xref: /freebsd/sbin/fsck_ffs/suj.c (revision 3c5ba95ad12285ad37c182a4bfc1b240ec6d18a7)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright 2009, 2010 Jeffrey W. Roberson <jeff@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include <sys/param.h>
33 #include <sys/disk.h>
34 #include <sys/disklabel.h>
35 #include <sys/mount.h>
36 #include <sys/stat.h>
37 
38 #include <ufs/ufs/ufsmount.h>
39 #include <ufs/ufs/dinode.h>
40 #include <ufs/ufs/dir.h>
41 #include <ufs/ffs/fs.h>
42 
43 #include <assert.h>
44 #include <err.h>
45 #include <setjmp.h>
46 #include <stdarg.h>
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <stdint.h>
50 #include <libufs.h>
51 #include <string.h>
52 #include <strings.h>
53 #include <sysexits.h>
54 #include <time.h>
55 
56 #include "fsck.h"
57 
58 #define	DOTDOT_OFFSET	DIRECTSIZ(1)
59 #define	SUJ_HASHSIZE	2048
60 #define	SUJ_HASHMASK	(SUJ_HASHSIZE - 1)
61 #define	SUJ_HASH(x)	((x * 2654435761) & SUJ_HASHMASK)
62 
63 struct suj_seg {
64 	TAILQ_ENTRY(suj_seg) ss_next;
65 	struct jsegrec	ss_rec;
66 	uint8_t		*ss_blk;
67 };
68 
69 struct suj_rec {
70 	TAILQ_ENTRY(suj_rec) sr_next;
71 	union jrec	*sr_rec;
72 };
73 TAILQ_HEAD(srechd, suj_rec);
74 
75 struct suj_ino {
76 	LIST_ENTRY(suj_ino)	si_next;
77 	struct srechd		si_recs;
78 	struct srechd		si_newrecs;
79 	struct srechd		si_movs;
80 	struct jtrncrec		*si_trunc;
81 	ino_t			si_ino;
82 	char			si_skipparent;
83 	char			si_hasrecs;
84 	char			si_blkadj;
85 	char			si_linkadj;
86 	int			si_mode;
87 	nlink_t			si_nlinkadj;
88 	nlink_t			si_nlink;
89 	nlink_t			si_dotlinks;
90 };
91 LIST_HEAD(inohd, suj_ino);
92 
93 struct suj_blk {
94 	LIST_ENTRY(suj_blk)	sb_next;
95 	struct srechd		sb_recs;
96 	ufs2_daddr_t		sb_blk;
97 };
98 LIST_HEAD(blkhd, suj_blk);
99 
100 struct data_blk {
101 	LIST_ENTRY(data_blk)	db_next;
102 	uint8_t			*db_buf;
103 	ufs2_daddr_t		db_blk;
104 	int			db_size;
105 	int			db_dirty;
106 };
107 
108 struct ino_blk {
109 	LIST_ENTRY(ino_blk)	ib_next;
110 	uint8_t			*ib_buf;
111 	int			ib_dirty;
112 	ufs2_daddr_t		ib_blk;
113 };
114 LIST_HEAD(iblkhd, ino_blk);
115 
116 struct suj_cg {
117 	LIST_ENTRY(suj_cg)	sc_next;
118 	struct blkhd		sc_blkhash[SUJ_HASHSIZE];
119 	struct inohd		sc_inohash[SUJ_HASHSIZE];
120 	struct iblkhd		sc_iblkhash[SUJ_HASHSIZE];
121 	struct ino_blk		*sc_lastiblk;
122 	struct suj_ino		*sc_lastino;
123 	struct suj_blk		*sc_lastblk;
124 	uint8_t			*sc_cgbuf;
125 	struct cg		*sc_cgp;
126 	int			sc_dirty;
127 	int			sc_cgx;
128 };
129 
130 static LIST_HEAD(cghd, suj_cg) cghash[SUJ_HASHSIZE];
131 static LIST_HEAD(dblkhd, data_blk) dbhash[SUJ_HASHSIZE];
132 static struct suj_cg *lastcg;
133 static struct data_blk *lastblk;
134 
135 static TAILQ_HEAD(seghd, suj_seg) allsegs;
136 static uint64_t oldseq;
137 static struct fs *fs = NULL;
138 static ino_t sujino;
139 
140 /*
141  * Summary statistics.
142  */
143 static uint64_t freefrags;
144 static uint64_t freeblocks;
145 static uint64_t freeinos;
146 static uint64_t freedir;
147 static uint64_t jbytes;
148 static uint64_t jrecs;
149 
150 static jmp_buf	jmpbuf;
151 
152 typedef void (*ino_visitor)(ino_t, ufs_lbn_t, ufs2_daddr_t, int);
153 static void err_suj(const char *, ...) __dead2;
154 static void ino_trunc(ino_t, off_t);
155 static void ino_decr(ino_t);
156 static void ino_adjust(struct suj_ino *);
157 static void ino_build(struct suj_ino *);
158 static int blk_isfree(ufs2_daddr_t);
159 static void initsuj(void);
160 
161 static void *
162 errmalloc(size_t n)
163 {
164 	void *a;
165 
166 	a = Malloc(n);
167 	if (a == NULL)
168 		err(EX_OSERR, "malloc(%zu)", n);
169 	return (a);
170 }
171 
172 /*
173  * When hit a fatal error in journalling check, print out
174  * the error and then offer to fallback to normal fsck.
175  */
176 static void
177 err_suj(const char * restrict fmt, ...)
178 {
179 	va_list ap;
180 
181 	if (preen)
182 		(void)fprintf(stdout, "%s: ", cdevname);
183 
184 	va_start(ap, fmt);
185 	(void)vfprintf(stdout, fmt, ap);
186 	va_end(ap);
187 
188 	longjmp(jmpbuf, -1);
189 }
190 
191 /*
192  * Mark file system as clean, write the super-block back, close the disk.
193  */
194 static void
195 closedisk(const char *devnam)
196 {
197 	struct csum *cgsum;
198 	uint32_t i;
199 
200 	/*
201 	 * Recompute the fs summary info from correct cs summaries.
202 	 */
203 	bzero(&fs->fs_cstotal, sizeof(struct csum_total));
204 	for (i = 0; i < fs->fs_ncg; i++) {
205 		cgsum = &fs->fs_cs(fs, i);
206 		fs->fs_cstotal.cs_nffree += cgsum->cs_nffree;
207 		fs->fs_cstotal.cs_nbfree += cgsum->cs_nbfree;
208 		fs->fs_cstotal.cs_nifree += cgsum->cs_nifree;
209 		fs->fs_cstotal.cs_ndir += cgsum->cs_ndir;
210 	}
211 	fs->fs_pendinginodes = 0;
212 	fs->fs_pendingblocks = 0;
213 	fs->fs_clean = 1;
214 	fs->fs_time = time(NULL);
215 	fs->fs_mtime = time(NULL);
216 	if (sbput(disk.d_fd, fs, 0) == -1)
217 		err(EX_OSERR, "sbput(%s)", devnam);
218 	if (ufs_disk_close(&disk) == -1)
219 		err(EX_OSERR, "ufs_disk_close(%s)", devnam);
220 	fs = NULL;
221 }
222 
223 /*
224  * Lookup a cg by number in the hash so we can keep track of which cgs
225  * need stats rebuilt.
226  */
227 static struct suj_cg *
228 cg_lookup(int cgx)
229 {
230 	struct cghd *hd;
231 	struct suj_cg *sc;
232 
233 	if (cgx < 0 || cgx >= fs->fs_ncg)
234 		err_suj("Bad cg number %d\n", cgx);
235 	if (lastcg && lastcg->sc_cgx == cgx)
236 		return (lastcg);
237 	hd = &cghash[SUJ_HASH(cgx)];
238 	LIST_FOREACH(sc, hd, sc_next)
239 		if (sc->sc_cgx == cgx) {
240 			lastcg = sc;
241 			return (sc);
242 		}
243 	sc = errmalloc(sizeof(*sc));
244 	bzero(sc, sizeof(*sc));
245 	sc->sc_cgbuf = errmalloc(fs->fs_bsize);
246 	sc->sc_cgp = (struct cg *)sc->sc_cgbuf;
247 	sc->sc_cgx = cgx;
248 	LIST_INSERT_HEAD(hd, sc, sc_next);
249 	/*
250 	 * Use bread() here rather than cgget() because the cylinder group
251 	 * may be corrupted but we want it anyway so we can fix it.
252 	 */
253 	if (bread(&disk, fsbtodb(fs, cgtod(fs, sc->sc_cgx)), sc->sc_cgbuf,
254 	    fs->fs_bsize) == -1)
255 		err_suj("Unable to read cylinder group %d\n", sc->sc_cgx);
256 
257 	return (sc);
258 }
259 
260 /*
261  * Lookup an inode number in the hash and allocate a suj_ino if it does
262  * not exist.
263  */
264 static struct suj_ino *
265 ino_lookup(ino_t ino, int creat)
266 {
267 	struct suj_ino *sino;
268 	struct inohd *hd;
269 	struct suj_cg *sc;
270 
271 	sc = cg_lookup(ino_to_cg(fs, ino));
272 	if (sc->sc_lastino && sc->sc_lastino->si_ino == ino)
273 		return (sc->sc_lastino);
274 	hd = &sc->sc_inohash[SUJ_HASH(ino)];
275 	LIST_FOREACH(sino, hd, si_next)
276 		if (sino->si_ino == ino)
277 			return (sino);
278 	if (creat == 0)
279 		return (NULL);
280 	sino = errmalloc(sizeof(*sino));
281 	bzero(sino, sizeof(*sino));
282 	sino->si_ino = ino;
283 	TAILQ_INIT(&sino->si_recs);
284 	TAILQ_INIT(&sino->si_newrecs);
285 	TAILQ_INIT(&sino->si_movs);
286 	LIST_INSERT_HEAD(hd, sino, si_next);
287 
288 	return (sino);
289 }
290 
291 /*
292  * Lookup a block number in the hash and allocate a suj_blk if it does
293  * not exist.
294  */
295 static struct suj_blk *
296 blk_lookup(ufs2_daddr_t blk, int creat)
297 {
298 	struct suj_blk *sblk;
299 	struct suj_cg *sc;
300 	struct blkhd *hd;
301 
302 	sc = cg_lookup(dtog(fs, blk));
303 	if (sc->sc_lastblk && sc->sc_lastblk->sb_blk == blk)
304 		return (sc->sc_lastblk);
305 	hd = &sc->sc_blkhash[SUJ_HASH(fragstoblks(fs, blk))];
306 	LIST_FOREACH(sblk, hd, sb_next)
307 		if (sblk->sb_blk == blk)
308 			return (sblk);
309 	if (creat == 0)
310 		return (NULL);
311 	sblk = errmalloc(sizeof(*sblk));
312 	bzero(sblk, sizeof(*sblk));
313 	sblk->sb_blk = blk;
314 	TAILQ_INIT(&sblk->sb_recs);
315 	LIST_INSERT_HEAD(hd, sblk, sb_next);
316 
317 	return (sblk);
318 }
319 
320 static struct data_blk *
321 dblk_lookup(ufs2_daddr_t blk)
322 {
323 	struct data_blk *dblk;
324 	struct dblkhd *hd;
325 
326 	hd = &dbhash[SUJ_HASH(fragstoblks(fs, blk))];
327 	if (lastblk && lastblk->db_blk == blk)
328 		return (lastblk);
329 	LIST_FOREACH(dblk, hd, db_next)
330 		if (dblk->db_blk == blk)
331 			return (dblk);
332 	/*
333 	 * The inode block wasn't located, allocate a new one.
334 	 */
335 	dblk = errmalloc(sizeof(*dblk));
336 	bzero(dblk, sizeof(*dblk));
337 	LIST_INSERT_HEAD(hd, dblk, db_next);
338 	dblk->db_blk = blk;
339 	return (dblk);
340 }
341 
342 static uint8_t *
343 dblk_read(ufs2_daddr_t blk, int size)
344 {
345 	struct data_blk *dblk;
346 
347 	dblk = dblk_lookup(blk);
348 	/*
349 	 * I doubt size mismatches can happen in practice but it is trivial
350 	 * to handle.
351 	 */
352 	if (size != dblk->db_size) {
353 		if (dblk->db_buf)
354 			free(dblk->db_buf);
355 		dblk->db_buf = errmalloc(size);
356 		dblk->db_size = size;
357 		if (bread(&disk, fsbtodb(fs, blk), dblk->db_buf, size) == -1)
358 			err_suj("Failed to read data block %jd\n", blk);
359 	}
360 	return (dblk->db_buf);
361 }
362 
363 static void
364 dblk_dirty(ufs2_daddr_t blk)
365 {
366 	struct data_blk *dblk;
367 
368 	dblk = dblk_lookup(blk);
369 	dblk->db_dirty = 1;
370 }
371 
372 static void
373 dblk_write(void)
374 {
375 	struct data_blk *dblk;
376 	int i;
377 
378 	for (i = 0; i < SUJ_HASHSIZE; i++) {
379 		LIST_FOREACH(dblk, &dbhash[i], db_next) {
380 			if (dblk->db_dirty == 0 || dblk->db_size == 0)
381 				continue;
382 			if (bwrite(&disk, fsbtodb(fs, dblk->db_blk),
383 			    dblk->db_buf, dblk->db_size) == -1)
384 				err_suj("Unable to write block %jd\n",
385 				    dblk->db_blk);
386 		}
387 	}
388 }
389 
390 static union dinode *
391 ino_read(ino_t ino)
392 {
393 	struct ino_blk *iblk;
394 	struct iblkhd *hd;
395 	struct suj_cg *sc;
396 	ufs2_daddr_t blk;
397 	int off;
398 
399 	blk = ino_to_fsba(fs, ino);
400 	sc = cg_lookup(ino_to_cg(fs, ino));
401 	iblk = sc->sc_lastiblk;
402 	if (iblk && iblk->ib_blk == blk)
403 		goto found;
404 	hd = &sc->sc_iblkhash[SUJ_HASH(fragstoblks(fs, blk))];
405 	LIST_FOREACH(iblk, hd, ib_next)
406 		if (iblk->ib_blk == blk)
407 			goto found;
408 	/*
409 	 * The inode block wasn't located, allocate a new one.
410 	 */
411 	iblk = errmalloc(sizeof(*iblk));
412 	bzero(iblk, sizeof(*iblk));
413 	iblk->ib_buf = errmalloc(fs->fs_bsize);
414 	iblk->ib_blk = blk;
415 	LIST_INSERT_HEAD(hd, iblk, ib_next);
416 	if (bread(&disk, fsbtodb(fs, blk), iblk->ib_buf, fs->fs_bsize) == -1)
417 		err_suj("Failed to read inode block %jd\n", blk);
418 found:
419 	sc->sc_lastiblk = iblk;
420 	off = ino_to_fsbo(fs, ino);
421 	if (fs->fs_magic == FS_UFS1_MAGIC)
422 		return (union dinode *)&((struct ufs1_dinode *)iblk->ib_buf)[off];
423 	else
424 		return (union dinode *)&((struct ufs2_dinode *)iblk->ib_buf)[off];
425 }
426 
427 static void
428 ino_dirty(ino_t ino)
429 {
430 	struct ino_blk *iblk;
431 	struct iblkhd *hd;
432 	struct suj_cg *sc;
433 	ufs2_daddr_t blk;
434 
435 	blk = ino_to_fsba(fs, ino);
436 	sc = cg_lookup(ino_to_cg(fs, ino));
437 	iblk = sc->sc_lastiblk;
438 	if (iblk && iblk->ib_blk == blk) {
439 		iblk->ib_dirty = 1;
440 		return;
441 	}
442 	hd = &sc->sc_iblkhash[SUJ_HASH(fragstoblks(fs, blk))];
443 	LIST_FOREACH(iblk, hd, ib_next) {
444 		if (iblk->ib_blk == blk) {
445 			iblk->ib_dirty = 1;
446 			return;
447 		}
448 	}
449 	ino_read(ino);
450 	ino_dirty(ino);
451 }
452 
453 static void
454 iblk_write(struct ino_blk *iblk)
455 {
456 
457 	if (iblk->ib_dirty == 0)
458 		return;
459 	if (bwrite(&disk, fsbtodb(fs, iblk->ib_blk), iblk->ib_buf,
460 	    fs->fs_bsize) == -1)
461 		err_suj("Failed to write inode block %jd\n", iblk->ib_blk);
462 }
463 
464 static int
465 blk_overlaps(struct jblkrec *brec, ufs2_daddr_t start, int frags)
466 {
467 	ufs2_daddr_t bstart;
468 	ufs2_daddr_t bend;
469 	ufs2_daddr_t end;
470 
471 	end = start + frags;
472 	bstart = brec->jb_blkno + brec->jb_oldfrags;
473 	bend = bstart + brec->jb_frags;
474 	if (start < bend && end > bstart)
475 		return (1);
476 	return (0);
477 }
478 
479 static int
480 blk_equals(struct jblkrec *brec, ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t start,
481     int frags)
482 {
483 
484 	if (brec->jb_ino != ino || brec->jb_lbn != lbn)
485 		return (0);
486 	if (brec->jb_blkno + brec->jb_oldfrags != start)
487 		return (0);
488 	if (brec->jb_frags < frags)
489 		return (0);
490 	return (1);
491 }
492 
493 static void
494 blk_setmask(struct jblkrec *brec, int *mask)
495 {
496 	int i;
497 
498 	for (i = brec->jb_oldfrags; i < brec->jb_oldfrags + brec->jb_frags; i++)
499 		*mask |= 1 << i;
500 }
501 
502 /*
503  * Determine whether a given block has been reallocated to a new location.
504  * Returns a mask of overlapping bits if any frags have been reused or
505  * zero if the block has not been re-used and the contents can be trusted.
506  *
507  * This is used to ensure that an orphaned pointer due to truncate is safe
508  * to be freed.  The mask value can be used to free partial blocks.
509  */
510 static int
511 blk_freemask(ufs2_daddr_t blk, ino_t ino, ufs_lbn_t lbn, int frags)
512 {
513 	struct suj_blk *sblk;
514 	struct suj_rec *srec;
515 	struct jblkrec *brec;
516 	int mask;
517 	int off;
518 
519 	/*
520 	 * To be certain we're not freeing a reallocated block we lookup
521 	 * this block in the blk hash and see if there is an allocation
522 	 * journal record that overlaps with any fragments in the block
523 	 * we're concerned with.  If any fragments have ben reallocated
524 	 * the block has already been freed and re-used for another purpose.
525 	 */
526 	mask = 0;
527 	sblk = blk_lookup(blknum(fs, blk), 0);
528 	if (sblk == NULL)
529 		return (0);
530 	off = blk - sblk->sb_blk;
531 	TAILQ_FOREACH(srec, &sblk->sb_recs, sr_next) {
532 		brec = (struct jblkrec *)srec->sr_rec;
533 		/*
534 		 * If the block overlaps but does not match
535 		 * exactly this record refers to the current
536 		 * location.
537 		 */
538 		if (blk_overlaps(brec, blk, frags) == 0)
539 			continue;
540 		if (blk_equals(brec, ino, lbn, blk, frags) == 1)
541 			mask = 0;
542 		else
543 			blk_setmask(brec, &mask);
544 	}
545 	if (debug)
546 		printf("blk_freemask: blk %jd sblk %jd off %d mask 0x%X\n",
547 		    blk, sblk->sb_blk, off, mask);
548 	return (mask >> off);
549 }
550 
551 /*
552  * Determine whether it is safe to follow an indirect.  It is not safe
553  * if any part of the indirect has been reallocated or the last journal
554  * entry was an allocation.  Just allocated indirects may not have valid
555  * pointers yet and all of their children will have their own records.
556  * It is also not safe to follow an indirect if the cg bitmap has been
557  * cleared as a new allocation may write to the block prior to the journal
558  * being written.
559  *
560  * Returns 1 if it's safe to follow the indirect and 0 otherwise.
561  */
562 static int
563 blk_isindir(ufs2_daddr_t blk, ino_t ino, ufs_lbn_t lbn)
564 {
565 	struct suj_blk *sblk;
566 	struct jblkrec *brec;
567 
568 	sblk = blk_lookup(blk, 0);
569 	if (sblk == NULL)
570 		return (1);
571 	if (TAILQ_EMPTY(&sblk->sb_recs))
572 		return (1);
573 	brec = (struct jblkrec *)TAILQ_LAST(&sblk->sb_recs, srechd)->sr_rec;
574 	if (blk_equals(brec, ino, lbn, blk, fs->fs_frag))
575 		if (brec->jb_op == JOP_FREEBLK)
576 			return (!blk_isfree(blk));
577 	return (0);
578 }
579 
580 /*
581  * Clear an inode from the cg bitmap.  If the inode was already clear return
582  * 0 so the caller knows it does not have to check the inode contents.
583  */
584 static int
585 ino_free(ino_t ino, int mode)
586 {
587 	struct suj_cg *sc;
588 	uint8_t *inosused;
589 	struct cg *cgp;
590 	int cg;
591 
592 	cg = ino_to_cg(fs, ino);
593 	ino = ino % fs->fs_ipg;
594 	sc = cg_lookup(cg);
595 	cgp = sc->sc_cgp;
596 	inosused = cg_inosused(cgp);
597 	/*
598 	 * The bitmap may never have made it to the disk so we have to
599 	 * conditionally clear.  We can avoid writing the cg in this case.
600 	 */
601 	if (isclr(inosused, ino))
602 		return (0);
603 	freeinos++;
604 	clrbit(inosused, ino);
605 	if (ino < cgp->cg_irotor)
606 		cgp->cg_irotor = ino;
607 	cgp->cg_cs.cs_nifree++;
608 	if ((mode & IFMT) == IFDIR) {
609 		freedir++;
610 		cgp->cg_cs.cs_ndir--;
611 	}
612 	sc->sc_dirty = 1;
613 
614 	return (1);
615 }
616 
617 /*
618  * Free 'frags' frags starting at filesystem block 'bno' skipping any frags
619  * set in the mask.
620  */
621 static void
622 blk_free(ufs2_daddr_t bno, int mask, int frags)
623 {
624 	ufs1_daddr_t fragno, cgbno;
625 	struct suj_cg *sc;
626 	struct cg *cgp;
627 	int i, cg;
628 	uint8_t *blksfree;
629 
630 	if (debug)
631 		printf("Freeing %d frags at blk %jd mask 0x%x\n",
632 		    frags, bno, mask);
633 	cg = dtog(fs, bno);
634 	sc = cg_lookup(cg);
635 	cgp = sc->sc_cgp;
636 	cgbno = dtogd(fs, bno);
637 	blksfree = cg_blksfree(cgp);
638 
639 	/*
640 	 * If it's not allocated we only wrote the journal entry
641 	 * and never the bitmaps.  Here we unconditionally clear and
642 	 * resolve the cg summary later.
643 	 */
644 	if (frags == fs->fs_frag && mask == 0) {
645 		fragno = fragstoblks(fs, cgbno);
646 		ffs_setblock(fs, blksfree, fragno);
647 		freeblocks++;
648 	} else {
649 		/*
650 		 * deallocate the fragment
651 		 */
652 		for (i = 0; i < frags; i++)
653 			if ((mask & (1 << i)) == 0 && isclr(blksfree, cgbno +i)) {
654 				freefrags++;
655 				setbit(blksfree, cgbno + i);
656 			}
657 	}
658 	sc->sc_dirty = 1;
659 }
660 
661 /*
662  * Returns 1 if the whole block starting at 'bno' is marked free and 0
663  * otherwise.
664  */
665 static int
666 blk_isfree(ufs2_daddr_t bno)
667 {
668 	struct suj_cg *sc;
669 
670 	sc = cg_lookup(dtog(fs, bno));
671 	return ffs_isblock(fs, cg_blksfree(sc->sc_cgp), dtogd(fs, bno));
672 }
673 
674 /*
675  * Fetch an indirect block to find the block at a given lbn.  The lbn
676  * may be negative to fetch a specific indirect block pointer or positive
677  * to fetch a specific block.
678  */
679 static ufs2_daddr_t
680 indir_blkatoff(ufs2_daddr_t blk, ino_t ino, ufs_lbn_t cur, ufs_lbn_t lbn)
681 {
682 	ufs2_daddr_t *bap2;
683 	ufs2_daddr_t *bap1;
684 	ufs_lbn_t lbnadd;
685 	ufs_lbn_t base;
686 	int level;
687 	int i;
688 
689 	if (blk == 0)
690 		return (0);
691 	level = lbn_level(cur);
692 	if (level == -1)
693 		err_suj("Invalid indir lbn %jd\n", lbn);
694 	if (level == 0 && lbn < 0)
695 		err_suj("Invalid lbn %jd\n", lbn);
696 	bap2 = (void *)dblk_read(blk, fs->fs_bsize);
697 	bap1 = (void *)bap2;
698 	lbnadd = 1;
699 	base = -(cur + level);
700 	for (i = level; i > 0; i--)
701 		lbnadd *= NINDIR(fs);
702 	if (lbn > 0)
703 		i = (lbn - base) / lbnadd;
704 	else
705 		i = (-lbn - base) / lbnadd;
706 	if (i < 0 || i >= NINDIR(fs))
707 		err_suj("Invalid indirect index %d produced by lbn %jd\n",
708 		    i, lbn);
709 	if (level == 0)
710 		cur = base + (i * lbnadd);
711 	else
712 		cur = -(base + (i * lbnadd)) - (level - 1);
713 	if (fs->fs_magic == FS_UFS1_MAGIC)
714 		blk = bap1[i];
715 	else
716 		blk = bap2[i];
717 	if (cur == lbn)
718 		return (blk);
719 	if (level == 0)
720 		err_suj("Invalid lbn %jd at level 0\n", lbn);
721 	return indir_blkatoff(blk, ino, cur, lbn);
722 }
723 
724 /*
725  * Finds the disk block address at the specified lbn within the inode
726  * specified by ip.  This follows the whole tree and honors di_size and
727  * di_extsize so it is a true test of reachability.  The lbn may be
728  * negative if an extattr or indirect block is requested.
729  */
730 static ufs2_daddr_t
731 ino_blkatoff(union dinode *ip, ino_t ino, ufs_lbn_t lbn, int *frags)
732 {
733 	ufs_lbn_t tmpval;
734 	ufs_lbn_t cur;
735 	ufs_lbn_t next;
736 	int i;
737 
738 	/*
739 	 * Handle extattr blocks first.
740 	 */
741 	if (lbn < 0 && lbn >= -UFS_NXADDR) {
742 		lbn = -1 - lbn;
743 		if (lbn > lblkno(fs, ip->dp2.di_extsize - 1))
744 			return (0);
745 		*frags = numfrags(fs, sblksize(fs, ip->dp2.di_extsize, lbn));
746 		return (ip->dp2.di_extb[lbn]);
747 	}
748 	/*
749 	 * Now direct and indirect.
750 	 */
751 	if (DIP(ip, di_mode) == IFLNK &&
752 	    DIP(ip, di_size) < fs->fs_maxsymlinklen)
753 		return (0);
754 	if (lbn >= 0 && lbn < UFS_NDADDR) {
755 		*frags = numfrags(fs, sblksize(fs, DIP(ip, di_size), lbn));
756 		return (DIP(ip, di_db[lbn]));
757 	}
758 	*frags = fs->fs_frag;
759 
760 	for (i = 0, tmpval = NINDIR(fs), cur = UFS_NDADDR; i < UFS_NIADDR; i++,
761 	    tmpval *= NINDIR(fs), cur = next) {
762 		next = cur + tmpval;
763 		if (lbn == -cur - i)
764 			return (DIP(ip, di_ib[i]));
765 		/*
766 		 * Determine whether the lbn in question is within this tree.
767 		 */
768 		if (lbn < 0 && -lbn >= next)
769 			continue;
770 		if (lbn > 0 && lbn >= next)
771 			continue;
772 		return indir_blkatoff(DIP(ip, di_ib[i]), ino, -cur - i, lbn);
773 	}
774 	err_suj("lbn %jd not in ino\n", lbn);
775 	/* NOTREACHED */
776 }
777 
778 /*
779  * Determine whether a block exists at a particular lbn in an inode.
780  * Returns 1 if found, 0 if not.  lbn may be negative for indirects
781  * or ext blocks.
782  */
783 static int
784 blk_isat(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, int *frags)
785 {
786 	union dinode *ip;
787 	ufs2_daddr_t nblk;
788 
789 	ip = ino_read(ino);
790 
791 	if (DIP(ip, di_nlink) == 0 || DIP(ip, di_mode) == 0)
792 		return (0);
793 	nblk = ino_blkatoff(ip, ino, lbn, frags);
794 
795 	return (nblk == blk);
796 }
797 
798 /*
799  * Clear the directory entry at diroff that should point to child.  Minimal
800  * checking is done and it is assumed that this path was verified with isat.
801  */
802 static void
803 ino_clrat(ino_t parent, off_t diroff, ino_t child)
804 {
805 	union dinode *dip;
806 	struct direct *dp;
807 	ufs2_daddr_t blk;
808 	uint8_t *block;
809 	ufs_lbn_t lbn;
810 	int blksize;
811 	int frags;
812 	int doff;
813 
814 	if (debug)
815 		printf("Clearing inode %ju from parent %ju at offset %jd\n",
816 		    (uintmax_t)child, (uintmax_t)parent, diroff);
817 
818 	lbn = lblkno(fs, diroff);
819 	doff = blkoff(fs, diroff);
820 	dip = ino_read(parent);
821 	blk = ino_blkatoff(dip, parent, lbn, &frags);
822 	blksize = sblksize(fs, DIP(dip, di_size), lbn);
823 	block = dblk_read(blk, blksize);
824 	dp = (struct direct *)&block[doff];
825 	if (dp->d_ino != child)
826 		errx(1, "Inode %ju does not exist in %ju at %jd",
827 		    (uintmax_t)child, (uintmax_t)parent, diroff);
828 	dp->d_ino = 0;
829 	dblk_dirty(blk);
830 	/*
831 	 * The actual .. reference count will already have been removed
832 	 * from the parent by the .. remref record.
833 	 */
834 }
835 
836 /*
837  * Determines whether a pointer to an inode exists within a directory
838  * at a specified offset.  Returns the mode of the found entry.
839  */
840 static int
841 ino_isat(ino_t parent, off_t diroff, ino_t child, int *mode, int *isdot)
842 {
843 	union dinode *dip;
844 	struct direct *dp;
845 	ufs2_daddr_t blk;
846 	uint8_t *block;
847 	ufs_lbn_t lbn;
848 	int blksize;
849 	int frags;
850 	int dpoff;
851 	int doff;
852 
853 	*isdot = 0;
854 	dip = ino_read(parent);
855 	*mode = DIP(dip, di_mode);
856 	if ((*mode & IFMT) != IFDIR) {
857 		if (debug) {
858 			/*
859 			 * This can happen if the parent inode
860 			 * was reallocated.
861 			 */
862 			if (*mode != 0)
863 				printf("Directory %ju has bad mode %o\n",
864 				    (uintmax_t)parent, *mode);
865 			else
866 				printf("Directory %ju has zero mode\n",
867 				    (uintmax_t)parent);
868 		}
869 		return (0);
870 	}
871 	lbn = lblkno(fs, diroff);
872 	doff = blkoff(fs, diroff);
873 	blksize = sblksize(fs, DIP(dip, di_size), lbn);
874 	if (diroff + DIRECTSIZ(1) > DIP(dip, di_size) || doff >= blksize) {
875 		if (debug)
876 			printf("ino %ju absent from %ju due to offset %jd"
877 			    " exceeding size %jd\n",
878 			    (uintmax_t)child, (uintmax_t)parent, diroff,
879 			    DIP(dip, di_size));
880 		return (0);
881 	}
882 	blk = ino_blkatoff(dip, parent, lbn, &frags);
883 	if (blk <= 0) {
884 		if (debug)
885 			printf("Sparse directory %ju", (uintmax_t)parent);
886 		return (0);
887 	}
888 	block = dblk_read(blk, blksize);
889 	/*
890 	 * Walk through the records from the start of the block to be
891 	 * certain we hit a valid record and not some junk in the middle
892 	 * of a file name.  Stop when we reach or pass the expected offset.
893 	 */
894 	dpoff = rounddown(doff, DIRBLKSIZ);
895 	do {
896 		dp = (struct direct *)&block[dpoff];
897 		if (dpoff == doff)
898 			break;
899 		if (dp->d_reclen == 0)
900 			break;
901 		dpoff += dp->d_reclen;
902 	} while (dpoff <= doff);
903 	if (dpoff > fs->fs_bsize)
904 		err_suj("Corrupt directory block in dir ino %ju\n",
905 		    (uintmax_t)parent);
906 	/* Not found. */
907 	if (dpoff != doff) {
908 		if (debug)
909 			printf("ino %ju not found in %ju, lbn %jd, dpoff %d\n",
910 			    (uintmax_t)child, (uintmax_t)parent, lbn, dpoff);
911 		return (0);
912 	}
913 	/*
914 	 * We found the item in question.  Record the mode and whether it's
915 	 * a . or .. link for the caller.
916 	 */
917 	if (dp->d_ino == child) {
918 		if (child == parent)
919 			*isdot = 1;
920 		else if (dp->d_namlen == 2 &&
921 		    dp->d_name[0] == '.' && dp->d_name[1] == '.')
922 			*isdot = 1;
923 		*mode = DTTOIF(dp->d_type);
924 		return (1);
925 	}
926 	if (debug)
927 		printf("ino %ju doesn't match dirent ino %ju in parent %ju\n",
928 		    (uintmax_t)child, (uintmax_t)dp->d_ino, (uintmax_t)parent);
929 	return (0);
930 }
931 
932 #define	VISIT_INDIR	0x0001
933 #define	VISIT_EXT	0x0002
934 #define	VISIT_ROOT	0x0004	/* Operation came via root & valid pointers. */
935 
936 /*
937  * Read an indirect level which may or may not be linked into an inode.
938  */
939 static void
940 indir_visit(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, uint64_t *frags,
941     ino_visitor visitor, int flags)
942 {
943 	ufs2_daddr_t *bap2;
944 	ufs1_daddr_t *bap1;
945 	ufs_lbn_t lbnadd;
946 	ufs2_daddr_t nblk;
947 	ufs_lbn_t nlbn;
948 	int level;
949 	int i;
950 
951 	/*
952 	 * Don't visit indirect blocks with contents we can't trust.  This
953 	 * should only happen when indir_visit() is called to complete a
954 	 * truncate that never finished and not when a pointer is found via
955 	 * an inode.
956 	 */
957 	if (blk == 0)
958 		return;
959 	level = lbn_level(lbn);
960 	if (level == -1)
961 		err_suj("Invalid level for lbn %jd\n", lbn);
962 	if ((flags & VISIT_ROOT) == 0 && blk_isindir(blk, ino, lbn) == 0) {
963 		if (debug)
964 			printf("blk %jd ino %ju lbn %jd(%d) is not indir.\n",
965 			    blk, (uintmax_t)ino, lbn, level);
966 		goto out;
967 	}
968 	lbnadd = 1;
969 	for (i = level; i > 0; i--)
970 		lbnadd *= NINDIR(fs);
971 	bap1 = (void *)dblk_read(blk, fs->fs_bsize);
972 	bap2 = (void *)bap1;
973 	for (i = 0; i < NINDIR(fs); i++) {
974 		if (fs->fs_magic == FS_UFS1_MAGIC)
975 			nblk = *bap1++;
976 		else
977 			nblk = *bap2++;
978 		if (nblk == 0)
979 			continue;
980 		if (level == 0) {
981 			nlbn = -lbn + i * lbnadd;
982 			(*frags) += fs->fs_frag;
983 			visitor(ino, nlbn, nblk, fs->fs_frag);
984 		} else {
985 			nlbn = (lbn + 1) - (i * lbnadd);
986 			indir_visit(ino, nlbn, nblk, frags, visitor, flags);
987 		}
988 	}
989 out:
990 	if (flags & VISIT_INDIR) {
991 		(*frags) += fs->fs_frag;
992 		visitor(ino, lbn, blk, fs->fs_frag);
993 	}
994 }
995 
996 /*
997  * Visit each block in an inode as specified by 'flags' and call a
998  * callback function.  The callback may inspect or free blocks.  The
999  * count of frags found according to the size in the file is returned.
1000  * This is not valid for sparse files but may be used to determine
1001  * the correct di_blocks for a file.
1002  */
1003 static uint64_t
1004 ino_visit(union dinode *ip, ino_t ino, ino_visitor visitor, int flags)
1005 {
1006 	ufs_lbn_t nextlbn;
1007 	ufs_lbn_t tmpval;
1008 	ufs_lbn_t lbn;
1009 	uint64_t size;
1010 	uint64_t fragcnt;
1011 	int mode;
1012 	int frags;
1013 	int i;
1014 
1015 	size = DIP(ip, di_size);
1016 	mode = DIP(ip, di_mode) & IFMT;
1017 	fragcnt = 0;
1018 	if ((flags & VISIT_EXT) &&
1019 	    fs->fs_magic == FS_UFS2_MAGIC && ip->dp2.di_extsize) {
1020 		for (i = 0; i < UFS_NXADDR; i++) {
1021 			if (ip->dp2.di_extb[i] == 0)
1022 				continue;
1023 			frags = sblksize(fs, ip->dp2.di_extsize, i);
1024 			frags = numfrags(fs, frags);
1025 			fragcnt += frags;
1026 			visitor(ino, -1 - i, ip->dp2.di_extb[i], frags);
1027 		}
1028 	}
1029 	/* Skip datablocks for short links and devices. */
1030 	if (mode == IFBLK || mode == IFCHR ||
1031 	    (mode == IFLNK && size < fs->fs_maxsymlinklen))
1032 		return (fragcnt);
1033 	for (i = 0; i < UFS_NDADDR; i++) {
1034 		if (DIP(ip, di_db[i]) == 0)
1035 			continue;
1036 		frags = sblksize(fs, size, i);
1037 		frags = numfrags(fs, frags);
1038 		fragcnt += frags;
1039 		visitor(ino, i, DIP(ip, di_db[i]), frags);
1040 	}
1041 	/*
1042 	 * We know the following indirects are real as we're following
1043 	 * real pointers to them.
1044 	 */
1045 	flags |= VISIT_ROOT;
1046 	for (i = 0, tmpval = NINDIR(fs), lbn = UFS_NDADDR; i < UFS_NIADDR; i++,
1047 	    lbn = nextlbn) {
1048 		nextlbn = lbn + tmpval;
1049 		tmpval *= NINDIR(fs);
1050 		if (DIP(ip, di_ib[i]) == 0)
1051 			continue;
1052 		indir_visit(ino, -lbn - i, DIP(ip, di_ib[i]), &fragcnt, visitor,
1053 		    flags);
1054 	}
1055 	return (fragcnt);
1056 }
1057 
1058 /*
1059  * Null visitor function used when we just want to count blocks and
1060  * record the lbn.
1061  */
1062 ufs_lbn_t visitlbn;
1063 static void
1064 null_visit(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, int frags)
1065 {
1066 	if (lbn > 0)
1067 		visitlbn = lbn;
1068 }
1069 
1070 /*
1071  * Recalculate di_blocks when we discover that a block allocation or
1072  * free was not successfully completed.  The kernel does not roll this back
1073  * because it would be too expensive to compute which indirects were
1074  * reachable at the time the inode was written.
1075  */
1076 static void
1077 ino_adjblks(struct suj_ino *sino)
1078 {
1079 	union dinode *ip;
1080 	uint64_t blocks;
1081 	uint64_t frags;
1082 	off_t isize;
1083 	off_t size;
1084 	ino_t ino;
1085 
1086 	ino = sino->si_ino;
1087 	ip = ino_read(ino);
1088 	/* No need to adjust zero'd inodes. */
1089 	if (DIP(ip, di_mode) == 0)
1090 		return;
1091 	/*
1092 	 * Visit all blocks and count them as well as recording the last
1093 	 * valid lbn in the file.  If the file size doesn't agree with the
1094 	 * last lbn we need to truncate to fix it.  Otherwise just adjust
1095 	 * the blocks count.
1096 	 */
1097 	visitlbn = 0;
1098 	frags = ino_visit(ip, ino, null_visit, VISIT_INDIR | VISIT_EXT);
1099 	blocks = fsbtodb(fs, frags);
1100 	/*
1101 	 * We assume the size and direct block list is kept coherent by
1102 	 * softdep.  For files that have extended into indirects we truncate
1103 	 * to the size in the inode or the maximum size permitted by
1104 	 * populated indirects.
1105 	 */
1106 	if (visitlbn >= UFS_NDADDR) {
1107 		isize = DIP(ip, di_size);
1108 		size = lblktosize(fs, visitlbn + 1);
1109 		if (isize > size)
1110 			isize = size;
1111 		/* Always truncate to free any unpopulated indirects. */
1112 		ino_trunc(sino->si_ino, isize);
1113 		return;
1114 	}
1115 	if (blocks == DIP(ip, di_blocks))
1116 		return;
1117 	if (debug)
1118 		printf("ino %ju adjusting block count from %jd to %jd\n",
1119 		    (uintmax_t)ino, DIP(ip, di_blocks), blocks);
1120 	DIP_SET(ip, di_blocks, blocks);
1121 	ino_dirty(ino);
1122 }
1123 
1124 static void
1125 blk_free_visit(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, int frags)
1126 {
1127 
1128 	blk_free(blk, blk_freemask(blk, ino, lbn, frags), frags);
1129 }
1130 
1131 /*
1132  * Free a block or tree of blocks that was previously rooted in ino at
1133  * the given lbn.  If the lbn is an indirect all children are freed
1134  * recursively.
1135  */
1136 static void
1137 blk_free_lbn(ufs2_daddr_t blk, ino_t ino, ufs_lbn_t lbn, int frags, int follow)
1138 {
1139 	uint64_t resid;
1140 	int mask;
1141 
1142 	mask = blk_freemask(blk, ino, lbn, frags);
1143 	resid = 0;
1144 	if (lbn <= -UFS_NDADDR && follow && mask == 0)
1145 		indir_visit(ino, lbn, blk, &resid, blk_free_visit, VISIT_INDIR);
1146 	else
1147 		blk_free(blk, mask, frags);
1148 }
1149 
1150 static void
1151 ino_setskip(struct suj_ino *sino, ino_t parent)
1152 {
1153 	int isdot;
1154 	int mode;
1155 
1156 	if (ino_isat(sino->si_ino, DOTDOT_OFFSET, parent, &mode, &isdot))
1157 		sino->si_skipparent = 1;
1158 }
1159 
1160 static void
1161 ino_remref(ino_t parent, ino_t child, uint64_t diroff, int isdotdot)
1162 {
1163 	struct suj_ino *sino;
1164 	struct suj_rec *srec;
1165 	struct jrefrec *rrec;
1166 
1167 	/*
1168 	 * Lookup this inode to see if we have a record for it.
1169 	 */
1170 	sino = ino_lookup(child, 0);
1171 	/*
1172 	 * Tell any child directories we've already removed their
1173 	 * parent link cnt.  Don't try to adjust our link down again.
1174 	 */
1175 	if (sino != NULL && isdotdot == 0)
1176 		ino_setskip(sino, parent);
1177 	/*
1178 	 * No valid record for this inode.  Just drop the on-disk
1179 	 * link by one.
1180 	 */
1181 	if (sino == NULL || sino->si_hasrecs == 0) {
1182 		ino_decr(child);
1183 		return;
1184 	}
1185 	/*
1186 	 * Use ino_adjust() if ino_check() has already processed this
1187 	 * child.  If we lose the last non-dot reference to a
1188 	 * directory it will be discarded.
1189 	 */
1190 	if (sino->si_linkadj) {
1191 		sino->si_nlink--;
1192 		if (isdotdot)
1193 			sino->si_dotlinks--;
1194 		ino_adjust(sino);
1195 		return;
1196 	}
1197 	/*
1198 	 * If we haven't yet processed this inode we need to make
1199 	 * sure we will successfully discover the lost path.  If not
1200 	 * use nlinkadj to remember.
1201 	 */
1202 	TAILQ_FOREACH(srec, &sino->si_recs, sr_next) {
1203 		rrec = (struct jrefrec *)srec->sr_rec;
1204 		if (rrec->jr_parent == parent &&
1205 		    rrec->jr_diroff == diroff)
1206 			return;
1207 	}
1208 	sino->si_nlinkadj++;
1209 }
1210 
1211 /*
1212  * Free the children of a directory when the directory is discarded.
1213  */
1214 static void
1215 ino_free_children(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, int frags)
1216 {
1217 	struct suj_ino *sino;
1218 	struct direct *dp;
1219 	off_t diroff;
1220 	uint8_t *block;
1221 	int skipparent;
1222 	int isdotdot;
1223 	int dpoff;
1224 	int size;
1225 
1226 	sino = ino_lookup(ino, 0);
1227 	if (sino)
1228 		skipparent = sino->si_skipparent;
1229 	else
1230 		skipparent = 0;
1231 	size = lfragtosize(fs, frags);
1232 	block = dblk_read(blk, size);
1233 	dp = (struct direct *)&block[0];
1234 	for (dpoff = 0; dpoff < size && dp->d_reclen; dpoff += dp->d_reclen) {
1235 		dp = (struct direct *)&block[dpoff];
1236 		if (dp->d_ino == 0 || dp->d_ino == UFS_WINO)
1237 			continue;
1238 		if (dp->d_namlen == 1 && dp->d_name[0] == '.')
1239 			continue;
1240 		isdotdot = dp->d_namlen == 2 && dp->d_name[0] == '.' &&
1241 		    dp->d_name[1] == '.';
1242 		if (isdotdot && skipparent == 1)
1243 			continue;
1244 		if (debug)
1245 			printf("Directory %ju removing ino %ju name %s\n",
1246 			    (uintmax_t)ino, (uintmax_t)dp->d_ino, dp->d_name);
1247 		diroff = lblktosize(fs, lbn) + dpoff;
1248 		ino_remref(ino, dp->d_ino, diroff, isdotdot);
1249 	}
1250 }
1251 
1252 /*
1253  * Reclaim an inode, freeing all blocks and decrementing all children's
1254  * link counts.  Free the inode back to the cg.
1255  */
1256 static void
1257 ino_reclaim(union dinode *ip, ino_t ino, int mode)
1258 {
1259 	uint32_t gen;
1260 
1261 	if (ino == UFS_ROOTINO)
1262 		err_suj("Attempting to free UFS_ROOTINO\n");
1263 	if (debug)
1264 		printf("Truncating and freeing ino %ju, nlink %d, mode %o\n",
1265 		    (uintmax_t)ino, DIP(ip, di_nlink), DIP(ip, di_mode));
1266 
1267 	/* We are freeing an inode or directory. */
1268 	if ((DIP(ip, di_mode) & IFMT) == IFDIR)
1269 		ino_visit(ip, ino, ino_free_children, 0);
1270 	DIP_SET(ip, di_nlink, 0);
1271 	ino_visit(ip, ino, blk_free_visit, VISIT_EXT | VISIT_INDIR);
1272 	/* Here we have to clear the inode and release any blocks it holds. */
1273 	gen = DIP(ip, di_gen);
1274 	if (fs->fs_magic == FS_UFS1_MAGIC)
1275 		bzero(ip, sizeof(struct ufs1_dinode));
1276 	else
1277 		bzero(ip, sizeof(struct ufs2_dinode));
1278 	DIP_SET(ip, di_gen, gen);
1279 	ino_dirty(ino);
1280 	ino_free(ino, mode);
1281 	return;
1282 }
1283 
1284 /*
1285  * Adjust an inode's link count down by one when a directory goes away.
1286  */
1287 static void
1288 ino_decr(ino_t ino)
1289 {
1290 	union dinode *ip;
1291 	int reqlink;
1292 	int nlink;
1293 	int mode;
1294 
1295 	ip = ino_read(ino);
1296 	nlink = DIP(ip, di_nlink);
1297 	mode = DIP(ip, di_mode);
1298 	if (nlink < 1)
1299 		err_suj("Inode %d link count %d invalid\n", ino, nlink);
1300 	if (mode == 0)
1301 		err_suj("Inode %d has a link of %d with 0 mode\n", ino, nlink);
1302 	nlink--;
1303 	if ((mode & IFMT) == IFDIR)
1304 		reqlink = 2;
1305 	else
1306 		reqlink = 1;
1307 	if (nlink < reqlink) {
1308 		if (debug)
1309 			printf("ino %ju not enough links to live %d < %d\n",
1310 			    (uintmax_t)ino, nlink, reqlink);
1311 		ino_reclaim(ip, ino, mode);
1312 		return;
1313 	}
1314 	DIP_SET(ip, di_nlink, nlink);
1315 	ino_dirty(ino);
1316 }
1317 
1318 /*
1319  * Adjust the inode link count to 'nlink'.  If the count reaches zero
1320  * free it.
1321  */
1322 static void
1323 ino_adjust(struct suj_ino *sino)
1324 {
1325 	struct jrefrec *rrec;
1326 	struct suj_rec *srec;
1327 	struct suj_ino *stmp;
1328 	union dinode *ip;
1329 	nlink_t nlink;
1330 	nlink_t reqlink;
1331 	int recmode;
1332 	int isdot;
1333 	int mode;
1334 	ino_t ino;
1335 
1336 	nlink = sino->si_nlink;
1337 	ino = sino->si_ino;
1338 	mode = sino->si_mode & IFMT;
1339 	/*
1340 	 * If it's a directory with no dot links, it was truncated before
1341 	 * the name was cleared.  We need to clear the dirent that
1342 	 * points at it.
1343 	 */
1344 	if (mode == IFDIR && nlink == 1 && sino->si_dotlinks == 0) {
1345 		sino->si_nlink = nlink = 0;
1346 		TAILQ_FOREACH(srec, &sino->si_recs, sr_next) {
1347 			rrec = (struct jrefrec *)srec->sr_rec;
1348 			if (ino_isat(rrec->jr_parent, rrec->jr_diroff, ino,
1349 			    &recmode, &isdot) == 0)
1350 				continue;
1351 			ino_clrat(rrec->jr_parent, rrec->jr_diroff, ino);
1352 			break;
1353 		}
1354 		if (srec == NULL)
1355 			errx(1, "Directory %ju name not found", (uintmax_t)ino);
1356 	}
1357 	/*
1358 	 * If it's a directory with no real names pointing to it go ahead
1359 	 * and truncate it.  This will free any children.
1360 	 */
1361 	if (mode == IFDIR && nlink - sino->si_dotlinks == 0) {
1362 		sino->si_nlink = nlink = 0;
1363 		/*
1364 		 * Mark any .. links so they know not to free this inode
1365 		 * when they are removed.
1366 		 */
1367 		TAILQ_FOREACH(srec, &sino->si_recs, sr_next) {
1368 			rrec = (struct jrefrec *)srec->sr_rec;
1369 			if (rrec->jr_diroff == DOTDOT_OFFSET) {
1370 				stmp = ino_lookup(rrec->jr_parent, 0);
1371 				if (stmp)
1372 					ino_setskip(stmp, ino);
1373 			}
1374 		}
1375 	}
1376 	ip = ino_read(ino);
1377 	mode = DIP(ip, di_mode) & IFMT;
1378 	if (nlink > UFS_LINK_MAX)
1379 		err_suj("ino %ju nlink manipulation error, new %ju, old %d\n",
1380 		    (uintmax_t)ino, (uintmax_t)nlink, DIP(ip, di_nlink));
1381 	if (debug)
1382 	       printf("Adjusting ino %ju, nlink %ju, old link %d lastmode %o\n",
1383 		    (uintmax_t)ino, (uintmax_t)nlink, DIP(ip, di_nlink),
1384 		    sino->si_mode);
1385 	if (mode == 0) {
1386 		if (debug)
1387 			printf("ino %ju, zero inode freeing bitmap\n",
1388 			    (uintmax_t)ino);
1389 		ino_free(ino, sino->si_mode);
1390 		return;
1391 	}
1392 	/* XXX Should be an assert? */
1393 	if (mode != sino->si_mode && debug)
1394 		printf("ino %ju, mode %o != %o\n",
1395 		    (uintmax_t)ino, mode, sino->si_mode);
1396 	if ((mode & IFMT) == IFDIR)
1397 		reqlink = 2;
1398 	else
1399 		reqlink = 1;
1400 	/* If the inode doesn't have enough links to live, free it. */
1401 	if (nlink < reqlink) {
1402 		if (debug)
1403 			printf("ino %ju not enough links to live %ju < %ju\n",
1404 			    (uintmax_t)ino, (uintmax_t)nlink,
1405 			    (uintmax_t)reqlink);
1406 		ino_reclaim(ip, ino, mode);
1407 		return;
1408 	}
1409 	/* If required write the updated link count. */
1410 	if (DIP(ip, di_nlink) == nlink) {
1411 		if (debug)
1412 			printf("ino %ju, link matches, skipping.\n",
1413 			    (uintmax_t)ino);
1414 		return;
1415 	}
1416 	DIP_SET(ip, di_nlink, nlink);
1417 	ino_dirty(ino);
1418 }
1419 
1420 /*
1421  * Truncate some or all blocks in an indirect, freeing any that are required
1422  * and zeroing the indirect.
1423  */
1424 static void
1425 indir_trunc(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, ufs_lbn_t lastlbn)
1426 {
1427 	ufs2_daddr_t *bap2;
1428 	ufs1_daddr_t *bap1;
1429 	ufs_lbn_t lbnadd;
1430 	ufs2_daddr_t nblk;
1431 	ufs_lbn_t next;
1432 	ufs_lbn_t nlbn;
1433 	int dirty;
1434 	int level;
1435 	int i;
1436 
1437 	if (blk == 0)
1438 		return;
1439 	dirty = 0;
1440 	level = lbn_level(lbn);
1441 	if (level == -1)
1442 		err_suj("Invalid level for lbn %jd\n", lbn);
1443 	lbnadd = 1;
1444 	for (i = level; i > 0; i--)
1445 		lbnadd *= NINDIR(fs);
1446 	bap1 = (void *)dblk_read(blk, fs->fs_bsize);
1447 	bap2 = (void *)bap1;
1448 	for (i = 0; i < NINDIR(fs); i++) {
1449 		if (fs->fs_magic == FS_UFS1_MAGIC)
1450 			nblk = *bap1++;
1451 		else
1452 			nblk = *bap2++;
1453 		if (nblk == 0)
1454 			continue;
1455 		if (level != 0) {
1456 			nlbn = (lbn + 1) - (i * lbnadd);
1457 			/*
1458 			 * Calculate the lbn of the next indirect to
1459 			 * determine if any of this indirect must be
1460 			 * reclaimed.
1461 			 */
1462 			next = -(lbn + level) + ((i+1) * lbnadd);
1463 			if (next <= lastlbn)
1464 				continue;
1465 			indir_trunc(ino, nlbn, nblk, lastlbn);
1466 			/* If all of this indirect was reclaimed, free it. */
1467 			nlbn = next - lbnadd;
1468 			if (nlbn < lastlbn)
1469 				continue;
1470 		} else {
1471 			nlbn = -lbn + i * lbnadd;
1472 			if (nlbn < lastlbn)
1473 				continue;
1474 		}
1475 		dirty = 1;
1476 		blk_free(nblk, 0, fs->fs_frag);
1477 		if (fs->fs_magic == FS_UFS1_MAGIC)
1478 			*(bap1 - 1) = 0;
1479 		else
1480 			*(bap2 - 1) = 0;
1481 	}
1482 	if (dirty)
1483 		dblk_dirty(blk);
1484 }
1485 
1486 /*
1487  * Truncate an inode to the minimum of the given size or the last populated
1488  * block after any over size have been discarded.  The kernel would allocate
1489  * the last block in the file but fsck does not and neither do we.  This
1490  * code never extends files, only shrinks them.
1491  */
1492 static void
1493 ino_trunc(ino_t ino, off_t size)
1494 {
1495 	union dinode *ip;
1496 	ufs2_daddr_t bn;
1497 	uint64_t totalfrags;
1498 	ufs_lbn_t nextlbn;
1499 	ufs_lbn_t lastlbn;
1500 	ufs_lbn_t tmpval;
1501 	ufs_lbn_t lbn;
1502 	ufs_lbn_t i;
1503 	int frags;
1504 	off_t cursize;
1505 	off_t off;
1506 	int mode;
1507 
1508 	ip = ino_read(ino);
1509 	mode = DIP(ip, di_mode) & IFMT;
1510 	cursize = DIP(ip, di_size);
1511 	if (debug)
1512 		printf("Truncating ino %ju, mode %o to size %jd from size %jd\n",
1513 		    (uintmax_t)ino, mode, size, cursize);
1514 
1515 	/* Skip datablocks for short links and devices. */
1516 	if (mode == 0 || mode == IFBLK || mode == IFCHR ||
1517 	    (mode == IFLNK && cursize < fs->fs_maxsymlinklen))
1518 		return;
1519 	/* Don't extend. */
1520 	if (size > cursize)
1521 		size = cursize;
1522 	lastlbn = lblkno(fs, blkroundup(fs, size));
1523 	for (i = lastlbn; i < UFS_NDADDR; i++) {
1524 		if (DIP(ip, di_db[i]) == 0)
1525 			continue;
1526 		frags = sblksize(fs, cursize, i);
1527 		frags = numfrags(fs, frags);
1528 		blk_free(DIP(ip, di_db[i]), 0, frags);
1529 		DIP_SET(ip, di_db[i], 0);
1530 	}
1531 	/*
1532 	 * Follow indirect blocks, freeing anything required.
1533 	 */
1534 	for (i = 0, tmpval = NINDIR(fs), lbn = UFS_NDADDR; i < UFS_NIADDR; i++,
1535 	    lbn = nextlbn) {
1536 		nextlbn = lbn + tmpval;
1537 		tmpval *= NINDIR(fs);
1538 		/* If we're not freeing any in this indirect range skip it. */
1539 		if (lastlbn >= nextlbn)
1540 			continue;
1541 		if (DIP(ip, di_ib[i]) == 0)
1542 			continue;
1543 		indir_trunc(ino, -lbn - i, DIP(ip, di_ib[i]), lastlbn);
1544 		/* If we freed everything in this indirect free the indir. */
1545 		if (lastlbn > lbn)
1546 			continue;
1547 		blk_free(DIP(ip, di_ib[i]), 0, frags);
1548 		DIP_SET(ip, di_ib[i], 0);
1549 	}
1550 	ino_dirty(ino);
1551 	/*
1552 	 * Now that we've freed any whole blocks that exceed the desired
1553 	 * truncation size, figure out how many blocks remain and what the
1554 	 * last populated lbn is.  We will set the size to this last lbn
1555 	 * rather than worrying about allocating the final lbn as the kernel
1556 	 * would've done.  This is consistent with normal fsck behavior.
1557 	 */
1558 	visitlbn = 0;
1559 	totalfrags = ino_visit(ip, ino, null_visit, VISIT_INDIR | VISIT_EXT);
1560 	if (size > lblktosize(fs, visitlbn + 1))
1561 		size = lblktosize(fs, visitlbn + 1);
1562 	/*
1563 	 * If we're truncating direct blocks we have to adjust frags
1564 	 * accordingly.
1565 	 */
1566 	if (visitlbn < UFS_NDADDR && totalfrags) {
1567 		long oldspace, newspace;
1568 
1569 		bn = DIP(ip, di_db[visitlbn]);
1570 		if (bn == 0)
1571 			err_suj("Bad blk at ino %ju lbn %jd\n",
1572 			    (uintmax_t)ino, visitlbn);
1573 		oldspace = sblksize(fs, cursize, visitlbn);
1574 		newspace = sblksize(fs, size, visitlbn);
1575 		if (oldspace != newspace) {
1576 			bn += numfrags(fs, newspace);
1577 			frags = numfrags(fs, oldspace - newspace);
1578 			blk_free(bn, 0, frags);
1579 			totalfrags -= frags;
1580 		}
1581 	}
1582 	DIP_SET(ip, di_blocks, fsbtodb(fs, totalfrags));
1583 	DIP_SET(ip, di_size, size);
1584 	/*
1585 	 * If we've truncated into the middle of a block or frag we have
1586 	 * to zero it here.  Otherwise the file could extend into
1587 	 * uninitialized space later.
1588 	 */
1589 	off = blkoff(fs, size);
1590 	if (off && DIP(ip, di_mode) != IFDIR) {
1591 		uint8_t *buf;
1592 		long clrsize;
1593 
1594 		bn = ino_blkatoff(ip, ino, visitlbn, &frags);
1595 		if (bn == 0)
1596 			err_suj("Block missing from ino %ju at lbn %jd\n",
1597 			    (uintmax_t)ino, visitlbn);
1598 		clrsize = frags * fs->fs_fsize;
1599 		buf = dblk_read(bn, clrsize);
1600 		clrsize -= off;
1601 		buf += off;
1602 		bzero(buf, clrsize);
1603 		dblk_dirty(bn);
1604 	}
1605 	return;
1606 }
1607 
1608 /*
1609  * Process records available for one inode and determine whether the
1610  * link count is correct or needs adjusting.
1611  */
1612 static void
1613 ino_check(struct suj_ino *sino)
1614 {
1615 	struct suj_rec *srec;
1616 	struct jrefrec *rrec;
1617 	nlink_t dotlinks;
1618 	nlink_t newlinks;
1619 	nlink_t removes;
1620 	nlink_t nlink;
1621 	ino_t ino;
1622 	int isdot;
1623 	int isat;
1624 	int mode;
1625 
1626 	if (sino->si_hasrecs == 0)
1627 		return;
1628 	ino = sino->si_ino;
1629 	rrec = (struct jrefrec *)TAILQ_FIRST(&sino->si_recs)->sr_rec;
1630 	nlink = rrec->jr_nlink;
1631 	newlinks = 0;
1632 	dotlinks = 0;
1633 	removes = sino->si_nlinkadj;
1634 	TAILQ_FOREACH(srec, &sino->si_recs, sr_next) {
1635 		rrec = (struct jrefrec *)srec->sr_rec;
1636 		isat = ino_isat(rrec->jr_parent, rrec->jr_diroff,
1637 		    rrec->jr_ino, &mode, &isdot);
1638 		if (isat && (mode & IFMT) != (rrec->jr_mode & IFMT))
1639 			err_suj("Inode mode/directory type mismatch %o != %o\n",
1640 			    mode, rrec->jr_mode);
1641 		if (debug)
1642 			printf("jrefrec: op %d ino %ju, nlink %ju, parent %ju, "
1643 			    "diroff %jd, mode %o, isat %d, isdot %d\n",
1644 			    rrec->jr_op, (uintmax_t)rrec->jr_ino,
1645 			    (uintmax_t)rrec->jr_nlink,
1646 			    (uintmax_t)rrec->jr_parent,
1647 			    (uintmax_t)rrec->jr_diroff,
1648 			    rrec->jr_mode, isat, isdot);
1649 		mode = rrec->jr_mode & IFMT;
1650 		if (rrec->jr_op == JOP_REMREF)
1651 			removes++;
1652 		newlinks += isat;
1653 		if (isdot)
1654 			dotlinks += isat;
1655 	}
1656 	/*
1657 	 * The number of links that remain are the starting link count
1658 	 * subtracted by the total number of removes with the total
1659 	 * links discovered back in.  An incomplete remove thus
1660 	 * makes no change to the link count but an add increases
1661 	 * by one.
1662 	 */
1663 	if (debug)
1664 		printf(
1665 		    "ino %ju nlink %ju newlinks %ju removes %ju dotlinks %ju\n",
1666 		    (uintmax_t)ino, (uintmax_t)nlink, (uintmax_t)newlinks,
1667 		    (uintmax_t)removes, (uintmax_t)dotlinks);
1668 	nlink += newlinks;
1669 	nlink -= removes;
1670 	sino->si_linkadj = 1;
1671 	sino->si_nlink = nlink;
1672 	sino->si_dotlinks = dotlinks;
1673 	sino->si_mode = mode;
1674 	ino_adjust(sino);
1675 }
1676 
1677 /*
1678  * Process records available for one block and determine whether it is
1679  * still allocated and whether the owning inode needs to be updated or
1680  * a free completed.
1681  */
1682 static void
1683 blk_check(struct suj_blk *sblk)
1684 {
1685 	struct suj_rec *srec;
1686 	struct jblkrec *brec;
1687 	struct suj_ino *sino;
1688 	ufs2_daddr_t blk;
1689 	int mask;
1690 	int frags;
1691 	int isat;
1692 
1693 	/*
1694 	 * Each suj_blk actually contains records for any fragments in that
1695 	 * block.  As a result we must evaluate each record individually.
1696 	 */
1697 	sino = NULL;
1698 	TAILQ_FOREACH(srec, &sblk->sb_recs, sr_next) {
1699 		brec = (struct jblkrec *)srec->sr_rec;
1700 		frags = brec->jb_frags;
1701 		blk = brec->jb_blkno + brec->jb_oldfrags;
1702 		isat = blk_isat(brec->jb_ino, brec->jb_lbn, blk, &frags);
1703 		if (sino == NULL || sino->si_ino != brec->jb_ino) {
1704 			sino = ino_lookup(brec->jb_ino, 1);
1705 			sino->si_blkadj = 1;
1706 		}
1707 		if (debug)
1708 			printf("op %d blk %jd ino %ju lbn %jd frags %d isat %d (%d)\n",
1709 			    brec->jb_op, blk, (uintmax_t)brec->jb_ino,
1710 			    brec->jb_lbn, brec->jb_frags, isat, frags);
1711 		/*
1712 		 * If we found the block at this address we still have to
1713 		 * determine if we need to free the tail end that was
1714 		 * added by adding contiguous fragments from the same block.
1715 		 */
1716 		if (isat == 1) {
1717 			if (frags == brec->jb_frags)
1718 				continue;
1719 			mask = blk_freemask(blk, brec->jb_ino, brec->jb_lbn,
1720 			    brec->jb_frags);
1721 			mask >>= frags;
1722 			blk += frags;
1723 			frags = brec->jb_frags - frags;
1724 			blk_free(blk, mask, frags);
1725 			continue;
1726 		}
1727 		/*
1728 	 	 * The block wasn't found, attempt to free it.  It won't be
1729 		 * freed if it was actually reallocated.  If this was an
1730 		 * allocation we don't want to follow indirects as they
1731 		 * may not be written yet.  Any children of the indirect will
1732 		 * have their own records.  If it's a free we need to
1733 		 * recursively free children.
1734 		 */
1735 		blk_free_lbn(blk, brec->jb_ino, brec->jb_lbn, brec->jb_frags,
1736 		    brec->jb_op == JOP_FREEBLK);
1737 	}
1738 }
1739 
1740 /*
1741  * Walk the list of inode records for this cg and resolve moved and duplicate
1742  * inode references now that we have a complete picture.
1743  */
1744 static void
1745 cg_build(struct suj_cg *sc)
1746 {
1747 	struct suj_ino *sino;
1748 	int i;
1749 
1750 	for (i = 0; i < SUJ_HASHSIZE; i++)
1751 		LIST_FOREACH(sino, &sc->sc_inohash[i], si_next)
1752 			ino_build(sino);
1753 }
1754 
1755 /*
1756  * Handle inodes requiring truncation.  This must be done prior to
1757  * looking up any inodes in directories.
1758  */
1759 static void
1760 cg_trunc(struct suj_cg *sc)
1761 {
1762 	struct suj_ino *sino;
1763 	int i;
1764 
1765 	for (i = 0; i < SUJ_HASHSIZE; i++) {
1766 		LIST_FOREACH(sino, &sc->sc_inohash[i], si_next) {
1767 			if (sino->si_trunc) {
1768 				ino_trunc(sino->si_ino,
1769 				    sino->si_trunc->jt_size);
1770 				sino->si_blkadj = 0;
1771 				sino->si_trunc = NULL;
1772 			}
1773 			if (sino->si_blkadj)
1774 				ino_adjblks(sino);
1775 		}
1776 	}
1777 }
1778 
1779 static void
1780 cg_adj_blk(struct suj_cg *sc)
1781 {
1782 	struct suj_ino *sino;
1783 	int i;
1784 
1785 	for (i = 0; i < SUJ_HASHSIZE; i++) {
1786 		LIST_FOREACH(sino, &sc->sc_inohash[i], si_next) {
1787 			if (sino->si_blkadj)
1788 				ino_adjblks(sino);
1789 		}
1790 	}
1791 }
1792 
1793 /*
1794  * Free any partially allocated blocks and then resolve inode block
1795  * counts.
1796  */
1797 static void
1798 cg_check_blk(struct suj_cg *sc)
1799 {
1800 	struct suj_blk *sblk;
1801 	int i;
1802 
1803 
1804 	for (i = 0; i < SUJ_HASHSIZE; i++)
1805 		LIST_FOREACH(sblk, &sc->sc_blkhash[i], sb_next)
1806 			blk_check(sblk);
1807 }
1808 
1809 /*
1810  * Walk the list of inode records for this cg, recovering any
1811  * changes which were not complete at the time of crash.
1812  */
1813 static void
1814 cg_check_ino(struct suj_cg *sc)
1815 {
1816 	struct suj_ino *sino;
1817 	int i;
1818 
1819 	for (i = 0; i < SUJ_HASHSIZE; i++)
1820 		LIST_FOREACH(sino, &sc->sc_inohash[i], si_next)
1821 			ino_check(sino);
1822 }
1823 
1824 /*
1825  * Write a potentially dirty cg.  Recalculate the summary information and
1826  * update the superblock summary.
1827  */
1828 static void
1829 cg_write(struct suj_cg *sc)
1830 {
1831 	ufs1_daddr_t fragno, cgbno, maxbno;
1832 	u_int8_t *blksfree;
1833 	struct cg *cgp;
1834 	int blk;
1835 	int i;
1836 
1837 	if (sc->sc_dirty == 0)
1838 		return;
1839 	/*
1840 	 * Fix the frag and cluster summary.
1841 	 */
1842 	cgp = sc->sc_cgp;
1843 	cgp->cg_cs.cs_nbfree = 0;
1844 	cgp->cg_cs.cs_nffree = 0;
1845 	bzero(&cgp->cg_frsum, sizeof(cgp->cg_frsum));
1846 	maxbno = fragstoblks(fs, fs->fs_fpg);
1847 	if (fs->fs_contigsumsize > 0) {
1848 		for (i = 1; i <= fs->fs_contigsumsize; i++)
1849 			cg_clustersum(cgp)[i] = 0;
1850 		bzero(cg_clustersfree(cgp), howmany(maxbno, CHAR_BIT));
1851 	}
1852 	blksfree = cg_blksfree(cgp);
1853 	for (cgbno = 0; cgbno < maxbno; cgbno++) {
1854 		if (ffs_isfreeblock(fs, blksfree, cgbno))
1855 			continue;
1856 		if (ffs_isblock(fs, blksfree, cgbno)) {
1857 			ffs_clusteracct(fs, cgp, cgbno, 1);
1858 			cgp->cg_cs.cs_nbfree++;
1859 			continue;
1860 		}
1861 		fragno = blkstofrags(fs, cgbno);
1862 		blk = blkmap(fs, blksfree, fragno);
1863 		ffs_fragacct(fs, blk, cgp->cg_frsum, 1);
1864 		for (i = 0; i < fs->fs_frag; i++)
1865 			if (isset(blksfree, fragno + i))
1866 				cgp->cg_cs.cs_nffree++;
1867 	}
1868 	/*
1869 	 * Update the superblock cg summary from our now correct values
1870 	 * before writing the block.
1871 	 */
1872 	fs->fs_cs(fs, sc->sc_cgx) = cgp->cg_cs;
1873 	if (cgput(&disk, cgp) == -1)
1874 		err_suj("Unable to write cylinder group %d\n", sc->sc_cgx);
1875 }
1876 
1877 /*
1878  * Write out any modified inodes.
1879  */
1880 static void
1881 cg_write_inos(struct suj_cg *sc)
1882 {
1883 	struct ino_blk *iblk;
1884 	int i;
1885 
1886 	for (i = 0; i < SUJ_HASHSIZE; i++)
1887 		LIST_FOREACH(iblk, &sc->sc_iblkhash[i], ib_next)
1888 			if (iblk->ib_dirty)
1889 				iblk_write(iblk);
1890 }
1891 
1892 static void
1893 cg_apply(void (*apply)(struct suj_cg *))
1894 {
1895 	struct suj_cg *scg;
1896 	int i;
1897 
1898 	for (i = 0; i < SUJ_HASHSIZE; i++)
1899 		LIST_FOREACH(scg, &cghash[i], sc_next)
1900 			apply(scg);
1901 }
1902 
1903 /*
1904  * Process the unlinked but referenced file list.  Freeing all inodes.
1905  */
1906 static void
1907 ino_unlinked(void)
1908 {
1909 	union dinode *ip;
1910 	uint16_t mode;
1911 	ino_t inon;
1912 	ino_t ino;
1913 
1914 	ino = fs->fs_sujfree;
1915 	fs->fs_sujfree = 0;
1916 	while (ino != 0) {
1917 		ip = ino_read(ino);
1918 		mode = DIP(ip, di_mode) & IFMT;
1919 		inon = DIP(ip, di_freelink);
1920 		DIP_SET(ip, di_freelink, 0);
1921 		/*
1922 		 * XXX Should this be an errx?
1923 		 */
1924 		if (DIP(ip, di_nlink) == 0) {
1925 			if (debug)
1926 				printf("Freeing unlinked ino %ju mode %o\n",
1927 				    (uintmax_t)ino, mode);
1928 			ino_reclaim(ip, ino, mode);
1929 		} else if (debug)
1930 			printf("Skipping ino %ju mode %o with link %d\n",
1931 			    (uintmax_t)ino, mode, DIP(ip, di_nlink));
1932 		ino = inon;
1933 	}
1934 }
1935 
1936 /*
1937  * Append a new record to the list of records requiring processing.
1938  */
1939 static void
1940 ino_append(union jrec *rec)
1941 {
1942 	struct jrefrec *refrec;
1943 	struct jmvrec *mvrec;
1944 	struct suj_ino *sino;
1945 	struct suj_rec *srec;
1946 
1947 	mvrec = &rec->rec_jmvrec;
1948 	refrec = &rec->rec_jrefrec;
1949 	if (debug && mvrec->jm_op == JOP_MVREF)
1950 		printf("ino move: ino %ju, parent %ju, "
1951 		    "diroff %jd, oldoff %jd\n",
1952 		    (uintmax_t)mvrec->jm_ino, (uintmax_t)mvrec->jm_parent,
1953 		    (uintmax_t)mvrec->jm_newoff, (uintmax_t)mvrec->jm_oldoff);
1954 	else if (debug &&
1955 	    (refrec->jr_op == JOP_ADDREF || refrec->jr_op == JOP_REMREF))
1956 		printf("ino ref: op %d, ino %ju, nlink %ju, "
1957 		    "parent %ju, diroff %jd\n",
1958 		    refrec->jr_op, (uintmax_t)refrec->jr_ino,
1959 		    (uintmax_t)refrec->jr_nlink,
1960 		    (uintmax_t)refrec->jr_parent, (uintmax_t)refrec->jr_diroff);
1961 	sino = ino_lookup(((struct jrefrec *)rec)->jr_ino, 1);
1962 	sino->si_hasrecs = 1;
1963 	srec = errmalloc(sizeof(*srec));
1964 	srec->sr_rec = rec;
1965 	TAILQ_INSERT_TAIL(&sino->si_newrecs, srec, sr_next);
1966 }
1967 
1968 /*
1969  * Add a reference adjustment to the sino list and eliminate dups.  The
1970  * primary loop in ino_build_ref() checks for dups but new ones may be
1971  * created as a result of offset adjustments.
1972  */
1973 static void
1974 ino_add_ref(struct suj_ino *sino, struct suj_rec *srec)
1975 {
1976 	struct jrefrec *refrec;
1977 	struct suj_rec *srn;
1978 	struct jrefrec *rrn;
1979 
1980 	refrec = (struct jrefrec *)srec->sr_rec;
1981 	/*
1982 	 * We walk backwards so that the oldest link count is preserved.  If
1983 	 * an add record conflicts with a remove keep the remove.  Redundant
1984 	 * removes are eliminated in ino_build_ref.  Otherwise we keep the
1985 	 * oldest record at a given location.
1986 	 */
1987 	for (srn = TAILQ_LAST(&sino->si_recs, srechd); srn;
1988 	    srn = TAILQ_PREV(srn, srechd, sr_next)) {
1989 		rrn = (struct jrefrec *)srn->sr_rec;
1990 		if (rrn->jr_parent != refrec->jr_parent ||
1991 		    rrn->jr_diroff != refrec->jr_diroff)
1992 			continue;
1993 		if (rrn->jr_op == JOP_REMREF || refrec->jr_op == JOP_ADDREF) {
1994 			rrn->jr_mode = refrec->jr_mode;
1995 			return;
1996 		}
1997 		/*
1998 		 * Adding a remove.
1999 		 *
2000 		 * Replace the record in place with the old nlink in case
2001 		 * we replace the head of the list.  Abandon srec as a dup.
2002 		 */
2003 		refrec->jr_nlink = rrn->jr_nlink;
2004 		srn->sr_rec = srec->sr_rec;
2005 		return;
2006 	}
2007 	TAILQ_INSERT_TAIL(&sino->si_recs, srec, sr_next);
2008 }
2009 
2010 /*
2011  * Create a duplicate of a reference at a previous location.
2012  */
2013 static void
2014 ino_dup_ref(struct suj_ino *sino, struct jrefrec *refrec, off_t diroff)
2015 {
2016 	struct jrefrec *rrn;
2017 	struct suj_rec *srn;
2018 
2019 	rrn = errmalloc(sizeof(*refrec));
2020 	*rrn = *refrec;
2021 	rrn->jr_op = JOP_ADDREF;
2022 	rrn->jr_diroff = diroff;
2023 	srn = errmalloc(sizeof(*srn));
2024 	srn->sr_rec = (union jrec *)rrn;
2025 	ino_add_ref(sino, srn);
2026 }
2027 
2028 /*
2029  * Add a reference to the list at all known locations.  We follow the offset
2030  * changes for a single instance and create duplicate add refs at each so
2031  * that we can tolerate any version of the directory block.  Eliminate
2032  * removes which collide with adds that are seen in the journal.  They should
2033  * not adjust the link count down.
2034  */
2035 static void
2036 ino_build_ref(struct suj_ino *sino, struct suj_rec *srec)
2037 {
2038 	struct jrefrec *refrec;
2039 	struct jmvrec *mvrec;
2040 	struct suj_rec *srp;
2041 	struct suj_rec *srn;
2042 	struct jrefrec *rrn;
2043 	off_t diroff;
2044 
2045 	refrec = (struct jrefrec *)srec->sr_rec;
2046 	/*
2047 	 * Search for a mvrec that matches this offset.  Whether it's an add
2048 	 * or a remove we can delete the mvref after creating a dup record in
2049 	 * the old location.
2050 	 */
2051 	if (!TAILQ_EMPTY(&sino->si_movs)) {
2052 		diroff = refrec->jr_diroff;
2053 		for (srn = TAILQ_LAST(&sino->si_movs, srechd); srn; srn = srp) {
2054 			srp = TAILQ_PREV(srn, srechd, sr_next);
2055 			mvrec = (struct jmvrec *)srn->sr_rec;
2056 			if (mvrec->jm_parent != refrec->jr_parent ||
2057 			    mvrec->jm_newoff != diroff)
2058 				continue;
2059 			diroff = mvrec->jm_oldoff;
2060 			TAILQ_REMOVE(&sino->si_movs, srn, sr_next);
2061 			free(srn);
2062 			ino_dup_ref(sino, refrec, diroff);
2063 		}
2064 	}
2065 	/*
2066 	 * If a remove wasn't eliminated by an earlier add just append it to
2067 	 * the list.
2068 	 */
2069 	if (refrec->jr_op == JOP_REMREF) {
2070 		ino_add_ref(sino, srec);
2071 		return;
2072 	}
2073 	/*
2074 	 * Walk the list of records waiting to be added to the list.  We
2075 	 * must check for moves that apply to our current offset and remove
2076 	 * them from the list.  Remove any duplicates to eliminate removes
2077 	 * with corresponding adds.
2078 	 */
2079 	TAILQ_FOREACH_SAFE(srn, &sino->si_newrecs, sr_next, srp) {
2080 		switch (srn->sr_rec->rec_jrefrec.jr_op) {
2081 		case JOP_ADDREF:
2082 			/*
2083 			 * This should actually be an error we should
2084 			 * have a remove for every add journaled.
2085 			 */
2086 			rrn = (struct jrefrec *)srn->sr_rec;
2087 			if (rrn->jr_parent != refrec->jr_parent ||
2088 			    rrn->jr_diroff != refrec->jr_diroff)
2089 				break;
2090 			TAILQ_REMOVE(&sino->si_newrecs, srn, sr_next);
2091 			break;
2092 		case JOP_REMREF:
2093 			/*
2094 			 * Once we remove the current iteration of the
2095 			 * record at this address we're done.
2096 			 */
2097 			rrn = (struct jrefrec *)srn->sr_rec;
2098 			if (rrn->jr_parent != refrec->jr_parent ||
2099 			    rrn->jr_diroff != refrec->jr_diroff)
2100 				break;
2101 			TAILQ_REMOVE(&sino->si_newrecs, srn, sr_next);
2102 			ino_add_ref(sino, srec);
2103 			return;
2104 		case JOP_MVREF:
2105 			/*
2106 			 * Update our diroff based on any moves that match
2107 			 * and remove the move.
2108 			 */
2109 			mvrec = (struct jmvrec *)srn->sr_rec;
2110 			if (mvrec->jm_parent != refrec->jr_parent ||
2111 			    mvrec->jm_oldoff != refrec->jr_diroff)
2112 				break;
2113 			ino_dup_ref(sino, refrec, mvrec->jm_oldoff);
2114 			refrec->jr_diroff = mvrec->jm_newoff;
2115 			TAILQ_REMOVE(&sino->si_newrecs, srn, sr_next);
2116 			break;
2117 		default:
2118 			err_suj("ino_build_ref: Unknown op %d\n",
2119 			    srn->sr_rec->rec_jrefrec.jr_op);
2120 		}
2121 	}
2122 	ino_add_ref(sino, srec);
2123 }
2124 
2125 /*
2126  * Walk the list of new records and add them in-order resolving any
2127  * dups and adjusted offsets.
2128  */
2129 static void
2130 ino_build(struct suj_ino *sino)
2131 {
2132 	struct suj_rec *srec;
2133 
2134 	while ((srec = TAILQ_FIRST(&sino->si_newrecs)) != NULL) {
2135 		TAILQ_REMOVE(&sino->si_newrecs, srec, sr_next);
2136 		switch (srec->sr_rec->rec_jrefrec.jr_op) {
2137 		case JOP_ADDREF:
2138 		case JOP_REMREF:
2139 			ino_build_ref(sino, srec);
2140 			break;
2141 		case JOP_MVREF:
2142 			/*
2143 			 * Add this mvrec to the queue of pending mvs.
2144 			 */
2145 			TAILQ_INSERT_TAIL(&sino->si_movs, srec, sr_next);
2146 			break;
2147 		default:
2148 			err_suj("ino_build: Unknown op %d\n",
2149 			    srec->sr_rec->rec_jrefrec.jr_op);
2150 		}
2151 	}
2152 	if (TAILQ_EMPTY(&sino->si_recs))
2153 		sino->si_hasrecs = 0;
2154 }
2155 
2156 /*
2157  * Modify journal records so they refer to the base block number
2158  * and a start and end frag range.  This is to facilitate the discovery
2159  * of overlapping fragment allocations.
2160  */
2161 static void
2162 blk_build(struct jblkrec *blkrec)
2163 {
2164 	struct suj_rec *srec;
2165 	struct suj_blk *sblk;
2166 	struct jblkrec *blkrn;
2167 	ufs2_daddr_t blk;
2168 	int frag;
2169 
2170 	if (debug)
2171 		printf("blk_build: op %d blkno %jd frags %d oldfrags %d "
2172 		    "ino %ju lbn %jd\n",
2173 		    blkrec->jb_op, (uintmax_t)blkrec->jb_blkno,
2174 		    blkrec->jb_frags, blkrec->jb_oldfrags,
2175 		    (uintmax_t)blkrec->jb_ino, (uintmax_t)blkrec->jb_lbn);
2176 
2177 	blk = blknum(fs, blkrec->jb_blkno);
2178 	frag = fragnum(fs, blkrec->jb_blkno);
2179 	sblk = blk_lookup(blk, 1);
2180 	/*
2181 	 * Rewrite the record using oldfrags to indicate the offset into
2182 	 * the block.  Leave jb_frags as the actual allocated count.
2183 	 */
2184 	blkrec->jb_blkno -= frag;
2185 	blkrec->jb_oldfrags = frag;
2186 	if (blkrec->jb_oldfrags + blkrec->jb_frags > fs->fs_frag)
2187 		err_suj("Invalid fragment count %d oldfrags %d\n",
2188 		    blkrec->jb_frags, frag);
2189 	/*
2190 	 * Detect dups.  If we detect a dup we always discard the oldest
2191 	 * record as it is superseded by the new record.  This speeds up
2192 	 * later stages but also eliminates free records which are used
2193 	 * to indicate that the contents of indirects can be trusted.
2194 	 */
2195 	TAILQ_FOREACH(srec, &sblk->sb_recs, sr_next) {
2196 		blkrn = (struct jblkrec *)srec->sr_rec;
2197 		if (blkrn->jb_ino != blkrec->jb_ino ||
2198 		    blkrn->jb_lbn != blkrec->jb_lbn ||
2199 		    blkrn->jb_blkno != blkrec->jb_blkno ||
2200 		    blkrn->jb_frags != blkrec->jb_frags ||
2201 		    blkrn->jb_oldfrags != blkrec->jb_oldfrags)
2202 			continue;
2203 		if (debug)
2204 			printf("Removed dup.\n");
2205 		/* Discard the free which is a dup with an alloc. */
2206 		if (blkrec->jb_op == JOP_FREEBLK)
2207 			return;
2208 		TAILQ_REMOVE(&sblk->sb_recs, srec, sr_next);
2209 		free(srec);
2210 		break;
2211 	}
2212 	srec = errmalloc(sizeof(*srec));
2213 	srec->sr_rec = (union jrec *)blkrec;
2214 	TAILQ_INSERT_TAIL(&sblk->sb_recs, srec, sr_next);
2215 }
2216 
2217 static void
2218 ino_build_trunc(struct jtrncrec *rec)
2219 {
2220 	struct suj_ino *sino;
2221 
2222 	if (debug)
2223 		printf("ino_build_trunc: op %d ino %ju, size %jd\n",
2224 		    rec->jt_op, (uintmax_t)rec->jt_ino,
2225 		    (uintmax_t)rec->jt_size);
2226 	sino = ino_lookup(rec->jt_ino, 1);
2227 	if (rec->jt_op == JOP_SYNC) {
2228 		sino->si_trunc = NULL;
2229 		return;
2230 	}
2231 	if (sino->si_trunc == NULL || sino->si_trunc->jt_size > rec->jt_size)
2232 		sino->si_trunc = rec;
2233 }
2234 
2235 /*
2236  * Build up tables of the operations we need to recover.
2237  */
2238 static void
2239 suj_build(void)
2240 {
2241 	struct suj_seg *seg;
2242 	union jrec *rec;
2243 	int off;
2244 	int i;
2245 
2246 	TAILQ_FOREACH(seg, &allsegs, ss_next) {
2247 		if (debug)
2248 			printf("seg %jd has %d records, oldseq %jd.\n",
2249 			    seg->ss_rec.jsr_seq, seg->ss_rec.jsr_cnt,
2250 			    seg->ss_rec.jsr_oldest);
2251 		off = 0;
2252 		rec = (union jrec *)seg->ss_blk;
2253 		for (i = 0; i < seg->ss_rec.jsr_cnt; off += JREC_SIZE, rec++) {
2254 			/* skip the segrec. */
2255 			if ((off % real_dev_bsize) == 0)
2256 				continue;
2257 			switch (rec->rec_jrefrec.jr_op) {
2258 			case JOP_ADDREF:
2259 			case JOP_REMREF:
2260 			case JOP_MVREF:
2261 				ino_append(rec);
2262 				break;
2263 			case JOP_NEWBLK:
2264 			case JOP_FREEBLK:
2265 				blk_build((struct jblkrec *)rec);
2266 				break;
2267 			case JOP_TRUNC:
2268 			case JOP_SYNC:
2269 				ino_build_trunc((struct jtrncrec *)rec);
2270 				break;
2271 			default:
2272 				err_suj("Unknown journal operation %d (%d)\n",
2273 				    rec->rec_jrefrec.jr_op, off);
2274 			}
2275 			i++;
2276 		}
2277 	}
2278 }
2279 
2280 /*
2281  * Prune the journal segments to those we care about based on the
2282  * oldest sequence in the newest segment.  Order the segment list
2283  * based on sequence number.
2284  */
2285 static void
2286 suj_prune(void)
2287 {
2288 	struct suj_seg *seg;
2289 	struct suj_seg *segn;
2290 	uint64_t newseq;
2291 	int discard;
2292 
2293 	if (debug)
2294 		printf("Pruning up to %jd\n", oldseq);
2295 	/* First free the expired segments. */
2296 	TAILQ_FOREACH_SAFE(seg, &allsegs, ss_next, segn) {
2297 		if (seg->ss_rec.jsr_seq >= oldseq)
2298 			continue;
2299 		TAILQ_REMOVE(&allsegs, seg, ss_next);
2300 		free(seg->ss_blk);
2301 		free(seg);
2302 	}
2303 	/* Next ensure that segments are ordered properly. */
2304 	seg = TAILQ_FIRST(&allsegs);
2305 	if (seg == NULL) {
2306 		if (debug)
2307 			printf("Empty journal\n");
2308 		return;
2309 	}
2310 	newseq = seg->ss_rec.jsr_seq;
2311 	for (;;) {
2312 		seg = TAILQ_LAST(&allsegs, seghd);
2313 		if (seg->ss_rec.jsr_seq >= newseq)
2314 			break;
2315 		TAILQ_REMOVE(&allsegs, seg, ss_next);
2316 		TAILQ_INSERT_HEAD(&allsegs, seg, ss_next);
2317 		newseq = seg->ss_rec.jsr_seq;
2318 
2319 	}
2320 	if (newseq != oldseq) {
2321 		TAILQ_FOREACH(seg, &allsegs, ss_next) {
2322 			printf("%jd, ", seg->ss_rec.jsr_seq);
2323 		}
2324 		printf("\n");
2325 		err_suj("Journal file sequence mismatch %jd != %jd\n",
2326 		    newseq, oldseq);
2327 	}
2328 	/*
2329 	 * The kernel may asynchronously write segments which can create
2330 	 * gaps in the sequence space.  Throw away any segments after the
2331 	 * gap as the kernel guarantees only those that are contiguously
2332 	 * reachable are marked as completed.
2333 	 */
2334 	discard = 0;
2335 	TAILQ_FOREACH_SAFE(seg, &allsegs, ss_next, segn) {
2336 		if (!discard && newseq++ == seg->ss_rec.jsr_seq) {
2337 			jrecs += seg->ss_rec.jsr_cnt;
2338 			jbytes += seg->ss_rec.jsr_blocks * real_dev_bsize;
2339 			continue;
2340 		}
2341 		discard = 1;
2342 		if (debug)
2343 			printf("Journal order mismatch %jd != %jd pruning\n",
2344 			    newseq-1, seg->ss_rec.jsr_seq);
2345 		TAILQ_REMOVE(&allsegs, seg, ss_next);
2346 		free(seg->ss_blk);
2347 		free(seg);
2348 	}
2349 	if (debug)
2350 		printf("Processing journal segments from %jd to %jd\n",
2351 		    oldseq, newseq-1);
2352 }
2353 
2354 /*
2355  * Verify the journal inode before attempting to read records.
2356  */
2357 static int
2358 suj_verifyino(union dinode *ip)
2359 {
2360 
2361 	if (DIP(ip, di_nlink) != 1) {
2362 		printf("Invalid link count %d for journal inode %ju\n",
2363 		    DIP(ip, di_nlink), (uintmax_t)sujino);
2364 		return (-1);
2365 	}
2366 
2367 	if ((DIP(ip, di_flags) & (SF_IMMUTABLE | SF_NOUNLINK)) !=
2368 	    (SF_IMMUTABLE | SF_NOUNLINK)) {
2369 		printf("Invalid flags 0x%X for journal inode %ju\n",
2370 		    DIP(ip, di_flags), (uintmax_t)sujino);
2371 		return (-1);
2372 	}
2373 
2374 	if (DIP(ip, di_mode) != (IFREG | IREAD)) {
2375 		printf("Invalid mode %o for journal inode %ju\n",
2376 		    DIP(ip, di_mode), (uintmax_t)sujino);
2377 		return (-1);
2378 	}
2379 
2380 	if (DIP(ip, di_size) < SUJ_MIN) {
2381 		printf("Invalid size %jd for journal inode %ju\n",
2382 		    DIP(ip, di_size), (uintmax_t)sujino);
2383 		return (-1);
2384 	}
2385 
2386 	if (DIP(ip, di_modrev) != fs->fs_mtime) {
2387 		printf("Journal timestamp does not match fs mount time\n");
2388 		return (-1);
2389 	}
2390 
2391 	return (0);
2392 }
2393 
2394 struct jblocks {
2395 	struct jextent *jb_extent;	/* Extent array. */
2396 	int		jb_avail;	/* Available extents. */
2397 	int		jb_used;	/* Last used extent. */
2398 	int		jb_head;	/* Allocator head. */
2399 	int		jb_off;		/* Allocator extent offset. */
2400 };
2401 struct jextent {
2402 	ufs2_daddr_t	je_daddr;	/* Disk block address. */
2403 	int		je_blocks;	/* Disk block count. */
2404 };
2405 
2406 static struct jblocks *suj_jblocks;
2407 
2408 static struct jblocks *
2409 jblocks_create(void)
2410 {
2411 	struct jblocks *jblocks;
2412 	int size;
2413 
2414 	jblocks = errmalloc(sizeof(*jblocks));
2415 	jblocks->jb_avail = 10;
2416 	jblocks->jb_used = 0;
2417 	jblocks->jb_head = 0;
2418 	jblocks->jb_off = 0;
2419 	size = sizeof(struct jextent) * jblocks->jb_avail;
2420 	jblocks->jb_extent = errmalloc(size);
2421 	bzero(jblocks->jb_extent, size);
2422 
2423 	return (jblocks);
2424 }
2425 
2426 /*
2427  * Return the next available disk block and the amount of contiguous
2428  * free space it contains.
2429  */
2430 static ufs2_daddr_t
2431 jblocks_next(struct jblocks *jblocks, int bytes, int *actual)
2432 {
2433 	struct jextent *jext;
2434 	ufs2_daddr_t daddr;
2435 	int freecnt;
2436 	int blocks;
2437 
2438 	blocks = bytes / disk.d_bsize;
2439 	jext = &jblocks->jb_extent[jblocks->jb_head];
2440 	freecnt = jext->je_blocks - jblocks->jb_off;
2441 	if (freecnt == 0) {
2442 		jblocks->jb_off = 0;
2443 		if (++jblocks->jb_head > jblocks->jb_used)
2444 			return (0);
2445 		jext = &jblocks->jb_extent[jblocks->jb_head];
2446 		freecnt = jext->je_blocks;
2447 	}
2448 	if (freecnt > blocks)
2449 		freecnt = blocks;
2450 	*actual = freecnt * disk.d_bsize;
2451 	daddr = jext->je_daddr + jblocks->jb_off;
2452 
2453 	return (daddr);
2454 }
2455 
2456 /*
2457  * Advance the allocation head by a specified number of bytes, consuming
2458  * one journal segment.
2459  */
2460 static void
2461 jblocks_advance(struct jblocks *jblocks, int bytes)
2462 {
2463 
2464 	jblocks->jb_off += bytes / disk.d_bsize;
2465 }
2466 
2467 static void
2468 jblocks_destroy(struct jblocks *jblocks)
2469 {
2470 
2471 	free(jblocks->jb_extent);
2472 	free(jblocks);
2473 }
2474 
2475 static void
2476 jblocks_add(struct jblocks *jblocks, ufs2_daddr_t daddr, int blocks)
2477 {
2478 	struct jextent *jext;
2479 	int size;
2480 
2481 	jext = &jblocks->jb_extent[jblocks->jb_used];
2482 	/* Adding the first block. */
2483 	if (jext->je_daddr == 0) {
2484 		jext->je_daddr = daddr;
2485 		jext->je_blocks = blocks;
2486 		return;
2487 	}
2488 	/* Extending the last extent. */
2489 	if (jext->je_daddr + jext->je_blocks == daddr) {
2490 		jext->je_blocks += blocks;
2491 		return;
2492 	}
2493 	/* Adding a new extent. */
2494 	if (++jblocks->jb_used == jblocks->jb_avail) {
2495 		jblocks->jb_avail *= 2;
2496 		size = sizeof(struct jextent) * jblocks->jb_avail;
2497 		jext = errmalloc(size);
2498 		bzero(jext, size);
2499 		bcopy(jblocks->jb_extent, jext,
2500 		    sizeof(struct jextent) * jblocks->jb_used);
2501 		free(jblocks->jb_extent);
2502 		jblocks->jb_extent = jext;
2503 	}
2504 	jext = &jblocks->jb_extent[jblocks->jb_used];
2505 	jext->je_daddr = daddr;
2506 	jext->je_blocks = blocks;
2507 
2508 	return;
2509 }
2510 
2511 /*
2512  * Add a file block from the journal to the extent map.  We can't read
2513  * each file block individually because the kernel treats it as a circular
2514  * buffer and segments may span mutliple contiguous blocks.
2515  */
2516 static void
2517 suj_add_block(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, int frags)
2518 {
2519 
2520 	jblocks_add(suj_jblocks, fsbtodb(fs, blk), fsbtodb(fs, frags));
2521 }
2522 
2523 static void
2524 suj_read(void)
2525 {
2526 	uint8_t block[1 * 1024 * 1024];
2527 	struct suj_seg *seg;
2528 	struct jsegrec *recn;
2529 	struct jsegrec *rec;
2530 	ufs2_daddr_t blk;
2531 	int readsize;
2532 	int blocks;
2533 	int recsize;
2534 	int size;
2535 	int i;
2536 
2537 	/*
2538 	 * Read records until we exhaust the journal space.  If we find
2539 	 * an invalid record we start searching for a valid segment header
2540 	 * at the next block.  This is because we don't have a head/tail
2541 	 * pointer and must recover the information indirectly.  At the gap
2542 	 * between the head and tail we won't necessarily have a valid
2543 	 * segment.
2544 	 */
2545 restart:
2546 	for (;;) {
2547 		size = sizeof(block);
2548 		blk = jblocks_next(suj_jblocks, size, &readsize);
2549 		if (blk == 0)
2550 			return;
2551 		size = readsize;
2552 		/*
2553 		 * Read 1MB at a time and scan for records within this block.
2554 		 */
2555 		if (bread(&disk, blk, &block, size) == -1) {
2556 			err_suj("Error reading journal block %jd\n",
2557 			    (intmax_t)blk);
2558 		}
2559 		for (rec = (void *)block; size; size -= recsize,
2560 		    rec = (struct jsegrec *)((uintptr_t)rec + recsize)) {
2561 			recsize = real_dev_bsize;
2562 			if (rec->jsr_time != fs->fs_mtime) {
2563 				if (debug)
2564 					printf("Rec time %jd != fs mtime %jd\n",
2565 					    rec->jsr_time, fs->fs_mtime);
2566 				jblocks_advance(suj_jblocks, recsize);
2567 				continue;
2568 			}
2569 			if (rec->jsr_cnt == 0) {
2570 				if (debug)
2571 					printf("Found illegal count %d\n",
2572 					    rec->jsr_cnt);
2573 				jblocks_advance(suj_jblocks, recsize);
2574 				continue;
2575 			}
2576 			blocks = rec->jsr_blocks;
2577 			recsize = blocks * real_dev_bsize;
2578 			if (recsize > size) {
2579 				/*
2580 				 * We may just have run out of buffer, restart
2581 				 * the loop to re-read from this spot.
2582 				 */
2583 				if (size < fs->fs_bsize &&
2584 				    size != readsize &&
2585 				    recsize <= fs->fs_bsize)
2586 					goto restart;
2587 				if (debug)
2588 					printf("Found invalid segsize %d > %d\n",
2589 					    recsize, size);
2590 				recsize = real_dev_bsize;
2591 				jblocks_advance(suj_jblocks, recsize);
2592 				continue;
2593 			}
2594 			/*
2595 			 * Verify that all blocks in the segment are present.
2596 			 */
2597 			for (i = 1; i < blocks; i++) {
2598 				recn = (void *)((uintptr_t)rec) + i *
2599 				    real_dev_bsize;
2600 				if (recn->jsr_seq == rec->jsr_seq &&
2601 				    recn->jsr_time == rec->jsr_time)
2602 					continue;
2603 				if (debug)
2604 					printf("Incomplete record %jd (%d)\n",
2605 					    rec->jsr_seq, i);
2606 				recsize = i * real_dev_bsize;
2607 				jblocks_advance(suj_jblocks, recsize);
2608 				goto restart;
2609 			}
2610 			seg = errmalloc(sizeof(*seg));
2611 			seg->ss_blk = errmalloc(recsize);
2612 			seg->ss_rec = *rec;
2613 			bcopy((void *)rec, seg->ss_blk, recsize);
2614 			if (rec->jsr_oldest > oldseq)
2615 				oldseq = rec->jsr_oldest;
2616 			TAILQ_INSERT_TAIL(&allsegs, seg, ss_next);
2617 			jblocks_advance(suj_jblocks, recsize);
2618 		}
2619 	}
2620 }
2621 
2622 /*
2623  * Search a directory block for the SUJ_FILE.
2624  */
2625 static void
2626 suj_find(ino_t ino, ufs_lbn_t lbn, ufs2_daddr_t blk, int frags)
2627 {
2628 	char block[MAXBSIZE];
2629 	struct direct *dp;
2630 	int bytes;
2631 	int off;
2632 
2633 	if (sujino)
2634 		return;
2635 	bytes = lfragtosize(fs, frags);
2636 	if (bread(&disk, fsbtodb(fs, blk), block, bytes) <= 0)
2637 		err_suj("Failed to read UFS_ROOTINO directory block %jd\n",
2638 		    blk);
2639 	for (off = 0; off < bytes; off += dp->d_reclen) {
2640 		dp = (struct direct *)&block[off];
2641 		if (dp->d_reclen == 0)
2642 			break;
2643 		if (dp->d_ino == 0)
2644 			continue;
2645 		if (dp->d_namlen != strlen(SUJ_FILE))
2646 			continue;
2647 		if (bcmp(dp->d_name, SUJ_FILE, dp->d_namlen) != 0)
2648 			continue;
2649 		sujino = dp->d_ino;
2650 		return;
2651 	}
2652 }
2653 
2654 /*
2655  * Orchestrate the verification of a filesystem via the softupdates journal.
2656  */
2657 int
2658 suj_check(const char *filesys)
2659 {
2660 	union dinode *jip;
2661 	union dinode *ip;
2662 	uint64_t blocks;
2663 	int retval;
2664 	struct suj_seg *seg;
2665 	struct suj_seg *segn;
2666 
2667 	initsuj();
2668 	fs = &sblock;
2669 	if (real_dev_bsize == 0 && ioctl(disk.d_fd, DIOCGSECTORSIZE,
2670 	    &real_dev_bsize) == -1)
2671 		real_dev_bsize = secsize;
2672 	if (debug)
2673 		printf("dev_bsize %u\n", real_dev_bsize);
2674 
2675 	/*
2676 	 * Set an exit point when SUJ check failed
2677 	 */
2678 	retval = setjmp(jmpbuf);
2679 	if (retval != 0) {
2680 		pwarn("UNEXPECTED SU+J INCONSISTENCY\n");
2681 		TAILQ_FOREACH_SAFE(seg, &allsegs, ss_next, segn) {
2682 			TAILQ_REMOVE(&allsegs, seg, ss_next);
2683 				free(seg->ss_blk);
2684 				free(seg);
2685 		}
2686 		if (reply("FALLBACK TO FULL FSCK") == 0) {
2687 			ckfini(0);
2688 			exit(EEXIT);
2689 		} else
2690 			return (-1);
2691 	}
2692 
2693 	/*
2694 	 * Find the journal inode.
2695 	 */
2696 	ip = ino_read(UFS_ROOTINO);
2697 	sujino = 0;
2698 	ino_visit(ip, UFS_ROOTINO, suj_find, 0);
2699 	if (sujino == 0) {
2700 		printf("Journal inode removed.  Use tunefs to re-create.\n");
2701 		sblock.fs_flags &= ~FS_SUJ;
2702 		sblock.fs_sujfree = 0;
2703 		return (-1);
2704 	}
2705 	/*
2706 	 * Fetch the journal inode and verify it.
2707 	 */
2708 	jip = ino_read(sujino);
2709 	printf("** SU+J Recovering %s\n", filesys);
2710 	if (suj_verifyino(jip) != 0)
2711 		return (-1);
2712 	/*
2713 	 * Build a list of journal blocks in jblocks before parsing the
2714 	 * available journal blocks in with suj_read().
2715 	 */
2716 	printf("** Reading %jd byte journal from inode %ju.\n",
2717 	    DIP(jip, di_size), (uintmax_t)sujino);
2718 	suj_jblocks = jblocks_create();
2719 	blocks = ino_visit(jip, sujino, suj_add_block, 0);
2720 	if (blocks != numfrags(fs, DIP(jip, di_size))) {
2721 		printf("Sparse journal inode %ju.\n", (uintmax_t)sujino);
2722 		return (-1);
2723 	}
2724 	suj_read();
2725 	jblocks_destroy(suj_jblocks);
2726 	suj_jblocks = NULL;
2727 	if (preen || reply("RECOVER")) {
2728 		printf("** Building recovery table.\n");
2729 		suj_prune();
2730 		suj_build();
2731 		cg_apply(cg_build);
2732 		printf("** Resolving unreferenced inode list.\n");
2733 		ino_unlinked();
2734 		printf("** Processing journal entries.\n");
2735 		cg_apply(cg_trunc);
2736 		cg_apply(cg_check_blk);
2737 		cg_apply(cg_adj_blk);
2738 		cg_apply(cg_check_ino);
2739 	}
2740 	if (preen == 0 && (jrecs > 0 || jbytes > 0) && reply("WRITE CHANGES") == 0)
2741 		return (0);
2742 	/*
2743 	 * To remain idempotent with partial truncations the free bitmaps
2744 	 * must be written followed by indirect blocks and lastly inode
2745 	 * blocks.  This preserves access to the modified pointers until
2746 	 * they are freed.
2747 	 */
2748 	cg_apply(cg_write);
2749 	dblk_write();
2750 	cg_apply(cg_write_inos);
2751 	/* Write back superblock. */
2752 	closedisk(filesys);
2753 	if (jrecs > 0 || jbytes > 0) {
2754 		printf("** %jd journal records in %jd bytes for %.2f%% utilization\n",
2755 		    jrecs, jbytes, ((float)jrecs / (float)(jbytes / JREC_SIZE)) * 100);
2756 		printf("** Freed %jd inodes (%jd dirs) %jd blocks, and %jd frags.\n",
2757 		    freeinos, freedir, freeblocks, freefrags);
2758 	}
2759 
2760 	return (0);
2761 }
2762 
2763 static void
2764 initsuj(void)
2765 {
2766 	int i;
2767 
2768 	for (i = 0; i < SUJ_HASHSIZE; i++) {
2769 		LIST_INIT(&cghash[i]);
2770 		LIST_INIT(&dbhash[i]);
2771 	}
2772 	lastcg = NULL;
2773 	lastblk = NULL;
2774 	TAILQ_INIT(&allsegs);
2775 	oldseq = 0;
2776 	fs = NULL;
2777 	sujino = 0;
2778 	freefrags = 0;
2779 	freeblocks = 0;
2780 	freeinos = 0;
2781 	freedir = 0;
2782 	jbytes = 0;
2783 	jrecs = 0;
2784 	suj_jblocks = NULL;
2785 }
2786