Commit | Line | Data |
---|---|---|
36fd6e86 DW |
1 | /* |
2 | * Copyright (C) 2017 Oracle. All Rights Reserved. | |
3 | * | |
4 | * Author: Darrick J. Wong <darrick.wong@oracle.com> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version 2 | |
9 | * of the License, or (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it would be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write the Free Software Foundation, | |
18 | * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. | |
19 | */ | |
20 | #include "xfs.h" | |
21 | #include "xfs_fs.h" | |
22 | #include "xfs_shared.h" | |
23 | #include "xfs_format.h" | |
24 | #include "xfs_trans_resv.h" | |
25 | #include "xfs_mount.h" | |
26 | #include "xfs_defer.h" | |
27 | #include "xfs_btree.h" | |
28 | #include "xfs_bit.h" | |
29 | #include "xfs_log_format.h" | |
30 | #include "xfs_trans.h" | |
31 | #include "xfs_sb.h" | |
32 | #include "xfs_inode.h" | |
33 | #include "xfs_alloc.h" | |
34 | #include "xfs_alloc_btree.h" | |
35 | #include "xfs_bmap.h" | |
36 | #include "xfs_bmap_btree.h" | |
37 | #include "xfs_ialloc.h" | |
38 | #include "xfs_ialloc_btree.h" | |
39 | #include "xfs_refcount.h" | |
40 | #include "xfs_refcount_btree.h" | |
41 | #include "xfs_rmap.h" | |
42 | #include "xfs_rmap_btree.h" | |
43 | #include "scrub/xfs_scrub.h" | |
44 | #include "scrub/scrub.h" | |
dcb660f9 | 45 | #include "scrub/common.h" |
36fd6e86 | 46 | #include "scrub/trace.h" |
b6c1beb9 DW |
47 | #include "scrub/scrub.h" |
48 | #include "scrub/btree.h" | |
36fd6e86 | 49 | |
a5637186 DW |
50 | /* |
51 | * Online Scrub and Repair | |
52 | * | |
53 | * Traditionally, XFS (the kernel driver) did not know how to check or | |
54 | * repair on-disk data structures. That task was left to the xfs_check | |
55 | * and xfs_repair tools, both of which require taking the filesystem | |
56 | * offline for a thorough but time consuming examination. Online | |
57 | * scrub & repair, on the other hand, enables us to check the metadata | |
58 | * for obvious errors while carefully stepping around the filesystem's | |
59 | * ongoing operations, locking rules, etc. | |
60 | * | |
61 | * Given that most XFS metadata consist of records stored in a btree, | |
62 | * most of the checking functions iterate the btree blocks themselves | |
63 | * looking for irregularities. When a record block is encountered, each | |
64 | * record can be checked for obviously bad values. Record values can | |
65 | * also be cross-referenced against other btrees to look for potential | |
66 | * misunderstandings between pieces of metadata. | |
67 | * | |
68 | * It is expected that the checkers responsible for per-AG metadata | |
69 | * structures will lock the AG headers (AGI, AGF, AGFL), iterate the | |
70 | * metadata structure, and perform any relevant cross-referencing before | |
71 | * unlocking the AG and returning the results to userspace. These | |
72 | * scrubbers must not keep an AG locked for too long to avoid tying up | |
73 | * the block and inode allocators. | |
74 | * | |
75 | * Block maps and b-trees rooted in an inode present a special challenge | |
76 | * because they can involve extents from any AG. The general scrubber | |
77 | * structure of lock -> check -> xref -> unlock still holds, but AG | |
78 | * locking order rules /must/ be obeyed to avoid deadlocks. The | |
79 | * ordering rule, of course, is that we must lock in increasing AG | |
80 | * order. Helper functions are provided to track which AG headers we've | |
81 | * already locked. If we detect an imminent locking order violation, we | |
82 | * can signal a potential deadlock, in which case the scrubber can jump | |
83 | * out to the top level, lock all the AGs in order, and retry the scrub. | |
84 | * | |
85 | * For file data (directories, extended attributes, symlinks) scrub, we | |
86 | * can simply lock the inode and walk the data. For btree data | |
87 | * (directories and attributes) we follow the same btree-scrubbing | |
88 | * strategy outlined previously to check the records. | |
89 | * | |
90 | * We use a bit of trickery with transactions to avoid buffer deadlocks | |
91 | * if there is a cycle in the metadata. The basic problem is that | |
92 | * travelling down a btree involves locking the current buffer at each | |
93 | * tree level. If a pointer should somehow point back to a buffer that | |
94 | * we've already examined, we will deadlock due to the second buffer | |
95 | * locking attempt. Note however that grabbing a buffer in transaction | |
96 | * context links the locked buffer to the transaction. If we try to | |
97 | * re-grab the buffer in the context of the same transaction, we avoid | |
98 | * the second lock attempt and continue. Between the verifier and the | |
99 | * scrubber, something will notice that something is amiss and report | |
100 | * the corruption. Therefore, each scrubber will allocate an empty | |
101 | * transaction, attach buffers to it, and cancel the transaction at the | |
102 | * end of the scrub run. Cancelling a non-dirty transaction simply | |
103 | * unlocks the buffers. | |
104 | * | |
105 | * There are four pieces of data that scrub can communicate to | |
106 | * userspace. The first is the error code (errno), which can be used to | |
107 | * communicate operational errors in performing the scrub. There are | |
108 | * also three flags that can be set in the scrub context. If the data | |
109 | * structure itself is corrupt, the CORRUPT flag will be set. If | |
110 | * the metadata is correct but otherwise suboptimal, the PREEN flag | |
111 | * will be set. | |
112 | */ | |
113 | ||
dcb660f9 DW |
114 | /* |
115 | * Scrub probe -- userspace uses this to probe if we're willing to scrub | |
116 | * or repair a given mountpoint. This will be used by xfs_scrub to | |
117 | * probe the kernel's abilities to scrub (and repair) the metadata. We | |
118 | * do this by validating the ioctl inputs from userspace, preparing the | |
119 | * filesystem for a scrub (or a repair) operation, and immediately | |
120 | * returning to userspace. Userspace can use the returned errno and | |
121 | * structure state to decide (in broad terms) if scrub/repair are | |
122 | * supported by the running kernel. | |
123 | */ | |
124 | int | |
125 | xfs_scrub_probe( | |
126 | struct xfs_scrub_context *sc) | |
127 | { | |
128 | int error = 0; | |
129 | ||
130 | if (sc->sm->sm_ino || sc->sm->sm_agno) | |
131 | return -EINVAL; | |
132 | if (xfs_scrub_should_terminate(sc, &error)) | |
133 | return error; | |
134 | ||
135 | return 0; | |
136 | } | |
137 | ||
a5637186 DW |
138 | /* Scrub setup and teardown */ |
139 | ||
140 | /* Free all the resources and finish the transactions. */ | |
141 | STATIC int | |
142 | xfs_scrub_teardown( | |
143 | struct xfs_scrub_context *sc, | |
144 | int error) | |
145 | { | |
b6c1beb9 | 146 | xfs_scrub_ag_free(sc, &sc->sa); |
a5637186 DW |
147 | if (sc->tp) { |
148 | xfs_trans_cancel(sc->tp); | |
149 | sc->tp = NULL; | |
150 | } | |
151 | return error; | |
152 | } | |
153 | ||
154 | /* Scrubbing dispatch. */ | |
155 | ||
156 | static const struct xfs_scrub_meta_ops meta_scrub_ops[] = { | |
dcb660f9 DW |
157 | { /* ioctl presence test */ |
158 | .setup = xfs_scrub_setup_fs, | |
159 | .scrub = xfs_scrub_probe, | |
160 | }, | |
21fb4cb1 DW |
161 | { /* superblock */ |
162 | .setup = xfs_scrub_setup_ag_header, | |
163 | .scrub = xfs_scrub_superblock, | |
164 | }, | |
ab9d5dc5 DW |
165 | { /* agf */ |
166 | .setup = xfs_scrub_setup_ag_header, | |
167 | .scrub = xfs_scrub_agf, | |
168 | }, | |
169 | { /* agfl */ | |
170 | .setup = xfs_scrub_setup_ag_header, | |
171 | .scrub = xfs_scrub_agfl, | |
172 | }, | |
a12890ae DW |
173 | { /* agi */ |
174 | .setup = xfs_scrub_setup_ag_header, | |
175 | .scrub = xfs_scrub_agi, | |
176 | }, | |
efa7a99c DW |
177 | { /* bnobt */ |
178 | .setup = xfs_scrub_setup_ag_allocbt, | |
179 | .scrub = xfs_scrub_bnobt, | |
180 | }, | |
181 | { /* cntbt */ | |
182 | .setup = xfs_scrub_setup_ag_allocbt, | |
183 | .scrub = xfs_scrub_cntbt, | |
184 | }, | |
3daa6641 DW |
185 | { /* inobt */ |
186 | .setup = xfs_scrub_setup_ag_iallocbt, | |
187 | .scrub = xfs_scrub_inobt, | |
188 | }, | |
189 | { /* finobt */ | |
190 | .setup = xfs_scrub_setup_ag_iallocbt, | |
191 | .scrub = xfs_scrub_finobt, | |
192 | .has = xfs_sb_version_hasfinobt, | |
193 | }, | |
c7e693d9 DW |
194 | { /* rmapbt */ |
195 | .setup = xfs_scrub_setup_ag_rmapbt, | |
196 | .scrub = xfs_scrub_rmapbt, | |
197 | .has = xfs_sb_version_hasrmapbt, | |
198 | }, | |
a5637186 DW |
199 | }; |
200 | ||
201 | /* This isn't a stable feature, warn once per day. */ | |
202 | static inline void | |
203 | xfs_scrub_experimental_warning( | |
204 | struct xfs_mount *mp) | |
205 | { | |
206 | static struct ratelimit_state scrub_warning = RATELIMIT_STATE_INIT( | |
207 | "xfs_scrub_warning", 86400 * HZ, 1); | |
208 | ratelimit_set_flags(&scrub_warning, RATELIMIT_MSG_ON_RELEASE); | |
209 | ||
210 | if (__ratelimit(&scrub_warning)) | |
211 | xfs_alert(mp, | |
212 | "EXPERIMENTAL online scrub feature in use. Use at your own risk!"); | |
213 | } | |
214 | ||
36fd6e86 DW |
215 | /* Dispatch metadata scrubbing. */ |
216 | int | |
217 | xfs_scrub_metadata( | |
218 | struct xfs_inode *ip, | |
219 | struct xfs_scrub_metadata *sm) | |
220 | { | |
a5637186 DW |
221 | struct xfs_scrub_context sc; |
222 | struct xfs_mount *mp = ip->i_mount; | |
223 | const struct xfs_scrub_meta_ops *ops; | |
224 | bool try_harder = false; | |
225 | int error = 0; | |
226 | ||
227 | trace_xfs_scrub_start(ip, sm, error); | |
228 | ||
229 | /* Forbidden if we are shut down or mounted norecovery. */ | |
230 | error = -ESHUTDOWN; | |
231 | if (XFS_FORCED_SHUTDOWN(mp)) | |
232 | goto out; | |
233 | error = -ENOTRECOVERABLE; | |
234 | if (mp->m_flags & XFS_MOUNT_NORECOVERY) | |
235 | goto out; | |
236 | ||
237 | /* Check our inputs. */ | |
238 | error = -EINVAL; | |
239 | sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT; | |
240 | if (sm->sm_flags & ~XFS_SCRUB_FLAGS_IN) | |
241 | goto out; | |
242 | if (memchr_inv(sm->sm_reserved, 0, sizeof(sm->sm_reserved))) | |
243 | goto out; | |
244 | ||
245 | /* Do we know about this type of metadata? */ | |
246 | error = -ENOENT; | |
247 | if (sm->sm_type >= XFS_SCRUB_TYPE_NR) | |
248 | goto out; | |
249 | ops = &meta_scrub_ops[sm->sm_type]; | |
250 | if (ops->scrub == NULL) | |
251 | goto out; | |
252 | ||
253 | /* | |
254 | * We won't scrub any filesystem that doesn't have the ability | |
255 | * to record unwritten extents. The option was made default in | |
256 | * 2003, removed from mkfs in 2007, and cannot be disabled in | |
257 | * v5, so if we find a filesystem without this flag it's either | |
258 | * really old or totally unsupported. Avoid it either way. | |
259 | * We also don't support v1-v3 filesystems, which aren't | |
260 | * mountable. | |
261 | */ | |
262 | error = -EOPNOTSUPP; | |
263 | if (!xfs_sb_version_hasextflgbit(&mp->m_sb)) | |
264 | goto out; | |
265 | ||
266 | /* Does this fs even support this type of metadata? */ | |
267 | error = -ENOENT; | |
268 | if (ops->has && !ops->has(&mp->m_sb)) | |
269 | goto out; | |
270 | ||
271 | /* We don't know how to repair anything yet. */ | |
272 | error = -EOPNOTSUPP; | |
273 | if (sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) | |
274 | goto out; | |
275 | ||
276 | xfs_scrub_experimental_warning(mp); | |
277 | ||
278 | retry_op: | |
279 | /* Set up for the operation. */ | |
280 | memset(&sc, 0, sizeof(sc)); | |
281 | sc.mp = ip->i_mount; | |
282 | sc.sm = sm; | |
283 | sc.ops = ops; | |
284 | sc.try_harder = try_harder; | |
b6c1beb9 | 285 | sc.sa.agno = NULLAGNUMBER; |
a5637186 DW |
286 | error = sc.ops->setup(&sc, ip); |
287 | if (error) | |
288 | goto out_teardown; | |
289 | ||
290 | /* Scrub for errors. */ | |
291 | error = sc.ops->scrub(&sc); | |
292 | if (!try_harder && error == -EDEADLOCK) { | |
293 | /* | |
294 | * Scrubbers return -EDEADLOCK to mean 'try harder'. | |
295 | * Tear down everything we hold, then set up again with | |
296 | * preparation for worst-case scenarios. | |
297 | */ | |
298 | error = xfs_scrub_teardown(&sc, 0); | |
299 | if (error) | |
300 | goto out; | |
301 | try_harder = true; | |
302 | goto retry_op; | |
303 | } else if (error) | |
304 | goto out_teardown; | |
305 | ||
306 | if (sc.sm->sm_flags & (XFS_SCRUB_OFLAG_CORRUPT | | |
307 | XFS_SCRUB_OFLAG_XCORRUPT)) | |
308 | xfs_alert_ratelimited(mp, "Corruption detected during scrub."); | |
309 | ||
310 | out_teardown: | |
311 | error = xfs_scrub_teardown(&sc, error); | |
312 | out: | |
313 | trace_xfs_scrub_done(ip, sm, error); | |
314 | if (error == -EFSCORRUPTED || error == -EFSBADCRC) { | |
315 | sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT; | |
316 | error = 0; | |
317 | } | |
318 | return error; | |
36fd6e86 | 319 | } |