- Apr 24, 2017
-
-
Jeff Cody authored
Signed-off-by:
Jeff Cody <jcody@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
John Snow <jsnow@redhat.com> Message-id: 00aed7ffdd7be4b9ed9ce1007d50028a72b34ebe.1491597120.git.jcody@redhat.com
-
Jeff Cody authored
Introduce check function for setting read_only flags. Will return < 0 on error, with appropriate Error value set. Does not alter any flags. Signed-off-by:
Jeff Cody <jcody@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
John Snow <jsnow@redhat.com> Message-id: e2bba34ac3bc76a0c42adc390413f358ae0566e8.1491597120.git.jcody@redhat.com
-
Jeff Cody authored
Move bdrv_is_read_only() up with its friends. Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
John Snow <jsnow@redhat.com> Signed-off-by:
Jeff Cody <jcody@redhat.com> Message-id: 73b2399459760c32506f9407efb9dddb3a2789de.1491597120.git.jcody@redhat.com
-
Jeff Cody authored
The BDRV_O_ALLOW_RDWR flag allows / prohibits the changing of the BDS 'read_only' state, but there are a few places where it is ignored. In the bdrv_set_read_only() helper, make sure to honor the flag. Signed-off-by:
Jeff Cody <jcody@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
John Snow <jsnow@redhat.com> Message-id: be2e5fb2d285cbece2b6d06bed54a6f56520d251.1491597120.git.jcody@redhat.com
-
Jeff Cody authored
A few block drivers will set the BDS read_only flag from their .bdrv_open() function. This means the bs->read_only flag could be set after we enable copy_on_read, as the BDRV_O_COPY_ON_READ flag check occurs prior to the call to bdrv->bdrv_open(). This adds an error return to bdrv_set_read_only(), and an error will be return if we try to set the BDS to read_only while copy_on_read is enabled. This patch also changes the behavior of vvfat. Before, vvfat could override the drive 'readonly' flag with its own, internal 'rw' flag. For instance, this -drive parameter would result in a writable image: "-drive format=vvfat,dir=/tmp/vvfat,rw,if=virtio,readonly=on" This is not correct. Now, attempting to use the above -drive parameter will result in an error (i.e., 'rw' is incompatible with 'readonly=on'). Signed-off-by:
Jeff Cody <jcody@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
John Snow <jsnow@redhat.com> Message-id: 0c5b4c1cc2c651471b131f21376dfd5ea24d2196.1491597120.git.jcody@redhat.com
-
Jeff Cody authored
We have a helper wrapper for checking for the BDS read_only flag, add a helper wrapper to set the read_only flag as well. Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by:
Jeff Cody <jcody@redhat.com> Reviewed-by:
John Snow <jsnow@redhat.com> Message-id: 9b18972d05f5fa2ac16c014f0af98d680553048d.1491597120.git.jcody@redhat.com
-
Fam Zheng authored
Signed-off-by:
Fam Zheng <famz@redhat.com> Message-Id: <20170421122710.15373-6-famz@redhat.com> Reviewed-by:
Markus Armbruster <armbru@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com> Signed-off-by:
Markus Armbruster <armbru@redhat.com>
-
- Apr 11, 2017
-
-
Hanna Reitz authored
In case of block migration, there may be writes to BlockBackends that do not have the write permission taken. Before this issue is fixed (which is not going to happen in 2.9), we therefore cannot assert that this is the case. Suggested-by:
Kevin Wolf <kwolf@redhat.com> Signed-off-by:
Max Reitz <mreitz@redhat.com> Reviewed-by:
Kevin Wolf <kwolf@redhat.com> Tested-by:
Kevin Wolf <kwolf@redhat.com> Message-id: 20170411145050.31290-1-mreitz@redhat.com Tested-by:
Laurent Vivier <lvivier@redhat.com> Signed-off-by:
Peter Maydell <peter.maydell@linaro.org>
-
Fam Zheng authored
Signed-off-by:
Fam Zheng <famz@redhat.com> Acked-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
Kevin Wolf <kwolf@redhat.com>
-
Fam Zheng authored
The fact that the bs->aio_context is changing can confuse the dataplane iothread, because of the now fine granularity aio context lock. bdrv_drain should rather be a bdrv_drained_begin/end pair, but since bs->aio_context is changing, we can just use aio_disable_external and bdrv_parent_drained_begin. Reported-by:
Ed Swierk <eswierk@skyportsystems.com> Signed-off-by:
Fam Zheng <famz@redhat.com> Acked-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
Kevin Wolf <kwolf@redhat.com>
-
- Apr 07, 2017
-
-
Fam Zheng authored
Suggested-by:
Kevin Wolf <kwolf@redhat.com> Signed-off-by:
Fam Zheng <famz@redhat.com> Signed-off-by:
Kevin Wolf <kwolf@redhat.com>
-
- Apr 03, 2017
-
-
Markus Armbruster authored
-blockdev and blockdev_add convert their arguments via QObject to BlockdevOptions for qmp_blockdev_add(), which converts them back to QObject, then to a flattened QDict. The QDict's members are typed according to the QAPI schema. -drive converts its argument via QemuOpts to a (flat) QDict. This QDict's members are all QString. Thus, the QType of a flat QDict member depends on whether it comes from -drive or -blockdev/blockdev_add, except when the QAPI type maps to QString, which is the case for 'str' and enumeration types. The block layer core extracts generic configuration from the flat QDict, and the block driver extracts driver-specific configuration. Both commonly do so by converting (parts of) the flat QDict to QemuOpts, which turns all values into strings. Not exactly elegant, but correct. However, A few places access the flat QDict directly: * Most of them access members that are always QString. Correct. * bdrv_open_inherit() accesses a boolean, carefully. Correct. * nfs_config() uses a QObject input visitor. Correct only because the visited type contains nothing but QStrings. * nbd_config() and ssh_config() use a QObject input visitor, and the visited types contain non-QStrings: InetSocketAddress members @numeric, @to, @ipv4, @ipv6. -drive works as long as you don't try to use them (they're all optional). @to is ignored anyway. Reproducer: -drive driver=ssh,server.host=h,server.port=22,server.ipv4,path=p -drive driver=nbd,server.type=inet,server.data.host=h,server.data.port=22,server.data.ipv4 both fail with "Invalid parameter type for 'data.ipv4', expected: boolean" Add suitable comments to all these places. Mark the buggy ones FIXME. "Fortunately", -drive's driver-specific options are entirely undocumented. Signed-off-by:
Markus Armbruster <armbru@redhat.com> Message-id: 1490895797-29094-5-git-send-email-armbru@redhat.com [mreitz: Fixed two typos] Reviewed-by:
Eric Blake <eblake@redhat.com> Signed-off-by:
Max Reitz <mreitz@redhat.com>
-
- Mar 17, 2017
-
-
Paolo Bonzini authored
While it is true that bdrv_set_aio_context only works on a single BlockDriverState subtree (see commit message for 53ec73e2, "block: Use bdrv_drain to replace uncessary bdrv_drain_all", 2015-07-07), it works at the AioContext level rather than the BlockDriverState level. Therefore, it is also necessary to trigger pending bottom halves too, even if no requests are pending. For NBD this ensures that the aio_co_schedule of a previous call to nbd_attach_aio_context is completed before detaching from the old AioContext; it fixes qemu-iotest 094. Another similar bug happens when the VM is stopped and the virtio-blk dataplane irqfd is torn down. In this case it's possible that guest I/O gets stuck if notify_guest_bh was scheduled but doesn't run. Calling aio_poll from another AioContext is safe if non-blocking; races such as the one mentioned in the commit message for c9d1a561 ("block: only call aio_poll on the current thread's AioContext", 2016-10-28) are a concern for blocking calls. I considered other options, including: - moving the bs->wakeup mechanism to AioContext, and letting the caller check. This might work for virtio which has a clear place to wakeup (notify_place_bh) and check the condition (virtio_blk_data_plane_stop). For aio_co_schedule I couldn't find a clear place to check the condition. - adding a dummy oneshot bottom half and waiting for it to trigger. This has the complication that bottom half list is LIFO for historical reasons. There were performance issues caused by bottom half ordering in the past, so I decided against it for 2.9. Fixes: 99723548 Reported-by:
Max Reitz <mreitz@redhat.com> Reported-by:
Halil Pasic <pasic@linux.vnet.ibm.com> Tested-by:
Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by:
Paolo Bonzini <pbonzini@redhat.com> Message-id: 20170314111157.14464-2-pbonzini@redhat.com Reviewed-by:
Eric Blake <eblake@redhat.com> Signed-off-by:
Max Reitz <mreitz@redhat.com>
-
Fam Zheng authored
Signed-off-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Alberto Garcia <berto@igalia.com> Signed-off-by:
Kevin Wolf <kwolf@redhat.com>
-
Fam Zheng authored
bdrv_child_set_perm alone is not very usable because the caller must call bdrv_child_check_perm first. This is already encapsulated conveniently in bdrv_child_try_set_perm, so remove the other prototypes from the header and fix the one wrong caller, block/mirror.c. Signed-off-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com> Signed-off-by:
Kevin Wolf <kwolf@redhat.com>
-
- Mar 13, 2017
-
-
Kevin Wolf authored
In bdrv_open_inherit(), the filename is refreshed after opening the backing file, but we neglected to do the same when the backing file changes later. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com>
-
Kevin Wolf authored
All callers pass false now, so the parameter can go away again. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com>
-
- Mar 07, 2017
-
-
Markus Armbruster authored
Signed-off-by:
Markus Armbruster <armbru@redhat.com> Reviewed-by:
Kevin Wolf <kwolf@redhat.com> Message-Id: <1488317230-26248-14-git-send-email-armbru@redhat.com>
-
Markus Armbruster authored
The next few commits will put the errors to use where appropriate. Signed-off-by:
Markus Armbruster <armbru@redhat.com> Reviewed-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com> Message-Id: <1488317230-26248-13-git-send-email-armbru@redhat.com>
-
Kevin Wolf authored
When adding an Error parameter, bdrv_replace_in_backing_chain() would become nothing more than a wrapper around change_parent_backing_link(). So make the latter public, renamed as bdrv_replace_node(), and remove bdrv_replace_in_backing_chain(). Most of the callers just remove a node from the graph that they just inserted, so they can use &error_abort, but completion of a mirror job with 'replaces' set can actually fail. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com>
-
Kevin Wolf authored
Instead of just trying to change parents by parent over to reference @to instead of @from, and abort()ing whenever the permissions don't allow this, do proper permission checking beforehand and pass any error to the callers. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com>
-
Kevin Wolf authored
change_parent_backing_link() will need to update multiple BdrvChild objects at once. Checking permissions reference by reference doesn't work because permissions need to be consistent only with all parents moved to the new child. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com>
-
Kevin Wolf authored
Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com>
-
Kevin Wolf authored
Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Eric Blake <eblake@redhat.com> Reviewed-by:
Philippe Mathieu-Daudé <f4bug@amsat.org>
-
- Feb 28, 2017
-
-
Kevin Wolf authored
Aborting on error in bdrv_append() isn't correct. This patch fixes it and lets the callers handle failures. Test case 085 needs a reference output update. This is caused by the reversed order of bdrv_set_backing_hd() and change_parent_backing_link() in bdrv_append(): When the backing file of the new node is set, the parent nodes are still pointing to the old top, so the backing blocker is now initialised with the node name rather than the BlockBackend name. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com>
-
Kevin Wolf authored
Not all callers of bdrv_set_backing_hd() know for sure that attaching the backing file will be allowed by the permission system. Return the error from the function rather than aborting. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com>
-
Kevin Wolf authored
This adds an assertion that ensures that the necessary resize permission has been granted before bdrv_truncate() is called. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
Now that the backing file child role implements .attach/.detach callbacks, nothing prevents us from modifying the graph even if that involves changing backing file links. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
Backing files are somewhat special compared to other kinds of children because they are attached and detached using bdrv_set_backing_hd() rather than the normal set of functions, which does a few more things like setting backing blockers, toggling the BDRV_O_NO_BACKING flag, setting parent_bs->backing_file, etc. These special features are a reason why change_parent_backing_link() can't handle backing files yet. With abstracting the additional features into .attach/.detach callbacks, we get a step closer to a function that can actually deal with this. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
bdrv_append() cares about isolation of the node that it modifies, but not about activity in some subtree below it. Instead of using the recursive bdrv_requests_pending(), directly check bs->in_flight, which considers only the node in question. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
When the parents' child links are updated in bdrv_append() or bdrv_replace_in_backing_chain(), this should affect all child links of BlockBackends or other nodes, but not on child links held for other purposes (like for setting permissions). This patch allows to control the behaviour per BdrvChildRole. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
Instead of just telling that there was some conflict, we can be specific and tell which permissions were in conflict and which way the conflict is. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com>
-
Kevin Wolf authored
For meaningful error messages in the permission system, we need to get some human-readable description of the parent of a BdrvChild. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
Now that blk_insert_bs() requests the BlockBackend permissions for the node it attaches to, it can fail. Instead of aborting, pass the errors to the callers. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
We want every user to be specific about the permissions it needs, so we'll pass the initial permissions as parameters to blk_new(). A user only needs to call blk_set_perm() if it wants to change the permissions after the fact. The permissions are stored in the BlockBackend and applied whenever a BlockDriverState should be attached in blk_insert_bs(). This does not include actually choosing the right set of permissions everywhere yet. Instead, the usual FIXME comment is added to each place and will be addressed in individual patches. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
Now that all block drivers with children tell us what permissions they need from each of their children, bdrv_attach_child() can use this information and make the right requirements while trying to attach new children. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com>
-
Kevin Wolf authored
All block drivers that can have child nodes implement .bdrv_child_perm() now. Make this officially a requirement by asserting that only drivers without children can omit .bdrv_child_perm(). Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
vvfat is the last remaining driver that can have children, but doesn't implement .bdrv_child_perm() yet. The default handlers aren't suitable here, so let's implement a very simple driver-specific one that protects the internal child from being used by other users as good as our permissions permit. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com>
-
Kevin Wolf authored
Almost all format drivers have the same characteristics as far as permissions are concerned: They have one or more children for storing their own data and, more importantly, metadata (can be written to and grow even without external write requests, must be protected against other writers and present consistent data) and optionally a backing file (this is just data, so like for a filter, it only depends on what the parent nodes need). This provides a default implementation that can be shared by most of our format drivers. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com>
-
Kevin Wolf authored
Most filters need permissions related to read and write for their children, but only if the node has a parent that wants to use the same operation on the filter. The same is true for resize. This adds a default implementation that simply forwards all necessary permissions to all children of the node and leaves the other permissions unchanged. Signed-off-by:
Kevin Wolf <kwolf@redhat.com> Acked-by:
Fam Zheng <famz@redhat.com> Reviewed-by:
Max Reitz <mreitz@redhat.com>
-