2 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; under version 2 of the License.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include <sys/ioctl.h>
27 #include <sys/ioccom.h>
32 #include "qemu_socket.h"
37 #define TRACE(msg, ...) do { \
38 LOG(msg, ## __VA_ARGS__); \
41 #define TRACE(msg, ...) \
45 #define LOG(msg, ...) do { \
46 fprintf(stderr, "%s:%s():L%d: " msg "\n", \
47 __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
50 /* This is all part of the "official" NBD API */
52 #define NBD_REQUEST_MAGIC 0x25609513
53 #define NBD_REPLY_MAGIC 0x67446698
55 #define NBD_SET_SOCK _IO(0xab, 0)
56 #define NBD_SET_BLKSIZE _IO(0xab, 1)
57 #define NBD_SET_SIZE _IO(0xab, 2)
58 #define NBD_DO_IT _IO(0xab, 3)
59 #define NBD_CLEAR_SOCK _IO(0xab, 4)
60 #define NBD_CLEAR_QUE _IO(0xab, 5)
61 #define NBD_PRINT_DEBUG _IO(0xab, 6)
62 #define NBD_SET_SIZE_BLOCKS _IO(0xab, 7)
63 #define NBD_DISCONNECT _IO(0xab, 8)
65 #define NBD_OPT_EXPORT_NAME (1 << 0)
67 /* That's all folks */
69 #define read_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, true)
70 #define write_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, false)
72 size_t nbd_wr_sync(int fd
, void *buffer
, size_t size
, bool do_read
)
76 while (offset
< size
) {
80 len
= recv(fd
, buffer
+ offset
, size
- offset
, 0);
82 len
= send(fd
, buffer
+ offset
, size
- offset
, 0);
86 errno
= socket_error();
88 /* recoverable error */
89 if (len
== -1 && (errno
== EAGAIN
|| errno
== EINTR
)) {
98 /* unrecoverable error */
109 int tcp_socket_outgoing(const char *address
, uint16_t port
)
113 struct sockaddr_in addr
;
115 s
= socket(PF_INET
, SOCK_STREAM
, 0);
120 if (inet_aton(address
, &in
) == 0) {
123 ent
= gethostbyname(address
);
128 memcpy(&in
, ent
->h_addr
, sizeof(in
));
131 addr
.sin_family
= AF_INET
;
132 addr
.sin_port
= htons(port
);
133 memcpy(&addr
.sin_addr
.s_addr
, &in
, sizeof(in
));
135 if (connect(s
, (struct sockaddr
*)&addr
, sizeof(addr
)) == -1) {
145 int tcp_socket_incoming(const char *address
, uint16_t port
)
149 struct sockaddr_in addr
;
152 s
= socket(PF_INET
, SOCK_STREAM
, 0);
157 if (inet_aton(address
, &in
) == 0) {
160 ent
= gethostbyname(address
);
165 memcpy(&in
, ent
->h_addr
, sizeof(in
));
168 addr
.sin_family
= AF_INET
;
169 addr
.sin_port
= htons(port
);
170 memcpy(&addr
.sin_addr
.s_addr
, &in
, sizeof(in
));
173 if (setsockopt(s
, SOL_SOCKET
, SO_REUSEADDR
,
174 (const void *) &opt
, sizeof(opt
)) == -1) {
178 if (bind(s
, (struct sockaddr
*)&addr
, sizeof(addr
)) == -1) {
182 if (listen(s
, 128) == -1) {
193 int unix_socket_incoming(const char *path
)
196 struct sockaddr_un addr
;
198 s
= socket(PF_UNIX
, SOCK_STREAM
, 0);
203 memset(&addr
, 0, sizeof(addr
));
204 addr
.sun_family
= AF_UNIX
;
205 pstrcpy(addr
.sun_path
, sizeof(addr
.sun_path
), path
);
207 if (bind(s
, (struct sockaddr
*)&addr
, sizeof(addr
)) == -1) {
211 if (listen(s
, 128) == -1) {
221 int unix_socket_outgoing(const char *path
)
224 struct sockaddr_un addr
;
226 s
= socket(PF_UNIX
, SOCK_STREAM
, 0);
231 memset(&addr
, 0, sizeof(addr
));
232 addr
.sun_family
= AF_UNIX
;
233 pstrcpy(addr
.sun_path
, sizeof(addr
.sun_path
), path
);
235 if (connect(s
, (struct sockaddr
*)&addr
, sizeof(addr
)) == -1) {
245 int unix_socket_incoming(const char *path
)
251 int unix_socket_outgoing(const char *path
)
273 int nbd_negotiate(int csock
, off_t size
)
275 char buf
[8 + 8 + 8 + 128];
278 [ 0 .. 7] passwd ("NBDMAGIC")
279 [ 8 .. 15] magic (0x00420281861253)
281 [24 .. 151] reserved (0)
284 TRACE("Beginning negotiation.");
285 memcpy(buf
, "NBDMAGIC", 8);
286 cpu_to_be64w((uint64_t*)(buf
+ 8), 0x00420281861253LL
);
287 cpu_to_be64w((uint64_t*)(buf
+ 16), size
);
288 memset(buf
+ 24, 0, 128);
290 if (write_sync(csock
, buf
, sizeof(buf
)) != sizeof(buf
)) {
296 TRACE("Negotation succeeded.");
301 int nbd_receive_negotiate(int csock
, const char *name
, uint32_t *flags
,
302 off_t
*size
, size_t *blocksize
)
308 TRACE("Receiving negotation.");
310 if (read_sync(csock
, buf
, 8) != 8) {
317 if (strlen(buf
) == 0) {
318 LOG("server connection closed");
323 TRACE("Magic is %c%c%c%c%c%c%c%c",
324 qemu_isprint(buf
[0]) ? buf
[0] : '.',
325 qemu_isprint(buf
[1]) ? buf
[1] : '.',
326 qemu_isprint(buf
[2]) ? buf
[2] : '.',
327 qemu_isprint(buf
[3]) ? buf
[3] : '.',
328 qemu_isprint(buf
[4]) ? buf
[4] : '.',
329 qemu_isprint(buf
[5]) ? buf
[5] : '.',
330 qemu_isprint(buf
[6]) ? buf
[6] : '.',
331 qemu_isprint(buf
[7]) ? buf
[7] : '.');
333 if (memcmp(buf
, "NBDMAGIC", 8) != 0) {
334 LOG("Invalid magic received");
339 if (read_sync(csock
, &magic
, sizeof(magic
)) != sizeof(magic
)) {
344 magic
= be64_to_cpu(magic
);
345 TRACE("Magic is 0x%" PRIx64
, magic
);
348 uint32_t reserved
= 0;
352 TRACE("Checking magic (opts_magic)");
353 if (magic
!= 0x49484156454F5054LL
) {
354 LOG("Bad magic received");
358 if (read_sync(csock
, &tmp
, sizeof(tmp
)) != sizeof(tmp
)) {
359 LOG("flags read failed");
363 *flags
= be16_to_cpu(tmp
) << 16;
364 /* reserved for future use */
365 if (write_sync(csock
, &reserved
, sizeof(reserved
)) !=
367 LOG("write failed (reserved)");
371 /* write the export name */
372 magic
= cpu_to_be64(magic
);
373 if (write_sync(csock
, &magic
, sizeof(magic
)) != sizeof(magic
)) {
374 LOG("write failed (magic)");
378 opt
= cpu_to_be32(NBD_OPT_EXPORT_NAME
);
379 if (write_sync(csock
, &opt
, sizeof(opt
)) != sizeof(opt
)) {
380 LOG("write failed (opt)");
384 namesize
= cpu_to_be32(strlen(name
));
385 if (write_sync(csock
, &namesize
, sizeof(namesize
)) !=
387 LOG("write failed (namesize)");
391 if (write_sync(csock
, (char*)name
, strlen(name
)) != strlen(name
)) {
392 LOG("write failed (name)");
397 TRACE("Checking magic (cli_magic)");
399 if (magic
!= 0x00420281861253LL
) {
400 LOG("Bad magic received");
406 if (read_sync(csock
, &s
, sizeof(s
)) != sizeof(s
)) {
411 *size
= be64_to_cpu(s
);
413 TRACE("Size is %" PRIu64
, *size
);
416 if (read_sync(csock
, flags
, sizeof(*flags
)) != sizeof(*flags
)) {
417 LOG("read failed (flags)");
421 *flags
= be32_to_cpup(flags
);
423 if (read_sync(csock
, &tmp
, sizeof(tmp
)) != sizeof(tmp
)) {
424 LOG("read failed (tmp)");
428 *flags
|= be32_to_cpu(tmp
);
430 if (read_sync(csock
, &buf
, 124) != 124) {
431 LOG("read failed (buf)");
439 int nbd_init(int fd
, int csock
, off_t size
, size_t blocksize
)
441 TRACE("Setting block size to %lu", (unsigned long)blocksize
);
443 if (ioctl(fd
, NBD_SET_BLKSIZE
, blocksize
) == -1) {
445 LOG("Failed setting NBD block size");
450 TRACE("Setting size to %zd block(s)", (size_t)(size
/ blocksize
));
452 if (ioctl(fd
, NBD_SET_SIZE_BLOCKS
, size
/ blocksize
) == -1) {
454 LOG("Failed setting size (in blocks)");
459 TRACE("Clearing NBD socket");
461 if (ioctl(fd
, NBD_CLEAR_SOCK
) == -1) {
463 LOG("Failed clearing NBD socket");
468 TRACE("Setting NBD socket");
470 if (ioctl(fd
, NBD_SET_SOCK
, csock
) == -1) {
472 LOG("Failed to set NBD socket");
477 TRACE("Negotiation ended");
482 int nbd_disconnect(int fd
)
484 ioctl(fd
, NBD_CLEAR_QUE
);
485 ioctl(fd
, NBD_DISCONNECT
);
486 ioctl(fd
, NBD_CLEAR_SOCK
);
490 int nbd_client(int fd
, int csock
)
495 TRACE("Doing NBD loop");
497 ret
= ioctl(fd
, NBD_DO_IT
);
500 TRACE("NBD loop returned %d: %s", ret
, strerror(serrno
));
502 TRACE("Clearing NBD queue");
503 ioctl(fd
, NBD_CLEAR_QUE
);
505 TRACE("Clearing NBD socket");
506 ioctl(fd
, NBD_CLEAR_SOCK
);
512 int nbd_init(int fd
, int csock
, off_t size
, size_t blocksize
)
518 int nbd_disconnect(int fd
)
524 int nbd_client(int fd
, int csock
)
531 int nbd_send_request(int csock
, struct nbd_request
*request
)
533 uint8_t buf
[4 + 4 + 8 + 8 + 4];
535 cpu_to_be32w((uint32_t*)buf
, NBD_REQUEST_MAGIC
);
536 cpu_to_be32w((uint32_t*)(buf
+ 4), request
->type
);
537 cpu_to_be64w((uint64_t*)(buf
+ 8), request
->handle
);
538 cpu_to_be64w((uint64_t*)(buf
+ 16), request
->from
);
539 cpu_to_be32w((uint32_t*)(buf
+ 24), request
->len
);
541 TRACE("Sending request to client");
543 if (write_sync(csock
, buf
, sizeof(buf
)) != sizeof(buf
)) {
544 LOG("writing to socket failed");
552 static int nbd_receive_request(int csock
, struct nbd_request
*request
)
554 uint8_t buf
[4 + 4 + 8 + 8 + 4];
557 if (read_sync(csock
, buf
, sizeof(buf
)) != sizeof(buf
)) {
564 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
565 [ 4 .. 7] type (0 == READ, 1 == WRITE)
571 magic
= be32_to_cpup((uint32_t*)buf
);
572 request
->type
= be32_to_cpup((uint32_t*)(buf
+ 4));
573 request
->handle
= be64_to_cpup((uint64_t*)(buf
+ 8));
574 request
->from
= be64_to_cpup((uint64_t*)(buf
+ 16));
575 request
->len
= be32_to_cpup((uint32_t*)(buf
+ 24));
577 TRACE("Got request: "
578 "{ magic = 0x%x, .type = %d, from = %" PRIu64
" , len = %u }",
579 magic
, request
->type
, request
->from
, request
->len
);
581 if (magic
!= NBD_REQUEST_MAGIC
) {
582 LOG("invalid magic (got 0x%x)", magic
);
589 int nbd_receive_reply(int csock
, struct nbd_reply
*reply
)
591 uint8_t buf
[4 + 4 + 8];
594 memset(buf
, 0xAA, sizeof(buf
));
596 if (read_sync(csock
, buf
, sizeof(buf
)) != sizeof(buf
)) {
603 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
604 [ 4 .. 7] error (0 == no error)
608 magic
= be32_to_cpup((uint32_t*)buf
);
609 reply
->error
= be32_to_cpup((uint32_t*)(buf
+ 4));
610 reply
->handle
= be64_to_cpup((uint64_t*)(buf
+ 8));
613 "{ magic = 0x%x, .error = %d, handle = %" PRIu64
" }",
614 magic
, reply
->error
, reply
->handle
);
616 if (magic
!= NBD_REPLY_MAGIC
) {
617 LOG("invalid magic (got 0x%x)", magic
);
624 static int nbd_send_reply(int csock
, struct nbd_reply
*reply
)
626 uint8_t buf
[4 + 4 + 8];
629 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
630 [ 4 .. 7] error (0 == no error)
633 cpu_to_be32w((uint32_t*)buf
, NBD_REPLY_MAGIC
);
634 cpu_to_be32w((uint32_t*)(buf
+ 4), reply
->error
);
635 cpu_to_be64w((uint64_t*)(buf
+ 8), reply
->handle
);
637 TRACE("Sending response to client");
639 if (write_sync(csock
, buf
, sizeof(buf
)) != sizeof(buf
)) {
640 LOG("writing to socket failed");
647 int nbd_trip(BlockDriverState
*bs
, int csock
, off_t size
, uint64_t dev_offset
,
648 off_t
*offset
, bool readonly
, uint8_t *data
, int data_size
)
650 struct nbd_request request
;
651 struct nbd_reply reply
;
653 TRACE("Reading request.");
655 if (nbd_receive_request(csock
, &request
) == -1)
658 if (request
.len
> data_size
) {
659 LOG("len (%u) is larger than max len (%u)",
660 request
.len
, data_size
);
665 if ((request
.from
+ request
.len
) < request
.from
) {
666 LOG("integer overflow detected! "
667 "you're probably being attacked");
672 if ((request
.from
+ request
.len
) > size
) {
673 LOG("From: %" PRIu64
", Len: %u, Size: %" PRIu64
674 ", Offset: %" PRIu64
"\n",
675 request
.from
, request
.len
, (uint64_t)size
, dev_offset
);
676 LOG("requested operation past EOF--bad client?");
681 TRACE("Decoding type");
683 reply
.handle
= request
.handle
;
686 switch (request
.type
) {
688 TRACE("Request type is READ");
690 if (bdrv_read(bs
, (request
.from
+ dev_offset
) / 512, data
,
691 request
.len
/ 512) == -1) {
692 LOG("reading from file failed");
696 *offset
+= request
.len
;
698 TRACE("Read %u byte(s)", request
.len
);
700 if (nbd_send_reply(csock
, &reply
) == -1)
703 TRACE("Sending data to client");
705 if (write_sync(csock
, data
, request
.len
) != request
.len
) {
706 LOG("writing to socket failed");
712 TRACE("Request type is WRITE");
714 TRACE("Reading %u byte(s)", request
.len
);
716 if (read_sync(csock
, data
, request
.len
) != request
.len
) {
717 LOG("reading from socket failed");
723 TRACE("Server is read-only, return error");
726 TRACE("Writing to device");
728 if (bdrv_write(bs
, (request
.from
+ dev_offset
) / 512,
729 data
, request
.len
/ 512) == -1) {
730 LOG("writing to file failed");
735 *offset
+= request
.len
;
738 if (nbd_send_reply(csock
, &reply
) == -1)
742 TRACE("Request type is DISCONNECT");
746 LOG("invalid request type (%u) received", request
.type
);
751 TRACE("Request/Reply complete");