OpenVZ / Virtuozzo kernel development (devel@openvz.org)
 help / color / mirror / Atom feed
From: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
To: den@openvz.org
Cc: devel@openvz.org
Subject: [Devel] [PATCH hci-8.1 v5 11/11] dm-ploop: truncate unused tail of top delta on suspend
Date: Tue, 13 Oct 2026 09:55:13 +0200	[thread overview]
Message-ID: <20261013075513.90618-12-alexander.ivanov@virtuozzo.com> (raw)
In-Reply-To: <20261013075513.90618-1-alexander.ivanov@virtuozzo.com>

Preallocated space and clusters at the end of the top delta freed by
discard are never given back, so the file size never shrinks. Now that
ploop reloads metadata on resume, we can truncate the top delta on
suspend: the next resumed ploop (maybe of reloaded table) picks up the
new file size.

Add ploop_calc_used_end(), which returns the end of the last cluster
used by the delta: either BAT area, the last mapped cluster or format
extension. Metadata is read from disk rather than taken from memory:
the next table load checks BAT entries against the file size (-EPROTO
otherwise), while in-memory BAT may differ from on-disk one after
failed BAT writeback. Skip it if md pages are not clean, as on-disk BAT
may miss allocated clusters then.

Userspace writes format extension (CBT) behind the last data cluster
of suspended device on umount, resumes it, and then removes the device,
which suspends it again. So keep the area up to the end of format
extension header, which is the last cluster of the extension, as
userspace does. Name the corresponding header field properly instead
of m_Reserved. The field was never interpreted before, so if it is not
cluster-aligned or out of range, don't truncate anything: unaligned
truncation would make the next resume fail with -EPROTO.

Truncate the top delta to the used end in ploop_postsuspend() after
pending preallocation is completed. Do it under ctl_rwsem, so that
ploop messages (e.g. resize) don't change the image in parallel. Skip
read-only devices and raw top delta. On error just leave the file as is.

Skip devices in standby mode as well: the top delta file is dead then,
and the truncation may hang with md->suspend_lock held, so dm_replace()
of libploop could neither replace nor remove the device.

Also skip it if the file size differs from top->file_size. Then another
ploop on the same images writes to the top delta (e.g. a live one left
by libploop error path), and on-disk BAT may miss clusters it has just
allocated, so the truncation would cut its data.

https://virtuozzo.atlassian.net/browse/VSTOR-148171
Feature: dm-ploop: ploop target driver

Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-ploop-bat.c    | 56 +++++++++++++++++++++++++++++++
 drivers/md/dm-ploop-target.c | 64 +++++++++++++++++++++++++++++++++---
 drivers/md/dm-ploop.h        |  3 +-
 3 files changed, 118 insertions(+), 5 deletions(-)

diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
index c060afdd8d3e..7bab746a3707 100644
--- a/drivers/md/dm-ploop-bat.c
+++ b/drivers/md/dm-ploop-bat.c
@@ -709,6 +709,62 @@ int ploop_reload_metadata(struct ploop *ploop)
 }
 ALLOW_ERROR_INJECTION(ploop_reload_metadata, ERRNO);
 
+/*
+ * Returns the end of the last cluster of delta @file used by BAT area,
+ * mapped clusters or format extension, according to on-disk metadata.
+ * Must be called on suspended device.
+ */
+loff_t ploop_calc_used_end(struct ploop *ploop, struct file *file)
+{
+	u32 i, end, nr_be, dst_clu, used_clus, *bat_entries;
+	struct rb_root md_root = RB_ROOT;
+	struct ploop_pvd_header *hdr;
+	struct rb_node *node;
+	struct md_page *md;
+	u64 ext_off, ext_clu;
+	loff_t used_end;
+	int ret;
+
+	/* BAT on disk may miss allocated clusters until writeback is done */
+	if (WARN_ON_ONCE(!ploop_md_pages_are_clean(ploop)))
+		return -EBUSY;
+
+	ret = ploop_read_delta_metadata(ploop, file, &md_root, &nr_be);
+	if (ret)
+		return ret;
+
+	used_clus = ploop_nr_bat_clusters(ploop, nr_be);
+	rb_root_for_each_md_page(&md_root, md, node) {
+		bat_entries = md->kmpage;
+		init_be_iter(nr_be, md->id, &i, &end);
+		for (; i <= end; i++) {
+			dst_clu = READ_ONCE(bat_entries[i]);
+			if (dst_clu != BAT_ENTRY_NONE && dst_clu >= used_clus)
+				used_clus = dst_clu + 1;
+		}
+	}
+
+	/* The header is the last cluster, see delta_save_optional_header() */
+	hdr = ploop_md_first_entry(&md_root)->kmpage;
+	ext_off = le64_to_cpu(hdr->m_FormatExtensionOffset);
+	if (ext_off) {
+		ext_clu = SEC_TO_CLU(ploop, ext_off);
+		if (CLU_TO_SEC(ploop, ext_clu) != ext_off ||
+		    ext_clu >= BAT_ENTRY_NONE) {
+			used_end = -EPROTO;
+			goto out;
+		}
+		if (ext_clu >= used_clus)
+			used_clus = ext_clu + 1;
+	}
+
+	used_end = CLU_TO_POS(ploop, used_clus);
+out:
+	ploop_free_md_pages_tree(&md_root);
+	return used_end;
+}
+ALLOW_ERROR_INJECTION(ploop_calc_used_end, ERRNO);
+
 void ploop_put_delta(struct ploop *ploop, struct ploop_delta *delta)
 {
 	int i;
diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c
index 3a24769d0a8f..f7ead7fb396a 100644
--- a/drivers/md/dm-ploop-target.c
+++ b/drivers/md/dm-ploop-target.c
@@ -449,8 +449,9 @@ static struct ploop_worker *ploop_worker_create(struct ploop *ploop,
  * ploop_dtr, as ploop_dtr is called on the old ploop after the new one is
  * resumed, so we can't possibly modify the image from the old ploop context
  * at this point, as new ploop may be already doing its own IO or
- * preallocation. This truncation should be done on ploop_*suspend (see
- * dm-qcow2 as it already implements that in qcow2_truncate_preallocations).
+ * preallocation. So this truncation is done on ploop_postsuspend (see
+ * ploop_truncate_unused_tail), and the new ploop picks up the new size
+ * of the top delta on metadata reload.
  */
 static int ploop_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 {
@@ -746,10 +747,59 @@ static void ploop_presuspend_undo(struct dm_target *ti)
 {
 	ploop_set_wants_suspend(ti, false);
 }
+
+/*
+ * Truncate preallocations and the tail of the top delta, which became
+ * unused after discard. The next resumed ploop (maybe of reloaded
+ * table) re-reads the size of the top delta in ploop_preresume().
+ */
+static void ploop_truncate_unused_tail(struct ploop *ploop)
+{
+	struct ploop_delta *top = ploop_top_delta(ploop);
+	unsigned long flags;
+	loff_t end;
+	int ret;
+
+	lockdep_assert_held_write(&ploop->ctl_rwsem);
+
+	if (ploop_is_ro(ploop) || top->is_raw)
+		return;
+	if (ploop_is_standby(ploop))
+		return;
+	if (!ploop_no_pending_prealloc(ploop))
+		return;
+	if (i_size_read(file_inode(top->file)) != top->file_size) {
+		PL_ERR("Top delta is changed by someone else, don't truncate it");
+		return;
+	}
+
+	end = ploop_calc_used_end(ploop, top->file);
+	if (end < 0) {
+		PL_ERR("Can't find used end of top delta: %lld", end);
+		return;
+	}
+	if (end >= top->file_size)
+		return;
+
+	ret = do_ftruncate(top->file, end, 0);
+	if (ret) {
+		PL_ERR("Can't truncate unused tail of top delta: %d", ret);
+		return;
+	}
+
+	spin_lock_irqsave(&ploop->bat_lock, flags);
+	top->file_size = end;
+	if (top->file_preallocated_area_start > end)
+		top->file_preallocated_area_start = end;
+	spin_unlock_irqrestore(&ploop->bat_lock, flags);
+}
+
 static void ploop_postsuspend(struct dm_target *ti)
 {
 	struct ploop *ploop = ti->private;
+	unsigned int noio_flags;
 
+	down_write(&ploop->ctl_rwsem);
 	/*
 	 * Let the next resumed ploop (maybe of reloaded table)
 	 * see final size of the top delta. Don't wait in standby
@@ -765,10 +815,16 @@ static void ploop_postsuspend(struct dm_target *ti)
 	/*
 	 * Data bios are completed before BAT writeback is finished
 	 * (see ploop_put_piwb()), so wait for it explicitly to make
-	 * md pages clean for ploop_reload_metadata().
+	 * md pages clean for ploop_reload_metadata() and
+	 * ploop_calc_used_end().
 	 */
 	wait_event(ploop->inflight_md_wq, !atomic_read(&ploop->inflight_md));
-	ploop_set_suspended(ti, true);
+	/* The device is suspended, see ploop_preresume() */
+	noio_flags = memalloc_noio_save();
+	ploop_truncate_unused_tail(ploop);
+	memalloc_noio_restore(noio_flags);
+	ploop->suspended = true;
+	up_write(&ploop->ctl_rwsem);
 }
 static int ploop_preresume(struct dm_target *ti)
 {
diff --git a/drivers/md/dm-ploop.h b/drivers/md/dm-ploop.h
index 5750eafc8a1b..bdc8033c9cc5 100644
--- a/drivers/md/dm-ploop.h
+++ b/drivers/md/dm-ploop.h
@@ -37,7 +37,7 @@ struct ploop_pvd_header {
 	__u32 m_DiskInUse;	/* Disk in use */
 	__u32 m_FirstBlockOffset; /* First data block offset (in sectors) */
 	__u32 m_Flags;		/* Misc flags */
-	__u8  m_Reserved[8];	/* Reserved */
+	__u64 m_FormatExtensionOffset; /* Format extension offset (in sectors) */
 };
 #pragma pack(pop)
 
@@ -643,6 +643,7 @@ extern void ploop_pio_prepare_offsets(struct ploop *ploop, struct pio *pio, u32
 extern int ploop_setup_metadata(struct ploop *ploop, struct page *page,
 				bool check_in_use);
 extern int ploop_reload_metadata(struct ploop *ploop);
+extern loff_t ploop_calc_used_end(struct ploop *ploop, struct file *file);
 extern int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
 				     struct rb_root *md_root, u32 *delta_nr_be);
 extern void ploop_index_wb_init(struct ploop_index_wb *piwb,
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

  parent reply	other threads:[~2026-10-13  7:57 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-13  7:55 [Devel] [PATCH hci-8.1 v5 00/11] dm-ploop: give back " Alexander Ivanov
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 01/11] dm-ploop: fix u32 overflow of the delta BAT byte size Alexander Ivanov
2026-10-13  8:02   ` no-reply
2026-10-13  9:24     ` Alexander Ivanov
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 02/11] dm-ploop: fix lost wakeup in ploop_allocator() Alexander Ivanov
2026-10-13  8:00   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 03/11] dm-ploop: reject a delta header whose BAT does not cover the target Alexander Ivanov
2026-10-13  8:01   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 04/11] dm-ploop: reject empty deltas Alexander Ivanov
2026-10-13  8:02   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 05/11] dm-ploop: set delta is_raw before applying its mappings Alexander Ivanov
2026-10-13  8:03   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 06/11] dm-ploop: factor out ploop_read_delta() from ploop_add_delta() Alexander Ivanov
2026-10-13  8:04   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 07/11] dm-ploop: take bat_lock around md page lookup in ploop_llseek_hole() Alexander Ivanov
2026-10-13  8:06   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 08/11] dm-ploop: use wake_up() for inflight_md_wq and dispatcher_wq_prealloc Alexander Ivanov
2026-10-13  8:04   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 09/11] dm-ploop: fix use-after-free on the last inflight_md decrement Alexander Ivanov
2026-10-13  8:11   ` no-reply
2026-10-13  7:55 ` [Devel] [PATCH hci-8.1 v5 10/11] dm-ploop: reload metadata on resume Alexander Ivanov
2026-10-13  8:16   ` no-reply
2026-10-13  7:55 ` Alexander Ivanov [this message]
2026-10-13  8:20   ` [Devel] [PATCH hci-8.1 v5 11/11] dm-ploop: truncate unused tail of top delta on suspend no-reply
2026-10-13 11:00     ` Alexander Ivanov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261013075513.90618-12-alexander.ivanov@virtuozzo.com \
    --to=alexander.ivanov@virtuozzo.com \
    --cc=den@openvz.org \
    --cc=devel@openvz.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox