2 * Copyright (C) 2016 Red Hat, Inc.
3 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
5 * Network Block Device Server Side
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; under version 2 of the License.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qapi/error.h"
22 #include "nbd-internal.h"
24 static int system_errno_to_nbd_errno(int err
)
50 /* Definitions for opaque data types */
52 typedef struct NBDRequestData NBDRequestData
;
54 struct NBDRequestData
{
55 QSIMPLEQ_ENTRY(NBDRequestData
) entry
;
63 void (*close
)(NBDExport
*exp
);
71 QTAILQ_HEAD(, NBDClient
) clients
;
72 QTAILQ_ENTRY(NBDExport
) next
;
76 BlockBackend
*eject_notifier_blk
;
77 Notifier eject_notifier
;
80 static QTAILQ_HEAD(, NBDExport
) exports
= QTAILQ_HEAD_INITIALIZER(exports
);
84 void (*close
)(NBDClient
*client
);
88 QCryptoTLSCreds
*tlscreds
;
90 QIOChannelSocket
*sioc
; /* The underlying data channel */
91 QIOChannel
*ioc
; /* The current I/O channel which may differ (eg TLS) */
93 Coroutine
*recv_coroutine
;
96 Coroutine
*send_coroutine
;
98 QTAILQ_ENTRY(NBDClient
) next
;
103 /* That's all folks */
105 static void nbd_client_receive_next_request(NBDClient
*client
);
107 static gboolean
nbd_negotiate_continue(QIOChannel
*ioc
,
108 GIOCondition condition
,
111 qemu_coroutine_enter(opaque
);
115 static int nbd_negotiate_read(QIOChannel
*ioc
, void *buffer
, size_t size
)
120 assert(qemu_in_coroutine());
121 /* Negotiation are always in main loop. */
122 watch
= qio_channel_add_watch(ioc
,
124 nbd_negotiate_continue
,
125 qemu_coroutine_self(),
127 ret
= read_sync(ioc
, buffer
, size
, NULL
);
128 g_source_remove(watch
);
133 static int nbd_negotiate_write(QIOChannel
*ioc
, const void *buffer
, size_t size
)
138 assert(qemu_in_coroutine());
139 /* Negotiation are always in main loop. */
140 watch
= qio_channel_add_watch(ioc
,
142 nbd_negotiate_continue
,
143 qemu_coroutine_self(),
145 ret
= write_sync(ioc
, buffer
, size
, NULL
);
146 g_source_remove(watch
);
150 static int nbd_negotiate_drop_sync(QIOChannel
*ioc
, size_t size
)
153 uint8_t *buffer
= g_malloc(MIN(65536, size
));
156 size_t count
= MIN(65536, size
);
157 ret
= nbd_negotiate_read(ioc
, buffer
, count
);
170 /* Basic flow for negotiation
197 /* Send a reply header, including length, but no payload.
198 * Return -errno on error, 0 on success. */
199 static int nbd_negotiate_send_rep_len(QIOChannel
*ioc
, uint32_t type
,
200 uint32_t opt
, uint32_t len
)
204 TRACE("Reply opt=%" PRIx32
" type=%" PRIx32
" len=%" PRIu32
,
207 magic
= cpu_to_be64(NBD_REP_MAGIC
);
208 if (nbd_negotiate_write(ioc
, &magic
, sizeof(magic
)) < 0) {
209 LOG("write failed (rep magic)");
212 opt
= cpu_to_be32(opt
);
213 if (nbd_negotiate_write(ioc
, &opt
, sizeof(opt
)) < 0) {
214 LOG("write failed (rep opt)");
217 type
= cpu_to_be32(type
);
218 if (nbd_negotiate_write(ioc
, &type
, sizeof(type
)) < 0) {
219 LOG("write failed (rep type)");
222 len
= cpu_to_be32(len
);
223 if (nbd_negotiate_write(ioc
, &len
, sizeof(len
)) < 0) {
224 LOG("write failed (rep data length)");
230 /* Send a reply header with default 0 length.
231 * Return -errno on error, 0 on success. */
232 static int nbd_negotiate_send_rep(QIOChannel
*ioc
, uint32_t type
, uint32_t opt
)
234 return nbd_negotiate_send_rep_len(ioc
, type
, opt
, 0);
237 /* Send an error reply.
238 * Return -errno on error, 0 on success. */
239 static int GCC_FMT_ATTR(4, 5)
240 nbd_negotiate_send_rep_err(QIOChannel
*ioc
, uint32_t type
,
241 uint32_t opt
, const char *fmt
, ...)
249 msg
= g_strdup_vprintf(fmt
, va
);
253 TRACE("sending error message \"%s\"", msg
);
254 ret
= nbd_negotiate_send_rep_len(ioc
, type
, opt
, len
);
258 if (nbd_negotiate_write(ioc
, msg
, len
) < 0) {
259 LOG("write failed (error message)");
269 /* Send a single NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
270 * Return -errno on error, 0 on success. */
271 static int nbd_negotiate_send_rep_list(QIOChannel
*ioc
, NBDExport
*exp
)
273 size_t name_len
, desc_len
;
275 const char *name
= exp
->name
? exp
->name
: "";
276 const char *desc
= exp
->description
? exp
->description
: "";
279 TRACE("Advertising export name '%s' description '%s'", name
, desc
);
280 name_len
= strlen(name
);
281 desc_len
= strlen(desc
);
282 len
= name_len
+ desc_len
+ sizeof(len
);
283 rc
= nbd_negotiate_send_rep_len(ioc
, NBD_REP_SERVER
, NBD_OPT_LIST
, len
);
288 len
= cpu_to_be32(name_len
);
289 if (nbd_negotiate_write(ioc
, &len
, sizeof(len
)) < 0) {
290 LOG("write failed (name length)");
293 if (nbd_negotiate_write(ioc
, name
, name_len
) < 0) {
294 LOG("write failed (name buffer)");
297 if (nbd_negotiate_write(ioc
, desc
, desc_len
) < 0) {
298 LOG("write failed (description buffer)");
304 /* Process the NBD_OPT_LIST command, with a potential series of replies.
305 * Return -errno on error, 0 on success. */
306 static int nbd_negotiate_handle_list(NBDClient
*client
, uint32_t length
)
311 if (nbd_negotiate_drop_sync(client
->ioc
, length
) < 0) {
314 return nbd_negotiate_send_rep_err(client
->ioc
,
315 NBD_REP_ERR_INVALID
, NBD_OPT_LIST
,
316 "OPT_LIST should not have length");
319 /* For each export, send a NBD_REP_SERVER reply. */
320 QTAILQ_FOREACH(exp
, &exports
, next
) {
321 if (nbd_negotiate_send_rep_list(client
->ioc
, exp
)) {
325 /* Finish with a NBD_REP_ACK. */
326 return nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
, NBD_OPT_LIST
);
329 static int nbd_negotiate_handle_export_name(NBDClient
*client
, uint32_t length
)
332 char name
[NBD_MAX_NAME_SIZE
+ 1];
335 [20 .. xx] export name (length bytes)
337 TRACE("Checking length");
338 if (length
>= sizeof(name
)) {
339 LOG("Bad length received");
342 if (nbd_negotiate_read(client
->ioc
, name
, length
) < 0) {
348 TRACE("Client requested export '%s'", name
);
350 client
->exp
= nbd_export_find(name
);
352 LOG("export not found");
356 QTAILQ_INSERT_TAIL(&client
->exp
->clients
, client
, next
);
357 nbd_export_get(client
->exp
);
363 /* Handle NBD_OPT_STARTTLS. Return NULL to drop connection, or else the
364 * new channel for all further (now-encrypted) communication. */
365 static QIOChannel
*nbd_negotiate_handle_starttls(NBDClient
*client
,
370 struct NBDTLSHandshakeData data
= { 0 };
372 TRACE("Setting up TLS");
375 if (nbd_negotiate_drop_sync(ioc
, length
) < 0) {
378 nbd_negotiate_send_rep_err(ioc
, NBD_REP_ERR_INVALID
, NBD_OPT_STARTTLS
,
379 "OPT_STARTTLS should not have length");
383 if (nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
,
384 NBD_OPT_STARTTLS
) < 0) {
388 tioc
= qio_channel_tls_new_server(ioc
,
396 qio_channel_set_name(QIO_CHANNEL(tioc
), "nbd-server-tls");
397 TRACE("Starting TLS handshake");
398 data
.loop
= g_main_loop_new(g_main_context_default(), FALSE
);
399 qio_channel_tls_handshake(tioc
,
404 if (!data
.complete
) {
405 g_main_loop_run(data
.loop
);
407 g_main_loop_unref(data
.loop
);
409 object_unref(OBJECT(tioc
));
410 error_free(data
.error
);
414 return QIO_CHANNEL(tioc
);
418 /* Process all NBD_OPT_* client option commands.
419 * Return -errno on error, 0 on success. */
420 static int nbd_negotiate_options(NBDClient
*client
)
423 bool fixedNewstyle
= false;
426 [ 0 .. 3] client flags
428 [ 0 .. 7] NBD_OPTS_MAGIC
429 [ 8 .. 11] NBD option
430 [12 .. 15] Data length
433 [ 0 .. 7] NBD_OPTS_MAGIC
434 [ 8 .. 11] Second NBD option
435 [12 .. 15] Data length
439 if (nbd_negotiate_read(client
->ioc
, &flags
, sizeof(flags
)) < 0) {
443 TRACE("Checking client flags");
444 be32_to_cpus(&flags
);
445 if (flags
& NBD_FLAG_C_FIXED_NEWSTYLE
) {
446 TRACE("Client supports fixed newstyle handshake");
447 fixedNewstyle
= true;
448 flags
&= ~NBD_FLAG_C_FIXED_NEWSTYLE
;
450 if (flags
& NBD_FLAG_C_NO_ZEROES
) {
451 TRACE("Client supports no zeroes at handshake end");
452 client
->no_zeroes
= true;
453 flags
&= ~NBD_FLAG_C_NO_ZEROES
;
456 TRACE("Unknown client flags 0x%" PRIx32
" received", flags
);
462 uint32_t clientflags
, length
;
465 if (nbd_negotiate_read(client
->ioc
, &magic
, sizeof(magic
)) < 0) {
469 TRACE("Checking opts magic");
470 if (magic
!= be64_to_cpu(NBD_OPTS_MAGIC
)) {
471 LOG("Bad magic received");
475 if (nbd_negotiate_read(client
->ioc
, &clientflags
,
476 sizeof(clientflags
)) < 0)
481 clientflags
= be32_to_cpu(clientflags
);
483 if (nbd_negotiate_read(client
->ioc
, &length
, sizeof(length
)) < 0) {
487 length
= be32_to_cpu(length
);
489 TRACE("Checking option 0x%" PRIx32
, clientflags
);
490 if (client
->tlscreds
&&
491 client
->ioc
== (QIOChannel
*)client
->sioc
) {
493 if (!fixedNewstyle
) {
494 TRACE("Unsupported option 0x%" PRIx32
, clientflags
);
497 switch (clientflags
) {
498 case NBD_OPT_STARTTLS
:
499 tioc
= nbd_negotiate_handle_starttls(client
, length
);
503 object_unref(OBJECT(client
->ioc
));
504 client
->ioc
= QIO_CHANNEL(tioc
);
507 case NBD_OPT_EXPORT_NAME
:
508 /* No way to return an error to client, so drop connection */
509 TRACE("Option 0x%x not permitted before TLS", clientflags
);
513 if (nbd_negotiate_drop_sync(client
->ioc
, length
) < 0) {
516 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
517 NBD_REP_ERR_TLS_REQD
,
520 "not permitted before TLS",
525 /* Let the client keep trying, unless they asked to quit */
526 if (clientflags
== NBD_OPT_ABORT
) {
531 } else if (fixedNewstyle
) {
532 switch (clientflags
) {
534 ret
= nbd_negotiate_handle_list(client
, length
);
541 /* NBD spec says we must try to reply before
542 * disconnecting, but that we must also tolerate
543 * guests that don't wait for our reply. */
544 nbd_negotiate_send_rep(client
->ioc
, NBD_REP_ACK
, clientflags
);
547 case NBD_OPT_EXPORT_NAME
:
548 return nbd_negotiate_handle_export_name(client
, length
);
550 case NBD_OPT_STARTTLS
:
551 if (nbd_negotiate_drop_sync(client
->ioc
, length
) < 0) {
554 if (client
->tlscreds
) {
555 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
558 "TLS already enabled");
560 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
563 "TLS not configured");
570 if (nbd_negotiate_drop_sync(client
->ioc
, length
) < 0) {
573 ret
= nbd_negotiate_send_rep_err(client
->ioc
,
576 "Unsupported option 0x%"
586 * If broken new-style we should drop the connection
587 * for anything except NBD_OPT_EXPORT_NAME
589 switch (clientflags
) {
590 case NBD_OPT_EXPORT_NAME
:
591 return nbd_negotiate_handle_export_name(client
, length
);
594 TRACE("Unsupported option 0x%" PRIx32
, clientflags
);
606 static coroutine_fn
int nbd_negotiate(NBDClientNewData
*data
)
608 NBDClient
*client
= data
->client
;
609 char buf
[8 + 8 + 8 + 128];
611 const uint16_t myflags
= (NBD_FLAG_HAS_FLAGS
| NBD_FLAG_SEND_TRIM
|
612 NBD_FLAG_SEND_FLUSH
| NBD_FLAG_SEND_FUA
|
613 NBD_FLAG_SEND_WRITE_ZEROES
);
617 /* Old style negotiation header without options
618 [ 0 .. 7] passwd ("NBDMAGIC")
619 [ 8 .. 15] magic (NBD_CLIENT_MAGIC)
621 [24 .. 25] server flags (0)
622 [26 .. 27] export flags
623 [28 .. 151] reserved (0)
625 New style negotiation header with options
626 [ 0 .. 7] passwd ("NBDMAGIC")
627 [ 8 .. 15] magic (NBD_OPTS_MAGIC)
628 [16 .. 17] server flags (0)
631 [26 .. 27] export flags
632 [28 .. 151] reserved (0, omit if no_zeroes)
635 qio_channel_set_blocking(client
->ioc
, false, NULL
);
638 TRACE("Beginning negotiation.");
639 memset(buf
, 0, sizeof(buf
));
640 memcpy(buf
, "NBDMAGIC", 8);
642 oldStyle
= client
->exp
!= NULL
&& !client
->tlscreds
;
644 TRACE("advertising size %" PRIu64
" and flags %x",
645 client
->exp
->size
, client
->exp
->nbdflags
| myflags
);
646 stq_be_p(buf
+ 8, NBD_CLIENT_MAGIC
);
647 stq_be_p(buf
+ 16, client
->exp
->size
);
648 stw_be_p(buf
+ 26, client
->exp
->nbdflags
| myflags
);
650 stq_be_p(buf
+ 8, NBD_OPTS_MAGIC
);
651 stw_be_p(buf
+ 16, NBD_FLAG_FIXED_NEWSTYLE
| NBD_FLAG_NO_ZEROES
);
655 if (client
->tlscreds
) {
656 TRACE("TLS cannot be enabled with oldstyle protocol");
659 if (nbd_negotiate_write(client
->ioc
, buf
, sizeof(buf
)) < 0) {
664 if (nbd_negotiate_write(client
->ioc
, buf
, 18) < 0) {
668 rc
= nbd_negotiate_options(client
);
670 LOG("option negotiation failed");
674 TRACE("advertising size %" PRIu64
" and flags %x",
675 client
->exp
->size
, client
->exp
->nbdflags
| myflags
);
676 stq_be_p(buf
+ 18, client
->exp
->size
);
677 stw_be_p(buf
+ 26, client
->exp
->nbdflags
| myflags
);
678 len
= client
->no_zeroes
? 10 : sizeof(buf
) - 18;
679 if (nbd_negotiate_write(client
->ioc
, buf
+ 18, len
) < 0) {
685 TRACE("Negotiation succeeded.");
691 static ssize_t
nbd_receive_request(QIOChannel
*ioc
, NBDRequest
*request
)
693 uint8_t buf
[NBD_REQUEST_SIZE
];
697 ret
= read_sync(ioc
, buf
, sizeof(buf
), NULL
);
703 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
704 [ 4 .. 5] flags (NBD_CMD_FLAG_FUA, ...)
705 [ 6 .. 7] type (NBD_CMD_READ, ...)
711 magic
= ldl_be_p(buf
);
712 request
->flags
= lduw_be_p(buf
+ 4);
713 request
->type
= lduw_be_p(buf
+ 6);
714 request
->handle
= ldq_be_p(buf
+ 8);
715 request
->from
= ldq_be_p(buf
+ 16);
716 request
->len
= ldl_be_p(buf
+ 24);
718 TRACE("Got request: { magic = 0x%" PRIx32
", .flags = %" PRIx16
719 ", .type = %" PRIx16
", from = %" PRIu64
", len = %" PRIu32
" }",
720 magic
, request
->flags
, request
->type
, request
->from
, request
->len
);
722 if (magic
!= NBD_REQUEST_MAGIC
) {
723 LOG("invalid magic (got 0x%" PRIx32
")", magic
);
729 static ssize_t
nbd_send_reply(QIOChannel
*ioc
, NBDReply
*reply
)
731 uint8_t buf
[NBD_REPLY_SIZE
];
733 reply
->error
= system_errno_to_nbd_errno(reply
->error
);
735 TRACE("Sending response to client: { .error = %" PRId32
736 ", handle = %" PRIu64
" }",
737 reply
->error
, reply
->handle
);
740 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
741 [ 4 .. 7] error (0 == no error)
744 stl_be_p(buf
, NBD_REPLY_MAGIC
);
745 stl_be_p(buf
+ 4, reply
->error
);
746 stq_be_p(buf
+ 8, reply
->handle
);
748 return write_sync(ioc
, buf
, sizeof(buf
), NULL
);
751 #define MAX_NBD_REQUESTS 16
753 void nbd_client_get(NBDClient
*client
)
758 void nbd_client_put(NBDClient
*client
)
760 if (--client
->refcount
== 0) {
761 /* The last reference should be dropped by client->close,
762 * which is called by client_close.
764 assert(client
->closing
);
766 qio_channel_detach_aio_context(client
->ioc
);
767 object_unref(OBJECT(client
->sioc
));
768 object_unref(OBJECT(client
->ioc
));
769 if (client
->tlscreds
) {
770 object_unref(OBJECT(client
->tlscreds
));
772 g_free(client
->tlsaclname
);
774 QTAILQ_REMOVE(&client
->exp
->clients
, client
, next
);
775 nbd_export_put(client
->exp
);
781 static void client_close(NBDClient
*client
)
783 if (client
->closing
) {
787 client
->closing
= true;
789 /* Force requests to finish. They will drop their own references,
790 * then we'll close the socket and free the NBDClient.
792 qio_channel_shutdown(client
->ioc
, QIO_CHANNEL_SHUTDOWN_BOTH
,
795 /* Also tell the client, so that they release their reference. */
797 client
->close(client
);
801 static NBDRequestData
*nbd_request_get(NBDClient
*client
)
805 assert(client
->nb_requests
<= MAX_NBD_REQUESTS
- 1);
806 client
->nb_requests
++;
808 req
= g_new0(NBDRequestData
, 1);
809 nbd_client_get(client
);
810 req
->client
= client
;
814 static void nbd_request_put(NBDRequestData
*req
)
816 NBDClient
*client
= req
->client
;
819 qemu_vfree(req
->data
);
823 client
->nb_requests
--;
824 nbd_client_receive_next_request(client
);
826 nbd_client_put(client
);
829 static void blk_aio_attached(AioContext
*ctx
, void *opaque
)
831 NBDExport
*exp
= opaque
;
834 TRACE("Export %s: Attaching clients to AIO context %p\n", exp
->name
, ctx
);
838 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
839 qio_channel_attach_aio_context(client
->ioc
, ctx
);
840 if (client
->recv_coroutine
) {
841 aio_co_schedule(ctx
, client
->recv_coroutine
);
843 if (client
->send_coroutine
) {
844 aio_co_schedule(ctx
, client
->send_coroutine
);
849 static void blk_aio_detach(void *opaque
)
851 NBDExport
*exp
= opaque
;
854 TRACE("Export %s: Detaching clients from AIO context %p\n", exp
->name
, exp
->ctx
);
856 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
857 qio_channel_detach_aio_context(client
->ioc
);
863 static void nbd_eject_notifier(Notifier
*n
, void *data
)
865 NBDExport
*exp
= container_of(n
, NBDExport
, eject_notifier
);
866 nbd_export_close(exp
);
869 NBDExport
*nbd_export_new(BlockDriverState
*bs
, off_t dev_offset
, off_t size
,
870 uint16_t nbdflags
, void (*close
)(NBDExport
*),
871 bool writethrough
, BlockBackend
*on_eject_blk
,
875 NBDExport
*exp
= g_malloc0(sizeof(NBDExport
));
879 /* Don't allow resize while the NBD server is running, otherwise we don't
880 * care what happens with the node. */
881 perm
= BLK_PERM_CONSISTENT_READ
;
882 if ((nbdflags
& NBD_FLAG_READ_ONLY
) == 0) {
883 perm
|= BLK_PERM_WRITE
;
885 blk
= blk_new(perm
, BLK_PERM_CONSISTENT_READ
| BLK_PERM_WRITE_UNCHANGED
|
886 BLK_PERM_WRITE
| BLK_PERM_GRAPH_MOD
);
887 ret
= blk_insert_bs(blk
, bs
, errp
);
891 blk_set_enable_write_cache(blk
, !writethrough
);
894 QTAILQ_INIT(&exp
->clients
);
896 exp
->dev_offset
= dev_offset
;
897 exp
->nbdflags
= nbdflags
;
898 exp
->size
= size
< 0 ? blk_getlength(blk
) : size
;
900 error_setg_errno(errp
, -exp
->size
,
901 "Failed to determine the NBD export's length");
904 exp
->size
-= exp
->size
% BDRV_SECTOR_SIZE
;
907 exp
->ctx
= blk_get_aio_context(blk
);
908 blk_add_aio_context_notifier(blk
, blk_aio_attached
, blk_aio_detach
, exp
);
911 blk_ref(on_eject_blk
);
912 exp
->eject_notifier_blk
= on_eject_blk
;
913 exp
->eject_notifier
.notify
= nbd_eject_notifier
;
914 blk_add_remove_bs_notifier(on_eject_blk
, &exp
->eject_notifier
);
918 * NBD exports are used for non-shared storage migration. Make sure
919 * that BDRV_O_INACTIVE is cleared and the image is ready for write
920 * access since the export could be available before migration handover.
922 aio_context_acquire(exp
->ctx
);
923 blk_invalidate_cache(blk
, NULL
);
924 aio_context_release(exp
->ctx
);
933 NBDExport
*nbd_export_find(const char *name
)
936 QTAILQ_FOREACH(exp
, &exports
, next
) {
937 if (strcmp(name
, exp
->name
) == 0) {
945 void nbd_export_set_name(NBDExport
*exp
, const char *name
)
947 if (exp
->name
== name
) {
952 if (exp
->name
!= NULL
) {
955 QTAILQ_REMOVE(&exports
, exp
, next
);
960 exp
->name
= g_strdup(name
);
961 QTAILQ_INSERT_TAIL(&exports
, exp
, next
);
966 void nbd_export_set_description(NBDExport
*exp
, const char *description
)
968 g_free(exp
->description
);
969 exp
->description
= g_strdup(description
);
972 void nbd_export_close(NBDExport
*exp
)
974 NBDClient
*client
, *next
;
977 QTAILQ_FOREACH_SAFE(client
, &exp
->clients
, next
, next
) {
978 client_close(client
);
980 nbd_export_set_name(exp
, NULL
);
981 nbd_export_set_description(exp
, NULL
);
985 void nbd_export_get(NBDExport
*exp
)
987 assert(exp
->refcount
> 0);
991 void nbd_export_put(NBDExport
*exp
)
993 assert(exp
->refcount
> 0);
994 if (exp
->refcount
== 1) {
995 nbd_export_close(exp
);
998 if (--exp
->refcount
== 0) {
999 assert(exp
->name
== NULL
);
1000 assert(exp
->description
== NULL
);
1007 if (exp
->eject_notifier_blk
) {
1008 notifier_remove(&exp
->eject_notifier
);
1009 blk_unref(exp
->eject_notifier_blk
);
1011 blk_remove_aio_context_notifier(exp
->blk
, blk_aio_attached
,
1012 blk_aio_detach
, exp
);
1013 blk_unref(exp
->blk
);
1021 BlockBackend
*nbd_export_get_blockdev(NBDExport
*exp
)
1026 void nbd_export_close_all(void)
1028 NBDExport
*exp
, *next
;
1030 QTAILQ_FOREACH_SAFE(exp
, &exports
, next
, next
) {
1031 nbd_export_close(exp
);
1035 static ssize_t
nbd_co_send_reply(NBDRequestData
*req
, NBDReply
*reply
,
1038 NBDClient
*client
= req
->client
;
1041 g_assert(qemu_in_coroutine());
1042 qemu_co_mutex_lock(&client
->send_lock
);
1043 client
->send_coroutine
= qemu_coroutine_self();
1046 rc
= nbd_send_reply(client
->ioc
, reply
);
1048 qio_channel_set_cork(client
->ioc
, true);
1049 rc
= nbd_send_reply(client
->ioc
, reply
);
1051 ret
= write_sync(client
->ioc
, req
->data
, len
, NULL
);
1056 qio_channel_set_cork(client
->ioc
, false);
1059 client
->send_coroutine
= NULL
;
1060 qemu_co_mutex_unlock(&client
->send_lock
);
1064 /* Collect a client request. Return 0 if request looks valid, -EAGAIN
1065 * to keep trying the collection, -EIO to drop connection right away,
1066 * and any other negative value to report an error to the client
1067 * (although the caller may still need to disconnect after reporting
1069 static ssize_t
nbd_co_receive_request(NBDRequestData
*req
,
1070 NBDRequest
*request
)
1072 NBDClient
*client
= req
->client
;
1075 g_assert(qemu_in_coroutine());
1076 assert(client
->recv_coroutine
== qemu_coroutine_self());
1077 rc
= nbd_receive_request(client
->ioc
, request
);
1079 if (rc
!= -EAGAIN
) {
1085 TRACE("Decoding type");
1087 if (request
->type
!= NBD_CMD_WRITE
) {
1088 /* No payload, we are ready to read the next request. */
1089 req
->complete
= true;
1092 if (request
->type
== NBD_CMD_DISC
) {
1093 /* Special case: we're going to disconnect without a reply,
1094 * whether or not flags, from, or len are bogus */
1095 TRACE("Request type is DISCONNECT");
1100 /* Check for sanity in the parameters, part 1. Defer as many
1101 * checks as possible until after reading any NBD_CMD_WRITE
1102 * payload, so we can try and keep the connection alive. */
1103 if ((request
->from
+ request
->len
) < request
->from
) {
1104 LOG("integer overflow detected, you're probably being attacked");
1109 if (request
->type
== NBD_CMD_READ
|| request
->type
== NBD_CMD_WRITE
) {
1110 if (request
->len
> NBD_MAX_BUFFER_SIZE
) {
1111 LOG("len (%" PRIu32
" ) is larger than max len (%u)",
1112 request
->len
, NBD_MAX_BUFFER_SIZE
);
1117 req
->data
= blk_try_blockalign(client
->exp
->blk
, request
->len
);
1118 if (req
->data
== NULL
) {
1123 if (request
->type
== NBD_CMD_WRITE
) {
1124 TRACE("Reading %" PRIu32
" byte(s)", request
->len
);
1126 if (read_sync(client
->ioc
, req
->data
, request
->len
, NULL
) < 0) {
1127 LOG("reading from socket failed");
1131 req
->complete
= true;
1134 /* Sanity checks, part 2. */
1135 if (request
->from
+ request
->len
> client
->exp
->size
) {
1136 LOG("operation past EOF; From: %" PRIu64
", Len: %" PRIu32
1137 ", Size: %" PRIu64
, request
->from
, request
->len
,
1138 (uint64_t)client
->exp
->size
);
1139 rc
= request
->type
== NBD_CMD_WRITE
? -ENOSPC
: -EINVAL
;
1142 if (request
->flags
& ~(NBD_CMD_FLAG_FUA
| NBD_CMD_FLAG_NO_HOLE
)) {
1143 LOG("unsupported flags (got 0x%x)", request
->flags
);
1147 if (request
->type
!= NBD_CMD_WRITE_ZEROES
&&
1148 (request
->flags
& NBD_CMD_FLAG_NO_HOLE
)) {
1149 LOG("unexpected flags (got 0x%x)", request
->flags
);
1157 client
->recv_coroutine
= NULL
;
1158 nbd_client_receive_next_request(client
);
1163 /* Owns a reference to the NBDClient passed as opaque. */
1164 static coroutine_fn
void nbd_trip(void *opaque
)
1166 NBDClient
*client
= opaque
;
1167 NBDExport
*exp
= client
->exp
;
1168 NBDRequestData
*req
;
1169 NBDRequest request
= { 0 }; /* GCC thinks it can be used uninitialized */
1174 TRACE("Reading request.");
1175 if (client
->closing
) {
1176 nbd_client_put(client
);
1180 req
= nbd_request_get(client
);
1181 ret
= nbd_co_receive_request(req
, &request
);
1182 if (ret
== -EAGAIN
) {
1189 reply
.handle
= request
.handle
;
1197 if (client
->closing
) {
1199 * The client may be closed when we are blocked in
1200 * nbd_co_receive_request()
1205 switch (request
.type
) {
1207 TRACE("Request type is READ");
1209 /* XXX: NBD Protocol only documents use of FUA with WRITE */
1210 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1211 ret
= blk_co_flush(exp
->blk
);
1213 LOG("flush failed");
1219 ret
= blk_pread(exp
->blk
, request
.from
+ exp
->dev_offset
,
1220 req
->data
, request
.len
);
1222 LOG("reading from file failed");
1227 TRACE("Read %" PRIu32
" byte(s)", request
.len
);
1228 if (nbd_co_send_reply(req
, &reply
, request
.len
) < 0)
1232 TRACE("Request type is WRITE");
1234 if (exp
->nbdflags
& NBD_FLAG_READ_ONLY
) {
1235 TRACE("Server is read-only, return error");
1236 reply
.error
= EROFS
;
1240 TRACE("Writing to device");
1243 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1244 flags
|= BDRV_REQ_FUA
;
1246 ret
= blk_pwrite(exp
->blk
, request
.from
+ exp
->dev_offset
,
1247 req
->data
, request
.len
, flags
);
1249 LOG("writing to file failed");
1254 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1259 case NBD_CMD_WRITE_ZEROES
:
1260 TRACE("Request type is WRITE_ZEROES");
1262 if (exp
->nbdflags
& NBD_FLAG_READ_ONLY
) {
1263 TRACE("Server is read-only, return error");
1264 reply
.error
= EROFS
;
1268 TRACE("Writing to device");
1271 if (request
.flags
& NBD_CMD_FLAG_FUA
) {
1272 flags
|= BDRV_REQ_FUA
;
1274 if (!(request
.flags
& NBD_CMD_FLAG_NO_HOLE
)) {
1275 flags
|= BDRV_REQ_MAY_UNMAP
;
1277 ret
= blk_pwrite_zeroes(exp
->blk
, request
.from
+ exp
->dev_offset
,
1278 request
.len
, flags
);
1280 LOG("writing to file failed");
1285 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1291 /* unreachable, thanks to special case in nbd_co_receive_request() */
1295 TRACE("Request type is FLUSH");
1297 ret
= blk_co_flush(exp
->blk
);
1299 LOG("flush failed");
1302 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1307 TRACE("Request type is TRIM");
1308 ret
= blk_co_pdiscard(exp
->blk
, request
.from
+ exp
->dev_offset
,
1311 LOG("discard failed");
1314 if (nbd_co_send_reply(req
, &reply
, 0) < 0) {
1319 LOG("invalid request type (%" PRIu32
") received", request
.type
);
1320 reply
.error
= EINVAL
;
1322 /* We must disconnect after NBD_CMD_WRITE if we did not
1325 if (nbd_co_send_reply(req
, &reply
, 0) < 0 || !req
->complete
) {
1331 TRACE("Request/Reply complete");
1334 nbd_request_put(req
);
1335 nbd_client_put(client
);
1339 nbd_request_put(req
);
1340 client_close(client
);
1341 nbd_client_put(client
);
1344 static void nbd_client_receive_next_request(NBDClient
*client
)
1346 if (!client
->recv_coroutine
&& client
->nb_requests
< MAX_NBD_REQUESTS
) {
1347 nbd_client_get(client
);
1348 client
->recv_coroutine
= qemu_coroutine_create(nbd_trip
, client
);
1349 aio_co_schedule(client
->exp
->ctx
, client
->recv_coroutine
);
1353 static coroutine_fn
void nbd_co_client_start(void *opaque
)
1355 NBDClientNewData
*data
= opaque
;
1356 NBDClient
*client
= data
->client
;
1357 NBDExport
*exp
= client
->exp
;
1360 nbd_export_get(exp
);
1361 QTAILQ_INSERT_TAIL(&exp
->clients
, client
, next
);
1363 qemu_co_mutex_init(&client
->send_lock
);
1365 if (nbd_negotiate(data
)) {
1366 client_close(client
);
1370 nbd_client_receive_next_request(client
);
1376 void nbd_client_new(NBDExport
*exp
,
1377 QIOChannelSocket
*sioc
,
1378 QCryptoTLSCreds
*tlscreds
,
1379 const char *tlsaclname
,
1380 void (*close_fn
)(NBDClient
*))
1383 NBDClientNewData
*data
= g_new(NBDClientNewData
, 1);
1385 client
= g_malloc0(sizeof(NBDClient
));
1386 client
->refcount
= 1;
1388 client
->tlscreds
= tlscreds
;
1390 object_ref(OBJECT(client
->tlscreds
));
1392 client
->tlsaclname
= g_strdup(tlsaclname
);
1393 client
->sioc
= sioc
;
1394 object_ref(OBJECT(client
->sioc
));
1395 client
->ioc
= QIO_CHANNEL(sioc
);
1396 object_ref(OBJECT(client
->ioc
));
1397 client
->close
= close_fn
;
1399 data
->client
= client
;
1400 data
->co
= qemu_coroutine_create(nbd_co_client_start
, data
);
1401 qemu_coroutine_enter(data
->co
);