tests/unit/test-bdrv-graph-mod.c

   1 /*
   2  * Block node graph modifications tests
   3  *
   4  * Copyright (c) 2019-2021 Virtuozzo International GmbH. All rights reserved.
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "qapi/error.h"
  23 #include "qemu/main-loop.h"
  24 #include "block/block_int.h"
  25 #include "sysemu/block-backend.h"
  26
  27 static BlockDriver bdrv_pass_through = {
  28     .format_name = "pass-through",
  29     .is_filter = true,
  30     .filtered_child_is_backing = true,
  31     .bdrv_child_perm = bdrv_default_perms,
  32 };
  33
  34 static void no_perm_default_perms(BlockDriverState *bs, BdrvChild *c,
  35                                          BdrvChildRole role,
  36                                          BlockReopenQueue *reopen_queue,
  37                                          uint64_t perm, uint64_t shared,
  38                                          uint64_t *nperm, uint64_t *nshared)
  39 {
  40     *nperm = 0;
  41     *nshared = BLK_PERM_ALL;
  42 }
  43
  44 static BlockDriver bdrv_no_perm = {
  45     .format_name = "no-perm",
  46     .supports_backing = true,
  47     .bdrv_child_perm = no_perm_default_perms,
  48 };
  49
  50 static void exclusive_write_perms(BlockDriverState *bs, BdrvChild *c,
  51                                   BdrvChildRole role,
  52                                   BlockReopenQueue *reopen_queue,
  53                                   uint64_t perm, uint64_t shared,
  54                                   uint64_t *nperm, uint64_t *nshared)
  55 {
  56     *nperm = BLK_PERM_WRITE;
  57     *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
  58 }
  59
  60 static BlockDriver bdrv_exclusive_writer = {
  61     .format_name = "exclusive-writer",
  62     .is_filter = true,
  63     .filtered_child_is_backing = true,
  64     .bdrv_child_perm = exclusive_write_perms,
  65 };
  66
  67 static BlockDriverState *no_perm_node(const char *name)
  68 {
  69     return bdrv_new_open_driver(&bdrv_no_perm, name, BDRV_O_RDWR, &error_abort);
  70 }
  71
  72 static BlockDriverState *pass_through_node(const char *name)
  73 {
  74     return bdrv_new_open_driver(&bdrv_pass_through, name,
  75                                 BDRV_O_RDWR, &error_abort);
  76 }
  77
  78 static BlockDriverState *exclusive_writer_node(const char *name)
  79 {
  80     return bdrv_new_open_driver(&bdrv_exclusive_writer, name,
  81                                 BDRV_O_RDWR, &error_abort);
  82 }
  83
  84 /*
  85  * test_update_perm_tree
  86  *
  87  * When checking node for a possibility to update permissions, it's subtree
  88  * should be correctly checked too. New permissions for each node should be
  89  * calculated and checked in context of permissions of other nodes. If we
  90  * check new permissions of the node only in context of old permissions of
  91  * its neighbors, we can finish up with wrong permission graph.
  92  *
  93  * This test firstly create the following graph:
  94  *                                +--------+
  95  *                                |  root  |
  96  *                                +--------+
  97  *                                    |
  98  *                                    | perm: write, read
  99  *                                    | shared: except write
 100  *                                    v
 101  *  +--------------------+          +----------------+
 102  *  | passthrough filter |--------->|  null-co node  |
 103  *  +--------------------+          +----------------+
 104  *
 105  *
 106  * and then, tries to append filter under node. Expected behavior: fail.
 107  * Otherwise we'll get the following picture, with two BdrvChild'ren, having
 108  * write permission to one node, without actually sharing it.
 109  *
 110  *                     +--------+
 111  *                     |  root  |
 112  *                     +--------+
 113  *                         |
 114  *                         | perm: write, read
 115  *                         | shared: except write
 116  *                         v
 117  *                +--------------------+
 118  *                | passthrough filter |
 119  *                +--------------------+
 120  *                       |   |
 121  *     perm: write, read |   | perm: write, read
 122  *  shared: except write |   | shared: except write
 123  *                       v   v
 124  *                +----------------+
 125  *                |  null co node  |
 126  *                +----------------+
 127  */
 128 static void test_update_perm_tree(void)
 129 {
 130     int ret;
 131
 132     BlockBackend *root = blk_new(qemu_get_aio_context(),
 133                                  BLK_PERM_WRITE | BLK_PERM_CONSISTENT_READ,
 134                                  BLK_PERM_ALL & ~BLK_PERM_WRITE);
 135     BlockDriverState *bs = no_perm_node("node");
 136     BlockDriverState *filter = pass_through_node("filter");
 137
 138     blk_insert_bs(root, bs, &error_abort);
 139
 140     bdrv_graph_wrlock(NULL);
 141     bdrv_attach_child(filter, bs, "child", &child_of_bds,
 142                       BDRV_CHILD_DATA, &error_abort);
 143     bdrv_graph_wrunlock();
 144
 145     aio_context_acquire(qemu_get_aio_context());
 146     ret = bdrv_append(filter, bs, NULL);
 147     g_assert_cmpint(ret, <, 0);
 148     aio_context_release(qemu_get_aio_context());
 149
 150     bdrv_unref(filter);
 151     blk_unref(root);
 152 }
 153
 154 /*
 155  * test_should_update_child
 156  *
 157  * Test that bdrv_replace_node, and concretely should_update_child
 158  * do the right thing, i.e. not creating loops on the graph.
 159  *
 160  * The test does the following:
 161  * 1. initial graph:
 162  *
 163  *   +------+          +--------+
 164  *   | root |          | filter |
 165  *   +------+          +--------+
 166  *      |                  |
 167  *  root|            target|
 168  *      v                  v
 169  *   +------+          +--------+
 170  *   | node |<---------| target |
 171  *   +------+  backing +--------+
 172  *
 173  * 2. Append @filter above @node. If should_update_child works correctly,
 174  * it understands, that backing child of @target should not be updated,
 175  * as it will create a loop on node graph. Resulting picture should
 176  * be the left one, not the right:
 177  *
 178  *     +------+                            +------+
 179  *     | root |                            | root |
 180  *     +------+                            +------+
 181  *        |                                   |
 182  *    root|                               root|
 183  *        v                                   v
 184  *    +--------+   target                 +--------+   target
 185  *    | filter |--------------+           | filter |--------------+
 186  *    +--------+              |           +--------+              |
 187  *        |                   |               |  ^                v
 188  * backing|                   |        backing|  |           +--------+
 189  *        v                   v               |  +-----------| target |
 190  *     +------+          +--------+           v      backing +--------+
 191  *     | node |<---------| target |        +------+
 192  *     +------+  backing +--------+        | node |
 193  *                                         +------+
 194  *
 195  *    (good picture)                       (bad picture)
 196  *
 197  */
 198 static void test_should_update_child(void)
 199 {
 200     BlockBackend *root = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
 201     BlockDriverState *bs = no_perm_node("node");
 202     BlockDriverState *filter = no_perm_node("filter");
 203     BlockDriverState *target = no_perm_node("target");
 204
 205     blk_insert_bs(root, bs, &error_abort);
 206
 207     bdrv_set_backing_hd(target, bs, &error_abort);
 208
 209     g_assert(target->backing->bs == bs);
 210     bdrv_graph_wrlock(NULL);
 211     bdrv_attach_child(filter, target, "target", &child_of_bds,
 212                       BDRV_CHILD_DATA, &error_abort);
 213     bdrv_graph_wrunlock();
 214     aio_context_acquire(qemu_get_aio_context());
 215     bdrv_append(filter, bs, &error_abort);
 216     aio_context_release(qemu_get_aio_context());
 217     g_assert(target->backing->bs == bs);
 218
 219     bdrv_unref(filter);
 220     bdrv_unref(bs);
 221     blk_unref(root);
 222 }
 223
 224 /*
 225  * test_parallel_exclusive_write
 226  *
 227  * Check that when we replace node, old permissions of the node being removed
 228  * doesn't break the replacement.
 229  */
 230 static void test_parallel_exclusive_write(void)
 231 {
 232     BlockDriverState *top = exclusive_writer_node("top");
 233     BlockDriverState *base = no_perm_node("base");
 234     BlockDriverState *fl1 = pass_through_node("fl1");
 235     BlockDriverState *fl2 = pass_through_node("fl2");
 236
 237     /*
 238      * bdrv_attach_child() eats child bs reference, so we need two @base
 239      * references for two filters:
 240      */
 241     bdrv_ref(base);
 242
 243     bdrv_graph_wrlock(NULL);
 244     bdrv_attach_child(top, fl1, "backing", &child_of_bds,
 245                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 246                       &error_abort);
 247     bdrv_attach_child(fl1, base, "backing", &child_of_bds,
 248                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 249                       &error_abort);
 250     bdrv_attach_child(fl2, base, "backing", &child_of_bds,
 251                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 252                       &error_abort);
 253     bdrv_graph_wrunlock();
 254
 255     bdrv_replace_node(fl1, fl2, &error_abort);
 256
 257     bdrv_unref(fl2);
 258     bdrv_unref(top);
 259 }
 260
 261 /*
 262  * write-to-selected node may have several DATA children, one of them may be
 263  * "selected". Exclusive write permission is taken on selected child.
 264  *
 265  * We don't realize write handler itself, as we need only to test how permission
 266  * update works.
 267  */
 268 typedef struct BDRVWriteToSelectedState {
 269     BdrvChild *selected;
 270 } BDRVWriteToSelectedState;
 271
 272 static void write_to_selected_perms(BlockDriverState *bs, BdrvChild *c,
 273                                     BdrvChildRole role,
 274                                     BlockReopenQueue *reopen_queue,
 275                                     uint64_t perm, uint64_t shared,
 276                                     uint64_t *nperm, uint64_t *nshared)
 277 {
 278     BDRVWriteToSelectedState *s = bs->opaque;
 279
 280     if (s->selected && c == s->selected) {
 281         *nperm = BLK_PERM_WRITE;
 282         *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
 283     } else {
 284         *nperm = 0;
 285         *nshared = BLK_PERM_ALL;
 286     }
 287 }
 288
 289 static BlockDriver bdrv_write_to_selected = {
 290     .format_name = "write-to-selected",
 291     .instance_size = sizeof(BDRVWriteToSelectedState),
 292     .bdrv_child_perm = write_to_selected_perms,
 293 };
 294
 295
 296 /*
 297  * The following test shows that topological-sort order is required for
 298  * permission update, simple DFS is not enough.
 299  *
 300  * Consider the block driver (write-to-selected) which has two children: one is
 301  * selected so we have exclusive write access to it and for the other one we
 302  * don't need any specific permissions.
 303  *
 304  * And, these two children has a common base child, like this:
 305  *   (additional "top" on top is used in test just because the only public
 306  *    function to update permission should get a specific child to update.
 307  *    Making bdrv_refresh_perms() public just for this test isn't worth it)
 308  *
 309  * ┌─────┐     ┌───────────────────┐     ┌─────┐
 310  * │ fl2 │ ◀── │ write-to-selected │ ◀── │ top │
 311  * └─────┘     └───────────────────┘     └─────┘
 312  *   │           │
 313  *   │           │ w
 314  *   │           ▼
 315  *   │         ┌──────┐
 316  *   │         │ fl1  │
 317  *   │         └──────┘
 318  *   │           │
 319  *   │           │ w
 320  *   │           ▼
 321  *   │         ┌──────┐
 322  *   └───────▶ │ base │
 323  *             └──────┘
 324  *
 325  * So, exclusive write is propagated.
 326  *
 327  * Assume, we want to select fl2 instead of fl1.
 328  * So, we set some option for write-to-selected driver and do permission update.
 329  *
 330  * With simple DFS, if permission update goes first through
 331  * write-to-selected -> fl1 -> base branch it will succeed: it firstly drop
 332  * exclusive write permissions and than apply them for another BdrvChildren.
 333  * But if permission update goes first through write-to-selected -> fl2 -> base
 334  * branch it will fail, as when we try to update fl2->base child, old not yet
 335  * updated fl1->base child will be in conflict.
 336  *
 337  * With topological-sort order we always update parents before children, so fl1
 338  * and fl2 are both updated when we update base and there is no conflict.
 339  */
 340 static void test_parallel_perm_update(void)
 341 {
 342     BlockDriverState *top = no_perm_node("top");
 343     BlockDriverState *ws =
 344             bdrv_new_open_driver(&bdrv_write_to_selected, "ws", BDRV_O_RDWR,
 345                                  &error_abort);
 346     BDRVWriteToSelectedState *s = ws->opaque;
 347     BlockDriverState *base = no_perm_node("base");
 348     BlockDriverState *fl1 = pass_through_node("fl1");
 349     BlockDriverState *fl2 = pass_through_node("fl2");
 350     BdrvChild *c_fl1, *c_fl2;
 351
 352     /*
 353      * bdrv_attach_child() eats child bs reference, so we need two @base
 354      * references for two filters:
 355      */
 356     bdrv_ref(base);
 357
 358     bdrv_graph_wrlock(NULL);
 359     bdrv_attach_child(top, ws, "file", &child_of_bds, BDRV_CHILD_DATA,
 360                       &error_abort);
 361     c_fl1 = bdrv_attach_child(ws, fl1, "first", &child_of_bds,
 362                               BDRV_CHILD_DATA, &error_abort);
 363     c_fl2 = bdrv_attach_child(ws, fl2, "second", &child_of_bds,
 364                               BDRV_CHILD_DATA, &error_abort);
 365     bdrv_attach_child(fl1, base, "backing", &child_of_bds,
 366                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 367                       &error_abort);
 368     bdrv_attach_child(fl2, base, "backing", &child_of_bds,
 369                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 370                       &error_abort);
 371     bdrv_graph_wrunlock();
 372
 373     /* Select fl1 as first child to be active */
 374     s->selected = c_fl1;
 375
 376     bdrv_graph_rdlock_main_loop();
 377
 378     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 379
 380     assert(c_fl1->perm & BLK_PERM_WRITE);
 381     assert(!(c_fl2->perm & BLK_PERM_WRITE));
 382
 383     /* Now, try to switch active child and update permissions */
 384     s->selected = c_fl2;
 385     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 386
 387     assert(c_fl2->perm & BLK_PERM_WRITE);
 388     assert(!(c_fl1->perm & BLK_PERM_WRITE));
 389
 390     /* Switch once more, to not care about real child order in the list */
 391     s->selected = c_fl1;
 392     bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
 393
 394     assert(c_fl1->perm & BLK_PERM_WRITE);
 395     assert(!(c_fl2->perm & BLK_PERM_WRITE));
 396
 397     bdrv_graph_rdunlock_main_loop();
 398     bdrv_unref(top);
 399 }
 400
 401 /*
 402  * It's possible that filter required permissions allows to insert it to backing
 403  * chain, like:
 404  *
 405  *  1.  [top] -> [filter] -> [base]
 406  *
 407  * but doesn't allow to add it as a branch:
 408  *
 409  *  2.  [filter] --\
 410  *                 v
 411  *      [top] -> [base]
 412  *
 413  * So, inserting such filter should do all graph modifications and only then
 414  * update permissions. If we try to go through intermediate state [2] and update
 415  * permissions on it we'll fail.
 416  *
 417  * Let's check that bdrv_append() can append such a filter.
 418  */
 419 static void test_append_greedy_filter(void)
 420 {
 421     BlockDriverState *top = exclusive_writer_node("top");
 422     BlockDriverState *base = no_perm_node("base");
 423     BlockDriverState *fl = exclusive_writer_node("fl1");
 424
 425     bdrv_graph_wrlock(NULL);
 426     bdrv_attach_child(top, base, "backing", &child_of_bds,
 427                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 428                       &error_abort);
 429     bdrv_graph_wrunlock();
 430
 431     aio_context_acquire(qemu_get_aio_context());
 432     bdrv_append(fl, base, &error_abort);
 433     aio_context_release(qemu_get_aio_context());
 434     bdrv_unref(fl);
 435     bdrv_unref(top);
 436 }
 437
 438 int main(int argc, char *argv[])
 439 {
 440     bdrv_init();
 441     qemu_init_main_loop(&error_abort);
 442
 443     g_test_init(&argc, &argv, NULL);
 444
 445     g_test_add_func("/bdrv-graph-mod/update-perm-tree", test_update_perm_tree);
 446     g_test_add_func("/bdrv-graph-mod/should-update-child",
 447                     test_should_update_child);
 448     g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
 449                     test_parallel_perm_update);
 450     g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
 451                     test_parallel_exclusive_write);
 452     g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
 453                     test_append_greedy_filter);
 454
 455     return g_test_run();
 456 }