ZLFS: double-indirect blocks -- files to about 1 GB

Add the double-indirect tree (zi_ib[1]): ZLFS_MAXFILESZ rises from
~2 MB to NDADDR + NINDIR + NINDIR^2 blocks.  The commit builds the
tree lazily -- only L2 blocks whose entries changed are rewritten, so
a splice deep in a large file writes one data block, one L2, the L1
and the inode; a shrink orphans whole L2 subtrees by zeroing their L1
entries.  zi_blocks is computed arithmetically from the no-holes
invariant.  zlfs_bmap_read loses its caller-held indirect cache (the
buffer cache serves repeat reads now that ZLFS blocks cache normally)
and walks all three levels through one guarded helper.  The cleaner
marks the whole ib[1] tree and refuses reclaim only for ib[2].

Review fixes: directories stay bounded by the zn_data commit path's
capacity (new ZLFS_MAXDIRSZ = direct + single indirect) -- the raised
file limit would have let a directory grow past what its commit path
can write, wedging every later commit with EFBIG; and the overlay
pointer array now grows geometrically (sequential writes were O(n^2)
at the new size).  The runtime harness in review exercised the actual
kernel functions through ~50 commits (splice, shrink, regrow, 14
injected failures) cleanly under ASan.

Add zlfs-bigfile.sh: 16 MB file across 7 L2 blocks, a splice at 10 MB,
cmp against an FFS template, re-checked over a remount.

Author: xsub

regress/sys/sys/dkzone/zlfs-bigfile.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+set -eu
+
+# ZLFS double-indirect test: a 16 MB file (4096 blocks -- direct +
+# single indirect + 7 L2 blocks of the double-indirect tree), a splice
+# at 10 MB (RMW of one double-range block; only that block, its L2, L1
+# and the inode may be rewritten), verified with cmp against an FFS
+# template, again after a remount.
+#
+# WARNING: this reformats the given disk with newfs_zlfs.
+
+usage()
+{
+	echo "usage: $0 disk [mount-point]" >&2
+	echo "warning: this reformats the disk with newfs_zlfs" >&2
+	exit 1
+}
+
+die()
+{
+	echo "$0: $*" >&2
+	exit 1
+}
+
+section()
+{
+	echo
+	echo "== $* =="
+}
+
+disk=${1-}
+mnt=${2-/mnt/zlfs}
+
+[ -n "$disk" ] && [ $# -le 2 ] || usage
+[ "$(id -u)" -eq 0 ] || die "must run as root"
+
+dev=/dev/$disk
+tmpl=/tmp/zlfs-big-tmpl
+
+section "newfs + mount"
+umount "$mnt" 2>/dev/null || true
+newfs_zlfs "$disk"
+mkdir -p "$mnt"
+mount_zlfs "$dev" "$mnt"
+
+section "16 MB random file (4096 blocks, double indirect)"
+dd if=/dev/random of="$tmpl" bs=64k count=256 2>/dev/null
+cp "$tmpl" "$mnt/big"
+sync
+cmp "$tmpl" "$mnt/big" || die "initial contents differ"
+echo "  ok: 16 MB written and committed"
+
+section "splice at 10 MB (RMW deep in the double-indirect range)"
+printf 'DOUBLE-IND' | dd of="$mnt/big" bs=1 seek=10485770 conv=notrunc 2>/dev/null
+printf 'DOUBLE-IND' | dd of="$tmpl" bs=1 seek=10485770 conv=notrunc 2>/dev/null
+sync
+cmp "$tmpl" "$mnt/big" || die "splice differs"
+echo "  ok: splice committed, rest intact"
+
+section "intact after remount?"
+umount "$mnt"
+mount_zlfs "$dev" "$mnt"
+cmp "$tmpl" "$mnt/big" || die "contents differ after remount"
+echo "  ok: byte-for-byte match after remount"
+
+rm -f "$tmpl"
+section "PASS"

sys/zlfs/zlfs_alloc.c

@@ -137,16 +137,16 @@ zlfs_gc_mark(struct zlfs_mount *zmp, u_int64_t lba)
 static int
 zlfs_gc_mark_blocks(struct zlfs_mount *zmp, const struct zlfs_inode *zi)
 {
-	struct buf *bp;
-	u_int64_t j, nindir = ZLFS_NINDIR(zmp);
+	struct buf *bp, *l2bp;
+	u_int64_t j, k, l1, nindir = ZLFS_NINDIR(zmp);
 	int error;
 
 	/*
-	 * This implementation never writes double/triple indirect blocks;
-	 * if some other writer of this format did, the blocks they reach
+	 * This implementation never writes triple indirect blocks; if
+	 * some other writer of this format did, the blocks they reach
 	 * would not be marked, so refuse to reclaim anything.
 	 */
-	if (zi->zi_ib[1] != 0 || zi->zi_ib[2] != 0)
+	if (zi->zi_ib[2] != 0)
 		return EFTYPE;
 
 	for (j = 0; j < ZLFS_NDADDR; j++)
@@ -161,6 +161,28 @@ zlfs_gc_mark_blocks(struct zlfs_mount *zmp, const struct zlfs_inode *zi)
 			    letoh64(((u_int64_t *)bp->b_data)[j]));
 		brelse(bp);
 	}
+	if (zi->zi_ib[1] != 0) {
+		zlfs_gc_mark(zmp, zi->zi_ib[1]);
+		error = zlfs_bread_block(zmp, zi->zi_ib[1], &bp);
+		if (error != 0)
+			return error;
+		for (j = 0; j < nindir; j++) {
+			l1 = letoh64(((u_int64_t *)bp->b_data)[j]);
+			if (l1 == 0)
+				continue;
+			zlfs_gc_mark(zmp, l1);
+			error = zlfs_bread_block(zmp, l1, &l2bp);
+			if (error != 0) {
+				brelse(bp);
+				return error;
+			}
+			for (k = 0; k < nindir; k++)
+				zlfs_gc_mark(zmp,
+				    letoh64(((u_int64_t *)l2bp->b_data)[k]));
+			brelse(l2bp);
+		}
+		brelse(bp);
+	}
 	return 0;
 }
 

sys/zlfs/zlfs_var.h

@@ -96,10 +96,21 @@ struct zlfs_node {
 	    ((zmp)->zm_super.zs_block_size / sizeof(u_int64_t)))
 
 /*
- * Largest file the write path supports: the direct blocks plus one
- * single-indirect block.  Double/triple indirect are not yet used.
+ * Largest file the write path supports: the direct blocks, one
+ * single-indirect block, and one double-indirect tree (about 1 GB at
+ * a 4 KB block size).  Triple indirect stays reserved.
  */
 #define ZLFS_MAXFILESZ(zmp) \
+	((ZLFS_NDADDR + ZLFS_NINDIR(zmp) + \
+	    ZLFS_NINDIR(zmp) * ZLFS_NINDIR(zmp)) * \
+	    (u_int64_t)(zmp)->zm_super.zs_block_size)
+
+/*
+ * Directories are committed through the whole-contents (zn_data) path,
+ * which writes direct plus single-indirect blocks only, so their growth
+ * must stop at that bound (16k+ entries at a 4 KB block).
+ */
+#define ZLFS_MAXDIRSZ(zmp) \
 	((ZLFS_NDADDR + ZLFS_NINDIR(zmp)) * \
 	    (u_int64_t)(zmp)->zm_super.zs_block_size)
 
@@ -144,8 +155,7 @@ void		zlfs_clean(struct zlfs_mount *);
 
 /* zlfs_write.c */
 int		zlfs_write_block(struct zlfs_mount *, u_int64_t, const void *);
-int		zlfs_bmap_read(struct zlfs_node *, u_int64_t, struct buf **,
-		    u_int64_t *);
+int		zlfs_bmap_read(struct zlfs_node *, u_int64_t, u_int64_t *);
 int		zlfs_node_load(struct zlfs_node *);
 int		zlfs_node_resize(struct zlfs_node *, size_t);
 int		zlfs_dblk_prepare(struct zlfs_node *, u_int64_t, int);

sys/zlfs/zlfs_vnops.c

@@ -114,7 +114,7 @@ zlfs_dir_add(struct zlfs_node *dnp, const char *name, int namlen,
 		}
 	}
 	if (slot == (u_int64_t)-1) {
-		if (dnp->zn_datalen + ZLFS_DIRENT_SIZE > ZLFS_MAXFILESZ(zmp))
+		if (dnp->zn_datalen + ZLFS_DIRENT_SIZE > ZLFS_MAXDIRSZ(zmp))
 			return ENOSPC;
 		error = zlfs_node_resize(dnp, dnp->zn_datalen + ZLFS_DIRENT_SIZE);
 		if (error != 0)
@@ -471,7 +471,7 @@ zlfs_setattr(void *v)
 /*
  * Read regular-file data block by block: a block with a dirty overlay
  * buffer is served from it, everything else from disk through
- * zlfs_bmap_read (direct and single-indirect pointers).
+ * zlfs_bmap_read (direct, single- and double-indirect pointers).
  */
 int
 zlfs_read(void *v)
@@ -482,7 +482,7 @@ zlfs_read(void *v)
 	struct zlfs_node *znp = VTOZ(vp);
 	struct zlfs_mount *zmp = znp->zn_zmp;
 	struct zlfs_inode *zi = &znp->zn_dinode;
-	struct buf *bp, *ind = NULL;
+	struct buf *bp;
 	u_int64_t blkno, boff, size;
 	u_int32_t bsize = zmp->zm_super.zs_block_size;
 	size_t n;
@@ -515,7 +515,7 @@ zlfs_read(void *v)
 			continue;
 		}
 
-		error = zlfs_bmap_read(znp, blkno, &ind, &lba);
+		error = zlfs_bmap_read(znp, blkno, &lba);
 		if (error == 0 && lba == 0)
 			error = EIO;
 		if (error != 0)
@@ -528,8 +528,6 @@ zlfs_read(void *v)
 		if (error != 0)
 			break;
 	}
-	if (ind != NULL)
-		brelse(ind);
 
 	return error;
 }
@@ -938,7 +936,7 @@ zlfs_rename(void *v)
 			goto out;
 	}
 	if (tnp == NULL && fdvp != tdvp) {
-		if (tdnp->zn_datalen + ZLFS_DIRENT_SIZE > ZLFS_MAXFILESZ(zmp)) {
+		if (tdnp->zn_datalen + ZLFS_DIRENT_SIZE > ZLFS_MAXDIRSZ(zmp)) {
 			error = ENOSPC;
 			goto out;
 		}