tests/unit/test-bdrv-graph-mod.c

   1 /*
   2  * Block node graph modifications tests
   3  *
   4  * Copyright (c) 2019-2021 Virtuozzo International GmbH. All rights reserved.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "qemu/main-loop.h"
  24 #include "block/block_int.h"
  25 #include "sysemu/block-backend.h"
  26
  27 static BlockDriver bdrv_pass_through = {
  28     .format_name = "pass-through",
  29     .bdrv_child_perm = bdrv_default_perms,
  30 };
  31
  32 static void no_perm_default_perms(BlockDriverState *bs, BdrvChild *c,
  33                                          BdrvChildRole role,
  34                                          BlockReopenQueue *reopen_queue,
  35                                          uint64_t perm, uint64_t shared,
  36                                          uint64_t *nperm, uint64_t *nshared)
  37 {
  38     *nperm = 0;
  39     *nshared = BLK_PERM_ALL;
  40 }
  41
  42 static BlockDriver bdrv_no_perm = {
  43     .format_name = "no-perm",
  44     .bdrv_child_perm = no_perm_default_perms,
  45 };
  46
  47 static void exclusive_write_perms(BlockDriverState *bs, BdrvChild *c,
  48                                   BdrvChildRole role,
  49                                   BlockReopenQueue *reopen_queue,
  50                                   uint64_t perm, uint64_t shared,
  51                                   uint64_t *nperm, uint64_t *nshared)
  52 {
  53     *nperm = BLK_PERM_WRITE;
  54     *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
  55 }
  56
  57 static BlockDriver bdrv_exclusive_writer = {
  58     .format_name = "exclusive-writer",
  59     .bdrv_child_perm = exclusive_write_perms,
  60 };
  61
  62 static BlockDriverState *no_perm_node(const char *name)
  63 {
  64     return bdrv_new_open_driver(&bdrv_no_perm, name, BDRV_O_RDWR, &error_abort);
  65 }
  66
  67 static BlockDriverState *pass_through_node(const char *name)
  68 {
  69     return bdrv_new_open_driver(&bdrv_pass_through, name,
  70                                 BDRV_O_RDWR, &error_abort);
  71 }
  72
  73 static BlockDriverState *exclusive_writer_node(const char *name)
  74 {
  75     return bdrv_new_open_driver(&bdrv_exclusive_writer, name,
  76                                 BDRV_O_RDWR, &error_abort);
  77 }
  78
  79 /*
  80  * test_update_perm_tree
  81  *
  82  * When checking node for a possibility to update permissions, it's subtree
  83  * should be correctly checked too. New permissions for each node should be
  84  * calculated and checked in context of permissions of other nodes. If we
  85  * check new permissions of the node only in context of old permissions of
  86  * its neighbors, we can finish up with wrong permission graph.
  87  *
  88  * This test firstly create the following graph:
  89  *                                +--------+
  90  *                                |  root  |
  91  *                                +--------+
  92  *                                    |
  93  *                                    | perm: write, read
  94  *                                    | shared: except write
  95  *                                    v
  96  *  +-------------------+           +----------------+
  97  *  | passtrough filter |---------->|  null-co node  |
  98  *  +-------------------+           +----------------+
  99  *
 100  *
 101  * and then, tries to append filter under node. Expected behavior: fail.
 102  * Otherwise we'll get the following picture, with two BdrvChild'ren, having
 103  * write permission to one node, without actually sharing it.
 104  *
 105  *                     +--------+
 106  *                     |  root  |
 107  *                     +--------+
 108  *                         |
 109  *                         | perm: write, read
 110  *                         | shared: except write
 111  *                         v
 112  *                +-------------------+
 113  *                | passtrough filter |
 114  *                +-------------------+
 115  *                       |   |
 116  *     perm: write, read |   | perm: write, read
 117  *  shared: except write |   | shared: except write
 118  *                       v   v
 119  *                +----------------+
 120  *                |  null co node  |
 121  *                +----------------+
 122  */
 123 static void test_update_perm_tree(void)
 124 {
 125     int ret;
 126
 127     BlockBackend *root = blk_new(qemu_get_aio_context(),
 128                                  BLK_PERM_WRITE | BLK_PERM_CONSISTENT_READ,
 129                                  BLK_PERM_ALL & ~BLK_PERM_WRITE);
 130     BlockDriverState *bs = no_perm_node("node");
 131     BlockDriverState *filter = pass_through_node("filter");
 132
 133     blk_insert_bs(root, bs, &error_abort);
 134
 135     bdrv_attach_child(filter, bs, "child", &child_of_bds,
 136                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY, &error_abort);
 137
 138     ret = bdrv_append(filter, bs, NULL);
 139     g_assert_cmpint(ret, <, 0);
 140
 141     blk_unref(root);
 142 }
 143
 144 /*
 145  * test_should_update_child
 146  *
 147  * Test that bdrv_replace_node, and concretely should_update_child
 148  * do the right thing, i.e. not creating loops on the graph.
 149  *
 150  * The test does the following:
 151  * 1. initial graph:
 152  *
 153  *   +------+          +--------+
 154  *   | root |          | filter |
 155  *   +------+          +--------+
 156  *      |                  |
 157  *  root|            target|
 158  *      v                  v
 159  *   +------+          +--------+
 160  *   | node |<---------| target |
 161  *   +------+  backing +--------+
 162  *
 163  * 2. Append @filter above @node. If should_update_child works correctly,
 164  * it understands, that backing child of @target should not be updated,
 165  * as it will create a loop on node graph. Resulting picture should
 166  * be the left one, not the right:
 167  *
 168  *     +------+                            +------+
 169  *     | root |                            | root |
 170  *     +------+                            +------+
 171  *        |                                   |
 172  *    root|                               root|
 173  *        v                                   v
 174  *    +--------+   target                 +--------+   target
 175  *    | filter |--------------+           | filter |--------------+
 176  *    +--------+              |           +--------+              |
 177  *        |                   |               |  ^                v
 178  * backing|                   |        backing|  |           +--------+
 179  *        v                   v               |  +-----------| target |
 180  *     +------+          +--------+           v      backing +--------+
 181  *     | node |<---------| target |        +------+
 182  *     +------+  backing +--------+        | node |
 183  *                                         +------+
 184  *
 185  *    (good picture)                       (bad picture)
 186  *
 187  */
 188 static void test_should_update_child(void)
 189 {
 190     BlockBackend *root = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
 191     BlockDriverState *bs = no_perm_node("node");
 192     BlockDriverState *filter = no_perm_node("filter");
 193     BlockDriverState *target = no_perm_node("target");
 194
 195     blk_insert_bs(root, bs, &error_abort);
 196
 197     bdrv_set_backing_hd(target, bs, &error_abort);
 198
 199     g_assert(target->backing->bs == bs);
 200     bdrv_attach_child(filter, target, "target", &child_of_bds,
 201                       BDRV_CHILD_DATA, &error_abort);
 202     bdrv_append(filter, bs, &error_abort);
 203     g_assert(target->backing->bs == bs);
 204
 205     bdrv_unref(bs);
 206     blk_unref(root);
 207 }
 208
 209 /*
 210  * test_parallel_exclusive_write
 211  *
 212  * Check that when we replace node, old permissions of the node being removed
 213  * doesn't break the replacement.
 214  */
 215 static void test_parallel_exclusive_write(void)
 216 {
 217     BlockDriverState *top = exclusive_writer_node("top");
 218     BlockDriverState *base = no_perm_node("base");
 219     BlockDriverState *fl1 = pass_through_node("fl1");
 220     BlockDriverState *fl2 = pass_through_node("fl2");
 221
 222     /*
 223      * bdrv_attach_child() eats child bs reference, so we need two @base
 224      * references for two filters:
 225      */
 226     bdrv_ref(base);
 227
 228     bdrv_attach_child(top, fl1, "backing", &child_of_bds, BDRV_CHILD_DATA,
 229                       &error_abort);
 230     bdrv_attach_child(fl1, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
 231                       &error_abort);
 232     bdrv_attach_child(fl2, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
 233                       &error_abort);
 234
 235     bdrv_replace_node(fl1, fl2, &error_abort);
 236
 237     bdrv_unref(fl2);
 238     bdrv_unref(top);
 239 }
 240
 241 static void write_to_file_perms(BlockDriverState *bs, BdrvChild *c,
 242                                      BdrvChildRole role,
 243                                      BlockReopenQueue *reopen_queue,
 244                                      uint64_t perm, uint64_t shared,
 245                                      uint64_t *nperm, uint64_t *nshared)
 246 {
 247     if (bs->file && c == bs->file) {
 248         *nperm = BLK_PERM_WRITE;
 249         *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
 250     } else {
 251         *nperm = 0;
 252         *nshared = BLK_PERM_ALL;
 253     }
 254 }
 255
 256 static BlockDriver bdrv_write_to_file = {
 257     .format_name = "tricky-perm",
 258     .bdrv_child_perm = write_to_file_perms,
 259 };
 260
 261
 262 /*
 263  * The following test shows that topological-sort order is required for
 264  * permission update, simple DFS is not enough.
 265  *
 266  * Consider the block driver which has two filter children: one active
 267  * with exclusive write access and one inactive with no specific
 268  * permissions.
 269  *
 270  * And, these two children has a common base child, like this:
 271  *
 272  * ┌─────┐     ┌──────┐
 273  * │ fl2 │ ◀── │ top  │
 274  * └─────┘     └──────┘
 275  *   │           │
 276  *   │           │ w
 277  *   │           ▼
 278  *   │         ┌──────┐
 279  *   │         │ fl1  │
 280  *   │         └──────┘
 281  *   │           │
 282  *   │           │ w
 283  *   │           ▼
 284  *   │         ┌──────┐
 285  *   └───────▶ │ base │
 286  *             └──────┘
 287  *
 288  * So, exclusive write is propagated.
 289  *
 290  * Assume, we want to make fl2 active instead of fl1.
 291  * So, we set some option for top driver and do permission update.
 292  *
 293  * With simple DFS, if permission update goes first through
 294  * top->fl1->base branch it will succeed: it firstly drop exclusive write
 295  * permissions and than apply them for another BdrvChildren.
 296  * But if permission update goes first through top->fl2->base branch it
 297  * will fail, as when we try to update fl2->base child, old not yet
 298  * updated fl1->base child will be in conflict.
 299  *
 300  * With topological-sort order we always update parents before children, so fl1
 301  * and fl2 are both updated when we update base and there is no conflict.
 302  */
 303 static void test_parallel_perm_update(void)
 304 {
 305     BlockDriverState *top = no_perm_node("top");
 306     BlockDriverState *tricky =
 307             bdrv_new_open_driver(&bdrv_write_to_file, "tricky", BDRV_O_RDWR,
 308                                  &error_abort);
 309     BlockDriverState *base = no_perm_node("base");
 310     BlockDriverState *fl1 = pass_through_node("fl1");
 311     BlockDriverState *fl2 = pass_through_node("fl2");
 312     BdrvChild *c_fl1, *c_fl2;
 313
 314     /*
 315      * bdrv_attach_child() eats child bs reference, so we need two @base
 316      * references for two filters:
 317      */
 318     bdrv_ref(base);
 319
 320     bdrv_attach_child(top, tricky, "file", &child_of_bds, BDRV_CHILD_DATA,
 321                       &error_abort);
 322     c_fl1 = bdrv_attach_child(tricky, fl1, "first", &child_of_bds,
 323                               BDRV_CHILD_FILTERED, &error_abort);
 324     c_fl2 = bdrv_attach_child(tricky, fl2, "second", &child_of_bds,
 325                               BDRV_CHILD_FILTERED, &error_abort);
 326     bdrv_attach_child(fl1, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
 327                       &error_abort);
 328     bdrv_attach_child(fl2, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
 329                       &error_abort);
 330
 331     /* Select fl1 as first child to be active */
 332     tricky->file = c_fl1;
 333     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 334
 335     assert(c_fl1->perm & BLK_PERM_WRITE);
 336     assert(!(c_fl2->perm & BLK_PERM_WRITE));
 337
 338     /* Now, try to switch active child and update permissions */
 339     tricky->file = c_fl2;
 340     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 341
 342     assert(c_fl2->perm & BLK_PERM_WRITE);
 343     assert(!(c_fl1->perm & BLK_PERM_WRITE));
 344
 345     /* Switch once more, to not care about real child order in the list */
 346     tricky->file = c_fl1;
 347     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 348
 349     assert(c_fl1->perm & BLK_PERM_WRITE);
 350     assert(!(c_fl2->perm & BLK_PERM_WRITE));
 351
 352     bdrv_unref(top);
 353 }
 354
 355 /*
 356  * It's possible that filter required permissions allows to insert it to backing
 357  * chain, like:
 358  *
 359  *  1.  [top] -> [filter] -> [base]
 360  *
 361  * but doesn't allow to add it as a branch:
 362  *
 363  *  2.  [filter] --\
 364  *                 v
 365  *      [top] -> [base]
 366  *
 367  * So, inserting such filter should do all graph modifications and only then
 368  * update permissions. If we try to go through intermediate state [2] and update
 369  * permissions on it we'll fail.
 370  *
 371  * Let's check that bdrv_append() can append such a filter.
 372  */
 373 static void test_append_greedy_filter(void)
 374 {
 375     BlockDriverState *top = exclusive_writer_node("top");
 376     BlockDriverState *base = no_perm_node("base");
 377     BlockDriverState *fl = exclusive_writer_node("fl1");
 378
 379     bdrv_attach_child(top, base, "backing", &child_of_bds, BDRV_CHILD_COW,
 380                       &error_abort);
 381
 382     bdrv_append(fl, base, &error_abort);
 383     bdrv_unref(top);
 384 }
 385
 386 int main(int argc, char *argv[])
 387 {
 388     int i;
 389     bool debug = false;
 390
 391     for (i = 1; i < argc; i++) {
 392         if (!strcmp(argv[i], "-d")) {
 393             debug = true;
 394             break;
 395         }
 396     }
 397
 398     bdrv_init();
 399     qemu_init_main_loop(&error_abort);
 400
 401     g_test_init(&argc, &argv, NULL);
 402
 403     g_test_add_func("/bdrv-graph-mod/update-perm-tree", test_update_perm_tree);
 404     g_test_add_func("/bdrv-graph-mod/should-update-child",
 405                     test_should_update_child);
 406
 407     if (debug) {
 408         g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
 409                         test_parallel_exclusive_write);
 410         g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
 411                         test_parallel_perm_update);
 412         g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
 413                         test_append_greedy_filter);
 414     }
 415
 416     return g_test_run();
 417 }