Commit | Line | Data |
---|---|---|
0b61f8a4 | 1 | // SPDX-License-Identifier: GPL-2.0+ |
3fd129b6 DW |
2 | /* |
3 | * Copyright (C) 2016 Oracle. All Rights Reserved. | |
3fd129b6 | 4 | * Author: Darrick J. Wong <darrick.wong@oracle.com> |
3fd129b6 DW |
5 | */ |
6 | #include "xfs.h" | |
7 | #include "xfs_fs.h" | |
8 | #include "xfs_shared.h" | |
9 | #include "xfs_format.h" | |
10 | #include "xfs_log_format.h" | |
11 | #include "xfs_trans_resv.h" | |
3fd129b6 | 12 | #include "xfs_mount.h" |
3fd129b6 | 13 | #include "xfs_alloc.h" |
e9e899a2 | 14 | #include "xfs_errortag.h" |
3fd129b6 DW |
15 | #include "xfs_error.h" |
16 | #include "xfs_trace.h" | |
3fd129b6 | 17 | #include "xfs_trans.h" |
3fd129b6 DW |
18 | #include "xfs_rmap_btree.h" |
19 | #include "xfs_btree.h" | |
84d69619 | 20 | #include "xfs_refcount_btree.h" |
76d771b4 | 21 | #include "xfs_ialloc_btree.h" |
9bbafc71 | 22 | #include "xfs_ag.h" |
5f213ddb | 23 | #include "xfs_ag_resv.h" |
3fd129b6 DW |
24 | |
25 | /* | |
26 | * Per-AG Block Reservations | |
27 | * | |
28 | * For some kinds of allocation group metadata structures, it is advantageous | |
29 | * to reserve a small number of blocks in each AG so that future expansions of | |
30 | * that data structure do not encounter ENOSPC because errors during a btree | |
31 | * split cause the filesystem to go offline. | |
32 | * | |
33 | * Prior to the introduction of reflink, this wasn't an issue because the free | |
34 | * space btrees maintain a reserve of space (the AGFL) to handle any expansion | |
35 | * that may be necessary; and allocations of other metadata (inodes, BMBT, | |
36 | * dir/attr) aren't restricted to a single AG. However, with reflink it is | |
37 | * possible to allocate all the space in an AG, have subsequent reflink/CoW | |
38 | * activity expand the refcount btree, and discover that there's no space left | |
39 | * to handle that expansion. Since we can calculate the maximum size of the | |
40 | * refcount btree, we can reserve space for it and avoid ENOSPC. | |
41 | * | |
42 | * Handling per-AG reservations consists of three changes to the allocator's | |
43 | * behavior: First, because these reservations are always needed, we decrease | |
44 | * the ag_max_usable counter to reflect the size of the AG after the reserved | |
45 | * blocks are taken. Second, the reservations must be reflected in the | |
46 | * fdblocks count to maintain proper accounting. Third, each AG must maintain | |
47 | * its own reserved block counter so that we can calculate the amount of space | |
48 | * that must remain free to maintain the reservations. Fourth, the "remaining | |
49 | * reserved blocks" count must be used when calculating the length of the | |
50 | * longest free extent in an AG and to clamp maxlen in the per-AG allocation | |
51 | * functions. In other words, we maintain a virtual allocation via in-core | |
52 | * accounting tricks so that we don't have to clean up after a crash. :) | |
53 | * | |
54 | * Reserved blocks can be managed by passing one of the enum xfs_ag_resv_type | |
55 | * values via struct xfs_alloc_arg or directly to the xfs_free_extent | |
56 | * function. It might seem a little funny to maintain a reservoir of blocks | |
57 | * to feed another reservoir, but the AGFL only holds enough blocks to get | |
58 | * through the next transaction. The per-AG reservation is to ensure (we | |
59 | * hope) that each AG never runs out of blocks. Each data structure wanting | |
60 | * to use the reservation system should update ask/used in xfs_ag_resv_init. | |
61 | */ | |
62 | ||
63 | /* | |
64 | * Are we critically low on blocks? For now we'll define that as the number | |
65 | * of blocks we can get our hands on being less than 10% of what we reserved | |
66 | * or less than some arbitrary number (maximum btree height). | |
67 | */ | |
68 | bool | |
69 | xfs_ag_resv_critical( | |
70 | struct xfs_perag *pag, | |
71 | enum xfs_ag_resv_type type) | |
72 | { | |
73 | xfs_extlen_t avail; | |
74 | xfs_extlen_t orig; | |
75 | ||
76 | switch (type) { | |
77 | case XFS_AG_RESV_METADATA: | |
21592863 | 78 | avail = pag->pagf_freeblks - pag->pag_rmapbt_resv.ar_reserved; |
3fd129b6 DW |
79 | orig = pag->pag_meta_resv.ar_asked; |
80 | break; | |
21592863 | 81 | case XFS_AG_RESV_RMAPBT: |
3fd129b6 DW |
82 | avail = pag->pagf_freeblks + pag->pagf_flcount - |
83 | pag->pag_meta_resv.ar_reserved; | |
21592863 | 84 | orig = pag->pag_rmapbt_resv.ar_asked; |
3fd129b6 DW |
85 | break; |
86 | default: | |
87 | ASSERT(0); | |
88 | return false; | |
89 | } | |
90 | ||
91 | trace_xfs_ag_resv_critical(pag, type, avail); | |
92 | ||
93 | /* Critically low if less than 10% or max btree height remains. */ | |
b74e15d7 DW |
94 | return XFS_TEST_ERROR(avail < orig / 10 || |
95 | avail < pag->pag_mount->m_agbtree_maxlevels, | |
9e24cfd0 | 96 | pag->pag_mount, XFS_ERRTAG_AG_RESV_CRITICAL); |
3fd129b6 DW |
97 | } |
98 | ||
99 | /* | |
100 | * How many blocks are reserved but not used, and therefore must not be | |
101 | * allocated away? | |
102 | */ | |
103 | xfs_extlen_t | |
104 | xfs_ag_resv_needed( | |
105 | struct xfs_perag *pag, | |
106 | enum xfs_ag_resv_type type) | |
107 | { | |
108 | xfs_extlen_t len; | |
109 | ||
21592863 | 110 | len = pag->pag_meta_resv.ar_reserved + pag->pag_rmapbt_resv.ar_reserved; |
3fd129b6 DW |
111 | switch (type) { |
112 | case XFS_AG_RESV_METADATA: | |
21592863 | 113 | case XFS_AG_RESV_RMAPBT: |
3fd129b6 DW |
114 | len -= xfs_perag_resv(pag, type)->ar_reserved; |
115 | break; | |
116 | case XFS_AG_RESV_NONE: | |
117 | /* empty */ | |
118 | break; | |
119 | default: | |
120 | ASSERT(0); | |
121 | } | |
122 | ||
123 | trace_xfs_ag_resv_needed(pag, type, len); | |
124 | ||
125 | return len; | |
126 | } | |
127 | ||
128 | /* Clean out a reservation */ | |
f30f656e | 129 | static void |
3fd129b6 DW |
130 | __xfs_ag_resv_free( |
131 | struct xfs_perag *pag, | |
132 | enum xfs_ag_resv_type type) | |
133 | { | |
134 | struct xfs_ag_resv *resv; | |
135 | xfs_extlen_t oldresv; | |
3fd129b6 DW |
136 | |
137 | trace_xfs_ag_resv_free(pag, type, 0); | |
138 | ||
139 | resv = xfs_perag_resv(pag, type); | |
9789dd9e DW |
140 | if (pag->pag_agno == 0) |
141 | pag->pag_mount->m_ag_max_usable += resv->ar_asked; | |
3fd129b6 | 142 | /* |
21592863 BF |
143 | * RMAPBT blocks come from the AGFL and AGFL blocks are always |
144 | * considered "free", so whatever was reserved at mount time must be | |
145 | * given back at umount. | |
3fd129b6 | 146 | */ |
21592863 | 147 | if (type == XFS_AG_RESV_RMAPBT) |
3fd129b6 DW |
148 | oldresv = resv->ar_orig_reserved; |
149 | else | |
150 | oldresv = resv->ar_reserved; | |
f30f656e | 151 | xfs_add_fdblocks(pag->pag_mount, oldresv); |
3fd129b6 DW |
152 | resv->ar_reserved = 0; |
153 | resv->ar_asked = 0; | |
d8cb5e42 | 154 | resv->ar_orig_reserved = 0; |
3fd129b6 DW |
155 | } |
156 | ||
157 | /* Free a per-AG reservation. */ | |
f30f656e | 158 | void |
3fd129b6 DW |
159 | xfs_ag_resv_free( |
160 | struct xfs_perag *pag) | |
161 | { | |
f30f656e CH |
162 | __xfs_ag_resv_free(pag, XFS_AG_RESV_RMAPBT); |
163 | __xfs_ag_resv_free(pag, XFS_AG_RESV_METADATA); | |
3fd129b6 DW |
164 | } |
165 | ||
166 | static int | |
167 | __xfs_ag_resv_init( | |
168 | struct xfs_perag *pag, | |
169 | enum xfs_ag_resv_type type, | |
170 | xfs_extlen_t ask, | |
171 | xfs_extlen_t used) | |
172 | { | |
173 | struct xfs_mount *mp = pag->pag_mount; | |
174 | struct xfs_ag_resv *resv; | |
175 | int error; | |
d8cb5e42 | 176 | xfs_extlen_t hidden_space; |
3fd129b6 | 177 | |
3fd129b6 DW |
178 | if (used > ask) |
179 | ask = used; | |
3fd129b6 | 180 | |
d8cb5e42 DW |
181 | switch (type) { |
182 | case XFS_AG_RESV_RMAPBT: | |
183 | /* | |
184 | * Space taken by the rmapbt is not subtracted from fdblocks | |
185 | * because the rmapbt lives in the free space. Here we must | |
186 | * subtract the entire reservation from fdblocks so that we | |
187 | * always have blocks available for rmapbt expansion. | |
188 | */ | |
189 | hidden_space = ask; | |
190 | break; | |
191 | case XFS_AG_RESV_METADATA: | |
192 | /* | |
193 | * Space taken by all other metadata btrees are accounted | |
194 | * on-disk as used space. We therefore only hide the space | |
195 | * that is reserved but not used by the trees. | |
196 | */ | |
197 | hidden_space = ask - used; | |
198 | break; | |
199 | default: | |
200 | ASSERT(0); | |
201 | return -EINVAL; | |
202 | } | |
2b92faed GX |
203 | |
204 | if (XFS_TEST_ERROR(false, mp, XFS_ERRTAG_AG_RESV_FAIL)) | |
205 | error = -ENOSPC; | |
206 | else | |
f30f656e | 207 | error = xfs_dec_fdblocks(mp, hidden_space, true); |
4dfa2b84 | 208 | if (error) { |
3fd129b6 DW |
209 | trace_xfs_ag_resv_init_error(pag->pag_mount, pag->pag_agno, |
210 | error, _RET_IP_); | |
76d771b4 CH |
211 | xfs_warn(mp, |
212 | "Per-AG reservation for AG %u failed. Filesystem may run out of space.", | |
213 | pag->pag_agno); | |
4dfa2b84 CH |
214 | return error; |
215 | } | |
3fd129b6 | 216 | |
9789dd9e DW |
217 | /* |
218 | * Reduce the maximum per-AG allocation length by however much we're | |
219 | * trying to reserve for an AG. Since this is a filesystem-wide | |
220 | * counter, we only make the adjustment for AG 0. This assumes that | |
221 | * there aren't any AGs hungrier for per-AG reservation than AG 0. | |
222 | */ | |
223 | if (pag->pag_agno == 0) | |
224 | mp->m_ag_max_usable -= ask; | |
4dfa2b84 CH |
225 | |
226 | resv = xfs_perag_resv(pag, type); | |
227 | resv->ar_asked = ask; | |
d8cb5e42 DW |
228 | resv->ar_orig_reserved = hidden_space; |
229 | resv->ar_reserved = ask - used; | |
4dfa2b84 CH |
230 | |
231 | trace_xfs_ag_resv_init(pag, type, ask); | |
232 | return 0; | |
3fd129b6 DW |
233 | } |
234 | ||
235 | /* Create a per-AG block reservation. */ | |
236 | int | |
237 | xfs_ag_resv_init( | |
ebcbef3a DW |
238 | struct xfs_perag *pag, |
239 | struct xfs_trans *tp) | |
3fd129b6 | 240 | { |
76d771b4 | 241 | struct xfs_mount *mp = pag->pag_mount; |
3fd129b6 DW |
242 | xfs_extlen_t ask; |
243 | xfs_extlen_t used; | |
2675ad38 BF |
244 | int error = 0, error2; |
245 | bool has_resv = false; | |
3fd129b6 DW |
246 | |
247 | /* Create the metadata reservation. */ | |
248 | if (pag->pag_meta_resv.ar_asked == 0) { | |
249 | ask = used = 0; | |
250 | ||
30933120 | 251 | error = xfs_refcountbt_calc_reserves(mp, tp, pag, &ask, &used); |
84d69619 DW |
252 | if (error) |
253 | goto out; | |
254 | ||
bab8b795 | 255 | error = xfs_finobt_calc_reserves(pag, tp, &ask, &used); |
3fd129b6 DW |
256 | if (error) |
257 | goto out; | |
76d771b4 CH |
258 | |
259 | error = __xfs_ag_resv_init(pag, XFS_AG_RESV_METADATA, | |
260 | ask, used); | |
261 | if (error) { | |
262 | /* | |
263 | * Because we didn't have per-AG reservations when the | |
264 | * finobt feature was added we might not be able to | |
265 | * reserve all needed blocks. Warn and fall back to the | |
266 | * old and potentially buggy code in that case, but | |
267 | * ensure we do have the reservation for the refcountbt. | |
268 | */ | |
269 | ask = used = 0; | |
270 | ||
e1f6ca11 | 271 | mp->m_finobt_nores = true; |
76d771b4 | 272 | |
30933120 | 273 | error = xfs_refcountbt_calc_reserves(mp, tp, pag, &ask, |
76d771b4 CH |
274 | &used); |
275 | if (error) | |
276 | goto out; | |
277 | ||
278 | error = __xfs_ag_resv_init(pag, XFS_AG_RESV_METADATA, | |
279 | ask, used); | |
280 | if (error) | |
281 | goto out; | |
282 | } | |
2675ad38 BF |
283 | if (ask) |
284 | has_resv = true; | |
3fd129b6 DW |
285 | } |
286 | ||
21592863 BF |
287 | /* Create the RMAPBT metadata reservation */ |
288 | if (pag->pag_rmapbt_resv.ar_asked == 0) { | |
3fd129b6 DW |
289 | ask = used = 0; |
290 | ||
30933120 | 291 | error = xfs_rmapbt_calc_reserves(mp, tp, pag, &ask, &used); |
84d69619 DW |
292 | if (error) |
293 | goto out; | |
294 | ||
21592863 | 295 | error = __xfs_ag_resv_init(pag, XFS_AG_RESV_RMAPBT, ask, used); |
3fd129b6 DW |
296 | if (error) |
297 | goto out; | |
2675ad38 BF |
298 | if (ask) |
299 | has_resv = true; | |
3fd129b6 DW |
300 | } |
301 | ||
302 | out: | |
2675ad38 BF |
303 | /* |
304 | * Initialize the pagf if we have at least one active reservation on the | |
305 | * AG. This may have occurred already via reservation calculation, but | |
306 | * fall back to an explicit init to ensure the in-core allocbt usage | |
307 | * counters are initialized as soon as possible. This is important | |
308 | * because filesystems with large perag reservations are susceptible to | |
309 | * free space reservation problems that the allocbt counter is used to | |
310 | * address. | |
311 | */ | |
312 | if (has_resv) { | |
08d3e84f | 313 | error2 = xfs_alloc_read_agf(pag, tp, 0, NULL); |
2675ad38 BF |
314 | if (error2) |
315 | return error2; | |
0f934251 DW |
316 | |
317 | /* | |
318 | * If there isn't enough space in the AG to satisfy the | |
319 | * reservation, let the caller know that there wasn't enough | |
320 | * space. Callers are responsible for deciding what to do | |
321 | * next, since (in theory) we can stumble along with | |
322 | * insufficient reservation if data blocks are being freed to | |
323 | * replenish the AG's free space. | |
324 | */ | |
325 | if (!error && | |
326 | xfs_perag_resv(pag, XFS_AG_RESV_METADATA)->ar_reserved + | |
327 | xfs_perag_resv(pag, XFS_AG_RESV_RMAPBT)->ar_reserved > | |
328 | pag->pagf_freeblks + pag->pagf_flcount) | |
329 | error = -ENOSPC; | |
2675ad38 | 330 | } |
0f934251 | 331 | |
3fd129b6 DW |
332 | return error; |
333 | } | |
334 | ||
335 | /* Allocate a block from the reservation. */ | |
336 | void | |
337 | xfs_ag_resv_alloc_extent( | |
338 | struct xfs_perag *pag, | |
339 | enum xfs_ag_resv_type type, | |
340 | struct xfs_alloc_arg *args) | |
341 | { | |
342 | struct xfs_ag_resv *resv; | |
343 | xfs_extlen_t len; | |
344 | uint field; | |
345 | ||
346 | trace_xfs_ag_resv_alloc_extent(pag, type, args->len); | |
347 | ||
348 | switch (type) { | |
0ab32086 BF |
349 | case XFS_AG_RESV_AGFL: |
350 | return; | |
3fd129b6 | 351 | case XFS_AG_RESV_METADATA: |
21592863 | 352 | case XFS_AG_RESV_RMAPBT: |
3fd129b6 DW |
353 | resv = xfs_perag_resv(pag, type); |
354 | break; | |
355 | default: | |
356 | ASSERT(0); | |
53004ee7 | 357 | fallthrough; |
3fd129b6 DW |
358 | case XFS_AG_RESV_NONE: |
359 | field = args->wasdel ? XFS_TRANS_SB_RES_FDBLOCKS : | |
360 | XFS_TRANS_SB_FDBLOCKS; | |
361 | xfs_trans_mod_sb(args->tp, field, -(int64_t)args->len); | |
362 | return; | |
363 | } | |
364 | ||
365 | len = min_t(xfs_extlen_t, args->len, resv->ar_reserved); | |
366 | resv->ar_reserved -= len; | |
21592863 | 367 | if (type == XFS_AG_RESV_RMAPBT) |
3fd129b6 DW |
368 | return; |
369 | /* Allocations of reserved blocks only need on-disk sb updates... */ | |
370 | xfs_trans_mod_sb(args->tp, XFS_TRANS_SB_RES_FDBLOCKS, -(int64_t)len); | |
371 | /* ...but non-reserved blocks need in-core and on-disk updates. */ | |
372 | if (args->len > len) | |
373 | xfs_trans_mod_sb(args->tp, XFS_TRANS_SB_FDBLOCKS, | |
374 | -((int64_t)args->len - len)); | |
375 | } | |
376 | ||
377 | /* Free a block to the reservation. */ | |
378 | void | |
379 | xfs_ag_resv_free_extent( | |
380 | struct xfs_perag *pag, | |
381 | enum xfs_ag_resv_type type, | |
382 | struct xfs_trans *tp, | |
383 | xfs_extlen_t len) | |
384 | { | |
385 | xfs_extlen_t leftover; | |
386 | struct xfs_ag_resv *resv; | |
387 | ||
388 | trace_xfs_ag_resv_free_extent(pag, type, len); | |
389 | ||
390 | switch (type) { | |
0ab32086 BF |
391 | case XFS_AG_RESV_AGFL: |
392 | return; | |
3fd129b6 | 393 | case XFS_AG_RESV_METADATA: |
21592863 | 394 | case XFS_AG_RESV_RMAPBT: |
3fd129b6 DW |
395 | resv = xfs_perag_resv(pag, type); |
396 | break; | |
397 | default: | |
398 | ASSERT(0); | |
53004ee7 | 399 | fallthrough; |
3fd129b6 DW |
400 | case XFS_AG_RESV_NONE: |
401 | xfs_trans_mod_sb(tp, XFS_TRANS_SB_FDBLOCKS, (int64_t)len); | |
4bdfd7d1 DW |
402 | fallthrough; |
403 | case XFS_AG_RESV_IGNORE: | |
3fd129b6 DW |
404 | return; |
405 | } | |
406 | ||
407 | leftover = min_t(xfs_extlen_t, len, resv->ar_asked - resv->ar_reserved); | |
408 | resv->ar_reserved += leftover; | |
21592863 | 409 | if (type == XFS_AG_RESV_RMAPBT) |
3fd129b6 DW |
410 | return; |
411 | /* Freeing into the reserved pool only requires on-disk update... */ | |
412 | xfs_trans_mod_sb(tp, XFS_TRANS_SB_RES_FDBLOCKS, len); | |
413 | /* ...but freeing beyond that requires in-core and on-disk update. */ | |
414 | if (len > leftover) | |
415 | xfs_trans_mod_sb(tp, XFS_TRANS_SB_FDBLOCKS, len - leftover); | |
416 | } |