net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for CONFIG_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include <linux/if_tun.h>
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef CONFIG_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #include "qemu-common.h"
 105 #include "net.h"
 106 #include "monitor.h"
 107 #include "sysemu.h"
 108 #include "qemu-timer.h"
 109 #include "qemu-char.h"
 110 #include "audio/audio.h"
 111 #include "qemu_socket.h"
 112 #include "qemu-log.h"
 113
 114 #include "slirp/libslirp.h"
 115 #include "qemu-queue.h"
 116
 117
 118 static VLANState *first_vlan;
 119
 120 /***********************************************************/
 121 /* network device redirectors */
 122
 123 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 124 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 125 {
 126     int len, i, j, c;
 127
 128     for(i=0;i<size;i+=16) {
 129         len = size - i;
 130         if (len > 16)
 131             len = 16;
 132         fprintf(f, "%08x ", i);
 133         for(j=0;j<16;j++) {
 134             if (j < len)
 135                 fprintf(f, " %02x", buf[i+j]);
 136             else
 137                 fprintf(f, "   ");
 138         }
 139         fprintf(f, " ");
 140         for(j=0;j<len;j++) {
 141             c = buf[i+j];
 142             if (c < ' ' || c > '~')
 143                 c = '.';
 144             fprintf(f, "%c", c);
 145         }
 146         fprintf(f, "\n");
 147     }
 148 }
 149 #endif
 150
 151 static int parse_macaddr(uint8_t *macaddr, const char *p)
 152 {
 153     int i;
 154     char *last_char;
 155     long int offset;
 156
 157     errno = 0;
 158     offset = strtol(p, &last_char, 0);
 159     if (0 == errno && '\0' == *last_char &&
 160             offset >= 0 && offset <= 0xFFFFFF) {
 161         macaddr[3] = (offset & 0xFF0000) >> 16;
 162         macaddr[4] = (offset & 0xFF00) >> 8;
 163         macaddr[5] = offset & 0xFF;
 164         return 0;
 165     } else {
 166         for(i = 0; i < 6; i++) {
 167             macaddr[i] = strtol(p, (char **)&p, 16);
 168             if (i == 5) {
 169                 if (*p != '\0')
 170                     return -1;
 171             } else {
 172                 if (*p != ':' && *p != '-')
 173                     return -1;
 174                 p++;
 175             }
 176         }
 177         return 0;
 178     }
 179
 180     return -1;
 181 }
 182
 183 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 184 {
 185     const char *p, *p1;
 186     int len;
 187     p = *pp;
 188     p1 = strchr(p, sep);
 189     if (!p1)
 190         return -1;
 191     len = p1 - p;
 192     p1++;
 193     if (buf_size > 0) {
 194         if (len > buf_size - 1)
 195             len = buf_size - 1;
 196         memcpy(buf, p, len);
 197         buf[len] = '\0';
 198     }
 199     *pp = p1;
 200     return 0;
 201 }
 202
 203 int parse_host_src_port(struct sockaddr_in *haddr,
 204                         struct sockaddr_in *saddr,
 205                         const char *input_str)
 206 {
 207     char *str = strdup(input_str);
 208     char *host_str = str;
 209     char *src_str;
 210     const char *src_str2;
 211     char *ptr;
 212
 213     /*
 214      * Chop off any extra arguments at the end of the string which
 215      * would start with a comma, then fill in the src port information
 216      * if it was provided else use the "any address" and "any port".
 217      */
 218     if ((ptr = strchr(str,',')))
 219         *ptr = '\0';
 220
 221     if ((src_str = strchr(input_str,'@'))) {
 222         *src_str = '\0';
 223         src_str++;
 224     }
 225
 226     if (parse_host_port(haddr, host_str) < 0)
 227         goto fail;
 228
 229     src_str2 = src_str;
 230     if (!src_str || *src_str == '\0')
 231         src_str2 = ":0";
 232
 233     if (parse_host_port(saddr, src_str2) < 0)
 234         goto fail;
 235
 236     free(str);
 237     return(0);
 238
 239 fail:
 240     free(str);
 241     return -1;
 242 }
 243
 244 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 245 {
 246     char buf[512];
 247     struct hostent *he;
 248     const char *p, *r;
 249     int port;
 250
 251     p = str;
 252     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 253         return -1;
 254     saddr->sin_family = AF_INET;
 255     if (buf[0] == '\0') {
 256         saddr->sin_addr.s_addr = 0;
 257     } else {
 258         if (qemu_isdigit(buf[0])) {
 259             if (!inet_aton(buf, &saddr->sin_addr))
 260                 return -1;
 261         } else {
 262             if ((he = gethostbyname(buf)) == NULL)
 263                 return - 1;
 264             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 265         }
 266     }
 267     port = strtol(p, (char **)&r, 0);
 268     if (r == p)
 269         return -1;
 270     saddr->sin_port = htons(port);
 271     return 0;
 272 }
 273
 274 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 275 {
 276     snprintf(vc->info_str, sizeof(vc->info_str),
 277              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 278              vc->model,
 279              macaddr[0], macaddr[1], macaddr[2],
 280              macaddr[3], macaddr[4], macaddr[5]);
 281 }
 282
 283 static char *assign_name(VLANClientState *vc1, const char *model)
 284 {
 285     VLANState *vlan;
 286     char buf[256];
 287     int id = 0;
 288
 289     for (vlan = first_vlan; vlan; vlan = vlan->next) {
 290         VLANClientState *vc;
 291
 292         for (vc = vlan->first_client; vc; vc = vc->next)
 293             if (vc != vc1 && strcmp(vc->model, model) == 0)
 294                 id++;
 295     }
 296
 297     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 298
 299     return strdup(buf);
 300 }
 301
 302 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 303                                       const char *model,
 304                                       const char *name,
 305                                       NetCanReceive *can_receive,
 306                                       NetReceive *receive,
 307                                       NetReceiveIOV *receive_iov,
 308                                       NetCleanup *cleanup,
 309                                       void *opaque)
 310 {
 311     VLANClientState *vc, **pvc;
 312     vc = qemu_mallocz(sizeof(VLANClientState));
 313     vc->model = strdup(model);
 314     if (name)
 315         vc->name = strdup(name);
 316     else
 317         vc->name = assign_name(vc, model);
 318     vc->can_receive = can_receive;
 319     vc->receive = receive;
 320     vc->receive_iov = receive_iov;
 321     vc->cleanup = cleanup;
 322     vc->opaque = opaque;
 323     vc->vlan = vlan;
 324
 325     vc->next = NULL;
 326     pvc = &vlan->first_client;
 327     while (*pvc != NULL)
 328         pvc = &(*pvc)->next;
 329     *pvc = vc;
 330     return vc;
 331 }
 332
 333 void qemu_del_vlan_client(VLANClientState *vc)
 334 {
 335     VLANClientState **pvc = &vc->vlan->first_client;
 336
 337     while (*pvc != NULL)
 338         if (*pvc == vc) {
 339             *pvc = vc->next;
 340             if (vc->cleanup) {
 341                 vc->cleanup(vc);
 342             }
 343             free(vc->name);
 344             free(vc->model);
 345             qemu_free(vc);
 346             break;
 347         } else
 348             pvc = &(*pvc)->next;
 349 }
 350
 351 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 352 {
 353     VLANClientState **pvc = &vlan->first_client;
 354
 355     while (*pvc != NULL)
 356         if ((*pvc)->opaque == opaque)
 357             return *pvc;
 358         else
 359             pvc = &(*pvc)->next;
 360
 361     return NULL;
 362 }
 363
 364 static VLANClientState *
 365 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 366                               const char *client_str)
 367 {
 368     VLANState *vlan;
 369     VLANClientState *vc;
 370
 371     vlan = qemu_find_vlan(vlan_id, 0);
 372     if (!vlan) {
 373         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 374         return NULL;
 375     }
 376
 377     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 378         if (!strcmp(vc->name, client_str)) {
 379             break;
 380         }
 381     }
 382     if (!vc) {
 383         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 384                        client_str, vlan_id);
 385     }
 386
 387     return vc;
 388 }
 389
 390 int qemu_can_send_packet(VLANClientState *sender)
 391 {
 392     VLANState *vlan = sender->vlan;
 393     VLANClientState *vc;
 394
 395     for (vc = vlan->first_client; vc != NULL; vc = vc->next) {
 396         if (vc == sender) {
 397             continue;
 398         }
 399
 400         /* no can_receive() handler, they can always receive */
 401         if (!vc->can_receive || vc->can_receive(vc)) {
 402             return 1;
 403         }
 404     }
 405     return 0;
 406 }
 407
 408 static int
 409 qemu_deliver_packet(VLANClientState *sender, const uint8_t *buf, int size)
 410 {
 411     VLANClientState *vc;
 412     int ret = -1;
 413
 414     sender->vlan->delivering = 1;
 415
 416     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 417         ssize_t len;
 418
 419         if (vc == sender) {
 420             continue;
 421         }
 422
 423         if (vc->link_down) {
 424             ret = size;
 425             continue;
 426         }
 427
 428         len = vc->receive(vc, buf, size);
 429
 430         ret = (ret >= 0) ? ret : len;
 431     }
 432
 433     sender->vlan->delivering = 0;
 434
 435     return ret;
 436 }
 437
 438 void qemu_purge_queued_packets(VLANClientState *vc)
 439 {
 440     VLANPacket *packet, *next;
 441
 442     QTAILQ_FOREACH_SAFE(packet, &vc->vlan->send_queue, entry, next) {
 443         if (packet->sender == vc) {
 444             QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 445             qemu_free(packet);
 446         }
 447     }
 448 }
 449
 450 void qemu_flush_queued_packets(VLANClientState *vc)
 451 {
 452     while (!QTAILQ_EMPTY(&vc->vlan->send_queue)) {
 453         VLANPacket *packet;
 454         int ret;
 455
 456         packet = QTAILQ_FIRST(&vc->vlan->send_queue);
 457         QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 458
 459         ret = qemu_deliver_packet(packet->sender, packet->data, packet->size);
 460         if (ret == 0 && packet->sent_cb != NULL) {
 461             QTAILQ_INSERT_HEAD(&vc->vlan->send_queue, packet, entry);
 462             break;
 463         }
 464
 465         if (packet->sent_cb)
 466             packet->sent_cb(packet->sender, ret);
 467
 468         qemu_free(packet);
 469     }
 470 }
 471
 472 static void qemu_enqueue_packet(VLANClientState *sender,
 473                                 const uint8_t *buf, int size,
 474                                 NetPacketSent *sent_cb)
 475 {
 476     VLANPacket *packet;
 477
 478     packet = qemu_malloc(sizeof(VLANPacket) + size);
 479     packet->sender = sender;
 480     packet->size = size;
 481     packet->sent_cb = sent_cb;
 482     memcpy(packet->data, buf, size);
 483
 484     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 485 }
 486
 487 ssize_t qemu_send_packet_async(VLANClientState *sender,
 488                                const uint8_t *buf, int size,
 489                                NetPacketSent *sent_cb)
 490 {
 491     int ret;
 492
 493     if (sender->link_down) {
 494         return size;
 495     }
 496
 497 #ifdef DEBUG_NET
 498     printf("vlan %d send:\n", sender->vlan->id);
 499     hex_dump(stdout, buf, size);
 500 #endif
 501
 502     if (sender->vlan->delivering) {
 503         qemu_enqueue_packet(sender, buf, size, NULL);
 504         return size;
 505     }
 506
 507     ret = qemu_deliver_packet(sender, buf, size);
 508     if (ret == 0 && sent_cb != NULL) {
 509         qemu_enqueue_packet(sender, buf, size, sent_cb);
 510         return 0;
 511     }
 512
 513     qemu_flush_queued_packets(sender);
 514
 515     return ret;
 516 }
 517
 518 void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size)
 519 {
 520     qemu_send_packet_async(vc, buf, size, NULL);
 521 }
 522
 523 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 524                                int iovcnt)
 525 {
 526     uint8_t buffer[4096];
 527     size_t offset = 0;
 528     int i;
 529
 530     for (i = 0; i < iovcnt; i++) {
 531         size_t len;
 532
 533         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 534         memcpy(buffer + offset, iov[i].iov_base, len);
 535         offset += len;
 536     }
 537
 538     return vc->receive(vc, buffer, offset);
 539 }
 540
 541 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 542 {
 543     size_t offset = 0;
 544     int i;
 545
 546     for (i = 0; i < iovcnt; i++)
 547         offset += iov[i].iov_len;
 548     return offset;
 549 }
 550
 551 static int qemu_deliver_packet_iov(VLANClientState *sender,
 552                                    const struct iovec *iov, int iovcnt)
 553 {
 554     VLANClientState *vc;
 555     int ret = -1;
 556
 557     sender->vlan->delivering = 1;
 558
 559     for (vc = sender->vlan->first_client; vc != NULL; vc = vc->next) {
 560         ssize_t len;
 561
 562         if (vc == sender) {
 563             continue;
 564         }
 565
 566         if (vc->link_down) {
 567             ret = calc_iov_length(iov, iovcnt);
 568             continue;
 569         }
 570
 571         if (vc->receive_iov) {
 572             len = vc->receive_iov(vc, iov, iovcnt);
 573         } else {
 574             len = vc_sendv_compat(vc, iov, iovcnt);
 575         }
 576
 577         ret = (ret >= 0) ? ret : len;
 578     }
 579
 580     sender->vlan->delivering = 0;
 581
 582     return ret;
 583 }
 584
 585 static ssize_t qemu_enqueue_packet_iov(VLANClientState *sender,
 586                                        const struct iovec *iov, int iovcnt,
 587                                        NetPacketSent *sent_cb)
 588 {
 589     VLANPacket *packet;
 590     size_t max_len = 0;
 591     int i;
 592
 593     max_len = calc_iov_length(iov, iovcnt);
 594
 595     packet = qemu_malloc(sizeof(VLANPacket) + max_len);
 596     packet->sender = sender;
 597     packet->sent_cb = sent_cb;
 598     packet->size = 0;
 599
 600     for (i = 0; i < iovcnt; i++) {
 601         size_t len = iov[i].iov_len;
 602
 603         memcpy(packet->data + packet->size, iov[i].iov_base, len);
 604         packet->size += len;
 605     }
 606
 607     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 608
 609     return packet->size;
 610 }
 611
 612 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 613                                 const struct iovec *iov, int iovcnt,
 614                                 NetPacketSent *sent_cb)
 615 {
 616     int ret;
 617
 618     if (sender->link_down) {
 619         return calc_iov_length(iov, iovcnt);
 620     }
 621
 622     if (sender->vlan->delivering) {
 623         return qemu_enqueue_packet_iov(sender, iov, iovcnt, NULL);
 624     }
 625
 626     ret = qemu_deliver_packet_iov(sender, iov, iovcnt);
 627     if (ret == 0 && sent_cb != NULL) {
 628         qemu_enqueue_packet_iov(sender, iov, iovcnt, sent_cb);
 629         return 0;
 630     }
 631
 632     qemu_flush_queued_packets(sender);
 633
 634     return ret;
 635 }
 636
 637 ssize_t
 638 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 639 {
 640     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 641 }
 642
 643 static void config_error(Monitor *mon, const char *fmt, ...)
 644 {
 645     va_list ap;
 646
 647     va_start(ap, fmt);
 648     if (mon) {
 649         monitor_vprintf(mon, fmt, ap);
 650     } else {
 651         fprintf(stderr, "qemu: ");
 652         vfprintf(stderr, fmt, ap);
 653         exit(1);
 654     }
 655     va_end(ap);
 656 }
 657
 658 #if defined(CONFIG_SLIRP)
 659
 660 /* slirp network adapter */
 661
 662 #define SLIRP_CFG_HOSTFWD 1
 663 #define SLIRP_CFG_LEGACY  2
 664
 665 struct slirp_config_str {
 666     struct slirp_config_str *next;
 667     int flags;
 668     char str[1024];
 669     int legacy_format;
 670 };
 671
 672 typedef struct SlirpState {
 673     QTAILQ_ENTRY(SlirpState) entry;
 674     VLANClientState *vc;
 675     Slirp *slirp;
 676 #ifndef _WIN32
 677     char smb_dir[128];
 678 #endif
 679 } SlirpState;
 680
 681 static struct slirp_config_str *slirp_configs;
 682 const char *legacy_tftp_prefix;
 683 const char *legacy_bootp_filename;
 684 static QTAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 685     QTAILQ_HEAD_INITIALIZER(slirp_stacks);
 686
 687 static void slirp_hostfwd(SlirpState *s, Monitor *mon, const char *redir_str,
 688                           int legacy_format);
 689 static void slirp_guestfwd(SlirpState *s, Monitor *mon, const char *config_str,
 690                            int legacy_format);
 691
 692 #ifndef _WIN32
 693 static const char *legacy_smb_export;
 694
 695 static void slirp_smb(SlirpState *s, Monitor *mon, const char *exported_dir,
 696                       struct in_addr vserver_addr);
 697 static void slirp_smb_cleanup(SlirpState *s);
 698 #else
 699 static inline void slirp_smb_cleanup(SlirpState *s) { }
 700 #endif
 701
 702 int slirp_can_output(void *opaque)
 703 {
 704     SlirpState *s = opaque;
 705
 706     return qemu_can_send_packet(s->vc);
 707 }
 708
 709 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 710 {
 711     SlirpState *s = opaque;
 712
 713 #ifdef DEBUG_SLIRP
 714     printf("slirp output:\n");
 715     hex_dump(stdout, pkt, pkt_len);
 716 #endif
 717     qemu_send_packet(s->vc, pkt, pkt_len);
 718 }
 719
 720 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 721 {
 722     SlirpState *s = vc->opaque;
 723
 724 #ifdef DEBUG_SLIRP
 725     printf("slirp input:\n");
 726     hex_dump(stdout, buf, size);
 727 #endif
 728     slirp_input(s->slirp, buf, size);
 729     return size;
 730 }
 731
 732 static void net_slirp_cleanup(VLANClientState *vc)
 733 {
 734     SlirpState *s = vc->opaque;
 735
 736     slirp_cleanup(s->slirp);
 737     slirp_smb_cleanup(s);
 738     QTAILQ_REMOVE(&slirp_stacks, s, entry);
 739     qemu_free(s);
 740 }
 741
 742 static int net_slirp_init(Monitor *mon, VLANState *vlan, const char *model,
 743                           const char *name, int restricted,
 744                           const char *vnetwork, const char *vhost,
 745                           const char *vhostname, const char *tftp_export,
 746                           const char *bootfile, const char *vdhcp_start,
 747                           const char *vnameserver, const char *smb_export,
 748                           const char *vsmbserver)
 749 {
 750     /* default settings according to historic slirp */
 751     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 752     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 753     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 754     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 755     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 756 #ifndef _WIN32
 757     struct in_addr smbsrv = { .s_addr = 0 };
 758 #endif
 759     SlirpState *s;
 760     char buf[20];
 761     uint32_t addr;
 762     int shift;
 763     char *end;
 764
 765     if (!tftp_export) {
 766         tftp_export = legacy_tftp_prefix;
 767     }
 768     if (!bootfile) {
 769         bootfile = legacy_bootp_filename;
 770     }
 771
 772     if (vnetwork) {
 773         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 774             if (!inet_aton(vnetwork, &net)) {
 775                 return -1;
 776             }
 777             addr = ntohl(net.s_addr);
 778             if (!(addr & 0x80000000)) {
 779                 mask.s_addr = htonl(0xff000000); /* class A */
 780             } else if ((addr & 0xfff00000) == 0xac100000) {
 781                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 782             } else if ((addr & 0xc0000000) == 0x80000000) {
 783                 mask.s_addr = htonl(0xffff0000); /* class B */
 784             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 785                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 786             } else if ((addr & 0xffff0000) == 0xc6120000) {
 787                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 788             } else if ((addr & 0xe0000000) == 0xe0000000) {
 789                 mask.s_addr = htonl(0xffffff00); /* class C */
 790             } else {
 791                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 792             }
 793         } else {
 794             if (!inet_aton(buf, &net)) {
 795                 return -1;
 796             }
 797             shift = strtol(vnetwork, &end, 10);
 798             if (*end != '\0') {
 799                 if (!inet_aton(vnetwork, &mask)) {
 800                     return -1;
 801                 }
 802             } else if (shift < 4 || shift > 32) {
 803                 return -1;
 804             } else {
 805                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 806             }
 807         }
 808         net.s_addr &= mask.s_addr;
 809         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 810         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 811         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 812     }
 813
 814     if (vhost && !inet_aton(vhost, &host)) {
 815         return -1;
 816     }
 817     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 818         return -1;
 819     }
 820
 821     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 822         return -1;
 823     }
 824     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 825         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 826         return -1;
 827     }
 828
 829     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 830         return -1;
 831     }
 832     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 833         dns.s_addr == host.s_addr) {
 834         return -1;
 835     }
 836
 837 #ifndef _WIN32
 838     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 839         return -1;
 840     }
 841 #endif
 842
 843     s = qemu_mallocz(sizeof(SlirpState));
 844     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 845                           tftp_export, bootfile, dhcp, dns, s);
 846     QTAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 847
 848     while (slirp_configs) {
 849         struct slirp_config_str *config = slirp_configs;
 850
 851         if (config->flags & SLIRP_CFG_HOSTFWD) {
 852             slirp_hostfwd(s, mon, config->str,
 853                           config->flags & SLIRP_CFG_LEGACY);
 854         } else {
 855             slirp_guestfwd(s, mon, config->str,
 856                            config->flags & SLIRP_CFG_LEGACY);
 857         }
 858         slirp_configs = config->next;
 859         qemu_free(config);
 860     }
 861 #ifndef _WIN32
 862     if (!smb_export) {
 863         smb_export = legacy_smb_export;
 864     }
 865     if (smb_export) {
 866         slirp_smb(s, mon, smb_export, smbsrv);
 867     }
 868 #endif
 869
 870     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive, NULL,
 871                                  net_slirp_cleanup, s);
 872     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 873              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 874     return 0;
 875 }
 876
 877 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 878                                 const char *stack)
 879 {
 880     VLANClientState *vc;
 881
 882     if (vlan) {
 883         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 884         if (!vc) {
 885             return NULL;
 886         }
 887         if (strcmp(vc->model, "user")) {
 888             monitor_printf(mon, "invalid device specified\n");
 889             return NULL;
 890         }
 891         return vc->opaque;
 892     } else {
 893         if (QTAILQ_EMPTY(&slirp_stacks)) {
 894             monitor_printf(mon, "user mode network stack not in use\n");
 895             return NULL;
 896         }
 897         return QTAILQ_FIRST(&slirp_stacks);
 898     }
 899 }
 900
 901 void net_slirp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 902 {
 903     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 904     int host_port;
 905     char buf[256] = "";
 906     const char *src_str, *p;
 907     SlirpState *s;
 908     int is_udp = 0;
 909     int err;
 910     const char *arg1 = qdict_get_str(qdict, "arg1");
 911     const char *arg2 = qdict_get_try_str(qdict, "arg2");
 912     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 913
 914     if (arg2) {
 915         s = slirp_lookup(mon, arg1, arg2);
 916         src_str = arg3;
 917     } else {
 918         s = slirp_lookup(mon, NULL, NULL);
 919         src_str = arg1;
 920     }
 921     if (!s) {
 922         return;
 923     }
 924
 925     if (!src_str || !src_str[0])
 926         goto fail_syntax;
 927
 928     p = src_str;
 929     get_str_sep(buf, sizeof(buf), &p, ':');
 930
 931     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 932         is_udp = 0;
 933     } else if (!strcmp(buf, "udp")) {
 934         is_udp = 1;
 935     } else {
 936         goto fail_syntax;
 937     }
 938
 939     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 940         goto fail_syntax;
 941     }
 942     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 943         goto fail_syntax;
 944     }
 945
 946     host_port = atoi(p);
 947
 948     err = slirp_remove_hostfwd(QTAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 949                                host_addr, host_port);
 950
 951     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 952                    err ? "removed" : "not found");
 953     return;
 954
 955  fail_syntax:
 956     monitor_printf(mon, "invalid format\n");
 957 }
 958
 959 static void slirp_hostfwd(SlirpState *s, Monitor *mon, const char *redir_str,
 960                           int legacy_format)
 961 {
 962     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 963     struct in_addr guest_addr = { .s_addr = 0 };
 964     int host_port, guest_port;
 965     const char *p;
 966     char buf[256];
 967     int is_udp;
 968     char *end;
 969
 970     p = redir_str;
 971     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 972         goto fail_syntax;
 973     }
 974     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 975         is_udp = 0;
 976     } else if (!strcmp(buf, "udp")) {
 977         is_udp = 1;
 978     } else {
 979         goto fail_syntax;
 980     }
 981
 982     if (!legacy_format) {
 983         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 984             goto fail_syntax;
 985         }
 986         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 987             goto fail_syntax;
 988         }
 989     }
 990
 991     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
 992         goto fail_syntax;
 993     }
 994     host_port = strtol(buf, &end, 0);
 995     if (*end != '\0' || host_port < 1 || host_port > 65535) {
 996         goto fail_syntax;
 997     }
 998
 999     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1000         goto fail_syntax;
1001     }
1002     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
1003         goto fail_syntax;
1004     }
1005
1006     guest_port = strtol(p, &end, 0);
1007     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
1008         goto fail_syntax;
1009     }
1010
1011     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
1012                           guest_port) < 0) {
1013         config_error(mon, "could not set up host forwarding rule '%s'\n",
1014                      redir_str);
1015     }
1016     return;
1017
1018  fail_syntax:
1019     config_error(mon, "invalid host forwarding rule '%s'\n", redir_str);
1020 }
1021
1022 void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict)
1023 {
1024     const char *redir_str;
1025     SlirpState *s;
1026     const char *arg1 = qdict_get_str(qdict, "arg1");
1027     const char *arg2 = qdict_get_try_str(qdict, "arg2");
1028     const char *arg3 = qdict_get_try_str(qdict, "arg3");
1029
1030     if (arg2) {
1031         s = slirp_lookup(mon, arg1, arg2);
1032         redir_str = arg3;
1033     } else {
1034         s = slirp_lookup(mon, NULL, NULL);
1035         redir_str = arg1;
1036     }
1037     if (s) {
1038         slirp_hostfwd(s, mon, redir_str, 0);
1039     }
1040
1041 }
1042
1043 void net_slirp_redir(const char *redir_str)
1044 {
1045     struct slirp_config_str *config;
1046
1047     if (QTAILQ_EMPTY(&slirp_stacks)) {
1048         config = qemu_malloc(sizeof(*config));
1049         pstrcpy(config->str, sizeof(config->str), redir_str);
1050         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1051         config->next = slirp_configs;
1052         slirp_configs = config;
1053         return;
1054     }
1055
1056     slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), NULL, redir_str, 1);
1057 }
1058
1059 #ifndef _WIN32
1060
1061 /* automatic user mode samba server configuration */
1062 static void slirp_smb_cleanup(SlirpState *s)
1063 {
1064     char cmd[128];
1065
1066     if (s->smb_dir[0] != '\0') {
1067         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1068         system(cmd);
1069         s->smb_dir[0] = '\0';
1070     }
1071 }
1072
1073 static void slirp_smb(SlirpState* s, Monitor *mon, const char *exported_dir,
1074                       struct in_addr vserver_addr)
1075 {
1076     static int instance;
1077     char smb_conf[128];
1078     char smb_cmdline[128];
1079     FILE *f;
1080
1081     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1082              (long)getpid(), instance++);
1083     if (mkdir(s->smb_dir, 0700) < 0) {
1084         config_error(mon, "could not create samba server dir '%s'\n",
1085                      s->smb_dir);
1086         return;
1087     }
1088     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1089
1090     f = fopen(smb_conf, "w");
1091     if (!f) {
1092         slirp_smb_cleanup(s);
1093         config_error(mon, "could not create samba server "
1094                      "configuration file '%s'\n", smb_conf);
1095         return;
1096     }
1097     fprintf(f,
1098             "[global]\n"
1099             "private dir=%s\n"
1100             "smb ports=0\n"
1101             "socket address=127.0.0.1\n"
1102             "pid directory=%s\n"
1103             "lock directory=%s\n"
1104             "log file=%s/log.smbd\n"
1105             "smb passwd file=%s/smbpasswd\n"
1106             "security = share\n"
1107             "[qemu]\n"
1108             "path=%s\n"
1109             "read only=no\n"
1110             "guest ok=yes\n",
1111             s->smb_dir,
1112             s->smb_dir,
1113             s->smb_dir,
1114             s->smb_dir,
1115             s->smb_dir,
1116             exported_dir
1117             );
1118     fclose(f);
1119
1120     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1121              SMBD_COMMAND, smb_conf);
1122
1123     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1124         slirp_smb_cleanup(s);
1125         config_error(mon, "conflicting/invalid smbserver address\n");
1126     }
1127 }
1128
1129 /* automatic user mode samba server configuration (legacy interface) */
1130 void net_slirp_smb(const char *exported_dir)
1131 {
1132     struct in_addr vserver_addr = { .s_addr = 0 };
1133
1134     if (legacy_smb_export) {
1135         fprintf(stderr, "-smb given twice\n");
1136         exit(1);
1137     }
1138     legacy_smb_export = exported_dir;
1139     if (!QTAILQ_EMPTY(&slirp_stacks)) {
1140         slirp_smb(QTAILQ_FIRST(&slirp_stacks), NULL, exported_dir,
1141                   vserver_addr);
1142     }
1143 }
1144
1145 #endif /* !defined(_WIN32) */
1146
1147 struct GuestFwd {
1148     CharDriverState *hd;
1149     struct in_addr server;
1150     int port;
1151     Slirp *slirp;
1152 };
1153
1154 static int guestfwd_can_read(void *opaque)
1155 {
1156     struct GuestFwd *fwd = opaque;
1157     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1158 }
1159
1160 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1161 {
1162     struct GuestFwd *fwd = opaque;
1163     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1164 }
1165
1166 static void slirp_guestfwd(SlirpState *s, Monitor *mon, const char *config_str,
1167                            int legacy_format)
1168 {
1169     struct in_addr server = { .s_addr = 0 };
1170     struct GuestFwd *fwd;
1171     const char *p;
1172     char buf[128];
1173     char *end;
1174     int port;
1175
1176     p = config_str;
1177     if (legacy_format) {
1178         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1179             goto fail_syntax;
1180         }
1181     } else {
1182         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1183             goto fail_syntax;
1184         }
1185         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1186             goto fail_syntax;
1187         }
1188         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1189             goto fail_syntax;
1190         }
1191         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1192             goto fail_syntax;
1193         }
1194         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1195             goto fail_syntax;
1196         }
1197     }
1198     port = strtol(buf, &end, 10);
1199     if (*end != '\0' || port < 1 || port > 65535) {
1200         goto fail_syntax;
1201     }
1202
1203     fwd = qemu_malloc(sizeof(struct GuestFwd));
1204     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1205     fwd->hd = qemu_chr_open(buf, p, NULL);
1206     if (!fwd->hd) {
1207         config_error(mon, "could not open guest forwarding device '%s'\n",
1208                      buf);
1209         qemu_free(fwd);
1210         return;
1211     }
1212
1213     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1214         config_error(mon, "conflicting/invalid host:port in guest forwarding "
1215                      "rule '%s'\n", config_str);
1216         qemu_free(fwd);
1217         return;
1218     }
1219     fwd->server = server;
1220     fwd->port = port;
1221     fwd->slirp = s->slirp;
1222
1223     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1224                           NULL, fwd);
1225     return;
1226
1227  fail_syntax:
1228     config_error(mon, "invalid guest forwarding rule '%s'\n", config_str);
1229 }
1230
1231 void do_info_usernet(Monitor *mon)
1232 {
1233     SlirpState *s;
1234
1235     QTAILQ_FOREACH(s, &slirp_stacks, entry) {
1236         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1237         slirp_connection_info(s->slirp, mon);
1238     }
1239 }
1240
1241 #endif /* CONFIG_SLIRP */
1242
1243 #if !defined(_WIN32)
1244
1245 typedef struct TAPState {
1246     VLANClientState *vc;
1247     int fd;
1248     char down_script[1024];
1249     char down_script_arg[128];
1250     uint8_t buf[4096];
1251     unsigned int read_poll : 1;
1252     unsigned int write_poll : 1;
1253 } TAPState;
1254
1255 static int launch_script(const char *setup_script, const char *ifname, int fd);
1256
1257 static int tap_can_send(void *opaque);
1258 static void tap_send(void *opaque);
1259 static void tap_writable(void *opaque);
1260
1261 static void tap_update_fd_handler(TAPState *s)
1262 {
1263     qemu_set_fd_handler2(s->fd,
1264                          s->read_poll  ? tap_can_send : NULL,
1265                          s->read_poll  ? tap_send     : NULL,
1266                          s->write_poll ? tap_writable : NULL,
1267                          s);
1268 }
1269
1270 static void tap_read_poll(TAPState *s, int enable)
1271 {
1272     s->read_poll = !!enable;
1273     tap_update_fd_handler(s);
1274 }
1275
1276 static void tap_write_poll(TAPState *s, int enable)
1277 {
1278     s->write_poll = !!enable;
1279     tap_update_fd_handler(s);
1280 }
1281
1282 static void tap_writable(void *opaque)
1283 {
1284     TAPState *s = opaque;
1285
1286     tap_write_poll(s, 0);
1287
1288     qemu_flush_queued_packets(s->vc);
1289 }
1290
1291 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1292                                int iovcnt)
1293 {
1294     TAPState *s = vc->opaque;
1295     ssize_t len;
1296
1297     do {
1298         len = writev(s->fd, iov, iovcnt);
1299     } while (len == -1 && errno == EINTR);
1300
1301     if (len == -1 && errno == EAGAIN) {
1302         tap_write_poll(s, 1);
1303         return 0;
1304     }
1305
1306     return len;
1307 }
1308
1309 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1310 {
1311     TAPState *s = vc->opaque;
1312     ssize_t len;
1313
1314     do {
1315         len = write(s->fd, buf, size);
1316     } while (len == -1 && (errno == EINTR || errno == EAGAIN));
1317
1318     return len;
1319 }
1320
1321 static int tap_can_send(void *opaque)
1322 {
1323     TAPState *s = opaque;
1324
1325     return qemu_can_send_packet(s->vc);
1326 }
1327
1328 #ifdef __sun__
1329 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1330 {
1331     struct strbuf sbuf;
1332     int f = 0;
1333
1334     sbuf.maxlen = maxlen;
1335     sbuf.buf = (char *)buf;
1336
1337     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1338 }
1339 #else
1340 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1341 {
1342     return read(tapfd, buf, maxlen);
1343 }
1344 #endif
1345
1346 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1347 {
1348     TAPState *s = vc->opaque;
1349     tap_read_poll(s, 1);
1350 }
1351
1352 static void tap_send(void *opaque)
1353 {
1354     TAPState *s = opaque;
1355     int size;
1356
1357     do {
1358         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1359         if (size <= 0) {
1360             break;
1361         }
1362
1363         size = qemu_send_packet_async(s->vc, s->buf, size, tap_send_completed);
1364         if (size == 0) {
1365             tap_read_poll(s, 0);
1366         }
1367     } while (size > 0);
1368 }
1369
1370 #ifdef TUNSETSNDBUF
1371 /* sndbuf should be set to a value lower than the tx queue
1372  * capacity of any destination network interface.
1373  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1374  * a good default, given a 1500 byte MTU.
1375  */
1376 #define TAP_DEFAULT_SNDBUF 1024*1024
1377
1378 static void tap_set_sndbuf(TAPState *s, const char *sndbuf_str, Monitor *mon)
1379 {
1380     int sndbuf = TAP_DEFAULT_SNDBUF;
1381
1382     if (sndbuf_str) {
1383         sndbuf = atoi(sndbuf_str);
1384     }
1385
1386     if (!sndbuf) {
1387         sndbuf = INT_MAX;
1388     }
1389
1390     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && sndbuf_str) {
1391         config_error(mon, "TUNSETSNDBUF ioctl failed: %s\n",
1392                      strerror(errno));
1393     }
1394 }
1395 #else
1396 static void tap_set_sndbuf(TAPState *s, const char *sndbuf_str, Monitor *mon)
1397 {
1398     if (sndbuf_str) {
1399         config_error(mon, "No '-net tap,sndbuf=<nbytes>' support available\n");
1400     }
1401 }
1402 #endif /* TUNSETSNDBUF */
1403
1404 static void tap_cleanup(VLANClientState *vc)
1405 {
1406     TAPState *s = vc->opaque;
1407
1408     qemu_purge_queued_packets(vc);
1409
1410     if (s->down_script[0])
1411         launch_script(s->down_script, s->down_script_arg, s->fd);
1412
1413     tap_read_poll(s, 0);
1414     tap_write_poll(s, 0);
1415     close(s->fd);
1416     qemu_free(s);
1417 }
1418
1419 /* fd support */
1420
1421 static TAPState *net_tap_fd_init(VLANState *vlan,
1422                                  const char *model,
1423                                  const char *name,
1424                                  int fd)
1425 {
1426     TAPState *s;
1427
1428     s = qemu_mallocz(sizeof(TAPState));
1429     s->fd = fd;
1430     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
1431                                  tap_receive_iov, tap_cleanup, s);
1432     tap_read_poll(s, 1);
1433     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
1434     return s;
1435 }
1436
1437 #if defined (CONFIG_BSD) || defined (__FreeBSD_kernel__)
1438 static int tap_open(char *ifname, int ifname_size)
1439 {
1440     int fd;
1441     char *dev;
1442     struct stat s;
1443
1444     TFR(fd = open("/dev/tap", O_RDWR));
1445     if (fd < 0) {
1446         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1447         return -1;
1448     }
1449
1450     fstat(fd, &s);
1451     dev = devname(s.st_rdev, S_IFCHR);
1452     pstrcpy(ifname, ifname_size, dev);
1453
1454     fcntl(fd, F_SETFL, O_NONBLOCK);
1455     return fd;
1456 }
1457 #elif defined(__sun__)
1458 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1459 /*
1460  * Allocate TAP device, returns opened fd.
1461  * Stores dev name in the first arg(must be large enough).
1462  */
1463 static int tap_alloc(char *dev, size_t dev_size)
1464 {
1465     int tap_fd, if_fd, ppa = -1;
1466     static int ip_fd = 0;
1467     char *ptr;
1468
1469     static int arp_fd = 0;
1470     int ip_muxid, arp_muxid;
1471     struct strioctl  strioc_if, strioc_ppa;
1472     int link_type = I_PLINK;;
1473     struct lifreq ifr;
1474     char actual_name[32] = "";
1475
1476     memset(&ifr, 0x0, sizeof(ifr));
1477
1478     if( *dev ){
1479        ptr = dev;
1480        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1481        ppa = atoi(ptr);
1482     }
1483
1484     /* Check if IP device was opened */
1485     if( ip_fd )
1486        close(ip_fd);
1487
1488     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1489     if (ip_fd < 0) {
1490        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1491        return -1;
1492     }
1493
1494     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1495     if (tap_fd < 0) {
1496        syslog(LOG_ERR, "Can't open /dev/tap");
1497        return -1;
1498     }
1499
1500     /* Assign a new PPA and get its unit number. */
1501     strioc_ppa.ic_cmd = TUNNEWPPA;
1502     strioc_ppa.ic_timout = 0;
1503     strioc_ppa.ic_len = sizeof(ppa);
1504     strioc_ppa.ic_dp = (char *)&ppa;
1505     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1506        syslog (LOG_ERR, "Can't assign new interface");
1507
1508     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1509     if (if_fd < 0) {
1510        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1511        return -1;
1512     }
1513     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1514        syslog(LOG_ERR, "Can't push IP module");
1515        return -1;
1516     }
1517
1518     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1519         syslog(LOG_ERR, "Can't get flags\n");
1520
1521     snprintf (actual_name, 32, "tap%d", ppa);
1522     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1523
1524     ifr.lifr_ppa = ppa;
1525     /* Assign ppa according to the unit number returned by tun device */
1526
1527     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1528         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1529     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1530         syslog (LOG_ERR, "Can't get flags\n");
1531     /* Push arp module to if_fd */
1532     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1533         syslog (LOG_ERR, "Can't push ARP module (2)");
1534
1535     /* Push arp module to ip_fd */
1536     if (ioctl (ip_fd, I_POP, NULL) < 0)
1537         syslog (LOG_ERR, "I_POP failed\n");
1538     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1539         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1540     /* Open arp_fd */
1541     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1542     if (arp_fd < 0)
1543        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1544
1545     /* Set ifname to arp */
1546     strioc_if.ic_cmd = SIOCSLIFNAME;
1547     strioc_if.ic_timout = 0;
1548     strioc_if.ic_len = sizeof(ifr);
1549     strioc_if.ic_dp = (char *)&ifr;
1550     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1551         syslog (LOG_ERR, "Can't set ifname to arp\n");
1552     }
1553
1554     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1555        syslog(LOG_ERR, "Can't link TAP device to IP");
1556        return -1;
1557     }
1558
1559     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1560         syslog (LOG_ERR, "Can't link TAP device to ARP");
1561
1562     close (if_fd);
1563
1564     memset(&ifr, 0x0, sizeof(ifr));
1565     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1566     ifr.lifr_ip_muxid  = ip_muxid;
1567     ifr.lifr_arp_muxid = arp_muxid;
1568
1569     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1570     {
1571       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1572       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1573       syslog (LOG_ERR, "Can't set multiplexor id");
1574     }
1575
1576     snprintf(dev, dev_size, "tap%d", ppa);
1577     return tap_fd;
1578 }
1579
1580 static int tap_open(char *ifname, int ifname_size)
1581 {
1582     char  dev[10]="";
1583     int fd;
1584     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1585        fprintf(stderr, "Cannot allocate TAP device\n");
1586        return -1;
1587     }
1588     pstrcpy(ifname, ifname_size, dev);
1589     fcntl(fd, F_SETFL, O_NONBLOCK);
1590     return fd;
1591 }
1592 #elif defined (_AIX)
1593 static int tap_open(char *ifname, int ifname_size)
1594 {
1595     fprintf (stderr, "no tap on AIX\n");
1596     return -1;
1597 }
1598 #else
1599 static int tap_open(char *ifname, int ifname_size)
1600 {
1601     struct ifreq ifr;
1602     int fd, ret;
1603
1604     TFR(fd = open("/dev/net/tun", O_RDWR));
1605     if (fd < 0) {
1606         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1607         return -1;
1608     }
1609     memset(&ifr, 0, sizeof(ifr));
1610     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1611     if (ifname[0] != '\0')
1612         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1613     else
1614         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1615     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1616     if (ret != 0) {
1617         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1618         close(fd);
1619         return -1;
1620     }
1621     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1622     fcntl(fd, F_SETFL, O_NONBLOCK);
1623     return fd;
1624 }
1625 #endif
1626
1627 static int launch_script(const char *setup_script, const char *ifname, int fd)
1628 {
1629     sigset_t oldmask, mask;
1630     int pid, status;
1631     char *args[3];
1632     char **parg;
1633
1634     sigemptyset(&mask);
1635     sigaddset(&mask, SIGCHLD);
1636     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1637
1638     /* try to launch network script */
1639     pid = fork();
1640     if (pid == 0) {
1641         int open_max = sysconf(_SC_OPEN_MAX), i;
1642
1643         for (i = 0; i < open_max; i++) {
1644             if (i != STDIN_FILENO &&
1645                 i != STDOUT_FILENO &&
1646                 i != STDERR_FILENO &&
1647                 i != fd) {
1648                 close(i);
1649             }
1650         }
1651         parg = args;
1652         *parg++ = (char *)setup_script;
1653         *parg++ = (char *)ifname;
1654         *parg++ = NULL;
1655         execv(setup_script, args);
1656         _exit(1);
1657     } else if (pid > 0) {
1658         while (waitpid(pid, &status, 0) != pid) {
1659             /* loop */
1660         }
1661         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1662
1663         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1664             return 0;
1665         }
1666     }
1667     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1668     return -1;
1669 }
1670
1671 static TAPState *net_tap_init(VLANState *vlan, const char *model,
1672                               const char *name, const char *ifname1,
1673                               const char *setup_script, const char *down_script)
1674 {
1675     TAPState *s;
1676     int fd;
1677     char ifname[128];
1678
1679     if (ifname1 != NULL)
1680         pstrcpy(ifname, sizeof(ifname), ifname1);
1681     else
1682         ifname[0] = '\0';
1683     TFR(fd = tap_open(ifname, sizeof(ifname)));
1684     if (fd < 0)
1685         return NULL;
1686
1687     if (!setup_script || !strcmp(setup_script, "no"))
1688         setup_script = "";
1689     if (setup_script[0] != '\0' &&
1690         launch_script(setup_script, ifname, fd)) {
1691         return NULL;
1692     }
1693     s = net_tap_fd_init(vlan, model, name, fd);
1694     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1695              "ifname=%s,script=%s,downscript=%s",
1696              ifname, setup_script, down_script);
1697     if (down_script && strcmp(down_script, "no")) {
1698         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
1699         snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
1700     }
1701     return s;
1702 }
1703
1704 #endif /* !_WIN32 */
1705
1706 #if defined(CONFIG_VDE)
1707 typedef struct VDEState {
1708     VLANClientState *vc;
1709     VDECONN *vde;
1710 } VDEState;
1711
1712 static void vde_to_qemu(void *opaque)
1713 {
1714     VDEState *s = opaque;
1715     uint8_t buf[4096];
1716     int size;
1717
1718     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1719     if (size > 0) {
1720         qemu_send_packet(s->vc, buf, size);
1721     }
1722 }
1723
1724 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1725 {
1726     VDEState *s = vc->opaque;
1727     ssize_t ret;
1728
1729     do {
1730       ret = vde_send(s->vde, (const char *)buf, size, 0);
1731     } while (ret < 0 && errno == EINTR);
1732
1733     return ret;
1734 }
1735
1736 static void vde_cleanup(VLANClientState *vc)
1737 {
1738     VDEState *s = vc->opaque;
1739     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1740     vde_close(s->vde);
1741     qemu_free(s);
1742 }
1743
1744 static int net_vde_init(VLANState *vlan, const char *model,
1745                         const char *name, const char *sock,
1746                         int port, const char *group, int mode)
1747 {
1748     VDEState *s;
1749     char *init_group = strlen(group) ? (char *)group : NULL;
1750     char *init_sock = strlen(sock) ? (char *)sock : NULL;
1751
1752     struct vde_open_args args = {
1753         .port = port,
1754         .group = init_group,
1755         .mode = mode,
1756     };
1757
1758     s = qemu_mallocz(sizeof(VDEState));
1759     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1760     if (!s->vde){
1761         free(s);
1762         return -1;
1763     }
1764     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
1765                                  NULL, vde_cleanup, s);
1766     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1767     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1768              sock, vde_datafd(s->vde));
1769     return 0;
1770 }
1771 #endif
1772
1773 /* network connection */
1774 typedef struct NetSocketState {
1775     VLANClientState *vc;
1776     int fd;
1777     int state; /* 0 = getting length, 1 = getting data */
1778     unsigned int index;
1779     unsigned int packet_len;
1780     uint8_t buf[4096];
1781     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1782 } NetSocketState;
1783
1784 typedef struct NetSocketListenState {
1785     VLANState *vlan;
1786     char *model;
1787     char *name;
1788     int fd;
1789 } NetSocketListenState;
1790
1791 /* XXX: we consider we can send the whole packet without blocking */
1792 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1793 {
1794     NetSocketState *s = vc->opaque;
1795     uint32_t len;
1796     len = htonl(size);
1797
1798     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1799     return send_all(s->fd, buf, size);
1800 }
1801
1802 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1803 {
1804     NetSocketState *s = vc->opaque;
1805
1806     return sendto(s->fd, (const void *)buf, size, 0,
1807                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
1808 }
1809
1810 static void net_socket_send(void *opaque)
1811 {
1812     NetSocketState *s = opaque;
1813     int size, err;
1814     unsigned l;
1815     uint8_t buf1[4096];
1816     const uint8_t *buf;
1817
1818     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
1819     if (size < 0) {
1820         err = socket_error();
1821         if (err != EWOULDBLOCK)
1822             goto eoc;
1823     } else if (size == 0) {
1824         /* end of connection */
1825     eoc:
1826         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1827         closesocket(s->fd);
1828         return;
1829     }
1830     buf = buf1;
1831     while (size > 0) {
1832         /* reassemble a packet from the network */
1833         switch(s->state) {
1834         case 0:
1835             l = 4 - s->index;
1836             if (l > size)
1837                 l = size;
1838             memcpy(s->buf + s->index, buf, l);
1839             buf += l;
1840             size -= l;
1841             s->index += l;
1842             if (s->index == 4) {
1843                 /* got length */
1844                 s->packet_len = ntohl(*(uint32_t *)s->buf);
1845                 s->index = 0;
1846                 s->state = 1;
1847             }
1848             break;
1849         case 1:
1850             l = s->packet_len - s->index;
1851             if (l > size)
1852                 l = size;
1853             if (s->index + l <= sizeof(s->buf)) {
1854                 memcpy(s->buf + s->index, buf, l);
1855             } else {
1856                 fprintf(stderr, "serious error: oversized packet received,"
1857                     "connection terminated.\n");
1858                 s->state = 0;
1859                 goto eoc;
1860             }
1861
1862             s->index += l;
1863             buf += l;
1864             size -= l;
1865             if (s->index >= s->packet_len) {
1866                 qemu_send_packet(s->vc, s->buf, s->packet_len);
1867                 s->index = 0;
1868                 s->state = 0;
1869             }
1870             break;
1871         }
1872     }
1873 }
1874
1875 static void net_socket_send_dgram(void *opaque)
1876 {
1877     NetSocketState *s = opaque;
1878     int size;
1879
1880     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
1881     if (size < 0)
1882         return;
1883     if (size == 0) {
1884         /* end of connection */
1885         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1886         return;
1887     }
1888     qemu_send_packet(s->vc, s->buf, size);
1889 }
1890
1891 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
1892 {
1893     struct ip_mreq imr;
1894     int fd;
1895     int val, ret;
1896     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
1897         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
1898                 inet_ntoa(mcastaddr->sin_addr),
1899                 (int)ntohl(mcastaddr->sin_addr.s_addr));
1900         return -1;
1901
1902     }
1903     fd = socket(PF_INET, SOCK_DGRAM, 0);
1904     if (fd < 0) {
1905         perror("socket(PF_INET, SOCK_DGRAM)");
1906         return -1;
1907     }
1908
1909     val = 1;
1910     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
1911                    (const char *)&val, sizeof(val));
1912     if (ret < 0) {
1913         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
1914         goto fail;
1915     }
1916
1917     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
1918     if (ret < 0) {
1919         perror("bind");
1920         goto fail;
1921     }
1922
1923     /* Add host to multicast group */
1924     imr.imr_multiaddr = mcastaddr->sin_addr;
1925     imr.imr_interface.s_addr = htonl(INADDR_ANY);
1926
1927     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
1928                      (const char *)&imr, sizeof(struct ip_mreq));
1929     if (ret < 0) {
1930         perror("setsockopt(IP_ADD_MEMBERSHIP)");
1931         goto fail;
1932     }
1933
1934     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
1935     val = 1;
1936     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
1937                    (const char *)&val, sizeof(val));
1938     if (ret < 0) {
1939         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
1940         goto fail;
1941     }
1942
1943     socket_set_nonblock(fd);
1944     return fd;
1945 fail:
1946     if (fd >= 0)
1947         closesocket(fd);
1948     return -1;
1949 }
1950
1951 static void net_socket_cleanup(VLANClientState *vc)
1952 {
1953     NetSocketState *s = vc->opaque;
1954     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1955     close(s->fd);
1956     qemu_free(s);
1957 }
1958
1959 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
1960                                                 const char *model,
1961                                                 const char *name,
1962                                                 int fd, int is_connected)
1963 {
1964     struct sockaddr_in saddr;
1965     int newfd;
1966     socklen_t saddr_len;
1967     NetSocketState *s;
1968
1969     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
1970      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
1971      * by ONLY ONE process: we must "clone" this dgram socket --jjo
1972      */
1973
1974     if (is_connected) {
1975         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
1976             /* must be bound */
1977             if (saddr.sin_addr.s_addr==0) {
1978                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
1979                         fd);
1980                 return NULL;
1981             }
1982             /* clone dgram socket */
1983             newfd = net_socket_mcast_create(&saddr);
1984             if (newfd < 0) {
1985                 /* error already reported by net_socket_mcast_create() */
1986                 close(fd);
1987                 return NULL;
1988             }
1989             /* clone newfd to fd, close newfd */
1990             dup2(newfd, fd);
1991             close(newfd);
1992
1993         } else {
1994             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
1995                     fd, strerror(errno));
1996             return NULL;
1997         }
1998     }
1999
2000     s = qemu_mallocz(sizeof(NetSocketState));
2001     s->fd = fd;
2002
2003     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
2004                                  NULL, net_socket_cleanup, s);
2005     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
2006
2007     /* mcast: save bound address as dst */
2008     if (is_connected) s->dgram_dst=saddr;
2009
2010     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2011             "socket: fd=%d (%s mcast=%s:%d)",
2012             fd, is_connected? "cloned" : "",
2013             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2014     return s;
2015 }
2016
2017 static void net_socket_connect(void *opaque)
2018 {
2019     NetSocketState *s = opaque;
2020     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2021 }
2022
2023 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2024                                                  const char *model,
2025                                                  const char *name,
2026                                                  int fd, int is_connected)
2027 {
2028     NetSocketState *s;
2029     s = qemu_mallocz(sizeof(NetSocketState));
2030     s->fd = fd;
2031     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
2032                                  NULL, net_socket_cleanup, s);
2033     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2034              "socket: fd=%d", fd);
2035     if (is_connected) {
2036         net_socket_connect(s);
2037     } else {
2038         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2039     }
2040     return s;
2041 }
2042
2043 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2044                                           const char *model, const char *name,
2045                                           int fd, int is_connected)
2046 {
2047     int so_type = -1, optlen=sizeof(so_type);
2048
2049     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2050         (socklen_t *)&optlen)< 0) {
2051         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2052         return NULL;
2053     }
2054     switch(so_type) {
2055     case SOCK_DGRAM:
2056         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2057     case SOCK_STREAM:
2058         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2059     default:
2060         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2061         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2062         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2063     }
2064     return NULL;
2065 }
2066
2067 static void net_socket_accept(void *opaque)
2068 {
2069     NetSocketListenState *s = opaque;
2070     NetSocketState *s1;
2071     struct sockaddr_in saddr;
2072     socklen_t len;
2073     int fd;
2074
2075     for(;;) {
2076         len = sizeof(saddr);
2077         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2078         if (fd < 0 && errno != EINTR) {
2079             return;
2080         } else if (fd >= 0) {
2081             break;
2082         }
2083     }
2084     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2085     if (!s1) {
2086         closesocket(fd);
2087     } else {
2088         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2089                  "socket: connection from %s:%d",
2090                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2091     }
2092 }
2093
2094 static int net_socket_listen_init(VLANState *vlan,
2095                                   const char *model,
2096                                   const char *name,
2097                                   const char *host_str)
2098 {
2099     NetSocketListenState *s;
2100     int fd, val, ret;
2101     struct sockaddr_in saddr;
2102
2103     if (parse_host_port(&saddr, host_str) < 0)
2104         return -1;
2105
2106     s = qemu_mallocz(sizeof(NetSocketListenState));
2107
2108     fd = socket(PF_INET, SOCK_STREAM, 0);
2109     if (fd < 0) {
2110         perror("socket");
2111         return -1;
2112     }
2113     socket_set_nonblock(fd);
2114
2115     /* allow fast reuse */
2116     val = 1;
2117     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2118
2119     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2120     if (ret < 0) {
2121         perror("bind");
2122         return -1;
2123     }
2124     ret = listen(fd, 0);
2125     if (ret < 0) {
2126         perror("listen");
2127         return -1;
2128     }
2129     s->vlan = vlan;
2130     s->model = strdup(model);
2131     s->name = name ? strdup(name) : NULL;
2132     s->fd = fd;
2133     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2134     return 0;
2135 }
2136
2137 static int net_socket_connect_init(VLANState *vlan,
2138                                    const char *model,
2139                                    const char *name,
2140                                    const char *host_str)
2141 {
2142     NetSocketState *s;
2143     int fd, connected, ret, err;
2144     struct sockaddr_in saddr;
2145
2146     if (parse_host_port(&saddr, host_str) < 0)
2147         return -1;
2148
2149     fd = socket(PF_INET, SOCK_STREAM, 0);
2150     if (fd < 0) {
2151         perror("socket");
2152         return -1;
2153     }
2154     socket_set_nonblock(fd);
2155
2156     connected = 0;
2157     for(;;) {
2158         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2159         if (ret < 0) {
2160             err = socket_error();
2161             if (err == EINTR || err == EWOULDBLOCK) {
2162             } else if (err == EINPROGRESS) {
2163                 break;
2164 #ifdef _WIN32
2165             } else if (err == WSAEALREADY) {
2166                 break;
2167 #endif
2168             } else {
2169                 perror("connect");
2170                 closesocket(fd);
2171                 return -1;
2172             }
2173         } else {
2174             connected = 1;
2175             break;
2176         }
2177     }
2178     s = net_socket_fd_init(vlan, model, name, fd, connected);
2179     if (!s)
2180         return -1;
2181     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2182              "socket: connect to %s:%d",
2183              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2184     return 0;
2185 }
2186
2187 static int net_socket_mcast_init(VLANState *vlan,
2188                                  const char *model,
2189                                  const char *name,
2190                                  const char *host_str)
2191 {
2192     NetSocketState *s;
2193     int fd;
2194     struct sockaddr_in saddr;
2195
2196     if (parse_host_port(&saddr, host_str) < 0)
2197         return -1;
2198
2199
2200     fd = net_socket_mcast_create(&saddr);
2201     if (fd < 0)
2202         return -1;
2203
2204     s = net_socket_fd_init(vlan, model, name, fd, 0);
2205     if (!s)
2206         return -1;
2207
2208     s->dgram_dst = saddr;
2209
2210     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2211              "socket: mcast=%s:%d",
2212              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2213     return 0;
2214
2215 }
2216
2217 typedef struct DumpState {
2218     VLANClientState *pcap_vc;
2219     int fd;
2220     int pcap_caplen;
2221 } DumpState;
2222
2223 #define PCAP_MAGIC 0xa1b2c3d4
2224
2225 struct pcap_file_hdr {
2226     uint32_t magic;
2227     uint16_t version_major;
2228     uint16_t version_minor;
2229     int32_t thiszone;
2230     uint32_t sigfigs;
2231     uint32_t snaplen;
2232     uint32_t linktype;
2233 };
2234
2235 struct pcap_sf_pkthdr {
2236     struct {
2237         int32_t tv_sec;
2238         int32_t tv_usec;
2239     } ts;
2240     uint32_t caplen;
2241     uint32_t len;
2242 };
2243
2244 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2245 {
2246     DumpState *s = vc->opaque;
2247     struct pcap_sf_pkthdr hdr;
2248     int64_t ts;
2249     int caplen;
2250
2251     /* Early return in case of previous error. */
2252     if (s->fd < 0) {
2253         return size;
2254     }
2255
2256     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, get_ticks_per_sec());
2257     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2258
2259     hdr.ts.tv_sec = ts / 1000000;
2260     hdr.ts.tv_usec = ts % 1000000;
2261     hdr.caplen = caplen;
2262     hdr.len = size;
2263     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2264         write(s->fd, buf, caplen) != caplen) {
2265         qemu_log("-net dump write error - stop dump\n");
2266         close(s->fd);
2267         s->fd = -1;
2268     }
2269
2270     return size;
2271 }
2272
2273 static void net_dump_cleanup(VLANClientState *vc)
2274 {
2275     DumpState *s = vc->opaque;
2276
2277     close(s->fd);
2278     qemu_free(s);
2279 }
2280
2281 static int net_dump_init(Monitor *mon, VLANState *vlan, const char *device,
2282                          const char *name, const char *filename, int len)
2283 {
2284     struct pcap_file_hdr hdr;
2285     DumpState *s;
2286
2287     s = qemu_malloc(sizeof(DumpState));
2288
2289     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2290     if (s->fd < 0) {
2291         config_error(mon, "-net dump: can't open %s\n", filename);
2292         return -1;
2293     }
2294
2295     s->pcap_caplen = len;
2296
2297     hdr.magic = PCAP_MAGIC;
2298     hdr.version_major = 2;
2299     hdr.version_minor = 4;
2300     hdr.thiszone = 0;
2301     hdr.sigfigs = 0;
2302     hdr.snaplen = s->pcap_caplen;
2303     hdr.linktype = 1;
2304
2305     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2306         config_error(mon, "-net dump write error: %s\n", strerror(errno));
2307         close(s->fd);
2308         qemu_free(s);
2309         return -1;
2310     }
2311
2312     s->pcap_vc = qemu_new_vlan_client(vlan, device, name, NULL, dump_receive, NULL,
2313                                       net_dump_cleanup, s);
2314     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2315              "dump to %s (len=%d)", filename, len);
2316     return 0;
2317 }
2318
2319 /* find or alloc a new VLAN */
2320 VLANState *qemu_find_vlan(int id, int allocate)
2321 {
2322     VLANState **pvlan, *vlan;
2323     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2324         if (vlan->id == id)
2325             return vlan;
2326     }
2327     if (!allocate) {
2328         return NULL;
2329     }
2330     vlan = qemu_mallocz(sizeof(VLANState));
2331     vlan->id = id;
2332     QTAILQ_INIT(&vlan->send_queue);
2333     vlan->next = NULL;
2334     pvlan = &first_vlan;
2335     while (*pvlan != NULL)
2336         pvlan = &(*pvlan)->next;
2337     *pvlan = vlan;
2338     return vlan;
2339 }
2340
2341 static int nic_get_free_idx(void)
2342 {
2343     int index;
2344
2345     for (index = 0; index < MAX_NICS; index++)
2346         if (!nd_table[index].used)
2347             return index;
2348     return -1;
2349 }
2350
2351 void qemu_check_nic_model(NICInfo *nd, const char *model)
2352 {
2353     const char *models[2];
2354
2355     models[0] = model;
2356     models[1] = NULL;
2357
2358     qemu_check_nic_model_list(nd, models, model);
2359 }
2360
2361 void qemu_check_nic_model_list(NICInfo *nd, const char * const *models,
2362                                const char *default_model)
2363 {
2364     int i, exit_status = 0;
2365
2366     if (!nd->model)
2367         nd->model = strdup(default_model);
2368
2369     if (strcmp(nd->model, "?") != 0) {
2370         for (i = 0 ; models[i]; i++)
2371             if (strcmp(nd->model, models[i]) == 0)
2372                 return;
2373
2374         fprintf(stderr, "qemu: Unsupported NIC model: %s\n", nd->model);
2375         exit_status = 1;
2376     }
2377
2378     fprintf(stderr, "qemu: Supported NIC models: ");
2379     for (i = 0 ; models[i]; i++)
2380         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2381
2382     exit(exit_status);
2383 }
2384
2385 static int net_handle_fd_param(Monitor *mon, const char *param)
2386 {
2387     if (!qemu_isdigit(param[0])) {
2388         int fd;
2389
2390         fd = monitor_get_fd(mon, param);
2391         if (fd == -1) {
2392             config_error(mon, "No file descriptor named %s found", param);
2393             return -1;
2394         }
2395
2396         return fd;
2397     } else {
2398         return strtol(param, NULL, 0);
2399     }
2400 }
2401
2402 int net_client_init(Monitor *mon, const char *device, const char *p)
2403 {
2404     char buf[1024];
2405     int vlan_id, ret;
2406     VLANState *vlan;
2407     char *name = NULL;
2408
2409     vlan_id = 0;
2410     if (get_param_value(buf, sizeof(buf), "vlan", p)) {
2411         vlan_id = strtol(buf, NULL, 0);
2412     }
2413     vlan = qemu_find_vlan(vlan_id, 1);
2414
2415     if (get_param_value(buf, sizeof(buf), "name", p)) {
2416         name = qemu_strdup(buf);
2417     }
2418     if (!strcmp(device, "nic")) {
2419         static const char * const nic_params[] = {
2420             "vlan", "name", "macaddr", "model", "addr", "id", "vectors", NULL
2421         };
2422         NICInfo *nd;
2423         uint8_t *macaddr;
2424         int idx = nic_get_free_idx();
2425
2426         if (check_params(buf, sizeof(buf), nic_params, p) < 0) {
2427             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2428             ret = -1;
2429             goto out;
2430         }
2431         if (idx == -1 || nb_nics >= MAX_NICS) {
2432             config_error(mon, "Too Many NICs\n");
2433             ret = -1;
2434             goto out;
2435         }
2436         nd = &nd_table[idx];
2437         macaddr = nd->macaddr;
2438         macaddr[0] = 0x52;
2439         macaddr[1] = 0x54;
2440         macaddr[2] = 0x00;
2441         macaddr[3] = 0x12;
2442         macaddr[4] = 0x34;
2443         macaddr[5] = 0x56 + idx;
2444
2445         if (get_param_value(buf, sizeof(buf), "macaddr", p)) {
2446             if (parse_macaddr(macaddr, buf) < 0) {
2447                 config_error(mon, "invalid syntax for ethernet address\n");
2448                 ret = -1;
2449                 goto out;
2450             }
2451         }
2452         if (get_param_value(buf, sizeof(buf), "model", p)) {
2453             nd->model = strdup(buf);
2454         }
2455         if (get_param_value(buf, sizeof(buf), "addr", p)) {
2456             nd->devaddr = strdup(buf);
2457         }
2458         if (get_param_value(buf, sizeof(buf), "id", p)) {
2459             nd->id = strdup(buf);
2460         }
2461         nd->nvectors = NIC_NVECTORS_UNSPECIFIED;
2462         if (get_param_value(buf, sizeof(buf), "vectors", p)) {
2463             char *endptr;
2464             long vectors = strtol(buf, &endptr, 0);
2465             if (*endptr) {
2466                 config_error(mon, "invalid syntax for # of vectors\n");
2467                 ret = -1;
2468                 goto out;
2469             }
2470             if (vectors < 0 || vectors > 0x7ffffff) {
2471                 config_error(mon, "invalid # of vectors\n");
2472                 ret = -1;
2473                 goto out;
2474             }
2475             nd->nvectors = vectors;
2476         }
2477         nd->vlan = vlan;
2478         nd->name = name;
2479         nd->used = 1;
2480         name = NULL;
2481         nb_nics++;
2482         vlan->nb_guest_devs++;
2483         ret = idx;
2484     } else
2485     if (!strcmp(device, "none")) {
2486         if (*p != '\0') {
2487             config_error(mon, "'none' takes no parameters\n");
2488             ret = -1;
2489             goto out;
2490         }
2491         /* does nothing. It is needed to signal that no network cards
2492            are wanted */
2493         ret = 0;
2494     } else
2495 #ifdef CONFIG_SLIRP
2496     if (!strcmp(device, "user")) {
2497         static const char * const slirp_params[] = {
2498             "vlan", "name", "hostname", "restrict", "ip", "net", "host",
2499             "tftp", "bootfile", "dhcpstart", "dns", "smb", "smbserver",
2500             "hostfwd", "guestfwd", NULL
2501         };
2502         struct slirp_config_str *config;
2503         int restricted = 0;
2504         char *vnet = NULL;
2505         char *vhost = NULL;
2506         char *vhostname = NULL;
2507         char *tftp_export = NULL;
2508         char *bootfile = NULL;
2509         char *vdhcp_start = NULL;
2510         char *vnamesrv = NULL;
2511         char *smb_export = NULL;
2512         char *vsmbsrv = NULL;
2513         const char *q;
2514
2515         if (check_params(buf, sizeof(buf), slirp_params, p) < 0) {
2516             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2517             ret = -1;
2518             goto out;
2519         }
2520         if (get_param_value(buf, sizeof(buf), "ip", p)) {
2521             int vnet_buflen = strlen(buf) + strlen("/24") + 1;
2522             /* emulate legacy parameter */
2523             vnet = qemu_malloc(vnet_buflen);
2524             pstrcpy(vnet, vnet_buflen, buf);
2525             pstrcat(vnet, vnet_buflen, "/24");
2526         }
2527         if (get_param_value(buf, sizeof(buf), "net", p)) {
2528             vnet = qemu_strdup(buf);
2529         }
2530         if (get_param_value(buf, sizeof(buf), "host", p)) {
2531             vhost = qemu_strdup(buf);
2532         }
2533         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
2534             vhostname = qemu_strdup(buf);
2535         }
2536         if (get_param_value(buf, sizeof(buf), "restrict", p)) {
2537             restricted = (buf[0] == 'y') ? 1 : 0;
2538         }
2539         if (get_param_value(buf, sizeof(buf), "dhcpstart", p)) {
2540             vdhcp_start = qemu_strdup(buf);
2541         }
2542         if (get_param_value(buf, sizeof(buf), "dns", p)) {
2543             vnamesrv = qemu_strdup(buf);
2544         }
2545         if (get_param_value(buf, sizeof(buf), "tftp", p)) {
2546             tftp_export = qemu_strdup(buf);
2547         }
2548         if (get_param_value(buf, sizeof(buf), "bootfile", p)) {
2549             bootfile = qemu_strdup(buf);
2550         }
2551         if (get_param_value(buf, sizeof(buf), "smb", p)) {
2552             smb_export = qemu_strdup(buf);
2553             if (get_param_value(buf, sizeof(buf), "smbserver", p)) {
2554                 vsmbsrv = qemu_strdup(buf);
2555             }
2556         }
2557         q = p;
2558         while (1) {
2559             config = qemu_malloc(sizeof(*config));
2560             if (!get_next_param_value(config->str, sizeof(config->str),
2561                                       "hostfwd", &q)) {
2562                 break;
2563             }
2564             config->flags = SLIRP_CFG_HOSTFWD;
2565             config->next = slirp_configs;
2566             slirp_configs = config;
2567             config = NULL;
2568         }
2569         q = p;
2570         while (1) {
2571             config = qemu_malloc(sizeof(*config));
2572             if (!get_next_param_value(config->str, sizeof(config->str),
2573                                       "guestfwd", &q)) {
2574                 break;
2575             }
2576             config->flags = 0;
2577             config->next = slirp_configs;
2578             slirp_configs = config;
2579             config = NULL;
2580         }
2581         qemu_free(config);
2582         vlan->nb_host_devs++;
2583         ret = net_slirp_init(mon, vlan, device, name, restricted, vnet, vhost,
2584                              vhostname, tftp_export, bootfile, vdhcp_start,
2585                              vnamesrv, smb_export, vsmbsrv);
2586         qemu_free(vnet);
2587         qemu_free(vhost);
2588         qemu_free(vhostname);
2589         qemu_free(tftp_export);
2590         qemu_free(bootfile);
2591         qemu_free(vdhcp_start);
2592         qemu_free(vnamesrv);
2593         qemu_free(smb_export);
2594         qemu_free(vsmbsrv);
2595     } else if (!strcmp(device, "channel")) {
2596         if (QTAILQ_EMPTY(&slirp_stacks)) {
2597             struct slirp_config_str *config;
2598
2599             config = qemu_malloc(sizeof(*config));
2600             pstrcpy(config->str, sizeof(config->str), p);
2601             config->flags = SLIRP_CFG_LEGACY;
2602             config->next = slirp_configs;
2603             slirp_configs = config;
2604         } else {
2605             slirp_guestfwd(QTAILQ_FIRST(&slirp_stacks), mon, p, 1);
2606         }
2607         ret = 0;
2608     } else
2609 #endif
2610 #ifdef _WIN32
2611     if (!strcmp(device, "tap")) {
2612         static const char * const tap_params[] = {
2613             "vlan", "name", "ifname", NULL
2614         };
2615         char ifname[64];
2616
2617         if (check_params(buf, sizeof(buf), tap_params, p) < 0) {
2618             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2619             ret = -1;
2620             goto out;
2621         }
2622         if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
2623             config_error(mon, "tap: no interface name\n");
2624             ret = -1;
2625             goto out;
2626         }
2627         vlan->nb_host_devs++;
2628         ret = tap_win32_init(vlan, device, name, ifname);
2629     } else
2630 #elif defined (_AIX)
2631 #else
2632     if (!strcmp(device, "tap")) {
2633         char ifname[64], chkbuf[64];
2634         char setup_script[1024], down_script[1024];
2635         TAPState *s;
2636         int fd;
2637         vlan->nb_host_devs++;
2638         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
2639             static const char * const fd_params[] = {
2640                 "vlan", "name", "fd", "sndbuf", NULL
2641             };
2642             ret = -1;
2643             if (check_params(chkbuf, sizeof(chkbuf), fd_params, p) < 0) {
2644                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2645                 goto out;
2646             }
2647             fd = net_handle_fd_param(mon, buf);
2648             if (fd == -1) {
2649                 goto out;
2650             }
2651             fcntl(fd, F_SETFL, O_NONBLOCK);
2652             s = net_tap_fd_init(vlan, device, name, fd);
2653             if (!s) {
2654                 close(fd);
2655             }
2656         } else {
2657             static const char * const tap_params[] = {
2658                 "vlan", "name", "ifname", "script", "downscript", "sndbuf", NULL
2659             };
2660             if (check_params(chkbuf, sizeof(chkbuf), tap_params, p) < 0) {
2661                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2662                 ret = -1;
2663                 goto out;
2664             }
2665             if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0) {
2666                 ifname[0] = '\0';
2667             }
2668             if (get_param_value(setup_script, sizeof(setup_script), "script", p) == 0) {
2669                 pstrcpy(setup_script, sizeof(setup_script), DEFAULT_NETWORK_SCRIPT);
2670             }
2671             if (get_param_value(down_script, sizeof(down_script), "downscript", p) == 0) {
2672                 pstrcpy(down_script, sizeof(down_script), DEFAULT_NETWORK_DOWN_SCRIPT);
2673             }
2674             s = net_tap_init(vlan, device, name, ifname, setup_script, down_script);
2675         }
2676         if (s != NULL) {
2677             const char *sndbuf_str = NULL;
2678             if (get_param_value(buf, sizeof(buf), "sndbuf", p)) {
2679                 sndbuf_str = buf;
2680             }
2681             tap_set_sndbuf(s, sndbuf_str, mon);
2682             ret = 0;
2683         } else {
2684             ret = -1;
2685         }
2686     } else
2687 #endif
2688     if (!strcmp(device, "socket")) {
2689         char chkbuf[64];
2690         if (get_param_value(buf, sizeof(buf), "fd", p) > 0) {
2691             static const char * const fd_params[] = {
2692                 "vlan", "name", "fd", NULL
2693             };
2694             int fd;
2695             ret = -1;
2696             if (check_params(chkbuf, sizeof(chkbuf), fd_params, p) < 0) {
2697                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2698                 goto out;
2699             }
2700             fd = net_handle_fd_param(mon, buf);
2701             if (fd == -1) {
2702                 goto out;
2703             }
2704             if (!net_socket_fd_init(vlan, device, name, fd, 1)) {
2705                 close(fd);
2706                 goto out;
2707             }
2708             ret = 0;
2709         } else if (get_param_value(buf, sizeof(buf), "listen", p) > 0) {
2710             static const char * const listen_params[] = {
2711                 "vlan", "name", "listen", NULL
2712             };
2713             if (check_params(chkbuf, sizeof(chkbuf), listen_params, p) < 0) {
2714                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2715                 ret = -1;
2716                 goto out;
2717             }
2718             ret = net_socket_listen_init(vlan, device, name, buf);
2719         } else if (get_param_value(buf, sizeof(buf), "connect", p) > 0) {
2720             static const char * const connect_params[] = {
2721                 "vlan", "name", "connect", NULL
2722             };
2723             if (check_params(chkbuf, sizeof(chkbuf), connect_params, p) < 0) {
2724                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2725                 ret = -1;
2726                 goto out;
2727             }
2728             ret = net_socket_connect_init(vlan, device, name, buf);
2729         } else if (get_param_value(buf, sizeof(buf), "mcast", p) > 0) {
2730             static const char * const mcast_params[] = {
2731                 "vlan", "name", "mcast", NULL
2732             };
2733             if (check_params(chkbuf, sizeof(chkbuf), mcast_params, p) < 0) {
2734                 config_error(mon, "invalid parameter '%s' in '%s'\n", chkbuf, p);
2735                 ret = -1;
2736                 goto out;
2737             }
2738             ret = net_socket_mcast_init(vlan, device, name, buf);
2739         } else {
2740             config_error(mon, "Unknown socket options: %s\n", p);
2741             ret = -1;
2742             goto out;
2743         }
2744         vlan->nb_host_devs++;
2745     } else
2746 #ifdef CONFIG_VDE
2747     if (!strcmp(device, "vde")) {
2748         static const char * const vde_params[] = {
2749             "vlan", "name", "sock", "port", "group", "mode", NULL
2750         };
2751         char vde_sock[1024], vde_group[512];
2752         int vde_port, vde_mode;
2753
2754         if (check_params(buf, sizeof(buf), vde_params, p) < 0) {
2755             config_error(mon, "invalid parameter '%s' in '%s'\n", buf, p);
2756             ret = -1;
2757             goto out;
2758         }
2759         vlan->nb_host_devs++;
2760         if (get_param_value(vde_sock, sizeof(vde_sock), "sock", p) <= 0) {
2761             vde_sock[0] = '\0';
2762         }
2763         if (get_param_value(buf, sizeof(buf), "port", p) > 0) {
2764             vde_port = strtol(buf, NULL, 10);
2765         } else {
2766             vde_port = 0;
2767         }
2768         if (get_param_value(vde_group, sizeof(vde_group), "group", p) <= 0) {
2769             vde_group[0] = '\0';
2770         }
2771         if (get_param_value(buf, sizeof(buf), "mode", p) > 0) {
2772             vde_mode = strtol(buf, NULL, 8);
2773         } else {
2774             vde_mode = 0700;
2775         }
2776         ret = net_vde_init(vlan, device, name, vde_sock, vde_port, vde_group, vde_mode);
2777     } else
2778 #endif
2779     if (!strcmp(device, "dump")) {
2780         int len = 65536;
2781
2782         if (get_param_value(buf, sizeof(buf), "len", p) > 0) {
2783             len = strtol(buf, NULL, 0);
2784         }
2785         if (!get_param_value(buf, sizeof(buf), "file", p)) {
2786             snprintf(buf, sizeof(buf), "qemu-vlan%d.pcap", vlan_id);
2787         }
2788         ret = net_dump_init(mon, vlan, device, name, buf, len);
2789     } else {
2790         config_error(mon, "Unknown network device: %s\n", device);
2791         ret = -1;
2792         goto out;
2793     }
2794     if (ret < 0) {
2795         config_error(mon, "Could not initialize device '%s'\n", device);
2796     }
2797 out:
2798     qemu_free(name);
2799     return ret;
2800 }
2801
2802 void net_client_uninit(NICInfo *nd)
2803 {
2804     nd->vlan->nb_guest_devs--;
2805     nb_nics--;
2806     nd->used = 0;
2807     free((void *)nd->model);
2808 }
2809
2810 static int net_host_check_device(const char *device)
2811 {
2812     int i;
2813     const char *valid_param_list[] = { "tap", "socket", "dump"
2814 #ifdef CONFIG_SLIRP
2815                                        ,"user"
2816 #endif
2817 #ifdef CONFIG_VDE
2818                                        ,"vde"
2819 #endif
2820     };
2821     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
2822         if (!strncmp(valid_param_list[i], device,
2823                      strlen(valid_param_list[i])))
2824             return 1;
2825     }
2826
2827     return 0;
2828 }
2829
2830 void net_host_device_add(Monitor *mon, const QDict *qdict)
2831 {
2832     const char *device = qdict_get_str(qdict, "device");
2833     const char *opts = qdict_get_try_str(qdict, "opts");
2834
2835     if (!net_host_check_device(device)) {
2836         monitor_printf(mon, "invalid host network device %s\n", device);
2837         return;
2838     }
2839     if (net_client_init(mon, device, opts ? opts : "") < 0) {
2840         monitor_printf(mon, "adding host network device %s failed\n", device);
2841     }
2842 }
2843
2844 void net_host_device_remove(Monitor *mon, const QDict *qdict)
2845 {
2846     VLANClientState *vc;
2847     int vlan_id = qdict_get_int(qdict, "vlan_id");
2848     const char *device = qdict_get_str(qdict, "device");
2849
2850     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
2851     if (!vc) {
2852         return;
2853     }
2854     if (!net_host_check_device(vc->model)) {
2855         monitor_printf(mon, "invalid host network device %s\n", device);
2856         return;
2857     }
2858     qemu_del_vlan_client(vc);
2859 }
2860
2861 int net_client_parse(const char *str)
2862 {
2863     const char *p;
2864     char *q;
2865     char device[64];
2866
2867     p = str;
2868     q = device;
2869     while (*p != '\0' && *p != ',') {
2870         if ((q - device) < sizeof(device) - 1)
2871             *q++ = *p;
2872         p++;
2873     }
2874     *q = '\0';
2875     if (*p == ',')
2876         p++;
2877
2878     return net_client_init(NULL, device, p);
2879 }
2880
2881 void net_set_boot_mask(int net_boot_mask)
2882 {
2883     int i;
2884
2885     /* Only the first four NICs may be bootable */
2886     net_boot_mask = net_boot_mask & 0xF;
2887
2888     for (i = 0; i < nb_nics; i++) {
2889         if (net_boot_mask & (1 << i)) {
2890             nd_table[i].bootable = 1;
2891             net_boot_mask &= ~(1 << i);
2892         }
2893     }
2894
2895     if (net_boot_mask) {
2896         fprintf(stderr, "Cannot boot from non-existent NIC\n");
2897         exit(1);
2898     }
2899 }
2900
2901 void do_info_network(Monitor *mon)
2902 {
2903     VLANState *vlan;
2904     VLANClientState *vc;
2905
2906     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2907         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
2908         for(vc = vlan->first_client; vc != NULL; vc = vc->next)
2909             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
2910     }
2911 }
2912
2913 void do_set_link(Monitor *mon, const QDict *qdict)
2914 {
2915     VLANState *vlan;
2916     VLANClientState *vc = NULL;
2917     const char *name = qdict_get_str(qdict, "name");
2918     const char *up_or_down = qdict_get_str(qdict, "up_or_down");
2919
2920     for (vlan = first_vlan; vlan != NULL; vlan = vlan->next)
2921         for (vc = vlan->first_client; vc != NULL; vc = vc->next)
2922             if (strcmp(vc->name, name) == 0)
2923                 goto done;
2924 done:
2925
2926     if (!vc) {
2927         monitor_printf(mon, "could not find network device '%s'\n", name);
2928         return;
2929     }
2930
2931     if (strcmp(up_or_down, "up") == 0)
2932         vc->link_down = 0;
2933     else if (strcmp(up_or_down, "down") == 0)
2934         vc->link_down = 1;
2935     else
2936         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
2937                        "valid\n", up_or_down);
2938
2939     if (vc->link_status_changed)
2940         vc->link_status_changed(vc);
2941 }
2942
2943 void net_cleanup(void)
2944 {
2945     VLANState *vlan;
2946
2947     /* close network clients */
2948     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2949         VLANClientState *vc = vlan->first_client;
2950
2951         while (vc) {
2952             VLANClientState *next = vc->next;
2953
2954             qemu_del_vlan_client(vc);
2955
2956             vc = next;
2957         }
2958     }
2959 }
2960
2961 void net_client_check(void)
2962 {
2963     VLANState *vlan;
2964
2965     for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {
2966         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
2967             continue;
2968         if (vlan->nb_guest_devs == 0)
2969             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
2970         if (vlan->nb_host_devs == 0)
2971             fprintf(stderr,
2972                     "Warning: vlan %d is not connected to host network\n",
2973                     vlan->id);
2974     }
2975 }