr && !s->using_vnet_hdr) {
1352         iov_copy[0].iov_base = &hdr;
1353         iov_copy[0].iov_len =  sizeof(hdr);
1354         memcpy(&iov_copy[1], iov, iovcnt * sizeof(*iov));
1355         iovp = iov_copy;
1356         iovcnt++;
1357     }
1358
1359     return tap_write_packet(s, iovp, iovcnt);
1360 }
1361
1362 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1363 {
1364     TAPState *s = vc->opaque;
1365     struct iovec iov[2];
1366     int iovcnt = 0;
1367     struct virtio_net_hdr hdr = { 0, };
1368
1369     if (s->has_vnet_hdr && !s->using_vnet_hdr) {
1370         iov[iovcnt].iov_base = &hdr;
1371         iov[iovcnt].iov_len  = sizeof(hdr);
1372         iovcnt++;
1373     }
1374
1375     iov[iovcnt].iov_base = (char *)buf;
1376     iov[iovcnt].iov_len  = size;
1377     iovcnt++;
1378
1379     return tap_write_packet(s, iov, iovcnt);
1380 }
1381
1382 static int tap_can_send(void *opaque)
1383 {
1384     TAPState *s = opaque;
1385
1386     return qemu_can_send_packet(s->vc);
1387 }
1388
1389 #ifdef __sun__
1390 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1391 {
1392     struct strbuf sbuf;
1393     int f = 0;
1394
1395     sbuf.maxlen = maxlen;
1396     sbuf.buf = (char *)buf;
1397
1398     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1399 }
1400 #else
1401 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1402 {
1403     return read(tapfd, buf, maxlen);
1404 }
1405 #endif
1406
1407 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1408 {
1409     TAPState *s = vc->opaque;
1410     tap_read_poll(s, 1);
1411 }
1412
1413 static void tap_send(void *opaque)
1414 {
1415     TAPState *s = opaque;
1416     int size;
1417
1418     do {
1419         uint8_t *buf = s->buf;
1420
1421         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1422         if (size <= 0) {
1423             break;
1424         }
1425
1426         if (s->has_vnet_hdr && !s->using_vnet_hdr) {
1427             buf  += sizeof(struct virtio_net_hdr);
1428             size -= sizeof(struct virtio_net_hdr);
1429         }
1430
1431         size = qemu_send_packet_async(s->vc, buf, size, tap_send_completed);
1432         if (size == 0) {
1433             tap_read_poll(s, 0);
1434         }
1435     } while (size > 0);
1436 }
1437
1438 /* sndbuf should be set to a value lower than the tx queue
1439  * capacity of any destination network interface.
1440  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1441  * a good default, given a 1500 byte MTU.
1442  */
1443 #define TAP_DEFAULT_SNDBUF 1024*1024
1444
1445 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1446 {
1447     int sndbuf;
1448
1449     sndbuf = qemu_opt_get_size(opts, "sndbuf", TAP_DEFAULT_SNDBUF);
1450     if (!sndbuf) {
1451         sndbuf = INT_MAX;
1452     }
1453
1454     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && qemu_opt_get(opts, "sndbuf")) {
1455         qemu_error("TUNSETSNDBUF ioctl failed: %s\n", strerror(errno));
1456         return -1;
1457     }
1458     return 0;
1459 }
1460
1461 int tap_has_vnet_hdr(VLANClientState *vc)
1462 {
1463     TAPState *s = vc->opaque;
1464
1465     assert(vc->type == NET_CLIENT_TYPE_TAP);
1466
1467     return s->has_vnet_hdr;
1468 }
1469
1470 void tap_using_vnet_hdr(VLANClientState *vc, int using_vnet_hdr)
1471 {
1472     TAPState *s = vc->opaque;
1473
1474     using_vnet_hdr = using_vnet_hdr != 0;
1475
1476     assert(vc->type == NET_CLIENT_TYPE_TAP);
1477     assert(s->has_vnet_hdr == using_vnet_hdr);
1478
1479     s->using_vnet_hdr = using_vnet_hdr;
1480 }
1481
1482 static int tap_probe_vnet_hdr(int fd)
1483 {
1484     struct ifreq ifr;
1485
1486     if (ioctl(fd, TUNGETIFF, &ifr) != 0) {
1487         qemu_error("TUNGETIFF ioctl() failed: %s\n", strerror(errno));
1488         return 0;
1489     }
1490
1491     return ifr.ifr_flags & IFF_VNET_HDR;
1492 }
1493
1494 static void tap_cleanup(VLANClientState *vc)
1495 {
1496     TAPState *s = vc->opaque;
1497
1498     qemu_purge_queued_packets(vc);
1499
1500     if (s->down_script[0])
1501         launch_script(s->down_script, s->down_script_arg, s->fd);
1502
1503     tap_read_poll(s, 0);
1504     tap_write_poll(s, 0);
1505     close(s->fd);
1506     qemu_free(s);
1507 }
1508
1509 /* fd support */
1510
1511 static TAPState *net_tap_fd_init(VLANState *vlan,
1512                                  const char *model,
1513                                  const char *name,
1514                                  int fd,
1515                                  int vnet_hdr)
1516 {
1517     TAPState *s;
1518
1519     s = qemu_mallocz(sizeof(TAPState));
1520     s->fd = fd;
1521     s->has_vnet_hdr = vnet_hdr != 0;
1522     s->using_vnet_hdr = 0;
1523     s->vc = qemu_new_vlan_client(NET_CLIENT_TYPE_TAP,
1524                                  vlan, NULL, model, name, NULL,
1525                                  tap_receive, tap_receive_iov,
1526                                  tap_cleanup, s);
1527     tap_read_poll(s, 1);
1528     return s;
1529 }
1530
1531 #if defined (CONFIG_BSD) || defined (__FreeBSD_kernel__)
1532 static int tap_open(char *ifname, int ifname_size,
1533                     int *vnet_hdr, int vnet_hdr_required)
1534 {
1535     int fd;
1536     char *dev;
1537     struct stat s;
1538
1539     TFR(fd = open("/dev/tap", O_RDWR));
1540     if (fd < 0) {
1541         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1542         return -1;
1543     }
1544
1545     fstat(fd, &s);
1546     dev = devname(s.st_rdev, S_IFCHR);
1547     pstrcpy(ifname, ifname_size, dev);
1548
1549     fcntl(fd, F_SETFL, O_NONBLOCK);
1550     return fd;
1551 }
1552 #elif defined(__sun__)
1553 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1554 /*
1555  * Allocate TAP device, returns opened fd.
1556  * Stores dev name in the first arg(must be large enough).
1557  */
1558 static int tap_alloc(char *dev, size_t dev_size)
1559 {
1560     int tap_fd, if_fd, ppa = -1;
1561     static int ip_fd = 0;
1562     char *ptr;
1563
1564     static int arp_fd = 0;
1565     int ip_muxid, arp_muxid;
1566     struct strioctl  strioc_if, strioc_ppa;
1567     int link_type = I_PLINK;;
1568     struct lifreq ifr;
1569     char actual_name[32] = "";
1570
1571     memset(&ifr, 0x0, sizeof(ifr));
1572
1573     if( *dev ){
1574        ptr = dev;
1575        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1576        ppa = atoi(ptr);
1577     }
1578
1579     /* Check if IP device was opened */
1580     if( ip_fd )
1581        close(ip_fd);
1582
1583     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1584     if (ip_fd < 0) {
1585        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1586        return -1;
1587     }
1588
1589     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1590     if (tap_fd < 0) {
1591        syslog(LOG_ERR, "Can't open /dev/tap");
1592        return -1;
1593     }
1594
1595     /* Assign a new PPA and get its unit number. */
1596     strioc_ppa.ic_cmd = TUNNEWPPA;
1597     strioc_ppa.ic_timout = 0;
1598     strioc_ppa.ic_len = sizeof(ppa);
1599     strioc_ppa.ic_dp = (char *)&ppa;
1600     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1601        syslog (LOG_ERR, "Can't assign new interface");
1602
1603     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1604     if (if_fd < 0) {
1605        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1606        return -1;
1607     }
1608     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1609        syslog(LOG_ERR, "Can't push IP module");
1610        return -1;
1611     }
1612
1613     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1614         syslog(LOG_ERR, "Can't get flags\n");
1615
1616     snprintf (actual_name, 32, "tap%d", ppa);
1617     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1618
1619     ifr.lifr_ppa = ppa;
1620     /* Assign ppa according to the unit number returned by tun device */
1621
1622     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1623         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1624     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1625         syslog (LOG_ERR, "Can't get flags\n");
1626     /* Push arp module to if_fd */
1627     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1628         syslog (LOG_ERR, "Can't push ARP module (2)");
1629
1630     /* Push arp module to ip_fd */
1631     if (ioctl (ip_fd, I_POP, NULL) < 0)
1632         syslog (LOG_ERR, "I_POP failed\n");
1633     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1634         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1635     /* Open arp_fd */
1636     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1637     if (arp_fd < 0)
1638        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1639
1640     /* Set ifname to arp */
1641     strioc_if.ic_cmd = SIOCSLIFNAME;
1642     strioc_if.ic_timout = 0;
1643     strioc_if.ic_len = sizeof(ifr);
1644     strioc_if.ic_dp = (char *)&ifr;
1645     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1646         syslog (LOG_ERR, "Can't set ifname to arp\n");
1647     }
1648
1649     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1650        syslog(LOG_ERR, "Can't link TAP device to IP");
1651        return -1;
1652     }
1653
1654     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1655         syslog (LOG_ERR, "Can't link TAP device to ARP");
1656
1657     close (if_fd);
1658
1659     memset(&ifr, 0x0, sizeof(ifr));
1660     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1661     ifr.lifr_ip_muxid  = ip_muxid;
1662     ifr.lifr_arp_muxid = arp_muxid;
1663
1664     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1665     {
1666       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1667       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1668       syslog (LOG_ERR, "Can't set multiplexor id");
1669     }
1670
1671     snprintf(dev, dev_size, "tap%d", ppa);
1672     return tap_fd;
1673 }
1674
1675 static int tap_open(char *ifname, int ifname_size,
1676                     int *vnet_hdr, int vnet_hdr_required)
1677 {
1678     char  dev[10]="";
1679     int fd;
1680     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1681        fprintf(stderr, "Cannot allocate TAP device\n");
1682        return -1;
1683     }
1684     pstrcpy(ifname, ifname_size, dev);
1685     fcntl(fd, F_SETFL, O_NONBLOCK);
1686     return fd;
1687 }
1688 #elif defined (_AIX)
1689 static int tap_open(char *ifname, int ifname_size,
1690                     int *vnet_hdr, int vnet_hdr_required)
1691 {
1692     fprintf (stderr, "no tap on AIX\n");
1693     return -1;
1694 }
1695 #else
1696 static int tap_open(char *ifname, int ifname_size,
1697                     int *vnet_hdr, int vnet_hdr_required)
1698 {
1699     struct ifreq ifr;
1700     int fd, ret;
1701
1702     TFR(fd = open("/dev/net/tun", O_RDWR));
1703     if (fd < 0) {
1704         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1705         return -1;
1706     }
1707     memset(&ifr, 0, sizeof(ifr));
1708     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1709
1710     if (*vnet_hdr) {
1711         unsigned int features;
1712
1713         if (ioctl(fd, TUNGETFEATURES, &features) == 0 &&
1714             features & IFF_VNET_HDR) {
1715             *vnet_hdr = 1;
1716             ifr.ifr_flags |= IFF_VNET_HDR;
1717         }
1718
1719         if (vnet_hdr_required && !*vnet_hdr) {
1720             qemu_error("vnet_hdr=1 requested, but no kernel "
1721                        "support for IFF_VNET_HDR available");
1722             close(fd);
1723             return -1;
1724         }
1725     }
1726
1727     if (ifname[0] != '\0')
1728         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1729     else
1730         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1731     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1732     if (ret != 0) {
1733         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1734         close(fd);
1735         return -1;
1736     }
1737     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1738     fcntl(fd, F_SETFL, O_NONBLOCK);
1739     return fd;
1740 }
1741 #endif
1742
1743 static int launch_script(const char *setup_script, const char *ifname, int fd)
1744 {
1745     sigset_t oldmask, mask;
1746     int pid, status;
1747     char *args[3];
1748     char **parg;
1749
1750     sigemptyset(&mask);
1751     sigaddset(&mask, SIGCHLD);
1752     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1753
1754     /* try to launch network script */
1755     pid = fork();
1756     if (pid == 0) {
1757         int open_max = sysconf(_SC_OPEN_MAX), i;
1758
1759         for (i = 0; i < open_max; i++) {
1760             if (i != STDIN_FILENO &&
1761                 i != STDOUT_FILENO &&
1762                 i != STDERR_FILENO &&
1763                 i != fd) {
1764                 close(i);
1765             }
1766         }
1767         parg = args;
1768         *parg++ = (char *)setup_script;
1769         *parg++ = (char *)ifname;
1770         *parg++ = NULL;
1771         execv(setup_script, args);
1772         _exit(1);
1773     } else if (pid > 0) {
1774         while (waitpid(pid, &status, 0) != pid) {
1775             /* loop */
1776         }
1777         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1778
1779         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1780             return 0;
1781         }
1782     }
1783     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1784     return -1;
1785 }
1786
1787 static int net_tap_init(QemuOpts *opts, int *vnet_hdr)
1788 {
1789     int fd, vnet_hdr_required;
1790     char ifname[128] = {0,};
1791     const char *setup_script;
1792
1793     if (qemu_opt_get(opts, "ifname")) {
1794         pstrcpy(ifname, sizeof(ifname), qemu_opt_get(opts, "ifname"));
1795     }
1796
1797     *vnet_hdr = qemu_opt_get_bool(opts, "vnet_hdr", 1);
1798     if (qemu_opt_get(opts, "vnet_hdr")) {
1799         vnet_hdr_required = *vnet_hdr;
1800     } else {
1801         vnet_hdr_required = 0;
1802     }
1803
1804     TFR(fd = tap_open(ifname, sizeof(ifname), vnet_hdr, vnet_hdr_required));
1805     if (fd < 0) {
1806         return -1;
1807     }
1808
1809     setup_script = qemu_opt_get(opts, "script");
1810     if (setup_script &&
1811         setup_script[0] != '\0' &&
1812         strcmp(setup_script, "no") != 0 &&
1813         launch_script(setup_script, ifname, fd)) {
1814         close(fd);
1815         return -1;
1816     }
1817
1818     qemu_opt_set(opts, "ifname", ifname);
1819
1820     return fd;
1821 }
1822
1823 #endif /* !_WIN32 */
1824
1825 #if defined(CONFIG_VDE)
1826 typedef struct VDEState {
1827     VLANClientState *vc;
1828     VDECONN *vde;
1829 } VDEState;
1830
1831 static void vde_to_qemu(void *opaque)
1832 {
1833     VDEState *s = opaque;
1834     uint8_t buf[4096];
1835     int size;
1836
1837     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1838     if (size > 0) {
1839         qemu_send_packet(s->vc, buf, size);
1840     }
1841 }
1842
1843 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1844 {
1845     VDEState *s = vc->opaque;
1846     ssize_t ret;
1847
1848     do {
1849       ret = vde_send(s->vde, (const char *)buf, size, 0);
1850     } while (ret < 0 && errno == EINTR);
1851
1852     return ret;
1853 }
1854
1855 static void vde_cleanup(VLANClientState *vc)
1856 {
1857     VDEState *s = vc->opaque;
1858     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1859     vde_close(s->vde);
1860     qemu_free(s);
1861 }
1862
1863 static int net_vde_init(VLANState *vlan, const char *model,
1864                         const char *name, const char *sock,
1865                         int port, const char *group, int mode)
1866 {
1867     VDEState *s;
1868     char *init_group = (char *)group;
1869     char *init_sock = (char *)sock;
1870
1871     struct vde_open_args args = {
1872         .port = port,
1873         .group = init_group,
1874         .mode = mode,
1875     };
1876
1877     s = qemu_mallocz(sizeof(VDEState));
1878     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1879     if (!s->vde){
1880         free(s);
1881         return -1;
1882     }
1883     s->vc = qemu_new_vlan_client(NET_CLIENT_TYPE_VDE,
1884                                  vlan, NULL, model, name, NULL,
1885                                  vde_receive, NULL,
1886                                  vde_cleanup, s);
1887     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1888     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1889              sock, vde_datafd(s->vde));
1890     return 0;
1891 }
1892 #endif
1893
1894 /* network connection */
1895 typedef struct NetSocketState {
1896     VLANClientState *vc;
1897     int fd;
1898     int state; /* 0 = getting length, 1 = getting data */
1899     unsigned int index;
1900     unsigned int packet_len;
1901     uint8_t buf[4096];
1902     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1903 } NetSocketState;
1904
1905 typedef struct NetSocketListenState {
1906     VLANState *vlan;
1907     char *model;
1908     char *name;
1909     int fd;
1910 } NetSocketListenState;
1911
1912 /* XXX: we consider we can send the whole packet without blocking */
1913 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1914 {
1915     NetSocketState *s = vc->opaque;
1916     uint32_t len;
1917     len = htonl(size);
1918
1919     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1920     return send_all(s->fd, buf, size);
1921 }
1922
1923 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1924 {
1925     NetSocketState *s = vc->opaque;
1926
1927     return sendto(s->fd, (const void *)buf, size, 0,
1928                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
1929 }
1930
1931 static void net_socket_send(void *opaque)
1932 {
1933     NetSocketState *s = opaque;
1934     int size, err;
1935     unsigned l;
1936     uint8_t buf1[4096];
1937     const uint8_t *buf;
1938
1939     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
1940     if (size < 0) {
1941         err = socket_error();
1942         if (err != EWOULDBLOCK)
1943             goto eoc;
1944     } else if (size == 0) {
1945         /* end of connection */
1946     eoc:
1947         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1948         closesocket(s->fd);
1949         return;
1950     }
1951     buf = buf1;
1952     while (size > 0) {
1953         /* reassemble a packet from the network */
1954         switch(s->state) {
1955         case 0:
1956             l = 4 - s->index;
1957             if (l > size)
1958                 l = size;
1959             memcpy(s->buf + s->index, buf, l);
1960             buf += l;
1961             size -= l;
1962             s->index += l;
1963             if (s->index == 4) {
1964                 /* got length */
1965                 s->packet_len = ntohl(*(uint32_t *)s->buf);
1966                 s->index = 0;
1967                 s->state = 1;
1968             }
1969             break;
1970         case 1:
1971             l = s->packet_len - s->index;
1972             if (l > size)
1973                 l = size;
1974             if (s->index + l <= sizeof(s->buf)) {
1975                 memcpy(s->buf + s->index, buf, l);
1976             } else {
1977                 fprintf(stderr, "serious error: oversized packet received,"
1978                     "connection terminated.\n");
1979                 s->state = 0;
1980                 goto eoc;
1981             }
1982
1983             s->index += l;
1984             buf += l;
1985             size -= l;
1986             if (s->index >= s->packet_len) {
1987                 qemu_send_packet(s->vc, s->buf, s->packet_len);
1988                 s->index = 0;
1989                 s->state = 0;
1990             }
1991             break;
1992         }
1993     }
1994 }
1995
1996 static void net_socket_send_dgram(void *opaque)
1997 {
1998     NetSocketState *s = opaque;
1999     int size;
2000
2001     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
2002     if (size < 0)
2003         return;
2004     if (size == 0) {
2005         /* end of connection */
2006         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
2007         return;
2008     }
2009     qemu_send_packet(s->vc, s->buf, size);
2010 }
2011
2012 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
2013 {
2014     struct ip_mreq imr;
2015     int fd;
2016     int val, ret;
2017     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
2018         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
2019                 inet_ntoa(mcastaddr->sin_addr),
2020                 (int)ntohl(mcastaddr->sin_addr.s_addr));
2021         return -1;
2022
2023     }
2024     fd = socket(PF_INET, SOCK_DGRAM, 0);
2025     if (fd < 0) {
2026         perror("socket(PF_INET, SOCK_DGRAM)");
2027         return -1;
2028     }
2029
2030     val = 1;
2031     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
2032                    (const char *)&val, sizeof(val));
2033     if (ret < 0) {
2034         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
2035         goto fail;
2036     }
2037
2038     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
2039     if (ret < 0) {
2040         perror("bind");
2041         goto fail;
2042     }
2043
2044     /* Add host to multicast group */
2045     imr.imr_multiaddr = mcastaddr->sin_addr;
2046     imr.imr_interface.s_addr = htonl(INADDR_ANY);
2047
2048     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
2049                      (const char *)&imr, sizeof(struct ip_mreq));
2050     if (ret < 0) {
2051         perror("setsockopt(IP_ADD_MEMBERSHIP)");
2052         goto fail;
2053     }
2054
2055     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
2056     val = 1;
2057     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
2058                    (const char *)&val, sizeof(val));
2059     if (ret < 0) {
2060         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
2061         goto fail;
2062     }
2063
2064     socket_set_nonblock(fd);
2065     return fd;
2066 fail:
2067     if (fd >= 0)
2068         closesocket(fd);
2069     return -1;
2070 }
2071
2072 static void net_socket_cleanup(VLANClientState *vc)
2073 {
2074     NetSocketState *s = vc->opaque;
2075     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
2076     close(s->fd);
2077     qemu_free(s);
2078 }
2079
2080 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
2081                                                 const char *model,
2082                                                 const char *name,
2083                                                 int fd, int is_connected)
2084 {
2085     struct sockaddr_in saddr;
2086     int newfd;
2087     socklen_t saddr_len;
2088     NetSocketState *s;
2089
2090     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
2091      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
2092      * by ONLY ONE process: we must "clone" this dgram socket --jjo
2093      */
2094
2095     if (is_connected) {
2096         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
2097             /* must be bound */
2098             if (saddr.sin_addr.s_addr==0) {
2099                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
2100                         fd);
2101                 return NULL;
2102             }
2103             /* clone dgram socket */
2104             newfd = net_socket_mcast_create(&saddr);
2105             if (newfd < 0) {
2106                 /* error already reported by net_socket_mcast_create() */
2107                 close(fd);
2108                 return NULL;
2109             }
2110             /* clone newfd to fd, close newfd */
2111             dup2(newfd, fd);
2112             close(newfd);
2113
2114         } else {
2115             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
2116                     fd, strerror(errno));
2117             return NULL;
2118         }
2119     }
2120
2121     s = qemu_mallocz(sizeof(NetSocketState));
2122     s->fd = fd;
2123
2124     s->vc = qemu_new_vlan_client(NET_CLIENT_TYPE_SOCKET,
2125                                  vlan, NULL, model, name, NULL,
2126                                  net_socket_receive_dgram, NULL,
2127                                  net_socket_cleanup, s);
2128     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
2129
2130     /* mcast: save bound address as dst */
2131     if (is_connected) s->dgram_dst=saddr;
2132
2133     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2134             "socket: fd=%d (%s mcast=%s:%d)",
2135             fd, is_connected? "cloned" : "",
2136             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2137     return s;
2138 }
2139
2140 static void net_socket_connect(void *opaque)
2141 {
2142     NetSocketState *s = opaque;
2143     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2144 }
2145
2146 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2147                                                  const char *model,
2148                                                  const char *name,
2149                                                  int fd, int is_connected)
2150 {
2151     NetSocketState *s;
2152     s = qemu_mallocz(sizeof(NetSocketState));
2153     s->fd = fd;
2154     s->vc = qemu_new_vlan_client(NET_CLIENT_TYPE_SOCKET,
2155                                  vlan, NULL, model, name, NULL,
2156                                  net_socket_receive, NULL,
2157                                  net_socket_cleanup, s);
2158     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2159              "socket: fd=%d", fd);
2160     if (is_connected) {
2161         net_socket_connect(s);
2162     } else {
2163         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2164     }
2165     return s;
2166 }
2167
2168 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2169                                           const char *model, const char *name,
2170                                           int fd, int is_connected)
2171 {
2172     int so_type = -1, optlen=sizeof(so_type);
2173
2174     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2175         (socklen_t *)&optlen)< 0) {
2176         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2177         return NULL;
2178     }
2179     switch(so_type) {
2180     case SOCK_DGRAM:
2181         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2182     case SOCK_STREAM:
2183         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2184     default:
2185         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2186         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2187         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2188     }
2189     return NULL;
2190 }
2191
2192 static void net_socket_accept(void *opaque)
2193 {
2194     NetSocketListenState *s = opaque;
2195     NetSocketState *s1;
2196     struct sockaddr_in saddr;
2197     socklen_t len;
2198     int fd;
2199
2200     for(;;) {
2201         len = sizeof(saddr);
2202         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2203         if (fd < 0 && errno != EINTR) {
2204             return;
2205         } else if (fd >= 0) {
2206             break;
2207         }
2208     }
2209     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2210     if (!s1) {
2211         closesocket(fd);
2212     } else {
2213         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2214                  "socket: connection from %s:%d",
2215                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2216     }
2217 }
2218
2219 static int net_socket_listen_init(VLANState *vlan,
2220                                   const char *model,
2221                                   const char *name,
2222                                   const char *host_str)
2223 {
2224     NetSocketListenState *s;
2225     int fd, val, ret;
2226     struct sockaddr_in saddr;
2227
2228     if (parse_host_port(&saddr, host_str) < 0)
2229         return -1;
2230
2231     s = qemu_mallocz(sizeof(NetSocketListenState));
2232
2233     fd = socket(PF_INET, SOCK_STREAM, 0);
2234     if (fd < 0) {
2235         perror("socket");
2236         return -1;
2237     }
2238     socket_set_nonblock(fd);
2239
2240     /* allow fast reuse */
2241     val = 1;
2242     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2243
2244     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2245     if (ret < 0) {
2246         perror("bind");
2247         return -1;
2248     }
2249     ret = listen(fd, 0);
2250     if (ret < 0) {
2251         perror("listen");
2252         return -1;
2253     }
2254     s->vlan = vlan;
2255     s->model = qemu_strdup(model);
2256     s->name = name ? qemu_strdup(name) : NULL;
2257     s->fd = fd;
2258     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2259     return 0;
2260 }
2261
2262 static int net_socket_connect_init(VLANState *vlan,
2263                                    const char *model,
2264                                    const char *name,
2265                                    const char *host_str)
2266 {
2267     NetSocketState *s;
2268     int fd, connected, ret, err;
2269     struct sockaddr_in saddr;
2270
2271     if (parse_host_port(&saddr, host_str) < 0)
2272         return -1;
2273
2274     fd = socket(PF_INET, SOCK_STREAM, 0);
2275     if (fd < 0) {
2276         perror("socket");
2277         return -1;
2278     }
2279     socket_set_nonblock(fd);
2280
2281     connected = 0;
2282     for(;;) {
2283         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2284         if (ret < 0) {
2285             err = socket_error();
2286             if (err == EINTR || err == EWOULDBLOCK) {
2287             } else if (err == EINPROGRESS) {
2288                 break;
2289 #ifdef _WIN32
2290             } else if (err == WSAEALREADY) {
2291                 break;
2292 #endif
2293             } else {
2294                 perror("connect");
2295                 closesocket(fd);
2296                 return -1;
2297             }
2298         } else {
2299             connected = 1;
2300             break;
2301         }
2302     }
2303     s = net_socket_fd_init(vlan, model, name, fd, connected);
2304     if (!s)
2305         return -1;
2306     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2307              "socket: connect to %s:%d",
2308              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2309     return 0;
2310 }
2311
2312 static int net_socket_mcast_init(VLANState *vlan,
2313                                  const char *model,
2314                                  const char *name,
2315                                  const char *host_str)
2316 {
2317     NetSocketState *s;
2318     int fd;
2319     struct sockaddr_in saddr;
2320
2321     if (parse_host_port(&saddr, host_str) < 0)
2322         return -1;
2323
2324
2325     fd = net_socket_mcast_create(&saddr);
2326     if (fd < 0)
2327         return -1;
2328
2329     s = net_socket_fd_init(vlan, model, name, fd, 0);
2330     if (!s)
2331         return -1;
2332
2333     s->dgram_dst = saddr;
2334
2335     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2336              "socket: mcast=%s:%d",
2337              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2338     return 0;
2339
2340 }
2341
2342 typedef struct DumpState {
2343     VLANClientState *pcap_vc;
2344     int fd;
2345     int pcap_caplen;
2346 } DumpState;
2347
2348 #define PCAP_MAGIC 0xa1b2c3d4
2349
2350 struct pcap_file_hdr {
2351     uint32_t magic;
2352     uint16_t version_major;
2353     uint16_t version_minor;
2354     int32_t thiszone;
2355     uint32_t sigfigs;
2356     uint32_t snaplen;
2357     uint32_t linktype;
2358 };
2359
2360 struct pcap_sf_pkthdr {
2361     struct {
2362         int32_t tv_sec;
2363         int32_t tv_usec;
2364     } ts;
2365     uint32_t caplen;
2366     uint32_t len;
2367 };
2368
2369 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2370 {
2371     DumpState *s = vc->opaque;
2372     struct pcap_sf_pkthdr hdr;
2373     int64_t ts;
2374     int caplen;
2375
2376     /* Early return in case of previous error. */
2377     if (s->fd < 0) {
2378         return size;
2379     }
2380
2381     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, get_ticks_per_sec());
2382     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2383
2384     hdr.ts.tv_sec = ts / 1000000;
2385     hdr.ts.tv_usec = ts % 1000000;
2386     hdr.caplen = caplen;
2387     hdr.len = size;
2388     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2389         write(s->fd, buf, caplen) != caplen) {
2390         qemu_log("-net dump write error - stop dump\n");
2391         close(s->fd);
2392         s->fd = -1;
2393     }
2394
2395     return size;
2396 }
2397
2398 static void net_dump_cleanup(VLANClientState *vc)
2399 {
2400     DumpState *s = vc->opaque;
2401
2402     close(s->fd);
2403     qemu_free(s);
2404 }
2405
2406 static int net_dump_init(VLANState *vlan, const char *device,
2407                          const char *name, const char *filename, int len)
2408 {
2409     struct pcap_file_hdr hdr;
2410     DumpState *s;
2411
2412     s = qemu_malloc(sizeof(DumpState));
2413
2414     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2415     if (s->fd < 0) {
2416         qemu_error("-net dump: can't open %s\n", filename);
2417         return -1;
2418     }
2419
2420     s->pcap_caplen = len;
2421
2422     hdr.magic = PCAP_MAGIC;
2423     hdr.version_major = 2;
2424     hdr.version_minor = 4;
2425     hdr.thiszone = 0;
2426     hdr.sigfigs = 0;
2427     hdr.snaplen = s->pcap_caplen;
2428     hdr.linktype = 1;
2429
2430     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2431         qemu_error("-net dump write error: %s\n", strerror(errno));
2432         close(s->fd);
2433         qemu_free(s);
2434         return -1;
2435     }
2436
2437     s->pcap_vc = qemu_new_vlan_client(NET_CLIENT_TYPE_DUMP,
2438                                       vlan, NULL, device, name, NULL,
2439                                       dump_receive, NULL,
2440                                       net_dump_cleanup, s);
2441     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2442              "dump to %s (len=%d)", filename, len);
2443     return 0;
2444 }
2445
2446 /* find or alloc a new VLAN */
2447 VLANState *qemu_find_vlan(int id, int allocate)
2448 {
2449     VLANState *vlan;
2450
2451     QTAILQ_FOREACH(vlan, &vlans, next) {
2452         if (vlan->id == id) {
2453             return vlan;
2454         }
2455     }
2456
2457     if (!allocate) {
2458         return NULL;
2459     }
2460
2461     vlan = qemu_mallocz(sizeof(VLANState));
2462     vlan->id = id;
2463     QTAILQ_INIT(&vlan->clients);
2464
2465     vlan->send_queue = qemu_new_net_queue(qemu_vlan_deliver_packet,
2466                                           qemu_vlan_deliver_packet_iov,
2467                                           vlan);
2468
2469     QTAILQ_INSERT_TAIL(&vlans, vlan, next);
2470
2471     return vlan;
2472 }
2473
2474 VLANClientState *qemu_find_netdev(const char *id)
2475 {
2476     VLANClientState *vc;
2477
2478     QTAILQ_FOREACH(vc, &non_vlan_clients, next) {
2479         if (!strcmp(vc->name, id)) {
2480             return vc;
2481         }
2482     }
2483
2484     return NULL;
2485 }
2486
2487 static int nic_get_free_idx(void)
2488 {
2489     int index;
2490
2491     for (index = 0; index < MAX_NICS; index++)
2492         if (!nd_table[index].used)
2493             return index;
2494     return -1;
2495 }
2496
2497 int qemu_show_nic_models(const char *arg, const char *const *models)
2498 {
2499     int i;
2500
2501     if (!arg || strcmp(arg, "?"))
2502         return 0;
2503
2504     fprintf(stderr, "qemu: Supported NIC models: ");
2505     for (i = 0 ; models[i]; i++)
2506         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2507     return 1;
2508 }
2509
2510 void qemu_check_nic_model(NICInfo *nd, const char *model)
2511 {
2512     const char *models[2];
2513
2514     models[0] = model;
2515     models[1] = NULL;
2516
2517     if (qemu_show_nic_models(nd->model, models))
2518         exit(0);
2519     if (qemu_find_nic_model(nd, models, model) < 0)
2520         exit(1);
2521 }
2522
2523 int qemu_find_nic_model(NICInfo *nd, const char * const *models,
2524                         const char *default_model)
2525 {
2526     int i;
2527
2528     if (!nd->model)
2529         nd->model = qemu_strdup(default_model);
2530
2531     for (i = 0 ; models[i]; i++) {
2532         if (strcmp(nd->model, models[i]) == 0)
2533             return i;
2534     }
2535
2536     qemu_error("qemu: Unsupported NIC model: %s\n", nd->model);
2537     return -1;
2538 }
2539
2540 static int net_handle_fd_param(Monitor *mon, const char *param)
2541 {
2542     if (!qemu_isdigit(param[0])) {
2543         int fd;
2544
2545         fd = monitor_get_fd(mon, param);
2546         if (fd == -1) {
2547             qemu_error("No file descriptor named %s found", param);
2548             return -1;
2549         }
2550
2551         return fd;
2552     } else {
2553         return strtol(param, NULL, 0);
2554     }
2555 }
2556
2557 static int net_init_nic(QemuOpts *opts,
2558                         Monitor *mon,
2559                         const char *name,
2560                         VLANState *vlan)
2561 {
2562     int idx;
2563     NICInfo *nd;
2564     const char *netdev;
2565
2566     idx = nic_get_free_idx();
2567     if (idx == -1 || nb_nics >= MAX_NICS) {
2568         qemu_error("Too Many NICs\n");
2569         return -1;
2570     }
2571
2572     nd = &nd_table[idx];
2573
2574     memset(nd, 0, sizeof(*nd));
2575
2576     if ((netdev = qemu_opt_get(opts, "netdev"))) {
2577         nd->netdev = qemu_find_netdev(netdev);
2578         if (!nd->netdev) {
2579             qemu_error("netdev '%s' not found\n", netdev);
2580             return -1;
2581         }
2582     } else {
2583         assert(vlan);
2584         nd->vlan = vlan;
2585     }
2586     if (name) {
2587         nd->name = qemu_strdup(name);
2588     }
2589     if (qemu_opt_get(opts, "model")) {
2590         nd->model = qemu_strdup(qemu_opt_get(opts, "model"));
2591     }
2592     if (qemu_opt_get(opts, "addr")) {
2593         nd->devaddr = qemu_strdup(qemu_opt_get(opts, "addr"));
2594     }
2595
2596     nd->macaddr[0] = 0x52;
2597     nd->macaddr[1] = 0x54;
2598     nd->macaddr[2] = 0x00;
2599     nd->macaddr[3] = 0x12;
2600     nd->macaddr[4] = 0x34;
2601     nd->macaddr[5] = 0x56 + idx;
2602
2603     if (qemu_opt_get(opts, "macaddr") &&
2604         parse_macaddr(nd->macaddr, qemu_opt_get(opts, "macaddr")) < 0) {
2605         qemu_error("invalid syntax for ethernet address\n");
2606         return -1;
2607     }
2608
2609     nd->nvectors = qemu_opt_get_number(opts, "vectors", NIC_NVECTORS_UNSPECIFIED);
2610     if (nd->nvectors != NIC_NVECTORS_UNSPECIFIED &&
2611         (nd->nvectors < 0 || nd->nvectors > 0x7ffffff)) {
2612         qemu_error("invalid # of vectors: %d\n", nd->nvectors);
2613         return -1;
2614     }
2615
2616     nd->used = 1;
2617     if (vlan) {
2618         nd->vlan->nb_guest_devs++;
2619     }
2620     nb_nics++;
2621
2622     return idx;
2623 }
2624
2625 #if defined(CONFIG_SLIRP)
2626 static int net_init_slirp_configs(const char *name, const char *value, void *opaque)
2627 {
2628     struct slirp_config_str *config;
2629
2630     if (strcmp(name, "hostfwd") != 0 && strcmp(name, "guestfwd") != 0) {
2631         return 0;
2632     }
2633
2634     config = qemu_mallocz(sizeof(*config));
2635
2636     pstrcpy(config->str, sizeof(config->str), value);
2637
2638     if (!strcmp(name, "hostfwd")) {
2639         config->flags = SLIRP_CFG_HOSTFWD;
2640     }
2641
2642     config->next = slirp_configs;
2643     slirp_configs = config;
2644
2645     return 0;
2646 }
2647
2648 static int net_init_slirp(QemuOpts *opts,
2649                           Monitor *mon,
2650                           const char *name,
2651                           VLANState *vlan)
2652 {
2653     struct slirp_config_str *config;
2654     const char *vhost;
2655     const char *vhostname;
2656     const char *vdhcp_start;
2657     const char *vnamesrv;
2658     const char *tftp_export;
2659     const char *bootfile;
2660     const char *smb_export;
2661     const char *vsmbsrv;
2662     char *vnet = NULL;
2663     int restricted = 0;
2664     int ret;
2665
2666     vhost       = qemu_opt_get(opts, "host");
2667     vhostname   = qemu_opt_get(opts, "hostname");
2668     vdhcp_start = qemu_opt_get(opts, "dhcpstart");
2669     vnamesrv    = qemu_opt_get(opts, "dns");
2670     tftp_export = qemu_opt_get(opts, "tftp");
2671     bootfile    = qemu_opt_get(opts, "bootfile");
2672     smb_export  = qemu_opt_get(opts, "smb");
2673     vsmbsrv     = qemu_opt_get(opts, "smbserver");
2674
2675     if (qemu_opt_get(opts, "ip")) {
2676         const char *ip = qemu_opt_get(opts, "ip");
2677         int l = strlen(ip) + strlen("/24") + 1;
2678
2679         vnet = qemu_malloc(l);
2680
2681         /* emulate legacy ip= parameter */
2682         pstrcpy(vnet, l, ip);
2683         pstrcat(vnet, l, "/24");
2684     }
2685
2686     if (qemu_opt_get(opts, "net")) {
2687         if (vnet) {
2688             qemu_free(vnet);
2689         }
2690         vnet = qemu_strdup(qemu_opt_get(opts, "net"));
2691     }
2692
2693     if (qemu_opt_get(opts, "restrict") &&
2694         qemu_opt_get(opts, "restrict")[0] == 'y') {
2695         restricted = 1;
2696     }
2697
2698     qemu_opt_foreach(opts, net_init_slirp_configs, NULL, 0);
2699
2700     ret = net_slirp_init(vlan, "user", name, restricted, vnet, vhost,
2701                          vhostname, tftp_export, bootfile, vdhcp_start,
2702                          vnamesrv, smb_export, vsmbsrv);
2703
2704     while (slirp_configs) {
2705         config = slirp_configs;
2706         slirp_configs = config->next;
2707         qemu_free(config);
2708     }
2709
2710     if (ret != -1 && vlan) {
2711         vlan->nb_host_devs++;
2712     }
2713
2714     qemu_free(vnet);
2715
2716     return ret;
2717 }
2718 #endif /* CONFIG_SLIRP */
2719
2720 #ifdef _WIN32
2721 static int net_init_tap_win32(QemuOpts *opts,
2722                               Monitor *mon,
2723                               const char *name,
2724                               VLANState *vlan)
2725 {
2726     const char *ifname;
2727
2728     ifname = qemu_opt_get(opts, "ifname");
2729
2730     if (!ifname) {
2731         qemu_error("tap: no interface name\n");
2732         return -1;
2733     }
2734
2735     if (tap_win32_init(vlan, "tap", name, ifname) == -1) {
2736         return -1;
2737     }
2738
2739     if (vlan) {
2740         vlan->nb_host_devs++;
2741     }
2742
2743     return 0;
2744 }
2745 #elif !defined(_AIX)
2746 static int net_init_tap(QemuOpts *opts,
2747                         Monitor *mon,
2748                         const char *name,
2749                         VLANState *vlan)
2750 {
2751     TAPState *s;
2752     int fd, vnet_hdr;
2753
2754     if (qemu_opt_get(opts, "fd")) {
2755         if (qemu_opt_get(opts, "ifname") ||
2756             qemu_opt_get(opts, "script") ||
2757             qemu_opt_get(opts, "downscript") ||
2758             qemu_opt_get(opts, "vnet_hdr")) {
2759             qemu_error("ifname=, script=, downscript= and vnet_hdr= is invalid with fd=\n");
2760             return -1;
2761         }
2762
2763         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2764         if (fd == -1) {
2765             return -1;
2766         }
2767
2768         fcntl(fd, F_SETFL, O_NONBLOCK);
2769
2770         vnet_hdr = tap_probe_vnet_hdr(fd);
2771     } else {
2772         if (!qemu_opt_get(opts, "script")) {
2773             qemu_opt_set(opts, "script", DEFAULT_NETWORK_SCRIPT);
2774         }
2775
2776         if (!qemu_opt_get(opts, "downscript")) {
2777             qemu_opt_set(opts, "downscript", DEFAULT_NETWORK_DOWN_SCRIPT);
2778         }
2779
2780         fd = net_tap_init(opts, &vnet_hdr);
2781     }
2782
2783     s = net_tap_fd_init(vlan, "tap", name, fd, vnet_hdr);
2784     if (!s) {
2785         close(fd);
2786         return -1;
2787     }
2788
2789     if (tap_set_sndbuf(s, opts) < 0) {
2790         return -1;
2791     }
2792
2793     if (qemu_opt_get(opts, "fd")) {
2794         snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
2795     } else {
2796         const char *ifname, *script, *downscript;
2797
2798         ifname     = qemu_opt_get(opts, "ifname");
2799         script     = qemu_opt_get(opts, "script");
2800         downscript = qemu_opt_get(opts, "downscript");
2801
2802         snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2803                  "ifname=%s,script=%s,downscript=%s",
2804                  ifname, script, downscript);
2805
2806         if (strcmp(downscript, "no") != 0) {
2807             snprintf(s->down_script, sizeof(s->down_script), "%s", downscript);
2808             snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
2809         }
2810     }
2811
2812     if (vlan) {
2813         vlan->nb_host_devs++;
2814     }
2815
2816     return 0;
2817 }
2818 #endif
2819
2820 static int net_init_socket(QemuOpts *opts,
2821                            Monitor *mon,
2822                            const char *name,
2823                            VLANState *vlan)
2824 {
2825     if (qemu_opt_get(opts, "fd")) {
2826         int fd;
2827
2828         if (qemu_opt_get(opts, "listen") ||
2829             qemu_opt_get(opts, "connect") ||
2830             qemu_opt_get(opts, "mcast")) {
2831             qemu_error("listen=, connect= and mcast= is invalid with fd=\n");
2832             return -1;
2833         }
2834
2835         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2836         if (fd == -1) {
2837             return -1;
2838         }
2839
2840         if (!net_socket_fd_init(vlan, "socket", name, fd, 1)) {
2841             close(fd);
2842             return -1;
2843         }
2844     } else if (qemu_opt_get(opts, "listen")) {
2845         const char *listen;
2846
2847         if (qemu_opt_get(opts, "fd") ||
2848             qemu_opt_get(opts, "connect") ||
2849             qemu_opt_get(opts, "mcast")) {
2850             qemu_error("fd=, connect= and mcast= is invalid with listen=\n");
2851             return -1;
2852         }
2853
2854         listen = qemu_opt_get(opts, "listen");
2855
2856         if (net_socket_listen_init(vlan, "socket", name, listen) == -1) {
2857             return -1;
2858         }
2859     } else if (qemu_opt_get(opts, "connect")) {
2860         const char *connect;
2861
2862         if (qemu_opt_get(opts, "fd") ||
2863             qemu_opt_get(opts, "listen") ||
2864             qemu_opt_get(opts, "mcast")) {
2865             qemu_error("fd=, listen= and mcast= is invalid with connect=\n");
2866             return -1;
2867         }
2868
2869         connect = qemu_opt_get(opts, "connect");
2870
2871         if (net_socket_connect_init(vlan, "socket", name, connect) == -1) {
2872             return -1;
2873         }
2874     } else if (qemu_opt_get(opts, "mcast")) {
2875         const char *mcast;
2876
2877         if (qemu_opt_get(opts, "fd") ||
2878             qemu_opt_get(opts, "connect") ||
2879             qemu_opt_get(opts, "listen")) {
2880             qemu_error("fd=, connect= and listen= is invalid with mcast=\n");
2881             return -1;
2882         }
2883
2884         mcast = qemu_opt_get(opts, "mcast");
2885
2886         if (net_socket_mcast_init(vlan, "socket", name, mcast) == -1) {
2887             return -1;
2888         }
2889     } else {
2890         qemu_error("-socket requires fd=, listen=, connect= or mcast=\n");
2891         return -1;
2892     }
2893
2894     if (vlan) {
2895         vlan->nb_host_devs++;
2896     }
2897
2898     return 0;
2899 }
2900
2901 #ifdef CONFIG_VDE
2902 static int net_init_vde(QemuOpts *opts,
2903                         Monitor *mon,
2904                         const char *name,
2905                         VLANState *vlan)
2906 {
2907     const char *sock;
2908     const char *group;
2909     int port, mode;
2910
2911     sock  = qemu_opt_get(opts, "sock");
2912     group = qemu_opt_get(opts, "group");
2913
2914     port = qemu_opt_get_number(opts, "port", 0);
2915     mode = qemu_opt_get_number(opts, "mode", 0700);
2916
2917     if (net_vde_init(vlan, "vde", name, sock, port, group, mode) == -1) {
2918         return -1;
2919     }
2920
2921     if (vlan) {
2922         vlan->nb_host_devs++;
2923     }
2924
2925     return 0;
2926 }
2927 #endif
2928
2929 static int net_init_dump(QemuOpts *opts,
2930                          Monitor *mon,
2931                          const char *name,
2932                          VLANState *vlan)
2933 {
2934     int len;
2935     const char *file;
2936     char def_file[128];
2937
2938     assert(vlan);
2939
2940     file = qemu_opt_get(opts, "file");
2941     if (!file) {
2942         snprintf(def_file, sizeof(def_file), "qemu-vlan%d.pcap", vlan->id);
2943         file = def_file;
2944     }
2945
2946     len = qemu_opt_get_size(opts, "len", 65536);
2947
2948     return net_dump_init(vlan, "dump", name, file, len);
2949 }
2950
2951 #define NET_COMMON_PARAMS_DESC                     \
2952     {                                              \
2953         .name = "type",                            \
2954         .type = QEMU_OPT_STRING,                   \
2955         .help = "net client type (nic, tap etc.)", \
2956      }, {                                          \
2957         .name = "vlan",                            \
2958         .type = QEMU_OPT_NUMBER,                   \
2959         .help = "vlan number",                     \
2960      }, {                                          \
2961         .name = "name",                            \
2962         .type = QEMU_OPT_STRING,                   \
2963         .help = "identifier for monitor commands", \
2964      }
2965
2966 typedef int (*net_client_init_func)(QemuOpts *opts,
2967                                     Monitor *mon,
2968                                     const char *name,
2969                                     VLANState *vlan);
2970
2971 /* magic number, but compiler will warn if too small */
2972 #define NET_MAX_DESC 20
2973
2974 static struct {
2975     const char *type;
2976     net_client_init_func init;
2977     QemuOptDesc desc[NET_MAX_DESC];
2978 } net_client_types[] = {
2979     {
2980         .type = "none",
2981         .desc = {
2982             NET_COMMON_PARAMS_DESC,
2983             { /* end of list */ }
2984         },
2985     }, {
2986         .type = "nic",
2987         .init = net_init_nic,
2988         .desc = {
2989             NET_COMMON_PARAMS_DESC,
2990             {
2991                 .name = "netdev",
2992                 .type = QEMU_OPT_STRING,
2993                 .help = "id of -netdev to connect to",
2994             },
2995             {
2996                 .name = "macaddr",
2997                 .type = QEMU_OPT_STRING,
2998                 .help = "MAC address",
2999             }, {
3000                 .name = "model",
3001                 .type = QEMU_OPT_STRING,
3002                 .help = "device model (e1000, rtl8139, virtio etc.)",
3003             }, {
3004                 .name = "addr",
3005                 .type = QEMU_OPT_STRING,
3006                 .help = "PCI device address",
3007             }, {
3008                 .name = "vectors",
3009                 .type = QEMU_OPT_NUMBER,
3010                 .help = "number of MSI-x vectors, 0 to disable MSI-X",
3011             },
3012             { /* end of list */ }
3013         },
3014 #ifdef CONFIG_SLIRP
3015     }, {
3016         .type = "user",
3017         .init = net_init_slirp,
3018         .desc = {
3019             NET_COMMON_PARAMS_DESC,
3020             {
3021                 .name = "hostname",
3022                 .type = QEMU_OPT_STRING,
3023                 .help = "client hostname reported by the builtin DHCP server",
3024             }, {
3025                 .name = "restrict",
3026                 .type = QEMU_OPT_STRING,
3027                 .help = "isolate the guest from the host (y|yes|n|no)",
3028             }, {
3029                 .name = "ip",
3030                 .type = QEMU_OPT_STRING,
3031                 .help = "legacy parameter, use net= instead",
3032             }, {
3033                 .name = "net",
3034                 .type = QEMU_OPT_STRING,
3035                 .help = "IP address and optional netmask",
3036             }, {
3037                 .name = "host",
3038                 .type = QEMU_OPT_STRING,
3039                 .help = "guest-visible address of the host",
3040             }, {
3041                 .name = "tftp",
3042                 .type = QEMU_OPT_STRING,
3043                 .help = "root directory of the built-in TFTP server",
3044             }, {
3045                 .name = "bootfile",
3046                 .type = QEMU_OPT_STRING,
3047                 .help = "BOOTP filename, for use with tftp=",
3048             }, {
3049                 .name = "dhcpstart",
3050                 .type = QEMU_OPT_STRING,
3051                 .help = "the first of the 16 IPs the built-in DHCP server can assign",
3052             }, {
3053                 .name = "dns",
3054                 .type = QEMU_OPT_STRING,
3055                 .help = "guest-visible address of the virtual nameserver",
3056             }, {
3057                 .name = "smb",
3058                 .type = QEMU_OPT_STRING,
3059                 .help = "root directory of the built-in SMB server",
3060             }, {
3061                 .name = "smbserver",
3062                 .type = QEMU_OPT_STRING,
3063                 .help = "IP address of the built-in SMB server",
3064             }, {
3065                 .name = "hostfwd",
3066                 .type = QEMU_OPT_STRING,
3067                 .help = "guest port number to forward incoming TCP or UDP connections",
3068             }, {
3069                 .name = "guestfwd",
3070                 .type = QEMU_OPT_STRING,
3071                 .help = "IP address and port to forward guest TCP connections",
3072             },
3073             { /* end of list */ }
3074         },
3075 #endif
3076 #ifdef _WIN32
3077     }, {
3078         .type = "tap",
3079         .init = net_init_tap_win32,
3080         .desc = {
3081             NET_COMMON_PARAMS_DESC,
3082             {
3083                 .name = "ifname",
3084                 .type = QEMU_OPT_STRING,
3085                 .help = "interface name",
3086             },
3087             { /* end of list */ }
3088         },
3089 #elif !defined(_AIX)
3090     }, {
3091         .type = "tap",
3092         .init = net_init_tap,
3093         .desc = {
3094             NET_COMMON_PARAMS_DESC,
3095             {
3096                 .name = "fd",
3097                 .type = QEMU_OPT_STRING,
3098                 .help = "file descriptor of an already opened tap",
3099             }, {
3100                 .name = "ifname",
3101                 .type = QEMU_OPT_STRING,
3102                 .help = "interface name",
3103             }, {
3104                 .name = "script",
3105                 .type = QEMU_OPT_STRING,
3106                 .help = "script to initialize the interface",
3107             }, {
3108                 .name = "downscript",
3109                 .type = QEMU_OPT_STRING,
3110                 .help = "script to shut down the interface",
3111             }, {
3112                 .name = "sndbuf",
3113                 .type = QEMU_OPT_SIZE,
3114                 .help = "send buffer limit"
3115             }, {
3116                 .name = "vnet_hdr",
3117                 .type = QEMU_OPT_BOOL,
3118                 .help = "enable the IFF_VNET_HDR flag on the tap interface"
3119             },
3120             { /* end of list */ }
3121         },
3122 #endif
3123     }, {
3124         .type = "socket",
3125         .init = net_init_socket,
3126         .desc = {
3127             NET_COMMON_PARAMS_DESC,
3128             {
3129                 .name = "fd",
3130                 .type = QEMU_OPT_STRING,
3131                 .help = "file descriptor of an already opened socket",
3132             }, {
3133                 .name = "listen",
3134                 .type = QEMU_OPT_STRING,
3135                 .help = "port number, and optional hostname, to listen on",
3136             }, {
3137                 .name = "connect",
3138                 .type = QEMU_OPT_STRING,
3139                 .help = "port number, and optional hostname, to connect to",
3140             }, {
3141                 .name = "mcast",
3142                 .type = QEMU_OPT_STRING,
3143                 .help = "UDP multicast address and port number",
3144             },
3145             { /* end of list */ }
3146         },
3147 #ifdef CONFIG_VDE
3148     }, {
3149         .type = "vde",
3150         .init = net_init_vde,
3151         .desc = {
3152             NET_COMMON_PARAMS_DESC,
3153             {
3154                 .name = "sock",
3155                 .type = QEMU_OPT_STRING,
3156                 .help = "socket path",
3157             }, {
3158                 .name = "port",
3159                 .type = QEMU_OPT_NUMBER,
3160                 .help = "port number",
3161             }, {
3162                 .name = "group",
3163                 .type = QEMU_OPT_STRING,
3164                 .help = "group owner of socket",
3165             }, {
3166                 .name = "mode",
3167                 .type = QEMU_OPT_NUMBER,
3168                 .help = "permissions for socket",
3169             },
3170             { /* end of list */ }
3171         },
3172 #endif
3173     }, {
3174         .type = "dump",
3175         .init = net_init_dump,
3176         .desc = {
3177             NET_COMMON_PARAMS_DESC,
3178             {
3179                 .name = "len",
3180                 .type = QEMU_OPT_SIZE,
3181                 .help = "per-packet size limit (64k default)",
3182             }, {
3183                 .name = "file",
3184                 .type = QEMU_OPT_STRING,
3185                 .help = "dump file path (default is qemu-vlan0.pcap)",
3186             },
3187             { /* end of list */ }
3188         },
3189     },
3190     { /* end of list */ }
3191 };
3192
3193 int net_client_init(Monitor *mon, QemuOpts *opts, int is_netdev)
3194 {
3195     const char *name;
3196     const char *type;
3197     int i;
3198
3199     type = qemu_opt_get(opts, "type");
3200     if (!type) {
3201         qemu_error("No type specified for -net\n");
3202         return -1;
3203     }
3204
3205     if (is_netdev) {
3206         if (strcmp(type, "tap") != 0 &&
3207 #ifdef CONFIG_SLIRP
3208             strcmp(type, "user") != 0 &&
3209 #endif
3210 #ifdef CONFIG_VDE
3211             strcmp(type, "vde") != 0 &&
3212 #endif
3213             strcmp(type, "socket") != 0) {
3214             qemu_error("The '%s' network backend type is not valid with -netdev\n",
3215                        type);
3216             return -1;
3217         }
3218
3219         if (qemu_opt_get(opts, "vlan")) {
3220             qemu_error("The 'vlan' parameter is not valid with -netdev\n");
3221             return -1;
3222         }
3223         if (qemu_opt_get(opts, "name")) {
3224             qemu_error("The 'name' parameter is not valid with -netdev\n");
3225             return -1;
3226         }
3227         if (!qemu_opts_id(opts)) {
3228             qemu_error("The id= parameter is required with -netdev\n");
3229             return -1;
3230         }
3231     }
3232
3233     name = qemu_opts_id(opts);
3234     if (!name) {
3235         name = qemu_opt_get(opts, "name");
3236     }
3237
3238     for (i = 0; net_client_types[i].type != NULL; i++) {
3239         if (!strcmp(net_client_types[i].type, type)) {
3240             VLANState *vlan = NULL;
3241
3242             if (qemu_opts_validate(opts, &net_client_types[i].desc[0]) == -1) {
3243                 return -1;
3244             }
3245
3246             /* Do not add to a vlan if it's a -netdev or a nic with a
3247              * netdev= parameter. */
3248             if (!(is_netdev ||
3249                   (strcmp(type, "nic") == 0 && qemu_opt_get(opts, "netdev")))) {
3250                 vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
3251             }
3252
3253             if (net_client_types[i].init) {
3254                 return net_client_types[i].init(opts, mon, name, vlan);
3255             } else {
3256                 return 0;
3257             }
3258         }
3259     }
3260
3261     qemu_error("Invalid -net type '%s'\n", type);
3262     return -1;
3263 }
3264
3265 void net_client_uninit(NICInfo *nd)
3266 {
3267     if (nd->vlan) {
3268         nd->vlan->nb_guest_devs--;
3269     }
3270     nb_nics--;
3271
3272     qemu_free(nd->model);
3273     qemu_free(nd->name);
3274     qemu_free(nd->devaddr);
3275
3276     nd->used = 0;
3277 }
3278
3279 static int net_host_check_device(const char *device)
3280 {
3281     int i;
3282     const char *valid_param_list[] = { "tap", "socket", "dump"
3283 #ifdef CONFIG_SLIRP
3284                                        ,"user"
3285 #endif
3286 #ifdef CONFIG_VDE
3287                                        ,"vde"
3288 #endif
3289     };
3290     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
3291         if (!strncmp(valid_param_list[i], device,
3292                      strlen(valid_param_list[i])))
3293             return 1;
3294     }
3295
3296     return 0;
3297 }
3298
3299 void net_host_device_add(Monitor *mon, const QDict *qdict)
3300 {
3301     const char *device = qdict_get_str(qdict, "device");
3302     const char *opts_str = qdict_get_try_str(qdict, "opts");
3303     QemuOpts *opts;
3304
3305     if (!net_host_check_device(device)) {
3306         monitor_printf(mon, "invalid host network device %s\n", device);
3307         return;
3308     }
3309
3310     opts = qemu_opts_parse(&qemu_net_opts, opts_str ? opts_str : "", NULL);
3311     if (!opts) {
3312         monitor_printf(mon, "parsing network options '%s' failed\n",
3313                        opts_str ? opts_str : "");
3314         return;
3315     }
3316
3317     qemu_opt_set(opts, "type", device);
3318
3319     if (net_client_init(mon, opts, 0) < 0) {
3320         monitor_printf(mon, "adding host network device %s failed\n", device);
3321     }
3322 }
3323
3324 void net_host_device_remove(Monitor *mon, const QDict *qdict)
3325 {
3326     VLANClientState *vc;
3327     int vlan_id = qdict_get_int(qdict, "vlan_id");
3328     const char *device = qdict_get_str(qdict, "device");
3329
3330     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
3331     if (!vc) {
3332         return;
3333     }
3334     if (!net_host_check_device(vc->model)) {
3335         monitor_printf(mon, "invalid host network device %s\n", device);
3336         return;
3337     }
3338     qemu_del_vlan_client(vc);
3339 }
3340
3341 void net_set_boot_mask(int net_boot_mask)
3342 {
3343     int i;
3344
3345     /* Only the first four NICs may be bootable */
3346     net_boot_mask = net_boot_mask & 0xF;
3347
3348     for (i = 0; i < nb_nics; i++) {
3349         if (net_boot_mask & (1 << i)) {
3350             nd_table[i].bootable = 1;
3351             net_boot_mask &= ~(1 << i);
3352         }
3353     }
3354
3355     if (net_boot_mask) {
3356         fprintf(stderr, "Cannot boot from non-existent NIC\n");
3357         exit(1);
3358     }
3359 }
3360
3361 void do_info_network(Monitor *mon)
3362 {
3363     VLANState *vlan;
3364
3365     QTAILQ_FOREACH(vlan, &vlans, next) {
3366         VLANClientState *vc;
3367
3368         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
3369
3370         QTAILQ_FOREACH(vc, &vlan->clients, next) {
3371             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
3372         }
3373     }
3374 }
3375
3376 void do_set_link(Monitor *mon, const QDict *qdict)
3377 {
3378     VLANState *vlan;
3379     VLANClientState *vc = NULL;
3380     const char *name = qdict_get_str(qdict, "name");
3381     const char *up_or_down = qdict_get_str(qdict, "up_or_down");
3382
3383     QTAILQ_FOREACH(vlan, &vlans, next) {
3384         QTAILQ_FOREACH(vc, &vlan->clients, next) {
3385             if (strcmp(vc->name, name) == 0) {
3386                 goto done;
3387             }
3388         }
3389     }
3390 done:
3391
3392     if (!vc) {
3393         monitor_printf(mon, "could not find network device '%s'\n", name);
3394         return;
3395     }
3396
3397     if (strcmp(up_or_down, "up") == 0)
3398         vc->link_down = 0;
3399     else if (strcmp(up_or_down, "down") == 0)
3400         vc->link_down = 1;
3401     else
3402         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
3403                        "valid\n", up_or_down);
3404
3405     if (vc->link_status_changed)
3406         vc->link_status_changed(vc);
3407 }
3408
3409 void net_cleanup(void)
3410 {
3411     VLANState *vlan;
3412     VLANClientState *vc, *next_vc;
3413
3414     QTAILQ_FOREACH(vlan, &vlans, next) {
3415         QTAILQ_FOREACH_SAFE(vc, &vlan->clients, next, next_vc) {
3416             qemu_del_vlan_client(vc);
3417         }
3418     }
3419
3420     QTAILQ_FOREACH_SAFE(vc, &non_vlan_clients, next, next_vc) {
3421         qemu_del_vlan_client(vc);
3422     }
3423 }
3424
3425 static void net_check_clients(void)
3426 {
3427     VLANState *vlan;
3428
3429     QTAILQ_FOREACH(vlan, &vlans, next) {
3430         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
3431             continue;
3432         if (vlan->nb_guest_devs == 0)
3433             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
3434         if (vlan->nb_host_devs == 0)
3435             fprintf(stderr,
3436                     "Warning: vlan %d is not connected to host network\n",
3437                     vlan->id);
3438     }
3439 }
3440
3441 static int net_init_client(QemuOpts *opts, void *dummy)
3442 {
3443     if (net_client_init(NULL, opts, 0) < 0)
3444         return -1;
3445     return 0;
3446 }
3447
3448 static int net_init_netdev(QemuOpts *opts, void *dummy)
3449 {
3450     return net_client_init(NULL, opts, 1);
3451 }
3452
3453 int net_init_clients(void)
3454 {
3455     if (QTAILQ_EMPTY(&qemu_net_opts.head)) {
3456         /* if no clients, we use a default config */
3457         qemu_opts_set(&qemu_net_opts, NULL, "type", "nic");
3458 #ifdef CONFIG_SLIRP
3459         qemu_opts_set(&qemu_net_opts, NULL, "type", "user");
3460 #endif
3461     }
3462
3463     QTAILQ_INIT(&vlans);
3464     QTAILQ_INIT(&non_vlan_clients);
3465
3466     if (qemu_opts_foreach(&qemu_netdev_opts, net_init_netdev, NULL, 1) == -1)
3467         return -1;
3468
3469     if (qemu_opts_foreach(&qemu_net_opts, net_init_client, NULL, 1) == -1) {
3470         return -1;
3471     }
3472
3473     net_check_clients();
3474
3475     return 0;
3476 }
3477
3478 int net_client_parse(QemuOptsList *opts_list, const char *optarg)
3479 {
3480 #if defined(CONFIG_SLIRP)
3481     /* handle legacy -net channel,port:chr */
3482     if (!strcmp(opts_list->name, "net") &&
3483         !strncmp(optarg, "channel,", strlen("channel,"))) {
3484         int ret;
3485
3486         optarg += strlen("channel,");
3487
3488         if (QTAILQ_EMPTY(&slirp_stacks)) {
3489             struct slirp_config_str *config;
3490
3491             config = qemu_malloc(sizeof(*config));
3492             pstrcpy(config->str, sizeof(config->str), optarg);
3493             config->flags = SLIRP_CFG_LEGACY;
3494             config->next = slirp_configs;
3495             slirp_configs = config;
3496             ret = 0;
3497         } else {
3498             ret = slirp_guestfwd(QTAILQ_FIRST(&slirp_stacks), optarg, 1);
3499         }
3500
3501         return ret;
3502     }
3503 #endif
3504     if (!qemu_opts_parse(opts_list, optarg, "type")) {
3505         return -1;
3506     }
3507
3508     return 0;
3509 }