nbd.c

   1 /*
   2  *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
   3  *
   4  *  Network Block Device
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; under version 2 of the License.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include "nbd.h"
  20 #include "block.h"
  21 #include "block_int.h"
  22
  23 #include "qemu-coroutine.h"
  24
  25 #include <errno.h>
  26 #include <string.h>
  27 #ifndef _WIN32
  28 #include <sys/ioctl.h>
  29 #endif
  30 #if defined(__sun__) || defined(__HAIKU__)
  31 #include <sys/ioccom.h>
  32 #endif
  33 #include <ctype.h>
  34 #include <inttypes.h>
  35
  36 #ifdef __linux__
  37 #include <linux/fs.h>
  38 #endif
  39
  40 #include "qemu_socket.h"
  41 #include "qemu-queue.h"
  42
  43 //#define DEBUG_NBD
  44
  45 #ifdef DEBUG_NBD
  46 #define TRACE(msg, ...) do { \
  47     LOG(msg, ## __VA_ARGS__); \
  48 } while(0)
  49 #else
  50 #define TRACE(msg, ...) \
  51     do { } while (0)
  52 #endif
  53
  54 #define LOG(msg, ...) do { \
  55     fprintf(stderr, "%s:%s():L%d: " msg "\n", \
  56             __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
  57 } while(0)
  58
  59 /* This is all part of the "official" NBD API */
  60
  61 #define NBD_REPLY_SIZE          (4 + 4 + 8)
  62 #define NBD_REQUEST_MAGIC       0x25609513
  63 #define NBD_REPLY_MAGIC         0x67446698
  64
  65 #define NBD_SET_SOCK            _IO(0xab, 0)
  66 #define NBD_SET_BLKSIZE         _IO(0xab, 1)
  67 #define NBD_SET_SIZE            _IO(0xab, 2)
  68 #define NBD_DO_IT               _IO(0xab, 3)
  69 #define NBD_CLEAR_SOCK          _IO(0xab, 4)
  70 #define NBD_CLEAR_QUE           _IO(0xab, 5)
  71 #define NBD_PRINT_DEBUG         _IO(0xab, 6)
  72 #define NBD_SET_SIZE_BLOCKS     _IO(0xab, 7)
  73 #define NBD_DISCONNECT          _IO(0xab, 8)
  74 #define NBD_SET_TIMEOUT         _IO(0xab, 9)
  75 #define NBD_SET_FLAGS           _IO(0xab, 10)
  76
  77 #define NBD_OPT_EXPORT_NAME     (1 << 0)
  78
  79 /* That's all folks */
  80
  81 #define read_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, true)
  82 #define write_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, false)
  83
  84 size_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
  85 {
  86     size_t offset = 0;
  87
  88     if (qemu_in_coroutine()) {
  89         if (do_read) {
  90             return qemu_co_recv(fd, buffer, size);
  91         } else {
  92             return qemu_co_send(fd, buffer, size);
  93         }
  94     }
  95
  96     while (offset < size) {
  97         ssize_t len;
  98
  99         if (do_read) {
 100             len = qemu_recv(fd, buffer + offset, size - offset, 0);
 101         } else {
 102             len = send(fd, buffer + offset, size - offset, 0);
 103         }
 104
 105         if (len == -1)
 106             errno = socket_error();
 107
 108         /* recoverable error */
 109         if (len == -1 && (errno == EAGAIN || errno == EINTR)) {
 110             continue;
 111         }
 112
 113         /* eof */
 114         if (len == 0) {
 115             break;
 116         }
 117
 118         /* unrecoverable error */
 119         if (len == -1) {
 120             return 0;
 121         }
 122
 123         offset += len;
 124     }
 125
 126     return offset;
 127 }
 128
 129 static void combine_addr(char *buf, size_t len, const char* address,
 130                          uint16_t port)
 131 {
 132     /* If the address-part contains a colon, it's an IPv6 IP so needs [] */
 133     if (strstr(address, ":")) {
 134         snprintf(buf, len, "[%s]:%u", address, port);
 135     } else {
 136         snprintf(buf, len, "%s:%u", address, port);
 137     }
 138 }
 139
 140 int tcp_socket_outgoing(const char *address, uint16_t port)
 141 {
 142     char address_and_port[128];
 143     combine_addr(address_and_port, 128, address, port);
 144     return tcp_socket_outgoing_spec(address_and_port);
 145 }
 146
 147 int tcp_socket_outgoing_spec(const char *address_and_port)
 148 {
 149     return inet_connect(address_and_port, SOCK_STREAM);
 150 }
 151
 152 int tcp_socket_incoming(const char *address, uint16_t port)
 153 {
 154     char address_and_port[128];
 155     combine_addr(address_and_port, 128, address, port);
 156     return tcp_socket_incoming_spec(address_and_port);
 157 }
 158
 159 int tcp_socket_incoming_spec(const char *address_and_port)
 160 {
 161     char *ostr  = NULL;
 162     int olen = 0;
 163     return inet_listen(address_and_port, ostr, olen, SOCK_STREAM, 0);
 164 }
 165
 166 int unix_socket_incoming(const char *path)
 167 {
 168     char *ostr = NULL;
 169     int olen = 0;
 170
 171     return unix_listen(path, ostr, olen);
 172 }
 173
 174 int unix_socket_outgoing(const char *path)
 175 {
 176     return unix_connect(path);
 177 }
 178
 179 /* Basic flow
 180
 181    Server         Client
 182
 183    Negotiate
 184                   Request
 185    Response
 186                   Request
 187    Response
 188                   ...
 189    ...
 190                   Request (type == 2)
 191 */
 192
 193 static int nbd_send_negotiate(int csock, off_t size, uint32_t flags)
 194 {
 195     char buf[8 + 8 + 8 + 128];
 196
 197     /* Negotiate
 198         [ 0 ..   7]   passwd   ("NBDMAGIC")
 199         [ 8 ..  15]   magic    (0x00420281861253)
 200         [16 ..  23]   size
 201         [24 ..  27]   flags
 202         [28 .. 151]   reserved (0)
 203      */
 204
 205     TRACE("Beginning negotiation.");
 206     memcpy(buf, "NBDMAGIC", 8);
 207     cpu_to_be64w((uint64_t*)(buf + 8), 0x00420281861253LL);
 208     cpu_to_be64w((uint64_t*)(buf + 16), size);
 209     cpu_to_be32w((uint32_t*)(buf + 24),
 210                  flags | NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
 211                  NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
 212     memset(buf + 28, 0, 124);
 213
 214     if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
 215         LOG("write failed");
 216         errno = EINVAL;
 217         return -1;
 218     }
 219
 220     TRACE("Negotiation succeeded.");
 221
 222     return 0;
 223 }
 224
 225 int nbd_receive_negotiate(int csock, const char *name, uint32_t *flags,
 226                           off_t *size, size_t *blocksize)
 227 {
 228     char buf[256];
 229     uint64_t magic, s;
 230     uint16_t tmp;
 231
 232     TRACE("Receiving negotiation.");
 233
 234     if (read_sync(csock, buf, 8) != 8) {
 235         LOG("read failed");
 236         errno = EINVAL;
 237         return -1;
 238     }
 239
 240     buf[8] = '\0';
 241     if (strlen(buf) == 0) {
 242         LOG("server connection closed");
 243         errno = EINVAL;
 244         return -1;
 245     }
 246
 247     TRACE("Magic is %c%c%c%c%c%c%c%c",
 248           qemu_isprint(buf[0]) ? buf[0] : '.',
 249           qemu_isprint(buf[1]) ? buf[1] : '.',
 250           qemu_isprint(buf[2]) ? buf[2] : '.',
 251           qemu_isprint(buf[3]) ? buf[3] : '.',
 252           qemu_isprint(buf[4]) ? buf[4] : '.',
 253           qemu_isprint(buf[5]) ? buf[5] : '.',
 254           qemu_isprint(buf[6]) ? buf[6] : '.',
 255           qemu_isprint(buf[7]) ? buf[7] : '.');
 256
 257     if (memcmp(buf, "NBDMAGIC", 8) != 0) {
 258         LOG("Invalid magic received");
 259         errno = EINVAL;
 260         return -1;
 261     }
 262
 263     if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
 264         LOG("read failed");
 265         errno = EINVAL;
 266         return -1;
 267     }
 268     magic = be64_to_cpu(magic);
 269     TRACE("Magic is 0x%" PRIx64, magic);
 270
 271     if (name) {
 272         uint32_t reserved = 0;
 273         uint32_t opt;
 274         uint32_t namesize;
 275
 276         TRACE("Checking magic (opts_magic)");
 277         if (magic != 0x49484156454F5054LL) {
 278             LOG("Bad magic received");
 279             errno = EINVAL;
 280             return -1;
 281         }
 282         if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
 283             LOG("flags read failed");
 284             errno = EINVAL;
 285             return -1;
 286         }
 287         *flags = be16_to_cpu(tmp) << 16;
 288         /* reserved for future use */
 289         if (write_sync(csock, &reserved, sizeof(reserved)) !=
 290             sizeof(reserved)) {
 291             LOG("write failed (reserved)");
 292             errno = EINVAL;
 293             return -1;
 294         }
 295         /* write the export name */
 296         magic = cpu_to_be64(magic);
 297         if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
 298             LOG("write failed (magic)");
 299             errno = EINVAL;
 300             return -1;
 301         }
 302         opt = cpu_to_be32(NBD_OPT_EXPORT_NAME);
 303         if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {
 304             LOG("write failed (opt)");
 305             errno = EINVAL;
 306             return -1;
 307         }
 308         namesize = cpu_to_be32(strlen(name));
 309         if (write_sync(csock, &namesize, sizeof(namesize)) !=
 310             sizeof(namesize)) {
 311             LOG("write failed (namesize)");
 312             errno = EINVAL;
 313             return -1;
 314         }
 315         if (write_sync(csock, (char*)name, strlen(name)) != strlen(name)) {
 316             LOG("write failed (name)");
 317             errno = EINVAL;
 318             return -1;
 319         }
 320     } else {
 321         TRACE("Checking magic (cli_magic)");
 322
 323         if (magic != 0x00420281861253LL) {
 324             LOG("Bad magic received");
 325             errno = EINVAL;
 326             return -1;
 327         }
 328     }
 329
 330     if (read_sync(csock, &s, sizeof(s)) != sizeof(s)) {
 331         LOG("read failed");
 332         errno = EINVAL;
 333         return -1;
 334     }
 335     *size = be64_to_cpu(s);
 336     *blocksize = 1024;
 337     TRACE("Size is %" PRIu64, *size);
 338
 339     if (!name) {
 340         if (read_sync(csock, flags, sizeof(*flags)) != sizeof(*flags)) {
 341             LOG("read failed (flags)");
 342             errno = EINVAL;
 343             return -1;
 344         }
 345         *flags = be32_to_cpup(flags);
 346     } else {
 347         if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
 348             LOG("read failed (tmp)");
 349             errno = EINVAL;
 350             return -1;
 351         }
 352         *flags |= be32_to_cpu(tmp);
 353     }
 354     if (read_sync(csock, &buf, 124) != 124) {
 355         LOG("read failed (buf)");
 356         errno = EINVAL;
 357         return -1;
 358     }
 359         return 0;
 360 }
 361
 362 #ifdef __linux__
 363 int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
 364 {
 365     TRACE("Setting NBD socket");
 366
 367     if (ioctl(fd, NBD_SET_SOCK, csock) == -1) {
 368         int serrno = errno;
 369         LOG("Failed to set NBD socket");
 370         errno = serrno;
 371         return -1;
 372     }
 373
 374     TRACE("Setting block size to %lu", (unsigned long)blocksize);
 375
 376     if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) == -1) {
 377         int serrno = errno;
 378         LOG("Failed setting NBD block size");
 379         errno = serrno;
 380         return -1;
 381     }
 382
 383         TRACE("Setting size to %zd block(s)", (size_t)(size / blocksize));
 384
 385     if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) == -1) {
 386         int serrno = errno;
 387         LOG("Failed setting size (in blocks)");
 388         errno = serrno;
 389         return -1;
 390     }
 391
 392     if (flags & NBD_FLAG_READ_ONLY) {
 393         int read_only = 1;
 394         TRACE("Setting readonly attribute");
 395
 396         if (ioctl(fd, BLKROSET, (unsigned long) &read_only) < 0) {
 397             int serrno = errno;
 398             LOG("Failed setting read-only attribute");
 399             errno = serrno;
 400             return -1;
 401         }
 402     }
 403
 404     if (ioctl(fd, NBD_SET_FLAGS, flags) < 0
 405         && errno != ENOTTY) {
 406         int serrno = errno;
 407         LOG("Failed setting flags");
 408         errno = serrno;
 409         return -1;
 410     }
 411
 412     TRACE("Negotiation ended");
 413
 414     return 0;
 415 }
 416
 417 int nbd_disconnect(int fd)
 418 {
 419     ioctl(fd, NBD_CLEAR_QUE);
 420     ioctl(fd, NBD_DISCONNECT);
 421     ioctl(fd, NBD_CLEAR_SOCK);
 422     return 0;
 423 }
 424
 425 int nbd_client(int fd)
 426 {
 427     int ret;
 428     int serrno;
 429
 430     TRACE("Doing NBD loop");
 431
 432     ret = ioctl(fd, NBD_DO_IT);
 433     if (ret == -1 && errno == EPIPE) {
 434         /* NBD_DO_IT normally returns EPIPE when someone has disconnected
 435          * the socket via NBD_DISCONNECT.  We do not want to return 1 in
 436          * that case.
 437          */
 438         ret = 0;
 439     }
 440     serrno = errno;
 441
 442     TRACE("NBD loop returned %d: %s", ret, strerror(serrno));
 443
 444     TRACE("Clearing NBD queue");
 445     ioctl(fd, NBD_CLEAR_QUE);
 446
 447     TRACE("Clearing NBD socket");
 448     ioctl(fd, NBD_CLEAR_SOCK);
 449
 450     errno = serrno;
 451     return ret;
 452 }
 453 #else
 454 int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
 455 {
 456     errno = ENOTSUP;
 457     return -1;
 458 }
 459
 460 int nbd_disconnect(int fd)
 461 {
 462     errno = ENOTSUP;
 463     return -1;
 464 }
 465
 466 int nbd_client(int fd)
 467 {
 468     errno = ENOTSUP;
 469     return -1;
 470 }
 471 #endif
 472
 473 int nbd_send_request(int csock, struct nbd_request *request)
 474 {
 475     uint8_t buf[4 + 4 + 8 + 8 + 4];
 476
 477     cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
 478     cpu_to_be32w((uint32_t*)(buf + 4), request->type);
 479     cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
 480     cpu_to_be64w((uint64_t*)(buf + 16), request->from);
 481     cpu_to_be32w((uint32_t*)(buf + 24), request->len);
 482
 483     TRACE("Sending request to client: "
 484           "{ .from = %" PRIu64", .len = %u, .handle = %" PRIu64", .type=%i}",
 485           request->from, request->len, request->handle, request->type);
 486
 487     if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
 488         LOG("writing to socket failed");
 489         errno = EINVAL;
 490         return -1;
 491     }
 492     return 0;
 493 }
 494
 495 static int nbd_receive_request(int csock, struct nbd_request *request)
 496 {
 497     uint8_t buf[4 + 4 + 8 + 8 + 4];
 498     uint32_t magic;
 499
 500     if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
 501         LOG("read failed");
 502         errno = EINVAL;
 503         return -1;
 504     }
 505
 506     /* Request
 507        [ 0 ..  3]   magic   (NBD_REQUEST_MAGIC)
 508        [ 4 ..  7]   type    (0 == READ, 1 == WRITE)
 509        [ 8 .. 15]   handle
 510        [16 .. 23]   from
 511        [24 .. 27]   len
 512      */
 513
 514     magic = be32_to_cpup((uint32_t*)buf);
 515     request->type  = be32_to_cpup((uint32_t*)(buf + 4));
 516     request->handle = be64_to_cpup((uint64_t*)(buf + 8));
 517     request->from  = be64_to_cpup((uint64_t*)(buf + 16));
 518     request->len   = be32_to_cpup((uint32_t*)(buf + 24));
 519
 520     TRACE("Got request: "
 521           "{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
 522           magic, request->type, request->from, request->len);
 523
 524     if (magic != NBD_REQUEST_MAGIC) {
 525         LOG("invalid magic (got 0x%x)", magic);
 526         errno = EINVAL;
 527         return -1;
 528     }
 529     return 0;
 530 }
 531
 532 int nbd_receive_reply(int csock, struct nbd_reply *reply)
 533 {
 534     uint8_t buf[NBD_REPLY_SIZE];
 535     uint32_t magic;
 536
 537     memset(buf, 0xAA, sizeof(buf));
 538
 539     if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
 540         LOG("read failed");
 541         errno = EINVAL;
 542         return -1;
 543     }
 544
 545     /* Reply
 546        [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
 547        [ 4 ..  7]    error   (0 == no error)
 548        [ 7 .. 15]    handle
 549      */
 550
 551     magic = be32_to_cpup((uint32_t*)buf);
 552     reply->error  = be32_to_cpup((uint32_t*)(buf + 4));
 553     reply->handle = be64_to_cpup((uint64_t*)(buf + 8));
 554
 555     TRACE("Got reply: "
 556           "{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
 557           magic, reply->error, reply->handle);
 558
 559     if (magic != NBD_REPLY_MAGIC) {
 560         LOG("invalid magic (got 0x%x)", magic);
 561         errno = EINVAL;
 562         return -1;
 563     }
 564     return 0;
 565 }
 566
 567 static int nbd_send_reply(int csock, struct nbd_reply *reply)
 568 {
 569     uint8_t buf[4 + 4 + 8];
 570
 571     /* Reply
 572        [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
 573        [ 4 ..  7]    error   (0 == no error)
 574        [ 7 .. 15]    handle
 575      */
 576     cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
 577     cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
 578     cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);
 579
 580     TRACE("Sending response to client");
 581
 582     if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
 583         LOG("writing to socket failed");
 584         errno = EINVAL;
 585         return -1;
 586     }
 587     return 0;
 588 }
 589
 590 #define MAX_NBD_REQUESTS 16
 591
 592 typedef struct NBDRequest NBDRequest;
 593
 594 struct NBDRequest {
 595     QSIMPLEQ_ENTRY(NBDRequest) entry;
 596     NBDClient *client;
 597     uint8_t *data;
 598 };
 599
 600 struct NBDExport {
 601     BlockDriverState *bs;
 602     off_t dev_offset;
 603     off_t size;
 604     uint32_t nbdflags;
 605     QSIMPLEQ_HEAD(, NBDRequest) requests;
 606 };
 607
 608 struct NBDClient {
 609     int refcount;
 610     void (*close)(NBDClient *client);
 611
 612     NBDExport *exp;
 613     int sock;
 614
 615     Coroutine *recv_coroutine;
 616
 617     CoMutex send_lock;
 618     Coroutine *send_coroutine;
 619
 620     int nb_requests;
 621 };
 622
 623 static void nbd_client_get(NBDClient *client)
 624 {
 625     client->refcount++;
 626 }
 627
 628 static void nbd_client_put(NBDClient *client)
 629 {
 630     if (--client->refcount == 0) {
 631         g_free(client);
 632     }
 633 }
 634
 635 static void nbd_client_close(NBDClient *client)
 636 {
 637     qemu_set_fd_handler2(client->sock, NULL, NULL, NULL, NULL);
 638     close(client->sock);
 639     client->sock = -1;
 640     if (client->close) {
 641         client->close(client);
 642     }
 643     nbd_client_put(client);
 644 }
 645
 646 static NBDRequest *nbd_request_get(NBDClient *client)
 647 {
 648     NBDRequest *req;
 649     NBDExport *exp = client->exp;
 650
 651     assert(client->nb_requests <= MAX_NBD_REQUESTS - 1);
 652     client->nb_requests++;
 653
 654     if (QSIMPLEQ_EMPTY(&exp->requests)) {
 655         req = g_malloc0(sizeof(NBDRequest));
 656         req->data = qemu_blockalign(exp->bs, NBD_BUFFER_SIZE);
 657     } else {
 658         req = QSIMPLEQ_FIRST(&exp->requests);
 659         QSIMPLEQ_REMOVE_HEAD(&exp->requests, entry);
 660     }
 661     nbd_client_get(client);
 662     req->client = client;
 663     return req;
 664 }
 665
 666 static void nbd_request_put(NBDRequest *req)
 667 {
 668     NBDClient *client = req->client;
 669     QSIMPLEQ_INSERT_HEAD(&client->exp->requests, req, entry);
 670     if (client->nb_requests-- == MAX_NBD_REQUESTS) {
 671         qemu_notify_event();
 672     }
 673     nbd_client_put(client);
 674 }
 675
 676 NBDExport *nbd_export_new(BlockDriverState *bs, off_t dev_offset,
 677                           off_t size, uint32_t nbdflags)
 678 {
 679     NBDExport *exp = g_malloc0(sizeof(NBDExport));
 680     QSIMPLEQ_INIT(&exp->requests);
 681     exp->bs = bs;
 682     exp->dev_offset = dev_offset;
 683     exp->nbdflags = nbdflags;
 684     exp->size = size == -1 ? exp->bs->total_sectors * 512 : size;
 685     return exp;
 686 }
 687
 688 void nbd_export_close(NBDExport *exp)
 689 {
 690     while (!QSIMPLEQ_EMPTY(&exp->requests)) {
 691         NBDRequest *first = QSIMPLEQ_FIRST(&exp->requests);
 692         QSIMPLEQ_REMOVE_HEAD(&exp->requests, entry);
 693         qemu_vfree(first->data);
 694         g_free(first);
 695     }
 696
 697     bdrv_close(exp->bs);
 698     g_free(exp);
 699 }
 700
 701 static int nbd_can_read(void *opaque);
 702 static void nbd_read(void *opaque);
 703 static void nbd_restart_write(void *opaque);
 704
 705 static int nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,
 706                              int len)
 707 {
 708     NBDClient *client = req->client;
 709     int csock = client->sock;
 710     int rc, ret;
 711
 712     qemu_co_mutex_lock(&client->send_lock);
 713     qemu_set_fd_handler2(csock, nbd_can_read, nbd_read,
 714                          nbd_restart_write, client);
 715     client->send_coroutine = qemu_coroutine_self();
 716
 717     if (!len) {
 718         rc = nbd_send_reply(csock, reply);
 719         if (rc == -1) {
 720             rc = -errno;
 721         }
 722     } else {
 723         socket_set_cork(csock, 1);
 724         rc = nbd_send_reply(csock, reply);
 725         if (rc != -1) {
 726             ret = qemu_co_send(csock, req->data, len);
 727             if (ret != len) {
 728                 errno = EIO;
 729                 rc = -1;
 730             }
 731         }
 732         if (rc == -1) {
 733             rc = -errno;
 734         }
 735         socket_set_cork(csock, 0);
 736     }
 737
 738     client->send_coroutine = NULL;
 739     qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);
 740     qemu_co_mutex_unlock(&client->send_lock);
 741     return rc;
 742 }
 743
 744 static int nbd_co_receive_request(NBDRequest *req, struct nbd_request *request)
 745 {
 746     NBDClient *client = req->client;
 747     int csock = client->sock;
 748     int rc;
 749
 750     client->recv_coroutine = qemu_coroutine_self();
 751     if (nbd_receive_request(csock, request) == -1) {
 752         rc = -EIO;
 753         goto out;
 754     }
 755
 756     if (request->len > NBD_BUFFER_SIZE) {
 757         LOG("len (%u) is larger than max len (%u)",
 758             request->len, NBD_BUFFER_SIZE);
 759         rc = -EINVAL;
 760         goto out;
 761     }
 762
 763     if ((request->from + request->len) < request->from) {
 764         LOG("integer overflow detected! "
 765             "you're probably being attacked");
 766         rc = -EINVAL;
 767         goto out;
 768     }
 769
 770     TRACE("Decoding type");
 771
 772     if ((request->type & NBD_CMD_MASK_COMMAND) == NBD_CMD_WRITE) {
 773         TRACE("Reading %u byte(s)", request->len);
 774
 775         if (qemu_co_recv(csock, req->data, request->len) != request->len) {
 776             LOG("reading from socket failed");
 777             rc = -EIO;
 778             goto out;
 779         }
 780     }
 781     rc = 0;
 782
 783 out:
 784     client->recv_coroutine = NULL;
 785     return rc;
 786 }
 787
 788 static void nbd_trip(void *opaque)
 789 {
 790     NBDClient *client = opaque;
 791     NBDRequest *req = nbd_request_get(client);
 792     NBDExport *exp = client->exp;
 793     struct nbd_request request;
 794     struct nbd_reply reply;
 795     int ret;
 796
 797     TRACE("Reading request.");
 798
 799     ret = nbd_co_receive_request(req, &request);
 800     if (ret == -EIO) {
 801         goto out;
 802     }
 803
 804     reply.handle = request.handle;
 805     reply.error = 0;
 806
 807     if (ret < 0) {
 808         reply.error = -ret;
 809         goto error_reply;
 810     }
 811
 812     if ((request.from + request.len) > exp->size) {
 813             LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
 814             ", Offset: %" PRIu64 "\n",
 815                     request.from, request.len,
 816                     (uint64_t)exp->size, (uint64_t)exp->dev_offset);
 817         LOG("requested operation past EOF--bad client?");
 818         goto invalid_request;
 819     }
 820
 821     switch (request.type & NBD_CMD_MASK_COMMAND) {
 822     case NBD_CMD_READ:
 823         TRACE("Request type is READ");
 824
 825         ret = bdrv_read(exp->bs, (request.from + exp->dev_offset) / 512,
 826                         req->data, request.len / 512);
 827         if (ret < 0) {
 828             LOG("reading from file failed");
 829             reply.error = -ret;
 830             goto error_reply;
 831         }
 832
 833         TRACE("Read %u byte(s)", request.len);
 834         if (nbd_co_send_reply(req, &reply, request.len) < 0)
 835             goto out;
 836         break;
 837     case NBD_CMD_WRITE:
 838         TRACE("Request type is WRITE");
 839
 840         if (exp->nbdflags & NBD_FLAG_READ_ONLY) {
 841             TRACE("Server is read-only, return error");
 842             reply.error = EROFS;
 843             goto error_reply;
 844         }
 845
 846         TRACE("Writing to device");
 847
 848         ret = bdrv_write(exp->bs, (request.from + exp->dev_offset) / 512,
 849                          req->data, request.len / 512);
 850         if (ret < 0) {
 851             LOG("writing to file failed");
 852             reply.error = -ret;
 853             goto error_reply;
 854         }
 855
 856         if (request.type & NBD_CMD_FLAG_FUA) {
 857             ret = bdrv_co_flush(exp->bs);
 858             if (ret < 0) {
 859                 LOG("flush failed");
 860                 reply.error = -ret;
 861                 goto error_reply;
 862             }
 863         }
 864
 865         if (nbd_co_send_reply(req, &reply, 0) < 0)
 866             goto out;
 867         break;
 868     case NBD_CMD_DISC:
 869         TRACE("Request type is DISCONNECT");
 870         errno = 0;
 871         goto out;
 872     case NBD_CMD_FLUSH:
 873         TRACE("Request type is FLUSH");
 874
 875         ret = bdrv_co_flush(exp->bs);
 876         if (ret < 0) {
 877             LOG("flush failed");
 878             reply.error = -ret;
 879         }
 880
 881         if (nbd_co_send_reply(req, &reply, 0) < 0)
 882             goto out;
 883         break;
 884     case NBD_CMD_TRIM:
 885         TRACE("Request type is TRIM");
 886         ret = bdrv_co_discard(exp->bs, (request.from + exp->dev_offset) / 512,
 887                               request.len / 512);
 888         if (ret < 0) {
 889             LOG("discard failed");
 890             reply.error = -ret;
 891         }
 892         if (nbd_co_send_reply(req, &reply, 0) < 0)
 893             goto out;
 894         break;
 895     default:
 896         LOG("invalid request type (%u) received", request.type);
 897     invalid_request:
 898         reply.error = -EINVAL;
 899     error_reply:
 900         if (nbd_co_send_reply(req, &reply, 0) == -1)
 901             goto out;
 902         break;
 903     }
 904
 905     TRACE("Request/Reply complete");
 906
 907     nbd_request_put(req);
 908     return;
 909
 910 out:
 911     nbd_request_put(req);
 912     nbd_client_close(client);
 913 }
 914
 915 static int nbd_can_read(void *opaque)
 916 {
 917     NBDClient *client = opaque;
 918
 919     return client->recv_coroutine || client->nb_requests < MAX_NBD_REQUESTS;
 920 }
 921
 922 static void nbd_read(void *opaque)
 923 {
 924     NBDClient *client = opaque;
 925
 926     if (client->recv_coroutine) {
 927         qemu_coroutine_enter(client->recv_coroutine, NULL);
 928     } else {
 929         qemu_coroutine_enter(qemu_coroutine_create(nbd_trip), client);
 930     }
 931 }
 932
 933 static void nbd_restart_write(void *opaque)
 934 {
 935     NBDClient *client = opaque;
 936
 937     qemu_coroutine_enter(client->send_coroutine, NULL);
 938 }
 939
 940 NBDClient *nbd_client_new(NBDExport *exp, int csock,
 941                           void (*close)(NBDClient *))
 942 {
 943     NBDClient *client;
 944     if (nbd_send_negotiate(csock, exp->size, exp->nbdflags) == -1) {
 945         return NULL;
 946     }
 947     client = g_malloc0(sizeof(NBDClient));
 948     client->refcount = 1;
 949     client->exp = exp;
 950     client->sock = csock;
 951     client->close = close;
 952     qemu_co_mutex_init(&client->send_lock);
 953     qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);
 954     return client;
 955 }