2 * Copyright (c) 2008 The DragonFly Project. All rights reserved.
4 * This code is derived from software contributed to The DragonFly Project
5 * by Matthew Dillon <dillon@backplane.com>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * 3. Neither the name of The DragonFly Project nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific, prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * $DragonFly: src/sys/vfs/hammer/hammer_recover.c,v 1.28 2008/06/30 00:03:55 dillon Exp $
39 static int hammer_check_tail_signature(hammer_fifo_tail_t tail
,
40 hammer_off_t end_off
);
41 static void hammer_recover_copy_undo(hammer_off_t undo_offset
,
42 char *src
, char *dst
, int bytes
);
44 static void hammer_recover_debug_dump(int w
, char *buf
, int bytes
);
46 static int hammer_recover_undo(hammer_mount_t hmp
, hammer_volume_t root_volume
,
47 hammer_fifo_undo_t undo
, int bytes
);
50 * Recover a filesystem on mount
52 * NOTE: No information from the root volume has been cached in the
53 * hammer_mount structure yet, so we need to access the root volume's
57 hammer_recover(hammer_mount_t hmp
, hammer_volume_t root_volume
)
59 hammer_blockmap_t rootmap
;
60 hammer_buffer_t buffer
;
61 hammer_off_t scan_offset
;
63 hammer_fifo_tail_t tail
;
64 hammer_fifo_undo_t undo
;
65 hammer_off_t first_offset
;
66 hammer_off_t last_offset
;
71 * Examine the UNDO FIFO. If it is empty the filesystem is clean
72 * and no action need be taken.
74 rootmap
= &root_volume
->ondisk
->vol0_blockmap
[HAMMER_ZONE_UNDO_INDEX
];
76 if (rootmap
->first_offset
== rootmap
->next_offset
)
79 first_offset
= rootmap
->first_offset
;
80 last_offset
= rootmap
->next_offset
;
82 if (last_offset
>= first_offset
) {
83 bytes
= last_offset
- first_offset
;
85 bytes
= rootmap
->alloc_offset
- first_offset
+
86 (last_offset
& HAMMER_OFF_LONG_MASK
);
88 kprintf("HAMMER(%s) Start Recovery %016llx - %016llx "
89 "(%lld bytes of UNDO)%s\n",
90 root_volume
->ondisk
->vol_name
,
91 first_offset
, last_offset
,
93 (hmp
->ronly
? " (RO)" : "(RW)"));
94 if (bytes
> (rootmap
->alloc_offset
& HAMMER_OFF_LONG_MASK
)) {
95 kprintf("Undo size is absurd, unable to mount\n");
100 * Scan the UNDOs backwards.
102 scan_offset
= last_offset
;
104 if (scan_offset
> rootmap
->alloc_offset
) {
105 kprintf("HAMMER(%s) UNDO record at %016llx FIFO overflow\n",
106 root_volume
->ondisk
->vol_name
,
112 while ((int64_t)bytes
> 0) {
113 if (hammer_debug_general
& 0x0080)
114 kprintf("scan_offset %016llx\n", scan_offset
);
115 if (scan_offset
== HAMMER_ZONE_ENCODE(HAMMER_ZONE_UNDO_INDEX
, 0)) {
116 scan_offset
= rootmap
->alloc_offset
;
119 if (scan_offset
- sizeof(*tail
) <
120 HAMMER_ZONE_ENCODE(HAMMER_ZONE_UNDO_INDEX
, 0)) {
121 kprintf("HAMMER(%s) UNDO record at %016llx FIFO "
123 root_volume
->ondisk
->vol_name
,
128 tail
= hammer_bread(hmp
, scan_offset
- sizeof(*tail
),
131 kprintf("HAMMER(%s) Unable to read UNDO TAIL "
133 root_volume
->ondisk
->vol_name
,
134 scan_offset
- sizeof(*tail
));
138 if (hammer_check_tail_signature(tail
, scan_offset
) != 0) {
139 kprintf("HAMMER(%s) Illegal UNDO TAIL signature "
141 root_volume
->ondisk
->vol_name
,
142 scan_offset
- sizeof(*tail
));
146 undo
= (void *)((char *)tail
+ sizeof(*tail
) - tail
->tail_size
);
148 error
= hammer_recover_undo(hmp
, root_volume
, undo
,
150 (int)((char *)undo
- (char *)buffer
->ondisk
));
152 kprintf("HAMMER(%s) UNDO record at %016llx failed\n",
153 root_volume
->ondisk
->vol_name
,
154 scan_offset
- tail
->tail_size
);
157 scan_offset
-= tail
->tail_size
;
158 bytes
-= tail
->tail_size
;
161 * If too many dirty buffers have built up we have to flush'm
162 * out. As long as we do not flush out the volume header
163 * a crash here should not cause any problems.
165 * buffer must be released so the flush can assert that
166 * all buffers are idle.
168 if (hammer_flusher_meta_limit(hmp
)) {
170 hammer_rel_buffer(buffer
, 0);
173 if (hmp
->ronly
== 0) {
174 hammer_recover_flush_buffers(hmp
, root_volume
,
176 kprintf("HAMMER(%s) Continuing recovery\n",
177 root_volume
->ondisk
->vol_name
);
178 } else if (reported
== 0) {
180 kprintf("HAMMER(%s) Recovery failure: Insufficient buffer cache to hold dirty buffers on read-only mount!\n",
181 root_volume
->ondisk
->vol_name
);
187 hammer_rel_buffer(buffer
, 0);
190 * After completely flushing all the recovered buffers the volume
191 * header will also be flushed. Force the UNDO FIFO to 0-length.
193 if (root_volume
->io
.recovered
== 0) {
194 hammer_ref_volume(root_volume
);
195 root_volume
->io
.recovered
= 1;
197 hammer_modify_volume(NULL
, root_volume
, NULL
, 0);
198 rootmap
= &root_volume
->ondisk
->vol0_blockmap
[HAMMER_ZONE_UNDO_INDEX
];
199 rootmap
->first_offset
= last_offset
;
200 rootmap
->next_offset
= last_offset
;
201 hammer_modify_volume_done(root_volume
);
204 * We have collected a large number of dirty buffers during the
205 * recovery, flush them all out. The root volume header will
206 * be flushed out last.
208 if (hmp
->ronly
== 0 && error
== 0)
209 hammer_recover_flush_buffers(hmp
, root_volume
, 1);
210 kprintf("HAMMER(%s) End Recovery\n", root_volume
->ondisk
->vol_name
);
215 hammer_check_tail_signature(hammer_fifo_tail_t tail
, hammer_off_t end_off
)
219 max_bytes
= ((end_off
- sizeof(*tail
)) & HAMMER_BUFMASK
);
220 max_bytes
+= sizeof(*tail
);
223 * tail overlaps buffer boundary
225 if (((end_off
- sizeof(*tail
)) ^ (end_off
- 1)) & ~HAMMER_BUFMASK64
) {
230 * signature check, the tail signature is allowed to be the head
231 * signature only for 8-byte PADs.
233 switch(tail
->tail_signature
) {
234 case HAMMER_TAIL_SIGNATURE
:
236 case HAMMER_HEAD_SIGNATURE
:
237 if (tail
->tail_type
!= HAMMER_HEAD_TYPE_PAD
||
238 tail
->tail_size
!= sizeof(*tail
)) {
245 * The undo structure must not overlap a buffer boundary.
247 if (tail
->tail_size
< 0 || tail
->tail_size
> max_bytes
) {
254 hammer_recover_undo(hammer_mount_t hmp
, hammer_volume_t root_volume
,
255 hammer_fifo_undo_t undo
, int bytes
)
257 hammer_fifo_tail_t tail
;
258 hammer_volume_t volume
;
259 hammer_buffer_t buffer
;
260 hammer_off_t buf_offset
;
269 * Basic sanity checks
271 if (bytes
< HAMMER_HEAD_ALIGN
) {
272 kprintf("HAMMER: Undo alignment error (%d)\n", bytes
);
275 if (undo
->head
.hdr_signature
!= HAMMER_HEAD_SIGNATURE
) {
276 kprintf("HAMMER: Bad head signature %04x\n",
277 undo
->head
.hdr_signature
);
280 if (undo
->head
.hdr_size
< HAMMER_HEAD_ALIGN
||
281 undo
->head
.hdr_size
> bytes
) {
282 kprintf("HAMMER: Bad size %d\n", bytes
);
287 * Skip PAD records. Note that PAD records also do not require
288 * a tail and may have a truncated structure.
290 if (undo
->head
.hdr_type
== HAMMER_HEAD_TYPE_PAD
)
296 crc
= crc32(undo
, HAMMER_FIFO_HEAD_CRCOFF
) ^
297 crc32(&undo
->head
+ 1, undo
->head
.hdr_size
- sizeof(undo
->head
));
298 if (undo
->head
.hdr_crc
!= crc
) {
299 kprintf("HAMMER: Undo record CRC failed %08x %08x\n",
300 undo
->head
.hdr_crc
, crc
);
308 bytes
= undo
->head
.hdr_size
;
309 tail
= (void *)((char *)undo
+ bytes
- sizeof(*tail
));
310 if (tail
->tail_size
!= undo
->head
.hdr_size
) {
311 kprintf("HAMMER: Bad tail size %d\n", tail
->tail_size
);
314 if (tail
->tail_type
!= undo
->head
.hdr_type
) {
315 kprintf("HAMMER: Bad tail type %d\n", tail
->tail_type
);
320 * Only process UNDO records
322 if (undo
->head
.hdr_type
!= HAMMER_HEAD_TYPE_UNDO
)
326 * Validate the UNDO record.
328 max_bytes
= undo
->head
.hdr_size
- sizeof(*undo
) - sizeof(*tail
);
329 if (undo
->undo_data_bytes
< 0 || undo
->undo_data_bytes
> max_bytes
) {
330 kprintf("HAMMER: Corrupt UNDO record, undo_data_bytes %d/%d\n",
331 undo
->undo_data_bytes
, max_bytes
);
336 * The undo offset may only be a zone-1 or zone-2 offset.
338 * Currently we only support a zone-1 offset representing the
341 zone
= HAMMER_ZONE_DECODE(undo
->undo_offset
);
342 offset
= undo
->undo_offset
& HAMMER_BUFMASK
;
344 if (offset
+ undo
->undo_data_bytes
> HAMMER_BUFSIZE
) {
345 kprintf("HAMMER: Corrupt UNDO record, bad offset\n");
350 case HAMMER_ZONE_RAW_VOLUME_INDEX
:
351 vol_no
= HAMMER_VOL_DECODE(undo
->undo_offset
);
352 volume
= hammer_get_volume(hmp
, vol_no
, &error
);
353 if (volume
== NULL
) {
354 kprintf("HAMMER: UNDO record, "
355 "cannot access volume %d\n", vol_no
);
358 hammer_modify_volume(NULL
, volume
, NULL
, 0);
359 hammer_recover_copy_undo(undo
->undo_offset
,
361 (char *)volume
->ondisk
+ offset
,
362 undo
->undo_data_bytes
);
363 hammer_modify_volume_done(volume
);
366 * Multiple modifications may be made to the same buffer.
367 * Also, the volume header cannot be written out until
368 * everything else has been flushed. This also
369 * covers the read-only case by preventing the kernel from
370 * flushing the buffer.
372 if (volume
->io
.recovered
== 0)
373 volume
->io
.recovered
= 1;
375 hammer_rel_volume(volume
, 0);
377 case HAMMER_ZONE_RAW_BUFFER_INDEX
:
378 buf_offset
= undo
->undo_offset
& ~HAMMER_BUFMASK64
;
379 buffer
= hammer_get_buffer(hmp
, buf_offset
, HAMMER_BUFSIZE
,
381 if (buffer
== NULL
) {
382 kprintf("HAMMER: UNDO record, "
383 "cannot access buffer %016llx\n",
387 hammer_modify_buffer(NULL
, buffer
, NULL
, 0);
388 hammer_recover_copy_undo(undo
->undo_offset
,
390 (char *)buffer
->ondisk
+ offset
,
391 undo
->undo_data_bytes
);
392 hammer_modify_buffer_done(buffer
);
395 * Multiple modifications may be made to the same buffer,
396 * improve performance by delaying the flush. This also
397 * covers the read-only case by preventing the kernel from
398 * flushing the buffer.
400 if (buffer
->io
.recovered
== 0)
401 buffer
->io
.recovered
= 1;
403 hammer_rel_buffer(buffer
, 0);
406 kprintf("HAMMER: Corrupt UNDO record\n");
413 hammer_recover_copy_undo(hammer_off_t undo_offset
,
414 char *src
, char *dst
, int bytes
)
416 if (hammer_debug_general
& 0x0080)
417 kprintf("UNDO %016llx: %d\n", undo_offset
, bytes
);
419 kprintf("UNDO %016llx:", undo_offset
);
420 hammer_recover_debug_dump(22, dst
, bytes
);
421 kprintf("%22s", "to:");
422 hammer_recover_debug_dump(22, src
, bytes
);
424 bcopy(src
, dst
, bytes
);
430 hammer_recover_debug_dump(int w
, char *buf
, int bytes
)
434 for (i
= 0; i
< bytes
; ++i
) {
435 if (i
&& (i
& 15) == 0)
436 kprintf("\n%*.*s", w
, w
, "");
437 kprintf(" %02x", (unsigned char)buf
[i
]);
445 * Flush recovered buffers from recovery operations. The call to this
446 * routine may be delayed if a read-only mount was made and then later
447 * upgraded to read-write.
449 * The volume header is always written last. The UNDO FIFO will be forced
450 * to zero-length by setting next_offset to first_offset. This leaves the
451 * (now stale) UNDO information used to recover the disk available for
454 static int hammer_recover_flush_volume_callback(hammer_volume_t
, void *);
455 static int hammer_recover_flush_buffer_callback(hammer_buffer_t
, void *);
458 hammer_recover_flush_buffers(hammer_mount_t hmp
, hammer_volume_t root_volume
,
462 * Flush the buffers out asynchronously, wait for all the I/O to
463 * complete, then do it again to destroy the buffer cache buffer
464 * so it doesn't alias something later on.
466 RB_SCAN(hammer_buf_rb_tree
, &hmp
->rb_bufs_root
, NULL
,
467 hammer_recover_flush_buffer_callback
, NULL
);
468 hammer_io_wait_all(hmp
, "hmrrcw");
469 RB_SCAN(hammer_buf_rb_tree
, &hmp
->rb_bufs_root
, NULL
,
470 hammer_recover_flush_buffer_callback
, NULL
);
472 RB_SCAN(hammer_vol_rb_tree
, &hmp
->rb_vols_root
, NULL
,
473 hammer_recover_flush_volume_callback
, root_volume
);
476 * Finaly, deal with the volume header.
478 if (root_volume
->io
.recovered
&& final
) {
480 while (hmp
->io_running_space
> 0)
481 tsleep(&hmp
->io_running_space
, 0, "hmrflx", 0);
483 root_volume
->io
.recovered
= 0;
484 hammer_io_flush(&root_volume
->io
);
485 hammer_rel_volume(root_volume
, 0);
491 hammer_recover_flush_volume_callback(hammer_volume_t volume
, void *data
)
493 hammer_volume_t root_volume
= data
;
495 if (volume
->io
.recovered
&& volume
!= root_volume
) {
496 volume
->io
.recovered
= 0;
497 hammer_io_flush(&volume
->io
);
498 hammer_rel_volume(volume
, 0);
505 hammer_recover_flush_buffer_callback(hammer_buffer_t buffer
, void *data
)
507 if (buffer
->io
.recovered
) {
508 buffer
->io
.recovered
= 0;
509 buffer
->io
.reclaim
= 1;
510 hammer_io_flush(&buffer
->io
);
511 hammer_rel_buffer(buffer
, 0);
513 KKASSERT(buffer
->io
.lock
.refs
== 0);
514 ++hammer_count_refedbufs
;
515 hammer_ref(&buffer
->io
.lock
);
516 buffer
->io
.reclaim
= 1;
517 hammer_rel_buffer(buffer
, 1);