| blob | c8ad2606f928b27f6b28705976ed88791b9d41e0 |
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (c) 2000-2006 Silicon Graphics, Inc.
4 * All Rights Reserved.
5 */
6 #include <linux/iversion.h>
50 /*
51 * These two are wrapper routines around the xfs_ilock() routine used to
52 * centralize some grungy code. They are used in places that wish to lock the
53 * inode solely for reading the extents. The reason these places can't just
54 * call xfs_ilock(ip, XFS_ILOCK_SHARED) is that the inode lock also guards to
55 * bringing in of the extents from disk for a file in b-tree format. If the
56 * inode is in b-tree format, then we need to lock the inode exclusively until
57 * the extents are read in. Locking it exclusively all the time would limit
58 * our parallelism unnecessarily, though. What we do instead is check to see
59 * if the extents have been read in yet, and only lock the inode exclusively
60 * if they have not.
61 *
62 * The functions return a value which should be given to the corresponding
63 * xfs_iunlock() call.
64 */
65 uint
68 {
75 }
77 uint
80 {
87 }
89 /*
90 * You can't set both SHARED and EXCL for the same lock,
91 * and only XFS_IOLOCK_SHARED, XFS_IOLOCK_EXCL, XFS_MMAPLOCK_SHARED,
92 * XFS_MMAPLOCK_EXCL, XFS_ILOCK_SHARED, XFS_ILOCK_EXCL are valid values
93 * to set in lock_flags.
94 */
97 uint lock_flags)
98 {
107 }
109 /*
110 * In addition to i_rwsem in the VFS inode, the xfs inode contains 2
111 * multi-reader locks: invalidate_lock and the i_lock. This routine allows
112 * various combinations of the locks to be obtained.
113 *
114 * The 3 locks should always be ordered so that the IO lock is obtained first,
115 * the mmap lock second and the ilock last in order to prevent deadlock.
116 *
117 * Basic locking order:
118 *
119 * i_rwsem -> invalidate_lock -> page_lock -> i_ilock
120 *
121 * mmap_lock locking order:
122 *
123 * i_rwsem -> page lock -> mmap_lock
124 * mmap_lock -> invalidate_lock -> page_lock
125 *
126 * The difference in mmap_lock locking order mean that we cannot hold the
127 * invalidate_lock over syscall based read(2)/write(2) based IO. These IO paths
128 * can fault in pages during copy in/out (for buffered IO) or require the
129 * mmap_lock in get_user_pages() to map the user pages into the kernel address
130 * space for direct IO. Similarly the i_rwsem cannot be taken inside a page
131 * fault because page faults already hold the mmap_lock.
132 *
133 * Hence to serialise fully against both syscall and mmap based IO, we need to
134 * take both the i_rwsem and the invalidate_lock. These locks should *only* be
135 * both taken in places where we need to invalidate the page cache in a race
136 * free manner (e.g. truncate, hole punch and other extent manipulation
137 * functions).
138 */
139 void
142 uint lock_flags)
143 {
154 }
162 }
168 }
170 /*
171 * This is just like xfs_ilock(), except that the caller
172 * is guaranteed not to sleep. It returns 1 if it gets
173 * the requested locks and 0 otherwise. If the IO lock is
174 * obtained but the inode lock cannot be, then the IO lock
175 * is dropped before returning.
176 *
177 * ip -- the inode being locked
178 * lock_flags -- this parameter indicates the inode's locks to be
179 * to be locked. See the comment for xfs_ilock() for a list
180 * of valid values.
181 */
182 int
185 uint lock_flags)
186 {
197 }
205 }
213 }
216 out_undo_mmaplock:
221 out_undo_iolock:
226 out:
228 }
230 /*
231 * xfs_iunlock() is used to drop the inode locks acquired with
232 * xfs_ilock() and xfs_ilock_nowait(). The caller must pass
233 * in the flags given to xfs_ilock() or xfs_ilock_nowait() so
234 * that we know which locks to drop.
235 *
236 * ip -- the inode being unlocked
237 * lock_flags -- this parameter indicates the inode's locks to be
238 * to be unlocked. See the comment for xfs_ilock() for a list
239 * of valid values for this parameter.
240 *
241 */
242 void
245 uint lock_flags)
246 {
265 }
267 /*
268 * give up write locks. the i/o lock cannot be held nested
269 * if it is being demoted.
270 */
271 void
274 uint lock_flags)
275 {
288 }
290 void
293 uint lock_flags)
294 {
295 /*
296 * Sometimes we assert the ILOCK is held exclusively, but we're in
297 * a workqueue, so lockdep doesn't know we're the owner.
298 */
313 }
315 /*
316 * xfs_lockdep_subclass_ok() is only used in an ASSERT, so is only called when
317 * DEBUG or XFS_WARN is set. And MAX_LOCKDEP_SUBCLASSES is then only defined
318 * when CONFIG_LOCKDEP is set. Hence the complex define below to avoid build
319 * errors and warnings.
320 */
321 #if (defined(DEBUG) || defined(XFS_WARN)) && defined(CONFIG_LOCKDEP)
322 static bool
325 {
327 }
328 #else
329 #define xfs_lockdep_subclass_ok(subclass) (true)
330 #endif
332 /*
333 * Bump the subclass so xfs_lock_inodes() acquires each lock with a different
334 * value. This can be called for any type of inode lock combination, including
335 * parent locking. Care must be taken to ensure we don't overrun the subclass
336 * storage fields in the class mask we build.
337 */
340 uint lock_mode,
341 uint subclass)
342 {
351 }
356 }
361 }
364 }
366 /*
367 * The following routine will lock n inodes in exclusive mode. We assume the
368 * caller calls us with the inodes in i_ino order.
369 *
370 * We need to detect deadlock where an inode that we lock is in the AIL and we
371 * start waiting for another inode that is locked by a thread in a long running
372 * transaction (such as truncate). This can result in deadlock since the long
373 * running trans might need to wait for the inode we just locked in order to
374 * push the tail and free space in the log.
375 *
376 * xfs_lock_inodes() can only be used to lock one type of lock at a time -
377 * the iolock, the mmaplock or the ilock, but not more than one at a time. If we
378 * lock more than one at a time, lockdep will report false positives saying we
379 * have violated locking orders.
380 */
381 void
385 uint lock_mode)
386 {
388 uint i;
393 /*
394 * Currently supports between 2 and 5 inodes with exclusive locking. We
395 * support an arbitrary depth of locking here, but absolute limits on
396 * inodes depend on the type of locking and the limits placed by
397 * lockdep annotations in xfs_lock_inumorder. These are all checked by
398 * the asserts.
399 */
402 XFS_ILOCK_EXCL));
404 XFS_ILOCK_SHARED)));
415 again:
424 /*
425 * If try_lock is not set yet, make sure all locked inodes are
426 * not in the AIL. If any are, set try_lock to be used later.
427 */
433 }
434 }
436 /*
437 * If any of the previous locks we have locked is in the AIL,
438 * we must TRY to get the second and subsequent locks. If
439 * we can't get any, we must release all we have
440 * and try again.
441 */
445 }
447 /* try_lock means we have an inode locked that is in the AIL. */
452 /*
453 * Unlock all previous guys and try again. xfs_iunlock will try
454 * to push the tail if the inode is in the AIL.
455 */
456 attempts++;
458 /*
459 * Check to see if we've already unlocked this one. Not
460 * the first one going back, and the inode ptr is the
461 * same.
462 */
467 }
471 }
473 }
474 }
476 /*
477 * xfs_lock_two_inodes() can only be used to lock ilock. The iolock and
478 * mmaplock must be double-locked separately since we use i_rwsem and
479 * invalidate_lock for that. We now support taking one lock EXCL and the
480 * other SHARED.
481 */
482 void
485 uint ip0_mode,
487 uint ip1_mode)
488 {
503 }
505 again:
508 /*
509 * If the first lock we have locked is in the AIL, we must TRY to get
510 * the second lock. If we can't get it, we must release the first one
511 * and try again.
512 */
520 }
523 }
524 }
526 /*
527 * Lookups up an inode from "name". If ci_name is not NULL, then a CI match
528 * is allowed, otherwise it has to be an exact match. If a CI match is found,
529 * ci_name->name will point to a the actual name (caller must free) or
530 * will be set to NULL if an exact match is found.
531 */
532 int
538 {
539 xfs_ino_t inum;
557 /*
558 * Fail if a directory entry in the regular directory tree points to
559 * a metadata file.
560 */
565 }
569 out_irele:
571 out_free_name:
574 out_unlock:
577 }
579 /*
580 * Initialise a newly allocated inode and return the in-core inode to the
581 * caller locked exclusively.
582 *
583 * Caller is responsible for unlocking the inode manually upon return
584 */
585 int
588 xfs_ino_t ino,
591 {
596 /*
597 * Get the in-core inode with the lock held exclusively to prevent
598 * others from looking at until we're done.
599 */
608 /* now that we have an i_mode we can setup the inode structure */
613 }
615 /* Return dquots for the ids that will be assigned to a new file. */
616 int
622 {
630 /*
631 * The uid/gid computation code must match what the VFS uses to
632 * assign i_[ug]id. INHERIT adjusts the gid computation for
633 * setgid/grpid systems.
634 */
639 }
645 }
647 int
652 {
657 };
664 xfs_ino_t ino;
667 uint resblks;
677 /* Make sure that we have allocated dquot(s) on disk. */
688 }
694 /*
695 * Initially assume that the file does not exist and
696 * reserve the resources for that case. If that is not
697 * the case we'll drop the one we have and get a more
698 * appropriate transaction later.
699 */
703 /* flush outstanding delalloc blocks and retry */
707 }
714 /*
715 * A newly created regular or special file just has one directory
716 * entry pointing to them, but a directory also the "." entry
717 * pointing to itself.
718 */
725 /*
726 * Now we join the directory inode to the transaction. We do not do it
727 * earlier because xfs_dialloc might commit the previous transaction
728 * (and release all the locks). An error from here on will result in
729 * the transaction cancel unlocking dp so don't do it explicitly in the
730 * error path.
731 */
738 /*
739 * If this is a synchronous mount, make sure that the
740 * create transaction goes to disk before returning to
741 * the user.
742 */
746 /*
747 * Attach the dquot(s) to the inodes and modify them incore.
748 * These ids of the inode couldn't have changed since the new
749 * inode has been locked ever since it was created.
750 */
767 out_trans_cancel:
769 out_release_inode:
770 /*
771 * Wait until after the current transaction is aborted to finish the
772 * setup of the inode and release the inode. This prevents recursive
773 * transactions and deadlocks from xfs_inactive.
774 */
779 }
780 out_parent:
782 out_release_dquots:
790 }
792 int
796 {
805 xfs_ino_t ino;
806 uint resblks;
814 /* Make sure that we have allocated dquot(s) on disk. */
836 /*
837 * Attach the dquot(s) to the inodes and modify them incore.
838 * These ids of the inode couldn't have changed since the new
839 * inode has been locked ever since it was created.
840 */
859 out_trans_cancel:
861 out_release_inode:
862 /*
863 * Wait until after the current transaction is aborted to finish the
864 * setup of the inode and release the inode. This prevents recursive
865 * transactions and deadlocks from xfs_inactive.
866 */
871 }
872 out_release_dquots:
878 }
880 int
885 {
890 };
923 /*
924 * We don't allow reservationless or quotaless hardlinking when parent
925 * pointers are enabled because we can't back out if the xattrs must
926 * grow.
927 */
931 }
933 /*
934 * If we are using project inheritance, we only allow hard link
935 * creation in our tree when the project IDs are the same; else
936 * the tree quota mechanism could be circumvented.
937 */
940 /*
941 * Project quota setup skips special files which can
942 * leave inodes in a PROJINHERIT directory without a
943 * project ID set. We need to allow links to be made
944 * to these "project-less" inodes because userspace
945 * expects them to succeed after project ID setup,
946 * but everything else should be rejected.
947 */
952 }
953 }
959 /*
960 * If this is a synchronous mount, make sure that the
961 * link transaction goes to disk before returning to
962 * the user.
963 */
973 error_return:
977 out_parent:
979 std_return:
983 }
985 /* Clear the reflink flag and the cowblocks tag if possible. */
986 static void
989 {
1001 }
1003 /*
1004 * Free up the underlying blocks past new_size. The new size must be smaller
1005 * than the current size. This routine can be used both for the attribute and
1006 * data fork, and does not modify the inode size, which is left to the caller.
1007 *
1008 * The transaction passed to this routine must have made a permanent log
1009 * reservation of at least XFS_ITRUNCATE_LOG_RES. This routine may commit the
1010 * given transaction and start new ones, so make sure everything involved in
1011 * the transaction is tidy before calling here. Some transaction will be
1012 * returned to the caller to be committed. The incoming transaction must
1013 * already include the inode, and both inode locks must be held exclusively.
1014 * The inode must also be "held" within the transaction. On return the inode
1015 * will be "held" within the returned transaction. This routine does NOT
1016 * require any disk space to be reserved for it within the transaction.
1017 *
1018 * If we get an error, we must return with the inode locked and linked into the
1019 * current transaction. This keeps things simple for the higher level code,
1020 * because it always knows that the inode is locked and held in the transaction
1021 * that returns to it whether errors occur or not. We don't mark the inode
1022 * dirty on error so that transactions can be easily aborted if possible.
1023 */
1024 int
1029 xfs_fsize_t new_size,
1031 {
1034 xfs_fileoff_t first_unmap_block;
1050 /*
1051 * Since it is possible for space to become allocated beyond
1052 * the end of the file (in a crash where the space is allocated
1053 * but the inode size is not yet updated), simply remove any
1054 * blocks which show up between the new EOF and the maximum
1055 * possible file size.
1056 *
1057 * We have to free all the blocks to the bmbt maximum offset, even if
1058 * the page cache can't scale that far.
1059 */
1064 }
1067 XFS_MAX_FILEOFF);
1072 /* Remove all pending CoW reservations. */
1079 }
1081 /*
1082 * Always re-log the inode so that our permanent transaction can keep
1083 * on rolling it forward in the log.
1084 */
1089 out:
1092 }
1094 /*
1095 * Mark all the buffers attached to this directory stale. In theory we should
1096 * never be freeing a directory with any blocks at all, but this covers the
1097 * case where we've recovered a directory swap with a "temporary" directory
1098 * created by online repair and now need to dump it.
1099 */
1100 STATIC void
1103 {
1109 xfs_fileoff_t off;
1111 /*
1112 * Invalidate each directory block. All directory blocks are of
1113 * fsbcount length and alignment, so we only need to walk those same
1114 * offsets. We hold the only reference to this inode, so we must wait
1115 * for the buffer locks.
1116 */
1122 xfs_fsblock_t fsbno;
1135 }
1136 }
1137 }
1139 /*
1140 * xfs_inactive_truncate
1141 *
1142 * Called to perform a truncate when an inode becomes unlinked.
1143 */
1144 STATIC int
1147 {
1156 }
1160 /*
1161 * Log the inode size first to prevent stale data exposure in the event
1162 * of a system crash before the truncate completes. See the related
1163 * comment in xfs_vn_setattr_size() for details.
1164 */
1181 error_trans_cancel:
1183 error_unlock:
1186 }
1188 /*
1189 * xfs_inactive_ifree()
1190 *
1191 * Perform the inode free when an inode is unlinked.
1192 */
1193 STATIC int
1196 {
1201 /*
1202 * We try to use a per-AG reservation for any block needed by the finobt
1203 * tree, but as the finobt feature predates the per-AG reservation
1204 * support a degraded file system might not have enough space for the
1205 * reservation at mount time. In that case try to dip into the reserved
1206 * pool and pray.
1207 *
1208 * Send a warning if the reservation does happen to fail, as the inode
1209 * now remains allocated and sits on the unlinked list until the fs is
1210 * repaired.
1211 */
1218 }
1222 "Failed to remove inode(s) from unlinked list. "
1226 }
1228 }
1230 /*
1231 * We do not hold the inode locked across the entire rolling transaction
1232 * here. We only need to hold it for the first transaction that
1233 * xfs_ifree() builds, which may mark the inode XFS_ISTALE if the
1234 * underlying cluster buffer is freed. Relogging an XFS_ISTALE inode
1235 * here breaks the relationship between cluster buffer invalidation and
1236 * stale inode invalidation on cluster buffer item journal commit
1237 * completion, and can result in leaving dirty stale inodes hanging
1238 * around in memory.
1239 *
1240 * We have no need for serialising this inode operation against other
1241 * operations - we freed the inode and hence reallocation is required
1242 * and that will serialise on reallocating the space the deferops need
1243 * to free. Hence we can unlock the inode on the first commit of
1244 * the transaction rather than roll it right through the deferops. This
1245 * avoids relogging the XFS_ISTALE inode.
1246 *
1247 * We check that xfs_ifree() hasn't grown an internal transaction roll
1248 * by asserting that the inode is still locked when it returns.
1249 */
1256 /*
1257 * If we fail to free the inode, shut down. The cancel
1258 * might do that, we need to make sure. Otherwise the
1259 * inode might be lost for a long time or forever.
1260 */
1265 }
1268 }
1270 /*
1271 * Credit the quota account(s). The inode is gone.
1272 */
1276 }
1278 /*
1279 * Returns true if we need to update the on-disk metadata before we can free
1280 * the memory used by this inode. Updates include freeing post-eof
1281 * preallocations; freeing COW staging extents; and marking the inode free in
1282 * the inobt if it is on the unlinked list.
1283 */
1284 bool
1287 {
1291 /*
1292 * If the inode is already free, then there can be nothing
1293 * to clean up here.
1294 */
1298 /*
1299 * If this is a read-only mount, don't do this (would generate I/O)
1300 * unless we're in log recovery and cleaning the iunlinked list.
1301 */
1305 /* If the log isn't running, push inodes straight to reclaim. */
1309 /* Metadata inodes require explicit resource cleanup. */
1313 /* Want to clean out the cow blocks if there are any. */
1317 /* Unlinked files must be freed. */
1321 /*
1322 * This file isn't being freed, so check if there are post-eof blocks
1323 * to free.
1324 *
1325 * Note: don't bother with iolock here since lockdep complains about
1326 * acquiring it in reclaim context. We have the only reference to the
1327 * inode at this point anyways.
1328 */
1330 }
1332 /*
1333 * Save health status somewhere, if we're dumping an inode with uncorrected
1334 * errors and online repair isn't running.
1335 */
1339 {
1356 /* There had better still be a perag structure! */
1359 }
1363 }
1365 /*
1366 * xfs_inactive
1367 *
1368 * This is called when the vnode reference count for the vnode
1369 * goes to zero. If the file has been unlinked, then it must
1370 * now be truncated. Also, we clear all of the read-ahead state
1371 * kept for the inode here since the file is now closed.
1372 */
1373 int
1376 {
1381 /*
1382 * If the inode is already free, then there can be nothing
1383 * to clean up here.
1384 */
1388 }
1395 /*
1396 * If this is a read-only mount, don't do this (would generate I/O)
1397 * unless we're in log recovery and cleaning the iunlinked list.
1398 */
1402 /* Metadata inodes require explicit resource cleanup. */
1406 /* Try to clean out the cow blocks if there are any. */
1411 /*
1412 * Note: don't bother with iolock here since lockdep complains
1413 * about acquiring it in reclaim context. We have the only
1414 * reference to the inode at this point anyways.
1415 */
1420 }
1428 /*
1429 * If this inode is being inactivated during a quotacheck and
1430 * has not yet been scanned by quotacheck, we /must/ remove
1431 * the dquots from the inode before inactivation changes the
1432 * block and inode counts. Most probably this is a result of
1433 * reloading the incore iunlinked list to purge unrecovered
1434 * unlinked inodes.
1435 */
1441 }
1446 }
1455 /*
1456 * If there are attributes associated with the file then blow them away
1457 * now. The code calls a routine that recursively deconstructs the
1458 * attribute fork. If also blows away the in-core attribute fork.
1459 */
1464 }
1468 /*
1469 * Free the inode.
1470 */
1473 out:
1474 /*
1475 * We're done making metadata updates for this inode, so we can release
1476 * the attached dquots.
1477 */
1480 }
1482 /*
1483 * Find an inode on the unlinked list. This does not take references to the
1484 * inode as we have existence guarantees by holding the AGI buffer lock and that
1485 * only unlinked, referenced inodes can be on the unlinked inode list. If we
1486 * don't find the inode in cache, then let the caller handle the situation.
1487 */
1491 xfs_agino_t agino)
1492 {
1498 /* Caller can handle inode not being in memory. */
1501 }
1503 /*
1504 * Inode in RCU freeing limbo should not happen. Warn about this and
1505 * let the caller handle the failure.
1506 */
1510 }
1514 }
1516 /*
1517 * Load the inode @next_agino into the cache and set its prev_unlinked pointer
1518 * to @prev_agino. Caller must hold the AGI to synchronize with other changes
1519 * to the unlinked list.
1520 */
1521 int
1525 xfs_agino_t prev_agino,
1526 xfs_agino_t next_agino)
1527 {
1535 #ifdef DEBUG
1540 #endif
1546 /*
1547 * Use an untrusted lookup just to be cautious in case the AGI has been
1548 * corrupted and now points at a free inode. That shouldn't happen,
1549 * but we'd rather shut down now since we're already running in a weird
1550 * situation.
1551 */
1557 }
1559 /* If this is not an unlinked inode, something is very wrong. */
1564 }
1568 rele:
1574 }
1576 /*
1577 * Look up the inode number specified and if it is not already marked XFS_ISTALE
1578 * mark it stale. We should only find clean inodes in this lookup that aren't
1579 * already stale.
1580 */
1581 static void
1585 xfs_ino_t inum)
1586 {
1591 retry:
1595 /* Inode not in memory, nothing to do */
1599 }
1601 /*
1602 * because this is an RCU protected lookup, we could find a recently
1603 * freed or even reallocated inode during the lookup. We need to check
1604 * under the i_flags_lock for a valid inode here. Skip it if it is not
1605 * valid, the wrong inode or stale.
1606 */
1611 /*
1612 * Don't try to lock/unlock the current inode, but we _cannot_ skip the
1613 * other inodes that we did not find in the list attached to the buffer
1614 * and are not already marked stale. If we can't lock it, back off and
1615 * retry.
1616 */
1623 }
1624 }
1627 /*
1628 * If the inode is flushing, it is already attached to the buffer. All
1629 * we needed to do here is mark the inode stale so buffer IO completion
1630 * will remove it from the AIL.
1631 */
1637 }
1639 /*
1640 * Inodes not attached to the buffer can be released immediately.
1641 * Everything else has to go through xfs_iflush_abort() on journal
1642 * commit as the flock synchronises removal of the inode from the
1643 * cluster buffer against inode reclaim.
1644 */
1652 /* we have a dirty inode in memory that has not yet been flushed. */
1664 out_iunlock:
1667 out_iflags_unlock:
1670 }
1672 /*
1673 * A big issue when freeing the inode cluster is that we _cannot_ skip any
1674 * inodes that are in memory - they all must be marked stale and attached to
1675 * the cluster buffer.
1676 */
1677 static int
1683 {
1687 xfs_daddr_t blkno;
1697 /*
1698 * The allocation bitmap tells us which inodes of the chunk were
1699 * physically allocated. Skip the cluster if an inode falls into
1700 * a sparse region.
1701 */
1706 }
1711 /*
1712 * We obtain and lock the backing buffer first in the process
1713 * here to ensure dirty inodes attached to the buffer remain in
1714 * the flushing state while we mark them stale.
1715 *
1716 * If we scan the in-memory inodes first, then buffer IO can
1717 * complete before we get a lock on it, and hence we may fail
1718 * to mark all the active inodes on the buffer stale.
1719 */
1726 /*
1727 * This buffer may not have been correctly initialised as we
1728 * didn't read it from disk. That's not important because we are
1729 * only using to mark the buffer as stale in the log, and to
1730 * attach stale cached inodes on it.
1731 *
1732 * For the inode that triggered the cluster freeing, this
1733 * attachment may occur in xfs_inode_item_precommit() after we
1734 * have marked this buffer stale. If this buffer was not in
1735 * memory before xfs_ifree_cluster() started, it will not be
1736 * marked XBF_DONE and this will cause problems later in
1737 * xfs_inode_item_precommit() when we trip over a (stale, !done)
1738 * buffer to attached to the transaction.
1739 *
1740 * Hence we have to mark the buffer as XFS_DONE here. This is
1741 * safe because we are also marking the buffer as XBF_STALE and
1742 * XFS_BLI_STALE. That means it will never be dispatched for
1743 * IO and it won't be unlocked until the cluster freeing has
1744 * been committed to the journal and the buffer unpinned. If it
1745 * is written, we want to know about it, and we want it to
1746 * fail. We can acheive this by adding a write verifier to the
1747 * buffer.
1748 */
1752 /*
1753 * Now we need to set all the cached clean inodes as XFS_ISTALE,
1754 * too. This requires lookups, and will skip inodes that we've
1755 * already marked XFS_ISTALE.
1756 */
1762 }
1764 }
1766 /*
1767 * This is called to return an inode to the inode free list. The inode should
1768 * already be truncated to 0 length and have no pages associated with it. This
1769 * routine also assumes that the inode is already a part of the transaction.
1770 *
1771 * The on-disk copy of the inode will have been added to the list of unlinked
1772 * inodes in the AGI. We need to remove the inode from that list atomically with
1773 * respect to freeing it here.
1774 */
1775 int
1779 {
1801 /* Don't attempt to replay owner changes for a deleted inode */
1808 out:
1811 }
1813 /*
1814 * This is called to unpin an inode. The caller must have the inode locked
1815 * in at least shared mode so that the buffer cannot be subsequently pinned
1816 * once someone is waiting for it to be unpinned.
1817 */
1818 static void
1821 {
1826 /* Give the log a push to start the unpinning I/O */
1829 }
1831 static void
1834 {
1846 }
1848 void
1851 {
1854 }
1856 /*
1857 * Removing an inode from the namespace involves removing the directory entry
1858 * and dropping the link count on the inode. Removing the directory entry can
1859 * result in locking an AGF (directory blocks were freed) and removing a link
1860 * count can result in placing the inode on an unlinked list which results in
1861 * locking an AGI.
1862 *
1863 * The big problem here is that we have an ordering constraint on AGF and AGI
1864 * locking - inode allocation locks the AGI, then can allocate a new extent for
1865 * new inodes, locking the AGF after the AGI. Similarly, freeing the inode
1866 * removes the inode from the unlinked list, requiring that we lock the AGI
1867 * first, and then freeing the inode can result in an inode chunk being freed
1868 * and hence freeing disk space requiring that we lock an AGF.
1869 *
1870 * Hence the ordering that is imposed by other parts of the code is AGI before
1871 * AGF. This means we cannot remove the directory entry before we drop the inode
1872 * reference count and put it on the unlinked list as this results in a lock
1873 * order of AGF then AGI, and this can deadlock against inode allocation and
1874 * freeing. Therefore we must drop the link counts before we remove the
1875 * directory entry.
1876 *
1877 * This is still safe from a transactional point of view - it is not until we
1878 * get to xfs_defer_finish() that we have the possibility of multiple
1879 * transactions in this operation. Hence as long as we remove the directory
1880 * entry and drop the link count in the first transaction of the remove
1881 * operation, there are no transactional constraints on the ordering here.
1882 */
1883 int
1888 {
1893 };
1899 uint resblks;
1920 /*
1921 * We try to get the real space reservation first, allowing for
1922 * directory btree deletion(s) implying possible bmap insert(s). If we
1923 * can't get the space reservation then we use 0 instead, and avoid the
1924 * bmap btree insert(s) in the directory code by, if the bmap insert
1925 * tries to happen, instead trimming the LAST block from the directory.
1926 *
1927 * Ignore EDQUOT and ENOSPC being returned via nospace_error because
1928 * the directory code can handle a reservationless update and we don't
1929 * want to prevent a user from trying to free space by deleting things.
1930 */
1937 }
1943 /*
1944 * If this is a synchronous mount, make sure that the
1945 * remove transaction goes to disk before returning to
1946 * the user.
1947 */
1963 out_trans_cancel:
1965 out_unlock:
1968 out_parent:
1970 std_return:
1972 }
1978 {
1982 /* Skip duplicate inodes if src and target dps are the same */
1986 }
1987 }
1989 /*
1990 * Enter all inodes for a rename transaction into a sorted array.
1991 */
1992 #define __XFS_SORT_INODES 5
1993 STATIC void
2002 {
2008 /*
2009 * i_tab contains a list of pointers to inodes. We initialize
2010 * the table here & we'll sort it. We will then use it to
2011 * order the acquisition of the inode locks.
2012 *
2013 * Note that the table may contain duplicates. e.g., dp1 == dp2.
2014 */
2026 }
2028 void
2032 {
2037 /*
2038 * Sort the elements via bubble sort. (Remember, there are at
2039 * most 5 elements to sort, so this is adequate.)
2040 */
2045 }
2046 }
2047 }
2049 /*
2050 * xfs_rename_alloc_whiteout()
2051 *
2052 * Return a referenced, unlinked, unlocked inode that can be used as a
2053 * whiteout in a rename transaction. We use a tmpfile inode here so that if we
2054 * crash between allocating the inode and linking it into the rename transaction
2055 * recovery will free the inode and we won't leak it.
2056 */
2057 static int
2063 {
2069 };
2085 }
2087 /*
2088 * Prepare the tmpfile inode as if it were created through the VFS.
2089 * Complete the inode setup and flag it as linkable. nlink is already
2090 * zero, so we can skip the drop_nlink.
2091 */
2098 }
2100 /*
2101 * xfs_rename
2102 */
2103 int
2113 {
2118 };
2123 };
2141 /*
2142 * If we are doing a whiteout operation, allocate the whiteout inode
2143 * we will be placing at the target and ensure the type is set
2144 * appropriately.
2145 */
2152 /* setup target dirent info as whiteout */
2154 }
2167 }
2173 }
2175 retry:
2185 }
2189 /*
2190 * We don't allow reservationless renaming when parent pointers are
2191 * enabled because we can't back out if the xattrs must grow.
2192 */
2197 }
2199 /*
2200 * Attach the dquots to the inodes
2201 */
2206 }
2208 /*
2209 * Lock all the participating inodes. Depending upon whether
2210 * the target_name exists in the target directory, and
2211 * whether the target directory is the same as the source
2212 * directory, we can lock from 2 to 5 inodes.
2213 */
2216 /*
2217 * Join all the inodes to the transaction.
2218 */
2228 /*
2229 * If we are using project inheritance, we only allow renames
2230 * into our tree when the project IDs are the same; else the
2231 * tree quota mechanism would be circumvented.
2232 */
2237 }
2239 /* RENAME_EXCHANGE is unique from here on. */
2242 spaceres);
2246 }
2248 /*
2249 * Try to reserve quota to handle an expansion of the target directory.
2250 * We'll allow the rename to continue in reservationless mode if we hit
2251 * a space usage constraint. If we trigger reservationless mode, save
2252 * the errno if there isn't any free space in the target directory.
2253 */
2264 }
2269 }
2272 }
2274 /*
2275 * We don't allow quotaless renaming when parent pointers are enabled
2276 * because we can't back out if the xattrs must grow.
2277 */
2281 }
2283 /*
2284 * Lock the AGI buffers we need to handle bumping the nlink of the
2285 * whiteout inode off the unlinked list and to handle dropping the
2286 * nlink of the target inode. Per locking order rules, do this in
2287 * increasing AG order and before directory block allocation tries to
2288 * grab AGFs because we grab AGIs before AGFs.
2289 *
2290 * The (vfs) caller must ensure that if src is a directory then
2291 * target_ip is either null or an empty directory.
2292 */
2306 }
2307 }
2315 /*
2316 * Now we have a real link, clear the "I'm a tmpfile" state
2317 * flag from the inode so it doesn't accidentally get misused in
2318 * future.
2319 */
2321 }
2323 out_commit:
2324 /*
2325 * If this is a synchronous mount, make sure that the rename
2326 * transaction goes to disk before returning to the user.
2327 */
2335 out_trans_cancel:
2337 out_unlock:
2339 out_tgt_ppargs:
2341 out_wip_ppargs:
2343 out_src_ppargs:
2345 out_release_wip:
2351 }
2353 static int
2357 {
2371 /*
2372 * We don't flush the inode if any of the following checks fail, but we
2373 * do still update the log item and attach to the backing buffer as if
2374 * the flush happened. This is a formality to facilitate predictable
2375 * error handling as the caller will shutdown and fail the buffer.
2376 */
2384 }
2394 }
2405 }
2406 }
2410 "%s: detected corrupt incore inode %llu, "
2416 }
2423 }
2425 /*
2426 * Inode item log recovery for v2 inodes are dependent on the flushiter
2427 * count for correct sequencing. We bump the flush iteration count so
2428 * we can detect flushes which postdate a log record during recovery.
2429 * This is redundant as we now log every change and hence this can't
2430 * happen but we need to still do it to ensure backwards compatibility
2431 * with old kernels that predate logging all inode changes.
2432 */
2436 /*
2437 * If there are inline format data / attr forks attached to this inode,
2438 * make sure they are not corrupt.
2439 */
2448 /*
2449 * Copy the dirty parts of the inode into the on-disk inode. We always
2450 * copy out the core of the inode, because if the inode is dirty at all
2451 * the core must be.
2452 */
2455 /* Wrap, we never let the log put out DI_MAX_FLUSH */
2459 }
2465 /*
2466 * We've recorded everything logged in the inode, so we'd like to clear
2467 * the ili_fields bits so we don't log and flush things unnecessarily.
2468 * However, we can't stop logging all this information until the data
2469 * we've copied into the disk buffer is written to disk. If we did we
2470 * might overwrite the copy of the inode in the log with all the data
2471 * after re-logging only part of it, and in the face of a crash we
2472 * wouldn't have all the data we need to recover.
2473 *
2474 * What we do is move the bits to the ili_last_fields field. When
2475 * logging the inode, these bits are moved back to the ili_fields field.
2476 * In the xfs_buf_inode_iodone() routine we clear ili_last_fields, since
2477 * we know that the information those bits represent is permanently on
2478 * disk. As long as the flush completes before the inode is logged
2479 * again, then both ili_fields and ili_last_fields will be cleared.
2480 */
2482 flush_out:
2490 /*
2491 * Store the current LSN of the inode so that we can tell whether the
2492 * item has moved in the AIL from xfs_buf_inode_iodone().
2493 */
2497 /* generate the checksum. */
2502 }
2504 /*
2505 * Non-blocking flush of dirty inode metadata into the backing buffer.
2506 *
2507 * The caller must have a reference to the inode and hold the cluster buffer
2508 * locked. The function will walk across all the inodes on the cluster buffer it
2509 * can find and lock without blocking, and flush them to the cluster buffer.
2510 *
2511 * On successful flushing of at least one inode, the caller must write out the
2512 * buffer and release it. If no inodes are flushed, -EAGAIN will be returned and
2513 * the caller needs to release the buffer. On failure, the filesystem will be
2514 * shut down, the buffer will have been unlocked and released, and EFSCORRUPTED
2515 * will be returned.
2516 */
2517 int
2520 {
2528 /*
2529 * We must use the safe variant here as on shutdown xfs_iflush_abort()
2530 * will remove itself from the list.
2531 */
2536 /*
2537 * Quick and dirty check to avoid locks if possible.
2538 */
2544 /*
2545 * The inode is still attached to the buffer, which means it is
2546 * dirty but reclaim might try to grab it. Check carefully for
2547 * that, and grab the ilock while still holding the i_flags_lock
2548 * to guarantee reclaim will not be able to reclaim this inode
2549 * once we drop the i_flags_lock.
2550 */
2556 }
2558 /*
2559 * ILOCK will pin the inode against reclaim and prevent
2560 * concurrent transactions modifying the inode while we are
2561 * flushing the inode. If we get the lock, set the flushing
2562 * state before we drop the i_flags_lock.
2563 */
2567 }
2571 /*
2572 * Abort flushing this inode if we are shut down because the
2573 * inode may not currently be in the AIL. This can occur when
2574 * log I/O failure unpins the inode without inserting into the
2575 * AIL, leaving a dirty/unpinned inode attached to the buffer
2576 * that otherwise looks like it should be flushed.
2577 */
2584 }
2586 /* don't block waiting on a log force to unpin dirty inodes */
2591 }
2595 else
2600 clcount++;
2601 }
2604 /*
2605 * Shutdown first so we kill the log before we release this
2606 * buffer. If it is an INODE_ALLOC buffer and pins the tail
2607 * of the log, failing it before the _log_ is shut down can
2608 * result in the log tail being moved forward in the journal
2609 * on disk because log writes can still be taking place. Hence
2610 * unpinning the tail will allow the ICREATE intent to be
2611 * removed from the log an recovery will fail with uninitialised
2612 * inode cluster buffers.
2613 */
2618 }
2627 }
2629 /* Release an inode. */
2630 void
2633 {
2636 }
2638 /*
2639 * Ensure all commited transactions touching the inode are written to the log.
2640 */
2641 int
2644 {
2655 }
2657 /*
2658 * Grab the exclusive iolock for a data copy from src to dest, making sure to
2659 * abide vfs locking order (lowest pointer value goes first) and breaking the
2660 * layout leases before proceeding. The loop is needed because we cannot call
2661 * the blocking break_layout() with the iolocks held, and therefore have to
2662 * back out both locks.
2663 */
2664 static int
2668 {
2674 retry:
2675 /* Wait to break both inodes' layouts before we start locking. */
2683 }
2685 /* Lock one inode and make sure nobody got in and leased it. */
2693 }
2698 /* Lock the other inode and make sure nobody got in and leased it. */
2707 }
2710 }
2712 static int
2716 {
2724 again:
2726 /* Lock the first inode */
2734 }
2739 /* Nested lock the second inode */
2741 /*
2742 * We cannot use xfs_break_dax_layouts() directly here because it may
2743 * need to unlock & lock the XFS_MMAPLOCK_EXCL which is not suitable
2744 * for this nested lock case.
2745 */
2751 }
2754 }
2756 /*
2757 * Lock two inodes so that userspace cannot initiate I/O via file syscalls or
2758 * mmap activity.
2759 */
2760 int
2764 {
2778 }
2784 }
2786 /* Unlock both inodes to allow IO and mmap activity. */
2787 void
2791 {
2803 }
2805 /* Drop the MMAPLOCK and the IOLOCK after a remap completes. */
2806 void
2810 {
2820 }
2822 /*
2823 * Reload the incore inode list for this inode. Caller should ensure that
2824 * the link count cannot change, either by taking ILOCK_SHARED or otherwise
2825 * preventing other threads from executing.
2826 */
2827 int
2831 {
2843 /* Grab the first inode in the list */
2850 /*
2851 * We've taken ILOCK_SHARED and the AGI buffer lock to stabilize the
2852 * incore unlinked list pointers for this inode. Check once more to
2853 * see if we raced with anyone else to reload the unlinked list.
2854 */
2858 }
2874 /* Found this caller's inode, set its backlink. */
2880 }
2882 /* Try in-memory lookup first. */
2887 /* Inode not in memory, try reloading it. */
2889 next_agino);
2893 /* Grab the reloaded inode. */
2896 /* No incore inode at all? We reloaded it... */
2900 }
2902 next_inode:
2905 }
2907 out_agibp:
2909 /* Should have found this inode somewhere in the iunlinked bucket. */
2913 }
2915 /* Decide if this inode is missing its unlinked list and reload it. */
2916 int
2919 {
2934 }
2936 /* Has this inode fork been zapped by repair? */
2937 bool
2941 {
2953 }
2959 }
2960 }
2962 /* Compute the number of data and realtime blocks used by a file. */
2963 void
2969 {
2976 }
2978 static void
2981 {
2987 }
2989 int
2993 {
3006 }
3008 int
3013 {
3026 fallthrough;
3033 }
3037 }
3039 /* Returns the size of fundamental allocation unit for a file, in bytes. */
3040 unsigned int
3043 {
3050 }
3052 /* Should we always be using copy on write for file writes? */
3053 bool
3056 {
3058 }