2 * Copyright (C) 2016 Red Hat, Inc.
3 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
5 * Network Block Device Server Side
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; under version 2 of the License.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qapi/error.h"
22 #include "nbd-internal.h"
24 static int system_errno_to_nbd_errno(int err
)
48 /* Definitions for opaque data types */
50 typedef struct NBDRequestData NBDRequestData
;
52 struct NBDRequestData
{
53 QSIMPLEQ_ENTRY(NBDRequestData
) entry
;
61 void (*close
)(NBDExport
*exp
);
69 QTAILQ_HEAD(, NBDClient
) clients
;
70 QTAILQ_ENTRY(NBDExport
) next
;
74 BlockBackend
*eject_notifier_blk
;
75 Notifier eject_notifier
;
78 static QTAILQ_HEAD(, NBDExport
) exports
= QTAILQ_HEAD_INITIALIZER(exports
);
82 void (*close
)(NBDClient
*client
);
85 QCryptoTLSCreds
*tlscreds
;
87 QIOChannelSocket
*sioc
; /* The underlying data channel */
88 QIOChannel
*ioc
; /* The current I/O channel which may differ (eg TLS) */
90 Coroutine
*recv_coroutine
;
93 Coroutine
*send_coroutine
;
97 QTAILQ_ENTRY(NBDClient
) next
;
102 /* That's all folks */
104 static void nbd_set_handlers(NBDClient
*client
);
105 static void nbd_unset_handlers(NBDClient
*client
);
106 static void nbd_update_can_read(NBDClient
*client
);
108 static gboolean
nbd_negotiate_continue(QIOChannel
*ioc
,
109 GIOCondition condition
,
112 qemu_coroutine_enter(opaque
);
116 static ssize_t
nbd_negotiate_read(QIOChannel
*ioc
, void *buffer
, size_t size
)
121 assert(qemu_in_coroutine());
122 /* Negotiation are always in main loop. */
123 watch
= qio_channel_add_watch(ioc
,
125 nbd_negotiate_continue
,
126 qemu_coroutine_self(),
128 ret
= read_sync(ioc
, buffer
, size
);
129 g_source_remove(watch
);
134 static ssize_t
nbd_negotiate_write(QIOChannel
*ioc
, const void *buffer
,
140 assert(qemu_in_coroutine());
141 /* Negotiation are always in main loop. */
142 watch
= qio_channel_add_watch(ioc
,
144 nbd_negotiate_continue
,
145 qemu_coroutine_self(),
147 ret
= write_sync(ioc
, buffer
, size
);
148 g_source_remove(watch
);
152 static ssize_t
nbd_negotiate_drop_sync(QIOChannel
*ioc
, size_t size
)
154 ssize_t ret
, dropped
= size
;
155 uint8_t *buffer
= g_malloc(MIN(65536, size
));
158 ret
= nbd_negotiate_read(ioc
, buffer
, MIN(65536, size
));
172 /* Basic flow for negotiation
199 /* Send a reply header, including length, but no payload.
200 * Return -errno on error, 0 on success. */
201 static int nbd_negotiate_send_rep_len(QIOChannel
*ioc
, uint32_t type
,
202 uint32_t opt
, uint32_t len
)
206 TRACE("Reply opt=%" PRIx32
" type=%" PRIx32
" len=%" PRIu32
,
209 magic
= cpu_to_be64(NBD_REP_MAGIC
);
210 if (nbd_negotiate_write(ioc
, &magic
, sizeof(magic
)) != sizeof(magic
)) {
211 LOG("write failed (rep magic)");
214 opt
= cpu_to_be32(opt
);
215 if (nbd_negotiate_write(ioc
, &opt
, sizeof(opt
)) != sizeof(opt
)) {
216 LOG("write failed (rep opt)");
219 type
= cpu_to_be32(type
);
220 if (nbd_negotiate_write(ioc
, &type
, sizeof(type
)) != sizeof(type
)) {
221 LOG("write failed (rep type)");
224 len
= cpu_to_be32(len
);
225 if (nbd_negotiate_write(ioc
, &len
, sizeof(len
)) != sizeof(len
)) {
226 LOG("write failed (rep data length)");
232 /* Send a reply header with default 0 length.
233 * Return -errno on error, 0 on success. */
234 static int nbd_negotiate_send_rep(QIOChannel
*ioc
, uint32_t type
, uint32_t opt
)
236 return nbd_negotiate_send_rep_len(ioc
, type
, opt
, 0);
239 /* Send an error reply.
240 * Return -errno on error, 0 on success. */
241 static int GCC_FMT_ATTR(4, 5)
242 nbd_negotiate_send_rep_err(QIOChannel
*ioc
, uint32_t type
,
243 uint32_t opt
, const char *fmt
, ...)
251 msg
= g_strdup_vprintf(fmt
, va
);
255 TRACE("sending error message \"%s\"", msg
);
256 ret
= nbd_negotiate_send_rep_len(ioc
, type
, opt
, len
);
260 if (nbd_negotiate_write(ioc
, msg
, len
) != len
) {
261 LOG("write failed (error message)");
271 /* Send a single NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
272 * Return -errno on error, 0 on success. */
273 static int nbd_negotiate_send_rep_list(QIOChannel
*ioc
, NBDExport
*exp
)
275 size_t name_len
, desc_len
;
277 const char *name
= exp
->name
? exp
->name
: "";
278 const char *desc
= exp
->description
? exp
->description
: "";
281 TRACE("Advertising export name '%s' description '%s'", name
, desc
);
282 name_len
= strlen(name
);
283 desc_len
= strlen(desc
);
284 len
= name_len
+ desc_len
+ sizeof(len
);
285 rc
= nbd_negotiate_send_rep_len(ioc
, NBD_REP_SERVER
, NBD_OPT_LIST
, len
);
290 len
= cpu_to_be32(name_len
);
291 if (nbd_negotiate_write(ioc
, &len
, sizeof(len
)) != sizeof(len
)) {
292 LOG("write failed (name length)");
295 if (nbd_negotiate_write(ioc
, name
, name_len
) != name_len
) {
296 LOG("write failed (name buffer)");
299 if (nbd_negotiate_write(ioc
, desc
, desc_len
) != desc_len
) {
300 LOG("write failed (description buffer)");
306 /* Process the NBD_OPT_LIST command, with a potential series of replies.
307 * Return -errno on error, 0 on success. */
308 static int nbd_negotiate_handle_list(NBDClient
*client
, uint32_t length
)
313 if (nbd_negotiate_drop_sync(client
->ioc
, length
) != length
) {
316 return nbd_negotiate_send_rep_err(client
->ioc
,
317 NBD_REP_ERR_INVALID
, NBD_OPT_LIST
,
318 "OPT_LIST should not have length");
321 /* For each export, send a NBD_REP_SERVER reply. */
322 QTAILQ_FOREACH(exp
, &exports
, next
) {
323 if (nbd_negotiate_send_rep_list(client
->ioc
, exp
)) {
327 /* Finish with a NBD_REP_ACK. */
328 return nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
, NBD_OPT_LIST
);
331 static int nbd_negotiate_handle_export_name(NBDClient
*client
, uint32_t length
)
334 char name
[NBD_MAX_NAME_SIZE
+ 1];
337 [20 .. xx] export name (length bytes)
339 TRACE("Checking length");
340 if (length
>= sizeof(name
)) {
341 LOG("Bad length received");
344 if (nbd_negotiate_read(client
->ioc
, name
, length
) != length
) {
350 TRACE("Client requested export '%s'", name
);
352 client
->exp
= nbd_export_find(name
);
354 LOG("export not found");
358 QTAILQ_INSERT_TAIL(&client
->exp
->clients
, client
, next
);
359 nbd_export_get(client
->exp
);
365 /* Handle NBD_OPT_STARTTLS. Return NULL to drop connection, or else the
366 * new channel for all further (now-encrypted) communication. */
367 static QIOChannel
*nbd_negotiate_handle_starttls(NBDClient
*client
,
372 struct NBDTLSHandshakeData data
= { 0 };
374 TRACE("Setting up TLS");
377 if (nbd_negotiate_drop_sync(ioc
, length
) != length
) {
380 nbd_negotiate_send_rep_err(ioc
, NBD_REP_ERR_INVALID
, NBD_OPT_STARTTLS
,
381 "OPT_STARTTLS should not have length");
385 if (nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
,
386 NBD_OPT_STARTTLS
) < 0) {
390 tioc
= qio_channel_tls_new_server(ioc
,
398 qio_channel_set_name(QIO_CHANNEL(tioc
), "nbd-server-tls");
399 TRACE("Starting TLS handshake");
400 data
.loop
= g_main_loop_new(g_main_context_default(), FALSE
);
401 qio_channel_tls_handshake(tioc
,
406 if (!data
.complete
) {
407 g_main_loop_run(data
.loop
);
409 g_main_loop_unref(data
.loop
);
411 object_unref(OBJECT(tioc
));
412 error_free(data
.error
);
416 return QIO_CHANNEL(tioc
);
420 /* Process all NBD_OPT_* client option commands.
421 * Return -errno on error, 0 on success. */
422 static int nbd_negotiate_options(NBDClient
*client
)
425 bool fixedNewstyle
= false;
428 [ 0 .. 3] client flags
430 [ 0 .. 7] NBD_OPTS_MAGIC
431 [ 8 .. 11] NBD option
432 [12 .. 15] Data length
435 [ 0 .. 7] NBD_OPTS_MAGIC
436 [ 8 .. 11] Second NBD option
437 [12 .. 15] Data length
441 if (nbd_negotiate_read(client
->ioc
, &flags
, sizeof(flags
)) !=
446 TRACE("Checking client flags");
447 be32_to_cpus(&flags
);
448 if (flags
& NBD_FLAG_C_FIXED_NEWSTYLE
) {
449 TRACE("Client supports fixed newstyle handshake");
450 fixedNewstyle
= true;
451 flags
&= ~NBD_FLAG_C_FIXED_NEWSTYLE
;
454 TRACE("Unknown client flags 0x%" PRIx32
" received", flags
);
460 uint32_t clientflags
, length
;
463 if (nbd_negotiate_read(client
->ioc
, &magic
, sizeof(magic
)) !=
468 TRACE("Checking opts magic");
469 if (magic
!= be64_to_cpu(NBD_OPTS_MAGIC
)) {
470 LOG("Bad magic received");
474 if (nbd_negotiate_read(client
->ioc
, &clientflags
,
475 sizeof(clientflags
)) != sizeof(clientflags
)) {
479 clientflags
= be32_to_cpu(clientflags
);
481 if (nbd_negotiate_read(client
->ioc
, &length
, sizeof(length
)) !=
486 length
= be32_to_cpu(length
);
488 TRACE("Checking option 0x%" PRIx32
, clientflags
);
489 if (client
->tlscreds
&&
490 client
->ioc
== (QIOChannel
*)client
->sioc
) {
492 if (!fixedNewstyle
) {
493 TRACE("Unsupported option 0x%" PRIx32
, clientflags
);
496 switch (clientflags
) {
497 case NBD_OPT_STARTTLS
:
498 tioc
= nbd_negotiate_handle_starttls(client
, length
);
502 object_unref(OBJECT(client
->ioc
));
503 client
->ioc
= QIO_CHANNEL(tioc
);
506 case NBD_OPT_EXPORT_NAME
:
507 /* No way to return an error to client, so drop connection */
508 TRACE("Option 0x%x not permitted before TLS", clientflags
);
512 if (nbd_negotiate_drop_sync(client
->ioc
, length
) != length
) {
515 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
516 NBD_REP_ERR_TLS_REQD
,
519 "not permitted before TLS",
526 } else if (fixedNewstyle
) {
527 switch (clientflags
) {
529 ret
= nbd_negotiate_handle_list(client
, length
);
538 case NBD_OPT_EXPORT_NAME
:
539 return nbd_negotiate_handle_export_name(client
, length
);
541 case NBD_OPT_STARTTLS
:
542 if (nbd_negotiate_drop_sync(client
->ioc
, length
) != length
) {
545 if (client
->tlscreds
) {
546 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
549 "TLS already enabled");
551 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
554 "TLS not configured");
561 if (nbd_negotiate_drop_sync(client
->ioc
, length
) != length
) {
564 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
567 "Unsupported option 0x%"
577 * If broken new-style we should drop the connection
578 * for anything except NBD_OPT_EXPORT_NAME
580 switch (clientflags
) {
581 case NBD_OPT_EXPORT_NAME
:
582 return nbd_negotiate_handle_export_name(client
, length
);
585 TRACE("Unsupported option 0x%" PRIx32
, clientflags
);
597 static coroutine_fn
int nbd_negotiate(NBDClientNewData
*data
)
599 NBDClient
*client
= data
->client
;
600 char buf
[8 + 8 + 8 + 128];
602 const uint16_t myflags
= (NBD_FLAG_HAS_FLAGS
| NBD_FLAG_SEND_TRIM
|
603 NBD_FLAG_SEND_FLUSH
| NBD_FLAG_SEND_FUA
);
606 /* Old style negotiation header without options
607 [ 0 .. 7] passwd ("NBDMAGIC")
608 [ 8 .. 15] magic (NBD_CLIENT_MAGIC)
610 [24 .. 25] server flags (0)
611 [26 .. 27] export flags
612 [28 .. 151] reserved (0)
614 New style negotiation header with options
615 [ 0 .. 7] passwd ("NBDMAGIC")
616 [ 8 .. 15] magic (NBD_OPTS_MAGIC)
617 [16 .. 17] server flags (0)
620 [26 .. 27] export flags
621 [28 .. 151] reserved (0)
624 qio_channel_set_blocking(client
->ioc
, false, NULL
);
627 TRACE("Beginning negotiation.");
628 memset(buf
, 0, sizeof(buf
));
629 memcpy(buf
, "NBDMAGIC", 8);
631 oldStyle
= client
->exp
!= NULL
&& !client
->tlscreds
;
633 TRACE("advertising size %" PRIu64
" and flags %x",
634 client
->exp
->size
, client
->exp
->nbdflags
| myflags
);
635 stq_be_p(buf
+ 8, NBD_CLIENT_MAGIC
);
636 stq_be_p(buf
+ 16, client
->exp
->size
);
637 stw_be_p(buf
+ 26, client
->exp
->nbdflags
| myflags
);
639 stq_be_p(buf
+ 8, NBD_OPTS_MAGIC
);
640 stw_be_p(buf
+ 16, NBD_FLAG_FIXED_NEWSTYLE
);
644 if (client
->tlscreds
) {
645 TRACE("TLS cannot be enabled with oldstyle protocol");
648 if (nbd_negotiate_write(client
->ioc
, buf
, sizeof(buf
)) != sizeof(buf
)) {
653 if (nbd_negotiate_write(client
->ioc
, buf
, 18) != 18) {
657 rc
= nbd_negotiate_options(client
);
659 LOG("option negotiation failed");
663 TRACE("advertising size %" PRIu64
" and flags %x",
664 client
->exp
->size
, client
->exp
->nbdflags
| myflags
);
665 stq_be_p(buf
+ 18, client
->exp
->size
);
666 stw_be_p(buf
+ 26, client
->exp
->nbdflags
| myflags
);
667 if (nbd_negotiate_write(client
->ioc
, buf
+ 18, sizeof(buf
) - 18) !=
674 TRACE("Negotiation succeeded.");
680 static ssize_t
nbd_receive_request(QIOChannel
*ioc
, NBDRequest
*request
)
682 uint8_t buf
[NBD_REQUEST_SIZE
];
686 ret
= read_sync(ioc
, buf
, sizeof(buf
));
691 if (ret
!= sizeof(buf
)) {
697 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
698 [ 4 .. 5] flags (NBD_CMD_FLAG_FUA, ...)
699 [ 6 .. 7] type (NBD_CMD_READ, ...)
705 magic
= ldl_be_p(buf
);
706 request
->flags
= lduw_be_p(buf
+ 4);
707 request
->type
= lduw_be_p(buf
+ 6);
708 request
->handle
= ldq_be_p(buf
+ 8);
709 request
->from
= ldq_be_p(buf
+ 16);
710 request
->len
= ldl_be_p(buf
+ 24);
712 TRACE("Got request: { magic = 0x%" PRIx32
", .flags = %" PRIx16
713 ", .type = %" PRIx16
", from = %" PRIu64
", len = %" PRIu32
" }",
714 magic
, request
->flags
, request
->type
, request
->from
, request
->len
);
716 if (magic
!= NBD_REQUEST_MAGIC
) {
717 LOG("invalid magic (got 0x%" PRIx32
")", magic
);
723 static ssize_t
nbd_send_reply(QIOChannel
*ioc
, NBDReply
*reply
)
725 uint8_t buf
[NBD_REPLY_SIZE
];
728 reply
->error
= system_errno_to_nbd_errno(reply
->error
);
730 TRACE("Sending response to client: { .error = %" PRId32
731 ", handle = %" PRIu64
" }",
732 reply
->error
, reply
->handle
);
735 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
736 [ 4 .. 7] error (0 == no error)
739 stl_be_p(buf
, NBD_REPLY_MAGIC
);
740 stl_be_p(buf
+ 4, reply
->error
);
741 stq_be_p(buf
+ 8, reply
->handle
);
743 ret
= write_sync(ioc
, buf
, sizeof(buf
));
748 if (ret
!= sizeof(buf
)) {
749 LOG("writing to socket failed");
755 #define MAX_NBD_REQUESTS 16
757 void nbd_client_get(NBDClient
*client
)
762 void nbd_client_put(NBDClient
*client
)
764 if (--client
->refcount
== 0) {
765 /* The last reference should be dropped by client->close,
766 * which is called by client_close.
768 assert(client
->closing
);
770 nbd_unset_handlers(client
);
771 object_unref(OBJECT(client
->sioc
));
772 object_unref(OBJECT(client
->ioc
));
773 if (client
->tlscreds
) {
774 object_unref(OBJECT(client
->tlscreds
));
776 g_free(client
->tlsaclname
);
778 QTAILQ_REMOVE(&client
->exp
->clients
, client
, next
);
779 nbd_export_put(client
->exp
);
785 static void client_close(NBDClient
*client
)
787 if (client
->closing
) {
791 client
->closing
= true;
793 /* Force requests to finish. They will drop their own references,
794 * then we'll close the socket and free the NBDClient.
796 qio_channel_shutdown(client
->ioc
, QIO_CHANNEL_SHUTDOWN_BOTH
,
799 /* Also tell the client, so that they release their reference. */
801 client
->close(client
);
805 static NBDRequestData
*nbd_request_get(NBDClient
*client
)
809 assert(client
->nb_requests
<= MAX_NBD_REQUESTS
- 1);
810 client
->nb_requests
++;
811 nbd_update_can_read(client
);
813 req
= g_new0(NBDRequestData
, 1);
814 nbd_client_get(client
);
815 req
->client
= client
;
819 static void nbd_request_put(NBDRequestData
*req
)
821 NBDClient
*client
= req
->client
;
824 qemu_vfree(req
->data
);
828 client
->nb_requests
--;
829 nbd_update_can_read(client
);
830 nbd_client_put(client
);
833 static void blk_aio_attached(AioContext
*ctx
, void *opaque
)
835 NBDExport
*exp
= opaque
;
838 TRACE("Export %s: Attaching clients to AIO context %p\n", exp
->name
, ctx
);
842 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
843 nbd_set_handlers(client
);
847 static void blk_aio_detach(void *opaque
)
849 NBDExport
*exp
= opaque
;
852 TRACE("Export %s: Detaching clients from AIO context %p\n", exp
->name
, exp
->ctx
);
854 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
855 nbd_unset_handlers(client
);
861 static void nbd_eject_notifier(Notifier
*n
, void *data
)
863 NBDExport
*exp
= container_of(n
, NBDExport
, eject_notifier
);
864 nbd_export_close(exp
);
867 NBDExport
*nbd_export_new(BlockDriverState
*bs
, off_t dev_offset
, off_t size
,
868 uint16_t nbdflags
, void (*close
)(NBDExport
*),
869 bool writethrough
, BlockBackend
*on_eject_blk
,
873 NBDExport
*exp
= g_malloc0(sizeof(NBDExport
));
876 blk_insert_bs(blk
, bs
);
877 blk_set_enable_write_cache(blk
, !writethrough
);
880 QTAILQ_INIT(&exp
->clients
);
882 exp
->dev_offset
= dev_offset
;
883 exp
->nbdflags
= nbdflags
;
884 exp
->size
= size
< 0 ? blk_getlength(blk
) : size
;
886 error_setg_errno(errp
, -exp
->size
,
887 "Failed to determine the NBD export's length");
890 exp
->size
-= exp
->size
% BDRV_SECTOR_SIZE
;
893 exp
->ctx
= blk_get_aio_context(blk
);
894 blk_add_aio_context_notifier(blk
, blk_aio_attached
, blk_aio_detach
, exp
);
897 blk_ref(on_eject_blk
);
898 exp
->eject_notifier_blk
= on_eject_blk
;
899 exp
->eject_notifier
.notify
= nbd_eject_notifier
;
900 blk_add_remove_bs_notifier(on_eject_blk
, &exp
->eject_notifier
);
904 * NBD exports are used for non-shared storage migration. Make sure
905 * that BDRV_O_INACTIVE is cleared and the image is ready for write
906 * access since the export could be available before migration handover.
908 aio_context_acquire(exp
->ctx
);
909 blk_invalidate_cache(blk
, NULL
);
910 aio_context_release(exp
->ctx
);
919 NBDExport
*nbd_export_find(const char *name
)
922 QTAILQ_FOREACH(exp
, &exports
, next
) {
923 if (strcmp(name
, exp
->name
) == 0) {
931 void nbd_export_set_name(NBDExport
*exp
, const char *name
)
933 if (exp
->name
== name
) {
938 if (exp
->name
!= NULL
) {
941 QTAILQ_REMOVE(&exports
, exp
, next
);
946 exp
->name
= g_strdup(name
);
947 QTAILQ_INSERT_TAIL(&exports
, exp
, next
);
952 void nbd_export_set_description(NBDExport
*exp
, const char *description
)
954 g_free(exp
->description
);
955 exp
->description
= g_strdup(description
);
958 void nbd_export_close(NBDExport
*exp
)
960 NBDClient
*client
, *next
;
963 QTAILQ_FOREACH_SAFE(client
, &exp
->clients
, next
, next
) {
964 client_close(client
);
966 nbd_export_set_name(exp
, NULL
);
967 nbd_export_set_description(exp
, NULL
);
971 void nbd_export_get(NBDExport
*exp
)
973 assert(exp
->refcount
> 0);
977 void nbd_export_put(NBDExport
*exp
)
979 assert(exp
->refcount
> 0);
980 if (exp
->refcount
== 1) {
981 nbd_export_close(exp
);
984 if (--exp
->refcount
== 0) {
985 assert(exp
->name
== NULL
);
986 assert(exp
->description
== NULL
);
993 if (exp
->eject_notifier_blk
) {
994 notifier_remove(&exp
->eject_notifier
);
995 blk_unref(exp
->eject_notifier_blk
);
997 blk_remove_aio_context_notifier(exp
->blk
, blk_aio_attached
,
998 blk_aio_detach
, exp
);
1007 BlockBackend
*nbd_export_get_blockdev(NBDExport
*exp
)
1012 void nbd_export_close_all(void)
1014 NBDExport
*exp
, *next
;
1016 QTAILQ_FOREACH_SAFE(exp
, &exports
, next
, next
) {
1017 nbd_export_close(exp
);
1021 static ssize_t
nbd_co_send_reply(NBDRequestData
*req
, NBDReply
*reply
,
1024 NBDClient
*client
= req
->client
;
1027 g_assert(qemu_in_coroutine());
1028 qemu_co_mutex_lock(&client
->send_lock
);
1029 client
->send_coroutine
= qemu_coroutine_self();
1030 nbd_set_handlers(client
);
1033 rc
= nbd_send_reply(client
->ioc
, reply
);
1035 qio_channel_set_cork(client
->ioc
, true);
1036 rc
= nbd_send_reply(client
->ioc
, reply
);
1038 ret
= write_sync(client
->ioc
, req
->data
, len
);
1043 qio_channel_set_cork(client
->ioc
, false);
1046 client
->send_coroutine
= NULL
;
1047 nbd_set_handlers(client
);
1048 qemu_co_mutex_unlock(&client
->send_lock
);
1052 /* Collect a client request. Return 0 if request looks valid, -EAGAIN
1053 * to keep trying the collection, -EIO to drop connection right away,
1054 * and any other negative value to report an error to the client
1055 * (although the caller may still need to disconnect after reporting
1057 static ssize_t
nbd_co_receive_request(NBDRequestData
*req
,
1058 NBDRequest
*request
)
1060 NBDClient
*client
= req
->client
;
1063 g_assert(qemu_in_coroutine());
1064 client
->recv_coroutine
= qemu_coroutine_self();
1065 nbd_update_can_read(client
);
1067 rc
= nbd_receive_request(client
->ioc
, request
);
1069 if (rc
!= -EAGAIN
) {
1075 TRACE("Decoding type");
1077 if (request
->type
!= NBD_CMD_WRITE
) {
1078 /* No payload, we are ready to read the next request. */
1079 req
->complete
= true;
1082 if (request
->type
== NBD_CMD_DISC
) {
1083 /* Special case: we're going to disconnect without a reply,
1084 * whether or not flags, from, or len are bogus */
1085 TRACE("Request type is DISCONNECT");
1090 /* Check for sanity in the parameters, part 1. Defer as many
1091 * checks as possible until after reading any NBD_CMD_WRITE
1092 * payload, so we can try and keep the connection alive. */
1093 if ((request
->from
+ request
->len
) < request
->from
) {
1094 LOG("integer overflow detected, you're probably being attacked");
1099 if (request
->type
== NBD_CMD_READ
|| request
->type
== NBD_CMD_WRITE
) {
1100 if (request
->len
> NBD_MAX_BUFFER_SIZE
) {
1101 LOG("len (%" PRIu32
" ) is larger than max len (%u)",
1102 request
->len
, NBD_MAX_BUFFER_SIZE
);
1107 req
->data
= blk_try_blockalign(client
->exp
->blk
, request
->len
);
1108 if (req
->data
== NULL
) {
1113 if (request
->type
== NBD_CMD_WRITE
) {
1114 TRACE("Reading %" PRIu32
" byte(s)", request
->len
);
1116 if (read_sync(client
->ioc
, req
->data
, request
->len
) != request
->len
) {
1117 LOG("reading from socket failed");
1121 req
->complete
= true;
1124 /* Sanity checks, part 2. */
1125 if (request
->from
+ request
->len
> client
->exp
->size
) {
1126 LOG("operation past EOF; From: %" PRIu64
", Len: %" PRIu32
1127 ", Size: %" PRIu64
, request
->from
, request
->len
,
1128 (uint64_t)client
->exp
->size
);
1129 rc
= request
->type
== NBD_CMD_WRITE
? -ENOSPC
: -EINVAL
;
1132 if (request
->flags
& ~NBD_CMD_FLAG_FUA
) {
1133 LOG("unsupported flags (got 0x%x)", request
->flags
);
1141 client
->recv_coroutine
= NULL
;
1142 nbd_update_can_read(client
);
1147 static void nbd_trip(void *opaque
)
1149 NBDClient
*client
= opaque
;
1150 NBDExport
*exp
= client
->exp
;
1151 NBDRequestData
*req
;
1157 TRACE("Reading request.");
1158 if (client
->closing
) {
1162 req
= nbd_request_get(client
);
1163 ret
= nbd_co_receive_request(req
, &request
);
1164 if (ret
== -EAGAIN
) {
1171 reply
.handle
= request
.handle
;
1179 if (client
->closing
) {
1181 * The client may be closed when we are blocked in
1182 * nbd_co_receive_request()
1187 switch (request
.type
) {
1189 TRACE("Request type is READ");
1191 /* XXX: NBD Protocol only documents use of FUA with WRITE */
1192 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1193 ret
= blk_co_flush(exp
->blk
);
1195 LOG("flush failed");
1201 ret
= blk_pread(exp
->blk
, request
.from
+ exp
->dev_offset
,
1202 req
->data
, request
.len
);
1204 LOG("reading from file failed");
1209 TRACE("Read %" PRIu32
" byte(s)", request
.len
);
1210 if (nbd_co_send_reply(req
, &reply
, request
.len
) < 0)
1214 TRACE("Request type is WRITE");
1216 if (exp
->nbdflags
& NBD_FLAG_READ_ONLY
) {
1217 TRACE("Server is read-only, return error");
1218 reply
.error
= EROFS
;
1222 TRACE("Writing to device");
1225 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1226 flags
|= BDRV_REQ_FUA
;
1228 ret
= blk_pwrite(exp
->blk
, request
.from
+ exp
->dev_offset
,
1229 req
->data
, request
.len
, flags
);
1231 LOG("writing to file failed");
1236 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1242 /* unreachable, thanks to special case in nbd_co_receive_request() */
1246 TRACE("Request type is FLUSH");
1248 ret
= blk_co_flush(exp
->blk
);
1250 LOG("flush failed");
1253 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1258 TRACE("Request type is TRIM");
1259 ret
= blk_co_pdiscard(exp
->blk
, request
.from
+ exp
->dev_offset
,
1262 LOG("discard failed");
1265 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1270 LOG("invalid request type (%" PRIu32
") received", request
.type
);
1271 reply
.error
= EINVAL
;
1273 /* We must disconnect after NBD_CMD_WRITE if we did not
1276 if (nbd_co_send_reply(req
, &reply
, 0) < 0 || !req
->complete
) {
1282 TRACE("Request/Reply complete");
1285 nbd_request_put(req
);
1289 nbd_request_put(req
);
1290 client_close(client
);
1293 static void nbd_read(void *opaque
)
1295 NBDClient
*client
= opaque
;
1297 if (client
->recv_coroutine
) {
1298 qemu_coroutine_enter(client
->recv_coroutine
);
1300 qemu_coroutine_enter(qemu_coroutine_create(nbd_trip
, client
));
1304 static void nbd_restart_write(void *opaque
)
1306 NBDClient
*client
= opaque
;
1308 qemu_coroutine_enter(client
->send_coroutine
);
1311 static void nbd_set_handlers(NBDClient
*client
)
1313 if (client
->exp
&& client
->exp
->ctx
) {
1314 aio_set_fd_handler(client
->exp
->ctx
, client
->sioc
->fd
,
1316 client
->can_read
? nbd_read
: NULL
,
1317 client
->send_coroutine
? nbd_restart_write
: NULL
,
1322 static void nbd_unset_handlers(NBDClient
*client
)
1324 if (client
->exp
&& client
->exp
->ctx
) {
1325 aio_set_fd_handler(client
->exp
->ctx
, client
->sioc
->fd
,
1326 true, NULL
, NULL
, NULL
);
1330 static void nbd_update_can_read(NBDClient
*client
)
1332 bool can_read
= client
->recv_coroutine
||
1333 client
->nb_requests
< MAX_NBD_REQUESTS
;
1335 if (can_read
!= client
->can_read
) {
1336 client
->can_read
= can_read
;
1337 nbd_set_handlers(client
);
1339 /* There is no need to invoke aio_notify(), since aio_set_fd_handler()
1340 * in nbd_set_handlers() will have taken care of that */
1344 static coroutine_fn
void nbd_co_client_start(void *opaque
)
1346 NBDClientNewData
*data
= opaque
;
1347 NBDClient
*client
= data
->client
;
1348 NBDExport
*exp
= client
->exp
;
1351 nbd_export_get(exp
);
1353 if (nbd_negotiate(data
)) {
1354 client_close(client
);
1357 qemu_co_mutex_init(&client
->send_lock
);
1358 nbd_set_handlers(client
);
1361 QTAILQ_INSERT_TAIL(&exp
->clients
, client
, next
);
1367 void nbd_client_new(NBDExport
*exp
,
1368 QIOChannelSocket
*sioc
,
1369 QCryptoTLSCreds
*tlscreds
,
1370 const char *tlsaclname
,
1371 void (*close_fn
)(NBDClient
*))
1374 NBDClientNewData
*data
= g_new(NBDClientNewData
, 1);
1376 client
= g_malloc0(sizeof(NBDClient
));
1377 client
->refcount
= 1;
1379 client
->tlscreds
= tlscreds
;
1381 object_ref(OBJECT(client
->tlscreds
));
1383 client
->tlsaclname
= g_strdup(tlsaclname
);
1384 client
->sioc
= sioc
;
1385 object_ref(OBJECT(client
->sioc
));
1386 client
->ioc
= QIO_CHANNEL(sioc
);
1387 object_ref(OBJECT(client
->ioc
));
1388 client
->can_read
= true;
1389 client
->close
= close_fn
;
1391 data
->client
= client
;
1392 data
->co
= qemu_coroutine_create(nbd_co_client_start
, data
);
1393 qemu_coroutine_enter(data
->co
);