repair.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * Copyright (C) 2018-2023 Oracle.  All Rights Reserved.
   4 * Author: Darrick J. Wong <djwong@kernel.org>
   5 */
   6#include "xfs.h"
   7#include "xfs_fs.h"
   8#include "xfs_shared.h"
   9#include "xfs_format.h"
  10#include "xfs_trans_resv.h"
  11#include "xfs_mount.h"
  12#include "xfs_btree.h"
  13#include "xfs_log_format.h"
  14#include "xfs_trans.h"
  15#include "xfs_sb.h"
  16#include "xfs_inode.h"
  17#include "xfs_alloc.h"
  18#include "xfs_alloc_btree.h"
  19#include "xfs_ialloc.h"
  20#include "xfs_ialloc_btree.h"
  21#include "xfs_rmap.h"
  22#include "xfs_rmap_btree.h"
  23#include "xfs_refcount_btree.h"
  24#include "xfs_rtbitmap.h"
  25#include "xfs_extent_busy.h"
  26#include "xfs_ag.h"
  27#include "xfs_ag_resv.h"
  28#include "xfs_quota.h"
  29#include "xfs_qm.h"
  30#include "xfs_defer.h"
  31#include "xfs_errortag.h"
  32#include "xfs_error.h"
  33#include "xfs_reflink.h"
  34#include "xfs_health.h"
  35#include "xfs_buf_mem.h"
  36#include "xfs_da_format.h"
  37#include "xfs_da_btree.h"
  38#include "xfs_attr.h"
  39#include "xfs_dir2.h"
  40#include "xfs_rtrmap_btree.h"
  41#include "xfs_rtbitmap.h"
  42#include "xfs_rtgroup.h"
  43#include "xfs_rtalloc.h"
  44#include "xfs_metafile.h"
  45#include "xfs_rtrefcount_btree.h"
  46#include "xfs_zone_alloc.h"
  47#include "scrub/scrub.h"
  48#include "scrub/common.h"
  49#include "scrub/trace.h"
  50#include "scrub/repair.h"
  51#include "scrub/bitmap.h"
  52#include "scrub/stats.h"
  53#include "scrub/xfile.h"
  54#include "scrub/attr_repair.h"
  55
  56/*
  57 * Attempt to repair some metadata, if the metadata is corrupt and userspace
  58 * told us to fix it.  This function returns -EAGAIN to mean "re-run scrub",
  59 * and will set *fixed to true if it thinks it repaired anything.
  60 */
  61int
  62xrep_attempt(
  63	struct xfs_scrub	*sc,
  64	struct xchk_stats_run	*run)
  65{
  66	u64			repair_start;
  67	int			error = 0;
  68
  69	trace_xrep_attempt(XFS_I(file_inode(sc->file)), sc->sm, error);
  70
  71	xchk_ag_btcur_free(&sc->sa);
  72	xchk_rtgroup_btcur_free(&sc->sr);
  73
  74	/* Repair whatever's broken. */
  75	ASSERT(sc->ops->repair);
  76	run->repair_attempted = true;
  77	repair_start = xchk_stats_now();
  78	error = sc->ops->repair(sc);
  79	trace_xrep_done(XFS_I(file_inode(sc->file)), sc->sm, error);
  80	run->repair_ns += xchk_stats_elapsed_ns(repair_start);
  81	switch (error) {
  82	case 0:
  83		/*
  84		 * Repair succeeded.  Commit the fixes and perform a second
  85		 * scrub so that we can tell userspace if we fixed the problem.
  86		 */
  87		sc->sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;
  88		sc->flags |= XREP_ALREADY_FIXED;
  89		run->repair_succeeded = true;
  90		return -EAGAIN;
  91	case -ECHRNG:
  92		sc->flags |= XCHK_NEED_DRAIN;
  93		run->retries++;
  94		return -EAGAIN;
  95	case -EDEADLOCK:
  96		/* Tell the caller to try again having grabbed all the locks. */
  97		if (!(sc->flags & XCHK_TRY_HARDER)) {
  98			sc->flags |= XCHK_TRY_HARDER;
  99			run->retries++;
 100			return -EAGAIN;
 101		}
 102		/*
 103		 * We tried harder but still couldn't grab all the resources
 104		 * we needed to fix it.  The corruption has not been fixed,
 105		 * so exit to userspace with the scan's output flags unchanged.
 106		 */
 107		return 0;
 108	default:
 109		/*
 110		 * EAGAIN tells the caller to re-scrub, so we cannot return
 111		 * that here.
 112		 */
 113		ASSERT(error != -EAGAIN);
 114		return error;
 115	}
 116}
 117
 118/*
 119 * Complain about unfixable problems in the filesystem.  We don't log
 120 * corruptions when IFLAG_REPAIR wasn't set on the assumption that the driver
 121 * program is xfs_scrub, which will call back with IFLAG_REPAIR set if the
 122 * administrator isn't running xfs_scrub in no-repairs mode.
 123 *
 124 * Use this helper function because _ratelimited silently declares a static
 125 * structure to track rate limiting information.
 126 */
 127void
 128xrep_failure(
 129	struct xfs_mount	*mp)
 130{
 131	xfs_alert_ratelimited(mp,
 132"Corruption not fixed during online repair.  Unmount and run xfs_repair.");
 133}
 134
 135/*
 136 * Repair probe -- userspace uses this to probe if we're willing to repair a
 137 * given mountpoint.
 138 */
 139int
 140xrep_probe(
 141	struct xfs_scrub	*sc)
 142{
 143	int			error = 0;
 144
 145	if (xchk_should_terminate(sc, &error))
 146		return error;
 147
 148	return 0;
 149}
 150
 151/*
 152 * Roll a transaction, keeping the AG headers locked and reinitializing
 153 * the btree cursors.
 154 */
 155int
 156xrep_roll_ag_trans(
 157	struct xfs_scrub	*sc)
 158{
 159	int			error;
 160
 161	/*
 162	 * Keep the AG header buffers locked while we roll the transaction.
 163	 * Ensure that both AG buffers are dirty and held when we roll the
 164	 * transaction so that they move forward in the log without losing the
 165	 * bli (and hence the bli type) when the transaction commits.
 166	 *
 167	 * Normal code would never hold clean buffers across a roll, but repair
 168	 * needs both buffers to maintain a total lock on the AG.
 169	 */
 170	if (sc->sa.agi_bp) {
 171		xfs_ialloc_log_agi(sc->tp, sc->sa.agi_bp, XFS_AGI_MAGICNUM);
 172		xfs_trans_bhold(sc->tp, sc->sa.agi_bp);
 173	}
 174
 175	if (sc->sa.agf_bp) {
 176		xfs_alloc_log_agf(sc->tp, sc->sa.agf_bp, XFS_AGF_MAGICNUM);
 177		xfs_trans_bhold(sc->tp, sc->sa.agf_bp);
 178	}
 179
 180	/*
 181	 * Roll the transaction.  We still hold the AG header buffers locked
 182	 * regardless of whether or not that succeeds.  On failure, the buffers
 183	 * will be released during teardown on our way out of the kernel.  If
 184	 * successful, join the buffers to the new transaction and move on.
 185	 */
 186	error = xfs_trans_roll(&sc->tp);
 187	if (error)
 188		return error;
 189
 190	/* Join the AG headers to the new transaction. */
 191	if (sc->sa.agi_bp)
 192		xfs_trans_bjoin(sc->tp, sc->sa.agi_bp);
 193	if (sc->sa.agf_bp)
 194		xfs_trans_bjoin(sc->tp, sc->sa.agf_bp);
 195
 196	return 0;
 197}
 198
 199/* Roll the scrub transaction, holding the primary metadata locked. */
 200int
 201xrep_roll_trans(
 202	struct xfs_scrub	*sc)
 203{
 204	if (!sc->ip)
 205		return xrep_roll_ag_trans(sc);
 206	return xfs_trans_roll_inode(&sc->tp, sc->ip);
 207}
 208
 209/* Finish all deferred work attached to the repair transaction. */
 210int
 211xrep_defer_finish(
 212	struct xfs_scrub	*sc)
 213{
 214	int			error;
 215
 216	/*
 217	 * Keep the AG header buffers locked while we complete deferred work
 218	 * items.  Ensure that both AG buffers are dirty and held when we roll
 219	 * the transaction so that they move forward in the log without losing
 220	 * the bli (and hence the bli type) when the transaction commits.
 221	 *
 222	 * Normal code would never hold clean buffers across a roll, but repair
 223	 * needs both buffers to maintain a total lock on the AG.
 224	 */
 225	if (sc->sa.agi_bp) {
 226		xfs_ialloc_log_agi(sc->tp, sc->sa.agi_bp, XFS_AGI_MAGICNUM);
 227		xfs_trans_bhold(sc->tp, sc->sa.agi_bp);
 228	}
 229
 230	if (sc->sa.agf_bp) {
 231		xfs_alloc_log_agf(sc->tp, sc->sa.agf_bp, XFS_AGF_MAGICNUM);
 232		xfs_trans_bhold(sc->tp, sc->sa.agf_bp);
 233	}
 234
 235	/*
 236	 * Finish all deferred work items.  We still hold the AG header buffers
 237	 * locked regardless of whether or not that succeeds.  On failure, the
 238	 * buffers will be released during teardown on our way out of the
 239	 * kernel.  If successful, join the buffers to the new transaction
 240	 * and move on.
 241	 */
 242	error = xfs_defer_finish(&sc->tp);
 243	if (error)
 244		return error;
 245
 246	/*
 247	 * Release the hold that we set above because defer_finish won't do
 248	 * that for us.  The defer roll code redirties held buffers after each
 249	 * roll, so the AG header buffers should be ready for logging.
 250	 */
 251	if (sc->sa.agi_bp)
 252		xfs_trans_bhold_release(sc->tp, sc->sa.agi_bp);
 253	if (sc->sa.agf_bp)
 254		xfs_trans_bhold_release(sc->tp, sc->sa.agf_bp);
 255
 256	return 0;
 257}
 258
 259/*
 260 * Does the given AG have enough space to rebuild a btree?  Neither AG
 261 * reservation can be critical, and we must have enough space (factoring
 262 * in AG reservations) to construct a whole btree.
 263 */
 264bool
 265xrep_ag_has_space(
 266	struct xfs_perag	*pag,
 267	xfs_extlen_t		nr_blocks,
 268	enum xfs_ag_resv_type	type)
 269{
 270	return  !xfs_ag_resv_critical(pag, XFS_AG_RESV_RMAPBT) &&
 271		!xfs_ag_resv_critical(pag, XFS_AG_RESV_METADATA) &&
 272		pag->pagf_freeblks > xfs_ag_resv_needed(pag, type) + nr_blocks;
 273}
 274
 275/*
 276 * Figure out how many blocks to reserve for an AG repair.  We calculate the
 277 * worst case estimate for the number of blocks we'd need to rebuild one of
 278 * any type of per-AG btree.
 279 */
 280xfs_extlen_t
 281xrep_calc_ag_resblks(
 282	struct xfs_scrub		*sc)
 283{
 284	struct xfs_mount		*mp = sc->mp;
 285	struct xfs_scrub_metadata	*sm = sc->sm;
 286	struct xfs_perag		*pag;
 287	struct xfs_buf			*bp;
 288	xfs_agino_t			icount = NULLAGINO;
 289	xfs_extlen_t			aglen = NULLAGBLOCK;
 290	xfs_extlen_t			usedlen;
 291	xfs_extlen_t			freelen;
 292	xfs_extlen_t			bnobt_sz;
 293	xfs_extlen_t			inobt_sz;
 294	xfs_extlen_t			rmapbt_sz;
 295	xfs_extlen_t			refcbt_sz;
 296	int				error;
 297
 298	if (!(sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))
 299		return 0;
 300
 301	pag = xfs_perag_get(mp, sm->sm_agno);
 302	if (xfs_perag_initialised_agi(pag)) {
 303		/* Use in-core icount if possible. */
 304		icount = pag->pagi_count;
 305	} else {
 306		/* Try to get the actual counters from disk. */
 307		error = xfs_ialloc_read_agi(pag, NULL, 0, &bp);
 308		if (!error) {
 309			icount = pag->pagi_count;
 310			xfs_buf_relse(bp);
 311		}
 312	}
 313
 314	/* Now grab the block counters from the AGF. */
 315	error = xfs_alloc_read_agf(pag, NULL, 0, &bp);
 316	if (error) {
 317		aglen = pag_group(pag)->xg_block_count;
 318		freelen = aglen;
 319		usedlen = aglen;
 320	} else {
 321		struct xfs_agf	*agf = bp->b_addr;
 322
 323		aglen = be32_to_cpu(agf->agf_length);
 324		freelen = be32_to_cpu(agf->agf_freeblks);
 325		usedlen = aglen - freelen;
 326		xfs_buf_relse(bp);
 327	}
 328
 329	/* If the icount is impossible, make some worst-case assumptions. */
 330	if (icount == NULLAGINO ||
 331	    !xfs_verify_agino(pag, icount)) {
 332		icount = pag->agino_max - pag->agino_min + 1;
 333	}
 334
 335	/* If the block counts are impossible, make worst-case assumptions. */
 336	if (aglen == NULLAGBLOCK ||
 337	    aglen != pag_group(pag)->xg_block_count ||
 338	    freelen >= aglen) {
 339		aglen = pag_group(pag)->xg_block_count;
 340		freelen = aglen;
 341		usedlen = aglen;
 342	}
 343
 344	trace_xrep_calc_ag_resblks(pag, icount, aglen, freelen, usedlen);
 345
 346	/*
 347	 * Figure out how many blocks we'd need worst case to rebuild
 348	 * each type of btree.  Note that we can only rebuild the
 349	 * bnobt/cntbt or inobt/finobt as pairs.
 350	 */
 351	bnobt_sz = 2 * xfs_allocbt_calc_size(mp, freelen);
 352	if (xfs_has_sparseinodes(mp))
 353		inobt_sz = xfs_iallocbt_calc_size(mp, icount /
 354				XFS_INODES_PER_HOLEMASK_BIT);
 355	else
 356		inobt_sz = xfs_iallocbt_calc_size(mp, icount /
 357				XFS_INODES_PER_CHUNK);
 358	if (xfs_has_finobt(mp))
 359		inobt_sz *= 2;
 360	if (xfs_has_reflink(mp))
 361		refcbt_sz = xfs_refcountbt_calc_size(mp, usedlen);
 362	else
 363		refcbt_sz = 0;
 364	if (xfs_has_rmapbt(mp)) {
 365		/*
 366		 * Guess how many blocks we need to rebuild the rmapbt.
 367		 * For non-reflink filesystems we can't have more records than
 368		 * used blocks.  However, with reflink it's possible to have
 369		 * more than one rmap record per AG block.  We don't know how
 370		 * many rmaps there could be in the AG, so we start off with
 371		 * what we hope is an generous over-estimation.
 372		 */
 373		if (xfs_has_reflink(mp))
 374			rmapbt_sz = xfs_rmapbt_calc_size(mp,
 375					(unsigned long long)aglen * 2);
 376		else
 377			rmapbt_sz = xfs_rmapbt_calc_size(mp, usedlen);
 378	} else {
 379		rmapbt_sz = 0;
 380	}
 381
 382	trace_xrep_calc_ag_resblks_btsize(pag, bnobt_sz, inobt_sz, rmapbt_sz,
 383			refcbt_sz);
 384	xfs_perag_put(pag);
 385
 386	return max(max(bnobt_sz, inobt_sz), max(rmapbt_sz, refcbt_sz));
 387}
 388
 389#ifdef CONFIG_XFS_RT
 390/*
 391 * Figure out how many blocks to reserve for a rtgroup repair.  We calculate
 392 * the worst case estimate for the number of blocks we'd need to rebuild one of
 393 * any type of per-rtgroup btree.
 394 */
 395xfs_extlen_t
 396xrep_calc_rtgroup_resblks(
 397	struct xfs_scrub		*sc)
 398{
 399	struct xfs_mount		*mp = sc->mp;
 400	struct xfs_scrub_metadata	*sm = sc->sm;
 401	uint64_t			usedlen;
 402	xfs_extlen_t			rmapbt_sz = 0;
 403
 404	if (!(sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR))
 405		return 0;
 406	if (!xfs_has_rtgroups(mp)) {
 407		ASSERT(0);
 408		return -EFSCORRUPTED;
 409	}
 410
 411	usedlen = xfs_rtbxlen_to_blen(mp, xfs_rtgroup_extents(mp, sm->sm_agno));
 412	ASSERT(usedlen <= XFS_MAX_RGBLOCKS);
 413
 414	if (xfs_has_rmapbt(mp))
 415		rmapbt_sz = xfs_rtrmapbt_calc_size(mp, usedlen);
 416
 417	trace_xrep_calc_rtgroup_resblks_btsize(mp, sm->sm_agno, usedlen,
 418			rmapbt_sz);
 419
 420	return rmapbt_sz;
 421}
 422#endif /* CONFIG_XFS_RT */
 423
 424/*
 425 * Reconstructing per-AG Btrees
 426 *
 427 * When a space btree is corrupt, we don't bother trying to fix it.  Instead,
 428 * we scan secondary space metadata to derive the records that should be in
 429 * the damaged btree, initialize a fresh btree root, and insert the records.
 430 * Note that for rebuilding the rmapbt we scan all the primary data to
 431 * generate the new records.
 432 *
 433 * However, that leaves the matter of removing all the metadata describing the
 434 * old broken structure.  For primary metadata we use the rmap data to collect
 435 * every extent with a matching rmap owner (bitmap); we then iterate all other
 436 * metadata structures with the same rmap owner to collect the extents that
 437 * cannot be removed (sublist).  We then subtract sublist from bitmap to
 438 * derive the blocks that were used by the old btree.  These blocks can be
 439 * reaped.
 440 *
 441 * For rmapbt reconstructions we must use different tactics for extent
 442 * collection.  First we iterate all primary metadata (this excludes the old
 443 * rmapbt, obviously) to generate new rmap records.  The gaps in the rmap
 444 * records are collected as bitmap.  The bnobt records are collected as
 445 * sublist.  As with the other btrees we subtract sublist from bitmap, and the
 446 * result (since the rmapbt lives in the free space) are the blocks from the
 447 * old rmapbt.
 448 */
 449
 450/* Ensure the freelist is the correct size. */
 451int
 452xrep_fix_freelist(
 453	struct xfs_scrub	*sc,
 454	int			alloc_flags)
 455{
 456	struct xfs_alloc_arg	args = {0};
 457
 458	args.mp = sc->mp;
 459	args.tp = sc->tp;
 460	args.agno = pag_agno(sc->sa.pag);
 461	args.alignment = 1;
 462	args.pag = sc->sa.pag;
 463
 464	return xfs_alloc_fix_freelist(&args, alloc_flags);
 465}
 466
 467/*
 468 * Finding per-AG Btree Roots for AGF/AGI Reconstruction
 469 *
 470 * If the AGF or AGI become slightly corrupted, it may be necessary to rebuild
 471 * the AG headers by using the rmap data to rummage through the AG looking for
 472 * btree roots.  This is not guaranteed to work if the AG is heavily damaged
 473 * or the rmap data are corrupt.
 474 *
 475 * Callers of xrep_find_ag_btree_roots must lock the AGF and AGFL
 476 * buffers if the AGF is being rebuilt; or the AGF and AGI buffers if the
 477 * AGI is being rebuilt.  It must maintain these locks until it's safe for
 478 * other threads to change the btrees' shapes.  The caller provides
 479 * information about the btrees to look for by passing in an array of
 480 * xrep_find_ag_btree with the (rmap owner, buf_ops, magic) fields set.
 481 * The (root, height) fields will be set on return if anything is found.  The
 482 * last element of the array should have a NULL buf_ops to mark the end of the
 483 * array.
 484 *
 485 * For every rmapbt record matching any of the rmap owners in btree_info,
 486 * read each block referenced by the rmap record.  If the block is a btree
 487 * block from this filesystem matching any of the magic numbers and has a
 488 * level higher than what we've already seen, remember the block and the
 489 * height of the tree required to have such a block.  When the call completes,
 490 * we return the highest block we've found for each btree description; those
 491 * should be the roots.
 492 */
 493
 494struct xrep_findroot {
 495	struct xfs_scrub		*sc;
 496	struct xfs_buf			*agfl_bp;
 497	struct xfs_agf			*agf;
 498	struct xrep_find_ag_btree	*btree_info;
 499};
 500
 501/* See if our block is in the AGFL. */
 502STATIC int
 503xrep_findroot_agfl_walk(
 504	struct xfs_mount	*mp,
 505	xfs_agblock_t		bno,
 506	void			*priv)
 507{
 508	xfs_agblock_t		*agbno = priv;
 509
 510	return (*agbno == bno) ? -ECANCELED : 0;
 511}
 512
 513/* Does this block match the btree information passed in? */
 514STATIC int
 515xrep_findroot_block(
 516	struct xrep_findroot		*ri,
 517	struct xrep_find_ag_btree	*fab,
 518	uint64_t			owner,
 519	xfs_agblock_t			agbno,
 520	bool				*done_with_block)
 521{
 522	struct xfs_mount		*mp = ri->sc->mp;
 523	struct xfs_buf			*bp;
 524	struct xfs_btree_block		*btblock;
 525	xfs_daddr_t			daddr;
 526	int				block_level;
 527	int				error = 0;
 528
 529	daddr = xfs_agbno_to_daddr(ri->sc->sa.pag, agbno);
 530
 531	/*
 532	 * Blocks in the AGFL have stale contents that might just happen to
 533	 * have a matching magic and uuid.  We don't want to pull these blocks
 534	 * in as part of a tree root, so we have to filter out the AGFL stuff
 535	 * here.  If the AGFL looks insane we'll just refuse to repair.
 536	 */
 537	if (owner == XFS_RMAP_OWN_AG) {
 538		error = xfs_agfl_walk(mp, ri->agf, ri->agfl_bp,
 539				xrep_findroot_agfl_walk, &agbno);
 540		if (error == -ECANCELED)
 541			return 0;
 542		if (error)
 543			return error;
 544	}
 545
 546	/*
 547	 * Read the buffer into memory so that we can see if it's a match for
 548	 * our btree type.  We have no clue if it is beforehand, and we want to
 549	 * avoid xfs_trans_read_buf's behavior of dumping the DONE state (which
 550	 * will cause needless disk reads in subsequent calls to this function)
 551	 * and logging metadata verifier failures.
 552	 *
 553	 * Therefore, pass in NULL buffer ops.  If the buffer was already in
 554	 * memory from some other caller it will already have b_ops assigned.
 555	 * If it was in memory from a previous unsuccessful findroot_block
 556	 * call, the buffer won't have b_ops but it should be clean and ready
 557	 * for us to try to verify if the read call succeeds.  The same applies
 558	 * if the buffer wasn't in memory at all.
 559	 *
 560	 * Note: If we never match a btree type with this buffer, it will be
 561	 * left in memory with NULL b_ops.  This shouldn't be a problem unless
 562	 * the buffer gets written.
 563	 */
 564	error = xfs_trans_read_buf(mp, ri->sc->tp, mp->m_ddev_targp, daddr,
 565			mp->m_bsize, 0, &bp, NULL);
 566	if (error)
 567		return error;
 568
 569	/* Ensure the block magic matches the btree type we're looking for. */
 570	btblock = XFS_BUF_TO_BLOCK(bp);
 571	ASSERT(fab->buf_ops->magic[1] != 0);
 572	if (btblock->bb_magic != fab->buf_ops->magic[1])
 573		goto out;
 574
 575	/*
 576	 * If the buffer already has ops applied and they're not the ones for
 577	 * this btree type, we know this block doesn't match the btree and we
 578	 * can bail out.
 579	 *
 580	 * If the buffer ops match ours, someone else has already validated
 581	 * the block for us, so we can move on to checking if this is a root
 582	 * block candidate.
 583	 *
 584	 * If the buffer does not have ops, nobody has successfully validated
 585	 * the contents and the buffer cannot be dirty.  If the magic, uuid,
 586	 * and structure match this btree type then we'll move on to checking
 587	 * if it's a root block candidate.  If there is no match, bail out.
 588	 */
 589	if (bp->b_ops) {
 590		if (bp->b_ops != fab->buf_ops)
 591			goto out;
 592	} else {
 593		ASSERT(!xfs_trans_buf_is_dirty(bp));
 594		if (!uuid_equal(&btblock->bb_u.s.bb_uuid,
 595				&mp->m_sb.sb_meta_uuid))
 596			goto out;
 597		/*
 598		 * Read verifiers can reference b_ops, so we set the pointer
 599		 * here.  If the verifier fails we'll reset the buffer state
 600		 * to what it was before we touched the buffer.
 601		 */
 602		bp->b_ops = fab->buf_ops;
 603		fab->buf_ops->verify_read(bp);
 604		if (bp->b_error) {
 605			bp->b_ops = NULL;
 606			bp->b_error = 0;
 607			goto out;
 608		}
 609
 610		/*
 611		 * Some read verifiers will (re)set b_ops, so we must be
 612		 * careful not to change b_ops after running the verifier.
 613		 */
 614	}
 615
 616	/*
 617	 * This block passes the magic/uuid and verifier tests for this btree
 618	 * type.  We don't need the caller to try the other tree types.
 619	 */
 620	*done_with_block = true;
 621
 622	/*
 623	 * Compare this btree block's level to the height of the current
 624	 * candidate root block.
 625	 *
 626	 * If the level matches the root we found previously, throw away both
 627	 * blocks because there can't be two candidate roots.
 628	 *
 629	 * If level is lower in the tree than the root we found previously,
 630	 * ignore this block.
 631	 */
 632	block_level = xfs_btree_get_level(btblock);
 633	if (block_level + 1 == fab->height) {
 634		fab->root = NULLAGBLOCK;
 635		goto out;
 636	} else if (block_level < fab->height) {
 637		goto out;
 638	}
 639
 640	/*
 641	 * This is the highest block in the tree that we've found so far.
 642	 * Update the btree height to reflect what we've learned from this
 643	 * block.
 644	 */
 645	fab->height = block_level + 1;
 646
 647	/*
 648	 * If this block doesn't have sibling pointers, then it's the new root
 649	 * block candidate.  Otherwise, the root will be found farther up the
 650	 * tree.
 651	 */
 652	if (btblock->bb_u.s.bb_leftsib == cpu_to_be32(NULLAGBLOCK) &&
 653	    btblock->bb_u.s.bb_rightsib == cpu_to_be32(NULLAGBLOCK))
 654		fab->root = agbno;
 655	else
 656		fab->root = NULLAGBLOCK;
 657
 658	trace_xrep_findroot_block(ri->sc->sa.pag, agbno,
 659			be32_to_cpu(btblock->bb_magic), fab->height - 1);
 660out:
 661	xfs_trans_brelse(ri->sc->tp, bp);
 662	return error;
 663}
 664
 665/*
 666 * Do any of the blocks in this rmap record match one of the btrees we're
 667 * looking for?
 668 */
 669STATIC int
 670xrep_findroot_rmap(
 671	struct xfs_btree_cur		*cur,
 672	const struct xfs_rmap_irec	*rec,
 673	void				*priv)
 674{
 675	struct xrep_findroot		*ri = priv;
 676	struct xrep_find_ag_btree	*fab;
 677	xfs_agblock_t			b;
 678	bool				done;
 679	int				error = 0;
 680
 681	/* Ignore anything that isn't AG metadata. */
 682	if (!XFS_RMAP_NON_INODE_OWNER(rec->rm_owner))
 683		return 0;
 684
 685	/* Otherwise scan each block + btree type. */
 686	for (b = 0; b < rec->rm_blockcount; b++) {
 687		done = false;
 688		for (fab = ri->btree_info; fab->buf_ops; fab++) {
 689			if (rec->rm_owner != fab->rmap_owner)
 690				continue;
 691			error = xrep_findroot_block(ri, fab,
 692					rec->rm_owner, rec->rm_startblock + b,
 693					&done);
 694			if (error)
 695				return error;
 696			if (done)
 697				break;
 698		}
 699	}
 700
 701	return 0;
 702}
 703
 704/* Find the roots of the per-AG btrees described in btree_info. */
 705int
 706xrep_find_ag_btree_roots(
 707	struct xfs_scrub		*sc,
 708	struct xfs_buf			*agf_bp,
 709	struct xrep_find_ag_btree	*btree_info,
 710	struct xfs_buf			*agfl_bp)
 711{
 712	struct xfs_mount		*mp = sc->mp;
 713	struct xrep_findroot		ri;
 714	struct xrep_find_ag_btree	*fab;
 715	struct xfs_btree_cur		*cur;
 716	int				error;
 717
 718	ASSERT(xfs_buf_islocked(agf_bp));
 719	ASSERT(agfl_bp == NULL || xfs_buf_islocked(agfl_bp));
 720
 721	ri.sc = sc;
 722	ri.btree_info = btree_info;
 723	ri.agf = agf_bp->b_addr;
 724	ri.agfl_bp = agfl_bp;
 725	for (fab = btree_info; fab->buf_ops; fab++) {
 726		ASSERT(agfl_bp || fab->rmap_owner != XFS_RMAP_OWN_AG);
 727		ASSERT(XFS_RMAP_NON_INODE_OWNER(fab->rmap_owner));
 728		fab->root = NULLAGBLOCK;
 729		fab->height = 0;
 730	}
 731
 732	cur = xfs_rmapbt_init_cursor(mp, sc->tp, agf_bp, sc->sa.pag);
 733	error = xfs_rmap_query_all(cur, xrep_findroot_rmap, &ri);
 734	xfs_btree_del_cursor(cur, error);
 735
 736	return error;
 737}
 738
 739#ifdef CONFIG_XFS_QUOTA
 740/* Update some quota flags in the superblock. */
 741void
 742xrep_update_qflags(
 743	struct xfs_scrub	*sc,
 744	unsigned int		clear_flags,
 745	unsigned int		set_flags)
 746{
 747	struct xfs_mount	*mp = sc->mp;
 748	struct xfs_buf		*bp;
 749
 750	mutex_lock(&mp->m_quotainfo->qi_quotaofflock);
 751	if ((mp->m_qflags & clear_flags) == 0 &&
 752	    (mp->m_qflags & set_flags) == set_flags)
 753		goto no_update;
 754
 755	mp->m_qflags &= ~clear_flags;
 756	mp->m_qflags |= set_flags;
 757
 758	spin_lock(&mp->m_sb_lock);
 759	mp->m_sb.sb_qflags &= ~clear_flags;
 760	mp->m_sb.sb_qflags |= set_flags;
 761	spin_unlock(&mp->m_sb_lock);
 762
 763	/*
 764	 * Update the quota flags in the ondisk superblock without touching
 765	 * the summary counters.  We have not quiesced inode chunk allocation,
 766	 * so we cannot coordinate with updates to the icount and ifree percpu
 767	 * counters.
 768	 */
 769	bp = xfs_trans_getsb(sc->tp);
 770	xfs_sb_to_disk(bp->b_addr, &mp->m_sb);
 771	xfs_trans_buf_set_type(sc->tp, bp, XFS_BLFT_SB_BUF);
 772	xfs_trans_log_buf(sc->tp, bp, 0, sizeof(struct xfs_dsb) - 1);
 773
 774no_update:
 775	mutex_unlock(&mp->m_quotainfo->qi_quotaofflock);
 776}
 777
 778/* Force a quotacheck the next time we mount. */
 779void
 780xrep_force_quotacheck(
 781	struct xfs_scrub	*sc,
 782	xfs_dqtype_t		type)
 783{
 784	uint			flag;
 785
 786	flag = xfs_quota_chkd_flag(type);
 787	if (!(flag & sc->mp->m_qflags))
 788		return;
 789
 790	xrep_update_qflags(sc, flag, 0);
 791}
 792
 793/*
 794 * Attach dquots to this inode, or schedule quotacheck to fix them.
 795 *
 796 * This function ensures that the appropriate dquots are attached to an inode.
 797 * We cannot allow the dquot code to allocate an on-disk dquot block here
 798 * because we're already in transaction context.  The on-disk dquot should
 799 * already exist anyway.  If the quota code signals corruption or missing quota
 800 * information, schedule quotacheck, which will repair corruptions in the quota
 801 * metadata.
 802 */
 803int
 804xrep_ino_dqattach(
 805	struct xfs_scrub	*sc)
 806{
 807	int			error;
 808
 809	ASSERT(sc->tp != NULL);
 810	ASSERT(sc->ip != NULL);
 811
 812	error = xfs_qm_dqattach(sc->ip);
 813	switch (error) {
 814	case -EFSBADCRC:
 815	case -EFSCORRUPTED:
 816	case -ENOENT:
 817		xfs_err_ratelimited(sc->mp,
 818"inode %llu repair encountered quota error %d, quotacheck forced.",
 819				(unsigned long long)sc->ip->i_ino, error);
 820		if (XFS_IS_UQUOTA_ON(sc->mp) && !sc->ip->i_udquot)
 821			xrep_force_quotacheck(sc, XFS_DQTYPE_USER);
 822		if (XFS_IS_GQUOTA_ON(sc->mp) && !sc->ip->i_gdquot)
 823			xrep_force_quotacheck(sc, XFS_DQTYPE_GROUP);
 824		if (XFS_IS_PQUOTA_ON(sc->mp) && !sc->ip->i_pdquot)
 825			xrep_force_quotacheck(sc, XFS_DQTYPE_PROJ);
 826		fallthrough;
 827	case -ESRCH:
 828		error = 0;
 829		break;
 830	default:
 831		break;
 832	}
 833
 834	return error;
 835}
 836#endif /* CONFIG_XFS_QUOTA */
 837
 838/*
 839 * Ensure that the inode being repaired is ready to handle a certain number of
 840 * extents, or return EFSCORRUPTED.  Caller must hold the ILOCK of the inode
 841 * being repaired and have joined it to the scrub transaction.
 842 */
 843int
 844xrep_ino_ensure_extent_count(
 845	struct xfs_scrub	*sc,
 846	int			whichfork,
 847	xfs_extnum_t		nextents)
 848{
 849	xfs_extnum_t		max_extents;
 850	bool			inode_has_nrext64;
 851
 852	inode_has_nrext64 = xfs_inode_has_large_extent_counts(sc->ip);
 853	max_extents = xfs_iext_max_nextents(inode_has_nrext64, whichfork);
 854	if (nextents <= max_extents)
 855		return 0;
 856	if (inode_has_nrext64)
 857		return -EFSCORRUPTED;
 858	if (!xfs_has_large_extent_counts(sc->mp))
 859		return -EFSCORRUPTED;
 860
 861	max_extents = xfs_iext_max_nextents(true, whichfork);
 862	if (nextents > max_extents)
 863		return -EFSCORRUPTED;
 864
 865	sc->ip->i_diflags2 |= XFS_DIFLAG2_NREXT64;
 866	xfs_trans_log_inode(sc->tp, sc->ip, XFS_ILOG_CORE);
 867	return 0;
 868}
 869
 870/*
 871 * Initialize all the btree cursors for an AG repair except for the btree that
 872 * we're rebuilding.
 873 */
 874void
 875xrep_ag_btcur_init(
 876	struct xfs_scrub	*sc,
 877	struct xchk_ag		*sa)
 878{
 879	struct xfs_mount	*mp = sc->mp;
 880
 881	/* Set up a bnobt cursor for cross-referencing. */
 882	if (sc->sm->sm_type != XFS_SCRUB_TYPE_BNOBT &&
 883	    sc->sm->sm_type != XFS_SCRUB_TYPE_CNTBT) {
 884		sa->bno_cur = xfs_bnobt_init_cursor(mp, sc->tp, sa->agf_bp,
 885				sc->sa.pag);
 886		sa->cnt_cur = xfs_cntbt_init_cursor(mp, sc->tp, sa->agf_bp,
 887				sc->sa.pag);
 888	}
 889
 890	/* Set up a inobt cursor for cross-referencing. */
 891	if (sc->sm->sm_type != XFS_SCRUB_TYPE_INOBT &&
 892	    sc->sm->sm_type != XFS_SCRUB_TYPE_FINOBT) {
 893		sa->ino_cur = xfs_inobt_init_cursor(sc->sa.pag, sc->tp,
 894				sa->agi_bp);
 895		if (xfs_has_finobt(mp))
 896			sa->fino_cur = xfs_finobt_init_cursor(sc->sa.pag,
 897					sc->tp, sa->agi_bp);
 898	}
 899
 900	/* Set up a rmapbt cursor for cross-referencing. */
 901	if (sc->sm->sm_type != XFS_SCRUB_TYPE_RMAPBT &&
 902	    xfs_has_rmapbt(mp))
 903		sa->rmap_cur = xfs_rmapbt_init_cursor(mp, sc->tp, sa->agf_bp,
 904				sc->sa.pag);
 905
 906	/* Set up a refcountbt cursor for cross-referencing. */
 907	if (sc->sm->sm_type != XFS_SCRUB_TYPE_REFCNTBT &&
 908	    xfs_has_reflink(mp))
 909		sa->refc_cur = xfs_refcountbt_init_cursor(mp, sc->tp,
 910				sa->agf_bp, sc->sa.pag);
 911}
 912
 913/*
 914 * Reinitialize the in-core AG state after a repair by rereading the AGF
 915 * buffer.  We had better get the same AGF buffer as the one that's attached
 916 * to the scrub context.
 917 */
 918int
 919xrep_reinit_pagf(
 920	struct xfs_scrub	*sc)
 921{
 922	struct xfs_perag	*pag = sc->sa.pag;
 923	struct xfs_buf		*bp;
 924	int			error;
 925
 926	ASSERT(pag);
 927	ASSERT(xfs_perag_initialised_agf(pag));
 928
 929	clear_bit(XFS_AGSTATE_AGF_INIT, &pag->pag_opstate);
 930	error = xfs_alloc_read_agf(pag, sc->tp, 0, &bp);
 931	if (error)
 932		return error;
 933
 934	if (bp != sc->sa.agf_bp) {
 935		ASSERT(bp == sc->sa.agf_bp);
 936		return -EFSCORRUPTED;
 937	}
 938
 939	return 0;
 940}
 941
 942/*
 943 * Reinitialize the in-core AG state after a repair by rereading the AGI
 944 * buffer.  We had better get the same AGI buffer as the one that's attached
 945 * to the scrub context.
 946 */
 947int
 948xrep_reinit_pagi(
 949	struct xfs_scrub	*sc)
 950{
 951	struct xfs_perag	*pag = sc->sa.pag;
 952	struct xfs_buf		*bp;
 953	int			error;
 954
 955	ASSERT(pag);
 956	ASSERT(xfs_perag_initialised_agi(pag));
 957
 958	clear_bit(XFS_AGSTATE_AGI_INIT, &pag->pag_opstate);
 959	error = xfs_ialloc_read_agi(pag, sc->tp, 0, &bp);
 960	if (error)
 961		return error;
 962
 963	if (bp != sc->sa.agi_bp) {
 964		ASSERT(bp == sc->sa.agi_bp);
 965		return -EFSCORRUPTED;
 966	}
 967
 968	return 0;
 969}
 970
 971/*
 972 * Given an active reference to a perag structure, load AG headers and cursors.
 973 * This should only be called to scan an AG while repairing file-based metadata.
 974 */
 975int
 976xrep_ag_init(
 977	struct xfs_scrub	*sc,
 978	struct xfs_perag	*pag,
 979	struct xchk_ag		*sa)
 980{
 981	int			error;
 982
 983	ASSERT(!sa->pag);
 984
 985	error = xfs_ialloc_read_agi(pag, sc->tp, 0, &sa->agi_bp);
 986	if (error)
 987		return error;
 988
 989	error = xfs_alloc_read_agf(pag, sc->tp, 0, &sa->agf_bp);
 990	if (error)
 991		return error;
 992
 993	/* Grab our own passive reference from the caller's ref. */
 994	sa->pag = xfs_perag_hold(pag);
 995	xrep_ag_btcur_init(sc, sa);
 996	return 0;
 997}
 998
 999#ifdef CONFIG_XFS_RT
1000/* Initialize all the btree cursors for a RT repair. */
1001void
1002xrep_rtgroup_btcur_init(
1003	struct xfs_scrub	*sc,
1004	struct xchk_rt		*sr)
1005{
1006	struct xfs_mount	*mp = sc->mp;
1007
1008	ASSERT(sr->rtg != NULL);
1009
1010	if (sc->sm->sm_type != XFS_SCRUB_TYPE_RTRMAPBT &&
1011	    (sr->rtlock_flags & XFS_RTGLOCK_RMAP) &&
1012	    xfs_has_rtrmapbt(mp))
1013		sr->rmap_cur = xfs_rtrmapbt_init_cursor(sc->tp, sr->rtg);
1014
1015	if (sc->sm->sm_type != XFS_SCRUB_TYPE_RTREFCBT &&
1016	    (sr->rtlock_flags & XFS_RTGLOCK_REFCOUNT) &&
1017	    xfs_has_rtreflink(mp))
1018		sr->refc_cur = xfs_rtrefcountbt_init_cursor(sc->tp, sr->rtg);
1019}
1020
1021/*
1022 * Given a reference to a rtgroup structure, lock rtgroup btree inodes and
1023 * create btree cursors.  Must only be called to repair a regular rt file.
1024 */
1025int
1026xrep_rtgroup_init(
1027	struct xfs_scrub	*sc,
1028	struct xfs_rtgroup	*rtg,
1029	struct xchk_rt		*sr,
1030	unsigned int		rtglock_flags)
1031{
1032	ASSERT(sr->rtg == NULL);
1033
1034	xfs_rtgroup_lock(rtg, rtglock_flags);
1035	sr->rtlock_flags = rtglock_flags;
1036
1037	/* Grab our own passive reference from the caller's ref. */
1038	sr->rtg = xfs_rtgroup_hold(rtg);
1039	xrep_rtgroup_btcur_init(sc, sr);
1040	return 0;
1041}
1042
1043/* Ensure that all rt blocks in the given range are not marked free. */
1044int
1045xrep_require_rtext_inuse(
1046	struct xfs_scrub	*sc,
1047	xfs_rgblock_t		rgbno,
1048	xfs_filblks_t		len)
1049{
1050	struct xfs_mount	*mp = sc->mp;
1051	xfs_rtxnum_t		startrtx;
1052	xfs_rtxnum_t		endrtx;
1053	bool			is_free = false;
1054	int			error = 0;
1055
1056	if (xfs_has_zoned(mp)) {
1057		if (!xfs_zone_rgbno_is_valid(sc->sr.rtg, rgbno + len - 1))
1058			return -EFSCORRUPTED;
1059		return 0;
1060	}
1061
1062	startrtx = xfs_rgbno_to_rtx(mp, rgbno);
1063	endrtx = xfs_rgbno_to_rtx(mp, rgbno + len - 1);
1064
1065	error = xfs_rtalloc_extent_is_free(sc->sr.rtg, sc->tp, startrtx,
1066			endrtx - startrtx + 1, &is_free);
1067	if (error)
1068		return error;
1069	if (is_free)
1070		return -EFSCORRUPTED;
1071
1072	return 0;
1073}
1074#endif /* CONFIG_XFS_RT */
1075
1076/* Reinitialize the per-AG block reservation for the AG we just fixed. */
1077int
1078xrep_reset_perag_resv(
1079	struct xfs_scrub	*sc)
1080{
1081	int			error;
1082
1083	if (!(sc->flags & XREP_RESET_PERAG_RESV))
1084		return 0;
1085
1086	ASSERT(sc->sa.pag != NULL);
1087	ASSERT(sc->ops->type == ST_PERAG);
1088	ASSERT(sc->tp);
1089
1090	sc->flags &= ~XREP_RESET_PERAG_RESV;
1091	xfs_ag_resv_free(sc->sa.pag);
1092	error = xfs_ag_resv_init(sc->sa.pag, sc->tp);
1093	if (error == -ENOSPC) {
1094		xfs_err(sc->mp,
1095"Insufficient free space to reset per-AG reservation for AG %u after repair.",
1096				pag_agno(sc->sa.pag));
1097		error = 0;
1098	}
1099
1100	return error;
1101}
1102
1103/* Decide if we are going to call the repair function for a scrub type. */
1104bool
1105xrep_will_attempt(
1106	struct xfs_scrub	*sc)
1107{
1108	/* Userspace asked us to rebuild the structure regardless. */
1109	if (sc->sm->sm_flags & XFS_SCRUB_IFLAG_FORCE_REBUILD)
1110		return true;
1111
1112	/* Let debug users force us into the repair routines. */
1113	if (XFS_TEST_ERROR(sc->mp, XFS_ERRTAG_FORCE_SCRUB_REPAIR))
1114		return true;
1115
1116	/* Metadata is corrupt or failed cross-referencing. */
1117	if (xchk_needs_repair(sc->sm))
1118		return true;
1119
1120	return false;
1121}
1122
1123/* Try to fix some part of a metadata inode by calling another scrubber. */
1124STATIC int
1125xrep_metadata_inode_subtype(
1126	struct xfs_scrub	*sc,
1127	unsigned int		scrub_type)
1128{
1129	struct xfs_scrub_subord	*sub;
1130	int			error;
1131
1132	/*
1133	 * Let's see if the inode needs repair.  Use a subordinate scrub context
1134	 * to call the scrub and repair functions so that we can hang on to the
1135	 * resources that we already acquired instead of using the standard
1136	 * setup/teardown routines.
1137	 */
1138	sub = xchk_scrub_create_subord(sc, scrub_type);
1139	if (!sub)
1140		return -ENOMEM;
1141
1142	error = sub->sc.ops->scrub(&sub->sc);
1143	if (error)
1144		goto out;
1145	if (!xrep_will_attempt(&sub->sc))
1146		goto out;
1147
1148	/*
1149	 * Repair some part of the inode.  This will potentially join the inode
1150	 * to the transaction.
1151	 */
1152	error = sub->sc.ops->repair(&sub->sc);
1153	if (error)
1154		goto out;
1155
1156	/*
1157	 * Finish all deferred intent items and then roll the transaction so
1158	 * that the inode will not be joined to the transaction when we exit
1159	 * the function.
1160	 */
1161	error = xfs_defer_finish(&sub->sc.tp);
1162	if (error)
1163		goto out;
1164	error = xfs_trans_roll(&sub->sc.tp);
1165	if (error)
1166		goto out;
1167
1168	/*
1169	 * Clear the corruption flags and re-check the metadata that we just
1170	 * repaired.
1171	 */
1172	sub->sc.sm->sm_flags &= ~XFS_SCRUB_FLAGS_OUT;
1173	error = sub->sc.ops->scrub(&sub->sc);
1174	if (error)
1175		goto out;
1176
1177	/* If corruption persists, the repair has failed. */
1178	if (xchk_needs_repair(sub->sc.sm)) {
1179		error = -EFSCORRUPTED;
1180		goto out;
1181	}
1182out:
1183	xchk_scrub_free_subord(sub);
1184	return error;
1185}
1186
1187/*
1188 * Repair the ondisk forks of a metadata inode.  The caller must ensure that
1189 * sc->ip points to the metadata inode and the ILOCK is held on that inode.
1190 * The inode must not be joined to the transaction before the call, and will
1191 * not be afterwards.
1192 */
1193int
1194xrep_metadata_inode_forks(
1195	struct xfs_scrub	*sc)
1196{
1197	bool			dirty = false;
1198	int			error;
1199
1200	/* Repair the inode record and the data fork. */
1201	error = xrep_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_INODE);
1202	if (error)
1203		return error;
1204
1205	error = xrep_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_BMBTD);
1206	if (error)
1207		return error;
1208
1209	/*
1210	 * Metadata files can only have extended attributes on metadir
1211	 * filesystems, either for parent pointers or for actual xattr data.
1212	 * For a non-metadir filesystem, make sure the attr fork looks ok
1213	 * before we delete it.
1214	 */
1215	if (xfs_inode_hasattr(sc->ip)) {
1216		error = xrep_metadata_inode_subtype(sc, XFS_SCRUB_TYPE_BMBTA);
1217		if (error)
1218			return error;
1219	}
1220
1221	/* Clear the reflink flag since metadata never shares. */
1222	if (xfs_is_reflink_inode(sc->ip)) {
1223		dirty = true;
1224		xfs_trans_ijoin(sc->tp, sc->ip, 0);
1225		error = xfs_reflink_clear_inode_flag(sc->ip, &sc->tp);
1226		if (error)
1227			return error;
1228	}
1229
1230	/*
1231	 * Metadata files on non-metadir filesystems cannot have attr forks,
1232	 * so clear them now.
1233	 */
1234	if (xfs_inode_hasattr(sc->ip) && !xfs_has_metadir(sc->mp)) {
1235		if (!dirty) {
1236			dirty = true;
1237			xfs_trans_ijoin(sc->tp, sc->ip, 0);
1238		}
1239		error = xrep_xattr_reset_fork(sc);
1240		if (error)
1241			return error;
1242	}
1243
1244	/*
1245	 * If we modified the inode, roll the transaction but don't rejoin the
1246	 * inode to the new transaction because xrep_bmap_data can do that.
1247	 */
1248	if (dirty) {
1249		error = xfs_trans_roll(&sc->tp);
1250		if (error)
1251			return error;
1252		dirty = false;
1253	}
1254
1255	return 0;
1256}
1257
1258/*
1259 * Set up an in-memory buffer cache so that we can use the xfbtree.  Allocating
1260 * a shmem file might take loks, so we cannot be in transaction context.  Park
1261 * our resources in the scrub context and let the teardown function take care
1262 * of them at the right time.
1263 */
1264int
1265xrep_setup_xfbtree(
1266	struct xfs_scrub	*sc,
1267	const char		*descr)
1268{
1269	ASSERT(sc->tp == NULL);
1270
1271	return xmbuf_alloc(sc->mp, descr, &sc->xmbtp);
1272}
1273
1274/*
1275 * See if this buffer can pass the given ->verify_struct() function.
1276 *
1277 * If the buffer already has ops attached and they're not the ones that were
1278 * passed in, we reject the buffer.  Otherwise, we perform the structure test
1279 * (note that we do not check CRCs) and return the outcome of the test.  The
1280 * buffer ops and error state are left unchanged.
1281 */
1282bool
1283xrep_buf_verify_struct(
1284	struct xfs_buf			*bp,
1285	const struct xfs_buf_ops	*ops)
1286{
1287	const struct xfs_buf_ops	*old_ops = bp->b_ops;
1288	xfs_failaddr_t			fa;
1289	int				old_error;
1290
1291	if (old_ops) {
1292		if (old_ops != ops)
1293			return false;
1294	}
1295
1296	old_error = bp->b_error;
1297	bp->b_ops = ops;
1298	fa = bp->b_ops->verify_struct(bp);
1299	bp->b_ops = old_ops;
1300	bp->b_error = old_error;
1301
1302	return fa == NULL;
1303}
1304
1305/* Check the sanity of a rmap record for a metadata btree inode. */
1306int
1307xrep_check_ino_btree_mapping(
1308	struct xfs_scrub		*sc,
1309	const struct xfs_rmap_irec	*rec)
1310{
1311	enum xbtree_recpacking		outcome;
1312	int				error;
1313
1314	/*
1315	 * Metadata btree inodes never have extended attributes, and all blocks
1316	 * should have the bmbt block flag set.
1317	 */
1318	if ((rec->rm_flags & XFS_RMAP_ATTR_FORK) ||
1319	    !(rec->rm_flags & XFS_RMAP_BMBT_BLOCK))
1320		return -EFSCORRUPTED;
1321
1322	/* Make sure the block is within the AG. */
1323	if (!xfs_verify_agbext(sc->sa.pag, rec->rm_startblock,
1324				rec->rm_blockcount))
1325		return -EFSCORRUPTED;
1326
1327	/* Make sure this isn't free space. */
1328	error = xfs_alloc_has_records(sc->sa.bno_cur, rec->rm_startblock,
1329			rec->rm_blockcount, &outcome);
1330	if (error)
1331		return error;
1332	if (outcome != XBTREE_RECPACKING_EMPTY)
1333		return -EFSCORRUPTED;
1334
1335	return 0;
1336}
1337
1338/*
1339 * Reset the block count of the inode being repaired, and adjust the dquot
1340 * block usage to match.  The inode must not have an xattr fork.
1341 */
1342void
1343xrep_inode_set_nblocks(
1344	struct xfs_scrub	*sc,
1345	int64_t			new_blocks)
1346{
1347	int64_t			delta =
1348		new_blocks - sc->ip->i_nblocks;
1349
1350	sc->ip->i_nblocks = new_blocks;
1351
1352	xfs_trans_log_inode(sc->tp, sc->ip, XFS_ILOG_CORE);
1353	if (delta != 0)
1354		xfs_trans_mod_dquot_byino(sc->tp, sc->ip, XFS_TRANS_DQ_BCOUNT,
1355				delta);
1356}
1357
1358/* Reset the block reservation for a metadata inode. */
1359int
1360xrep_reset_metafile_resv(
1361	struct xfs_scrub	*sc)
1362{
1363	struct xfs_mount	*mp = sc->mp;
1364	int64_t			delta;
1365	int			error;
1366
1367	delta = mp->m_metafile_resv_used + mp->m_metafile_resv_avail -
1368		mp->m_metafile_resv_target;
1369	if (delta == 0)
1370		return 0;
1371
1372	/*
1373	 * Too many blocks have been reserved, transfer some from the incore
1374	 * reservation back to the filesystem.
1375	 */
1376	if (delta > 0) {
1377		int64_t		give_back;
1378
1379		give_back = min_t(uint64_t, delta, mp->m_metafile_resv_avail);
1380		if (give_back > 0) {
1381			xfs_mod_sb_delalloc(mp, -give_back);
1382			xfs_add_fdblocks(mp, give_back);
1383			mp->m_metafile_resv_avail -= give_back;
1384		}
1385
1386		return 0;
1387	}
1388
1389	/*
1390	 * Not enough reservation; try to take some blocks from the filesystem
1391	 * to the metabtree reservation.
1392	 */
1393	delta = -delta; /* delta is negative here, so invert the sign. */
1394	error = xfs_dec_fdblocks(mp, delta, true);
1395	while (error == -ENOSPC) {
1396		delta--;
1397		if (delta == 0) {
1398			xfs_warn(sc->mp,
1399"Insufficient free space to reset metabtree reservation after repair.");
1400			return 0;
1401		}
1402		error = xfs_dec_fdblocks(mp, delta, true);
1403	}
1404	if (error)
1405		return error;
1406
1407	xfs_mod_sb_delalloc(mp, delta);
1408	mp->m_metafile_resv_avail += delta;
1409	return 0;
1410}