tests/unit/test-bdrv-graph-mod.c

   1 /*
   2  * Block node graph modifications tests
   3  *
   4  * Copyright (c) 2019-2021 Virtuozzo International GmbH. All rights reserved.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "qemu/main-loop.h"
  24 #include "block/block_int.h"
  25 #include "sysemu/block-backend.h"
  26
  27 static BlockDriver bdrv_pass_through = {
  28     .format_name = "pass-through",
  29     .is_filter = true,
  30     .filtered_child_is_backing = true,
  31     .bdrv_child_perm = bdrv_default_perms,
  32 };
  33
  34 static void no_perm_default_perms(BlockDriverState *bs, BdrvChild *c,
  35                                          BdrvChildRole role,
  36                                          BlockReopenQueue *reopen_queue,
  37                                          uint64_t perm, uint64_t shared,
  38                                          uint64_t *nperm, uint64_t *nshared)
  39 {
  40     *nperm = 0;
  41     *nshared = BLK_PERM_ALL;
  42 }
  43
  44 static BlockDriver bdrv_no_perm = {
  45     .format_name = "no-perm",
  46     .supports_backing = true,
  47     .bdrv_child_perm = no_perm_default_perms,
  48 };
  49
  50 static void exclusive_write_perms(BlockDriverState *bs, BdrvChild *c,
  51                                   BdrvChildRole role,
  52                                   BlockReopenQueue *reopen_queue,
  53                                   uint64_t perm, uint64_t shared,
  54                                   uint64_t *nperm, uint64_t *nshared)
  55 {
  56     *nperm = BLK_PERM_WRITE;
  57     *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
  58 }
  59
  60 static BlockDriver bdrv_exclusive_writer = {
  61     .format_name = "exclusive-writer",
  62     .is_filter = true,
  63     .filtered_child_is_backing = true,
  64     .bdrv_child_perm = exclusive_write_perms,
  65 };
  66
  67 static BlockDriverState *no_perm_node(const char *name)
  68 {
  69     return bdrv_new_open_driver(&bdrv_no_perm, name, BDRV_O_RDWR, &error_abort);
  70 }
  71
  72 static BlockDriverState *pass_through_node(const char *name)
  73 {
  74     return bdrv_new_open_driver(&bdrv_pass_through, name,
  75                                 BDRV_O_RDWR, &error_abort);
  76 }
  77
  78 static BlockDriverState *exclusive_writer_node(const char *name)
  79 {
  80     return bdrv_new_open_driver(&bdrv_exclusive_writer, name,
  81                                 BDRV_O_RDWR, &error_abort);
  82 }
  83
  84 /*
  85  * test_update_perm_tree
  86  *
  87  * When checking node for a possibility to update permissions, it's subtree
  88  * should be correctly checked too. New permissions for each node should be
  89  * calculated and checked in context of permissions of other nodes. If we
  90  * check new permissions of the node only in context of old permissions of
  91  * its neighbors, we can finish up with wrong permission graph.
  92  *
  93  * This test firstly create the following graph:
  94  *                                +--------+
  95  *                                |  root  |
  96  *                                +--------+
  97  *                                    |
  98  *                                    | perm: write, read
  99  *                                    | shared: except write
 100  *                                    v
 101  *  +--------------------+          +----------------+
 102  *  | passthrough filter |--------->|  null-co node  |
 103  *  +--------------------+          +----------------+
 104  *
 105  *
 106  * and then, tries to append filter under node. Expected behavior: fail.
 107  * Otherwise we'll get the following picture, with two BdrvChild'ren, having
 108  * write permission to one node, without actually sharing it.
 109  *
 110  *                     +--------+
 111  *                     |  root  |
 112  *                     +--------+
 113  *                         |
 114  *                         | perm: write, read
 115  *                         | shared: except write
 116  *                         v
 117  *                +--------------------+
 118  *                | passthrough filter |
 119  *                +--------------------+
 120  *                       |   |
 121  *     perm: write, read |   | perm: write, read
 122  *  shared: except write |   | shared: except write
 123  *                       v   v
 124  *                +----------------+
 125  *                |  null co node  |
 126  *                +----------------+
 127  */
 128 static void test_update_perm_tree(void)
 129 {
 130     int ret;
 131
 132     BlockBackend *root = blk_new(qemu_get_aio_context(),
 133                                  BLK_PERM_WRITE | BLK_PERM_CONSISTENT_READ,
 134                                  BLK_PERM_ALL & ~BLK_PERM_WRITE);
 135     BlockDriverState *bs = no_perm_node("node");
 136     BlockDriverState *filter = pass_through_node("filter");
 137
 138     blk_insert_bs(root, bs, &error_abort);
 139
 140     bdrv_attach_child(filter, bs, "child", &child_of_bds,
 141                       BDRV_CHILD_DATA, &error_abort);
 142
 143     aio_context_acquire(qemu_get_aio_context());
 144     ret = bdrv_append(filter, bs, NULL);
 145     g_assert_cmpint(ret, <, 0);
 146     aio_context_release(qemu_get_aio_context());
 147
 148     bdrv_unref(filter);
 149     blk_unref(root);
 150 }
 151
 152 /*
 153  * test_should_update_child
 154  *
 155  * Test that bdrv_replace_node, and concretely should_update_child
 156  * do the right thing, i.e. not creating loops on the graph.
 157  *
 158  * The test does the following:
 159  * 1. initial graph:
 160  *
 161  *   +------+          +--------+
 162  *   | root |          | filter |
 163  *   +------+          +--------+
 164  *      |                  |
 165  *  root|            target|
 166  *      v                  v
 167  *   +------+          +--------+
 168  *   | node |<---------| target |
 169  *   +------+  backing +--------+
 170  *
 171  * 2. Append @filter above @node. If should_update_child works correctly,
 172  * it understands, that backing child of @target should not be updated,
 173  * as it will create a loop on node graph. Resulting picture should
 174  * be the left one, not the right:
 175  *
 176  *     +------+                            +------+
 177  *     | root |                            | root |
 178  *     +------+                            +------+
 179  *        |                                   |
 180  *    root|                               root|
 181  *        v                                   v
 182  *    +--------+   target                 +--------+   target
 183  *    | filter |--------------+           | filter |--------------+
 184  *    +--------+              |           +--------+              |
 185  *        |                   |               |  ^                v
 186  * backing|                   |        backing|  |           +--------+
 187  *        v                   v               |  +-----------| target |
 188  *     +------+          +--------+           v      backing +--------+
 189  *     | node |<---------| target |        +------+
 190  *     +------+  backing +--------+        | node |
 191  *                                         +------+
 192  *
 193  *    (good picture)                       (bad picture)
 194  *
 195  */
 196 static void test_should_update_child(void)
 197 {
 198     BlockBackend *root = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
 199     BlockDriverState *bs = no_perm_node("node");
 200     BlockDriverState *filter = no_perm_node("filter");
 201     BlockDriverState *target = no_perm_node("target");
 202
 203     blk_insert_bs(root, bs, &error_abort);
 204
 205     bdrv_set_backing_hd(target, bs, &error_abort);
 206
 207     g_assert(target->backing->bs == bs);
 208     bdrv_attach_child(filter, target, "target", &child_of_bds,
 209                       BDRV_CHILD_DATA, &error_abort);
 210     aio_context_acquire(qemu_get_aio_context());
 211     bdrv_append(filter, bs, &error_abort);
 212     aio_context_release(qemu_get_aio_context());
 213     g_assert(target->backing->bs == bs);
 214
 215     bdrv_unref(filter);
 216     bdrv_unref(bs);
 217     blk_unref(root);
 218 }
 219
 220 /*
 221  * test_parallel_exclusive_write
 222  *
 223  * Check that when we replace node, old permissions of the node being removed
 224  * doesn't break the replacement.
 225  */
 226 static void test_parallel_exclusive_write(void)
 227 {
 228     BlockDriverState *top = exclusive_writer_node("top");
 229     BlockDriverState *base = no_perm_node("base");
 230     BlockDriverState *fl1 = pass_through_node("fl1");
 231     BlockDriverState *fl2 = pass_through_node("fl2");
 232
 233     /*
 234      * bdrv_attach_child() eats child bs reference, so we need two @base
 235      * references for two filters:
 236      */
 237     bdrv_ref(base);
 238
 239     bdrv_attach_child(top, fl1, "backing", &child_of_bds,
 240                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 241                       &error_abort);
 242     bdrv_attach_child(fl1, base, "backing", &child_of_bds,
 243                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 244                       &error_abort);
 245     bdrv_attach_child(fl2, base, "backing", &child_of_bds,
 246                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 247                       &error_abort);
 248
 249     bdrv_replace_node(fl1, fl2, &error_abort);
 250
 251     bdrv_unref(fl2);
 252     bdrv_unref(top);
 253 }
 254
 255 /*
 256  * write-to-selected node may have several DATA children, one of them may be
 257  * "selected". Exclusive write permission is taken on selected child.
 258  *
 259  * We don't realize write handler itself, as we need only to test how permission
 260  * update works.
 261  */
 262 typedef struct BDRVWriteToSelectedState {
 263     BdrvChild *selected;
 264 } BDRVWriteToSelectedState;
 265
 266 static void write_to_selected_perms(BlockDriverState *bs, BdrvChild *c,
 267                                     BdrvChildRole role,
 268                                     BlockReopenQueue *reopen_queue,
 269                                     uint64_t perm, uint64_t shared,
 270                                     uint64_t *nperm, uint64_t *nshared)
 271 {
 272     BDRVWriteToSelectedState *s = bs->opaque;
 273
 274     if (s->selected && c == s->selected) {
 275         *nperm = BLK_PERM_WRITE;
 276         *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
 277     } else {
 278         *nperm = 0;
 279         *nshared = BLK_PERM_ALL;
 280     }
 281 }
 282
 283 static BlockDriver bdrv_write_to_selected = {
 284     .format_name = "write-to-selected",
 285     .instance_size = sizeof(BDRVWriteToSelectedState),
 286     .bdrv_child_perm = write_to_selected_perms,
 287 };
 288
 289
 290 /*
 291  * The following test shows that topological-sort order is required for
 292  * permission update, simple DFS is not enough.
 293  *
 294  * Consider the block driver (write-to-selected) which has two children: one is
 295  * selected so we have exclusive write access to it and for the other one we
 296  * don't need any specific permissions.
 297  *
 298  * And, these two children has a common base child, like this:
 299  *   (additional "top" on top is used in test just because the only public
 300  *    function to update permission should get a specific child to update.
 301  *    Making bdrv_refresh_perms() public just for this test isn't worth it)
 302  *
 303  * ┌─────┐     ┌───────────────────┐     ┌─────┐
 304  * │ fl2 │ ◀── │ write-to-selected │ ◀── │ top │
 305  * └─────┘     └───────────────────┘     └─────┘
 306  *   │           │
 307  *   │           │ w
 308  *   │           ▼
 309  *   │         ┌──────┐
 310  *   │         │ fl1  │
 311  *   │         └──────┘
 312  *   │           │
 313  *   │           │ w
 314  *   │           ▼
 315  *   │         ┌──────┐
 316  *   └───────▶ │ base │
 317  *             └──────┘
 318  *
 319  * So, exclusive write is propagated.
 320  *
 321  * Assume, we want to select fl2 instead of fl1.
 322  * So, we set some option for write-to-selected driver and do permission update.
 323  *
 324  * With simple DFS, if permission update goes first through
 325  * write-to-selected -> fl1 -> base branch it will succeed: it firstly drop
 326  * exclusive write permissions and than apply them for another BdrvChildren.
 327  * But if permission update goes first through write-to-selected -> fl2 -> base
 328  * branch it will fail, as when we try to update fl2->base child, old not yet
 329  * updated fl1->base child will be in conflict.
 330  *
 331  * With topological-sort order we always update parents before children, so fl1
 332  * and fl2 are both updated when we update base and there is no conflict.
 333  */
 334 static void test_parallel_perm_update(void)
 335 {
 336     BlockDriverState *top = no_perm_node("top");
 337     BlockDriverState *ws =
 338             bdrv_new_open_driver(&bdrv_write_to_selected, "ws", BDRV_O_RDWR,
 339                                  &error_abort);
 340     BDRVWriteToSelectedState *s = ws->opaque;
 341     BlockDriverState *base = no_perm_node("base");
 342     BlockDriverState *fl1 = pass_through_node("fl1");
 343     BlockDriverState *fl2 = pass_through_node("fl2");
 344     BdrvChild *c_fl1, *c_fl2;
 345
 346     /*
 347      * bdrv_attach_child() eats child bs reference, so we need two @base
 348      * references for two filters:
 349      */
 350     bdrv_ref(base);
 351
 352     bdrv_attach_child(top, ws, "file", &child_of_bds, BDRV_CHILD_DATA,
 353                       &error_abort);
 354     c_fl1 = bdrv_attach_child(ws, fl1, "first", &child_of_bds,
 355                               BDRV_CHILD_DATA, &error_abort);
 356     c_fl2 = bdrv_attach_child(ws, fl2, "second", &child_of_bds,
 357                               BDRV_CHILD_DATA, &error_abort);
 358     bdrv_attach_child(fl1, base, "backing", &child_of_bds,
 359                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 360                       &error_abort);
 361     bdrv_attach_child(fl2, base, "backing", &child_of_bds,
 362                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 363                       &error_abort);
 364
 365     /* Select fl1 as first child to be active */
 366     s->selected = c_fl1;
 367     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 368
 369     assert(c_fl1->perm & BLK_PERM_WRITE);
 370     assert(!(c_fl2->perm & BLK_PERM_WRITE));
 371
 372     /* Now, try to switch active child and update permissions */
 373     s->selected = c_fl2;
 374     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 375
 376     assert(c_fl2->perm & BLK_PERM_WRITE);
 377     assert(!(c_fl1->perm & BLK_PERM_WRITE));
 378
 379     /* Switch once more, to not care about real child order in the list */
 380     s->selected = c_fl1;
 381     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 382
 383     assert(c_fl1->perm & BLK_PERM_WRITE);
 384     assert(!(c_fl2->perm & BLK_PERM_WRITE));
 385
 386     bdrv_unref(top);
 387 }
 388
 389 /*
 390  * It's possible that filter required permissions allows to insert it to backing
 391  * chain, like:
 392  *
 393  *  1.  [top] -> [filter] -> [base]
 394  *
 395  * but doesn't allow to add it as a branch:
 396  *
 397  *  2.  [filter] --\
 398  *                 v
 399  *      [top] -> [base]
 400  *
 401  * So, inserting such filter should do all graph modifications and only then
 402  * update permissions. If we try to go through intermediate state [2] and update
 403  * permissions on it we'll fail.
 404  *
 405  * Let's check that bdrv_append() can append such a filter.
 406  */
 407 static void test_append_greedy_filter(void)
 408 {
 409     BlockDriverState *top = exclusive_writer_node("top");
 410     BlockDriverState *base = no_perm_node("base");
 411     BlockDriverState *fl = exclusive_writer_node("fl1");
 412
 413     bdrv_attach_child(top, base, "backing", &child_of_bds,
 414                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 415                       &error_abort);
 416
 417     aio_context_acquire(qemu_get_aio_context());
 418     bdrv_append(fl, base, &error_abort);
 419     aio_context_release(qemu_get_aio_context());
 420     bdrv_unref(fl);
 421     bdrv_unref(top);
 422 }
 423
 424 int main(int argc, char *argv[])
 425 {
 426     bdrv_init();
 427     qemu_init_main_loop(&error_abort);
 428
 429     g_test_init(&argc, &argv, NULL);
 430
 431     g_test_add_func("/bdrv-graph-mod/update-perm-tree", test_update_perm_tree);
 432     g_test_add_func("/bdrv-graph-mod/should-update-child",
 433                     test_should_update_child);
 434     g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
 435                     test_parallel_perm_update);
 436     g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
 437                     test_parallel_exclusive_write);
 438     g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
 439                     test_append_greedy_filter);
 440
 441     return g_test_run();
 442 }