2 * Copyright (C) 2016-2017 Red Hat, Inc.
3 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
5 * Network Block Device Server Side
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; under version 2 of the License.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qapi/error.h"
23 #include "nbd-internal.h"
25 static int system_errno_to_nbd_errno(int err
)
51 /* Definitions for opaque data types */
53 typedef struct NBDRequestData NBDRequestData
;
55 struct NBDRequestData
{
56 QSIMPLEQ_ENTRY(NBDRequestData
) entry
;
64 void (*close
)(NBDExport
*exp
);
72 QTAILQ_HEAD(, NBDClient
) clients
;
73 QTAILQ_ENTRY(NBDExport
) next
;
77 BlockBackend
*eject_notifier_blk
;
78 Notifier eject_notifier
;
81 static QTAILQ_HEAD(, NBDExport
) exports
= QTAILQ_HEAD_INITIALIZER(exports
);
85 void (*close_fn
)(NBDClient
*client
, bool negotiated
);
89 QCryptoTLSCreds
*tlscreds
;
91 QIOChannelSocket
*sioc
; /* The underlying data channel */
92 QIOChannel
*ioc
; /* The current I/O channel which may differ (eg TLS) */
94 Coroutine
*recv_coroutine
;
97 Coroutine
*send_coroutine
;
99 QTAILQ_ENTRY(NBDClient
) next
;
104 /* That's all folks */
106 static void nbd_client_receive_next_request(NBDClient
*client
);
108 /* Basic flow for negotiation
135 /* Send a reply header, including length, but no payload.
136 * Return -errno on error, 0 on success. */
137 static int nbd_negotiate_send_rep_len(QIOChannel
*ioc
, uint32_t type
,
138 uint32_t opt
, uint32_t len
, Error
**errp
)
142 trace_nbd_negotiate_send_rep_len(opt
, nbd_opt_lookup(opt
),
143 type
, nbd_rep_lookup(type
), len
);
145 magic
= cpu_to_be64(NBD_REP_MAGIC
);
146 if (nbd_write(ioc
, &magic
, sizeof(magic
), errp
) < 0) {
147 error_prepend(errp
, "write failed (rep magic): ");
151 opt
= cpu_to_be32(opt
);
152 if (nbd_write(ioc
, &opt
, sizeof(opt
), errp
) < 0) {
153 error_prepend(errp
, "write failed (rep opt): ");
157 type
= cpu_to_be32(type
);
158 if (nbd_write(ioc
, &type
, sizeof(type
), errp
) < 0) {
159 error_prepend(errp
, "write failed (rep type): ");
163 len
= cpu_to_be32(len
);
164 if (nbd_write(ioc
, &len
, sizeof(len
), errp
) < 0) {
165 error_prepend(errp
, "write failed (rep data length): ");
171 /* Send a reply header with default 0 length.
172 * Return -errno on error, 0 on success. */
173 static int nbd_negotiate_send_rep(QIOChannel
*ioc
, uint32_t type
, uint32_t opt
,
176 return nbd_negotiate_send_rep_len(ioc
, type
, opt
, 0, errp
);
179 /* Send an error reply.
180 * Return -errno on error, 0 on success. */
181 static int GCC_FMT_ATTR(5, 6)
182 nbd_negotiate_send_rep_err(QIOChannel
*ioc
, uint32_t type
,
183 uint32_t opt
, Error
**errp
, const char *fmt
, ...)
191 msg
= g_strdup_vprintf(fmt
, va
);
195 trace_nbd_negotiate_send_rep_err(msg
);
196 ret
= nbd_negotiate_send_rep_len(ioc
, type
, opt
, len
, errp
);
200 if (nbd_write(ioc
, msg
, len
, errp
) < 0) {
201 error_prepend(errp
, "write failed (error message): ");
212 /* Send a single NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
213 * Return -errno on error, 0 on success. */
214 static int nbd_negotiate_send_rep_list(QIOChannel
*ioc
, NBDExport
*exp
,
217 size_t name_len
, desc_len
;
219 const char *name
= exp
->name
? exp
->name
: "";
220 const char *desc
= exp
->description
? exp
->description
: "";
223 trace_nbd_negotiate_send_rep_list(name
, desc
);
224 name_len
= strlen(name
);
225 desc_len
= strlen(desc
);
226 len
= name_len
+ desc_len
+ sizeof(len
);
227 ret
= nbd_negotiate_send_rep_len(ioc
, NBD_REP_SERVER
, NBD_OPT_LIST
, len
,
233 len
= cpu_to_be32(name_len
);
234 if (nbd_write(ioc
, &len
, sizeof(len
), errp
) < 0) {
235 error_prepend(errp
, "write failed (name length): ");
239 if (nbd_write(ioc
, name
, name_len
, errp
) < 0) {
240 error_prepend(errp
, "write failed (name buffer): ");
244 if (nbd_write(ioc
, desc
, desc_len
, errp
) < 0) {
245 error_prepend(errp
, "write failed (description buffer): ");
252 /* Process the NBD_OPT_LIST command, with a potential series of replies.
253 * Return -errno on error, 0 on success. */
254 static int nbd_negotiate_handle_list(NBDClient
*client
, uint32_t length
,
260 if (nbd_drop(client
->ioc
, length
, errp
) < 0) {
263 return nbd_negotiate_send_rep_err(client
->ioc
,
264 NBD_REP_ERR_INVALID
, NBD_OPT_LIST
,
266 "OPT_LIST should not have length");
269 /* For each export, send a NBD_REP_SERVER reply. */
270 QTAILQ_FOREACH(exp
, &exports
, next
) {
271 if (nbd_negotiate_send_rep_list(client
->ioc
, exp
, errp
)) {
275 /* Finish with a NBD_REP_ACK. */
276 return nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
, NBD_OPT_LIST
, errp
);
279 static int nbd_negotiate_handle_export_name(NBDClient
*client
, uint32_t length
,
282 char name
[NBD_MAX_NAME_SIZE
+ 1];
285 [20 .. xx] export name (length bytes)
287 trace_nbd_negotiate_handle_export_name();
288 if (length
>= sizeof(name
)) {
289 error_setg(errp
, "Bad length received");
292 if (nbd_read(client
->ioc
, name
, length
, errp
) < 0) {
293 error_prepend(errp
, "read failed: ");
298 trace_nbd_negotiate_handle_export_name_request(name
);
300 client
->exp
= nbd_export_find(name
);
302 error_setg(errp
, "export not found");
306 QTAILQ_INSERT_TAIL(&client
->exp
->clients
, client
, next
);
307 nbd_export_get(client
->exp
);
312 /* Handle NBD_OPT_STARTTLS. Return NULL to drop connection, or else the
313 * new channel for all further (now-encrypted) communication. */
314 static QIOChannel
*nbd_negotiate_handle_starttls(NBDClient
*client
,
320 struct NBDTLSHandshakeData data
= { 0 };
322 trace_nbd_negotiate_handle_starttls();
325 if (nbd_drop(ioc
, length
, errp
) < 0) {
328 nbd_negotiate_send_rep_err(ioc
, NBD_REP_ERR_INVALID
, NBD_OPT_STARTTLS
,
330 "OPT_STARTTLS should not have length");
334 if (nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
,
335 NBD_OPT_STARTTLS
, errp
) < 0) {
339 tioc
= qio_channel_tls_new_server(ioc
,
347 qio_channel_set_name(QIO_CHANNEL(tioc
), "nbd-server-tls");
348 trace_nbd_negotiate_handle_starttls_handshake();
349 data
.loop
= g_main_loop_new(g_main_context_default(), FALSE
);
350 qio_channel_tls_handshake(tioc
,
355 if (!data
.complete
) {
356 g_main_loop_run(data
.loop
);
358 g_main_loop_unref(data
.loop
);
360 object_unref(OBJECT(tioc
));
361 error_propagate(errp
, data
.error
);
365 return QIO_CHANNEL(tioc
);
368 /* nbd_negotiate_options
369 * Process all NBD_OPT_* client option commands.
371 * -errno on error, errp is set
372 * 0 on successful negotiation, errp is not set
373 * 1 if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
376 static int nbd_negotiate_options(NBDClient
*client
, Error
**errp
)
379 bool fixedNewstyle
= false;
382 [ 0 .. 3] client flags
384 [ 0 .. 7] NBD_OPTS_MAGIC
385 [ 8 .. 11] NBD option
386 [12 .. 15] Data length
389 [ 0 .. 7] NBD_OPTS_MAGIC
390 [ 8 .. 11] Second NBD option
391 [12 .. 15] Data length
395 if (nbd_read(client
->ioc
, &flags
, sizeof(flags
), errp
) < 0) {
396 error_prepend(errp
, "read failed: ");
399 trace_nbd_negotiate_options_flags();
400 be32_to_cpus(&flags
);
401 if (flags
& NBD_FLAG_C_FIXED_NEWSTYLE
) {
402 trace_nbd_negotiate_options_newstyle();
403 fixedNewstyle
= true;
404 flags
&= ~NBD_FLAG_C_FIXED_NEWSTYLE
;
406 if (flags
& NBD_FLAG_C_NO_ZEROES
) {
407 trace_nbd_negotiate_options_no_zeroes();
408 client
->no_zeroes
= true;
409 flags
&= ~NBD_FLAG_C_NO_ZEROES
;
412 error_setg(errp
, "Unknown client flags 0x%" PRIx32
" received", flags
);
418 uint32_t option
, length
;
421 if (nbd_read(client
->ioc
, &magic
, sizeof(magic
), errp
) < 0) {
422 error_prepend(errp
, "read failed: ");
425 magic
= be64_to_cpu(magic
);
426 trace_nbd_negotiate_options_check_magic(magic
);
427 if (magic
!= NBD_OPTS_MAGIC
) {
428 error_setg(errp
, "Bad magic received");
432 if (nbd_read(client
->ioc
, &option
,
433 sizeof(option
), errp
) < 0) {
434 error_prepend(errp
, "read failed: ");
437 option
= be32_to_cpu(option
);
439 if (nbd_read(client
->ioc
, &length
, sizeof(length
), errp
) < 0) {
440 error_prepend(errp
, "read failed: ");
443 length
= be32_to_cpu(length
);
445 trace_nbd_negotiate_options_check_option(option
,
446 nbd_opt_lookup(option
));
447 if (client
->tlscreds
&&
448 client
->ioc
== (QIOChannel
*)client
->sioc
) {
450 if (!fixedNewstyle
) {
451 error_setg(errp
, "Unsupported option 0x%" PRIx32
, option
);
455 case NBD_OPT_STARTTLS
:
456 tioc
= nbd_negotiate_handle_starttls(client
, length
, errp
);
460 object_unref(OBJECT(client
->ioc
));
461 client
->ioc
= QIO_CHANNEL(tioc
);
464 case NBD_OPT_EXPORT_NAME
:
465 /* No way to return an error to client, so drop connection */
466 error_setg(errp
, "Option 0x%x not permitted before TLS",
471 if (nbd_drop(client
->ioc
, length
, errp
) < 0) {
474 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
475 NBD_REP_ERR_TLS_REQD
,
478 "not permitted before TLS",
483 /* Let the client keep trying, unless they asked to
484 * quit. In this mode, we've already sent an error, so
485 * we can't ack the abort. */
486 if (option
== NBD_OPT_ABORT
) {
491 } else if (fixedNewstyle
) {
494 ret
= nbd_negotiate_handle_list(client
, length
, errp
);
501 /* NBD spec says we must try to reply before
502 * disconnecting, but that we must also tolerate
503 * guests that don't wait for our reply. */
504 nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
, option
, NULL
);
507 case NBD_OPT_EXPORT_NAME
:
508 return nbd_negotiate_handle_export_name(client
, length
, errp
);
510 case NBD_OPT_STARTTLS
:
511 if (nbd_drop(client
->ioc
, length
, errp
) < 0) {
514 if (client
->tlscreds
) {
515 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
518 "TLS already enabled");
520 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
523 "TLS not configured");
530 if (nbd_drop(client
->ioc
, length
, errp
) < 0) {
533 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
536 "Unsupported option 0x%"
537 PRIx32
" (%s)", option
,
538 nbd_opt_lookup(option
));
546 * If broken new-style we should drop the connection
547 * for anything except NBD_OPT_EXPORT_NAME
550 case NBD_OPT_EXPORT_NAME
:
551 return nbd_negotiate_handle_export_name(client
, length
, errp
);
554 error_setg(errp
, "Unsupported option 0x%" PRIx32
" (%s)",
555 option
, nbd_opt_lookup(option
));
564 * -errno on error, errp is set
565 * 0 on successful negotiation, errp is not set
566 * 1 if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
569 static coroutine_fn
int nbd_negotiate(NBDClient
*client
, Error
**errp
)
571 char buf
[8 + 8 + 8 + 128];
573 const uint16_t myflags
= (NBD_FLAG_HAS_FLAGS
| NBD_FLAG_SEND_TRIM
|
574 NBD_FLAG_SEND_FLUSH
| NBD_FLAG_SEND_FUA
|
575 NBD_FLAG_SEND_WRITE_ZEROES
);
579 /* Old style negotiation header without options
580 [ 0 .. 7] passwd ("NBDMAGIC")
581 [ 8 .. 15] magic (NBD_CLIENT_MAGIC)
583 [24 .. 25] server flags (0)
584 [26 .. 27] export flags
585 [28 .. 151] reserved (0)
587 New style negotiation header with options
588 [ 0 .. 7] passwd ("NBDMAGIC")
589 [ 8 .. 15] magic (NBD_OPTS_MAGIC)
590 [16 .. 17] server flags (0)
593 [26 .. 27] export flags
594 [28 .. 151] reserved (0, omit if no_zeroes)
597 qio_channel_set_blocking(client
->ioc
, false, NULL
);
599 trace_nbd_negotiate_begin();
600 memset(buf
, 0, sizeof(buf
));
601 memcpy(buf
, "NBDMAGIC", 8);
603 oldStyle
= client
->exp
!= NULL
&& !client
->tlscreds
;
605 trace_nbd_negotiate_old_style(client
->exp
->size
,
606 client
->exp
->nbdflags
| myflags
);
607 stq_be_p(buf
+ 8, NBD_CLIENT_MAGIC
);
608 stq_be_p(buf
+ 16, client
->exp
->size
);
609 stw_be_p(buf
+ 26, client
->exp
->nbdflags
| myflags
);
611 if (nbd_write(client
->ioc
, buf
, sizeof(buf
), errp
) < 0) {
612 error_prepend(errp
, "write failed: ");
616 stq_be_p(buf
+ 8, NBD_OPTS_MAGIC
);
617 stw_be_p(buf
+ 16, NBD_FLAG_FIXED_NEWSTYLE
| NBD_FLAG_NO_ZEROES
);
619 if (nbd_write(client
->ioc
, buf
, 18, errp
) < 0) {
620 error_prepend(errp
, "write failed: ");
623 ret
= nbd_negotiate_options(client
, errp
);
626 error_prepend(errp
, "option negotiation failed: ");
631 trace_nbd_negotiate_new_style_size_flags(
632 client
->exp
->size
, client
->exp
->nbdflags
| myflags
);
633 stq_be_p(buf
+ 18, client
->exp
->size
);
634 stw_be_p(buf
+ 26, client
->exp
->nbdflags
| myflags
);
635 len
= client
->no_zeroes
? 10 : sizeof(buf
) - 18;
636 ret
= nbd_write(client
->ioc
, buf
+ 18, len
, errp
);
638 error_prepend(errp
, "write failed: ");
643 trace_nbd_negotiate_success();
648 static int nbd_receive_request(QIOChannel
*ioc
, NBDRequest
*request
,
651 uint8_t buf
[NBD_REQUEST_SIZE
];
655 ret
= nbd_read(ioc
, buf
, sizeof(buf
), errp
);
661 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
662 [ 4 .. 5] flags (NBD_CMD_FLAG_FUA, ...)
663 [ 6 .. 7] type (NBD_CMD_READ, ...)
669 magic
= ldl_be_p(buf
);
670 request
->flags
= lduw_be_p(buf
+ 4);
671 request
->type
= lduw_be_p(buf
+ 6);
672 request
->handle
= ldq_be_p(buf
+ 8);
673 request
->from
= ldq_be_p(buf
+ 16);
674 request
->len
= ldl_be_p(buf
+ 24);
676 trace_nbd_receive_request(magic
, request
->flags
, request
->type
,
677 request
->from
, request
->len
);
679 if (magic
!= NBD_REQUEST_MAGIC
) {
680 error_setg(errp
, "invalid magic (got 0x%" PRIx32
")", magic
);
686 static int nbd_send_reply(QIOChannel
*ioc
, NBDReply
*reply
, Error
**errp
)
688 uint8_t buf
[NBD_REPLY_SIZE
];
690 reply
->error
= system_errno_to_nbd_errno(reply
->error
);
692 trace_nbd_send_reply(reply
->error
, reply
->handle
);
695 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
696 [ 4 .. 7] error (0 == no error)
699 stl_be_p(buf
, NBD_REPLY_MAGIC
);
700 stl_be_p(buf
+ 4, reply
->error
);
701 stq_be_p(buf
+ 8, reply
->handle
);
703 return nbd_write(ioc
, buf
, sizeof(buf
), errp
);
706 #define MAX_NBD_REQUESTS 16
708 void nbd_client_get(NBDClient
*client
)
713 void nbd_client_put(NBDClient
*client
)
715 if (--client
->refcount
== 0) {
716 /* The last reference should be dropped by client->close,
717 * which is called by client_close.
719 assert(client
->closing
);
721 qio_channel_detach_aio_context(client
->ioc
);
722 object_unref(OBJECT(client
->sioc
));
723 object_unref(OBJECT(client
->ioc
));
724 if (client
->tlscreds
) {
725 object_unref(OBJECT(client
->tlscreds
));
727 g_free(client
->tlsaclname
);
729 QTAILQ_REMOVE(&client
->exp
->clients
, client
, next
);
730 nbd_export_put(client
->exp
);
736 static void client_close(NBDClient
*client
, bool negotiated
)
738 if (client
->closing
) {
742 client
->closing
= true;
744 /* Force requests to finish. They will drop their own references,
745 * then we'll close the socket and free the NBDClient.
747 qio_channel_shutdown(client
->ioc
, QIO_CHANNEL_SHUTDOWN_BOTH
,
750 /* Also tell the client, so that they release their reference. */
751 if (client
->close_fn
) {
752 client
->close_fn(client
, negotiated
);
756 static NBDRequestData
*nbd_request_get(NBDClient
*client
)
760 assert(client
->nb_requests
<= MAX_NBD_REQUESTS
- 1);
761 client
->nb_requests
++;
763 req
= g_new0(NBDRequestData
, 1);
764 nbd_client_get(client
);
765 req
->client
= client
;
769 static void nbd_request_put(NBDRequestData
*req
)
771 NBDClient
*client
= req
->client
;
774 qemu_vfree(req
->data
);
778 client
->nb_requests
--;
779 nbd_client_receive_next_request(client
);
781 nbd_client_put(client
);
784 static void blk_aio_attached(AioContext
*ctx
, void *opaque
)
786 NBDExport
*exp
= opaque
;
789 trace_nbd_blk_aio_attached(exp
->name
, ctx
);
793 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
794 qio_channel_attach_aio_context(client
->ioc
, ctx
);
795 if (client
->recv_coroutine
) {
796 aio_co_schedule(ctx
, client
->recv_coroutine
);
798 if (client
->send_coroutine
) {
799 aio_co_schedule(ctx
, client
->send_coroutine
);
804 static void blk_aio_detach(void *opaque
)
806 NBDExport
*exp
= opaque
;
809 trace_nbd_blk_aio_detach(exp
->name
, exp
->ctx
);
811 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
812 qio_channel_detach_aio_context(client
->ioc
);
818 static void nbd_eject_notifier(Notifier
*n
, void *data
)
820 NBDExport
*exp
= container_of(n
, NBDExport
, eject_notifier
);
821 nbd_export_close(exp
);
824 NBDExport
*nbd_export_new(BlockDriverState
*bs
, off_t dev_offset
, off_t size
,
825 uint16_t nbdflags
, void (*close
)(NBDExport
*),
826 bool writethrough
, BlockBackend
*on_eject_blk
,
830 NBDExport
*exp
= g_malloc0(sizeof(NBDExport
));
834 /* Don't allow resize while the NBD server is running, otherwise we don't
835 * care what happens with the node. */
836 perm
= BLK_PERM_CONSISTENT_READ
;
837 if ((nbdflags
& NBD_FLAG_READ_ONLY
) == 0) {
838 perm
|= BLK_PERM_WRITE
;
840 blk
= blk_new(perm
, BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE_UNCHANGED
|
841 BLK_PERM_WRITE
| BLK_PERM_GRAPH_MOD
);
842 ret
= blk_insert_bs(blk
, bs
, errp
);
846 blk_set_enable_write_cache(blk
, !writethrough
);
849 QTAILQ_INIT(&exp
->clients
);
851 exp
->dev_offset
= dev_offset
;
852 exp
->nbdflags
= nbdflags
;
853 exp
->size
= size
< 0 ? blk_getlength(blk
) : size
;
855 error_setg_errno(errp
, -exp
->size
,
856 "Failed to determine the NBD export's length");
859 exp
->size
-= exp
->size
% BDRV_SECTOR_SIZE
;
862 exp
->ctx
= blk_get_aio_context(blk
);
863 blk_add_aio_context_notifier(blk
, blk_aio_attached
, blk_aio_detach
, exp
);
866 blk_ref(on_eject_blk
);
867 exp
->eject_notifier_blk
= on_eject_blk
;
868 exp
->eject_notifier
.notify
= nbd_eject_notifier
;
869 blk_add_remove_bs_notifier(on_eject_blk
, &exp
->eject_notifier
);
873 * NBD exports are used for non-shared storage migration. Make sure
874 * that BDRV_O_INACTIVE is cleared and the image is ready for write
875 * access since the export could be available before migration handover.
877 aio_context_acquire(exp
->ctx
);
878 blk_invalidate_cache(blk
, NULL
);
879 aio_context_release(exp
->ctx
);
888 NBDExport
*nbd_export_find(const char *name
)
891 QTAILQ_FOREACH(exp
, &exports
, next
) {
892 if (strcmp(name
, exp
->name
) == 0) {
900 void nbd_export_set_name(NBDExport
*exp
, const char *name
)
902 if (exp
->name
== name
) {
907 if (exp
->name
!= NULL
) {
910 QTAILQ_REMOVE(&exports
, exp
, next
);
915 exp
->name
= g_strdup(name
);
916 QTAILQ_INSERT_TAIL(&exports
, exp
, next
);
921 void nbd_export_set_description(NBDExport
*exp
, const char *description
)
923 g_free(exp
->description
);
924 exp
->description
= g_strdup(description
);
927 void nbd_export_close(NBDExport
*exp
)
929 NBDClient
*client
, *next
;
932 QTAILQ_FOREACH_SAFE(client
, &exp
->clients
, next
, next
) {
933 client_close(client
, true);
935 nbd_export_set_name(exp
, NULL
);
936 nbd_export_set_description(exp
, NULL
);
940 void nbd_export_get(NBDExport
*exp
)
942 assert(exp
->refcount
> 0);
946 void nbd_export_put(NBDExport
*exp
)
948 assert(exp
->refcount
> 0);
949 if (exp
->refcount
== 1) {
950 nbd_export_close(exp
);
953 if (--exp
->refcount
== 0) {
954 assert(exp
->name
== NULL
);
955 assert(exp
->description
== NULL
);
962 if (exp
->eject_notifier_blk
) {
963 notifier_remove(&exp
->eject_notifier
);
964 blk_unref(exp
->eject_notifier_blk
);
966 blk_remove_aio_context_notifier(exp
->blk
, blk_aio_attached
,
967 blk_aio_detach
, exp
);
976 BlockBackend
*nbd_export_get_blockdev(NBDExport
*exp
)
981 void nbd_export_close_all(void)
983 NBDExport
*exp
, *next
;
985 QTAILQ_FOREACH_SAFE(exp
, &exports
, next
, next
) {
986 nbd_export_close(exp
);
990 static int nbd_co_send_reply(NBDRequestData
*req
, NBDReply
*reply
, int len
,
993 NBDClient
*client
= req
->client
;
996 g_assert(qemu_in_coroutine());
998 trace_nbd_co_send_reply(reply
->handle
, reply
->error
, len
);
1000 qemu_co_mutex_lock(&client
->send_lock
);
1001 client
->send_coroutine
= qemu_coroutine_self();
1004 ret
= nbd_send_reply(client
->ioc
, reply
, errp
);
1006 qio_channel_set_cork(client
->ioc
, true);
1007 ret
= nbd_send_reply(client
->ioc
, reply
, errp
);
1009 ret
= nbd_write(client
->ioc
, req
->data
, len
, errp
);
1014 qio_channel_set_cork(client
->ioc
, false);
1017 client
->send_coroutine
= NULL
;
1018 qemu_co_mutex_unlock(&client
->send_lock
);
1022 /* nbd_co_receive_request
1023 * Collect a client request. Return 0 if request looks valid, -EIO to drop
1024 * connection right away, and any other negative value to report an error to
1025 * the client (although the caller may still need to disconnect after reporting
1028 static int nbd_co_receive_request(NBDRequestData
*req
, NBDRequest
*request
,
1031 NBDClient
*client
= req
->client
;
1033 g_assert(qemu_in_coroutine());
1034 assert(client
->recv_coroutine
== qemu_coroutine_self());
1035 if (nbd_receive_request(client
->ioc
, request
, errp
) < 0) {
1039 trace_nbd_co_receive_request_decode_type(request
->handle
, request
->type
,
1040 nbd_cmd_lookup(request
->type
));
1042 if (request
->type
!= NBD_CMD_WRITE
) {
1043 /* No payload, we are ready to read the next request. */
1044 req
->complete
= true;
1047 if (request
->type
== NBD_CMD_DISC
) {
1048 /* Special case: we're going to disconnect without a reply,
1049 * whether or not flags, from, or len are bogus */
1053 /* Check for sanity in the parameters, part 1. Defer as many
1054 * checks as possible until after reading any NBD_CMD_WRITE
1055 * payload, so we can try and keep the connection alive. */
1056 if ((request
->from
+ request
->len
) < request
->from
) {
1058 "integer overflow detected, you're probably being attacked");
1062 if (request
->type
== NBD_CMD_READ
|| request
->type
== NBD_CMD_WRITE
) {
1063 if (request
->len
> NBD_MAX_BUFFER_SIZE
) {
1064 error_setg(errp
, "len (%" PRIu32
" ) is larger than max len (%u)",
1065 request
->len
, NBD_MAX_BUFFER_SIZE
);
1069 req
->data
= blk_try_blockalign(client
->exp
->blk
, request
->len
);
1070 if (req
->data
== NULL
) {
1071 error_setg(errp
, "No memory");
1075 if (request
->type
== NBD_CMD_WRITE
) {
1076 if (nbd_read(client
->ioc
, req
->data
, request
->len
, errp
) < 0) {
1077 error_prepend(errp
, "reading from socket failed: ");
1080 req
->complete
= true;
1082 trace_nbd_co_receive_request_payload_received(request
->handle
,
1086 /* Sanity checks, part 2. */
1087 if (request
->from
+ request
->len
> client
->exp
->size
) {
1088 error_setg(errp
, "operation past EOF; From: %" PRIu64
", Len: %" PRIu32
1089 ", Size: %" PRIu64
, request
->from
, request
->len
,
1090 (uint64_t)client
->exp
->size
);
1091 return request
->type
== NBD_CMD_WRITE
? -ENOSPC
: -EINVAL
;
1093 if (request
->flags
& ~(NBD_CMD_FLAG_FUA
| NBD_CMD_FLAG_NO_HOLE
)) {
1094 error_setg(errp
, "unsupported flags (got 0x%x)", request
->flags
);
1097 if (request
->type
!= NBD_CMD_WRITE_ZEROES
&&
1098 (request
->flags
& NBD_CMD_FLAG_NO_HOLE
)) {
1099 error_setg(errp
, "unexpected flags (got 0x%x)", request
->flags
);
1106 /* Owns a reference to the NBDClient passed as opaque. */
1107 static coroutine_fn
void nbd_trip(void *opaque
)
1109 NBDClient
*client
= opaque
;
1110 NBDExport
*exp
= client
->exp
;
1111 NBDRequestData
*req
;
1112 NBDRequest request
= { 0 }; /* GCC thinks it can be used uninitialized */
1116 int reply_data_len
= 0;
1117 Error
*local_err
= NULL
;
1120 if (client
->closing
) {
1121 nbd_client_put(client
);
1125 req
= nbd_request_get(client
);
1126 ret
= nbd_co_receive_request(req
, &request
, &local_err
);
1127 client
->recv_coroutine
= NULL
;
1128 nbd_client_receive_next_request(client
);
1133 reply
.handle
= request
.handle
;
1141 if (client
->closing
) {
1143 * The client may be closed when we are blocked in
1144 * nbd_co_receive_request()
1149 switch (request
.type
) {
1151 /* XXX: NBD Protocol only documents use of FUA with WRITE */
1152 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1153 ret
= blk_co_flush(exp
->blk
);
1155 error_setg_errno(&local_err
, -ret
, "flush failed");
1161 ret
= blk_pread(exp
->blk
, request
.from
+ exp
->dev_offset
,
1162 req
->data
, request
.len
);
1164 error_setg_errno(&local_err
, -ret
, "reading from file failed");
1169 reply_data_len
= request
.len
;
1173 if (exp
->nbdflags
& NBD_FLAG_READ_ONLY
) {
1174 reply
.error
= EROFS
;
1179 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1180 flags
|= BDRV_REQ_FUA
;
1182 ret
= blk_pwrite(exp
->blk
, request
.from
+ exp
->dev_offset
,
1183 req
->data
, request
.len
, flags
);
1185 error_setg_errno(&local_err
, -ret
, "writing to file failed");
1190 case NBD_CMD_WRITE_ZEROES
:
1191 if (exp
->nbdflags
& NBD_FLAG_READ_ONLY
) {
1192 error_setg(&local_err
, "Server is read-only, return error");
1193 reply
.error
= EROFS
;
1198 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1199 flags
|= BDRV_REQ_FUA
;
1201 if (!(request
.flags
& NBD_CMD_FLAG_NO_HOLE
)) {
1202 flags
|= BDRV_REQ_MAY_UNMAP
;
1204 ret
= blk_pwrite_zeroes(exp
->blk
, request
.from
+ exp
->dev_offset
,
1205 request
.len
, flags
);
1207 error_setg_errno(&local_err
, -ret
, "writing to file failed");
1213 /* unreachable, thanks to special case in nbd_co_receive_request() */
1217 ret
= blk_co_flush(exp
->blk
);
1219 error_setg_errno(&local_err
, -ret
, "flush failed");
1225 ret
= blk_co_pdiscard(exp
->blk
, request
.from
+ exp
->dev_offset
,
1228 error_setg_errno(&local_err
, -ret
, "discard failed");
1234 error_setg(&local_err
, "invalid request type (%" PRIu32
") received",
1236 reply
.error
= EINVAL
;
1241 /* If we are here local_err is not fatal error, already stored in
1243 error_report_err(local_err
);
1247 if (nbd_co_send_reply(req
, &reply
, reply_data_len
, &local_err
) < 0) {
1248 error_prepend(&local_err
, "Failed to send reply: ");
1252 /* We must disconnect after NBD_CMD_WRITE if we did not
1255 if (!req
->complete
) {
1256 error_setg(&local_err
, "Request handling failed in intermediate state");
1261 nbd_request_put(req
);
1262 nbd_client_put(client
);
1267 error_reportf_err(local_err
, "Disconnect client, due to: ");
1269 nbd_request_put(req
);
1270 client_close(client
, true);
1271 nbd_client_put(client
);
1274 static void nbd_client_receive_next_request(NBDClient
*client
)
1276 if (!client
->recv_coroutine
&& client
->nb_requests
< MAX_NBD_REQUESTS
) {
1277 nbd_client_get(client
);
1278 client
->recv_coroutine
= qemu_coroutine_create(nbd_trip
, client
);
1279 aio_co_schedule(client
->exp
->ctx
, client
->recv_coroutine
);
1283 static coroutine_fn
void nbd_co_client_start(void *opaque
)
1285 NBDClient
*client
= opaque
;
1286 NBDExport
*exp
= client
->exp
;
1287 Error
*local_err
= NULL
;
1290 nbd_export_get(exp
);
1291 QTAILQ_INSERT_TAIL(&exp
->clients
, client
, next
);
1293 qemu_co_mutex_init(&client
->send_lock
);
1295 if (nbd_negotiate(client
, &local_err
)) {
1297 error_report_err(local_err
);
1299 client_close(client
, false);
1303 nbd_client_receive_next_request(client
);
1307 * Create a new client listener on the given export @exp, using the
1308 * given channel @sioc. Begin servicing it in a coroutine. When the
1309 * connection closes, call @close_fn with an indication of whether the
1310 * client completed negotiation.
1312 void nbd_client_new(NBDExport
*exp
,
1313 QIOChannelSocket
*sioc
,
1314 QCryptoTLSCreds
*tlscreds
,
1315 const char *tlsaclname
,
1316 void (*close_fn
)(NBDClient
*, bool))
1321 client
= g_malloc0(sizeof(NBDClient
));
1322 client
->refcount
= 1;
1324 client
->tlscreds
= tlscreds
;
1326 object_ref(OBJECT(client
->tlscreds
));
1328 client
->tlsaclname
= g_strdup(tlsaclname
);
1329 client
->sioc
= sioc
;
1330 object_ref(OBJECT(client
->sioc
));
1331 client
->ioc
= QIO_CHANNEL(sioc
);
1332 object_ref(OBJECT(client
->ioc
));
1333 client
->close_fn
= close_fn
;
1335 co
= qemu_coroutine_create(nbd_co_client_start
, client
);
1336 qemu_coroutine_enter(co
);