Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
[qemu.git] / nbd.c
1 /*
2 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
3 *
4 * Network Block Device
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; under version 2 of the License.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include "block/nbd.h"
20 #include "block/block.h"
21
22 #include "block/coroutine.h"
23
24 #include <errno.h>
25 #include <string.h>
26 #ifndef _WIN32
27 #include <sys/ioctl.h>
28 #endif
29 #if defined(__sun__) || defined(__HAIKU__)
30 #include <sys/ioccom.h>
31 #endif
32 #include <ctype.h>
33 #include <inttypes.h>
34
35 #ifdef __linux__
36 #include <linux/fs.h>
37 #endif
38
39 #include "qemu/sockets.h"
40 #include "qemu/queue.h"
41 #include "qemu/main-loop.h"
42
43 //#define DEBUG_NBD
44
45 #ifdef DEBUG_NBD
46 #define TRACE(msg, ...) do { \
47 LOG(msg, ## __VA_ARGS__); \
48 } while(0)
49 #else
50 #define TRACE(msg, ...) \
51 do { } while (0)
52 #endif
53
54 #define LOG(msg, ...) do { \
55 fprintf(stderr, "%s:%s():L%d: " msg "\n", \
56 __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
57 } while(0)
58
59 /* This is all part of the "official" NBD API */
60
61 #define NBD_REQUEST_SIZE (4 + 4 + 8 + 8 + 4)
62 #define NBD_REPLY_SIZE (4 + 4 + 8)
63 #define NBD_REQUEST_MAGIC 0x25609513
64 #define NBD_REPLY_MAGIC 0x67446698
65 #define NBD_OPTS_MAGIC 0x49484156454F5054LL
66 #define NBD_CLIENT_MAGIC 0x0000420281861253LL
67
68 #define NBD_SET_SOCK _IO(0xab, 0)
69 #define NBD_SET_BLKSIZE _IO(0xab, 1)
70 #define NBD_SET_SIZE _IO(0xab, 2)
71 #define NBD_DO_IT _IO(0xab, 3)
72 #define NBD_CLEAR_SOCK _IO(0xab, 4)
73 #define NBD_CLEAR_QUE _IO(0xab, 5)
74 #define NBD_PRINT_DEBUG _IO(0xab, 6)
75 #define NBD_SET_SIZE_BLOCKS _IO(0xab, 7)
76 #define NBD_DISCONNECT _IO(0xab, 8)
77 #define NBD_SET_TIMEOUT _IO(0xab, 9)
78 #define NBD_SET_FLAGS _IO(0xab, 10)
79
80 #define NBD_OPT_EXPORT_NAME (1 << 0)
81
82 /* Definitions for opaque data types */
83
84 typedef struct NBDRequest NBDRequest;
85
86 struct NBDRequest {
87 QSIMPLEQ_ENTRY(NBDRequest) entry;
88 NBDClient *client;
89 uint8_t *data;
90 };
91
92 struct NBDExport {
93 int refcount;
94 void (*close)(NBDExport *exp);
95
96 BlockDriverState *bs;
97 char *name;
98 off_t dev_offset;
99 off_t size;
100 uint32_t nbdflags;
101 QTAILQ_HEAD(, NBDClient) clients;
102 QTAILQ_ENTRY(NBDExport) next;
103 };
104
105 static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);
106
107 struct NBDClient {
108 int refcount;
109 void (*close)(NBDClient *client);
110
111 NBDExport *exp;
112 int sock;
113
114 Coroutine *recv_coroutine;
115
116 CoMutex send_lock;
117 Coroutine *send_coroutine;
118
119 QTAILQ_ENTRY(NBDClient) next;
120 int nb_requests;
121 bool closing;
122 };
123
124 /* That's all folks */
125
126 ssize_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
127 {
128 size_t offset = 0;
129 int err;
130
131 if (qemu_in_coroutine()) {
132 if (do_read) {
133 return qemu_co_recv(fd, buffer, size);
134 } else {
135 return qemu_co_send(fd, buffer, size);
136 }
137 }
138
139 while (offset < size) {
140 ssize_t len;
141
142 if (do_read) {
143 len = qemu_recv(fd, buffer + offset, size - offset, 0);
144 } else {
145 len = send(fd, buffer + offset, size - offset, 0);
146 }
147
148 if (len < 0) {
149 err = socket_error();
150
151 /* recoverable error */
152 if (err == EINTR || (offset > 0 && err == EAGAIN)) {
153 continue;
154 }
155
156 /* unrecoverable error */
157 return -err;
158 }
159
160 /* eof */
161 if (len == 0) {
162 break;
163 }
164
165 offset += len;
166 }
167
168 return offset;
169 }
170
171 static ssize_t read_sync(int fd, void *buffer, size_t size)
172 {
173 /* Sockets are kept in blocking mode in the negotiation phase. After
174 * that, a non-readable socket simply means that another thread stole
175 * our request/reply. Synchronization is done with recv_coroutine, so
176 * that this is coroutine-safe.
177 */
178 return nbd_wr_sync(fd, buffer, size, true);
179 }
180
181 static ssize_t write_sync(int fd, void *buffer, size_t size)
182 {
183 int ret;
184 do {
185 /* For writes, we do expect the socket to be writable. */
186 ret = nbd_wr_sync(fd, buffer, size, false);
187 } while (ret == -EAGAIN);
188 return ret;
189 }
190
191 /* Basic flow for negotiation
192
193 Server Client
194 Negotiate
195
196 or
197
198 Server Client
199 Negotiate #1
200 Option
201 Negotiate #2
202
203 ----
204
205 followed by
206
207 Server Client
208 Request
209 Response
210 Request
211 Response
212 ...
213 ...
214 Request (type == 2)
215
216 */
217
218 static int nbd_receive_options(NBDClient *client)
219 {
220 int csock = client->sock;
221 char name[256];
222 uint32_t tmp, length;
223 uint64_t magic;
224 int rc;
225
226 /* Client sends:
227 [ 0 .. 3] reserved (0)
228 [ 4 .. 11] NBD_OPTS_MAGIC
229 [12 .. 15] NBD_OPT_EXPORT_NAME
230 [16 .. 19] length
231 [20 .. xx] export name (length bytes)
232 */
233
234 rc = -EINVAL;
235 if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
236 LOG("read failed");
237 goto fail;
238 }
239 TRACE("Checking reserved");
240 if (tmp != 0) {
241 LOG("Bad reserved received");
242 goto fail;
243 }
244
245 if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
246 LOG("read failed");
247 goto fail;
248 }
249 TRACE("Checking reserved");
250 if (magic != be64_to_cpu(NBD_OPTS_MAGIC)) {
251 LOG("Bad magic received");
252 goto fail;
253 }
254
255 if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
256 LOG("read failed");
257 goto fail;
258 }
259 TRACE("Checking option");
260 if (tmp != be32_to_cpu(NBD_OPT_EXPORT_NAME)) {
261 LOG("Bad option received");
262 goto fail;
263 }
264
265 if (read_sync(csock, &length, sizeof(length)) != sizeof(length)) {
266 LOG("read failed");
267 goto fail;
268 }
269 TRACE("Checking length");
270 length = be32_to_cpu(length);
271 if (length > 255) {
272 LOG("Bad length received");
273 goto fail;
274 }
275 if (read_sync(csock, name, length) != length) {
276 LOG("read failed");
277 goto fail;
278 }
279 name[length] = '\0';
280
281 client->exp = nbd_export_find(name);
282 if (!client->exp) {
283 LOG("export not found");
284 goto fail;
285 }
286
287 QTAILQ_INSERT_TAIL(&client->exp->clients, client, next);
288 nbd_export_get(client->exp);
289
290 TRACE("Option negotiation succeeded.");
291 rc = 0;
292 fail:
293 return rc;
294 }
295
296 static int nbd_send_negotiate(NBDClient *client)
297 {
298 int csock = client->sock;
299 char buf[8 + 8 + 8 + 128];
300 int rc;
301 const int myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
302 NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
303
304 /* Negotiation header without options:
305 [ 0 .. 7] passwd ("NBDMAGIC")
306 [ 8 .. 15] magic (NBD_CLIENT_MAGIC)
307 [16 .. 23] size
308 [24 .. 25] server flags (0)
309 [24 .. 27] export flags
310 [28 .. 151] reserved (0)
311
312 Negotiation header with options, part 1:
313 [ 0 .. 7] passwd ("NBDMAGIC")
314 [ 8 .. 15] magic (NBD_OPTS_MAGIC)
315 [16 .. 17] server flags (0)
316
317 part 2 (after options are sent):
318 [18 .. 25] size
319 [26 .. 27] export flags
320 [28 .. 151] reserved (0)
321 */
322
323 qemu_set_block(csock);
324 rc = -EINVAL;
325
326 TRACE("Beginning negotiation.");
327 memset(buf, 0, sizeof(buf));
328 memcpy(buf, "NBDMAGIC", 8);
329 if (client->exp) {
330 assert ((client->exp->nbdflags & ~65535) == 0);
331 cpu_to_be64w((uint64_t*)(buf + 8), NBD_CLIENT_MAGIC);
332 cpu_to_be64w((uint64_t*)(buf + 16), client->exp->size);
333 cpu_to_be16w((uint16_t*)(buf + 26), client->exp->nbdflags | myflags);
334 } else {
335 cpu_to_be64w((uint64_t*)(buf + 8), NBD_OPTS_MAGIC);
336 }
337
338 if (client->exp) {
339 if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
340 LOG("write failed");
341 goto fail;
342 }
343 } else {
344 if (write_sync(csock, buf, 18) != 18) {
345 LOG("write failed");
346 goto fail;
347 }
348 rc = nbd_receive_options(client);
349 if (rc < 0) {
350 LOG("option negotiation failed");
351 goto fail;
352 }
353
354 assert ((client->exp->nbdflags & ~65535) == 0);
355 cpu_to_be64w((uint64_t*)(buf + 18), client->exp->size);
356 cpu_to_be16w((uint16_t*)(buf + 26), client->exp->nbdflags | myflags);
357 if (write_sync(csock, buf + 18, sizeof(buf) - 18) != sizeof(buf) - 18) {
358 LOG("write failed");
359 goto fail;
360 }
361 }
362
363 TRACE("Negotiation succeeded.");
364 rc = 0;
365 fail:
366 qemu_set_nonblock(csock);
367 return rc;
368 }
369
370 int nbd_receive_negotiate(int csock, const char *name, uint32_t *flags,
371 off_t *size, size_t *blocksize)
372 {
373 char buf[256];
374 uint64_t magic, s;
375 uint16_t tmp;
376 int rc;
377
378 TRACE("Receiving negotiation.");
379
380 rc = -EINVAL;
381
382 if (read_sync(csock, buf, 8) != 8) {
383 LOG("read failed");
384 goto fail;
385 }
386
387 buf[8] = '\0';
388 if (strlen(buf) == 0) {
389 LOG("server connection closed");
390 goto fail;
391 }
392
393 TRACE("Magic is %c%c%c%c%c%c%c%c",
394 qemu_isprint(buf[0]) ? buf[0] : '.',
395 qemu_isprint(buf[1]) ? buf[1] : '.',
396 qemu_isprint(buf[2]) ? buf[2] : '.',
397 qemu_isprint(buf[3]) ? buf[3] : '.',
398 qemu_isprint(buf[4]) ? buf[4] : '.',
399 qemu_isprint(buf[5]) ? buf[5] : '.',
400 qemu_isprint(buf[6]) ? buf[6] : '.',
401 qemu_isprint(buf[7]) ? buf[7] : '.');
402
403 if (memcmp(buf, "NBDMAGIC", 8) != 0) {
404 LOG("Invalid magic received");
405 goto fail;
406 }
407
408 if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
409 LOG("read failed");
410 goto fail;
411 }
412 magic = be64_to_cpu(magic);
413 TRACE("Magic is 0x%" PRIx64, magic);
414
415 if (name) {
416 uint32_t reserved = 0;
417 uint32_t opt;
418 uint32_t namesize;
419
420 TRACE("Checking magic (opts_magic)");
421 if (magic != NBD_OPTS_MAGIC) {
422 LOG("Bad magic received");
423 goto fail;
424 }
425 if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
426 LOG("flags read failed");
427 goto fail;
428 }
429 *flags = be16_to_cpu(tmp) << 16;
430 /* reserved for future use */
431 if (write_sync(csock, &reserved, sizeof(reserved)) !=
432 sizeof(reserved)) {
433 LOG("write failed (reserved)");
434 goto fail;
435 }
436 /* write the export name */
437 magic = cpu_to_be64(magic);
438 if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
439 LOG("write failed (magic)");
440 goto fail;
441 }
442 opt = cpu_to_be32(NBD_OPT_EXPORT_NAME);
443 if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {
444 LOG("write failed (opt)");
445 goto fail;
446 }
447 namesize = cpu_to_be32(strlen(name));
448 if (write_sync(csock, &namesize, sizeof(namesize)) !=
449 sizeof(namesize)) {
450 LOG("write failed (namesize)");
451 goto fail;
452 }
453 if (write_sync(csock, (char*)name, strlen(name)) != strlen(name)) {
454 LOG("write failed (name)");
455 goto fail;
456 }
457 } else {
458 TRACE("Checking magic (cli_magic)");
459
460 if (magic != NBD_CLIENT_MAGIC) {
461 LOG("Bad magic received");
462 goto fail;
463 }
464 }
465
466 if (read_sync(csock, &s, sizeof(s)) != sizeof(s)) {
467 LOG("read failed");
468 goto fail;
469 }
470 *size = be64_to_cpu(s);
471 *blocksize = 1024;
472 TRACE("Size is %" PRIu64, *size);
473
474 if (!name) {
475 if (read_sync(csock, flags, sizeof(*flags)) != sizeof(*flags)) {
476 LOG("read failed (flags)");
477 goto fail;
478 }
479 *flags = be32_to_cpup(flags);
480 } else {
481 if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
482 LOG("read failed (tmp)");
483 goto fail;
484 }
485 *flags |= be32_to_cpu(tmp);
486 }
487 if (read_sync(csock, &buf, 124) != 124) {
488 LOG("read failed (buf)");
489 goto fail;
490 }
491 rc = 0;
492
493 fail:
494 return rc;
495 }
496
497 #ifdef __linux__
498 int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
499 {
500 TRACE("Setting NBD socket");
501
502 if (ioctl(fd, NBD_SET_SOCK, csock) < 0) {
503 int serrno = errno;
504 LOG("Failed to set NBD socket");
505 return -serrno;
506 }
507
508 TRACE("Setting block size to %lu", (unsigned long)blocksize);
509
510 if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) < 0) {
511 int serrno = errno;
512 LOG("Failed setting NBD block size");
513 return -serrno;
514 }
515
516 TRACE("Setting size to %zd block(s)", (size_t)(size / blocksize));
517
518 if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) < 0) {
519 int serrno = errno;
520 LOG("Failed setting size (in blocks)");
521 return -serrno;
522 }
523
524 if (ioctl(fd, NBD_SET_FLAGS, flags) < 0) {
525 if (errno == ENOTTY) {
526 int read_only = (flags & NBD_FLAG_READ_ONLY) != 0;
527 TRACE("Setting readonly attribute");
528
529 if (ioctl(fd, BLKROSET, (unsigned long) &read_only) < 0) {
530 int serrno = errno;
531 LOG("Failed setting read-only attribute");
532 return -serrno;
533 }
534 } else {
535 int serrno = errno;
536 LOG("Failed setting flags");
537 return -serrno;
538 }
539 }
540
541 TRACE("Negotiation ended");
542
543 return 0;
544 }
545
546 int nbd_disconnect(int fd)
547 {
548 ioctl(fd, NBD_CLEAR_QUE);
549 ioctl(fd, NBD_DISCONNECT);
550 ioctl(fd, NBD_CLEAR_SOCK);
551 return 0;
552 }
553
554 int nbd_client(int fd)
555 {
556 int ret;
557 int serrno;
558
559 TRACE("Doing NBD loop");
560
561 ret = ioctl(fd, NBD_DO_IT);
562 if (ret < 0 && errno == EPIPE) {
563 /* NBD_DO_IT normally returns EPIPE when someone has disconnected
564 * the socket via NBD_DISCONNECT. We do not want to return 1 in
565 * that case.
566 */
567 ret = 0;
568 }
569 serrno = errno;
570
571 TRACE("NBD loop returned %d: %s", ret, strerror(serrno));
572
573 TRACE("Clearing NBD queue");
574 ioctl(fd, NBD_CLEAR_QUE);
575
576 TRACE("Clearing NBD socket");
577 ioctl(fd, NBD_CLEAR_SOCK);
578
579 errno = serrno;
580 return ret;
581 }
582 #else
583 int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
584 {
585 return -ENOTSUP;
586 }
587
588 int nbd_disconnect(int fd)
589 {
590 return -ENOTSUP;
591 }
592
593 int nbd_client(int fd)
594 {
595 return -ENOTSUP;
596 }
597 #endif
598
599 ssize_t nbd_send_request(int csock, struct nbd_request *request)
600 {
601 uint8_t buf[NBD_REQUEST_SIZE];
602 ssize_t ret;
603
604 cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
605 cpu_to_be32w((uint32_t*)(buf + 4), request->type);
606 cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
607 cpu_to_be64w((uint64_t*)(buf + 16), request->from);
608 cpu_to_be32w((uint32_t*)(buf + 24), request->len);
609
610 TRACE("Sending request to client: "
611 "{ .from = %" PRIu64", .len = %u, .handle = %" PRIu64", .type=%i}",
612 request->from, request->len, request->handle, request->type);
613
614 ret = write_sync(csock, buf, sizeof(buf));
615 if (ret < 0) {
616 return ret;
617 }
618
619 if (ret != sizeof(buf)) {
620 LOG("writing to socket failed");
621 return -EINVAL;
622 }
623 return 0;
624 }
625
626 static ssize_t nbd_receive_request(int csock, struct nbd_request *request)
627 {
628 uint8_t buf[NBD_REQUEST_SIZE];
629 uint32_t magic;
630 ssize_t ret;
631
632 ret = read_sync(csock, buf, sizeof(buf));
633 if (ret < 0) {
634 return ret;
635 }
636
637 if (ret != sizeof(buf)) {
638 LOG("read failed");
639 return -EINVAL;
640 }
641
642 /* Request
643 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
644 [ 4 .. 7] type (0 == READ, 1 == WRITE)
645 [ 8 .. 15] handle
646 [16 .. 23] from
647 [24 .. 27] len
648 */
649
650 magic = be32_to_cpup((uint32_t*)buf);
651 request->type = be32_to_cpup((uint32_t*)(buf + 4));
652 request->handle = be64_to_cpup((uint64_t*)(buf + 8));
653 request->from = be64_to_cpup((uint64_t*)(buf + 16));
654 request->len = be32_to_cpup((uint32_t*)(buf + 24));
655
656 TRACE("Got request: "
657 "{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
658 magic, request->type, request->from, request->len);
659
660 if (magic != NBD_REQUEST_MAGIC) {
661 LOG("invalid magic (got 0x%x)", magic);
662 return -EINVAL;
663 }
664 return 0;
665 }
666
667 ssize_t nbd_receive_reply(int csock, struct nbd_reply *reply)
668 {
669 uint8_t buf[NBD_REPLY_SIZE];
670 uint32_t magic;
671 ssize_t ret;
672
673 ret = read_sync(csock, buf, sizeof(buf));
674 if (ret < 0) {
675 return ret;
676 }
677
678 if (ret != sizeof(buf)) {
679 LOG("read failed");
680 return -EINVAL;
681 }
682
683 /* Reply
684 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
685 [ 4 .. 7] error (0 == no error)
686 [ 7 .. 15] handle
687 */
688
689 magic = be32_to_cpup((uint32_t*)buf);
690 reply->error = be32_to_cpup((uint32_t*)(buf + 4));
691 reply->handle = be64_to_cpup((uint64_t*)(buf + 8));
692
693 TRACE("Got reply: "
694 "{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
695 magic, reply->error, reply->handle);
696
697 if (magic != NBD_REPLY_MAGIC) {
698 LOG("invalid magic (got 0x%x)", magic);
699 return -EINVAL;
700 }
701 return 0;
702 }
703
704 static ssize_t nbd_send_reply(int csock, struct nbd_reply *reply)
705 {
706 uint8_t buf[NBD_REPLY_SIZE];
707 ssize_t ret;
708
709 /* Reply
710 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
711 [ 4 .. 7] error (0 == no error)
712 [ 7 .. 15] handle
713 */
714 cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
715 cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
716 cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);
717
718 TRACE("Sending response to client");
719
720 ret = write_sync(csock, buf, sizeof(buf));
721 if (ret < 0) {
722 return ret;
723 }
724
725 if (ret != sizeof(buf)) {
726 LOG("writing to socket failed");
727 return -EINVAL;
728 }
729 return 0;
730 }
731
732 #define MAX_NBD_REQUESTS 16
733
734 void nbd_client_get(NBDClient *client)
735 {
736 client->refcount++;
737 }
738
739 void nbd_client_put(NBDClient *client)
740 {
741 if (--client->refcount == 0) {
742 /* The last reference should be dropped by client->close,
743 * which is called by nbd_client_close.
744 */
745 assert(client->closing);
746
747 qemu_set_fd_handler2(client->sock, NULL, NULL, NULL, NULL);
748 close(client->sock);
749 client->sock = -1;
750 if (client->exp) {
751 QTAILQ_REMOVE(&client->exp->clients, client, next);
752 nbd_export_put(client->exp);
753 }
754 g_free(client);
755 }
756 }
757
758 void nbd_client_close(NBDClient *client)
759 {
760 if (client->closing) {
761 return;
762 }
763
764 client->closing = true;
765
766 /* Force requests to finish. They will drop their own references,
767 * then we'll close the socket and free the NBDClient.
768 */
769 shutdown(client->sock, 2);
770
771 /* Also tell the client, so that they release their reference. */
772 if (client->close) {
773 client->close(client);
774 }
775 }
776
777 static NBDRequest *nbd_request_get(NBDClient *client)
778 {
779 NBDRequest *req;
780
781 assert(client->nb_requests <= MAX_NBD_REQUESTS - 1);
782 client->nb_requests++;
783
784 req = g_slice_new0(NBDRequest);
785 nbd_client_get(client);
786 req->client = client;
787 return req;
788 }
789
790 static void nbd_request_put(NBDRequest *req)
791 {
792 NBDClient *client = req->client;
793
794 if (req->data) {
795 qemu_vfree(req->data);
796 }
797 g_slice_free(NBDRequest, req);
798
799 if (client->nb_requests-- == MAX_NBD_REQUESTS) {
800 qemu_notify_event();
801 }
802 nbd_client_put(client);
803 }
804
805 NBDExport *nbd_export_new(BlockDriverState *bs, off_t dev_offset,
806 off_t size, uint32_t nbdflags,
807 void (*close)(NBDExport *))
808 {
809 NBDExport *exp = g_malloc0(sizeof(NBDExport));
810 exp->refcount = 1;
811 QTAILQ_INIT(&exp->clients);
812 exp->bs = bs;
813 exp->dev_offset = dev_offset;
814 exp->nbdflags = nbdflags;
815 exp->size = size == -1 ? bdrv_getlength(bs) : size;
816 exp->close = close;
817 bdrv_ref(bs);
818 return exp;
819 }
820
821 NBDExport *nbd_export_find(const char *name)
822 {
823 NBDExport *exp;
824 QTAILQ_FOREACH(exp, &exports, next) {
825 if (strcmp(name, exp->name) == 0) {
826 return exp;
827 }
828 }
829
830 return NULL;
831 }
832
833 void nbd_export_set_name(NBDExport *exp, const char *name)
834 {
835 if (exp->name == name) {
836 return;
837 }
838
839 nbd_export_get(exp);
840 if (exp->name != NULL) {
841 g_free(exp->name);
842 exp->name = NULL;
843 QTAILQ_REMOVE(&exports, exp, next);
844 nbd_export_put(exp);
845 }
846 if (name != NULL) {
847 nbd_export_get(exp);
848 exp->name = g_strdup(name);
849 QTAILQ_INSERT_TAIL(&exports, exp, next);
850 }
851 nbd_export_put(exp);
852 }
853
854 void nbd_export_close(NBDExport *exp)
855 {
856 NBDClient *client, *next;
857
858 nbd_export_get(exp);
859 QTAILQ_FOREACH_SAFE(client, &exp->clients, next, next) {
860 nbd_client_close(client);
861 }
862 nbd_export_set_name(exp, NULL);
863 nbd_export_put(exp);
864 if (exp->bs) {
865 bdrv_unref(exp->bs);
866 exp->bs = NULL;
867 }
868 }
869
870 void nbd_export_get(NBDExport *exp)
871 {
872 assert(exp->refcount > 0);
873 exp->refcount++;
874 }
875
876 void nbd_export_put(NBDExport *exp)
877 {
878 assert(exp->refcount > 0);
879 if (exp->refcount == 1) {
880 nbd_export_close(exp);
881 }
882
883 if (--exp->refcount == 0) {
884 assert(exp->name == NULL);
885
886 if (exp->close) {
887 exp->close(exp);
888 }
889
890 g_free(exp);
891 }
892 }
893
894 BlockDriverState *nbd_export_get_blockdev(NBDExport *exp)
895 {
896 return exp->bs;
897 }
898
899 void nbd_export_close_all(void)
900 {
901 NBDExport *exp, *next;
902
903 QTAILQ_FOREACH_SAFE(exp, &exports, next, next) {
904 nbd_export_close(exp);
905 }
906 }
907
908 static int nbd_can_read(void *opaque);
909 static void nbd_read(void *opaque);
910 static void nbd_restart_write(void *opaque);
911
912 static ssize_t nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,
913 int len)
914 {
915 NBDClient *client = req->client;
916 int csock = client->sock;
917 ssize_t rc, ret;
918
919 qemu_co_mutex_lock(&client->send_lock);
920 qemu_set_fd_handler2(csock, nbd_can_read, nbd_read,
921 nbd_restart_write, client);
922 client->send_coroutine = qemu_coroutine_self();
923
924 if (!len) {
925 rc = nbd_send_reply(csock, reply);
926 } else {
927 socket_set_cork(csock, 1);
928 rc = nbd_send_reply(csock, reply);
929 if (rc >= 0) {
930 ret = qemu_co_send(csock, req->data, len);
931 if (ret != len) {
932 rc = -EIO;
933 }
934 }
935 socket_set_cork(csock, 0);
936 }
937
938 client->send_coroutine = NULL;
939 qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);
940 qemu_co_mutex_unlock(&client->send_lock);
941 return rc;
942 }
943
944 static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *request)
945 {
946 NBDClient *client = req->client;
947 int csock = client->sock;
948 uint32_t command;
949 ssize_t rc;
950
951 client->recv_coroutine = qemu_coroutine_self();
952 rc = nbd_receive_request(csock, request);
953 if (rc < 0) {
954 if (rc != -EAGAIN) {
955 rc = -EIO;
956 }
957 goto out;
958 }
959
960 if (request->len > NBD_MAX_BUFFER_SIZE) {
961 LOG("len (%u) is larger than max len (%u)",
962 request->len, NBD_MAX_BUFFER_SIZE);
963 rc = -EINVAL;
964 goto out;
965 }
966
967 if ((request->from + request->len) < request->from) {
968 LOG("integer overflow detected! "
969 "you're probably being attacked");
970 rc = -EINVAL;
971 goto out;
972 }
973
974 TRACE("Decoding type");
975
976 command = request->type & NBD_CMD_MASK_COMMAND;
977 if (command == NBD_CMD_READ || command == NBD_CMD_WRITE) {
978 req->data = qemu_blockalign(client->exp->bs, request->len);
979 }
980 if (command == NBD_CMD_WRITE) {
981 TRACE("Reading %u byte(s)", request->len);
982
983 if (qemu_co_recv(csock, req->data, request->len) != request->len) {
984 LOG("reading from socket failed");
985 rc = -EIO;
986 goto out;
987 }
988 }
989 rc = 0;
990
991 out:
992 client->recv_coroutine = NULL;
993 return rc;
994 }
995
996 static void nbd_trip(void *opaque)
997 {
998 NBDClient *client = opaque;
999 NBDExport *exp = client->exp;
1000 NBDRequest *req;
1001 struct nbd_request request;
1002 struct nbd_reply reply;
1003 ssize_t ret;
1004
1005 TRACE("Reading request.");
1006 if (client->closing) {
1007 return;
1008 }
1009
1010 req = nbd_request_get(client);
1011 ret = nbd_co_receive_request(req, &request);
1012 if (ret == -EAGAIN) {
1013 goto done;
1014 }
1015 if (ret == -EIO) {
1016 goto out;
1017 }
1018
1019 reply.handle = request.handle;
1020 reply.error = 0;
1021
1022 if (ret < 0) {
1023 reply.error = -ret;
1024 goto error_reply;
1025 }
1026
1027 if ((request.from + request.len) > exp->size) {
1028 LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
1029 ", Offset: %" PRIu64 "\n",
1030 request.from, request.len,
1031 (uint64_t)exp->size, (uint64_t)exp->dev_offset);
1032 LOG("requested operation past EOF--bad client?");
1033 goto invalid_request;
1034 }
1035
1036 switch (request.type & NBD_CMD_MASK_COMMAND) {
1037 case NBD_CMD_READ:
1038 TRACE("Request type is READ");
1039
1040 if (request.type & NBD_CMD_FLAG_FUA) {
1041 ret = bdrv_co_flush(exp->bs);
1042 if (ret < 0) {
1043 LOG("flush failed");
1044 reply.error = -ret;
1045 goto error_reply;
1046 }
1047 }
1048
1049 ret = bdrv_read(exp->bs, (request.from + exp->dev_offset) / 512,
1050 req->data, request.len / 512);
1051 if (ret < 0) {
1052 LOG("reading from file failed");
1053 reply.error = -ret;
1054 goto error_reply;
1055 }
1056
1057 TRACE("Read %u byte(s)", request.len);
1058 if (nbd_co_send_reply(req, &reply, request.len) < 0)
1059 goto out;
1060 break;
1061 case NBD_CMD_WRITE:
1062 TRACE("Request type is WRITE");
1063
1064 if (exp->nbdflags & NBD_FLAG_READ_ONLY) {
1065 TRACE("Server is read-only, return error");
1066 reply.error = EROFS;
1067 goto error_reply;
1068 }
1069
1070 TRACE("Writing to device");
1071
1072 ret = bdrv_write(exp->bs, (request.from + exp->dev_offset) / 512,
1073 req->data, request.len / 512);
1074 if (ret < 0) {
1075 LOG("writing to file failed");
1076 reply.error = -ret;
1077 goto error_reply;
1078 }
1079
1080 if (request.type & NBD_CMD_FLAG_FUA) {
1081 ret = bdrv_co_flush(exp->bs);
1082 if (ret < 0) {
1083 LOG("flush failed");
1084 reply.error = -ret;
1085 goto error_reply;
1086 }
1087 }
1088
1089 if (nbd_co_send_reply(req, &reply, 0) < 0) {
1090 goto out;
1091 }
1092 break;
1093 case NBD_CMD_DISC:
1094 TRACE("Request type is DISCONNECT");
1095 errno = 0;
1096 goto out;
1097 case NBD_CMD_FLUSH:
1098 TRACE("Request type is FLUSH");
1099
1100 ret = bdrv_co_flush(exp->bs);
1101 if (ret < 0) {
1102 LOG("flush failed");
1103 reply.error = -ret;
1104 }
1105 if (nbd_co_send_reply(req, &reply, 0) < 0) {
1106 goto out;
1107 }
1108 break;
1109 case NBD_CMD_TRIM:
1110 TRACE("Request type is TRIM");
1111 ret = bdrv_co_discard(exp->bs, (request.from + exp->dev_offset) / 512,
1112 request.len / 512);
1113 if (ret < 0) {
1114 LOG("discard failed");
1115 reply.error = -ret;
1116 }
1117 if (nbd_co_send_reply(req, &reply, 0) < 0) {
1118 goto out;
1119 }
1120 break;
1121 default:
1122 LOG("invalid request type (%u) received", request.type);
1123 invalid_request:
1124 reply.error = -EINVAL;
1125 error_reply:
1126 if (nbd_co_send_reply(req, &reply, 0) < 0) {
1127 goto out;
1128 }
1129 break;
1130 }
1131
1132 TRACE("Request/Reply complete");
1133
1134 done:
1135 nbd_request_put(req);
1136 return;
1137
1138 out:
1139 nbd_request_put(req);
1140 nbd_client_close(client);
1141 }
1142
1143 static int nbd_can_read(void *opaque)
1144 {
1145 NBDClient *client = opaque;
1146
1147 return client->recv_coroutine || client->nb_requests < MAX_NBD_REQUESTS;
1148 }
1149
1150 static void nbd_read(void *opaque)
1151 {
1152 NBDClient *client = opaque;
1153
1154 if (client->recv_coroutine) {
1155 qemu_coroutine_enter(client->recv_coroutine, NULL);
1156 } else {
1157 qemu_coroutine_enter(qemu_coroutine_create(nbd_trip), client);
1158 }
1159 }
1160
1161 static void nbd_restart_write(void *opaque)
1162 {
1163 NBDClient *client = opaque;
1164
1165 qemu_coroutine_enter(client->send_coroutine, NULL);
1166 }
1167
1168 NBDClient *nbd_client_new(NBDExport *exp, int csock,
1169 void (*close)(NBDClient *))
1170 {
1171 NBDClient *client;
1172 client = g_malloc0(sizeof(NBDClient));
1173 client->refcount = 1;
1174 client->exp = exp;
1175 client->sock = csock;
1176 if (nbd_send_negotiate(client) < 0) {
1177 g_free(client);
1178 return NULL;
1179 }
1180 client->close = close;
1181 qemu_co_mutex_init(&client->send_lock);
1182 qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);
1183
1184 if (exp) {
1185 QTAILQ_INSERT_TAIL(&exp->clients, client, next);
1186 nbd_export_get(exp);
1187 }
1188 return client;
1189 }