Re: [Qemu-devel] [PATCH] Make default invocation of block drivers safer

[Markus Armbruster]

Anthony Liguori <address@hidden> writes:

> On 07/14/2010 01:43 PM, Christoph Hellwig wrote:
>> Err, strong NACK.  Please don't start messing with the contents of the
>> data plane, we're getting into real trouble there.  It's perfectly
>> valid for a guest to create an image inside an image, and with hardware
>> support for nested virtualization I guess this use case will become
>> rather common, just as it already is on S/390 with VM.
>>    
>
> Then we have to remove block format probing.
>
> The two things are fundamentally incompatible.

I agree with Christoph: changing guest writes is a big no-no, and
changing them silently is even worse.

I could perhaps accept EIO.  Elsewhere in this thread you wrote that you
rejected that approach because "it would trigger the stop-on-error
behavior and the result would be far too difficult for a management
tool/person to deal with."  I think that would be *far* superior in
fact: it fails spectacularly, immediately and safely instead of silently
corrupting disk contents.

The real problem in need of fixing is the unsafe default.  You wrote
that "most users want block probing".  I disagree.  Users want to set up
drives with as little hassle as possible.  If format is optional, and
appears to work, why bother specifying it?  That they get an unsafe
default that way is a big surprise to them.  And I can't blame them!
Users can reasonably expect programs not to trap them.

If we want to let users define drives without having to specify the
format, we can guess the format from the file name.