int nbd_trip(BlockDriverState *bs, int csock, off_t size, uint64_t dev_offset,

             off_t *offset, uint32_t nbdflags, uint8_t *data, int data_size)

{

    struct nbd_request request;

    struct nbd_reply reply;



    TRACE("Reading request.");



    if (nbd_receive_request(csock, &request) == -1)

        return -1;



    if (request.len + NBD_REPLY_SIZE > data_size) {

        LOG("len (%u) is larger than max len (%u)",

            request.len + NBD_REPLY_SIZE, data_size);

        errno = EINVAL;

        return -1;

    }



    if ((request.from + request.len) < request.from) {

        LOG("integer overflow detected! "

            "you're probably being attacked");

        errno = EINVAL;

        return -1;

    }



    if ((request.from + request.len) > size) {

            LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64

            ", Offset: %" PRIu64 "\n",

                    request.from, request.len, (uint64_t)size, dev_offset);

        LOG("requested operation past EOF--bad client?");

        errno = EINVAL;

        return -1;

    }



    TRACE("Decoding type");



    reply.handle = request.handle;

    reply.error = 0;



    switch (request.type) {

    case NBD_CMD_READ:

        TRACE("Request type is READ");



        if (bdrv_read(bs, (request.from + dev_offset) / 512,

                  data + NBD_REPLY_SIZE,

                  request.len / 512) == -1) {

            LOG("reading from file failed");

            errno = EINVAL;

            return -1;

        }

        *offset += request.len;



        TRACE("Read %u byte(s)", request.len);



        /* Reply

           [ 0 ..  3]    magic   (NBD_REPLY_MAGIC)

           [ 4 ..  7]    error   (0 == no error)

           [ 7 .. 15]    handle

         */



        cpu_to_be32w((uint32_t*)data, NBD_REPLY_MAGIC);

        cpu_to_be32w((uint32_t*)(data + 4), reply.error);

        cpu_to_be64w((uint64_t*)(data + 8), reply.handle);



        TRACE("Sending data to client");



        if (write_sync(csock, data,

                   request.len + NBD_REPLY_SIZE) !=

                   request.len + NBD_REPLY_SIZE) {

            LOG("writing to socket failed");

            errno = EINVAL;

            return -1;

        }

        break;

    case NBD_CMD_WRITE:

        TRACE("Request type is WRITE");



        TRACE("Reading %u byte(s)", request.len);



        if (read_sync(csock, data, request.len) != request.len) {

            LOG("reading from socket failed");

            errno = EINVAL;

            return -1;

        }



        if (nbdflags & NBD_FLAG_READ_ONLY) {

            TRACE("Server is read-only, return error");

            reply.error = 1;

        } else {

            TRACE("Writing to device");



            if (bdrv_write(bs, (request.from + dev_offset) / 512,

                       data, request.len / 512) == -1) {

                LOG("writing to file failed");

                errno = EINVAL;

                return -1;

            }



            *offset += request.len;

        }



        if (nbd_send_reply(csock, &reply) == -1)

            return -1;

        break;

    case NBD_CMD_DISC:

        TRACE("Request type is DISCONNECT");

        errno = 0;

        return 1;

    default:

        LOG("invalid request type (%u) received", request.type);

        errno = EINVAL;

        return -1;

    }



    TRACE("Request/Reply complete");



    return 0;

}

int nbd_trip(BlockDriverState *bs, int csock, off_t size, uint64_t dev_offset,

             off_t *offset, uint32_t nbdflags, uint8_t *data, int data_size)

{

    struct nbd_request request;

    struct nbd_reply reply;



    TRACE("Reading request.");



    if (nbd_receive_request(csock, &request) == -1)

        return -1;



    if (request.len + NBD_REPLY_SIZE > data_size) {

        LOG("len (%u) is larger than max len (%u)",

            request.len + NBD_REPLY_SIZE, data_size);

        errno = EINVAL;

        return -1;

    }



    if ((request.from + request.len) < request.from) {

        LOG("integer overflow detected! "

            "you're probably being attacked");

        errno = EINVAL;

        return -1;

    }



    if ((request.from + request.len) > size) {

            LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64

            ", Offset: %" PRIu64 "\n",

                    request.from, request.len, (uint64_t)size, dev_offset);

        LOG("requested operation past EOF--bad client?");

        errno = EINVAL;

        return -1;

    }



    TRACE("Decoding type");



    reply.handle = request.handle;

    reply.error = 0;



    switch (request.type) {

    case NBD_CMD_READ:

        TRACE("Request type is READ");



        if (bdrv_read(bs, (request.from + dev_offset) / 512,

                  data + NBD_REPLY_SIZE,

                  request.len / 512) == -1) {

            LOG("reading from file failed");

            errno = EINVAL;

            return -1;

        }

        *offset += request.len;



        TRACE("Read %u byte(s)", request.len);



        











        cpu_to_be32w((uint32_t*)data, NBD_REPLY_MAGIC);

        cpu_to_be32w((uint32_t*)(data + 4), reply.error);

        cpu_to_be64w((uint64_t*)(data + 8), reply.handle);



        TRACE("Sending data to client");



        if (write_sync(csock, data,

                   request.len + NBD_REPLY_SIZE) !=

                   request.len + NBD_REPLY_SIZE) {

            LOG("writing to socket failed");

            errno = EINVAL;

            return -1;

        }

        break;

    case NBD_CMD_WRITE:

        TRACE("Request type is WRITE");



        TRACE("Reading %u byte(s)", request.len);



        if (read_sync(csock, data, request.len) != request.len) {

            LOG("reading from socket failed");

            errno = EINVAL;

            return -1;

        }



        if (nbdflags & NBD_FLAG_READ_ONLY) {

            TRACE("Server is read-only, return error");

            reply.error = 1;

        } else {

            TRACE("Writing to device");



            if (bdrv_write(bs, (request.from + dev_offset) / 512,

                       data, request.len / 512) == -1) {

                LOG("writing to file failed");

                errno = EINVAL;

                return -1;

            }



            *offset += request.len;

        }



        if (nbd_send_reply(csock, &reply) == -1)

            return -1;

        break;

    case NBD_CMD_DISC:

        TRACE("Request type is DISCONNECT");

        errno = 0;

        return 1;

    default:

        LOG("invalid request type (%u) received", request.type);

        errno = EINVAL;

        return -1;

    }



    TRACE("Request/Reply complete");



    return 0;

}

int FUNC_0(BlockDriverState *VAR_0, int VAR_1, off_t VAR_2, uint64_t VAR_3,

             off_t *VAR_4, uint32_t VAR_5, uint8_t *VAR_6, int VAR_7)

{

    struct nbd_request VAR_8;

    struct nbd_reply VAR_9;



    TRACE("Reading VAR_8.");



    if (nbd_receive_request(VAR_1, &VAR_8) == -1)

        return -1;



    if (VAR_8.len + NBD_REPLY_SIZE > VAR_7) {

        LOG("len (%u) is larger than max len (%u)",

            VAR_8.len + NBD_REPLY_SIZE, VAR_7);

        errno = EINVAL;

        return -1;

    }



    if ((VAR_8.from + VAR_8.len) < VAR_8.from) {

        LOG("integer overflow detected! "

            "you're probably being attacked");

        errno = EINVAL;

        return -1;

    }



    if ((VAR_8.from + VAR_8.len) > VAR_2) {

            LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64

            ", Offset: %" PRIu64 "\n",

                    VAR_8.from, VAR_8.len, (uint64_t)VAR_2, VAR_3);

        LOG("requested operation past EOF--bad client?");

        errno = EINVAL;

        return -1;

    }



    TRACE("Decoding type");



    VAR_9.handle = VAR_8.handle;

    VAR_9.error = 0;



    switch (VAR_8.type) {

    case NBD_CMD_READ:

        TRACE("Request type is READ");



        if (bdrv_read(VAR_0, (VAR_8.from + VAR_3) / 512,

                  VAR_6 + NBD_REPLY_SIZE,

                  VAR_8.len / 512) == -1) {

            LOG("reading from file failed");

            errno = EINVAL;

            return -1;

        }

        *VAR_4 += VAR_8.len;



        TRACE("Read %u byte(s)", VAR_8.len);



        











        cpu_to_be32w((uint32_t*)VAR_6, NBD_REPLY_MAGIC);

        cpu_to_be32w((uint32_t*)(VAR_6 + 4), VAR_9.error);

        cpu_to_be64w((uint64_t*)(VAR_6 + 8), VAR_9.handle);



        TRACE("Sending VAR_6 to client");



        if (write_sync(VAR_1, VAR_6,

                   VAR_8.len + NBD_REPLY_SIZE) !=

                   VAR_8.len + NBD_REPLY_SIZE) {

            LOG("writing to socket failed");

            errno = EINVAL;

            return -1;

        }

        break;

    case NBD_CMD_WRITE:

        TRACE("Request type is WRITE");



        TRACE("Reading %u byte(s)", VAR_8.len);



        if (read_sync(VAR_1, VAR_6, VAR_8.len) != VAR_8.len) {

            LOG("reading from socket failed");

            errno = EINVAL;

            return -1;

        }



        if (VAR_5 & NBD_FLAG_READ_ONLY) {

            TRACE("Server is read-only, return error");

            VAR_9.error = 1;

        } else {

            TRACE("Writing to device");



            if (bdrv_write(VAR_0, (VAR_8.from + VAR_3) / 512,

                       VAR_6, VAR_8.len / 512) == -1) {

                LOG("writing to file failed");

                errno = EINVAL;

                return -1;

            }



            *VAR_4 += VAR_8.len;

        }



        if (nbd_send_reply(VAR_1, &VAR_9) == -1)

            return -1;

        break;

    case NBD_CMD_DISC:

        TRACE("Request type is DISCONNECT");

        errno = 0;

        return 1;

    default:

        LOG("invalid VAR_8 type (%u) received", VAR_8.type);

        errno = EINVAL;

        return -1;

    }



    TRACE("Request/Reply complete");



    return 0;

}

int FUNC_0(BlockDriverState *VAR_0, int VAR_1, off_t VAR_2, uint64_t VAR_3,
off_t *VAR_4, uint32_t VAR_5, uint8_t *VAR_6, int VAR_7)
{ struct nbd_request VAR_8; struct nbd_reply VAR_9; TRACE("Reading VAR_8."); if (nbd_receive_request(VAR_1, &VAR_8) == -1)
return -1; if (VAR_8.len + NBD_REPLY_SIZE > VAR_7) { LOG("len (%u) is larger than max len (%u)",
VAR_8.len + NBD_REPLY_SIZE, VAR_7); errno = EINVAL; return -1; } if ((VAR_8.from + VAR_8.len) < VAR_8.from) { LOG("integer overflow detected! "
"you're probably being attacked"); errno = EINVAL; return -1; } if ((VAR_8.from + VAR_8.len) > VAR_2) { LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
", Offset: %" PRIu64 "\n",
VAR_8.from, VAR_8.len, (uint64_t)VAR_2, VAR_3); LOG("requested operation past EOF--bad client?"); errno = EINVAL; return -1; } TRACE("Decoding type"); VAR_9.handle = VAR_8.handle; VAR_9.error = 0; switch (VAR_8.type) { case NBD_CMD_READ:
TRACE("Request type is READ"); if (bdrv_read(VAR_0, (VAR_8.from + VAR_3) / 512,
VAR_6 + NBD_REPLY_SIZE,
VAR_8.len / 512) == -1) { LOG("reading from file failed"); errno = EINVAL; return -1; } *VAR_4 += VAR_8.len; TRACE("Read %u byte(s)", VAR_8.len); cpu_to_be32w((uint32_t*)VAR_6, NBD_REPLY_MAGIC); cpu_to_be32w((uint32_t*)(VAR_6 + 4), VAR_9.error); cpu_to_be64w((uint64_t*)(VAR_6 + 8), VAR_9.handle); TRACE("Sending VAR_6 to client"); if (write_sync(VAR_1, VAR_6,
VAR_8.len + NBD_REPLY_SIZE) !=
VAR_8.len + NBD_REPLY_SIZE) { LOG("writing to socket failed"); errno = EINVAL; return -1; } break; case NBD_CMD_WRITE:
TRACE("Request type is WRITE"); TRACE("Reading %u byte(s)", VAR_8.len); if (read_sync(VAR_1, VAR_6, VAR_8.len) != VAR_8.len) { LOG("reading from socket failed"); errno = EINVAL; return -1; } if (VAR_5 & NBD_FLAG_READ_ONLY) { TRACE("Server is read-only, return error"); VAR_9.error = 1; } else { TRACE("Writing to device"); if (bdrv_write(VAR_0, (VAR_8.from + VAR_3) / 512,
VAR_6, VAR_8.len / 512) == -1) { LOG("writing to file failed"); errno = EINVAL; return -1; } *VAR_4 += VAR_8.len; } if (nbd_send_reply(VAR_1, &VAR_9) == -1)
return -1; break; case NBD_CMD_DISC:
TRACE("Request type is DISCONNECT"); errno = 0; return 1; default:
LOG("invalid VAR_8 type (%u) received", VAR_8.type); errno = EINVAL; return -1; } TRACE("Request/Reply complete"); return 0; }