Ronnie Sahlberg rsahlberg · review.whamcloud.com

LU-20238 ec: GFNI-accelerated EC primitives

Add a runtime-dispatched GFNI fast path to libec.a (LU-19465).
On x86_64 with GFNI, ec_encode_data(), ec_encode_data_update(),
ec_init_tables(), gf_vect_dot_prod() and gf_vect_mad() route to
AVX-512 or AVX2 GFNI kernels; everywhere else the existing
ec_*_base() path is used unchanged.

The kernels are C intrinsics (_mm{256,512}_gf2p8affine_epi64_epi8)
gated per-function with __attribute__((target(...))), so the build
needs only GCC >= 10 / clang >= 8 and no NASM.  They use only the
GF(2^8) affine instruction and XOR/load/store, not the PSHUFB
nibble-table lookup the ISA-L AVX2/SSE kernels rely on.

The multi-output AVX-512 dot_prod kernels take the coefficient as
an EVEX {1to8} embedded broadcast to keep it off Port5; compilers
will not emit {1to8} from intrinsics, so a short inline-asm macro
is used.  The mad kernels use _mm512_set1_epi64(), the coefficient
being loop-invariant there.
Against ISA-L's NASM kernels this reaches parity on AVX-512 (+1%
to -5%) and matches or beats NASM on 4 of 5 AVX2 benchmarks, the
one slower case by 6%.

A configure probe (EC_GFNI_SUPPORT) compile-tests the intrinsic
and defines LUSTRE_EC_GFNI for the libec.a build only.  It rejects
GCC 8 and 9, which mark GF2P8AFFINEQB commutative and can swap its
data and matrix operands, giving wrong parity.  Every
dispatch block is guarded by the pair defined(LUSTRE_EC_GFNI) &&
!defined(__KERNEL__), so no shipped consumer reaches a GFNI kernel
yet: ec.ko and liblustreapi both take the base path, and the
numbers above compare kernels directly rather than describing a
user-visible speedup.  Follow-on patches add the Kbuild plumbing
and the liblustreapi wiring.

gfni_ec_test checks that the GFNI and base paths produce identical
output, and exits 77 without GFNI so a caller can skip instead of
recording a base-against-base pass.  It installs with the test
suite; sanity-ec.sh test_0 sweeps geometries and lengths through
it.  -i picks the kernel family directly, because the runtime
dispatch always prefers AVX-512 and would otherwise leave the
AVX2 kernels untested on any CPU that has both.

The vendored gf_*_gfni.c kernels are reflowed for lustre
checkpatch; see lustre/utils/erasurecode/GFNI_VENDORED.md.

Test-Parameters: trivial testlist=sanity-ec
Signed-off-by: Hiroshi Nishida <hnishida@thelustrecollective.com>
Assisted-by: Claude:Opus-5 claude-code
Change-Id: Ia40a743c8e47c018250728668090215c7bd8365b

LU-17531 lfs: add 'mirror extend --no-resync' option

Allow adding a mirror without syncing its content
beforehand, so that it can be resynced later. The new
mirrors are marked stale and stay unusable until
"lfs mirror resync" is run. Merging a stale mirror needs FLR EC
enabled on both the client and the MDS (llite_enable_flr_ec and
mdt_enable_flr_ec, negotiated at mount), otherwise the extend is
refused.

--no-resync cannot be used with -f VICTIM_FILE or with --ec,
since the parity mirror is computed from up-to-date data.

Assisted-by: Codex:gpt-6.1-sol
Signed-off-by: Bobi Jam <bobijam@whamcloud.com>
Change-Id: I1b43fb0299c2aaea72587eff9168e4cdee075624

LU-12669 lov: slow and dead OST detection for degraded reads

A read of an EC file whose data stripe is on a dead OST waits for
the RPC's adaptive timeout, 7 s in production, before it is
reconstructed from parity; a slow OSS extends that with early
replies, and even a dead import costs the FLR retry rounds first.

Give such reads a soft deadline and route around the OST.  A
request past it fails with -ETIMEDOUT without failing the import or
touching the adaptive timeout.  Each OSC keeps a smoothed OST_READ
latency and deviation per RPC size, as for the TCP retransmission
timer, and a top-level no-delay read of an EC or mirrored file gets
a deadline, counted from its send, of the largest of
osc.*.slow_read_pct (default 300) percent of the smoothed latency,
that latency plus four deviations, and osc.*.slow_read_min_ms
(default 250 ms for a non-rotational OST, 2 s otherwise).  An
abandoned read marks the import slow for four times its deadline;
each further soft timeout before a successful read doubles the
deadline and the mark, up to the adaptive timeout.

LOV treats a deactivated, invalid, disconnected or slow-marked import
as unavailable, but not one reconnecting from idle.  A read of a dead
stripe is reconstructed at once when its raid set's own parity covers
its dead stripes, and of a slow-marked one only when it covers all of
its unavailable stripes; otherwise the read waits for them, e.g. until
an OSS failover completes.  A read spanning several raid sets waits if
any of them cannot be rebuilt.  With no in-sync parity the file reads
like a plain mirror.  A read of part of a raid set, whose
reconstruction reads many times its size, gets no soft deadline and is
not reconstructed around a slow stripe when most of the set's other
stripes are on OSTs running at over twice their median latency since
mount and over an eighth of slow_read_min_ms.  A plain mirror's
buffered reads get the same deadline and rotate mirrors on expiry,
unless no other mirror can serve the read.  An EC read skips the lock
and read of a stripe it reconstructs by having no sub-IO for it,
rather than through the lso_status shared with other readers.
osc.*.slow_read_stats shows the estimates and counters.

A 1MiB read of stripe 0 of a 4+2 EC file on an 8-OST VM, with one
30s stall of its OST (OBD_FAIL_OST_BRW_PAUSE_BULK), then 200 1MiB
direct and 200 4KiB buffered random reads while 4 writers load all
OSTs:

  slow_read_pct            0 (off)    300 (default)
  direct read, stall       30053ms    2069ms
  buffered read, stall     30055ms    2048ms
  reads under load: 0 soft timeouts, no extra parity or survivor reads

Also fix lov_io_set_range() rounding the reconstruction range end
past its component, which LBUGged "uncovered page!"; the
ra_cur_pages leak in ll_readahead_handle_work() when
cl_io_rw_init() fails, which stopped readahead for the mount; and
do_file_read_iter() never clearing via_hybrid_switched, which ran
later O_DIRECT AIO reads on the same lu_env synchronously.  Also fix
ll_readahead_handle_work() passing a page index and count to
cl_io_rw_init() as bytes, which routed async readahead of FLR and EC
files by the wrong extent, and the client io_latency_stats arrays
being one size short for a maximum-size RPC.

Add sanity-ec 54a-54k, and change test_29a to check that a read with
more stripes lost than parity waits for their OSTs.

Test-Parameters: testlist=sanity-ec ostcount=8
Test-Parameters: testlist=sanity-ec ostcount=8 fstype=zfs
Test-Parameters: testlist=sanity,sanity-flr ostcount=8
Fixes: c2791674260b ("LU-12043 llite: improve single-thread read performance")
Fixes: 3fc4243da7ef ("LU-13802 llite: tag switched hybrid IOs")
Fixes: 783c13bb0b8f ("LU-12669 ec: recover data from parity")
Fixes: d67cf23fb18a ("LU-18993 osc: Add IO RPC latency statistics by size")
Signed-off-by: Maximilian Dilger <mdilger@whamcloud.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I0913e1ee977c9850193c92835edb185b0aedc6d4

LU-12669 ec: wait for stripes that parity cannot rebuild

A read of an EC file whose raid set has more data stripes on stopped
OSTs than parity can rebuild fails with -EAGAIN or -EIO, while the
same read of a file without parity waits for the OSTs to return,
e.g. after an OSS failover.  Adding parity to a file should not make
it less available than a plain striped file.

When CIT_EC_RD finds too many unavailable stripes or too little
parity, set the new cl_io::ci_ec_wait, which cl_io_loop() turns into
a restart, and record that raid set's range.  Restart the read up to
the start of that raid set as CIT_EC_RD, so earlier raid sets are
still rebuilt from parity, then read that raid set as a plain read
without the no-delay flag, which waits for the stripes' OSTs.  The
rest of the read goes back to the no-delay read, so later raid sets
are also rebuilt from parity.  A synchronous direct read whose aio
was freed for the CIT_EC_RD restart gets a new one.  A read of a
deactivated OST still fails at once.  Since waiting for the OSTs is
not an error, print a debug message instead of a console warning.

Change sanity-ec test_29a to check that such a buffered or direct
read waits for its OSTs and then returns the right data, and add
test_29b and test_29c for reads whose second or first raid set is
rebuilt from parity.

Test-Parameters: testlist=sanity-ec ostcount=8
Fixes: 783c13bb0b8f ("LU-12669 ec: recover data from parity")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I9956bab1b63744d0b52d03268b95c78ca73ebbe5

LU-20967 osd-ldiskfs: name the failure_domain local file

The failure_domain file added in LU-19066 has no entry in the
osd_lf_maps[] table in osd_scrub.c, so osd_lf_fid2name() returns no
name for its FID and osd_obj_spec_insert() creates no directory entry
for it in the OST device root.  e2fsck then treats the inode as
disconnected and wants to reconnect it into lost+found:

  Pass 4: Checking reference counts
  Unattached inode 88
  Connect to /lost+found? no
  myfs-OST0003: ***** WARNING: Filesystem still has errors *****

Add a FAILURE_DOMAIN entry to osd_lf_maps[] with OLF_SHOW_NAME, like
health_check, so the file is linked into the device root under its own
name and e2fsck no longer reports an error.

Existing targets already have the unnamed inode, and the same can
happen to any named local file whose name is lost to directory
corruption that e2fsck repaired.  The initial OI scrub already walks
osd_lf_maps[] to drop stale OI mappings for files that no longer
exist; make it instead relink a file that still has a valid OI mapping
and inode but no name in the root, so such files are recovered on
mount rather than left unattached.  The relink is restricted to plain
named regular-file entries and keeps the OI mapping on a transient
failure, so an inode that still exists is never orphaned.

When e2fsck has already reconnected such a file into lost+found under
a numeric name, the OI scrub now renames it back out of lost+found to
its proper name during the lost+found scan, moving the single name
rather than adding a second one, so the link count stays correct.

Fixes: 612732b59482 ("LU-19066 obdfilter: Create a failure_domain file")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Co-authored-by: Chris Walker <chris.walker@netapp.com>
Assisted-by: ClaudeCode:claude-opus-4-8 ltvm llm_code_and_review_tools
Change-Id: Idf1c415213059670f4fbac1b708526acc73ebbe5

LU-19823 lod: fit EC raid sets to the OSTs without domains

With "lfs setstripe -c 6 --ec 6+3" on 8 OSTs, QoS shrank the single
raid set to 5+3 so that its parity fit, while RR placed all 6 data
stripes and then failed with ENOSPC when it found only 2 OSTs left
for the parity.  Which one ran depended on the free space balance of
the OSTs, so sanity-ec test_27h passed or failed depending on the
earlier tests.

lod_ec_fit_fdoms() already fits the raid sets to the failure domains
before either allocator places the data.  Without failure domains,
count each active OST as a domain of its own, so RR and QoS fit the
same K.  A -c component wider than the active OSTs is fitted by the
stripes it can place, and if its raid sets must shrink, still to at
least 3/4 of the requested K.  As with domains, a layout may be
stored with the smaller K of its raid sets.  Describe this in
lfs-setstripe.1.

Have sanity-ec test_27h check that a layout which can't fit fails, and
one that can gets fewer data stripes, with both the RR and QoS
allocators.

Fixes: c53abca9f9ee ("LU-19852 lod: raidset aware stripe allocator")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ief45b5df095e03fd96065b85eb6b1008bd3ebbe5

LU-8933 lod: leave inactive targets out of the RR array

Inactive OSTs stayed in the round-robin array, so every layout that
reached one skipped it and used up an index, and the OST after it in
the array got its share of first stripes as well as its own.

Leave inactive targets out of the array built by lod_qos_calc_rr(),
unless all of them are inactive, and rebuild the arrays when a target
becomes active or inactive, counted in lq_rr_gen along with failure
domain changes.  The RR allocators index the array by its own size
rather than the pool's.  The periodic statfs update still checks the
inactive targets, and notices when they become active again.  OSTs
that are full, read-only, or have max_create_count=0 are inactive for
this too, so they also leave the array until they can be used again.
This also stops directory stripes being allocated on an inactive MDT
that is not disconnected, e.g. one that is full or deactivated by
config, which lod_mdt_alloc_rr() and lod_mdt_alloc_qos() did not check
for.  Keep returning -EINPROGRESS when no target could be used and a
target of the pool is disconnected, or one left out of the array
became active since it was built, and don't let the smaller array
raise the rounds of an overstriped directory above
lod_max_stripes_per_mdt.  Overstriped OST layouts from the RR
allocator are likewise spread over the active OSTs only, e.g. "lfs
setstripe -C 8" with 1 of 8 OSTs inactive gets 8 stripes with 2 on one
OST, instead of 7 stripes.

Rebuilding the arrays after a target becomes active or inactive only
tries to take lq_rw_sem, and the allocators keep using the old array,
so creates don't wait behind allocators sleeping in precreate
(LU-15393).  Failure domain changes are now rebuilt the same way.
Only if the array stays stale for 10 * qos_maxage, or at once and then
every qos_maxage after an omitted target becomes active, does one
thread wait at most 2s for it, as QoS allocation does.  Move that
timed wait to lu_down_write_timeout() for both, and the backoff to
lu_rr_should_wait() and lu_rr_wait_failed(), which lod_rr_test checks.
Count the targets that become active in lq_active_gen for this.
Also avoid a static checker warning about lrfs_count - 1 underflowing
in lu_rr_fdoms_init().

Add sanity test_51i to check the first stripe balance and overstriping
with OST0001 deactivated, and test_51k to check that RR and QoS
directory stripes skip a deactivated MDT.  test_51i waits until every
OST has enough precreated objects, using up the short FID sequence
tail of any OST that has too few.  With 8 OSTs and 800 2-stripe files
test_51i gives these first stripes per active OST:

  before  50-200
  after   113-115

Check up to 32 OSTs in sanity test_51g, or 64 with SLOW=yes, and
check the OSSs used by other mirrors once per layout in lod_rr_test
rather than once per OST, so that test_51g takes about 20s.

Use the renamed timer cleanup API where available, with a fallback for
older kernels.

Fixes: ced540165ef5 ("LU-16623 lod: handle object allocation consistently")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Assisted-by: Codex:gpt-6.1-sol
Change-Id: I8361eea7d707559ba65a9377fa642ca7833ebbe5

LU-20211 mdt: trunc(0) layout replace on inactive stripes

When truncate(0) hits a file whose layout references deactivated or
disconnected OSTs, and the client advertises
OBD_CONNECT2_LAYOUT_REPLACE, replace the layout: move the old layout
onto a volatile victim and instantiate a fresh layout on the file from
the existing pattern via QoS/RR.  A full or read-only OST is still
usable and does not trigger this.  If the new layout cannot be
allocated, keep the old layout and do a normal trunc(0).
Skip it for a lease holder (MDS_TRUNC_KEEP_LEASE): lfs mirror resync
and copy truncate only one mirror, and the in-sync mirror must stay.
An OST is offline if it was deactivated or its OSP import is not
connected, which is checked directly since LOD only learns of the
disconnection at its next statfs refresh.

After the layout swap, do not update the parent FID of the volatile
victim's objects, which are destroyed on close, nor of any object on
an offline OST.  That update reads the object's filter_fid first, and
the RPC would wait for an unreachable OST while LAYOUT EX is held.
An OST that reconnects between the declare and execute passes is also
skipped at execute, since no OSP sub-transaction was declared for it.

Skip replace when any component has LCME_FL_NOSYNC.  That flag freezes
the mirror's existing objects; swap would discard the snapshot.  The
NOSYNC test runs once, inside mdt_replace_unavailable_layout(), which
returns 0 so setattr falls through to a normal trunc(0).

mdt_reint_setattr() does not check NOSYNC.  It probes for an
unavailable layout before mdt_attr_set() and without a DLM lock, so a
healthy trunc(0) skips LAYOUT EX.  If the probe finds one,
mdt_attr_set() takes UPDATE|LAYOUT|XATTR EX in a single enqueue and
replaces the layout under it.  A second lock on the file while the
saved UPDATE lock is held could queue behind a setxattr waiting for
both, and deadlock (LU-3601).  The unavailable-stripe result is
re-checked under the lock, so a concurrent trunc(0) that already
replaced the layout does not allocate a second set of objects.

Extend the layout API with MD_LAYOUT_UNAVAILABLE (detect stripes on
offline OSTs) and MD_LAYOUT_INSTANTIATE (allocate from a source
pattern).  Add lod_generate_lovea_template() to emit uninstantiated
LOVEA templates that omit placement hints so new stripes use QoS/RR,
and trigger replacement from mdt_reint_setattr() via
mdt_replace_unavailable_layout().

Layout-type handling for templates / instantiate:
- DoM: never carries OST objects; force stripe_count to 0 and skip
  the OST object array so LOVEA size matches INIT DoM.
- PFL/DoM: keep the DoM component and replace only OST components.
- SEL: coerce LOV_MAGIC_SEL to COMP_V1 for lod_qos_parse_config();
  keep LCME_FL_EXTENSION and restamp SEL when LOVEA is written.
- EC: re-emit bound data/parity as unbound (IS_LINK_ID + shared
  link id) so lod_qos_prep_create() can pair before component IDs
  exist.

Layout replace creates a volatile victim via mdt_orphan_open().
Set mlc_no_inherit on MD_LAYOUT_INSTANTIATE so the new layout does
not inherit the local ROOT default pool from the orphan parent.
Zero mti_spec first defensively before the volatile create;
mdt_thread_info_reset() already clears it per request, and setattr
does not leave create state there.

After a successful swap, sync the object before replying so the new
layout is durable; replay skips replace.  On success, return
MS_LAYOUT_REPLACED (with OBD_MD_FLEASIZE) in the setattr reply so
the client applies the new LOVEA.  Before applying it, the client
discards its dirty pages past the returned size (all of them for
trunc(0)), so prune does not write them back to unavailable OSTs.
This lets a later server replace only the OST objects past a
non-zero truncate size.  The client reserves the default layout size
in the setattr reply buffer of any truncate.  A resent trunc(0)
setattr (lost or truncated reply) returns the current layout with
MS_LAYOUT_REPLACED, whether or not the original request replaced it;
the client ignores a layout whose generation is unchanged.

Add sanity/test_27xt (plain, PFL/DoM, SEL), sanity-ec/test_74b (EC),
and sanity-flr/test_50e (mirrors, resync), which stop the OST.  Add
sanity/test_27xv, which holds the replace with
OBD_FAIL_MDS_LAYOUT_REPLACE_PAUSE while a setxattr from a second
mount waits for the file, with sync_lock_cancel=never so the saved
UPDATE lock stays PW, to check for the deadlock.

Test-Parameters: testlist=sanity serverversion=2.17 env=SANITY_EXCEPT="24D 27D"
Test-Parameters: testlist=sanity-flr ostcount=5 serverversion=2.17 env=SANITY_FLR_EXCEPT="0a 34b"
Test-Parameters: testlist=sanity clientversion=2.17
Assisted-by: Cursor:Grok-4.6 llm_code_and_review_tools
Signed-off-by: Keguang Xu <kxu@ddn.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Assisted-by: Cursor:Composer
Change-Id: I07e0792a51e144d935cece4b028e17f659e4ccfd

LU-19066 target: add failure domains for MDT devices

A per-OST failure_domain was added so the MDS can keep mirror and EC
parity stripes in different hardware fault domains from the data
stripes.  MDTs have no equivalent, so fault domains cannot be taken
into account when placing remote directories or DNE layouts across
MDTs.

Add the same failure_domain to MDT devices.  Move the local-file
read/write code out of the OFD into generic tgt_failure_domain_read()
and tgt_failure_domain_write() helpers in the target layer shared by
OST and MDT, and rename OFD_FAILURE_DOMAIN_OID to FAILURE_DOMAIN_OID.
The MDT loads its failure_domain at setup, exposes it through the
mdt.*.failure_domain parameter, and reports it in obd_statfs so that
"lfs df --mdt=N --output=domain" and the LOD object allocator can use
it, as for OSTs.

Also make the shared helper safe on a read-only device: read without
creating the file and write returns -EROFS, so an rdonly_dev or
snapshot mount of a target formatted before the file existed still
works.

The failure_domain is a lone __u32 with no invariant tying it to any
neighbouring field, so access it with READ_ONCE()/WRITE_ONCE() rather
than taking ofd_flags_lock, keeping a lock out of the OST_STATFS reply
path, as suggested in review of the LU-17000 data-race fix.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: I7b9c4d89652efb30aee25ef5484b4873de3ebbe5

LU-20565 tests: run sanity-ec with fewer OSTs

On a filesystem with 4 OSTs, sanity-ec subtests 4e, 5b, 6d, 6e, 6f,
7a, 23a, 23b, 23c, 24a, 25a, 26a and 28a would fail in "lfs setstripe"
with "No space left on device (28)", because they hard-code an EC 4+2
geometry and the raidset allocator needs 6 distinct OSTs for it.

None of these subtests depends on that geometry, so use the EC_ARG,
EC_DSTRIPE and EC_CSTRIPE defaults that enable_ec() scales to OSTCOUNT
for the layout and the expected stripe counts.  Size the sanity-ec/26a
file and overwrite from EC_DSTRIPE so it still covers 5 full rows.

Test-Parameters: trivial testlist=sanity-ec
Test-Parameters: testlist=sanity-ec ostcount=4
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Change-Id: Ie76079973f5ee62cb77888d448194913693ebbe5

LU-9 lod: weighted round-robin QoS allocation

When OST free space is unbalanced, lod_ost_alloc_qos() picks each
stripe at random, weighted by free space less penalties for recently
used OSTs and OSSs.  The random choice only balances allocations on
average, so some OSTs get far more or fewer objects than their share,
and first stripes are not balanced at all.

Use the round-robin array and start index for QoS allocation too, and
map each round-robin index to an OST by weight, so that OSTs are used
in proportion to their free space, and in round-robin order if their
free space is the same.  Each pass through the array spaces its
indices evenly over the total weight, at least as far apart as the
largest weight so that consecutive indices use different OSTs, or one
per OST if the weights are nearly equal.  After every index has been
used as a start, the spacing is shifted by a golden ratio fraction, so
that OSTs whose weight is not a multiple of the spacing get their
share over several passes.  An OST gets at most one stripe of a
layout, so cap the weights at 1/stripes of the total and share the
rest among the other OSTs by weight, and overstriped layouts other
than EC still fall back to round-robin allocation.

Drop the penalties from the OST weights, since they only served to
spread the random choices, so the tgt_penalty values shown by
lod.*.qos_ost_weights no longer affect OST allocation.  qos_prio_free
now moves the weights above the average down toward it, so 100%
allocates in proportion to free space, and 0% uses the OSTs with more
than the average free space equally.  Fuller OSTs keep a weight in
proportion to their free space.  lod.*.qos_ost_weights shows the
weights that are used.  Scale the weights down by a power of two if
needed so their sums cannot overflow.  MDT QoS allocation and the
qos_threshold_rr and qos_prio_free defaults are unchanged.

An OST that can't be used for a stripe now only moves that stripe on
to the next OST in the array.  Before, the random choice skipped the
weight of avoided, used or failing OSTs differently than it summed
it, so allocation often failed and fell back to round-robin when
OSTs were offline (LU-20526).  Also return success when a layout
using the default striping gets fewer stripes than requested but at
least the minimum, instead of -ENOSPC, which skipped the round-robin
fallback and failed the create.

Add lod.*.qos_wrr_enable, 1 by default, which can be set to 0 to pick
the OSTs at random by the same weights, without the penalties, as a
fallback in case of problems with weighted round-robin allocation.

Add man pages for lod.qos_threshold_rr, lod.qos_prio_free,
lod.qos_maxage and lod.qos_ost_weights, and their mdt_ versions, and
for lod.qos_wrr_enable.  Also fix lod.*.qos_maxage, which showed
mdt_qos_maxage.

Add a QoS mode to lod_rr_test and run it in sanity test_51g, and add
sanity test_51h to run test_51d with qos_threshold_rr=0, and to check
that qos_wrr_enable=0 uses all OSTs.  Repeat the creates of test_51d
if an OST starts a new FID sequence during them, since it has no
precreated objects for a while.  lod_rr_test with 3-48 OSTs on 2-4
OSSs, and more free space on the last OSS, finds these fail to put
4/5-5/4 of each OST's capped share of objects on it, or 2/3-3/2 of its
share of first objects.  Before is modelled as the weighted random
choice without penalties:

                           before         after
  2x free space            335/3516       0/3516
  4x free space            1665/3516      0/3516
  10x, qos_prio_free=90%   2305/3516      0/3516
  2x, qos_prio_free=50%    160/3516       0/3516
  10x on one OST, 1-4 OSS  2712/4689      0/4689

For example 16 OSTs on 2 OSSs, 4 stripes, 4x free space on OSS1:

             OSS0 OSTs            OSS1 OSTs
             objects  #0 objects  objects  #0 objects
  before     167-191  34-44       605-636  136-188
  after      156-164  39-41       640      160
  wanted     160      40          640      160

Fixes: ced540165ef5 ("LU-16623 lod: handle object allocation consistently")
Signed-off-by: Frederick Dilger <fdilger@whamcloud.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ie314438e03f867fe978adc37d62b504532961cd2

LU-12669 llite: make AIO reads on EC file synchronous

For sync DIO, EC recovery on read failure runs inline in
ll_file_io_generic() after cl_sync_io_wait_recycle().  AIO
has the same recovery requirement but cannot run recovery
from the sub-DIO completion path: ll_file_io_generic()
returns -EIOCBQUEUED to the VFS before the BRW completion
fires, so the syscall context recovery needs (the lu_env,
the user's iov_iter, the range lock) is gone by the time the
read error is known.

Rather than building a workqueue-based async recovery path,
make AIO reads on EC files behave as sync DIO: after
cl_io_loop(), for an AIO read on a layout with a parity
mirror, set cda_no_aio_complete and cda_creator_free to
disarm the async ki_complete path, then drop into the same
wait + restart code sync DIO uses.  The VFS calls
ki_complete itself when we return.

The check is on the whole layout, not on the component at
the read offset, so a read starting in a plain component is
drained on its first pass too.  Otherwise an error from that
pass surfaces in a later EC pass, which reconstructs only
its own range and reports the earlier bytes as read.  For
the same reason, an AIO read whose layout gains a parity
mirror after an earlier async pass has moved bytes stays
async, and reports a read error as it would on a plain file.

The flag flip is race-free because the submission ref on
cda_sync is still held: end_io cannot fire until we drop it
in cl_sync_io_wait_recycle().

This disables async semantics for every AIO read on an EC
file, not only those that need recovery. We cannot tell at
submission time whether reconstruction will be needed, so
the sync conversion drains queued IO even when submission
requests a restart without returning -EIOCBQUEUED.  As a
side effect, the range_lock taken by ll_file_io_generic() is
now held until all sub-DIOs have drained, instead of being
dropped while they are still in flight.

Do not retry -EINVAL or -EFAULT as a reconstruction read,
for sync DIO or AIO: they reject the request itself, so an
unaligned O_DIRECT read fails on an EC file as it does on a
plain file.

Re-enable the existing degraded AIO regression tests now
that these reads use the synchronous recovery path. Cover
an inactive later stripe in a single multi-stripe AIO, and
a failed plain component ahead of an EC one.

Test-Parameters: testlist=sanity-ec
Test-Parameters: testlist=sanity-ec fstype=zfs
Assisted-by: Opus:4.8 llm_code_and_review_tools
Assisted-by: Codex:gpt-6.1-sol
Signed-off-by: Patrick Farrell <pfarrell@whamcloud.com>
Signed-off-by: Marc Vef <mvef@whamcloud.com>
Change-Id: I394a3610e33b29ead8f5adb52dfa21db6b721944

LU-12669 lov: split EC reads at a raid set parity cannot cover

A read of an EC file that touches a raid set with more dead stripes
than its parity can stand in for waits for their OSTs, even for the
dead stripes of raid sets that parity could rebuild, so the whole read
waits for every dead OST.  Reconstructing the whole read instead fails
on that set with -EIO, as a CIT_EC_RD cycle covers all raid sets of a
row at once.

Stop the read where the first raid set of the other kind starts, and
restart the rest there: a reconstruction stops before a set that
cannot be rebuilt (cl_io::ci_ec_split), and ll_file_io_generic()
restarts the rest as a CIT_READ, which waits for that set; a read that
waits stops before a set that can be rebuilt.  A failed direct read
whose DIO state is already freed keeps restarting as CIT_EC_RD.  A
large read() across many rows with alternating raid sets uses three
restarts per row, as going back to reconstruction restarts once more
as CIT_READ and then as CIT_EC_RD, so it returns short after about 333
such rows, once RETRY_ATTEMPTS restarts are used up.

Add sanity-ec test_72a, which reads two rows and brings back only the
raid set that cannot be rebuilt, and checks that the read completes
with the data stripe of the other set still down.

Test-Parameters: testlist=sanity-ec ostcount=8
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: I21a023db83276919086acb9bc75cbf3d733ebbe5

LU-12668 utils: resync EC parity with mirror resync API

'lfs mirror resync' would resync stale data components with
llapi_mirror_resync_many_params() and then stale parity components
with a separate llapi_ec_resync_many_params().  Other callers of the
generic resync functions would never resync parity, and parity
components passed to llapi_mirror_resync_many_params() would have
file data copied into them.  Running `lfs mirror resync --only' on
a data mirror would also leave the stale parity protecting it, as
only the parity mirror's own id selected parity components.

Instead, resync parity components in llapi_mirror_resync_many_params()
from the data components they protect, after the data components have
been copied, and skip a parity component whose data component failed
in the same call.  Count --stats and bandwidth progress once over
both, with the EC struct llapi_resync_progress.  Replace
llapi_ec_resync_many_params() and llapi_ec_find_stale(), which are not
yet included in a release, with llapi_mirror_find_stale_flags(), which
collects the stale data components and, with LCME_FL_PARITY, then the
stale parity components, also those protecting a mirror given in
@mirror_ids, and resync both kinds of component in one call from
lfs.  With LCME_FL_NOSYNC it also collects the components of NOSYNC
mirrors without listing them in @mirror_ids.
llapi_mirror_find_stale() still returns only data components, for
callers that copy data themselves.

An error in one component no longer undoes the others: lrc_synced
stays set for each component that was synced, and lfs still clears
LCME_FL_STALE from those before returning the error.
'lfs mirror resync --force-resync' now marks components to be synced
as llapi_mirror_find_stale() does, not after.

Add man pages for llapi_mirror_find_stale(3), covering the new
llapi_mirror_find_stale_flags(), and llapi_mirror_resync_many(3).

Add sanity-ec test_12i.

Test-Parameters: testlist=sanity-ec,sanity-flr
Fixes: 03191be6f459 ("LU-12668 ec: add support to resync stale ec comps")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ic40b61c233d1898cd75b30afe01adb45e23ebbe5

LU-19298 lod: use Xarray instead of static arrays for comp entires

The LOD layer implements very large static arrays to manage the
component entries for each layout. This works well for the case
that all the components are for block I/O that are expected to
be aligned to each other in a specific order. In such cases the
API works to add or delete components at the end of such layouts.
With the upcoming introducting of parity and foreign components
the rules change in that you can delete or add a component
located in the middle of the layout. This would be very
complicated when using static arrays.

To make life easier for upcoming projects we move away from
static arrays to using Xarrays. We no longer requires creating
a whole new array and copying components over. Instead we just
insert or delete components into the Xarray. This current
implementation just does the change from static arrary to
Xarray without truly introducing gaps in the Xarray. This can
be done in follow on patches and can be used to greatly simplify
the code. For example since "gaps" are allowed in the Xarray
we can place components in the Xarray using the mirror id as
apart of the index which mirrors the component ID. This removes
the need to manage the new mirror ranges in the Xarray.

Change-Id: I67020f899ad89bfa6095c4b22f7f1b07b6de3e86
Signed-off-by: James Simmons <jsimmons@infradead.org>

LU-19823 lod: unique failure domains per EC raid set

With "lfs setstripe -c N --ec K+M" the allocator required every data
and parity stripe of the component to be in a different failure
domain, while with -C this was only needed within each raid set.
A wide file such as "-c 40 --ec 8+2" on 40 OSTs needs 10 domains
per raid set but 50 for the component, so it failed with ENOSPC
unless the file was overstriped.

Each raid set is protected on its own, so require different failure
domains only within each raid set, for both -c and -C.  With -c the
data stripes are still on different OSTs, so the file can use the
bandwidth of all OSTs, and parity shares OSTs with the data of other
raid sets.  A -c component short of OSTs is split into raid sets
again after its stripes are placed, so keep each run of consecutive
data stripes as long as the largest possible raid set in different
domains.  QoS no longer trims the data stripes of a -c component with
several raid sets to leave separate OSTs for its parity.

Each raid set still needs its data and parity stripes in different
failure domains, but the data stripes of a -c component need fewer, so
with too few domains the data could be placed and the RR allocator
then accepted a parity component with too few stripes.  Check the
domains before placing the data, and use raid sets of fewer data
stripes, down to K - K/4 as in lod_stripe_count_min(), or fail with
ENOSPC.  A single raid set gets fewer data stripes, so "-c 3 --ec 2+1"
with 3 domains becomes "-c 2 --ec 2+1".  Also fail a parity component
that RR could not place completely, as QoS does, since other mirrors
can use up domains that this check does not see.

An EC file is also two mirrors, so the FLR check required different
domains for all stripes of the data component too.  Leave the domains
within an EC component to the EC check.

Also fix lod_comp_find_linked() matching a plain mirror component to
the parity of an EC mirror, which let the plain mirror share a failure
domain with that parity, and restore the count of OSTs available to
mirrors when QoS gives up, so the RR fallback can place EC stripes.

Rename lod_fd_check_*() to lod_fdom_check_*() so "fd" is not read as a
file descriptor.  Describe the mirror rules in
obdfilter.failure_domain.4 and reference it from lfs-setstripe.1,
lfs-mirror-create.1 and lfs-mirror-extend.1.

Fixes: 026de09ead3d ("LU-19823 lod: Make the stripe allocators failure domain aware.")
Fixes: c53abca9f9ee ("LU-19852 lod: raidset aware stripe allocator")
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ic197df8fba1a9e0a313442cc435d1959763ebbe5

LU-12669 ec: fix degraded read page leak and short read

Fix two bugs in degraded EC reads:

- Pages rebuilt from parity stay busy on the OSC until their lock is
  cancelled, as only a completed transfer puts a page on the LRU
  list.  A degraded read of more than max_cached_mb then waits in
  osc_lru_alloc() forever.  Add cl_page_lru_add() (cpo_lru_add) so
  vvp_io_ec_rd_end() puts each rebuilt page it keeps on the LRU
  list.

- While the OST of the last stripe is unavailable the file's KMS is
  short, and vvp_prep_size() of a concurrent read writes it to i_size.
  An EC read near EOF then reads that i_size back and returns no data,
  or its copy-out stops at it.  Keep the MDT size that
  vvp_update_inode_size() got, raise i_size for the whole read, and
  restart if i_size still cuts it short.

Add sanity-ec test_49g for the page leak, and test_51b, with two new
fail_locs, for the short read.

Test-Parameters: testlist=sanity-ec ostcount=8
Fixes: 783c13bb0b8f ("LU-12669 ec: recover data from parity")
Fixes: 240cad9a0a82 ("LU-19344 llite: set read size correctly")
Assisted-by: ClaudeCode:claude-opus-5.5 llm_code_and_review_tools
Signed-off-by: Maximilian Dilger <mdilger@whamcloud.com>
Change-Id: Ie052eeefc07d5bdb67d93c2307c47a3968441bd5

LU-20690 ec: copy parity in 1+N recovery reads

A raidset with one data stripe stores a copy of that stripe in each of
its p parity objects: llapi_ec_compute_parities() memcpy()s the data
instead of calling ec_encode_data() when k == 1, so --ec 1+N writes p
identical copies.  The client recovery path did not know this and
always ran the Cauchy decode, where the coefficient of parity stripe i
is gf_inv(i + 1).  Only parity stripe 0 has coefficient 1, matching
what is on disk.  A read that lost the data stripe and parity stripe
0, and fell back to any other parity, thus returned data * 2, * 3,
... rather than the data.

Copy the first parity page that could be read over the error page
when the raidset has one data stripe, in lov_ec_recover_page().  The
RS setup is of no use in that case either, so skip the encode matrix
in lov_ec_bufs_alloc() and the scratch matrices, GF tables, matrix
inversion and ec_init_tables() in lov_ec_recover_init() when dcount
is 1.

Add sanity-ec test 40e, which fails the data OST and the OST of
parity stripe 0 in a 1+2 layout, so the read has to be rebuilt from
parity stripe 1.

Test-Parameters: testlist=sanity-ec ostcount=8
Signed-off-by: Bobi Jam <bobijam@whamcloud.com>
Assisted-by: AugmentAgent:DeepSeek-V4.1-Flash
Change-Id: Idbe55e61f464d1e91bb5093bf1c41442dc588f72

LU-20690 ec: store EC parity like RAID10

The k >= p restriction is not a Cauchy/ISA-L limit. It comes from
storing parity as RAID0|PARITY: the p parity objects of a raidset are
concatenated along the file offset, so raidset_count * p * stripe_size
does not fit in a finite PFL extent when p > k (for example
--ec 2+3 -E 2M). This patch changes the parity layout; the p <= k
checks in lfs and llapi stay until a following patch removes them.

Store EC parity as LOV_PATTERN_PARITY instead. A raidset is an EC
split of the stripe set, and the layout is like RAID10 in that it has
the same two axes:

  - across the raidsets of one stripe set: like RAID0, one
    stripe_size per raidset;
  - within one raidset: like RAID1, the p parity stripes share one
    file offset (the same object_off).

The RAID1 axis comes from recovery. A raidset of k data and p parity
stripes survives the loss of any p of its k + p stripes, just as a
RAID1 of p + 1 copies survives the loss of any p copies. RAID1 is the
k == 1 case, where each parity is a copy of the data (--ec 1+N). The
p parities protect the same data, so they share its offset: the
offset says which data is protected, the parity index says which
redundancy unit it is.

What differs from RAID1 is I/O, not the role. For k > 1 the parities
are not replicas: each holds a different parity, and a lost stripe is
rebuilt from any k survivors rather than copied from one. The parity
uses the extent of the data component.

RAID0 places data rows from file offset 0, whereas counting EC rows
and raidsets from e_start groups the wrong k stripes when e_start is
not a multiple of the data stripe width: the stripes EC groups as one
raidset are not the objects lod paired with that raidset's parity
OSTs, and a degraded read rebuilds a lost stripe from the wrong
parity. For example -E 4M -c 1 -E eof -S 1M -c 8 --ec 4+1 puts offset
4M on object 4 (raidset 1), which counting from e_start encodes into
the parity of raidset 0. When e_start is not a multiple of
stripe_size, as after a 64K DoM component, counting stripe_size
parity slots from e_start also splits stripes at
e_start + n * stripe_size and overflows e_end.

Count rows and raidsets from file offset 0, as RAID0 maps the data
objects:

  row = off / (stripe_count * stripe_size)
  ec_off = O
      + (row - row of e_start) * raidset_count * stripe_size
      + raidset * stripe_size + off % stripe_size

Data before e_start is taken as zero, and so is its parity, which is
not stored: the origin O moves back from e_start over the raidsets of
the first row that end before e_start, and over the part of the
raidset of e_start below e_start % stripe_size when e_start is in its
last data stripe. slot % raidset_count stays the raidset, so the
parity OSTs lod pairs are unchanged, and every stored parity byte has
data in the component. Common DoM and PFL layouts with an unaligned
e_start are supported and keep their parity within [e_start, e_end),
such as:
- -E 64K -L mdt -E 1M -c 1 -S 1M -E eof -c 4 -S 4M --ec 4+2;
- -E 64K -L mdt -E 16M -c 2 -S 1M -E eof -c 4 -S 4M --ec 2+2;
- -E 64K -L mdt -E eof -c 4 -S 1M --ec 2+2;
- -E 1M -c 1 -S 1M -E 64M -c 1 -S 4M -E eof -c 4 -S 4M --ec 4+2.
When every raidset has one data stripe (--ec 1+N, or one data
stripe), there is one parity slot per data stripe and nothing to
pack, so rows and O count from file offset 0, as RAID0 does: ec_off
is the data offset, and each parity object is a copy of its data
object at the same object offsets, so it can stand in for it.
Otherwise O depends only on e_start, the data stripe count, k and the
stripe size, not on e_end, and when e_start is a multiple of the
stripe width, O is e_start.

Add ec_raidset_count(), ec_raidset_first(), ec_stripe_to_raidset()
and ec_off_to_raidset_offset() next to ec_split_stripes() in
lustre_user.h, and struct ec_parity_geom with ec_parity_geom_init(),
ec_data_to_parity() and its inverse ec_parity_to_data(), with
ec_parity_width() for the parity bytes of one stripe set, and use
them in lov, lod and llapi instead of open-coding the k0 * n0 split.
ec_parity_geom_init() also records the data row of parity slot 0 in
epg_row0 (0 for 1-data raidsets).
lov caches O in lsme_parity_origin when the layout is unpacked and
returns it from lsme_stripe_origin(), and lov_parity_geom_init()
fails a degraded read whose pair does not match in stripe size,
raidsets or origin; the parity mirror EOF of such a pair is also
bounded by one parity row per stripe set from e_start. Raidset
objects before e_start read as zero in degraded reads and resync.
A read is widened to whole raid sets, but not past the e_end of its
component, so a read ending there does not start an empty recovery
cycle for the next component's first raid set, which may begin before
its e_start.
lsme_parity_raid10() now just returns lsme_is_parity(), as every
parity component is LOV_PATTERN_PARITY, and
lsme_parity_slots_per_raidset() is dropped.

A component shorter than one stripe (e_end < e_start + stripe_size)
whose raidset continues past e_end (e.g. [64K, 1M) with -S 1M -c 2
--ec 2+2, or [1M, 4M) with -S 4M -c 2 --ec 2+2, where the second
stripe is never reached) still has no room for a full stripe_size
parity slot from e_start. ec_parity_fits() detects it:
llapi_layout_sanity() refuses it with LSE_EC_PARITY_FIT,
llapi_ec_check_comp_match() refuses to resync or verify it, and
lod_comp_prep_create() checks it again with the final data stripe
count, also for lfs mirror extend --ec.

The lov slot geometry, the STRIPE I/O scope and the per-stripe llapi
helpers were added by the previous patches and only take effect for
LOV_PATTERN_PARITY. This patch switches the encoding so they apply:
llapi_pattern_to_lov() and llapi_layout_to_lum() emit
LOV_PATTERN_PARITY, lov_pattern_supported() accepts it in place of
RAID0|PARITY (and lov_pattern_available() via that), and lod allocates
and verifies parity components with it. EC has not shipped, so the old
combination is not kept. Finite-extent stripe-count shrinking, now in
one lod_comp_shrink_to_extent() helper instead of three copies, is
skipped for parity components. lsm_unpackmd_comp_md_v1() and
lod_verify_striping() reject a component whose LCME_FL_PARITY flag and
LOV_PATTERN_PARITY disagree, since the parity geometry follows the
flag.

vvp_prep_size() no longer writes KMS into i_size for parity I/O.
ci_parity_eof is derived from i_size, and KMS is only a lower bound
of the data size, so a parity read within KMS shrank ci_parity_eof
for later parity I/O.

Userspace resync and verify move to the RAID10 offsets: one
stripe_size per raidset, each parity addressed by its stripe index,
leaving the part of the first parity slot below e_start alone. The
punch, zero-fill and hole verify of a parity slot are bounded by the
e_end of its component; no slot runs past e_end while
ec_parity_fits() holds, so this is only a defensive bound. Hole
punch-or-clear and hole verify loop over the p parity stripes that
share an offset when they fall back to zero-fill or zero-content
reads.

lfs setstripe --yaml parses the pattern as the comma-separated flags
lfs getstripe -y prints, so "parity,overstriped" keeps overstriping.

lfs mirror read of a parity mirror still dumps every parity object in
RAID0 order, through mirror_dump_parity() in lfs, from e_start.  The
dump of a component stops at its e_end: when the extent is not a
multiple of the data stripe set, the raid sets of the last row past
e_end hold the data of the next component.  The glimpse lock of such
a read spans every component, so lov_lock_sub_init() no longer
rejects a glimpse because a component the I/O does not cover has
fewer parity stripes than the designated one; lov_io_iter_init()
checks the components the I/O covers.

Example: -E 128M -c 11 -S 1M --ec 4+2

  data/parity extent [0, 128M)
  raidsets [4,2], [4,2], [3,2] (raidset_count=3)
  parity has 6 OST objects
  one data stripe set = 11M
  one parity stripe set = 3M (not 1M flat, not 6M concat)

  stripeset raidset data_pos    ec_off  concat  objects
  --------- ------- ----------- ------- ------- -------
  0         0       [0, 4M)     0       0       0,1
  0         1       [4M, 8M)    1M      2M      2,3
  0         2       [8M, 11M)   2M      4M      4,5
  1         0       [11M, 15M)  3M      6M      0,1
  1         1       [15M, 19M)  4M      8M      2,3
  1         2       [19M, 22M)  5M      10M     4,5

The concat column is what RAID0|PARITY would have used, and is what
overflows a finite extent when p > k.

Tests: sanity-ec 12c/12d/34c cover
holes and multi-raidset offsets, 30d and 31b-31e check the parity dump
size, 34d dumps a mixed-p mirror whose first extent is not a multiple
of the stripe set, 63d recovers reads from parity of raidset 1 in a
PFL component that does not start at 0, 301 covers an e_start that
stripe_size does not divide and checks that a component whose parity
would pass e_end is refused for that reason, 302 resyncs, verifies and
reads degraded common PFL layouts with an unaligned e_start, 303
recovers reads when e_start is not a multiple of the stripe width,
with equal and unequal raidsets, 304 covers zero-fill before e_start,
305 truncates at raidset and unaligned component boundaries, and 306
reads degraded across a component boundary where the raid set of the
first component runs into the next one.
llapi_layout_test asserts the component pattern is LLAPI_LAYOUT_PARITY
and 68 checks the parity placement over a range of geometries and
extents, and that 1-data raidset copies are at the data object
offsets.

Test-Parameters: testlist=sanity-ec ostcount=8
Test-Parameters: testlist=llapi_layout_test
Test-Parameters: testlist=sanity-ec ostcount=8 fstype=zfs
Signed-off-by: Keguang Xu <kxu@ddn.com>
Signed-off-by: Ronnie Sahlberg <rsahlberg@whamcloud.com>
Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: Cursor:Composer/Opus5.5 llm_code_and_review_tools
Assisted-by: ClaudeCode:claude-opus-5-5 ltvm llm_code_and_review_tools
Assisted-by: ClaudeCode:claude-fable-5-1 llm_code_and_review_tools
Change-Id: I9574df44969ddd40776f028b3c326d150ea08eb5

LU-15834 lfs: mirror extend take current OSTs into account

Makes mirror extend try to allocate different OSTs from existing
mirrors.

When extending a mirror, the source file FID is stored in the victim
layout's first component's object l_ost_oi::oi_fid, also set a
special flag LCME_FL_FOR_MERGE in the component.

As LOD parses this merge victim layout, it extracts the source file
FID in lod_object::ldo_merge_src_fid, and as LOD is trying to
allocate OST objects, it would try to avoid those OST indices already
used in the overlapping components from the source file.

Signed-off-by: Bobi Jam <bobijam@whamcloud.com>
Change-Id: I8bcb0411ed64447c34fa8c1443c45a3888d73842

LU-20958 llite: drop strict SOM size with the UPDATE lock

A strict SOM size and blocks from the MDS are only valid under the
MDS UPDATE lock: a write or truncate of the file takes LAYOUT|UPDATE
in EX mode before the MDS marks the SOM stale.  The client kept
OBD_MD_FLSIZE|OBD_MD_FLBLOCKS in lli_attr_valid after that lock was
cancelled, so anything trusting them without a getattr would use a
size from before another client's write.  stat() was not affected,
since ll_getattr() revalidates first, but EC lseek and the fsync
blocks update are about to rely on these bits.

Clear them from lli_attr_valid when the UPDATE lock is cancelled, so
the next getattr fetches them again.

Add sanity-flr test_44i, which writes a mirrored file with a strict
SOM size and checks the blocks stored at close.

Signed-off-by: Andreas Dilger <adilger@thelustrecollective.com>
Assisted-by: ClaudeCode:claude-opus-5.5 ltvm,llm_code_and_review_tools
Change-Id: Ice12d7b03bb2b78e4f6b1f839d4b8ac4b03ebbe5

LU-20690 ec: implement STRIPE I/O scope

In the RAID10-like EC parity layout the p stripes of a raidset share
one file offset but hold different data, so read and write must name
one of them. Implement LL_IO_SCOPE_STRIPE for that.

ll_io_scope_validate() accepts STRIPE with ios_mirror_id in
[1, MIRROR_ID_MAX] and ios_stripe_idx below
LOV_EC_MAX_CODING_STRIPES. ios_stripe_idx must be 0 for FILE and
MIRROR. It is not checked against p here: the scope outlives the
layout and the I/O type is not known yet. ll_io_scope_init() handles
STRIPE like MIRROR and, for STRIPE, copies ios_stripe_idx into
cl_io::ci_designated_stripe and sets ci_designated_stripe_set.
OBJECT stays reserved.

ci_designated_stripe is an unsigned index. 0 is a valid stripe, so
ci_designated_stripe_set says whether it is in use. A zeroed cl_io
is unset. The index is meaningful only with ci_designated_mirror
set.

lov visits only the stripes an I/O touches through
lov_foreach_io_stripe(), and maps an offset to a stripe through
lov_io_stripe_number(). On a parity component, read and write use
only the designated stripe of each raidset and fail with -EINVAL if
it is unset or not less than p. Punch, truncate, fallocate and lseek
reach every stripe and ignore the index, so a leftover STRIPE scope
does not fail them.

These helpers target the bare LOV_PATTERN_PARITY encoding for stripe
picking. lov_page_init_composite() also refuses CPT_CACHEABLE pages
when ci_designated_mirror is set on any parity component
(lsm_entry_is_parity()), including RAID0|PARITY. That covers MIRROR
and STRIPE scopes and LL_IOC_FLR_SET_MIRROR: a designated parity
read that falls back to the page cache (fcntl clears O_DIRECT, or a
short O_DIRECT read finished through the cache) returns -EINVAL.
sanity-ec test_312 checks that case.

llapi_io_scope_set(3) and the uapi comment document STRIPE, and that
ios_layout_version 0 uses the fd version from the last lease release
or resync lease. LL_IOC_SET_IO_SCOPE reuses nr 177 with
LL_IOC_FLR_SET_MIRROR (different size) to save an ioctl number.
sanity-flr test_213a checks the ioctl limits for FILE, MIRROR and
STRIPE, that OBJECT stays reserved, that mirror resync still goes
through the SET_MIRROR alias, and that a STRIPE read of a non-parity
mirror ignores the index. sanity-ec test_311 checks that lseek,
truncate and fallocate succeed for any index, and skips below 6
OSTs. io_scope gains -b, -x, -r, -t, -f and -l for that.

Test-Parameters: testlist=sanity-flr
Test-Parameters: testlist=sanity-ec ostcount=8
Assisted-by: Cursor:Composer-2 llm_code_and_review_tools
Signed-off-by: Keguang Xu <kxu@ddn.com>
Change-Id: Ia8c9e729df4f8651ac4f9dad88d4aef8b056100d