1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2016 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <darrick.wong@oracle.com>
6 #include "libxfs_priv.h"
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_log_format.h"
11 #include "xfs_trans_resv.h"
13 #include "xfs_mount.h"
14 #include "xfs_defer.h"
15 #include "xfs_alloc.h"
16 #include "xfs_errortag.h"
17 #include "xfs_trace.h"
18 #include "xfs_cksum.h"
19 #include "xfs_trans.h"
22 #include "xfs_bmap_btree.h"
23 #include "xfs_ag_resv.h"
24 #include "xfs_trans_space.h"
25 #include "xfs_rmap_btree.h"
26 #include "xfs_btree.h"
27 #include "xfs_refcount_btree.h"
28 #include "xfs_ialloc_btree.h"
31 * Per-AG Block Reservations
33 * For some kinds of allocation group metadata structures, it is advantageous
34 * to reserve a small number of blocks in each AG so that future expansions of
35 * that data structure do not encounter ENOSPC because errors during a btree
36 * split cause the filesystem to go offline.
38 * Prior to the introduction of reflink, this wasn't an issue because the free
39 * space btrees maintain a reserve of space (the AGFL) to handle any expansion
40 * that may be necessary; and allocations of other metadata (inodes, BMBT,
41 * dir/attr) aren't restricted to a single AG. However, with reflink it is
42 * possible to allocate all the space in an AG, have subsequent reflink/CoW
43 * activity expand the refcount btree, and discover that there's no space left
44 * to handle that expansion. Since we can calculate the maximum size of the
45 * refcount btree, we can reserve space for it and avoid ENOSPC.
47 * Handling per-AG reservations consists of three changes to the allocator's
48 * behavior: First, because these reservations are always needed, we decrease
49 * the ag_max_usable counter to reflect the size of the AG after the reserved
50 * blocks are taken. Second, the reservations must be reflected in the
51 * fdblocks count to maintain proper accounting. Third, each AG must maintain
52 * its own reserved block counter so that we can calculate the amount of space
53 * that must remain free to maintain the reservations. Fourth, the "remaining
54 * reserved blocks" count must be used when calculating the length of the
55 * longest free extent in an AG and to clamp maxlen in the per-AG allocation
56 * functions. In other words, we maintain a virtual allocation via in-core
57 * accounting tricks so that we don't have to clean up after a crash. :)
59 * Reserved blocks can be managed by passing one of the enum xfs_ag_resv_type
60 * values via struct xfs_alloc_arg or directly to the xfs_free_extent
61 * function. It might seem a little funny to maintain a reservoir of blocks
62 * to feed another reservoir, but the AGFL only holds enough blocks to get
63 * through the next transaction. The per-AG reservation is to ensure (we
64 * hope) that each AG never runs out of blocks. Each data structure wanting
65 * to use the reservation system should update ask/used in xfs_ag_resv_init.
69 * Are we critically low on blocks? For now we'll define that as the number
70 * of blocks we can get our hands on being less than 10% of what we reserved
71 * or less than some arbitrary number (maximum btree height).
75 struct xfs_perag
*pag
,
76 enum xfs_ag_resv_type type
)
82 case XFS_AG_RESV_METADATA
:
83 avail
= pag
->pagf_freeblks
- pag
->pag_rmapbt_resv
.ar_reserved
;
84 orig
= pag
->pag_meta_resv
.ar_asked
;
86 case XFS_AG_RESV_RMAPBT
:
87 avail
= pag
->pagf_freeblks
+ pag
->pagf_flcount
-
88 pag
->pag_meta_resv
.ar_reserved
;
89 orig
= pag
->pag_rmapbt_resv
.ar_asked
;
96 trace_xfs_ag_resv_critical(pag
, type
, avail
);
98 /* Critically low if less than 10% or max btree height remains. */
99 return XFS_TEST_ERROR(avail
< orig
/ 10 || avail
< XFS_BTREE_MAXLEVELS
,
100 pag
->pag_mount
, XFS_ERRTAG_AG_RESV_CRITICAL
);
104 * How many blocks are reserved but not used, and therefore must not be
109 struct xfs_perag
*pag
,
110 enum xfs_ag_resv_type type
)
114 len
= pag
->pag_meta_resv
.ar_reserved
+ pag
->pag_rmapbt_resv
.ar_reserved
;
116 case XFS_AG_RESV_METADATA
:
117 case XFS_AG_RESV_RMAPBT
:
118 len
-= xfs_perag_resv(pag
, type
)->ar_reserved
;
120 case XFS_AG_RESV_NONE
:
127 trace_xfs_ag_resv_needed(pag
, type
, len
);
132 /* Clean out a reservation */
135 struct xfs_perag
*pag
,
136 enum xfs_ag_resv_type type
)
138 struct xfs_ag_resv
*resv
;
139 xfs_extlen_t oldresv
;
142 trace_xfs_ag_resv_free(pag
, type
, 0);
144 resv
= xfs_perag_resv(pag
, type
);
145 if (pag
->pag_agno
== 0)
146 pag
->pag_mount
->m_ag_max_usable
+= resv
->ar_asked
;
148 * RMAPBT blocks come from the AGFL and AGFL blocks are always
149 * considered "free", so whatever was reserved at mount time must be
150 * given back at umount.
152 if (type
== XFS_AG_RESV_RMAPBT
)
153 oldresv
= resv
->ar_orig_reserved
;
155 oldresv
= resv
->ar_reserved
;
156 error
= xfs_mod_fdblocks(pag
->pag_mount
, oldresv
, true);
157 resv
->ar_reserved
= 0;
159 resv
->ar_orig_reserved
= 0;
162 trace_xfs_ag_resv_free_error(pag
->pag_mount
, pag
->pag_agno
,
167 /* Free a per-AG reservation. */
170 struct xfs_perag
*pag
)
175 error
= __xfs_ag_resv_free(pag
, XFS_AG_RESV_RMAPBT
);
176 err2
= __xfs_ag_resv_free(pag
, XFS_AG_RESV_METADATA
);
184 struct xfs_perag
*pag
,
185 enum xfs_ag_resv_type type
,
189 struct xfs_mount
*mp
= pag
->pag_mount
;
190 struct xfs_ag_resv
*resv
;
192 xfs_extlen_t hidden_space
;
198 case XFS_AG_RESV_RMAPBT
:
200 * Space taken by the rmapbt is not subtracted from fdblocks
201 * because the rmapbt lives in the free space. Here we must
202 * subtract the entire reservation from fdblocks so that we
203 * always have blocks available for rmapbt expansion.
207 case XFS_AG_RESV_METADATA
:
209 * Space taken by all other metadata btrees are accounted
210 * on-disk as used space. We therefore only hide the space
211 * that is reserved but not used by the trees.
213 hidden_space
= ask
- used
;
219 error
= xfs_mod_fdblocks(mp
, -(int64_t)hidden_space
, true);
221 trace_xfs_ag_resv_init_error(pag
->pag_mount
, pag
->pag_agno
,
224 "Per-AG reservation for AG %u failed. Filesystem may run out of space.",
230 * Reduce the maximum per-AG allocation length by however much we're
231 * trying to reserve for an AG. Since this is a filesystem-wide
232 * counter, we only make the adjustment for AG 0. This assumes that
233 * there aren't any AGs hungrier for per-AG reservation than AG 0.
235 if (pag
->pag_agno
== 0)
236 mp
->m_ag_max_usable
-= ask
;
238 resv
= xfs_perag_resv(pag
, type
);
239 resv
->ar_asked
= ask
;
240 resv
->ar_orig_reserved
= hidden_space
;
241 resv
->ar_reserved
= ask
- used
;
243 trace_xfs_ag_resv_init(pag
, type
, ask
);
247 /* Create a per-AG block reservation. */
250 struct xfs_perag
*pag
,
251 struct xfs_trans
*tp
)
253 struct xfs_mount
*mp
= pag
->pag_mount
;
254 xfs_agnumber_t agno
= pag
->pag_agno
;
259 /* Create the metadata reservation. */
260 if (pag
->pag_meta_resv
.ar_asked
== 0) {
263 error
= xfs_refcountbt_calc_reserves(mp
, tp
, agno
, &ask
, &used
);
267 error
= xfs_finobt_calc_reserves(mp
, tp
, agno
, &ask
, &used
);
271 error
= __xfs_ag_resv_init(pag
, XFS_AG_RESV_METADATA
,
275 * Because we didn't have per-AG reservations when the
276 * finobt feature was added we might not be able to
277 * reserve all needed blocks. Warn and fall back to the
278 * old and potentially buggy code in that case, but
279 * ensure we do have the reservation for the refcountbt.
283 mp
->m_inotbt_nores
= true;
285 error
= xfs_refcountbt_calc_reserves(mp
, tp
, agno
, &ask
,
290 error
= __xfs_ag_resv_init(pag
, XFS_AG_RESV_METADATA
,
297 /* Create the RMAPBT metadata reservation */
298 if (pag
->pag_rmapbt_resv
.ar_asked
== 0) {
301 error
= xfs_rmapbt_calc_reserves(mp
, tp
, agno
, &ask
, &used
);
305 error
= __xfs_ag_resv_init(pag
, XFS_AG_RESV_RMAPBT
, ask
, used
);
311 /* need to read in the AGF for the ASSERT below to work */
312 error
= xfs_alloc_pagf_init(pag
->pag_mount
, tp
, pag
->pag_agno
, 0);
316 ASSERT(xfs_perag_resv(pag
, XFS_AG_RESV_METADATA
)->ar_reserved
+
317 xfs_perag_resv(pag
, XFS_AG_RESV_RMAPBT
)->ar_reserved
<=
318 pag
->pagf_freeblks
+ pag
->pagf_flcount
);
324 /* Allocate a block from the reservation. */
326 xfs_ag_resv_alloc_extent(
327 struct xfs_perag
*pag
,
328 enum xfs_ag_resv_type type
,
329 struct xfs_alloc_arg
*args
)
331 struct xfs_ag_resv
*resv
;
335 trace_xfs_ag_resv_alloc_extent(pag
, type
, args
->len
);
338 case XFS_AG_RESV_AGFL
:
340 case XFS_AG_RESV_METADATA
:
341 case XFS_AG_RESV_RMAPBT
:
342 resv
= xfs_perag_resv(pag
, type
);
347 case XFS_AG_RESV_NONE
:
348 field
= args
->wasdel
? XFS_TRANS_SB_RES_FDBLOCKS
:
349 XFS_TRANS_SB_FDBLOCKS
;
350 xfs_trans_mod_sb(args
->tp
, field
, -(int64_t)args
->len
);
354 len
= min_t(xfs_extlen_t
, args
->len
, resv
->ar_reserved
);
355 resv
->ar_reserved
-= len
;
356 if (type
== XFS_AG_RESV_RMAPBT
)
358 /* Allocations of reserved blocks only need on-disk sb updates... */
359 xfs_trans_mod_sb(args
->tp
, XFS_TRANS_SB_RES_FDBLOCKS
, -(int64_t)len
);
360 /* ...but non-reserved blocks need in-core and on-disk updates. */
362 xfs_trans_mod_sb(args
->tp
, XFS_TRANS_SB_FDBLOCKS
,
363 -((int64_t)args
->len
- len
));
366 /* Free a block to the reservation. */
368 xfs_ag_resv_free_extent(
369 struct xfs_perag
*pag
,
370 enum xfs_ag_resv_type type
,
371 struct xfs_trans
*tp
,
374 xfs_extlen_t leftover
;
375 struct xfs_ag_resv
*resv
;
377 trace_xfs_ag_resv_free_extent(pag
, type
, len
);
380 case XFS_AG_RESV_AGFL
:
382 case XFS_AG_RESV_METADATA
:
383 case XFS_AG_RESV_RMAPBT
:
384 resv
= xfs_perag_resv(pag
, type
);
389 case XFS_AG_RESV_NONE
:
390 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_FDBLOCKS
, (int64_t)len
);
394 leftover
= min_t(xfs_extlen_t
, len
, resv
->ar_asked
- resv
->ar_reserved
);
395 resv
->ar_reserved
+= leftover
;
396 if (type
== XFS_AG_RESV_RMAPBT
)
398 /* Freeing into the reserved pool only requires on-disk update... */
399 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_RES_FDBLOCKS
, len
);
400 /* ...but freeing beyond that requires in-core and on-disk update. */
402 xfs_trans_mod_sb(tp
, XFS_TRANS_SB_FDBLOCKS
, len
- leftover
);