net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for CONFIG_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include <linux/if_tun.h>
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef CONFIG_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #include "qemu-common.h"
 105 #include "net.h"
 106 #include "monitor.h"
 107 #include "sysemu.h"
 108 #include "qemu-timer.h"
 109 #include "qemu-char.h"
 110 #include "audio/audio.h"
 111 #include "qemu_socket.h"
 112 #include "qemu-log.h"
 113 #include "qemu-config.h"
 114
 115 #include "slirp/libslirp.h"
 116
 117 static QTAILQ_HEAD(, VLANState) vlans;
 118 static QTAILQ_HEAD(, VLANClientState) non_vlan_clients;
 119
 120 /***********************************************************/
 121 /* network device redirectors */
 122
 123 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 124 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 125 {
 126     int len, i, j, c;
 127
 128     for(i=0;i<size;i+=16) {
 129         len = size - i;
 130         if (len > 16)
 131             len = 16;
 132         fprintf(f, "%08x ", i);
 133         for(j=0;j<16;j++) {
 134             if (j < len)
 135                 fprintf(f, " %02x", buf[i+j]);
 136             else
 137                 fprintf(f, "   ");
 138         }
 139         fprintf(f, " ");
 140         for(j=0;j<len;j++) {
 141             c = buf[i+j];
 142             if (c < ' ' || c > '~')
 143                 c = '.';
 144             fprintf(f, "%c", c);
 145         }
 146         fprintf(f, "\n");
 147     }
 148 }
 149 #endif
 150
 151 static int parse_macaddr(uint8_t *macaddr, const char *p)
 152 {
 153     int i;
 154     char *last_char;
 155     long int offset;
 156
 157     errno = 0;
 158     offset = strtol(p, &last_char, 0);
 159     if (0 == errno && '\0' == *last_char &&
 160             offset >= 0 && offset <= 0xFFFFFF) {
 161         macaddr[3] = (offset & 0xFF0000) >> 16;
 162         macaddr[4] = (offset & 0xFF00) >> 8;
 163         macaddr[5] = offset & 0xFF;
 164         return 0;
 165     } else {
 166         for(i = 0; i < 6; i++) {
 167             macaddr[i] = strtol(p, (char **)&p, 16);
 168             if (i == 5) {
 169                 if (*p != '\0')
 170                     return -1;
 171             } else {
 172                 if (*p != ':' && *p != '-')
 173                     return -1;
 174                 p++;
 175             }
 176         }
 177         return 0;
 178     }
 179
 180     return -1;
 181 }
 182
 183 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 184 {
 185     const char *p, *p1;
 186     int len;
 187     p = *pp;
 188     p1 = strchr(p, sep);
 189     if (!p1)
 190         return -1;
 191     len = p1 - p;
 192     p1++;
 193     if (buf_size > 0) {
 194         if (len > buf_size - 1)
 195             len = buf_size - 1;
 196         memcpy(buf, p, len);
 197         buf[len] = '\0';
 198     }
 199     *pp = p1;
 200     return 0;
 201 }
 202
 203 int parse_host_src_port(struct sockaddr_in *haddr,
 204                         struct sockaddr_in *saddr,
 205                         const char *input_str)
 206 {
 207     char *str = strdup(input_str);
 208     char *host_str = str;
 209     char *src_str;
 210     const char *src_str2;
 211     char *ptr;
 212
 213     /*
 214      * Chop off any extra arguments at the end of the string which
 215      * would start with a comma, then fill in the src port information
 216      * if it was provided else use the "any address" and "any port".
 217      */
 218     if ((ptr = strchr(str,',')))
 219         *ptr = '\0';
 220
 221     if ((src_str = strchr(input_str,'@'))) {
 222         *src_str = '\0';
 223         src_str++;
 224     }
 225
 226     if (parse_host_port(haddr, host_str) < 0)
 227         goto fail;
 228
 229     src_str2 = src_str;
 230     if (!src_str || *src_str == '\0')
 231         src_str2 = ":0";
 232
 233     if (parse_host_port(saddr, src_str2) < 0)
 234         goto fail;
 235
 236     free(str);
 237     return(0);
 238
 239 fail:
 240     free(str);
 241     return -1;
 242 }
 243
 244 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 245 {
 246     char buf[512];
 247     struct hostent *he;
 248     const char *p, *r;
 249     int port;
 250
 251     p = str;
 252     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 253         return -1;
 254     saddr->sin_family = AF_INET;
 255     if (buf[0] == '\0') {
 256         saddr->sin_addr.s_addr = 0;
 257     } else {
 258         if (qemu_isdigit(buf[0])) {
 259             if (!inet_aton(buf, &saddr->sin_addr))
 260                 return -1;
 261         } else {
 262             if ((he = gethostbyname(buf)) == NULL)
 263                 return - 1;
 264             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 265         }
 266     }
 267     port = strtol(p, (char **)&r, 0);
 268     if (r == p)
 269         return -1;
 270     saddr->sin_port = htons(port);
 271     return 0;
 272 }
 273
 274 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 275 {
 276     snprintf(vc->info_str, sizeof(vc->info_str),
 277              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 278              vc->model,
 279              macaddr[0], macaddr[1], macaddr[2],
 280              macaddr[3], macaddr[4], macaddr[5]);
 281 }
 282
 283 static char *assign_name(VLANClientState *vc1, const char *model)
 284 {
 285     VLANState *vlan;
 286     char buf[256];
 287     int id = 0;
 288
 289     QTAILQ_FOREACH(vlan, &vlans, next) {
 290         VLANClientState *vc;
 291
 292         QTAILQ_FOREACH(vc, &vlan->clients, next) {
 293             if (vc != vc1 && strcmp(vc->model, model) == 0) {
 294                 id++;
 295             }
 296         }
 297     }
 298
 299     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 300
 301     return qemu_strdup(buf);
 302 }
 303
 304 static ssize_t qemu_deliver_packet(VLANClientState *sender,
 305                                    const uint8_t *data,
 306                                    size_t size,
 307                                    void *opaque);
 308 static ssize_t qemu_deliver_packet_iov(VLANClientState *sender,
 309                                        const struct iovec *iov,
 310                                        int iovcnt,
 311                                        void *opaque);
 312
 313 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 314                                       VLANClientState *peer,
 315                                       const char *model,
 316                                       const char *name,
 317                                       NetCanReceive *can_receive,
 318                                       NetReceive *receive,
 319                                       NetReceiveIOV *receive_iov,
 320                                       NetCleanup *cleanup,
 321                                       void *opaque)
 322 {
 323     VLANClientState *vc;
 324
 325     vc = qemu_mallocz(sizeof(VLANClientState));
 326
 327     vc->model = qemu_strdup(model);
 328     if (name)
 329         vc->name = qemu_strdup(name);
 330     else
 331         vc->name = assign_name(vc, model);
 332     vc->can_receive = can_receive;
 333     vc->receive = receive;
 334     vc->receive_iov = receive_iov;
 335     vc->cleanup = cleanup;
 336     vc->opaque = opaque;
 337
 338     if (vlan) {
 339         assert(!peer);
 340         vc->vlan = vlan;
 341         QTAILQ_INSERT_TAIL(&vc->vlan->clients, vc, next);
 342     } else {
 343         if (peer) {
 344             vc->peer = peer;
 345             peer->peer = vc;
 346         }
 347         QTAILQ_INSERT_TAIL(&non_vlan_clients, vc, next);
 348
 349         vc->send_queue = qemu_new_net_queue(qemu_deliver_packet,
 350                                             qemu_deliver_packet_iov,
 351                                             vc);
 352     }
 353
 354     return vc;
 355 }
 356
 357 void qemu_del_vlan_client(VLANClientState *vc)
 358 {
 359     if (vc->vlan) {
 360         QTAILQ_REMOVE(&vc->vlan->clients, vc, next);
 361     } else {
 362         if (vc->send_queue) {
 363             qemu_del_net_queue(vc->send_queue);
 364         }
 365         QTAILQ_REMOVE(&non_vlan_clients, vc, next);
 366         if (vc->peer) {
 367             vc->peer->peer = NULL;
 368         }
 369     }
 370
 371     if (vc->cleanup) {
 372         vc->cleanup(vc);
 373     }
 374
 375     qemu_free(vc->name);
 376     qemu_free(vc->model);
 377     qemu_free(vc);
 378 }
 379
 380 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 381 {
 382     VLANClientState *vc;
 383
 384     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 385         if (vc->opaque == opaque) {
 386             return vc;
 387         }
 388     }
 389
 390     return NULL;
 391 }
 392
 393 static VLANClientState *
 394 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 395                               const char *client_str)
 396 {
 397     VLANState *vlan;
 398     VLANClientState *vc;
 399
 400     vlan = qemu_find_vlan(vlan_id, 0);
 401     if (!vlan) {
 402         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 403         return NULL;
 404     }
 405
 406     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 407         if (!strcmp(vc->name, client_str)) {
 408             break;
 409         }
 410     }
 411     if (!vc) {
 412         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 413                        client_str, vlan_id);
 414     }
 415
 416     return vc;
 417 }
 418
 419 int qemu_can_send_packet(VLANClientState *sender)
 420 {
 421     VLANState *vlan = sender->vlan;
 422     VLANClientState *vc;
 423
 424     if (sender->peer) {
 425         if (!sender->peer->can_receive ||
 426             sender->peer->can_receive(sender->peer)) {
 427             return 1;
 428         } else {
 429             return 0;
 430         }
 431     }
 432
 433     if (!sender->vlan) {
 434         return 1;
 435     }
 436
 437     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 438         if (vc == sender) {
 439             continue;
 440         }
 441
 442         /* no can_receive() handler, they can always receive */
 443         if (!vc->can_receive || vc->can_receive(vc)) {
 444             return 1;
 445         }
 446     }
 447     return 0;
 448 }
 449
 450 static ssize_t qemu_deliver_packet(VLANClientState *sender,
 451                                    const uint8_t *data,
 452                                    size_t size,
 453                                    void *opaque)
 454 {
 455     VLANClientState *vc = opaque;
 456
 457     if (vc->link_down) {
 458         return size;
 459     }
 460
 461     return vc->receive(vc, data, size);
 462 }
 463
 464 static ssize_t qemu_vlan_deliver_packet(VLANClientState *sender,
 465                                         const uint8_t *buf,
 466                                         size_t size,
 467                                         void *opaque)
 468 {
 469     VLANState *vlan = opaque;
 470     VLANClientState *vc;
 471     int ret = -1;
 472
 473     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 474         ssize_t len;
 475
 476         if (vc == sender) {
 477             continue;
 478         }
 479
 480         if (vc->link_down) {
 481             ret = size;
 482             continue;
 483         }
 484
 485         len = vc->receive(vc, buf, size);
 486
 487         ret = (ret >= 0) ? ret : len;
 488     }
 489
 490     return ret;
 491 }
 492
 493 void qemu_purge_queued_packets(VLANClientState *vc)
 494 {
 495     NetQueue *queue;
 496
 497     if (!vc->peer && !vc->vlan) {
 498         return;
 499     }
 500
 501     if (vc->peer) {
 502         queue = vc->peer->send_queue;
 503     } else {
 504         queue = vc->vlan->send_queue;
 505     }
 506
 507     qemu_net_queue_purge(queue, vc);
 508 }
 509
 510 void qemu_flush_queued_packets(VLANClientState *vc)
 511 {
 512     NetQueue *queue;
 513
 514     if (vc->vlan) {
 515         queue = vc->vlan->send_queue;
 516     } else {
 517         queue = vc->send_queue;
 518     }
 519
 520     qemu_net_queue_flush(queue);
 521 }
 522
 523 ssize_t qemu_send_packet_async(VLANClientState *sender,
 524                                const uint8_t *buf, int size,
 525                                NetPacketSent *sent_cb)
 526 {
 527     NetQueue *queue;
 528
 529 #ifdef DEBUG_NET
 530     printf("qemu_send_packet_async:\n");
 531     hex_dump(stdout, buf, size);
 532 #endif
 533
 534     if (sender->link_down || (!sender->peer && !sender->vlan)) {
 535         return size;
 536     }
 537
 538     if (sender->peer) {
 539         queue = sender->peer->send_queue;
 540     } else {
 541         queue = sender->vlan->send_queue;
 542     }
 543
 544     return qemu_net_queue_send(queue, sender, buf, size, sent_cb);
 545 }
 546
 547 void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size)
 548 {
 549     qemu_send_packet_async(vc, buf, size, NULL);
 550 }
 551
 552 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 553                                int iovcnt)
 554 {
 555     uint8_t buffer[4096];
 556     size_t offset = 0;
 557     int i;
 558
 559     for (i = 0; i < iovcnt; i++) {
 560         size_t len;
 561
 562         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 563         memcpy(buffer + offset, iov[i].iov_base, len);
 564         offset += len;
 565     }
 566
 567     return vc->receive(vc, buffer, offset);
 568 }
 569
 570 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 571 {
 572     size_t offset = 0;
 573     int i;
 574
 575     for (i = 0; i < iovcnt; i++)
 576         offset += iov[i].iov_len;
 577     return offset;
 578 }
 579
 580 static ssize_t qemu_deliver_packet_iov(VLANClientState *sender,
 581                                        const struct iovec *iov,
 582                                        int iovcnt,
 583                                        void *opaque)
 584 {
 585     VLANClientState *vc = opaque;
 586
 587     if (vc->link_down) {
 588         return calc_iov_length(iov, iovcnt);
 589     }
 590
 591     if (vc->receive_iov) {
 592         return vc->receive_iov(vc, iov, iovcnt);
 593     } else {
 594         return vc_sendv_compat(vc, iov, iovcnt);
 595     }
 596 }
 597
 598 static ssize_t qemu_vlan_deliver_packet_iov(VLANClientState *sender,
 599                                             const struct iovec *iov,
 600                                             int iovcnt,
 601                                             void *opaque)
 602 {
 603     VLANState *vlan = opaque;
 604     VLANClientState *vc;
 605     ssize_t ret = -1;
 606
 607     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 608         ssize_t len;
 609
 610         if (vc == sender) {
 611             continue;
 612         }
 613
 614         if (vc->link_down) {
 615             ret = calc_iov_length(iov, iovcnt);
 616             continue;
 617         }
 618
 619         if (vc->receive_iov) {
 620             len = vc->receive_iov(vc, iov, iovcnt);
 621         } else {
 622             len = vc_sendv_compat(vc, iov, iovcnt);
 623         }
 624
 625         ret = (ret >= 0) ? ret : len;
 626     }
 627
 628     return ret;
 629 }
 630
 631 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 632                                 const struct iovec *iov, int iovcnt,
 633                                 NetPacketSent *sent_cb)
 634 {
 635     NetQueue *queue;
 636
 637     if (sender->link_down || (!sender->peer && !sender->vlan)) {
 638         return calc_iov_length(iov, iovcnt);
 639     }
 640
 641     if (sender->peer) {
 642         queue = sender->peer->send_queue;
 643     } else {
 644         queue = sender->vlan->send_queue;
 645     }
 646
 647     return qemu_net_queue_send_iov(queue, sender, iov, iovcnt, sent_cb);
 648 }
 649
 650 ssize_t
 651 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 652 {
 653     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 654 }
 655
 656 #if defined(CONFIG_SLIRP)
 657
 658 /* slirp network adapter */
 659
 660 #define SLIRP_CFG_HOSTFWD 1
 661 #define SLIRP_CFG_LEGACY  2
 662
 663 struct slirp_config_str {
 664     struct slirp_config_str *next;
 665     int flags;
 666     char str[1024];
 667     int legacy_format;
 668 };
 669
 670 typedef struct SlirpState {
 671     QTAILQ_ENTRY(SlirpState) entry;
 672     VLANClientState *vc;
 673     Slirp *slirp;
 674 #ifndef _WIN32
 675     char smb_dir[128];
 676 #endif
 677 } SlirpState;
 678
 679 static struct slirp_config_str *slirp_configs;
 680 const char *legacy_tftp_prefix;
 681 const char *legacy_bootp_filename;
 682 static QTAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 683     QTAILQ_HEAD_INITIALIZER(slirp_stacks);
 684
 685 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 686                          int legacy_format);
 687 static int slirp_guestfwd(SlirpState *s, const char *config_str,
 688                           int legacy_format);
 689
 690 #ifndef _WIN32
 691 static const char *legacy_smb_export;
 692
 693 static int slirp_smb(SlirpState *s, const char *exported_dir,
 694                      struct in_addr vserver_addr);
 695 static void slirp_smb_cleanup(SlirpState *s);
 696 #else
 697 static inline void slirp_smb_cleanup(SlirpState *s) { }
 698 #endif
 699
 700 int slirp_can_output(void *opaque)
 701 {
 702     SlirpState *s = opaque;
 703
 704     return qemu_can_send_packet(s->vc);
 705 }
 706
 707 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 708 {
 709     SlirpState *s = opaque;
 710
 711 #ifdef DEBUG_SLIRP
 712     printf("slirp output:\n");
 713     hex_dump(stdout, pkt, pkt_len);
 714 #endif
 715     qemu_send_packet(s->vc, pkt, pkt_len);
 716 }
 717
 718 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 719 {
 720     SlirpState *s = vc->opaque;
 721
 722 #ifdef DEBUG_SLIRP
 723     printf("slirp input:\n");
 724     hex_dump(stdout, buf, size);
 725 #endif
 726     slirp_input(s->slirp, buf, size);
 727     return size;
 728 }
 729
 730 static void net_slirp_cleanup(VLANClientState *vc)
 731 {
 732     SlirpState *s = vc->opaque;
 733
 734     slirp_cleanup(s->slirp);
 735     slirp_smb_cleanup(s);
 736     QTAILQ_REMOVE(&slirp_stacks, s, entry);
 737     qemu_free(s);
 738 }
 739
 740 static int net_slirp_init(VLANState *vlan, const char *model,
 741                           const char *name, int restricted,
 742                           const char *vnetwork, const char *vhost,
 743                           const char *vhostname, const char *tftp_export,
 744                           const char *bootfile, const char *vdhcp_start,
 745                           const char *vnameserver, const char *smb_export,
 746                           const char *vsmbserver)
 747 {
 748     /* default settings according to historic slirp */
 749     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 750     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 751     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 752     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 753     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 754 #ifndef _WIN32
 755     struct in_addr smbsrv = { .s_addr = 0 };
 756 #endif
 757     SlirpState *s;
 758     char buf[20];
 759     uint32_t addr;
 760     int shift;
 761     char *end;
 762     struct slirp_config_str *config;
 763
 764     if (!tftp_export) {
 765         tftp_export = legacy_tftp_prefix;
 766     }
 767     if (!bootfile) {
 768         bootfile = legacy_bootp_filename;
 769     }
 770
 771     if (vnetwork) {
 772         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 773             if (!inet_aton(vnetwork, &net)) {
 774                 return -1;
 775             }
 776             addr = ntohl(net.s_addr);
 777             if (!(addr & 0x80000000)) {
 778                 mask.s_addr = htonl(0xff000000); /* class A */
 779             } else if ((addr & 0xfff00000) == 0xac100000) {
 780                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 781             } else if ((addr & 0xc0000000) == 0x80000000) {
 782                 mask.s_addr = htonl(0xffff0000); /* class B */
 783             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 784                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 785             } else if ((addr & 0xffff0000) == 0xc6120000) {
 786                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 787             } else if ((addr & 0xe0000000) == 0xe0000000) {
 788                 mask.s_addr = htonl(0xffffff00); /* class C */
 789             } else {
 790                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 791             }
 792         } else {
 793             if (!inet_aton(buf, &net)) {
 794                 return -1;
 795             }
 796             shift = strtol(vnetwork, &end, 10);
 797             if (*end != '\0') {
 798                 if (!inet_aton(vnetwork, &mask)) {
 799                     return -1;
 800                 }
 801             } else if (shift < 4 || shift > 32) {
 802                 return -1;
 803             } else {
 804                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 805             }
 806         }
 807         net.s_addr &= mask.s_addr;
 808         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 809         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 810         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 811     }
 812
 813     if (vhost && !inet_aton(vhost, &host)) {
 814         return -1;
 815     }
 816     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 817         return -1;
 818     }
 819
 820     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 821         return -1;
 822     }
 823     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 824         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 825         return -1;
 826     }
 827
 828     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 829         return -1;
 830     }
 831     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 832         dns.s_addr == host.s_addr) {
 833         return -1;
 834     }
 835
 836 #ifndef _WIN32
 837     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 838         return -1;
 839     }
 840 #endif
 841
 842     s = qemu_mallocz(sizeof(SlirpState));
 843     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 844                           tftp_export, bootfile, dhcp, dns, s);
 845     QTAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 846
 847     for (config = slirp_configs; config; config = config->next) {
 848         if (config->flags & SLIRP_CFG_HOSTFWD) {
 849             if (slirp_hostfwd(s, config->str,
 850                               config->flags & SLIRP_CFG_LEGACY) < 0)
 851                 return -1;
 852         } else {
 853             if (slirp_guestfwd(s, config->str,
 854                                config->flags & SLIRP_CFG_LEGACY) < 0)
 855                 return -1;
 856         }
 857     }
 858 #ifndef _WIN32
 859     if (!smb_export) {
 860         smb_export = legacy_smb_export;
 861     }
 862     if (smb_export) {
 863         if (slirp_smb(s, smb_export, smbsrv) < 0)
 864             return -1;
 865     }
 866 #endif
 867
 868     s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
 869                                  slirp_receive, NULL,
 870                                  net_slirp_cleanup, s);
 871     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 872              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 873     return 0;
 874 }
 875
 876 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 877                                 const char *stack)
 878 {
 879     VLANClientState *vc;
 880
 881     if (vlan) {
 882         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 883         if (!vc) {
 884             return NULL;
 885         }
 886         if (strcmp(vc->model, "user")) {
 887             monitor_printf(mon, "invalid device specified\n");
 888             return NULL;
 889         }
 890         return vc->opaque;
 891     } else {
 892         if (QTAILQ_EMPTY(&slirp_stacks)) {
 893             monitor_printf(mon, "user mode network stack not in use\n");
 894             return NULL;
 895         }
 896         return QTAILQ_FIRST(&slirp_stacks);
 897     }
 898 }
 899
 900 void net_slirp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 901 {
 902     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 903     int host_port;
 904     char buf[256] = "";
 905     const char *src_str, *p;
 906     SlirpState *s;
 907     int is_udp = 0;
 908     int err;
 909     const char *arg1 = qdict_get_str(qdict, "arg1");
 910     const char *arg2 = qdict_get_try_str(qdict, "arg2");
 911     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 912
 913     if (arg2) {
 914         s = slirp_lookup(mon, arg1, arg2);
 915         src_str = arg3;
 916     } else {
 917         s = slirp_lookup(mon, NULL, NULL);
 918         src_str = arg1;
 919     }
 920     if (!s) {
 921         return;
 922     }
 923
 924     if (!src_str || !src_str[0])
 925         goto fail_syntax;
 926
 927     p = src_str;
 928     get_str_sep(buf, sizeof(buf), &p, ':');
 929
 930     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 931         is_udp = 0;
 932     } else if (!strcmp(buf, "udp")) {
 933         is_udp = 1;
 934     } else {
 935         goto fail_syntax;
 936     }
 937
 938     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 939         goto fail_syntax;
 940     }
 941     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 942         goto fail_syntax;
 943     }
 944
 945     host_port = atoi(p);
 946
 947     err = slirp_remove_hostfwd(QTAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 948                                host_addr, host_port);
 949
 950     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 951                    err ? "removed" : "not found");
 952     return;
 953
 954  fail_syntax:
 955     monitor_printf(mon, "invalid format\n");
 956 }
 957
 958 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 959                          int legacy_format)
 960 {
 961     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 962     struct in_addr guest_addr = { .s_addr = 0 };
 963     int host_port, guest_port;
 964     const char *p;
 965     char buf[256];
 966     int is_udp;
 967     char *end;
 968
 969     p = redir_str;
 970     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 971         goto fail_syntax;
 972     }
 973     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 974         is_udp = 0;
 975     } else if (!strcmp(buf, "udp")) {
 976         is_udp = 1;
 977     } else {
 978         goto fail_syntax;
 979     }
 980
 981     if (!legacy_format) {
 982         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 983             goto fail_syntax;
 984         }
 985         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 986             goto fail_syntax;
 987         }
 988     }
 989
 990     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
 991         goto fail_syntax;
 992     }
 993     host_port = strtol(buf, &end, 0);
 994     if (*end != '\0' || host_port < 1 || host_port > 65535) {
 995         goto fail_syntax;
 996     }
 997
 998     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 999         goto fail_syntax;
1000     }
1001     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
1002         goto fail_syntax;
1003     }
1004
1005     guest_port = strtol(p, &end, 0);
1006     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
1007         goto fail_syntax;
1008     }
1009
1010     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
1011                           guest_port) < 0) {
1012         qemu_error("could not set up host forwarding rule '%s'\n",
1013                    redir_str);
1014         return -1;
1015     }
1016     return 0;
1017
1018  fail_syntax:
1019     qemu_error("invalid host forwarding rule '%s'\n", redir_str);
1020     return -1;
1021 }
1022
1023 void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict)
1024 {
1025     const char *redir_str;
1026     SlirpState *s;
1027     const char *arg1 = qdict_get_str(qdict, "arg1");
1028     const char *arg2 = qdict_get_try_str(qdict, "arg2");
1029     const char *arg3 = qdict_get_try_str(qdict, "arg3");
1030
1031     if (arg2) {
1032         s = slirp_lookup(mon, arg1, arg2);
1033         redir_str = arg3;
1034     } else {
1035         s = slirp_lookup(mon, NULL, NULL);
1036         redir_str = arg1;
1037     }
1038     if (s) {
1039         slirp_hostfwd(s, redir_str, 0);
1040     }
1041
1042 }
1043
1044 int net_slirp_redir(const char *redir_str)
1045 {
1046     struct slirp_config_str *config;
1047
1048     if (QTAILQ_EMPTY(&slirp_stacks)) {
1049         config = qemu_malloc(sizeof(*config));
1050         pstrcpy(config->str, sizeof(config->str), redir_str);
1051         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1052         config->next = slirp_configs;
1053         slirp_configs = config;
1054         return 0;
1055     }
1056
1057     return slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), redir_str, 1);
1058 }
1059
1060 #ifndef _WIN32
1061
1062 /* automatic user mode samba server configuration */
1063 static void slirp_smb_cleanup(SlirpState *s)
1064 {
1065     char cmd[128];
1066
1067     if (s->smb_dir[0] != '\0') {
1068         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1069         system(cmd);
1070         s->smb_dir[0] = '\0';
1071     }
1072 }
1073
1074 static int slirp_smb(SlirpState* s, const char *exported_dir,
1075                      struct in_addr vserver_addr)
1076 {
1077     static int instance;
1078     char smb_conf[128];
1079     char smb_cmdline[128];
1080     FILE *f;
1081
1082     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1083              (long)getpid(), instance++);
1084     if (mkdir(s->smb_dir, 0700) < 0) {
1085         qemu_error("could not create samba server dir '%s'\n", s->smb_dir);
1086         return -1;
1087     }
1088     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1089
1090     f = fopen(smb_conf, "w");
1091     if (!f) {
1092         slirp_smb_cleanup(s);
1093         qemu_error("could not create samba server configuration file '%s'\n",
1094                    smb_conf);
1095         return -1;
1096     }
1097     fprintf(f,
1098             "[global]\n"
1099             "private dir=%s\n"
1100             "smb ports=0\n"
1101             "socket address=127.0.0.1\n"
1102             "pid directory=%s\n"
1103             "lock directory=%s\n"
1104             "log file=%s/log.smbd\n"
1105             "smb passwd file=%s/smbpasswd\n"
1106             "security = share\n"
1107             "[qemu]\n"
1108             "path=%s\n"
1109             "read only=no\n"
1110             "guest ok=yes\n",
1111             s->smb_dir,
1112             s->smb_dir,
1113             s->smb_dir,
1114             s->smb_dir,
1115             s->smb_dir,
1116             exported_dir
1117             );
1118     fclose(f);
1119
1120     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1121              SMBD_COMMAND, smb_conf);
1122
1123     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1124         slirp_smb_cleanup(s);
1125         qemu_error("conflicting/invalid smbserver address\n");
1126         return -1;
1127     }
1128     return 0;
1129 }
1130
1131 /* automatic user mode samba server configuration (legacy interface) */
1132 int net_slirp_smb(const char *exported_dir)
1133 {
1134     struct in_addr vserver_addr = { .s_addr = 0 };
1135
1136     if (legacy_smb_export) {
1137         fprintf(stderr, "-smb given twice\n");
1138         return -1;
1139     }
1140     legacy_smb_export = exported_dir;
1141     if (!QTAILQ_EMPTY(&slirp_stacks)) {
1142         return slirp_smb(QTAILQ_FIRST(&slirp_stacks), exported_dir,
1143                          vserver_addr);
1144     }
1145     return 0;
1146 }
1147
1148 #endif /* !defined(_WIN32) */
1149
1150 struct GuestFwd {
1151     CharDriverState *hd;
1152     struct in_addr server;
1153     int port;
1154     Slirp *slirp;
1155 };
1156
1157 static int guestfwd_can_read(void *opaque)
1158 {
1159     struct GuestFwd *fwd = opaque;
1160     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1161 }
1162
1163 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1164 {
1165     struct GuestFwd *fwd = opaque;
1166     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1167 }
1168
1169 static int slirp_guestfwd(SlirpState *s, const char *config_str,
1170                           int legacy_format)
1171 {
1172     struct in_addr server = { .s_addr = 0 };
1173     struct GuestFwd *fwd;
1174     const char *p;
1175     char buf[128];
1176     char *end;
1177     int port;
1178
1179     p = config_str;
1180     if (legacy_format) {
1181         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1182             goto fail_syntax;
1183         }
1184     } else {
1185         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1186             goto fail_syntax;
1187         }
1188         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1189             goto fail_syntax;
1190         }
1191         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1192             goto fail_syntax;
1193         }
1194         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1195             goto fail_syntax;
1196         }
1197         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1198             goto fail_syntax;
1199         }
1200     }
1201     port = strtol(buf, &end, 10);
1202     if (*end != '\0' || port < 1 || port > 65535) {
1203         goto fail_syntax;
1204     }
1205
1206     fwd = qemu_malloc(sizeof(struct GuestFwd));
1207     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1208     fwd->hd = qemu_chr_open(buf, p, NULL);
1209     if (!fwd->hd) {
1210         qemu_error("could not open guest forwarding device '%s'\n", buf);
1211         qemu_free(fwd);
1212         return -1;
1213     }
1214
1215     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1216         qemu_error("conflicting/invalid host:port in guest forwarding "
1217                    "rule '%s'\n", config_str);
1218         qemu_free(fwd);
1219         return -1;
1220     }
1221     fwd->server = server;
1222     fwd->port = port;
1223     fwd->slirp = s->slirp;
1224
1225     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1226                           NULL, fwd);
1227     return 0;
1228
1229  fail_syntax:
1230     qemu_error("invalid guest forwarding rule '%s'\n", config_str);
1231     return -1;
1232 }
1233
1234 void do_info_usernet(Monitor *mon)
1235 {
1236     SlirpState *s;
1237
1238     QTAILQ_FOREACH(s, &slirp_stacks, entry) {
1239         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1240         slirp_connection_info(s->slirp, mon);
1241     }
1242 }
1243
1244 #endif /* CONFIG_SLIRP */
1245
1246 #if !defined(_WIN32)
1247
1248 typedef struct TAPState {
1249     VLANClientState *vc;
1250     int fd;
1251     char down_script[1024];
1252     char down_script_arg[128];
1253     uint8_t buf[4096];
1254     unsigned int read_poll : 1;
1255     unsigned int write_poll : 1;
1256 } TAPState;
1257
1258 static int launch_script(const char *setup_script, const char *ifname, int fd);
1259
1260 static int tap_can_send(void *opaque);
1261 static void tap_send(void *opaque);
1262 static void tap_writable(void *opaque);
1263
1264 static void tap_update_fd_handler(TAPState *s)
1265 {
1266     qemu_set_fd_handler2(s->fd,
1267                          s->read_poll  ? tap_can_send : NULL,
1268                          s->read_poll  ? tap_send     : NULL,
1269                          s->write_poll ? tap_writable : NULL,
1270                          s);
1271 }
1272
1273 static void tap_read_poll(TAPState *s, int enable)
1274 {
1275     s->read_poll = !!enable;
1276     tap_update_fd_handler(s);
1277 }
1278
1279 static void tap_write_poll(TAPState *s, int enable)
1280 {
1281     s->write_poll = !!enable;
1282     tap_update_fd_handler(s);
1283 }
1284
1285 static void tap_writable(void *opaque)
1286 {
1287     TAPState *s = opaque;
1288
1289     tap_write_poll(s, 0);
1290
1291     qemu_flush_queued_packets(s->vc);
1292 }
1293
1294 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1295                                int iovcnt)
1296 {
1297     TAPState *s = vc->opaque;
1298     ssize_t len;
1299
1300     do {
1301         len = writev(s->fd, iov, iovcnt);
1302     } while (len == -1 && errno == EINTR);
1303
1304     if (len == -1 && errno == EAGAIN) {
1305         tap_write_poll(s, 1);
1306         return 0;
1307     }
1308
1309     return len;
1310 }
1311
1312 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1313 {
1314     TAPState *s = vc->opaque;
1315     ssize_t len;
1316
1317     do {
1318         len = write(s->fd, buf, size);
1319     } while (len == -1 && (errno == EINTR || errno == EAGAIN));
1320
1321     return len;
1322 }
1323
1324 static int tap_can_send(void *opaque)
1325 {
1326     TAPState *s = opaque;
1327
1328     return qemu_can_send_packet(s->vc);
1329 }
1330
1331 #ifdef __sun__
1332 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1333 {
1334     struct strbuf sbuf;
1335     int f = 0;
1336
1337     sbuf.maxlen = maxlen;
1338     sbuf.buf = (char *)buf;
1339
1340     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1341 }
1342 #else
1343 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1344 {
1345     return read(tapfd, buf, maxlen);
1346 }
1347 #endif
1348
1349 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1350 {
1351     TAPState *s = vc->opaque;
1352     tap_read_poll(s, 1);
1353 }
1354
1355 static void tap_send(void *opaque)
1356 {
1357     TAPState *s = opaque;
1358     int size;
1359
1360     do {
1361         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1362         if (size <= 0) {
1363             break;
1364         }
1365
1366         size = qemu_send_packet_async(s->vc, s->buf, size, tap_send_completed);
1367         if (size == 0) {
1368             tap_read_poll(s, 0);
1369         }
1370     } while (size > 0);
1371 }
1372
1373 #ifdef TUNSETSNDBUF
1374 /* sndbuf should be set to a value lower than the tx queue
1375  * capacity of any destination network interface.
1376  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1377  * a good default, given a 1500 byte MTU.
1378  */
1379 #define TAP_DEFAULT_SNDBUF 1024*1024
1380
1381 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1382 {
1383     int sndbuf;
1384
1385     sndbuf = qemu_opt_get_size(opts, "sndbuf", TAP_DEFAULT_SNDBUF);
1386     if (!sndbuf) {
1387         sndbuf = INT_MAX;
1388     }
1389
1390     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && qemu_opt_get(opts, "sndbuf")) {
1391         qemu_error("TUNSETSNDBUF ioctl failed: %s\n", strerror(errno));
1392         return -1;
1393     }
1394     return 0;
1395 }
1396 #else
1397 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1398 {
1399     return 0;
1400 }
1401 #endif /* TUNSETSNDBUF */
1402
1403 static void tap_cleanup(VLANClientState *vc)
1404 {
1405     TAPState *s = vc->opaque;
1406
1407     qemu_purge_queued_packets(vc);
1408
1409     if (s->down_script[0])
1410         launch_script(s->down_script, s->down_script_arg, s->fd);
1411
1412     tap_read_poll(s, 0);
1413     tap_write_poll(s, 0);
1414     close(s->fd);
1415     qemu_free(s);
1416 }
1417
1418 /* fd support */
1419
1420 static TAPState *net_tap_fd_init(VLANState *vlan,
1421                                  const char *model,
1422                                  const char *name,
1423                                  int fd)
1424 {
1425     TAPState *s;
1426
1427     s = qemu_mallocz(sizeof(TAPState));
1428     s->fd = fd;
1429     s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
1430                                  tap_receive, tap_receive_iov,
1431                                  tap_cleanup, s);
1432     tap_read_poll(s, 1);
1433     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
1434     return s;
1435 }
1436
1437 #if defined (CONFIG_BSD) || defined (__FreeBSD_kernel__)
1438 static int tap_open(char *ifname, int ifname_size)
1439 {
1440     int fd;
1441     char *dev;
1442     struct stat s;
1443
1444     TFR(fd = open("/dev/tap", O_RDWR));
1445     if (fd < 0) {
1446         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1447         return -1;
1448     }
1449
1450     fstat(fd, &s);
1451     dev = devname(s.st_rdev, S_IFCHR);
1452     pstrcpy(ifname, ifname_size, dev);
1453
1454     fcntl(fd, F_SETFL, O_NONBLOCK);
1455     return fd;
1456 }
1457 #elif defined(__sun__)
1458 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1459 /*
1460  * Allocate TAP device, returns opened fd.
1461  * Stores dev name in the first arg(must be large enough).
1462  */
1463 static int tap_alloc(char *dev, size_t dev_size)
1464 {
1465     int tap_fd, if_fd, ppa = -1;
1466     static int ip_fd = 0;
1467     char *ptr;
1468
1469     static int arp_fd = 0;
1470     int ip_muxid, arp_muxid;
1471     struct strioctl  strioc_if, strioc_ppa;
1472     int link_type = I_PLINK;;
1473     struct lifreq ifr;
1474     char actual_name[32] = "";
1475
1476     memset(&ifr, 0x0, sizeof(ifr));
1477
1478     if( *dev ){
1479        ptr = dev;
1480        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1481        ppa = atoi(ptr);
1482     }
1483
1484     /* Check if IP device was opened */
1485     if( ip_fd )
1486        close(ip_fd);
1487
1488     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1489     if (ip_fd < 0) {
1490        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1491        return -1;
1492     }
1493
1494     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1495     if (tap_fd < 0) {
1496        syslog(LOG_ERR, "Can't open /dev/tap");
1497        return -1;
1498     }
1499
1500     /* Assign a new PPA and get its unit number. */
1501     strioc_ppa.ic_cmd = TUNNEWPPA;
1502     strioc_ppa.ic_timout = 0;
1503     strioc_ppa.ic_len = sizeof(ppa);
1504     strioc_ppa.ic_dp = (char *)&ppa;
1505     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1506        syslog (LOG_ERR, "Can't assign new interface");
1507
1508     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1509     if (if_fd < 0) {
1510        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1511        return -1;
1512     }
1513     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1514        syslog(LOG_ERR, "Can't push IP module");
1515        return -1;
1516     }
1517
1518     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1519         syslog(LOG_ERR, "Can't get flags\n");
1520
1521     snprintf (actual_name, 32, "tap%d", ppa);
1522     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1523
1524     ifr.lifr_ppa = ppa;
1525     /* Assign ppa according to the unit number returned by tun device */
1526
1527     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1528         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1529     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1530         syslog (LOG_ERR, "Can't get flags\n");
1531     /* Push arp module to if_fd */
1532     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1533         syslog (LOG_ERR, "Can't push ARP module (2)");
1534
1535     /* Push arp module to ip_fd */
1536     if (ioctl (ip_fd, I_POP, NULL) < 0)
1537         syslog (LOG_ERR, "I_POP failed\n");
1538     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1539         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1540     /* Open arp_fd */
1541     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1542     if (arp_fd < 0)
1543        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1544
1545     /* Set ifname to arp */
1546     strioc_if.ic_cmd = SIOCSLIFNAME;
1547     strioc_if.ic_timout = 0;
1548     strioc_if.ic_len = sizeof(ifr);
1549     strioc_if.ic_dp = (char *)&ifr;
1550     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1551         syslog (LOG_ERR, "Can't set ifname to arp\n");
1552     }
1553
1554     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1555        syslog(LOG_ERR, "Can't link TAP device to IP");
1556        return -1;
1557     }
1558
1559     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1560         syslog (LOG_ERR, "Can't link TAP device to ARP");
1561
1562     close (if_fd);
1563
1564     memset(&ifr, 0x0, sizeof(ifr));
1565     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1566     ifr.lifr_ip_muxid  = ip_muxid;
1567     ifr.lifr_arp_muxid = arp_muxid;
1568
1569     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1570     {
1571       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1572       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1573       syslog (LOG_ERR, "Can't set multiplexor id");
1574     }
1575
1576     snprintf(dev, dev_size, "tap%d", ppa);
1577     return tap_fd;
1578 }
1579
1580 static int tap_open(char *ifname, int ifname_size)
1581 {
1582     char  dev[10]="";
1583     int fd;
1584     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1585        fprintf(stderr, "Cannot allocate TAP device\n");
1586        return -1;
1587     }
1588     pstrcpy(ifname, ifname_size, dev);
1589     fcntl(fd, F_SETFL, O_NONBLOCK);
1590     return fd;
1591 }
1592 #elif defined (_AIX)
1593 static int tap_open(char *ifname, int ifname_size)
1594 {
1595     fprintf (stderr, "no tap on AIX\n");
1596     return -1;
1597 }
1598 #else
1599 static int tap_open(char *ifname, int ifname_size)
1600 {
1601     struct ifreq ifr;
1602     int fd, ret;
1603
1604     TFR(fd = open("/dev/net/tun", O_RDWR));
1605     if (fd < 0) {
1606         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1607         return -1;
1608     }
1609     memset(&ifr, 0, sizeof(ifr));
1610     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1611     if (ifname[0] != '\0')
1612         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1613     else
1614         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1615     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1616     if (ret != 0) {
1617         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1618         close(fd);
1619         return -1;
1620     }
1621     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1622     fcntl(fd, F_SETFL, O_NONBLOCK);
1623     return fd;
1624 }
1625 #endif
1626
1627 static int launch_script(const char *setup_script, const char *ifname, int fd)
1628 {
1629     sigset_t oldmask, mask;
1630     int pid, status;
1631     char *args[3];
1632     char **parg;
1633
1634     sigemptyset(&mask);
1635     sigaddset(&mask, SIGCHLD);
1636     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1637
1638     /* try to launch network script */
1639     pid = fork();
1640     if (pid == 0) {
1641         int open_max = sysconf(_SC_OPEN_MAX), i;
1642
1643         for (i = 0; i < open_max; i++) {
1644             if (i != STDIN_FILENO &&
1645                 i != STDOUT_FILENO &&
1646                 i != STDERR_FILENO &&
1647                 i != fd) {
1648                 close(i);
1649             }
1650         }
1651         parg = args;
1652         *parg++ = (char *)setup_script;
1653         *parg++ = (char *)ifname;
1654         *parg++ = NULL;
1655         execv(setup_script, args);
1656         _exit(1);
1657     } else if (pid > 0) {
1658         while (waitpid(pid, &status, 0) != pid) {
1659             /* loop */
1660         }
1661         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1662
1663         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1664             return 0;
1665         }
1666     }
1667     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1668     return -1;
1669 }
1670
1671 static TAPState *net_tap_init(VLANState *vlan, const char *model,
1672                               const char *name, const char *ifname1,
1673                               const char *setup_script, const char *down_script)
1674 {
1675     TAPState *s;
1676     int fd;
1677     char ifname[128];
1678
1679     if (ifname1 != NULL)
1680         pstrcpy(ifname, sizeof(ifname), ifname1);
1681     else
1682         ifname[0] = '\0';
1683     TFR(fd = tap_open(ifname, sizeof(ifname)));
1684     if (fd < 0)
1685         return NULL;
1686
1687     if (!setup_script || !strcmp(setup_script, "no"))
1688         setup_script = "";
1689     if (setup_script[0] != '\0' &&
1690         launch_script(setup_script, ifname, fd)) {
1691         return NULL;
1692     }
1693     s = net_tap_fd_init(vlan, model, name, fd);
1694     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1695              "ifname=%s,script=%s,downscript=%s",
1696              ifname, setup_script, down_script);
1697     if (down_script && strcmp(down_script, "no")) {
1698         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
1699         snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
1700     }
1701     return s;
1702 }
1703
1704 #endif /* !_WIN32 */
1705
1706 #if defined(CONFIG_VDE)
1707 typedef struct VDEState {
1708     VLANClientState *vc;
1709     VDECONN *vde;
1710 } VDEState;
1711
1712 static void vde_to_qemu(void *opaque)
1713 {
1714     VDEState *s = opaque;
1715     uint8_t buf[4096];
1716     int size;
1717
1718     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1719     if (size > 0) {
1720         qemu_send_packet(s->vc, buf, size);
1721     }
1722 }
1723
1724 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1725 {
1726     VDEState *s = vc->opaque;
1727     ssize_t ret;
1728
1729     do {
1730       ret = vde_send(s->vde, (const char *)buf, size, 0);
1731     } while (ret < 0 && errno == EINTR);
1732
1733     return ret;
1734 }
1735
1736 static void vde_cleanup(VLANClientState *vc)
1737 {
1738     VDEState *s = vc->opaque;
1739     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1740     vde_close(s->vde);
1741     qemu_free(s);
1742 }
1743
1744 static int net_vde_init(VLANState *vlan, const char *model,
1745                         const char *name, const char *sock,
1746                         int port, const char *group, int mode)
1747 {
1748     VDEState *s;
1749     char *init_group = (char *)group;
1750     char *init_sock = (char *)sock;
1751
1752     struct vde_open_args args = {
1753         .port = port,
1754         .group = init_group,
1755         .mode = mode,
1756     };
1757
1758     s = qemu_mallocz(sizeof(VDEState));
1759     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1760     if (!s->vde){
1761         free(s);
1762         return -1;
1763     }
1764     s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
1765                                  vde_receive, NULL,
1766                                  vde_cleanup, s);
1767     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1768     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1769              sock, vde_datafd(s->vde));
1770     return 0;
1771 }
1772 #endif
1773
1774 /* network connection */
1775 typedef struct NetSocketState {
1776     VLANClientState *vc;
1777     int fd;
1778     int state; /* 0 = getting length, 1 = getting data */
1779     unsigned int index;
1780     unsigned int packet_len;
1781     uint8_t buf[4096];
1782     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1783 } NetSocketState;
1784
1785 typedef struct NetSocketListenState {
1786     VLANState *vlan;
1787     char *model;
1788     char *name;
1789     int fd;
1790 } NetSocketListenState;
1791
1792 /* XXX: we consider we can send the whole packet without blocking */
1793 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1794 {
1795     NetSocketState *s = vc->opaque;
1796     uint32_t len;
1797     len = htonl(size);
1798
1799     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1800     return send_all(s->fd, buf, size);
1801 }
1802
1803 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1804 {
1805     NetSocketState *s = vc->opaque;
1806
1807     return sendto(s->fd, (const void *)buf, size, 0,
1808                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
1809 }
1810
1811 static void net_socket_send(void *opaque)
1812 {
1813     NetSocketState *s = opaque;
1814     int size, err;
1815     unsigned l;
1816     uint8_t buf1[4096];
1817     const uint8_t *buf;
1818
1819     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
1820     if (size < 0) {
1821         err = socket_error();
1822         if (err != EWOULDBLOCK)
1823             goto eoc;
1824     } else if (size == 0) {
1825         /* end of connection */
1826     eoc:
1827         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1828         closesocket(s->fd);
1829         return;
1830     }
1831     buf = buf1;
1832     while (size > 0) {
1833         /* reassemble a packet from the network */
1834         switch(s->state) {
1835         case 0:
1836             l = 4 - s->index;
1837             if (l > size)
1838                 l = size;
1839             memcpy(s->buf + s->index, buf, l);
1840             buf += l;
1841             size -= l;
1842             s->index += l;
1843             if (s->index == 4) {
1844                 /* got length */
1845                 s->packet_len = ntohl(*(uint32_t *)s->buf);
1846                 s->index = 0;
1847                 s->state = 1;
1848             }
1849             break;
1850         case 1:
1851             l = s->packet_len - s->index;
1852             if (l > size)
1853                 l = size;
1854             if (s->index + l <= sizeof(s->buf)) {
1855                 memcpy(s->buf + s->index, buf, l);
1856             } else {
1857                 fprintf(stderr, "serious error: oversized packet received,"
1858                     "connection terminated.\n");
1859                 s->state = 0;
1860                 goto eoc;
1861             }
1862
1863             s->index += l;
1864             buf += l;
1865             size -= l;
1866             if (s->index >= s->packet_len) {
1867                 qemu_send_packet(s->vc, s->buf, s->packet_len);
1868                 s->index = 0;
1869                 s->state = 0;
1870             }
1871             break;
1872         }
1873     }
1874 }
1875
1876 static void net_socket_send_dgram(void *opaque)
1877 {
1878     NetSocketState *s = opaque;
1879     int size;
1880
1881     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
1882     if (size < 0)
1883         return;
1884     if (size == 0) {
1885         /* end of connection */
1886         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1887         return;
1888     }
1889     qemu_send_packet(s->vc, s->buf, size);
1890 }
1891
1892 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
1893 {
1894     struct ip_mreq imr;
1895     int fd;
1896     int val, ret;
1897     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
1898         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
1899                 inet_ntoa(mcastaddr->sin_addr),
1900                 (int)ntohl(mcastaddr->sin_addr.s_addr));
1901         return -1;
1902
1903     }
1904     fd = socket(PF_INET, SOCK_DGRAM, 0);
1905     if (fd < 0) {
1906         perror("socket(PF_INET, SOCK_DGRAM)");
1907         return -1;
1908     }
1909
1910     val = 1;
1911     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
1912                    (const char *)&val, sizeof(val));
1913     if (ret < 0) {
1914         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
1915         goto fail;
1916     }
1917
1918     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
1919     if (ret < 0) {
1920         perror("bind");
1921         goto fail;
1922     }
1923
1924     /* Add host to multicast group */
1925     imr.imr_multiaddr = mcastaddr->sin_addr;
1926     imr.imr_interface.s_addr = htonl(INADDR_ANY);
1927
1928     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
1929                      (const char *)&imr, sizeof(struct ip_mreq));
1930     if (ret < 0) {
1931         perror("setsockopt(IP_ADD_MEMBERSHIP)");
1932         goto fail;
1933     }
1934
1935     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
1936     val = 1;
1937     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
1938                    (const char *)&val, sizeof(val));
1939     if (ret < 0) {
1940         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
1941         goto fail;
1942     }
1943
1944     socket_set_nonblock(fd);
1945     return fd;
1946 fail:
1947     if (fd >= 0)
1948         closesocket(fd);
1949     return -1;
1950 }
1951
1952 static void net_socket_cleanup(VLANClientState *vc)
1953 {
1954     NetSocketState *s = vc->opaque;
1955     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1956     close(s->fd);
1957     qemu_free(s);
1958 }
1959
1960 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
1961                                                 const char *model,
1962                                                 const char *name,
1963                                                 int fd, int is_connected)
1964 {
1965     struct sockaddr_in saddr;
1966     int newfd;
1967     socklen_t saddr_len;
1968     NetSocketState *s;
1969
1970     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
1971      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
1972      * by ONLY ONE process: we must "clone" this dgram socket --jjo
1973      */
1974
1975     if (is_connected) {
1976         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
1977             /* must be bound */
1978             if (saddr.sin_addr.s_addr==0) {
1979                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
1980                         fd);
1981                 return NULL;
1982             }
1983             /* clone dgram socket */
1984             newfd = net_socket_mcast_create(&saddr);
1985             if (newfd < 0) {
1986                 /* error already reported by net_socket_mcast_create() */
1987                 close(fd);
1988                 return NULL;
1989             }
1990             /* clone newfd to fd, close newfd */
1991             dup2(newfd, fd);
1992             close(newfd);
1993
1994         } else {
1995             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
1996                     fd, strerror(errno));
1997             return NULL;
1998         }
1999     }
2000
2001     s = qemu_mallocz(sizeof(NetSocketState));
2002     s->fd = fd;
2003
2004     s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
2005                                  net_socket_receive_dgram, NULL,
2006                                  net_socket_cleanup, s);
2007     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
2008
2009     /* mcast: save bound address as dst */
2010     if (is_connected) s->dgram_dst=saddr;
2011
2012     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2013             "socket: fd=%d (%s mcast=%s:%d)",
2014             fd, is_connected? "cloned" : "",
2015             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2016     return s;
2017 }
2018
2019 static void net_socket_connect(void *opaque)
2020 {
2021     NetSocketState *s = opaque;
2022     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2023 }
2024
2025 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2026                                                  const char *model,
2027                                                  const char *name,
2028                                                  int fd, int is_connected)
2029 {
2030     NetSocketState *s;
2031     s = qemu_mallocz(sizeof(NetSocketState));
2032     s->fd = fd;
2033     s->vc = qemu_new_vlan_client(vlan, NULL, model, name, NULL,
2034                                  net_socket_receive, NULL,
2035                                  net_socket_cleanup, s);
2036     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2037              "socket: fd=%d", fd);
2038     if (is_connected) {
2039         net_socket_connect(s);
2040     } else {
2041         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2042     }
2043     return s;
2044 }
2045
2046 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2047                                           const char *model, const char *name,
2048                                           int fd, int is_connected)
2049 {
2050     int so_type = -1, optlen=sizeof(so_type);
2051
2052     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2053         (socklen_t *)&optlen)< 0) {
2054         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2055         return NULL;
2056     }
2057     switch(so_type) {
2058     case SOCK_DGRAM:
2059         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2060     case SOCK_STREAM:
2061         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2062     default:
2063         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2064         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2065         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2066     }
2067     return NULL;
2068 }
2069
2070 static void net_socket_accept(void *opaque)
2071 {
2072     NetSocketListenState *s = opaque;
2073     NetSocketState *s1;
2074     struct sockaddr_in saddr;
2075     socklen_t len;
2076     int fd;
2077
2078     for(;;) {
2079         len = sizeof(saddr);
2080         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2081         if (fd < 0 && errno != EINTR) {
2082             return;
2083         } else if (fd >= 0) {
2084             break;
2085         }
2086     }
2087     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2088     if (!s1) {
2089         closesocket(fd);
2090     } else {
2091         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2092                  "socket: connection from %s:%d",
2093                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2094     }
2095 }
2096
2097 static int net_socket_listen_init(VLANState *vlan,
2098                                   const char *model,
2099                                   const char *name,
2100                                   const char *host_str)
2101 {
2102     NetSocketListenState *s;
2103     int fd, val, ret;
2104     struct sockaddr_in saddr;
2105
2106     if (parse_host_port(&saddr, host_str) < 0)
2107         return -1;
2108
2109     s = qemu_mallocz(sizeof(NetSocketListenState));
2110
2111     fd = socket(PF_INET, SOCK_STREAM, 0);
2112     if (fd < 0) {
2113         perror("socket");
2114         return -1;
2115     }
2116     socket_set_nonblock(fd);
2117
2118     /* allow fast reuse */
2119     val = 1;
2120     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2121
2122     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2123     if (ret < 0) {
2124         perror("bind");
2125         return -1;
2126     }
2127     ret = listen(fd, 0);
2128     if (ret < 0) {
2129         perror("listen");
2130         return -1;
2131     }
2132     s->vlan = vlan;
2133     s->model = qemu_strdup(model);
2134     s->name = name ? qemu_strdup(name) : NULL;
2135     s->fd = fd;
2136     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2137     return 0;
2138 }
2139
2140 static int net_socket_connect_init(VLANState *vlan,
2141                                    const char *model,
2142                                    const char *name,
2143                                    const char *host_str)
2144 {
2145     NetSocketState *s;
2146     int fd, connected, ret, err;
2147     struct sockaddr_in saddr;
2148
2149     if (parse_host_port(&saddr, host_str) < 0)
2150         return -1;
2151
2152     fd = socket(PF_INET, SOCK_STREAM, 0);
2153     if (fd < 0) {
2154         perror("socket");
2155         return -1;
2156     }
2157     socket_set_nonblock(fd);
2158
2159     connected = 0;
2160     for(;;) {
2161         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2162         if (ret < 0) {
2163             err = socket_error();
2164             if (err == EINTR || err == EWOULDBLOCK) {
2165             } else if (err == EINPROGRESS) {
2166                 break;
2167 #ifdef _WIN32
2168             } else if (err == WSAEALREADY) {
2169                 break;
2170 #endif
2171             } else {
2172                 perror("connect");
2173                 closesocket(fd);
2174                 return -1;
2175             }
2176         } else {
2177             connected = 1;
2178             break;
2179         }
2180     }
2181     s = net_socket_fd_init(vlan, model, name, fd, connected);
2182     if (!s)
2183         return -1;
2184     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2185              "socket: connect to %s:%d",
2186              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2187     return 0;
2188 }
2189
2190 static int net_socket_mcast_init(VLANState *vlan,
2191                                  const char *model,
2192                                  const char *name,
2193                                  const char *host_str)
2194 {
2195     NetSocketState *s;
2196     int fd;
2197     struct sockaddr_in saddr;
2198
2199     if (parse_host_port(&saddr, host_str) < 0)
2200         return -1;
2201
2202
2203     fd = net_socket_mcast_create(&saddr);
2204     if (fd < 0)
2205         return -1;
2206
2207     s = net_socket_fd_init(vlan, model, name, fd, 0);
2208     if (!s)
2209         return -1;
2210
2211     s->dgram_dst = saddr;
2212
2213     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2214              "socket: mcast=%s:%d",
2215              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2216     return 0;
2217
2218 }
2219
2220 typedef struct DumpState {
2221     VLANClientState *pcap_vc;
2222     int fd;
2223     int pcap_caplen;
2224 } DumpState;
2225
2226 #define PCAP_MAGIC 0xa1b2c3d4
2227
2228 struct pcap_file_hdr {
2229     uint32_t magic;
2230     uint16_t version_major;
2231     uint16_t version_minor;
2232     int32_t thiszone;
2233     uint32_t sigfigs;
2234     uint32_t snaplen;
2235     uint32_t linktype;
2236 };
2237
2238 struct pcap_sf_pkthdr {
2239     struct {
2240         int32_t tv_sec;
2241         int32_t tv_usec;
2242     } ts;
2243     uint32_t caplen;
2244     uint32_t len;
2245 };
2246
2247 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2248 {
2249     DumpState *s = vc->opaque;
2250     struct pcap_sf_pkthdr hdr;
2251     int64_t ts;
2252     int caplen;
2253
2254     /* Early return in case of previous error. */
2255     if (s->fd < 0) {
2256         return size;
2257     }
2258
2259     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, get_ticks_per_sec());
2260     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2261
2262     hdr.ts.tv_sec = ts / 1000000;
2263     hdr.ts.tv_usec = ts % 1000000;
2264     hdr.caplen = caplen;
2265     hdr.len = size;
2266     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2267         write(s->fd, buf, caplen) != caplen) {
2268         qemu_log("-net dump write error - stop dump\n");
2269         close(s->fd);
2270         s->fd = -1;
2271     }
2272
2273     return size;
2274 }
2275
2276 static void net_dump_cleanup(VLANClientState *vc)
2277 {
2278     DumpState *s = vc->opaque;
2279
2280     close(s->fd);
2281     qemu_free(s);
2282 }
2283
2284 static int net_dump_init(VLANState *vlan, const char *device,
2285                          const char *name, const char *filename, int len)
2286 {
2287     struct pcap_file_hdr hdr;
2288     DumpState *s;
2289
2290     s = qemu_malloc(sizeof(DumpState));
2291
2292     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2293     if (s->fd < 0) {
2294         qemu_error("-net dump: can't open %s\n", filename);
2295         return -1;
2296     }
2297
2298     s->pcap_caplen = len;
2299
2300     hdr.magic = PCAP_MAGIC;
2301     hdr.version_major = 2;
2302     hdr.version_minor = 4;
2303     hdr.thiszone = 0;
2304     hdr.sigfigs = 0;
2305     hdr.snaplen = s->pcap_caplen;
2306     hdr.linktype = 1;
2307
2308     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2309         qemu_error("-net dump write error: %s\n", strerror(errno));
2310         close(s->fd);
2311         qemu_free(s);
2312         return -1;
2313     }
2314
2315     s->pcap_vc = qemu_new_vlan_client(vlan, NULL, device, name, NULL,
2316                                       dump_receive, NULL,
2317                                       net_dump_cleanup, s);
2318     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2319              "dump to %s (len=%d)", filename, len);
2320     return 0;
2321 }
2322
2323 /* find or alloc a new VLAN */
2324 VLANState *qemu_find_vlan(int id, int allocate)
2325 {
2326     VLANState *vlan;
2327
2328     QTAILQ_FOREACH(vlan, &vlans, next) {
2329         if (vlan->id == id) {
2330             return vlan;
2331         }
2332     }
2333
2334     if (!allocate) {
2335         return NULL;
2336     }
2337
2338     vlan = qemu_mallocz(sizeof(VLANState));
2339     vlan->id = id;
2340     QTAILQ_INIT(&vlan->clients);
2341
2342     vlan->send_queue = qemu_new_net_queue(qemu_vlan_deliver_packet,
2343                                           qemu_vlan_deliver_packet_iov,
2344                                           vlan);
2345
2346     QTAILQ_INSERT_TAIL(&vlans, vlan, next);
2347
2348     return vlan;
2349 }
2350
2351 static VLANClientState *qemu_find_netdev(const char *id)
2352 {
2353     VLANClientState *vc;
2354
2355     QTAILQ_FOREACH(vc, &non_vlan_clients, next) {
2356         if (!strcmp(vc->name, id)) {
2357             return vc;
2358         }
2359     }
2360
2361     return NULL;
2362 }
2363
2364 static int nic_get_free_idx(void)
2365 {
2366     int index;
2367
2368     for (index = 0; index < MAX_NICS; index++)
2369         if (!nd_table[index].used)
2370             return index;
2371     return -1;
2372 }
2373
2374 int qemu_show_nic_models(const char *arg, const char *const *models)
2375 {
2376     int i;
2377
2378     if (!arg || strcmp(arg, "?"))
2379         return 0;
2380
2381     fprintf(stderr, "qemu: Supported NIC models: ");
2382     for (i = 0 ; models[i]; i++)
2383         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2384     return 1;
2385 }
2386
2387 void qemu_check_nic_model(NICInfo *nd, const char *model)
2388 {
2389     const char *models[2];
2390
2391     models[0] = model;
2392     models[1] = NULL;
2393
2394     if (qemu_show_nic_models(nd->model, models))
2395         exit(0);
2396     if (qemu_find_nic_model(nd, models, model) < 0)
2397         exit(1);
2398 }
2399
2400 int qemu_find_nic_model(NICInfo *nd, const char * const *models,
2401                         const char *default_model)
2402 {
2403     int i;
2404
2405     if (!nd->model)
2406         nd->model = qemu_strdup(default_model);
2407
2408     for (i = 0 ; models[i]; i++) {
2409         if (strcmp(nd->model, models[i]) == 0)
2410             return i;
2411     }
2412
2413     qemu_error("qemu: Unsupported NIC model: %s\n", nd->model);
2414     return -1;
2415 }
2416
2417 static int net_handle_fd_param(Monitor *mon, const char *param)
2418 {
2419     if (!qemu_isdigit(param[0])) {
2420         int fd;
2421
2422         fd = monitor_get_fd(mon, param);
2423         if (fd == -1) {
2424             qemu_error("No file descriptor named %s found", param);
2425             return -1;
2426         }
2427
2428         return fd;
2429     } else {
2430         return strtol(param, NULL, 0);
2431     }
2432 }
2433
2434 static int net_init_nic(QemuOpts *opts,
2435                         Monitor *mon,
2436                         const char *name,
2437                         VLANState *vlan)
2438 {
2439     int idx;
2440     NICInfo *nd;
2441     const char *netdev;
2442
2443     idx = nic_get_free_idx();
2444     if (idx == -1 || nb_nics >= MAX_NICS) {
2445         qemu_error("Too Many NICs\n");
2446         return -1;
2447     }
2448
2449     nd = &nd_table[idx];
2450
2451     memset(nd, 0, sizeof(*nd));
2452
2453     if ((netdev = qemu_opt_get(opts, "netdev"))) {
2454         nd->netdev = qemu_find_netdev(netdev);
2455         if (!nd->netdev) {
2456             qemu_error("netdev '%s' not found\n", netdev);
2457             return -1;
2458         }
2459     } else {
2460         assert(vlan);
2461         nd->vlan = vlan;
2462     }
2463     if (name) {
2464         nd->name = qemu_strdup(name);
2465     }
2466     if (qemu_opt_get(opts, "model")) {
2467         nd->model = qemu_strdup(qemu_opt_get(opts, "model"));
2468     }
2469     if (qemu_opt_get(opts, "addr")) {
2470         nd->devaddr = qemu_strdup(qemu_opt_get(opts, "addr"));
2471     }
2472
2473     nd->macaddr[0] = 0x52;
2474     nd->macaddr[1] = 0x54;
2475     nd->macaddr[2] = 0x00;
2476     nd->macaddr[3] = 0x12;
2477     nd->macaddr[4] = 0x34;
2478     nd->macaddr[5] = 0x56 + idx;
2479
2480     if (qemu_opt_get(opts, "macaddr") &&
2481         parse_macaddr(nd->macaddr, qemu_opt_get(opts, "macaddr")) < 0) {
2482         qemu_error("invalid syntax for ethernet address\n");
2483         return -1;
2484     }
2485
2486     nd->nvectors = qemu_opt_get_number(opts, "vectors", NIC_NVECTORS_UNSPECIFIED);
2487     if (nd->nvectors != NIC_NVECTORS_UNSPECIFIED &&
2488         (nd->nvectors < 0 || nd->nvectors > 0x7ffffff)) {
2489         qemu_error("invalid # of vectors: %d\n", nd->nvectors);
2490         return -1;
2491     }
2492
2493     nd->used = 1;
2494     if (vlan) {
2495         nd->vlan->nb_guest_devs++;
2496     }
2497     nb_nics++;
2498
2499     return idx;
2500 }
2501
2502 #if defined(CONFIG_SLIRP)
2503 static int net_init_slirp_configs(const char *name, const char *value, void *opaque)
2504 {
2505     struct slirp_config_str *config;
2506
2507     if (strcmp(name, "hostfwd") != 0 && strcmp(name, "guestfwd") != 0) {
2508         return 0;
2509     }
2510
2511     config = qemu_mallocz(sizeof(*config));
2512
2513     pstrcpy(config->str, sizeof(config->str), value);
2514
2515     if (!strcmp(name, "hostfwd")) {
2516         config->flags = SLIRP_CFG_HOSTFWD;
2517     }
2518
2519     config->next = slirp_configs;
2520     slirp_configs = config;
2521
2522     return 0;
2523 }
2524
2525 static int net_init_slirp(QemuOpts *opts,
2526                           Monitor *mon,
2527                           const char *name,
2528                           VLANState *vlan)
2529 {
2530     struct slirp_config_str *config;
2531     const char *vhost;
2532     const char *vhostname;
2533     const char *vdhcp_start;
2534     const char *vnamesrv;
2535     const char *tftp_export;
2536     const char *bootfile;
2537     const char *smb_export;
2538     const char *vsmbsrv;
2539     char *vnet = NULL;
2540     int restricted = 0;
2541     int ret;
2542
2543     vhost       = qemu_opt_get(opts, "host");
2544     vhostname   = qemu_opt_get(opts, "hostname");
2545     vdhcp_start = qemu_opt_get(opts, "dhcpstart");
2546     vnamesrv    = qemu_opt_get(opts, "dns");
2547     tftp_export = qemu_opt_get(opts, "tftp");
2548     bootfile    = qemu_opt_get(opts, "bootfile");
2549     smb_export  = qemu_opt_get(opts, "smb");
2550     vsmbsrv     = qemu_opt_get(opts, "smbserver");
2551
2552     if (qemu_opt_get(opts, "ip")) {
2553         const char *ip = qemu_opt_get(opts, "ip");
2554         int l = strlen(ip) + strlen("/24") + 1;
2555
2556         vnet = qemu_malloc(l);
2557
2558         /* emulate legacy ip= parameter */
2559         pstrcpy(vnet, l, ip);
2560         pstrcat(vnet, l, "/24");
2561     }
2562
2563     if (qemu_opt_get(opts, "net")) {
2564         if (vnet) {
2565             qemu_free(vnet);
2566         }
2567         vnet = qemu_strdup(qemu_opt_get(opts, "net"));
2568     }
2569
2570     if (qemu_opt_get(opts, "restrict") &&
2571         qemu_opt_get(opts, "restrict")[0] == 'y') {
2572         restricted = 1;
2573     }
2574
2575     qemu_opt_foreach(opts, net_init_slirp_configs, NULL, 0);
2576
2577     ret = net_slirp_init(vlan, "user", name, restricted, vnet, vhost,
2578                          vhostname, tftp_export, bootfile, vdhcp_start,
2579                          vnamesrv, smb_export, vsmbsrv);
2580
2581     while (slirp_configs) {
2582         config = slirp_configs;
2583         slirp_configs = config->next;
2584         qemu_free(config);
2585     }
2586
2587     if (ret != -1 && vlan) {
2588         vlan->nb_host_devs++;
2589     }
2590
2591     qemu_free(vnet);
2592
2593     return ret;
2594 }
2595 #endif /* CONFIG_SLIRP */
2596
2597 #ifdef _WIN32
2598 static int net_init_tap_win32(QemuOpts *opts,
2599                               Monitor *mon,
2600                               const char *name,
2601                               VLANState *vlan)
2602 {
2603     const char *ifname;
2604
2605     ifname = qemu_opt_get(opts, "ifname");
2606
2607     if (!ifname) {
2608         qemu_error("tap: no interface name\n");
2609         return -1;
2610     }
2611
2612     if (tap_win32_init(vlan, "tap", name, ifname) == -1) {
2613         return -1;
2614     }
2615
2616     if (vlan) {
2617         vlan->nb_host_devs++;
2618     }
2619
2620     return 0;
2621 }
2622 #elif !defined(_AIX)
2623 static int net_init_tap(QemuOpts *opts,
2624                         Monitor *mon,
2625                         const char *name,
2626                         VLANState *vlan)
2627 {
2628     TAPState *s;
2629
2630     if (qemu_opt_get(opts, "fd")) {
2631         int fd;
2632
2633         if (qemu_opt_get(opts, "ifname") ||
2634             qemu_opt_get(opts, "script") ||
2635             qemu_opt_get(opts, "downscript")) {
2636             qemu_error("ifname=, script= and downscript= is invalid with fd=\n");
2637             return -1;
2638         }
2639
2640         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2641         if (fd == -1) {
2642             return -1;
2643         }
2644
2645         fcntl(fd, F_SETFL, O_NONBLOCK);
2646
2647         s = net_tap_fd_init(vlan, "tap", name, fd);
2648         if (!s) {
2649             close(fd);
2650         }
2651     } else {
2652         const char *ifname, *script, *downscript;
2653
2654         ifname     = qemu_opt_get(opts, "ifname");
2655         script     = qemu_opt_get(opts, "script");
2656         downscript = qemu_opt_get(opts, "downscript");
2657
2658         if (!script) {
2659             script = DEFAULT_NETWORK_SCRIPT;
2660         }
2661         if (!downscript) {
2662             downscript = DEFAULT_NETWORK_DOWN_SCRIPT;
2663         }
2664
2665         s = net_tap_init(vlan, "tap", name, ifname, script, downscript);
2666     }
2667
2668     if (!s) {
2669         return -1;
2670     }
2671
2672     if (tap_set_sndbuf(s, opts) < 0) {
2673         return -1;
2674     }
2675
2676     if (vlan) {
2677         vlan->nb_host_devs++;
2678     }
2679
2680     return 0;
2681 }
2682 #endif
2683
2684 static int net_init_socket(QemuOpts *opts,
2685                            Monitor *mon,
2686                            const char *name,
2687                            VLANState *vlan)
2688 {
2689     if (qemu_opt_get(opts, "fd")) {
2690         int fd;
2691
2692         if (qemu_opt_get(opts, "listen") ||
2693             qemu_opt_get(opts, "connect") ||
2694             qemu_opt_get(opts, "mcast")) {
2695             qemu_error("listen=, connect= and mcast= is invalid with fd=\n");
2696             return -1;
2697         }
2698
2699         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2700         if (fd == -1) {
2701             return -1;
2702         }
2703
2704         if (!net_socket_fd_init(vlan, "socket", name, fd, 1)) {
2705             close(fd);
2706             return -1;
2707         }
2708     } else if (qemu_opt_get(opts, "listen")) {
2709         const char *listen;
2710
2711         if (qemu_opt_get(opts, "fd") ||
2712             qemu_opt_get(opts, "connect") ||
2713             qemu_opt_get(opts, "mcast")) {
2714             qemu_error("fd=, connect= and mcast= is invalid with listen=\n");
2715             return -1;
2716         }
2717
2718         listen = qemu_opt_get(opts, "listen");
2719
2720         if (net_socket_listen_init(vlan, "socket", name, listen) == -1) {
2721             return -1;
2722         }
2723     } else if (qemu_opt_get(opts, "connect")) {
2724         const char *connect;
2725
2726         if (qemu_opt_get(opts, "fd") ||
2727             qemu_opt_get(opts, "listen") ||
2728             qemu_opt_get(opts, "mcast")) {
2729             qemu_error("fd=, listen= and mcast= is invalid with connect=\n");
2730             return -1;
2731         }
2732
2733         connect = qemu_opt_get(opts, "connect");
2734
2735         if (net_socket_connect_init(vlan, "socket", name, connect) == -1) {
2736             return -1;
2737         }
2738     } else if (qemu_opt_get(opts, "mcast")) {
2739         const char *mcast;
2740
2741         if (qemu_opt_get(opts, "fd") ||
2742             qemu_opt_get(opts, "connect") ||
2743             qemu_opt_get(opts, "listen")) {
2744             qemu_error("fd=, connect= and listen= is invalid with mcast=\n");
2745             return -1;
2746         }
2747
2748         mcast = qemu_opt_get(opts, "mcast");
2749
2750         if (net_socket_mcast_init(vlan, "socket", name, mcast) == -1) {
2751             return -1;
2752         }
2753     } else {
2754         qemu_error("-socket requires fd=, listen=, connect= or mcast=\n");
2755         return -1;
2756     }
2757
2758     if (vlan) {
2759         vlan->nb_host_devs++;
2760     }
2761
2762     return 0;
2763 }
2764
2765 #ifdef CONFIG_VDE
2766 static int net_init_vde(QemuOpts *opts,
2767                         Monitor *mon,
2768                         const char *name,
2769                         VLANState *vlan)
2770 {
2771     const char *sock;
2772     const char *group;
2773     int port, mode;
2774
2775     sock  = qemu_opt_get(opts, "sock");
2776     group = qemu_opt_get(opts, "group");
2777
2778     port = qemu_opt_get_number(opts, "port", 0);
2779     mode = qemu_opt_get_number(opts, "mode", 0700);
2780
2781     if (net_vde_init(vlan, "vde", name, sock, port, group, mode) == -1) {
2782         return -1;
2783     }
2784
2785     if (vlan) {
2786         vlan->nb_host_devs++;
2787     }
2788
2789     return 0;
2790 }
2791 #endif
2792
2793 static int net_init_dump(QemuOpts *opts,
2794                          Monitor *mon,
2795                          const char *name,
2796                          VLANState *vlan)
2797 {
2798     int len;
2799     const char *file;
2800     char def_file[128];
2801
2802     assert(vlan);
2803
2804     file = qemu_opt_get(opts, "file");
2805     if (!file) {
2806         snprintf(def_file, sizeof(def_file), "qemu-vlan%d.pcap", vlan->id);
2807         file = def_file;
2808     }
2809
2810     len = qemu_opt_get_size(opts, "len", 65536);
2811
2812     return net_dump_init(vlan, "dump", name, file, len);
2813 }
2814
2815 #define NET_COMMON_PARAMS_DESC                     \
2816     {                                              \
2817         .name = "type",                            \
2818         .type = QEMU_OPT_STRING,                   \
2819         .help = "net client type (nic, tap etc.)", \
2820      }, {                                          \
2821         .name = "vlan",                            \
2822         .type = QEMU_OPT_NUMBER,                   \
2823         .help = "vlan number",                     \
2824      }, {                                          \
2825         .name = "name",                            \
2826         .type = QEMU_OPT_STRING,                   \
2827         .help = "identifier for monitor commands", \
2828      }
2829
2830 typedef int (*net_client_init_func)(QemuOpts *opts,
2831                                     Monitor *mon,
2832                                     const char *name,
2833                                     VLANState *vlan);
2834
2835 /* magic number, but compiler will warn if too small */
2836 #define NET_MAX_DESC 20
2837
2838 static struct {
2839     const char *type;
2840     net_client_init_func init;
2841     QemuOptDesc desc[NET_MAX_DESC];
2842 } net_client_types[] = {
2843     {
2844         .type = "none",
2845         .desc = {
2846             NET_COMMON_PARAMS_DESC,
2847             { /* end of list */ }
2848         },
2849     }, {
2850         .type = "nic",
2851         .init = net_init_nic,
2852         .desc = {
2853             NET_COMMON_PARAMS_DESC,
2854             {
2855                 .name = "netdev",
2856                 .type = QEMU_OPT_STRING,
2857                 .help = "id of -netdev to connect to",
2858             },
2859             {
2860                 .name = "macaddr",
2861                 .type = QEMU_OPT_STRING,
2862                 .help = "MAC address",
2863             }, {
2864                 .name = "model",
2865                 .type = QEMU_OPT_STRING,
2866                 .help = "device model (e1000, rtl8139, virtio etc.)",
2867             }, {
2868                 .name = "addr",
2869                 .type = QEMU_OPT_STRING,
2870                 .help = "PCI device address",
2871             }, {
2872                 .name = "vectors",
2873                 .type = QEMU_OPT_NUMBER,
2874                 .help = "number of MSI-x vectors, 0 to disable MSI-X",
2875             },
2876             { /* end of list */ }
2877         },
2878 #ifdef CONFIG_SLIRP
2879     }, {
2880         .type = "user",
2881         .init = net_init_slirp,
2882         .desc = {
2883             NET_COMMON_PARAMS_DESC,
2884             {
2885                 .name = "hostname",
2886                 .type = QEMU_OPT_STRING,
2887                 .help = "client hostname reported by the builtin DHCP server",
2888             }, {
2889                 .name = "restrict",
2890                 .type = QEMU_OPT_STRING,
2891                 .help = "isolate the guest from the host (y|yes|n|no)",
2892             }, {
2893                 .name = "ip",
2894                 .type = QEMU_OPT_STRING,
2895                 .help = "legacy parameter, use net= instead",
2896             }, {
2897                 .name = "net",
2898                 .type = QEMU_OPT_STRING,
2899                 .help = "IP address and optional netmask",
2900             }, {
2901                 .name = "host",
2902                 .type = QEMU_OPT_STRING,
2903                 .help = "guest-visible address of the host",
2904             }, {
2905                 .name = "tftp",
2906                 .type = QEMU_OPT_STRING,
2907                 .help = "root directory of the built-in TFTP server",
2908             }, {
2909                 .name = "bootfile",
2910                 .type = QEMU_OPT_STRING,
2911                 .help = "BOOTP filename, for use with tftp=",
2912             }, {
2913                 .name = "dhcpstart",
2914                 .type = QEMU_OPT_STRING,
2915                 .help = "the first of the 16 IPs the built-in DHCP server can assign",
2916             }, {
2917                 .name = "dns",
2918                 .type = QEMU_OPT_STRING,
2919                 .help = "guest-visible address of the virtual nameserver",
2920             }, {
2921                 .name = "smb",
2922                 .type = QEMU_OPT_STRING,
2923                 .help = "root directory of the built-in SMB server",
2924             }, {
2925                 .name = "smbserver",
2926                 .type = QEMU_OPT_STRING,
2927                 .help = "IP address of the built-in SMB server",
2928             }, {
2929                 .name = "hostfwd",
2930                 .type = QEMU_OPT_STRING,
2931                 .help = "guest port number to forward incoming TCP or UDP connections",
2932             }, {
2933                 .name = "guestfwd",
2934                 .type = QEMU_OPT_STRING,
2935                 .help = "IP address and port to forward guest TCP connections",
2936             },
2937             { /* end of list */ }
2938         },
2939 #endif
2940 #ifdef _WIN32
2941     }, {
2942         .type = "tap",
2943         .init = net_init_tap_win32,
2944         .desc = {
2945             NET_COMMON_PARAMS_DESC,
2946             {
2947                 .name = "ifname",
2948                 .type = QEMU_OPT_STRING,
2949                 .help = "interface name",
2950             },
2951             { /* end of list */ }
2952         },
2953 #elif !defined(_AIX)
2954     }, {
2955         .type = "tap",
2956         .init = net_init_tap,
2957         .desc = {
2958             NET_COMMON_PARAMS_DESC,
2959             {
2960                 .name = "fd",
2961                 .type = QEMU_OPT_STRING,
2962                 .help = "file descriptor of an already opened tap",
2963             }, {
2964                 .name = "ifname",
2965                 .type = QEMU_OPT_STRING,
2966                 .help = "interface name",
2967             }, {
2968                 .name = "script",
2969                 .type = QEMU_OPT_STRING,
2970                 .help = "script to initialize the interface",
2971             }, {
2972                 .name = "downscript",
2973                 .type = QEMU_OPT_STRING,
2974                 .help = "script to shut down the interface",
2975 #ifdef TUNSETSNDBUF
2976             }, {
2977                 .name = "sndbuf",
2978                 .type = QEMU_OPT_SIZE,
2979                 .help = "send buffer limit"
2980 #endif
2981             },
2982             { /* end of list */ }
2983         },
2984 #endif
2985     }, {
2986         .type = "socket",
2987         .init = net_init_socket,
2988         .desc = {
2989             NET_COMMON_PARAMS_DESC,
2990             {
2991                 .name = "fd",
2992                 .type = QEMU_OPT_STRING,
2993                 .help = "file descriptor of an already opened socket",
2994             }, {
2995                 .name = "listen",
2996                 .type = QEMU_OPT_STRING,
2997                 .help = "port number, and optional hostname, to listen on",
2998             }, {
2999                 .name = "connect",
3000                 .type = QEMU_OPT_STRING,
3001                 .help = "port number, and optional hostname, to connect to",
3002             }, {
3003                 .name = "mcast",
3004                 .type = QEMU_OPT_STRING,
3005                 .help = "UDP multicast address and port number",
3006             },
3007             { /* end of list */ }
3008         },
3009 #ifdef CONFIG_VDE
3010     }, {
3011         .type = "vde",
3012         .init = net_init_vde,
3013         .desc = {
3014             NET_COMMON_PARAMS_DESC,
3015             {
3016                 .name = "sock",
3017                 .type = QEMU_OPT_STRING,
3018                 .help = "socket path",
3019             }, {
3020                 .name = "port",
3021                 .type = QEMU_OPT_NUMBER,
3022                 .help = "port number",
3023             }, {
3024                 .name = "group",
3025                 .type = QEMU_OPT_STRING,
3026                 .help = "group owner of socket",
3027             }, {
3028                 .name = "mode",
3029                 .type = QEMU_OPT_NUMBER,
3030                 .help = "permissions for socket",
3031             },
3032             { /* end of list */ }
3033         },
3034 #endif
3035     }, {
3036         .type = "dump",
3037         .init = net_init_dump,
3038         .desc = {
3039             NET_COMMON_PARAMS_DESC,
3040             {
3041                 .name = "len",
3042                 .type = QEMU_OPT_SIZE,
3043                 .help = "per-packet size limit (64k default)",
3044             }, {
3045                 .name = "file",
3046                 .type = QEMU_OPT_STRING,
3047                 .help = "dump file path (default is qemu-vlan0.pcap)",
3048             },
3049             { /* end of list */ }
3050         },
3051     },
3052     { /* end of list */ }
3053 };
3054
3055 int net_client_init(Monitor *mon, QemuOpts *opts, int is_netdev)
3056 {
3057     const char *name;
3058     const char *type;
3059     int i;
3060
3061     type = qemu_opt_get(opts, "type");
3062     if (!type) {
3063         qemu_error("No type specified for -net\n");
3064         return -1;
3065     }
3066
3067     if (is_netdev) {
3068         if (strcmp(type, "tap") != 0 &&
3069 #ifdef CONFIG_SLIRP
3070             strcmp(type, "user") != 0 &&
3071 #endif
3072 #ifdef CONFIG_VDE
3073             strcmp(type, "vde") != 0 &&
3074 #endif
3075             strcmp(type, "socket") != 0) {
3076             qemu_error("The '%s' network backend type is not valid with -netdev\n",
3077                        type);
3078             return -1;
3079         }
3080
3081         if (qemu_opt_get(opts, "vlan")) {
3082             qemu_error("The 'vlan' parameter is not valid with -netdev\n");
3083             return -1;
3084         }
3085         if (qemu_opt_get(opts, "name")) {
3086             qemu_error("The 'name' parameter is not valid with -netdev\n");
3087             return -1;
3088         }
3089         if (!qemu_opts_id(opts)) {
3090             qemu_error("The id= parameter is required with -netdev\n");
3091             return -1;
3092         }
3093     }
3094
3095     name = qemu_opts_id(opts);
3096     if (!name) {
3097         name = qemu_opt_get(opts, "name");
3098     }
3099
3100     for (i = 0; net_client_types[i].type != NULL; i++) {
3101         if (!strcmp(net_client_types[i].type, type)) {
3102             VLANState *vlan = NULL;
3103
3104             if (qemu_opts_validate(opts, &net_client_types[i].desc[0]) == -1) {
3105                 return -1;
3106             }
3107
3108             /* Do not add to a vlan if it's a -netdev or a nic with a
3109              * netdev= parameter. */
3110             if (!(is_netdev ||
3111                   (strcmp(type, "nic") == 0 && qemu_opt_get(opts, "netdev")))) {
3112                 vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
3113             }
3114
3115             if (net_client_types[i].init) {
3116                 return net_client_types[i].init(opts, mon, name, vlan);
3117             } else {
3118                 return 0;
3119             }
3120         }
3121     }
3122
3123     qemu_error("Invalid -net type '%s'\n", type);
3124     return -1;
3125 }
3126
3127 void net_client_uninit(NICInfo *nd)
3128 {
3129     if (nd->vlan) {
3130         nd->vlan->nb_guest_devs--;
3131     }
3132     nb_nics--;
3133
3134     qemu_free(nd->model);
3135     qemu_free(nd->name);
3136     qemu_free(nd->devaddr);
3137
3138     nd->used = 0;
3139 }
3140
3141 static int net_host_check_device(const char *device)
3142 {
3143     int i;
3144     const char *valid_param_list[] = { "tap", "socket", "dump"
3145 #ifdef CONFIG_SLIRP
3146                                        ,"user"
3147 #endif
3148 #ifdef CONFIG_VDE
3149                                        ,"vde"
3150 #endif
3151     };
3152     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
3153         if (!strncmp(valid_param_list[i], device,
3154                      strlen(valid_param_list[i])))
3155             return 1;
3156     }
3157
3158     return 0;
3159 }
3160
3161 void net_host_device_add(Monitor *mon, const QDict *qdict)
3162 {
3163     const char *device = qdict_get_str(qdict, "device");
3164     const char *opts_str = qdict_get_try_str(qdict, "opts");
3165     QemuOpts *opts;
3166
3167     if (!net_host_check_device(device)) {
3168         monitor_printf(mon, "invalid host network device %s\n", device);
3169         return;
3170     }
3171
3172     opts = qemu_opts_parse(&qemu_net_opts, opts_str ? opts_str : "", NULL);
3173     if (!opts) {
3174         monitor_printf(mon, "parsing network options '%s' failed\n",
3175                        opts_str ? opts_str : "");
3176         return;
3177     }
3178
3179     qemu_opt_set(opts, "type", device);
3180
3181     if (net_client_init(mon, opts, 0) < 0) {
3182         monitor_printf(mon, "adding host network device %s failed\n", device);
3183     }
3184 }
3185
3186 void net_host_device_remove(Monitor *mon, const QDict *qdict)
3187 {
3188     VLANClientState *vc;
3189     int vlan_id = qdict_get_int(qdict, "vlan_id");
3190     const char *device = qdict_get_str(qdict, "device");
3191
3192     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
3193     if (!vc) {
3194         return;
3195     }
3196     if (!net_host_check_device(vc->model)) {
3197         monitor_printf(mon, "invalid host network device %s\n", device);
3198         return;
3199     }
3200     qemu_del_vlan_client(vc);
3201 }
3202
3203 void net_set_boot_mask(int net_boot_mask)
3204 {
3205     int i;
3206
3207     /* Only the first four NICs may be bootable */
3208     net_boot_mask = net_boot_mask & 0xF;
3209
3210     for (i = 0; i < nb_nics; i++) {
3211         if (net_boot_mask & (1 << i)) {
3212             nd_table[i].bootable = 1;
3213             net_boot_mask &= ~(1 << i);
3214         }
3215     }
3216
3217     if (net_boot_mask) {
3218         fprintf(stderr, "Cannot boot from non-existent NIC\n");
3219         exit(1);
3220     }
3221 }
3222
3223 void do_info_network(Monitor *mon)
3224 {
3225     VLANState *vlan;
3226
3227     QTAILQ_FOREACH(vlan, &vlans, next) {
3228         VLANClientState *vc;
3229
3230         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
3231
3232         QTAILQ_FOREACH(vc, &vlan->clients, next) {
3233             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
3234         }
3235     }
3236 }
3237
3238 void do_set_link(Monitor *mon, const QDict *qdict)
3239 {
3240     VLANState *vlan;
3241     VLANClientState *vc = NULL;
3242     const char *name = qdict_get_str(qdict, "name");
3243     const char *up_or_down = qdict_get_str(qdict, "up_or_down");
3244
3245     QTAILQ_FOREACH(vlan, &vlans, next) {
3246         QTAILQ_FOREACH(vc, &vlan->clients, next) {
3247             if (strcmp(vc->name, name) == 0) {
3248                 goto done;
3249             }
3250         }
3251     }
3252 done:
3253
3254     if (!vc) {
3255         monitor_printf(mon, "could not find network device '%s'\n", name);
3256         return;
3257     }
3258
3259     if (strcmp(up_or_down, "up") == 0)
3260         vc->link_down = 0;
3261     else if (strcmp(up_or_down, "down") == 0)
3262         vc->link_down = 1;
3263     else
3264         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
3265                        "valid\n", up_or_down);
3266
3267     if (vc->link_status_changed)
3268         vc->link_status_changed(vc);
3269 }
3270
3271 void net_cleanup(void)
3272 {
3273     VLANState *vlan;
3274     VLANClientState *vc, *next_vc;
3275
3276     QTAILQ_FOREACH(vlan, &vlans, next) {
3277         QTAILQ_FOREACH_SAFE(vc, &vlan->clients, next, next_vc) {
3278             qemu_del_vlan_client(vc);
3279         }
3280     }
3281
3282     QTAILQ_FOREACH_SAFE(vc, &non_vlan_clients, next, next_vc) {
3283         qemu_del_vlan_client(vc);
3284     }
3285 }
3286
3287 static void net_check_clients(void)
3288 {
3289     VLANState *vlan;
3290
3291     QTAILQ_FOREACH(vlan, &vlans, next) {
3292         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
3293             continue;
3294         if (vlan->nb_guest_devs == 0)
3295             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
3296         if (vlan->nb_host_devs == 0)
3297             fprintf(stderr,
3298                     "Warning: vlan %d is not connected to host network\n",
3299                     vlan->id);
3300     }
3301 }
3302
3303 static int net_init_client(QemuOpts *opts, void *dummy)
3304 {
3305     if (net_client_init(NULL, opts, 0) < 0)
3306         return -1;
3307     return 0;
3308 }
3309
3310 static int net_init_netdev(QemuOpts *opts, void *dummy)
3311 {
3312     return net_client_init(NULL, opts, 1);
3313 }
3314
3315 int net_init_clients(void)
3316 {
3317     if (QTAILQ_EMPTY(&qemu_net_opts.head)) {
3318         /* if no clients, we use a default config */
3319         qemu_opts_set(&qemu_net_opts, NULL, "type", "nic");
3320 #ifdef CONFIG_SLIRP
3321         qemu_opts_set(&qemu_net_opts, NULL, "type", "user");
3322 #endif
3323     }
3324
3325     QTAILQ_INIT(&vlans);
3326     QTAILQ_INIT(&non_vlan_clients);
3327
3328     if (qemu_opts_foreach(&qemu_netdev_opts, net_init_netdev, NULL, 1) == -1)
3329         return -1;
3330
3331     if (qemu_opts_foreach(&qemu_net_opts, net_init_client, NULL, 1) == -1) {
3332         return -1;
3333     }
3334
3335     net_check_clients();
3336
3337     return 0;
3338 }
3339
3340 int net_client_parse(QemuOptsList *opts_list, const char *optarg)
3341 {
3342 #if defined(CONFIG_SLIRP)
3343     /* handle legacy -net channel,port:chr */
3344     if (!strcmp(opts_list->name, "net") &&
3345         !strncmp(optarg, "channel,", strlen("channel,"))) {
3346         int ret;
3347
3348         optarg += strlen("channel,");
3349
3350         if (QTAILQ_EMPTY(&slirp_stacks)) {
3351             struct slirp_config_str *config;
3352
3353             config = qemu_malloc(sizeof(*config));
3354             pstrcpy(config->str, sizeof(config->str), optarg);
3355             config->flags = SLIRP_CFG_LEGACY;
3356             config->next = slirp_configs;
3357             slirp_configs = config;
3358             ret = 0;
3359         } else {
3360             ret = slirp_guestfwd(QTAILQ_FIRST(&slirp_stacks), optarg, 1);
3361         }
3362
3363         return ret;
3364     }
3365 #endif
3366     if (!qemu_opts_parse(opts_list, optarg, "type")) {
3367         return -1;
3368     }
3369
3370     return 0;
3371 }