1// SPDX-License-Identifier: GPL-2.0+ 2/* 3 * Copyright (C) 2019 Oracle. All Rights Reserved. 4 * Author: Darrick J. Wong <darrick.wong@oracle.com> 5 */ 6#include "xfs.h" 7#include "xfs_fs.h" 8#include "xfs_shared.h" 9#include "xfs_format.h" 10#include "xfs_trans_resv.h" 11#include "xfs_mount.h" 12#include "xfs_sb.h" 13#include "xfs_alloc.h" 14#include "xfs_ialloc.h" 15#include "xfs_health.h" 16#include "scrub/scrub.h" 17#include "scrub/common.h" 18#include "scrub/trace.h" 19 20/* 21 * FS Summary Counters 22 * =================== 23 * 24 * The basics of filesystem summary counter checking are that we iterate the 25 * AGs counting the number of free blocks, free space btree blocks, per-AG 26 * reservations, inodes, delayed allocation reservations, and free inodes. 27 * Then we compare what we computed against the in-core counters. 28 * 29 * However, the reality is that summary counters are a tricky beast to check. 30 * While we /could/ freeze the filesystem and scramble around the AGs counting 31 * the free blocks, in practice we prefer not do that for a scan because 32 * freezing is costly. To get around this, we added a per-cpu counter of the 33 * delalloc reservations so that we can rotor around the AGs relatively 34 * quickly, and we allow the counts to be slightly off because we're not taking 35 * any locks while we do this. 36 * 37 * So the first thing we do is warm up the buffer cache in the setup routine by 38 * walking all the AGs to make sure the incore per-AG structure has been 39 * initialized. The expected value calculation then iterates the incore per-AG 40 * structures as quickly as it can. We snapshot the percpu counters before and 41 * after this operation and use the difference in counter values to guess at 42 * our tolerance for mismatch between expected and actual counter values. 43 */ 44 45/* 46 * Since the expected value computation is lockless but only browses incore 47 * values, the percpu counters should be fairly close to each other. However, 48 * we'll allow ourselves to be off by at least this (arbitrary) amount. 49 */ 50#define XCHK_FSCOUNT_MIN_VARIANCE (512) 51 52/* 53 * Make sure the per-AG structure has been initialized from the on-disk header 54 * contents and trust that the incore counters match the ondisk counters. (The 55 * AGF and AGI scrubbers check them, and a normal xfs_scrub run checks the 56 * summary counters after checking all AG headers). Do this from the setup 57 * function so that the inner AG aggregation loop runs as quickly as possible. 58 * 59 * This function runs during the setup phase /before/ we start checking any 60 * metadata. 61 */ 62STATIC int 63xchk_fscount_warmup( 64 struct xfs_scrub *sc) 65{ 66 struct xfs_mount *mp = sc->mp; 67 struct xfs_buf *agi_bp = NULL; 68 struct xfs_buf *agf_bp = NULL; 69 struct xfs_perag *pag = NULL; 70 xfs_agnumber_t agno; 71 int error = 0; 72 73 for (agno = 0; agno < mp->m_sb.sb_agcount; agno++) { 74 pag = xfs_perag_get(mp, agno); 75 76 if (pag->pagi_init && pag->pagf_init) 77 goto next_loop_perag; 78 79 /* Lock both AG headers. */ 80 error = xfs_ialloc_read_agi(mp, sc->tp, agno, &agi_bp); 81 if (error) 82 break; 83 error = xfs_alloc_read_agf(mp, sc->tp, agno, 0, &agf_bp); 84 if (error) 85 break; 86 87 /* 88 * These are supposed to be initialized by the header read 89 * function. 90 */ 91 error = -EFSCORRUPTED; 92 if (!pag->pagi_init || !pag->pagf_init) 93 break; 94 95 xfs_buf_relse(agf_bp); 96 agf_bp = NULL; 97 xfs_buf_relse(agi_bp); 98 agi_bp = NULL; 99next_loop_perag: 100 xfs_perag_put(pag); 101 pag = NULL; 102 error = 0; 103 104 if (xchk_should_terminate(sc, &error)) 105 break; 106 } 107 108 if (agf_bp) 109 xfs_buf_relse(agf_bp); 110 if (agi_bp) 111 xfs_buf_relse(agi_bp); 112 if (pag) 113 xfs_perag_put(pag); 114 return error; 115} 116 117int 118xchk_setup_fscounters( 119 struct xfs_scrub *sc, 120 struct xfs_inode *ip) 121{ 122 struct xchk_fscounters *fsc; 123 int error; 124 125 sc->buf = kmem_zalloc(sizeof(struct xchk_fscounters), 0); 126 if (!sc->buf) 127 return -ENOMEM; 128 fsc = sc->buf; 129 130 xfs_icount_range(sc->mp, &fsc->icount_min, &fsc->icount_max); 131 132 /* We must get the incore counters set up before we can proceed. */ 133 error = xchk_fscount_warmup(sc); 134 if (error) 135 return error; 136 137 /* 138 * Pause background reclaim while we're scrubbing to reduce the 139 * likelihood of background perturbations to the counters throwing off 140 * our calculations. 141 */ 142 xchk_stop_reaping(sc); 143 144 return xchk_trans_alloc(sc, 0); 145} 146 147/* 148 * Calculate what the global in-core counters ought to be from the incore 149 * per-AG structure. Callers can compare this to the actual in-core counters 150 * to estimate by how much both in-core and on-disk counters need to be 151 * adjusted. 152 */ 153STATIC int 154xchk_fscount_aggregate_agcounts( 155 struct xfs_scrub *sc, 156 struct xchk_fscounters *fsc) 157{ 158 struct xfs_mount *mp = sc->mp; 159 struct xfs_perag *pag; 160 uint64_t delayed; 161 xfs_agnumber_t agno; 162 int tries = 8; 163 int error = 0; 164 165retry: 166 fsc->icount = 0; 167 fsc->ifree = 0; 168 fsc->fdblocks = 0; 169 170 for (agno = 0; agno < mp->m_sb.sb_agcount; agno++) { 171 pag = xfs_perag_get(mp, agno); 172 173 /* This somehow got unset since the warmup? */ 174 if (!pag->pagi_init || !pag->pagf_init) { 175 xfs_perag_put(pag); 176 return -EFSCORRUPTED; 177 } 178 179 /* Count all the inodes */ 180 fsc->icount += pag->pagi_count; 181 fsc->ifree += pag->pagi_freecount; 182 183 /* Add up the free/freelist/bnobt/cntbt blocks */ 184 fsc->fdblocks += pag->pagf_freeblks; 185 fsc->fdblocks += pag->pagf_flcount; 186 fsc->fdblocks += pag->pagf_btreeblks; 187 188 /* 189 * Per-AG reservations are taken out of the incore counters, 190 * so they must be left out of the free blocks computation. 191 */ 192 fsc->fdblocks -= pag->pag_meta_resv.ar_reserved; 193 fsc->fdblocks -= pag->pag_rmapbt_resv.ar_orig_reserved; 194 195 xfs_perag_put(pag); 196 197 if (xchk_should_terminate(sc, &error)) 198 break; 199 } 200 201 if (error) 202 return error; 203 204 /* 205 * The global incore space reservation is taken from the incore 206 * counters, so leave that out of the computation. 207 */ 208 fsc->fdblocks -= mp->m_resblks_avail; 209 210 /* 211 * Delayed allocation reservations are taken out of the incore counters 212 * but not recorded on disk, so leave them and their indlen blocks out 213 * of the computation. 214 */ 215 delayed = percpu_counter_sum(&mp->m_delalloc_blks); 216 fsc->fdblocks -= delayed; 217 218 trace_xchk_fscounters_calc(mp, fsc->icount, fsc->ifree, fsc->fdblocks, 219 delayed); 220 221 222 /* Bail out if the values we compute are totally nonsense. */ 223 if (fsc->icount < fsc->icount_min || fsc->icount > fsc->icount_max || 224 fsc->fdblocks > mp->m_sb.sb_dblocks || 225 fsc->ifree > fsc->icount_max) 226 return -EFSCORRUPTED; 227 228 /* 229 * If ifree > icount then we probably had some perturbation in the 230 * counters while we were calculating things. We'll try a few times 231 * to maintain ifree <= icount before giving up. 232 */ 233 if (fsc->ifree > fsc->icount) { 234 if (tries--) 235 goto retry; 236 xchk_set_incomplete(sc); 237 return 0; 238 } 239 240 return 0; 241} 242 243/* 244 * Is the @counter reasonably close to the @expected value? 245 * 246 * We neither locked nor froze anything in the filesystem while aggregating the 247 * per-AG data to compute the @expected value, which means that the counter 248 * could have changed. We know the @old_value of the summation of the counter 249 * before the aggregation, and we re-sum the counter now. If the expected 250 * value falls between the two summations, we're ok. 251 * 252 * Otherwise, we /might/ have a problem. If the change in the summations is 253 * more than we want to tolerate, the filesystem is probably busy and we should 254 * just send back INCOMPLETE and see if userspace will try again. 255 */ 256static inline bool 257xchk_fscount_within_range( 258 struct xfs_scrub *sc, 259 const int64_t old_value, 260 struct percpu_counter *counter, 261 uint64_t expected) 262{ 263 int64_t min_value, max_value; 264 int64_t curr_value = percpu_counter_sum(counter); 265 266 trace_xchk_fscounters_within_range(sc->mp, expected, curr_value, 267 old_value); 268 269 /* Negative values are always wrong. */ 270 if (curr_value < 0) 271 return false; 272 273 /* Exact matches are always ok. */ 274 if (curr_value == expected) 275 return true; 276 277 min_value = min(old_value, curr_value); 278 max_value = max(old_value, curr_value); 279 280 /* Within the before-and-after range is ok. */ 281 if (expected >= min_value && expected <= max_value) 282 return true; 283 284 /* 285 * If the difference between the two summations is too large, the fs 286 * might just be busy and so we'll mark the scrub incomplete. Return 287 * true here so that we don't mark the counter corrupt. 288 * 289 * XXX: In the future when userspace can grant scrub permission to 290 * quiesce the filesystem to solve the outsized variance problem, this 291 * check should be moved up and the return code changed to signal to 292 * userspace that we need quiesce permission. 293 */ 294 if (max_value - min_value >= XCHK_FSCOUNT_MIN_VARIANCE) { 295 xchk_set_incomplete(sc); 296 return true; 297 } 298 299 return false; 300} 301 302/* Check the superblock counters. */ 303int 304xchk_fscounters( 305 struct xfs_scrub *sc) 306{ 307 struct xfs_mount *mp = sc->mp; 308 struct xchk_fscounters *fsc = sc->buf; 309 int64_t icount, ifree, fdblocks; 310 int error; 311 312 /* Snapshot the percpu counters. */ 313 icount = percpu_counter_sum(&mp->m_icount); 314 ifree = percpu_counter_sum(&mp->m_ifree); 315 fdblocks = percpu_counter_sum(&mp->m_fdblocks); 316 317 /* No negative values, please! */ 318 if (icount < 0 || ifree < 0 || fdblocks < 0) 319 xchk_set_corrupt(sc); 320 321 /* See if icount is obviously wrong. */ 322 if (icount < fsc->icount_min || icount > fsc->icount_max) 323 xchk_set_corrupt(sc); 324 325 /* See if fdblocks is obviously wrong. */ 326 if (fdblocks > mp->m_sb.sb_dblocks) 327 xchk_set_corrupt(sc); 328 329 /* 330 * If ifree exceeds icount by more than the minimum variance then 331 * something's probably wrong with the counters. 332 */ 333 if (ifree > icount && ifree - icount > XCHK_FSCOUNT_MIN_VARIANCE) 334 xchk_set_corrupt(sc); 335 336 /* Walk the incore AG headers to calculate the expected counters. */ 337 error = xchk_fscount_aggregate_agcounts(sc, fsc); 338 if (!xchk_process_error(sc, 0, XFS_SB_BLOCK(mp), &error)) 339 return error; 340 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_INCOMPLETE) 341 return 0; 342 343 /* Compare the in-core counters with whatever we counted. */ 344 if (!xchk_fscount_within_range(sc, icount, &mp->m_icount, fsc->icount)) 345 xchk_set_corrupt(sc); 346 347 if (!xchk_fscount_within_range(sc, ifree, &mp->m_ifree, fsc->ifree)) 348 xchk_set_corrupt(sc); 349 350 if (!xchk_fscount_within_range(sc, fdblocks, &mp->m_fdblocks, 351 fsc->fdblocks)) 352 xchk_set_corrupt(sc); 353 354 return 0; 355} 356