Re: [PATCH v4 2/6] block: Allow changing bs->file on reopen

[Vladimir Sementsov-Ogievskiy]

17.03.2021 20:15, Alberto Garcia wrote:
> When the x-blockdev-reopen was added it allowed reconfiguring the
> graph by replacing backing files, but changing the 'file' option was
> forbidden. Because of this restriction some operations are not
> possible, notably inserting and removing block filters.
>
> This patch adds support for replacing the 'file' option. This is
> similar to replacing the backing file and the user is likewise
> responsible for the correctness of the resulting graph, otherwise this
> can lead to data corruption.
>
> Signed-off-by: Alberto Garcia <berto@igalia.com>

In general patch looks OK for me, some comments below.

> ---
>   include/block/block.h  |   1 +
>   block.c                | 119 ++++++++++++++++++++++++++---------------
>   tests/qemu-iotests/245 |   9 ++--
>   3 files changed, 81 insertions(+), 48 deletions(-)
>
> diff --git a/include/block/block.h b/include/block/block.h
> index 5eb1e4cab9..e2732a0187 100644
> --- a/include/block/block.h
> +++ b/include/block/block.h
> @@ -209,6 +209,7 @@ typedef struct BDRVReopenState {
>       bool backing_missing;
>       bool replace_backing_bs;  /* new_backing_bs is ignored if this is false */
>       BlockDriverState *old_backing_bs; /* keep pointer for permissions update 
> */
> +    BlockDriverState *old_file_bs;    /* keep pointer for permissions update */
>       QDict *options;
>       QDict *explicit_options;
>       void *opaque;
> diff --git a/block.c b/block.c
> index 764cdbec7d..8ff0afd77b 100644
> --- a/block.c
> +++ b/block.c
> @@ -98,7 +98,7 @@ static void bdrv_remove_filter_or_cow_child(BlockDriverState 
> *bs,
>   
>   static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
>                                  BlockReopenQueue *queue,
> -                               Transaction *set_backings_tran, Error **errp);
> +                               Transaction *tran, Error **errp);

I'd not call it just "tran" to not interfere with transaction actions. Of 
course, reopen should be finally refactored to work cleanly on Transaction API, but that 
is not done yet. And here we pass a transaction pointer only to keep children 
modification.. So, let's make it change_child_tran, or something like this.

>   static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
>   static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
>   
> @@ -4049,6 +4049,10 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
>               refresh_list = bdrv_topological_dfs(refresh_list, found,
>                                                   state->old_backing_bs);
>           }
> +        if (state->old_file_bs) {
> +            refresh_list = bdrv_topological_dfs(refresh_list, found,
> +                                                state->old_file_bs);
> +        }
>       }
>   
>       /*
> @@ -4161,65 +4165,77 @@ static bool bdrv_reopen_can_attach(BlockDriverState 
> *parent,
>    *
>    * Return 0 on success, otherwise return < 0 and set @errp.
>    */
> -static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
> -                                     Transaction *set_backings_tran,
> -                                     Error **errp)
> +static int bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
> +                                             bool parse_file, Transaction 
> *tran,
> +                                             Error **errp)
>   {
>       BlockDriverState *bs = reopen_state->bs;
> -    BlockDriverState *overlay_bs, *below_bs, *new_backing_bs;
> +    BlockDriverState *overlay_bs, *below_bs, *new_child_bs;
> +    BdrvChild *child = parse_file ? bs->file : bs->backing;
>       QObject *value;
>       const char *str;
>   
> -    value = qdict_get(reopen_state->options, "backing");
> +    value = qdict_get(reopen_state->options, parse_file ? "file" : "backing");
>       if (value == NULL) {
>           return 0;
>       }
>   
>       switch (qobject_type(value)) {
>       case QTYPE_QNULL:
> -        new_backing_bs = NULL;
> +        assert(!parse_file); /* The 'file' option does not allow a null value 
> */
> +        new_child_bs = NULL;
>           break;
>       case QTYPE_QSTRING:
>           str = qstring_get_str(qobject_to(QString, value));
> -        new_backing_bs = bdrv_lookup_bs(NULL, str, errp);
> -        if (new_backing_bs == NULL) {
> +        new_child_bs = bdrv_lookup_bs(NULL, str, errp);
> +        if (new_child_bs == NULL) {
>               return -EINVAL;
> -        } else if (bdrv_recurse_has_child(new_backing_bs, bs)) {
> -            error_setg(errp, "Making '%s' a backing file of '%s' "
> -                       "would create a cycle", str, bs->node_name);
> +        } else if (bdrv_recurse_has_child(new_child_bs, bs)) {
> +            error_setg(errp, "Making '%s' a %s of '%s' would create a cycle",
> +                       str, parse_file ? "file" : "backing file",

maybe s/"file"/"file child"/

> +                       bs->node_name);
>               return -EINVAL;
>           }
>           break;
>       default:
> -        /* 'backing' does not allow any other data type */
> +        /* The options QDict has been flattened, so 'backing' and 'file'
> +         * do not allow any other data type here. */

checkpatch should complain that you didn't fix style of the comment...

>           g_assert_not_reached();
>       }
>   
> -    /*
> -     * Check AioContext compatibility so that the bdrv_set_backing_hd() call in
> -     * bdrv_reopen_commit() won't fail.
> -     */
> -    if (new_backing_bs) {
> -        if (!bdrv_reopen_can_attach(bs, bs->backing, new_backing_bs, errp)) {
> +    /* If 'file' points to the current child then there's nothing to do */
> +    if (child_bs(child) == new_child_bs) {
> +        return 0;
> +    }
> +
> +    /* Check AioContext compatibility */
> +    if (new_child_bs) {
> +        if (!bdrv_reopen_can_attach(bs, child, new_child_bs, errp)) {
>               return -EINVAL;
>           }
>       }
>   
> -    /*
> -     * Ensure that @bs can really handle backing files, because we are
> -     * about to give it one (or swap the existing one)
> -     */
> -    if (bs->drv->is_filter) {
> -        /* Filters always have a file or a backing child */
> -        if (!bs->backing) {
> -            error_setg(errp, "'%s' is a %s filter node that does not support a 
> "
> -                       "backing child", bs->node_name, bs->drv->format_name);
> +    if (parse_file) {
> +        assert(child && child->bs);

I'm not sure, that we can't get children without a bs at some point.. And we 
have so many checks about it in the code. Probably we can drop them all? But I 
don't want to care to much. If this assertion fires, we'll fix a bug.

> +    } else {
> +        /*
> +         * Ensure that @bs can really handle backing files, because we are
> +         * about to give it one (or swap the existing one)
> +         */
> +        if (bs->drv->is_filter) {
> +            /* Filters always have a file or a backing child */

Probably we can assert bs->backing, as otherwise backing option should be 
unsupported [preexisting, not about this patch]

> +            if (!bs->backing) {
> +                error_setg(errp, "'%s' is a %s filter node "
> +                           "that does not support a backing child",
> +                           bs->node_name, bs->drv->format_name);
> +                return -EINVAL;
> +            }
> +        } else if (!bs->drv->supports_backing) {

Probably we can assert bs->drv->supports_backing, as otherwise backing option 
should be unsupported [preexisting, not about this patch]

> +            error_setg(errp, "Driver '%s' of node '%s' "
> +                       "does not support backing files",
> +                       bs->drv->format_name, bs->node_name);
>               return -EINVAL;
>           }
> -    } else if (!bs->drv->supports_backing) {
> -        error_setg(errp, "Driver '%s' of node '%s' does not support backing "
> -                   "files", bs->drv->format_name, bs->node_name);
> -        return -EINVAL;
>       }
>   
>       /*
> @@ -4238,13 +4254,13 @@ static int bdrv_reopen_parse_backing(BDRVReopenState 
> *reopen_state,
>       }
>   
>       /* If we want to replace the backing file we need some extra checks */

You didn't update the comment.

> -    if (new_backing_bs != bdrv_filter_or_cow_bs(overlay_bs)) {
> +    if (new_child_bs != bdrv_filter_or_cow_bs(overlay_bs)) {
>           int ret;
>   
>           /* Check for implicit nodes between bs and its backing file */
>           if (bs != overlay_bs) {
> -            error_setg(errp, "Cannot change backing link if '%s' has "
> -                       "an implicit backing file", bs->node_name);
> +            error_setg(errp, "Cannot change %s link if '%s' has an implicit "
> +                       "child", parse_file ? "file" : "backing", 
> bs->node_name);
>               return -EPERM;
>           }
>           /*
> @@ -4256,16 +4272,24 @@ static int bdrv_reopen_parse_backing(BDRVReopenState 
> *reopen_state,
>            * with bs->drv->supports_backing == true.
>            */
>           if (bdrv_is_backing_chain_frozen(overlay_bs,
> -                                         child_bs(overlay_bs->backing), errp))
> +                                         bdrv_filter_or_cow_bs(overlay_bs),
> +                                         errp))
>           {
>               return -EPERM;
>           }
> -        reopen_state->replace_backing_bs = true;
> -        reopen_state->old_backing_bs = bs->backing ? bs->backing->bs : NULL;
> -        ret = bdrv_set_backing_noperm(bs, new_backing_bs, set_backings_tran,
> -                                      errp);
> -        if (ret < 0) {
> -            return ret;
> +        if (parse_file) {
> +            /* Store the old file bs, we'll need to refresh its permissions */
> +            reopen_state->old_file_bs = bs->file->bs;
> +
> +            /* And finally replace the child */
> +            bdrv_replace_child(bs->file, new_child_bs, tran);

I think that actually, we need also to update inherits_from and do 
refresh_limits like in bdrv_set_backing_noperm().

Probably, bdrv_replace_child should do it. Probably not (there are still a lot 
of things to refactor in block.c :)..

Hm. Also, using blockdev-reopen probably means that we are in a blockdev word, 
so we should not care about inherits_from here.

But at least calling bdrv_refresh_limits(bs, tran, NULL) will not hurt. (or we 
can check an error code and honestly return it as well).


Also, you don't create reopen_state->replace_file_bs, like for backing.. On 
bdrv_reopen_comnmit replace_backing_bs is used to remove corresponding options.. 
Shouldn't we do the same with file options?

> +        } else {
> +            reopen_state->replace_backing_bs = true;
> +            reopen_state->old_backing_bs = child_bs(bs->backing);
> +            ret = bdrv_set_backing_noperm(bs, new_child_bs, tran, errp);
> +            if (ret < 0) {
> +                return ret;
> +            }
>           }
>       }
>   
> @@ -4291,7 +4315,7 @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
>    */
>   static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
>                                  BlockReopenQueue *queue,
> -                               Transaction *set_backings_tran, Error **errp)
> +                               Transaction *tran, Error **errp)
>   {
>       int ret = -1;
>       int old_flags;
> @@ -4411,12 +4435,19 @@ static int bdrv_reopen_prepare(BDRVReopenState 
> *reopen_state,
>        * either a reference to an existing node (using its node name)
>        * or NULL to simply detach the current backing file.
>        */
> -    ret = bdrv_reopen_parse_backing(reopen_state, set_backings_tran, errp);
> +    ret = bdrv_reopen_parse_file_or_backing(reopen_state, false, tran, errp);
>       if (ret < 0) {
>           goto error;
>       }
>       qdict_del(reopen_state->options, "backing");
>   
> +    /* Allow changing the 'file' option. In this case NULL is not allowed */
> +    ret = bdrv_reopen_parse_file_or_backing(reopen_state, true, tran, errp);
> +    if (ret < 0) {
> +        goto error;
> +    }
> +    qdict_del(reopen_state->options, "file");
> +
>       /* Options that are not handled are only okay if they are unchanged
>        * compared to the old state. It is expected that some options are only
>        * used for the initial open, but not reopen (e.g. filename) */
> diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
> index fc5297e268..a4d0b10e9d 100755
> --- a/tests/qemu-iotests/245
> +++ b/tests/qemu-iotests/245
> @@ -146,8 +146,8 @@ class TestBlockdevReopen(iotests.QMPTestCase):
>           self.reopen(opts, {'driver': 'raw'}, "Cannot change the option 
> 'driver'")
>           self.reopen(opts, {'driver': ''}, "Invalid parameter ''")
>           self.reopen(opts, {'driver': None}, "Invalid parameter type for 'driver', 
> expected: string")
> -        self.reopen(opts, {'file': 'not-found'}, "Cannot change the option 
> 'file'")
> -        self.reopen(opts, {'file': ''}, "Cannot change the option 'file'")
> +        self.reopen(opts, {'file': 'not-found'}, "Cannot find device='' nor 
> node-name='not-found'")

Interesting that error-message say about device='', not 'not-found'...

> +        self.reopen(opts, {'file': ''}, "Cannot find device='' nor 
> node-name=''")
>           self.reopen(opts, {'file': None}, "Invalid parameter type for 'file', 
> expected: BlockdevRef")
>           self.reopen(opts, {'file.node-name': 'newname'}, "Cannot change the option 
> 'node-name'")
>           self.reopen(opts, {'file.driver': 'host_device'}, "Cannot change the 
> option 'driver'")
> @@ -455,7 +455,8 @@ class TestBlockdevReopen(iotests.QMPTestCase):
>           # More illegal operations
>           self.reopen(opts[2], {'backing': 'hd1'},
>                       "Making 'hd1' a backing file of 'hd2' would create a 
> cycle")
> -        self.reopen(opts[2], {'file': 'hd0-file'}, "Cannot change the option 
> 'file'")
> +        self.reopen(opts[2], {'file': 'hd0-file'},
> +                    "Conflicts with use by hd2 as 'file', which does not allow 
> 'write, resize' on hd0-file")
>   
>           result = self.vm.qmp('blockdev-del', conv_keys = True, node_name = 'hd2')
>           self.assert_qmp(result, 'error/class', 'GenericError')
> @@ -969,7 +970,7 @@ class TestBlockdevReopen(iotests.QMPTestCase):
>   
>           # We can't remove hd1 while the commit job is ongoing
>           opts['backing'] = None
> -        self.reopen(opts, {}, "Cannot change backing link if 'hd0' has an implicit 
> backing file")
> +        self.reopen(opts, {}, "Cannot change backing link if 'hd0' has an implicit 
> child")
>   
>           # hd2 <- hd0
>           self.vm.run_job('commit0', auto_finalize = False, auto_dismiss = True)

--
Best regards,
Vladimir