When bcachefs was a C program that had some functions implemented in
Rust, it was necessary to make a static library containing the Rust
functions available for the C program to link.
Now that bcachefs is a Rust program, that library is no longer needed.
Instead, the Rust executable links in libbachefs.a.
This patch updates the crate structure to reflect that. The command
functions are moved into their own module.
There could be a need to create a "libbachefs-tools" library in the
future that exposes an API for bcachefs functionality to other
userspace programs. That will be a different, external API as opposed to
the previous library functions which were an internal API for the
bcachefs tool itself.
Signed-off-by: Thomas Bertschinger <tahbertschinger@gmail.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
The only use for itertools is in parse_mount_options() where we take a
vector, convert it to iterator and then join it. Instead, we can join
the vector directly.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
The memmove() in pop_cmd() reads and writes beyond the end of argv.
This is basically harmless in the current C program; the environment
variable list immediately follows argv so all this does is unnecessarily
copy the beginning of that list.
However, this will become problematic once we start calling C functions
like fs_cmds() from Rust code. Then argv will be a Vec<String> (as
*mut *mut i8) and the memory layout will be different--in particular,
I don't think we can assume that a Vec<String> will be NULL-terminated
like argv always is--, meaning the invalid write could lead to heap
corruption.
Also, it doesn't look like full_cmd ever gets used after calling
pop_cmd() so I'm removing it here since it looks unneeded to me.
Signed-off-by: Thomas Bertschinger <tahbertschinger@gmail.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
block_size is in bytes, not sectors, so when calling round_up(),
we could start rounding up by a way too large size and then overflow
outside the area that migrate allocated for us.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
The bcachefs sub-commands that are implemented in Rust (completions,
list, and mount) had separate entrypoints and thus had some differences
in behavior.
This introduces a common entry point for the Rust sub-commands. This
reduces duplicate boilerplate code like parsing argv and setting up
logging, and will facilitate converting more sub-commands to Rust in
the future.
An immediate benefit is that this fixes an issue with `bcachefs list`
not reporting errors:
before:
$ bcachefs list /dev/typo
$ echo $?
0
after:
$ bcachefs list /dev/typo
ERROR - bcachefs_rust::cmd_list: Fatal error: "No such file or directory"
$ echo $?
1
Signed-off-by: Thomas Bertschinger <tahbertschinger@gmail.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Neal Gompa [Sun, 24 Dec 2023 13:34:16 +0000 (08:34 -0500)]
Makefile, fsck: Use libexec instead of lib
These are executables that need to be installed in a non-path location.
Most distributions now install these into /usr/libexec, and the
path variable for this is LIBEXECDIR, so use that instead.
Kent Overstreet [Sun, 24 Dec 2023 00:37:04 +0000 (19:37 -0500)]
cmd_fsck: -k, run fsck in kernel
This adds a new option to cmd_fsck for using the kernel implementation
of fsck instead of userspace, via the BCH_IOCTL_FSCK_OFFLINE ioctl.
This isn't intended for normal usage - mainly for testing and debugging
purposes, and for when the kernel version of bcachefs better matches the
on disk format version.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Specifically, do not recursively expand $(CFLAGS) because this leads to
repeatedly performing compile tests (e. g. cc-disable-warning) on every
recipe execution.
Without (nproc=32):
```
$ time env -i PATH=/usr/bin BCACHEFS_FUSE=1 NO_RUST=1 make -j$(nproc)
<...>
[LD] bcachefs
72,48s user 11,29s system 190% cpu 44,036 total
```
With:
```
$ time env -i PATH=/usr/bin BCACHEFS_FUSE=1 NO_RUST=1 make -j$(nproc)
<...>
[LD] bcachefs
66,79s user 5,17s system 1955% cpu 3,679 total
```
This adds on to 446ec6b092cc ("docs: mention that libclang is
required"). That commit updated the dependency list for Debian. This
adds the packages needed to get llvm-config for arch and fedora.
Signed-off-by: Thomas Bertschinger <tahbertschinger@gmail.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Kent Overstreet [Wed, 20 Dec 2023 00:17:19 +0000 (19:17 -0500)]
cmd_migrate: fix write_data()
passing a parent closure is totally unnecessary when using
BCH_WRITE_SYNC - and pops an assert in debug mode, because the write
path no longer supports delivering completions that way.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Chris Webb [Sat, 9 Dec 2023 14:31:40 +0000 (14:31 +0000)]
bcachefs-tools: Disable -Wgnu-variable-sized-type-not-at-end for clang
clang's default warnings include -Wgnu-variable-sized-type-not-at-end,
producing a lot of false alarms about the GNU extension for libbcachefs.
Disable these using cc-disable-warning when building with clang.
Signed-off-by: Chris Webb <chris@arachsys.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Chris Webb [Sat, 9 Dec 2023 14:15:08 +0000 (14:15 +0000)]
bcachefs-tools: Guard the __struct_group() #define in kernel.h
Our include/linux/byteorder.h uses the system <asm/byteorder.h>
because we don't provide our own in include/asm. This then pulls in
system <linux/stddef.h> which defines __struct_group. That definition
collides with the unconditional #define __struct_group in our local
include/linux/kernel.h, provoking preprocessor warnings.
Signed-off-by: Chris Webb <chris@arachsys.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Chris Webb [Sat, 9 Dec 2023 12:50:31 +0000 (12:50 +0000)]
bcachefs-tools: Avoid glibc-specific mallinfo() in shrinker
Before 326d7c1, the shrinker used freeram and totalram from a struct
sysinfo (constructed from /proc/meminfo) to target 25% free physical
memory. As well as the slowness of repeatedly reading /proc/meminfo,
this was a problem as freeram rises when the system starts to swap.
We don't want swapping to reduce our estimate of memory pressure.
To work around this, in 326d7c1 the shrinker started to use the total
allocated heap from a glibc-specific interface mallinfo2(), aiming to
shrink such that our heap is less than 80% of physical memory, unless
overall free memory is less than 6% so that becomes the determining factor.
Unfortunately, a sign error in the calculation means this heuristic
never worked. It would shrink aggressively when the process was small,
and not at all when the process grew beyond 80% of physical RAM. Only the
fallback test ensuring the free physical RAM doesn't fall below 6% would
actually kick in under memory pressure. It also breaks portability to
anything other than recent glibc.
Later, in 2440469 the mallinfo2() was replaced with the older mallinfo()
to improve compatibility with older glibc. This is even more problematic:
it's still not portable but also struct mallinfo has (signed) int fields
which overflow for large processes on 32-bit machines with a 3G/1G split.
Rather than trying to use libc-specific debug interfaces and our own heap
to inform the shrinker, use the information about free and total swap
we already have from sysinfo(2) to explicitly compensate for swapping
in our estimate of free physical memory. Target free memory of 6% of
physical RAM adjusted for zero swap use when calculating the pressure
on the shrinker, based on the effective behaviour of 326d7c1 in practice
given the sign error.
As well as fixing portability to non-glibc systems, this loosens the
assumption that we are the only process using significant memory when
setting the shrinker target. It wouldn't be unreasonable to run two
fsck jobs against independent devices on a large RAM machine and want to
balance physical RAM between them.
Signed-off-by: Chris Webb <chris@arachsys.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Chris Webb [Sat, 9 Dec 2023 12:49:12 +0000 (12:49 +0000)]
bcachefs-tools: Use sysinfo(2) directly to implement si_meminfo()
Use a single sysinfo(2) call to fill out struct sysinfo instead of
multiple libc sysconf(3) requests, which will only make sysinfo(2) calls
internally anyway. This also enables us to access other struct sysinfo
fields, not just the three filled-out previously.
As we provide our own definition of struct sysinfo in include/linux/mm.h
to match the kernel, which is not guaranteed to align with the definition
libc provides in <sys/sysinfo.h>, use syscall(SYS_sysinfo, ...) directly
instead of the libc wrapper.
Signed-off-by: Chris Webb <chris@arachsys.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Tero Roponen [Fri, 8 Dec 2023 08:10:52 +0000 (10:10 +0200)]
bcachefs-tools: make 'all' the default Makefile goal
"fsck/bcachefsck_all:" coming before "all:" in the Makefile
causes the bcachefs binary not being built by default. Fix
this by explicitly setting the .DEFAULT_GOAL=all.
Signed-off-by: Tero Roponen <tero.roponen@gmail.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Darrick J. Wong [Tue, 5 Dec 2023 02:43:31 +0000 (18:43 -0800)]
fsck: add a service to schedule and run bcachefsck@ services
Create a script that looks for mounted bcachefs filesystems and tries to
run as many of them in parallel as possible without two different
scrubbers hitting the same low level block device.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Darrick J. Wong [Tue, 5 Dec 2023 02:43:31 +0000 (18:43 -0800)]
fsck: add systemd service definitions for automatic online service
Add some systemd service files so that bcachefs can automatically fsck
mounted filesystems in the background. Hopefully with minimal
disruption to frontend operations.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Multiple small fuse fixes for write, api, and hardlink
* changed in Makefile to use recomended fuse api 35;
* force foreground mode, because fuse_daemonize is forking after initalization other bcachefs threads;
* fix fuse_link, there where mistype in fuse_log (the paremeter need to be inum.inum);
* The write_aligned is fixed, by wrapping struct bch_write_op into container with single closure and using end_io callback to release
that closure.
Kent Overstreet [Tue, 5 Dec 2023 23:28:14 +0000 (18:28 -0500)]
Disable shrinker thread shutdown
We seem to be hitting a rare crash in the exit path of fsck - when
shutting down the shrinker thread. Disable exiting the shrinker thread
as a workaround.
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Darrick J. Wong [Tue, 5 Dec 2023 00:44:29 +0000 (19:44 -0500)]
misc: don't allow udisks to automount bcachefs filesystems with no prompt
The unending stream of syzbot bug reports and overwrought filing of CVEs
for corner case handling (i.e. things that distract from actual user
complaints) in XFS has generated all sorts of of overheated rhetoric
about how every bug is a Serious Security Issue(tm) because anyone can
craft a malicious filesystem on a USB stick, insert the stick into a
victim machine, and mount will trigger a bug in the kernel driver that
leads to some compromise or DoS or something.
I thought that nobody would be foolish enough to automount an XFS
filesystem. What a fool I was! It turns out that udisks can be told
that it's okay to automount things, and then GNOME will do exactly that.
Including mounting mangled XFS filesystems! Same with bcachefs!
<delete angry rant about poor decisionmaking and armchair fs developers
blasting us on X while not actually doing any of the work>
Turn off /this/ idiocy by adding a udev rule to tell udisks not to
automount bcachefs filesystems.
This will not stop a logged in user from unwittingly inserting a
malicious storage device and pressing [mount] and getting breached.
This is not a substitute for a thorough audit. This is not a substitute
for lklfuse. This does not solve the general problem of in-kernel fs
drivers being a huge attack surface. I just want to give Kent a break
from some of the oceans of bu******.
Signed-off-by: Darrick J. Wong <djwong@kernel.org> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Brian Foster [Mon, 27 Nov 2023 18:31:10 +0000 (13:31 -0500)]
bcachefs-tools: don't skip stale superblock wipe in force mode
Even though the blkid wipe has been fixed to detect and wipe old
superblocks, we still incorrectly skip the wipe when in force mode.
Update the force logic in open_for_format() to bypass the user
request and otherwise proceed with the wipe.
Signed-off-by: Brian Foster <bfoster@redhat.com> Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
projects / bcachefs-tools-debian / log