2 * Copyright (C) 2016-2022 Red Hat, Inc.
3 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
5 * Network Block Device Server Side
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; under version 2 of the License.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
22 #include "block/export.h"
23 #include "qapi/error.h"
24 #include "qemu/queue.h"
26 #include "nbd-internal.h"
27 #include "qemu/units.h"
28 #include "qemu/memalign.h"
30 #define NBD_META_ID_BASE_ALLOCATION 0
31 #define NBD_META_ID_ALLOCATION_DEPTH 1
32 /* Dirty bitmaps use 'NBD_META_ID_DIRTY_BITMAP + i', so keep this id last. */
33 #define NBD_META_ID_DIRTY_BITMAP 2
36 * NBD_MAX_BLOCK_STATUS_EXTENTS: 1 MiB of extents data. An empirical
37 * constant. If an increase is needed, note that the NBD protocol
38 * recommends no larger than 32 mb, so that the client won't consider
39 * the reply as a denial of service attack.
41 #define NBD_MAX_BLOCK_STATUS_EXTENTS (1 * MiB / 8)
43 static int system_errno_to_nbd_errno(int err
)
64 #if ENOTSUP != EOPNOTSUPP
76 /* Definitions for opaque data types */
78 typedef struct NBDRequestData NBDRequestData
;
80 struct NBDRequestData
{
93 QTAILQ_HEAD(, NBDClient
) clients
;
94 QTAILQ_ENTRY(NBDExport
) next
;
96 BlockBackend
*eject_notifier_blk
;
97 Notifier eject_notifier
;
99 bool allocation_depth
;
100 BdrvDirtyBitmap
**export_bitmaps
;
101 size_t nr_export_bitmaps
;
104 static QTAILQ_HEAD(, NBDExport
) exports
= QTAILQ_HEAD_INITIALIZER(exports
);
106 /* NBDExportMetaContexts represents a list of contexts to be exported,
107 * as selected by NBD_OPT_SET_META_CONTEXT. Also used for
108 * NBD_OPT_LIST_META_CONTEXT. */
109 typedef struct NBDExportMetaContexts
{
111 size_t count
; /* number of negotiated contexts */
112 bool base_allocation
; /* export base:allocation context (block status) */
113 bool allocation_depth
; /* export qemu:allocation-depth */
115 * export qemu:dirty-bitmap:<export bitmap name>,
116 * sized by exp->nr_export_bitmaps
118 } NBDExportMetaContexts
;
122 void (*close_fn
)(NBDClient
*client
, bool negotiated
);
125 QCryptoTLSCreds
*tlscreds
;
127 QIOChannelSocket
*sioc
; /* The underlying data channel */
128 QIOChannel
*ioc
; /* The current I/O channel which may differ (eg TLS) */
130 Coroutine
*recv_coroutine
;
133 Coroutine
*send_coroutine
;
138 QTAILQ_ENTRY(NBDClient
) next
;
142 uint32_t check_align
; /* If non-zero, check for aligned client requests */
144 bool structured_reply
;
145 NBDExportMetaContexts export_meta
;
147 uint32_t opt
; /* Current option being negotiated */
148 uint32_t optlen
; /* remaining length of data in ioc for the option being
152 static void nbd_client_receive_next_request(NBDClient
*client
);
154 /* Basic flow for negotiation
181 static inline void set_be_option_rep(NBDOptionReply
*rep
, uint32_t option
,
182 uint32_t type
, uint32_t length
)
184 stq_be_p(&rep
->magic
, NBD_REP_MAGIC
);
185 stl_be_p(&rep
->option
, option
);
186 stl_be_p(&rep
->type
, type
);
187 stl_be_p(&rep
->length
, length
);
190 /* Send a reply header, including length, but no payload.
191 * Return -errno on error, 0 on success. */
192 static int nbd_negotiate_send_rep_len(NBDClient
*client
, uint32_t type
,
193 uint32_t len
, Error
**errp
)
197 trace_nbd_negotiate_send_rep_len(client
->opt
, nbd_opt_lookup(client
->opt
),
198 type
, nbd_rep_lookup(type
), len
);
200 assert(len
< NBD_MAX_BUFFER_SIZE
);
202 set_be_option_rep(&rep
, client
->opt
, type
, len
);
203 return nbd_write(client
->ioc
, &rep
, sizeof(rep
), errp
);
206 /* Send a reply header with default 0 length.
207 * Return -errno on error, 0 on success. */
208 static int nbd_negotiate_send_rep(NBDClient
*client
, uint32_t type
,
211 return nbd_negotiate_send_rep_len(client
, type
, 0, errp
);
214 /* Send an error reply.
215 * Return -errno on error, 0 on success. */
216 static int G_GNUC_PRINTF(4, 0)
217 nbd_negotiate_send_rep_verr(NBDClient
*client
, uint32_t type
,
218 Error
**errp
, const char *fmt
, va_list va
)
221 g_autofree
char *msg
= NULL
;
225 msg
= g_strdup_vprintf(fmt
, va
);
227 assert(len
< NBD_MAX_STRING_SIZE
);
228 trace_nbd_negotiate_send_rep_err(msg
);
229 ret
= nbd_negotiate_send_rep_len(client
, type
, len
, errp
);
233 if (nbd_write(client
->ioc
, msg
, len
, errp
) < 0) {
234 error_prepend(errp
, "write failed (error message): ");
242 * Return a malloc'd copy of @name suitable for use in an error reply.
245 nbd_sanitize_name(const char *name
)
247 if (strnlen(name
, 80) < 80) {
248 return g_strdup(name
);
250 /* XXX Should we also try to sanitize any control characters? */
251 return g_strdup_printf("%.80s...", name
);
254 /* Send an error reply.
255 * Return -errno on error, 0 on success. */
256 static int G_GNUC_PRINTF(4, 5)
257 nbd_negotiate_send_rep_err(NBDClient
*client
, uint32_t type
,
258 Error
**errp
, const char *fmt
, ...)
264 ret
= nbd_negotiate_send_rep_verr(client
, type
, errp
, fmt
, va
);
269 /* Drop remainder of the current option, and send a reply with the
270 * given error type and message. Return -errno on read or write
271 * failure; or 0 if connection is still live. */
272 static int G_GNUC_PRINTF(4, 0)
273 nbd_opt_vdrop(NBDClient
*client
, uint32_t type
, Error
**errp
,
274 const char *fmt
, va_list va
)
276 int ret
= nbd_drop(client
->ioc
, client
->optlen
, errp
);
280 ret
= nbd_negotiate_send_rep_verr(client
, type
, errp
, fmt
, va
);
285 static int G_GNUC_PRINTF(4, 5)
286 nbd_opt_drop(NBDClient
*client
, uint32_t type
, Error
**errp
,
287 const char *fmt
, ...)
293 ret
= nbd_opt_vdrop(client
, type
, errp
, fmt
, va
);
299 static int G_GNUC_PRINTF(3, 4)
300 nbd_opt_invalid(NBDClient
*client
, Error
**errp
, const char *fmt
, ...)
306 ret
= nbd_opt_vdrop(client
, NBD_REP_ERR_INVALID
, errp
, fmt
, va
);
312 /* Read size bytes from the unparsed payload of the current option.
313 * If @check_nul, require that no NUL bytes appear in buffer.
314 * Return -errno on I/O error, 0 if option was completely handled by
315 * sending a reply about inconsistent lengths, or 1 on success. */
316 static int nbd_opt_read(NBDClient
*client
, void *buffer
, size_t size
,
317 bool check_nul
, Error
**errp
)
319 if (size
> client
->optlen
) {
320 return nbd_opt_invalid(client
, errp
,
321 "Inconsistent lengths in option %s",
322 nbd_opt_lookup(client
->opt
));
324 client
->optlen
-= size
;
325 if (qio_channel_read_all(client
->ioc
, buffer
, size
, errp
) < 0) {
329 if (check_nul
&& strnlen(buffer
, size
) != size
) {
330 return nbd_opt_invalid(client
, errp
,
331 "Unexpected embedded NUL in option %s",
332 nbd_opt_lookup(client
->opt
));
337 /* Drop size bytes from the unparsed payload of the current option.
338 * Return -errno on I/O error, 0 if option was completely handled by
339 * sending a reply about inconsistent lengths, or 1 on success. */
340 static int nbd_opt_skip(NBDClient
*client
, size_t size
, Error
**errp
)
342 if (size
> client
->optlen
) {
343 return nbd_opt_invalid(client
, errp
,
344 "Inconsistent lengths in option %s",
345 nbd_opt_lookup(client
->opt
));
347 client
->optlen
-= size
;
348 return nbd_drop(client
->ioc
, size
, errp
) < 0 ? -EIO
: 1;
353 * Read a string with the format:
354 * uint32_t len (<= NBD_MAX_STRING_SIZE)
355 * len bytes string (not 0-terminated)
357 * On success, @name will be allocated.
358 * If @length is non-null, it will be set to the actual string length.
360 * Return -errno on I/O error, 0 if option was completely handled by
361 * sending a reply about inconsistent lengths, or 1 on success.
363 static int nbd_opt_read_name(NBDClient
*client
, char **name
, uint32_t *length
,
368 g_autofree
char *local_name
= NULL
;
371 ret
= nbd_opt_read(client
, &len
, sizeof(len
), false, errp
);
375 len
= cpu_to_be32(len
);
377 if (len
> NBD_MAX_STRING_SIZE
) {
378 return nbd_opt_invalid(client
, errp
,
379 "Invalid name length: %" PRIu32
, len
);
382 local_name
= g_malloc(len
+ 1);
383 ret
= nbd_opt_read(client
, local_name
, len
, true, errp
);
387 local_name
[len
] = '\0';
392 *name
= g_steal_pointer(&local_name
);
397 /* Send a single NBD_REP_SERVER reply to NBD_OPT_LIST, including payload.
398 * Return -errno on error, 0 on success. */
399 static int nbd_negotiate_send_rep_list(NBDClient
*client
, NBDExport
*exp
,
403 size_t name_len
, desc_len
;
405 const char *name
= exp
->name
? exp
->name
: "";
406 const char *desc
= exp
->description
? exp
->description
: "";
407 QIOChannel
*ioc
= client
->ioc
;
410 trace_nbd_negotiate_send_rep_list(name
, desc
);
411 name_len
= strlen(name
);
412 desc_len
= strlen(desc
);
413 assert(name_len
<= NBD_MAX_STRING_SIZE
&& desc_len
<= NBD_MAX_STRING_SIZE
);
414 len
= name_len
+ desc_len
+ sizeof(len
);
415 ret
= nbd_negotiate_send_rep_len(client
, NBD_REP_SERVER
, len
, errp
);
420 len
= cpu_to_be32(name_len
);
421 if (nbd_write(ioc
, &len
, sizeof(len
), errp
) < 0) {
422 error_prepend(errp
, "write failed (name length): ");
426 if (nbd_write(ioc
, name
, name_len
, errp
) < 0) {
427 error_prepend(errp
, "write failed (name buffer): ");
431 if (nbd_write(ioc
, desc
, desc_len
, errp
) < 0) {
432 error_prepend(errp
, "write failed (description buffer): ");
439 /* Process the NBD_OPT_LIST command, with a potential series of replies.
440 * Return -errno on error, 0 on success. */
441 static int nbd_negotiate_handle_list(NBDClient
*client
, Error
**errp
)
444 assert(client
->opt
== NBD_OPT_LIST
);
446 /* For each export, send a NBD_REP_SERVER reply. */
447 QTAILQ_FOREACH(exp
, &exports
, next
) {
448 if (nbd_negotiate_send_rep_list(client
, exp
, errp
)) {
452 /* Finish with a NBD_REP_ACK. */
453 return nbd_negotiate_send_rep(client
, NBD_REP_ACK
, errp
);
456 static void nbd_check_meta_export(NBDClient
*client
)
458 if (client
->exp
!= client
->export_meta
.exp
) {
459 client
->export_meta
.count
= 0;
463 /* Send a reply to NBD_OPT_EXPORT_NAME.
464 * Return -errno on error, 0 on success. */
465 static int nbd_negotiate_handle_export_name(NBDClient
*client
, bool no_zeroes
,
469 g_autofree
char *name
= NULL
;
470 char buf
[NBD_REPLY_EXPORT_NAME_SIZE
] = "";
476 [20 .. xx] export name (length bytes)
479 [ 8 .. 9] export flags
480 [10 .. 133] reserved (0) [unless no_zeroes]
482 trace_nbd_negotiate_handle_export_name();
483 if (client
->optlen
> NBD_MAX_STRING_SIZE
) {
484 error_setg(errp
, "Bad length received");
487 name
= g_malloc(client
->optlen
+ 1);
488 if (nbd_read(client
->ioc
, name
, client
->optlen
, "export name", errp
) < 0) {
491 name
[client
->optlen
] = '\0';
494 trace_nbd_negotiate_handle_export_name_request(name
);
496 client
->exp
= nbd_export_find(name
);
498 error_setg(errp
, "export not found");
502 myflags
= client
->exp
->nbdflags
;
503 if (client
->structured_reply
) {
504 myflags
|= NBD_FLAG_SEND_DF
;
506 trace_nbd_negotiate_new_style_size_flags(client
->exp
->size
, myflags
);
507 stq_be_p(buf
, client
->exp
->size
);
508 stw_be_p(buf
+ 8, myflags
);
509 len
= no_zeroes
? 10 : sizeof(buf
);
510 ret
= nbd_write(client
->ioc
, buf
, len
, errp
);
512 error_prepend(errp
, "write failed: ");
516 QTAILQ_INSERT_TAIL(&client
->exp
->clients
, client
, next
);
517 blk_exp_ref(&client
->exp
->common
);
518 nbd_check_meta_export(client
);
523 /* Send a single NBD_REP_INFO, with a buffer @buf of @length bytes.
524 * The buffer does NOT include the info type prefix.
525 * Return -errno on error, 0 if ready to send more. */
526 static int nbd_negotiate_send_info(NBDClient
*client
,
527 uint16_t info
, uint32_t length
, void *buf
,
532 trace_nbd_negotiate_send_info(info
, nbd_info_lookup(info
), length
);
533 rc
= nbd_negotiate_send_rep_len(client
, NBD_REP_INFO
,
534 sizeof(info
) + length
, errp
);
538 info
= cpu_to_be16(info
);
539 if (nbd_write(client
->ioc
, &info
, sizeof(info
), errp
) < 0) {
542 if (nbd_write(client
->ioc
, buf
, length
, errp
) < 0) {
548 /* nbd_reject_length: Handle any unexpected payload.
549 * @fatal requests that we quit talking to the client, even if we are able
550 * to successfully send an error reply.
552 * -errno transmission error occurred or @fatal was requested, errp is set
553 * 0 error message successfully sent to client, errp is not set
555 static int nbd_reject_length(NBDClient
*client
, bool fatal
, Error
**errp
)
559 assert(client
->optlen
);
560 ret
= nbd_opt_invalid(client
, errp
, "option '%s' has unexpected length",
561 nbd_opt_lookup(client
->opt
));
563 error_setg(errp
, "option '%s' has unexpected length",
564 nbd_opt_lookup(client
->opt
));
570 /* Handle NBD_OPT_INFO and NBD_OPT_GO.
571 * Return -errno on error, 0 if ready for next option, and 1 to move
572 * into transmission phase. */
573 static int nbd_negotiate_handle_info(NBDClient
*client
, Error
**errp
)
576 g_autofree
char *name
= NULL
;
580 uint32_t namelen
= 0;
581 bool sendname
= false;
582 bool blocksize
= false;
584 char buf
[sizeof(uint64_t) + sizeof(uint16_t)];
585 uint32_t check_align
= 0;
589 4 bytes: L, name length (can be 0)
591 2 bytes: N, number of requests (can be 0)
592 N * 2 bytes: N requests
594 rc
= nbd_opt_read_name(client
, &name
, &namelen
, errp
);
598 trace_nbd_negotiate_handle_export_name_request(name
);
600 rc
= nbd_opt_read(client
, &requests
, sizeof(requests
), false, errp
);
604 requests
= be16_to_cpu(requests
);
605 trace_nbd_negotiate_handle_info_requests(requests
);
607 rc
= nbd_opt_read(client
, &request
, sizeof(request
), false, errp
);
611 request
= be16_to_cpu(request
);
612 trace_nbd_negotiate_handle_info_request(request
,
613 nbd_info_lookup(request
));
614 /* We care about NBD_INFO_NAME and NBD_INFO_BLOCK_SIZE;
615 * everything else is either a request we don't know or
616 * something we send regardless of request */
621 case NBD_INFO_BLOCK_SIZE
:
626 if (client
->optlen
) {
627 return nbd_reject_length(client
, false, errp
);
630 exp
= nbd_export_find(name
);
632 g_autofree
char *sane_name
= nbd_sanitize_name(name
);
634 return nbd_negotiate_send_rep_err(client
, NBD_REP_ERR_UNKNOWN
,
635 errp
, "export '%s' not present",
639 /* Don't bother sending NBD_INFO_NAME unless client requested it */
641 rc
= nbd_negotiate_send_info(client
, NBD_INFO_NAME
, namelen
, name
,
648 /* Send NBD_INFO_DESCRIPTION only if available, regardless of
650 if (exp
->description
) {
651 size_t len
= strlen(exp
->description
);
653 assert(len
<= NBD_MAX_STRING_SIZE
);
654 rc
= nbd_negotiate_send_info(client
, NBD_INFO_DESCRIPTION
,
655 len
, exp
->description
, errp
);
661 /* Send NBD_INFO_BLOCK_SIZE always, but tweak the minimum size
662 * according to whether the client requested it, and according to
663 * whether this is OPT_INFO or OPT_GO. */
664 /* minimum - 1 for back-compat, or actual if client will obey it. */
665 if (client
->opt
== NBD_OPT_INFO
|| blocksize
) {
666 check_align
= sizes
[0] = blk_get_request_alignment(exp
->common
.blk
);
670 assert(sizes
[0] <= NBD_MAX_BUFFER_SIZE
);
671 /* preferred - Hard-code to 4096 for now.
672 * TODO: is blk_bs(blk)->bl.opt_transfer appropriate? */
673 sizes
[1] = MAX(4096, sizes
[0]);
674 /* maximum - At most 32M, but smaller as appropriate. */
675 sizes
[2] = MIN(blk_get_max_transfer(exp
->common
.blk
), NBD_MAX_BUFFER_SIZE
);
676 trace_nbd_negotiate_handle_info_block_size(sizes
[0], sizes
[1], sizes
[2]);
677 sizes
[0] = cpu_to_be32(sizes
[0]);
678 sizes
[1] = cpu_to_be32(sizes
[1]);
679 sizes
[2] = cpu_to_be32(sizes
[2]);
680 rc
= nbd_negotiate_send_info(client
, NBD_INFO_BLOCK_SIZE
,
681 sizeof(sizes
), sizes
, errp
);
686 /* Send NBD_INFO_EXPORT always */
687 myflags
= exp
->nbdflags
;
688 if (client
->structured_reply
) {
689 myflags
|= NBD_FLAG_SEND_DF
;
691 trace_nbd_negotiate_new_style_size_flags(exp
->size
, myflags
);
692 stq_be_p(buf
, exp
->size
);
693 stw_be_p(buf
+ 8, myflags
);
694 rc
= nbd_negotiate_send_info(client
, NBD_INFO_EXPORT
,
695 sizeof(buf
), buf
, errp
);
701 * If the client is just asking for NBD_OPT_INFO, but forgot to
702 * request block sizes in a situation that would impact
703 * performance, then return an error. But for NBD_OPT_GO, we
704 * tolerate all clients, regardless of alignments.
706 if (client
->opt
== NBD_OPT_INFO
&& !blocksize
&&
707 blk_get_request_alignment(exp
->common
.blk
) > 1) {
708 return nbd_negotiate_send_rep_err(client
,
709 NBD_REP_ERR_BLOCK_SIZE_REQD
,
711 "request NBD_INFO_BLOCK_SIZE to "
716 rc
= nbd_negotiate_send_rep(client
, NBD_REP_ACK
, errp
);
721 if (client
->opt
== NBD_OPT_GO
) {
723 client
->check_align
= check_align
;
724 QTAILQ_INSERT_TAIL(&client
->exp
->clients
, client
, next
);
725 blk_exp_ref(&client
->exp
->common
);
726 nbd_check_meta_export(client
);
733 /* Handle NBD_OPT_STARTTLS. Return NULL to drop connection, or else the
734 * new channel for all further (now-encrypted) communication. */
735 static QIOChannel
*nbd_negotiate_handle_starttls(NBDClient
*client
,
740 struct NBDTLSHandshakeData data
= { 0 };
742 assert(client
->opt
== NBD_OPT_STARTTLS
);
744 trace_nbd_negotiate_handle_starttls();
747 if (nbd_negotiate_send_rep(client
, NBD_REP_ACK
, errp
) < 0) {
751 tioc
= qio_channel_tls_new_server(ioc
,
759 qio_channel_set_name(QIO_CHANNEL(tioc
), "nbd-server-tls");
760 trace_nbd_negotiate_handle_starttls_handshake();
761 data
.loop
= g_main_loop_new(g_main_context_default(), FALSE
);
762 qio_channel_tls_handshake(tioc
,
768 if (!data
.complete
) {
769 g_main_loop_run(data
.loop
);
771 g_main_loop_unref(data
.loop
);
773 object_unref(OBJECT(tioc
));
774 error_propagate(errp
, data
.error
);
778 return QIO_CHANNEL(tioc
);
781 /* nbd_negotiate_send_meta_context
783 * Send one chunk of reply to NBD_OPT_{LIST,SET}_META_CONTEXT
785 * For NBD_OPT_LIST_META_CONTEXT @context_id is ignored, 0 is used instead.
787 static int nbd_negotiate_send_meta_context(NBDClient
*client
,
792 NBDOptionReplyMetaContext opt
;
793 struct iovec iov
[] = {
794 {.iov_base
= &opt
, .iov_len
= sizeof(opt
)},
795 {.iov_base
= (void *)context
, .iov_len
= strlen(context
)}
798 assert(iov
[1].iov_len
<= NBD_MAX_STRING_SIZE
);
799 if (client
->opt
== NBD_OPT_LIST_META_CONTEXT
) {
803 trace_nbd_negotiate_meta_query_reply(context
, context_id
);
804 set_be_option_rep(&opt
.h
, client
->opt
, NBD_REP_META_CONTEXT
,
805 sizeof(opt
) - sizeof(opt
.h
) + iov
[1].iov_len
);
806 stl_be_p(&opt
.context_id
, context_id
);
808 return qio_channel_writev_all(client
->ioc
, iov
, 2, errp
) < 0 ? -EIO
: 0;
812 * Return true if @query matches @pattern, or if @query is empty when
813 * the @client is performing _LIST_.
815 static bool nbd_meta_empty_or_pattern(NBDClient
*client
, const char *pattern
,
819 trace_nbd_negotiate_meta_query_parse("empty");
820 return client
->opt
== NBD_OPT_LIST_META_CONTEXT
;
822 if (strcmp(query
, pattern
) == 0) {
823 trace_nbd_negotiate_meta_query_parse(pattern
);
826 trace_nbd_negotiate_meta_query_skip("pattern not matched");
831 * Return true and adjust @str in place if it begins with @prefix.
833 static bool nbd_strshift(const char **str
, const char *prefix
)
835 size_t len
= strlen(prefix
);
837 if (strncmp(*str
, prefix
, len
) == 0) {
844 /* nbd_meta_base_query
846 * Handle queries to 'base' namespace. For now, only the base:allocation
847 * context is available. Return true if @query has been handled.
849 static bool nbd_meta_base_query(NBDClient
*client
, NBDExportMetaContexts
*meta
,
852 if (!nbd_strshift(&query
, "base:")) {
855 trace_nbd_negotiate_meta_query_parse("base:");
857 if (nbd_meta_empty_or_pattern(client
, "allocation", query
)) {
858 meta
->base_allocation
= true;
863 /* nbd_meta_qemu_query
865 * Handle queries to 'qemu' namespace. For now, only the qemu:dirty-bitmap:
866 * and qemu:allocation-depth contexts are available. Return true if @query
869 static bool nbd_meta_qemu_query(NBDClient
*client
, NBDExportMetaContexts
*meta
,
874 if (!nbd_strshift(&query
, "qemu:")) {
877 trace_nbd_negotiate_meta_query_parse("qemu:");
880 if (client
->opt
== NBD_OPT_LIST_META_CONTEXT
) {
881 meta
->allocation_depth
= meta
->exp
->allocation_depth
;
882 if (meta
->exp
->nr_export_bitmaps
) {
883 memset(meta
->bitmaps
, 1, meta
->exp
->nr_export_bitmaps
);
886 trace_nbd_negotiate_meta_query_parse("empty");
890 if (strcmp(query
, "allocation-depth") == 0) {
891 trace_nbd_negotiate_meta_query_parse("allocation-depth");
892 meta
->allocation_depth
= meta
->exp
->allocation_depth
;
896 if (nbd_strshift(&query
, "dirty-bitmap:")) {
897 trace_nbd_negotiate_meta_query_parse("dirty-bitmap:");
899 if (client
->opt
== NBD_OPT_LIST_META_CONTEXT
&&
900 meta
->exp
->nr_export_bitmaps
) {
901 memset(meta
->bitmaps
, 1, meta
->exp
->nr_export_bitmaps
);
903 trace_nbd_negotiate_meta_query_parse("empty");
907 for (i
= 0; i
< meta
->exp
->nr_export_bitmaps
; i
++) {
910 bm_name
= bdrv_dirty_bitmap_name(meta
->exp
->export_bitmaps
[i
]);
911 if (strcmp(bm_name
, query
) == 0) {
912 meta
->bitmaps
[i
] = true;
913 trace_nbd_negotiate_meta_query_parse(query
);
917 trace_nbd_negotiate_meta_query_skip("no dirty-bitmap match");
921 trace_nbd_negotiate_meta_query_skip("unknown qemu context");
925 /* nbd_negotiate_meta_query
927 * Parse namespace name and call corresponding function to parse body of the
930 * The only supported namespaces are 'base' and 'qemu'.
932 * Return -errno on I/O error, 0 if option was completely handled by
933 * sending a reply about inconsistent lengths, or 1 on success. */
934 static int nbd_negotiate_meta_query(NBDClient
*client
,
935 NBDExportMetaContexts
*meta
, Error
**errp
)
938 g_autofree
char *query
= NULL
;
941 ret
= nbd_opt_read(client
, &len
, sizeof(len
), false, errp
);
945 len
= cpu_to_be32(len
);
947 if (len
> NBD_MAX_STRING_SIZE
) {
948 trace_nbd_negotiate_meta_query_skip("length too long");
949 return nbd_opt_skip(client
, len
, errp
);
952 query
= g_malloc(len
+ 1);
953 ret
= nbd_opt_read(client
, query
, len
, true, errp
);
959 if (nbd_meta_base_query(client
, meta
, query
)) {
962 if (nbd_meta_qemu_query(client
, meta
, query
)) {
966 trace_nbd_negotiate_meta_query_skip("unknown namespace");
970 /* nbd_negotiate_meta_queries
971 * Handle NBD_OPT_LIST_META_CONTEXT and NBD_OPT_SET_META_CONTEXT
973 * Return -errno on I/O error, or 0 if option was completely handled. */
974 static int nbd_negotiate_meta_queries(NBDClient
*client
,
975 NBDExportMetaContexts
*meta
, Error
**errp
)
978 g_autofree
char *export_name
= NULL
;
979 /* Mark unused to work around https://bugs.llvm.org/show_bug.cgi?id=3888 */
980 g_autofree G_GNUC_UNUSED
bool *bitmaps
= NULL
;
981 NBDExportMetaContexts local_meta
= {0};
986 if (client
->opt
== NBD_OPT_SET_META_CONTEXT
&& !client
->structured_reply
) {
987 return nbd_opt_invalid(client
, errp
,
988 "request option '%s' when structured reply "
990 nbd_opt_lookup(client
->opt
));
993 if (client
->opt
== NBD_OPT_LIST_META_CONTEXT
) {
994 /* Only change the caller's meta on SET. */
998 g_free(meta
->bitmaps
);
999 memset(meta
, 0, sizeof(*meta
));
1001 ret
= nbd_opt_read_name(client
, &export_name
, NULL
, errp
);
1006 meta
->exp
= nbd_export_find(export_name
);
1007 if (meta
->exp
== NULL
) {
1008 g_autofree
char *sane_name
= nbd_sanitize_name(export_name
);
1010 return nbd_opt_drop(client
, NBD_REP_ERR_UNKNOWN
, errp
,
1011 "export '%s' not present", sane_name
);
1013 meta
->bitmaps
= g_new0(bool, meta
->exp
->nr_export_bitmaps
);
1014 if (client
->opt
== NBD_OPT_LIST_META_CONTEXT
) {
1015 bitmaps
= meta
->bitmaps
;
1018 ret
= nbd_opt_read(client
, &nb_queries
, sizeof(nb_queries
), false, errp
);
1022 nb_queries
= cpu_to_be32(nb_queries
);
1023 trace_nbd_negotiate_meta_context(nbd_opt_lookup(client
->opt
),
1024 export_name
, nb_queries
);
1026 if (client
->opt
== NBD_OPT_LIST_META_CONTEXT
&& !nb_queries
) {
1027 /* enable all known contexts */
1028 meta
->base_allocation
= true;
1029 meta
->allocation_depth
= meta
->exp
->allocation_depth
;
1030 if (meta
->exp
->nr_export_bitmaps
) {
1031 memset(meta
->bitmaps
, 1, meta
->exp
->nr_export_bitmaps
);
1034 for (i
= 0; i
< nb_queries
; ++i
) {
1035 ret
= nbd_negotiate_meta_query(client
, meta
, errp
);
1042 if (meta
->base_allocation
) {
1043 ret
= nbd_negotiate_send_meta_context(client
, "base:allocation",
1044 NBD_META_ID_BASE_ALLOCATION
,
1052 if (meta
->allocation_depth
) {
1053 ret
= nbd_negotiate_send_meta_context(client
, "qemu:allocation-depth",
1054 NBD_META_ID_ALLOCATION_DEPTH
,
1062 for (i
= 0; i
< meta
->exp
->nr_export_bitmaps
; i
++) {
1063 const char *bm_name
;
1064 g_autofree
char *context
= NULL
;
1066 if (!meta
->bitmaps
[i
]) {
1070 bm_name
= bdrv_dirty_bitmap_name(meta
->exp
->export_bitmaps
[i
]);
1071 context
= g_strdup_printf("qemu:dirty-bitmap:%s", bm_name
);
1073 ret
= nbd_negotiate_send_meta_context(client
, context
,
1074 NBD_META_ID_DIRTY_BITMAP
+ i
,
1082 ret
= nbd_negotiate_send_rep(client
, NBD_REP_ACK
, errp
);
1084 meta
->count
= count
;
1090 /* nbd_negotiate_options
1091 * Process all NBD_OPT_* client option commands, during fixed newstyle
1094 * -errno on error, errp is set
1095 * 0 on successful negotiation, errp is not set
1096 * 1 if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
1099 static int nbd_negotiate_options(NBDClient
*client
, Error
**errp
)
1102 bool fixedNewstyle
= false;
1103 bool no_zeroes
= false;
1106 [ 0 .. 3] client flags
1108 Then we loop until NBD_OPT_EXPORT_NAME or NBD_OPT_GO:
1109 [ 0 .. 7] NBD_OPTS_MAGIC
1110 [ 8 .. 11] NBD option
1111 [12 .. 15] Data length
1114 [ 0 .. 7] NBD_OPTS_MAGIC
1115 [ 8 .. 11] Second NBD option
1116 [12 .. 15] Data length
1120 if (nbd_read32(client
->ioc
, &flags
, "flags", errp
) < 0) {
1123 trace_nbd_negotiate_options_flags(flags
);
1124 if (flags
& NBD_FLAG_C_FIXED_NEWSTYLE
) {
1125 fixedNewstyle
= true;
1126 flags
&= ~NBD_FLAG_C_FIXED_NEWSTYLE
;
1128 if (flags
& NBD_FLAG_C_NO_ZEROES
) {
1130 flags
&= ~NBD_FLAG_C_NO_ZEROES
;
1133 error_setg(errp
, "Unknown client flags 0x%" PRIx32
" received", flags
);
1139 uint32_t option
, length
;
1142 if (nbd_read64(client
->ioc
, &magic
, "opts magic", errp
) < 0) {
1145 trace_nbd_negotiate_options_check_magic(magic
);
1146 if (magic
!= NBD_OPTS_MAGIC
) {
1147 error_setg(errp
, "Bad magic received");
1151 if (nbd_read32(client
->ioc
, &option
, "option", errp
) < 0) {
1154 client
->opt
= option
;
1156 if (nbd_read32(client
->ioc
, &length
, "option length", errp
) < 0) {
1159 assert(!client
->optlen
);
1160 client
->optlen
= length
;
1162 if (length
> NBD_MAX_BUFFER_SIZE
) {
1163 error_setg(errp
, "len (%" PRIu32
" ) is larger than max len (%u)",
1164 length
, NBD_MAX_BUFFER_SIZE
);
1168 trace_nbd_negotiate_options_check_option(option
,
1169 nbd_opt_lookup(option
));
1170 if (client
->tlscreds
&&
1171 client
->ioc
== (QIOChannel
*)client
->sioc
) {
1173 if (!fixedNewstyle
) {
1174 error_setg(errp
, "Unsupported option 0x%" PRIx32
, option
);
1178 case NBD_OPT_STARTTLS
:
1180 /* Unconditionally drop the connection if the client
1181 * can't start a TLS negotiation correctly */
1182 return nbd_reject_length(client
, true, errp
);
1184 tioc
= nbd_negotiate_handle_starttls(client
, errp
);
1189 object_unref(OBJECT(client
->ioc
));
1190 client
->ioc
= QIO_CHANNEL(tioc
);
1193 case NBD_OPT_EXPORT_NAME
:
1194 /* No way to return an error to client, so drop connection */
1195 error_setg(errp
, "Option 0x%x not permitted before TLS",
1200 /* Let the client keep trying, unless they asked to
1201 * quit. Always try to give an error back to the
1202 * client; but when replying to OPT_ABORT, be aware
1203 * that the client may hang up before receiving the
1204 * error, in which case we are fine ignoring the
1205 * resulting EPIPE. */
1206 ret
= nbd_opt_drop(client
, NBD_REP_ERR_TLS_REQD
,
1207 option
== NBD_OPT_ABORT
? NULL
: errp
,
1209 " not permitted before TLS", option
);
1210 if (option
== NBD_OPT_ABORT
) {
1215 } else if (fixedNewstyle
) {
1219 ret
= nbd_reject_length(client
, false, errp
);
1221 ret
= nbd_negotiate_handle_list(client
, errp
);
1226 /* NBD spec says we must try to reply before
1227 * disconnecting, but that we must also tolerate
1228 * guests that don't wait for our reply. */
1229 nbd_negotiate_send_rep(client
, NBD_REP_ACK
, NULL
);
1232 case NBD_OPT_EXPORT_NAME
:
1233 return nbd_negotiate_handle_export_name(client
, no_zeroes
,
1238 ret
= nbd_negotiate_handle_info(client
, errp
);
1240 assert(option
== NBD_OPT_GO
);
1245 case NBD_OPT_STARTTLS
:
1247 ret
= nbd_reject_length(client
, false, errp
);
1248 } else if (client
->tlscreds
) {
1249 ret
= nbd_negotiate_send_rep_err(client
,
1250 NBD_REP_ERR_INVALID
, errp
,
1251 "TLS already enabled");
1253 ret
= nbd_negotiate_send_rep_err(client
,
1254 NBD_REP_ERR_POLICY
, errp
,
1255 "TLS not configured");
1259 case NBD_OPT_STRUCTURED_REPLY
:
1261 ret
= nbd_reject_length(client
, false, errp
);
1262 } else if (client
->structured_reply
) {
1263 ret
= nbd_negotiate_send_rep_err(
1264 client
, NBD_REP_ERR_INVALID
, errp
,
1265 "structured reply already negotiated");
1267 ret
= nbd_negotiate_send_rep(client
, NBD_REP_ACK
, errp
);
1268 client
->structured_reply
= true;
1272 case NBD_OPT_LIST_META_CONTEXT
:
1273 case NBD_OPT_SET_META_CONTEXT
:
1274 ret
= nbd_negotiate_meta_queries(client
, &client
->export_meta
,
1279 ret
= nbd_opt_drop(client
, NBD_REP_ERR_UNSUP
, errp
,
1280 "Unsupported option %" PRIu32
" (%s)",
1281 option
, nbd_opt_lookup(option
));
1286 * If broken new-style we should drop the connection
1287 * for anything except NBD_OPT_EXPORT_NAME
1290 case NBD_OPT_EXPORT_NAME
:
1291 return nbd_negotiate_handle_export_name(client
, no_zeroes
,
1295 error_setg(errp
, "Unsupported option %" PRIu32
" (%s)",
1296 option
, nbd_opt_lookup(option
));
1308 * -errno on error, errp is set
1309 * 0 on successful negotiation, errp is not set
1310 * 1 if client sent NBD_OPT_ABORT, i.e. on valid disconnect,
1313 static coroutine_fn
int nbd_negotiate(NBDClient
*client
, Error
**errp
)
1316 char buf
[NBD_OLDSTYLE_NEGOTIATE_SIZE
] = "";
1319 /* Old style negotiation header, no room for options
1320 [ 0 .. 7] passwd ("NBDMAGIC")
1321 [ 8 .. 15] magic (NBD_CLIENT_MAGIC)
1323 [24 .. 27] export flags (zero-extended)
1324 [28 .. 151] reserved (0)
1326 New style negotiation header, client can send options
1327 [ 0 .. 7] passwd ("NBDMAGIC")
1328 [ 8 .. 15] magic (NBD_OPTS_MAGIC)
1329 [16 .. 17] server flags (0)
1330 ....options sent, ending in NBD_OPT_EXPORT_NAME or NBD_OPT_GO....
1333 qio_channel_set_blocking(client
->ioc
, false, NULL
);
1335 trace_nbd_negotiate_begin();
1336 memcpy(buf
, "NBDMAGIC", 8);
1338 stq_be_p(buf
+ 8, NBD_OPTS_MAGIC
);
1339 stw_be_p(buf
+ 16, NBD_FLAG_FIXED_NEWSTYLE
| NBD_FLAG_NO_ZEROES
);
1341 if (nbd_write(client
->ioc
, buf
, 18, errp
) < 0) {
1342 error_prepend(errp
, "write failed: ");
1345 ret
= nbd_negotiate_options(client
, errp
);
1348 error_prepend(errp
, "option negotiation failed: ");
1353 /* Attach the channel to the same AioContext as the export */
1354 if (client
->exp
&& client
->exp
->common
.ctx
) {
1355 qio_channel_attach_aio_context(client
->ioc
, client
->exp
->common
.ctx
);
1358 assert(!client
->optlen
);
1359 trace_nbd_negotiate_success();
1365 * Tries to read @size bytes from @ioc. This is a local implementation of
1366 * qio_channel_readv_all_eof. We have it here because we need it to be
1367 * interruptible and to know when the coroutine is yielding.
1368 * Returns 1 on success
1369 * 0 on eof, when no data was read (errp is not set)
1370 * negative errno on failure (errp is set)
1372 static inline int coroutine_fn
1373 nbd_read_eof(NBDClient
*client
, void *buffer
, size_t size
, Error
**errp
)
1375 bool partial
= false;
1379 struct iovec iov
= { .iov_base
= buffer
, .iov_len
= size
};
1382 len
= qio_channel_readv(client
->ioc
, &iov
, 1, errp
);
1383 if (len
== QIO_CHANNEL_ERR_BLOCK
) {
1384 client
->read_yielding
= true;
1385 qio_channel_yield(client
->ioc
, G_IO_IN
);
1386 client
->read_yielding
= false;
1387 if (client
->quiescing
) {
1391 } else if (len
< 0) {
1393 } else if (len
== 0) {
1396 "Unexpected end-of-file before all bytes were read");
1405 buffer
= (uint8_t *) buffer
+ len
;
1410 static int nbd_receive_request(NBDClient
*client
, NBDRequest
*request
,
1413 uint8_t buf
[NBD_REQUEST_SIZE
];
1417 ret
= nbd_read_eof(client
, buf
, sizeof(buf
), errp
);
1426 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
1427 [ 4 .. 5] flags (NBD_CMD_FLAG_FUA, ...)
1428 [ 6 .. 7] type (NBD_CMD_READ, ...)
1434 magic
= ldl_be_p(buf
);
1435 request
->flags
= lduw_be_p(buf
+ 4);
1436 request
->type
= lduw_be_p(buf
+ 6);
1437 request
->handle
= ldq_be_p(buf
+ 8);
1438 request
->from
= ldq_be_p(buf
+ 16);
1439 request
->len
= ldl_be_p(buf
+ 24);
1441 trace_nbd_receive_request(magic
, request
->flags
, request
->type
,
1442 request
->from
, request
->len
);
1444 if (magic
!= NBD_REQUEST_MAGIC
) {
1445 error_setg(errp
, "invalid magic (got 0x%" PRIx32
")", magic
);
1451 #define MAX_NBD_REQUESTS 16
1453 void nbd_client_get(NBDClient
*client
)
1458 void nbd_client_put(NBDClient
*client
)
1460 if (--client
->refcount
== 0) {
1461 /* The last reference should be dropped by client->close,
1462 * which is called by client_close.
1464 assert(client
->closing
);
1466 qio_channel_detach_aio_context(client
->ioc
);
1467 object_unref(OBJECT(client
->sioc
));
1468 object_unref(OBJECT(client
->ioc
));
1469 if (client
->tlscreds
) {
1470 object_unref(OBJECT(client
->tlscreds
));
1472 g_free(client
->tlsauthz
);
1474 QTAILQ_REMOVE(&client
->exp
->clients
, client
, next
);
1475 blk_exp_unref(&client
->exp
->common
);
1477 g_free(client
->export_meta
.bitmaps
);
1482 static void client_close(NBDClient
*client
, bool negotiated
)
1484 if (client
->closing
) {
1488 client
->closing
= true;
1490 /* Force requests to finish. They will drop their own references,
1491 * then we'll close the socket and free the NBDClient.
1493 qio_channel_shutdown(client
->ioc
, QIO_CHANNEL_SHUTDOWN_BOTH
,
1496 /* Also tell the client, so that they release their reference. */
1497 if (client
->close_fn
) {
1498 client
->close_fn(client
, negotiated
);
1502 static NBDRequestData
*nbd_request_get(NBDClient
*client
)
1504 NBDRequestData
*req
;
1506 assert(client
->nb_requests
<= MAX_NBD_REQUESTS
- 1);
1507 client
->nb_requests
++;
1509 req
= g_new0(NBDRequestData
, 1);
1510 nbd_client_get(client
);
1511 req
->client
= client
;
1515 static void nbd_request_put(NBDRequestData
*req
)
1517 NBDClient
*client
= req
->client
;
1520 qemu_vfree(req
->data
);
1524 client
->nb_requests
--;
1526 if (client
->quiescing
&& client
->nb_requests
== 0) {
1530 nbd_client_receive_next_request(client
);
1532 nbd_client_put(client
);
1535 static void blk_aio_attached(AioContext
*ctx
, void *opaque
)
1537 NBDExport
*exp
= opaque
;
1540 trace_nbd_blk_aio_attached(exp
->name
, ctx
);
1542 exp
->common
.ctx
= ctx
;
1544 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
1545 qio_channel_attach_aio_context(client
->ioc
, ctx
);
1547 assert(client
->nb_requests
== 0);
1548 assert(client
->recv_coroutine
== NULL
);
1549 assert(client
->send_coroutine
== NULL
);
1553 static void blk_aio_detach(void *opaque
)
1555 NBDExport
*exp
= opaque
;
1558 trace_nbd_blk_aio_detach(exp
->name
, exp
->common
.ctx
);
1560 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
1561 qio_channel_detach_aio_context(client
->ioc
);
1564 exp
->common
.ctx
= NULL
;
1567 static void nbd_drained_begin(void *opaque
)
1569 NBDExport
*exp
= opaque
;
1572 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
1573 client
->quiescing
= true;
1577 static void nbd_drained_end(void *opaque
)
1579 NBDExport
*exp
= opaque
;
1582 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
1583 client
->quiescing
= false;
1584 nbd_client_receive_next_request(client
);
1588 static bool nbd_drained_poll(void *opaque
)
1590 NBDExport
*exp
= opaque
;
1593 QTAILQ_FOREACH(client
, &exp
->clients
, next
) {
1594 if (client
->nb_requests
!= 0) {
1596 * If there's a coroutine waiting for a request on nbd_read_eof()
1597 * enter it here so we don't depend on the client to wake it up.
1599 if (client
->recv_coroutine
!= NULL
&& client
->read_yielding
) {
1600 qemu_aio_coroutine_enter(exp
->common
.ctx
,
1601 client
->recv_coroutine
);
1611 static void nbd_eject_notifier(Notifier
*n
, void *data
)
1613 NBDExport
*exp
= container_of(n
, NBDExport
, eject_notifier
);
1615 blk_exp_request_shutdown(&exp
->common
);
1618 void nbd_export_set_on_eject_blk(BlockExport
*exp
, BlockBackend
*blk
)
1620 NBDExport
*nbd_exp
= container_of(exp
, NBDExport
, common
);
1621 assert(exp
->drv
== &blk_exp_nbd
);
1622 assert(nbd_exp
->eject_notifier_blk
== NULL
);
1625 nbd_exp
->eject_notifier_blk
= blk
;
1626 nbd_exp
->eject_notifier
.notify
= nbd_eject_notifier
;
1627 blk_add_remove_bs_notifier(blk
, &nbd_exp
->eject_notifier
);
1630 static const BlockDevOps nbd_block_ops
= {
1631 .drained_begin
= nbd_drained_begin
,
1632 .drained_end
= nbd_drained_end
,
1633 .drained_poll
= nbd_drained_poll
,
1636 static int nbd_export_create(BlockExport
*blk_exp
, BlockExportOptions
*exp_args
,
1639 NBDExport
*exp
= container_of(blk_exp
, NBDExport
, common
);
1640 BlockExportOptionsNbd
*arg
= &exp_args
->u
.nbd
;
1641 BlockBackend
*blk
= blk_exp
->blk
;
1643 uint64_t perm
, shared_perm
;
1644 bool readonly
= !exp_args
->writable
;
1645 BlockDirtyBitmapOrStrList
*bitmaps
;
1649 assert(exp_args
->type
== BLOCK_EXPORT_TYPE_NBD
);
1651 if (!nbd_server_is_running()) {
1652 error_setg(errp
, "NBD server not running");
1656 if (!arg
->has_name
) {
1657 arg
->name
= exp_args
->node_name
;
1660 if (strlen(arg
->name
) > NBD_MAX_STRING_SIZE
) {
1661 error_setg(errp
, "export name '%s' too long", arg
->name
);
1665 if (arg
->description
&& strlen(arg
->description
) > NBD_MAX_STRING_SIZE
) {
1666 error_setg(errp
, "description '%s' too long", arg
->description
);
1670 if (nbd_export_find(arg
->name
)) {
1671 error_setg(errp
, "NBD server already has export named '%s'", arg
->name
);
1675 size
= blk_getlength(blk
);
1677 error_setg_errno(errp
, -size
,
1678 "Failed to determine the NBD export's length");
1682 /* Don't allow resize while the NBD server is running, otherwise we don't
1683 * care what happens with the node. */
1684 blk_get_perm(blk
, &perm
, &shared_perm
);
1685 ret
= blk_set_perm(blk
, perm
, shared_perm
& ~BLK_PERM_RESIZE
, errp
);
1690 QTAILQ_INIT(&exp
->clients
);
1691 exp
->name
= g_strdup(arg
->name
);
1692 exp
->description
= g_strdup(arg
->description
);
1693 exp
->nbdflags
= (NBD_FLAG_HAS_FLAGS
| NBD_FLAG_SEND_FLUSH
|
1694 NBD_FLAG_SEND_FUA
| NBD_FLAG_SEND_CACHE
);
1696 if (nbd_server_max_connections() != 1) {
1697 exp
->nbdflags
|= NBD_FLAG_CAN_MULTI_CONN
;
1700 exp
->nbdflags
|= NBD_FLAG_READ_ONLY
;
1702 exp
->nbdflags
|= (NBD_FLAG_SEND_TRIM
| NBD_FLAG_SEND_WRITE_ZEROES
|
1703 NBD_FLAG_SEND_FAST_ZERO
);
1705 exp
->size
= QEMU_ALIGN_DOWN(size
, BDRV_SECTOR_SIZE
);
1707 for (bitmaps
= arg
->bitmaps
; bitmaps
; bitmaps
= bitmaps
->next
) {
1708 exp
->nr_export_bitmaps
++;
1710 exp
->export_bitmaps
= g_new0(BdrvDirtyBitmap
*, exp
->nr_export_bitmaps
);
1711 for (i
= 0, bitmaps
= arg
->bitmaps
; bitmaps
;
1712 i
++, bitmaps
= bitmaps
->next
)
1715 BlockDriverState
*bs
= blk_bs(blk
);
1716 BdrvDirtyBitmap
*bm
= NULL
;
1718 switch (bitmaps
->value
->type
) {
1720 bitmap
= bitmaps
->value
->u
.local
;
1722 bm
= bdrv_find_dirty_bitmap(bs
, bitmap
);
1727 bs
= bdrv_filter_or_cow_bs(bs
);
1732 error_setg(errp
, "Bitmap '%s' is not found",
1733 bitmaps
->value
->u
.local
);
1737 if (readonly
&& bdrv_is_writable(bs
) &&
1738 bdrv_dirty_bitmap_enabled(bm
)) {
1740 error_setg(errp
, "Enabled bitmap '%s' incompatible with "
1741 "readonly export", bitmap
);
1746 bitmap
= bitmaps
->value
->u
.external
.name
;
1747 bm
= block_dirty_bitmap_lookup(bitmaps
->value
->u
.external
.node
,
1748 bitmap
, NULL
, errp
);
1760 if (bdrv_dirty_bitmap_check(bm
, BDRV_BITMAP_ALLOW_RO
, errp
)) {
1765 exp
->export_bitmaps
[i
] = bm
;
1766 assert(strlen(bitmap
) <= BDRV_BITMAP_MAX_NAME_SIZE
);
1769 /* Mark bitmaps busy in a separate loop, to simplify roll-back concerns. */
1770 for (i
= 0; i
< exp
->nr_export_bitmaps
; i
++) {
1771 bdrv_dirty_bitmap_set_busy(exp
->export_bitmaps
[i
], true);
1774 exp
->allocation_depth
= arg
->allocation_depth
;
1777 * We need to inhibit request queuing in the block layer to ensure we can
1778 * be properly quiesced when entering a drained section, as our coroutines
1779 * servicing pending requests might enter blk_pread().
1781 blk_set_disable_request_queuing(blk
, true);
1783 blk_add_aio_context_notifier(blk
, blk_aio_attached
, blk_aio_detach
, exp
);
1785 blk_set_dev_ops(blk
, &nbd_block_ops
, exp
);
1787 QTAILQ_INSERT_TAIL(&exports
, exp
, next
);
1792 g_free(exp
->export_bitmaps
);
1794 g_free(exp
->description
);
1798 NBDExport
*nbd_export_find(const char *name
)
1801 QTAILQ_FOREACH(exp
, &exports
, next
) {
1802 if (strcmp(name
, exp
->name
) == 0) {
1811 nbd_export_aio_context(NBDExport
*exp
)
1813 return exp
->common
.ctx
;
1816 static void nbd_export_request_shutdown(BlockExport
*blk_exp
)
1818 NBDExport
*exp
= container_of(blk_exp
, NBDExport
, common
);
1819 NBDClient
*client
, *next
;
1821 blk_exp_ref(&exp
->common
);
1823 * TODO: Should we expand QMP NbdServerRemoveNode enum to allow a
1824 * close mode that stops advertising the export to new clients but
1825 * still permits existing clients to run to completion? Because of
1826 * that possibility, nbd_export_close() can be called more than
1827 * once on an export.
1829 QTAILQ_FOREACH_SAFE(client
, &exp
->clients
, next
, next
) {
1830 client_close(client
, true);
1835 QTAILQ_REMOVE(&exports
, exp
, next
);
1837 blk_exp_unref(&exp
->common
);
1840 static void nbd_export_delete(BlockExport
*blk_exp
)
1843 NBDExport
*exp
= container_of(blk_exp
, NBDExport
, common
);
1845 assert(exp
->name
== NULL
);
1846 assert(QTAILQ_EMPTY(&exp
->clients
));
1848 g_free(exp
->description
);
1849 exp
->description
= NULL
;
1851 if (exp
->common
.blk
) {
1852 if (exp
->eject_notifier_blk
) {
1853 notifier_remove(&exp
->eject_notifier
);
1854 blk_unref(exp
->eject_notifier_blk
);
1856 blk_remove_aio_context_notifier(exp
->common
.blk
, blk_aio_attached
,
1857 blk_aio_detach
, exp
);
1858 blk_set_disable_request_queuing(exp
->common
.blk
, false);
1861 for (i
= 0; i
< exp
->nr_export_bitmaps
; i
++) {
1862 bdrv_dirty_bitmap_set_busy(exp
->export_bitmaps
[i
], false);
1866 const BlockExportDriver blk_exp_nbd
= {
1867 .type
= BLOCK_EXPORT_TYPE_NBD
,
1868 .instance_size
= sizeof(NBDExport
),
1869 .create
= nbd_export_create
,
1870 .delete = nbd_export_delete
,
1871 .request_shutdown
= nbd_export_request_shutdown
,
1874 static int coroutine_fn
nbd_co_send_iov(NBDClient
*client
, struct iovec
*iov
,
1875 unsigned niov
, Error
**errp
)
1879 g_assert(qemu_in_coroutine());
1880 qemu_co_mutex_lock(&client
->send_lock
);
1881 client
->send_coroutine
= qemu_coroutine_self();
1883 ret
= qio_channel_writev_all(client
->ioc
, iov
, niov
, errp
) < 0 ? -EIO
: 0;
1885 client
->send_coroutine
= NULL
;
1886 qemu_co_mutex_unlock(&client
->send_lock
);
1891 static inline void set_be_simple_reply(NBDSimpleReply
*reply
, uint64_t error
,
1894 stl_be_p(&reply
->magic
, NBD_SIMPLE_REPLY_MAGIC
);
1895 stl_be_p(&reply
->error
, error
);
1896 stq_be_p(&reply
->handle
, handle
);
1899 static int nbd_co_send_simple_reply(NBDClient
*client
,
1906 NBDSimpleReply reply
;
1907 int nbd_err
= system_errno_to_nbd_errno(error
);
1908 struct iovec iov
[] = {
1909 {.iov_base
= &reply
, .iov_len
= sizeof(reply
)},
1910 {.iov_base
= data
, .iov_len
= len
}
1913 trace_nbd_co_send_simple_reply(handle
, nbd_err
, nbd_err_lookup(nbd_err
),
1915 set_be_simple_reply(&reply
, nbd_err
, handle
);
1917 return nbd_co_send_iov(client
, iov
, len
? 2 : 1, errp
);
1920 static inline void set_be_chunk(NBDStructuredReplyChunk
*chunk
, uint16_t flags
,
1921 uint16_t type
, uint64_t handle
, uint32_t length
)
1923 stl_be_p(&chunk
->magic
, NBD_STRUCTURED_REPLY_MAGIC
);
1924 stw_be_p(&chunk
->flags
, flags
);
1925 stw_be_p(&chunk
->type
, type
);
1926 stq_be_p(&chunk
->handle
, handle
);
1927 stl_be_p(&chunk
->length
, length
);
1930 static int coroutine_fn
nbd_co_send_structured_done(NBDClient
*client
,
1934 NBDStructuredReplyChunk chunk
;
1935 struct iovec iov
[] = {
1936 {.iov_base
= &chunk
, .iov_len
= sizeof(chunk
)},
1939 trace_nbd_co_send_structured_done(handle
);
1940 set_be_chunk(&chunk
, NBD_REPLY_FLAG_DONE
, NBD_REPLY_TYPE_NONE
, handle
, 0);
1942 return nbd_co_send_iov(client
, iov
, 1, errp
);
1945 static int coroutine_fn
nbd_co_send_structured_read(NBDClient
*client
,
1953 NBDStructuredReadData chunk
;
1954 struct iovec iov
[] = {
1955 {.iov_base
= &chunk
, .iov_len
= sizeof(chunk
)},
1956 {.iov_base
= data
, .iov_len
= size
}
1960 trace_nbd_co_send_structured_read(handle
, offset
, data
, size
);
1961 set_be_chunk(&chunk
.h
, final
? NBD_REPLY_FLAG_DONE
: 0,
1962 NBD_REPLY_TYPE_OFFSET_DATA
, handle
,
1963 sizeof(chunk
) - sizeof(chunk
.h
) + size
);
1964 stq_be_p(&chunk
.offset
, offset
);
1966 return nbd_co_send_iov(client
, iov
, 2, errp
);
1969 static int coroutine_fn
nbd_co_send_structured_error(NBDClient
*client
,
1975 NBDStructuredError chunk
;
1976 int nbd_err
= system_errno_to_nbd_errno(error
);
1977 struct iovec iov
[] = {
1978 {.iov_base
= &chunk
, .iov_len
= sizeof(chunk
)},
1979 {.iov_base
= (char *)msg
, .iov_len
= msg
? strlen(msg
) : 0},
1983 trace_nbd_co_send_structured_error(handle
, nbd_err
,
1984 nbd_err_lookup(nbd_err
), msg
? msg
: "");
1985 set_be_chunk(&chunk
.h
, NBD_REPLY_FLAG_DONE
, NBD_REPLY_TYPE_ERROR
, handle
,
1986 sizeof(chunk
) - sizeof(chunk
.h
) + iov
[1].iov_len
);
1987 stl_be_p(&chunk
.error
, nbd_err
);
1988 stw_be_p(&chunk
.message_length
, iov
[1].iov_len
);
1990 return nbd_co_send_iov(client
, iov
, 1 + !!iov
[1].iov_len
, errp
);
1993 /* Do a sparse read and send the structured reply to the client.
1994 * Returns -errno if sending fails. bdrv_block_status_above() failure is
1995 * reported to the client, at which point this function succeeds.
1997 static int coroutine_fn
nbd_co_send_sparse_read(NBDClient
*client
,
2005 NBDExport
*exp
= client
->exp
;
2006 size_t progress
= 0;
2008 while (progress
< size
) {
2010 int status
= bdrv_block_status_above(blk_bs(exp
->common
.blk
), NULL
,
2012 size
- progress
, &pnum
, NULL
,
2017 char *msg
= g_strdup_printf("unable to check for holes: %s",
2020 ret
= nbd_co_send_structured_error(client
, handle
, -status
, msg
,
2025 assert(pnum
&& pnum
<= size
- progress
);
2026 final
= progress
+ pnum
== size
;
2027 if (status
& BDRV_BLOCK_ZERO
) {
2028 NBDStructuredReadHole chunk
;
2029 struct iovec iov
[] = {
2030 {.iov_base
= &chunk
, .iov_len
= sizeof(chunk
)},
2033 trace_nbd_co_send_structured_read_hole(handle
, offset
+ progress
,
2035 set_be_chunk(&chunk
.h
, final
? NBD_REPLY_FLAG_DONE
: 0,
2036 NBD_REPLY_TYPE_OFFSET_HOLE
,
2037 handle
, sizeof(chunk
) - sizeof(chunk
.h
));
2038 stq_be_p(&chunk
.offset
, offset
+ progress
);
2039 stl_be_p(&chunk
.length
, pnum
);
2040 ret
= nbd_co_send_iov(client
, iov
, 1, errp
);
2042 ret
= blk_pread(exp
->common
.blk
, offset
+ progress
,
2043 data
+ progress
, pnum
);
2045 error_setg_errno(errp
, -ret
, "reading from file failed");
2048 ret
= nbd_co_send_structured_read(client
, handle
, offset
+ progress
,
2049 data
+ progress
, pnum
, final
,
2061 typedef struct NBDExtentArray
{
2063 unsigned int nb_alloc
;
2065 uint64_t total_length
;
2067 bool converted_to_be
;
2070 static NBDExtentArray
*nbd_extent_array_new(unsigned int nb_alloc
)
2072 NBDExtentArray
*ea
= g_new0(NBDExtentArray
, 1);
2074 ea
->nb_alloc
= nb_alloc
;
2075 ea
->extents
= g_new(NBDExtent
, nb_alloc
);
2081 static void nbd_extent_array_free(NBDExtentArray
*ea
)
2083 g_free(ea
->extents
);
2086 G_DEFINE_AUTOPTR_CLEANUP_FUNC(NBDExtentArray
, nbd_extent_array_free
)
2088 /* Further modifications of the array after conversion are abandoned */
2089 static void nbd_extent_array_convert_to_be(NBDExtentArray
*ea
)
2093 assert(!ea
->converted_to_be
);
2094 ea
->can_add
= false;
2095 ea
->converted_to_be
= true;
2097 for (i
= 0; i
< ea
->count
; i
++) {
2098 ea
->extents
[i
].flags
= cpu_to_be32(ea
->extents
[i
].flags
);
2099 ea
->extents
[i
].length
= cpu_to_be32(ea
->extents
[i
].length
);
2104 * Add extent to NBDExtentArray. If extent can't be added (no available space),
2106 * For safety, when returning -1 for the first time, .can_add is set to false,
2107 * and further calls to nbd_extent_array_add() will crash.
2108 * (this avoids the situation where a caller ignores failure to add one extent,
2109 * where adding another extent that would squash into the last array entry
2110 * would result in an incorrect range reported to the client)
2112 static int nbd_extent_array_add(NBDExtentArray
*ea
,
2113 uint32_t length
, uint32_t flags
)
2115 assert(ea
->can_add
);
2121 /* Extend previous extent if flags are the same */
2122 if (ea
->count
> 0 && flags
== ea
->extents
[ea
->count
- 1].flags
) {
2123 uint64_t sum
= (uint64_t)length
+ ea
->extents
[ea
->count
- 1].length
;
2125 if (sum
<= UINT32_MAX
) {
2126 ea
->extents
[ea
->count
- 1].length
= sum
;
2127 ea
->total_length
+= length
;
2132 if (ea
->count
>= ea
->nb_alloc
) {
2133 ea
->can_add
= false;
2137 ea
->total_length
+= length
;
2138 ea
->extents
[ea
->count
] = (NBDExtent
) {.length
= length
, .flags
= flags
};
2144 static int blockstatus_to_extents(BlockDriverState
*bs
, uint64_t offset
,
2145 uint64_t bytes
, NBDExtentArray
*ea
)
2150 int ret
= bdrv_block_status_above(bs
, NULL
, offset
, bytes
, &num
,
2157 flags
= (ret
& BDRV_BLOCK_DATA
? 0 : NBD_STATE_HOLE
) |
2158 (ret
& BDRV_BLOCK_ZERO
? NBD_STATE_ZERO
: 0);
2160 if (nbd_extent_array_add(ea
, num
, flags
) < 0) {
2171 static int blockalloc_to_extents(BlockDriverState
*bs
, uint64_t offset
,
2172 uint64_t bytes
, NBDExtentArray
*ea
)
2176 int ret
= bdrv_is_allocated_above(bs
, NULL
, false, offset
, bytes
,
2183 if (nbd_extent_array_add(ea
, num
, ret
) < 0) {
2195 * nbd_co_send_extents
2197 * @ea is converted to BE by the function
2198 * @last controls whether NBD_REPLY_FLAG_DONE is sent.
2200 static int nbd_co_send_extents(NBDClient
*client
, uint64_t handle
,
2202 bool last
, uint32_t context_id
, Error
**errp
)
2204 NBDStructuredMeta chunk
;
2205 struct iovec iov
[] = {
2206 {.iov_base
= &chunk
, .iov_len
= sizeof(chunk
)},
2207 {.iov_base
= ea
->extents
, .iov_len
= ea
->count
* sizeof(ea
->extents
[0])}
2210 nbd_extent_array_convert_to_be(ea
);
2212 trace_nbd_co_send_extents(handle
, ea
->count
, context_id
, ea
->total_length
,
2214 set_be_chunk(&chunk
.h
, last
? NBD_REPLY_FLAG_DONE
: 0,
2215 NBD_REPLY_TYPE_BLOCK_STATUS
,
2216 handle
, sizeof(chunk
) - sizeof(chunk
.h
) + iov
[1].iov_len
);
2217 stl_be_p(&chunk
.context_id
, context_id
);
2219 return nbd_co_send_iov(client
, iov
, 2, errp
);
2222 /* Get block status from the exported device and send it to the client */
2223 static int nbd_co_send_block_status(NBDClient
*client
, uint64_t handle
,
2224 BlockDriverState
*bs
, uint64_t offset
,
2225 uint32_t length
, bool dont_fragment
,
2226 bool last
, uint32_t context_id
,
2230 unsigned int nb_extents
= dont_fragment
? 1 : NBD_MAX_BLOCK_STATUS_EXTENTS
;
2231 g_autoptr(NBDExtentArray
) ea
= nbd_extent_array_new(nb_extents
);
2233 if (context_id
== NBD_META_ID_BASE_ALLOCATION
) {
2234 ret
= blockstatus_to_extents(bs
, offset
, length
, ea
);
2236 ret
= blockalloc_to_extents(bs
, offset
, length
, ea
);
2239 return nbd_co_send_structured_error(
2240 client
, handle
, -ret
, "can't get block status", errp
);
2243 return nbd_co_send_extents(client
, handle
, ea
, last
, context_id
, errp
);
2246 /* Populate @ea from a dirty bitmap. */
2247 static void bitmap_to_extents(BdrvDirtyBitmap
*bitmap
,
2248 uint64_t offset
, uint64_t length
,
2251 int64_t start
, dirty_start
, dirty_count
;
2252 int64_t end
= offset
+ length
;
2255 bdrv_dirty_bitmap_lock(bitmap
);
2257 for (start
= offset
;
2258 bdrv_dirty_bitmap_next_dirty_area(bitmap
, start
, end
, INT32_MAX
,
2259 &dirty_start
, &dirty_count
);
2260 start
= dirty_start
+ dirty_count
)
2262 if ((nbd_extent_array_add(es
, dirty_start
- start
, 0) < 0) ||
2263 (nbd_extent_array_add(es
, dirty_count
, NBD_STATE_DIRTY
) < 0))
2271 /* last non dirty extent, nothing to do if array is now full */
2272 (void) nbd_extent_array_add(es
, end
- start
, 0);
2275 bdrv_dirty_bitmap_unlock(bitmap
);
2278 static int nbd_co_send_bitmap(NBDClient
*client
, uint64_t handle
,
2279 BdrvDirtyBitmap
*bitmap
, uint64_t offset
,
2280 uint32_t length
, bool dont_fragment
, bool last
,
2281 uint32_t context_id
, Error
**errp
)
2283 unsigned int nb_extents
= dont_fragment
? 1 : NBD_MAX_BLOCK_STATUS_EXTENTS
;
2284 g_autoptr(NBDExtentArray
) ea
= nbd_extent_array_new(nb_extents
);
2286 bitmap_to_extents(bitmap
, offset
, length
, ea
);
2288 return nbd_co_send_extents(client
, handle
, ea
, last
, context_id
, errp
);
2291 /* nbd_co_receive_request
2292 * Collect a client request. Return 0 if request looks valid, -EIO to drop
2293 * connection right away, -EAGAIN to indicate we were interrupted and the
2294 * channel should be quiesced, and any other negative value to report an error
2295 * to the client (although the caller may still need to disconnect after
2296 * reporting the error).
2298 static int nbd_co_receive_request(NBDRequestData
*req
, NBDRequest
*request
,
2301 NBDClient
*client
= req
->client
;
2305 g_assert(qemu_in_coroutine());
2306 assert(client
->recv_coroutine
== qemu_coroutine_self());
2307 ret
= nbd_receive_request(client
, request
, errp
);
2312 trace_nbd_co_receive_request_decode_type(request
->handle
, request
->type
,
2313 nbd_cmd_lookup(request
->type
));
2315 if (request
->type
!= NBD_CMD_WRITE
) {
2316 /* No payload, we are ready to read the next request. */
2317 req
->complete
= true;
2320 if (request
->type
== NBD_CMD_DISC
) {
2321 /* Special case: we're going to disconnect without a reply,
2322 * whether or not flags, from, or len are bogus */
2326 if (request
->type
== NBD_CMD_READ
|| request
->type
== NBD_CMD_WRITE
||
2327 request
->type
== NBD_CMD_CACHE
)
2329 if (request
->len
> NBD_MAX_BUFFER_SIZE
) {
2330 error_setg(errp
, "len (%" PRIu32
" ) is larger than max len (%u)",
2331 request
->len
, NBD_MAX_BUFFER_SIZE
);
2335 if (request
->type
!= NBD_CMD_CACHE
) {
2336 req
->data
= blk_try_blockalign(client
->exp
->common
.blk
,
2338 if (req
->data
== NULL
) {
2339 error_setg(errp
, "No memory");
2345 if (request
->type
== NBD_CMD_WRITE
) {
2346 if (nbd_read(client
->ioc
, req
->data
, request
->len
, "CMD_WRITE data",
2351 req
->complete
= true;
2353 trace_nbd_co_receive_request_payload_received(request
->handle
,
2357 /* Sanity checks. */
2358 if (client
->exp
->nbdflags
& NBD_FLAG_READ_ONLY
&&
2359 (request
->type
== NBD_CMD_WRITE
||
2360 request
->type
== NBD_CMD_WRITE_ZEROES
||
2361 request
->type
== NBD_CMD_TRIM
)) {
2362 error_setg(errp
, "Export is read-only");
2365 if (request
->from
> client
->exp
->size
||
2366 request
->len
> client
->exp
->size
- request
->from
) {
2367 error_setg(errp
, "operation past EOF; From: %" PRIu64
", Len: %" PRIu32
2368 ", Size: %" PRIu64
, request
->from
, request
->len
,
2370 return (request
->type
== NBD_CMD_WRITE
||
2371 request
->type
== NBD_CMD_WRITE_ZEROES
) ? -ENOSPC
: -EINVAL
;
2373 if (client
->check_align
&& !QEMU_IS_ALIGNED(request
->from
| request
->len
,
2374 client
->check_align
)) {
2376 * The block layer gracefully handles unaligned requests, but
2377 * it's still worth tracing client non-compliance
2379 trace_nbd_co_receive_align_compliance(nbd_cmd_lookup(request
->type
),
2382 client
->check_align
);
2384 valid_flags
= NBD_CMD_FLAG_FUA
;
2385 if (request
->type
== NBD_CMD_READ
&& client
->structured_reply
) {
2386 valid_flags
|= NBD_CMD_FLAG_DF
;
2387 } else if (request
->type
== NBD_CMD_WRITE_ZEROES
) {
2388 valid_flags
|= NBD_CMD_FLAG_NO_HOLE
| NBD_CMD_FLAG_FAST_ZERO
;
2389 } else if (request
->type
== NBD_CMD_BLOCK_STATUS
) {
2390 valid_flags
|= NBD_CMD_FLAG_REQ_ONE
;
2392 if (request
->flags
& ~valid_flags
) {
2393 error_setg(errp
, "unsupported flags for command %s (got 0x%x)",
2394 nbd_cmd_lookup(request
->type
), request
->flags
);
2401 /* Send simple reply without a payload, or a structured error
2402 * @error_msg is ignored if @ret >= 0
2403 * Returns 0 if connection is still live, -errno on failure to talk to client
2405 static coroutine_fn
int nbd_send_generic_reply(NBDClient
*client
,
2408 const char *error_msg
,
2411 if (client
->structured_reply
&& ret
< 0) {
2412 return nbd_co_send_structured_error(client
, handle
, -ret
, error_msg
,
2415 return nbd_co_send_simple_reply(client
, handle
, ret
< 0 ? -ret
: 0,
2420 /* Handle NBD_CMD_READ request.
2421 * Return -errno if sending fails. Other errors are reported directly to the
2422 * client as an error reply. */
2423 static coroutine_fn
int nbd_do_cmd_read(NBDClient
*client
, NBDRequest
*request
,
2424 uint8_t *data
, Error
**errp
)
2427 NBDExport
*exp
= client
->exp
;
2429 assert(request
->type
== NBD_CMD_READ
);
2431 /* XXX: NBD Protocol only documents use of FUA with WRITE */
2432 if (request
->flags
& NBD_CMD_FLAG_FUA
) {
2433 ret
= blk_co_flush(exp
->common
.blk
);
2435 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2436 "flush failed", errp
);
2440 if (client
->structured_reply
&& !(request
->flags
& NBD_CMD_FLAG_DF
) &&
2443 return nbd_co_send_sparse_read(client
, request
->handle
, request
->from
,
2444 data
, request
->len
, errp
);
2447 ret
= blk_pread(exp
->common
.blk
, request
->from
, data
, request
->len
);
2449 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2450 "reading from file failed", errp
);
2453 if (client
->structured_reply
) {
2455 return nbd_co_send_structured_read(client
, request
->handle
,
2456 request
->from
, data
,
2457 request
->len
, true, errp
);
2459 return nbd_co_send_structured_done(client
, request
->handle
, errp
);
2462 return nbd_co_send_simple_reply(client
, request
->handle
, 0,
2463 data
, request
->len
, errp
);
2470 * Handle NBD_CMD_CACHE request.
2471 * Return -errno if sending fails. Other errors are reported directly to the
2472 * client as an error reply.
2474 static coroutine_fn
int nbd_do_cmd_cache(NBDClient
*client
, NBDRequest
*request
,
2478 NBDExport
*exp
= client
->exp
;
2480 assert(request
->type
== NBD_CMD_CACHE
);
2482 ret
= blk_co_preadv(exp
->common
.blk
, request
->from
, request
->len
,
2483 NULL
, BDRV_REQ_COPY_ON_READ
| BDRV_REQ_PREFETCH
);
2485 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2486 "caching data failed", errp
);
2489 /* Handle NBD request.
2490 * Return -errno if sending fails. Other errors are reported directly to the
2491 * client as an error reply. */
2492 static coroutine_fn
int nbd_handle_request(NBDClient
*client
,
2493 NBDRequest
*request
,
2494 uint8_t *data
, Error
**errp
)
2498 NBDExport
*exp
= client
->exp
;
2502 switch (request
->type
) {
2504 return nbd_do_cmd_cache(client
, request
, errp
);
2507 return nbd_do_cmd_read(client
, request
, data
, errp
);
2511 if (request
->flags
& NBD_CMD_FLAG_FUA
) {
2512 flags
|= BDRV_REQ_FUA
;
2514 ret
= blk_pwrite(exp
->common
.blk
, request
->from
, data
, request
->len
,
2516 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2517 "writing to file failed", errp
);
2519 case NBD_CMD_WRITE_ZEROES
:
2521 if (request
->flags
& NBD_CMD_FLAG_FUA
) {
2522 flags
|= BDRV_REQ_FUA
;
2524 if (!(request
->flags
& NBD_CMD_FLAG_NO_HOLE
)) {
2525 flags
|= BDRV_REQ_MAY_UNMAP
;
2527 if (request
->flags
& NBD_CMD_FLAG_FAST_ZERO
) {
2528 flags
|= BDRV_REQ_NO_FALLBACK
;
2530 ret
= blk_pwrite_zeroes(exp
->common
.blk
, request
->from
, request
->len
,
2532 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2533 "writing to file failed", errp
);
2536 /* unreachable, thanks to special case in nbd_co_receive_request() */
2540 ret
= blk_co_flush(exp
->common
.blk
);
2541 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2542 "flush failed", errp
);
2545 ret
= blk_co_pdiscard(exp
->common
.blk
, request
->from
, request
->len
);
2546 if (ret
>= 0 && request
->flags
& NBD_CMD_FLAG_FUA
) {
2547 ret
= blk_co_flush(exp
->common
.blk
);
2549 return nbd_send_generic_reply(client
, request
->handle
, ret
,
2550 "discard failed", errp
);
2552 case NBD_CMD_BLOCK_STATUS
:
2553 if (!request
->len
) {
2554 return nbd_send_generic_reply(client
, request
->handle
, -EINVAL
,
2555 "need non-zero length", errp
);
2557 if (client
->export_meta
.count
) {
2558 bool dont_fragment
= request
->flags
& NBD_CMD_FLAG_REQ_ONE
;
2559 int contexts_remaining
= client
->export_meta
.count
;
2561 if (client
->export_meta
.base_allocation
) {
2562 ret
= nbd_co_send_block_status(client
, request
->handle
,
2563 blk_bs(exp
->common
.blk
),
2565 request
->len
, dont_fragment
,
2566 !--contexts_remaining
,
2567 NBD_META_ID_BASE_ALLOCATION
,
2574 if (client
->export_meta
.allocation_depth
) {
2575 ret
= nbd_co_send_block_status(client
, request
->handle
,
2576 blk_bs(exp
->common
.blk
),
2577 request
->from
, request
->len
,
2579 !--contexts_remaining
,
2580 NBD_META_ID_ALLOCATION_DEPTH
,
2587 for (i
= 0; i
< client
->exp
->nr_export_bitmaps
; i
++) {
2588 if (!client
->export_meta
.bitmaps
[i
]) {
2591 ret
= nbd_co_send_bitmap(client
, request
->handle
,
2592 client
->exp
->export_bitmaps
[i
],
2593 request
->from
, request
->len
,
2594 dont_fragment
, !--contexts_remaining
,
2595 NBD_META_ID_DIRTY_BITMAP
+ i
, errp
);
2601 assert(!contexts_remaining
);
2605 return nbd_send_generic_reply(client
, request
->handle
, -EINVAL
,
2606 "CMD_BLOCK_STATUS not negotiated",
2611 msg
= g_strdup_printf("invalid request type (%" PRIu32
") received",
2613 ret
= nbd_send_generic_reply(client
, request
->handle
, -EINVAL
, msg
,
2620 /* Owns a reference to the NBDClient passed as opaque. */
2621 static coroutine_fn
void nbd_trip(void *opaque
)
2623 NBDClient
*client
= opaque
;
2624 NBDRequestData
*req
;
2625 NBDRequest request
= { 0 }; /* GCC thinks it can be used uninitialized */
2627 Error
*local_err
= NULL
;
2630 if (client
->closing
) {
2631 nbd_client_put(client
);
2635 if (client
->quiescing
) {
2637 * We're switching between AIO contexts. Don't attempt to receive a new
2638 * request and kick the main context which may be waiting for us.
2640 nbd_client_put(client
);
2641 client
->recv_coroutine
= NULL
;
2646 req
= nbd_request_get(client
);
2647 ret
= nbd_co_receive_request(req
, &request
, &local_err
);
2648 client
->recv_coroutine
= NULL
;
2650 if (client
->closing
) {
2652 * The client may be closed when we are blocked in
2653 * nbd_co_receive_request()
2658 if (ret
== -EAGAIN
) {
2659 assert(client
->quiescing
);
2663 nbd_client_receive_next_request(client
);
2669 /* It wasn't -EIO, so, according to nbd_co_receive_request()
2670 * semantics, we should return the error to the client. */
2671 Error
*export_err
= local_err
;
2674 ret
= nbd_send_generic_reply(client
, request
.handle
, -EINVAL
,
2675 error_get_pretty(export_err
), &local_err
);
2676 error_free(export_err
);
2678 ret
= nbd_handle_request(client
, &request
, req
->data
, &local_err
);
2681 error_prepend(&local_err
, "Failed to send reply: ");
2685 /* We must disconnect after NBD_CMD_WRITE if we did not
2688 if (!req
->complete
) {
2689 error_setg(&local_err
, "Request handling failed in intermediate state");
2694 nbd_request_put(req
);
2695 nbd_client_put(client
);
2700 error_reportf_err(local_err
, "Disconnect client, due to: ");
2702 nbd_request_put(req
);
2703 client_close(client
, true);
2704 nbd_client_put(client
);
2707 static void nbd_client_receive_next_request(NBDClient
*client
)
2709 if (!client
->recv_coroutine
&& client
->nb_requests
< MAX_NBD_REQUESTS
&&
2710 !client
->quiescing
) {
2711 nbd_client_get(client
);
2712 client
->recv_coroutine
= qemu_coroutine_create(nbd_trip
, client
);
2713 aio_co_schedule(client
->exp
->common
.ctx
, client
->recv_coroutine
);
2717 static coroutine_fn
void nbd_co_client_start(void *opaque
)
2719 NBDClient
*client
= opaque
;
2720 Error
*local_err
= NULL
;
2722 qemu_co_mutex_init(&client
->send_lock
);
2724 if (nbd_negotiate(client
, &local_err
)) {
2726 error_report_err(local_err
);
2728 client_close(client
, false);
2732 nbd_client_receive_next_request(client
);
2736 * Create a new client listener using the given channel @sioc.
2737 * Begin servicing it in a coroutine. When the connection closes, call
2738 * @close_fn with an indication of whether the client completed negotiation.
2740 void nbd_client_new(QIOChannelSocket
*sioc
,
2741 QCryptoTLSCreds
*tlscreds
,
2742 const char *tlsauthz
,
2743 void (*close_fn
)(NBDClient
*, bool))
2748 client
= g_new0(NBDClient
, 1);
2749 client
->refcount
= 1;
2750 client
->tlscreds
= tlscreds
;
2752 object_ref(OBJECT(client
->tlscreds
));
2754 client
->tlsauthz
= g_strdup(tlsauthz
);
2755 client
->sioc
= sioc
;
2756 object_ref(OBJECT(client
->sioc
));
2757 client
->ioc
= QIO_CHANNEL(sioc
);
2758 object_ref(OBJECT(client
->ioc
));
2759 client
->close_fn
= close_fn
;
2761 co
= qemu_coroutine_create(nbd_co_client_start
, client
);
2762 qemu_coroutine_enter(co
);