[PATCH 0/4] block, scsi-disk: honour a size change on child replacement

Denis V. Lunev posted 4 patches 1 week, 6 days ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260812121500.1034178-1-den@openvz.org
Maintainers: Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Fam Zheng <fam@euphon.net>, Fabiano Rosas <farosas@suse.de>, Laurent Vivier <lvivier@redhat.com>
block.c                                    | 13 +++++
hw/scsi/scsi-disk.c                        | 16 ++++--
include/block/block_int-io.h               |  3 ++
tests/qemu-iotests/tests/qom-set-drive     | 14 +++--
tests/qemu-iotests/tests/qom-set-drive.out |  2 +
tests/qtest/virtio-scsi-test.c             | 63 ++++++++++++++++++++++
6 files changed, 104 insertions(+), 7 deletions(-)
[PATCH 0/4] block, scsi-disk: honour a size change on child replacement
Posted by Denis V. Lunev 1 week, 6 days ago
qom-set of the 'drive' property is allowed on a realized device and ends
up in bdrv_replace_child_bs(), which swaps the node a BdrvChild points to
without telling the parent anything about it. Every other way the size of
a node changes goes through bdrv_co_truncate(), which does notify, so a
device model caching the size of its child has no way to learn that it
changed.

scsi-disk is the one really hurt by this. check_lba_range() validates
every guest request against SCSIDevice.max_lba, filled in by
scsi_disk_reset() and updated only by the READ CAPACITY(10) and (16)
handlers. Point a scsi-hd at a larger node and every request past the end
of the old one is refused with ILLEGAL REQUEST / LOGICAL BLOCK ADDRESS
OUT OF RANGE for the whole life of the device, which Linux turns into
EREMOTEIO for reads as well as writes. It is silent on the host:
out-of-range requests are answered by scsi_check_condition() and never
reach scsi_handle_rw_error(), so there is no BLOCK_IO_ERROR event and
io-status stays 'ok'. virtio-blk and ide call blk_get_geometry() for
every request, so they end up with a stale idea of the size but never
refuse I/O the node underneath can serve.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Hanna Reitz <hreitz@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Fam Zheng <fam@euphon.net>

Denis V. Lunev (4):
  block: notify the parent when a replaced child has a different size
  scsi-disk: refresh the cached capacity from the resize callback
  tests/qtest/virtio-scsi: cover a replacement that changes the size
  tests/qemu-iotests/qom-set-drive: replace with a differently sized
    node

 block.c                                    | 13 +++++
 hw/scsi/scsi-disk.c                        | 16 ++++--
 include/block/block_int-io.h               |  3 ++
 tests/qemu-iotests/tests/qom-set-drive     | 14 +++--
 tests/qemu-iotests/tests/qom-set-drive.out |  2 +
 tests/qtest/virtio-scsi-test.c             | 63 ++++++++++++++++++++++
 6 files changed, 104 insertions(+), 7 deletions(-)


base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22
-- 
2.53.0
Re: [PATCH 0/4] block, scsi-disk: honour a size change on child replacement
Posted by Denis V. Lunev 6 days, 21 hours ago
On 8/12/26 14:14, Denis V. Lunev wrote:
> This email originated from an IP that might not be authorized by the domain it was sent from.
> Do not click links or open attachments unless it is an email you expected to receive.
> qom-set of the 'drive' property is allowed on a realized device and ends
> up in bdrv_replace_child_bs(), which swaps the node a BdrvChild points to
> without telling the parent anything about it. Every other way the size of
> a node changes goes through bdrv_co_truncate(), which does notify, so a
> device model caching the size of its child has no way to learn that it
> changed.
>
> scsi-disk is the one really hurt by this. check_lba_range() validates
> every guest request against SCSIDevice.max_lba, filled in by
> scsi_disk_reset() and updated only by the READ CAPACITY(10) and (16)
> handlers. Point a scsi-hd at a larger node and every request past the end
> of the old one is refused with ILLEGAL REQUEST / LOGICAL BLOCK ADDRESS
> OUT OF RANGE for the whole life of the device, which Linux turns into
> EREMOTEIO for reads as well as writes. It is silent on the host:
> out-of-range requests are answered by scsi_check_condition() and never
> reach scsi_handle_rw_error(), so there is no BLOCK_IO_ERROR event and
> io-status stays 'ok'. virtio-blk and ide call blk_get_geometry() for
> every request, so they end up with a stale idea of the size but never
> refuse I/O the node underneath can serve.
>
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Hanna Reitz <hreitz@redhat.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Fam Zheng <fam@euphon.net>
>
> Denis V. Lunev (4):
>   block: notify the parent when a replaced child has a different size
>   scsi-disk: refresh the cached capacity from the resize callback
>   tests/qtest/virtio-scsi: cover a replacement that changes the size
>   tests/qemu-iotests/qom-set-drive: replace with a differently sized
>     node
>
>  block.c                                    | 13 +++++
>  hw/scsi/scsi-disk.c                        | 16 ++++--
>  include/block/block_int-io.h               |  3 ++
>  tests/qemu-iotests/tests/qom-set-drive     | 14 +++--
>  tests/qemu-iotests/tests/qom-set-drive.out |  2 +
>  tests/qtest/virtio-scsi-test.c             | 63 ++++++++++++++++++++++
>  6 files changed, 104 insertions(+), 7 deletions(-)
>
>
> base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22
ping