xref: /openbmc/qemu/nbd/client.c (revision ba632924)
1 /*
2  *  Copyright (C) 2016-2018 Red Hat, Inc.
3  *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
4  *
5  *  Network Block Device Client Side
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License as published by
9  *  the Free Software Foundation; under version 2 of the License.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qapi/error.h"
22 #include "trace.h"
23 #include "nbd-internal.h"
24 #include "qemu/cutils.h"
25 
26 /* Definitions for opaque data types */
27 
28 static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);
29 
30 /* That's all folks */
31 
32 /* Basic flow for negotiation
33 
34    Server         Client
35    Negotiate
36 
37    or
38 
39    Server         Client
40    Negotiate #1
41                   Option
42    Negotiate #2
43 
44    ----
45 
46    followed by
47 
48    Server         Client
49                   Request
50    Response
51                   Request
52    Response
53                   ...
54    ...
55                   Request (type == 2)
56 
57 */
58 
59 /* Send an option request.
60  *
61  * The request is for option @opt, with @data containing @len bytes of
62  * additional payload for the request (@len may be -1 to treat @data as
63  * a C string; and @data may be NULL if @len is 0).
64  * Return 0 if successful, -1 with errp set if it is impossible to
65  * continue. */
66 static int nbd_send_option_request(QIOChannel *ioc, uint32_t opt,
67                                    uint32_t len, const char *data,
68                                    Error **errp)
69 {
70     NBDOption req;
71     QEMU_BUILD_BUG_ON(sizeof(req) != 16);
72 
73     if (len == -1) {
74         req.length = len = strlen(data);
75     }
76     trace_nbd_send_option_request(opt, nbd_opt_lookup(opt), len);
77 
78     stq_be_p(&req.magic, NBD_OPTS_MAGIC);
79     stl_be_p(&req.option, opt);
80     stl_be_p(&req.length, len);
81 
82     if (nbd_write(ioc, &req, sizeof(req), errp) < 0) {
83         error_prepend(errp, "Failed to send option request header: ");
84         return -1;
85     }
86 
87     if (len && nbd_write(ioc, (char *) data, len, errp) < 0) {
88         error_prepend(errp, "Failed to send option request data: ");
89         return -1;
90     }
91 
92     return 0;
93 }
94 
95 /* Send NBD_OPT_ABORT as a courtesy to let the server know that we are
96  * not going to attempt further negotiation. */
97 static void nbd_send_opt_abort(QIOChannel *ioc)
98 {
99     /* Technically, a compliant server is supposed to reply to us; but
100      * older servers disconnected instead. At any rate, we're allowed
101      * to disconnect without waiting for the server reply, so we don't
102      * even care if the request makes it to the server, let alone
103      * waiting around for whether the server replies. */
104     nbd_send_option_request(ioc, NBD_OPT_ABORT, 0, NULL, NULL);
105 }
106 
107 
108 /* Receive the header of an option reply, which should match the given
109  * opt.  Read through the length field, but NOT the length bytes of
110  * payload. Return 0 if successful, -1 with errp set if it is
111  * impossible to continue. */
112 static int nbd_receive_option_reply(QIOChannel *ioc, uint32_t opt,
113                                     NBDOptionReply *reply, Error **errp)
114 {
115     QEMU_BUILD_BUG_ON(sizeof(*reply) != 20);
116     if (nbd_read(ioc, reply, sizeof(*reply), "option reply", errp) < 0) {
117         nbd_send_opt_abort(ioc);
118         return -1;
119     }
120     reply->magic = be64_to_cpu(reply->magic);
121     reply->option = be32_to_cpu(reply->option);
122     reply->type = be32_to_cpu(reply->type);
123     reply->length = be32_to_cpu(reply->length);
124 
125     trace_nbd_receive_option_reply(reply->option, nbd_opt_lookup(reply->option),
126                                    reply->type, nbd_rep_lookup(reply->type),
127                                    reply->length);
128 
129     if (reply->magic != NBD_REP_MAGIC) {
130         error_setg(errp, "Unexpected option reply magic");
131         nbd_send_opt_abort(ioc);
132         return -1;
133     }
134     if (reply->option != opt) {
135         error_setg(errp, "Unexpected option type %u (%s), expected %u (%s)",
136                    reply->option, nbd_opt_lookup(reply->option),
137                    opt, nbd_opt_lookup(opt));
138         nbd_send_opt_abort(ioc);
139         return -1;
140     }
141     return 0;
142 }
143 
144 /* If reply represents success, return 1 without further action.
145  * If reply represents an error, consume the optional payload of
146  * the packet on ioc.  Then return 0 for unsupported (so the client
147  * can fall back to other approaches), or -1 with errp set for other
148  * errors.
149  */
150 static int nbd_handle_reply_err(QIOChannel *ioc, NBDOptionReply *reply,
151                                 Error **errp)
152 {
153     char *msg = NULL;
154     int result = -1;
155 
156     if (!(reply->type & (1 << 31))) {
157         return 1;
158     }
159 
160     if (reply->length) {
161         if (reply->length > NBD_MAX_BUFFER_SIZE) {
162             error_setg(errp, "server error %" PRIu32
163                        " (%s) message is too long",
164                        reply->type, nbd_rep_lookup(reply->type));
165             goto cleanup;
166         }
167         msg = g_malloc(reply->length + 1);
168         if (nbd_read(ioc, msg, reply->length, NULL, errp) < 0) {
169             error_prepend(errp, "Failed to read option error %" PRIu32
170                           " (%s) message: ",
171                           reply->type, nbd_rep_lookup(reply->type));
172             goto cleanup;
173         }
174         msg[reply->length] = '\0';
175         trace_nbd_server_error_msg(reply->type,
176                                    nbd_reply_type_lookup(reply->type), msg);
177     }
178 
179     switch (reply->type) {
180     case NBD_REP_ERR_UNSUP:
181         trace_nbd_reply_err_unsup(reply->option, nbd_opt_lookup(reply->option));
182         result = 0;
183         goto cleanup;
184 
185     case NBD_REP_ERR_POLICY:
186         error_setg(errp, "Denied by server for option %" PRIu32 " (%s)",
187                    reply->option, nbd_opt_lookup(reply->option));
188         break;
189 
190     case NBD_REP_ERR_INVALID:
191         error_setg(errp, "Invalid parameters for option %" PRIu32 " (%s)",
192                    reply->option, nbd_opt_lookup(reply->option));
193         break;
194 
195     case NBD_REP_ERR_PLATFORM:
196         error_setg(errp, "Server lacks support for option %" PRIu32 " (%s)",
197                    reply->option, nbd_opt_lookup(reply->option));
198         break;
199 
200     case NBD_REP_ERR_TLS_REQD:
201         error_setg(errp, "TLS negotiation required before option %" PRIu32
202                    " (%s)", reply->option, nbd_opt_lookup(reply->option));
203         break;
204 
205     case NBD_REP_ERR_UNKNOWN:
206         error_setg(errp, "Requested export not available");
207         break;
208 
209     case NBD_REP_ERR_SHUTDOWN:
210         error_setg(errp, "Server shutting down before option %" PRIu32 " (%s)",
211                    reply->option, nbd_opt_lookup(reply->option));
212         break;
213 
214     case NBD_REP_ERR_BLOCK_SIZE_REQD:
215         error_setg(errp, "Server requires INFO_BLOCK_SIZE for option %" PRIu32
216                    " (%s)", reply->option, nbd_opt_lookup(reply->option));
217         break;
218 
219     default:
220         error_setg(errp, "Unknown error code when asking for option %" PRIu32
221                    " (%s)", reply->option, nbd_opt_lookup(reply->option));
222         break;
223     }
224 
225     if (msg) {
226         error_append_hint(errp, "server reported: %s\n", msg);
227     }
228 
229  cleanup:
230     g_free(msg);
231     if (result < 0) {
232         nbd_send_opt_abort(ioc);
233     }
234     return result;
235 }
236 
237 /* nbd_receive_list:
238  * Process another portion of the NBD_OPT_LIST reply, populating any
239  * name received into *@name. If @description is non-NULL, and the
240  * server provided a description, that is also populated. The caller
241  * must eventually call g_free() on success.
242  * Returns 1 if name and description were set and iteration must continue,
243  *         0 if iteration is complete (including if OPT_LIST unsupported),
244  *         -1 with @errp set if an unrecoverable error occurred.
245  */
246 static int nbd_receive_list(QIOChannel *ioc, char **name, char **description,
247                             Error **errp)
248 {
249     int ret = -1;
250     NBDOptionReply reply;
251     uint32_t len;
252     uint32_t namelen;
253     char *local_name = NULL;
254     char *local_desc = NULL;
255     int error;
256 
257     if (nbd_receive_option_reply(ioc, NBD_OPT_LIST, &reply, errp) < 0) {
258         return -1;
259     }
260     error = nbd_handle_reply_err(ioc, &reply, errp);
261     if (error <= 0) {
262         return error;
263     }
264     len = reply.length;
265 
266     if (reply.type == NBD_REP_ACK) {
267         if (len != 0) {
268             error_setg(errp, "length too long for option end");
269             nbd_send_opt_abort(ioc);
270             return -1;
271         }
272         return 0;
273     } else if (reply.type != NBD_REP_SERVER) {
274         error_setg(errp, "Unexpected reply type %u (%s), expected %u (%s)",
275                    reply.type, nbd_rep_lookup(reply.type),
276                    NBD_REP_SERVER, nbd_rep_lookup(NBD_REP_SERVER));
277         nbd_send_opt_abort(ioc);
278         return -1;
279     }
280 
281     if (len < sizeof(namelen) || len > NBD_MAX_BUFFER_SIZE) {
282         error_setg(errp, "incorrect option length %" PRIu32, len);
283         nbd_send_opt_abort(ioc);
284         return -1;
285     }
286     if (nbd_read32(ioc, &namelen, "option name length", errp) < 0) {
287         nbd_send_opt_abort(ioc);
288         return -1;
289     }
290     len -= sizeof(namelen);
291     if (len < namelen) {
292         error_setg(errp, "incorrect option name length");
293         nbd_send_opt_abort(ioc);
294         return -1;
295     }
296 
297     local_name = g_malloc(namelen + 1);
298     if (nbd_read(ioc, local_name, namelen, "export name", errp) < 0) {
299         nbd_send_opt_abort(ioc);
300         goto out;
301     }
302     local_name[namelen] = '\0';
303     len -= namelen;
304     if (len) {
305         local_desc = g_malloc(len + 1);
306         if (nbd_read(ioc, local_desc, len, "export description", errp) < 0) {
307             nbd_send_opt_abort(ioc);
308             goto out;
309         }
310         local_desc[len] = '\0';
311     }
312 
313     trace_nbd_receive_list(local_name, local_desc ?: "");
314     *name = local_name;
315     local_name = NULL;
316     if (description) {
317         *description = local_desc;
318         local_desc = NULL;
319     }
320     ret = 1;
321 
322  out:
323     g_free(local_name);
324     g_free(local_desc);
325     return ret;
326 }
327 
328 
329 /*
330  * nbd_opt_info_or_go:
331  * Send option for NBD_OPT_INFO or NBD_OPT_GO and parse the reply.
332  * Returns -1 if the option proves the export @info->name cannot be
333  * used, 0 if the option is unsupported (fall back to NBD_OPT_LIST and
334  * NBD_OPT_EXPORT_NAME in that case), and > 0 if the export is good to
335  * go (with the rest of @info populated).
336  */
337 static int nbd_opt_info_or_go(QIOChannel *ioc, uint32_t opt,
338                               NBDExportInfo *info, Error **errp)
339 {
340     NBDOptionReply reply;
341     uint32_t len = strlen(info->name);
342     uint16_t type;
343     int error;
344     char *buf;
345 
346     /* The protocol requires that the server send NBD_INFO_EXPORT with
347      * a non-zero flags (at least NBD_FLAG_HAS_FLAGS must be set); so
348      * flags still 0 is a witness of a broken server. */
349     info->flags = 0;
350 
351     assert(opt == NBD_OPT_GO || opt == NBD_OPT_INFO);
352     trace_nbd_opt_info_go_start(nbd_opt_lookup(opt), info->name);
353     buf = g_malloc(4 + len + 2 + 2 * info->request_sizes + 1);
354     stl_be_p(buf, len);
355     memcpy(buf + 4, info->name, len);
356     /* At most one request, everything else up to server */
357     stw_be_p(buf + 4 + len, info->request_sizes);
358     if (info->request_sizes) {
359         stw_be_p(buf + 4 + len + 2, NBD_INFO_BLOCK_SIZE);
360     }
361     error = nbd_send_option_request(ioc, opt,
362                                     4 + len + 2 + 2 * info->request_sizes,
363                                     buf, errp);
364     g_free(buf);
365     if (error < 0) {
366         return -1;
367     }
368 
369     while (1) {
370         if (nbd_receive_option_reply(ioc, opt, &reply, errp) < 0) {
371             return -1;
372         }
373         error = nbd_handle_reply_err(ioc, &reply, errp);
374         if (error <= 0) {
375             return error;
376         }
377         len = reply.length;
378 
379         if (reply.type == NBD_REP_ACK) {
380             /*
381              * Server is done sending info, and moved into transmission
382              * phase for NBD_OPT_GO, but make sure it sent flags
383              */
384             if (len) {
385                 error_setg(errp, "server sent invalid NBD_REP_ACK");
386                 return -1;
387             }
388             if (!info->flags) {
389                 error_setg(errp, "broken server omitted NBD_INFO_EXPORT");
390                 return -1;
391             }
392             trace_nbd_opt_info_go_success(nbd_opt_lookup(opt));
393             return 1;
394         }
395         if (reply.type != NBD_REP_INFO) {
396             error_setg(errp, "unexpected reply type %u (%s), expected %u (%s)",
397                        reply.type, nbd_rep_lookup(reply.type),
398                        NBD_REP_INFO, nbd_rep_lookup(NBD_REP_INFO));
399             nbd_send_opt_abort(ioc);
400             return -1;
401         }
402         if (len < sizeof(type)) {
403             error_setg(errp, "NBD_REP_INFO length %" PRIu32 " is too short",
404                        len);
405             nbd_send_opt_abort(ioc);
406             return -1;
407         }
408         if (nbd_read16(ioc, &type, "info type", errp) < 0) {
409             nbd_send_opt_abort(ioc);
410             return -1;
411         }
412         len -= sizeof(type);
413         switch (type) {
414         case NBD_INFO_EXPORT:
415             if (len != sizeof(info->size) + sizeof(info->flags)) {
416                 error_setg(errp, "remaining export info len %" PRIu32
417                            " is unexpected size", len);
418                 nbd_send_opt_abort(ioc);
419                 return -1;
420             }
421             if (nbd_read64(ioc, &info->size, "info size", errp) < 0) {
422                 nbd_send_opt_abort(ioc);
423                 return -1;
424             }
425             if (nbd_read16(ioc, &info->flags, "info flags", errp) < 0) {
426                 nbd_send_opt_abort(ioc);
427                 return -1;
428             }
429             trace_nbd_receive_negotiate_size_flags(info->size, info->flags);
430             break;
431 
432         case NBD_INFO_BLOCK_SIZE:
433             if (len != sizeof(info->min_block) * 3) {
434                 error_setg(errp, "remaining export info len %" PRIu32
435                            " is unexpected size", len);
436                 nbd_send_opt_abort(ioc);
437                 return -1;
438             }
439             if (nbd_read32(ioc, &info->min_block, "info minimum block size",
440                            errp) < 0) {
441                 nbd_send_opt_abort(ioc);
442                 return -1;
443             }
444             if (!is_power_of_2(info->min_block)) {
445                 error_setg(errp, "server minimum block size %" PRIu32
446                            " is not a power of two", info->min_block);
447                 nbd_send_opt_abort(ioc);
448                 return -1;
449             }
450             if (nbd_read32(ioc, &info->opt_block, "info preferred block size",
451                            errp) < 0)
452             {
453                 nbd_send_opt_abort(ioc);
454                 return -1;
455             }
456             if (!is_power_of_2(info->opt_block) ||
457                 info->opt_block < info->min_block) {
458                 error_setg(errp, "server preferred block size %" PRIu32
459                            " is not valid", info->opt_block);
460                 nbd_send_opt_abort(ioc);
461                 return -1;
462             }
463             if (nbd_read32(ioc, &info->max_block, "info maximum block size",
464                            errp) < 0)
465             {
466                 nbd_send_opt_abort(ioc);
467                 return -1;
468             }
469             if (info->max_block < info->min_block) {
470                 error_setg(errp, "server maximum block size %" PRIu32
471                            " is not valid", info->max_block);
472                 nbd_send_opt_abort(ioc);
473                 return -1;
474             }
475             trace_nbd_opt_info_block_size(info->min_block, info->opt_block,
476                                           info->max_block);
477             break;
478 
479         default:
480             trace_nbd_opt_info_unknown(type, nbd_info_lookup(type));
481             if (nbd_drop(ioc, len, errp) < 0) {
482                 error_prepend(errp, "Failed to read info payload: ");
483                 nbd_send_opt_abort(ioc);
484                 return -1;
485             }
486             break;
487         }
488     }
489 }
490 
491 /* Return -1 on failure, 0 if wantname is an available export. */
492 static int nbd_receive_query_exports(QIOChannel *ioc,
493                                      const char *wantname,
494                                      Error **errp)
495 {
496     bool list_empty = true;
497     bool found_export = false;
498 
499     trace_nbd_receive_query_exports_start(wantname);
500     if (nbd_send_option_request(ioc, NBD_OPT_LIST, 0, NULL, errp) < 0) {
501         return -1;
502     }
503 
504     while (1) {
505         char *name;
506         int ret = nbd_receive_list(ioc, &name, NULL, errp);
507 
508         if (ret < 0) {
509             /* Server gave unexpected reply */
510             return -1;
511         } else if (ret == 0) {
512             /* Done iterating. */
513             if (list_empty) {
514                 /*
515                  * We don't have enough context to tell a server that
516                  * sent an empty list apart from a server that does
517                  * not support the list command; but as this function
518                  * is just used to trigger a nicer error message
519                  * before trying NBD_OPT_EXPORT_NAME, assume the
520                  * export is available.
521                  */
522                 return 0;
523             } else if (!found_export) {
524                 error_setg(errp, "No export with name '%s' available",
525                            wantname);
526                 nbd_send_opt_abort(ioc);
527                 return -1;
528             }
529             trace_nbd_receive_query_exports_success(wantname);
530             return 0;
531         }
532         list_empty = false;
533         if (!strcmp(name, wantname)) {
534             found_export = true;
535         }
536         g_free(name);
537     }
538 }
539 
540 /* nbd_request_simple_option: Send an option request, and parse the reply
541  * return 1 for successful negotiation,
542  *        0 if operation is unsupported,
543  *        -1 with errp set for any other error
544  */
545 static int nbd_request_simple_option(QIOChannel *ioc, int opt, Error **errp)
546 {
547     NBDOptionReply reply;
548     int error;
549 
550     if (nbd_send_option_request(ioc, opt, 0, NULL, errp) < 0) {
551         return -1;
552     }
553 
554     if (nbd_receive_option_reply(ioc, opt, &reply, errp) < 0) {
555         return -1;
556     }
557     error = nbd_handle_reply_err(ioc, &reply, errp);
558     if (error <= 0) {
559         return error;
560     }
561 
562     if (reply.type != NBD_REP_ACK) {
563         error_setg(errp, "Server answered option %d (%s) with unexpected "
564                    "reply %" PRIu32 " (%s)", opt, nbd_opt_lookup(opt),
565                    reply.type, nbd_rep_lookup(reply.type));
566         nbd_send_opt_abort(ioc);
567         return -1;
568     }
569 
570     if (reply.length != 0) {
571         error_setg(errp, "Option %d ('%s') response length is %" PRIu32
572                    " (it should be zero)", opt, nbd_opt_lookup(opt),
573                    reply.length);
574         nbd_send_opt_abort(ioc);
575         return -1;
576     }
577 
578     return 1;
579 }
580 
581 static QIOChannel *nbd_receive_starttls(QIOChannel *ioc,
582                                         QCryptoTLSCreds *tlscreds,
583                                         const char *hostname, Error **errp)
584 {
585     int ret;
586     QIOChannelTLS *tioc;
587     struct NBDTLSHandshakeData data = { 0 };
588 
589     ret = nbd_request_simple_option(ioc, NBD_OPT_STARTTLS, errp);
590     if (ret <= 0) {
591         if (ret == 0) {
592             error_setg(errp, "Server don't support STARTTLS option");
593             nbd_send_opt_abort(ioc);
594         }
595         return NULL;
596     }
597 
598     trace_nbd_receive_starttls_new_client();
599     tioc = qio_channel_tls_new_client(ioc, tlscreds, hostname, errp);
600     if (!tioc) {
601         return NULL;
602     }
603     qio_channel_set_name(QIO_CHANNEL(tioc), "nbd-client-tls");
604     data.loop = g_main_loop_new(g_main_context_default(), FALSE);
605     trace_nbd_receive_starttls_tls_handshake();
606     qio_channel_tls_handshake(tioc,
607                               nbd_tls_handshake,
608                               &data,
609                               NULL,
610                               NULL);
611 
612     if (!data.complete) {
613         g_main_loop_run(data.loop);
614     }
615     g_main_loop_unref(data.loop);
616     if (data.error) {
617         error_propagate(errp, data.error);
618         object_unref(OBJECT(tioc));
619         return NULL;
620     }
621 
622     return QIO_CHANNEL(tioc);
623 }
624 
625 /*
626  * nbd_send_meta_query:
627  * Send 0 or 1 set/list meta context queries.
628  * Return 0 on success, -1 with errp set for any error
629  */
630 static int nbd_send_meta_query(QIOChannel *ioc, uint32_t opt,
631                                const char *export, const char *query,
632                                Error **errp)
633 {
634     int ret;
635     uint32_t export_len = strlen(export);
636     uint32_t queries = !!query;
637     uint32_t query_len = 0;
638     uint32_t data_len;
639     char *data;
640     char *p;
641 
642     data_len = sizeof(export_len) + export_len + sizeof(queries);
643     if (query) {
644         query_len = strlen(query);
645         data_len += sizeof(query_len) + query_len;
646     } else {
647         assert(opt == NBD_OPT_LIST_META_CONTEXT);
648     }
649     p = data = g_malloc(data_len);
650 
651     trace_nbd_opt_meta_request(nbd_opt_lookup(opt), query ?: "(all)", export);
652     stl_be_p(p, export_len);
653     memcpy(p += sizeof(export_len), export, export_len);
654     stl_be_p(p += export_len, queries);
655     if (query) {
656         stl_be_p(p += sizeof(queries), query_len);
657         memcpy(p += sizeof(query_len), query, query_len);
658     }
659 
660     ret = nbd_send_option_request(ioc, opt, data_len, data, errp);
661     g_free(data);
662     return ret;
663 }
664 
665 /*
666  * nbd_receive_one_meta_context:
667  * Called in a loop to receive and trace one set/list meta context reply.
668  * Pass non-NULL @name or @id to collect results back to the caller, which
669  * must eventually call g_free().
670  * return 1 if name is set and iteration must continue,
671  *        0 if iteration is complete (including if option is unsupported),
672  *        -1 with errp set for any error
673  */
674 static int nbd_receive_one_meta_context(QIOChannel *ioc,
675                                         uint32_t opt,
676                                         char **name,
677                                         uint32_t *id,
678                                         Error **errp)
679 {
680     int ret;
681     NBDOptionReply reply;
682     char *local_name = NULL;
683     uint32_t local_id;
684 
685     if (nbd_receive_option_reply(ioc, opt, &reply, errp) < 0) {
686         return -1;
687     }
688 
689     ret = nbd_handle_reply_err(ioc, &reply, errp);
690     if (ret <= 0) {
691         return ret;
692     }
693 
694     if (reply.type == NBD_REP_ACK) {
695         if (reply.length != 0) {
696             error_setg(errp, "Unexpected length to ACK response");
697             nbd_send_opt_abort(ioc);
698             return -1;
699         }
700         return 0;
701     } else if (reply.type != NBD_REP_META_CONTEXT) {
702         error_setg(errp, "Unexpected reply type %u (%s), expected %u (%s)",
703                    reply.type, nbd_rep_lookup(reply.type),
704                    NBD_REP_META_CONTEXT, nbd_rep_lookup(NBD_REP_META_CONTEXT));
705         nbd_send_opt_abort(ioc);
706         return -1;
707     }
708 
709     if (reply.length <= sizeof(local_id) ||
710         reply.length > NBD_MAX_BUFFER_SIZE) {
711         error_setg(errp, "Failed to negotiate meta context, server "
712                    "answered with unexpected length %" PRIu32,
713                    reply.length);
714         nbd_send_opt_abort(ioc);
715         return -1;
716     }
717 
718     if (nbd_read32(ioc, &local_id, "context id", errp) < 0) {
719         return -1;
720     }
721 
722     reply.length -= sizeof(local_id);
723     local_name = g_malloc(reply.length + 1);
724     if (nbd_read(ioc, local_name, reply.length, "context name", errp) < 0) {
725         g_free(local_name);
726         return -1;
727     }
728     local_name[reply.length] = '\0';
729     trace_nbd_opt_meta_reply(nbd_opt_lookup(opt), local_name, local_id);
730 
731     if (name) {
732         *name = local_name;
733     } else {
734         g_free(local_name);
735     }
736     if (id) {
737         *id = local_id;
738     }
739     return 1;
740 }
741 
742 /*
743  * nbd_negotiate_simple_meta_context:
744  * Request the server to set the meta context for export @info->name
745  * using @info->x_dirty_bitmap with a fallback to "base:allocation",
746  * setting @info->context_id to the resulting id. Fail if the server
747  * responds with more than one context or with a context different
748  * than the query.
749  * return 1 for successful negotiation,
750  *        0 if operation is unsupported,
751  *        -1 with errp set for any other error
752  */
753 static int nbd_negotiate_simple_meta_context(QIOChannel *ioc,
754                                              NBDExportInfo *info,
755                                              Error **errp)
756 {
757     /*
758      * TODO: Removing the x_dirty_bitmap hack will mean refactoring
759      * this function to request and store ids for multiple contexts
760      * (both base:allocation and a dirty bitmap), at which point this
761      * function should lose the term _simple.
762      */
763     int ret;
764     const char *context = info->x_dirty_bitmap ?: "base:allocation";
765     bool received = false;
766     char *name = NULL;
767 
768     if (nbd_send_meta_query(ioc, NBD_OPT_SET_META_CONTEXT,
769                             info->name, context, errp) < 0) {
770         return -1;
771     }
772 
773     ret = nbd_receive_one_meta_context(ioc, NBD_OPT_SET_META_CONTEXT,
774                                        &name, &info->context_id, errp);
775     if (ret < 0) {
776         return -1;
777     }
778     if (ret == 1) {
779         if (strcmp(context, name)) {
780             error_setg(errp, "Failed to negotiate meta context '%s', server "
781                        "answered with different context '%s'", context,
782                        name);
783             g_free(name);
784             nbd_send_opt_abort(ioc);
785             return -1;
786         }
787         g_free(name);
788         received = true;
789 
790         ret = nbd_receive_one_meta_context(ioc, NBD_OPT_SET_META_CONTEXT,
791                                            NULL, NULL, errp);
792         if (ret < 0) {
793             return -1;
794         }
795     }
796     if (ret != 0) {
797         error_setg(errp, "Server answered with more than one context");
798         nbd_send_opt_abort(ioc);
799         return -1;
800     }
801     return received;
802 }
803 
804 /*
805  * nbd_list_meta_contexts:
806  * Request the server to list all meta contexts for export @info->name.
807  * return 0 if list is complete (even if empty),
808  *        -1 with errp set for any error
809  */
810 static int nbd_list_meta_contexts(QIOChannel *ioc,
811                                   NBDExportInfo *info,
812                                   Error **errp)
813 {
814     int ret;
815     int seen_any = false;
816     int seen_qemu = false;
817 
818     if (nbd_send_meta_query(ioc, NBD_OPT_LIST_META_CONTEXT,
819                             info->name, NULL, errp) < 0) {
820         return -1;
821     }
822 
823     while (1) {
824         char *context;
825 
826         ret = nbd_receive_one_meta_context(ioc, NBD_OPT_LIST_META_CONTEXT,
827                                            &context, NULL, errp);
828         if (ret == 0 && seen_any && !seen_qemu) {
829             /*
830              * Work around qemu 3.0 bug: the server forgot to send
831              * "qemu:" replies to 0 queries. If we saw at least one
832              * reply (probably base:allocation), but none of them were
833              * qemu:, then run a more specific query to make sure.
834              */
835             seen_qemu = true;
836             if (nbd_send_meta_query(ioc, NBD_OPT_LIST_META_CONTEXT,
837                                     info->name, "qemu:", errp) < 0) {
838                 return -1;
839             }
840             continue;
841         }
842         if (ret <= 0) {
843             return ret;
844         }
845         seen_any = true;
846         seen_qemu |= strstart(context, "qemu:", NULL);
847         info->contexts = g_renew(char *, info->contexts, ++info->n_contexts);
848         info->contexts[info->n_contexts - 1] = context;
849     }
850 }
851 
852 /*
853  * nbd_start_negotiate:
854  * Start the handshake to the server.  After a positive return, the server
855  * is ready to accept additional NBD_OPT requests.
856  * Returns: negative errno: failure talking to server
857  *          0: server is oldstyle, must call nbd_negotiate_finish_oldstyle
858  *          1: server is newstyle, but can only accept EXPORT_NAME
859  *          2: server is newstyle, but lacks structured replies
860  *          3: server is newstyle and set up for structured replies
861  */
862 static int nbd_start_negotiate(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
863                                const char *hostname, QIOChannel **outioc,
864                                bool structured_reply, bool *zeroes,
865                                Error **errp)
866 {
867     uint64_t magic;
868 
869     trace_nbd_start_negotiate(tlscreds, hostname ? hostname : "<null>");
870 
871     if (zeroes) {
872         *zeroes = true;
873     }
874     if (outioc) {
875         *outioc = NULL;
876     }
877     if (tlscreds && !outioc) {
878         error_setg(errp, "Output I/O channel required for TLS");
879         return -EINVAL;
880     }
881 
882     if (nbd_read64(ioc, &magic, "initial magic", errp) < 0) {
883         return -EINVAL;
884     }
885     trace_nbd_receive_negotiate_magic(magic);
886 
887     if (magic != NBD_INIT_MAGIC) {
888         error_setg(errp, "Bad initial magic received: 0x%" PRIx64, magic);
889         return -EINVAL;
890     }
891 
892     if (nbd_read64(ioc, &magic, "server magic", errp) < 0) {
893         return -EINVAL;
894     }
895     trace_nbd_receive_negotiate_magic(magic);
896 
897     if (magic == NBD_OPTS_MAGIC) {
898         uint32_t clientflags = 0;
899         uint16_t globalflags;
900         bool fixedNewStyle = false;
901 
902         if (nbd_read16(ioc, &globalflags, "server flags", errp) < 0) {
903             return -EINVAL;
904         }
905         trace_nbd_receive_negotiate_server_flags(globalflags);
906         if (globalflags & NBD_FLAG_FIXED_NEWSTYLE) {
907             fixedNewStyle = true;
908             clientflags |= NBD_FLAG_C_FIXED_NEWSTYLE;
909         }
910         if (globalflags & NBD_FLAG_NO_ZEROES) {
911             if (zeroes) {
912                 *zeroes = false;
913             }
914             clientflags |= NBD_FLAG_C_NO_ZEROES;
915         }
916         /* client requested flags */
917         clientflags = cpu_to_be32(clientflags);
918         if (nbd_write(ioc, &clientflags, sizeof(clientflags), errp) < 0) {
919             error_prepend(errp, "Failed to send clientflags field: ");
920             return -EINVAL;
921         }
922         if (tlscreds) {
923             if (fixedNewStyle) {
924                 *outioc = nbd_receive_starttls(ioc, tlscreds, hostname, errp);
925                 if (!*outioc) {
926                     return -EINVAL;
927                 }
928                 ioc = *outioc;
929             } else {
930                 error_setg(errp, "Server does not support STARTTLS");
931                 return -EINVAL;
932             }
933         }
934         if (fixedNewStyle) {
935             int result = 0;
936 
937             if (structured_reply) {
938                 result = nbd_request_simple_option(ioc,
939                                                    NBD_OPT_STRUCTURED_REPLY,
940                                                    errp);
941                 if (result < 0) {
942                     return -EINVAL;
943                 }
944             }
945             return 2 + result;
946         } else {
947             return 1;
948         }
949     } else if (magic == NBD_CLIENT_MAGIC) {
950         if (tlscreds) {
951             error_setg(errp, "Server does not support STARTTLS");
952             return -EINVAL;
953         }
954         return 0;
955     } else {
956         error_setg(errp, "Bad server magic received: 0x%" PRIx64, magic);
957         return -EINVAL;
958     }
959 }
960 
961 /*
962  * nbd_negotiate_finish_oldstyle:
963  * Populate @info with the size and export flags from an oldstyle server,
964  * but does not consume 124 bytes of reserved zero padding.
965  * Returns 0 on success, -1 with @errp set on failure
966  */
967 static int nbd_negotiate_finish_oldstyle(QIOChannel *ioc, NBDExportInfo *info,
968                                          Error **errp)
969 {
970     uint32_t oldflags;
971 
972     if (nbd_read64(ioc, &info->size, "export length", errp) < 0) {
973         return -EINVAL;
974     }
975 
976     if (nbd_read32(ioc, &oldflags, "export flags", errp) < 0) {
977         return -EINVAL;
978     }
979     if (oldflags & ~0xffff) {
980         error_setg(errp, "Unexpected export flags %0x" PRIx32, oldflags);
981         return -EINVAL;
982     }
983     info->flags = oldflags;
984     return 0;
985 }
986 
987 /*
988  * nbd_receive_negotiate:
989  * Connect to server, complete negotiation, and move into transmission phase.
990  * Returns: negative errno: failure talking to server
991  *          0: server is connected
992  */
993 int nbd_receive_negotiate(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
994                           const char *hostname, QIOChannel **outioc,
995                           NBDExportInfo *info, Error **errp)
996 {
997     int result;
998     bool zeroes;
999     bool base_allocation = info->base_allocation;
1000 
1001     assert(info->name);
1002     trace_nbd_receive_negotiate_name(info->name);
1003 
1004     result = nbd_start_negotiate(ioc, tlscreds, hostname, outioc,
1005                                  info->structured_reply, &zeroes, errp);
1006 
1007     info->structured_reply = false;
1008     info->base_allocation = false;
1009     if (tlscreds && *outioc) {
1010         ioc = *outioc;
1011     }
1012 
1013     switch (result) {
1014     case 3: /* newstyle, with structured replies */
1015         info->structured_reply = true;
1016         if (base_allocation) {
1017             result = nbd_negotiate_simple_meta_context(ioc, info, errp);
1018             if (result < 0) {
1019                 return -EINVAL;
1020             }
1021             info->base_allocation = result == 1;
1022         }
1023         /* fall through */
1024     case 2: /* newstyle, try OPT_GO */
1025         /* Try NBD_OPT_GO first - if it works, we are done (it
1026          * also gives us a good message if the server requires
1027          * TLS).  If it is not available, fall back to
1028          * NBD_OPT_LIST for nicer error messages about a missing
1029          * export, then use NBD_OPT_EXPORT_NAME.  */
1030         result = nbd_opt_info_or_go(ioc, NBD_OPT_GO, info, errp);
1031         if (result < 0) {
1032             return -EINVAL;
1033         }
1034         if (result > 0) {
1035             return 0;
1036         }
1037         /* Check our desired export is present in the
1038          * server export list. Since NBD_OPT_EXPORT_NAME
1039          * cannot return an error message, running this
1040          * query gives us better error reporting if the
1041          * export name is not available.
1042          */
1043         if (nbd_receive_query_exports(ioc, info->name, errp) < 0) {
1044             return -EINVAL;
1045         }
1046         /* fall through */
1047     case 1: /* newstyle, but limited to EXPORT_NAME */
1048         /* write the export name request */
1049         if (nbd_send_option_request(ioc, NBD_OPT_EXPORT_NAME, -1, info->name,
1050                                     errp) < 0) {
1051             return -EINVAL;
1052         }
1053 
1054         /* Read the response */
1055         if (nbd_read64(ioc, &info->size, "export length", errp) < 0) {
1056             return -EINVAL;
1057         }
1058 
1059         if (nbd_read16(ioc, &info->flags, "export flags", errp) < 0) {
1060             return -EINVAL;
1061         }
1062         break;
1063     case 0: /* oldstyle, parse length and flags */
1064         if (*info->name) {
1065             error_setg(errp, "Server does not support non-empty export names");
1066             return -EINVAL;
1067         }
1068         if (nbd_negotiate_finish_oldstyle(ioc, info, errp) < 0) {
1069             return -EINVAL;
1070         }
1071         break;
1072     default:
1073         return result;
1074     }
1075 
1076     trace_nbd_receive_negotiate_size_flags(info->size, info->flags);
1077     if (zeroes && nbd_drop(ioc, 124, errp) < 0) {
1078         error_prepend(errp, "Failed to read reserved block: ");
1079         return -EINVAL;
1080     }
1081     return 0;
1082 }
1083 
1084 /* Clean up result of nbd_receive_export_list */
1085 void nbd_free_export_list(NBDExportInfo *info, int count)
1086 {
1087     int i, j;
1088 
1089     if (!info) {
1090         return;
1091     }
1092 
1093     for (i = 0; i < count; i++) {
1094         g_free(info[i].name);
1095         g_free(info[i].description);
1096         for (j = 0; j < info[i].n_contexts; j++) {
1097             g_free(info[i].contexts[j]);
1098         }
1099         g_free(info[i].contexts);
1100     }
1101     g_free(info);
1102 }
1103 
1104 /*
1105  * nbd_receive_export_list:
1106  * Query details about a server's exports, then disconnect without
1107  * going into transmission phase. Return a count of the exports listed
1108  * in @info by the server, or -1 on error. Caller must free @info using
1109  * nbd_free_export_list().
1110  */
1111 int nbd_receive_export_list(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
1112                             const char *hostname, NBDExportInfo **info,
1113                             Error **errp)
1114 {
1115     int result;
1116     int count = 0;
1117     int i;
1118     int rc;
1119     int ret = -1;
1120     NBDExportInfo *array = NULL;
1121     QIOChannel *sioc = NULL;
1122 
1123     *info = NULL;
1124     result = nbd_start_negotiate(ioc, tlscreds, hostname, &sioc, true, NULL,
1125                                  errp);
1126     if (tlscreds && sioc) {
1127         ioc = sioc;
1128     }
1129 
1130     switch (result) {
1131     case 2:
1132     case 3:
1133         /* newstyle - use NBD_OPT_LIST to populate array, then try
1134          * NBD_OPT_INFO on each array member. If structured replies
1135          * are enabled, also try NBD_OPT_LIST_META_CONTEXT. */
1136         if (nbd_send_option_request(ioc, NBD_OPT_LIST, 0, NULL, errp) < 0) {
1137             goto out;
1138         }
1139         while (1) {
1140             char *name;
1141             char *desc;
1142 
1143             rc = nbd_receive_list(ioc, &name, &desc, errp);
1144             if (rc < 0) {
1145                 goto out;
1146             } else if (rc == 0) {
1147                 break;
1148             }
1149             array = g_renew(NBDExportInfo, array, ++count);
1150             memset(&array[count - 1], 0, sizeof(*array));
1151             array[count - 1].name = name;
1152             array[count - 1].description = desc;
1153             array[count - 1].structured_reply = result == 3;
1154         }
1155 
1156         for (i = 0; i < count; i++) {
1157             array[i].request_sizes = true;
1158             rc = nbd_opt_info_or_go(ioc, NBD_OPT_INFO, &array[i], errp);
1159             if (rc < 0) {
1160                 goto out;
1161             } else if (rc == 0) {
1162                 /*
1163                  * Pointless to try rest of loop. If OPT_INFO doesn't work,
1164                  * it's unlikely that meta contexts work either
1165                  */
1166                 break;
1167             }
1168 
1169             if (result == 3 &&
1170                 nbd_list_meta_contexts(ioc, &array[i], errp) < 0) {
1171                 goto out;
1172             }
1173         }
1174 
1175         /* Send NBD_OPT_ABORT as a courtesy before hanging up */
1176         nbd_send_opt_abort(ioc);
1177         break;
1178     case 1: /* newstyle, but limited to EXPORT_NAME */
1179         error_setg(errp, "Server does not support export lists");
1180         /* We can't even send NBD_OPT_ABORT, so merely hang up */
1181         goto out;
1182     case 0: /* oldstyle, parse length and flags */
1183         array = g_new0(NBDExportInfo, 1);
1184         array->name = g_strdup("");
1185         count = 1;
1186 
1187         if (nbd_negotiate_finish_oldstyle(ioc, array, errp) < 0) {
1188             goto out;
1189         }
1190 
1191         /* Send NBD_CMD_DISC as a courtesy to the server, but ignore all
1192          * errors now that we have the information we wanted. */
1193         if (nbd_drop(ioc, 124, NULL) == 0) {
1194             NBDRequest request = { .type = NBD_CMD_DISC };
1195 
1196             nbd_send_request(ioc, &request);
1197         }
1198         break;
1199     default:
1200         goto out;
1201     }
1202 
1203     *info = array;
1204     array = NULL;
1205     ret = count;
1206 
1207  out:
1208     qio_channel_shutdown(ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
1209     qio_channel_close(ioc, NULL);
1210     object_unref(OBJECT(sioc));
1211     nbd_free_export_list(array, count);
1212     return ret;
1213 }
1214 
1215 #ifdef __linux__
1216 int nbd_init(int fd, QIOChannelSocket *sioc, NBDExportInfo *info,
1217              Error **errp)
1218 {
1219     unsigned long sector_size = MAX(BDRV_SECTOR_SIZE, info->min_block);
1220     unsigned long sectors = info->size / sector_size;
1221 
1222     /* FIXME: Once the kernel module is patched to honor block sizes,
1223      * and to advertise that fact to user space, we should update the
1224      * hand-off to the kernel to use any block sizes we learned. */
1225     assert(!info->request_sizes);
1226     if (info->size / sector_size != sectors) {
1227         error_setg(errp, "Export size %" PRIu64 " too large for 32-bit kernel",
1228                    info->size);
1229         return -E2BIG;
1230     }
1231 
1232     trace_nbd_init_set_socket();
1233 
1234     if (ioctl(fd, NBD_SET_SOCK, (unsigned long) sioc->fd) < 0) {
1235         int serrno = errno;
1236         error_setg(errp, "Failed to set NBD socket");
1237         return -serrno;
1238     }
1239 
1240     trace_nbd_init_set_block_size(sector_size);
1241 
1242     if (ioctl(fd, NBD_SET_BLKSIZE, sector_size) < 0) {
1243         int serrno = errno;
1244         error_setg(errp, "Failed setting NBD block size");
1245         return -serrno;
1246     }
1247 
1248     trace_nbd_init_set_size(sectors);
1249     if (info->size % sector_size) {
1250         trace_nbd_init_trailing_bytes(info->size % sector_size);
1251     }
1252 
1253     if (ioctl(fd, NBD_SET_SIZE_BLOCKS, sectors) < 0) {
1254         int serrno = errno;
1255         error_setg(errp, "Failed setting size (in blocks)");
1256         return -serrno;
1257     }
1258 
1259     if (ioctl(fd, NBD_SET_FLAGS, (unsigned long) info->flags) < 0) {
1260         if (errno == ENOTTY) {
1261             int read_only = (info->flags & NBD_FLAG_READ_ONLY) != 0;
1262             trace_nbd_init_set_readonly();
1263 
1264             if (ioctl(fd, BLKROSET, (unsigned long) &read_only) < 0) {
1265                 int serrno = errno;
1266                 error_setg(errp, "Failed setting read-only attribute");
1267                 return -serrno;
1268             }
1269         } else {
1270             int serrno = errno;
1271             error_setg(errp, "Failed setting flags");
1272             return -serrno;
1273         }
1274     }
1275 
1276     trace_nbd_init_finish();
1277 
1278     return 0;
1279 }
1280 
1281 int nbd_client(int fd)
1282 {
1283     int ret;
1284     int serrno;
1285 
1286     trace_nbd_client_loop();
1287 
1288     ret = ioctl(fd, NBD_DO_IT);
1289     if (ret < 0 && errno == EPIPE) {
1290         /* NBD_DO_IT normally returns EPIPE when someone has disconnected
1291          * the socket via NBD_DISCONNECT.  We do not want to return 1 in
1292          * that case.
1293          */
1294         ret = 0;
1295     }
1296     serrno = errno;
1297 
1298     trace_nbd_client_loop_ret(ret, strerror(serrno));
1299 
1300     trace_nbd_client_clear_queue();
1301     ioctl(fd, NBD_CLEAR_QUE);
1302 
1303     trace_nbd_client_clear_socket();
1304     ioctl(fd, NBD_CLEAR_SOCK);
1305 
1306     errno = serrno;
1307     return ret;
1308 }
1309 
1310 int nbd_disconnect(int fd)
1311 {
1312     ioctl(fd, NBD_CLEAR_QUE);
1313     ioctl(fd, NBD_DISCONNECT);
1314     ioctl(fd, NBD_CLEAR_SOCK);
1315     return 0;
1316 }
1317 
1318 #endif /* __linux__ */
1319 
1320 int nbd_send_request(QIOChannel *ioc, NBDRequest *request)
1321 {
1322     uint8_t buf[NBD_REQUEST_SIZE];
1323 
1324     trace_nbd_send_request(request->from, request->len, request->handle,
1325                            request->flags, request->type,
1326                            nbd_cmd_lookup(request->type));
1327 
1328     stl_be_p(buf, NBD_REQUEST_MAGIC);
1329     stw_be_p(buf + 4, request->flags);
1330     stw_be_p(buf + 6, request->type);
1331     stq_be_p(buf + 8, request->handle);
1332     stq_be_p(buf + 16, request->from);
1333     stl_be_p(buf + 24, request->len);
1334 
1335     return nbd_write(ioc, buf, sizeof(buf), NULL);
1336 }
1337 
1338 /* nbd_receive_simple_reply
1339  * Read simple reply except magic field (which should be already read).
1340  * Payload is not read (payload is possible for CMD_READ, but here we even
1341  * don't know whether it take place or not).
1342  */
1343 static int nbd_receive_simple_reply(QIOChannel *ioc, NBDSimpleReply *reply,
1344                                     Error **errp)
1345 {
1346     int ret;
1347 
1348     assert(reply->magic == NBD_SIMPLE_REPLY_MAGIC);
1349 
1350     ret = nbd_read(ioc, (uint8_t *)reply + sizeof(reply->magic),
1351                    sizeof(*reply) - sizeof(reply->magic), "reply", errp);
1352     if (ret < 0) {
1353         return ret;
1354     }
1355 
1356     reply->error = be32_to_cpu(reply->error);
1357     reply->handle = be64_to_cpu(reply->handle);
1358 
1359     return 0;
1360 }
1361 
1362 /* nbd_receive_structured_reply_chunk
1363  * Read structured reply chunk except magic field (which should be already
1364  * read).
1365  * Payload is not read.
1366  */
1367 static int nbd_receive_structured_reply_chunk(QIOChannel *ioc,
1368                                               NBDStructuredReplyChunk *chunk,
1369                                               Error **errp)
1370 {
1371     int ret;
1372 
1373     assert(chunk->magic == NBD_STRUCTURED_REPLY_MAGIC);
1374 
1375     ret = nbd_read(ioc, (uint8_t *)chunk + sizeof(chunk->magic),
1376                    sizeof(*chunk) - sizeof(chunk->magic), "structured chunk",
1377                    errp);
1378     if (ret < 0) {
1379         return ret;
1380     }
1381 
1382     chunk->flags = be16_to_cpu(chunk->flags);
1383     chunk->type = be16_to_cpu(chunk->type);
1384     chunk->handle = be64_to_cpu(chunk->handle);
1385     chunk->length = be32_to_cpu(chunk->length);
1386 
1387     return 0;
1388 }
1389 
1390 /* nbd_receive_reply
1391  * Returns 1 on success
1392  *         0 on eof, when no data was read (errp is not set)
1393  *         negative errno on failure (errp is set)
1394  */
1395 int nbd_receive_reply(QIOChannel *ioc, NBDReply *reply, Error **errp)
1396 {
1397     int ret;
1398     const char *type;
1399 
1400     ret = nbd_read_eof(ioc, &reply->magic, sizeof(reply->magic), errp);
1401     if (ret <= 0) {
1402         return ret;
1403     }
1404 
1405     reply->magic = be32_to_cpu(reply->magic);
1406 
1407     switch (reply->magic) {
1408     case NBD_SIMPLE_REPLY_MAGIC:
1409         ret = nbd_receive_simple_reply(ioc, &reply->simple, errp);
1410         if (ret < 0) {
1411             break;
1412         }
1413         trace_nbd_receive_simple_reply(reply->simple.error,
1414                                        nbd_err_lookup(reply->simple.error),
1415                                        reply->handle);
1416         break;
1417     case NBD_STRUCTURED_REPLY_MAGIC:
1418         ret = nbd_receive_structured_reply_chunk(ioc, &reply->structured, errp);
1419         if (ret < 0) {
1420             break;
1421         }
1422         type = nbd_reply_type_lookup(reply->structured.type);
1423         trace_nbd_receive_structured_reply_chunk(reply->structured.flags,
1424                                                  reply->structured.type, type,
1425                                                  reply->structured.handle,
1426                                                  reply->structured.length);
1427         break;
1428     default:
1429         error_setg(errp, "invalid magic (got 0x%" PRIx32 ")", reply->magic);
1430         return -EINVAL;
1431     }
1432     if (ret < 0) {
1433         return ret;
1434     }
1435 
1436     return 1;
1437 }
1438 
1439