MFC of 350682

Correct first superblock backup location in fsck_ffs.8.

MFC of 347064, 347066, and 347130

Avoid leaking kernel stack when creating directory names.

MFC r328013:

Exit fsck_ffs with non-zero status when file system is not repaired.

When the fsck_ffs program cannot fully repair a file system, it will
output the message PLEASE RERUN FSCK. However, it does not exit with a
non-zero status in this case (contradicting the man page claim that it
"exits with 0 on success, and >0 if an error occurs." The fsck
rc-script (when running "fsck -y") tests the status from fsck (which
passes along the exit status from fsck_ffs) and issues a "stop_boot"
if the status fails. However, this is not effective since fsck_ffs can
return zero even on (some) errors. Effectively, it is left to a later
step in the boot process when the file systems are mounted to detect
the still-unclean file system and stop the boot.

This change modifies fsck_ffs so that when it cannot fully repair the
file system and issues the PLEASE RERUN FSCK message it also exits
with a non-zero status.

While here, the fsck_ffs man page has also been updated to document
the failing exit status codes used by fsck_ffs. Previously, only exit
status 7 was documented. Some of these exit statuses are tested for in
the fsck rc-script, so they are clearly depended upon and deserve
documentation.

PR: 211485
Sponsored by: Dell EMC

MFC r313745:

* Add missing parameters to usage()
* Add missing parameters to manpage synopsis
* Add missing description of -d flag
* Sort flags descriptions

Reviewed by: allanjude, kib
Approved by: allanjude
MFC after: 1 week
Sponsored by: Rubicon Communications (Netgate)
Differential Revision: https://reviews.freebsd.org/D9152

MFC r306734:
Add history section to fsck_ffs(8)
Move sentence to a new line as advised by igor.

PR: 212474
Approved by: bcr (mentor)
Differential Revision: https://reviews.freebsd.org/D8104

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Add the -R option to allow fsck_ffs to restart itself when too many critical
errors have been detected in a particular run.

Clean up the global state variables so that a restart can happen correctly.

Separate the global variables in fsck_ffs and fsdb to their own file. This
fixes header sharing with fscd.

Correctly initialize, static-ize, and remove global variables as needed in
dir.c. This fixes a problem with lost+found directories that was causing
a segfault.

Correctly initialize, static-ize, and remove global variables as needed in
suj.c.

Initialize the suj globals before allocating the disk object, not after.
Also ensure that 'preen' mode doesn't conflict with 'restart' mode

Submitted by: scottl, max
Reviewed by: max, mckusick (earlier version)
Obtained from: Netflix
MFC after: 3 days

Document the -S flag to fsck_ffs

Obtained from: Netflix

Add a -Z option which zeroes unused blocks. It can be combined with -E,
in which case unused blocks are first zeroed and then erased.

Reviewed by: mckusick
MFC after: 3 weeks

Be more helpful about alternate superblocks.

Add an -E option to mirror newfs's. The idea is that if you have a system
that was built before ffs grew support for TRIM, your filesystem will have
plenty of free blocks that the flash chip doesn't know are free, so it
can't take advantage of them for wear leveling. Once you've upgraded your
kernel, you enable TRIM on the filesystem (tunefs -t enable), then run
fsck_ffs -E on it before mounting it.

I tested this patch by half-filling an mdconfig'ed filesystem image,
running fsck_ffs -E on it, then verifying that the contents were not
damaged by comparing them to a pristine copy using rsync's checksum
functionality. There is no reliable way to test it on real hardware.

Many thanks to mckusick@, who provided the tricky parts of this patch and
reviewed the final version.

Reviewed by: mckusick@
MFC after: 3 weeks

Fix boo-boo in previous commit.

MFC after: 3 weeks

Alphabetize the options. No date bump since no actual change to the text.

MFC after: 3 weeks

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Fix typos and spelling mistakes.

Note that foreground fsck should be run after a filesystem related panic.

Suggested by: Mikhail Teterin (mi@)
MFC after: 1 week

Update the actions previously attempted by the -D option to make them
robust. With these changes fsck is now able to detect and reliably
rebuild corrupted cylinder group maps. The -D option is no longer
necessary as it has been replaced by a prompt asking whether the
corrupted cylinder group should be rebuilt and doing so when requested.
These actions are only offered and taken when running fsck in manual
mode. Corrupted cylinder groups found during preen mode cause the fsck
to fail.

Add the -r option to free up excess unused inodes. Decreasing the
number of preallocated inodes reduces the running time of future
runs of fsck and frees up space that can allocated to files. The -r
option is ignored when running in preen mode.

Reviewed by: Xin LI <delphij@>
Sponsored by: Rsync.net

Add the '-C' "check clean" flag. If the FS is marked clean, skip file
system checking. However, if the file system is not clean, perform a
full fsck.

Reviewed by: delphij
Obtained from: Juniper Networks

Rename option 'C' to 'D' (damaged) in order to avoid a conflict with upcoming
Juniper 'C' (clean) flag.

Requested by: obrien
MFC after: 1 week

Fix typo.

Submitted by: Ben Kaduk <minimarmot gmail com>
MFC after: 3 days

Document the -F 's return statement.
If the application returns succesfully
the return code is 7 (which means the
filesystem is clean).

PR: 127432
Submitted by: edwin
MFC after: 3 days

Add a new flag, '-C' which enables a special mode that is intended for
catastrophic recovery. Currently, this mode only validates whether a
cylindergroup has good signature data, and prompts the user to decide
whether to clear it as a whole.

This mode is useful when there is data damage on a disk and you are
working on copy of the original disk, as fsck_ffs(8) tends to abnormally
exit in such case, as a last resort to recover data from the disk.

Mention the default location of alternative super block on a
UFS2 file system, in fsck_ffs(8).

Submitted by: KOMATSU Shinichiro <koma2 at lovepeers ! org>
PR: docs/86362
MFC After: 3 days

Sync program's usage() with manpage's SYNOPSIS.

Added the EXIT STATUS section where appropriate.

Mechanically kill hard sentence breaks.

Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp

Uniformly refer to a file system as "file system".

Approved by: re

Fix some 'SYNOPSIS' and 'usage' messages.

s/filesystem/file system/g as discussed on -developers

mdoc(7) police: section 1 and 8 manpages document their exit
codes under the DIAGNOSTICS section, not RETURN VALUES, which
is for section 2, 3, and 9 manpages.

Actually I haven't enumerated the return values yet (thats why I hadn't
committed it yet). So vague'ize the wording a little bit to make up
for it.

Revision 1.23 wasn't about WARNS, but rather be a more verbose about
informing of the return values.

Default to WARNS=2.
Binary builds that cannot handle this must explicitly set WARNS=0.

Reviewed by: mike

Remove whitespace at EOL.

mdoc(7) police:
document date updated, removed history info from the .Os call, cosmetics.

Add support for the -F flag which determines whether a specified
filesystem needs foreground checking (usually at boot time) or
can defer to background checking (after the system is up and running).
See the manual page, fsck_ffs(8), for details on the -F and -B options.
These options are primarily intended for use by the fsck front end.

All output is directed to stdout so that the output is coherent
when redirected to a file or a pipe. Unify the code with the fsck
front end that allows either a device or a mount point to be
specified as the argument to be checked.

mdoc(7) police: prepare for mdocNG.

Use ".Nm fsck_ffs", so that this turns up in whatis(1), and others.
Add .Xr to fsck.

Prompted by: JM Jr's script that shows binaries with no whatis info
Reviewed by: adrian

Document fsck_ffs's new SIGINFO handler.

Reviewed by: sheldonh

Prepare for mdoc(7)NG.

mdoc(7) police: use the new features of the Nm macro.

$Id$ -> $FreeBSD$

Cosmetic and documentation changes brought from earlier FreeBSD versions.
(e.g. RCS Id:)

Reviewed by: Don Lewis <Don.Lewis@tsc.tdk.com>
Submitted by: Kirk McKusick <mckusick@McKusick.COM>
Obtained from: Mckusick, BSDI and a host of others

This exactly matches Kirks sources imported under the
Tag MCKUSICK2. These are as supplied by kirk with one small
change needed to compile under freeBSD.

Some FreeBSD patches will be added back, though many have been
added to Kirk's sources already.

Correct use of .Nm. Add rcsid. Remove unused #includes. Use err(3).

Restored lost reference to fsdb(8).

Fixed weird quoting of $Id$.

Merge from Lite2. Note that Lite2 has it's own filesystem clean check
skipping code that overrides ours sooner. One should be eliminated,
but for now it works.

Revert $FreeBSD$ to $Id$

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Sort cross references.

Fix the case where fsck would not see sparse directories and the kernel would
panic. If such a thing is fixed fsck needs a rerun (and bugs the user to do
so).

Reviewed by: Kirk McKusick

Correct some man page cross references and some file
locations.

Remove reference to fsdb(8). We don't have it.

Added filesystem clean bit support. This only affects fsck during a
preen (-p), and in that case the filesystem is skipped if it is clean.
A new flag "-f" for 'force' has been added which basically gives back
the old behavior of checking all the filesystems all the time. This
very closely models the behavior of SunOS and Ultrix.

BSD 4.4 Lite sbin Sources

Note: XNSrouted and routed NOT imported here, they shall be imported with
usr.sbin.