xfs/scrub/fscounters.c

0001 // SPDX-License-Identifier: GPL-2.0+
0002 /*
0003  * Copyright (C) 2019 Oracle.  All Rights Reserved.
0004  * Author: Darrick J. Wong <darrick.wong@oracle.com>
0005  */
0006 #include "xfs.h"
0007 #include "xfs_fs.h"
0008 #include "xfs_shared.h"
0009 #include "xfs_format.h"
0010 #include "xfs_trans_resv.h"
0011 #include "xfs_mount.h"
0012 #include "xfs_alloc.h"
0013 #include "xfs_ialloc.h"
0014 #include "xfs_health.h"
0015 #include "xfs_btree.h"
0016 #include "xfs_ag.h"
0017 #include "scrub/scrub.h"
0018 #include "scrub/common.h"
0019 #include "scrub/trace.h"
0020
0021 /*
0022  * FS Summary Counters
0023  * ===================
0024  *
0025  * The basics of filesystem summary counter checking are that we iterate the
0026  * AGs counting the number of free blocks, free space btree blocks, per-AG
0027  * reservations, inodes, delayed allocation reservations, and free inodes.
0028  * Then we compare what we computed against the in-core counters.
0029  *
0030  * However, the reality is that summary counters are a tricky beast to check.
0031  * While we /could/ freeze the filesystem and scramble around the AGs counting
0032  * the free blocks, in practice we prefer not do that for a scan because
0033  * freezing is costly.  To get around this, we added a per-cpu counter of the
0034  * delalloc reservations so that we can rotor around the AGs relatively
0035  * quickly, and we allow the counts to be slightly off because we're not taking
0036  * any locks while we do this.
0037  *
0038  * So the first thing we do is warm up the buffer cache in the setup routine by
0039  * walking all the AGs to make sure the incore per-AG structure has been
0040  * initialized.  The expected value calculation then iterates the incore per-AG
0041  * structures as quickly as it can.  We snapshot the percpu counters before and
0042  * after this operation and use the difference in counter values to guess at
0043  * our tolerance for mismatch between expected and actual counter values.
0044  */
0045
0046 /*
0047  * Since the expected value computation is lockless but only browses incore
0048  * values, the percpu counters should be fairly close to each other.  However,
0049  * we'll allow ourselves to be off by at least this (arbitrary) amount.
0050  */
0051 #define XCHK_FSCOUNT_MIN_VARIANCE   (512)
0052
0053 /*
0054  * Make sure the per-AG structure has been initialized from the on-disk header
0055  * contents and trust that the incore counters match the ondisk counters.  (The
0056  * AGF and AGI scrubbers check them, and a normal xfs_scrub run checks the
0057  * summary counters after checking all AG headers).  Do this from the setup
0058  * function so that the inner AG aggregation loop runs as quickly as possible.
0059  *
0060  * This function runs during the setup phase /before/ we start checking any
0061  * metadata.
0062  */
0063 STATIC int
0064 xchk_fscount_warmup(
0065     struct xfs_scrub    *sc)
0066 {
0067     struct xfs_mount    *mp = sc->mp;
0068     struct xfs_buf      *agi_bp = NULL;
0069     struct xfs_buf      *agf_bp = NULL;
0070     struct xfs_perag    *pag = NULL;
0071     xfs_agnumber_t      agno;
0072     int         error = 0;
0073
0074     for_each_perag(mp, agno, pag) {
0075         if (xchk_should_terminate(sc, &error))
0076             break;
0077         if (pag->pagi_init && pag->pagf_init)
0078             continue;
0079
0080         /* Lock both AG headers. */
0081         error = xfs_ialloc_read_agi(pag, sc->tp, &agi_bp);
0082         if (error)
0083             break;
0084         error = xfs_alloc_read_agf(pag, sc->tp, 0, &agf_bp);
0085         if (error)
0086             break;
0087
0088         /*
0089          * These are supposed to be initialized by the header read
0090          * function.
0091          */
0092         if (!pag->pagi_init || !pag->pagf_init) {
0093             error = -EFSCORRUPTED;
0094             break;
0095         }
0096
0097         xfs_buf_relse(agf_bp);
0098         agf_bp = NULL;
0099         xfs_buf_relse(agi_bp);
0100         agi_bp = NULL;
0101     }
0102
0103     if (agf_bp)
0104         xfs_buf_relse(agf_bp);
0105     if (agi_bp)
0106         xfs_buf_relse(agi_bp);
0107     if (pag)
0108         xfs_perag_put(pag);
0109     return error;
0110 }
0111
0112 int
0113 xchk_setup_fscounters(
0114     struct xfs_scrub    *sc)
0115 {
0116     struct xchk_fscounters  *fsc;
0117     int         error;
0118
0119     sc->buf = kmem_zalloc(sizeof(struct xchk_fscounters), 0);
0120     if (!sc->buf)
0121         return -ENOMEM;
0122     fsc = sc->buf;
0123
0124     xfs_icount_range(sc->mp, &fsc->icount_min, &fsc->icount_max);
0125
0126     /* We must get the incore counters set up before we can proceed. */
0127     error = xchk_fscount_warmup(sc);
0128     if (error)
0129         return error;
0130
0131     /*
0132      * Pause background reclaim while we're scrubbing to reduce the
0133      * likelihood of background perturbations to the counters throwing off
0134      * our calculations.
0135      */
0136     xchk_stop_reaping(sc);
0137
0138     return xchk_trans_alloc(sc, 0);
0139 }
0140
0141 /* Count free space btree blocks manually for pre-lazysbcount filesystems. */
0142 static int
0143 xchk_fscount_btreeblks(
0144     struct xfs_scrub    *sc,
0145     struct xchk_fscounters  *fsc,
0146     xfs_agnumber_t      agno)
0147 {
0148     xfs_extlen_t        blocks;
0149     int         error;
0150
0151     error = xchk_ag_init_existing(sc, agno, &sc->sa);
0152     if (error)
0153         goto out_free;
0154
0155     error = xfs_btree_count_blocks(sc->sa.bno_cur, &blocks);
0156     if (error)
0157         goto out_free;
0158     fsc->fdblocks += blocks - 1;
0159
0160     error = xfs_btree_count_blocks(sc->sa.cnt_cur, &blocks);
0161     if (error)
0162         goto out_free;
0163     fsc->fdblocks += blocks - 1;
0164
0165 out_free:
0166     xchk_ag_free(sc, &sc->sa);
0167     return error;
0168 }
0169
0170 /*
0171  * Calculate what the global in-core counters ought to be from the incore
0172  * per-AG structure.  Callers can compare this to the actual in-core counters
0173  * to estimate by how much both in-core and on-disk counters need to be
0174  * adjusted.
0175  */
0176 STATIC int
0177 xchk_fscount_aggregate_agcounts(
0178     struct xfs_scrub    *sc,
0179     struct xchk_fscounters  *fsc)
0180 {
0181     struct xfs_mount    *mp = sc->mp;
0182     struct xfs_perag    *pag;
0183     uint64_t        delayed;
0184     xfs_agnumber_t      agno;
0185     int         tries = 8;
0186     int         error = 0;
0187
0188 retry:
0189     fsc->icount = 0;
0190     fsc->ifree = 0;
0191     fsc->fdblocks = 0;
0192
0193     for_each_perag(mp, agno, pag) {
0194         if (xchk_should_terminate(sc, &error))
0195             break;
0196
0197         /* This somehow got unset since the warmup? */
0198         if (!pag->pagi_init || !pag->pagf_init) {
0199             error = -EFSCORRUPTED;
0200             break;
0201         }
0202
0203         /* Count all the inodes */
0204         fsc->icount += pag->pagi_count;
0205         fsc->ifree += pag->pagi_freecount;
0206
0207         /* Add up the free/freelist/bnobt/cntbt blocks */
0208         fsc->fdblocks += pag->pagf_freeblks;
0209         fsc->fdblocks += pag->pagf_flcount;
0210         if (xfs_has_lazysbcount(sc->mp)) {
0211             fsc->fdblocks += pag->pagf_btreeblks;
0212         } else {
0213             error = xchk_fscount_btreeblks(sc, fsc, agno);
0214             if (error)
0215                 break;
0216         }
0217
0218         /*
0219          * Per-AG reservations are taken out of the incore counters,
0220          * so they must be left out of the free blocks computation.
0221          */
0222         fsc->fdblocks -= pag->pag_meta_resv.ar_reserved;
0223         fsc->fdblocks -= pag->pag_rmapbt_resv.ar_orig_reserved;
0224
0225     }
0226     if (pag)
0227         xfs_perag_put(pag);
0228     if (error)
0229         return error;
0230
0231     /*
0232      * The global incore space reservation is taken from the incore
0233      * counters, so leave that out of the computation.
0234      */
0235     fsc->fdblocks -= mp->m_resblks_avail;
0236
0237     /*
0238      * Delayed allocation reservations are taken out of the incore counters
0239      * but not recorded on disk, so leave them and their indlen blocks out
0240      * of the computation.
0241      */
0242     delayed = percpu_counter_sum(&mp->m_delalloc_blks);
0243     fsc->fdblocks -= delayed;
0244
0245     trace_xchk_fscounters_calc(mp, fsc->icount, fsc->ifree, fsc->fdblocks,
0246             delayed);
0247
0248
0249     /* Bail out if the values we compute are totally nonsense. */
0250     if (fsc->icount < fsc->icount_min || fsc->icount > fsc->icount_max ||
0251         fsc->fdblocks > mp->m_sb.sb_dblocks ||
0252         fsc->ifree > fsc->icount_max)
0253         return -EFSCORRUPTED;
0254
0255     /*
0256      * If ifree > icount then we probably had some perturbation in the
0257      * counters while we were calculating things.  We'll try a few times
0258      * to maintain ifree <= icount before giving up.
0259      */
0260     if (fsc->ifree > fsc->icount) {
0261         if (tries--)
0262             goto retry;
0263         xchk_set_incomplete(sc);
0264         return 0;
0265     }
0266
0267     return 0;
0268 }
0269
0270 /*
0271  * Is the @counter reasonably close to the @expected value?
0272  *
0273  * We neither locked nor froze anything in the filesystem while aggregating the
0274  * per-AG data to compute the @expected value, which means that the counter
0275  * could have changed.  We know the @old_value of the summation of the counter
0276  * before the aggregation, and we re-sum the counter now.  If the expected
0277  * value falls between the two summations, we're ok.
0278  *
0279  * Otherwise, we /might/ have a problem.  If the change in the summations is
0280  * more than we want to tolerate, the filesystem is probably busy and we should
0281  * just send back INCOMPLETE and see if userspace will try again.
0282  */
0283 static inline bool
0284 xchk_fscount_within_range(
0285     struct xfs_scrub    *sc,
0286     const int64_t       old_value,
0287     struct percpu_counter   *counter,
0288     uint64_t        expected)
0289 {
0290     int64_t         min_value, max_value;
0291     int64_t         curr_value = percpu_counter_sum(counter);
0292
0293     trace_xchk_fscounters_within_range(sc->mp, expected, curr_value,
0294             old_value);
0295
0296     /* Negative values are always wrong. */
0297     if (curr_value < 0)
0298         return false;
0299
0300     /* Exact matches are always ok. */
0301     if (curr_value == expected)
0302         return true;
0303
0304     min_value = min(old_value, curr_value);
0305     max_value = max(old_value, curr_value);
0306
0307     /* Within the before-and-after range is ok. */
0308     if (expected >= min_value && expected <= max_value)
0309         return true;
0310
0311     /*
0312      * If the difference between the two summations is too large, the fs
0313      * might just be busy and so we'll mark the scrub incomplete.  Return
0314      * true here so that we don't mark the counter corrupt.
0315      *
0316      * XXX: In the future when userspace can grant scrub permission to
0317      * quiesce the filesystem to solve the outsized variance problem, this
0318      * check should be moved up and the return code changed to signal to
0319      * userspace that we need quiesce permission.
0320      */
0321     if (max_value - min_value >= XCHK_FSCOUNT_MIN_VARIANCE) {
0322         xchk_set_incomplete(sc);
0323         return true;
0324     }
0325
0326     return false;
0327 }
0328
0329 /* Check the superblock counters. */
0330 int
0331 xchk_fscounters(
0332     struct xfs_scrub    *sc)
0333 {
0334     struct xfs_mount    *mp = sc->mp;
0335     struct xchk_fscounters  *fsc = sc->buf;
0336     int64_t         icount, ifree, fdblocks;
0337     int         error;
0338
0339     /* Snapshot the percpu counters. */
0340     icount = percpu_counter_sum(&mp->m_icount);
0341     ifree = percpu_counter_sum(&mp->m_ifree);
0342     fdblocks = percpu_counter_sum(&mp->m_fdblocks);
0343
0344     /* No negative values, please! */
0345     if (icount < 0 || ifree < 0 || fdblocks < 0)
0346         xchk_set_corrupt(sc);
0347
0348     /* See if icount is obviously wrong. */
0349     if (icount < fsc->icount_min || icount > fsc->icount_max)
0350         xchk_set_corrupt(sc);
0351
0352     /* See if fdblocks is obviously wrong. */
0353     if (fdblocks > mp->m_sb.sb_dblocks)
0354         xchk_set_corrupt(sc);
0355
0356     /*
0357      * If ifree exceeds icount by more than the minimum variance then
0358      * something's probably wrong with the counters.
0359      */
0360     if (ifree > icount && ifree - icount > XCHK_FSCOUNT_MIN_VARIANCE)
0361         xchk_set_corrupt(sc);
0362
0363     /* Walk the incore AG headers to calculate the expected counters. */
0364     error = xchk_fscount_aggregate_agcounts(sc, fsc);
0365     if (!xchk_process_error(sc, 0, XFS_SB_BLOCK(mp), &error))
0366         return error;
0367     if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_INCOMPLETE)
0368         return 0;
0369
0370     /* Compare the in-core counters with whatever we counted. */
0371     if (!xchk_fscount_within_range(sc, icount, &mp->m_icount, fsc->icount))
0372         xchk_set_corrupt(sc);
0373
0374     if (!xchk_fscount_within_range(sc, ifree, &mp->m_ifree, fsc->ifree))
0375         xchk_set_corrupt(sc);
0376
0377     if (!xchk_fscount_within_range(sc, fdblocks, &mp->m_fdblocks,
0378             fsc->fdblocks))
0379         xchk_set_corrupt(sc);
0380
0381     return 0;
0382 }