[qemu.git] / nbd.c

/*
 *  Copyright (C) 2005  Anthony Liguori <[email protected]>
 *
 *  Network Block Device
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; under version 2 of the License.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 */

#include "nbd.h"

#include <errno.h>
#include <string.h>
#ifndef _WIN32
#include <sys/ioctl.h>
#endif
#ifdef __sun__
#include <sys/ioccom.h>
#endif
#include <ctype.h>
#include <inttypes.h>

#include "qemu_socket.h"

//#define DEBUG_NBD

#ifdef DEBUG_NBD
#define TRACE(msg, ...) do { \
    LOG(msg, ## __VA_ARGS__); \
} while(0)
#else
#define TRACE(msg, ...) \
    do { } while (0)
#endif

#define LOG(msg, ...) do { \
    fprintf(stderr, "%s:%s():L%d: " msg "\n", \
            __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
} while(0)

/* This is all part of the "official" NBD API */

#define NBD_REQUEST_MAGIC       0x25609513
#define NBD_REPLY_MAGIC         0x67446698

#define NBD_SET_SOCK            _IO(0xab, 0)
#define NBD_SET_BLKSIZE         _IO(0xab, 1)
#define NBD_SET_SIZE            _IO(0xab, 2)
#define NBD_DO_IT               _IO(0xab, 3)
#define NBD_CLEAR_SOCK          _IO(0xab, 4)
#define NBD_CLEAR_QUE           _IO(0xab, 5)
#define NBD_PRINT_DEBUG	        _IO(0xab, 6)
#define NBD_SET_SIZE_BLOCKS	_IO(0xab, 7)
#define NBD_DISCONNECT          _IO(0xab, 8)

/* That's all folks */

#define read_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, true)
#define write_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, false)

size_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
{
    size_t offset = 0;

    while (offset < size) {
        ssize_t len;

        if (do_read) {
            len = recv(fd, buffer + offset, size - offset, 0);
        } else {
            len = send(fd, buffer + offset, size - offset, 0);
        }

        if (len == -1)
            errno = socket_error();

        /* recoverable error */
        if (len == -1 && (errno == EAGAIN || errno == EINTR)) {
            continue;
        }

        /* eof */
        if (len == 0) {
            break;
        }

        /* unrecoverable error */
        if (len == -1) {
            return 0;
        }

        offset += len;
    }

    return offset;
}

int tcp_socket_outgoing(const char *address, uint16_t port)
{
    int s;
    struct in_addr in;
    struct sockaddr_in addr;

    s = socket(PF_INET, SOCK_STREAM, 0);
    if (s == -1) {
        return -1;
    }

    if (inet_aton(address, &in) == 0) {
        struct hostent *ent;

        ent = gethostbyname(address);
        if (ent == NULL) {
            goto error;
        }

        memcpy(&in, ent->h_addr, sizeof(in));
    }

    addr.sin_family = AF_INET;
    addr.sin_port = htons(port);
    memcpy(&addr.sin_addr.s_addr, &in, sizeof(in));

    if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
        goto error;
    }

    return s;
error:
    closesocket(s);
    return -1;
}

int tcp_socket_incoming(const char *address, uint16_t port)
{
    int s;
    struct in_addr in;
    struct sockaddr_in addr;
    int opt;

    s = socket(PF_INET, SOCK_STREAM, 0);
    if (s == -1) {
        return -1;
    }

    if (inet_aton(address, &in) == 0) {
        struct hostent *ent;

        ent = gethostbyname(address);
        if (ent == NULL) {
            goto error;
        }

        memcpy(&in, ent->h_addr, sizeof(in));
    }

    addr.sin_family = AF_INET;
    addr.sin_port = htons(port);
    memcpy(&addr.sin_addr.s_addr, &in, sizeof(in));

    opt = 1;
    if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
                   (const void *) &opt, sizeof(opt)) == -1) {
        goto error;
    }

    if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
        goto error;
    }

    if (listen(s, 128) == -1) {
        goto error;
    }

    return s;
error:
    closesocket(s);
    return -1;
}

#ifndef _WIN32
int unix_socket_incoming(const char *path)
{
    int s;
    struct sockaddr_un addr;

    s = socket(PF_UNIX, SOCK_STREAM, 0);
    if (s == -1) {
        return -1;
    }

    memset(&addr, 0, sizeof(addr));
    addr.sun_family = AF_UNIX;
    pstrcpy(addr.sun_path, sizeof(addr.sun_path), path);

    if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
        goto error;
    }

    if (listen(s, 128) == -1) {
        goto error;
    }

    return s;
error:
    closesocket(s);
    return -1;
}

int unix_socket_outgoing(const char *path)
{
    int s;
    struct sockaddr_un addr;

    s = socket(PF_UNIX, SOCK_STREAM, 0);
    if (s == -1) {
        return -1;
    }

    memset(&addr, 0, sizeof(addr));
    addr.sun_family = AF_UNIX;
    pstrcpy(addr.sun_path, sizeof(addr.sun_path), path);

    if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
        goto error;
    }

    return s;
error:
    closesocket(s);
    return -1;
}
#else
int unix_socket_incoming(const char *path)
{
    errno = ENOTSUP;
    return -1;
}

int unix_socket_outgoing(const char *path)
{
    errno = ENOTSUP;
    return -1;
}
#endif


/* Basic flow

   Server         Client

   Negotiate
                  Request
   Response
                  Request
   Response
                  ...
   ...
                  Request (type == 2)
*/

int nbd_negotiate(int csock, off_t size)
{
	char buf[8 + 8 + 8 + 128];

	/* Negotiate
	   [ 0 ..   7]   passwd   ("NBDMAGIC")
	   [ 8 ..  15]   magic    (0x00420281861253)
	   [16 ..  23]   size
	   [24 .. 151]   reserved (0)
	 */

	TRACE("Beginning negotiation.");
	memcpy(buf, "NBDMAGIC", 8);
	cpu_to_be64w((uint64_t*)(buf + 8), 0x00420281861253LL);
	cpu_to_be64w((uint64_t*)(buf + 16), size);
	memset(buf + 24, 0, 128);

	if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
		LOG("write failed");
		errno = EINVAL;
		return -1;
	}

	TRACE("Negotation succeeded.");

	return 0;
}

int nbd_receive_negotiate(int csock, off_t *size, size_t *blocksize)
{
	char buf[8 + 8 + 8 + 128];
	uint64_t magic;

	TRACE("Receiving negotation.");

	if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
		LOG("read failed");
		errno = EINVAL;
		return -1;
	}

	magic = be64_to_cpup((uint64_t*)(buf + 8));
	*size = be64_to_cpup((uint64_t*)(buf + 16));
	*blocksize = 1024;

	TRACE("Magic is %c%c%c%c%c%c%c%c",
	      qemu_isprint(buf[0]) ? buf[0] : '.',
	      qemu_isprint(buf[1]) ? buf[1] : '.',
	      qemu_isprint(buf[2]) ? buf[2] : '.',
	      qemu_isprint(buf[3]) ? buf[3] : '.',
	      qemu_isprint(buf[4]) ? buf[4] : '.',
	      qemu_isprint(buf[5]) ? buf[5] : '.',
	      qemu_isprint(buf[6]) ? buf[6] : '.',
	      qemu_isprint(buf[7]) ? buf[7] : '.');
	TRACE("Magic is 0x%" PRIx64, magic);
	TRACE("Size is %" PRIu64, *size);

	if (memcmp(buf, "NBDMAGIC", 8) != 0) {
		LOG("Invalid magic received");
		errno = EINVAL;
		return -1;
	}

	TRACE("Checking magic");

	if (magic != 0x00420281861253LL) {
		LOG("Bad magic received");
		errno = EINVAL;
		return -1;
	}
        return 0;
}

#ifndef _WIN32
int nbd_init(int fd, int csock, off_t size, size_t blocksize)
{
	TRACE("Setting block size to %lu", (unsigned long)blocksize);

	if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) == -1) {
		int serrno = errno;
		LOG("Failed setting NBD block size");
		errno = serrno;
		return -1;
	}

        TRACE("Setting size to %zd block(s)", (size_t)(size / blocksize));

	if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) == -1) {
		int serrno = errno;
		LOG("Failed setting size (in blocks)");
		errno = serrno;
		return -1;
	}

	TRACE("Clearing NBD socket");

	if (ioctl(fd, NBD_CLEAR_SOCK) == -1) {
		int serrno = errno;
		LOG("Failed clearing NBD socket");
		errno = serrno;
		return -1;
	}

	TRACE("Setting NBD socket");

	if (ioctl(fd, NBD_SET_SOCK, csock) == -1) {
		int serrno = errno;
		LOG("Failed to set NBD socket");
		errno = serrno;
		return -1;
	}

	TRACE("Negotiation ended");

	return 0;
}

int nbd_disconnect(int fd)
{
	ioctl(fd, NBD_CLEAR_QUE);
	ioctl(fd, NBD_DISCONNECT);
	ioctl(fd, NBD_CLEAR_SOCK);
	return 0;
}

int nbd_client(int fd, int csock)
{
	int ret;
	int serrno;

	TRACE("Doing NBD loop");

	ret = ioctl(fd, NBD_DO_IT);
	serrno = errno;

	TRACE("NBD loop returned %d: %s", ret, strerror(serrno));

	TRACE("Clearing NBD queue");
	ioctl(fd, NBD_CLEAR_QUE);

	TRACE("Clearing NBD socket");
	ioctl(fd, NBD_CLEAR_SOCK);

	errno = serrno;
	return ret;
}
#else
int nbd_init(int fd, int csock, off_t size, size_t blocksize)
{
    errno = ENOTSUP;
    return -1;
}

int nbd_disconnect(int fd)
{
    errno = ENOTSUP;
    return -1;
}

int nbd_client(int fd, int csock)
{
    errno = ENOTSUP;
    return -1;
}
#endif

int nbd_send_request(int csock, struct nbd_request *request)
{
	uint8_t buf[4 + 4 + 8 + 8 + 4];

	cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
	cpu_to_be32w((uint32_t*)(buf + 4), request->type);
	cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
	cpu_to_be64w((uint64_t*)(buf + 16), request->from);
	cpu_to_be32w((uint32_t*)(buf + 24), request->len);

	TRACE("Sending request to client");

	if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
		LOG("writing to socket failed");
		errno = EINVAL;
		return -1;
	}
	return 0;
}


static int nbd_receive_request(int csock, struct nbd_request *request)
{
	uint8_t buf[4 + 4 + 8 + 8 + 4];
	uint32_t magic;

	if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
		LOG("read failed");
		errno = EINVAL;
		return -1;
	}

	/* Request
	   [ 0 ..  3]   magic   (NBD_REQUEST_MAGIC)
	   [ 4 ..  7]   type    (0 == READ, 1 == WRITE)
	   [ 8 .. 15]   handle
	   [16 .. 23]   from
	   [24 .. 27]   len
	 */

	magic = be32_to_cpup((uint32_t*)buf);
	request->type  = be32_to_cpup((uint32_t*)(buf + 4));
	request->handle = be64_to_cpup((uint64_t*)(buf + 8));
	request->from  = be64_to_cpup((uint64_t*)(buf + 16));
	request->len   = be32_to_cpup((uint32_t*)(buf + 24));

	TRACE("Got request: "
	      "{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
	      magic, request->type, request->from, request->len);

	if (magic != NBD_REQUEST_MAGIC) {
		LOG("invalid magic (got 0x%x)", magic);
		errno = EINVAL;
		return -1;
	}
	return 0;
}

int nbd_receive_reply(int csock, struct nbd_reply *reply)
{
	uint8_t buf[4 + 4 + 8];
	uint32_t magic;

	memset(buf, 0xAA, sizeof(buf));

	if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
		LOG("read failed");
		errno = EINVAL;
		return -1;
	}

	/* Reply
	   [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
	   [ 4 ..  7]    error   (0 == no error)
	   [ 7 .. 15]    handle
	 */

	magic = be32_to_cpup((uint32_t*)buf);
	reply->error  = be32_to_cpup((uint32_t*)(buf + 4));
	reply->handle = be64_to_cpup((uint64_t*)(buf + 8));

	TRACE("Got reply: "
	      "{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
	      magic, reply->error, reply->handle);

	if (magic != NBD_REPLY_MAGIC) {
		LOG("invalid magic (got 0x%x)", magic);
		errno = EINVAL;
		return -1;
	}
	return 0;
}

static int nbd_send_reply(int csock, struct nbd_reply *reply)
{
	uint8_t buf[4 + 4 + 8];

	/* Reply
	   [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)
	   [ 4 ..  7]    error   (0 == no error)
	   [ 7 .. 15]    handle
	 */
	cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
	cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
	cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);

	TRACE("Sending response to client");

	if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
		LOG("writing to socket failed");
		errno = EINVAL;
		return -1;
	}
	return 0;
}

int nbd_trip(BlockDriverState *bs, int csock, off_t size, uint64_t dev_offset,
             off_t *offset, bool readonly, uint8_t *data, int data_size)
{
	struct nbd_request request;
	struct nbd_reply reply;

	TRACE("Reading request.");

	if (nbd_receive_request(csock, &request) == -1)
		return -1;

	if (request.len > data_size) {
		LOG("len (%u) is larger than max len (%u)",
		    request.len, data_size);
		errno = EINVAL;
		return -1;
	}

	if ((request.from + request.len) < request.from) {
		LOG("integer overflow detected! "
		    "you're probably being attacked");
		errno = EINVAL;
		return -1;
	}

	if ((request.from + request.len) > size) {
	        LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
		    ", Offset: %" PRIu64 "\n",
                    request.from, request.len, (uint64_t)size, dev_offset);
		LOG("requested operation past EOF--bad client?");
		errno = EINVAL;
		return -1;
	}

	TRACE("Decoding type");

	reply.handle = request.handle;
	reply.error = 0;

	switch (request.type) {
	case NBD_CMD_READ:
		TRACE("Request type is READ");

		if (bdrv_read(bs, (request.from + dev_offset) / 512, data,
			      request.len / 512) == -1) {
			LOG("reading from file failed");
			errno = EINVAL;
			return -1;
		}
		*offset += request.len;

		TRACE("Read %u byte(s)", request.len);

		if (nbd_send_reply(csock, &reply) == -1)
			return -1;

		TRACE("Sending data to client");

		if (write_sync(csock, data, request.len) != request.len) {
			LOG("writing to socket failed");
			errno = EINVAL;
			return -1;
		}
		break;
	case NBD_CMD_WRITE:
		TRACE("Request type is WRITE");

		TRACE("Reading %u byte(s)", request.len);

		if (read_sync(csock, data, request.len) != request.len) {
			LOG("reading from socket failed");
			errno = EINVAL;
			return -1;
		}

		if (readonly) {
			TRACE("Server is read-only, return error");
			reply.error = 1;
		} else {
			TRACE("Writing to device");

			if (bdrv_write(bs, (request.from + dev_offset) / 512,
				       data, request.len / 512) == -1) {
				LOG("writing to file failed");
				errno = EINVAL;
				return -1;
			}

			*offset += request.len;
		}

		if (nbd_send_reply(csock, &reply) == -1)
			return -1;
		break;
	case NBD_CMD_DISC:
		TRACE("Request type is DISCONNECT");
		errno = 0;
		return 1;
	default:
		LOG("invalid request type (%u) received", request.type);
		errno = EINVAL;
		return -1;
	}

	TRACE("Request/Reply complete");

	return 0;
}
Commit	Line	Data
75818250	1	/*
7a5ca864 FB	2	* Copyright (C) 2005 Anthony Liguori <[email protected]>
	3	*
	4	* Network Block Device
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License as published by
	8	* the Free Software Foundation; under version 2 of the License.
	9	*
	10	* This program is distributed in the hope that it will be useful,
	11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	* GNU General Public License for more details.
	14	*
	15	* You should have received a copy of the GNU General Public License
8167ee88	16	* along with this program; if not, see <http://www.gnu.org/licenses/>.
75818250	17	*/
7a5ca864 FB	18
	19	#include "nbd.h"
	20
	21	#include <errno.h>
	22	#include <string.h>
03ff3ca3	23	#ifndef _WIN32
7a5ca864	24	#include <sys/ioctl.h>
03ff3ca3	25	#endif
7e00eb9b AL	26	#ifdef __sun__
	27	#include <sys/ioccom.h>
	28	#endif
7a5ca864 FB	29	#include <ctype.h>
7a5ca864 FB	30	#include <inttypes.h>
75818250	31
03ff3ca3 AL	32	#include "qemu_socket.h"
	33
	34	//#define DEBUG_NBD
	35
	36	#ifdef DEBUG_NBD
75818250	37	#define TRACE(msg, ...) do { \
03ff3ca3	38	LOG(msg, ## __VA_ARGS__); \
75818250	39	} while(0)
03ff3ca3 AL	40	#else
	41	#define TRACE(msg, ...) \
	42	do { } while (0)
	43	#endif
7a5ca864 FB	44
	45	#define LOG(msg, ...) do { \
	46	fprintf(stderr, "%s:%s():L%d: " msg "\n", \
	47	__FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
	48	} while(0)
	49
7a5ca864 FB	50	/* This is all part of the "official" NBD API */
	51
	52	#define NBD_REQUEST_MAGIC 0x25609513
	53	#define NBD_REPLY_MAGIC 0x67446698
	54
	55	#define NBD_SET_SOCK _IO(0xab, 0)
	56	#define NBD_SET_BLKSIZE _IO(0xab, 1)
	57	#define NBD_SET_SIZE _IO(0xab, 2)
	58	#define NBD_DO_IT _IO(0xab, 3)
	59	#define NBD_CLEAR_SOCK _IO(0xab, 4)
	60	#define NBD_CLEAR_QUE _IO(0xab, 5)
	61	#define NBD_PRINT_DEBUG _IO(0xab, 6)
	62	#define NBD_SET_SIZE_BLOCKS _IO(0xab, 7)
	63	#define NBD_DISCONNECT _IO(0xab, 8)
	64
	65	/* That's all folks */
	66
75818250 TS	67	#define read_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, true)
75818250 TS	68	#define write_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, false)
7a5ca864	69
75818250	70	size_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
7a5ca864 FB	71	{
	72	size_t offset = 0;
	73
	74	while (offset < size) {
	75	ssize_t len;
	76
	77	if (do_read) {
03ff3ca3	78	len = recv(fd, buffer + offset, size - offset, 0);
7a5ca864	79	} else {
03ff3ca3	80	len = send(fd, buffer + offset, size - offset, 0);
7a5ca864 FB	81	}
7a5ca864 FB	82
03ff3ca3 AL	83	if (len == -1)
	84	errno = socket_error();
	85
7a5ca864	86	/* recoverable error */
75818250	87	if (len == -1 && (errno == EAGAIN \|\| errno == EINTR)) {
7a5ca864 FB	88	continue;
	89	}
	90
	91	/* eof */
	92	if (len == 0) {
	93	break;
	94	}
	95
	96	/* unrecoverable error */
	97	if (len == -1) {
	98	return 0;
	99	}
	100
	101	offset += len;
	102	}
	103
	104	return offset;
	105	}
	106
75818250	107	int tcp_socket_outgoing(const char *address, uint16_t port)
7a5ca864 FB	108	{
	109	int s;
	110	struct in_addr in;
	111	struct sockaddr_in addr;
7a5ca864 FB	112
	113	s = socket(PF_INET, SOCK_STREAM, 0);
	114	if (s == -1) {
	115	return -1;
	116	}
	117
	118	if (inet_aton(address, &in) == 0) {
	119	struct hostent *ent;
	120
	121	ent = gethostbyname(address);
	122	if (ent == NULL) {
	123	goto error;
	124	}
	125
	126	memcpy(&in, ent->h_addr, sizeof(in));
	127	}
	128
	129	addr.sin_family = AF_INET;
	130	addr.sin_port = htons(port);
	131	memcpy(&addr.sin_addr.s_addr, &in, sizeof(in));
	132
	133	if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
	134	goto error;
	135	}
	136
	137	return s;
	138	error:
03ff3ca3	139	closesocket(s);
7a5ca864 FB	140	return -1;
	141	}
	142
	143	int tcp_socket_incoming(const char *address, uint16_t port)
	144	{
	145	int s;
	146	struct in_addr in;
	147	struct sockaddr_in addr;
7a5ca864 FB	148	int opt;
	149
	150	s = socket(PF_INET, SOCK_STREAM, 0);
	151	if (s == -1) {
	152	return -1;
	153	}
	154
	155	if (inet_aton(address, &in) == 0) {
	156	struct hostent *ent;
	157
	158	ent = gethostbyname(address);
	159	if (ent == NULL) {
	160	goto error;
	161	}
	162
	163	memcpy(&in, ent->h_addr, sizeof(in));
	164	}
	165
	166	addr.sin_family = AF_INET;
	167	addr.sin_port = htons(port);
	168	memcpy(&addr.sin_addr.s_addr, &in, sizeof(in));
	169
	170	opt = 1;
0a656f5f	171	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
0a656f5f	172	(const void *) &opt, sizeof(opt)) == -1) {
7a5ca864 FB	173	goto error;
	174	}
	175
	176	if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
	177	goto error;
	178	}
	179
	180	if (listen(s, 128) == -1) {
	181	goto error;
	182	}
	183
	184	return s;
	185	error:
03ff3ca3	186	closesocket(s);
7a5ca864 FB	187	return -1;
	188	}
	189
03ff3ca3	190	#ifndef _WIN32
cd831bd7 TS	191	int unix_socket_incoming(const char *path)
	192	{
	193	int s;
	194	struct sockaddr_un addr;
cd831bd7 TS	195
	196	s = socket(PF_UNIX, SOCK_STREAM, 0);
	197	if (s == -1) {
	198	return -1;
	199	}
	200
	201	memset(&addr, 0, sizeof(addr));
	202	addr.sun_family = AF_UNIX;
	203	pstrcpy(addr.sun_path, sizeof(addr.sun_path), path);
	204
	205	if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
	206	goto error;
	207	}
	208
	209	if (listen(s, 128) == -1) {
	210	goto error;
	211	}
	212
	213	return s;
	214	error:
03ff3ca3	215	closesocket(s);
cd831bd7 TS	216	return -1;
	217	}
	218
	219	int unix_socket_outgoing(const char *path)
	220	{
	221	int s;
	222	struct sockaddr_un addr;
cd831bd7 TS	223
	224	s = socket(PF_UNIX, SOCK_STREAM, 0);
	225	if (s == -1) {
	226	return -1;
	227	}
	228
	229	memset(&addr, 0, sizeof(addr));
	230	addr.sun_family = AF_UNIX;
	231	pstrcpy(addr.sun_path, sizeof(addr.sun_path), path);
	232
	233	if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
	234	goto error;
	235	}
	236
	237	return s;
	238	error:
03ff3ca3 AL	239	closesocket(s);
	240	return -1;
	241	}
	242	#else
	243	int unix_socket_incoming(const char *path)
	244	{
	245	errno = ENOTSUP;
cd831bd7 TS	246	return -1;
	247	}
	248
03ff3ca3 AL	249	int unix_socket_outgoing(const char *path)
	250	{
	251	errno = ENOTSUP;
	252	return -1;
	253	}
	254	#endif
	255
cd831bd7	256
7a5ca864 FB	257	/* Basic flow
	258
	259	Server Client
	260
	261	Negotiate
	262	Request
	263	Response
	264	Request
	265	Response
	266	...
	267	...
	268	Request (type == 2)
	269	*/
	270
27982661	271	int nbd_negotiate(int csock, off_t size)
7a5ca864 FB	272	{
	273	char buf[8 + 8 + 8 + 128];
	274
	275	/* Negotiate
	276	[ 0 .. 7] passwd ("NBDMAGIC")
	277	[ 8 .. 15] magic (0x00420281861253)
	278	[16 .. 23] size
	279	[24 .. 151] reserved (0)
	280	*/
	281
	282	TRACE("Beginning negotiation.");
	283	memcpy(buf, "NBDMAGIC", 8);
	284	cpu_to_be64w((uint64_t*)(buf + 8), 0x00420281861253LL);
	285	cpu_to_be64w((uint64_t*)(buf + 16), size);
	286	memset(buf + 24, 0, 128);
	287
	288	if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
	289	LOG("write failed");
	290	errno = EINVAL;
	291	return -1;
	292	}
	293
	294	TRACE("Negotation succeeded.");
	295
	296	return 0;
	297	}
	298
cd831bd7	299	int nbd_receive_negotiate(int csock, off_t size, size_t blocksize)
7a5ca864 FB	300	{
	301	char buf[8 + 8 + 8 + 128];
	302	uint64_t magic;
7a5ca864 FB	303
	304	TRACE("Receiving negotation.");
	305
	306	if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
	307	LOG("read failed");
	308	errno = EINVAL;
	309	return -1;
	310	}
	311
	312	magic = be64_to_cpup((uint64_t*)(buf + 8));
cd831bd7 TS	313	size = be64_to_cpup((uint64_t)(buf + 16));
cd831bd7 TS	314	*blocksize = 1024;
7a5ca864 FB	315
7a5ca864 FB	316	TRACE("Magic is %c%c%c%c%c%c%c%c",
47398b9c BS	317	qemu_isprint(buf[0]) ? buf[0] : '.',
	318	qemu_isprint(buf[1]) ? buf[1] : '.',
	319	qemu_isprint(buf[2]) ? buf[2] : '.',
	320	qemu_isprint(buf[3]) ? buf[3] : '.',
	321	qemu_isprint(buf[4]) ? buf[4] : '.',
	322	qemu_isprint(buf[5]) ? buf[5] : '.',
	323	qemu_isprint(buf[6]) ? buf[6] : '.',
	324	qemu_isprint(buf[7]) ? buf[7] : '.');
7a5ca864	325	TRACE("Magic is 0x%" PRIx64, magic);
cd831bd7	326	TRACE("Size is %" PRIu64, *size);
7a5ca864 FB	327
	328	if (memcmp(buf, "NBDMAGIC", 8) != 0) {
	329	LOG("Invalid magic received");
	330	errno = EINVAL;
	331	return -1;
	332	}
	333
	334	TRACE("Checking magic");
	335
	336	if (magic != 0x00420281861253LL) {
	337	LOG("Bad magic received");
	338	errno = EINVAL;
	339	return -1;
	340	}
cd831bd7 TS	341	return 0;
cd831bd7 TS	342	}
7a5ca864	343
03ff3ca3	344	#ifndef _WIN32
cd831bd7 TS	345	int nbd_init(int fd, int csock, off_t size, size_t blocksize)
cd831bd7 TS	346	{
7a5ca864 FB	347	TRACE("Setting block size to %lu", (unsigned long)blocksize);
	348
	349	if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) == -1) {
	350	int serrno = errno;
	351	LOG("Failed setting NBD block size");
	352	errno = serrno;
	353	return -1;
	354	}
	355
0bfcd599	356	TRACE("Setting size to %zd block(s)", (size_t)(size / blocksize));
7a5ca864 FB	357
	358	if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) == -1) {
	359	int serrno = errno;
	360	LOG("Failed setting size (in blocks)");
	361	errno = serrno;
	362	return -1;
	363	}
	364
	365	TRACE("Clearing NBD socket");
	366
	367	if (ioctl(fd, NBD_CLEAR_SOCK) == -1) {
	368	int serrno = errno;
	369	LOG("Failed clearing NBD socket");
	370	errno = serrno;
	371	return -1;
	372	}
	373
	374	TRACE("Setting NBD socket");
	375
	376	if (ioctl(fd, NBD_SET_SOCK, csock) == -1) {
	377	int serrno = errno;
	378	LOG("Failed to set NBD socket");
	379	errno = serrno;
	380	return -1;
	381	}
	382
	383	TRACE("Negotiation ended");
	384
	385	return 0;
	386	}
	387
	388	int nbd_disconnect(int fd)
	389	{
	390	ioctl(fd, NBD_CLEAR_QUE);
	391	ioctl(fd, NBD_DISCONNECT);
	392	ioctl(fd, NBD_CLEAR_SOCK);
	393	return 0;
	394	}
	395
	396	int nbd_client(int fd, int csock)
	397	{
	398	int ret;
	399	int serrno;
	400
	401	TRACE("Doing NBD loop");
	402
	403	ret = ioctl(fd, NBD_DO_IT);
	404	serrno = errno;
	405
	406	TRACE("NBD loop returned %d: %s", ret, strerror(serrno));
	407
	408	TRACE("Clearing NBD queue");
	409	ioctl(fd, NBD_CLEAR_QUE);
	410
	411	TRACE("Clearing NBD socket");
	412	ioctl(fd, NBD_CLEAR_SOCK);
	413
	414	errno = serrno;
	415	return ret;
	416	}
03ff3ca3 AL	417	#else
	418	int nbd_init(int fd, int csock, off_t size, size_t blocksize)
	419	{
	420	errno = ENOTSUP;
	421	return -1;
	422	}
	423
	424	int nbd_disconnect(int fd)
	425	{
	426	errno = ENOTSUP;
	427	return -1;
	428	}
	429
	430	int nbd_client(int fd, int csock)
	431	{
	432	errno = ENOTSUP;
	433	return -1;
	434	}
	435	#endif
7a5ca864	436
75818250	437	int nbd_send_request(int csock, struct nbd_request *request)
7a5ca864	438	{
7a5ca864	439	uint8_t buf[4 + 4 + 8 + 8 + 4];
7a5ca864	440
75818250 TS	441	cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
	442	cpu_to_be32w((uint32_t*)(buf + 4), request->type);
	443	cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
	444	cpu_to_be64w((uint64_t*)(buf + 16), request->from);
	445	cpu_to_be32w((uint32_t*)(buf + 24), request->len);
	446
	447	TRACE("Sending request to client");
	448
	449	if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
	450	LOG("writing to socket failed");
	451	errno = EINVAL;
	452	return -1;
	453	}
	454	return 0;
	455	}
	456
	457
	458	static int nbd_receive_request(int csock, struct nbd_request *request)
	459	{
	460	uint8_t buf[4 + 4 + 8 + 8 + 4];
	461	uint32_t magic;
7a5ca864 FB	462
	463	if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
	464	LOG("read failed");
	465	errno = EINVAL;
	466	return -1;
	467	}
	468
	469	/* Request
75818250 TS	470	[ 0 .. 3] magic (NBD_REQUEST_MAGIC)
	471	[ 4 .. 7] type (0 == READ, 1 == WRITE)
	472	[ 8 .. 15] handle
	473	[16 .. 23] from
	474	[24 .. 27] len
7a5ca864 FB	475	*/
	476
	477	magic = be32_to_cpup((uint32_t*)buf);
75818250 TS	478	request->type = be32_to_cpup((uint32_t*)(buf + 4));
	479	request->handle = be64_to_cpup((uint64_t*)(buf + 8));
	480	request->from = be64_to_cpup((uint64_t*)(buf + 16));
	481	request->len = be32_to_cpup((uint32_t*)(buf + 24));
7a5ca864 FB	482
	483	TRACE("Got request: "
	484	"{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
75818250	485	magic, request->type, request->from, request->len);
7a5ca864 FB	486
	487	if (magic != NBD_REQUEST_MAGIC) {
	488	LOG("invalid magic (got 0x%x)", magic);
	489	errno = EINVAL;
	490	return -1;
	491	}
d94888e3	492	return 0;
75818250 TS	493	}
	494
	495	int nbd_receive_reply(int csock, struct nbd_reply *reply)
	496	{
	497	uint8_t buf[4 + 4 + 8];
	498	uint32_t magic;
	499
	500	memset(buf, 0xAA, sizeof(buf));
	501
	502	if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
	503	LOG("read failed");
	504	errno = EINVAL;
	505	return -1;
	506	}
	507
	508	/* Reply
	509	[ 0 .. 3] magic (NBD_REPLY_MAGIC)
	510	[ 4 .. 7] error (0 == no error)
	511	[ 7 .. 15] handle
	512	*/
	513
	514	magic = be32_to_cpup((uint32_t*)buf);
	515	reply->error = be32_to_cpup((uint32_t*)(buf + 4));
	516	reply->handle = be64_to_cpup((uint64_t*)(buf + 8));
	517
	518	TRACE("Got reply: "
	519	"{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
	520	magic, reply->error, reply->handle);
	521
	522	if (magic != NBD_REPLY_MAGIC) {
	523	LOG("invalid magic (got 0x%x)", magic);
	524	errno = EINVAL;
	525	return -1;
	526	}
	527	return 0;
	528	}
	529
	530	static int nbd_send_reply(int csock, struct nbd_reply *reply)
	531	{
	532	uint8_t buf[4 + 4 + 8];
	533
	534	/* Reply
	535	[ 0 .. 3] magic (NBD_REPLY_MAGIC)
	536	[ 4 .. 7] error (0 == no error)
	537	[ 7 .. 15] handle
	538	*/
	539	cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
	540	cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
	541	cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);
	542
	543	TRACE("Sending response to client");
	544
	545	if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
	546	LOG("writing to socket failed");
	547	errno = EINVAL;
	548	return -1;
	549	}
	550	return 0;
	551	}
7a5ca864	552
75818250 TS	553	int nbd_trip(BlockDriverState *bs, int csock, off_t size, uint64_t dev_offset,
	554	off_t offset, bool readonly, uint8_t data, int data_size)
	555	{
	556	struct nbd_request request;
	557	struct nbd_reply reply;
	558
	559	TRACE("Reading request.");
	560
	561	if (nbd_receive_request(csock, &request) == -1)
	562	return -1;
	563
	564	if (request.len > data_size) {
2f726488	565	LOG("len (%u) is larger than max len (%u)",
75818250	566	request.len, data_size);
7a5ca864 FB	567	errno = EINVAL;
	568	return -1;
	569	}
	570
75818250	571	if ((request.from + request.len) < request.from) {
7a5ca864 FB	572	LOG("integer overflow detected! "
	573	"you're probably being attacked");
	574	errno = EINVAL;
	575	return -1;
	576	}
	577
75818250	578	if ((request.from + request.len) > size) {
7a5ca864 FB	579	LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
7a5ca864 FB	580	", Offset: %" PRIu64 "\n",
b9e82a59	581	request.from, request.len, (uint64_t)size, dev_offset);
7a5ca864 FB	582	LOG("requested operation past EOF--bad client?");
	583	errno = EINVAL;
	584	return -1;
	585	}
	586
7a5ca864 FB	587	TRACE("Decoding type");
7a5ca864 FB	588
75818250 TS	589	reply.handle = request.handle;
	590	reply.error = 0;
	591
	592	switch (request.type) {
	593	case NBD_CMD_READ:
7a5ca864 FB	594	TRACE("Request type is READ");
7a5ca864 FB	595
75818250 TS	596	if (bdrv_read(bs, (request.from + dev_offset) / 512, data,
75818250 TS	597	request.len / 512) == -1) {
7a5ca864 FB	598	LOG("reading from file failed");
	599	errno = EINVAL;
	600	return -1;
	601	}
75818250	602	*offset += request.len;
7a5ca864	603
75818250	604	TRACE("Read %u byte(s)", request.len);
7a5ca864	605
75818250	606	if (nbd_send_reply(csock, &reply) == -1)
7a5ca864	607	return -1;
7a5ca864 FB	608
	609	TRACE("Sending data to client");
	610
75818250	611	if (write_sync(csock, data, request.len) != request.len) {
7a5ca864 FB	612	LOG("writing to socket failed");
	613	errno = EINVAL;
	614	return -1;
	615	}
	616	break;
75818250	617	case NBD_CMD_WRITE:
7a5ca864 FB	618	TRACE("Request type is WRITE");
7a5ca864 FB	619
75818250	620	TRACE("Reading %u byte(s)", request.len);
7a5ca864	621
75818250	622	if (read_sync(csock, data, request.len) != request.len) {
7a5ca864 FB	623	LOG("reading from socket failed");
	624	errno = EINVAL;
	625	return -1;
	626	}
	627
	628	if (readonly) {
	629	TRACE("Server is read-only, return error");
75818250	630	reply.error = 1;
7a5ca864 FB	631	} else {
	632	TRACE("Writing to device");
	633
75818250 TS	634	if (bdrv_write(bs, (request.from + dev_offset) / 512,
75818250 TS	635	data, request.len / 512) == -1) {
7a5ca864 FB	636	LOG("writing to file failed");
	637	errno = EINVAL;
	638	return -1;
	639	}
	640
75818250	641	*offset += request.len;
7a5ca864 FB	642	}
7a5ca864 FB	643
75818250	644	if (nbd_send_reply(csock, &reply) == -1)
7a5ca864	645	return -1;
7a5ca864	646	break;
75818250	647	case NBD_CMD_DISC:
7a5ca864 FB	648	TRACE("Request type is DISCONNECT");
	649	errno = 0;
	650	return 1;
	651	default:
75818250	652	LOG("invalid request type (%u) received", request.type);
7a5ca864 FB	653	errno = EINVAL;
	654	return -1;
	655	}
	656
	657	TRACE("Request/Reply complete");
	658
	659	return 0;
	660	}