xref: /qemu/block/nbd.c (revision abff1abf)
1 /*
2  * QEMU Block driver for  NBD
3  *
4  * Copyright (c) 2019 Virtuozzo International GmbH.
5  * Copyright (C) 2016 Red Hat, Inc.
6  * Copyright (C) 2008 Bull S.A.S.
7  *     Author: Laurent Vivier <Laurent.Vivier@bull.net>
8  *
9  * Some parts:
10  *    Copyright (C) 2007 Anthony Liguori <anthony@codemonkey.ws>
11  *
12  * Permission is hereby granted, free of charge, to any person obtaining a copy
13  * of this software and associated documentation files (the "Software"), to deal
14  * in the Software without restriction, including without limitation the rights
15  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
16  * copies of the Software, and to permit persons to whom the Software is
17  * furnished to do so, subject to the following conditions:
18  *
19  * The above copyright notice and this permission notice shall be included in
20  * all copies or substantial portions of the Software.
21  *
22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
23  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
24  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
25  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
26  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
27  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
28  * THE SOFTWARE.
29  */
30 
31 #include "qemu/osdep.h"
32 
33 #include "trace.h"
34 #include "qemu/uri.h"
35 #include "qemu/option.h"
36 #include "qemu/cutils.h"
37 #include "qemu/main-loop.h"
38 
39 #include "qapi/qapi-visit-sockets.h"
40 #include "qapi/qmp/qstring.h"
41 
42 #include "block/qdict.h"
43 #include "block/nbd.h"
44 #include "block/block_int.h"
45 
46 #define EN_OPTSTR ":exportname="
47 #define MAX_NBD_REQUESTS    16
48 
49 #define HANDLE_TO_INDEX(bs, handle) ((handle) ^ (uint64_t)(intptr_t)(bs))
50 #define INDEX_TO_HANDLE(bs, index)  ((index)  ^ (uint64_t)(intptr_t)(bs))
51 
52 typedef struct {
53     Coroutine *coroutine;
54     uint64_t offset;        /* original offset of the request */
55     bool receiving;         /* waiting for connection_co? */
56 } NBDClientRequest;
57 
58 typedef enum NBDClientState {
59     NBD_CLIENT_CONNECTING_WAIT,
60     NBD_CLIENT_CONNECTING_NOWAIT,
61     NBD_CLIENT_CONNECTED,
62     NBD_CLIENT_QUIT
63 } NBDClientState;
64 
65 typedef struct BDRVNBDState {
66     QIOChannelSocket *sioc; /* The master data channel */
67     QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
68     NBDExportInfo info;
69 
70     CoMutex send_mutex;
71     CoQueue free_sema;
72     Coroutine *connection_co;
73     Coroutine *teardown_co;
74     QemuCoSleepState *connection_co_sleep_ns_state;
75     bool drained;
76     bool wait_drained_end;
77     int in_flight;
78     NBDClientState state;
79     int connect_status;
80     Error *connect_err;
81     bool wait_in_flight;
82 
83     NBDClientRequest requests[MAX_NBD_REQUESTS];
84     NBDReply reply;
85     BlockDriverState *bs;
86 
87     /* Connection parameters */
88     uint32_t reconnect_delay;
89     SocketAddress *saddr;
90     char *export, *tlscredsid;
91     QCryptoTLSCreds *tlscreds;
92     const char *hostname;
93     char *x_dirty_bitmap;
94 } BDRVNBDState;
95 
96 static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
97                                                   Error **errp);
98 static int nbd_client_handshake(BlockDriverState *bs, QIOChannelSocket *sioc,
99                                 Error **errp);
100 
101 static void nbd_clear_bdrvstate(BDRVNBDState *s)
102 {
103     object_unref(OBJECT(s->tlscreds));
104     qapi_free_SocketAddress(s->saddr);
105     s->saddr = NULL;
106     g_free(s->export);
107     s->export = NULL;
108     g_free(s->tlscredsid);
109     s->tlscredsid = NULL;
110     g_free(s->x_dirty_bitmap);
111     s->x_dirty_bitmap = NULL;
112 }
113 
114 static void nbd_channel_error(BDRVNBDState *s, int ret)
115 {
116     if (ret == -EIO) {
117         if (s->state == NBD_CLIENT_CONNECTED) {
118             s->state = s->reconnect_delay ? NBD_CLIENT_CONNECTING_WAIT :
119                                             NBD_CLIENT_CONNECTING_NOWAIT;
120         }
121     } else {
122         if (s->state == NBD_CLIENT_CONNECTED) {
123             qio_channel_shutdown(s->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
124         }
125         s->state = NBD_CLIENT_QUIT;
126     }
127 }
128 
129 static void nbd_recv_coroutines_wake_all(BDRVNBDState *s)
130 {
131     int i;
132 
133     for (i = 0; i < MAX_NBD_REQUESTS; i++) {
134         NBDClientRequest *req = &s->requests[i];
135 
136         if (req->coroutine && req->receiving) {
137             aio_co_wake(req->coroutine);
138         }
139     }
140 }
141 
142 static void nbd_client_detach_aio_context(BlockDriverState *bs)
143 {
144     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
145 
146     qio_channel_detach_aio_context(QIO_CHANNEL(s->ioc));
147 }
148 
149 static void nbd_client_attach_aio_context_bh(void *opaque)
150 {
151     BlockDriverState *bs = opaque;
152     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
153 
154     /*
155      * The node is still drained, so we know the coroutine has yielded in
156      * nbd_read_eof(), the only place where bs->in_flight can reach 0, or it is
157      * entered for the first time. Both places are safe for entering the
158      * coroutine.
159      */
160     qemu_aio_coroutine_enter(bs->aio_context, s->connection_co);
161     bdrv_dec_in_flight(bs);
162 }
163 
164 static void nbd_client_attach_aio_context(BlockDriverState *bs,
165                                           AioContext *new_context)
166 {
167     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
168 
169     /*
170      * s->connection_co is either yielded from nbd_receive_reply or from
171      * nbd_co_reconnect_loop()
172      */
173     if (s->state == NBD_CLIENT_CONNECTED) {
174         qio_channel_attach_aio_context(QIO_CHANNEL(s->ioc), new_context);
175     }
176 
177     bdrv_inc_in_flight(bs);
178 
179     /*
180      * Need to wait here for the BH to run because the BH must run while the
181      * node is still drained.
182      */
183     aio_wait_bh_oneshot(new_context, nbd_client_attach_aio_context_bh, bs);
184 }
185 
186 static void coroutine_fn nbd_client_co_drain_begin(BlockDriverState *bs)
187 {
188     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
189 
190     s->drained = true;
191     if (s->connection_co_sleep_ns_state) {
192         qemu_co_sleep_wake(s->connection_co_sleep_ns_state);
193     }
194 }
195 
196 static void coroutine_fn nbd_client_co_drain_end(BlockDriverState *bs)
197 {
198     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
199 
200     s->drained = false;
201     if (s->wait_drained_end) {
202         s->wait_drained_end = false;
203         aio_co_wake(s->connection_co);
204     }
205 }
206 
207 
208 static void nbd_teardown_connection(BlockDriverState *bs)
209 {
210     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
211 
212     if (s->ioc) {
213         /* finish any pending coroutines */
214         qio_channel_shutdown(s->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
215     } else if (s->sioc) {
216         /* abort negotiation */
217         qio_channel_shutdown(QIO_CHANNEL(s->sioc), QIO_CHANNEL_SHUTDOWN_BOTH,
218                              NULL);
219     }
220 
221     s->state = NBD_CLIENT_QUIT;
222     if (s->connection_co) {
223         if (s->connection_co_sleep_ns_state) {
224             qemu_co_sleep_wake(s->connection_co_sleep_ns_state);
225         }
226     }
227     if (qemu_in_coroutine()) {
228         s->teardown_co = qemu_coroutine_self();
229         /* connection_co resumes us when it terminates */
230         qemu_coroutine_yield();
231         s->teardown_co = NULL;
232     } else {
233         BDRV_POLL_WHILE(bs, s->connection_co);
234     }
235     assert(!s->connection_co);
236 }
237 
238 static bool nbd_client_connecting(BDRVNBDState *s)
239 {
240     return s->state == NBD_CLIENT_CONNECTING_WAIT ||
241         s->state == NBD_CLIENT_CONNECTING_NOWAIT;
242 }
243 
244 static bool nbd_client_connecting_wait(BDRVNBDState *s)
245 {
246     return s->state == NBD_CLIENT_CONNECTING_WAIT;
247 }
248 
249 static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
250 {
251     int ret;
252     Error *local_err = NULL;
253     QIOChannelSocket *sioc;
254 
255     if (!nbd_client_connecting(s)) {
256         return;
257     }
258 
259     /* Wait for completion of all in-flight requests */
260 
261     qemu_co_mutex_lock(&s->send_mutex);
262 
263     while (s->in_flight > 0) {
264         qemu_co_mutex_unlock(&s->send_mutex);
265         nbd_recv_coroutines_wake_all(s);
266         s->wait_in_flight = true;
267         qemu_coroutine_yield();
268         s->wait_in_flight = false;
269         qemu_co_mutex_lock(&s->send_mutex);
270     }
271 
272     qemu_co_mutex_unlock(&s->send_mutex);
273 
274     if (!nbd_client_connecting(s)) {
275         return;
276     }
277 
278     /*
279      * Now we are sure that nobody is accessing the channel, and no one will
280      * try until we set the state to CONNECTED.
281      */
282 
283     /* Finalize previous connection if any */
284     if (s->ioc) {
285         nbd_client_detach_aio_context(s->bs);
286         object_unref(OBJECT(s->sioc));
287         s->sioc = NULL;
288         object_unref(OBJECT(s->ioc));
289         s->ioc = NULL;
290     }
291 
292     sioc = nbd_establish_connection(s->saddr, &local_err);
293     if (!sioc) {
294         ret = -ECONNREFUSED;
295         goto out;
296     }
297 
298     bdrv_dec_in_flight(s->bs);
299 
300     ret = nbd_client_handshake(s->bs, sioc, &local_err);
301 
302     if (s->drained) {
303         s->wait_drained_end = true;
304         while (s->drained) {
305             /*
306              * We may be entered once from nbd_client_attach_aio_context_bh
307              * and then from nbd_client_co_drain_end. So here is a loop.
308              */
309             qemu_coroutine_yield();
310         }
311     }
312     bdrv_inc_in_flight(s->bs);
313 
314 out:
315     s->connect_status = ret;
316     error_free(s->connect_err);
317     s->connect_err = NULL;
318     error_propagate(&s->connect_err, local_err);
319 
320     if (ret >= 0) {
321         /* successfully connected */
322         s->state = NBD_CLIENT_CONNECTED;
323         qemu_co_queue_restart_all(&s->free_sema);
324     }
325 }
326 
327 static coroutine_fn void nbd_co_reconnect_loop(BDRVNBDState *s)
328 {
329     uint64_t start_time_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
330     uint64_t delay_ns = s->reconnect_delay * NANOSECONDS_PER_SECOND;
331     uint64_t timeout = 1 * NANOSECONDS_PER_SECOND;
332     uint64_t max_timeout = 16 * NANOSECONDS_PER_SECOND;
333 
334     nbd_reconnect_attempt(s);
335 
336     while (nbd_client_connecting(s)) {
337         if (s->state == NBD_CLIENT_CONNECTING_WAIT &&
338             qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time_ns > delay_ns)
339         {
340             s->state = NBD_CLIENT_CONNECTING_NOWAIT;
341             qemu_co_queue_restart_all(&s->free_sema);
342         }
343 
344         if (s->drained) {
345             bdrv_dec_in_flight(s->bs);
346             s->wait_drained_end = true;
347             while (s->drained) {
348                 /*
349                  * We may be entered once from nbd_client_attach_aio_context_bh
350                  * and then from nbd_client_co_drain_end. So here is a loop.
351                  */
352                 qemu_coroutine_yield();
353             }
354             bdrv_inc_in_flight(s->bs);
355         } else {
356             qemu_co_sleep_ns_wakeable(QEMU_CLOCK_REALTIME, timeout,
357                                       &s->connection_co_sleep_ns_state);
358             if (timeout < max_timeout) {
359                 timeout *= 2;
360             }
361         }
362 
363         nbd_reconnect_attempt(s);
364     }
365 }
366 
367 static coroutine_fn void nbd_connection_entry(void *opaque)
368 {
369     BDRVNBDState *s = opaque;
370     uint64_t i;
371     int ret = 0;
372     Error *local_err = NULL;
373 
374     while (s->state != NBD_CLIENT_QUIT) {
375         /*
376          * The NBD client can only really be considered idle when it has
377          * yielded from qio_channel_readv_all_eof(), waiting for data. This is
378          * the point where the additional scheduled coroutine entry happens
379          * after nbd_client_attach_aio_context().
380          *
381          * Therefore we keep an additional in_flight reference all the time and
382          * only drop it temporarily here.
383          */
384 
385         if (nbd_client_connecting(s)) {
386             nbd_co_reconnect_loop(s);
387         }
388 
389         if (s->state != NBD_CLIENT_CONNECTED) {
390             continue;
391         }
392 
393         assert(s->reply.handle == 0);
394         ret = nbd_receive_reply(s->bs, s->ioc, &s->reply, &local_err);
395 
396         if (local_err) {
397             trace_nbd_read_reply_entry_fail(ret, error_get_pretty(local_err));
398             error_free(local_err);
399             local_err = NULL;
400         }
401         if (ret <= 0) {
402             nbd_channel_error(s, ret ? ret : -EIO);
403             continue;
404         }
405 
406         /*
407          * There's no need for a mutex on the receive side, because the
408          * handler acts as a synchronization point and ensures that only
409          * one coroutine is called until the reply finishes.
410          */
411         i = HANDLE_TO_INDEX(s, s->reply.handle);
412         if (i >= MAX_NBD_REQUESTS ||
413             !s->requests[i].coroutine ||
414             !s->requests[i].receiving ||
415             (nbd_reply_is_structured(&s->reply) && !s->info.structured_reply))
416         {
417             nbd_channel_error(s, -EINVAL);
418             continue;
419         }
420 
421         /*
422          * We're woken up again by the request itself.  Note that there
423          * is no race between yielding and reentering connection_co.  This
424          * is because:
425          *
426          * - if the request runs on the same AioContext, it is only
427          *   entered after we yield
428          *
429          * - if the request runs on a different AioContext, reentering
430          *   connection_co happens through a bottom half, which can only
431          *   run after we yield.
432          */
433         aio_co_wake(s->requests[i].coroutine);
434         qemu_coroutine_yield();
435     }
436 
437     qemu_co_queue_restart_all(&s->free_sema);
438     nbd_recv_coroutines_wake_all(s);
439     bdrv_dec_in_flight(s->bs);
440 
441     s->connection_co = NULL;
442     if (s->ioc) {
443         nbd_client_detach_aio_context(s->bs);
444         object_unref(OBJECT(s->sioc));
445         s->sioc = NULL;
446         object_unref(OBJECT(s->ioc));
447         s->ioc = NULL;
448     }
449 
450     if (s->teardown_co) {
451         aio_co_wake(s->teardown_co);
452     }
453     aio_wait_kick();
454 }
455 
456 static int nbd_co_send_request(BlockDriverState *bs,
457                                NBDRequest *request,
458                                QEMUIOVector *qiov)
459 {
460     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
461     int rc, i = -1;
462 
463     qemu_co_mutex_lock(&s->send_mutex);
464     while (s->in_flight == MAX_NBD_REQUESTS || nbd_client_connecting_wait(s)) {
465         qemu_co_queue_wait(&s->free_sema, &s->send_mutex);
466     }
467 
468     if (s->state != NBD_CLIENT_CONNECTED) {
469         rc = -EIO;
470         goto err;
471     }
472 
473     s->in_flight++;
474 
475     for (i = 0; i < MAX_NBD_REQUESTS; i++) {
476         if (s->requests[i].coroutine == NULL) {
477             break;
478         }
479     }
480 
481     g_assert(qemu_in_coroutine());
482     assert(i < MAX_NBD_REQUESTS);
483 
484     s->requests[i].coroutine = qemu_coroutine_self();
485     s->requests[i].offset = request->from;
486     s->requests[i].receiving = false;
487 
488     request->handle = INDEX_TO_HANDLE(s, i);
489 
490     assert(s->ioc);
491 
492     if (qiov) {
493         qio_channel_set_cork(s->ioc, true);
494         rc = nbd_send_request(s->ioc, request);
495         if (rc >= 0 && s->state == NBD_CLIENT_CONNECTED) {
496             if (qio_channel_writev_all(s->ioc, qiov->iov, qiov->niov,
497                                        NULL) < 0) {
498                 rc = -EIO;
499             }
500         } else if (rc >= 0) {
501             rc = -EIO;
502         }
503         qio_channel_set_cork(s->ioc, false);
504     } else {
505         rc = nbd_send_request(s->ioc, request);
506     }
507 
508 err:
509     if (rc < 0) {
510         nbd_channel_error(s, rc);
511         if (i != -1) {
512             s->requests[i].coroutine = NULL;
513             s->in_flight--;
514         }
515         if (s->in_flight == 0 && s->wait_in_flight) {
516             aio_co_wake(s->connection_co);
517         } else {
518             qemu_co_queue_next(&s->free_sema);
519         }
520     }
521     qemu_co_mutex_unlock(&s->send_mutex);
522     return rc;
523 }
524 
525 static inline uint16_t payload_advance16(uint8_t **payload)
526 {
527     *payload += 2;
528     return lduw_be_p(*payload - 2);
529 }
530 
531 static inline uint32_t payload_advance32(uint8_t **payload)
532 {
533     *payload += 4;
534     return ldl_be_p(*payload - 4);
535 }
536 
537 static inline uint64_t payload_advance64(uint8_t **payload)
538 {
539     *payload += 8;
540     return ldq_be_p(*payload - 8);
541 }
542 
543 static int nbd_parse_offset_hole_payload(BDRVNBDState *s,
544                                          NBDStructuredReplyChunk *chunk,
545                                          uint8_t *payload, uint64_t orig_offset,
546                                          QEMUIOVector *qiov, Error **errp)
547 {
548     uint64_t offset;
549     uint32_t hole_size;
550 
551     if (chunk->length != sizeof(offset) + sizeof(hole_size)) {
552         error_setg(errp, "Protocol error: invalid payload for "
553                          "NBD_REPLY_TYPE_OFFSET_HOLE");
554         return -EINVAL;
555     }
556 
557     offset = payload_advance64(&payload);
558     hole_size = payload_advance32(&payload);
559 
560     if (!hole_size || offset < orig_offset || hole_size > qiov->size ||
561         offset > orig_offset + qiov->size - hole_size) {
562         error_setg(errp, "Protocol error: server sent chunk exceeding requested"
563                          " region");
564         return -EINVAL;
565     }
566     if (s->info.min_block &&
567         !QEMU_IS_ALIGNED(hole_size, s->info.min_block)) {
568         trace_nbd_structured_read_compliance("hole");
569     }
570 
571     qemu_iovec_memset(qiov, offset - orig_offset, 0, hole_size);
572 
573     return 0;
574 }
575 
576 /*
577  * nbd_parse_blockstatus_payload
578  * Based on our request, we expect only one extent in reply, for the
579  * base:allocation context.
580  */
581 static int nbd_parse_blockstatus_payload(BDRVNBDState *s,
582                                          NBDStructuredReplyChunk *chunk,
583                                          uint8_t *payload, uint64_t orig_length,
584                                          NBDExtent *extent, Error **errp)
585 {
586     uint32_t context_id;
587 
588     /* The server succeeded, so it must have sent [at least] one extent */
589     if (chunk->length < sizeof(context_id) + sizeof(*extent)) {
590         error_setg(errp, "Protocol error: invalid payload for "
591                          "NBD_REPLY_TYPE_BLOCK_STATUS");
592         return -EINVAL;
593     }
594 
595     context_id = payload_advance32(&payload);
596     if (s->info.context_id != context_id) {
597         error_setg(errp, "Protocol error: unexpected context id %d for "
598                          "NBD_REPLY_TYPE_BLOCK_STATUS, when negotiated context "
599                          "id is %d", context_id,
600                          s->info.context_id);
601         return -EINVAL;
602     }
603 
604     extent->length = payload_advance32(&payload);
605     extent->flags = payload_advance32(&payload);
606 
607     if (extent->length == 0) {
608         error_setg(errp, "Protocol error: server sent status chunk with "
609                    "zero length");
610         return -EINVAL;
611     }
612 
613     /*
614      * A server sending unaligned block status is in violation of the
615      * protocol, but as qemu-nbd 3.1 is such a server (at least for
616      * POSIX files that are not a multiple of 512 bytes, since qemu
617      * rounds files up to 512-byte multiples but lseek(SEEK_HOLE)
618      * still sees an implicit hole beyond the real EOF), it's nicer to
619      * work around the misbehaving server. If the request included
620      * more than the final unaligned block, truncate it back to an
621      * aligned result; if the request was only the final block, round
622      * up to the full block and change the status to fully-allocated
623      * (always a safe status, even if it loses information).
624      */
625     if (s->info.min_block && !QEMU_IS_ALIGNED(extent->length,
626                                                    s->info.min_block)) {
627         trace_nbd_parse_blockstatus_compliance("extent length is unaligned");
628         if (extent->length > s->info.min_block) {
629             extent->length = QEMU_ALIGN_DOWN(extent->length,
630                                              s->info.min_block);
631         } else {
632             extent->length = s->info.min_block;
633             extent->flags = 0;
634         }
635     }
636 
637     /*
638      * We used NBD_CMD_FLAG_REQ_ONE, so the server should not have
639      * sent us any more than one extent, nor should it have included
640      * status beyond our request in that extent. However, it's easy
641      * enough to ignore the server's noncompliance without killing the
642      * connection; just ignore trailing extents, and clamp things to
643      * the length of our request.
644      */
645     if (chunk->length > sizeof(context_id) + sizeof(*extent)) {
646         trace_nbd_parse_blockstatus_compliance("more than one extent");
647     }
648     if (extent->length > orig_length) {
649         extent->length = orig_length;
650         trace_nbd_parse_blockstatus_compliance("extent length too large");
651     }
652 
653     return 0;
654 }
655 
656 /*
657  * nbd_parse_error_payload
658  * on success @errp contains message describing nbd error reply
659  */
660 static int nbd_parse_error_payload(NBDStructuredReplyChunk *chunk,
661                                    uint8_t *payload, int *request_ret,
662                                    Error **errp)
663 {
664     uint32_t error;
665     uint16_t message_size;
666 
667     assert(chunk->type & (1 << 15));
668 
669     if (chunk->length < sizeof(error) + sizeof(message_size)) {
670         error_setg(errp,
671                    "Protocol error: invalid payload for structured error");
672         return -EINVAL;
673     }
674 
675     error = nbd_errno_to_system_errno(payload_advance32(&payload));
676     if (error == 0) {
677         error_setg(errp, "Protocol error: server sent structured error chunk "
678                          "with error = 0");
679         return -EINVAL;
680     }
681 
682     *request_ret = -error;
683     message_size = payload_advance16(&payload);
684 
685     if (message_size > chunk->length - sizeof(error) - sizeof(message_size)) {
686         error_setg(errp, "Protocol error: server sent structured error chunk "
687                          "with incorrect message size");
688         return -EINVAL;
689     }
690 
691     /* TODO: Add a trace point to mention the server complaint */
692 
693     /* TODO handle ERROR_OFFSET */
694 
695     return 0;
696 }
697 
698 static int nbd_co_receive_offset_data_payload(BDRVNBDState *s,
699                                               uint64_t orig_offset,
700                                               QEMUIOVector *qiov, Error **errp)
701 {
702     QEMUIOVector sub_qiov;
703     uint64_t offset;
704     size_t data_size;
705     int ret;
706     NBDStructuredReplyChunk *chunk = &s->reply.structured;
707 
708     assert(nbd_reply_is_structured(&s->reply));
709 
710     /* The NBD spec requires at least one byte of payload */
711     if (chunk->length <= sizeof(offset)) {
712         error_setg(errp, "Protocol error: invalid payload for "
713                          "NBD_REPLY_TYPE_OFFSET_DATA");
714         return -EINVAL;
715     }
716 
717     if (nbd_read64(s->ioc, &offset, "OFFSET_DATA offset", errp) < 0) {
718         return -EIO;
719     }
720 
721     data_size = chunk->length - sizeof(offset);
722     assert(data_size);
723     if (offset < orig_offset || data_size > qiov->size ||
724         offset > orig_offset + qiov->size - data_size) {
725         error_setg(errp, "Protocol error: server sent chunk exceeding requested"
726                          " region");
727         return -EINVAL;
728     }
729     if (s->info.min_block && !QEMU_IS_ALIGNED(data_size, s->info.min_block)) {
730         trace_nbd_structured_read_compliance("data");
731     }
732 
733     qemu_iovec_init(&sub_qiov, qiov->niov);
734     qemu_iovec_concat(&sub_qiov, qiov, offset - orig_offset, data_size);
735     ret = qio_channel_readv_all(s->ioc, sub_qiov.iov, sub_qiov.niov, errp);
736     qemu_iovec_destroy(&sub_qiov);
737 
738     return ret < 0 ? -EIO : 0;
739 }
740 
741 #define NBD_MAX_MALLOC_PAYLOAD 1000
742 static coroutine_fn int nbd_co_receive_structured_payload(
743         BDRVNBDState *s, void **payload, Error **errp)
744 {
745     int ret;
746     uint32_t len;
747 
748     assert(nbd_reply_is_structured(&s->reply));
749 
750     len = s->reply.structured.length;
751 
752     if (len == 0) {
753         return 0;
754     }
755 
756     if (payload == NULL) {
757         error_setg(errp, "Unexpected structured payload");
758         return -EINVAL;
759     }
760 
761     if (len > NBD_MAX_MALLOC_PAYLOAD) {
762         error_setg(errp, "Payload too large");
763         return -EINVAL;
764     }
765 
766     *payload = g_new(char, len);
767     ret = nbd_read(s->ioc, *payload, len, "structured payload", errp);
768     if (ret < 0) {
769         g_free(*payload);
770         *payload = NULL;
771         return ret;
772     }
773 
774     return 0;
775 }
776 
777 /*
778  * nbd_co_do_receive_one_chunk
779  * for simple reply:
780  *   set request_ret to received reply error
781  *   if qiov is not NULL: read payload to @qiov
782  * for structured reply chunk:
783  *   if error chunk: read payload, set @request_ret, do not set @payload
784  *   else if offset_data chunk: read payload data to @qiov, do not set @payload
785  *   else: read payload to @payload
786  *
787  * If function fails, @errp contains corresponding error message, and the
788  * connection with the server is suspect.  If it returns 0, then the
789  * transaction succeeded (although @request_ret may be a negative errno
790  * corresponding to the server's error reply), and errp is unchanged.
791  */
792 static coroutine_fn int nbd_co_do_receive_one_chunk(
793         BDRVNBDState *s, uint64_t handle, bool only_structured,
794         int *request_ret, QEMUIOVector *qiov, void **payload, Error **errp)
795 {
796     int ret;
797     int i = HANDLE_TO_INDEX(s, handle);
798     void *local_payload = NULL;
799     NBDStructuredReplyChunk *chunk;
800 
801     if (payload) {
802         *payload = NULL;
803     }
804     *request_ret = 0;
805 
806     /* Wait until we're woken up by nbd_connection_entry.  */
807     s->requests[i].receiving = true;
808     qemu_coroutine_yield();
809     s->requests[i].receiving = false;
810     if (s->state != NBD_CLIENT_CONNECTED) {
811         error_setg(errp, "Connection closed");
812         return -EIO;
813     }
814     assert(s->ioc);
815 
816     assert(s->reply.handle == handle);
817 
818     if (nbd_reply_is_simple(&s->reply)) {
819         if (only_structured) {
820             error_setg(errp, "Protocol error: simple reply when structured "
821                              "reply chunk was expected");
822             return -EINVAL;
823         }
824 
825         *request_ret = -nbd_errno_to_system_errno(s->reply.simple.error);
826         if (*request_ret < 0 || !qiov) {
827             return 0;
828         }
829 
830         return qio_channel_readv_all(s->ioc, qiov->iov, qiov->niov,
831                                      errp) < 0 ? -EIO : 0;
832     }
833 
834     /* handle structured reply chunk */
835     assert(s->info.structured_reply);
836     chunk = &s->reply.structured;
837 
838     if (chunk->type == NBD_REPLY_TYPE_NONE) {
839         if (!(chunk->flags & NBD_REPLY_FLAG_DONE)) {
840             error_setg(errp, "Protocol error: NBD_REPLY_TYPE_NONE chunk without"
841                        " NBD_REPLY_FLAG_DONE flag set");
842             return -EINVAL;
843         }
844         if (chunk->length) {
845             error_setg(errp, "Protocol error: NBD_REPLY_TYPE_NONE chunk with"
846                        " nonzero length");
847             return -EINVAL;
848         }
849         return 0;
850     }
851 
852     if (chunk->type == NBD_REPLY_TYPE_OFFSET_DATA) {
853         if (!qiov) {
854             error_setg(errp, "Unexpected NBD_REPLY_TYPE_OFFSET_DATA chunk");
855             return -EINVAL;
856         }
857 
858         return nbd_co_receive_offset_data_payload(s, s->requests[i].offset,
859                                                   qiov, errp);
860     }
861 
862     if (nbd_reply_type_is_error(chunk->type)) {
863         payload = &local_payload;
864     }
865 
866     ret = nbd_co_receive_structured_payload(s, payload, errp);
867     if (ret < 0) {
868         return ret;
869     }
870 
871     if (nbd_reply_type_is_error(chunk->type)) {
872         ret = nbd_parse_error_payload(chunk, local_payload, request_ret, errp);
873         g_free(local_payload);
874         return ret;
875     }
876 
877     return 0;
878 }
879 
880 /*
881  * nbd_co_receive_one_chunk
882  * Read reply, wake up connection_co and set s->quit if needed.
883  * Return value is a fatal error code or normal nbd reply error code
884  */
885 static coroutine_fn int nbd_co_receive_one_chunk(
886         BDRVNBDState *s, uint64_t handle, bool only_structured,
887         int *request_ret, QEMUIOVector *qiov, NBDReply *reply, void **payload,
888         Error **errp)
889 {
890     int ret = nbd_co_do_receive_one_chunk(s, handle, only_structured,
891                                           request_ret, qiov, payload, errp);
892 
893     if (ret < 0) {
894         memset(reply, 0, sizeof(*reply));
895         nbd_channel_error(s, ret);
896     } else {
897         /* For assert at loop start in nbd_connection_entry */
898         *reply = s->reply;
899     }
900     s->reply.handle = 0;
901 
902     if (s->connection_co && !s->wait_in_flight) {
903         /*
904          * We must check s->wait_in_flight, because we may entered by
905          * nbd_recv_coroutines_wake_all(), in this case we should not
906          * wake connection_co here, it will woken by last request.
907          */
908         aio_co_wake(s->connection_co);
909     }
910 
911     return ret;
912 }
913 
914 typedef struct NBDReplyChunkIter {
915     int ret;
916     int request_ret;
917     Error *err;
918     bool done, only_structured;
919 } NBDReplyChunkIter;
920 
921 static void nbd_iter_channel_error(NBDReplyChunkIter *iter,
922                                    int ret, Error **local_err)
923 {
924     assert(local_err && *local_err);
925     assert(ret < 0);
926 
927     if (!iter->ret) {
928         iter->ret = ret;
929         error_propagate(&iter->err, *local_err);
930     } else {
931         error_free(*local_err);
932     }
933 
934     *local_err = NULL;
935 }
936 
937 static void nbd_iter_request_error(NBDReplyChunkIter *iter, int ret)
938 {
939     assert(ret < 0);
940 
941     if (!iter->request_ret) {
942         iter->request_ret = ret;
943     }
944 }
945 
946 /*
947  * NBD_FOREACH_REPLY_CHUNK
948  * The pointer stored in @payload requires g_free() to free it.
949  */
950 #define NBD_FOREACH_REPLY_CHUNK(s, iter, handle, structured, \
951                                 qiov, reply, payload) \
952     for (iter = (NBDReplyChunkIter) { .only_structured = structured }; \
953          nbd_reply_chunk_iter_receive(s, &iter, handle, qiov, reply, payload);)
954 
955 /*
956  * nbd_reply_chunk_iter_receive
957  * The pointer stored in @payload requires g_free() to free it.
958  */
959 static bool nbd_reply_chunk_iter_receive(BDRVNBDState *s,
960                                          NBDReplyChunkIter *iter,
961                                          uint64_t handle,
962                                          QEMUIOVector *qiov, NBDReply *reply,
963                                          void **payload)
964 {
965     int ret, request_ret;
966     NBDReply local_reply;
967     NBDStructuredReplyChunk *chunk;
968     Error *local_err = NULL;
969     if (s->state != NBD_CLIENT_CONNECTED) {
970         error_setg(&local_err, "Connection closed");
971         nbd_iter_channel_error(iter, -EIO, &local_err);
972         goto break_loop;
973     }
974 
975     if (iter->done) {
976         /* Previous iteration was last. */
977         goto break_loop;
978     }
979 
980     if (reply == NULL) {
981         reply = &local_reply;
982     }
983 
984     ret = nbd_co_receive_one_chunk(s, handle, iter->only_structured,
985                                    &request_ret, qiov, reply, payload,
986                                    &local_err);
987     if (ret < 0) {
988         nbd_iter_channel_error(iter, ret, &local_err);
989     } else if (request_ret < 0) {
990         nbd_iter_request_error(iter, request_ret);
991     }
992 
993     /* Do not execute the body of NBD_FOREACH_REPLY_CHUNK for simple reply. */
994     if (nbd_reply_is_simple(reply) || s->state != NBD_CLIENT_CONNECTED) {
995         goto break_loop;
996     }
997 
998     chunk = &reply->structured;
999     iter->only_structured = true;
1000 
1001     if (chunk->type == NBD_REPLY_TYPE_NONE) {
1002         /* NBD_REPLY_FLAG_DONE is already checked in nbd_co_receive_one_chunk */
1003         assert(chunk->flags & NBD_REPLY_FLAG_DONE);
1004         goto break_loop;
1005     }
1006 
1007     if (chunk->flags & NBD_REPLY_FLAG_DONE) {
1008         /* This iteration is last. */
1009         iter->done = true;
1010     }
1011 
1012     /* Execute the loop body */
1013     return true;
1014 
1015 break_loop:
1016     s->requests[HANDLE_TO_INDEX(s, handle)].coroutine = NULL;
1017 
1018     qemu_co_mutex_lock(&s->send_mutex);
1019     s->in_flight--;
1020     if (s->in_flight == 0 && s->wait_in_flight) {
1021         aio_co_wake(s->connection_co);
1022     } else {
1023         qemu_co_queue_next(&s->free_sema);
1024     }
1025     qemu_co_mutex_unlock(&s->send_mutex);
1026 
1027     return false;
1028 }
1029 
1030 static int nbd_co_receive_return_code(BDRVNBDState *s, uint64_t handle,
1031                                       int *request_ret, Error **errp)
1032 {
1033     NBDReplyChunkIter iter;
1034 
1035     NBD_FOREACH_REPLY_CHUNK(s, iter, handle, false, NULL, NULL, NULL) {
1036         /* nbd_reply_chunk_iter_receive does all the work */
1037     }
1038 
1039     error_propagate(errp, iter.err);
1040     *request_ret = iter.request_ret;
1041     return iter.ret;
1042 }
1043 
1044 static int nbd_co_receive_cmdread_reply(BDRVNBDState *s, uint64_t handle,
1045                                         uint64_t offset, QEMUIOVector *qiov,
1046                                         int *request_ret, Error **errp)
1047 {
1048     NBDReplyChunkIter iter;
1049     NBDReply reply;
1050     void *payload = NULL;
1051     Error *local_err = NULL;
1052 
1053     NBD_FOREACH_REPLY_CHUNK(s, iter, handle, s->info.structured_reply,
1054                             qiov, &reply, &payload)
1055     {
1056         int ret;
1057         NBDStructuredReplyChunk *chunk = &reply.structured;
1058 
1059         assert(nbd_reply_is_structured(&reply));
1060 
1061         switch (chunk->type) {
1062         case NBD_REPLY_TYPE_OFFSET_DATA:
1063             /*
1064              * special cased in nbd_co_receive_one_chunk, data is already
1065              * in qiov
1066              */
1067             break;
1068         case NBD_REPLY_TYPE_OFFSET_HOLE:
1069             ret = nbd_parse_offset_hole_payload(s, &reply.structured, payload,
1070                                                 offset, qiov, &local_err);
1071             if (ret < 0) {
1072                 nbd_channel_error(s, ret);
1073                 nbd_iter_channel_error(&iter, ret, &local_err);
1074             }
1075             break;
1076         default:
1077             if (!nbd_reply_type_is_error(chunk->type)) {
1078                 /* not allowed reply type */
1079                 nbd_channel_error(s, -EINVAL);
1080                 error_setg(&local_err,
1081                            "Unexpected reply type: %d (%s) for CMD_READ",
1082                            chunk->type, nbd_reply_type_lookup(chunk->type));
1083                 nbd_iter_channel_error(&iter, -EINVAL, &local_err);
1084             }
1085         }
1086 
1087         g_free(payload);
1088         payload = NULL;
1089     }
1090 
1091     error_propagate(errp, iter.err);
1092     *request_ret = iter.request_ret;
1093     return iter.ret;
1094 }
1095 
1096 static int nbd_co_receive_blockstatus_reply(BDRVNBDState *s,
1097                                             uint64_t handle, uint64_t length,
1098                                             NBDExtent *extent,
1099                                             int *request_ret, Error **errp)
1100 {
1101     NBDReplyChunkIter iter;
1102     NBDReply reply;
1103     void *payload = NULL;
1104     Error *local_err = NULL;
1105     bool received = false;
1106 
1107     assert(!extent->length);
1108     NBD_FOREACH_REPLY_CHUNK(s, iter, handle, false, NULL, &reply, &payload) {
1109         int ret;
1110         NBDStructuredReplyChunk *chunk = &reply.structured;
1111 
1112         assert(nbd_reply_is_structured(&reply));
1113 
1114         switch (chunk->type) {
1115         case NBD_REPLY_TYPE_BLOCK_STATUS:
1116             if (received) {
1117                 nbd_channel_error(s, -EINVAL);
1118                 error_setg(&local_err, "Several BLOCK_STATUS chunks in reply");
1119                 nbd_iter_channel_error(&iter, -EINVAL, &local_err);
1120             }
1121             received = true;
1122 
1123             ret = nbd_parse_blockstatus_payload(s, &reply.structured,
1124                                                 payload, length, extent,
1125                                                 &local_err);
1126             if (ret < 0) {
1127                 nbd_channel_error(s, ret);
1128                 nbd_iter_channel_error(&iter, ret, &local_err);
1129             }
1130             break;
1131         default:
1132             if (!nbd_reply_type_is_error(chunk->type)) {
1133                 nbd_channel_error(s, -EINVAL);
1134                 error_setg(&local_err,
1135                            "Unexpected reply type: %d (%s) "
1136                            "for CMD_BLOCK_STATUS",
1137                            chunk->type, nbd_reply_type_lookup(chunk->type));
1138                 nbd_iter_channel_error(&iter, -EINVAL, &local_err);
1139             }
1140         }
1141 
1142         g_free(payload);
1143         payload = NULL;
1144     }
1145 
1146     if (!extent->length && !iter.request_ret) {
1147         error_setg(&local_err, "Server did not reply with any status extents");
1148         nbd_iter_channel_error(&iter, -EIO, &local_err);
1149     }
1150 
1151     error_propagate(errp, iter.err);
1152     *request_ret = iter.request_ret;
1153     return iter.ret;
1154 }
1155 
1156 static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
1157                           QEMUIOVector *write_qiov)
1158 {
1159     int ret, request_ret;
1160     Error *local_err = NULL;
1161     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1162 
1163     assert(request->type != NBD_CMD_READ);
1164     if (write_qiov) {
1165         assert(request->type == NBD_CMD_WRITE);
1166         assert(request->len == iov_size(write_qiov->iov, write_qiov->niov));
1167     } else {
1168         assert(request->type != NBD_CMD_WRITE);
1169     }
1170 
1171     do {
1172         ret = nbd_co_send_request(bs, request, write_qiov);
1173         if (ret < 0) {
1174             continue;
1175         }
1176 
1177         ret = nbd_co_receive_return_code(s, request->handle,
1178                                          &request_ret, &local_err);
1179         if (local_err) {
1180             trace_nbd_co_request_fail(request->from, request->len,
1181                                       request->handle, request->flags,
1182                                       request->type,
1183                                       nbd_cmd_lookup(request->type),
1184                                       ret, error_get_pretty(local_err));
1185             error_free(local_err);
1186             local_err = NULL;
1187         }
1188     } while (ret < 0 && nbd_client_connecting_wait(s));
1189 
1190     return ret ? ret : request_ret;
1191 }
1192 
1193 static int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
1194                                 uint64_t bytes, QEMUIOVector *qiov, int flags)
1195 {
1196     int ret, request_ret;
1197     Error *local_err = NULL;
1198     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1199     NBDRequest request = {
1200         .type = NBD_CMD_READ,
1201         .from = offset,
1202         .len = bytes,
1203     };
1204 
1205     assert(bytes <= NBD_MAX_BUFFER_SIZE);
1206     assert(!flags);
1207 
1208     if (!bytes) {
1209         return 0;
1210     }
1211     /*
1212      * Work around the fact that the block layer doesn't do
1213      * byte-accurate sizing yet - if the read exceeds the server's
1214      * advertised size because the block layer rounded size up, then
1215      * truncate the request to the server and tail-pad with zero.
1216      */
1217     if (offset >= s->info.size) {
1218         assert(bytes < BDRV_SECTOR_SIZE);
1219         qemu_iovec_memset(qiov, 0, 0, bytes);
1220         return 0;
1221     }
1222     if (offset + bytes > s->info.size) {
1223         uint64_t slop = offset + bytes - s->info.size;
1224 
1225         assert(slop < BDRV_SECTOR_SIZE);
1226         qemu_iovec_memset(qiov, bytes - slop, 0, slop);
1227         request.len -= slop;
1228     }
1229 
1230     do {
1231         ret = nbd_co_send_request(bs, &request, NULL);
1232         if (ret < 0) {
1233             continue;
1234         }
1235 
1236         ret = nbd_co_receive_cmdread_reply(s, request.handle, offset, qiov,
1237                                            &request_ret, &local_err);
1238         if (local_err) {
1239             trace_nbd_co_request_fail(request.from, request.len, request.handle,
1240                                       request.flags, request.type,
1241                                       nbd_cmd_lookup(request.type),
1242                                       ret, error_get_pretty(local_err));
1243             error_free(local_err);
1244             local_err = NULL;
1245         }
1246     } while (ret < 0 && nbd_client_connecting_wait(s));
1247 
1248     return ret ? ret : request_ret;
1249 }
1250 
1251 static int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
1252                                  uint64_t bytes, QEMUIOVector *qiov, int flags)
1253 {
1254     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1255     NBDRequest request = {
1256         .type = NBD_CMD_WRITE,
1257         .from = offset,
1258         .len = bytes,
1259     };
1260 
1261     assert(!(s->info.flags & NBD_FLAG_READ_ONLY));
1262     if (flags & BDRV_REQ_FUA) {
1263         assert(s->info.flags & NBD_FLAG_SEND_FUA);
1264         request.flags |= NBD_CMD_FLAG_FUA;
1265     }
1266 
1267     assert(bytes <= NBD_MAX_BUFFER_SIZE);
1268 
1269     if (!bytes) {
1270         return 0;
1271     }
1272     return nbd_co_request(bs, &request, qiov);
1273 }
1274 
1275 static int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
1276                                        int bytes, BdrvRequestFlags flags)
1277 {
1278     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1279     NBDRequest request = {
1280         .type = NBD_CMD_WRITE_ZEROES,
1281         .from = offset,
1282         .len = bytes,
1283     };
1284 
1285     assert(!(s->info.flags & NBD_FLAG_READ_ONLY));
1286     if (!(s->info.flags & NBD_FLAG_SEND_WRITE_ZEROES)) {
1287         return -ENOTSUP;
1288     }
1289 
1290     if (flags & BDRV_REQ_FUA) {
1291         assert(s->info.flags & NBD_FLAG_SEND_FUA);
1292         request.flags |= NBD_CMD_FLAG_FUA;
1293     }
1294     if (!(flags & BDRV_REQ_MAY_UNMAP)) {
1295         request.flags |= NBD_CMD_FLAG_NO_HOLE;
1296     }
1297     if (flags & BDRV_REQ_NO_FALLBACK) {
1298         assert(s->info.flags & NBD_FLAG_SEND_FAST_ZERO);
1299         request.flags |= NBD_CMD_FLAG_FAST_ZERO;
1300     }
1301 
1302     if (!bytes) {
1303         return 0;
1304     }
1305     return nbd_co_request(bs, &request, NULL);
1306 }
1307 
1308 static int nbd_client_co_flush(BlockDriverState *bs)
1309 {
1310     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1311     NBDRequest request = { .type = NBD_CMD_FLUSH };
1312 
1313     if (!(s->info.flags & NBD_FLAG_SEND_FLUSH)) {
1314         return 0;
1315     }
1316 
1317     request.from = 0;
1318     request.len = 0;
1319 
1320     return nbd_co_request(bs, &request, NULL);
1321 }
1322 
1323 static int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset,
1324                                   int bytes)
1325 {
1326     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1327     NBDRequest request = {
1328         .type = NBD_CMD_TRIM,
1329         .from = offset,
1330         .len = bytes,
1331     };
1332 
1333     assert(!(s->info.flags & NBD_FLAG_READ_ONLY));
1334     if (!(s->info.flags & NBD_FLAG_SEND_TRIM) || !bytes) {
1335         return 0;
1336     }
1337 
1338     return nbd_co_request(bs, &request, NULL);
1339 }
1340 
1341 static int coroutine_fn nbd_client_co_block_status(
1342         BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
1343         int64_t *pnum, int64_t *map, BlockDriverState **file)
1344 {
1345     int ret, request_ret;
1346     NBDExtent extent = { 0 };
1347     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1348     Error *local_err = NULL;
1349 
1350     NBDRequest request = {
1351         .type = NBD_CMD_BLOCK_STATUS,
1352         .from = offset,
1353         .len = MIN(QEMU_ALIGN_DOWN(INT_MAX, bs->bl.request_alignment),
1354                    MIN(bytes, s->info.size - offset)),
1355         .flags = NBD_CMD_FLAG_REQ_ONE,
1356     };
1357 
1358     if (!s->info.base_allocation) {
1359         *pnum = bytes;
1360         *map = offset;
1361         *file = bs;
1362         return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID;
1363     }
1364 
1365     /*
1366      * Work around the fact that the block layer doesn't do
1367      * byte-accurate sizing yet - if the status request exceeds the
1368      * server's advertised size because the block layer rounded size
1369      * up, we truncated the request to the server (above), or are
1370      * called on just the hole.
1371      */
1372     if (offset >= s->info.size) {
1373         *pnum = bytes;
1374         assert(bytes < BDRV_SECTOR_SIZE);
1375         /* Intentionally don't report offset_valid for the hole */
1376         return BDRV_BLOCK_ZERO;
1377     }
1378 
1379     if (s->info.min_block) {
1380         assert(QEMU_IS_ALIGNED(request.len, s->info.min_block));
1381     }
1382     do {
1383         ret = nbd_co_send_request(bs, &request, NULL);
1384         if (ret < 0) {
1385             continue;
1386         }
1387 
1388         ret = nbd_co_receive_blockstatus_reply(s, request.handle, bytes,
1389                                                &extent, &request_ret,
1390                                                &local_err);
1391         if (local_err) {
1392             trace_nbd_co_request_fail(request.from, request.len, request.handle,
1393                                       request.flags, request.type,
1394                                       nbd_cmd_lookup(request.type),
1395                                       ret, error_get_pretty(local_err));
1396             error_free(local_err);
1397             local_err = NULL;
1398         }
1399     } while (ret < 0 && nbd_client_connecting_wait(s));
1400 
1401     if (ret < 0 || request_ret < 0) {
1402         return ret ? ret : request_ret;
1403     }
1404 
1405     assert(extent.length);
1406     *pnum = extent.length;
1407     *map = offset;
1408     *file = bs;
1409     return (extent.flags & NBD_STATE_HOLE ? 0 : BDRV_BLOCK_DATA) |
1410         (extent.flags & NBD_STATE_ZERO ? BDRV_BLOCK_ZERO : 0) |
1411         BDRV_BLOCK_OFFSET_VALID;
1412 }
1413 
1414 static int nbd_client_reopen_prepare(BDRVReopenState *state,
1415                                      BlockReopenQueue *queue, Error **errp)
1416 {
1417     BDRVNBDState *s = (BDRVNBDState *)state->bs->opaque;
1418 
1419     if ((state->flags & BDRV_O_RDWR) && (s->info.flags & NBD_FLAG_READ_ONLY)) {
1420         error_setg(errp, "Can't reopen read-only NBD mount as read/write");
1421         return -EACCES;
1422     }
1423     return 0;
1424 }
1425 
1426 static void nbd_client_close(BlockDriverState *bs)
1427 {
1428     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1429     NBDRequest request = { .type = NBD_CMD_DISC };
1430 
1431     if (s->ioc) {
1432         nbd_send_request(s->ioc, &request);
1433     }
1434 
1435     nbd_teardown_connection(bs);
1436 }
1437 
1438 static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
1439                                                   Error **errp)
1440 {
1441     ERRP_GUARD();
1442     QIOChannelSocket *sioc;
1443 
1444     sioc = qio_channel_socket_new();
1445     qio_channel_set_name(QIO_CHANNEL(sioc), "nbd-client");
1446 
1447     qio_channel_socket_connect_sync(sioc, saddr, errp);
1448     if (*errp) {
1449         object_unref(OBJECT(sioc));
1450         return NULL;
1451     }
1452 
1453     qio_channel_set_delay(QIO_CHANNEL(sioc), false);
1454 
1455     return sioc;
1456 }
1457 
1458 /* nbd_client_handshake takes ownership on sioc. On failure it is unref'ed. */
1459 static int nbd_client_handshake(BlockDriverState *bs, QIOChannelSocket *sioc,
1460                                 Error **errp)
1461 {
1462     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1463     AioContext *aio_context = bdrv_get_aio_context(bs);
1464     int ret;
1465 
1466     trace_nbd_client_handshake(s->export);
1467 
1468     s->sioc = sioc;
1469 
1470     qio_channel_set_blocking(QIO_CHANNEL(sioc), false, NULL);
1471     qio_channel_attach_aio_context(QIO_CHANNEL(sioc), aio_context);
1472 
1473     s->info.request_sizes = true;
1474     s->info.structured_reply = true;
1475     s->info.base_allocation = true;
1476     s->info.x_dirty_bitmap = g_strdup(s->x_dirty_bitmap);
1477     s->info.name = g_strdup(s->export ?: "");
1478     ret = nbd_receive_negotiate(aio_context, QIO_CHANNEL(sioc), s->tlscreds,
1479                                 s->hostname, &s->ioc, &s->info, errp);
1480     g_free(s->info.x_dirty_bitmap);
1481     g_free(s->info.name);
1482     if (ret < 0) {
1483         object_unref(OBJECT(sioc));
1484         s->sioc = NULL;
1485         return ret;
1486     }
1487     if (s->x_dirty_bitmap && !s->info.base_allocation) {
1488         error_setg(errp, "requested x-dirty-bitmap %s not found",
1489                    s->x_dirty_bitmap);
1490         ret = -EINVAL;
1491         goto fail;
1492     }
1493     if (s->info.flags & NBD_FLAG_READ_ONLY) {
1494         ret = bdrv_apply_auto_read_only(bs, "NBD export is read-only", errp);
1495         if (ret < 0) {
1496             goto fail;
1497         }
1498     }
1499     if (s->info.flags & NBD_FLAG_SEND_FUA) {
1500         bs->supported_write_flags = BDRV_REQ_FUA;
1501         bs->supported_zero_flags |= BDRV_REQ_FUA;
1502     }
1503     if (s->info.flags & NBD_FLAG_SEND_WRITE_ZEROES) {
1504         bs->supported_zero_flags |= BDRV_REQ_MAY_UNMAP;
1505         if (s->info.flags & NBD_FLAG_SEND_FAST_ZERO) {
1506             bs->supported_zero_flags |= BDRV_REQ_NO_FALLBACK;
1507         }
1508     }
1509 
1510     if (!s->ioc) {
1511         s->ioc = QIO_CHANNEL(sioc);
1512         object_ref(OBJECT(s->ioc));
1513     }
1514 
1515     trace_nbd_client_handshake_success(s->export);
1516 
1517     return 0;
1518 
1519  fail:
1520     /*
1521      * We have connected, but must fail for other reasons.
1522      * Send NBD_CMD_DISC as a courtesy to the server.
1523      */
1524     {
1525         NBDRequest request = { .type = NBD_CMD_DISC };
1526 
1527         nbd_send_request(s->ioc ?: QIO_CHANNEL(sioc), &request);
1528 
1529         object_unref(OBJECT(sioc));
1530         s->sioc = NULL;
1531 
1532         return ret;
1533     }
1534 }
1535 
1536 /*
1537  * Parse nbd_open options
1538  */
1539 
1540 static int nbd_parse_uri(const char *filename, QDict *options)
1541 {
1542     URI *uri;
1543     const char *p;
1544     QueryParams *qp = NULL;
1545     int ret = 0;
1546     bool is_unix;
1547 
1548     uri = uri_parse(filename);
1549     if (!uri) {
1550         return -EINVAL;
1551     }
1552 
1553     /* transport */
1554     if (!g_strcmp0(uri->scheme, "nbd")) {
1555         is_unix = false;
1556     } else if (!g_strcmp0(uri->scheme, "nbd+tcp")) {
1557         is_unix = false;
1558     } else if (!g_strcmp0(uri->scheme, "nbd+unix")) {
1559         is_unix = true;
1560     } else {
1561         ret = -EINVAL;
1562         goto out;
1563     }
1564 
1565     p = uri->path ? uri->path : "";
1566     if (p[0] == '/') {
1567         p++;
1568     }
1569     if (p[0]) {
1570         qdict_put_str(options, "export", p);
1571     }
1572 
1573     qp = query_params_parse(uri->query);
1574     if (qp->n > 1 || (is_unix && !qp->n) || (!is_unix && qp->n)) {
1575         ret = -EINVAL;
1576         goto out;
1577     }
1578 
1579     if (is_unix) {
1580         /* nbd+unix:///export?socket=path */
1581         if (uri->server || uri->port || strcmp(qp->p[0].name, "socket")) {
1582             ret = -EINVAL;
1583             goto out;
1584         }
1585         qdict_put_str(options, "server.type", "unix");
1586         qdict_put_str(options, "server.path", qp->p[0].value);
1587     } else {
1588         QString *host;
1589         char *port_str;
1590 
1591         /* nbd[+tcp]://host[:port]/export */
1592         if (!uri->server) {
1593             ret = -EINVAL;
1594             goto out;
1595         }
1596 
1597         /* strip braces from literal IPv6 address */
1598         if (uri->server[0] == '[') {
1599             host = qstring_from_substr(uri->server, 1,
1600                                        strlen(uri->server) - 1);
1601         } else {
1602             host = qstring_from_str(uri->server);
1603         }
1604 
1605         qdict_put_str(options, "server.type", "inet");
1606         qdict_put(options, "server.host", host);
1607 
1608         port_str = g_strdup_printf("%d", uri->port ?: NBD_DEFAULT_PORT);
1609         qdict_put_str(options, "server.port", port_str);
1610         g_free(port_str);
1611     }
1612 
1613 out:
1614     if (qp) {
1615         query_params_free(qp);
1616     }
1617     uri_free(uri);
1618     return ret;
1619 }
1620 
1621 static bool nbd_has_filename_options_conflict(QDict *options, Error **errp)
1622 {
1623     const QDictEntry *e;
1624 
1625     for (e = qdict_first(options); e; e = qdict_next(options, e)) {
1626         if (!strcmp(e->key, "host") ||
1627             !strcmp(e->key, "port") ||
1628             !strcmp(e->key, "path") ||
1629             !strcmp(e->key, "export") ||
1630             strstart(e->key, "server.", NULL))
1631         {
1632             error_setg(errp, "Option '%s' cannot be used with a file name",
1633                        e->key);
1634             return true;
1635         }
1636     }
1637 
1638     return false;
1639 }
1640 
1641 static void nbd_parse_filename(const char *filename, QDict *options,
1642                                Error **errp)
1643 {
1644     g_autofree char *file = NULL;
1645     char *export_name;
1646     const char *host_spec;
1647     const char *unixpath;
1648 
1649     if (nbd_has_filename_options_conflict(options, errp)) {
1650         return;
1651     }
1652 
1653     if (strstr(filename, "://")) {
1654         int ret = nbd_parse_uri(filename, options);
1655         if (ret < 0) {
1656             error_setg(errp, "No valid URL specified");
1657         }
1658         return;
1659     }
1660 
1661     file = g_strdup(filename);
1662 
1663     export_name = strstr(file, EN_OPTSTR);
1664     if (export_name) {
1665         if (export_name[strlen(EN_OPTSTR)] == 0) {
1666             return;
1667         }
1668         export_name[0] = 0; /* truncate 'file' */
1669         export_name += strlen(EN_OPTSTR);
1670 
1671         qdict_put_str(options, "export", export_name);
1672     }
1673 
1674     /* extract the host_spec - fail if it's not nbd:... */
1675     if (!strstart(file, "nbd:", &host_spec)) {
1676         error_setg(errp, "File name string for NBD must start with 'nbd:'");
1677         return;
1678     }
1679 
1680     if (!*host_spec) {
1681         return;
1682     }
1683 
1684     /* are we a UNIX or TCP socket? */
1685     if (strstart(host_spec, "unix:", &unixpath)) {
1686         qdict_put_str(options, "server.type", "unix");
1687         qdict_put_str(options, "server.path", unixpath);
1688     } else {
1689         InetSocketAddress *addr = g_new(InetSocketAddress, 1);
1690 
1691         if (inet_parse(addr, host_spec, errp)) {
1692             goto out_inet;
1693         }
1694 
1695         qdict_put_str(options, "server.type", "inet");
1696         qdict_put_str(options, "server.host", addr->host);
1697         qdict_put_str(options, "server.port", addr->port);
1698     out_inet:
1699         qapi_free_InetSocketAddress(addr);
1700     }
1701 }
1702 
1703 static bool nbd_process_legacy_socket_options(QDict *output_options,
1704                                               QemuOpts *legacy_opts,
1705                                               Error **errp)
1706 {
1707     const char *path = qemu_opt_get(legacy_opts, "path");
1708     const char *host = qemu_opt_get(legacy_opts, "host");
1709     const char *port = qemu_opt_get(legacy_opts, "port");
1710     const QDictEntry *e;
1711 
1712     if (!path && !host && !port) {
1713         return true;
1714     }
1715 
1716     for (e = qdict_first(output_options); e; e = qdict_next(output_options, e))
1717     {
1718         if (strstart(e->key, "server.", NULL)) {
1719             error_setg(errp, "Cannot use 'server' and path/host/port at the "
1720                        "same time");
1721             return false;
1722         }
1723     }
1724 
1725     if (path && host) {
1726         error_setg(errp, "path and host may not be used at the same time");
1727         return false;
1728     } else if (path) {
1729         if (port) {
1730             error_setg(errp, "port may not be used without host");
1731             return false;
1732         }
1733 
1734         qdict_put_str(output_options, "server.type", "unix");
1735         qdict_put_str(output_options, "server.path", path);
1736     } else if (host) {
1737         qdict_put_str(output_options, "server.type", "inet");
1738         qdict_put_str(output_options, "server.host", host);
1739         qdict_put_str(output_options, "server.port",
1740                       port ?: stringify(NBD_DEFAULT_PORT));
1741     }
1742 
1743     return true;
1744 }
1745 
1746 static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options,
1747                                  Error **errp)
1748 {
1749     SocketAddress *saddr = NULL;
1750     QDict *addr = NULL;
1751     Visitor *iv = NULL;
1752 
1753     qdict_extract_subqdict(options, &addr, "server.");
1754     if (!qdict_size(addr)) {
1755         error_setg(errp, "NBD server address missing");
1756         goto done;
1757     }
1758 
1759     iv = qobject_input_visitor_new_flat_confused(addr, errp);
1760     if (!iv) {
1761         goto done;
1762     }
1763 
1764     if (!visit_type_SocketAddress(iv, NULL, &saddr, errp)) {
1765         goto done;
1766     }
1767 
1768 done:
1769     qobject_unref(addr);
1770     visit_free(iv);
1771     return saddr;
1772 }
1773 
1774 static QCryptoTLSCreds *nbd_get_tls_creds(const char *id, Error **errp)
1775 {
1776     Object *obj;
1777     QCryptoTLSCreds *creds;
1778 
1779     obj = object_resolve_path_component(
1780         object_get_objects_root(), id);
1781     if (!obj) {
1782         error_setg(errp, "No TLS credentials with id '%s'",
1783                    id);
1784         return NULL;
1785     }
1786     creds = (QCryptoTLSCreds *)
1787         object_dynamic_cast(obj, TYPE_QCRYPTO_TLS_CREDS);
1788     if (!creds) {
1789         error_setg(errp, "Object with id '%s' is not TLS credentials",
1790                    id);
1791         return NULL;
1792     }
1793 
1794     if (creds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
1795         error_setg(errp,
1796                    "Expecting TLS credentials with a client endpoint");
1797         return NULL;
1798     }
1799     object_ref(obj);
1800     return creds;
1801 }
1802 
1803 
1804 static QemuOptsList nbd_runtime_opts = {
1805     .name = "nbd",
1806     .head = QTAILQ_HEAD_INITIALIZER(nbd_runtime_opts.head),
1807     .desc = {
1808         {
1809             .name = "host",
1810             .type = QEMU_OPT_STRING,
1811             .help = "TCP host to connect to",
1812         },
1813         {
1814             .name = "port",
1815             .type = QEMU_OPT_STRING,
1816             .help = "TCP port to connect to",
1817         },
1818         {
1819             .name = "path",
1820             .type = QEMU_OPT_STRING,
1821             .help = "Unix socket path to connect to",
1822         },
1823         {
1824             .name = "export",
1825             .type = QEMU_OPT_STRING,
1826             .help = "Name of the NBD export to open",
1827         },
1828         {
1829             .name = "tls-creds",
1830             .type = QEMU_OPT_STRING,
1831             .help = "ID of the TLS credentials to use",
1832         },
1833         {
1834             .name = "x-dirty-bitmap",
1835             .type = QEMU_OPT_STRING,
1836             .help = "experimental: expose named dirty bitmap in place of "
1837                     "block status",
1838         },
1839         {
1840             .name = "reconnect-delay",
1841             .type = QEMU_OPT_NUMBER,
1842             .help = "On an unexpected disconnect, the nbd client tries to "
1843                     "connect again until succeeding or encountering a serious "
1844                     "error.  During the first @reconnect-delay seconds, all "
1845                     "requests are paused and will be rerun on a successful "
1846                     "reconnect. After that time, any delayed requests and all "
1847                     "future requests before a successful reconnect will "
1848                     "immediately fail. Default 0",
1849         },
1850         { /* end of list */ }
1851     },
1852 };
1853 
1854 static int nbd_process_options(BlockDriverState *bs, QDict *options,
1855                                Error **errp)
1856 {
1857     BDRVNBDState *s = bs->opaque;
1858     QemuOpts *opts;
1859     int ret = -EINVAL;
1860 
1861     opts = qemu_opts_create(&nbd_runtime_opts, NULL, 0, &error_abort);
1862     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1863         goto error;
1864     }
1865 
1866     /* Translate @host, @port, and @path to a SocketAddress */
1867     if (!nbd_process_legacy_socket_options(options, opts, errp)) {
1868         goto error;
1869     }
1870 
1871     /* Pop the config into our state object. Exit if invalid. */
1872     s->saddr = nbd_config(s, options, errp);
1873     if (!s->saddr) {
1874         goto error;
1875     }
1876 
1877     s->export = g_strdup(qemu_opt_get(opts, "export"));
1878     if (s->export && strlen(s->export) > NBD_MAX_STRING_SIZE) {
1879         error_setg(errp, "export name too long to send to server");
1880         goto error;
1881     }
1882 
1883     s->tlscredsid = g_strdup(qemu_opt_get(opts, "tls-creds"));
1884     if (s->tlscredsid) {
1885         s->tlscreds = nbd_get_tls_creds(s->tlscredsid, errp);
1886         if (!s->tlscreds) {
1887             goto error;
1888         }
1889 
1890         /* TODO SOCKET_ADDRESS_KIND_FD where fd has AF_INET or AF_INET6 */
1891         if (s->saddr->type != SOCKET_ADDRESS_TYPE_INET) {
1892             error_setg(errp, "TLS only supported over IP sockets");
1893             goto error;
1894         }
1895         s->hostname = s->saddr->u.inet.host;
1896     }
1897 
1898     s->x_dirty_bitmap = g_strdup(qemu_opt_get(opts, "x-dirty-bitmap"));
1899     if (s->x_dirty_bitmap && strlen(s->x_dirty_bitmap) > NBD_MAX_STRING_SIZE) {
1900         error_setg(errp, "x-dirty-bitmap query too long to send to server");
1901         goto error;
1902     }
1903 
1904     s->reconnect_delay = qemu_opt_get_number(opts, "reconnect-delay", 0);
1905 
1906     ret = 0;
1907 
1908  error:
1909     if (ret < 0) {
1910         nbd_clear_bdrvstate(s);
1911     }
1912     qemu_opts_del(opts);
1913     return ret;
1914 }
1915 
1916 static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
1917                     Error **errp)
1918 {
1919     int ret;
1920     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1921     QIOChannelSocket *sioc;
1922 
1923     ret = nbd_process_options(bs, options, errp);
1924     if (ret < 0) {
1925         return ret;
1926     }
1927 
1928     s->bs = bs;
1929     qemu_co_mutex_init(&s->send_mutex);
1930     qemu_co_queue_init(&s->free_sema);
1931 
1932     /*
1933      * establish TCP connection, return error if it fails
1934      * TODO: Configurable retry-until-timeout behaviour.
1935      */
1936     sioc = nbd_establish_connection(s->saddr, errp);
1937     if (!sioc) {
1938         return -ECONNREFUSED;
1939     }
1940 
1941     ret = nbd_client_handshake(bs, sioc, errp);
1942     if (ret < 0) {
1943         nbd_clear_bdrvstate(s);
1944         return ret;
1945     }
1946     /* successfully connected */
1947     s->state = NBD_CLIENT_CONNECTED;
1948 
1949     s->connection_co = qemu_coroutine_create(nbd_connection_entry, s);
1950     bdrv_inc_in_flight(bs);
1951     aio_co_schedule(bdrv_get_aio_context(bs), s->connection_co);
1952 
1953     return 0;
1954 }
1955 
1956 static int nbd_co_flush(BlockDriverState *bs)
1957 {
1958     return nbd_client_co_flush(bs);
1959 }
1960 
1961 static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)
1962 {
1963     BDRVNBDState *s = (BDRVNBDState *)bs->opaque;
1964     uint32_t min = s->info.min_block;
1965     uint32_t max = MIN_NON_ZERO(NBD_MAX_BUFFER_SIZE, s->info.max_block);
1966 
1967     /*
1968      * If the server did not advertise an alignment:
1969      * - a size that is not sector-aligned implies that an alignment
1970      *   of 1 can be used to access those tail bytes
1971      * - advertisement of block status requires an alignment of 1, so
1972      *   that we don't violate block layer constraints that block
1973      *   status is always aligned (as we can't control whether the
1974      *   server will report sub-sector extents, such as a hole at EOF
1975      *   on an unaligned POSIX file)
1976      * - otherwise, assume the server is so old that we are safer avoiding
1977      *   sub-sector requests
1978      */
1979     if (!min) {
1980         min = (!QEMU_IS_ALIGNED(s->info.size, BDRV_SECTOR_SIZE) ||
1981                s->info.base_allocation) ? 1 : BDRV_SECTOR_SIZE;
1982     }
1983 
1984     bs->bl.request_alignment = min;
1985     bs->bl.max_pdiscard = QEMU_ALIGN_DOWN(INT_MAX, min);
1986     bs->bl.max_pwrite_zeroes = max;
1987     bs->bl.max_transfer = max;
1988 
1989     if (s->info.opt_block &&
1990         s->info.opt_block > bs->bl.opt_transfer) {
1991         bs->bl.opt_transfer = s->info.opt_block;
1992     }
1993 }
1994 
1995 static void nbd_close(BlockDriverState *bs)
1996 {
1997     BDRVNBDState *s = bs->opaque;
1998 
1999     nbd_client_close(bs);
2000     nbd_clear_bdrvstate(s);
2001 }
2002 
2003 /*
2004  * NBD cannot truncate, but if the caller asks to truncate to the same size, or
2005  * to a smaller size with exact=false, there is no reason to fail the
2006  * operation.
2007  *
2008  * Preallocation mode is ignored since it does not seems useful to fail when
2009  * we never change anything.
2010  */
2011 static int coroutine_fn nbd_co_truncate(BlockDriverState *bs, int64_t offset,
2012                                         bool exact, PreallocMode prealloc,
2013                                         BdrvRequestFlags flags, Error **errp)
2014 {
2015     BDRVNBDState *s = bs->opaque;
2016 
2017     if (offset != s->info.size && exact) {
2018         error_setg(errp, "Cannot resize NBD nodes");
2019         return -ENOTSUP;
2020     }
2021 
2022     if (offset > s->info.size) {
2023         error_setg(errp, "Cannot grow NBD nodes");
2024         return -EINVAL;
2025     }
2026 
2027     return 0;
2028 }
2029 
2030 static int64_t nbd_getlength(BlockDriverState *bs)
2031 {
2032     BDRVNBDState *s = bs->opaque;
2033 
2034     return s->info.size;
2035 }
2036 
2037 static void nbd_refresh_filename(BlockDriverState *bs)
2038 {
2039     BDRVNBDState *s = bs->opaque;
2040     const char *host = NULL, *port = NULL, *path = NULL;
2041     size_t len = 0;
2042 
2043     if (s->saddr->type == SOCKET_ADDRESS_TYPE_INET) {
2044         const InetSocketAddress *inet = &s->saddr->u.inet;
2045         if (!inet->has_ipv4 && !inet->has_ipv6 && !inet->has_to) {
2046             host = inet->host;
2047             port = inet->port;
2048         }
2049     } else if (s->saddr->type == SOCKET_ADDRESS_TYPE_UNIX) {
2050         path = s->saddr->u.q_unix.path;
2051     } /* else can't represent as pseudo-filename */
2052 
2053     if (path && s->export) {
2054         len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
2055                        "nbd+unix:///%s?socket=%s", s->export, path);
2056     } else if (path && !s->export) {
2057         len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
2058                        "nbd+unix://?socket=%s", path);
2059     } else if (host && s->export) {
2060         len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
2061                        "nbd://%s:%s/%s", host, port, s->export);
2062     } else if (host && !s->export) {
2063         len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
2064                        "nbd://%s:%s", host, port);
2065     }
2066     if (len >= sizeof(bs->exact_filename)) {
2067         /* Name is too long to represent exactly, so leave it empty. */
2068         bs->exact_filename[0] = '\0';
2069     }
2070 }
2071 
2072 static char *nbd_dirname(BlockDriverState *bs, Error **errp)
2073 {
2074     /* The generic bdrv_dirname() implementation is able to work out some
2075      * directory name for NBD nodes, but that would be wrong. So far there is no
2076      * specification for how "export paths" would work, so NBD does not have
2077      * directory names. */
2078     error_setg(errp, "Cannot generate a base directory for NBD nodes");
2079     return NULL;
2080 }
2081 
2082 static const char *const nbd_strong_runtime_opts[] = {
2083     "path",
2084     "host",
2085     "port",
2086     "export",
2087     "tls-creds",
2088     "server.",
2089 
2090     NULL
2091 };
2092 
2093 static BlockDriver bdrv_nbd = {
2094     .format_name                = "nbd",
2095     .protocol_name              = "nbd",
2096     .instance_size              = sizeof(BDRVNBDState),
2097     .bdrv_parse_filename        = nbd_parse_filename,
2098     .bdrv_co_create_opts        = bdrv_co_create_opts_simple,
2099     .create_opts                = &bdrv_create_opts_simple,
2100     .bdrv_file_open             = nbd_open,
2101     .bdrv_reopen_prepare        = nbd_client_reopen_prepare,
2102     .bdrv_co_preadv             = nbd_client_co_preadv,
2103     .bdrv_co_pwritev            = nbd_client_co_pwritev,
2104     .bdrv_co_pwrite_zeroes      = nbd_client_co_pwrite_zeroes,
2105     .bdrv_close                 = nbd_close,
2106     .bdrv_co_flush_to_os        = nbd_co_flush,
2107     .bdrv_co_pdiscard           = nbd_client_co_pdiscard,
2108     .bdrv_refresh_limits        = nbd_refresh_limits,
2109     .bdrv_co_truncate           = nbd_co_truncate,
2110     .bdrv_getlength             = nbd_getlength,
2111     .bdrv_detach_aio_context    = nbd_client_detach_aio_context,
2112     .bdrv_attach_aio_context    = nbd_client_attach_aio_context,
2113     .bdrv_co_drain_begin        = nbd_client_co_drain_begin,
2114     .bdrv_co_drain_end          = nbd_client_co_drain_end,
2115     .bdrv_refresh_filename      = nbd_refresh_filename,
2116     .bdrv_co_block_status       = nbd_client_co_block_status,
2117     .bdrv_dirname               = nbd_dirname,
2118     .strong_runtime_opts        = nbd_strong_runtime_opts,
2119 };
2120 
2121 static BlockDriver bdrv_nbd_tcp = {
2122     .format_name                = "nbd",
2123     .protocol_name              = "nbd+tcp",
2124     .instance_size              = sizeof(BDRVNBDState),
2125     .bdrv_parse_filename        = nbd_parse_filename,
2126     .bdrv_co_create_opts        = bdrv_co_create_opts_simple,
2127     .create_opts                = &bdrv_create_opts_simple,
2128     .bdrv_file_open             = nbd_open,
2129     .bdrv_reopen_prepare        = nbd_client_reopen_prepare,
2130     .bdrv_co_preadv             = nbd_client_co_preadv,
2131     .bdrv_co_pwritev            = nbd_client_co_pwritev,
2132     .bdrv_co_pwrite_zeroes      = nbd_client_co_pwrite_zeroes,
2133     .bdrv_close                 = nbd_close,
2134     .bdrv_co_flush_to_os        = nbd_co_flush,
2135     .bdrv_co_pdiscard           = nbd_client_co_pdiscard,
2136     .bdrv_refresh_limits        = nbd_refresh_limits,
2137     .bdrv_co_truncate           = nbd_co_truncate,
2138     .bdrv_getlength             = nbd_getlength,
2139     .bdrv_detach_aio_context    = nbd_client_detach_aio_context,
2140     .bdrv_attach_aio_context    = nbd_client_attach_aio_context,
2141     .bdrv_co_drain_begin        = nbd_client_co_drain_begin,
2142     .bdrv_co_drain_end          = nbd_client_co_drain_end,
2143     .bdrv_refresh_filename      = nbd_refresh_filename,
2144     .bdrv_co_block_status       = nbd_client_co_block_status,
2145     .bdrv_dirname               = nbd_dirname,
2146     .strong_runtime_opts        = nbd_strong_runtime_opts,
2147 };
2148 
2149 static BlockDriver bdrv_nbd_unix = {
2150     .format_name                = "nbd",
2151     .protocol_name              = "nbd+unix",
2152     .instance_size              = sizeof(BDRVNBDState),
2153     .bdrv_parse_filename        = nbd_parse_filename,
2154     .bdrv_co_create_opts        = bdrv_co_create_opts_simple,
2155     .create_opts                = &bdrv_create_opts_simple,
2156     .bdrv_file_open             = nbd_open,
2157     .bdrv_reopen_prepare        = nbd_client_reopen_prepare,
2158     .bdrv_co_preadv             = nbd_client_co_preadv,
2159     .bdrv_co_pwritev            = nbd_client_co_pwritev,
2160     .bdrv_co_pwrite_zeroes      = nbd_client_co_pwrite_zeroes,
2161     .bdrv_close                 = nbd_close,
2162     .bdrv_co_flush_to_os        = nbd_co_flush,
2163     .bdrv_co_pdiscard           = nbd_client_co_pdiscard,
2164     .bdrv_refresh_limits        = nbd_refresh_limits,
2165     .bdrv_co_truncate           = nbd_co_truncate,
2166     .bdrv_getlength             = nbd_getlength,
2167     .bdrv_detach_aio_context    = nbd_client_detach_aio_context,
2168     .bdrv_attach_aio_context    = nbd_client_attach_aio_context,
2169     .bdrv_co_drain_begin        = nbd_client_co_drain_begin,
2170     .bdrv_co_drain_end          = nbd_client_co_drain_end,
2171     .bdrv_refresh_filename      = nbd_refresh_filename,
2172     .bdrv_co_block_status       = nbd_client_co_block_status,
2173     .bdrv_dirname               = nbd_dirname,
2174     .strong_runtime_opts        = nbd_strong_runtime_opts,
2175 };
2176 
2177 static void bdrv_nbd_init(void)
2178 {
2179     bdrv_register(&bdrv_nbd);
2180     bdrv_register(&bdrv_nbd_tcp);
2181     bdrv_register(&bdrv_nbd_unix);
2182 }
2183 
2184 block_init(bdrv_nbd_init);
2185