1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* Copyright (c) 2000-2005 Silicon Graphics, Inc.
4	* All Rights Reserved.
5	*/
6	#include "xfs.h"
7	#include "xfs_fs.h"
8	#include "xfs_shared.h"
9	#include "xfs_format.h"
10	#include "xfs_log_format.h"
11	#include "xfs_trans_resv.h"
12	#include "xfs_mount.h"
13	#include "xfs_errortag.h"
14	#include "xfs_error.h"
15	#include "xfs_trans.h"
16	#include "xfs_trans_priv.h"
17	#include "xfs_log.h"
18	#include "xfs_log_priv.h"
19	#include "xfs_trace.h"
20	#include "xfs_sysfs.h"
21	#include "xfs_sb.h"
22	#include "xfs_health.h"
23
24	struct kmem_cache *xfs_log_ticket_cache;
25
26	/* Local miscellaneous function prototypes */
27	STATIC struct xlog *
28	xlog_alloc_log(
29	struct xfs_mount *mp,
30	struct xfs_buftarg *log_target,
31	xfs_daddr_t blk_offset,
32	int num_bblks);
33	STATIC int
34	xlog_space_left(
35	struct xlog *log,
36	atomic64_t *head);
37	STATIC void
38	xlog_dealloc_log(
39	struct xlog *log);
40
41	/* local state machine functions */
42	STATIC void xlog_state_done_syncing(
43	struct xlog_in_core *iclog);
44	STATIC void xlog_state_do_callback(
45	struct xlog *log);
46	STATIC int
47	xlog_state_get_iclog_space(
48	struct xlog *log,
49	int len,
50	struct xlog_in_core **iclog,
51	struct xlog_ticket *ticket,
52	int *logoffsetp);
53	STATIC void
54	xlog_grant_push_ail(
55	struct xlog *log,
56	int need_bytes);
57	STATIC void
58	xlog_sync(
59	struct xlog *log,
60	struct xlog_in_core *iclog,
61	struct xlog_ticket *ticket);
62	#if defined(DEBUG)
63	STATIC void
64	xlog_verify_grant_tail(
65	struct xlog *log);
66	STATIC void
67	xlog_verify_iclog(
68	struct xlog *log,
69	struct xlog_in_core *iclog,
70	int count);
71	STATIC void
72	xlog_verify_tail_lsn(
73	struct xlog *log,
74	struct xlog_in_core *iclog);
75	#else
76	#define xlog_verify_grant_tail(a)
77	#define xlog_verify_iclog(a,b,c)
78	#define xlog_verify_tail_lsn(a,b)
79	#endif
80
81	STATIC int
82	xlog_iclogs_empty(
83	struct xlog *log);
84
85	static int
86	xfs_log_cover(struct xfs_mount *);
87
88	/*
89	* We need to make sure the buffer pointer returned is naturally aligned for the
90	* biggest basic data type we put into it. We have already accounted for this
91	* padding when sizing the buffer.
92	*
93	* However, this padding does not get written into the log, and hence we have to
94	* track the space used by the log vectors separately to prevent log space hangs
95	* due to inaccurate accounting (i.e. a leak) of the used log space through the
96	* CIL context ticket.
97	*
98	* We also add space for the xlog_op_header that describes this region in the
99	* log. This prepends the data region we return to the caller to copy their data
100	* into, so do all the static initialisation of the ophdr now. Because the ophdr
101	* is not 8 byte aligned, we have to be careful to ensure that we align the
102	* start of the buffer such that the region we return to the call is 8 byte
103	* aligned and packed against the tail of the ophdr.
104	*/
105	void *
106	xlog_prepare_iovec(
107	struct xfs_log_vec *lv,
108	struct xfs_log_iovec **vecp,
109	uint type)
110	{
111	struct xfs_log_iovec *vec = *vecp;
112	struct xlog_op_header *oph;
113	uint32_t len;
114	void *buf;
115
116	if (vec) {
117	ASSERT(vec - lv->lv_iovecp < lv->lv_niovecs);
118	vec++;
119	} else {
120	vec = &lv->lv_iovecp[0];
121	}
122
123	len = lv->lv_buf_len + sizeof(struct xlog_op_header);
124	if (!IS_ALIGNED(len, sizeof(uint64_t))) {
125	lv->lv_buf_len = round_up(len, sizeof(uint64_t)) -
126	sizeof(struct xlog_op_header);
127	}
128
129	vec->i_type = type;
130	vec->i_addr = lv->lv_buf + lv->lv_buf_len;
131
132	oph = vec->i_addr;
133	oph->oh_clientid = XFS_TRANSACTION;
134	oph->oh_res2 = 0;
135	oph->oh_flags = 0;
136
137	buf = vec->i_addr + sizeof(struct xlog_op_header);
138	ASSERT(IS_ALIGNED((unsigned long)buf, sizeof(uint64_t)));
139
140	*vecp = vec;
141	return buf;
142	}
143
144	static void
145	xlog_grant_sub_space(
146	struct xlog *log,
147	atomic64_t *head,
148	int bytes)
149	{
150	int64_t head_val = atomic64_read(v: head);
151	int64_t new, old;
152
153	do {
154	int cycle, space;
155
156	xlog_crack_grant_head_val(val: head_val, cycle: &cycle, space: &space);
157
158	space -= bytes;
159	if (space < 0) {
160	space += log->l_logsize;
161	cycle--;
162	}
163
164	old = head_val;
165	new = xlog_assign_grant_head_val(cycle, space);
166	head_val = atomic64_cmpxchg(v: head, old, new);
167	} while (head_val != old);
168	}
169
170	static void
171	xlog_grant_add_space(
172	struct xlog *log,
173	atomic64_t *head,
174	int bytes)
175	{
176	int64_t head_val = atomic64_read(v: head);
177	int64_t new, old;
178
179	do {
180	int tmp;
181	int cycle, space;
182
183	xlog_crack_grant_head_val(val: head_val, cycle: &cycle, space: &space);
184
185	tmp = log->l_logsize - space;
186	if (tmp > bytes)
187	space += bytes;
188	else {
189	space = bytes - tmp;
190	cycle++;
191	}
192
193	old = head_val;
194	new = xlog_assign_grant_head_val(cycle, space);
195	head_val = atomic64_cmpxchg(v: head, old, new);
196	} while (head_val != old);
197	}
198
199	STATIC void
200	xlog_grant_head_init(
201	struct xlog_grant_head *head)
202	{
203	xlog_assign_grant_head(head: &head->grant, cycle: 1, space: 0);
204	INIT_LIST_HEAD(list: &head->waiters);
205	spin_lock_init(&head->lock);
206	}
207
208	STATIC void
209	xlog_grant_head_wake_all(
210	struct xlog_grant_head *head)
211	{
212	struct xlog_ticket *tic;
213
214	spin_lock(lock: &head->lock);
215	list_for_each_entry(tic, &head->waiters, t_queue)
216	wake_up_process(tsk: tic->t_task);
217	spin_unlock(lock: &head->lock);
218	}
219
220	static inline int
221	xlog_ticket_reservation(
222	struct xlog *log,
223	struct xlog_grant_head *head,
224	struct xlog_ticket *tic)
225	{
226	if (head == &log->l_write_head) {
227	ASSERT(tic->t_flags & XLOG_TIC_PERM_RESERV);
228	return tic->t_unit_res;
229	}
230
231	if (tic->t_flags & XLOG_TIC_PERM_RESERV)
232	return tic->t_unit_res * tic->t_cnt;
233
234	return tic->t_unit_res;
235	}
236
237	STATIC bool
238	xlog_grant_head_wake(
239	struct xlog *log,
240	struct xlog_grant_head *head,
241	int *free_bytes)
242	{
243	struct xlog_ticket *tic;
244	int need_bytes;
245	bool woken_task = false;
246
247	list_for_each_entry(tic, &head->waiters, t_queue) {
248
249	/*
250	* There is a chance that the size of the CIL checkpoints in
251	* progress at the last AIL push target calculation resulted in
252	* limiting the target to the log head (l_last_sync_lsn) at the
253	* time. This may not reflect where the log head is now as the
254	* CIL checkpoints may have completed.
255	*
256	* Hence when we are woken here, it may be that the head of the
257	* log that has moved rather than the tail. As the tail didn't
258	* move, there still won't be space available for the
259	* reservation we require. However, if the AIL has already
260	* pushed to the target defined by the old log head location, we
261	* will hang here waiting for something else to update the AIL
262	* push target.
263	*
264	* Therefore, if there isn't space to wake the first waiter on
265	* the grant head, we need to push the AIL again to ensure the
266	* target reflects both the current log tail and log head
267	* position before we wait for the tail to move again.
268	*/
269
270	need_bytes = xlog_ticket_reservation(log, head, tic);
271	if (*free_bytes < need_bytes) {
272	if (!woken_task)
273	xlog_grant_push_ail(log, need_bytes);
274	return false;
275	}
276
277	*free_bytes -= need_bytes;
278	trace_xfs_log_grant_wake_up(log, tic);
279	wake_up_process(tsk: tic->t_task);
280	woken_task = true;
281	}
282
283	return true;
284	}
285
286	STATIC int
287	xlog_grant_head_wait(
288	struct xlog *log,
289	struct xlog_grant_head *head,
290	struct xlog_ticket *tic,
291	int need_bytes) __releases(&head->lock)
292	__acquires(&head->lock)
293	{
294	list_add_tail(new: &tic->t_queue, head: &head->waiters);
295
296	do {
297	if (xlog_is_shutdown(log))
298	goto shutdown;
299	xlog_grant_push_ail(log, need_bytes);
300
301	__set_current_state(TASK_UNINTERRUPTIBLE);
302	spin_unlock(lock: &head->lock);
303
304	XFS_STATS_INC(log->l_mp, xs_sleep_logspace);
305
306	trace_xfs_log_grant_sleep(log, tic);
307	schedule();
308	trace_xfs_log_grant_wake(log, tic);
309
310	spin_lock(lock: &head->lock);
311	if (xlog_is_shutdown(log))
312	goto shutdown;
313	} while (xlog_space_left(log, head: &head->grant) < need_bytes);
314
315	list_del_init(entry: &tic->t_queue);
316	return 0;
317	shutdown:
318	list_del_init(entry: &tic->t_queue);
319	return -EIO;
320	}
321
322	/*
323	* Atomically get the log space required for a log ticket.
324	*
325	* Once a ticket gets put onto head->waiters, it will only return after the
326	* needed reservation is satisfied.
327	*
328	* This function is structured so that it has a lock free fast path. This is
329	* necessary because every new transaction reservation will come through this
330	* path. Hence any lock will be globally hot if we take it unconditionally on
331	* every pass.
332	*
333	* As tickets are only ever moved on and off head->waiters under head->lock, we
334	* only need to take that lock if we are going to add the ticket to the queue
335	* and sleep. We can avoid taking the lock if the ticket was never added to
336	* head->waiters because the t_queue list head will be empty and we hold the
337	* only reference to it so it can safely be checked unlocked.
338	*/
339	STATIC int
340	xlog_grant_head_check(
341	struct xlog *log,
342	struct xlog_grant_head *head,
343	struct xlog_ticket *tic,
344	int *need_bytes)
345	{
346	int free_bytes;
347	int error = 0;
348
349	ASSERT(!xlog_in_recovery(log));
350
351	/*
352	* If there are other waiters on the queue then give them a chance at
353	* logspace before us. Wake up the first waiters, if we do not wake
354	* up all the waiters then go to sleep waiting for more free space,
355	* otherwise try to get some space for this transaction.
356	*/
357	*need_bytes = xlog_ticket_reservation(log, head, tic);
358	free_bytes = xlog_space_left(log, head: &head->grant);
359	if (!list_empty_careful(head: &head->waiters)) {
360	spin_lock(lock: &head->lock);
361	if (!xlog_grant_head_wake(log, head, free_bytes: &free_bytes) ||
362	free_bytes < *need_bytes) {
363	error = xlog_grant_head_wait(log, head, tic,
364	need_bytes: *need_bytes);
365	}
366	spin_unlock(lock: &head->lock);
367	} else if (free_bytes < *need_bytes) {
368	spin_lock(lock: &head->lock);
369	error = xlog_grant_head_wait(log, head, tic, need_bytes: *need_bytes);
370	spin_unlock(lock: &head->lock);
371	}
372
373	return error;
374	}
375
376	bool
377	xfs_log_writable(
378	struct xfs_mount *mp)
379	{
380	/*
381	* Do not write to the log on norecovery mounts, if the data or log
382	* devices are read-only, or if the filesystem is shutdown. Read-only
383	* mounts allow internal writes for log recovery and unmount purposes,
384	* so don't restrict that case.
385	*/
386	if (xfs_has_norecovery(mp))
387	return false;
388	if (xfs_readonly_buftarg(mp->m_ddev_targp))
389	return false;
390	if (xfs_readonly_buftarg(mp->m_log->l_targ))
391	return false;
392	if (xlog_is_shutdown(log: mp->m_log))
393	return false;
394	return true;
395	}
396
397	/*
398	* Replenish the byte reservation required by moving the grant write head.
399	*/
400	int
401	xfs_log_regrant(
402	struct xfs_mount *mp,
403	struct xlog_ticket *tic)
404	{
405	struct xlog *log = mp->m_log;
406	int need_bytes;
407	int error = 0;
408
409	if (xlog_is_shutdown(log))
410	return -EIO;
411
412	XFS_STATS_INC(mp, xs_try_logspace);
413
414	/*
415	* This is a new transaction on the ticket, so we need to change the
416	* transaction ID so that the next transaction has a different TID in
417	* the log. Just add one to the existing tid so that we can see chains
418	* of rolling transactions in the log easily.
419	*/
420	tic->t_tid++;
421
422	xlog_grant_push_ail(log, need_bytes: tic->t_unit_res);
423
424	tic->t_curr_res = tic->t_unit_res;
425	if (tic->t_cnt > 0)
426	return 0;
427
428	trace_xfs_log_regrant(log, tic);
429
430	error = xlog_grant_head_check(log, head: &log->l_write_head, tic,
431	need_bytes: &need_bytes);
432	if (error)
433	goto out_error;
434
435	xlog_grant_add_space(log, head: &log->l_write_head.grant, bytes: need_bytes);
436	trace_xfs_log_regrant_exit(log, tic);
437	xlog_verify_grant_tail(log);
438	return 0;
439
440	out_error:
441	/*
442	* If we are failing, make sure the ticket doesn't have any current
443	* reservations. We don't want to add this back when the ticket/
444	* transaction gets cancelled.
445	*/
446	tic->t_curr_res = 0;
447	tic->t_cnt = 0; /* ungrant will give back unit_res * t_cnt. */
448	return error;
449	}
450
451	/*
452	* Reserve log space and return a ticket corresponding to the reservation.
453	*
454	* Each reservation is going to reserve extra space for a log record header.
455	* When writes happen to the on-disk log, we don't subtract the length of the
456	* log record header from any reservation. By wasting space in each
457	* reservation, we prevent over allocation problems.
458	*/
459	int
460	xfs_log_reserve(
461	struct xfs_mount *mp,
462	int unit_bytes,
463	int cnt,
464	struct xlog_ticket **ticp,
465	bool permanent)
466	{
467	struct xlog *log = mp->m_log;
468	struct xlog_ticket *tic;
469	int need_bytes;
470	int error = 0;
471
472	if (xlog_is_shutdown(log))
473	return -EIO;
474
475	XFS_STATS_INC(mp, xs_try_logspace);
476
477	ASSERT(*ticp == NULL);
478	tic = xlog_ticket_alloc(log, unit_bytes, count: cnt, permanent);
479	*ticp = tic;
480
481	xlog_grant_push_ail(log, need_bytes: tic->t_cnt ? tic->t_unit_res * tic->t_cnt
482	: tic->t_unit_res);
483
484	trace_xfs_log_reserve(log, tic);
485
486	error = xlog_grant_head_check(log, head: &log->l_reserve_head, tic,
487	need_bytes: &need_bytes);
488	if (error)
489	goto out_error;
490
491	xlog_grant_add_space(log, head: &log->l_reserve_head.grant, bytes: need_bytes);
492	xlog_grant_add_space(log, head: &log->l_write_head.grant, bytes: need_bytes);
493	trace_xfs_log_reserve_exit(log, tic);
494	xlog_verify_grant_tail(log);
495	return 0;
496
497	out_error:
498	/*
499	* If we are failing, make sure the ticket doesn't have any current
500	* reservations. We don't want to add this back when the ticket/
501	* transaction gets cancelled.
502	*/
503	tic->t_curr_res = 0;
504	tic->t_cnt = 0; /* ungrant will give back unit_res * t_cnt. */
505	return error;
506	}
507
508	/*
509	* Run all the pending iclog callbacks and wake log force waiters and iclog
510	* space waiters so they can process the newly set shutdown state. We really
511	* don't care what order we process callbacks here because the log is shut down
512	* and so state cannot change on disk anymore. However, we cannot wake waiters
513	* until the callbacks have been processed because we may be in unmount and
514	* we must ensure that all AIL operations the callbacks perform have completed
515	* before we tear down the AIL.
516	*
517	* We avoid processing actively referenced iclogs so that we don't run callbacks
518	* while the iclog owner might still be preparing the iclog for IO submssion.
519	* These will be caught by xlog_state_iclog_release() and call this function
520	* again to process any callbacks that may have been added to that iclog.
521	*/
522	static void
523	xlog_state_shutdown_callbacks(
524	struct xlog *log)
525	{
526	struct xlog_in_core *iclog;
527	LIST_HEAD(cb_list);
528
529	iclog = log->l_iclog;
530	do {
531	if (atomic_read(v: &iclog->ic_refcnt)) {
532	/* Reference holder will re-run iclog callbacks. */
533	continue;
534	}
535	list_splice_init(list: &iclog->ic_callbacks, head: &cb_list);
536	spin_unlock(lock: &log->l_icloglock);
537
538	xlog_cil_process_committed(list: &cb_list);
539
540	spin_lock(lock: &log->l_icloglock);
541	wake_up_all(&iclog->ic_write_wait);
542	wake_up_all(&iclog->ic_force_wait);
543	} while ((iclog = iclog->ic_next) != log->l_iclog);
544
545	wake_up_all(&log->l_flush_wait);
546	}
547
548	/*
549	* Flush iclog to disk if this is the last reference to the given iclog and the
550	* it is in the WANT_SYNC state.
551	*
552	* If XLOG_ICL_NEED_FUA is already set on the iclog, we need to ensure that the
553	* log tail is updated correctly. NEED_FUA indicates that the iclog will be
554	* written to stable storage, and implies that a commit record is contained
555	* within the iclog. We need to ensure that the log tail does not move beyond
556	* the tail that the first commit record in the iclog ordered against, otherwise
557	* correct recovery of that checkpoint becomes dependent on future operations
558	* performed on this iclog.
559	*
560	* Hence if NEED_FUA is set and the current iclog tail lsn is empty, write the
561	* current tail into iclog. Once the iclog tail is set, future operations must
562	* not modify it, otherwise they potentially violate ordering constraints for
563	* the checkpoint commit that wrote the initial tail lsn value. The tail lsn in
564	* the iclog will get zeroed on activation of the iclog after sync, so we
565	* always capture the tail lsn on the iclog on the first NEED_FUA release
566	* regardless of the number of active reference counts on this iclog.
567	*/
568	int
569	xlog_state_release_iclog(
570	struct xlog *log,
571	struct xlog_in_core *iclog,
572	struct xlog_ticket *ticket)
573	{
574	xfs_lsn_t tail_lsn;
575	bool last_ref;
576
577	lockdep_assert_held(&log->l_icloglock);
578
579	trace_xlog_iclog_release(iclog, _RET_IP_);
580	/*
581	* Grabbing the current log tail needs to be atomic w.r.t. the writing
582	* of the tail LSN into the iclog so we guarantee that the log tail does
583	* not move between the first time we know that the iclog needs to be
584	* made stable and when we eventually submit it.
585	*/
586	if ((iclog->ic_state == XLOG_STATE_WANT_SYNC ||
587	(iclog->ic_flags & XLOG_ICL_NEED_FUA)) &&
588	!iclog->ic_header.h_tail_lsn) {
589	tail_lsn = xlog_assign_tail_lsn(log->l_mp);
590	iclog->ic_header.h_tail_lsn = cpu_to_be64(tail_lsn);
591	}
592
593	last_ref = atomic_dec_and_test(v: &iclog->ic_refcnt);
594
595	if (xlog_is_shutdown(log)) {
596	/*
597	* If there are no more references to this iclog, process the
598	* pending iclog callbacks that were waiting on the release of
599	* this iclog.
600	*/
601	if (last_ref)
602	xlog_state_shutdown_callbacks(log);
603	return -EIO;
604	}
605
606	if (!last_ref)
607	return 0;
608
609	if (iclog->ic_state != XLOG_STATE_WANT_SYNC) {
610	ASSERT(iclog->ic_state == XLOG_STATE_ACTIVE);
611	return 0;
612	}
613
614	iclog->ic_state = XLOG_STATE_SYNCING;
615	xlog_verify_tail_lsn(log, iclog);
616	trace_xlog_iclog_syncing(iclog, _RET_IP_);
617
618	spin_unlock(lock: &log->l_icloglock);
619	xlog_sync(log, iclog, ticket);
620	spin_lock(lock: &log->l_icloglock);
621	return 0;
622	}
623
624	/*
625	* Mount a log filesystem
626	*
627	* mp - ubiquitous xfs mount point structure
628	* log_target - buftarg of on-disk log device
629	* blk_offset - Start block # where block size is 512 bytes (BBSIZE)
630	* num_bblocks - Number of BBSIZE blocks in on-disk log
631	*
632	* Return error or zero.
633	*/
634	int
635	xfs_log_mount(
636	xfs_mount_t *mp,
637	struct xfs_buftarg *log_target,
638	xfs_daddr_t blk_offset,
639	int num_bblks)
640	{
641	struct xlog *log;
642	int error = 0;
643	int min_logfsbs;
644
645	if (!xfs_has_norecovery(mp)) {
646	xfs_notice(mp, "Mounting V%d Filesystem %pU",
647	XFS_SB_VERSION_NUM(&mp->m_sb),
648	&mp->m_sb.sb_uuid);
649	} else {
650	xfs_notice(mp,
651	"Mounting V%d filesystem %pU in no-recovery mode. Filesystem will be inconsistent.",
652	XFS_SB_VERSION_NUM(&mp->m_sb),
653	&mp->m_sb.sb_uuid);
654	ASSERT(xfs_is_readonly(mp));
655	}
656
657	log = xlog_alloc_log(mp, log_target, blk_offset, num_bblks);
658	if (IS_ERR(ptr: log)) {
659	error = PTR_ERR(ptr: log);
660	goto out;
661	}
662	mp->m_log = log;
663
664	/*
665	* Now that we have set up the log and it's internal geometry
666	* parameters, we can validate the given log space and drop a critical
667	* message via syslog if the log size is too small. A log that is too
668	* small can lead to unexpected situations in transaction log space
669	* reservation stage. The superblock verifier has already validated all
670	* the other log geometry constraints, so we don't have to check those
671	* here.
672	*
673	* Note: For v4 filesystems, we can't just reject the mount if the
674	* validation fails. This would mean that people would have to
675	* downgrade their kernel just to remedy the situation as there is no
676	* way to grow the log (short of black magic surgery with xfs_db).
677	*
678	* We can, however, reject mounts for V5 format filesystems, as the
679	* mkfs binary being used to make the filesystem should never create a
680	* filesystem with a log that is too small.
681	*/
682	min_logfsbs = xfs_log_calc_minimum_size(mp);
683	if (mp->m_sb.sb_logblocks < min_logfsbs) {
684	xfs_warn(mp,
685	"Log size %d blocks too small, minimum size is %d blocks",
686	mp->m_sb.sb_logblocks, min_logfsbs);
687
688	/*
689	* Log check errors are always fatal on v5; or whenever bad
690	* metadata leads to a crash.
691	*/
692	if (xfs_has_crc(mp)) {
693	xfs_crit(mp, "AAIEEE! Log failed size checks. Abort!");
694	ASSERT(0);
695	error = -EINVAL;
696	goto out_free_log;
697	}
698	xfs_crit(mp, "Log size out of supported range.");
699	xfs_crit(mp,
700	"Continuing onwards, but if log hangs are experienced then please report this message in the bug report.");
701	}
702
703	/*
704	* Initialize the AIL now we have a log.
705	*/
706	error = xfs_trans_ail_init(mp);
707	if (error) {
708	xfs_warn(mp, "AIL initialisation failed: error %d", error);
709	goto out_free_log;
710	}
711	log->l_ailp = mp->m_ail;
712
713	/*
714	* skip log recovery on a norecovery mount. pretend it all
715	* just worked.
716	*/
717	if (!xfs_has_norecovery(mp)) {
718	error = xlog_recover(log);
719	if (error) {
720	xfs_warn(mp, "log mount/recovery failed: error %d",
721	error);
722	xlog_recover_cancel(log);
723	goto out_destroy_ail;
724	}
725	}
726
727	error = xfs_sysfs_init(kobj: &log->l_kobj, ktype: &xfs_log_ktype, parent_kobj: &mp->m_kobj,
728	name: "log");
729	if (error)
730	goto out_destroy_ail;
731
732	/* Normal transactions can now occur */
733	clear_bit(XLOG_ACTIVE_RECOVERY, addr: &log->l_opstate);
734
735	/*
736	* Now the log has been fully initialised and we know were our
737	* space grant counters are, we can initialise the permanent ticket
738	* needed for delayed logging to work.
739	*/
740	xlog_cil_init_post_recovery(log);
741
742	return 0;
743
744	out_destroy_ail:
745	xfs_trans_ail_destroy(mp);
746	out_free_log:
747	xlog_dealloc_log(log);
748	out:
749	return error;
750	}
751
752	/*
753	* Finish the recovery of the file system. This is separate from the
754	* xfs_log_mount() call, because it depends on the code in xfs_mountfs() to read
755	* in the root and real-time bitmap inodes between calling xfs_log_mount() and
756	* here.
757	*
758	* If we finish recovery successfully, start the background log work. If we are
759	* not doing recovery, then we have a RO filesystem and we don't need to start
760	* it.
761	*/
762	int
763	xfs_log_mount_finish(
764	struct xfs_mount *mp)
765	{
766	struct xlog *log = mp->m_log;
767	int error = 0;
768
769	if (xfs_has_norecovery(mp)) {
770	ASSERT(xfs_is_readonly(mp));
771	return 0;
772	}
773
774	/*
775	* During the second phase of log recovery, we need iget and
776	* iput to behave like they do for an active filesystem.
777	* xfs_fs_drop_inode needs to be able to prevent the deletion
778	* of inodes before we're done replaying log items on those
779	* inodes. Turn it off immediately after recovery finishes
780	* so that we don't leak the quota inodes if subsequent mount
781	* activities fail.
782	*
783	* We let all inodes involved in redo item processing end up on
784	* the LRU instead of being evicted immediately so that if we do
785	* something to an unlinked inode, the irele won't cause
786	* premature truncation and freeing of the inode, which results
787	* in log recovery failure. We have to evict the unreferenced
788	* lru inodes after clearing SB_ACTIVE because we don't
789	* otherwise clean up the lru if there's a subsequent failure in
790	* xfs_mountfs, which leads to us leaking the inodes if nothing
791	* else (e.g. quotacheck) references the inodes before the
792	* mount failure occurs.
793	*/
794	mp->m_super->s_flags |= SB_ACTIVE;
795	xfs_log_work_queue(mp);
796	if (xlog_recovery_needed(log))
797	error = xlog_recover_finish(log);
798	mp->m_super->s_flags &= ~SB_ACTIVE;
799	evict_inodes(sb: mp->m_super);
800
801	/*
802	* Drain the buffer LRU after log recovery. This is required for v4
803	* filesystems to avoid leaving around buffers with NULL verifier ops,
804	* but we do it unconditionally to make sure we're always in a clean
805	* cache state after mount.
806	*
807	* Don't push in the error case because the AIL may have pending intents
808	* that aren't removed until recovery is cancelled.
809	*/
810	if (xlog_recovery_needed(log)) {
811	if (!error) {
812	xfs_log_force(mp, XFS_LOG_SYNC);
813	xfs_ail_push_all_sync(mp->m_ail);
814	}
815	xfs_notice(mp, "Ending recovery (logdev: %s)",
816	mp->m_logname ? mp->m_logname : "internal");
817	} else {
818	xfs_info(mp, "Ending clean mount");
819	}
820	xfs_buftarg_drain(mp->m_ddev_targp);
821
822	clear_bit(XLOG_RECOVERY_NEEDED, addr: &log->l_opstate);
823
824	/* Make sure the log is dead if we're returning failure. */
825	ASSERT(!error || xlog_is_shutdown(log));
826
827	return error;
828	}
829
830	/*
831	* The mount has failed. Cancel the recovery if it hasn't completed and destroy
832	* the log.
833	*/
834	void
835	xfs_log_mount_cancel(
836	struct xfs_mount *mp)
837	{
838	xlog_recover_cancel(mp->m_log);
839	xfs_log_unmount(mp);
840	}
841
842	/*
843	* Flush out the iclog to disk ensuring that device caches are flushed and
844	* the iclog hits stable storage before any completion waiters are woken.
845	*/
846	static inline int
847	xlog_force_iclog(
848	struct xlog_in_core *iclog)
849	{
850	atomic_inc(v: &iclog->ic_refcnt);
851	iclog->ic_flags |= XLOG_ICL_NEED_FLUSH | XLOG_ICL_NEED_FUA;
852	if (iclog->ic_state == XLOG_STATE_ACTIVE)
853	xlog_state_switch_iclogs(log: iclog->ic_log, iclog, eventual_size: 0);
854	return xlog_state_release_iclog(log: iclog->ic_log, iclog, NULL);
855	}
856
857	/*
858	* Cycle all the iclogbuf locks to make sure all log IO completion
859	* is done before we tear down these buffers.
860	*/
861	static void
862	xlog_wait_iclog_completion(struct xlog *log)
863	{
864	int i;
865	struct xlog_in_core *iclog = log->l_iclog;
866
867	for (i = 0; i < log->l_iclog_bufs; i++) {
868	down(sem: &iclog->ic_sema);
869	up(sem: &iclog->ic_sema);
870	iclog = iclog->ic_next;
871	}
872	}
873
874	/*
875	* Wait for the iclog and all prior iclogs to be written disk as required by the
876	* log force state machine. Waiting on ic_force_wait ensures iclog completions
877	* have been ordered and callbacks run before we are woken here, hence
878	* guaranteeing that all the iclogs up to this one are on stable storage.
879	*/
880	int
881	xlog_wait_on_iclog(
882	struct xlog_in_core *iclog)
883	__releases(iclog->ic_log->l_icloglock)
884	{
885	struct xlog *log = iclog->ic_log;
886
887	trace_xlog_iclog_wait_on(iclog, _RET_IP_);
888	if (!xlog_is_shutdown(log) &&
889	iclog->ic_state != XLOG_STATE_ACTIVE &&
890	iclog->ic_state != XLOG_STATE_DIRTY) {
891	XFS_STATS_INC(log->l_mp, xs_log_force_sleep);
892	xlog_wait(wq: &iclog->ic_force_wait, lock: &log->l_icloglock);
893	} else {
894	spin_unlock(lock: &log->l_icloglock);
895	}
896
897	if (xlog_is_shutdown(log))
898	return -EIO;
899	return 0;
900	}
901
902	/*
903	* Write out an unmount record using the ticket provided. We have to account for
904	* the data space used in the unmount ticket as this write is not done from a
905	* transaction context that has already done the accounting for us.
906	*/
907	static int
908	xlog_write_unmount_record(
909	struct xlog *log,
910	struct xlog_ticket *ticket)
911	{
912	struct {
913	struct xlog_op_header ophdr;
914	struct xfs_unmount_log_format ulf;
915	} unmount_rec = {
916	.ophdr = {
917	.oh_clientid = XFS_LOG,
918	.oh_tid = cpu_to_be32(ticket->t_tid),
919	.oh_flags = XLOG_UNMOUNT_TRANS,
920	},
921	.ulf = {
922	.magic = XLOG_UNMOUNT_TYPE,
923	},
924	};
925	struct xfs_log_iovec reg = {
926	.i_addr = &unmount_rec,
927	.i_len = sizeof(unmount_rec),
928	.i_type = XLOG_REG_TYPE_UNMOUNT,
929	};
930	struct xfs_log_vec vec = {
931	.lv_niovecs = 1,
932	.lv_iovecp = &reg,
933	};
934	LIST_HEAD(lv_chain);
935	list_add(new: &vec.lv_list, head: &lv_chain);
936
937	BUILD_BUG_ON((sizeof(struct xlog_op_header) +
938	sizeof(struct xfs_unmount_log_format)) !=
939	sizeof(unmount_rec));
940
941	/* account for space used by record data */
942	ticket->t_curr_res -= sizeof(unmount_rec);
943
944	return xlog_write(log, NULL, lv_chain: &lv_chain, tic: ticket, len: reg.i_len);
945	}
946
947	/*
948	* Mark the filesystem clean by writing an unmount record to the head of the
949	* log.
950	*/
951	static void
952	xlog_unmount_write(
953	struct xlog *log)
954	{
955	struct xfs_mount *mp = log->l_mp;
956	struct xlog_in_core *iclog;
957	struct xlog_ticket *tic = NULL;
958	int error;
959
960	error = xfs_log_reserve(mp, unit_bytes: 600, cnt: 1, ticp: &tic, permanent: 0);
961	if (error)
962	goto out_err;
963
964	error = xlog_write_unmount_record(log, ticket: tic);
965	/*
966	* At this point, we're umounting anyway, so there's no point in
967	* transitioning log state to shutdown. Just continue...
968	*/
969	out_err:
970	if (error)
971	xfs_alert(mp, "%s: unmount record failed", __func__);
972
973	spin_lock(lock: &log->l_icloglock);
974	iclog = log->l_iclog;
975	error = xlog_force_iclog(iclog);
976	xlog_wait_on_iclog(iclog);
977
978	if (tic) {
979	trace_xfs_log_umount_write(log, tic);
980	xfs_log_ticket_ungrant(log, ticket: tic);
981	}
982	}
983
984	static void
985	xfs_log_unmount_verify_iclog(
986	struct xlog *log)
987	{
988	struct xlog_in_core *iclog = log->l_iclog;
989
990	do {
991	ASSERT(iclog->ic_state == XLOG_STATE_ACTIVE);
992	ASSERT(iclog->ic_offset == 0);
993	} while ((iclog = iclog->ic_next) != log->l_iclog);
994	}
995
996	/*
997	* Unmount record used to have a string "Unmount filesystem--" in the
998	* data section where the "Un" was really a magic number (XLOG_UNMOUNT_TYPE).
999	* We just write the magic number now since that particular field isn't
1000	* currently architecture converted and "Unmount" is a bit foo.
1001	* As far as I know, there weren't any dependencies on the old behaviour.
1002	*/
1003	static void
1004	xfs_log_unmount_write(
1005	struct xfs_mount *mp)
1006	{
1007	struct xlog *log = mp->m_log;
1008
1009	if (!xfs_log_writable(mp))
1010	return;
1011
1012	xfs_log_force(mp, XFS_LOG_SYNC);
1013
1014	if (xlog_is_shutdown(log))
1015	return;
1016
1017	/*
1018	* If we think the summary counters are bad, avoid writing the unmount
1019	* record to force log recovery at next mount, after which the summary
1020	* counters will be recalculated. Refer to xlog_check_unmount_rec for
1021	* more details.
1022	*/
1023	if (XFS_TEST_ERROR(xfs_fs_has_sickness(mp, XFS_SICK_FS_COUNTERS), mp,
1024	XFS_ERRTAG_FORCE_SUMMARY_RECALC)) {
1025	xfs_alert(mp, "%s: will fix summary counters at next mount",
1026	__func__);
1027	return;
1028	}
1029
1030	xfs_log_unmount_verify_iclog(log);
1031	xlog_unmount_write(log);
1032	}
1033
1034	/*
1035	* Empty the log for unmount/freeze.
1036	*
1037	* To do this, we first need to shut down the background log work so it is not
1038	* trying to cover the log as we clean up. We then need to unpin all objects in
1039	* the log so we can then flush them out. Once they have completed their IO and
1040	* run the callbacks removing themselves from the AIL, we can cover the log.
1041	*/
1042	int
1043	xfs_log_quiesce(
1044	struct xfs_mount *mp)
1045	{
1046	/*
1047	* Clear log incompat features since we're quiescing the log. Report
1048	* failures, though it's not fatal to have a higher log feature
1049	* protection level than the log contents actually require.
1050	*/
1051	if (xfs_clear_incompat_log_features(mp)) {
1052	int error;
1053
1054	error = xfs_sync_sb(mp, false);
1055	if (error)
1056	xfs_warn(mp,
1057	"Failed to clear log incompat features on quiesce");
1058	}
1059
1060	cancel_delayed_work_sync(dwork: &mp->m_log->l_work);
1061	xfs_log_force(mp, XFS_LOG_SYNC);
1062
1063	/*
1064	* The superblock buffer is uncached and while xfs_ail_push_all_sync()
1065	* will push it, xfs_buftarg_wait() will not wait for it. Further,
1066	* xfs_buf_iowait() cannot be used because it was pushed with the
1067	* XBF_ASYNC flag set, so we need to use a lock/unlock pair to wait for
1068	* the IO to complete.
1069	*/
1070	xfs_ail_push_all_sync(mp->m_ail);
1071	xfs_buftarg_wait(mp->m_ddev_targp);
1072	xfs_buf_lock(mp->m_sb_bp);
1073	xfs_buf_unlock(mp->m_sb_bp);
1074
1075	return xfs_log_cover(mp);
1076	}
1077
1078	void
1079	xfs_log_clean(
1080	struct xfs_mount *mp)
1081	{
1082	xfs_log_quiesce(mp);
1083	xfs_log_unmount_write(mp);
1084	}
1085
1086	/*
1087	* Shut down and release the AIL and Log.
1088	*
1089	* During unmount, we need to ensure we flush all the dirty metadata objects
1090	* from the AIL so that the log is empty before we write the unmount record to
1091	* the log. Once this is done, we can tear down the AIL and the log.
1092	*/
1093	void
1094	xfs_log_unmount(
1095	struct xfs_mount *mp)
1096	{
1097	xfs_log_clean(mp);
1098
1099	/*
1100	* If shutdown has come from iclog IO context, the log
1101	* cleaning will have been skipped and so we need to wait
1102	* for the iclog to complete shutdown processing before we
1103	* tear anything down.
1104	*/
1105	xlog_wait_iclog_completion(log: mp->m_log);
1106
1107	xfs_buftarg_drain(mp->m_ddev_targp);
1108
1109	xfs_trans_ail_destroy(mp);
1110
1111	xfs_sysfs_del(kobj: &mp->m_log->l_kobj);
1112
1113	xlog_dealloc_log(log: mp->m_log);
1114	}
1115
1116	void
1117	xfs_log_item_init(
1118	struct xfs_mount *mp,
1119	struct xfs_log_item *item,
1120	int type,
1121	const struct xfs_item_ops *ops)
1122	{
1123	item->li_log = mp->m_log;
1124	item->li_ailp = mp->m_ail;
1125	item->li_type = type;
1126	item->li_ops = ops;
1127	item->li_lv = NULL;
1128
1129	INIT_LIST_HEAD(list: &item->li_ail);
1130	INIT_LIST_HEAD(list: &item->li_cil);
1131	INIT_LIST_HEAD(list: &item->li_bio_list);
1132	INIT_LIST_HEAD(list: &item->li_trans);
1133	}
1134
1135	/*
1136	* Wake up processes waiting for log space after we have moved the log tail.
1137	*/
1138	void
1139	xfs_log_space_wake(
1140	struct xfs_mount *mp)
1141	{
1142	struct xlog *log = mp->m_log;
1143	int free_bytes;
1144
1145	if (xlog_is_shutdown(log))
1146	return;
1147
1148	if (!list_empty_careful(head: &log->l_write_head.waiters)) {
1149	ASSERT(!xlog_in_recovery(log));
1150
1151	spin_lock(lock: &log->l_write_head.lock);
1152	free_bytes = xlog_space_left(log, head: &log->l_write_head.grant);
1153	xlog_grant_head_wake(log, head: &log->l_write_head, free_bytes: &free_bytes);
1154	spin_unlock(lock: &log->l_write_head.lock);
1155	}
1156
1157	if (!list_empty_careful(head: &log->l_reserve_head.waiters)) {
1158	ASSERT(!xlog_in_recovery(log));
1159
1160	spin_lock(lock: &log->l_reserve_head.lock);
1161	free_bytes = xlog_space_left(log, head: &log->l_reserve_head.grant);
1162	xlog_grant_head_wake(log, head: &log->l_reserve_head, free_bytes: &free_bytes);
1163	spin_unlock(lock: &log->l_reserve_head.lock);
1164	}
1165	}
1166
1167	/*
1168	* Determine if we have a transaction that has gone to disk that needs to be
1169	* covered. To begin the transition to the idle state firstly the log needs to
1170	* be idle. That means the CIL, the AIL and the iclogs needs to be empty before
1171	* we start attempting to cover the log.
1172	*
1173	* Only if we are then in a state where covering is needed, the caller is
1174	* informed that dummy transactions are required to move the log into the idle
1175	* state.
1176	*
1177	* If there are any items in the AIl or CIL, then we do not want to attempt to
1178	* cover the log as we may be in a situation where there isn't log space
1179	* available to run a dummy transaction and this can lead to deadlocks when the
1180	* tail of the log is pinned by an item that is modified in the CIL. Hence
1181	* there's no point in running a dummy transaction at this point because we
1182	* can't start trying to idle the log until both the CIL and AIL are empty.
1183	*/
1184	static bool
1185	xfs_log_need_covered(
1186	struct xfs_mount *mp)
1187	{
1188	struct xlog *log = mp->m_log;
1189	bool needed = false;
1190
1191	if (!xlog_cil_empty(log))
1192	return false;
1193
1194	spin_lock(lock: &log->l_icloglock);
1195	switch (log->l_covered_state) {
1196	case XLOG_STATE_COVER_DONE:
1197	case XLOG_STATE_COVER_DONE2:
1198	case XLOG_STATE_COVER_IDLE:
1199	break;
1200	case XLOG_STATE_COVER_NEED:
1201	case XLOG_STATE_COVER_NEED2:
1202	if (xfs_ail_min_lsn(log->l_ailp))
1203	break;
1204	if (!xlog_iclogs_empty(log))
1205	break;
1206
1207	needed = true;
1208	if (log->l_covered_state == XLOG_STATE_COVER_NEED)
1209	log->l_covered_state = XLOG_STATE_COVER_DONE;
1210	else
1211	log->l_covered_state = XLOG_STATE_COVER_DONE2;
1212	break;
1213	default:
1214	needed = true;
1215	break;
1216	}
1217	spin_unlock(lock: &log->l_icloglock);
1218	return needed;
1219	}
1220
1221	/*
1222	* Explicitly cover the log. This is similar to background log covering but
1223	* intended for usage in quiesce codepaths. The caller is responsible to ensure
1224	* the log is idle and suitable for covering. The CIL, iclog buffers and AIL
1225	* must all be empty.
1226	*/
1227	static int
1228	xfs_log_cover(
1229	struct xfs_mount *mp)
1230	{
1231	int error = 0;
1232	bool need_covered;
1233
1234	ASSERT((xlog_cil_empty(mp->m_log) && xlog_iclogs_empty(mp->m_log) &&
1235	!xfs_ail_min_lsn(mp->m_log->l_ailp)) ||
1236	xlog_is_shutdown(mp->m_log));
1237
1238	if (!xfs_log_writable(mp))
1239	return 0;
1240
1241	/*
1242	* xfs_log_need_covered() is not idempotent because it progresses the
1243	* state machine if the log requires covering. Therefore, we must call
1244	* this function once and use the result until we've issued an sb sync.
1245	* Do so first to make that abundantly clear.
1246	*
1247	* Fall into the covering sequence if the log needs covering or the
1248	* mount has lazy superblock accounting to sync to disk. The sb sync
1249	* used for covering accumulates the in-core counters, so covering
1250	* handles this for us.
1251	*/
1252	need_covered = xfs_log_need_covered(mp);
1253	if (!need_covered && !xfs_has_lazysbcount(mp))
1254	return 0;
1255
1256	/*
1257	* To cover the log, commit the superblock twice (at most) in
1258	* independent checkpoints. The first serves as a reference for the
1259	* tail pointer. The sync transaction and AIL push empties the AIL and
1260	* updates the in-core tail to the LSN of the first checkpoint. The
1261	* second commit updates the on-disk tail with the in-core LSN,
1262	* covering the log. Push the AIL one more time to leave it empty, as
1263	* we found it.
1264	*/
1265	do {
1266	error = xfs_sync_sb(mp, true);
1267	if (error)
1268	break;
1269	xfs_ail_push_all_sync(mp->m_ail);
1270	} while (xfs_log_need_covered(mp));
1271
1272	return error;
1273	}
1274
1275	/*
1276	* We may be holding the log iclog lock upon entering this routine.
1277	*/
1278	xfs_lsn_t
1279	xlog_assign_tail_lsn_locked(
1280	struct xfs_mount *mp)
1281	{
1282	struct xlog *log = mp->m_log;
1283	struct xfs_log_item *lip;
1284	xfs_lsn_t tail_lsn;
1285
1286	assert_spin_locked(&mp->m_ail->ail_lock);
1287
1288	/*
1289	* To make sure we always have a valid LSN for the log tail we keep
1290	* track of the last LSN which was committed in log->l_last_sync_lsn,
1291	* and use that when the AIL was empty.
1292	*/
1293	lip = xfs_ail_min(ailp: mp->m_ail);
1294	if (lip)
1295	tail_lsn = lip->li_lsn;
1296	else
1297	tail_lsn = atomic64_read(&log->l_last_sync_lsn);
1298	trace_xfs_log_assign_tail_lsn(log, tail_lsn);
1299	atomic64_set(&log->l_tail_lsn, tail_lsn);
1300	return tail_lsn;
1301	}
1302
1303	xfs_lsn_t
1304	xlog_assign_tail_lsn(
1305	struct xfs_mount *mp)
1306	{
1307	xfs_lsn_t tail_lsn;
1308
1309	spin_lock(lock: &mp->m_ail->ail_lock);
1310	tail_lsn = xlog_assign_tail_lsn_locked(mp);
1311	spin_unlock(lock: &mp->m_ail->ail_lock);
1312
1313	return tail_lsn;
1314	}
1315
1316	/*
1317	* Return the space in the log between the tail and the head. The head
1318	* is passed in the cycle/bytes formal parms. In the special case where
1319	* the reserve head has wrapped passed the tail, this calculation is no
1320	* longer valid. In this case, just return 0 which means there is no space
1321	* in the log. This works for all places where this function is called
1322	* with the reserve head. Of course, if the write head were to ever
1323	* wrap the tail, we should blow up. Rather than catch this case here,
1324	* we depend on other ASSERTions in other parts of the code. XXXmiken
1325	*
1326	* If reservation head is behind the tail, we have a problem. Warn about it,
1327	* but then treat it as if the log is empty.
1328	*
1329	* If the log is shut down, the head and tail may be invalid or out of whack, so
1330	* shortcut invalidity asserts in this case so that we don't trigger them
1331	* falsely.
1332	*/
1333	STATIC int
1334	xlog_space_left(
1335	struct xlog *log,
1336	atomic64_t *head)
1337	{
1338	int tail_bytes;
1339	int tail_cycle;
1340	int head_cycle;
1341	int head_bytes;
1342
1343	xlog_crack_grant_head(head, cycle: &head_cycle, space: &head_bytes);
1344	xlog_crack_atomic_lsn(lsn: &log->l_tail_lsn, cycle: &tail_cycle, block: &tail_bytes);
1345	tail_bytes = BBTOB(tail_bytes);
1346	if (tail_cycle == head_cycle && head_bytes >= tail_bytes)
1347	return log->l_logsize - (head_bytes - tail_bytes);
1348	if (tail_cycle + 1 < head_cycle)
1349	return 0;
1350
1351	/* Ignore potential inconsistency when shutdown. */
1352	if (xlog_is_shutdown(log))
1353	return log->l_logsize;
1354
1355	if (tail_cycle < head_cycle) {
1356	ASSERT(tail_cycle == (head_cycle - 1));
1357	return tail_bytes - head_bytes;
1358	}
1359
1360	/*
1361	* The reservation head is behind the tail. In this case we just want to
1362	* return the size of the log as the amount of space left.
1363	*/
1364	xfs_alert(log->l_mp, "xlog_space_left: head behind tail");
1365	xfs_alert(log->l_mp, " tail_cycle = %d, tail_bytes = %d",
1366	tail_cycle, tail_bytes);
1367	xfs_alert(log->l_mp, " GH cycle = %d, GH bytes = %d",
1368	head_cycle, head_bytes);
1369	ASSERT(0);
1370	return log->l_logsize;
1371	}
1372
1373
1374	static void
1375	xlog_ioend_work(
1376	struct work_struct *work)
1377	{
1378	struct xlog_in_core *iclog =
1379	container_of(work, struct xlog_in_core, ic_end_io_work);
1380	struct xlog *log = iclog->ic_log;
1381	int error;
1382
1383	error = blk_status_to_errno(status: iclog->ic_bio.bi_status);
1384	#ifdef DEBUG
1385	/* treat writes with injected CRC errors as failed */
1386	if (iclog->ic_fail_crc)
1387	error = -EIO;
1388	#endif
1389
1390	/*
1391	* Race to shutdown the filesystem if we see an error.
1392	*/
1393	if (XFS_TEST_ERROR(error, log->l_mp, XFS_ERRTAG_IODONE_IOERR)) {
1394	xfs_alert(log->l_mp, "log I/O error %d", error);
1395	xlog_force_shutdown(log, SHUTDOWN_LOG_IO_ERROR);
1396	}
1397
1398	xlog_state_done_syncing(iclog);
1399	bio_uninit(&iclog->ic_bio);
1400
1401	/*
1402	* Drop the lock to signal that we are done. Nothing references the
1403	* iclog after this, so an unmount waiting on this lock can now tear it
1404	* down safely. As such, it is unsafe to reference the iclog after the
1405	* unlock as we could race with it being freed.
1406	*/
1407	up(sem: &iclog->ic_sema);
1408	}
1409
1410	/*
1411	* Return size of each in-core log record buffer.
1412	*
1413	* All machines get 8 x 32kB buffers by default, unless tuned otherwise.
1414	*
1415	* If the filesystem blocksize is too large, we may need to choose a
1416	* larger size since the directory code currently logs entire blocks.
1417	*/
1418	STATIC void
1419	xlog_get_iclog_buffer_size(
1420	struct xfs_mount *mp,
1421	struct xlog *log)
1422	{
1423	if (mp->m_logbufs <= 0)
1424	mp->m_logbufs = XLOG_MAX_ICLOGS;
1425	if (mp->m_logbsize <= 0)
1426	mp->m_logbsize = XLOG_BIG_RECORD_BSIZE;
1427
1428	log->l_iclog_bufs = mp->m_logbufs;
1429	log->l_iclog_size = mp->m_logbsize;
1430
1431	/*
1432	* # headers = size / 32k - one header holds cycles from 32k of data.
1433	*/
1434	log->l_iclog_heads =
1435	DIV_ROUND_UP(mp->m_logbsize, XLOG_HEADER_CYCLE_SIZE);
1436	log->l_iclog_hsize = log->l_iclog_heads << BBSHIFT;
1437	}
1438
1439	void
1440	xfs_log_work_queue(
1441	struct xfs_mount *mp)
1442	{
1443	queue_delayed_work(wq: mp->m_sync_workqueue, dwork: &mp->m_log->l_work,
1444	delay: msecs_to_jiffies(xfs_syncd_centisecs * 10));
1445	}
1446
1447	/*
1448	* Clear the log incompat flags if we have the opportunity.
1449	*
1450	* This only happens if we're about to log the second dummy transaction as part
1451	* of covering the log and we can get the log incompat feature usage lock.
1452	*/
1453	static inline void
1454	xlog_clear_incompat(
1455	struct xlog *log)
1456	{
1457	struct xfs_mount *mp = log->l_mp;
1458
1459	if (!xfs_sb_has_incompat_log_feature(&mp->m_sb,
1460	XFS_SB_FEAT_INCOMPAT_LOG_ALL))
1461	return;
1462
1463	if (log->l_covered_state != XLOG_STATE_COVER_DONE2)
1464	return;
1465
1466	if (!down_write_trylock(sem: &log->l_incompat_users))
1467	return;
1468
1469	xfs_clear_incompat_log_features(mp);
1470	up_write(sem: &log->l_incompat_users);
1471	}
1472
1473	/*
1474	* Every sync period we need to unpin all items in the AIL and push them to
1475	* disk. If there is nothing dirty, then we might need to cover the log to
1476	* indicate that the filesystem is idle.
1477	*/
1478	static void
1479	xfs_log_worker(
1480	struct work_struct *work)
1481	{
1482	struct xlog *log = container_of(to_delayed_work(work),
1483	struct xlog, l_work);
1484	struct xfs_mount *mp = log->l_mp;
1485
1486	/* dgc: errors ignored - not fatal and nowhere to report them */
1487	if (xfs_fs_writable(mp, level: SB_FREEZE_WRITE) && xfs_log_need_covered(mp)) {
1488	/*
1489	* Dump a transaction into the log that contains no real change.
1490	* This is needed to stamp the current tail LSN into the log
1491	* during the covering operation.
1492	*
1493	* We cannot use an inode here for this - that will push dirty
1494	* state back up into the VFS and then periodic inode flushing
1495	* will prevent log covering from making progress. Hence we
1496	* synchronously log the superblock instead to ensure the
1497	* superblock is immediately unpinned and can be written back.
1498	*/
1499	xlog_clear_incompat(log);
1500	xfs_sync_sb(mp, true);
1501	} else
1502	xfs_log_force(mp, flags: 0);
1503
1504	/* start pushing all the metadata that is currently dirty */
1505	xfs_ail_push_all(mp->m_ail);
1506
1507	/* queue us up again */
1508	xfs_log_work_queue(mp);
1509	}
1510
1511	/*
1512	* This routine initializes some of the log structure for a given mount point.
1513	* Its primary purpose is to fill in enough, so recovery can occur. However,
1514	* some other stuff may be filled in too.
1515	*/
1516	STATIC struct xlog *
1517	xlog_alloc_log(
1518	struct xfs_mount *mp,
1519	struct xfs_buftarg *log_target,
1520	xfs_daddr_t blk_offset,
1521	int num_bblks)
1522	{
1523	struct xlog *log;
1524	xlog_rec_header_t *head;
1525	xlog_in_core_t **iclogp;
1526	xlog_in_core_t *iclog, *prev_iclog=NULL;
1527	int i;
1528	int error = -ENOMEM;
1529	uint log2_size = 0;
1530
1531	log = kzalloc(size: sizeof(struct xlog), GFP_KERNEL | __GFP_RETRY_MAYFAIL);
1532	if (!log) {
1533	xfs_warn(mp, "Log allocation failed: No memory!");
1534	goto out;
1535	}
1536
1537	log->l_mp = mp;
1538	log->l_targ = log_target;
1539	log->l_logsize = BBTOB(num_bblks);
1540	log->l_logBBstart = blk_offset;
1541	log->l_logBBsize = num_bblks;
1542	log->l_covered_state = XLOG_STATE_COVER_IDLE;
1543	set_bit(XLOG_ACTIVE_RECOVERY, addr: &log->l_opstate);
1544	INIT_DELAYED_WORK(&log->l_work, xfs_log_worker);
1545	INIT_LIST_HEAD(list: &log->r_dfops);
1546
1547	log->l_prev_block = -1;
1548	/* log->l_tail_lsn = 0x100000000LL; cycle = 1; current block = 0 */
1549	xlog_assign_atomic_lsn(lsn: &log->l_tail_lsn, cycle: 1, block: 0);
1550	xlog_assign_atomic_lsn(lsn: &log->l_last_sync_lsn, cycle: 1, block: 0);
1551	log->l_curr_cycle = 1; /* 0 is bad since this is initial value */
1552
1553	if (xfs_has_logv2(mp) && mp->m_sb.sb_logsunit > 1)
1554	log->l_iclog_roundoff = mp->m_sb.sb_logsunit;
1555	else
1556	log->l_iclog_roundoff = BBSIZE;
1557
1558	xlog_grant_head_init(head: &log->l_reserve_head);
1559	xlog_grant_head_init(head: &log->l_write_head);
1560
1561	error = -EFSCORRUPTED;
1562	if (xfs_has_sector(mp)) {
1563	log2_size = mp->m_sb.sb_logsectlog;
1564	if (log2_size < BBSHIFT) {
1565	xfs_warn(mp, "Log sector size too small (0x%x < 0x%x)",
1566	log2_size, BBSHIFT);
1567	goto out_free_log;
1568	}
1569
1570	log2_size -= BBSHIFT;
1571	if (log2_size > mp->m_sectbb_log) {
1572	xfs_warn(mp, "Log sector size too large (0x%x > 0x%x)",
1573	log2_size, mp->m_sectbb_log);
1574	goto out_free_log;
1575	}
1576
1577	/* for larger sector sizes, must have v2 or external log */
1578	if (log2_size && log->l_logBBstart > 0 &&
1579	!xfs_has_logv2(mp)) {
1580	xfs_warn(mp,
1581	"log sector size (0x%x) invalid for configuration.",
1582	log2_size);
1583	goto out_free_log;
1584	}
1585	}
1586	log->l_sectBBsize = 1 << log2_size;
1587
1588	init_rwsem(&log->l_incompat_users);
1589
1590	xlog_get_iclog_buffer_size(mp, log);
1591
1592	spin_lock_init(&log->l_icloglock);
1593	init_waitqueue_head(&log->l_flush_wait);
1594
1595	iclogp = &log->l_iclog;
1596	/*
1597	* The amount of memory to allocate for the iclog structure is
1598	* rather funky due to the way the structure is defined. It is
1599	* done this way so that we can use different sizes for machines
1600	* with different amounts of memory. See the definition of
1601	* xlog_in_core_t in xfs_log_priv.h for details.
1602	*/
1603	ASSERT(log->l_iclog_size >= 4096);
1604	for (i = 0; i < log->l_iclog_bufs; i++) {
1605	size_t bvec_size = howmany(log->l_iclog_size, PAGE_SIZE) *
1606	sizeof(struct bio_vec);
1607
1608	iclog = kzalloc(size: sizeof(*iclog) + bvec_size,
1609	GFP_KERNEL | __GFP_RETRY_MAYFAIL);
1610	if (!iclog)
1611	goto out_free_iclog;
1612
1613	*iclogp = iclog;
1614	iclog->ic_prev = prev_iclog;
1615	prev_iclog = iclog;
1616
1617	iclog->ic_data = kvzalloc(size: log->l_iclog_size,
1618	GFP_KERNEL | __GFP_RETRY_MAYFAIL);
1619	if (!iclog->ic_data)
1620	goto out_free_iclog;
1621	head = &iclog->ic_header;
1622	memset(head, 0, sizeof(xlog_rec_header_t));
1623	head->h_magicno = cpu_to_be32(XLOG_HEADER_MAGIC_NUM);
1624	head->h_version = cpu_to_be32(
1625	xfs_has_logv2(log->l_mp) ? 2 : 1);
1626	head->h_size = cpu_to_be32(log->l_iclog_size);
1627	/* new fields */
1628	head->h_fmt = cpu_to_be32(XLOG_FMT);
1629	memcpy(&head->h_fs_uuid, &mp->m_sb.sb_uuid, sizeof(uuid_t));
1630
1631	iclog->ic_size = log->l_iclog_size - log->l_iclog_hsize;
1632	iclog->ic_state = XLOG_STATE_ACTIVE;
1633	iclog->ic_log = log;
1634	atomic_set(v: &iclog->ic_refcnt, i: 0);
1635	INIT_LIST_HEAD(list: &iclog->ic_callbacks);
1636	iclog->ic_datap = (void *)iclog->ic_data + log->l_iclog_hsize;
1637
1638	init_waitqueue_head(&iclog->ic_force_wait);
1639	init_waitqueue_head(&iclog->ic_write_wait);
1640	INIT_WORK(&iclog->ic_end_io_work, xlog_ioend_work);
1641	sema_init(sem: &iclog->ic_sema, val: 1);
1642
1643	iclogp = &iclog->ic_next;
1644	}
1645	*iclogp = log->l_iclog; /* complete ring */
1646	log->l_iclog->ic_prev = prev_iclog; /* re-write 1st prev ptr */
1647
1648	log->l_ioend_workqueue = alloc_workqueue(fmt: "xfs-log/%s",
1649	XFS_WQFLAGS(WQ_FREEZABLE | WQ_MEM_RECLAIM |
1650	WQ_HIGHPRI),
1651	max_active: 0, mp->m_super->s_id);
1652	if (!log->l_ioend_workqueue)
1653	goto out_free_iclog;
1654
1655	error = xlog_cil_init(log);
1656	if (error)
1657	goto out_destroy_workqueue;
1658	return log;
1659
1660	out_destroy_workqueue:
1661	destroy_workqueue(wq: log->l_ioend_workqueue);
1662	out_free_iclog:
1663	for (iclog = log->l_iclog; iclog; iclog = prev_iclog) {
1664	prev_iclog = iclog->ic_next;
1665	kvfree(addr: iclog->ic_data);
1666	kfree(objp: iclog);
1667	if (prev_iclog == log->l_iclog)
1668	break;
1669	}
1670	out_free_log:
1671	kfree(objp: log);
1672	out:
1673	return ERR_PTR(error);
1674	} /* xlog_alloc_log */
1675
1676	/*
1677	* Compute the LSN that we'd need to push the log tail towards in order to have
1678	* (a) enough on-disk log space to log the number of bytes specified, (b) at
1679	* least 25% of the log space free, and (c) at least 256 blocks free. If the
1680	* log free space already meets all three thresholds, this function returns
1681	* NULLCOMMITLSN.
1682	*/
1683	xfs_lsn_t
1684	xlog_grant_push_threshold(
1685	struct xlog *log,
1686	int need_bytes)
1687	{
1688	xfs_lsn_t threshold_lsn = 0;
1689	xfs_lsn_t last_sync_lsn;
1690	int free_blocks;
1691	int free_bytes;
1692	int threshold_block;
1693	int threshold_cycle;
1694	int free_threshold;
1695
1696	ASSERT(BTOBB(need_bytes) < log->l_logBBsize);
1697
1698	free_bytes = xlog_space_left(log, head: &log->l_reserve_head.grant);
1699	free_blocks = BTOBBT(free_bytes);
1700
1701	/*
1702	* Set the threshold for the minimum number of free blocks in the
1703	* log to the maximum of what the caller needs, one quarter of the
1704	* log, and 256 blocks.
1705	*/
1706	free_threshold = BTOBB(need_bytes);
1707	free_threshold = max(free_threshold, (log->l_logBBsize >> 2));
1708	free_threshold = max(free_threshold, 256);
1709	if (free_blocks >= free_threshold)
1710	return NULLCOMMITLSN;
1711
1712	xlog_crack_atomic_lsn(lsn: &log->l_tail_lsn, cycle: &threshold_cycle,
1713	block: &threshold_block);
1714	threshold_block += free_threshold;
1715	if (threshold_block >= log->l_logBBsize) {
1716	threshold_block -= log->l_logBBsize;
1717	threshold_cycle += 1;
1718	}
1719	threshold_lsn = xlog_assign_lsn(threshold_cycle,
1720	threshold_block);
1721	/*
1722	* Don't pass in an lsn greater than the lsn of the last
1723	* log record known to be on disk. Use a snapshot of the last sync lsn
1724	* so that it doesn't change between the compare and the set.
1725	*/
1726	last_sync_lsn = atomic64_read(&log->l_last_sync_lsn);
1727	if (XFS_LSN_CMP(threshold_lsn, last_sync_lsn) > 0)
1728	threshold_lsn = last_sync_lsn;
1729
1730	return threshold_lsn;
1731	}
1732
1733	/*
1734	* Push the tail of the log if we need to do so to maintain the free log space
1735	* thresholds set out by xlog_grant_push_threshold. We may need to adopt a
1736	* policy which pushes on an lsn which is further along in the log once we
1737	* reach the high water mark. In this manner, we would be creating a low water
1738	* mark.
1739	*/
1740	STATIC void
1741	xlog_grant_push_ail(
1742	struct xlog *log,
1743	int need_bytes)
1744	{
1745	xfs_lsn_t threshold_lsn;
1746
1747	threshold_lsn = xlog_grant_push_threshold(log, need_bytes);
1748	if (threshold_lsn == NULLCOMMITLSN || xlog_is_shutdown(log))
1749	return;
1750
1751	/*
1752	* Get the transaction layer to kick the dirty buffers out to
1753	* disk asynchronously. No point in trying to do this if
1754	* the filesystem is shutting down.
1755	*/
1756	xfs_ail_push(log->l_ailp, threshold_lsn);
1757	}
1758
1759	/*
1760	* Stamp cycle number in every block
1761	*/
1762	STATIC void
1763	xlog_pack_data(
1764	struct xlog *log,
1765	struct xlog_in_core *iclog,
1766	int roundoff)
1767	{
1768	int i, j, k;
1769	int size = iclog->ic_offset + roundoff;
1770	__be32 cycle_lsn;
1771	char *dp;
1772
1773	cycle_lsn = CYCLE_LSN_DISK(iclog->ic_header.h_lsn);
1774
1775	dp = iclog->ic_datap;
1776	for (i = 0; i < BTOBB(size); i++) {
1777	if (i >= (XLOG_HEADER_CYCLE_SIZE / BBSIZE))
1778	break;
1779	iclog->ic_header.h_cycle_data[i] = *(__be32 *)dp;
1780	*(__be32 *)dp = cycle_lsn;
1781	dp += BBSIZE;
1782	}
1783
1784	if (xfs_has_logv2(mp: log->l_mp)) {
1785	xlog_in_core_2_t *xhdr = iclog->ic_data;
1786
1787	for ( ; i < BTOBB(size); i++) {
1788	j = i / (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
1789	k = i % (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
1790	xhdr[j].hic_xheader.xh_cycle_data[k] = *(__be32 *)dp;
1791	*(__be32 *)dp = cycle_lsn;
1792	dp += BBSIZE;
1793	}
1794
1795	for (i = 1; i < log->l_iclog_heads; i++)
1796	xhdr[i].hic_xheader.xh_cycle = cycle_lsn;
1797	}
1798	}
1799
1800	/*
1801	* Calculate the checksum for a log buffer.
1802	*
1803	* This is a little more complicated than it should be because the various
1804	* headers and the actual data are non-contiguous.
1805	*/
1806	__le32
1807	xlog_cksum(
1808	struct xlog *log,
1809	struct xlog_rec_header *rhead,
1810	char *dp,
1811	int size)
1812	{
1813	uint32_t crc;
1814
1815	/* first generate the crc for the record header ... */
1816	crc = xfs_start_cksum_update((char *)rhead,
1817	sizeof(struct xlog_rec_header),
1818	offsetof(struct xlog_rec_header, h_crc));
1819
1820	/* ... then for additional cycle data for v2 logs ... */
1821	if (xfs_has_logv2(mp: log->l_mp)) {
1822	union xlog_in_core2 *xhdr = (union xlog_in_core2 *)rhead;
1823	int i;
1824	int xheads;
1825
1826	xheads = DIV_ROUND_UP(size, XLOG_HEADER_CYCLE_SIZE);
1827
1828	for (i = 1; i < xheads; i++) {
1829	crc = crc32c(crc, &xhdr[i].hic_xheader,
1830	sizeof(struct xlog_rec_ext_header));
1831	}
1832	}
1833
1834	/* ... and finally for the payload */
1835	crc = crc32c(crc, address: dp, length: size);
1836
1837	return xfs_end_cksum(crc);
1838	}
1839
1840	static void
1841	xlog_bio_end_io(
1842	struct bio *bio)
1843	{
1844	struct xlog_in_core *iclog = bio->bi_private;
1845
1846	queue_work(wq: iclog->ic_log->l_ioend_workqueue,
1847	work: &iclog->ic_end_io_work);
1848	}
1849
1850	static int
1851	xlog_map_iclog_data(
1852	struct bio *bio,
1853	void *data,
1854	size_t count)
1855	{
1856	do {
1857	struct page *page = kmem_to_page(addr: data);
1858	unsigned int off = offset_in_page(data);
1859	size_t len = min_t(size_t, count, PAGE_SIZE - off);
1860
1861	if (bio_add_page(bio, page, len, off) != len)
1862	return -EIO;
1863
1864	data += len;
1865	count -= len;
1866	} while (count);
1867
1868	return 0;
1869	}
1870
1871	STATIC void
1872	xlog_write_iclog(
1873	struct xlog *log,
1874	struct xlog_in_core *iclog,
1875	uint64_t bno,
1876	unsigned int count)
1877	{
1878	ASSERT(bno < log->l_logBBsize);
1879	trace_xlog_iclog_write(iclog, _RET_IP_);
1880
1881	/*
1882	* We lock the iclogbufs here so that we can serialise against I/O
1883	* completion during unmount. We might be processing a shutdown
1884	* triggered during unmount, and that can occur asynchronously to the
1885	* unmount thread, and hence we need to ensure that completes before
1886	* tearing down the iclogbufs. Hence we need to hold the buffer lock
1887	* across the log IO to archieve that.
1888	*/
1889	down(sem: &iclog->ic_sema);
1890	if (xlog_is_shutdown(log)) {
1891	/*
1892	* It would seem logical to return EIO here, but we rely on
1893	* the log state machine to propagate I/O errors instead of
1894	* doing it here. We kick of the state machine and unlock
1895	* the buffer manually, the code needs to be kept in sync
1896	* with the I/O completion path.
1897	*/
1898	goto sync;
1899	}
1900
1901	/*
1902	* We use REQ_SYNC | REQ_IDLE here to tell the block layer the are more
1903	* IOs coming immediately after this one. This prevents the block layer
1904	* writeback throttle from throttling log writes behind background
1905	* metadata writeback and causing priority inversions.
1906	*/
1907	bio_init(bio: &iclog->ic_bio, bdev: log->l_targ->bt_bdev, table: iclog->ic_bvec,
1908	howmany(count, PAGE_SIZE),
1909	opf: REQ_OP_WRITE | REQ_META | REQ_SYNC | REQ_IDLE);
1910	iclog->ic_bio.bi_iter.bi_sector = log->l_logBBstart + bno;
1911	iclog->ic_bio.bi_end_io = xlog_bio_end_io;
1912	iclog->ic_bio.bi_private = iclog;
1913
1914	if (iclog->ic_flags & XLOG_ICL_NEED_FLUSH) {
1915	iclog->ic_bio.bi_opf |= REQ_PREFLUSH;
1916	/*
1917	* For external log devices, we also need to flush the data
1918	* device cache first to ensure all metadata writeback covered
1919	* by the LSN in this iclog is on stable storage. This is slow,
1920	* but it *must* complete before we issue the external log IO.
1921	*
1922	* If the flush fails, we cannot conclude that past metadata
1923	* writeback from the log succeeded. Repeating the flush is
1924	* not possible, hence we must shut down with log IO error to
1925	* avoid shutdown re-entering this path and erroring out again.
1926	*/
1927	if (log->l_targ != log->l_mp->m_ddev_targp &&
1928	blkdev_issue_flush(bdev: log->l_mp->m_ddev_targp->bt_bdev))
1929	goto shutdown;
1930	}
1931	if (iclog->ic_flags & XLOG_ICL_NEED_FUA)
1932	iclog->ic_bio.bi_opf |= REQ_FUA;
1933
1934	iclog->ic_flags &= ~(XLOG_ICL_NEED_FLUSH | XLOG_ICL_NEED_FUA);
1935
1936	if (xlog_map_iclog_data(bio: &iclog->ic_bio, data: iclog->ic_data, count))
1937	goto shutdown;
1938
1939	if (is_vmalloc_addr(x: iclog->ic_data))
1940	flush_kernel_vmap_range(vaddr: iclog->ic_data, size: count);
1941
1942	/*
1943	* If this log buffer would straddle the end of the log we will have
1944	* to split it up into two bios, so that we can continue at the start.
1945	*/
1946	if (bno + BTOBB(count) > log->l_logBBsize) {
1947	struct bio *split;
1948
1949	split = bio_split(bio: &iclog->ic_bio, sectors: log->l_logBBsize - bno,
1950	GFP_NOIO, bs: &fs_bio_set);
1951	bio_chain(split, &iclog->ic_bio);
1952	submit_bio(bio: split);
1953
1954	/* restart at logical offset zero for the remainder */
1955	iclog->ic_bio.bi_iter.bi_sector = log->l_logBBstart;
1956	}
1957
1958	submit_bio(bio: &iclog->ic_bio);
1959	return;
1960	shutdown:
1961	xlog_force_shutdown(log, SHUTDOWN_LOG_IO_ERROR);
1962	sync:
1963	xlog_state_done_syncing(iclog);
1964	up(sem: &iclog->ic_sema);
1965	}
1966
1967	/*
1968	* We need to bump cycle number for the part of the iclog that is
1969	* written to the start of the log. Watch out for the header magic
1970	* number case, though.
1971	*/
1972	static void
1973	xlog_split_iclog(
1974	struct xlog *log,
1975	void *data,
1976	uint64_t bno,
1977	unsigned int count)
1978	{
1979	unsigned int split_offset = BBTOB(log->l_logBBsize - bno);
1980	unsigned int i;
1981
1982	for (i = split_offset; i < count; i += BBSIZE) {
1983	uint32_t cycle = get_unaligned_be32(p: data + i);
1984
1985	if (++cycle == XLOG_HEADER_MAGIC_NUM)
1986	cycle++;
1987	put_unaligned_be32(val: cycle, p: data + i);
1988	}
1989	}
1990
1991	static int
1992	xlog_calc_iclog_size(
1993	struct xlog *log,
1994	struct xlog_in_core *iclog,
1995	uint32_t *roundoff)
1996	{
1997	uint32_t count_init, count;
1998
1999	/* Add for LR header */
2000	count_init = log->l_iclog_hsize + iclog->ic_offset;
2001	count = roundup(count_init, log->l_iclog_roundoff);
2002
2003	*roundoff = count - count_init;
2004
2005	ASSERT(count >= count_init);
2006	ASSERT(*roundoff < log->l_iclog_roundoff);
2007	return count;
2008	}
2009
2010	/*
2011	* Flush out the in-core log (iclog) to the on-disk log in an asynchronous
2012	* fashion. Previously, we should have moved the current iclog
2013	* ptr in the log to point to the next available iclog. This allows further
2014	* write to continue while this code syncs out an iclog ready to go.
2015	* Before an in-core log can be written out, the data section must be scanned
2016	* to save away the 1st word of each BBSIZE block into the header. We replace
2017	* it with the current cycle count. Each BBSIZE block is tagged with the
2018	* cycle count because there in an implicit assumption that drives will
2019	* guarantee that entire 512 byte blocks get written at once. In other words,
2020	* we can't have part of a 512 byte block written and part not written. By
2021	* tagging each block, we will know which blocks are valid when recovering
2022	* after an unclean shutdown.
2023	*
2024	* This routine is single threaded on the iclog. No other thread can be in
2025	* this routine with the same iclog. Changing contents of iclog can there-
2026	* fore be done without grabbing the state machine lock. Updating the global
2027	* log will require grabbing the lock though.
2028	*
2029	* The entire log manager uses a logical block numbering scheme. Only
2030	* xlog_write_iclog knows about the fact that the log may not start with
2031	* block zero on a given device.
2032	*/
2033	STATIC void
2034	xlog_sync(
2035	struct xlog *log,
2036	struct xlog_in_core *iclog,
2037	struct xlog_ticket *ticket)
2038	{
2039	unsigned int count; /* byte count of bwrite */
2040	unsigned int roundoff; /* roundoff to BB or stripe */
2041	uint64_t bno;
2042	unsigned int size;
2043
2044	ASSERT(atomic_read(&iclog->ic_refcnt) == 0);
2045	trace_xlog_iclog_sync(iclog, _RET_IP_);
2046
2047	count = xlog_calc_iclog_size(log, iclog, roundoff: &roundoff);
2048
2049	/*
2050	* If we have a ticket, account for the roundoff via the ticket
2051	* reservation to avoid touching the hot grant heads needlessly.
2052	* Otherwise, we have to move grant heads directly.
2053	*/
2054	if (ticket) {
2055	ticket->t_curr_res -= roundoff;
2056	} else {
2057	xlog_grant_add_space(log, head: &log->l_reserve_head.grant, bytes: roundoff);
2058	xlog_grant_add_space(log, head: &log->l_write_head.grant, bytes: roundoff);
2059	}
2060
2061	/* put cycle number in every block */
2062	xlog_pack_data(log, iclog, roundoff);
2063
2064	/* real byte length */
2065	size = iclog->ic_offset;
2066	if (xfs_has_logv2(mp: log->l_mp))
2067	size += roundoff;
2068	iclog->ic_header.h_len = cpu_to_be32(size);
2069
2070	XFS_STATS_INC(log->l_mp, xs_log_writes);
2071	XFS_STATS_ADD(log->l_mp, xs_log_blocks, BTOBB(count));
2072
2073	bno = BLOCK_LSN(be64_to_cpu(iclog->ic_header.h_lsn));
2074
2075	/* Do we need to split this write into 2 parts? */
2076	if (bno + BTOBB(count) > log->l_logBBsize)
2077	xlog_split_iclog(log, data: &iclog->ic_header, bno, count);
2078
2079	/* calculcate the checksum */
2080	iclog->ic_header.h_crc = xlog_cksum(log, rhead: &iclog->ic_header,
2081	dp: iclog->ic_datap, size);
2082	/*
2083	* Intentionally corrupt the log record CRC based on the error injection
2084	* frequency, if defined. This facilitates testing log recovery in the
2085	* event of torn writes. Hence, set the IOABORT state to abort the log
2086	* write on I/O completion and shutdown the fs. The subsequent mount
2087	* detects the bad CRC and attempts to recover.
2088	*/
2089	#ifdef DEBUG
2090	if (XFS_TEST_ERROR(false, log->l_mp, XFS_ERRTAG_LOG_BAD_CRC)) {
2091	iclog->ic_header.h_crc &= cpu_to_le32(0xAAAAAAAA);
2092	iclog->ic_fail_crc = true;
2093	xfs_warn(log->l_mp,
2094	"Intentionally corrupted log record at LSN 0x%llx. Shutdown imminent.",
2095	be64_to_cpu(iclog->ic_header.h_lsn));
2096	}
2097	#endif
2098	xlog_verify_iclog(log, iclog, count);
2099	xlog_write_iclog(log, iclog, bno, count);
2100	}
2101
2102	/*
2103	* Deallocate a log structure
2104	*/
2105	STATIC void
2106	xlog_dealloc_log(
2107	struct xlog *log)
2108	{
2109	xlog_in_core_t *iclog, *next_iclog;
2110	int i;
2111
2112	/*
2113	* Destroy the CIL after waiting for iclog IO completion because an
2114	* iclog EIO error will try to shut down the log, which accesses the
2115	* CIL to wake up the waiters.
2116	*/
2117	xlog_cil_destroy(log);
2118
2119	iclog = log->l_iclog;
2120	for (i = 0; i < log->l_iclog_bufs; i++) {
2121	next_iclog = iclog->ic_next;
2122	kvfree(addr: iclog->ic_data);
2123	kfree(objp: iclog);
2124	iclog = next_iclog;
2125	}
2126
2127	log->l_mp->m_log = NULL;
2128	destroy_workqueue(wq: log->l_ioend_workqueue);
2129	kfree(objp: log);
2130	}
2131
2132	/*
2133	* Update counters atomically now that memcpy is done.
2134	*/
2135	static inline void
2136	xlog_state_finish_copy(
2137	struct xlog *log,
2138	struct xlog_in_core *iclog,
2139	int record_cnt,
2140	int copy_bytes)
2141	{
2142	lockdep_assert_held(&log->l_icloglock);
2143
2144	be32_add_cpu(var: &iclog->ic_header.h_num_logops, val: record_cnt);
2145	iclog->ic_offset += copy_bytes;
2146	}
2147
2148	/*
2149	* print out info relating to regions written which consume
2150	* the reservation
2151	*/
2152	void
2153	xlog_print_tic_res(
2154	struct xfs_mount *mp,
2155	struct xlog_ticket *ticket)
2156	{
2157	xfs_warn(mp, "ticket reservation summary:");
2158	xfs_warn(mp, " unit res = %d bytes", ticket->t_unit_res);
2159	xfs_warn(mp, " current res = %d bytes", ticket->t_curr_res);
2160	xfs_warn(mp, " original count = %d", ticket->t_ocnt);
2161	xfs_warn(mp, " remaining count = %d", ticket->t_cnt);
2162	}
2163
2164	/*
2165	* Print a summary of the transaction.
2166	*/
2167	void
2168	xlog_print_trans(
2169	struct xfs_trans *tp)
2170	{
2171	struct xfs_mount *mp = tp->t_mountp;
2172	struct xfs_log_item *lip;
2173
2174	/* dump core transaction and ticket info */
2175	xfs_warn(mp, "transaction summary:");
2176	xfs_warn(mp, " log res = %d", tp->t_log_res);
2177	xfs_warn(mp, " log count = %d", tp->t_log_count);
2178	xfs_warn(mp, " flags = 0x%x", tp->t_flags);
2179
2180	xlog_print_tic_res(mp, ticket: tp->t_ticket);
2181
2182	/* dump each log item */
2183	list_for_each_entry(lip, &tp->t_items, li_trans) {
2184	struct xfs_log_vec *lv = lip->li_lv;
2185	struct xfs_log_iovec *vec;
2186	int i;
2187
2188	xfs_warn(mp, "log item: ");
2189	xfs_warn(mp, " type = 0x%x", lip->li_type);
2190	xfs_warn(mp, " flags = 0x%lx", lip->li_flags);
2191	if (!lv)
2192	continue;
2193	xfs_warn(mp, " niovecs = %d", lv->lv_niovecs);
2194	xfs_warn(mp, " size = %d", lv->lv_size);
2195	xfs_warn(mp, " bytes = %d", lv->lv_bytes);
2196	xfs_warn(mp, " buf len = %d", lv->lv_buf_len);
2197
2198	/* dump each iovec for the log item */
2199	vec = lv->lv_iovecp;
2200	for (i = 0; i < lv->lv_niovecs; i++) {
2201	int dumplen = min(vec->i_len, 32);
2202
2203	xfs_warn(mp, " iovec[%d]", i);
2204	xfs_warn(mp, " type = 0x%x", vec->i_type);
2205	xfs_warn(mp, " len = %d", vec->i_len);
2206	xfs_warn(mp, " first %d bytes of iovec[%d]:", dumplen, i);
2207	xfs_hex_dump(p: vec->i_addr, length: dumplen);
2208
2209	vec++;
2210	}
2211	}
2212	}
2213
2214	static inline void
2215	xlog_write_iovec(
2216	struct xlog_in_core *iclog,
2217	uint32_t *log_offset,
2218	void *data,
2219	uint32_t write_len,
2220	int *bytes_left,
2221	uint32_t *record_cnt,
2222	uint32_t *data_cnt)
2223	{
2224	ASSERT(*log_offset < iclog->ic_log->l_iclog_size);
2225	ASSERT(*log_offset % sizeof(int32_t) == 0);
2226	ASSERT(write_len % sizeof(int32_t) == 0);
2227
2228	memcpy(iclog->ic_datap + *log_offset, data, write_len);
2229	*log_offset += write_len;
2230	*bytes_left -= write_len;
2231	(*record_cnt)++;
2232	*data_cnt += write_len;
2233	}
2234
2235	/*
2236	* Write log vectors into a single iclog which is guaranteed by the caller
2237	* to have enough space to write the entire log vector into.
2238	*/
2239	static void
2240	xlog_write_full(
2241	struct xfs_log_vec *lv,
2242	struct xlog_ticket *ticket,
2243	struct xlog_in_core *iclog,
2244	uint32_t *log_offset,
2245	uint32_t *len,
2246	uint32_t *record_cnt,
2247	uint32_t *data_cnt)
2248	{
2249	int index;
2250
2251	ASSERT(*log_offset + *len <= iclog->ic_size ||
2252	iclog->ic_state == XLOG_STATE_WANT_SYNC);
2253
2254	/*
2255	* Ordered log vectors have no regions to write so this
2256	* loop will naturally skip them.
2257	*/
2258	for (index = 0; index < lv->lv_niovecs; index++) {
2259	struct xfs_log_iovec *reg = &lv->lv_iovecp[index];
2260	struct xlog_op_header *ophdr = reg->i_addr;
2261
2262	ophdr->oh_tid = cpu_to_be32(ticket->t_tid);
2263	xlog_write_iovec(iclog, log_offset, data: reg->i_addr,
2264	write_len: reg->i_len, bytes_left: len, record_cnt, data_cnt);
2265	}
2266	}
2267
2268	static int
2269	xlog_write_get_more_iclog_space(
2270	struct xlog_ticket *ticket,
2271	struct xlog_in_core **iclogp,
2272	uint32_t *log_offset,
2273	uint32_t len,
2274	uint32_t *record_cnt,
2275	uint32_t *data_cnt)
2276	{
2277	struct xlog_in_core *iclog = *iclogp;
2278	struct xlog *log = iclog->ic_log;
2279	int error;
2280
2281	spin_lock(lock: &log->l_icloglock);
2282	ASSERT(iclog->ic_state == XLOG_STATE_WANT_SYNC);
2283	xlog_state_finish_copy(log, iclog, record_cnt: *record_cnt, copy_bytes: *data_cnt);
2284	error = xlog_state_release_iclog(log, iclog, ticket);
2285	spin_unlock(lock: &log->l_icloglock);
2286	if (error)
2287	return error;
2288
2289	error = xlog_state_get_iclog_space(log, len, iclog: &iclog, ticket,
2290	logoffsetp: log_offset);
2291	if (error)
2292	return error;
2293	*record_cnt = 0;
2294	*data_cnt = 0;
2295	*iclogp = iclog;
2296	return 0;
2297	}
2298
2299	/*
2300	* Write log vectors into a single iclog which is smaller than the current chain
2301	* length. We write until we cannot fit a full record into the remaining space
2302	* and then stop. We return the log vector that is to be written that cannot
2303	* wholly fit in the iclog.
2304	*/
2305	static int
2306	xlog_write_partial(
2307	struct xfs_log_vec *lv,
2308	struct xlog_ticket *ticket,
2309	struct xlog_in_core **iclogp,
2310	uint32_t *log_offset,
2311	uint32_t *len,
2312	uint32_t *record_cnt,
2313	uint32_t *data_cnt)
2314	{
2315	struct xlog_in_core *iclog = *iclogp;
2316	struct xlog_op_header *ophdr;
2317	int index = 0;
2318	uint32_t rlen;
2319	int error;
2320
2321	/* walk the logvec, copying until we run out of space in the iclog */
2322	for (index = 0; index < lv->lv_niovecs; index++) {
2323	struct xfs_log_iovec *reg = &lv->lv_iovecp[index];
2324	uint32_t reg_offset = 0;
2325
2326	/*
2327	* The first region of a continuation must have a non-zero
2328	* length otherwise log recovery will just skip over it and
2329	* start recovering from the next opheader it finds. Because we
2330	* mark the next opheader as a continuation, recovery will then
2331	* incorrectly add the continuation to the previous region and
2332	* that breaks stuff.
2333	*
2334	* Hence if there isn't space for region data after the
2335	* opheader, then we need to start afresh with a new iclog.
2336	*/
2337	if (iclog->ic_size - *log_offset <=
2338	sizeof(struct xlog_op_header)) {
2339	error = xlog_write_get_more_iclog_space(ticket,
2340	iclogp: &iclog, log_offset, len: *len, record_cnt,
2341	data_cnt);
2342	if (error)
2343	return error;
2344	}
2345
2346	ophdr = reg->i_addr;
2347	rlen = min_t(uint32_t, reg->i_len, iclog->ic_size - *log_offset);
2348
2349	ophdr->oh_tid = cpu_to_be32(ticket->t_tid);
2350	ophdr->oh_len = cpu_to_be32(rlen - sizeof(struct xlog_op_header));
2351	if (rlen != reg->i_len)
2352	ophdr->oh_flags |= XLOG_CONTINUE_TRANS;
2353
2354	xlog_write_iovec(iclog, log_offset, data: reg->i_addr,
2355	write_len: rlen, bytes_left: len, record_cnt, data_cnt);
2356
2357	/* If we wrote the whole region, move to the next. */
2358	if (rlen == reg->i_len)
2359	continue;
2360
2361	/*
2362	* We now have a partially written iovec, but it can span
2363	* multiple iclogs so we loop here. First we release the iclog
2364	* we currently have, then we get a new iclog and add a new
2365	* opheader. Then we continue copying from where we were until
2366	* we either complete the iovec or fill the iclog. If we
2367	* complete the iovec, then we increment the index and go right
2368	* back to the top of the outer loop. if we fill the iclog, we
2369	* run the inner loop again.
2370	*
2371	* This is complicated by the tail of a region using all the
2372	* space in an iclog and hence requiring us to release the iclog
2373	* and get a new one before returning to the outer loop. We must
2374	* always guarantee that we exit this inner loop with at least
2375	* space for log transaction opheaders left in the current
2376	* iclog, hence we cannot just terminate the loop at the end
2377	* of the of the continuation. So we loop while there is no
2378	* space left in the current iclog, and check for the end of the
2379	* continuation after getting a new iclog.
2380	*/
2381	do {
2382	/*
2383	* Ensure we include the continuation opheader in the
2384	* space we need in the new iclog by adding that size
2385	* to the length we require. This continuation opheader
2386	* needs to be accounted to the ticket as the space it
2387	* consumes hasn't been accounted to the lv we are
2388	* writing.
2389	*/
2390	error = xlog_write_get_more_iclog_space(ticket,
2391	&iclog, log_offset,
2392	*len + sizeof(struct xlog_op_header),
2393	record_cnt, data_cnt);
2394	if (error)
2395	return error;
2396
2397	ophdr = iclog->ic_datap + *log_offset;
2398	ophdr->oh_tid = cpu_to_be32(ticket->t_tid);
2399	ophdr->oh_clientid = XFS_TRANSACTION;
2400	ophdr->oh_res2 = 0;
2401	ophdr->oh_flags = XLOG_WAS_CONT_TRANS;
2402
2403	ticket->t_curr_res -= sizeof(struct xlog_op_header);
2404	*log_offset += sizeof(struct xlog_op_header);
2405	*data_cnt += sizeof(struct xlog_op_header);
2406
2407	/*
2408	* If rlen fits in the iclog, then end the region
2409	* continuation. Otherwise we're going around again.
2410	*/
2411	reg_offset += rlen;
2412	rlen = reg->i_len - reg_offset;
2413	if (rlen <= iclog->ic_size - *log_offset)
2414	ophdr->oh_flags |= XLOG_END_TRANS;
2415	else
2416	ophdr->oh_flags |= XLOG_CONTINUE_TRANS;
2417
2418	rlen = min_t(uint32_t, rlen, iclog->ic_size - *log_offset);
2419	ophdr->oh_len = cpu_to_be32(rlen);
2420
2421	xlog_write_iovec(iclog, log_offset,
2422	data: reg->i_addr + reg_offset,
2423	write_len: rlen, bytes_left: len, record_cnt, data_cnt);
2424
2425	} while (ophdr->oh_flags & XLOG_CONTINUE_TRANS);
2426	}
2427
2428	/*
2429	* No more iovecs remain in this logvec so return the next log vec to
2430	* the caller so it can go back to fast path copying.
2431	*/
2432	*iclogp = iclog;
2433	return 0;
2434	}
2435
2436	/*
2437	* Write some region out to in-core log
2438	*
2439	* This will be called when writing externally provided regions or when
2440	* writing out a commit record for a given transaction.
2441	*
2442	* General algorithm:
2443	* 1. Find total length of this write. This may include adding to the
2444	* lengths passed in.
2445	* 2. Check whether we violate the tickets reservation.
2446	* 3. While writing to this iclog
2447	* A. Reserve as much space in this iclog as can get
2448	* B. If this is first write, save away start lsn
2449	* C. While writing this region:
2450	* 1. If first write of transaction, write start record
2451	* 2. Write log operation header (header per region)
2452	* 3. Find out if we can fit entire region into this iclog
2453	* 4. Potentially, verify destination memcpy ptr
2454	* 5. Memcpy (partial) region
2455	* 6. If partial copy, release iclog; otherwise, continue
2456	* copying more regions into current iclog
2457	* 4. Mark want sync bit (in simulation mode)
2458	* 5. Release iclog for potential flush to on-disk log.
2459	*
2460	* ERRORS:
2461	* 1. Panic if reservation is overrun. This should never happen since
2462	* reservation amounts are generated internal to the filesystem.
2463	* NOTES:
2464	* 1. Tickets are single threaded data structures.
2465	* 2. The XLOG_END_TRANS & XLOG_CONTINUE_TRANS flags are passed down to the
2466	* syncing routine. When a single log_write region needs to span
2467	* multiple in-core logs, the XLOG_CONTINUE_TRANS bit should be set
2468	* on all log operation writes which don't contain the end of the
2469	* region. The XLOG_END_TRANS bit is used for the in-core log
2470	* operation which contains the end of the continued log_write region.
2471	* 3. When xlog_state_get_iclog_space() grabs the rest of the current iclog,
2472	* we don't really know exactly how much space will be used. As a result,
2473	* we don't update ic_offset until the end when we know exactly how many
2474	* bytes have been written out.
2475	*/
2476	int
2477	xlog_write(
2478	struct xlog *log,
2479	struct xfs_cil_ctx *ctx,
2480	struct list_head *lv_chain,
2481	struct xlog_ticket *ticket,
2482	uint32_t len)
2483
2484	{
2485	struct xlog_in_core *iclog = NULL;
2486	struct xfs_log_vec *lv;
2487	uint32_t record_cnt = 0;
2488	uint32_t data_cnt = 0;
2489	int error = 0;
2490	int log_offset;
2491
2492	if (ticket->t_curr_res < 0) {
2493	xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
2494	"ctx ticket reservation ran out. Need to up reservation");
2495	xlog_print_tic_res(mp: log->l_mp, ticket);
2496	xlog_force_shutdown(log, SHUTDOWN_LOG_IO_ERROR);
2497	}
2498
2499	error = xlog_state_get_iclog_space(log, len, iclog: &iclog, ticket,
2500	logoffsetp: &log_offset);
2501	if (error)
2502	return error;
2503
2504	ASSERT(log_offset <= iclog->ic_size - 1);
2505
2506	/*
2507	* If we have a context pointer, pass it the first iclog we are
2508	* writing to so it can record state needed for iclog write
2509	* ordering.
2510	*/
2511	if (ctx)
2512	xlog_cil_set_ctx_write_state(ctx, iclog);
2513
2514	list_for_each_entry(lv, lv_chain, lv_list) {
2515	/*
2516	* If the entire log vec does not fit in the iclog, punt it to
2517	* the partial copy loop which can handle this case.
2518	*/
2519	if (lv->lv_niovecs &&
2520	lv->lv_bytes > iclog->ic_size - log_offset) {
2521	error = xlog_write_partial(lv, ticket, iclogp: &iclog,
2522	log_offset: &log_offset, len: &len, record_cnt: &record_cnt,
2523	data_cnt: &data_cnt);
2524	if (error) {
2525	/*
2526	* We have no iclog to release, so just return
2527	* the error immediately.
2528	*/
2529	return error;
2530	}
2531	} else {
2532	xlog_write_full(lv, ticket, iclog, log_offset: &log_offset,
2533	len: &len, record_cnt: &record_cnt, data_cnt: &data_cnt);
2534	}
2535	}
2536	ASSERT(len == 0);
2537
2538	/*
2539	* We've already been guaranteed that the last writes will fit inside
2540	* the current iclog, and hence it will already have the space used by
2541	* those writes accounted to it. Hence we do not need to update the
2542	* iclog with the number of bytes written here.
2543	*/
2544	spin_lock(lock: &log->l_icloglock);
2545	xlog_state_finish_copy(log, iclog, record_cnt, copy_bytes: 0);
2546	error = xlog_state_release_iclog(log, iclog, ticket);
2547	spin_unlock(lock: &log->l_icloglock);
2548
2549	return error;
2550	}
2551
2552	static void
2553	xlog_state_activate_iclog(
2554	struct xlog_in_core *iclog,
2555	int *iclogs_changed)
2556	{
2557	ASSERT(list_empty_careful(&iclog->ic_callbacks));
2558	trace_xlog_iclog_activate(iclog, _RET_IP_);
2559
2560	/*
2561	* If the number of ops in this iclog indicate it just contains the
2562	* dummy transaction, we can change state into IDLE (the second time
2563	* around). Otherwise we should change the state into NEED a dummy.
2564	* We don't need to cover the dummy.
2565	*/
2566	if (*iclogs_changed == 0 &&
2567	iclog->ic_header.h_num_logops == cpu_to_be32(XLOG_COVER_OPS)) {
2568	*iclogs_changed = 1;
2569	} else {
2570	/*
2571	* We have two dirty iclogs so start over. This could also be
2572	* num of ops indicating this is not the dummy going out.
2573	*/
2574	*iclogs_changed = 2;
2575	}
2576
2577	iclog->ic_state = XLOG_STATE_ACTIVE;
2578	iclog->ic_offset = 0;
2579	iclog->ic_header.h_num_logops = 0;
2580	memset(iclog->ic_header.h_cycle_data, 0,
2581	sizeof(iclog->ic_header.h_cycle_data));
2582	iclog->ic_header.h_lsn = 0;
2583	iclog->ic_header.h_tail_lsn = 0;
2584	}
2585
2586	/*
2587	* Loop through all iclogs and mark all iclogs currently marked DIRTY as
2588	* ACTIVE after iclog I/O has completed.
2589	*/
2590	static void
2591	xlog_state_activate_iclogs(
2592	struct xlog *log,
2593	int *iclogs_changed)
2594	{
2595	struct xlog_in_core *iclog = log->l_iclog;
2596
2597	do {
2598	if (iclog->ic_state == XLOG_STATE_DIRTY)
2599	xlog_state_activate_iclog(iclog, iclogs_changed);
2600	/*
2601	* The ordering of marking iclogs ACTIVE must be maintained, so
2602	* an iclog doesn't become ACTIVE beyond one that is SYNCING.
2603	*/
2604	else if (iclog->ic_state != XLOG_STATE_ACTIVE)
2605	break;
2606	} while ((iclog = iclog->ic_next) != log->l_iclog);
2607	}
2608
2609	static int
2610	xlog_covered_state(
2611	int prev_state,
2612	int iclogs_changed)
2613	{
2614	/*
2615	* We go to NEED for any non-covering writes. We go to NEED2 if we just
2616	* wrote the first covering record (DONE). We go to IDLE if we just
2617	* wrote the second covering record (DONE2) and remain in IDLE until a
2618	* non-covering write occurs.
2619	*/
2620	switch (prev_state) {
2621	case XLOG_STATE_COVER_IDLE:
2622	if (iclogs_changed == 1)
2623	return XLOG_STATE_COVER_IDLE;
2624	fallthrough;
2625	case XLOG_STATE_COVER_NEED:
2626	case XLOG_STATE_COVER_NEED2:
2627	break;
2628	case XLOG_STATE_COVER_DONE:
2629	if (iclogs_changed == 1)
2630	return XLOG_STATE_COVER_NEED2;
2631	break;
2632	case XLOG_STATE_COVER_DONE2:
2633	if (iclogs_changed == 1)
2634	return XLOG_STATE_COVER_IDLE;
2635	break;
2636	default:
2637	ASSERT(0);
2638	}
2639
2640	return XLOG_STATE_COVER_NEED;
2641	}
2642
2643	STATIC void
2644	xlog_state_clean_iclog(
2645	struct xlog *log,
2646	struct xlog_in_core *dirty_iclog)
2647	{
2648	int iclogs_changed = 0;
2649
2650	trace_xlog_iclog_clean(iclog: dirty_iclog, _RET_IP_);
2651
2652	dirty_iclog->ic_state = XLOG_STATE_DIRTY;
2653
2654	xlog_state_activate_iclogs(log, iclogs_changed: &iclogs_changed);
2655	wake_up_all(&dirty_iclog->ic_force_wait);
2656
2657	if (iclogs_changed) {
2658	log->l_covered_state = xlog_covered_state(prev_state: log->l_covered_state,
2659	iclogs_changed);
2660	}
2661	}
2662
2663	STATIC xfs_lsn_t
2664	xlog_get_lowest_lsn(
2665	struct xlog *log)
2666	{
2667	struct xlog_in_core *iclog = log->l_iclog;
2668	xfs_lsn_t lowest_lsn = 0, lsn;
2669
2670	do {
2671	if (iclog->ic_state == XLOG_STATE_ACTIVE ||
2672	iclog->ic_state == XLOG_STATE_DIRTY)
2673	continue;
2674
2675	lsn = be64_to_cpu(iclog->ic_header.h_lsn);
2676	if ((lsn && !lowest_lsn) || XFS_LSN_CMP(lsn, lowest_lsn) < 0)
2677	lowest_lsn = lsn;
2678	} while ((iclog = iclog->ic_next) != log->l_iclog);
2679
2680	return lowest_lsn;
2681	}
2682
2683	/*
2684	* Completion of a iclog IO does not imply that a transaction has completed, as
2685	* transactions can be large enough to span many iclogs. We cannot change the
2686	* tail of the log half way through a transaction as this may be the only
2687	* transaction in the log and moving the tail to point to the middle of it
2688	* will prevent recovery from finding the start of the transaction. Hence we
2689	* should only update the last_sync_lsn if this iclog contains transaction
2690	* completion callbacks on it.
2691	*
2692	* We have to do this before we drop the icloglock to ensure we are the only one
2693	* that can update it.
2694	*
2695	* If we are moving the last_sync_lsn forwards, we also need to ensure we kick
2696	* the reservation grant head pushing. This is due to the fact that the push
2697	* target is bound by the current last_sync_lsn value. Hence if we have a large
2698	* amount of log space bound up in this committing transaction then the
2699	* last_sync_lsn value may be the limiting factor preventing tail pushing from
2700	* freeing space in the log. Hence once we've updated the last_sync_lsn we
2701	* should push the AIL to ensure the push target (and hence the grant head) is
2702	* no longer bound by the old log head location and can move forwards and make
2703	* progress again.
2704	*/
2705	static void
2706	xlog_state_set_callback(
2707	struct xlog *log,
2708	struct xlog_in_core *iclog,
2709	xfs_lsn_t header_lsn)
2710	{
2711	trace_xlog_iclog_callback(iclog, _RET_IP_);
2712	iclog->ic_state = XLOG_STATE_CALLBACK;
2713
2714	ASSERT(XFS_LSN_CMP(atomic64_read(&log->l_last_sync_lsn),
2715	header_lsn) <= 0);
2716
2717	if (list_empty_careful(head: &iclog->ic_callbacks))
2718	return;
2719
2720	atomic64_set(v: &log->l_last_sync_lsn, i: header_lsn);
2721	xlog_grant_push_ail(log, need_bytes: 0);
2722	}
2723
2724	/*
2725	* Return true if we need to stop processing, false to continue to the next
2726	* iclog. The caller will need to run callbacks if the iclog is returned in the
2727	* XLOG_STATE_CALLBACK state.
2728	*/
2729	static bool
2730	xlog_state_iodone_process_iclog(
2731	struct xlog *log,
2732	struct xlog_in_core *iclog)
2733	{
2734	xfs_lsn_t lowest_lsn;
2735	xfs_lsn_t header_lsn;
2736
2737	switch (iclog->ic_state) {
2738	case XLOG_STATE_ACTIVE:
2739	case XLOG_STATE_DIRTY:
2740	/*
2741	* Skip all iclogs in the ACTIVE & DIRTY states:
2742	*/
2743	return false;
2744	case XLOG_STATE_DONE_SYNC:
2745	/*
2746	* Now that we have an iclog that is in the DONE_SYNC state, do
2747	* one more check here to see if we have chased our tail around.
2748	* If this is not the lowest lsn iclog, then we will leave it
2749	* for another completion to process.
2750	*/
2751	header_lsn = be64_to_cpu(iclog->ic_header.h_lsn);
2752	lowest_lsn = xlog_get_lowest_lsn(log);
2753	if (lowest_lsn && XFS_LSN_CMP(lowest_lsn, header_lsn) < 0)
2754	return false;
2755	xlog_state_set_callback(log, iclog, header_lsn);
2756	return false;
2757	default:
2758	/*
2759	* Can only perform callbacks in order. Since this iclog is not
2760	* in the DONE_SYNC state, we skip the rest and just try to
2761	* clean up.
2762	*/
2763	return true;
2764	}
2765	}
2766
2767	/*
2768	* Loop over all the iclogs, running attached callbacks on them. Return true if
2769	* we ran any callbacks, indicating that we dropped the icloglock. We don't need
2770	* to handle transient shutdown state here at all because
2771	* xlog_state_shutdown_callbacks() will be run to do the necessary shutdown
2772	* cleanup of the callbacks.
2773	*/
2774	static bool
2775	xlog_state_do_iclog_callbacks(
2776	struct xlog *log)
2777	__releases(&log->l_icloglock)
2778	__acquires(&log->l_icloglock)
2779	{
2780	struct xlog_in_core *first_iclog = log->l_iclog;
2781	struct xlog_in_core *iclog = first_iclog;
2782	bool ran_callback = false;
2783
2784	do {
2785	LIST_HEAD(cb_list);
2786
2787	if (xlog_state_iodone_process_iclog(log, iclog))
2788	break;
2789	if (iclog->ic_state != XLOG_STATE_CALLBACK) {
2790	iclog = iclog->ic_next;
2791	continue;
2792	}
2793	list_splice_init(list: &iclog->ic_callbacks, head: &cb_list);
2794	spin_unlock(lock: &log->l_icloglock);
2795
2796	trace_xlog_iclog_callbacks_start(iclog, _RET_IP_);
2797	xlog_cil_process_committed(list: &cb_list);
2798	trace_xlog_iclog_callbacks_done(iclog, _RET_IP_);
2799	ran_callback = true;
2800
2801	spin_lock(lock: &log->l_icloglock);
2802	xlog_state_clean_iclog(log, dirty_iclog: iclog);
2803	iclog = iclog->ic_next;
2804	} while (iclog != first_iclog);
2805
2806	return ran_callback;
2807	}
2808
2809
2810	/*
2811	* Loop running iclog completion callbacks until there are no more iclogs in a
2812	* state that can run callbacks.
2813	*/
2814	STATIC void
2815	xlog_state_do_callback(
2816	struct xlog *log)
2817	{
2818	int flushcnt = 0;
2819	int repeats = 0;
2820
2821	spin_lock(lock: &log->l_icloglock);
2822	while (xlog_state_do_iclog_callbacks(log)) {
2823	if (xlog_is_shutdown(log))
2824	break;
2825
2826	if (++repeats > 5000) {
2827	flushcnt += repeats;
2828	repeats = 0;
2829	xfs_warn(log->l_mp,
2830	"%s: possible infinite loop (%d iterations)",
2831	__func__, flushcnt);
2832	}
2833	}
2834
2835	if (log->l_iclog->ic_state == XLOG_STATE_ACTIVE)
2836	wake_up_all(&log->l_flush_wait);
2837
2838	spin_unlock(lock: &log->l_icloglock);
2839	}
2840
2841
2842	/*
2843	* Finish transitioning this iclog to the dirty state.
2844	*
2845	* Callbacks could take time, so they are done outside the scope of the
2846	* global state machine log lock.
2847	*/
2848	STATIC void
2849	xlog_state_done_syncing(
2850	struct xlog_in_core *iclog)
2851	{
2852	struct xlog *log = iclog->ic_log;
2853
2854	spin_lock(lock: &log->l_icloglock);
2855	ASSERT(atomic_read(&iclog->ic_refcnt) == 0);
2856	trace_xlog_iclog_sync_done(iclog, _RET_IP_);
2857
2858	/*
2859	* If we got an error, either on the first buffer, or in the case of
2860	* split log writes, on the second, we shut down the file system and
2861	* no iclogs should ever be attempted to be written to disk again.
2862	*/
2863	if (!xlog_is_shutdown(log)) {
2864	ASSERT(iclog->ic_state == XLOG_STATE_SYNCING);
2865	iclog->ic_state = XLOG_STATE_DONE_SYNC;
2866	}
2867
2868	/*
2869	* Someone could be sleeping prior to writing out the next
2870	* iclog buffer, we wake them all, one will get to do the
2871	* I/O, the others get to wait for the result.
2872	*/
2873	wake_up_all(&iclog->ic_write_wait);
2874	spin_unlock(lock: &log->l_icloglock);
2875	xlog_state_do_callback(log);
2876	}
2877
2878	/*
2879	* If the head of the in-core log ring is not (ACTIVE or DIRTY), then we must
2880	* sleep. We wait on the flush queue on the head iclog as that should be
2881	* the first iclog to complete flushing. Hence if all iclogs are syncing,
2882	* we will wait here and all new writes will sleep until a sync completes.
2883	*
2884	* The in-core logs are used in a circular fashion. They are not used
2885	* out-of-order even when an iclog past the head is free.
2886	*
2887	* return:
2888	* * log_offset where xlog_write() can start writing into the in-core
2889	* log's data space.
2890	* * in-core log pointer to which xlog_write() should write.
2891	* * boolean indicating this is a continued write to an in-core log.
2892	* If this is the last write, then the in-core log's offset field
2893	* needs to be incremented, depending on the amount of data which
2894	* is copied.
2895	*/
2896	STATIC int
2897	xlog_state_get_iclog_space(
2898	struct xlog *log,
2899	int len,
2900	struct xlog_in_core **iclogp,
2901	struct xlog_ticket *ticket,
2902	int *logoffsetp)
2903	{
2904	int log_offset;
2905	xlog_rec_header_t *head;
2906	xlog_in_core_t *iclog;
2907
2908	restart:
2909	spin_lock(lock: &log->l_icloglock);
2910	if (xlog_is_shutdown(log)) {
2911	spin_unlock(lock: &log->l_icloglock);
2912	return -EIO;
2913	}
2914
2915	iclog = log->l_iclog;
2916	if (iclog->ic_state != XLOG_STATE_ACTIVE) {
2917	XFS_STATS_INC(log->l_mp, xs_log_noiclogs);
2918
2919	/* Wait for log writes to have flushed */
2920	xlog_wait(wq: &log->l_flush_wait, lock: &log->l_icloglock);
2921	goto restart;
2922	}
2923
2924	head = &iclog->ic_header;
2925
2926	atomic_inc(v: &iclog->ic_refcnt); /* prevents sync */
2927	log_offset = iclog->ic_offset;
2928
2929	trace_xlog_iclog_get_space(iclog, _RET_IP_);
2930
2931	/* On the 1st write to an iclog, figure out lsn. This works
2932	* if iclogs marked XLOG_STATE_WANT_SYNC always write out what they are
2933	* committing to. If the offset is set, that's how many blocks
2934	* must be written.
2935	*/
2936	if (log_offset == 0) {
2937	ticket->t_curr_res -= log->l_iclog_hsize;
2938	head->h_cycle = cpu_to_be32(log->l_curr_cycle);
2939	head->h_lsn = cpu_to_be64(
2940	xlog_assign_lsn(log->l_curr_cycle, log->l_curr_block));
2941	ASSERT(log->l_curr_block >= 0);
2942	}
2943
2944	/* If there is enough room to write everything, then do it. Otherwise,
2945	* claim the rest of the region and make sure the XLOG_STATE_WANT_SYNC
2946	* bit is on, so this will get flushed out. Don't update ic_offset
2947	* until you know exactly how many bytes get copied. Therefore, wait
2948	* until later to update ic_offset.
2949	*
2950	* xlog_write() algorithm assumes that at least 2 xlog_op_header_t's
2951	* can fit into remaining data section.
2952	*/
2953	if (iclog->ic_size - iclog->ic_offset < 2*sizeof(xlog_op_header_t)) {
2954	int error = 0;
2955
2956	xlog_state_switch_iclogs(log, iclog, eventual_size: iclog->ic_size);
2957
2958	/*
2959	* If we are the only one writing to this iclog, sync it to
2960	* disk. We need to do an atomic compare and decrement here to
2961	* avoid racing with concurrent atomic_dec_and_lock() calls in
2962	* xlog_state_release_iclog() when there is more than one
2963	* reference to the iclog.
2964	*/
2965	if (!atomic_add_unless(v: &iclog->ic_refcnt, a: -1, u: 1))
2966	error = xlog_state_release_iclog(log, iclog, ticket);
2967	spin_unlock(lock: &log->l_icloglock);
2968	if (error)
2969	return error;
2970	goto restart;
2971	}
2972
2973	/* Do we have enough room to write the full amount in the remainder
2974	* of this iclog? Or must we continue a write on the next iclog and
2975	* mark this iclog as completely taken? In the case where we switch
2976	* iclogs (to mark it taken), this particular iclog will release/sync
2977	* to disk in xlog_write().
2978	*/
2979	if (len <= iclog->ic_size - iclog->ic_offset)
2980	iclog->ic_offset += len;
2981	else
2982	xlog_state_switch_iclogs(log, iclog, eventual_size: iclog->ic_size);
2983	*iclogp = iclog;
2984
2985	ASSERT(iclog->ic_offset <= iclog->ic_size);
2986	spin_unlock(lock: &log->l_icloglock);
2987
2988	*logoffsetp = log_offset;
2989	return 0;
2990	}
2991
2992	/*
2993	* The first cnt-1 times a ticket goes through here we don't need to move the
2994	* grant write head because the permanent reservation has reserved cnt times the
2995	* unit amount. Release part of current permanent unit reservation and reset
2996	* current reservation to be one units worth. Also move grant reservation head
2997	* forward.
2998	*/
2999	void
3000	xfs_log_ticket_regrant(
3001	struct xlog *log,
3002	struct xlog_ticket *ticket)
3003	{
3004	trace_xfs_log_ticket_regrant(log, tic: ticket);
3005
3006	if (ticket->t_cnt > 0)
3007	ticket->t_cnt--;
3008
3009	xlog_grant_sub_space(log, head: &log->l_reserve_head.grant,
3010	bytes: ticket->t_curr_res);
3011	xlog_grant_sub_space(log, head: &log->l_write_head.grant,
3012	bytes: ticket->t_curr_res);
3013	ticket->t_curr_res = ticket->t_unit_res;
3014
3015	trace_xfs_log_ticket_regrant_sub(log, tic: ticket);
3016
3017	/* just return if we still have some of the pre-reserved space */
3018	if (!ticket->t_cnt) {
3019	xlog_grant_add_space(log, head: &log->l_reserve_head.grant,
3020	bytes: ticket->t_unit_res);
3021	trace_xfs_log_ticket_regrant_exit(log, tic: ticket);
3022
3023	ticket->t_curr_res = ticket->t_unit_res;
3024	}
3025
3026	xfs_log_ticket_put(ticket);
3027	}
3028
3029	/*
3030	* Give back the space left from a reservation.
3031	*
3032	* All the information we need to make a correct determination of space left
3033	* is present. For non-permanent reservations, things are quite easy. The
3034	* count should have been decremented to zero. We only need to deal with the
3035	* space remaining in the current reservation part of the ticket. If the
3036	* ticket contains a permanent reservation, there may be left over space which
3037	* needs to be released. A count of N means that N-1 refills of the current
3038	* reservation can be done before we need to ask for more space. The first
3039	* one goes to fill up the first current reservation. Once we run out of
3040	* space, the count will stay at zero and the only space remaining will be
3041	* in the current reservation field.
3042	*/
3043	void
3044	xfs_log_ticket_ungrant(
3045	struct xlog *log,
3046	struct xlog_ticket *ticket)
3047	{
3048	int bytes;
3049
3050	trace_xfs_log_ticket_ungrant(log, tic: ticket);
3051
3052	if (ticket->t_cnt > 0)
3053	ticket->t_cnt--;
3054
3055	trace_xfs_log_ticket_ungrant_sub(log, tic: ticket);
3056
3057	/*
3058	* If this is a permanent reservation ticket, we may be able to free
3059	* up more space based on the remaining count.
3060	*/
3061	bytes = ticket->t_curr_res;
3062	if (ticket->t_cnt > 0) {
3063	ASSERT(ticket->t_flags & XLOG_TIC_PERM_RESERV);
3064	bytes += ticket->t_unit_res*ticket->t_cnt;
3065	}
3066
3067	xlog_grant_sub_space(log, head: &log->l_reserve_head.grant, bytes);
3068	xlog_grant_sub_space(log, head: &log->l_write_head.grant, bytes);
3069
3070	trace_xfs_log_ticket_ungrant_exit(log, tic: ticket);
3071
3072	xfs_log_space_wake(mp: log->l_mp);
3073	xfs_log_ticket_put(ticket);
3074	}
3075
3076	/*
3077	* This routine will mark the current iclog in the ring as WANT_SYNC and move
3078	* the current iclog pointer to the next iclog in the ring.
3079	*/
3080	void
3081	xlog_state_switch_iclogs(
3082	struct xlog *log,
3083	struct xlog_in_core *iclog,
3084	int eventual_size)
3085	{
3086	ASSERT(iclog->ic_state == XLOG_STATE_ACTIVE);
3087	assert_spin_locked(&log->l_icloglock);
3088	trace_xlog_iclog_switch(iclog, _RET_IP_);
3089
3090	if (!eventual_size)
3091	eventual_size = iclog->ic_offset;
3092	iclog->ic_state = XLOG_STATE_WANT_SYNC;
3093	iclog->ic_header.h_prev_block = cpu_to_be32(log->l_prev_block);
3094	log->l_prev_block = log->l_curr_block;
3095	log->l_prev_cycle = log->l_curr_cycle;
3096
3097	/* roll log?: ic_offset changed later */
3098	log->l_curr_block += BTOBB(eventual_size)+BTOBB(log->l_iclog_hsize);
3099
3100	/* Round up to next log-sunit */
3101	if (log->l_iclog_roundoff > BBSIZE) {
3102	uint32_t sunit_bb = BTOBB(log->l_iclog_roundoff);
3103	log->l_curr_block = roundup(log->l_curr_block, sunit_bb);
3104	}
3105
3106	if (log->l_curr_block >= log->l_logBBsize) {
3107	/*
3108	* Rewind the current block before the cycle is bumped to make
3109	* sure that the combined LSN never transiently moves forward
3110	* when the log wraps to the next cycle. This is to support the
3111	* unlocked sample of these fields from xlog_valid_lsn(). Most
3112	* other cases should acquire l_icloglock.
3113	*/
3114	log->l_curr_block -= log->l_logBBsize;
3115	ASSERT(log->l_curr_block >= 0);
3116	smp_wmb();
3117	log->l_curr_cycle++;
3118	if (log->l_curr_cycle == XLOG_HEADER_MAGIC_NUM)
3119	log->l_curr_cycle++;
3120	}
3121	ASSERT(iclog == log->l_iclog);
3122	log->l_iclog = iclog->ic_next;
3123	}
3124
3125	/*
3126	* Force the iclog to disk and check if the iclog has been completed before
3127	* xlog_force_iclog() returns. This can happen on synchronous (e.g.
3128	* pmem) or fast async storage because we drop the icloglock to issue the IO.
3129	* If completion has already occurred, tell the caller so that it can avoid an
3130	* unnecessary wait on the iclog.
3131	*/
3132	static int
3133	xlog_force_and_check_iclog(
3134	struct xlog_in_core *iclog,
3135	bool *completed)
3136	{
3137	xfs_lsn_t lsn = be64_to_cpu(iclog->ic_header.h_lsn);
3138	int error;
3139
3140	*completed = false;
3141	error = xlog_force_iclog(iclog);
3142	if (error)
3143	return error;
3144
3145	/*
3146	* If the iclog has already been completed and reused the header LSN
3147	* will have been rewritten by completion
3148	*/
3149	if (be64_to_cpu(iclog->ic_header.h_lsn) != lsn)
3150	*completed = true;
3151	return 0;
3152	}
3153
3154	/*
3155	* Write out all data in the in-core log as of this exact moment in time.
3156	*
3157	* Data may be written to the in-core log during this call. However,
3158	* we don't guarantee this data will be written out. A change from past
3159	* implementation means this routine will *not* write out zero length LRs.
3160	*
3161	* Basically, we try and perform an intelligent scan of the in-core logs.
3162	* If we determine there is no flushable data, we just return. There is no
3163	* flushable data if:
3164	*
3165	* 1. the current iclog is active and has no data; the previous iclog
3166	* is in the active or dirty state.
3167	* 2. the current iclog is drity, and the previous iclog is in the
3168	* active or dirty state.
3169	*
3170	* We may sleep if:
3171	*
3172	* 1. the current iclog is not in the active nor dirty state.
3173	* 2. the current iclog dirty, and the previous iclog is not in the
3174	* active nor dirty state.
3175	* 3. the current iclog is active, and there is another thread writing
3176	* to this particular iclog.
3177	* 4. a) the current iclog is active and has no other writers
3178	* b) when we return from flushing out this iclog, it is still
3179	* not in the active nor dirty state.
3180	*/
3181	int
3182	xfs_log_force(
3183	struct xfs_mount *mp,
3184	uint flags)
3185	{
3186	struct xlog *log = mp->m_log;
3187	struct xlog_in_core *iclog;
3188
3189	XFS_STATS_INC(mp, xs_log_force);
3190	trace_xfs_log_force(mp, 0, _RET_IP_);
3191
3192	xlog_cil_force(log);
3193
3194	spin_lock(lock: &log->l_icloglock);
3195	if (xlog_is_shutdown(log))
3196	goto out_error;
3197
3198	iclog = log->l_iclog;
3199	trace_xlog_iclog_force(iclog, _RET_IP_);
3200
3201	if (iclog->ic_state == XLOG_STATE_DIRTY ||
3202	(iclog->ic_state == XLOG_STATE_ACTIVE &&
3203	atomic_read(v: &iclog->ic_refcnt) == 0 && iclog->ic_offset == 0)) {
3204	/*
3205	* If the head is dirty or (active and empty), then we need to
3206	* look at the previous iclog.
3207	*
3208	* If the previous iclog is active or dirty we are done. There
3209	* is nothing to sync out. Otherwise, we attach ourselves to the
3210	* previous iclog and go to sleep.
3211	*/
3212	iclog = iclog->ic_prev;
3213	} else if (iclog->ic_state == XLOG_STATE_ACTIVE) {
3214	if (atomic_read(v: &iclog->ic_refcnt) == 0) {
3215	/* We have exclusive access to this iclog. */
3216	bool completed;
3217
3218	if (xlog_force_and_check_iclog(iclog, completed: &completed))
3219	goto out_error;
3220
3221	if (completed)
3222	goto out_unlock;
3223	} else {
3224	/*
3225	* Someone else is still writing to this iclog, so we
3226	* need to ensure that when they release the iclog it
3227	* gets synced immediately as we may be waiting on it.
3228	*/
3229	xlog_state_switch_iclogs(log, iclog, eventual_size: 0);
3230	}
3231	}
3232
3233	/*
3234	* The iclog we are about to wait on may contain the checkpoint pushed
3235	* by the above xlog_cil_force() call, but it may not have been pushed
3236	* to disk yet. Like the ACTIVE case above, we need to make sure caches
3237	* are flushed when this iclog is written.
3238	*/
3239	if (iclog->ic_state == XLOG_STATE_WANT_SYNC)
3240	iclog->ic_flags |= XLOG_ICL_NEED_FLUSH | XLOG_ICL_NEED_FUA;
3241
3242	if (flags & XFS_LOG_SYNC)
3243	return xlog_wait_on_iclog(iclog);
3244	out_unlock:
3245	spin_unlock(lock: &log->l_icloglock);
3246	return 0;
3247	out_error:
3248	spin_unlock(lock: &log->l_icloglock);
3249	return -EIO;
3250	}
3251
3252	/*
3253	* Force the log to a specific LSN.
3254	*
3255	* If an iclog with that lsn can be found:
3256	* If it is in the DIRTY state, just return.
3257	* If it is in the ACTIVE state, move the in-core log into the WANT_SYNC
3258	* state and go to sleep or return.
3259	* If it is in any other state, go to sleep or return.
3260	*
3261	* Synchronous forces are implemented with a wait queue. All callers trying
3262	* to force a given lsn to disk must wait on the queue attached to the
3263	* specific in-core log. When given in-core log finally completes its write
3264	* to disk, that thread will wake up all threads waiting on the queue.
3265	*/
3266	static int
3267	xlog_force_lsn(
3268	struct xlog *log,
3269	xfs_lsn_t lsn,
3270	uint flags,
3271	int *log_flushed,
3272	bool already_slept)
3273	{
3274	struct xlog_in_core *iclog;
3275	bool completed;
3276
3277	spin_lock(lock: &log->l_icloglock);
3278	if (xlog_is_shutdown(log))
3279	goto out_error;
3280
3281	iclog = log->l_iclog;
3282	while (be64_to_cpu(iclog->ic_header.h_lsn) != lsn) {
3283	trace_xlog_iclog_force_lsn(iclog, _RET_IP_);
3284	iclog = iclog->ic_next;
3285	if (iclog == log->l_iclog)
3286	goto out_unlock;
3287	}
3288
3289	switch (iclog->ic_state) {
3290	case XLOG_STATE_ACTIVE:
3291	/*
3292	* We sleep here if we haven't already slept (e.g. this is the
3293	* first time we've looked at the correct iclog buf) and the
3294	* buffer before us is going to be sync'ed. The reason for this
3295	* is that if we are doing sync transactions here, by waiting
3296	* for the previous I/O to complete, we can allow a few more
3297	* transactions into this iclog before we close it down.
3298	*
3299	* Otherwise, we mark the buffer WANT_SYNC, and bump up the
3300	* refcnt so we can release the log (which drops the ref count).
3301	* The state switch keeps new transaction commits from using
3302	* this buffer. When the current commits finish writing into
3303	* the buffer, the refcount will drop to zero and the buffer
3304	* will go out then.
3305	*/
3306	if (!already_slept &&
3307	(iclog->ic_prev->ic_state == XLOG_STATE_WANT_SYNC ||
3308	iclog->ic_prev->ic_state == XLOG_STATE_SYNCING)) {
3309	xlog_wait(wq: &iclog->ic_prev->ic_write_wait,
3310	lock: &log->l_icloglock);
3311	return -EAGAIN;
3312	}
3313	if (xlog_force_and_check_iclog(iclog, completed: &completed))
3314	goto out_error;
3315	if (log_flushed)
3316	*log_flushed = 1;
3317	if (completed)
3318	goto out_unlock;
3319	break;
3320	case XLOG_STATE_WANT_SYNC:
3321	/*
3322	* This iclog may contain the checkpoint pushed by the
3323	* xlog_cil_force_seq() call, but there are other writers still
3324	* accessing it so it hasn't been pushed to disk yet. Like the
3325	* ACTIVE case above, we need to make sure caches are flushed
3326	* when this iclog is written.
3327	*/
3328	iclog->ic_flags |= XLOG_ICL_NEED_FLUSH | XLOG_ICL_NEED_FUA;
3329	break;
3330	default:
3331	/*
3332	* The entire checkpoint was written by the CIL force and is on
3333	* its way to disk already. It will be stable when it
3334	* completes, so we don't need to manipulate caches here at all.
3335	* We just need to wait for completion if necessary.
3336	*/
3337	break;
3338	}
3339
3340	if (flags & XFS_LOG_SYNC)
3341	return xlog_wait_on_iclog(iclog);
3342	out_unlock:
3343	spin_unlock(lock: &log->l_icloglock);
3344	return 0;
3345	out_error:
3346	spin_unlock(lock: &log->l_icloglock);
3347	return -EIO;
3348	}
3349
3350	/*
3351	* Force the log to a specific checkpoint sequence.
3352	*
3353	* First force the CIL so that all the required changes have been flushed to the
3354	* iclogs. If the CIL force completed it will return a commit LSN that indicates
3355	* the iclog that needs to be flushed to stable storage. If the caller needs
3356	* a synchronous log force, we will wait on the iclog with the LSN returned by
3357	* xlog_cil_force_seq() to be completed.
3358	*/
3359	int
3360	xfs_log_force_seq(
3361	struct xfs_mount *mp,
3362	xfs_csn_t seq,
3363	uint flags,
3364	int *log_flushed)
3365	{
3366	struct xlog *log = mp->m_log;
3367	xfs_lsn_t lsn;
3368	int ret;
3369	ASSERT(seq != 0);
3370
3371	XFS_STATS_INC(mp, xs_log_force);
3372	trace_xfs_log_force(mp, seq, _RET_IP_);
3373
3374	lsn = xlog_cil_force_seq(log, seq);
3375	if (lsn == NULLCOMMITLSN)
3376	return 0;
3377
3378	ret = xlog_force_lsn(log, lsn, flags, log_flushed, false);
3379	if (ret == -EAGAIN) {
3380	XFS_STATS_INC(mp, xs_log_force_sleep);
3381	ret = xlog_force_lsn(log, lsn, flags, log_flushed, true);
3382	}
3383	return ret;
3384	}
3385
3386	/*
3387	* Free a used ticket when its refcount falls to zero.
3388	*/
3389	void
3390	xfs_log_ticket_put(
3391	xlog_ticket_t *ticket)
3392	{
3393	ASSERT(atomic_read(&ticket->t_ref) > 0);
3394	if (atomic_dec_and_test(v: &ticket->t_ref))
3395	kmem_cache_free(s: xfs_log_ticket_cache, objp: ticket);
3396	}
3397
3398	xlog_ticket_t *
3399	xfs_log_ticket_get(
3400	xlog_ticket_t *ticket)
3401	{
3402	ASSERT(atomic_read(&ticket->t_ref) > 0);
3403	atomic_inc(v: &ticket->t_ref);
3404	return ticket;
3405	}
3406
3407	/*
3408	* Figure out the total log space unit (in bytes) that would be
3409	* required for a log ticket.
3410	*/
3411	static int
3412	xlog_calc_unit_res(
3413	struct xlog *log,
3414	int unit_bytes,
3415	int *niclogs)
3416	{
3417	int iclog_space;
3418	uint num_headers;
3419
3420	/*
3421	* Permanent reservations have up to 'cnt'-1 active log operations
3422	* in the log. A unit in this case is the amount of space for one
3423	* of these log operations. Normal reservations have a cnt of 1
3424	* and their unit amount is the total amount of space required.
3425	*
3426	* The following lines of code account for non-transaction data
3427	* which occupy space in the on-disk log.
3428	*
3429	* Normal form of a transaction is:
3430	* <oph><trans-hdr><start-oph><reg1-oph><reg1><reg2-oph>...<commit-oph>
3431	* and then there are LR hdrs, split-recs and roundoff at end of syncs.
3432	*
3433	* We need to account for all the leadup data and trailer data
3434	* around the transaction data.
3435	* And then we need to account for the worst case in terms of using
3436	* more space.
3437	* The worst case will happen if:
3438	* - the placement of the transaction happens to be such that the
3439	* roundoff is at its maximum
3440	* - the transaction data is synced before the commit record is synced
3441	* i.e. <transaction-data><roundoff> | <commit-rec><roundoff>
3442	* Therefore the commit record is in its own Log Record.
3443	* This can happen as the commit record is called with its
3444	* own region to xlog_write().
3445	* This then means that in the worst case, roundoff can happen for
3446	* the commit-rec as well.
3447	* The commit-rec is smaller than padding in this scenario and so it is
3448	* not added separately.
3449	*/
3450
3451	/* for trans header */
3452	unit_bytes += sizeof(xlog_op_header_t);
3453	unit_bytes += sizeof(xfs_trans_header_t);
3454
3455	/* for start-rec */
3456	unit_bytes += sizeof(xlog_op_header_t);
3457
3458	/*
3459	* for LR headers - the space for data in an iclog is the size minus
3460	* the space used for the headers. If we use the iclog size, then we
3461	* undercalculate the number of headers required.
3462	*
3463	* Furthermore - the addition of op headers for split-recs might
3464	* increase the space required enough to require more log and op
3465	* headers, so take that into account too.
3466	*
3467	* IMPORTANT: This reservation makes the assumption that if this
3468	* transaction is the first in an iclog and hence has the LR headers
3469	* accounted to it, then the remaining space in the iclog is
3470	* exclusively for this transaction. i.e. if the transaction is larger
3471	* than the iclog, it will be the only thing in that iclog.
3472	* Fundamentally, this means we must pass the entire log vector to
3473	* xlog_write to guarantee this.
3474	*/
3475	iclog_space = log->l_iclog_size - log->l_iclog_hsize;
3476	num_headers = howmany(unit_bytes, iclog_space);
3477
3478	/* for split-recs - ophdrs added when data split over LRs */
3479	unit_bytes += sizeof(xlog_op_header_t) * num_headers;
3480
3481	/* add extra header reservations if we overrun */
3482	while (!num_headers ||
3483	howmany(unit_bytes, iclog_space) > num_headers) {
3484	unit_bytes += sizeof(xlog_op_header_t);
3485	num_headers++;
3486	}
3487	unit_bytes += log->l_iclog_hsize * num_headers;
3488
3489	/* for commit-rec LR header - note: padding will subsume the ophdr */
3490	unit_bytes += log->l_iclog_hsize;
3491
3492	/* roundoff padding for transaction data and one for commit record */
3493	unit_bytes += 2 * log->l_iclog_roundoff;
3494
3495	if (niclogs)
3496	*niclogs = num_headers;
3497	return unit_bytes;
3498	}
3499
3500	int
3501	xfs_log_calc_unit_res(
3502	struct xfs_mount *mp,
3503	int unit_bytes)
3504	{
3505	return xlog_calc_unit_res(log: mp->m_log, unit_bytes, NULL);
3506	}
3507
3508	/*
3509	* Allocate and initialise a new log ticket.
3510	*/
3511	struct xlog_ticket *
3512	xlog_ticket_alloc(
3513	struct xlog *log,
3514	int unit_bytes,
3515	int cnt,
3516	bool permanent)
3517	{
3518	struct xlog_ticket *tic;
3519	int unit_res;
3520
3521	tic = kmem_cache_zalloc(k: xfs_log_ticket_cache,
3522	GFP_KERNEL | __GFP_NOFAIL);
3523
3524	unit_res = xlog_calc_unit_res(log, unit_bytes, niclogs: &tic->t_iclog_hdrs);
3525
3526	atomic_set(v: &tic->t_ref, i: 1);
3527	tic->t_task = current;
3528	INIT_LIST_HEAD(list: &tic->t_queue);
3529	tic->t_unit_res = unit_res;
3530	tic->t_curr_res = unit_res;
3531	tic->t_cnt = cnt;
3532	tic->t_ocnt = cnt;
3533	tic->t_tid = get_random_u32();
3534	if (permanent)
3535	tic->t_flags |= XLOG_TIC_PERM_RESERV;
3536
3537	return tic;
3538	}
3539
3540	#if defined(DEBUG)
3541	/*
3542	* Check to make sure the grant write head didn't just over lap the tail. If
3543	* the cycles are the same, we can't be overlapping. Otherwise, make sure that
3544	* the cycles differ by exactly one and check the byte count.
3545	*
3546	* This check is run unlocked, so can give false positives. Rather than assert
3547	* on failures, use a warn-once flag and a panic tag to allow the admin to
3548	* determine if they want to panic the machine when such an error occurs. For
3549	* debug kernels this will have the same effect as using an assert but, unlinke
3550	* an assert, it can be turned off at runtime.
3551	*/
3552	STATIC void
3553	xlog_verify_grant_tail(
3554	struct xlog *log)
3555	{
3556	int tail_cycle, tail_blocks;
3557	int cycle, space;
3558
3559	xlog_crack_grant_head(head: &log->l_write_head.grant, cycle: &cycle, space: &space);
3560	xlog_crack_atomic_lsn(lsn: &log->l_tail_lsn, cycle: &tail_cycle, block: &tail_blocks);
3561	if (tail_cycle != cycle) {
3562	if (cycle - 1 != tail_cycle &&
3563	!test_and_set_bit(XLOG_TAIL_WARN, addr: &log->l_opstate)) {
3564	xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
3565	"%s: cycle - 1 != tail_cycle", __func__);
3566	}
3567
3568	if (space > BBTOB(tail_blocks) &&
3569	!test_and_set_bit(XLOG_TAIL_WARN, addr: &log->l_opstate)) {
3570	xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
3571	"%s: space > BBTOB(tail_blocks)", __func__);
3572	}
3573	}
3574	}
3575
3576	/* check if it will fit */
3577	STATIC void
3578	xlog_verify_tail_lsn(
3579	struct xlog *log,
3580	struct xlog_in_core *iclog)
3581	{
3582	xfs_lsn_t tail_lsn = be64_to_cpu(iclog->ic_header.h_tail_lsn);
3583	int blocks;
3584
3585	if (CYCLE_LSN(tail_lsn) == log->l_prev_cycle) {
3586	blocks =
3587	log->l_logBBsize - (log->l_prev_block - BLOCK_LSN(tail_lsn));
3588	if (blocks < BTOBB(iclog->ic_offset)+BTOBB(log->l_iclog_hsize))
3589	xfs_emerg(log->l_mp, "%s: ran out of log space", __func__);
3590	} else {
3591	ASSERT(CYCLE_LSN(tail_lsn)+1 == log->l_prev_cycle);
3592
3593	if (BLOCK_LSN(tail_lsn) == log->l_prev_block)
3594	xfs_emerg(log->l_mp, "%s: tail wrapped", __func__);
3595
3596	blocks = BLOCK_LSN(tail_lsn) - log->l_prev_block;
3597	if (blocks < BTOBB(iclog->ic_offset) + 1)
3598	xfs_emerg(log->l_mp, "%s: ran out of log space", __func__);
3599	}
3600	}
3601
3602	/*
3603	* Perform a number of checks on the iclog before writing to disk.
3604	*
3605	* 1. Make sure the iclogs are still circular
3606	* 2. Make sure we have a good magic number
3607	* 3. Make sure we don't have magic numbers in the data
3608	* 4. Check fields of each log operation header for:
3609	* A. Valid client identifier
3610	* B. tid ptr value falls in valid ptr space (user space code)
3611	* C. Length in log record header is correct according to the
3612	* individual operation headers within record.
3613	* 5. When a bwrite will occur within 5 blocks of the front of the physical
3614	* log, check the preceding blocks of the physical log to make sure all
3615	* the cycle numbers agree with the current cycle number.
3616	*/
3617	STATIC void
3618	xlog_verify_iclog(
3619	struct xlog *log,
3620	struct xlog_in_core *iclog,
3621	int count)
3622	{
3623	xlog_op_header_t *ophead;
3624	xlog_in_core_t *icptr;
3625	xlog_in_core_2_t *xhdr;
3626	void *base_ptr, *ptr, *p;
3627	ptrdiff_t field_offset;
3628	uint8_t clientid;
3629	int len, i, j, k, op_len;
3630	int idx;
3631
3632	/* check validity of iclog pointers */
3633	spin_lock(lock: &log->l_icloglock);
3634	icptr = log->l_iclog;
3635	for (i = 0; i < log->l_iclog_bufs; i++, icptr = icptr->ic_next)
3636	ASSERT(icptr);
3637
3638	if (icptr != log->l_iclog)
3639	xfs_emerg(log->l_mp, "%s: corrupt iclog ring", __func__);
3640	spin_unlock(lock: &log->l_icloglock);
3641
3642	/* check log magic numbers */
3643	if (iclog->ic_header.h_magicno != cpu_to_be32(XLOG_HEADER_MAGIC_NUM))
3644	xfs_emerg(log->l_mp, "%s: invalid magic num", __func__);
3645
3646	base_ptr = ptr = &iclog->ic_header;
3647	p = &iclog->ic_header;
3648	for (ptr += BBSIZE; ptr < base_ptr + count; ptr += BBSIZE) {
3649	if (*(__be32 *)ptr == cpu_to_be32(XLOG_HEADER_MAGIC_NUM))
3650	xfs_emerg(log->l_mp, "%s: unexpected magic num",
3651	__func__);
3652	}
3653
3654	/* check fields */
3655	len = be32_to_cpu(iclog->ic_header.h_num_logops);
3656	base_ptr = ptr = iclog->ic_datap;
3657	ophead = ptr;
3658	xhdr = iclog->ic_data;
3659	for (i = 0; i < len; i++) {
3660	ophead = ptr;
3661
3662	/* clientid is only 1 byte */
3663	p = &ophead->oh_clientid;
3664	field_offset = p - base_ptr;
3665	if (field_offset & 0x1ff) {
3666	clientid = ophead->oh_clientid;
3667	} else {
3668	idx = BTOBBT((void *)&ophead->oh_clientid - iclog->ic_datap);
3669	if (idx >= (XLOG_HEADER_CYCLE_SIZE / BBSIZE)) {
3670	j = idx / (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
3671	k = idx % (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
3672	clientid = xlog_get_client_id(
3673	xhdr[j].hic_xheader.xh_cycle_data[k]);
3674	} else {
3675	clientid = xlog_get_client_id(
3676	i: iclog->ic_header.h_cycle_data[idx]);
3677	}
3678	}
3679	if (clientid != XFS_TRANSACTION && clientid != XFS_LOG) {
3680	xfs_warn(log->l_mp,
3681	"%s: op %d invalid clientid %d op "PTR_FMT" offset 0x%lx",
3682	__func__, i, clientid, ophead,
3683	(unsigned long)field_offset);
3684	}
3685
3686	/* check length */
3687	p = &ophead->oh_len;
3688	field_offset = p - base_ptr;
3689	if (field_offset & 0x1ff) {
3690	op_len = be32_to_cpu(ophead->oh_len);
3691	} else {
3692	idx = BTOBBT((void *)&ophead->oh_len - iclog->ic_datap);
3693	if (idx >= (XLOG_HEADER_CYCLE_SIZE / BBSIZE)) {
3694	j = idx / (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
3695	k = idx % (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
3696	op_len = be32_to_cpu(xhdr[j].hic_xheader.xh_cycle_data[k]);
3697	} else {
3698	op_len = be32_to_cpu(iclog->ic_header.h_cycle_data[idx]);
3699	}
3700	}
3701	ptr += sizeof(xlog_op_header_t) + op_len;
3702	}
3703	}
3704	#endif
3705
3706	/*
3707	* Perform a forced shutdown on the log.
3708	*
3709	* This can be called from low level log code to trigger a shutdown, or from the
3710	* high level mount shutdown code when the mount shuts down.
3711	*
3712	* Our main objectives here are to make sure that:
3713	* a. if the shutdown was not due to a log IO error, flush the logs to
3714	* disk. Anything modified after this is ignored.
3715	* b. the log gets atomically marked 'XLOG_IO_ERROR' for all interested
3716	* parties to find out. Nothing new gets queued after this is done.
3717	* c. Tasks sleeping on log reservations, pinned objects and
3718	* other resources get woken up.
3719	* d. The mount is also marked as shut down so that log triggered shutdowns
3720	* still behave the same as if they called xfs_forced_shutdown().
3721	*
3722	* Return true if the shutdown cause was a log IO error and we actually shut the
3723	* log down.
3724	*/
3725	bool
3726	xlog_force_shutdown(
3727	struct xlog *log,
3728	uint32_t shutdown_flags)
3729	{
3730	bool log_error = (shutdown_flags & SHUTDOWN_LOG_IO_ERROR);
3731
3732	if (!log)
3733	return false;
3734
3735	/*
3736	* Flush all the completed transactions to disk before marking the log
3737	* being shut down. We need to do this first as shutting down the log
3738	* before the force will prevent the log force from flushing the iclogs
3739	* to disk.
3740	*
3741	* When we are in recovery, there are no transactions to flush, and
3742	* we don't want to touch the log because we don't want to perturb the
3743	* current head/tail for future recovery attempts. Hence we need to
3744	* avoid a log force in this case.
3745	*
3746	* If we are shutting down due to a log IO error, then we must avoid
3747	* trying to write the log as that may just result in more IO errors and
3748	* an endless shutdown/force loop.
3749	*/
3750	if (!log_error && !xlog_in_recovery(log))
3751	xfs_log_force(mp: log->l_mp, XFS_LOG_SYNC);
3752
3753	/*
3754	* Atomically set the shutdown state. If the shutdown state is already
3755	* set, there someone else is performing the shutdown and so we are done
3756	* here. This should never happen because we should only ever get called
3757	* once by the first shutdown caller.
3758	*
3759	* Much of the log state machine transitions assume that shutdown state
3760	* cannot change once they hold the log->l_icloglock. Hence we need to
3761	* hold that lock here, even though we use the atomic test_and_set_bit()
3762	* operation to set the shutdown state.
3763	*/
3764	spin_lock(lock: &log->l_icloglock);
3765	if (test_and_set_bit(XLOG_IO_ERROR, addr: &log->l_opstate)) {
3766	spin_unlock(lock: &log->l_icloglock);
3767	return false;
3768	}
3769	spin_unlock(lock: &log->l_icloglock);
3770
3771	/*
3772	* If this log shutdown also sets the mount shutdown state, issue a
3773	* shutdown warning message.
3774	*/
3775	if (!test_and_set_bit(XFS_OPSTATE_SHUTDOWN, addr: &log->l_mp->m_opstate)) {
3776	xfs_alert_tag(log->l_mp, XFS_PTAG_SHUTDOWN_LOGERROR,
3777	"Filesystem has been shut down due to log error (0x%x).",
3778	shutdown_flags);
3779	xfs_alert(log->l_mp,
3780	"Please unmount the filesystem and rectify the problem(s).");
3781	if (xfs_error_level >= XFS_ERRLEVEL_HIGH)
3782	xfs_stack_trace();
3783	}
3784
3785	/*
3786	* We don't want anybody waiting for log reservations after this. That
3787	* means we have to wake up everybody queued up on reserveq as well as
3788	* writeq. In addition, we make sure in xlog_{re}grant_log_space that
3789	* we don't enqueue anything once the SHUTDOWN flag is set, and this
3790	* action is protected by the grant locks.
3791	*/
3792	xlog_grant_head_wake_all(head: &log->l_reserve_head);
3793	xlog_grant_head_wake_all(head: &log->l_write_head);
3794
3795	/*
3796	* Wake up everybody waiting on xfs_log_force. Wake the CIL push first
3797	* as if the log writes were completed. The abort handling in the log
3798	* item committed callback functions will do this again under lock to
3799	* avoid races.
3800	*/
3801	spin_lock(lock: &log->l_cilp->xc_push_lock);
3802	wake_up_all(&log->l_cilp->xc_start_wait);
3803	wake_up_all(&log->l_cilp->xc_commit_wait);
3804	spin_unlock(lock: &log->l_cilp->xc_push_lock);
3805
3806	spin_lock(lock: &log->l_icloglock);
3807	xlog_state_shutdown_callbacks(log);
3808	spin_unlock(lock: &log->l_icloglock);
3809
3810	wake_up_var(var: &log->l_opstate);
3811	return log_error;
3812	}
3813
3814	STATIC int
3815	xlog_iclogs_empty(
3816	struct xlog *log)
3817	{
3818	xlog_in_core_t *iclog;
3819
3820	iclog = log->l_iclog;
3821	do {
3822	/* endianness does not matter here, zero is zero in
3823	* any language.
3824	*/
3825	if (iclog->ic_header.h_num_logops)
3826	return 0;
3827	iclog = iclog->ic_next;
3828	} while (iclog != log->l_iclog);
3829	return 1;
3830	}
3831
3832	/*
3833	* Verify that an LSN stamped into a piece of metadata is valid. This is
3834	* intended for use in read verifiers on v5 superblocks.
3835	*/
3836	bool
3837	xfs_log_check_lsn(
3838	struct xfs_mount *mp,
3839	xfs_lsn_t lsn)
3840	{
3841	struct xlog *log = mp->m_log;
3842	bool valid;
3843
3844	/*
3845	* norecovery mode skips mount-time log processing and unconditionally
3846	* resets the in-core LSN. We can't validate in this mode, but
3847	* modifications are not allowed anyways so just return true.
3848	*/
3849	if (xfs_has_norecovery(mp))
3850	return true;
3851
3852	/*
3853	* Some metadata LSNs are initialized to NULL (e.g., the agfl). This is
3854	* handled by recovery and thus safe to ignore here.
3855	*/
3856	if (lsn == NULLCOMMITLSN)
3857	return true;
3858
3859	valid = xlog_valid_lsn(mp->m_log, lsn);
3860
3861	/* warn the user about what's gone wrong before verifier failure */
3862	if (!valid) {
3863	spin_lock(lock: &log->l_icloglock);
3864	xfs_warn(mp,
3865	"Corruption warning: Metadata has LSN (%d:%d) ahead of current LSN (%d:%d). "
3866	"Please unmount and run xfs_repair (>= v4.3) to resolve.",
3867	CYCLE_LSN(lsn), BLOCK_LSN(lsn),
3868	log->l_curr_cycle, log->l_curr_block);
3869	spin_unlock(lock: &log->l_icloglock);
3870	}
3871
3872	return valid;
3873	}
3874
3875	/*
3876	* Notify the log that we're about to start using a feature that is protected
3877	* by a log incompat feature flag. This will prevent log covering from
3878	* clearing those flags.
3879	*/
3880	void
3881	xlog_use_incompat_feat(
3882	struct xlog *log)
3883	{
3884	down_read(sem: &log->l_incompat_users);
3885	}
3886
3887	/* Notify the log that we've finished using log incompat features. */
3888	void
3889	xlog_drop_incompat_feat(
3890	struct xlog *log)
3891	{
3892	up_read(sem: &log->l_incompat_users);
3893	}
3894