/*
 * Copyright © Stéphane Raimbault <stephane.raimbault@gmail.com>
 *
 * SPDX-License-Identifier: LGPL-2.1-or-later
 *
 * 本库实现了 Modbus 协议。
 * http://libmodbus.org/
 */

#include <errno.h>
#include <limits.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

#include "config.h"

#include "myLog.h"
#include "modbus-private.h"
#include "modbus.h"

/* 内部使用 */
#define MSG_LENGTH_UNDEFINED -1

/* 导出的版本号 */
const unsigned int libmodbus_version_major = LIBMODBUS_VERSION_MAJOR;
const unsigned int libmodbus_version_minor = LIBMODBUS_VERSION_MINOR;
const unsigned int libmodbus_version_micro = LIBMODBUS_VERSION_MICRO;

/* RTU 和 TCP 的最大 ADU 长度之间的最大值（取 TCP 的值） */
#define MAX_MESSAGE_LENGTH 260

/* 解析查询分为3个步骤 */
typedef enum {
    _STEP_FUNCTION,
    _STEP_META,
    _STEP_DATA
} _step_t;

const char *modbus_strerror(int errnum)
{
    switch (errnum) {
    case EMBXILFUN:
        return "Illegal function";
    case EMBXILADD:
        return "Illegal data address";
    case EMBXILVAL:
        return "Illegal data value";
    case EMBXSFAIL:
        return "Slave device or server failure";
    case EMBXACK:
        return "Acknowledge";
    case EMBXSBUSY:
        return "Slave device or server is busy";
    case EMBXNACK:
        return "Negative acknowledge";
    case EMBXMEMPAR:
        return "Memory parity error";
    case EMBXGPATH:
        return "Gateway path unavailable";
    case EMBXGTAR:
        return "Target device failed to respond";
    case EMBBADCRC:
        return "Invalid CRC";
    case EMBBADDATA:
        return "Invalid data";
    case EMBBADEXC:
        return "Invalid exception code";
    case EMBMDATA:
        return "Too many data";
    case EMBBADSLAVE:
        return "Response not from requested slave";
    default:
        return strerror(errnum);
    }
}

void _error_print(modbus_t *ctx, const char *context)
{
    if (ctx->debug) {
        if (context != NULL) {
            LOG_E("%s: %s", modbus_strerror(errno), context);
        } else {
            LOG_E("%s", modbus_strerror(errno));
        }
    }
}

static void _sleep_response_timeout(modbus_t *ctx)
{
    /* 响应超时始终为正数 */
    /* 使用 nanosleep 实现的 usleep 源码 */
    struct timespec request, remaining;
    request.tv_sec = ctx->response_timeout.tv_sec;
    request.tv_nsec = ((long int) ctx->response_timeout.tv_usec) * 1000;
    while (nanosleep(&request, &remaining) == -1 && errno == EINTR) {
        request = remaining;
    }
}

int modbus_flush(modbus_t *ctx)
{
    int rc;

    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    rc = ctx->backend->flush(ctx);
    if (rc != -1 && ctx->debug) {
        /* 并非所有后端都能返回已刷新的字节数 */
        LOG_I("Bytes flushed (%d)\n", rc);
    }
    return rc;
}

/* 计算预期响应的长度（包括校验和） */
static unsigned int compute_response_length_from_request(modbus_t *ctx, uint8_t *req)
{
    int length;
    const int offset = ctx->backend->header_length;

    switch (req[offset]) {
    case MODBUS_FC_READ_COILS:
    case MODBUS_FC_READ_DISCRETE_INPUTS: {
        /* 报文头 + 值的数量（来自 write_bits 的代码） */
        int nb = (req[offset + 3] << 8) | req[offset + 4];
        length = 2 + (nb / 8) + ((nb % 8) ? 1 : 0);
    } break;
    case MODBUS_FC_WRITE_AND_READ_REGISTERS:
    case MODBUS_FC_READ_HOLDING_REGISTERS:
    case MODBUS_FC_READ_INPUT_REGISTERS:
        /* 报文头 + 2 * 值的数量 */
        length = 2 + 2 * (req[offset + 3] << 8 | req[offset + 4]);
        break;
    case MODBUS_FC_READ_EXCEPTION_STATUS:
        length = 3;
        break;
    case MODBUS_FC_REPORT_SLAVE_ID:
        /* 响应是设备特定的（报文头中提供了长度信息） */
        return MSG_LENGTH_UNDEFINED;
    case MODBUS_FC_MASK_WRITE_REGISTER:
        length = 7;
        break;
    default:
        length = 5;
    }

    return offset + length + ctx->backend->checksum_length;
}

/* 发送请求/响应 */
static int send_msg(modbus_t *ctx, uint8_t *msg, int msg_length)
{
    int rc;
    int i;

    msg_length = ctx->backend->send_msg_pre(msg, msg_length);

    if (ctx->debug) {
        LOG_I("Sending %d bytes:", msg_length);
        for (i = 0; i < msg_length; i++)
            printf("[%.2X]", msg[i]);
        printf("\n");
    }

    /* 在恢复模式下，写命令会反复发出直到成功！默认禁用。 */
    do {
        rc = ctx->backend->send(ctx, msg, msg_length);
        if (rc == -1) {
            _error_print(ctx, NULL);
            if (ctx->error_recovery & MODBUS_ERROR_RECOVERY_LINK) {
                int saved_errno = errno;

                if ((errno == EBADF || errno == ECONNRESET || errno == EPIPE)) {
                    modbus_close(ctx);
                    _sleep_response_timeout(ctx);
                    modbus_connect(ctx);
                } else {
                    _sleep_response_timeout(ctx);
                    modbus_flush(ctx);
                }
                errno = saved_errno;
            }
        }
    } while ((ctx->error_recovery & MODBUS_ERROR_RECOVERY_LINK) && rc == -1);

    if (rc > 0 && rc != msg_length) {
        errno = EMBBADDATA;
        return -1;
    }

    return rc;
}

int modbus_send_raw_request_tid(modbus_t *ctx,
                                const uint8_t *raw_req,
                                int raw_req_length,
                                int tid)
{
    sft_t sft;
    uint8_t req[MAX_MESSAGE_LENGTH];
    int req_length;

    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (raw_req_length < 2 || raw_req_length > (MODBUS_MAX_PDU_LENGTH + 1)) {
        /* 原始请求必须至少包含功能码和从站地址，且不得超过
           最大 PDU 长度加上从站地址的长度。 */
        errno = EINVAL;
        return -1;
    }

    sft.slave = raw_req[0];
    sft.function = raw_req[1];
    /* t_id 保持为零 */
    sft.t_id = tid;
    /* 此响应函数仅设置报文头，因此在这里使用很方便 */
    req_length = ctx->backend->build_response_basis(&sft, req);

    if (raw_req_length > 2) {
        /* 复制功能码之后的数据 */
        memcpy(req + req_length, raw_req + 2, raw_req_length - 2);
        req_length += raw_req_length - 2;
    }

    return send_msg(ctx, req, req_length);
}

int modbus_send_raw_request(modbus_t *ctx, const uint8_t *raw_req, int raw_req_length)
{
    return modbus_send_raw_request_tid(ctx, raw_req, raw_req_length, 0);
}

/*
 *  ---------- 请求         指示 ----------
 *  | 客户端 | ---------------------->| 服务器 |
 *  ---------- 确认         响应 ----------
 */

/* 在接收到功能码后计算需要读取的长度 */
static uint8_t compute_meta_length_after_function(int function, msg_type_t msg_type)
{
    int length;

    if (msg_type == MSG_INDICATION) {
        if (function <= MODBUS_FC_WRITE_SINGLE_REGISTER) {
            length = 4;
        } else if (function == MODBUS_FC_WRITE_MULTIPLE_COILS ||
                   function == MODBUS_FC_WRITE_MULTIPLE_REGISTERS) {
            length = 5;
        } else if (function == MODBUS_FC_MASK_WRITE_REGISTER) {
            length = 6;
        } else if (function == MODBUS_FC_WRITE_AND_READ_REGISTERS) {
            length = 9;
        } else {
            /* MODBUS_FC_READ_EXCEPTION_STATUS, MODBUS_FC_REPORT_SLAVE_ID */
            length = 0;
        }
    } else {
        /* MSG_CONFIRMATION */
        switch (function) {
        case MODBUS_FC_WRITE_SINGLE_COIL:
        case MODBUS_FC_WRITE_SINGLE_REGISTER:
        case MODBUS_FC_WRITE_MULTIPLE_COILS:
        case MODBUS_FC_WRITE_MULTIPLE_REGISTERS:
            length = 4;
            break;
        case MODBUS_FC_MASK_WRITE_REGISTER:
            length = 6;
            break;
        default:
            length = 1;
        }
    }

    return length;
}

/* 在元信息（地址、数量等）之后计算需要读取的数据长度 */
static int
compute_data_length_after_meta(modbus_t *ctx, uint8_t *msg, msg_type_t msg_type)
{
    int function = msg[ctx->backend->header_length];
    int length;

    if (msg_type == MSG_INDICATION) {
        switch (function) {
        case MODBUS_FC_WRITE_MULTIPLE_COILS:
        case MODBUS_FC_WRITE_MULTIPLE_REGISTERS:
            length = msg[ctx->backend->header_length + 5];
            break;
        case MODBUS_FC_WRITE_AND_READ_REGISTERS:
            length = msg[ctx->backend->header_length + 9];
            break;
        default:
            length = 0;
        }
    } else {
        /* MSG_CONFIRMATION */
        if (function <= MODBUS_FC_READ_INPUT_REGISTERS ||
            function == MODBUS_FC_REPORT_SLAVE_ID ||
            function == MODBUS_FC_WRITE_AND_READ_REGISTERS) {
            length = msg[ctx->backend->header_length + 1];
        } else {
            length = 0;
        }
    }

    length += ctx->backend->checksum_length;

    return length;
}

/* 等待来自 Modbus 服务器的响应或来自 Modbus 客户端的请求。
   如果没有回复，此函数会阻塞（3次超时）。

   如果成功，函数应返回接收到的字符数，
   并将接收到的消息存储在 uint8_t 数组中。否则返回 -1，
   并设置 errno 为以下定义的值之一：
   - ECONNRESET
   - EMBBADDATA
   - ETIMEDOUT
   - read() 或 recv() 错误码
*/

int _modbus_receive_msg(modbus_t *ctx, uint8_t *msg, msg_type_t msg_type)
{
    int rc;
    fd_set rset;
    struct timeval tv;
    struct timeval *p_tv;
    unsigned int length_to_read;
    int msg_length = 0;
    _step_t step;

    if (ctx->debug) {
        if (msg_type == MSG_INDICATION) {
            LOG_I("Waiting for an indication...\n");
        } else {
            LOG_I("Waiting for a confirmation...\n");
        }
    }

    if (!ctx->backend->is_connected(ctx)) {
        if (ctx->debug) {
            LOG_E("ERROR The connection is not established.");
        }
        return -1;
    }

    /* 将文件描述符添加到集合中 */
    FD_ZERO(&rset);
    if (ctx->s < 0 || ctx->s >= FD_SETSIZE) {
        if (ctx->debug) {
            LOG_E("ERROR Invalid socket descriptor %d", ctx->s);
        }
        errno = EINVAL;
        return -1;
    }
    FD_SET(ctx->s, &rset);

    /* 我们需要逐步分析消息。在第一步，我们希望
     * 到达功能码的位置，因为所有包都包含此信息。 */
    step = _STEP_FUNCTION;
    length_to_read = ctx->backend->header_length + 1;

    if (msg_type == MSG_INDICATION) {
        /* 等待消息，我们不知道消息何时会到达 */
        if (ctx->indication_timeout.tv_sec == 0 && ctx->indication_timeout.tv_usec == 0) {
            /* 默认情况下，指示超时未设置 */
            p_tv = NULL;
        } else {
            /* 等待指示（服务器接收到的请求的名称，参见时序图） */
            tv.tv_sec = ctx->indication_timeout.tv_sec;
            tv.tv_usec = ctx->indication_timeout.tv_usec;
            p_tv = &tv;
        }
    } else {
        tv.tv_sec = ctx->response_timeout.tv_sec;
        tv.tv_usec = ctx->response_timeout.tv_usec;
        p_tv = &tv;
    }

    while (length_to_read != 0) {
        rc = ctx->backend->select(ctx, &rset, p_tv, length_to_read);
        if (rc == -1) {
            _error_print(ctx, "select");
            if (ctx->error_recovery & MODBUS_ERROR_RECOVERY_LINK) {
                int saved_errno = errno;

                if (errno == ETIMEDOUT) {
                    _sleep_response_timeout(ctx);
                    modbus_flush(ctx);
                } else if (errno == EBADF) {
                    modbus_close(ctx);
                    modbus_connect(ctx);
                }
                errno = saved_errno;
            }
            return -1;
        }

        rc = ctx->backend->recv(ctx, msg + msg_length, length_to_read);
        if (rc == 0) {
            errno = ECONNRESET;
            rc = -1;
        }

        if (rc == -1) {
            _error_print(ctx, "read");
            if ((ctx->error_recovery & MODBUS_ERROR_RECOVERY_LINK) &&
                (errno == ECONNRESET || errno == ECONNREFUSED || errno == EBADF)) {
                int saved_errno = errno;
                modbus_close(ctx);
                modbus_connect(ctx);
                /* 可能被之前的调用清除 */
                errno = saved_errno;
            }
            return -1;
        }

        /* 显示接收到的每个字符的十六进制代码 */
        if (ctx->debug) {
            LOG_I("Received %d bytes:", rc);
            int i;
            for (i = 0; i < rc; i++)
                printf("<%.2X>", msg[msg_length + i]);
        }

        /* 累加已接收的字节数 */
        msg_length += rc;
        /* 计算剩余字节数 */
        length_to_read -= rc;

        if (length_to_read == 0) {
            switch (step) {
            case _STEP_FUNCTION:
                /* 功能码位置 */
                length_to_read = compute_meta_length_after_function(
                    msg[ctx->backend->header_length], msg_type);
                if (length_to_read != 0) {
                    step = _STEP_META;
                    break;
                } /* 否则直接切换到下一步 */
            case _STEP_META:
                length_to_read = compute_data_length_after_meta(ctx, msg, msg_type);
                if ((msg_length + length_to_read) > ctx->backend->max_adu_length) {
                    errno = EMBBADDATA;
                    _error_print(ctx, "too many data");
                    return -1;
                }
                step = _STEP_DATA;
                break;
            default:
                break;
            }
        }

        if (length_to_read > 0 &&
            (ctx->byte_timeout.tv_sec > 0 || ctx->byte_timeout.tv_usec > 0)) {
            /* 如果缓冲区中没有字符，两个连续字节之间允许的超时间隔
               由 byte_timeout 定义 */
            tv.tv_sec = ctx->byte_timeout.tv_sec;
            tv.tv_usec = ctx->byte_timeout.tv_usec;
            p_tv = &tv;
        }
        /* 否则超时不会重新设置，必须在响应超时（仅对确认消息）到期之前
           读取完整的响应 */
    }

    if (ctx->debug)
        printf("\n");

    return ctx->backend->check_integrity(ctx, msg, msg_length);
}

/* 接收来自 Modbus 主站的请求 */
int modbus_receive(modbus_t *ctx, uint8_t *req)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return ctx->backend->receive(ctx, req);
}

/* 接收确认消息。

   函数应将读取到的响应存储在 rsp 中，并返回值的数量（位或字）。
   否则返回 -1 并设置 errno。

   此函数不检查确认消息是否与初始请求的预期响应一致。
*/
int modbus_receive_confirmation(modbus_t *ctx, uint8_t *rsp)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
}

static int check_confirmation(modbus_t *ctx, uint8_t *req, uint8_t *rsp, int rsp_length)
{
    int rc;
    int rsp_length_computed;
    const unsigned int offset = ctx->backend->header_length;
    const int function = rsp[offset];

    if (ctx->backend->pre_check_confirmation) {
        rc = ctx->backend->pre_check_confirmation(ctx, req, rsp, rsp_length);
        if (rc == -1) {
            if (ctx->error_recovery & MODBUS_ERROR_RECOVERY_PROTOCOL) {
                _sleep_response_timeout(ctx);
                modbus_flush(ctx);
            }
            return -1;
        }
    }

    rsp_length_computed = compute_response_length_from_request(ctx, req);

    /* 异常码 */
    if (function >= 0x80) {
        if (rsp_length == (int) (offset + 2 + ctx->backend->checksum_length) &&
            req[offset] == (rsp[offset] - 0x80)) {
            /* 收到有效的异常码 */

            int exception_code = rsp[offset + 1];
            if (exception_code < MODBUS_EXCEPTION_MAX) {
                errno = MODBUS_ENOBASE + exception_code;
            } else {
                errno = EMBBADEXC;
            }
            _error_print(ctx, NULL);
            return -1;
        } else {
            errno = EMBBADEXC;
            _error_print(ctx, NULL);
            return -1;
        }
    }

    /* 检查长度 */
    if ((rsp_length == rsp_length_computed ||
         rsp_length_computed == MSG_LENGTH_UNDEFINED) &&
        function < 0x80) {
        int req_nb_value;
        int rsp_nb_value;
        int resp_addr_ok = TRUE;
        int resp_data_ok = TRUE;

        /* 检查功能码 */
        if (function != req[offset]) {
            if (ctx->debug) 
            {
                LOG_E("Received function not corresponding to the request (0x%X != 0x%X)", function, req[offset]);
            }
            if (ctx->error_recovery & MODBUS_ERROR_RECOVERY_PROTOCOL) {
                _sleep_response_timeout(ctx);
                modbus_flush(ctx);
            }
            errno = EMBBADDATA;
            return -1;
        }

        /* 检查值的数量是否与请求一致 */
        switch (function) {
        case MODBUS_FC_READ_COILS:
        case MODBUS_FC_READ_DISCRETE_INPUTS:
            /* 读取功能，一个字节中包含8个值
             * （请求中的值数量与响应中的字节计数） */
            req_nb_value = (req[offset + 3] << 8) + req[offset + 4];
            req_nb_value = (req_nb_value / 8) + ((req_nb_value % 8) ? 1 : 0);
            rsp_nb_value = rsp[offset + 1];
            break;
        case MODBUS_FC_WRITE_AND_READ_REGISTERS:
        case MODBUS_FC_READ_HOLDING_REGISTERS:
        case MODBUS_FC_READ_INPUT_REGISTERS:
            /* 读取功能，1个值 = 2个字节 */
            req_nb_value = (req[offset + 3] << 8) + req[offset + 4];
            rsp_nb_value = (rsp[offset + 1] / 2);
            break;
        case MODBUS_FC_WRITE_MULTIPLE_COILS:
        case MODBUS_FC_WRITE_MULTIPLE_REGISTERS:
            /* 请求和响应中的地址必须相等 */
            if ((req[offset + 1] != rsp[offset + 1]) ||
                (req[offset + 2] != rsp[offset + 2])) {
                resp_addr_ok = FALSE;
            }
            /* N个写功能 */
            req_nb_value = (req[offset + 3] << 8) + req[offset + 4];
            rsp_nb_value = (rsp[offset + 3] << 8) | rsp[offset + 4];
            break;
        case MODBUS_FC_REPORT_SLAVE_ID:
            /* 报告从站ID（接收到的字节数） */
            req_nb_value = rsp_nb_value = rsp[offset + 1];
            break;
        case MODBUS_FC_WRITE_SINGLE_COIL:
        case MODBUS_FC_WRITE_SINGLE_REGISTER:
            /* 请求和响应中的地址必须相等 */
            if ((req[offset + 1] != rsp[offset + 1]) ||
                (req[offset + 2] != rsp[offset + 2])) {
                resp_addr_ok = FALSE;
            }
            /* 请求和响应中的数据必须相等 */
            if ((req[offset + 3] != rsp[offset + 3]) ||
                (req[offset + 4] != rsp[offset + 4])) {
                resp_data_ok = FALSE;
            }
            /* 1个写功能及其他 */
            req_nb_value = rsp_nb_value = 1;
            break;
        default:
            /* 1个写功能及其他 */
            req_nb_value = rsp_nb_value = 1;
            break;
        }

        if ((req_nb_value == rsp_nb_value) && (resp_addr_ok == TRUE) &&
            (resp_data_ok == TRUE)) {
            rc = rsp_nb_value;
        } else {
            if (ctx->debug) {
                LOG_E(
                        "Received data not corresponding to the request (%d != %d)",
                        rsp_nb_value,
                        req_nb_value);
            }

            if (ctx->error_recovery & MODBUS_ERROR_RECOVERY_PROTOCOL) {
                _sleep_response_timeout(ctx);
                modbus_flush(ctx);
            }

            errno = EMBBADDATA;
            rc = -1;
        }
    } else {
        if (ctx->debug) 
        {
            LOG_E("Message length not corresponding to the computed length (%d != %d)", rsp_length, rsp_length_computed);
        }
        if (ctx->error_recovery & MODBUS_ERROR_RECOVERY_PROTOCOL) {
            _sleep_response_timeout(ctx);
            modbus_flush(ctx);
        }
        errno = EMBBADDATA;
        rc = -1;
    }

    return rc;
}

static int
response_io_status(uint8_t *tab_io_status, int address, int nb, uint8_t *rsp, int offset)
{
    int shift = 0;
    /* 替代 byte（在 Win32 中不允许） */
    int one_byte = 0;
    int i;

    for (i = address; i < address + nb; i++) {
        one_byte |= tab_io_status[i] << shift;
        if (shift == 7) {
            /* 字节已满 */
            rsp[offset++] = one_byte;
            one_byte = shift = 0;
        } else {
            shift++;
        }
    }

    if (shift != 0)
        rsp[offset++] = one_byte;

    return offset;
}

/* 构建异常响应 */
static int response_exception(modbus_t *ctx,
                              sft_t *sft,
                              int exception_code,
                              uint8_t *rsp,
                              unsigned int to_flush,
                              const char *template,
                              ...)
{
    int rsp_length;

    /* 打印调试消息 */
    if (ctx->debug) {
        va_list ap;
        char buf[256];

        va_start(ap, template);
        vsnprintf(buf, sizeof(buf), template, ap);
        va_end(ap);
        LOG_E("%s", buf);
    }

    /* 如果需要则刷新 */
    if (to_flush) {
        _sleep_response_timeout(ctx);
        modbus_flush(ctx);
    }

    /* 构建异常响应 */
    sft->function = sft->function + 0x80;
    rsp_length = ctx->backend->build_response_basis(sft, rsp);
    rsp[rsp_length++] = exception_code;

    return rsp_length;
}

/* 发送对接收到的请求的响应。
   分析请求并构造响应。

   如果发生错误，此函数会相应地构造错误响应。
*/
int modbus_reply(modbus_t *ctx,
                 const uint8_t *req,
                 int req_length,
                 modbus_mapping_t *mb_mapping)
{
    unsigned int offset;
    int slave;
    int function;
    uint16_t address;
    uint8_t rsp[MAX_MESSAGE_LENGTH];
    int rsp_length = 0;
    sft_t sft;

    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    offset = ctx->backend->header_length;
    slave = req[offset - 1];
    function = req[offset];

    /* 某些功能码（例如 FC_READ_EXCEPTION_STATUS、FC_REPORT_SLAVE_ID）
       在请求 PDU 中不携带地址，因此仅在可用时读取。读取它们是安全的，
       因为它们的长度在 MODBUS_MAX_ADU_LENGTH 范围内，这只是为了保持一致性。
    */
    if (req_length >= (int) (offset + 3))
        address = (req[offset + 1] << 8) + req[offset + 2];
    else
        address = 0;

    sft.slave = slave;
    sft.function = function;
    sft.t_id = ctx->backend->get_response_tid(req);

    /* 在值数量非法错误时刷新数据。 */
    switch (function) {
    case MODBUS_FC_READ_COILS:
    case MODBUS_FC_READ_DISCRETE_INPUTS: {
        unsigned int is_input = (function == MODBUS_FC_READ_DISCRETE_INPUTS);
        int start_bits = is_input ? mb_mapping->start_input_bits : mb_mapping->start_bits;
        int nb_bits = is_input ? mb_mapping->nb_input_bits : mb_mapping->nb_bits;
        uint8_t *tab_bits = is_input ? mb_mapping->tab_input_bits : mb_mapping->tab_bits;
        const char *const name = is_input ? "read_input_bits" : "read_bits";
        int nb = (req[offset + 3] << 8) + req[offset + 4];
        /* 映射可以偏移以减少内存消耗，它并不总是从地址零开始。 */
        int mapping_address = address - start_bits;

        if (nb < 1 || MODBUS_MAX_READ_BITS < nb) {
            rsp_length = response_exception(ctx,
                                            &sft,
                                            MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                                            rsp,
                                            TRUE,
                                            "Illegal nb of values %d in %s (max %d)\n",
                                            nb,
                                            name,
                                            MODBUS_MAX_READ_BITS);
        } else if (mapping_address < 0 || (mapping_address + nb) > nb_bits) {
            rsp_length = response_exception(ctx,
                                            &sft,
                                            MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                            rsp,
                                            FALSE,
                                            "Illegal data address 0x%0X in %s\n",
                                            mapping_address < 0 ? address : address + nb,
                                            name);
        } else {
            rsp_length = ctx->backend->build_response_basis(&sft, rsp);
            rsp[rsp_length++] = (nb / 8) + ((nb % 8) ? 1 : 0);
            rsp_length =
                response_io_status(tab_bits, mapping_address, nb, rsp, rsp_length);
        }
    } break;
    case MODBUS_FC_READ_HOLDING_REGISTERS:
    case MODBUS_FC_READ_INPUT_REGISTERS: {
        unsigned int is_input = (function == MODBUS_FC_READ_INPUT_REGISTERS);
        int start_registers =
            is_input ? mb_mapping->start_input_registers : mb_mapping->start_registers;
        int nb_registers =
            is_input ? mb_mapping->nb_input_registers : mb_mapping->nb_registers;
        uint16_t *tab_registers =
            is_input ? mb_mapping->tab_input_registers : mb_mapping->tab_registers;
        const char *const name = is_input ? "read_input_registers" : "read_registers";
        int nb = (req[offset + 3] << 8) + req[offset + 4];
        /* 映射可以偏移以减少内存消耗，它并不总是从地址零开始。 */
        int mapping_address = address - start_registers;

        if (nb < 1 || MODBUS_MAX_READ_REGISTERS < nb) {
            rsp_length = response_exception(ctx,
                                            &sft,
                                            MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                                            rsp,
                                            TRUE,
                                            "Illegal nb of values %d in %s (max %d)\n",
                                            nb,
                                            name,
                                            MODBUS_MAX_READ_REGISTERS);
        } else if (mapping_address < 0 || (mapping_address + nb) > nb_registers) {
            rsp_length = response_exception(ctx,
                                            &sft,
                                            MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                            rsp,
                                            FALSE,
                                            "Illegal data address 0x%0X in %s\n",
                                            mapping_address < 0 ? address : address + nb,
                                            name);
        } else {
            int i;

            rsp_length = ctx->backend->build_response_basis(&sft, rsp);
            rsp[rsp_length++] = nb << 1;
            for (i = mapping_address; i < mapping_address + nb; i++) {
                rsp[rsp_length++] = tab_registers[i] >> 8;
                rsp[rsp_length++] = tab_registers[i] & 0xFF;
            }
        }
    } break;
    case MODBUS_FC_WRITE_SINGLE_COIL: {
        int mapping_address = address - mb_mapping->start_bits;

        if (mapping_address < 0 || mapping_address >= mb_mapping->nb_bits) {
            rsp_length = response_exception(ctx,
                                            &sft,
                                            MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                            rsp,
                                            FALSE,
                                            "Illegal data address 0x%0X in write bit\n",
                                            address);
            break;
        }

        /* 此检查仅在此处进行，以确保使用 memcpy 是安全的。 */
        rsp_length = compute_response_length_from_request(ctx, (uint8_t *) req);
        if (rsp_length != req_length) {
            /* modbus_reply 的错误使用 */
            rsp_length = response_exception(
                ctx,
                &sft,
                MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                rsp,
                FALSE,
                "Invalid request length in modbus_reply to write bit (%d)\n",
                req_length);
            break;
        }

        /* 不复制 CRC（如果有的话），它将在后面计算（即使与请求中的相同） */
        rsp_length -= ctx->backend->checksum_length;

        int data = (req[offset + 3] << 8) + req[offset + 4];
        if (data == 0xFF00 || data == 0x0) {
            /* 将更改应用到映射 */
            mb_mapping->tab_bits[mapping_address] = data ? ON : OFF;
            /* 准备响应 */
            memcpy(rsp, req, rsp_length);
        } else {
            rsp_length = response_exception(
                ctx,
                &sft,
                MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                rsp,
                FALSE,
                "Illegal data value 0x%0X in write_bit request at address %0X\n",
                data,
                address);
        }
    } break;
    case MODBUS_FC_WRITE_SINGLE_REGISTER: {
        int mapping_address = address - mb_mapping->start_registers;

        if (mapping_address < 0 || mapping_address >= mb_mapping->nb_registers) {
            rsp_length =
                response_exception(ctx,
                                   &sft,
                                   MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                   rsp,
                                   FALSE,
                                   "Illegal data address 0x%0X in write_register\n",
                                   address);
            break;
        }

        rsp_length = compute_response_length_from_request(ctx, (uint8_t *) req);
        if (rsp_length != req_length) {
            /* modbus_reply 的错误使用 */
            rsp_length = response_exception(
                ctx,
                &sft,
                MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                rsp,
                FALSE,
                "Invalid request length in modbus_reply to write register (%d)\n",
                req_length);
            break;
        }
        int data = (req[offset + 3] << 8) + req[offset + 4];

        mb_mapping->tab_registers[mapping_address] = data;

        rsp_length -= ctx->backend->checksum_length;
        memcpy(rsp, req, rsp_length);
    } break;
    case MODBUS_FC_WRITE_MULTIPLE_COILS: {
        int nb = (req[offset + 3] << 8) + req[offset + 4];
        int nb_bits = req[offset + 5];
        int mapping_address = address - mb_mapping->start_bits;

        if (nb < 1 || MODBUS_MAX_WRITE_BITS < nb || nb_bits * 8 < nb) {
            /* 由于地址无效（例如 nb 为0但请求中包含要写入的值），
             * 指示可能在读取时被截断，因此需要刷新。 */
            rsp_length =
                response_exception(ctx,
                                   &sft,
                                   MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                                   rsp,
                                   TRUE,
                                   "Illegal number of values %d in write_bits (max %d)\n",
                                   nb,
                                   MODBUS_MAX_WRITE_BITS);
        } else if (mapping_address < 0 || (mapping_address + nb) > mb_mapping->nb_bits) {
            rsp_length = response_exception(ctx,
                                            &sft,
                                            MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                            rsp,
                                            FALSE,
                                            "Illegal data address 0x%0X in write_bits\n",
                                            mapping_address < 0 ? address : address + nb);
        } else {
            /* 6 = 字节计数 */
            modbus_set_bits_from_bytes(
                mb_mapping->tab_bits, mapping_address, nb, &req[offset + 6]);

            rsp_length = ctx->backend->build_response_basis(&sft, rsp);
            /* 4 用于复制位地址（2字节）和位的数量 */
            memcpy(rsp + rsp_length, req + rsp_length, 4);
            rsp_length += 4;
        }
    } break;
    case MODBUS_FC_WRITE_MULTIPLE_REGISTERS: {
        int nb = (req[offset + 3] << 8) + req[offset + 4];
        int nb_bytes = req[offset + 5];
        int mapping_address = address - mb_mapping->start_registers;

        if (nb < 1 || MODBUS_MAX_WRITE_REGISTERS < nb || nb_bytes != nb * 2) {
            rsp_length = response_exception(
                ctx,
                &sft,
                MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                rsp,
                TRUE,
                "Illegal number of values %d in write_registers (max %d)\n",
                nb,
                MODBUS_MAX_WRITE_REGISTERS);
        } else if (mapping_address < 0 ||
                   (mapping_address + nb) > mb_mapping->nb_registers) {
            rsp_length =
                response_exception(ctx,
                                   &sft,
                                   MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                   rsp,
                                   FALSE,
                                   "Illegal data address 0x%0X in write_registers\n",
                                   mapping_address < 0 ? address : address + nb);
        } else {
            int i, j;
            for (i = mapping_address, j = 6; i < mapping_address + nb; i++, j += 2) {
                /* 6 和 7 = 第一个值 */
                mb_mapping->tab_registers[i] =
                    (req[offset + j] << 8) + req[offset + j + 1];
            }

            rsp_length = ctx->backend->build_response_basis(&sft, rsp);
            /* 4 用于复制地址（2字节）和寄存器数量 */
            memcpy(rsp + rsp_length, req + rsp_length, 4);
            rsp_length += 4;
        }
    } break;
    case MODBUS_FC_REPORT_SLAVE_ID: {
        int str_len;
        int byte_count_pos;

        rsp_length = ctx->backend->build_response_basis(&sft, rsp);
        /* 暂时跳过字节计数 */
        byte_count_pos = rsp_length++;
        rsp[rsp_length++] = _REPORT_SLAVE_ID;
        /* 运行指示状态设置为 ON */
        rsp[rsp_length++] = 0xFF;
        /* LMB + LIBMODBUS_VERSION_STRING 的长度 */
        str_len = 3 + strlen(LIBMODBUS_VERSION_STRING);
        memcpy(rsp + rsp_length, "LMB" LIBMODBUS_VERSION_STRING, str_len);
        rsp_length += str_len;
        rsp[byte_count_pos] = rsp_length - byte_count_pos - 1;
    } break;
    case MODBUS_FC_READ_EXCEPTION_STATUS:
        rsp_length = response_exception(ctx,
                                        &sft,
                                        MODBUS_EXCEPTION_ILLEGAL_FUNCTION,
                                        rsp,
                                        TRUE,
                                        "Unsupported function: READ EXCEPTION STATUS (0x07)\n");
        break;
    case MODBUS_FC_MASK_WRITE_REGISTER: {
        int mapping_address = address - mb_mapping->start_registers;

        if (mapping_address < 0 || mapping_address >= mb_mapping->nb_registers) {
            rsp_length =
                response_exception(ctx,
                                   &sft,
                                   MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                                   rsp,
                                   FALSE,
                                   "Illegal data address 0x%0X in write_register\n",
                                   address);
        } else {
            uint16_t data = mb_mapping->tab_registers[mapping_address];
            uint16_t and = (req[offset + 3] << 8) + req[offset + 4];
            uint16_t or = (req[offset + 5] << 8) + req[offset + 6];

            data = (data & and) | (or & (~and));
            mb_mapping->tab_registers[mapping_address] = data;

            rsp_length = compute_response_length_from_request(ctx, (uint8_t *) req);
            if (rsp_length != req_length) {
                /* modbus_reply 的错误使用 */
                rsp_length = response_exception(ctx,
                                                &sft,
                                                MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                                                rsp,
                                                FALSE,
                                                "Invalid request length in modbus_reply "
                                                "to mask write register (%d)\n",
                                                req_length);
                break;
            }

            rsp_length -= ctx->backend->checksum_length;
            memcpy(rsp, req, rsp_length);
        }
    } break;
    case MODBUS_FC_WRITE_AND_READ_REGISTERS: {
        int nb = (req[offset + 3] << 8) + req[offset + 4];
        uint16_t address_write = (req[offset + 5] << 8) + req[offset + 6];
        int nb_write = (req[offset + 7] << 8) + req[offset + 8];
        int nb_write_bytes = req[offset + 9];
        int mapping_address = address - mb_mapping->start_registers;
        int mapping_address_write = address_write - mb_mapping->start_registers;

        if (nb_write < 1 || MODBUS_MAX_WR_WRITE_REGISTERS < nb_write || nb < 1 ||
            MODBUS_MAX_WR_READ_REGISTERS < nb || nb_write_bytes != nb_write * 2) {
            rsp_length = response_exception(
                ctx,
                &sft,
                MODBUS_EXCEPTION_ILLEGAL_DATA_VALUE,
                rsp,
                TRUE,
                "Illegal nb of values (W%d, R%d) in write_and_read_registers (max W%d, "
                "R%d)\n",
                nb_write,
                nb,
                MODBUS_MAX_WR_WRITE_REGISTERS,
                MODBUS_MAX_WR_READ_REGISTERS);
        } else if (mapping_address < 0 ||
                   (mapping_address + nb) > mb_mapping->nb_registers ||
                   mapping_address_write < 0 ||
                   (mapping_address_write + nb_write) > mb_mapping->nb_registers) {
            rsp_length = response_exception(
                ctx,
                &sft,
                MODBUS_EXCEPTION_ILLEGAL_DATA_ADDRESS,
                rsp,
                FALSE,
                "Illegal data read address 0x%0X or write address 0x%0X "
                "write_and_read_registers\n",
                mapping_address < 0 ? address : address + nb,
                mapping_address_write < 0 ? address_write : address_write + nb_write);
        } else {
            int i, j;
            rsp_length = ctx->backend->build_response_basis(&sft, rsp);
            rsp[rsp_length++] = nb << 1;

            /* 先写入。
               10 和 11 是第一个要写入的值的偏移量 */
            for (i = mapping_address_write, j = 10; i < mapping_address_write + nb_write;
                 i++, j += 2) {
                mb_mapping->tab_registers[i] =
                    (req[offset + j] << 8) + req[offset + j + 1];
            }

            /* 然后读取响应数据 */
            for (i = mapping_address; i < mapping_address + nb; i++) {
                rsp[rsp_length++] = mb_mapping->tab_registers[i] >> 8;
                rsp[rsp_length++] = mb_mapping->tab_registers[i] & 0xFF;
            }
        }
    } break;

    default:
        rsp_length = response_exception(ctx,
                                        &sft,
                                        MODBUS_EXCEPTION_ILLEGAL_FUNCTION,
                                        rsp,
                                        TRUE,
                                        "Unknown Modbus function code: 0x%0X\n",
                                        function);
        break;
    }

    /* 在 RTU 模式下，当请求是广播时抑制任何响应，
     * 除非启用了 quirk 特性。 */
    if (ctx->backend->backend_type == _MODBUS_BACKEND_TYPE_RTU &&
        slave == MODBUS_BROADCAST_ADDRESS &&
        !(ctx->quirks & MODBUS_QUIRK_REPLY_TO_BROADCAST)) {
        return 0;
    }
    return send_msg(ctx, rsp, rsp_length);
}

int modbus_reply_exception(modbus_t *ctx, const uint8_t *req, unsigned int exception_code)
{
    unsigned int offset;
    int slave;
    int function;
    uint8_t rsp[MAX_MESSAGE_LENGTH];
    int rsp_length;
    sft_t sft;

    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    offset = ctx->backend->header_length;
    slave = req[offset - 1];
    function = req[offset];

    sft.slave = slave;
    sft.function = function + 0x80;
    sft.t_id = ctx->backend->get_response_tid(req);
    rsp_length = ctx->backend->build_response_basis(&sft, rsp);

    /* 正整数异常码 */
    if (exception_code < MODBUS_EXCEPTION_MAX) {
        rsp[rsp_length++] = exception_code;
        return send_msg(ctx, rsp, rsp_length);
    } else {
        errno = EINVAL;
        return -1;
    }
}

/* 读取 I/O 状态 */
static int read_io_status(modbus_t *ctx, int function, int addr, int nb, uint8_t *dest)
{
    int rc;
    int req_length;

    uint8_t req[_MIN_REQ_LENGTH];
    uint8_t rsp[MAX_MESSAGE_LENGTH];

    req_length = ctx->backend->build_request_basis(ctx, function, addr, nb, req);

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        int temp, bit;
        int pos = 0;
        unsigned int offset;
        unsigned int offset_end;
        unsigned int i;

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
        if (rc == -1)
            return -1;

        offset = ctx->backend->header_length + 2;
        offset_end = offset + rc;
        for (i = offset; i < offset_end; i++) {
            /* 将寄存器高字节移位到 temp */
            temp = rsp[i];

            for (bit = 0x01; (bit & 0xff) && (pos < nb);) {
                dest[pos++] = (temp & bit) ? TRUE : FALSE;
                bit = bit << 1;
            }
        }
    }

    return rc;
}

/* 读取位的布尔状态，并将数组元素设置为 TRUE 或 FALSE（单个位）。 */
int modbus_read_bits(modbus_t *ctx, int addr, int nb, uint8_t *dest)
{
    int rc;

    if (ctx == NULL || dest == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (nb < 1 || nb > MODBUS_MAX_READ_BITS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many bits requested (%d > %d)",
                    nb,
                    MODBUS_MAX_READ_BITS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    rc = read_io_status(ctx, MODBUS_FC_READ_COILS, addr, nb, dest);

    if (rc == -1)
        return -1;
    else
        return nb;
}

/* 与 modbus_read_bits 相同，但读取远程设备的输入表 */
int modbus_read_input_bits(modbus_t *ctx, int addr, int nb, uint8_t *dest)
{
    int rc;

    if (ctx == NULL || dest == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (nb < 1 || nb > MODBUS_MAX_READ_BITS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many discrete inputs requested (%d > %d)",
                    nb,
                    MODBUS_MAX_READ_BITS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    rc = read_io_status(ctx, MODBUS_FC_READ_DISCRETE_INPUTS, addr, nb, dest);

    if (rc == -1)
        return -1;
    else
        return nb;
}

/* 从远程设备读取数据并将数据放入数组中 */
static int read_registers(modbus_t *ctx, int function, int addr, int nb, uint16_t *dest)
{
    int rc;
    int req_length;
    uint8_t req[_MIN_REQ_LENGTH];
    uint8_t rsp[MAX_MESSAGE_LENGTH];

    if (nb > MODBUS_MAX_READ_REGISTERS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many registers requested (%d > %d)",
                    nb,
                    MODBUS_MAX_READ_REGISTERS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    req_length = ctx->backend->build_request_basis(ctx, function, addr, nb, req);

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        unsigned int offset;
        int i;

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
        if (rc == -1)
            return -1;

        offset = ctx->backend->header_length;

        for (i = 0; i < rc; i++) {
            /* 将寄存器高字节移位到 temp，与低字节进行 OR 运算 */
            dest[i] = (rsp[offset + 2 + (i << 1)] << 8) | rsp[offset + 3 + (i << 1)];
        }
    }

    return rc;
}

/* 读取远程设备的保持寄存器并将数据放入数组 */
int modbus_read_registers(modbus_t *ctx, int addr, int nb, uint16_t *dest)
{
    int status;

    if (ctx == NULL || dest == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (nb < 1 || nb > MODBUS_MAX_READ_REGISTERS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many registers requested (%d > %d)",
                    nb,
                    MODBUS_MAX_READ_REGISTERS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    status = read_registers(ctx, MODBUS_FC_READ_HOLDING_REGISTERS, addr, nb, dest);
    return status;
}

/* 读取远程设备的输入寄存器并将数据放入数组 */
int modbus_read_input_registers(modbus_t *ctx, int addr, int nb, uint16_t *dest)
{
    int status;

    if (ctx == NULL || dest == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (nb < 1 || nb > MODBUS_MAX_READ_REGISTERS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many input registers requested (%d > %d)",
                    nb,
                    MODBUS_MAX_READ_REGISTERS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    status = read_registers(ctx, MODBUS_FC_READ_INPUT_REGISTERS, addr, nb, dest);

    return status;
}

/* 向远程设备的指定寄存器写入一个值。
   由 write_bit 和 write_register 使用 */
static int write_single(modbus_t *ctx, int function, int addr, const uint16_t value)
{
    int rc;
    int req_length;
    uint8_t req[_MIN_REQ_LENGTH];

    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    req_length = ctx->backend->build_request_basis(ctx, function, addr, (int) value, req);

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        /* 由 write_bit 和 write_register 使用 */
        uint8_t rsp[MAX_MESSAGE_LENGTH];

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
    }

    return rc;
}

/* 打开或关闭远程设备的单个位 */
int modbus_write_bit(modbus_t *ctx, int addr, int status)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return write_single(ctx, MODBUS_FC_WRITE_SINGLE_COIL, addr, status ? 0xFF00 : 0);
}

/* 向远程设备的一个寄存器写入一个值 */
int modbus_write_register(modbus_t *ctx, int addr, const uint16_t value)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return write_single(ctx, MODBUS_FC_WRITE_SINGLE_REGISTER, addr, value);
}

/* 将数组中的位写入远程设备 */
int modbus_write_bits(modbus_t *ctx, int addr, int nb, const uint8_t *src)
{
    int rc;
    int i;
    int byte_count;
    int req_length;
    int bit_check = 0;
    int pos = 0;
    uint8_t req[MAX_MESSAGE_LENGTH];

    if (ctx == NULL || src == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (nb < 1 || nb > MODBUS_MAX_WRITE_BITS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Writing too many bits (%d > %d)",
                    nb,
                    MODBUS_MAX_WRITE_BITS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    req_length = ctx->backend->build_request_basis(
        ctx, MODBUS_FC_WRITE_MULTIPLE_COILS, addr, nb, req);
    byte_count = (nb / 8) + ((nb % 8) ? 1 : 0);
    req[req_length++] = byte_count;

    for (i = 0; i < byte_count; i++) {
        int bit;

        bit = 0x01;
        req[req_length] = 0;

        while ((bit & 0xFF) && (bit_check++ < nb)) {
            if (src[pos++])
                req[req_length] |= bit;
            else
                req[req_length] &= ~bit;

            bit = bit << 1;
        }
        req_length++;
    }

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        uint8_t rsp[MAX_MESSAGE_LENGTH];

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
    }

    return rc;
}

/* 将数组中的值写入远程设备的寄存器 */
int modbus_write_registers(modbus_t *ctx, int addr, int nb, const uint16_t *src)
{
    int rc;
    int i;
    int req_length;
    int byte_count;
    uint8_t req[MAX_MESSAGE_LENGTH];

    if (ctx == NULL || src == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (nb < 1 || nb > MODBUS_MAX_WRITE_REGISTERS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Trying to write to too many registers (%d > %d)",
                    nb,
                    MODBUS_MAX_WRITE_REGISTERS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    req_length = ctx->backend->build_request_basis(
        ctx, MODBUS_FC_WRITE_MULTIPLE_REGISTERS, addr, nb, req);
    byte_count = nb * 2;
    req[req_length++] = byte_count;

    for (i = 0; i < nb; i++) {
        req[req_length++] = src[i] >> 8;
        req[req_length++] = src[i] & 0x00FF;
    }

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        uint8_t rsp[MAX_MESSAGE_LENGTH];

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
    }

    return rc;
}

int modbus_mask_write_register(modbus_t *ctx,
                               int addr,
                               uint16_t and_mask,
                               uint16_t or_mask)
{
    int rc;
    int req_length;
    /* 请求长度不能超过 _MIN_REQ_LENGTH - 2 加上4个字节来存储掩码。
     * 丑陋的减法是用来移除未使用的 'nb' 值（2字节）。 */
    uint8_t req[_MIN_REQ_LENGTH + 2];

    req_length = ctx->backend->build_request_basis(
        ctx, MODBUS_FC_MASK_WRITE_REGISTER, addr, 0, req);

    /* 权宜之计，计数未使用 */
    req_length -= 2;

    req[req_length++] = and_mask >> 8;
    req[req_length++] = and_mask & 0x00ff;
    req[req_length++] = or_mask >> 8;
    req[req_length++] = or_mask & 0x00ff;

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        /* 由 write_bit 和 write_register 使用 */
        uint8_t rsp[MAX_MESSAGE_LENGTH];

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
    }

    return rc;
}

/* 从 src 数组向远程设备写入多个寄存器，
   并从远程设备读取多个寄存器到 dest 数组。 */
int modbus_write_and_read_registers(modbus_t *ctx,
                                    int write_addr,
                                    int write_nb,
                                    const uint16_t *src,
                                    int read_addr,
                                    int read_nb,
                                    uint16_t *dest)

{
    int rc;
    int req_length;
    int i;
    int byte_count;
    uint8_t req[MAX_MESSAGE_LENGTH];
    uint8_t rsp[MAX_MESSAGE_LENGTH];

    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    if (write_nb > MODBUS_MAX_WR_WRITE_REGISTERS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many registers to write (%d > %d)",
                    write_nb,
                    MODBUS_MAX_WR_WRITE_REGISTERS);
        }
        errno = EMBXILVAL;
        return -1;
    }

    if (read_nb > MODBUS_MAX_WR_READ_REGISTERS) {
        if (ctx->debug) {
            LOG_E(
                    "ERROR Too many registers requested (%d > %d)",
                    read_nb,
                    MODBUS_MAX_WR_READ_REGISTERS);
        }
        errno = EMBXILVAL;
        return -1;
    }
    req_length = ctx->backend->build_request_basis(
        ctx, MODBUS_FC_WRITE_AND_READ_REGISTERS, read_addr, read_nb, req);

    req[req_length++] = write_addr >> 8;
    req[req_length++] = write_addr & 0x00ff;
    req[req_length++] = write_nb >> 8;
    req[req_length++] = write_nb & 0x00ff;
    byte_count = write_nb * 2;
    req[req_length++] = byte_count;

    for (i = 0; i < write_nb; i++) {
        req[req_length++] = src[i] >> 8;
        req[req_length++] = src[i] & 0x00FF;
    }

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        unsigned int offset;

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
        if (rc == -1)
            return -1;

        offset = ctx->backend->header_length;
        for (i = 0; i < rc; i++) {
            /* 将寄存器高字节移位到 temp，与低字节进行 OR 运算 */
            dest[i] = (rsp[offset + 2 + (i << 1)] << 8) | rsp[offset + 3 + (i << 1)];
        }
    }

    return rc;
}

/* 发送请求以获取设备的从站ID（仅在串行通信中可用）。 */
int modbus_report_slave_id(modbus_t *ctx, int max_dest, uint8_t *dest)
{
    int rc;
    int req_length;
    uint8_t req[_MIN_REQ_LENGTH];

    if (ctx == NULL || max_dest <= 0) {
        errno = EINVAL;
        return -1;
    }

    req_length =
        ctx->backend->build_request_basis(ctx, MODBUS_FC_REPORT_SLAVE_ID, 0, 0, req);

    /* 权宜之计，地址和计数未使用 */
    req_length -= 4;

    rc = send_msg(ctx, req, req_length);
    if (rc > 0) {
        int i;
        unsigned int offset;
        uint8_t rsp[MAX_MESSAGE_LENGTH];

        rc = _modbus_receive_msg(ctx, rsp, MSG_CONFIRMATION);
        if (rc == -1)
            return -1;

        rc = check_confirmation(ctx, req, rsp, rc);
        if (rc == -1)
            return -1;

        offset = ctx->backend->header_length + 2;

        /* 字节计数、从站ID、运行指示状态和附加数据。
           将复制截断到 max_dest 以内。 */
        for (i = 0; i < rc && i < max_dest; i++) {
            dest[i] = rsp[offset + i];
        }
    }

    return rc;
}

void _modbus_init_common(modbus_t *ctx)
{
    /* 从站和套接字初始化为 -1 */
    ctx->slave = -1;
    ctx->s = -1;

    ctx->debug = FALSE;
    ctx->error_recovery = MODBUS_ERROR_RECOVERY_NONE;
    ctx->quirks = MODBUS_QUIRK_NONE;

    ctx->response_timeout.tv_sec = 0;
    ctx->response_timeout.tv_usec = _RESPONSE_TIMEOUT;

    ctx->byte_timeout.tv_sec = 0;
    ctx->byte_timeout.tv_usec = _BYTE_TIMEOUT;

    ctx->indication_timeout.tv_sec = 0;
    ctx->indication_timeout.tv_usec = 0;
}

/* 定义从站编号 */
int modbus_set_slave(modbus_t *ctx, int slave)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return ctx->backend->set_slave(ctx, slave);
}

int modbus_get_slave(modbus_t *ctx)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return ctx->slave;
}

int modbus_set_error_recovery(modbus_t *ctx, modbus_error_recovery_mode error_recovery)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    /* modbus_error_recovery_mode 的类型是无符号枚举 */
    ctx->error_recovery = (uint8_t) error_recovery;
    return 0;
}

// FIXME 在 Windows RTU 下无法工作
int modbus_set_socket(modbus_t *ctx, int s)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    ctx->s = s;
    return 0;
}

int modbus_get_socket(modbus_t *ctx)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return ctx->s;
}

/* 获取等待响应所用的超时间隔 */
int modbus_get_response_timeout(modbus_t *ctx, uint32_t *to_sec, uint32_t *to_usec)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    *to_sec = ctx->response_timeout.tv_sec;
    *to_usec = ctx->response_timeout.tv_usec;
    return 0;
}

int modbus_set_response_timeout(modbus_t *ctx, uint32_t to_sec, uint32_t to_usec)
{
    if (ctx == NULL || (to_sec == 0 && to_usec == 0) || to_usec > 999999) {
        errno = EINVAL;
        return -1;
    }

    ctx->response_timeout.tv_sec = to_sec;
    ctx->response_timeout.tv_usec = to_usec;
    return 0;
}

/* 获取消息的两个连续字节之间的超时间隔 */
int modbus_get_byte_timeout(modbus_t *ctx, uint32_t *to_sec, uint32_t *to_usec)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    *to_sec = ctx->byte_timeout.tv_sec;
    *to_usec = ctx->byte_timeout.tv_usec;
    return 0;
}

int modbus_set_byte_timeout(modbus_t *ctx, uint32_t to_sec, uint32_t to_usec)
{
    /* 当两个值都为零时，字节超时可以被禁用 */
    if (ctx == NULL || to_usec > 999999) {
        errno = EINVAL;
        return -1;
    }

    ctx->byte_timeout.tv_sec = to_sec;
    ctx->byte_timeout.tv_usec = to_usec;
    return 0;
}

/* 获取服务器等待客户端指示所用的超时间隔 */
int modbus_get_indication_timeout(modbus_t *ctx, uint32_t *to_sec, uint32_t *to_usec)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    *to_sec = ctx->indication_timeout.tv_sec;
    *to_usec = ctx->indication_timeout.tv_usec;
    return 0;
}

int modbus_set_indication_timeout(modbus_t *ctx, uint32_t to_sec, uint32_t to_usec)
{
    /* 当两个值都为零时，指示超时可以被禁用 */
    if (ctx == NULL || to_usec > 999999) {
        errno = EINVAL;
        return -1;
    }

    ctx->indication_timeout.tv_sec = to_sec;
    ctx->indication_timeout.tv_usec = to_usec;
    return 0;
}

int modbus_get_header_length(modbus_t *ctx)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return ctx->backend->header_length;
}

int modbus_enable_quirks(modbus_t *ctx, unsigned int quirks_mask)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    /* 启用掩码中对应索引位置为真的 quirk 特性 */
    ctx->quirks |= quirks_mask;
    return 0;
}

int modbus_disable_quirks(modbus_t *ctx, unsigned int quirks_mask)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    /* 禁用掩码中对应索引位置为真的 quirk 特性 */
    ctx->quirks &= ~quirks_mask;
    return 0;
}

int modbus_connect(modbus_t *ctx)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    return ctx->backend->connect(ctx);
}

void modbus_close(modbus_t *ctx)
{
    if (ctx == NULL)
        return;

    ctx->backend->close(ctx);
}

void modbus_free(modbus_t *ctx)
{
    if (ctx == NULL)
        return;

    ctx->backend->free(ctx);
}

int modbus_set_debug(modbus_t *ctx, int flag)
{
    if (ctx == NULL) {
        errno = EINVAL;
        return -1;
    }

    ctx->debug = flag;
    return 0;
}

/* 分配4个数组来存储位、输入位、寄存器和输入寄存器。
   指针存储在 modbus_mapping 结构中。

   modbus_mapping_new_start_address() 函数在成功时返回新分配的结构体。
   否则返回 NULL 并设置 errno 为 ENOMEM。 */
modbus_mapping_t *modbus_mapping_new_start_address(unsigned int start_bits,
                                                   unsigned int nb_bits,
                                                   unsigned int start_input_bits,
                                                   unsigned int nb_input_bits,
                                                   unsigned int start_registers,
                                                   unsigned int nb_registers,
                                                   unsigned int start_input_registers,
                                                   unsigned int nb_input_registers)
{
    modbus_mapping_t *mb_mapping;

    mb_mapping = (modbus_mapping_t *) malloc(sizeof(modbus_mapping_t));
    if (mb_mapping == NULL) {
        return NULL;
    }

    /* 0X - 线圈 */
    mb_mapping->nb_bits = nb_bits;
    mb_mapping->start_bits = start_bits;
    if (nb_bits == 0) {
        mb_mapping->tab_bits = NULL;
    } else {
        /* 负数会引发 POSIX 错误 */
        mb_mapping->tab_bits = (uint8_t *) malloc(nb_bits * sizeof(uint8_t));
        if (mb_mapping->tab_bits == NULL) {
            free(mb_mapping);
            return NULL;
        }
        memset(mb_mapping->tab_bits, 0, nb_bits * sizeof(uint8_t));
    }

    /* 1X - 离散输入 */
    mb_mapping->nb_input_bits = nb_input_bits;
    mb_mapping->start_input_bits = start_input_bits;
    if (nb_input_bits == 0) {
        mb_mapping->tab_input_bits = NULL;
    } else {
        mb_mapping->tab_input_bits = (uint8_t *) malloc(nb_input_bits * sizeof(uint8_t));
        if (mb_mapping->tab_input_bits == NULL) {
            free(mb_mapping->tab_bits);
            free(mb_mapping);
            return NULL;
        }
        memset(mb_mapping->tab_input_bits, 0, nb_input_bits * sizeof(uint8_t));
    }

    /* 4X - 保持寄存器 */
    mb_mapping->nb_registers = nb_registers;
    mb_mapping->start_registers = start_registers;
    if (nb_registers == 0) {
        mb_mapping->tab_registers = NULL;
    } else {
        mb_mapping->tab_registers = (uint16_t *) malloc(nb_registers * sizeof(uint16_t));
        if (mb_mapping->tab_registers == NULL) {
            free(mb_mapping->tab_input_bits);
            free(mb_mapping->tab_bits);
            free(mb_mapping);
            return NULL;
        }
        memset(mb_mapping->tab_registers, 0, nb_registers * sizeof(uint16_t));
    }

    /* 3X - 输入寄存器 */
    mb_mapping->nb_input_registers = nb_input_registers;
    mb_mapping->start_input_registers = start_input_registers;
    if (nb_input_registers == 0) {
        mb_mapping->tab_input_registers = NULL;
    } else {
        mb_mapping->tab_input_registers =
            (uint16_t *) malloc(nb_input_registers * sizeof(uint16_t));
        if (mb_mapping->tab_input_registers == NULL) {
            free(mb_mapping->tab_registers);
            free(mb_mapping->tab_input_bits);
            free(mb_mapping->tab_bits);
            free(mb_mapping);
            return NULL;
        }
        memset(mb_mapping->tab_input_registers, 0, nb_input_registers * sizeof(uint16_t));
    }

    return mb_mapping;
}

modbus_mapping_t *modbus_mapping_new(int nb_bits,
                                     int nb_input_bits,
                                     int nb_registers,
                                     int nb_input_registers)
{
    return modbus_mapping_new_start_address(
        0, nb_bits, 0, nb_input_bits, 0, nb_registers, 0, nb_input_registers);
}

/* 释放4个数组 */
void modbus_mapping_free(modbus_mapping_t *mb_mapping)
{
    if (mb_mapping == NULL) {
        return;
    }

    free(mb_mapping->tab_input_registers);
    free(mb_mapping->tab_registers);
    free(mb_mapping->tab_input_bits);
    free(mb_mapping->tab_bits);
    free(mb_mapping);
}

#ifndef HAVE_STRLCPY
/*
 * strlcpy 函数最初由 Todd C. Miller <Todd.Miller@courtesan.com> 开发，
 * 用于简化安全代码的编写。
 * 详情请参见 ftp://ftp.openbsd.org/pub/OpenBSD/src/lib/libc/string/strlcpy.3
 *
 * 感谢 Ulrich Drepper... 才怪！
 *
 * 将 src 复制到大小为 dest_size 的目标字符串 dest。最多复制 dest_size-1 个字符。
 * 始终以 NUL 结尾（除非 dest_size == 0）。
 * 返回 strlen(src)；如果 retval >= dest_size，则发生了截断。
 */
size_t strlcpy(char *dest, const char *src, size_t dest_size)
{
    register char *d = dest;
    register const char *s = src;
    register size_t n = dest_size;

    /* 复制尽可能多的字节 */
    if (n != 0 && --n != 0) {
        do {
            if ((*d++ = *s++) == 0)
                break;
        } while (--n != 0);
    }

    /* dest 中没有足够的空间，添加 NUL 并遍历 src 的剩余部分 */
    if (n == 0) {
        if (dest_size != 0)
            *d = '\0'; /* 以 NUL 结尾 dest */
        while (*s++)
            ;
    }

    return (s - src - 1); /* 计数不包括 NUL */
}
#endif
