nbd.c

   1 /*
   2  *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
   3  *
   4  *  Network Block Device
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; under version 2 of the License.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include "block/nbd.h"
  20 #include "block/block.h"
  21
  22 #include "block/coroutine.h"
  23
  24 #include <errno.h>
  25 #include <string.h>
  26 #ifndef _WIN32
  27 #include <sys/ioctl.h>
  28 #endif
  29 #if defined(__sun__) || defined(__HAIKU__)
  30 #include <sys/ioccom.h>
  31 #endif
  32 #include <ctype.h>
  33 #include <inttypes.h>
  34
  35 #ifdef __linux__
  36 #include <linux/fs.h>
  37 #endif
  38
  39 #include "qemu/sockets.h"
  40 #include "qemu/queue.h"
  41
  42 //#define DEBUG_NBD
  43
  44 #ifdef DEBUG_NBD
  45 #define TRACE(msg, ...) do { \
  46     LOG(msg, ## __VA_ARGS__); \
  47 } while(0)
  48 #else
  49 #define TRACE(msg, ...) \
  50     do { } while (0)
  51 #endif
  52
  53 #define LOG(msg, ...) do { \
  54     fprintf(stderr, "%s:%s():L%d: " msg "\n", \
  55             __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
  56 } while(0)
  57
  58 /* This is all part of the "official" NBD API */
  59
  60 #define NBD_REQUEST_SIZE        (4 + 4 + 8 + 8 + 4)
  61 #define NBD_REPLY_SIZE          (4 + 4 + 8)
  62 #define NBD_REQUEST_MAGIC       0x25609513
  63 #define NBD_REPLY_MAGIC         0x67446698
  64 #define NBD_OPTS_MAGIC          0x49484156454F5054LL
  65 #define NBD_CLIENT_MAGIC        0x0000420281861253LL
  66
  67 #define NBD_SET_SOCK            _IO(0xab, 0)
  68 #define NBD_SET_BLKSIZE         _IO(0xab, 1)
  69 #define NBD_SET_SIZE            _IO(0xab, 2)
  70 #define NBD_DO_IT               _IO(0xab, 3)
  71 #define NBD_CLEAR_SOCK          _IO(0xab, 4)
  72 #define NBD_CLEAR_QUE           _IO(0xab, 5)
  73 #define NBD_PRINT_DEBUG         _IO(0xab, 6)
  74 #define NBD_SET_SIZE_BLOCKS     _IO(0xab, 7)
  75 #define NBD_DISCONNECT          _IO(0xab, 8)
  76 #define NBD_SET_TIMEOUT         _IO(0xab, 9)
  77 #define NBD_SET_FLAGS           _IO(0xab, 10)
  78
  79 #define NBD_OPT_EXPORT_NAME     (1 << 0)
  80
  81 /* Definitions for opaque data types */
  82
  83 typedef struct NBDRequest NBDRequest;
  84
  85 struct NBDRequest {
  86     QSIMPLEQ_ENTRY(NBDRequest) entry;
  87     NBDClient *client;
  88     uint8_t *data;
  89 };
  90
  91 struct NBDExport {
  92     int refcount;
  93     void (*close)(NBDExport *exp);
  94
  95     BlockDriverState *bs;
  96     char *name;
  97     off_t dev_offset;
  98     off_t size;
  99     uint32_t nbdflags;
 100     QTAILQ_HEAD(, NBDClient) clients;
 101     QSIMPLEQ_HEAD(, NBDRequest) requests;
 102     QTAILQ_ENTRY(NBDExport) next;
 103 };
 104
 105 static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);
 106
 107 struct NBDClient {
 108     int refcount;
 109     void (*close)(NBDClient *client);
 110
 111     NBDExport *exp;
 112     int sock;
 113
 114     Coroutine *recv_coroutine;
 115
 116     CoMutex send_lock;
 117     Coroutine *send_coroutine;
 118
 119     QTAILQ_ENTRY(NBDClient) next;
 120     int nb_requests;
 121     bool closing;
 122 };
 123
 124 /* That's all folks */
 125
 126 ssize_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
 127 {
 128     size_t offset = 0;
 129     int err;
 130
 131     if (qemu_in_coroutine()) {
 132         if (do_read) {
 133             return qemu_co_recv(fd, buffer, size);
 134         } else {
 135             return qemu_co_send(fd, buffer, size);
 136         }
 137     }
 138
 139     while (offset < size) {
 140         ssize_t len;
 141
 142         if (do_read) {
 143             len = qemu_recv(fd, buffer + offset, size - offset, 0);
 144         } else {
 145             len = send(fd, buffer + offset, size - offset, 0);
 146         }
 147
 148         if (len < 0) {
 149             err = socket_error();
 150
 151             /* recoverable error */
 152             if (err == EINTR || (offset > 0 && err == EAGAIN)) {
 153                 continue;
 154             }
 155
 156             /* unrecoverable error */
 157             return -err;
 158         }
 159
 160         /* eof */
 161         if (len == 0) {
 162             break;
 163         }
 164
 165         offset += len;
 166     }
 167
 168     return offset;
 169 }
 170
 171 static ssize_t read_sync(int fd, void *buffer, size_t size)
 172 {
 173     /* Sockets are kept in blocking mode in the negotiation phase.  After
 174      * that, a non-readable socket simply means that another thread stole
 175      * our request/reply.  Synchronization is done with recv_coroutine, so
 176      * that this is coroutine-safe.
 177      */
 178     return nbd_wr_sync(fd, buffer, size, true);
 179 }
 180
 181 static ssize_t write_sync(int fd, void *buffer, size_t size)
 182 {
 183     int ret;
 184     do {
 185         /* For writes, we do expect the socket to be writable.  */
 186         ret = nbd_wr_sync(fd, buffer, size, false);
 187     } while (ret == -EAGAIN);
 188     return ret;
 189 }
 190
 191 static void combine_addr(char *buf, size_t len, const char* address,
 192                          uint16_t port)
 193 {
 194     /* If the address-part contains a colon, it's an IPv6 IP so needs [] */
 195     if (strstr(address, ":")) {
 196         snprintf(buf, len, "[%s]:%u", address, port);
 197     } else {
 198         snprintf(buf, len, "%s:%u", address, port);
 199     }
 200 }
 201
 202 int tcp_socket_outgoing(const char *address, uint16_t port)
 203 {
 204     char address_and_port[128];
 205     combine_addr(address_and_port, 128, address, port);
 206     return tcp_socket_outgoing_spec(address_and_port);
 207 }
 208
 209 int tcp_socket_outgoing_spec(const char *address_and_port)
 210 {
 211     Error *local_err = NULL;
 212     int fd = inet_connect(address_and_port, &local_err);
 213
 214     if (local_err != NULL) {
 215         qerror_report_err(local_err);
 216         error_free(local_err);
 217     }
 218     return fd;
 219 }
 220
 221 int tcp_socket_outgoing_opts(QemuOpts *opts)
 222 {
 223     Error *local_err = NULL;
 224     int fd = inet_connect_opts(opts, &local_err, NULL, NULL);
 225     if (local_err != NULL) {
 226         qerror_report_err(local_err);
 227         error_free(local_err);
 228     }
 229
 230     return fd;
 231 }
 232
 233 int tcp_socket_incoming(const char *address, uint16_t port)
 234 {
 235     char address_and_port[128];
 236     combine_addr(address_and_port, 128, address, port);
 237     return tcp_socket_incoming_spec(address_and_port);
 238 }
 239
 240 int tcp_socket_incoming_spec(const char *address_and_port)
 241 {
 242     Error *local_err = NULL;
 243     int fd = inet_listen(address_and_port, NULL, 0, SOCK_STREAM, 0, &local_err);
 244
 245     if (local_err != NULL) {
 246         qerror_report_err(local_err);
 247         error_free(local_err);
 248     }
 249     return fd;
 250 }
 251
 252 int unix_socket_incoming(const char *path)
 253 {
 254     Error *local_err = NULL;
 255     int fd = unix_listen(path, NULL, 0, &local_err);
 256
 257     if (local_err != NULL) {
 258         qerror_report_err(local_err);
 259         error_free(local_err);
 260     }
 261     return fd;
 262 }
 263
 264 int unix_socket_outgoing(const char *path)
 265 {
 266     Error *local_err = NULL;
 267     int fd = unix_connect(path, &local_err);
 268
 269     if (local_err != NULL) {
 270         qerror_report_err(local_err);
 271         error_free(local_err);
 272     }
 273     return fd;
 274 }
 275
 276 /* Basic flow for negotiation
 277
 278    Server         Client
 279    Negotiate
 280
 281    or
 282
 283    Server         Client
 284    Negotiate #1
 285                   Option
 286    Negotiate #2
 287
 288    ----
 289
 290    followed by
 291
 292    Server         Client
 293                   Request
 294    Response
 295                   Request
 296    Response
 297                   ...
 298    ...
 299                   Request (type == 2)
 300
 301 */
 302
 303 static int nbd_receive_options(NBDClient *client)
 304 {
 305     int csock = client->sock;
 306     char name[256];
 307     uint32_t tmp, length;
 308     uint64_t magic;
 309     int rc;
 310
 311     /* Client sends:
 312         [ 0 ..   3]   reserved (0)
 313         [ 4 ..  11]   NBD_OPTS_MAGIC
 314         [12 ..  15]   NBD_OPT_EXPORT_NAME
 315         [16 ..  19]   length
 316         [20 ..  xx]   export name (length bytes)
 317      */
 318
 319     rc = -EINVAL;
 320     if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
 321         LOG("read failed");
 322         goto fail;
 323     }
 324     TRACE("Checking reserved");
 325     if (tmp != 0) {
 326         LOG("Bad reserved received");
 327         goto fail;
 328     }
 329
 330     if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
 331         LOG("read failed");
 332         goto fail;
 333     }
 334     TRACE("Checking reserved");
 335     if (magic != be64_to_cpu(NBD_OPTS_MAGIC)) {
 336         LOG("Bad magic received");
 337         goto fail;
 338     }
 339
 340     if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
 341         LOG("read failed");
 342         goto fail;
 343     }
 344     TRACE("Checking option");
 345     if (tmp != be32_to_cpu(NBD_OPT_EXPORT_NAME)) {
 346         LOG("Bad option received");
 347         goto fail;
 348     }
 349
 350     if (read_sync(csock, &length, sizeof(length)) != sizeof(length)) {
 351         LOG("read failed");
 352         goto fail;
 353     }
 354     TRACE("Checking length");
 355     length = be32_to_cpu(length);
 356     if (length > 255) {
 357         LOG("Bad length received");
 358         goto fail;
 359     }
 360     if (read_sync(csock, name, length) != length) {
 361         LOG("read failed");
 362         goto fail;
 363     }
 364     name[length] = '\0';
 365
 366     client->exp = nbd_export_find(name);
 367     if (!client->exp) {
 368         LOG("export not found");
 369         goto fail;
 370     }
 371
 372     QTAILQ_INSERT_TAIL(&client->exp->clients, client, next);
 373     nbd_export_get(client->exp);
 374
 375     TRACE("Option negotiation succeeded.");
 376     rc = 0;
 377 fail:
 378     return rc;
 379 }
 380
 381 static int nbd_send_negotiate(NBDClient *client)
 382 {
 383     int csock = client->sock;
 384     char buf[8 + 8 + 8 + 128];
 385     int rc;
 386     const int myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
 387                          NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
 388
 389     /* Negotiation header without options:
 390         [ 0 ..   7]   passwd       ("NBDMAGIC")
 391         [ 8 ..  15]   magic        (NBD_CLIENT_MAGIC)
 392         [16 ..  23]   size
 393         [24 ..  25]   server flags (0)
 394         [24 ..  27]   export flags
 395         [28 .. 151]   reserved     (0)
 396
 397        Negotiation header with options, part 1:
 398         [ 0 ..   7]   passwd       ("NBDMAGIC")
 399         [ 8 ..  15]   magic        (NBD_OPTS_MAGIC)
 400         [16 ..  17]   server flags (0)
 401
 402        part 2 (after options are sent):
 403         [18 ..  25]   size
 404         [26 ..  27]   export flags
 405         [28 .. 151]   reserved     (0)
 406      */
 407
 408     socket_set_block(csock);
 409     rc = -EINVAL;
 410
 411     TRACE("Beginning negotiation.");
 412     memset(buf, 0, sizeof(buf));
 413     memcpy(buf, "NBDMAGIC", 8);
 414     if (client->exp) {
 415         assert ((client->exp->nbdflags & ~65535) == 0);
 416         cpu_to_be64w((uint64_t*)(buf + 8), NBD_CLIENT_MAGIC);
 417         cpu_to_be64w((uint64_t*)(buf + 16), client->exp->size);
 418         cpu_to_be16w((uint16_t*)(buf + 26), client->exp->nbdflags | myflags);
 419     } else {
 420         cpu_to_be64w((uint64_t*)(buf + 8), NBD_OPTS_MAGIC);
 421     }
 422
 423     if (client->exp) {
 424         if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
 425             LOG("write failed");
 426             goto fail;
 427         }
 428     } else {
 429         if (write_sync(csock, buf, 18) != 18) {
 430             LOG("write failed");
 431             goto fail;
 432         }
 433         rc = nbd_receive_options(client);
 434         if (rc < 0) {
 435             LOG("option negotiation failed");
 436             goto fail;
 437         }
 438
 439         assert ((client->exp->nbdflags & ~65535) == 0);
 440         cpu_to_be64w((uint64_t*)(buf + 18), client->exp->size);
 441         cpu_to_be16w((uint16_t*)(buf + 26), client->exp->nbdflags | myflags);
 442         if (write_sync(csock, buf + 18, sizeof(buf) - 18) != sizeof(buf) - 18) {
 443             LOG("write failed");
 444             goto fail;
 445         }
 446     }
 447
 448     TRACE("Negotiation succeeded.");
 449     rc = 0;
 450 fail:
 451     socket_set_nonblock(csock);
 452     return rc;
 453 }
 454
 455 int nbd_receive_negotiate(int csock, const char *name, uint32_t *flags,
 456                           off_t *size, size_t *blocksize)
 457 {
 458     char buf[256];
 459     uint64_t magic, s;
 460     uint16_t tmp;
 461     int rc;
 462
 463     TRACE("Receiving negotiation.");
 464
 465     socket_set_block(csock);
 466     rc = -EINVAL;
 467
 468     if (read_sync(csock, buf, 8) != 8) {
 469         LOG("read failed");
 470         goto fail;
 471     }
 472
 473     buf[8] = '\0';
 474     if (strlen(buf) == 0) {
 475         LOG("server connection closed");
 476         goto fail;
 477     }
 478
 479     TRACE("Magic is %c%c%c%c%c%c%c%c",
 480           qemu_isprint(buf[0]) ? buf[0] : '.',
 481           qemu_isprint(buf[1]) ? buf[1] : '.',
 482           qemu_isprint(buf[2]) ? buf[2] : '.',
 483           qemu_isprint(buf[3]) ? buf[3] : '.',
 484           qemu_isprint(buf[4]) ? buf[4] : '.',
 485           qemu_isprint(buf[5]) ? buf[5] : '.',
 486           qemu_isprint(buf[6]) ? buf[6] : '.',
 487           qemu_isprint(buf[7]) ? buf[7] : '.');
 488
 489     if (memcmp(buf, "NBDMAGIC", 8) != 0) {
 490         LOG("Invalid magic received");
 491         goto fail;
 492     }
 493
 494     if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
 495         LOG("read failed");
 496         goto fail;
 497     }
 498     magic = be64_to_cpu(magic);
 499     TRACE("Magic is 0x%" PRIx64, magic);
 500
 501     if (name) {
 502         uint32_t reserved = 0;
 503         uint32_t opt;
 504         uint32_t namesize;
 505
 506         TRACE("Checking magic (opts_magic)");
 507         if (magic != NBD_OPTS_MAGIC) {
 508             LOG("Bad magic received");
 509             goto fail;
 510         }
 511         if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
 512             LOG("flags read failed");
 513             goto fail;
 514         }
 515         *flags = be16_to_cpu(tmp) << 16;
 516         /* reserved for future use */
 517         if (write_sync(csock, &reserved, sizeof(reserved)) !=
 518             sizeof(reserved)) {
 519             LOG("write failed (reserved)");
 520             goto fail;
 521         }
 522         /* write the export name */
 523         magic = cpu_to_be64(magic);
 524         if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
 525             LOG("write failed (magic)");
 526             goto fail;
 527         }
 528         opt = cpu_to_be32(NBD_OPT_EXPORT_NAME);
 529         if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {
 530             LOG("write failed (opt)");
 531             goto fail;
 532         }
 533         namesize = cpu_to_be32(strlen(name));
 534         if (write_sync(csock, &namesize, sizeof(namesize)) !=
 535             sizeof(namesize)) {
 536             LOG("write failed (namesize)");
 537             goto fail;
 538         }
 539         if (write_sync(csock, (char*)name, strlen(name)) != strlen(name)) {
 540             LOG("write failed (name)");
 541             goto fail;
 542         }
 543     } else {
 544         TRACE("Checking magic (cli_magic)");
 545
 546         if (magic != NBD_CLIENT_MAGIC) {
 547             LOG("Bad magic received");
 548             goto fail;
 549         }
 550     }
 551
 552     if (read_sync(csock, &s, sizeof(s)) != sizeof(s)) {
 553         LOG("read failed");
 554         goto fail;
 555     }
 556     *size = be64_to_cpu(s);
 557     *blocksize = 1024;
 558     TRACE("Size is %" PRIu64, *size);
 559
 560     if (!name) {
 561         if (read_sync(csock, flags, sizeof(*flags)) != sizeof(*flags)) {
 562             LOG("read failed (flags)");
 563             goto fail;
 564         }
 565         *flags = be32_to_cpup(flags);
 566     } else {
 567         if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
 568             LOG("read failed (tmp)");
 569             goto fail;
 570         }
 571         *flags |= be32_to_cpu(tmp);
 572     }
 573     if (read_sync(csock, &buf, 124) != 124) {
 574         LOG("read failed (buf)");
 575         goto fail;
 576     }
 577     rc = 0;
 578
 579 fail:
 580     socket_set_nonblock(csock);
 581     return rc;
 582 }
 583
 584 #ifdef __linux__
 585 int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
 586 {
 587     TRACE("Setting NBD socket");
 588
 589     if (ioctl(fd, NBD_SET_SOCK, csock) < 0) {
 590         int serrno = errno;
 591         LOG("Failed to set NBD socket");
 592         return -serrno;
 593     }
 594
 595     TRACE("Setting block size to %lu", (unsigned long)blocksize);
 596
 597     if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) < 0) {
 598         int serrno = errno;
 599         LOG("Failed setting NBD block size");
 600         return -serrno;
 601     }
 602
 603         TRACE("Setting size to %zd block(s)", (size_t)(size / blocksize));
 604
 605     if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) < 0) {
 606         int serrno = errno;
 607         LOG("Failed setting size (in blocks)");
 608         return -serrno;
 609     }
 610
 611     if (ioctl(fd, NBD_SET_FLAGS, flags) < 0) {
 612         if (errno == ENOTTY) {
 613             int read_only = (flags & NBD_FLAG_READ_ONLY) != 0;
 614             TRACE("Setting readonly attribute");
 615
 616             if (ioctl(fd, BLKROSET, (unsigned long) &read_only) < 0) {
 617                 int serrno = errno;
 618                 LOG("Failed setting read-only attribute");
 619                 return -serrno;
 620             }
 621         } else {
 622             int serrno = errno;
 623             LOG("Failed setting flags");
 624             return -serrno;
 625         }
 626     }
 627
 628     TRACE("Negotiation ended");
 629
 630     return 0;
 631 }
 632
 633 int nbd_disconnect(int fd)
 634 {
 635     ioctl(fd, NBD_CLEAR_QUE);
 636     ioctl(fd, NBD_DISCONNECT);
 637     ioctl(fd, NBD_CLEAR_SOCK);
 638     return 0;
 639 }
 640
 641 int nbd_client(int fd)
 642 {
 643     int ret;
 644     int serrno;
 645
 646     TRACE("Doing NBD loop");
 647
 648     ret = ioctl(fd, NBD_DO_IT);
 649     if (ret < 0 && errno == EPIPE) {
 650         /* NBD_DO_IT normally returns EPIPE when someone has disconnected
 651          * the socket via NBD_DISCONNECT.  We do not want to return 1 in
 652          * that case.
 653          */
 654         ret = 0;
 655     }
 656     serrno = errno;
 657
 658     TRACE("NBD loop returned %d: %s", ret, strerror(serrno));
 659
 660     TRACE("Clearing NBD queue");
 661     ioctl(fd, NBD_CLEAR_QUE);
 662
 663     TRACE("Clearing NBD socket");
 664     ioctl(fd, NBD_CLEAR_SOCK);
 665
 666     errno = serrno;
 667     return ret;
 668 }
 669 #else
 670 int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
 671 {
 672     return -ENOTSUP;
 673 }
 674
 675 int nbd_disconnect(int fd)
 676 {
 677     return -ENOTSUP;
 678 }
 679
 680 int nbd_client(int fd)
 681 {
 682     return -ENOTSUP;
 683 }
 684 #endif
 685
 686 ssize_t nbd_send_request(int csock, struct nbd_request *request)
 687 {
 688     uint8_t buf[NBD_REQUEST_SIZE];
 689     ssize_t ret;
 690
 691     cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
 692     cpu_to_be32w((uint32_t*)(buf + 4), request->type);
 693     cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
 694     cpu_to_be64w((uint64_t*)(buf + 16), request->from);
 695     cpu_to_be32w((uint32_t*)(buf + 24), request->len);
 696
 697     TRACE("Sending request to client: "
 698           "{ .from = %" PRIu64", .len = %u, .handle = %" PRIu64", .type=%i}",
 699           request->from, request->len, request->handle, request->type);
 700
 701     ret = write_sync(csock, buf, sizeof(buf));
 702     if (ret < 0) {
 703         return ret;
 704     }
 705
 706     if (ret != sizeof(buf)) {
 707         LOG("writing to socket failed");
 708         return -EINVAL;
 709     }
 710     return 0;
 711 }
 712
 713 static ssize_t nbd_receive_request(int csock, struct nbd_request *request)
 714 {
 715     uint8_t buf[NBD_REQUEST_SIZE];
 716     uint32_t magic;
 717     ssize_t ret;
 718
 719     ret = read_sync(csock, buf, sizeof(buf));
 720     if (ret < 0) {
 721         return ret;
 722     }
 723
 724     if (ret != sizeof(buf)) {
 725         LOG("read failed");
 726         return -EINVAL;
 727     }
 728
 729     /* Request
 730        [ 0 ..  3]   magic   (NBD_REQUEST_MAGIC)
 731        [ 4 ..  7]   type    (0 == READ, 1 == WRITE)
 732        [ 8 .. 15]   handle
 733        [16 .. 23]   from
 734        [24 .. 27]   len
 735      */
 736
 737     magic = be32_to_cpup((uint32_t*)buf);
 738     request->type  = be32_to_cpup((uint32_t*)(buf + 4));
 739     request->handle = be64_to_cpup((uint64_t*)(buf + 8));
 740     request->from  = be64_to_cpup((uint64_t*)(buf + 16));
 741     request->len   = be32_to_cpup((uint32_t*)(buf + 24));
 742
 743     TRACE("Got request: "
 744           "{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
 745           magic, request->type, request->from, request->len);
 746
 747     if (magic != NBD_REQUEST_MAGIC) {
 748         LOG("invalid magic (got 0x%x)", magic);
 749         return -EINVAL;
 750     }
 751     return 0;
 752 }
 753
 754 ssize_t nbd_receive_reply(int csock, struct nbd_reply *reply)
 755 {
 756     uint8_t buf[NBD_REPLY_SIZE];
 757     uint32_t magic;
 758     ssize_t ret;
 759
 760     ret = read_sync(csock, buf, sizeof(buf));
 761     if (ret < 0) {
 762         return ret;
 763     }
 764
 765     if (ret != sizeof(buf)) {
 766         LOG("read failed");
 767         return -EINVAL;
 768     }
 769
 770     /* Reply
 771        [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
 772        [ 4 ..  7]    error   (0 == no error)
 773        [ 7 .. 15]    handle
 774      */
 775
 776     magic = be32_to_cpup((uint32_t*)buf);
 777     reply->error  = be32_to_cpup((uint32_t*)(buf + 4));
 778     reply->handle = be64_to_cpup((uint64_t*)(buf + 8));
 779
 780     TRACE("Got reply: "
 781           "{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
 782           magic, reply->error, reply->handle);
 783
 784     if (magic != NBD_REPLY_MAGIC) {
 785         LOG("invalid magic (got 0x%x)", magic);
 786         return -EINVAL;
 787     }
 788     return 0;
 789 }
 790
 791 static ssize_t nbd_send_reply(int csock, struct nbd_reply *reply)
 792 {
 793     uint8_t buf[NBD_REPLY_SIZE];
 794     ssize_t ret;
 795
 796     /* Reply
 797        [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
 798        [ 4 ..  7]    error   (0 == no error)
 799        [ 7 .. 15]    handle
 800      */
 801     cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
 802     cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
 803     cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);
 804
 805     TRACE("Sending response to client");
 806
 807     ret = write_sync(csock, buf, sizeof(buf));
 808     if (ret < 0) {
 809         return ret;
 810     }
 811
 812     if (ret != sizeof(buf)) {
 813         LOG("writing to socket failed");
 814         return -EINVAL;
 815     }
 816     return 0;
 817 }
 818
 819 #define MAX_NBD_REQUESTS 16
 820
 821 void nbd_client_get(NBDClient *client)
 822 {
 823     client->refcount++;
 824 }
 825
 826 void nbd_client_put(NBDClient *client)
 827 {
 828     if (--client->refcount == 0) {
 829         /* The last reference should be dropped by client->close,
 830          * which is called by nbd_client_close.
 831          */
 832         assert(client->closing);
 833
 834         qemu_set_fd_handler2(client->sock, NULL, NULL, NULL, NULL);
 835         close(client->sock);
 836         client->sock = -1;
 837         if (client->exp) {
 838             QTAILQ_REMOVE(&client->exp->clients, client, next);
 839             nbd_export_put(client->exp);
 840         }
 841         g_free(client);
 842     }
 843 }
 844
 845 void nbd_client_close(NBDClient *client)
 846 {
 847     if (client->closing) {
 848         return;
 849     }
 850
 851     client->closing = true;
 852
 853     /* Force requests to finish.  They will drop their own references,
 854      * then we'll close the socket and free the NBDClient.
 855      */
 856     shutdown(client->sock, 2);
 857
 858     /* Also tell the client, so that they release their reference.  */
 859     if (client->close) {
 860         client->close(client);
 861     }
 862 }
 863
 864 static NBDRequest *nbd_request_get(NBDClient *client)
 865 {
 866     NBDRequest *req;
 867     NBDExport *exp = client->exp;
 868
 869     assert(client->nb_requests <= MAX_NBD_REQUESTS - 1);
 870     client->nb_requests++;
 871
 872     if (QSIMPLEQ_EMPTY(&exp->requests)) {
 873         req = g_malloc0(sizeof(NBDRequest));
 874         req->data = qemu_blockalign(exp->bs, NBD_BUFFER_SIZE);
 875     } else {
 876         req = QSIMPLEQ_FIRST(&exp->requests);
 877         QSIMPLEQ_REMOVE_HEAD(&exp->requests, entry);
 878     }
 879     nbd_client_get(client);
 880     req->client = client;
 881     return req;
 882 }
 883
 884 static void nbd_request_put(NBDRequest *req)
 885 {
 886     NBDClient *client = req->client;
 887     QSIMPLEQ_INSERT_HEAD(&client->exp->requests, req, entry);
 888     if (client->nb_requests-- == MAX_NBD_REQUESTS) {
 889         qemu_notify_event();
 890     }
 891     nbd_client_put(client);
 892 }
 893
 894 NBDExport *nbd_export_new(BlockDriverState *bs, off_t dev_offset,
 895                           off_t size, uint32_t nbdflags,
 896                           void (*close)(NBDExport *))
 897 {
 898     NBDExport *exp = g_malloc0(sizeof(NBDExport));
 899     QSIMPLEQ_INIT(&exp->requests);
 900     exp->refcount = 1;
 901     QTAILQ_INIT(&exp->clients);
 902     exp->bs = bs;
 903     exp->dev_offset = dev_offset;
 904     exp->nbdflags = nbdflags;
 905     exp->size = size == -1 ? bdrv_getlength(bs) : size;
 906     exp->close = close;
 907     return exp;
 908 }
 909
 910 NBDExport *nbd_export_find(const char *name)
 911 {
 912     NBDExport *exp;
 913     QTAILQ_FOREACH(exp, &exports, next) {
 914         if (strcmp(name, exp->name) == 0) {
 915             return exp;
 916         }
 917     }
 918
 919     return NULL;
 920 }
 921
 922 void nbd_export_set_name(NBDExport *exp, const char *name)
 923 {
 924     if (exp->name == name) {
 925         return;
 926     }
 927
 928     nbd_export_get(exp);
 929     if (exp->name != NULL) {
 930         g_free(exp->name);
 931         exp->name = NULL;
 932         QTAILQ_REMOVE(&exports, exp, next);
 933         nbd_export_put(exp);
 934     }
 935     if (name != NULL) {
 936         nbd_export_get(exp);
 937         exp->name = g_strdup(name);
 938         QTAILQ_INSERT_TAIL(&exports, exp, next);
 939     }
 940     nbd_export_put(exp);
 941 }
 942
 943 void nbd_export_close(NBDExport *exp)
 944 {
 945     NBDClient *client, *next;
 946
 947     nbd_export_get(exp);
 948     QTAILQ_FOREACH_SAFE(client, &exp->clients, next, next) {
 949         nbd_client_close(client);
 950     }
 951     nbd_export_set_name(exp, NULL);
 952     nbd_export_put(exp);
 953 }
 954
 955 void nbd_export_get(NBDExport *exp)
 956 {
 957     assert(exp->refcount > 0);
 958     exp->refcount++;
 959 }
 960
 961 void nbd_export_put(NBDExport *exp)
 962 {
 963     assert(exp->refcount > 0);
 964     if (exp->refcount == 1) {
 965         nbd_export_close(exp);
 966     }
 967
 968     if (--exp->refcount == 0) {
 969         assert(exp->name == NULL);
 970
 971         if (exp->close) {
 972             exp->close(exp);
 973         }
 974
 975         while (!QSIMPLEQ_EMPTY(&exp->requests)) {
 976             NBDRequest *first = QSIMPLEQ_FIRST(&exp->requests);
 977             QSIMPLEQ_REMOVE_HEAD(&exp->requests, entry);
 978             qemu_vfree(first->data);
 979             g_free(first);
 980         }
 981
 982         g_free(exp);
 983     }
 984 }
 985
 986 BlockDriverState *nbd_export_get_blockdev(NBDExport *exp)
 987 {
 988     return exp->bs;
 989 }
 990
 991 void nbd_export_close_all(void)
 992 {
 993     NBDExport *exp, *next;
 994
 995     QTAILQ_FOREACH_SAFE(exp, &exports, next, next) {
 996         nbd_export_close(exp);
 997     }
 998 }
 999
1000 static int nbd_can_read(void *opaque);
1001 static void nbd_read(void *opaque);
1002 static void nbd_restart_write(void *opaque);
1003
1004 static ssize_t nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,
1005                                  int len)
1006 {
1007     NBDClient *client = req->client;
1008     int csock = client->sock;
1009     ssize_t rc, ret;
1010
1011     qemu_co_mutex_lock(&client->send_lock);
1012     qemu_set_fd_handler2(csock, nbd_can_read, nbd_read,
1013                          nbd_restart_write, client);
1014     client->send_coroutine = qemu_coroutine_self();
1015
1016     if (!len) {
1017         rc = nbd_send_reply(csock, reply);
1018     } else {
1019         socket_set_cork(csock, 1);
1020         rc = nbd_send_reply(csock, reply);
1021         if (rc >= 0) {
1022             ret = qemu_co_send(csock, req->data, len);
1023             if (ret != len) {
1024                 rc = -EIO;
1025             }
1026         }
1027         socket_set_cork(csock, 0);
1028     }
1029
1030     client->send_coroutine = NULL;
1031     qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);
1032     qemu_co_mutex_unlock(&client->send_lock);
1033     return rc;
1034 }
1035
1036 static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *request)
1037 {
1038     NBDClient *client = req->client;
1039     int csock = client->sock;
1040     ssize_t rc;
1041
1042     client->recv_coroutine = qemu_coroutine_self();
1043     rc = nbd_receive_request(csock, request);
1044     if (rc < 0) {
1045         if (rc != -EAGAIN) {
1046             rc = -EIO;
1047         }
1048         goto out;
1049     }
1050
1051     if (request->len > NBD_BUFFER_SIZE) {
1052         LOG("len (%u) is larger than max len (%u)",
1053             request->len, NBD_BUFFER_SIZE);
1054         rc = -EINVAL;
1055         goto out;
1056     }
1057
1058     if ((request->from + request->len) < request->from) {
1059         LOG("integer overflow detected! "
1060             "you're probably being attacked");
1061         rc = -EINVAL;
1062         goto out;
1063     }
1064
1065     TRACE("Decoding type");
1066
1067     if ((request->type & NBD_CMD_MASK_COMMAND) == NBD_CMD_WRITE) {
1068         TRACE("Reading %u byte(s)", request->len);
1069
1070         if (qemu_co_recv(csock, req->data, request->len) != request->len) {
1071             LOG("reading from socket failed");
1072             rc = -EIO;
1073             goto out;
1074         }
1075     }
1076     rc = 0;
1077
1078 out:
1079     client->recv_coroutine = NULL;
1080     return rc;
1081 }
1082
1083 static void nbd_trip(void *opaque)
1084 {
1085     NBDClient *client = opaque;
1086     NBDExport *exp = client->exp;
1087     NBDRequest *req;
1088     struct nbd_request request;
1089     struct nbd_reply reply;
1090     ssize_t ret;
1091
1092     TRACE("Reading request.");
1093     if (client->closing) {
1094         return;
1095     }
1096
1097     req = nbd_request_get(client);
1098     ret = nbd_co_receive_request(req, &request);
1099     if (ret == -EAGAIN) {
1100         goto done;
1101     }
1102     if (ret == -EIO) {
1103         goto out;
1104     }
1105
1106     reply.handle = request.handle;
1107     reply.error = 0;
1108
1109     if (ret < 0) {
1110         reply.error = -ret;
1111         goto error_reply;
1112     }
1113
1114     if ((request.from + request.len) > exp->size) {
1115             LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
1116             ", Offset: %" PRIu64 "\n",
1117                     request.from, request.len,
1118                     (uint64_t)exp->size, (uint64_t)exp->dev_offset);
1119         LOG("requested operation past EOF--bad client?");
1120         goto invalid_request;
1121     }
1122
1123     switch (request.type & NBD_CMD_MASK_COMMAND) {
1124     case NBD_CMD_READ:
1125         TRACE("Request type is READ");
1126
1127         if (request.type & NBD_CMD_FLAG_FUA) {
1128             ret = bdrv_co_flush(exp->bs);
1129             if (ret < 0) {
1130                 LOG("flush failed");
1131                 reply.error = -ret;
1132                 goto error_reply;
1133             }
1134         }
1135
1136         ret = bdrv_read(exp->bs, (request.from + exp->dev_offset) / 512,
1137                         req->data, request.len / 512);
1138         if (ret < 0) {
1139             LOG("reading from file failed");
1140             reply.error = -ret;
1141             goto error_reply;
1142         }
1143
1144         TRACE("Read %u byte(s)", request.len);
1145         if (nbd_co_send_reply(req, &reply, request.len) < 0)
1146             goto out;
1147         break;
1148     case NBD_CMD_WRITE:
1149         TRACE("Request type is WRITE");
1150
1151         if (exp->nbdflags & NBD_FLAG_READ_ONLY) {
1152             TRACE("Server is read-only, return error");
1153             reply.error = EROFS;
1154             goto error_reply;
1155         }
1156
1157         TRACE("Writing to device");
1158
1159         ret = bdrv_write(exp->bs, (request.from + exp->dev_offset) / 512,
1160                          req->data, request.len / 512);
1161         if (ret < 0) {
1162             LOG("writing to file failed");
1163             reply.error = -ret;
1164             goto error_reply;
1165         }
1166
1167         if (request.type & NBD_CMD_FLAG_FUA) {
1168             ret = bdrv_co_flush(exp->bs);
1169             if (ret < 0) {
1170                 LOG("flush failed");
1171                 reply.error = -ret;
1172                 goto error_reply;
1173             }
1174         }
1175
1176         if (nbd_co_send_reply(req, &reply, 0) < 0) {
1177             goto out;
1178         }
1179         break;
1180     case NBD_CMD_DISC:
1181         TRACE("Request type is DISCONNECT");
1182         errno = 0;
1183         goto out;
1184     case NBD_CMD_FLUSH:
1185         TRACE("Request type is FLUSH");
1186
1187         ret = bdrv_co_flush(exp->bs);
1188         if (ret < 0) {
1189             LOG("flush failed");
1190             reply.error = -ret;
1191         }
1192         if (nbd_co_send_reply(req, &reply, 0) < 0) {
1193             goto out;
1194         }
1195         break;
1196     case NBD_CMD_TRIM:
1197         TRACE("Request type is TRIM");
1198         ret = bdrv_co_discard(exp->bs, (request.from + exp->dev_offset) / 512,
1199                               request.len / 512);
1200         if (ret < 0) {
1201             LOG("discard failed");
1202             reply.error = -ret;
1203         }
1204         if (nbd_co_send_reply(req, &reply, 0) < 0) {
1205             goto out;
1206         }
1207         break;
1208     default:
1209         LOG("invalid request type (%u) received", request.type);
1210     invalid_request:
1211         reply.error = -EINVAL;
1212     error_reply:
1213         if (nbd_co_send_reply(req, &reply, 0) < 0) {
1214             goto out;
1215         }
1216         break;
1217     }
1218
1219     TRACE("Request/Reply complete");
1220
1221 done:
1222     nbd_request_put(req);
1223     return;
1224
1225 out:
1226     nbd_request_put(req);
1227     nbd_client_close(client);
1228 }
1229
1230 static int nbd_can_read(void *opaque)
1231 {
1232     NBDClient *client = opaque;
1233
1234     return client->recv_coroutine || client->nb_requests < MAX_NBD_REQUESTS;
1235 }
1236
1237 static void nbd_read(void *opaque)
1238 {
1239     NBDClient *client = opaque;
1240
1241     if (client->recv_coroutine) {
1242         qemu_coroutine_enter(client->recv_coroutine, NULL);
1243     } else {
1244         qemu_coroutine_enter(qemu_coroutine_create(nbd_trip), client);
1245     }
1246 }
1247
1248 static void nbd_restart_write(void *opaque)
1249 {
1250     NBDClient *client = opaque;
1251
1252     qemu_coroutine_enter(client->send_coroutine, NULL);
1253 }
1254
1255 NBDClient *nbd_client_new(NBDExport *exp, int csock,
1256                           void (*close)(NBDClient *))
1257 {
1258     NBDClient *client;
1259     client = g_malloc0(sizeof(NBDClient));
1260     client->refcount = 1;
1261     client->exp = exp;
1262     client->sock = csock;
1263     if (nbd_send_negotiate(client) < 0) {
1264         g_free(client);
1265         return NULL;
1266     }
1267     client->close = close;
1268     qemu_co_mutex_init(&client->send_lock);
1269     qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);
1270
1271     if (exp) {
1272         QTAILQ_INSERT_TAIL(&exp->clients, client, next);
1273         nbd_export_get(exp);
1274     }
1275     return client;
1276 }