1 // SPDX-License-Identifier: GPL-2.0
3 * Copyright (c) 2000-2005 Silicon Graphics, Inc.
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_log_format.h"
11 #include "xfs_trans_resv.h"
13 #include "xfs_mount.h"
14 #include "xfs_trans.h"
15 #include "xfs_error.h"
16 #include "xfs_alloc.h"
17 #include "xfs_fsops.h"
18 #include "xfs_trans_space.h"
20 #include "xfs_log_priv.h"
22 #include "xfs_ag_resv.h"
23 #include "xfs_trace.h"
26 * Write new AG headers to disk. Non-transactional, but need to be
27 * written and completed prior to the growfs transaction being logged.
28 * To do this, we use a delayed write buffer list and wait for
29 * submission and IO completion of the list as a whole. This allows the
30 * IO subsystem to merge all the AG headers in a single AG into a single
31 * IO and hide most of the latency of the IO from us.
33 * This also means that if we get an error whilst building the buffer
34 * list to write, we can cancel the entire list without having written
38 xfs_resizefs_init_new_ags(
40 struct aghdr_init_data
*id
,
41 xfs_agnumber_t oagcount
,
42 xfs_agnumber_t nagcount
,
44 struct xfs_perag
*last_pag
,
45 bool *lastag_extended
)
47 struct xfs_mount
*mp
= tp
->t_mountp
;
48 xfs_rfsblock_t nb
= mp
->m_sb
.sb_dblocks
+ delta
;
51 *lastag_extended
= false;
53 INIT_LIST_HEAD(&id
->buffer_list
);
54 for (id
->agno
= nagcount
- 1;
56 id
->agno
--, delta
-= id
->agsize
) {
58 if (id
->agno
== nagcount
- 1)
59 id
->agsize
= nb
- (id
->agno
*
60 (xfs_rfsblock_t
)mp
->m_sb
.sb_agblocks
);
62 id
->agsize
= mp
->m_sb
.sb_agblocks
;
64 error
= xfs_ag_init_headers(mp
, id
);
66 xfs_buf_delwri_cancel(&id
->buffer_list
);
71 error
= xfs_buf_delwri_submit(&id
->buffer_list
);
76 *lastag_extended
= true;
77 error
= xfs_ag_extend_space(last_pag
, tp
, delta
);
86 xfs_growfs_data_private(
87 struct xfs_mount
*mp
, /* mount point for filesystem */
88 struct xfs_growfs_data
*in
) /* growfs data input struct */
90 xfs_agnumber_t oagcount
= mp
->m_sb
.sb_agcount
;
93 xfs_agnumber_t nagcount
;
94 xfs_agnumber_t nagimax
= 0;
95 xfs_rfsblock_t nb
, nb_div
, nb_mod
;
97 bool lastag_extended
= false;
99 struct aghdr_init_data id
= {};
100 struct xfs_perag
*last_pag
;
103 error
= xfs_sb_validate_fsb_count(&mp
->m_sb
, nb
);
107 if (nb
> mp
->m_sb
.sb_dblocks
) {
108 error
= xfs_buf_read_uncached(mp
->m_ddev_targp
,
109 XFS_FSB_TO_BB(mp
, nb
) - XFS_FSS_TO_BB(mp
, 1),
110 XFS_FSS_TO_BB(mp
, 1), 0, &bp
, NULL
);
117 nb_mod
= do_div(nb_div
, mp
->m_sb
.sb_agblocks
);
118 if (nb_mod
&& nb_mod
>= XFS_MIN_AG_BLOCKS
)
121 nb
= nb_div
* mp
->m_sb
.sb_agblocks
;
123 if (nb_div
> XFS_MAX_AGNUMBER
+ 1) {
124 nb_div
= XFS_MAX_AGNUMBER
+ 1;
125 nb
= nb_div
* mp
->m_sb
.sb_agblocks
;
128 delta
= nb
- mp
->m_sb
.sb_dblocks
;
130 * Reject filesystems with a single AG because they are not
131 * supported, and reject a shrink operation that would cause a
132 * filesystem to become unsupported.
134 if (delta
< 0 && nagcount
< 2)
141 /* TODO: shrinking the entire AGs hasn't yet completed */
142 if (nagcount
< oagcount
)
145 /* allocate the new per-ag structures */
146 error
= xfs_initialize_perag(mp
, oagcount
, nagcount
, nb
, &nagimax
);
151 error
= xfs_trans_alloc(mp
, &M_RES(mp
)->tr_growdata
,
152 XFS_GROWFS_SPACE_RES(mp
), 0, XFS_TRANS_RESERVE
,
155 error
= xfs_trans_alloc(mp
, &M_RES(mp
)->tr_growdata
, -delta
, 0,
158 goto out_free_unused_perag
;
160 last_pag
= xfs_perag_get(mp
, oagcount
- 1);
162 error
= xfs_resizefs_init_new_ags(tp
, &id
, oagcount
, nagcount
,
163 delta
, last_pag
, &lastag_extended
);
165 xfs_warn_experimental(mp
, XFS_EXPERIMENTAL_SHRINK
);
166 error
= xfs_ag_shrink_space(last_pag
, &tp
, -delta
);
168 xfs_perag_put(last_pag
);
170 goto out_trans_cancel
;
173 * Update changed superblock fields transactionally. These are not
174 * seen by the rest of the world until the transaction commit applies
175 * them atomically to the superblock.
177 if (nagcount
> oagcount
)
178 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_AGCOUNT
, nagcount
- oagcount
);
180 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_DBLOCKS
, delta
);
182 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_FDBLOCKS
, id
.nfree
);
185 * Sync sb counters now to reflect the updated values. This is
186 * particularly important for shrink because the write verifier
187 * will fail if sb_fdblocks is ever larger than sb_dblocks.
189 if (xfs_has_lazysbcount(mp
))
192 xfs_trans_set_sync(tp
);
193 error
= xfs_trans_commit(tp
);
197 /* New allocation groups fully initialized, so update mount struct */
199 mp
->m_maxagi
= nagimax
;
200 xfs_set_low_space_thresholds(mp
);
201 mp
->m_alloc_set_aside
= xfs_alloc_set_aside(mp
);
205 * If we expanded the last AG, free the per-AG reservation
206 * so we can reinitialize it with the new size.
208 if (lastag_extended
) {
209 struct xfs_perag
*pag
;
211 pag
= xfs_perag_get(mp
, id
.agno
);
212 xfs_ag_resv_free(pag
);
216 * Reserve AG metadata blocks. ENOSPC here does not mean there
217 * was a growfs failure, just that there still isn't space for
218 * new user data after the grow has been run.
220 error
= xfs_fs_reserve_ag_blocks(mp
);
221 if (error
== -ENOSPC
)
227 xfs_trans_cancel(tp
);
228 out_free_unused_perag
:
229 if (nagcount
> oagcount
)
230 xfs_free_perag_range(mp
, oagcount
, nagcount
);
235 xfs_growfs_log_private(
236 struct xfs_mount
*mp
, /* mount point for filesystem */
237 struct xfs_growfs_log
*in
) /* growfs log input struct */
242 if (nb
< XFS_MIN_LOG_BLOCKS
|| nb
< XFS_B_TO_FSB(mp
, XFS_MIN_LOG_BYTES
))
244 if (nb
== mp
->m_sb
.sb_logblocks
&&
245 in
->isint
== (mp
->m_sb
.sb_logstart
!= 0))
248 * Moving the log is hard, need new interfaces to sync
249 * the log first, hold off all activity while moving it.
250 * Can have shorter or longer log in the same space,
251 * or transform internal to external log or vice versa.
258 struct xfs_mount
*mp
,
261 struct xfs_trans
*tp
;
268 error
= xfs_trans_alloc(mp
, &M_RES(mp
)->tr_growdata
,
269 XFS_GROWFS_SPACE_RES(mp
), 0, XFS_TRANS_RESERVE
, &tp
);
273 dpct
= imaxpct
- mp
->m_sb
.sb_imax_pct
;
274 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_IMAXPCT
, dpct
);
275 xfs_trans_set_sync(tp
);
276 return xfs_trans_commit(tp
);
280 * protected versions of growfs function acquire and release locks on the mount
281 * point - exported through ioctls: XFS_IOC_FSGROWFSDATA, XFS_IOC_FSGROWFSLOG,
286 struct xfs_mount
*mp
,
287 struct xfs_growfs_data
*in
)
291 if (!capable(CAP_SYS_ADMIN
))
293 if (!mutex_trylock(&mp
->m_growlock
))
296 /* update imaxpct separately to the physical grow of the filesystem */
297 if (in
->imaxpct
!= mp
->m_sb
.sb_imax_pct
) {
298 error
= xfs_growfs_imaxpct(mp
, in
->imaxpct
);
303 if (in
->newblocks
!= mp
->m_sb
.sb_dblocks
) {
304 error
= xfs_growfs_data_private(mp
, in
);
309 /* Post growfs calculations needed to reflect new state in operations */
310 if (mp
->m_sb
.sb_imax_pct
) {
311 uint64_t icount
= mp
->m_sb
.sb_dblocks
* mp
->m_sb
.sb_imax_pct
;
313 M_IGEO(mp
)->maxicount
= XFS_FSB_TO_INO(mp
, icount
);
315 M_IGEO(mp
)->maxicount
= 0;
317 /* Update secondary superblocks now the physical grow has completed */
318 error
= xfs_update_secondary_sbs(mp
);
322 * Increment the generation unconditionally, the error could be from
323 * updating the secondary superblocks, in which case the new size
327 mutex_unlock(&mp
->m_growlock
);
334 struct xfs_growfs_log
*in
)
338 if (!capable(CAP_SYS_ADMIN
))
340 if (!mutex_trylock(&mp
->m_growlock
))
342 error
= xfs_growfs_log_private(mp
, in
);
343 mutex_unlock(&mp
->m_growlock
);
348 * Reserve the requested number of blocks if available. Otherwise return
349 * as many as possible to satisfy the request. The actual number
350 * reserved are returned in outval.
354 struct xfs_mount
*mp
,
357 int64_t lcounter
, delta
;
358 int64_t fdblks_delta
= 0;
363 * With per-cpu counters, this becomes an interesting problem. we need
364 * to work out if we are freeing or allocation blocks first, then we can
365 * do the modification as necessary.
367 * We do this under the m_sb_lock so that if we are near ENOSPC, we will
368 * hold out any changes while we work out what to do. This means that
369 * the amount of free space can change while we do this, so we need to
370 * retry if we end up trying to reserve more space than is available.
372 spin_lock(&mp
->m_sb_lock
);
375 * If our previous reservation was larger than the current value,
376 * then move any unused blocks back to the free pool. Modify the resblks
377 * counters directly since we shouldn't have any problems unreserving
380 if (mp
->m_resblks
> request
) {
381 lcounter
= mp
->m_resblks_avail
- request
;
382 if (lcounter
> 0) { /* release unused blocks */
383 fdblks_delta
= lcounter
;
384 mp
->m_resblks_avail
-= lcounter
;
386 mp
->m_resblks
= request
;
388 spin_unlock(&mp
->m_sb_lock
);
389 xfs_add_fdblocks(mp
, fdblks_delta
);
390 spin_lock(&mp
->m_sb_lock
);
397 * If the request is larger than the current reservation, reserve the
398 * blocks before we update the reserve counters. Sample m_fdblocks and
399 * perform a partial reservation if the request exceeds free space.
401 * The code below estimates how many blocks it can request from
402 * fdblocks to stash in the reserve pool. This is a classic TOCTOU
403 * race since fdblocks updates are not always coordinated via
404 * m_sb_lock. Set the reserve size even if there's not enough free
405 * space to fill it because mod_fdblocks will refill an undersized
406 * reserve when it can.
408 free
= percpu_counter_sum(&mp
->m_fdblocks
) -
409 xfs_fdblocks_unavailable(mp
);
410 delta
= request
- mp
->m_resblks
;
411 mp
->m_resblks
= request
;
412 if (delta
> 0 && free
> 0) {
414 * We'll either succeed in getting space from the free block
415 * count or we'll get an ENOSPC. Don't set the reserved flag
416 * here - we don't want to reserve the extra reserve blocks
419 * The desired reserve size can change after we drop the lock.
420 * Use mod_fdblocks to put the space into the reserve or into
421 * fdblocks as appropriate.
423 fdblks_delta
= min(free
, delta
);
424 spin_unlock(&mp
->m_sb_lock
);
425 error
= xfs_dec_fdblocks(mp
, fdblks_delta
, 0);
427 xfs_add_fdblocks(mp
, fdblks_delta
);
428 spin_lock(&mp
->m_sb_lock
);
431 spin_unlock(&mp
->m_sb_lock
);
441 case XFS_FSOP_GOING_FLAGS_DEFAULT
: {
442 if (!bdev_freeze(mp
->m_super
->s_bdev
)) {
443 xfs_force_shutdown(mp
, SHUTDOWN_FORCE_UMOUNT
);
444 bdev_thaw(mp
->m_super
->s_bdev
);
448 case XFS_FSOP_GOING_FLAGS_LOGFLUSH
:
449 xfs_force_shutdown(mp
, SHUTDOWN_FORCE_UMOUNT
);
451 case XFS_FSOP_GOING_FLAGS_NOLOGFLUSH
:
452 xfs_force_shutdown(mp
,
453 SHUTDOWN_FORCE_UMOUNT
| SHUTDOWN_LOG_IO_ERROR
);
463 * Force a shutdown of the filesystem instantly while keeping the filesystem
464 * consistent. We don't do an unmount here; just shutdown the shop, make sure
465 * that absolutely nothing persistent happens to this filesystem after this
468 * The shutdown state change is atomic, resulting in the first and only the
469 * first shutdown call processing the shutdown. This means we only shutdown the
470 * log once as it requires, and we don't spam the logs when multiple concurrent
471 * shutdowns race to set the shutdown flags.
474 xfs_do_force_shutdown(
475 struct xfs_mount
*mp
,
484 if (xfs_set_shutdown(mp
)) {
485 xlog_shutdown_wait(mp
->m_log
);
489 mp
->m_sb_bp
->b_flags
|= XBF_DONE
;
491 if (flags
& SHUTDOWN_FORCE_UMOUNT
)
492 xfs_alert(mp
, "User initiated shutdown received.");
494 if (xlog_force_shutdown(mp
->m_log
, flags
)) {
495 tag
= XFS_PTAG_SHUTDOWN_LOGERROR
;
496 why
= "Log I/O Error";
497 } else if (flags
& SHUTDOWN_CORRUPT_INCORE
) {
498 tag
= XFS_PTAG_SHUTDOWN_CORRUPT
;
499 why
= "Corruption of in-memory data";
500 } else if (flags
& SHUTDOWN_CORRUPT_ONDISK
) {
501 tag
= XFS_PTAG_SHUTDOWN_CORRUPT
;
502 why
= "Corruption of on-disk metadata";
503 } else if (flags
& SHUTDOWN_DEVICE_REMOVED
) {
504 tag
= XFS_PTAG_SHUTDOWN_IOERROR
;
505 why
= "Block device removal";
507 tag
= XFS_PTAG_SHUTDOWN_IOERROR
;
508 why
= "Metadata I/O Error";
511 trace_xfs_force_shutdown(mp
, tag
, flags
, fname
, lnnum
);
513 xfs_alert_tag(mp
, tag
,
514 "%s (0x%x) detected at %pS (%s:%d). Shutting down filesystem.",
515 why
, flags
, __return_address
, fname
, lnnum
);
517 "Please unmount the filesystem and rectify the problem(s)");
518 if (xfs_error_level
>= XFS_ERRLEVEL_HIGH
)
523 * Reserve free space for per-AG metadata.
526 xfs_fs_reserve_ag_blocks(
527 struct xfs_mount
*mp
)
529 struct xfs_perag
*pag
= NULL
;
533 mp
->m_finobt_nores
= false;
534 while ((pag
= xfs_perag_next(mp
, pag
))) {
535 err2
= xfs_ag_resv_init(pag
, NULL
);
540 if (error
&& error
!= -ENOSPC
) {
542 "Error %d reserving per-AG metadata reserve pool.", error
);
543 xfs_force_shutdown(mp
, SHUTDOWN_CORRUPT_INCORE
);
550 * Free space reserved for per-AG metadata.
553 xfs_fs_unreserve_ag_blocks(
554 struct xfs_mount
*mp
)
556 struct xfs_perag
*pag
= NULL
;
558 while ((pag
= xfs_perag_next(mp
, pag
)))
559 xfs_ag_resv_free(pag
);