// SPDX-License-Identifier: GPL-2.0
#include "bcachefs.h"

#include "btree/cache.h"
#include "btree/iter.h"

#include "fs/namei.h"

#include "journal/journal.h"

#include "init/dev.h"
#include "init/error.h"
#include "init/passes.h"
#include "init/fs.h"

#include "util/thread_with_file.h"

#define FSCK_ERR_RATELIMIT_NR	10

void __bch2_log_msg_start(const char *fs_or_dev_name, struct printbuf *out)
{
	printbuf_indent_add_nextline(out, 2);

#ifdef BCACHEFS_LOG_PREFIX
	prt_printf(out, "bcachefs (%s): ", fs_or_dev_name);
#endif
}

bool __bch2_inconsistent_error(struct bch_fs *c, struct printbuf *out)
{
	set_bit(BCH_FS_error, &c->flags);

	switch (c->opts.errors) {
	case BCH_ON_ERROR_continue:
		return false;
	case BCH_ON_ERROR_fix_safe:
	case BCH_ON_ERROR_ro:
		bch2_fs_emergency_read_only(c, out);
		return true;
	case BCH_ON_ERROR_panic:
		bch2_print_str(c, KERN_ERR, out->buf);
		panic(bch2_fmt(c, "panic after error"));
		return true;
	default:
		BUG();
	}
}

bool bch2_inconsistent_error(struct bch_fs *c)
{
	CLASS(printbuf, buf)();
	guard(printbuf_atomic)(&buf);

	printbuf_indent_add_nextline(&buf, 2);

	bool ret = __bch2_inconsistent_error(c, &buf);
	if (ret)
		bch_err(c, "%s", buf.buf);
	return ret;
}

__printf(3, 0)
static bool bch2_fs_trans_inconsistent(struct bch_fs *c, struct btree_trans *trans,
				       const char *fmt, va_list args)
{
	CLASS(printbuf, buf)();
	guard(printbuf_atomic)(&buf);

	bch2_log_msg_start(c, &buf);

	prt_vprintf(&buf, fmt, args);
	prt_newline(&buf);

	if (trans)
		bch2_trans_updates_to_text(&buf, trans);
	bool ret = __bch2_inconsistent_error(c, &buf);
	bch2_print_str(c, KERN_ERR, buf.buf);
	return ret;
}

bool bch2_fs_inconsistent(struct bch_fs *c, const char *fmt, ...)
{
	va_list args;
	va_start(args, fmt);
	bool ret = bch2_fs_trans_inconsistent(c, NULL, fmt, args);
	va_end(args);
	return ret;
}

bool bch2_trans_inconsistent(struct btree_trans *trans, const char *fmt, ...)
{
	va_list args;
	va_start(args, fmt);
	bool ret = bch2_fs_trans_inconsistent(trans->c, trans, fmt, args);
	va_end(args);
	return ret;
}

int __bch2_topology_error(struct bch_fs *c, struct printbuf *out)
{
	prt_printf(out, "btree topology error: ");

	set_bit(BCH_FS_topology_error, &c->flags);
	if (!test_bit(BCH_FS_in_recovery, &c->flags)) {
		__bch2_inconsistent_error(c, out);
		return bch_err_throw(c, btree_need_topology_repair);
	} else {
		return bch2_run_explicit_recovery_pass(c, out, BCH_RECOVERY_PASS_check_topology, 0) ?:
			bch_err_throw(c, btree_need_topology_repair);
	}
}

int bch2_fs_topology_error(struct bch_fs *c, const char *fmt, ...)
{
	CLASS(bch_log_msg, msg)(c);

	va_list args;
	va_start(args, fmt);
	prt_vprintf(&msg.m, fmt, args);
	va_end(args);

	return __bch2_topology_error(c, &msg.m);
}

void bch2_fatal_error(struct bch_fs *c, const char *func, const char *fmt, ...)
{
	CLASS(bch_log_msg, msg)(c);
	msg.m.suppress = true; /* only print if this message caused us to go RO */

	prt_printf(&msg.m, "%s(): fatal error ", func);

	va_list args;
	va_start(args, fmt);
	prt_vprintf(&msg.m, fmt, args);
	va_end(args);

	prt_newline(&msg.m);

	bch2_fs_emergency_read_only(c, &msg.m);
	prt_printf(&msg.m, "fatal error - emergency read only");
}

void bch2_io_error_work(struct work_struct *work)
{
	struct bch_dev *ca = container_of(work, struct bch_dev, io_error_work);
	struct bch_fs *c = ca->fs;

	/* XXX: if it's reads or checksums that are failing, set it to failed */

	unsigned long write_errors_start = READ_ONCE(ca->write_errors_start);

	if (write_errors_start &&
	    time_after(jiffies,
		       write_errors_start + c->opts.write_error_timeout * HZ)) {
		guard(rwsem_write)(&c->state_lock);

		/*
		 * We hold ref_outer, not ca->ref: device removal may have
		 * completed while we waited for state_lock, and the member
		 * slot is no longer ours to touch. Same if the fs is
		 * shutting down - don't flip member states mid-teardown.
		 * Never cancelled: we own a ref, so teardown drains us
		 * instead (bch2_dev_free()) and we always run and put:
		 */
		if (!READ_ONCE(ca->removing) &&
		    !test_bit(BCH_FS_stopping, &c->flags) &&
		    ca->mi.state < BCH_MEMBER_STATE_ro) {
			bool print = true;
			CLASS(printbuf, buf)();
			__bch2_log_msg_start(ca->name, &buf);

			prt_printf(&buf, "writes erroring for %u seconds\n",
				c->opts.write_error_timeout);

			bool dev = !__bch2_dev_set_state(c, ca, BCH_MEMBER_STATE_ro,
							 BCH_FORCE_IF_DEGRADED, &buf);

			prt_printf(&buf, "setting %s ro", dev ? "device" : "filesystem");
			if (!dev)
				print = bch2_fs_emergency_read_only(c, &buf);

			if (print)
				bch2_print_str(c, KERN_ERR, buf.buf);
		}
	}

	bch2_dev_put_outer(ca);
}

void bch2_io_error(struct bch_dev *ca, enum bch_member_error_type type)
{
	atomic64_inc(&ca->errors[type]);

	if (type == BCH_MEMBER_ERROR_write && !ca->write_errors_start)
		ca->write_errors_start = jiffies;

	/*
	 * The work blocks on state_lock, which device removal holds while
	 * draining ca->ref - so it owns a ref_outer (memory lifetime only),
	 * never a ca->ref. One ref per queued instance:
	 */
	bch2_dev_get_outer(ca);
	if (!queue_work(system_long_wq, &ca->io_error_work))
		bch2_dev_put_outer(ca);
}

enum ask_yn {
	YN_NO,
	YN_YES,
	YN_ALLNO,
	YN_ALLYES,
};

static enum ask_yn parse_yn_response(char *buf)
{
	buf = strim(buf);

	if (strlen(buf) == 1)
		switch (buf[0]) {
		case 'n':
			return YN_NO;
		case 'y':
			return YN_YES;
		case 'N':
			return YN_ALLNO;
		case 'Y':
			return YN_ALLYES;
		}
	return -1;
}

#ifdef __KERNEL__
static enum ask_yn bch2_fsck_ask_yn(struct bch_fs *c, struct btree_trans *trans)
{
	struct stdio_redirect *stdio = bch2_fs_stdio_redirect_user(c);

	if (!stdio)
		return YN_NO;

	if (trans)
		bch2_trans_unlock(trans);

	unsigned long unlock_long_at = trans ? jiffies + HZ * 2 : 0;
	darray_char line = {};
	int ret;

	do {
		unsigned long t;
		bch2_print_str_user(c, " (y,n, or Y,N for all errors of this type) ");
rewait:
		t = unlock_long_at
			? max_t(long, unlock_long_at - jiffies, 0)
			: MAX_SCHEDULE_TIMEOUT;

		int r = bch2_stdio_redirect_readline_timeout(stdio, &line, t);
		if (r == -ETIME) {
			bch2_trans_unlock_long(trans);
			unlock_long_at = 0;
			goto rewait;
		}

		if (r < 0) {
			ret = YN_NO;
			break;
		}

		darray_last(line) = '\0';
	} while ((ret = parse_yn_response(line.data)) < 0);

	darray_exit(&line);
	return ret;
}
#else

#include "tools-util.h"

static enum ask_yn bch2_fsck_ask_yn(struct bch_fs *c, struct btree_trans *trans)
{
	char *buf = NULL;
	size_t buflen = 0;
	int ret;

	do {
		fputs(" (y,n, or Y,N for all errors of this type) ", stdout);
		fflush(stdout);

		if (getline(&buf, &buflen, stdin) < 0)
			die("error reading from standard input");
	} while ((ret = parse_yn_response(buf)) < 0);

	free(buf);
	return ret;
}

#endif

static struct fsck_err_state *fsck_err_get(struct bch_fs *c,
					   enum bch_sb_error_id id)
{
	darray_for_each(c->errors.msgs, i)
		if ((*i)->id == id)
			return *i;

	struct fsck_err_state *s = kzalloc(sizeof(*s), GFP_NOIO);
	if (!s) {
		if (!c->errors.msgs_alloc_err)
			bch_err(c, "kmalloc err, cannot ratelimit fsck errs");
		c->errors.msgs_alloc_err = true;
		return NULL;
	}

	s->id = id;

	if (darray_push(&c->errors.msgs, s)) {
		if (!c->errors.msgs_alloc_err)
			bch_err(c, "kmalloc err, cannot ratelimit fsck errs");
		c->errors.msgs_alloc_err = true;
		kfree(s);
		return NULL;
	}

	return s;
}

static int fsck_err_nr_cmp(const void *_l, const void *_r)
{
	const struct fsck_err_state *l = *((const struct fsck_err_state **) _l);
	const struct fsck_err_state *r = *((const struct fsck_err_state **) _r);

	return cmp_int(r->nr, l->nr);
}

void bch2_fsck_err_counts_to_text(struct printbuf *out, struct bch_fs *c)
{
	guard(mutex)(&c->errors.msgs_lock);

	sort_nonatomic(c->errors.msgs.data, c->errors.msgs.nr,
		       sizeof(c->errors.msgs.data[0]), fsck_err_nr_cmp, NULL);

	darray_for_each(c->errors.msgs, i) {
		bch2_sb_error_id_to_text(out, (*i)->id);
		prt_printf(out, "\t%llu\n", (*i)->nr);
	}
}

/* s/fix?/fixing/ s/recreate?/recreating/ */
static void prt_actioning(struct printbuf *out, const char *action)
{
	unsigned len = strlen(action);

	BUG_ON(action[len - 1] != '?');
	--len;

	if (action[len - 1] == 'e')
		--len;

	prt_bytes(out, action, len);
	prt_str(out, "ing");
}

static const u8 fsck_flags_extra[] = {
#define x(t, n, flags)		[BCH_FSCK_ERR_##t] = flags,
	BCH_SB_ERRS()
#undef x
};

static int do_fsck_ask_yn(struct bch_fs *c,
			  struct btree_trans *trans,
			  struct printbuf *question,
			  const char *action)
{
	prt_str(question, ", ");
	prt_str(question, action);

	bch2_print_str_user(c, question->buf);

	int ask = bch2_fsck_ask_yn(c, trans);

	if (trans) {
		int ret = bch2_trans_relock(trans);
		if (ret)
			return ret;
	}

	return ask;
}

static struct fsck_err_state *count_fsck_err_locked(struct bch_fs *c,
			  enum bch_sb_error_id id, const char *msg,
			  bool *repeat, bool *print, bool *suppress)
{
	bch2_sb_error_count(c, id);

	struct fsck_err_state *s = fsck_err_get(c, id);
	if (s) {
		/*
		 * We may be called multiple times for the same error on
		 * transaction restart - this memoizes instead of asking the user
		 * multiple times for the same error:
		 */
		if (s->last_msg && !strcmp(msg, s->last_msg)) {
			*repeat = true;
			*print = false;
			return s;
		}

		kfree(s->last_msg);
		s->last_msg = kstrdup(msg, GFP_KERNEL);

		if (c->opts.ratelimit_errors &&
		    s->nr >= FSCK_ERR_RATELIMIT_NR) {
			if (s->nr == FSCK_ERR_RATELIMIT_NR)
				*suppress = true;
			else
				*print = false;
		}

		s->nr++;
	}
	return s;
}

bool __bch2_count_fsck_err(struct bch_fs *c,
			   enum bch_sb_error_id id, struct printbuf *msg)
{
	bch2_sb_error_count(c, id);

	bool print = true, repeat = false, suppress = false;

	scoped_guard(mutex, &c->errors.msgs_lock)
		count_fsck_err_locked(c, id, msg->buf, &repeat, &print, &suppress);

	if (suppress)
		prt_printf(msg, "Ratelimiting new instances of previous error\n");

	return print && !repeat;
}

int bch2_fsck_err_opt(struct bch_fs *c,
		      enum bch_fsck_flags flags,
		      enum bch_sb_error_id err)
{
	if (!WARN_ON(err >= ARRAY_SIZE(fsck_flags_extra)))
		flags |= fsck_flags_extra[err];

	if (test_bit(BCH_FS_in_fsck, &c->flags) ||
	    c->opts.fix_errors != FSCK_FIX_exit) {
		if (!(flags & (FSCK_CAN_FIX|FSCK_CAN_IGNORE)))
			return bch_err_throw(c, fsck_repair_unimplemented);

		switch (c->opts.fix_errors) {
		case FSCK_FIX_exit:
			return bch_err_throw(c, fsck_errors_not_fixed);
		case FSCK_FIX_yes:
			if (flags & FSCK_CAN_FIX)
				return bch_err_throw(c, fsck_fix);
			fallthrough;
		case FSCK_FIX_no:
			if (flags & FSCK_CAN_IGNORE)
				return bch_err_throw(c, fsck_ignore);
			return bch_err_throw(c, fsck_errors_not_fixed);
		case FSCK_FIX_ask:
			if (flags & FSCK_AUTOFIX)
				return bch_err_throw(c, fsck_fix);
			return bch_err_throw(c, fsck_ask);
		default:
			BUG();
		}
	} else {
		if ((flags & FSCK_AUTOFIX) &&
		    (c->opts.errors == BCH_ON_ERROR_continue ||
		     c->opts.errors == BCH_ON_ERROR_fix_safe))
			return bch_err_throw(c, fsck_fix);

		if (c->opts.errors == BCH_ON_ERROR_continue &&
		    (flags & FSCK_CAN_IGNORE))
			return bch_err_throw(c, fsck_ignore);
		return bch_err_throw(c, fsck_errors_not_fixed);
	}
}

int __bch2_fsck_err(struct bch_fs *c,
		  struct btree_trans *trans,
		  struct bpos pos,
		  enum bch_fsck_flags flags,
		  enum bch_sb_error_id err,
		  const char *fmt, ...)
{
	va_list args;
	CLASS(printbuf, buf)();
	struct printbuf *out = &buf;
	int ret = 0;
	const char *action_orig = "fix?", *action = action_orig;

	might_sleep();

	if (!WARN_ON(err >= ARRAY_SIZE(fsck_flags_extra)))
		flags |= fsck_flags_extra[err];

	if (!c)
		c = trans->c;

	/*
	 * An inode-scoped error (pos != POS_MIN) records damage against the
	 * inode before the outcome below is decided: the error is the damage,
	 * whether or not we fix it - and silent/ratelimited instances still
	 * record (recording is idempotent).
	 */
	if (!bpos_eq(pos, POS_MIN) && !WARN_ON(!trans))
		try(bch2_damage_record(trans, pos, err));

	/*
	 * Ugly: if there's a transaction in the current task it has to be
	 * passed in to unlock if we prompt for user input.
	 *
	 * But, plumbing a transaction and transaction restarts into
	 * bkey_validate() is problematic.
	 *
	 * So:
	 * - make all bkey errors AUTOFIX, they're simple anyways (we just
	 *   delete the key)
	 * - and we don't need to warn if we're not prompting
	 */
	WARN_ON((flags & FSCK_CAN_FIX) &&
		!(flags & FSCK_AUTOFIX) &&
		!trans &&
		bch2_current_has_btree_trans(c));

	if ((flags & FSCK_ERR_SILENT) ||
	    test_bit(err, c->sb.errors_silent)) {
		set_bit(BCH_FS_errors_fixed_silent, &c->flags);
		return flags & FSCK_CAN_FIX
			? bch_err_throw(c, fsck_fix)
			: bch_err_throw(c, fsck_ignore);
	}

	printbuf_indent_add_nextline(out, 2);

#ifdef BCACHEFS_LOG_PREFIX
	if (strncmp(fmt, "bcachefs", 8))
		prt_printf(out, bch2_log_msg(c, ""));
#endif

	va_start(args, fmt);
	prt_vprintf(out, fmt, args);
	va_end(args);

	/* Custom fix/continue/recreate/etc.? */
	if (out->buf[out->pos - 1] == '?') {
		const char *p = strrchr(out->buf, ',');
		if (p) {
			out->pos = p - out->buf;
			action = kstrdup(p + 2, GFP_KERNEL);
			if (!action) {
				ret = -ENOMEM;
				goto err;
			}
		}
	}

	mutex_lock(&c->errors.msgs_lock);
	bool repeat = false, print = true, suppress = false;
	bool inconsistent = false, exiting = false;
	struct fsck_err_state *s =
		count_fsck_err_locked(c, err, buf.buf, &repeat, &print, &suppress);
	if (repeat) {
		ret = s->ret;
		goto err_unlock;
	}

	if ((flags & FSCK_AUTOFIX) &&
	    (c->opts.errors == BCH_ON_ERROR_continue ||
	     c->opts.errors == BCH_ON_ERROR_fix_safe)) {
		prt_str(out, ", ");
		if (flags & FSCK_CAN_FIX) {
			prt_actioning(out, action);
			ret = bch_err_throw(c, fsck_fix);
		} else {
			prt_str(out, ", continuing");
			ret = bch_err_throw(c, fsck_ignore);
		}

		goto print;
	} else if (!test_bit(BCH_FS_in_fsck, &c->flags)) {
		if (c->opts.errors != BCH_ON_ERROR_continue ||
		    !(flags & (FSCK_CAN_FIX|FSCK_CAN_IGNORE))) {
			if (flags & FSCK_AUTOFIX)
				prt_printf(out, ", shutting down\n"
						 "error is autofix, but errors=%s prevents self-healing\n"
						 "run fsck or set errors=fix_safe to allow self-healing",
					   bch2_error_actions[c->opts.errors]);
			else if (flags & (FSCK_CAN_FIX|FSCK_CAN_IGNORE))
				prt_str(out, ", shutting down\n"
						 "error is fixable, but not marked safe for self-healing\n"
						 "run fsck");
			else
				prt_str(out, ", shutting down\n"
						 "error not marked as autofix and not in fsck\n"
						 "run fsck, and forward to devs so error can be marked for self-healing");
			inconsistent = true;
			print = true;
			ret = bch_err_throw(c, fsck_errors_not_fixed);
		} else if (flags & FSCK_CAN_FIX) {
			prt_str(out, ", ");
			prt_actioning(out, action);
			ret = bch_err_throw(c, fsck_fix);
		} else {
			prt_str(out, ", continuing");
			ret = bch_err_throw(c, fsck_ignore);
		}
	} else if (c->opts.fix_errors == FSCK_FIX_exit) {
		prt_str(out, ", exiting");
		ret = bch_err_throw(c, fsck_errors_not_fixed);
	} else if (flags & FSCK_CAN_FIX) {
		int fix = s && s->fix
			? s->fix
			: c->opts.fix_errors;

		if (fix == FSCK_FIX_ask) {
			print = false;

			ret = do_fsck_ask_yn(c, trans, out, action);
			if (ret < 0)
				goto err_unlock;

			if (ret >= YN_ALLNO && s)
				s->fix = ret == YN_ALLNO
					? FSCK_FIX_no
					: FSCK_FIX_yes;

			ret = ret & 1
				? bch_err_throw(c, fsck_fix)
				: bch_err_throw(c, fsck_ignore);
		} else if (fix == FSCK_FIX_yes ||
			   (c->opts.nochanges &&
			    !(flags & FSCK_CAN_IGNORE))) {
			prt_str(out, ", ");
			prt_actioning(out, action);
			ret = bch_err_throw(c, fsck_fix);
		} else {
			prt_str(out, ", not ");
			prt_actioning(out, action);
			ret = bch_err_throw(c, fsck_ignore);
		}
	} else {
		if (flags & FSCK_CAN_IGNORE) {
			prt_str(out, ", continuing");
			ret = bch_err_throw(c, fsck_ignore);
		} else {
			prt_str(out, " (repair unimplemented)");
			ret = bch_err_throw(c, fsck_repair_unimplemented);
		}
	}

	if (bch2_err_matches(ret, BCH_ERR_fsck_ignore) &&
	    (c->opts.fix_errors == FSCK_FIX_exit ||
	     !(flags & FSCK_CAN_IGNORE)))
		ret = bch_err_throw(c, fsck_errors_not_fixed);

	if (test_bit(BCH_FS_in_fsck, &c->flags) &&
	    (!bch2_err_matches(ret, BCH_ERR_fsck_fix) &&
	     !bch2_err_matches(ret, BCH_ERR_fsck_ignore))) {
		exiting = true;
		print = true;
	}
print:
	prt_newline(out);

	if (inconsistent)
		__bch2_inconsistent_error(c, out);
	else if (exiting)
		prt_printf(out, "Unable to continue, halting\n");
	else if (suppress)
		prt_printf(out, "Ratelimiting new instances of previous error\n");

	if (print) {
		/* possibly strip an empty line, from printbuf_indent_add */
		while (out->pos && out->buf[out->pos - 1] == ' ')
			--out->pos;
		printbuf_nul_terminate(out);

		bch2_print_str_user(c, out->buf);
	}

	if (s)
		s->ret = ret;
err_unlock:
	mutex_unlock(&c->errors.msgs_lock);
err:
	if (trans &&
	    !(flags & FSCK_ERR_NO_LOG) &&
	    ret == -BCH_ERR_fsck_fix)
		ret = bch2_trans_log_str(trans, bch2_sb_error_strs[err]) ?: ret;

	/*
	 * We don't yet track whether the filesystem currently has errors, for
	 * log_fsck_err()s: that would require us to track for every error type
	 * which recovery pass corrects it, to get the fsck exit status correct:
	 */
	if (bch2_err_matches(ret, BCH_ERR_transaction_restart)) {
		/* nothing */
	} else if (bch2_err_matches(ret, BCH_ERR_fsck_fix)) {
		set_bit(BCH_FS_errors_fixed, &c->flags);
	} else {
		set_bit(BCH_FS_errors_not_fixed, &c->flags);
		set_bit(BCH_FS_error, &c->flags);
	}

	if (action != action_orig)
		kfree(action);

	BUG_ON(!ret);
	return ret;
}

static const char * const bch2_bkey_validate_contexts[] = {
#define x(n) #n,
	BKEY_VALIDATE_CONTEXTS()
#undef x
	NULL
};

int __bch2_bkey_fsck_err(struct bch_fs *c,
			 struct bkey_s_c k,
			 const struct bkey_validate_context *from,
			 enum bch_sb_error_id err,
			 const char *fmt, ...)
{
	if (from->flags & BCH_VALIDATE_silent)
		return bch_err_throw(c, fsck_delete_bkey);

	unsigned fsck_flags = 0;
	if (!(from->flags & (BCH_VALIDATE_write|BCH_VALIDATE_commit))) {
		if (test_bit(err, c->sb.errors_silent))
			return bch_err_throw(c, fsck_delete_bkey);

		fsck_flags |= FSCK_AUTOFIX|FSCK_CAN_FIX;
	}
	if (!WARN_ON(err >= ARRAY_SIZE(fsck_flags_extra)))
		fsck_flags |= fsck_flags_extra[err];

	CLASS(printbuf, buf)();
	prt_printf(&buf, "invalid bkey in %s",
		   bch2_bkey_validate_contexts[from->from]);

	if (from->from == BKEY_VALIDATE_journal)
		prt_printf(&buf, " journal seq=%llu offset=%u",
			   from->journal_seq, from->journal_offset);

	prt_str(&buf, " btree=");
	bch2_btree_id_to_text(&buf, from->btree);
	prt_printf(&buf, " level=%u: ", from->level);

	bch2_bkey_val_to_text(&buf, c, k);
	prt_newline(&buf);

	va_list args;
	va_start(args, fmt);
	prt_vprintf(&buf, fmt, args);
	va_end(args);

	int ret = __bch2_fsck_err(c, NULL, POS_MIN, fsck_flags, err, "%s, delete?", buf.buf);
	return ret;
}

static void __bch2_flush_fsck_errs(struct bch_fs *c, bool print)
{
	guard(mutex)(&c->errors.msgs_lock);

	darray_for_each(c->errors.msgs, i) {
		struct fsck_err_state *s = *i;

		if (print && s->ratelimited && s->last_msg)
			bch_err(c, "Saw %llu errors like:\n  %s", s->nr, s->last_msg);

		kfree(s->last_msg);
		kfree(s);
	}

	darray_exit(&c->errors.msgs);
}

void bch2_flush_fsck_errs(struct bch_fs *c)
{
	__bch2_flush_fsck_errs(c, true);
}

void bch2_free_fsck_errs(struct bch_fs *c)
{
	__bch2_flush_fsck_errs(c, false);
}

/*
 * Paths damaged during fsck, remembered for the end-of-fsck summary - see
 * struct fsck_damaged_path. Recorded when an inode-scoped error is reported
 * (__bch2_fsck_err() with a pos), deduped by (inum, snapshot) with error ids
 * merged. Dedup is what makes this restart-safe: an error re-reported after a
 * transaction restart just re-merges the same id.
 */

#define FSCK_DAMAGED_PATHS_MAX	4096
#define FSCK_DAMAGED_PATHS_PRINT 200

static void fsck_damaged_path_add_err(struct fsck_damaged_path *i,
				      enum bch_sb_error_id err)
{
	for (unsigned j = 0; j < i->nr_errors; j++)
		if (i->errors[j] == err)
			return;

	if (i->nr_errors < ARRAY_SIZE(i->errors))
		i->errors[i->nr_errors++] = err;
}

/*
 * The in-memory half of damage recording, feeding the end-of-fsck summary
 * and the fsck_damaged_paths debugfs file; called from bch2_damage_record()
 * alongside the durable damage btree write. Goes away once reporting reads
 * the damage btree.
 */
void bch2_fsck_damaged(struct btree_trans *trans, struct bpos pos,
		       enum bch_sb_error_id err)
{
	struct bch_fs *c = trans->c;

	/*
	 * Both key-position conventions land here: extent-style keys carry
	 * the inum in pos.inode; inode keys live at (0, inum, snapshot), so
	 * a zero inode field means the inum is in the offset field:
	 */
	u64 inum = pos.inode ?: pos.offset;

	guard(mutex)(&c->errors.msgs_lock);

	/* Damage on one inode arrives in runs - check the last entry first: */
	if (c->errors.damaged_paths.nr) {
		struct fsck_damaged_path *last = &darray_last(c->errors.damaged_paths);
		if (last->inum == inum && last->snapshot == pos.snapshot) {
			fsck_damaged_path_add_err(last, err);
			return;
		}
	}

	darray_for_each(c->errors.damaged_paths, i)
		if (i->inum == inum && i->snapshot == pos.snapshot) {
			fsck_damaged_path_add_err(i, err);
			return;
		}

	if (c->errors.damaged_paths.nr >= FSCK_DAMAGED_PATHS_MAX ||
	    darray_push(&c->errors.damaged_paths, ((struct fsck_damaged_path) {
			.inum		= inum,
			.snapshot	= pos.snapshot,
			.nr_errors	= 1,
			.errors		= { err },
		})))
		c->errors.damaged_paths_alloc_err = true;
}

/*
 * A damage entry's snapshot may itself be dead by report time - that's
 * exactly how keys_deleted entries arise - so a failed resolution retries
 * through the inode's surviving snapshot versions: the path in a live view
 * still names the file for the user.
 */
static int damaged_path_resolve(struct btree_trans *trans, u64 inum,
				u32 snapshot, struct printbuf *path)
{
	printbuf_reset(path);
	int ret = bch2_inum_snapshot_to_path(trans, inum, snapshot, NULL, path);
	if (!ret || bch2_err_matches(ret, BCH_ERR_transaction_restart))
		return ret;

	struct bkey_s_c k;
	for_each_btree_key_norestart(trans, iter, BTREE_ID_inodes, POS(0, inum),
				     BTREE_ITER_all_snapshots, k, ret) {
		if (k.k->p.offset != inum)
			break;
		if (k.k->p.snapshot == snapshot || !bkey_is_inode(k.k))
			continue;

		printbuf_reset(path);
		ret = bch2_inum_snapshot_to_path(trans, inum, k.k->p.snapshot,
						 NULL, path);
		if (!ret || bch2_err_matches(ret, BCH_ERR_transaction_restart))
			return ret;
	}

	return ret ?: bch_err_throw(trans->c, ENOENT_inode);
}

void bch2_fsck_damaged_path_to_text(struct printbuf *out, struct btree_trans *trans,
				    const struct fsck_damaged_path *i)
{
	CLASS(printbuf, path)();

	/* Resolve into a temp buffer so a restart doesn't duplicate output: */
	int ret = lockrestart_do(trans,
		damaged_path_resolve(trans, i->inum, i->snapshot, &path));
	if (!ret)
		prt_str(out, path.buf);
	else
		prt_printf(out, "inum %llu:%u", i->inum, i->snapshot);

	prt_str(out, ": ");

	for (unsigned j = 0; j < i->nr_errors; j++) {
		if (j)
			prt_str(out, ", ");
		prt_str(out, bch2_sb_error_strs[i->errors[j]]);
	}
	prt_newline(out);
}

void bch2_fsck_damaged_paths_to_text(struct printbuf *out, struct bch_fs *c)
{
	if (!c->errors.damaged_paths.nr)
		return;

	prt_printf(out, "%zu paths damaged by fsck", c->errors.damaged_paths.nr);
	if (c->errors.damaged_paths_alloc_err)
		prt_str(out, " (list incomplete)");
	prt_str(out, ":\n");
	bch2_printbuf_indent_add(out, 2);

	CLASS(btree_trans, trans)(c);
	u32 nr_printed = 0;

	darray_for_each(c->errors.damaged_paths, i) {
		if (nr_printed++ >= FSCK_DAMAGED_PATHS_PRINT) {
			prt_printf(out, "... and %zu more (untruncated list in debugfs: fsck_damaged_paths)\n",
				   c->errors.damaged_paths.nr - FSCK_DAMAGED_PATHS_PRINT);
			break;
		}

		bch2_fsck_damaged_path_to_text(out, trans, i);
	}

	bch2_printbuf_indent_sub(out, 2);
}

int bch2_inum_offset_err_msg_trans_norestart(struct btree_trans *trans, struct printbuf *out,
					     u32 subvol, struct bpos pos)
{
	int ret = 0;
	if (subvol)
		ret = bch2_inum_to_path(trans, (subvol_inum) { subvol, pos.inode }, out);
	else if (pos.snapshot)
		ret = bch2_inum_snapshot_to_path(trans, pos.inode, pos.snapshot, NULL, out);

	if (bch2_err_matches(ret, BCH_ERR_transaction_restart))
		return ret;

	if (!subvol && !pos.snapshot)
		prt_printf(out, "inum %llu", pos.inode);
	else if (ret)
		prt_printf(out, "inum %u:%llu", subvol, pos.inode);
	prt_printf(out, " offset %llu", pos.offset << 9);
	return 0;
}

void bch2_inum_offset_err_msg_trans(struct btree_trans *trans, struct printbuf *out,
				    u32 subvol, struct bpos pos)
{
	lockrestart_do(trans, bch2_inum_offset_err_msg_trans_norestart(trans, out, subvol, pos));
}

void bch2_fs_errors_exit(struct bch_fs *c)
{
	darray_exit(&c->errors.damaged_paths);
	darray_exit(&c->errors.counts);
}

void bch2_fs_errors_init_early(struct bch_fs *c)
{
	darray_init(&c->errors.msgs);
	darray_init(&c->errors.damaged_paths);
	mutex_init(&c->errors.msgs_lock);

	mutex_init(&c->errors.counts_lock);
	darray_init(&c->errors.counts);
}

int bch2_fs_errors_init(struct bch_fs *c)
{
	return bch2_sb_errors_to_cpu(c);
}
