virtio-blk: add discard request support

CHANGELOG.md

@@ -59,6 +59,9 @@ and this project adheres to
 - Added support for Linux 6.18 host kernels alongside the existing 5.10 and 6.1
   host kernels. See the [kernel support policy](docs/kernel-policy.md) for
   details.
+- [#5908](https://github.com/firecracker-microvm/firecracker/pull/5908): Add
+  opt-in virtio-blk discard support for writable `Sync` IO engine drives through
+  the `discard` drive configuration field.
 
 ### Changed
 

docs/api_requests/block-discard.md

@@ -0,0 +1,43 @@
+# Block device discard
+
+Firecracker can expose virtio-blk discard support to Linux guests. When enabled,
+the guest can issue discard/TRIM requests, for example through `fstrim`, and
+Firecracker forwards those requests to the backing storage.
+
+Discard is configured per virtio-block device through the `discard` field in the
+`PUT /drives/{drive_id}` request. It is disabled by default.
+
+## Supported configuration
+
+Discard is currently supported only for writable virtio-block devices using the
+`Sync` IO engine. It is not supported for:
+
+- read-only drives;
+- `Async` IO engine drives;
+- vhost-user block devices.
+
+For regular backing files, Firecracker uses hole punching. For block-device
+backends, Firecracker uses `BLKDISCARD`.
+
+## Example configuration
+
+```bash
+curl --unix-socket ${socket} -i \
+     -X PUT "http://localhost/drives/rootfs" \
+     -H "accept: application/json" \
+     -H "Content-Type: application/json" \
+     -d "{
+             \"drive_id\": \"rootfs\",
+             \"path_on_host\": \"${drive_path}\",
+             \"is_root_device\": true,
+             \"is_read_only\": false,
+             \"io_engine\": \"Sync\",
+             \"discard\": true
+         }"
+```
+
+After the guest boots, Linux guests can usually issue discard requests with:
+
+```bash
+fstrim -av
+```

resources/seccomp/aarch64-unknown-linux-musl.json

@@ -42,6 +42,19 @@
             {
                 "syscall": "fsync"
             },
+            {
+                "syscall": "fallocate",
+                "comment": "Used by the VirtIO block device to punch holes for discard on regular backing files",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 3,
+                        "comment": "FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE"
+                    }
+                ]
+            },
             {
                 "syscall": "close"
             },
@@ -519,6 +532,19 @@
                     }
                 ]
             },
+            {
+                "syscall": "ioctl",
+                "comment": "Used by the VirtIO block device to pass discard through to block-device backing files",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 4727,
+                        "comment": "BLKDISCARD"
+                    }
+                ]
+            },
             {
                 "syscall": "ioctl",
                 "comment": "Used to make vsock UDS nonblocking",

resources/seccomp/x86_64-unknown-linux-musl.json

@@ -42,6 +42,19 @@
             {
                 "syscall": "fsync"
             },
+            {
+                "syscall": "fallocate",
+                "comment": "Used by the VirtIO block device to punch holes for discard on regular backing files",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 3,
+                        "comment": "FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE"
+                    }
+                ]
+            },
             {
                 "syscall": "close"
             },
@@ -571,6 +584,19 @@
                     }
                 ]
             },
+            {
+                "syscall": "ioctl",
+                "comment": "Used by the VirtIO block device to pass discard through to block-device backing files",
+                "args": [
+                    {
+                        "index": 1,
+                        "type": "dword",
+                        "op": "eq",
+                        "val": 4727,
+                        "comment": "BLKDISCARD"
+                    }
+                ]
+            },
             {
                 "syscall": "ioctl",
                 "args": [

src/firecracker/swagger/firecracker.yaml

@@ -1238,6 +1238,14 @@ definitions:
         description:
           Is block read only.
           This field is required for virtio-block config and should be omitted for vhost-user-block configuration.
+      discard:
+        type: boolean
+        description:
+          Enables virtio-blk discard support. When enabled, the guest can issue
+          discard/TRIM requests for this drive. Only supported for writable
+          virtio-block devices using the Sync IO engine.
+          This field is optional for virtio-block config and should be omitted for vhost-user-block configuration.
+        default: false
       path_on_host:
         type: string
         description:

src/vmm/src/builder.rs

@@ -894,6 +894,7 @@ pub(crate) mod tests {
                 cache_type: custom_block_cfg.cache_type,
 
                 is_read_only: Some(custom_block_cfg.is_read_only),
+                discard: None,
                 path_on_host: Some(
                     block_files
                         .last()

src/vmm/src/device_manager/mod.rs

@@ -886,6 +886,7 @@ pub(crate) mod tests {
             is_root_device: is_root,
             cache_type: CacheType::Unsafe,
             is_read_only: Some(false),
+            discard: None,
             path_on_host: Some(f.as_path().to_str().unwrap().to_string()),
             rate_limiter: None,
             file_engine_type: None,

src/vmm/src/devices/virtio/block/vhost_user/device.rs

@@ -67,9 +67,10 @@ impl TryFrom<&BlockDeviceConfig> for VhostUserBlockConfig {
     type Error = VhostUserBlockError;
 
     fn try_from(value: &BlockDeviceConfig) -> Result<Self, Self::Error> {
-        if let (Some(socket), None, None, None, None) = (
+        if let (Some(socket), None, None, None, None, None) = (
             &value.socket,
             &value.is_read_only,
+            &value.discard,
             &value.path_on_host,
             &value.rate_limiter,
             &value.file_engine_type,
@@ -97,6 +98,7 @@ impl From<VhostUserBlockConfig> for BlockDeviceConfig {
             cache_type: value.cache_type,
 
             is_read_only: None,
+            discard: None,
             path_on_host: None,
             rate_limiter: None,
             file_engine_type: None,
@@ -409,6 +411,7 @@ mod tests {
             cache_type: CacheType::Unsafe,
 
             is_read_only: None,
+            discard: None,
             path_on_host: None,
             rate_limiter: None,
             file_engine_type: None,
@@ -424,6 +427,7 @@ mod tests {
             cache_type: CacheType::Unsafe,
 
             is_read_only: Some(true),
+            discard: None,
             path_on_host: Some("path".to_string()),
             rate_limiter: None,
             file_engine_type: Some(FileEngineType::Sync),
@@ -439,6 +443,7 @@ mod tests {
             cache_type: CacheType::Unsafe,
 
             is_read_only: Some(true),
+            discard: None,
             path_on_host: Some("path".to_string()),
             rate_limiter: None,
             file_engine_type: Some(FileEngineType::Sync),