From patchwork Wed Feb 21 23:39:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Blake X-Patchwork-Id: 876423 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zmvHq1528z9sW3 for ; Thu, 22 Feb 2018 10:45:43 +1100 (AEDT) Received: from localhost ([::1]:35310 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eoe4z-00025K-8d for incoming@patchwork.ozlabs.org; Wed, 21 Feb 2018 18:45:41 -0500 Received: from eggs.gnu.org ([208.118.235.92]:37420) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eoe3W-0001rH-0y for qemu-devel@nongnu.org; Wed, 21 Feb 2018 18:44:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eoe2C-0008Cr-FB for qemu-devel@nongnu.org; Wed, 21 Feb 2018 18:44:10 -0500 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:48182 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eodzb-0004a9-5Z; Wed, 21 Feb 2018 18:40:07 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 9253840201A4; Wed, 21 Feb 2018 23:40:05 +0000 (UTC) Received: from red.redhat.com (ovpn-122-122.rdu2.redhat.com [10.10.122.122]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1857AAF02C; Wed, 21 Feb 2018 23:40:05 +0000 (UTC) From: Eric Blake To: qemu-devel@nongnu.org Date: Wed, 21 Feb 2018 17:39:53 -0600 Message-Id: <20180221233953.5142-4-eblake@redhat.com> In-Reply-To: <20180221233953.5142-1-eblake@redhat.com> References: <20180221233953.5142-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Wed, 21 Feb 2018 23:40:05 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Wed, 21 Feb 2018 23:40:05 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'eblake@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v2 3/3] qcow2: Avoid memory over-allocation on compressed images X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, berto@igalia.com, qemu-block@nongnu.org, Max Reitz Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" When reading a compressed image, we were allocating s->cluster_data to 32*cluster_size + 512 (possibly over 64 megabytes, for an image with 2M clusters). Let's check out the history: Back when qcow2 was first written, we used s->cluster_data for everything, including copy_sectors() and encryption, where we want to operate on more than one cluster at once. Obviously, at that point, the buffer had to be aligned for other users, even though compression itself doesn't require any alignment (the fact that the compressed data generally starts mid-sector means that aligning our buffer buys us nothing - either the protocol already supports byte-based access into whatever offset we want, or we are already using a bounce buffer to read a full sector, and copying into our destination no longer requires alignment). But commit 1b9f1491 (v1.1!) changed things to allocate parallel buffers on demand rather than sharing a single buffer, for encryption and COW, leaving compression as the final client of s->cluster_data. That use was still preserved, because if a single compressed cluster is read more than once, we reuse the cache instead of decompressing it a second time (someday, we may come up with better caching to avoid wasting repeated decompressions while still being more parallel, but that is a task for another patch; the XXX comment in qcow2_co_preadv for QCOW2_CLUSTER_COMPRESSED is telling). Much later, in commit de82815d (v2.2), we noticed that a 64M allocation is prone to failure, so we switched over to a graceful memory allocation error message. Elsewhere in the code, we do g_malloc(2 * cluster_size) without ever checking for failure, but even 4M starts to be large enough that trying to be nice is worth the effort, so we want to keep that aspect. Then even later, in 3e4c7052 (2.11), we realized that allocating a large buffer up front for every qcow2 image is expensive, and switched to lazy allocation only for images that actually had compressed clusters. But in the process, we never even bothered to check whether what we were allocating still made sense in its new context! So, it's time to cut back on the waste. A compressed cluster written by qemu will NEVER occupy more than an uncompressed cluster, but based on mid-sector alignment, we may still need to read 1 cluster + 1 sector in order to recover enough bytes for the decompression. But third-party producers of qcow2 may not be as smart, and gzip DOES document that because the compression stream adds metadata, and because of the pigeonhole principle, there are worst case scenarios where attempts to compress will actually inflate an image, by up to 0.015% (or 62 sectors larger for an unfortunate 2M compression). In fact, the qcow2 spec permits up to 2 full clusters of sectors beyond the initial offset; and the way decompression works, it really doesn't matter if we read too much (gzip ignores slop, once it has decoded a full cluster), so it's feasible to encounter a third-party image that reports the maximum 'nb_csectors' possible, even if it no longer has any bearing to the actual compressed size. So it's easier to just allocate cluster_data to be as large as we can ever possibly see; even if it still wastes up to 2M on any image created by qcow2, that's still an improvment of 60M less waste than pre-patch. Signed-off-by: Eric Blake --- v2: actually check allocation failure (previous version meant to use g_malloc, but ended up posted with g_try_malloc without checking); add assertions outside of conditional, improve commit message to better match reality now that qcow2 spec bug has been fixed --- block/qcow2-cluster.c | 27 ++++++++++++++++++--------- block/qcow2.c | 2 +- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c index 85be7d5e340..7d5276b5f6b 100644 --- a/block/qcow2-cluster.c +++ b/block/qcow2-cluster.c @@ -1598,20 +1598,29 @@ int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset) sector_offset = coffset & 511; csize = nb_csectors * 512 - sector_offset; - /* Allocate buffers on first decompress operation, most images are - * uncompressed and the memory overhead can be avoided. The buffers - * are freed in .bdrv_close(). + /* Allocate buffers on the first decompress operation; most + * images are uncompressed and the memory overhead can be + * avoided. The buffers are freed in .bdrv_close(). qemu + * never writes an inflated cluster, and gzip itself never + * inflates a problematic cluster by more than 0.015%, but the + * qcow2 format allows up to 2 full clusters beyond the sector + * containing offset, and gzip ignores trailing slop, so it's + * easier to just allocate that much up front than to reject + * third-party images with overlarge csize. */ + assert(!!s->cluster_data == !!s->cluster_cache); + assert(csize < 2 * s->cluster_size + 512); if (!s->cluster_data) { - /* one more sector for decompressed data alignment */ - s->cluster_data = qemu_try_blockalign(bs->file->bs, - QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size + 512); + s->cluster_data = g_try_malloc(2 * s->cluster_size + 512); if (!s->cluster_data) { return -ENOMEM; } - } - if (!s->cluster_cache) { - s->cluster_cache = g_malloc(s->cluster_size); + s->cluster_cache = g_try_malloc(s->cluster_size); + if (!s->cluster_cache) { + g_free(s->cluster_data); + s->cluster_data = NULL; + return -ENOMEM; + } } BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED); diff --git a/block/qcow2.c b/block/qcow2.c index 288b5299d80..6ad3436e0e5 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -2103,7 +2103,7 @@ static void qcow2_close(BlockDriverState *bs) g_free(s->image_backing_format); g_free(s->cluster_cache); - qemu_vfree(s->cluster_data); + g_free(s->cluster_data); qcow2_refcount_close(bs); qcow2_free_snapshots(bs); }