From: "Denis V. Lunev" <den@openvz.org>
To: qemu-devel@nongnu.org
Cc: qemu-block@nongnu.org, "Denis V. Lunev" <den@openvz.org>,
Kevin Wolf <kwolf@redhat.com>, Hanna Reitz <hreitz@redhat.com>,
Paolo Bonzini <pbonzini@redhat.com>, Fam Zheng <fam@euphon.net>
Subject: [PATCH 0/4] block, scsi-disk: honour a size change on child replacement
Date: Wed, 12 Aug 2026 14:14:56 +0200 [thread overview]
Message-ID: <20260812121500.1034178-1-den@openvz.org> (raw)
qom-set of the 'drive' property is allowed on a realized device and ends
up in bdrv_replace_child_bs(), which swaps the node a BdrvChild points to
without telling the parent anything about it. Every other way the size of
a node changes goes through bdrv_co_truncate(), which does notify, so a
device model caching the size of its child has no way to learn that it
changed.
scsi-disk is the one really hurt by this. check_lba_range() validates
every guest request against SCSIDevice.max_lba, filled in by
scsi_disk_reset() and updated only by the READ CAPACITY(10) and (16)
handlers. Point a scsi-hd at a larger node and every request past the end
of the old one is refused with ILLEGAL REQUEST / LOGICAL BLOCK ADDRESS
OUT OF RANGE for the whole life of the device, which Linux turns into
EREMOTEIO for reads as well as writes. It is silent on the host:
out-of-range requests are answered by scsi_check_condition() and never
reach scsi_handle_rw_error(), so there is no BLOCK_IO_ERROR event and
io-status stays 'ok'. virtio-blk and ide call blk_get_geometry() for
every request, so they end up with a stale idea of the size but never
refuse I/O the node underneath can serve.
Signed-off-by: Denis V. Lunev <den@openvz.org>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Hanna Reitz <hreitz@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Fam Zheng <fam@euphon.net>
Denis V. Lunev (4):
block: notify the parent when a replaced child has a different size
scsi-disk: refresh the cached capacity from the resize callback
tests/qtest/virtio-scsi: cover a replacement that changes the size
tests/qemu-iotests/qom-set-drive: replace with a differently sized
node
block.c | 13 +++++
hw/scsi/scsi-disk.c | 16 ++++--
include/block/block_int-io.h | 3 ++
tests/qemu-iotests/tests/qom-set-drive | 14 +++--
tests/qemu-iotests/tests/qom-set-drive.out | 2 +
tests/qtest/virtio-scsi-test.c | 63 ++++++++++++++++++++++
6 files changed, 104 insertions(+), 7 deletions(-)
base-commit: 3e3ccab106f879b1512f8e0d51a827dd4de30e22
--
2.53.0
next reply other threads:[~2026-08-12 12:15 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 12:14 Denis V. Lunev [this message]
2026-08-12 12:14 ` [PATCH 1/4] block: notify the parent when a replaced child has a different size Denis V. Lunev
2026-08-12 12:14 ` [PATCH 2/4] scsi-disk: refresh the cached capacity from the resize callback Denis V. Lunev
2026-08-12 12:14 ` [PATCH 3/4] tests/qtest/virtio-scsi: cover a replacement that changes the size Denis V. Lunev
2026-08-12 12:15 ` [PATCH 4/4] tests/qemu-iotests/qom-set-drive: replace with a differently sized node Denis V. Lunev
2026-08-19 9:36 ` [PATCH 0/4] block, scsi-disk: honour a size change on child replacement Denis V. Lunev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260812121500.1034178-1-den@openvz.org \
--to=den@openvz.org \
--cc=fam@euphon.net \
--cc=hreitz@redhat.com \
--cc=kwolf@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.