nbd.c 34.4 KB
Newer Older
1
/*
2 3 4 5 6 7 8 9 10 11 12 13 14 15
 *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
 *
 *  Network Block Device
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; under version 2 of the License.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
16
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
17
 */
18

19 20
#include "block/nbd.h"
#include "block/block.h"
Max Reitz's avatar
Max Reitz committed
21
#include "block/block_int.h"
22

23
#include "block/coroutine.h"
24

25 26
#include <errno.h>
#include <string.h>
27
#ifndef _WIN32
28
#include <sys/ioctl.h>
29
#endif
30
#if defined(__sun__) || defined(__HAIKU__)
31 32
#include <sys/ioccom.h>
#endif
33 34
#include <ctype.h>
#include <inttypes.h>
35

36 37 38 39
#ifdef __linux__
#include <linux/fs.h>
#endif

40 41
#include "qemu/sockets.h"
#include "qemu/queue.h"
42
#include "qemu/main-loop.h"
43 44 45 46

//#define DEBUG_NBD

#ifdef DEBUG_NBD
47
#define TRACE(msg, ...) do { \
48
    LOG(msg, ## __VA_ARGS__); \
49
} while(0)
50 51 52 53
#else
#define TRACE(msg, ...) \
    do { } while (0)
#endif
54 55 56 57 58 59

#define LOG(msg, ...) do { \
    fprintf(stderr, "%s:%s():L%d: " msg "\n", \
            __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
} while(0)

60 61 62 63 64
/* This is all part of the "official" NBD API.
 *
 * The most up-to-date documentation is available at:
 * https://github.com/yoe/nbd/blob/master/doc/proto.txt
 */
65

Paolo Bonzini's avatar
Paolo Bonzini committed
66
#define NBD_REQUEST_SIZE        (4 + 4 + 8 + 8 + 4)
67
#define NBD_REPLY_SIZE          (4 + 4 + 8)
68 69
#define NBD_REQUEST_MAGIC       0x25609513
#define NBD_REPLY_MAGIC         0x67446698
Paolo Bonzini's avatar
Paolo Bonzini committed
70 71
#define NBD_OPTS_MAGIC          0x49484156454F5054LL
#define NBD_CLIENT_MAGIC        0x0000420281861253LL
72
#define NBD_REP_MAGIC           0x3e889045565a9LL
73 74 75 76 77 78 79

#define NBD_SET_SOCK            _IO(0xab, 0)
#define NBD_SET_BLKSIZE         _IO(0xab, 1)
#define NBD_SET_SIZE            _IO(0xab, 2)
#define NBD_DO_IT               _IO(0xab, 3)
#define NBD_CLEAR_SOCK          _IO(0xab, 4)
#define NBD_CLEAR_QUE           _IO(0xab, 5)
80 81
#define NBD_PRINT_DEBUG         _IO(0xab, 6)
#define NBD_SET_SIZE_BLOCKS     _IO(0xab, 7)
82
#define NBD_DISCONNECT          _IO(0xab, 8)
83 84
#define NBD_SET_TIMEOUT         _IO(0xab, 9)
#define NBD_SET_FLAGS           _IO(0xab, 10)
85

86 87
#define NBD_OPT_EXPORT_NAME     (1)
#define NBD_OPT_ABORT           (2)
88
#define NBD_OPT_LIST            (3)
89

90 91 92 93 94 95 96 97 98 99 100
/* Definitions for opaque data types */

typedef struct NBDRequest NBDRequest;

struct NBDRequest {
    QSIMPLEQ_ENTRY(NBDRequest) entry;
    NBDClient *client;
    uint8_t *data;
};

struct NBDExport {
101
    int refcount;
102 103
    void (*close)(NBDExport *exp);

104
    BlockDriverState *bs;
105
    char *name;
106 107 108
    off_t dev_offset;
    off_t size;
    uint32_t nbdflags;
109
    QTAILQ_HEAD(, NBDClient) clients;
110
    QTAILQ_ENTRY(NBDExport) next;
Max Reitz's avatar
Max Reitz committed
111 112

    AioContext *ctx;
113 114
};

115 116
static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);

117 118 119 120 121 122 123 124 125 126 127 128
struct NBDClient {
    int refcount;
    void (*close)(NBDClient *client);

    NBDExport *exp;
    int sock;

    Coroutine *recv_coroutine;

    CoMutex send_lock;
    Coroutine *send_coroutine;

Max Reitz's avatar
Max Reitz committed
129 130
    bool can_read;

131
    QTAILQ_ENTRY(NBDClient) next;
132
    int nb_requests;
133
    bool closing;
134 135
};

136 137
/* That's all folks */

Max Reitz's avatar
Max Reitz committed
138 139 140 141
static void nbd_set_handlers(NBDClient *client);
static void nbd_unset_handlers(NBDClient *client);
static void nbd_update_can_read(NBDClient *client);

142
ssize_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
143 144
{
    size_t offset = 0;
145
    int err;
146

147 148 149 150 151 152 153 154
    if (qemu_in_coroutine()) {
        if (do_read) {
            return qemu_co_recv(fd, buffer, size);
        } else {
            return qemu_co_send(fd, buffer, size);
        }
    }

155 156 157 158
    while (offset < size) {
        ssize_t len;

        if (do_read) {
Blue Swirl's avatar
Blue Swirl committed
159
            len = qemu_recv(fd, buffer + offset, size - offset, 0);
160
        } else {
161
            len = send(fd, buffer + offset, size - offset, 0);
162 163
        }

164
        if (len < 0) {
165
            err = socket_error();
166

167
            /* recoverable error */
168
            if (err == EINTR || (offset > 0 && (err == EAGAIN || err == EWOULDBLOCK))) {
169 170 171 172
                continue;
            }

            /* unrecoverable error */
173
            return -err;
174 175 176 177 178 179 180 181 182 183 184 185 186
        }

        /* eof */
        if (len == 0) {
            break;
        }

        offset += len;
    }

    return offset;
}

187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206
static ssize_t read_sync(int fd, void *buffer, size_t size)
{
    /* Sockets are kept in blocking mode in the negotiation phase.  After
     * that, a non-readable socket simply means that another thread stole
     * our request/reply.  Synchronization is done with recv_coroutine, so
     * that this is coroutine-safe.
     */
    return nbd_wr_sync(fd, buffer, size, true);
}

static ssize_t write_sync(int fd, void *buffer, size_t size)
{
    int ret;
    do {
        /* For writes, we do expect the socket to be writable.  */
        ret = nbd_wr_sync(fd, buffer, size, false);
    } while (ret == -EAGAIN);
    return ret;
}

207
/* Basic flow for negotiation
208 209 210

   Server         Client
   Negotiate
211 212 213 214 215 216 217 218 219 220 221 222 223

   or

   Server         Client
   Negotiate #1
                  Option
   Negotiate #2

   ----

   followed by

   Server         Client
224 225 226 227 228 229 230
                  Request
   Response
                  Request
   Response
                  ...
   ...
                  Request (type == 2)
231

232 233
*/

234
static int nbd_send_rep(int csock, uint32_t type, uint32_t opt)
235 236
{
    uint64_t magic;
237
    uint32_t len;
238

239 240 241 242
    magic = cpu_to_be64(NBD_REP_MAGIC);
    if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
        LOG("write failed (rep magic)");
        return -EINVAL;
243
    }
244 245 246 247
    opt = cpu_to_be32(opt);
    if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {
        LOG("write failed (rep opt)");
        return -EINVAL;
248
    }
249 250 251 252
    type = cpu_to_be32(type);
    if (write_sync(csock, &type, sizeof(type)) != sizeof(type)) {
        LOG("write failed (rep type)");
        return -EINVAL;
253
    }
254 255 256 257
    len = cpu_to_be32(0);
    if (write_sync(csock, &len, sizeof(len)) != sizeof(len)) {
        LOG("write failed (rep data length)");
        return -EINVAL;
258
    }
259 260
    return 0;
}
261

262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319
static int nbd_send_rep_list(int csock, NBDExport *exp)
{
    uint64_t magic, name_len;
    uint32_t opt, type, len;

    name_len = strlen(exp->name);
    magic = cpu_to_be64(NBD_REP_MAGIC);
    if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
        LOG("write failed (magic)");
        return -EINVAL;
     }
    opt = cpu_to_be32(NBD_OPT_LIST);
    if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {
        LOG("write failed (opt)");
        return -EINVAL;
    }
    type = cpu_to_be32(NBD_REP_SERVER);
    if (write_sync(csock, &type, sizeof(type)) != sizeof(type)) {
        LOG("write failed (reply type)");
        return -EINVAL;
    }
    len = cpu_to_be32(name_len + sizeof(len));
    if (write_sync(csock, &len, sizeof(len)) != sizeof(len)) {
        LOG("write failed (length)");
        return -EINVAL;
    }
    len = cpu_to_be32(name_len);
    if (write_sync(csock, &len, sizeof(len)) != sizeof(len)) {
        LOG("write failed (length)");
        return -EINVAL;
    }
    if (write_sync(csock, exp->name, name_len) != name_len) {
        LOG("write failed (buffer)");
        return -EINVAL;
    }
    return 0;
}

static int nbd_handle_list(NBDClient *client, uint32_t length)
{
    int csock;
    NBDExport *exp;

    csock = client->sock;
    if (length) {
        return nbd_send_rep(csock, NBD_REP_ERR_INVALID, NBD_OPT_LIST);
    }

    /* For each export, send a NBD_REP_SERVER reply. */
    QTAILQ_FOREACH(exp, &exports, next) {
        if (nbd_send_rep_list(csock, exp)) {
            return -EINVAL;
        }
    }
    /* Finish with a NBD_REP_ACK. */
    return nbd_send_rep(csock, NBD_REP_ACK, NBD_OPT_LIST);
}

320 321 322 323
static int nbd_handle_export_name(NBDClient *client, uint32_t length)
{
    int rc = -EINVAL, csock = client->sock;
    char name[256];
324

325 326 327
    /* Client sends:
        [20 ..  xx]   export name (length bytes)
     */
328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351
    TRACE("Checking length");
    if (length > 255) {
        LOG("Bad length received");
        goto fail;
    }
    if (read_sync(csock, name, length) != length) {
        LOG("read failed");
        goto fail;
    }
    name[length] = '\0';

    client->exp = nbd_export_find(name);
    if (!client->exp) {
        LOG("export not found");
        goto fail;
    }

    QTAILQ_INSERT_TAIL(&client->exp->clients, client, next);
    nbd_export_get(client->exp);
    rc = 0;
fail:
    return rc;
}

352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400
static int nbd_receive_options(NBDClient *client)
{
    while (1) {
        int csock = client->sock;
        uint32_t tmp, length;
        uint64_t magic;

        /* Client sends:
            [ 0 ..   3]   client flags
            [ 4 ..  11]   NBD_OPTS_MAGIC
            [12 ..  15]   NBD option
            [16 ..  19]   length
            ...           Rest of request
        */

        if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
            LOG("read failed");
            return -EINVAL;
        }
        TRACE("Checking client flags");
        tmp = be32_to_cpu(tmp);
        if (tmp != 0 && tmp != NBD_FLAG_C_FIXED_NEWSTYLE) {
            LOG("Bad client flags received");
            return -EINVAL;
        }

        if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
            LOG("read failed");
            return -EINVAL;
        }
        TRACE("Checking opts magic");
        if (magic != be64_to_cpu(NBD_OPTS_MAGIC)) {
            LOG("Bad magic received");
            return -EINVAL;
        }

        if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
            LOG("read failed");
            return -EINVAL;
        }

        if (read_sync(csock, &length, sizeof(length)) != sizeof(length)) {
            LOG("read failed");
            return -EINVAL;
        }
        length = be32_to_cpu(length);

        TRACE("Checking option");
        switch (be32_to_cpu(tmp)) {
401 402 403 404 405 406
        case NBD_OPT_LIST:
            if (nbd_handle_list(client, length) < 0) {
                return 1;
            }
            break;

407 408 409 410 411 412 413 414 415 416 417 418 419 420 421
        case NBD_OPT_ABORT:
            return -EINVAL;

        case NBD_OPT_EXPORT_NAME:
            return nbd_handle_export_name(client, length);

        default:
            tmp = be32_to_cpu(tmp);
            LOG("Unsupported option 0x%x", tmp);
            nbd_send_rep(client->sock, NBD_REP_ERR_UNSUP, tmp);
            return -EINVAL;
        }
    }
}

422
static int nbd_send_negotiate(NBDClient *client)
423
{
424
    int csock = client->sock;
425
    char buf[8 + 8 + 8 + 128];
426
    int rc;
427 428
    const int myflags = (NBD_FLAG_HAS_FLAGS | NBD_FLAG_SEND_TRIM |
                         NBD_FLAG_SEND_FLUSH | NBD_FLAG_SEND_FUA);
429

430 431 432
    /* Negotiation header without options:
        [ 0 ..   7]   passwd       ("NBDMAGIC")
        [ 8 ..  15]   magic        (NBD_CLIENT_MAGIC)
433
        [16 ..  23]   size
434
        [24 ..  25]   server flags (0)
435
        [26 ..  27]   export flags
436 437 438 439 440 441 442 443 444 445 446
        [28 .. 151]   reserved     (0)

       Negotiation header with options, part 1:
        [ 0 ..   7]   passwd       ("NBDMAGIC")
        [ 8 ..  15]   magic        (NBD_OPTS_MAGIC)
        [16 ..  17]   server flags (0)

       part 2 (after options are sent):
        [18 ..  25]   size
        [26 ..  27]   export flags
        [28 .. 151]   reserved     (0)
447 448
     */

449
    qemu_set_block(csock);
450 451
    rc = -EINVAL;

452
    TRACE("Beginning negotiation.");
453
    memset(buf, 0, sizeof(buf));
454
    memcpy(buf, "NBDMAGIC", 8);
455 456 457 458 459 460 461
    if (client->exp) {
        assert ((client->exp->nbdflags & ~65535) == 0);
        cpu_to_be64w((uint64_t*)(buf + 8), NBD_CLIENT_MAGIC);
        cpu_to_be64w((uint64_t*)(buf + 16), client->exp->size);
        cpu_to_be16w((uint16_t*)(buf + 26), client->exp->nbdflags | myflags);
    } else {
        cpu_to_be64w((uint64_t*)(buf + 8), NBD_OPTS_MAGIC);
462
        cpu_to_be16w((uint16_t *)(buf + 16), NBD_FLAG_FIXED_NEWSTYLE);
463
    }
464

465 466 467 468 469 470 471 472 473 474 475
    if (client->exp) {
        if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
            LOG("write failed");
            goto fail;
        }
    } else {
        if (write_sync(csock, buf, 18) != 18) {
            LOG("write failed");
            goto fail;
        }
        rc = nbd_receive_options(client);
476
        if (rc != 0) {
477 478 479 480 481 482 483 484 485 486 487
            LOG("option negotiation failed");
            goto fail;
        }

        assert ((client->exp->nbdflags & ~65535) == 0);
        cpu_to_be64w((uint64_t*)(buf + 18), client->exp->size);
        cpu_to_be16w((uint16_t*)(buf + 26), client->exp->nbdflags | myflags);
        if (write_sync(csock, buf + 18, sizeof(buf) - 18) != sizeof(buf) - 18) {
            LOG("write failed");
            goto fail;
        }
488 489
    }

490
    TRACE("Negotiation succeeded.");
491 492
    rc = 0;
fail:
493
    qemu_set_nonblock(csock);
494
    return rc;
495 496
}

497 498
int nbd_receive_negotiate(int csock, const char *name, uint32_t *flags,
                          off_t *size, size_t *blocksize)
499
{
500 501 502
    char buf[256];
    uint64_t magic, s;
    uint16_t tmp;
503
    int rc;
504

505
    TRACE("Receiving negotiation.");
506

507 508
    rc = -EINVAL;

509 510
    if (read_sync(csock, buf, 8) != 8) {
        LOG("read failed");
511
        goto fail;
512 513 514 515 516
    }

    buf[8] = '\0';
    if (strlen(buf) == 0) {
        LOG("server connection closed");
517
        goto fail;
518 519 520 521 522 523 524 525 526 527 528 529 530 531
    }

    TRACE("Magic is %c%c%c%c%c%c%c%c",
          qemu_isprint(buf[0]) ? buf[0] : '.',
          qemu_isprint(buf[1]) ? buf[1] : '.',
          qemu_isprint(buf[2]) ? buf[2] : '.',
          qemu_isprint(buf[3]) ? buf[3] : '.',
          qemu_isprint(buf[4]) ? buf[4] : '.',
          qemu_isprint(buf[5]) ? buf[5] : '.',
          qemu_isprint(buf[6]) ? buf[6] : '.',
          qemu_isprint(buf[7]) ? buf[7] : '.');

    if (memcmp(buf, "NBDMAGIC", 8) != 0) {
        LOG("Invalid magic received");
532
        goto fail;
533 534 535 536
    }

    if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
        LOG("read failed");
537
        goto fail;
538 539 540 541 542 543 544 545 546 547
    }
    magic = be64_to_cpu(magic);
    TRACE("Magic is 0x%" PRIx64, magic);

    if (name) {
        uint32_t reserved = 0;
        uint32_t opt;
        uint32_t namesize;

        TRACE("Checking magic (opts_magic)");
Paolo Bonzini's avatar
Paolo Bonzini committed
548
        if (magic != NBD_OPTS_MAGIC) {
549
            LOG("Bad magic received");
550
            goto fail;
551 552 553
        }
        if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
            LOG("flags read failed");
554
            goto fail;
555 556 557 558 559 560
        }
        *flags = be16_to_cpu(tmp) << 16;
        /* reserved for future use */
        if (write_sync(csock, &reserved, sizeof(reserved)) !=
            sizeof(reserved)) {
            LOG("write failed (reserved)");
561
            goto fail;
562 563 564 565 566
        }
        /* write the export name */
        magic = cpu_to_be64(magic);
        if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {
            LOG("write failed (magic)");
567
            goto fail;
568 569 570 571
        }
        opt = cpu_to_be32(NBD_OPT_EXPORT_NAME);
        if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {
            LOG("write failed (opt)");
572
            goto fail;
573 574 575 576 577
        }
        namesize = cpu_to_be32(strlen(name));
        if (write_sync(csock, &namesize, sizeof(namesize)) !=
            sizeof(namesize)) {
            LOG("write failed (namesize)");
578
            goto fail;
579 580 581
        }
        if (write_sync(csock, (char*)name, strlen(name)) != strlen(name)) {
            LOG("write failed (name)");
582
            goto fail;
583 584 585 586
        }
    } else {
        TRACE("Checking magic (cli_magic)");

Paolo Bonzini's avatar
Paolo Bonzini committed
587
        if (magic != NBD_CLIENT_MAGIC) {
588
            LOG("Bad magic received");
589
            goto fail;
590 591 592 593 594
        }
    }

    if (read_sync(csock, &s, sizeof(s)) != sizeof(s)) {
        LOG("read failed");
595
        goto fail;
596 597 598 599 600 601 602 603
    }
    *size = be64_to_cpu(s);
    *blocksize = 1024;
    TRACE("Size is %" PRIu64, *size);

    if (!name) {
        if (read_sync(csock, flags, sizeof(*flags)) != sizeof(*flags)) {
            LOG("read failed (flags)");
604
            goto fail;
605 606 607 608 609
        }
        *flags = be32_to_cpup(flags);
    } else {
        if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) {
            LOG("read failed (tmp)");
610
            goto fail;
611 612 613 614 615
        }
        *flags |= be32_to_cpu(tmp);
    }
    if (read_sync(csock, &buf, 124) != 124) {
        LOG("read failed (buf)");
616
        goto fail;
617
    }
618 619 620 621
    rc = 0;

fail:
    return rc;
622
}
623

624 625
#ifdef __linux__
int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
626
{
627 628
    TRACE("Setting NBD socket");

629
    if (ioctl(fd, NBD_SET_SOCK, csock) < 0) {
630 631
        int serrno = errno;
        LOG("Failed to set NBD socket");
632
        return -serrno;
633 634
    }

635
    TRACE("Setting block size to %lu", (unsigned long)blocksize);
636

637
    if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) < 0) {
638 639
        int serrno = errno;
        LOG("Failed setting NBD block size");
640
        return -serrno;
641
    }
642

643
        TRACE("Setting size to %zd block(s)", (size_t)(size / blocksize));
644

645
    if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) < 0) {
646 647
        int serrno = errno;
        LOG("Failed setting size (in blocks)");
648
        return -serrno;
649
    }
650

651 652 653 654 655 656 657 658 659 660 661
    if (ioctl(fd, NBD_SET_FLAGS, flags) < 0) {
        if (errno == ENOTTY) {
            int read_only = (flags & NBD_FLAG_READ_ONLY) != 0;
            TRACE("Setting readonly attribute");

            if (ioctl(fd, BLKROSET, (unsigned long) &read_only) < 0) {
                int serrno = errno;
                LOG("Failed setting read-only attribute");
                return -serrno;
            }
        } else {
662
            int serrno = errno;
663
            LOG("Failed setting flags");
664
            return -serrno;
665 666 667
        }
    }

668
    TRACE("Negotiation ended");
669

670
    return 0;
671 672 673 674
}

int nbd_disconnect(int fd)
{
675 676 677 678
    ioctl(fd, NBD_CLEAR_QUE);
    ioctl(fd, NBD_DISCONNECT);
    ioctl(fd, NBD_CLEAR_SOCK);
    return 0;
679 680
}

681
int nbd_client(int fd)
682
{
683 684
    int ret;
    int serrno;
685

686
    TRACE("Doing NBD loop");
687

688
    ret = ioctl(fd, NBD_DO_IT);
689
    if (ret < 0 && errno == EPIPE) {
690 691 692 693 694 695
        /* NBD_DO_IT normally returns EPIPE when someone has disconnected
         * the socket via NBD_DISCONNECT.  We do not want to return 1 in
         * that case.
         */
        ret = 0;
    }
696
    serrno = errno;
697

698
    TRACE("NBD loop returned %d: %s", ret, strerror(serrno));
699

700 701
    TRACE("Clearing NBD queue");
    ioctl(fd, NBD_CLEAR_QUE);
702

703 704
    TRACE("Clearing NBD socket");
    ioctl(fd, NBD_CLEAR_SOCK);
705

706 707
    errno = serrno;
    return ret;
708
}
709
#else
710
int nbd_init(int fd, int csock, uint32_t flags, off_t size, size_t blocksize)
711
{
712
    return -ENOTSUP;
713 714 715 716
}

int nbd_disconnect(int fd)
{
717
    return -ENOTSUP;
718 719
}

720
int nbd_client(int fd)
721
{
722
    return -ENOTSUP;
723 724
}
#endif
725

726
ssize_t nbd_send_request(int csock, struct nbd_request *request)
727
{
Paolo Bonzini's avatar
Paolo Bonzini committed
728
    uint8_t buf[NBD_REQUEST_SIZE];
729
    ssize_t ret;
730 731 732 733 734 735

    cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
    cpu_to_be32w((uint32_t*)(buf + 4), request->type);
    cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
    cpu_to_be64w((uint64_t*)(buf + 16), request->from);
    cpu_to_be32w((uint32_t*)(buf + 24), request->len);
736

737 738 739 740
    TRACE("Sending request to client: "
          "{ .from = %" PRIu64", .len = %u, .handle = %" PRIu64", .type=%i}",
          request->from, request->len, request->handle, request->type);

741 742 743 744 745 746
    ret = write_sync(csock, buf, sizeof(buf));
    if (ret < 0) {
        return ret;
    }

    if (ret != sizeof(buf)) {
747
        LOG("writing to socket failed");
748
        return -EINVAL;
749 750 751
    }
    return 0;
}
752

753
static ssize_t nbd_receive_request(int csock, struct nbd_request *request)
754
{
Paolo Bonzini's avatar
Paolo Bonzini committed
755
    uint8_t buf[NBD_REQUEST_SIZE];
756
    uint32_t magic;
757
    ssize_t ret;
758

759 760 761 762 763 764
    ret = read_sync(csock, buf, sizeof(buf));
    if (ret < 0) {
        return ret;
    }

    if (ret != sizeof(buf)) {
765
        LOG("read failed");
766
        return -EINVAL;
767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788
    }

    /* Request
       [ 0 ..  3]   magic   (NBD_REQUEST_MAGIC)
       [ 4 ..  7]   type    (0 == READ, 1 == WRITE)
       [ 8 .. 15]   handle
       [16 .. 23]   from
       [24 .. 27]   len
     */

    magic = be32_to_cpup((uint32_t*)buf);
    request->type  = be32_to_cpup((uint32_t*)(buf + 4));
    request->handle = be64_to_cpup((uint64_t*)(buf + 8));
    request->from  = be64_to_cpup((uint64_t*)(buf + 16));
    request->len   = be32_to_cpup((uint32_t*)(buf + 24));

    TRACE("Got request: "
          "{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
          magic, request->type, request->from, request->len);

    if (magic != NBD_REQUEST_MAGIC) {
        LOG("invalid magic (got 0x%x)", magic);
789
        return -EINVAL;
790 791
    }
    return 0;
792 793
}

794
ssize_t nbd_receive_reply(int csock, struct nbd_reply *reply)
795
{
796 797
    uint8_t buf[NBD_REPLY_SIZE];
    uint32_t magic;
798
    ssize_t ret;
799

800 801 802 803 804 805
    ret = read_sync(csock, buf, sizeof(buf));
    if (ret < 0) {
        return ret;
    }

    if (ret != sizeof(buf)) {
806
        LOG("read failed");
807
        return -EINVAL;
808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825
    }

    /* Reply
       [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
       [ 4 ..  7]    error   (0 == no error)
       [ 7 .. 15]    handle
     */

    magic = be32_to_cpup((uint32_t*)buf);
    reply->error  = be32_to_cpup((uint32_t*)(buf + 4));
    reply->handle = be64_to_cpup((uint64_t*)(buf + 8));

    TRACE("Got reply: "
          "{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
          magic, reply->error, reply->handle);

    if (magic != NBD_REPLY_MAGIC) {
        LOG("invalid magic (got 0x%x)", magic);
826
        return -EINVAL;
827 828
    }
    return 0;
829 830
}

831
static ssize_t nbd_send_reply(int csock, struct nbd_reply *reply)
832
{
Paolo Bonzini's avatar
Paolo Bonzini committed
833
    uint8_t buf[NBD_REPLY_SIZE];
834
    ssize_t ret;
835 836 837 838 839 840 841 842 843 844 845 846

    /* Reply
       [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
       [ 4 ..  7]    error   (0 == no error)
       [ 7 .. 15]    handle
     */
    cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
    cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
    cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);

    TRACE("Sending response to client");

847 848 849 850 851 852
    ret = write_sync(csock, buf, sizeof(buf));
    if (ret < 0) {
        return ret;
    }

    if (ret != sizeof(buf)) {
853
        LOG("writing to socket failed");
854
        return -EINVAL;
855 856
    }
    return 0;
857
}
858

859 860
#define MAX_NBD_REQUESTS 16

861
void nbd_client_get(NBDClient *client)
862 863 864 865
{
    client->refcount++;
}

866
void nbd_client_put(NBDClient *client)
867 868
{
    if (--client->refcount == 0) {
869 870 871 872 873
        /* The last reference should be dropped by client->close,
         * which is called by nbd_client_close.
         */
        assert(client->closing);

Max Reitz's avatar
Max Reitz committed
874
        nbd_unset_handlers(client);
875 876
        close(client->sock);
        client->sock = -1;
877 878 879 880
        if (client->exp) {
            QTAILQ_REMOVE(&client->exp->clients, client, next);
            nbd_export_put(client->exp);
        }
881 882 883 884
        g_free(client);
    }
}

885
void nbd_client_close(NBDClient *client)
886
{
887 888 889 890 891 892 893 894 895 896 897 898
    if (client->closing) {
        return;
    }

    client->closing = true;

    /* Force requests to finish.  They will drop their own references,
     * then we'll close the socket and free the NBDClient.
     */
    shutdown(client->sock, 2);

    /* Also tell the client, so that they release their reference.  */
899 900 901 902 903
    if (client->close) {
        client->close(client);
    }
}

904
static NBDRequest *nbd_request_get(NBDClient *client)
905 906
{
    NBDRequest *req;
907

908 909
    assert(client->nb_requests <= MAX_NBD_REQUESTS - 1);
    client->nb_requests++;
Max Reitz's avatar
Max Reitz committed
910
    nbd_update_can_read(client);
911

912
    req = g_slice_new0(NBDRequest);
913 914
    nbd_client_get(client);
    req->client = client;
915 916 917
    return req;
}

918
static void nbd_request_put(NBDRequest *req)
919
{
920
    NBDClient *client = req->client;
921

922 923 924
    if (req->data) {
        qemu_vfree(req->data);
    }
925 926
    g_slice_free(NBDRequest, req);

Max Reitz's avatar
Max Reitz committed
927 928
    client->nb_requests--;
    nbd_update_can_read(client);
929
    nbd_client_put(client);
930 931
}

932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959
static void bs_aio_attached(AioContext *ctx, void *opaque)
{
    NBDExport *exp = opaque;
    NBDClient *client;

    TRACE("Export %s: Attaching clients to AIO context %p\n", exp->name, ctx);

    exp->ctx = ctx;

    QTAILQ_FOREACH(client, &exp->clients, next) {
        nbd_set_handlers(client);
    }
}

static void bs_aio_detach(void *opaque)
{
    NBDExport *exp = opaque;
    NBDClient *client;

    TRACE("Export %s: Detaching clients from AIO context %p\n", exp->name, exp->ctx);

    QTAILQ_FOREACH(client, &exp->clients, next) {
        nbd_unset_handlers(client);
    }

    exp->ctx = NULL;
}

960
NBDExport *nbd_export_new(BlockDriverState *bs, off_t dev_offset,
961 962
                          off_t size, uint32_t nbdflags,
                          void (*close)(NBDExport *))
963 964
{
    NBDExport *exp = g_malloc0(sizeof(NBDExport));
965
    exp->refcount = 1;
966
    QTAILQ_INIT(&exp->clients);
967 968 969
    exp->bs = bs;
    exp->dev_offset = dev_offset;
    exp->nbdflags = nbdflags;
970
    exp->size = size == -1 ? bdrv_getlength(bs) : size;
971
    exp->close = close;
Max Reitz's avatar
Max Reitz committed
972
    exp->ctx = bdrv_get_aio_context(bs);
973
    bdrv_ref(bs);
974
    bdrv_add_aio_context_notifier(bs, bs_aio_attached, bs_aio_detach, exp);
975 976 977 978 979 980
    /*
     * NBD exports are used for non-shared storage migration.  Make sure
     * that BDRV_O_INCOMING is cleared and the image is ready for write
     * access since the export could be available before migration handover.
     */
    bdrv_invalidate_cache(bs, NULL);
981 982 983
    return exp;
}

984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016
NBDExport *nbd_export_find(const char *name)
{
    NBDExport *exp;
    QTAILQ_FOREACH(exp, &exports, next) {
        if (strcmp(name, exp->name) == 0) {
            return exp;
        }
    }

    return NULL;
}

void nbd_export_set_name(NBDExport *exp, const char *name)
{
    if (exp->name == name) {
        return;
    }

    nbd_export_get(exp);
    if (exp->name != NULL) {
        g_free(exp->name);
        exp->name = NULL;
        QTAILQ_REMOVE(&exports, exp, next);
        nbd_export_put(exp);
    }
    if (name != NULL) {
        nbd_export_get(exp);
        exp->name = g_strdup(name);
        QTAILQ_INSERT_TAIL(&exports, exp, next);
    }
    nbd_export_put(exp);
}

1017 1018
void nbd_export_close(NBDExport *exp)
{
1019
    NBDClient *client, *next;
1020

1021 1022 1023 1024
    nbd_export_get(exp);
    QTAILQ_FOREACH_SAFE(client, &exp->clients, next, next) {
        nbd_client_close(client);
    }
1025
    nbd_export_set_name(exp, NULL);
1026
    nbd_export_put(exp);
1027
    if (exp->bs) {
1028 1029
        bdrv_remove_aio_context_notifier(exp->bs, bs_aio_attached,
                                         bs_aio_detach, exp);
1030 1031 1032
        bdrv_unref(exp->bs);
        exp->bs = NULL;
    }
1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045
}

void nbd_export_get(NBDExport *exp)
{
    assert(exp->refcount > 0);
    exp->refcount++;
}

void nbd_export_put(NBDExport *exp)
{
    assert(exp->refcount > 0);
    if (exp->refcount == 1) {
        nbd_export_close(exp);
1046 1047
    }

1048
    if (--exp->refcount == 0) {
1049 1050
        assert(exp->name == NULL);

1051 1052 1053 1054
        if (exp->close) {
            exp->close(exp);
        }

1055 1056
        g_free(exp);
    }
1057 1058
}

1059 1060 1061 1062 1063
BlockDriverState *nbd_export_get_blockdev(NBDExport *exp)
{
    return exp->bs;
}

1064 1065 1066 1067 1068 1069 1070 1071 1072
void nbd_export_close_all(void)
{
    NBDExport *exp, *next;

    QTAILQ_FOREACH_SAFE(exp, &exports, next, next) {
        nbd_export_close(exp);
    }
}

1073 1074
static ssize_t nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,
                                 int len)
1075
{
1076 1077
    NBDClient *client = req->client;
    int csock = client->sock;
1078
    ssize_t rc, ret;
1079

1080 1081
    qemu_co_mutex_lock(&client->send_lock);
    client->send_coroutine = qemu_coroutine_self();
Max Reitz's avatar
Max Reitz committed
1082
    nbd_set_handlers(client);
1083

1084 1085 1086 1087 1088
    if (!len) {
        rc = nbd_send_reply(csock, reply);
    } else {
        socket_set_cork(csock, 1);
        rc = nbd_send_reply(csock, reply);
1089
        if (rc >= 0) {
1090
            ret = qemu_co_send(csock, req->data, len);
1091
            if (ret != len) {
1092
                rc = -EIO;
1093 1094 1095 1096
            }
        }
        socket_set_cork(csock, 0);
    }
1097 1098

    client->send_coroutine = NULL;
Max Reitz's avatar
Max Reitz committed
1099
    nbd_set_handlers(client);
1100
    qemu_co_mutex_unlock(&client->send_lock);
1101 1102 1103
    return rc;
}

1104
static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *request)
1105
{
1106 1107
    NBDClient *client = req->client;
    int csock = client->sock;
1108
    uint32_t command;
1109
    ssize_t rc;
1110

1111
    client->recv_coroutine = qemu_coroutine_self();
Max Reitz's avatar
Max Reitz committed
1112 1113
    nbd_update_can_read(client);

1114 1115 1116 1117 1118
    rc = nbd_receive_request(csock, request);
    if (rc < 0) {
        if (rc != -EAGAIN) {
            rc = -EIO;
        }
1119 1120 1121
        goto out;
    }

1122
    if (request->len > NBD_MAX_BUFFER_SIZE) {
1123
        LOG("len (%u) is larger than max len (%u)",
1124
            request->len, NBD_MAX_BUFFER_SIZE);
1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137
        rc = -EINVAL;
        goto out;
    }

    if ((request->from + request->len) < request->from) {
        LOG("integer overflow detected! "
            "you're probably being attacked");
        rc = -EINVAL;
        goto out;
    }

    TRACE("Decoding type");

1138 1139 1140 1141 1142
    command = request->type & NBD_CMD_MASK_COMMAND;
    if (command == NBD_CMD_READ || command == NBD_CMD_WRITE) {
        req->data = qemu_blockalign(client->exp->bs, request->len);
    }
    if (command == NBD_CMD_WRITE) {
1143 1144
        TRACE("Reading %u byte(s)", request->len);

1145
        if (qemu_co_recv(csock, req->data, request->len) != request->len) {
1146 1147 1148 1149 1150 1151 1152 1153
            LOG("reading from socket failed");
            rc = -EIO;
            goto out;
        }
    }
    rc = 0;

out:
1154
    client->recv_coroutine = NULL;
Max Reitz's avatar
Max Reitz committed
1155 1156
    nbd_update_can_read(client);

1157 1158 1159
    return rc;
}

1160
static void nbd_trip(void *opaque)
1161
{
1162
    NBDClient *client = opaque;
1163
    NBDExport *exp = client->exp;
1164
    NBDRequest *req;
1165 1166
    struct nbd_request request;
    struct nbd_reply reply;
1167
    ssize_t ret;
1168
    uint32_t command;
1169 1170

    TRACE("Reading request.");
1171 1172 1173
    if (client->closing) {
        return;
    }
1174

1175
    req = nbd_request_get(client);
1176
    ret = nbd_co_receive_request(req, &request);
1177 1178 1179
    if (ret == -EAGAIN) {
        goto done;
    }
1180
    if (ret == -EIO) {
1181
        goto out;
1182
    }
1183

1184 1185 1186
    reply.handle = request.handle;
    reply.error = 0;

1187 1188 1189
    if (ret < 0) {
        reply.error = -ret;
        goto error_reply;
1190
    }
1191 1192
    command = request.type & NBD_CMD_MASK_COMMAND;
    if (command != NBD_CMD_DISC && (request.from + request.len) > exp->size) {
1193 1194
            LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
            ", Offset: %" PRIu64 "\n",
1195
                    request.from, request.len,
1196
                    (uint64_t)exp->size, (uint64_t)exp->dev_offset);
1197
        LOG("requested operation past EOF--bad client?");
1198
        goto invalid_request;
1199 1200
    }

1201
    switch (command) {
1202 1203 1204
    case NBD_CMD_READ:
        TRACE("Request type is READ");

Paolo Bonzini's avatar
Paolo Bonzini committed
1205 1206 1207 1208 1209 1210 1211 1212 1213
        if (request.type & NBD_CMD_FLAG_FUA) {
            ret = bdrv_co_flush(exp->bs);
            if (ret < 0) {
                LOG("flush failed");
                reply.error = -ret;
                goto error_reply;
            }
        }

1214
        ret = bdrv_read(exp->bs, (request.from + exp->dev_offset) / 512,
1215
                        req->data, request.len / 512);
1216
        if (ret < 0) {
1217
            LOG("reading from file failed");
1218
            reply.error = -ret;
1219
            goto error_reply;
1220 1221 1222
        }

        TRACE("Read %u byte(s)", request.len);
1223
        if (nbd_co_send_reply(req, &reply, request.len) < 0)
1224
            goto out;
1225 1226 1227 1228
        break;
    case NBD_CMD_WRITE:
        TRACE("Request type is WRITE");

1229
        if (exp->nbdflags & NBD_FLAG_READ_ONLY) {
1230
            TRACE("Server is read-only, return error");
1231 1232 1233 1234 1235 1236
            reply.error = EROFS;
            goto error_reply;
        }

        TRACE("Writing to device");

1237
        ret = bdrv_write(exp->bs, (request.from + exp->dev_offset) / 512,
1238
                         req->data, request.len / 512);
1239 1240 1241 1242 1243
        if (ret < 0) {
            LOG("writing to file failed");
            reply.error = -ret;
            goto error_reply;
        }
1244

1245
        if (request.type & NBD_CMD_FLAG_FUA) {
1246
            ret = bdrv_co_flush(exp->bs);
1247
            if (ret < 0) {
1248
                LOG("flush failed");
1249
                reply.error = -ret;
1250
                goto error_reply;
1251
            }
1252 1253
        }

1254
        if (nbd_co_send_reply(req, &reply, 0) < 0) {
1255
            goto out;
1256
        }
1257 1258 1259 1260
        break;
    case NBD_CMD_DISC:
        TRACE("Request type is DISCONNECT");
        errno = 0;
1261
        goto out;
1262 1263 1264
    case NBD_CMD_FLUSH:
        TRACE("Request type is FLUSH");

1265
        ret = bdrv_co_flush(exp->bs);
1266 1267 1268 1269
        if (ret < 0) {
            LOG("flush failed");
            reply.error = -ret;
        }
1270
        if (nbd_co_send_reply(req, &reply, 0) < 0) {
1271
            goto out;
1272
        }
1273 1274 1275
        break;
    case NBD_CMD_TRIM:
        TRACE("Request type is TRIM");
1276 1277
        ret = bdrv_co_discard(exp->bs, (request.from + exp->dev_offset) / 512,
                              request.len / 512);
1278 1279 1280 1281
        if (ret < 0) {
            LOG("discard failed");
            reply.error = -ret;
        }
1282
        if (nbd_co_send_reply(req, &reply, 0) < 0) {
1283
            goto out;
1284
        }
1285
        break;
1286 1287
    default:
        LOG("invalid request type (%u) received", request.type);
1288 1289 1290
    invalid_request:
        reply.error = -EINVAL;
    error_reply:
1291
        if (nbd_co_send_reply(req, &reply, 0) < 0) {
1292
            goto out;
1293
        }
1294
        break;
1295 1296 1297 1298
    }

    TRACE("Request/Reply complete");

1299
done:
1300 1301 1302
    nbd_request_put(req);
    return;

1303
out:
1304
    nbd_request_put(req);
1305
    nbd_client_close(client);
1306
}
1307

1308 1309 1310 1311
static void nbd_read(void *opaque)
{
    NBDClient *client = opaque;

1312 1313 1314 1315
    if (client->recv_coroutine) {
        qemu_coroutine_enter(client->recv_coroutine, NULL);
    } else {
        qemu_coroutine_enter(qemu_coroutine_create(nbd_trip), client);
1316 1317 1318
    }
}

1319 1320 1321 1322 1323 1324 1325
static void nbd_restart_write(void *opaque)
{
    NBDClient *client = opaque;

    qemu_coroutine_enter(client->send_coroutine, NULL);
}

Max Reitz's avatar
Max Reitz committed
1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356
static void nbd_set_handlers(NBDClient *client)
{
    if (client->exp && client->exp->ctx) {
        aio_set_fd_handler(client->exp->ctx, client->sock,
                           client->can_read ? nbd_read : NULL,
                           client->send_coroutine ? nbd_restart_write : NULL,
                           client);
    }
}

static void nbd_unset_handlers(NBDClient *client)
{
    if (client->exp && client->exp->ctx) {
        aio_set_fd_handler(client->exp->ctx, client->sock, NULL, NULL, NULL);
    }
}

static void nbd_update_can_read(NBDClient *client)
{
    bool can_read = client->recv_coroutine ||
                    client->nb_requests < MAX_NBD_REQUESTS;

    if (can_read != client->can_read) {
        client->can_read = can_read;
        nbd_set_handlers(client);

        /* There is no need to invoke aio_notify(), since aio_set_fd_handler()
         * in nbd_set_handlers() will have taken care of that */
    }
}

1357 1358
NBDClient *nbd_client_new(NBDExport *exp, int csock,
                          void (*close)(NBDClient *))
1359
{
1360 1361 1362 1363 1364
    NBDClient *client;
    client = g_malloc0(sizeof(NBDClient));
    client->refcount = 1;
    client->exp = exp;
    client->sock = csock;
Max Reitz's avatar
Max Reitz committed
1365
    client->can_read = true;
1366
    if (nbd_send_negotiate(client)) {
1367 1368 1369
        g_free(client);
        return NULL;
    }
1370
    client->close = close;
1371
    qemu_co_mutex_init(&client->send_lock);
Max Reitz's avatar
Max Reitz committed
1372
    nbd_set_handlers(client);
1373

1374 1375 1376 1377
    if (exp) {
        QTAILQ_INSERT_TAIL(&exp->clients, client, next);
        nbd_export_get(exp);
    }
1378
    return client;
1379
}