Total coverage: 103729 (6%)of 1815429 




























































 4141 



















 1138 







 4134 













 3676 

 1137 

 1137 



 3681 
 1138 




 4137 

 4137 





 4128 












   31 





   31 


   31 



























   31 


   31 





















































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (C) 2010 Red Hat, Inc., Peter Zijlstra
 *
 * Provides a framework for enqueueing and running callbacks from hardirq
 * context. The enqueueing is NMI-safe.
 */

#include <linux/bug.h>
#include <linux/kernel.h>
#include <linux/export.h>
#include <linux/irq_work.h>
#include <linux/percpu.h>
#include <linux/hardirq.h>
#include <linux/irqflags.h>
#include <linux/sched.h>
#include <linux/tick.h>
#include <linux/cpu.h>
#include <linux/notifier.h>
#include <linux/smp.h>
#include <linux/smpboot.h>
#include <asm/processor.h>
#include <linux/kasan.h>

#include <trace/events/ipi.h>

static DEFINE_PER_CPU(struct llist_head, raised_list);
static DEFINE_PER_CPU(struct llist_head, lazy_list);
static DEFINE_PER_CPU(struct task_struct *, irq_workd);

static void wake_irq_workd(void)
{
        struct task_struct *tsk = __this_cpu_read(irq_workd);

        if (!llist_empty(this_cpu_ptr(&lazy_list)) && tsk)
                wake_up_process(tsk);
}

#ifdef CONFIG_SMP
static void irq_work_wake(struct irq_work *entry)
{
        wake_irq_workd();
}

static DEFINE_PER_CPU(struct irq_work, irq_work_wakeup) =
        IRQ_WORK_INIT_HARD(irq_work_wake);
#endif

static int irq_workd_should_run(unsigned int cpu)
{
        return !llist_empty(this_cpu_ptr(&lazy_list));
}

/*
 * Claim the entry so that no one else will poke at it.
 */
static bool irq_work_claim(struct irq_work *work)
{
        int oflags;

        oflags = atomic_fetch_or(IRQ_WORK_CLAIMED | CSD_TYPE_IRQ_WORK, &work->node.a_flags);
        /*
         * If the work is already pending, no need to raise the IPI.
         * The pairing smp_mb() in irq_work_single() makes sure
         * everything we did before is visible.
         */
        if (oflags & IRQ_WORK_PENDING)
                return false;
        return true;
}

void __weak arch_irq_work_raise(void)
{
        /*
         * Lame architectures will get the timer tick callback
         */
}

static __always_inline void irq_work_raise(struct irq_work *work)
{
        if (trace_ipi_send_cpu_enabled() && arch_irq_work_has_interrupt())
                trace_ipi_send_cpu(smp_processor_id(), _RET_IP_, work->func);

        arch_irq_work_raise();
}

/* Enqueue on current CPU, work must already be claimed and preempt disabled */
static void __irq_work_queue_local(struct irq_work *work)
{
        struct llist_head *list;
        bool rt_lazy_work = false;
        bool lazy_work = false;
        int work_flags;

        work_flags = atomic_read(&work->node.a_flags);
        if (work_flags & IRQ_WORK_LAZY)
                lazy_work = true;
        else if (IS_ENABLED(CONFIG_PREEMPT_RT) &&
                 !(work_flags & IRQ_WORK_HARD_IRQ))
                rt_lazy_work = true;

        if (lazy_work || rt_lazy_work)
                list = this_cpu_ptr(&lazy_list);
        else
                list = this_cpu_ptr(&raised_list);

        if (!llist_add(&work->node.llist, list))
                return;

        /* If the work is "lazy", handle it from next tick if any */
        if (!lazy_work || tick_nohz_tick_stopped())
                irq_work_raise(work);
}

/* Enqueue the irq work @work on the current CPU */
bool irq_work_queue(struct irq_work *work)
{
        /* Only queue if not already pending */
        if (!irq_work_claim(work))
                return false;

        /* Queue the entry and raise the IPI if needed. */
        preempt_disable();
        __irq_work_queue_local(work);
        preempt_enable();

        return true;
}
EXPORT_SYMBOL_GPL(irq_work_queue);

/*
 * Enqueue the irq_work @work on @cpu unless it's already pending
 * somewhere.
 *
 * Can be re-enqueued while the callback is still in progress.
 */
bool irq_work_queue_on(struct irq_work *work, int cpu)
{
#ifndef CONFIG_SMP
        return irq_work_queue(work);

#else /* CONFIG_SMP: */
        /* All work should have been flushed before going offline */
        WARN_ON_ONCE(cpu_is_offline(cpu));

        /* Only queue if not already pending */
        if (!irq_work_claim(work))
                return false;

        kasan_record_aux_stack_noalloc(work);

        preempt_disable();
        if (cpu != smp_processor_id()) {
                /* Arch remote IPI send/receive backend aren't NMI safe */
                WARN_ON_ONCE(in_nmi());

                /*
                 * On PREEMPT_RT the items which are not marked as
                 * IRQ_WORK_HARD_IRQ are added to the lazy list and a HARD work
                 * item is used on the remote CPU to wake the thread.
                 */
                if (IS_ENABLED(CONFIG_PREEMPT_RT) &&
                    !(atomic_read(&work->node.a_flags) & IRQ_WORK_HARD_IRQ)) {

                        if (!llist_add(&work->node.llist, &per_cpu(lazy_list, cpu)))
                                goto out;

                        work = &per_cpu(irq_work_wakeup, cpu);
                        if (!irq_work_claim(work))
                                goto out;
                }

                __smp_call_single_queue(cpu, &work->node.llist);
        } else {
                __irq_work_queue_local(work);
        }
out:
        preempt_enable();

        return true;
#endif /* CONFIG_SMP */
}

bool irq_work_needs_cpu(void)
{
        struct llist_head *raised, *lazy;

        raised = this_cpu_ptr(&raised_list);
        lazy = this_cpu_ptr(&lazy_list);

        if (llist_empty(raised) || arch_irq_work_has_interrupt())
                if (llist_empty(lazy))
                        return false;

        /* All work should have been flushed before going offline */
        WARN_ON_ONCE(cpu_is_offline(smp_processor_id()));

        return true;
}

void irq_work_single(void *arg)
{
        struct irq_work *work = arg;
        int flags;

        /*
         * Clear the PENDING bit, after this point the @work can be re-used.
         * The PENDING bit acts as a lock, and we own it, so we can clear it
         * without atomic ops.
         */
        flags = atomic_read(&work->node.a_flags);
        flags &= ~IRQ_WORK_PENDING;
        atomic_set(&work->node.a_flags, flags);

        /*
         * See irq_work_claim().
         */
        smp_mb();

        lockdep_irq_work_enter(flags);
        work->func(work);
        lockdep_irq_work_exit(flags);

        /*
         * Clear the BUSY bit, if set, and return to the free state if no-one
         * else claimed it meanwhile.
         */
        (void)atomic_cmpxchg(&work->node.a_flags, flags, flags & ~IRQ_WORK_BUSY);

        if ((IS_ENABLED(CONFIG_PREEMPT_RT) && !irq_work_is_hard(work)) ||
            !arch_irq_work_has_interrupt())
                rcuwait_wake_up(&work->irqwait);
}

static void irq_work_run_list(struct llist_head *list)
{
        struct irq_work *work, *tmp;
        struct llist_node *llnode;

        /*
         * On PREEMPT_RT IRQ-work which is not marked as HARD will be processed
         * in a per-CPU thread in preemptible context. Only the items which are
         * marked as IRQ_WORK_HARD_IRQ will be processed in hardirq context.
         */
        BUG_ON(!irqs_disabled() && !IS_ENABLED(CONFIG_PREEMPT_RT));

        if (llist_empty(list))
                return;

        llnode = llist_del_all(list);
        llist_for_each_entry_safe(work, tmp, llnode, node.llist)
                irq_work_single(work);
}

/*
 * hotplug calls this through:
 *  hotplug_cfd() -> flush_smp_call_function_queue()
 */
void irq_work_run(void)
{
        irq_work_run_list(this_cpu_ptr(&raised_list));
        if (!IS_ENABLED(CONFIG_PREEMPT_RT))
                irq_work_run_list(this_cpu_ptr(&lazy_list));
        else
                wake_irq_workd();
}
EXPORT_SYMBOL_GPL(irq_work_run);

void irq_work_tick(void)
{
        struct llist_head *raised = this_cpu_ptr(&raised_list);

        if (!llist_empty(raised) && !arch_irq_work_has_interrupt())
                irq_work_run_list(raised);

        if (!IS_ENABLED(CONFIG_PREEMPT_RT))
                irq_work_run_list(this_cpu_ptr(&lazy_list));
        else
                wake_irq_workd();
}

/*
 * Synchronize against the irq_work @entry, ensures the entry is not
 * currently in use.
 */
void irq_work_sync(struct irq_work *work)
{
        lockdep_assert_irqs_enabled();
        might_sleep();

        if ((IS_ENABLED(CONFIG_PREEMPT_RT) && !irq_work_is_hard(work)) ||
            !arch_irq_work_has_interrupt()) {
                rcuwait_wait_event(&work->irqwait, !irq_work_is_busy(work),
                                   TASK_UNINTERRUPTIBLE);
                return;
        }

        while (irq_work_is_busy(work))
                cpu_relax();
}
EXPORT_SYMBOL_GPL(irq_work_sync);

static void run_irq_workd(unsigned int cpu)
{
        irq_work_run_list(this_cpu_ptr(&lazy_list));
}

static void irq_workd_setup(unsigned int cpu)
{
        sched_set_fifo_low(current);
}

static struct smp_hotplug_thread irqwork_threads = {
        .store                  = &irq_workd,
        .setup                        = irq_workd_setup,
        .thread_should_run      = irq_workd_should_run,
        .thread_fn              = run_irq_workd,
        .thread_comm            = "irq_work/%u",
};

static __init int irq_work_init_threads(void)
{
        if (IS_ENABLED(CONFIG_PREEMPT_RT))
                BUG_ON(smpboot_register_percpu_thread(&irqwork_threads));
        return 0;
}
early_initcall(irq_work_init_threads);



















    2 








    1 











    2 







    2 










    4 




    4 




    4 







    4 























    4 





    4 






    4 




    4 






    4 



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) 2007 Red Hat.  All rights reserved.
 */

#include <linux/fs.h>
#include <linux/string.h>
#include <linux/xattr.h>
#include <linux/posix_acl_xattr.h>
#include <linux/posix_acl.h>
#include <linux/sched.h>
#include <linux/sched/mm.h>
#include <linux/slab.h>
#include "ctree.h"
#include "xattr.h"
#include "acl.h"

struct posix_acl *btrfs_get_acl(struct inode *inode, int type, bool rcu)
{
        int size;
        const char *name;
        char *value = NULL;
        struct posix_acl *acl;

        if (rcu)
                return ERR_PTR(-ECHILD);

        switch (type) {
        case ACL_TYPE_ACCESS:
                name = XATTR_NAME_POSIX_ACL_ACCESS;
                break;
        case ACL_TYPE_DEFAULT:
                name = XATTR_NAME_POSIX_ACL_DEFAULT;
                break;
        default:
                return ERR_PTR(-EINVAL);
        }

        size = btrfs_getxattr(inode, name, NULL, 0);
        if (size > 0) {
                value = kzalloc(size, GFP_KERNEL);
                if (!value)
                        return ERR_PTR(-ENOMEM);
                size = btrfs_getxattr(inode, name, value, size);
        }
        if (size > 0)
                acl = posix_acl_from_xattr(&init_user_ns, value, size);
        else if (size == -ENODATA || size == 0)
                acl = NULL;
        else
                acl = ERR_PTR(size);
        kfree(value);

        return acl;
}

int __btrfs_set_acl(struct btrfs_trans_handle *trans, struct inode *inode,
                    struct posix_acl *acl, int type)
{
        int ret, size = 0;
        const char *name;
        char *value = NULL;

        switch (type) {
        case ACL_TYPE_ACCESS:
                name = XATTR_NAME_POSIX_ACL_ACCESS;
                break;
        case ACL_TYPE_DEFAULT:
                if (!S_ISDIR(inode->i_mode))
                        return acl ? -EINVAL : 0;
                name = XATTR_NAME_POSIX_ACL_DEFAULT;
                break;
        default:
                return -EINVAL;
        }

        if (acl) {
                unsigned int nofs_flag;

                size = posix_acl_xattr_size(acl->a_count);
                /*
                 * We're holding a transaction handle, so use a NOFS memory
                 * allocation context to avoid deadlock if reclaim happens.
                 */
                nofs_flag = memalloc_nofs_save();
                value = kmalloc(size, GFP_KERNEL);
                memalloc_nofs_restore(nofs_flag);
                if (!value) {
                        ret = -ENOMEM;
                        goto out;
                }

                ret = posix_acl_to_xattr(&init_user_ns, acl, value, size);
                if (ret < 0)
                        goto out;
        }

        if (trans)
                ret = btrfs_setxattr(trans, inode, name, value, size, 0);
        else
                ret = btrfs_setxattr_trans(inode, name, value, size, 0);

out:
        kfree(value);

        if (!ret)
                set_cached_acl(inode, type, acl);

        return ret;
}

int btrfs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
                  struct posix_acl *acl, int type)
{
        int ret;
        struct inode *inode = d_inode(dentry);
        umode_t old_mode = inode->i_mode;

        if (type == ACL_TYPE_ACCESS && acl) {
                ret = posix_acl_update_mode(idmap, inode,
                                            &inode->i_mode, &acl);
                if (ret)
                        return ret;
        }
        ret = __btrfs_set_acl(NULL, inode, acl, type);
        if (ret)
                inode->i_mode = old_mode;
        return ret;
}






































































































































































































































































































    5 
















































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
/* SPDX-License-Identifier: GPL-2.0 */
/*
 *  linux/fs/ufs/util.h
 *
 * Copyright (C) 1998 
 * Daniel Pirkl <daniel.pirkl@email.cz>
 * Charles University, Faculty of Mathematics and Physics
 */

#include <linux/buffer_head.h>
#include <linux/fs.h>
#include "swab.h"

/*
 * functions used for retyping
 */
static inline struct ufs_buffer_head *UCPI_UBH(struct ufs_cg_private_info *cpi)
{
        return &cpi->c_ubh;
}
static inline struct ufs_buffer_head *USPI_UBH(struct ufs_sb_private_info *spi)
{
        return &spi->s_ubh;
}



/*
 * macros used for accessing structures
 */
static inline s32
ufs_get_fs_state(struct super_block *sb, struct ufs_super_block_first *usb1,
                 struct ufs_super_block_third *usb3)
{
        switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
        case UFS_ST_SUNOS:
                if (fs32_to_cpu(sb, usb3->fs_postblformat) == UFS_42POSTBLFMT)
                        return fs32_to_cpu(sb, usb1->fs_u0.fs_sun.fs_state);
                fallthrough;        /* to UFS_ST_SUN */
        case UFS_ST_SUN:
                return fs32_to_cpu(sb, usb3->fs_un2.fs_sun.fs_state);
        case UFS_ST_SUNx86:
                return fs32_to_cpu(sb, usb1->fs_u1.fs_sunx86.fs_state);
        case UFS_ST_44BSD:
        default:
                return fs32_to_cpu(sb, usb3->fs_un2.fs_44.fs_state);
        }
}

static inline void
ufs_set_fs_state(struct super_block *sb, struct ufs_super_block_first *usb1,
                 struct ufs_super_block_third *usb3, s32 value)
{
        switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
        case UFS_ST_SUNOS:
                if (fs32_to_cpu(sb, usb3->fs_postblformat) == UFS_42POSTBLFMT) {
                        usb1->fs_u0.fs_sun.fs_state = cpu_to_fs32(sb, value);
                        break;
                }
                fallthrough;        /* to UFS_ST_SUN */
        case UFS_ST_SUN:
                usb3->fs_un2.fs_sun.fs_state = cpu_to_fs32(sb, value);
                break;
        case UFS_ST_SUNx86:
                usb1->fs_u1.fs_sunx86.fs_state = cpu_to_fs32(sb, value);
                break;
        case UFS_ST_44BSD:
                usb3->fs_un2.fs_44.fs_state = cpu_to_fs32(sb, value);
                break;
        }
}

static inline u32
ufs_get_fs_npsect(struct super_block *sb, struct ufs_super_block_first *usb1,
                  struct ufs_super_block_third *usb3)
{
        if ((UFS_SB(sb)->s_flags & UFS_ST_MASK) == UFS_ST_SUNx86)
                return fs32_to_cpu(sb, usb3->fs_un2.fs_sunx86.fs_npsect);
        else
                return fs32_to_cpu(sb, usb1->fs_u1.fs_sun.fs_npsect);
}

static inline u64
ufs_get_fs_qbmask(struct super_block *sb, struct ufs_super_block_third *usb3)
{
        __fs64 tmp;

        switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
        case UFS_ST_SUNOS:
        case UFS_ST_SUN:
                ((__fs32 *)&tmp)[0] = usb3->fs_un2.fs_sun.fs_qbmask[0];
                ((__fs32 *)&tmp)[1] = usb3->fs_un2.fs_sun.fs_qbmask[1];
                break;
        case UFS_ST_SUNx86:
                ((__fs32 *)&tmp)[0] = usb3->fs_un2.fs_sunx86.fs_qbmask[0];
                ((__fs32 *)&tmp)[1] = usb3->fs_un2.fs_sunx86.fs_qbmask[1];
                break;
        case UFS_ST_44BSD:
                ((__fs32 *)&tmp)[0] = usb3->fs_un2.fs_44.fs_qbmask[0];
                ((__fs32 *)&tmp)[1] = usb3->fs_un2.fs_44.fs_qbmask[1];
                break;
        }

        return fs64_to_cpu(sb, tmp);
}

static inline u64
ufs_get_fs_qfmask(struct super_block *sb, struct ufs_super_block_third *usb3)
{
        __fs64 tmp;

        switch (UFS_SB(sb)->s_flags & UFS_ST_MASK) {
        case UFS_ST_SUNOS:
        case UFS_ST_SUN:
                ((__fs32 *)&tmp)[0] = usb3->fs_un2.fs_sun.fs_qfmask[0];
                ((__fs32 *)&tmp)[1] = usb3->fs_un2.fs_sun.fs_qfmask[1];
                break;
        case UFS_ST_SUNx86:
                ((__fs32 *)&tmp)[0] = usb3->fs_un2.fs_sunx86.fs_qfmask[0];
                ((__fs32 *)&tmp)[1] = usb3->fs_un2.fs_sunx86.fs_qfmask[1];
                break;
        case UFS_ST_44BSD:
                ((__fs32 *)&tmp)[0] = usb3->fs_un2.fs_44.fs_qfmask[0];
                ((__fs32 *)&tmp)[1] = usb3->fs_un2.fs_44.fs_qfmask[1];
                break;
        }

        return fs64_to_cpu(sb, tmp);
}

static inline u16
ufs_get_de_namlen(struct super_block *sb, struct ufs_dir_entry *de)
{
        if ((UFS_SB(sb)->s_flags & UFS_DE_MASK) == UFS_DE_OLD)
                return fs16_to_cpu(sb, de->d_u.d_namlen);
        else
                return de->d_u.d_44.d_namlen; /* XXX this seems wrong */
}

static inline void
ufs_set_de_namlen(struct super_block *sb, struct ufs_dir_entry *de, u16 value)
{
        if ((UFS_SB(sb)->s_flags & UFS_DE_MASK) == UFS_DE_OLD)
                de->d_u.d_namlen = cpu_to_fs16(sb, value);
        else
                de->d_u.d_44.d_namlen = value; /* XXX this seems wrong */
}

static inline void
ufs_set_de_type(struct super_block *sb, struct ufs_dir_entry *de, int mode)
{
        if ((UFS_SB(sb)->s_flags & UFS_DE_MASK) != UFS_DE_44BSD)
                return;

        /*
         * TODO turn this into a table lookup
         */
        switch (mode & S_IFMT) {
        case S_IFSOCK:
                de->d_u.d_44.d_type = DT_SOCK;
                break;
        case S_IFLNK:
                de->d_u.d_44.d_type = DT_LNK;
                break;
        case S_IFREG:
                de->d_u.d_44.d_type = DT_REG;
                break;
        case S_IFBLK:
                de->d_u.d_44.d_type = DT_BLK;
                break;
        case S_IFDIR:
                de->d_u.d_44.d_type = DT_DIR;
                break;
        case S_IFCHR:
                de->d_u.d_44.d_type = DT_CHR;
                break;
        case S_IFIFO:
                de->d_u.d_44.d_type = DT_FIFO;
                break;
        default:
                de->d_u.d_44.d_type = DT_UNKNOWN;
        }
}

static inline u32
ufs_get_inode_uid(struct super_block *sb, struct ufs_inode *inode)
{
        switch (UFS_SB(sb)->s_flags & UFS_UID_MASK) {
        case UFS_UID_44BSD:
                return fs32_to_cpu(sb, inode->ui_u3.ui_44.ui_uid);
        case UFS_UID_EFT:
                if (inode->ui_u1.oldids.ui_suid == 0xFFFF)
                        return fs32_to_cpu(sb, inode->ui_u3.ui_sun.ui_uid);
                fallthrough;
        default:
                return fs16_to_cpu(sb, inode->ui_u1.oldids.ui_suid);
        }
}

static inline void
ufs_set_inode_uid(struct super_block *sb, struct ufs_inode *inode, u32 value)
{
        switch (UFS_SB(sb)->s_flags & UFS_UID_MASK) {
        case UFS_UID_44BSD:
                inode->ui_u3.ui_44.ui_uid = cpu_to_fs32(sb, value);
                inode->ui_u1.oldids.ui_suid = cpu_to_fs16(sb, value);
                break;
        case UFS_UID_EFT:
                inode->ui_u3.ui_sun.ui_uid = cpu_to_fs32(sb, value);
                if (value > 0xFFFF)
                        value = 0xFFFF;
                fallthrough;
        default:
                inode->ui_u1.oldids.ui_suid = cpu_to_fs16(sb, value);
                break;
        }
}

static inline u32
ufs_get_inode_gid(struct super_block *sb, struct ufs_inode *inode)
{
        switch (UFS_SB(sb)->s_flags & UFS_UID_MASK) {
        case UFS_UID_44BSD:
                return fs32_to_cpu(sb, inode->ui_u3.ui_44.ui_gid);
        case UFS_UID_EFT:
                if (inode->ui_u1.oldids.ui_sgid == 0xFFFF)
                        return fs32_to_cpu(sb, inode->ui_u3.ui_sun.ui_gid);
                fallthrough;
        default:
                return fs16_to_cpu(sb, inode->ui_u1.oldids.ui_sgid);
        }
}

static inline void
ufs_set_inode_gid(struct super_block *sb, struct ufs_inode *inode, u32 value)
{
        switch (UFS_SB(sb)->s_flags & UFS_UID_MASK) {
        case UFS_UID_44BSD:
                inode->ui_u3.ui_44.ui_gid = cpu_to_fs32(sb, value);
                inode->ui_u1.oldids.ui_sgid =  cpu_to_fs16(sb, value);
                break;
        case UFS_UID_EFT:
                inode->ui_u3.ui_sun.ui_gid = cpu_to_fs32(sb, value);
                if (value > 0xFFFF)
                        value = 0xFFFF;
                fallthrough;
        default:
                inode->ui_u1.oldids.ui_sgid =  cpu_to_fs16(sb, value);
                break;
        }
}

dev_t ufs_get_inode_dev(struct super_block *, struct ufs_inode_info *);
void ufs_set_inode_dev(struct super_block *, struct ufs_inode_info *, dev_t);
int ufs_prepare_chunk(struct folio *folio, loff_t pos, unsigned len);

/*
 * These functions manipulate ufs buffers
 */
#define ubh_bread(sb,fragment,size) _ubh_bread_(uspi,sb,fragment,size)  
extern struct ufs_buffer_head * _ubh_bread_(struct ufs_sb_private_info *, struct super_block *, u64 , u64);
extern struct ufs_buffer_head * ubh_bread_uspi(struct ufs_sb_private_info *, struct super_block *, u64, u64);
extern void ubh_brelse (struct ufs_buffer_head *);
extern void ubh_brelse_uspi (struct ufs_sb_private_info *);
extern void ubh_mark_buffer_dirty (struct ufs_buffer_head *);
extern void ubh_mark_buffer_uptodate (struct ufs_buffer_head *, int);
extern void ubh_sync_block(struct ufs_buffer_head *);
extern void ubh_bforget (struct ufs_buffer_head *);
extern int  ubh_buffer_dirty (struct ufs_buffer_head *);
#define ubh_ubhcpymem(mem,ubh,size) _ubh_ubhcpymem_(uspi,mem,ubh,size)
extern void _ubh_ubhcpymem_(struct ufs_sb_private_info *, unsigned char *, struct ufs_buffer_head *, unsigned);
#define ubh_memcpyubh(ubh,mem,size) _ubh_memcpyubh_(uspi,ubh,mem,size)
extern void _ubh_memcpyubh_(struct ufs_sb_private_info *, struct ufs_buffer_head *, unsigned char *, unsigned);

/* This functions works with cache pages*/
struct folio *ufs_get_locked_folio(struct address_space *mapping, pgoff_t index);
static inline void ufs_put_locked_folio(struct folio *folio)
{
       folio_unlock(folio);
       folio_put(folio);
}

/*
 * macros and inline function to get important structures from ufs_sb_private_info
 */

static inline void *get_usb_offset(struct ufs_sb_private_info *uspi,
                                   unsigned int offset)
{
        unsigned int index;
        
        index = offset >> uspi->s_fshift;
        offset &= ~uspi->s_fmask;
        return uspi->s_ubh.bh[index]->b_data + offset;
}

#define ubh_get_usb_first(uspi) \
        ((struct ufs_super_block_first *)get_usb_offset((uspi), 0))

#define ubh_get_usb_second(uspi) \
        ((struct ufs_super_block_second *)get_usb_offset((uspi), UFS_SECTOR_SIZE))

#define ubh_get_usb_third(uspi)        \
        ((struct ufs_super_block_third *)get_usb_offset((uspi), 2*UFS_SECTOR_SIZE))


#define ubh_get_ucg(ubh) \
        ((struct ufs_cylinder_group *)((ubh)->bh[0]->b_data))


/*
 * Extract byte from ufs_buffer_head
 * Extract the bits for a block from a map inside ufs_buffer_head
 */
#define ubh_get_addr8(ubh,begin) \
        ((u8*)(ubh)->bh[(begin) >> uspi->s_fshift]->b_data + \
        ((begin) & ~uspi->s_fmask))

#define ubh_get_addr16(ubh,begin) \
        (((__fs16*)((ubh)->bh[(begin) >> (uspi->s_fshift-1)]->b_data)) + \
        ((begin) & ((uspi->fsize>>1) - 1)))

#define ubh_get_addr32(ubh,begin) \
        (((__fs32*)((ubh)->bh[(begin) >> (uspi->s_fshift-2)]->b_data)) + \
        ((begin) & ((uspi->s_fsize>>2) - 1)))

#define ubh_get_addr64(ubh,begin) \
        (((__fs64*)((ubh)->bh[(begin) >> (uspi->s_fshift-3)]->b_data)) + \
        ((begin) & ((uspi->s_fsize>>3) - 1)))

#define ubh_get_addr ubh_get_addr8

static inline void *ubh_get_data_ptr(struct ufs_sb_private_info *uspi,
                                     struct ufs_buffer_head *ubh,
                                     u64 blk)
{
        if (uspi->fs_magic == UFS2_MAGIC)
                return ubh_get_addr64(ubh, blk);
        else
                return ubh_get_addr32(ubh, blk);
}

#define ubh_blkmap(ubh,begin,bit) \
        ((*ubh_get_addr(ubh, (begin) + ((bit) >> 3)) >> ((bit) & 7)) & (0xff >> (UFS_MAXFRAG - uspi->s_fpb)))

static inline u64
ufs_freefrags(struct ufs_sb_private_info *uspi)
{
        return ufs_blkstofrags(uspi->cs_total.cs_nbfree) +
                uspi->cs_total.cs_nffree;
}

/*
 * Macros to access cylinder group array structures
 */
#define ubh_cg_blktot(ucpi,cylno) \
        (*((__fs32*)ubh_get_addr(UCPI_UBH(ucpi), (ucpi)->c_btotoff + ((cylno) << 2))))

#define ubh_cg_blks(ucpi,cylno,rpos) \
        (*((__fs16*)ubh_get_addr(UCPI_UBH(ucpi), \
        (ucpi)->c_boff + (((cylno) * uspi->s_nrpos + (rpos)) << 1 ))))

/*
 * Bitmap operations
 * These functions work like classical bitmap operations.
 * The difference is that we don't have the whole bitmap
 * in one contiguous chunk of memory, but in several buffers.
 * The parameters of each function are super_block, ufs_buffer_head and
 * position of the beginning of the bitmap.
 */
#define ubh_setbit(ubh,begin,bit) \
        (*ubh_get_addr(ubh, (begin) + ((bit) >> 3)) |= (1 << ((bit) & 7)))

#define ubh_clrbit(ubh,begin,bit) \
        (*ubh_get_addr (ubh, (begin) + ((bit) >> 3)) &= ~(1 << ((bit) & 7)))

#define ubh_isset(ubh,begin,bit) \
        (*ubh_get_addr (ubh, (begin) + ((bit) >> 3)) & (1 << ((bit) & 7)))

#define ubh_isclr(ubh,begin,bit) (!ubh_isset(ubh,begin,bit))

#define ubh_find_first_zero_bit(ubh,begin,size) _ubh_find_next_zero_bit_(uspi,ubh,begin,size,0)

#define ubh_find_next_zero_bit(ubh,begin,size,offset) _ubh_find_next_zero_bit_(uspi,ubh,begin,size,offset)
static inline unsigned _ubh_find_next_zero_bit_(
        struct ufs_sb_private_info * uspi, struct ufs_buffer_head * ubh,
        unsigned begin, unsigned size, unsigned offset)
{
        unsigned base, count, pos;

        size -= offset;
        begin <<= 3;
        offset += begin;
        base = offset >> uspi->s_bpfshift;
        offset &= uspi->s_bpfmask;
        for (;;) {
                count = min_t(unsigned int, size + offset, uspi->s_bpf);
                size -= count - offset;
                pos = find_next_zero_bit_le(ubh->bh[base]->b_data, count, offset);
                if (pos < count || !size)
                        break;
                base++;
                offset = 0;
        }
        return (base << uspi->s_bpfshift) + pos - begin;
}         

static inline unsigned find_last_zero_bit (unsigned char * bitmap,
        unsigned size, unsigned offset)
{
        unsigned bit, i;
        unsigned char * mapp;
        unsigned char map;

        mapp = bitmap + (size >> 3);
        map = *mapp--;
        bit = 1 << (size & 7);
        for (i = size; i > offset; i--) {
                if ((map & bit) == 0)
                        break;
                if ((i & 7) != 0) {
                        bit >>= 1;
                } else {
                        map = *mapp--;
                        bit = 1 << 7;
                }
        }
        return i;
}

#define ubh_find_last_zero_bit(ubh,begin,size,offset) _ubh_find_last_zero_bit_(uspi,ubh,begin,size,offset)
static inline unsigned _ubh_find_last_zero_bit_(
        struct ufs_sb_private_info * uspi, struct ufs_buffer_head * ubh,
        unsigned begin, unsigned start, unsigned end)
{
        unsigned base, count, pos, size;

        size = start - end;
        begin <<= 3;
        start += begin;
        base = start >> uspi->s_bpfshift;
        start &= uspi->s_bpfmask;
        for (;;) {
                count = min_t(unsigned int,
                            size + (uspi->s_bpf - start), uspi->s_bpf)
                        - (uspi->s_bpf - start);
                size -= count;
                pos = find_last_zero_bit (ubh->bh[base]->b_data,
                        start, start - count);
                if (pos > start - count || !size)
                        break;
                base--;
                start = uspi->s_bpf;
        }
        return (base << uspi->s_bpfshift) + pos - begin;
}         

#define ubh_isblockclear(ubh,begin,block) (!_ubh_isblockset_(uspi,ubh,begin,block))

#define ubh_isblockset(ubh,begin,block) _ubh_isblockset_(uspi,ubh,begin,block)
static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi,
        struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
{
        u8 mask;
        switch (uspi->s_fpb) {
        case 8:
                    return (*ubh_get_addr (ubh, begin + block) == 0xff);
        case 4:
                mask = 0x0f << ((block & 0x01) << 2);
                return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask;
        case 2:
                mask = 0x03 << ((block & 0x03) << 1);
                return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask;
        case 1:
                mask = 0x01 << (block & 0x07);
                return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask;
        }
        return 0;        
}

#define ubh_clrblock(ubh,begin,block) _ubh_clrblock_(uspi,ubh,begin,block)
static inline void _ubh_clrblock_(struct ufs_sb_private_info * uspi,
        struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
{
        switch (uspi->s_fpb) {
        case 8:
                    *ubh_get_addr (ubh, begin + block) = 0x00;
                    return; 
        case 4:
                *ubh_get_addr (ubh, begin + (block >> 1)) &= ~(0x0f << ((block & 0x01) << 2));
                return;
        case 2:
                *ubh_get_addr (ubh, begin + (block >> 2)) &= ~(0x03 << ((block & 0x03) << 1));
                return;
        case 1:
                *ubh_get_addr (ubh, begin + (block >> 3)) &= ~(0x01 << ((block & 0x07)));
                return;
        }
}

#define ubh_setblock(ubh,begin,block) _ubh_setblock_(uspi,ubh,begin,block)
static inline void _ubh_setblock_(struct ufs_sb_private_info * uspi,
        struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
{
        switch (uspi->s_fpb) {
        case 8:
                    *ubh_get_addr(ubh, begin + block) = 0xff;
                    return;
        case 4:
                *ubh_get_addr(ubh, begin + (block >> 1)) |= (0x0f << ((block & 0x01) << 2));
                return;
        case 2:
                *ubh_get_addr(ubh, begin + (block >> 2)) |= (0x03 << ((block & 0x03) << 1));
                return;
        case 1:
                *ubh_get_addr(ubh, begin + (block >> 3)) |= (0x01 << ((block & 0x07)));
                return;
        }
}

static inline void ufs_fragacct (struct super_block * sb, unsigned blockmap,
        __fs32 * fraglist, int cnt)
{
        struct ufs_sb_private_info * uspi;
        unsigned fragsize, pos;
        
        uspi = UFS_SB(sb)->s_uspi;
        
        fragsize = 0;
        for (pos = 0; pos < uspi->s_fpb; pos++) {
                if (blockmap & (1 << pos)) {
                        fragsize++;
                }
                else if (fragsize > 0) {
                        fs32_add(sb, &fraglist[fragsize], cnt);
                        fragsize = 0;
                }
        }
        if (fragsize > 0 && fragsize < uspi->s_fpb)
                fs32_add(sb, &fraglist[fragsize], cnt);
}

static inline void *ufs_get_direct_data_ptr(struct ufs_sb_private_info *uspi,
                                            struct ufs_inode_info *ufsi,
                                            unsigned blk)
{
        BUG_ON(blk > UFS_TIND_BLOCK);
        return uspi->fs_magic == UFS2_MAGIC ?
                (void *)&ufsi->i_u1.u2_i_data[blk] :
                (void *)&ufsi->i_u1.i_data[blk];
}

static inline u64 ufs_data_ptr_to_cpu(struct super_block *sb, void *p)
{
        return UFS_SB(sb)->s_uspi->fs_magic == UFS2_MAGIC ?
                fs64_to_cpu(sb, *(__fs64 *)p) :
                fs32_to_cpu(sb, *(__fs32 *)p);
}

static inline void ufs_cpu_to_data_ptr(struct super_block *sb, void *p, u64 val)
{
        if (UFS_SB(sb)->s_uspi->fs_magic == UFS2_MAGIC)
                *(__fs64 *)p = cpu_to_fs64(sb, val);
        else
                *(__fs32 *)p = cpu_to_fs32(sb, val);
}

static inline void ufs_data_ptr_clear(struct ufs_sb_private_info *uspi,
                                      void *p)
{
        if (uspi->fs_magic == UFS2_MAGIC)
                *(__fs64 *)p = 0;
        else
                *(__fs32 *)p = 0;
}

static inline int ufs_is_data_ptr_zero(struct ufs_sb_private_info *uspi,
                                       void *p)
{
        if (uspi->fs_magic == UFS2_MAGIC)
                return *(__fs64 *)p == 0;
        else
                return *(__fs32 *)p == 0;
}

static inline __fs32 ufs_get_seconds(struct super_block *sbp)
{
        time64_t now = ktime_get_real_seconds();

        /* Signed 32-bit interpretation wraps around in 2038, which
         * happens in ufs1 inode stamps but not ufs2 using 64-bits
         * stamps. For superblock and blockgroup, let's assume
         * unsigned 32-bit stamps, which are good until y2106.
         * Wrap around rather than clamp here to make the dirty
         * file system detection work in the superblock stamp.
         */
        return cpu_to_fs32(sbp, lower_32_bits(now));
}










































































































































































































































































































































































































































































































   55 

















   55 















   55 





















































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef __NET_GENERIC_NETLINK_H
#define __NET_GENERIC_NETLINK_H

#include <linux/net.h>
#include <net/netlink.h>
#include <net/net_namespace.h>
#include <uapi/linux/genetlink.h>

#define GENLMSG_DEFAULT_SIZE (NLMSG_DEFAULT_SIZE - GENL_HDRLEN)

/* Non-parallel generic netlink requests are serialized by a global lock. */
void genl_lock(void);
void genl_unlock(void);

#define MODULE_ALIAS_GENL_FAMILY(family) \
 MODULE_ALIAS_NET_PF_PROTO_NAME(PF_NETLINK, NETLINK_GENERIC, "-family-" family)

/* Binding to multicast group requires %CAP_NET_ADMIN */
#define GENL_MCAST_CAP_NET_ADMIN        BIT(0)
/* Binding to multicast group requires %CAP_SYS_ADMIN */
#define GENL_MCAST_CAP_SYS_ADMIN        BIT(1)

/**
 * struct genl_multicast_group - generic netlink multicast group
 * @name: name of the multicast group, names are per-family
 * @flags: GENL_MCAST_* flags
 */
struct genl_multicast_group {
        char                        name[GENL_NAMSIZ];
        u8                        flags;
};

struct genl_split_ops;
struct genl_info;

/**
 * struct genl_family - generic netlink family
 * @hdrsize: length of user specific header in bytes
 * @name: name of family
 * @version: protocol version
 * @maxattr: maximum number of attributes supported
 * @policy: netlink policy
 * @netnsok: set to true if the family can handle network
 *        namespaces and should be presented in all of them
 * @parallel_ops: operations can be called in parallel and aren't
 *        synchronized by the core genetlink code
 * @pre_doit: called before an operation's doit callback, it may
 *        do additional, common, filtering and return an error
 * @post_doit: called after an operation's doit callback, it may
 *        undo operations done by pre_doit, for example release locks
 * @bind: called when family multicast group is added to a netlink socket
 * @unbind: called when family multicast group is removed from a netlink socket
 * @module: pointer to the owning module (set to THIS_MODULE)
 * @mcgrps: multicast groups used by this family
 * @n_mcgrps: number of multicast groups
 * @resv_start_op: first operation for which reserved fields of the header
 *        can be validated and policies are required (see below);
 *        new families should leave this field at zero
 * @ops: the operations supported by this family
 * @n_ops: number of operations supported by this family
 * @small_ops: the small-struct operations supported by this family
 * @n_small_ops: number of small-struct operations supported by this family
 * @split_ops: the split do/dump form of operation definition
 * @n_split_ops: number of entries in @split_ops, not that with split do/dump
 *        ops the number of entries is not the same as number of commands
 * @sock_priv_size: the size of per-socket private memory
 * @sock_priv_init: the per-socket private memory initializer
 * @sock_priv_destroy: the per-socket private memory destructor
 *
 * Attribute policies (the combination of @policy and @maxattr fields)
 * can be attached at the family level or at the operation level.
 * If both are present the per-operation policy takes precedence.
 * For operations before @resv_start_op lack of policy means that the core
 * will perform no attribute parsing or validation. For newer operations
 * if policy is not provided core will reject all TLV attributes.
 */
struct genl_family {
        unsigned int                hdrsize;
        char                        name[GENL_NAMSIZ];
        unsigned int                version;
        unsigned int                maxattr;
        u8                        netnsok:1;
        u8                        parallel_ops:1;
        u8                        n_ops;
        u8                        n_small_ops;
        u8                        n_split_ops;
        u8                        n_mcgrps;
        u8                        resv_start_op;
        const struct nla_policy *policy;
        int                        (*pre_doit)(const struct genl_split_ops *ops,
                                            struct sk_buff *skb,
                                            struct genl_info *info);
        void                        (*post_doit)(const struct genl_split_ops *ops,
                                             struct sk_buff *skb,
                                             struct genl_info *info);
        int                        (*bind)(int mcgrp);
        void                        (*unbind)(int mcgrp);
        const struct genl_ops *        ops;
        const struct genl_small_ops *small_ops;
        const struct genl_split_ops *split_ops;
        const struct genl_multicast_group *mcgrps;
        struct module                *module;

        size_t                        sock_priv_size;
        void                        (*sock_priv_init)(void *priv);
        void                        (*sock_priv_destroy)(void *priv);

/* private: internal use only */
        /* protocol family identifier */
        int                        id;
        /* starting number of multicast group IDs in this family */
        unsigned int                mcgrp_offset;
        /* list of per-socket privs */
        struct xarray                *sock_privs;
};

/**
 * struct genl_info - receiving information
 * @snd_seq: sending sequence number
 * @snd_portid: netlink portid of sender
 * @family: generic netlink family
 * @nlhdr: netlink message header
 * @genlhdr: generic netlink message header
 * @attrs: netlink attributes
 * @_net: network namespace
 * @user_ptr: user pointers
 * @extack: extended ACK report struct
 */
struct genl_info {
        u32                        snd_seq;
        u32                        snd_portid;
        const struct genl_family *family;
        const struct nlmsghdr *        nlhdr;
        struct genlmsghdr *        genlhdr;
        struct nlattr **        attrs;
        possible_net_t                _net;
        void *                        user_ptr[2];
        struct netlink_ext_ack *extack;
};

static inline struct net *genl_info_net(const struct genl_info *info)
{
        return read_pnet(&info->_net);
}

static inline void genl_info_net_set(struct genl_info *info, struct net *net)
{
        write_pnet(&info->_net, net);
}

static inline void *genl_info_userhdr(const struct genl_info *info)
{
        return (u8 *)info->genlhdr + GENL_HDRLEN;
}

#define GENL_SET_ERR_MSG(info, msg) NL_SET_ERR_MSG((info)->extack, msg)

#define GENL_SET_ERR_MSG_FMT(info, msg, args...) \
        NL_SET_ERR_MSG_FMT((info)->extack, msg, ##args)

/* Report that a root attribute is missing */
#define GENL_REQ_ATTR_CHECK(info, attr) ({                                \
        const struct genl_info *__info = (info);                        \
                                                                        \
        NL_REQ_ATTR_CHECK(__info->extack, NULL, __info->attrs, (attr)); \
})

enum genl_validate_flags {
        GENL_DONT_VALIDATE_STRICT                = BIT(0),
        GENL_DONT_VALIDATE_DUMP                        = BIT(1),
        GENL_DONT_VALIDATE_DUMP_STRICT                = BIT(2),
};

/**
 * struct genl_small_ops - generic netlink operations (small version)
 * @cmd: command identifier
 * @internal_flags: flags used by the family
 * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM)
 * @validate: validation flags from enum genl_validate_flags
 * @doit: standard command callback
 * @dumpit: callback for dumpers
 *
 * This is a cut-down version of struct genl_ops for users who don't need
 * most of the ancillary infra and want to save space.
 */
struct genl_small_ops {
        int        (*doit)(struct sk_buff *skb, struct genl_info *info);
        int        (*dumpit)(struct sk_buff *skb, struct netlink_callback *cb);
        u8        cmd;
        u8        internal_flags;
        u8        flags;
        u8        validate;
};

/**
 * struct genl_ops - generic netlink operations
 * @cmd: command identifier
 * @internal_flags: flags used by the family
 * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM)
 * @maxattr: maximum number of attributes supported
 * @policy: netlink policy (takes precedence over family policy)
 * @validate: validation flags from enum genl_validate_flags
 * @doit: standard command callback
 * @start: start callback for dumps
 * @dumpit: callback for dumpers
 * @done: completion callback for dumps
 */
struct genl_ops {
        int                       (*doit)(struct sk_buff *skb,
                                       struct genl_info *info);
        int                       (*start)(struct netlink_callback *cb);
        int                       (*dumpit)(struct sk_buff *skb,
                                         struct netlink_callback *cb);
        int                       (*done)(struct netlink_callback *cb);
        const struct nla_policy *policy;
        unsigned int                maxattr;
        u8                        cmd;
        u8                        internal_flags;
        u8                        flags;
        u8                        validate;
};

/**
 * struct genl_split_ops - generic netlink operations (do/dump split version)
 * @cmd: command identifier
 * @internal_flags: flags used by the family
 * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM)
 * @validate: validation flags from enum genl_validate_flags
 * @policy: netlink policy (takes precedence over family policy)
 * @maxattr: maximum number of attributes supported
 *
 * Do callbacks:
 * @pre_doit: called before an operation's @doit callback, it may
 *        do additional, common, filtering and return an error
 * @doit: standard command callback
 * @post_doit: called after an operation's @doit callback, it may
 *        undo operations done by pre_doit, for example release locks
 *
 * Dump callbacks:
 * @start: start callback for dumps
 * @dumpit: callback for dumpers
 * @done: completion callback for dumps
 *
 * Do callbacks can be used if %GENL_CMD_CAP_DO is set in @flags.
 * Dump callbacks can be used if %GENL_CMD_CAP_DUMP is set in @flags.
 * Exactly one of those flags must be set.
 */
struct genl_split_ops {
        union {
                struct {
                        int (*pre_doit)(const struct genl_split_ops *ops,
                                        struct sk_buff *skb,
                                        struct genl_info *info);
                        int (*doit)(struct sk_buff *skb,
                                    struct genl_info *info);
                        void (*post_doit)(const struct genl_split_ops *ops,
                                          struct sk_buff *skb,
                                          struct genl_info *info);
                };
                struct {
                        int (*start)(struct netlink_callback *cb);
                        int (*dumpit)(struct sk_buff *skb,
                                      struct netlink_callback *cb);
                        int (*done)(struct netlink_callback *cb);
                };
        };
        const struct nla_policy *policy;
        unsigned int                maxattr;
        u8                        cmd;
        u8                        internal_flags;
        u8                        flags;
        u8                        validate;
};

/**
 * struct genl_dumpit_info - info that is available during dumpit op call
 * @op: generic netlink ops - for internal genl code usage
 * @attrs: netlink attributes
 * @info: struct genl_info describing the request
 */
struct genl_dumpit_info {
        struct genl_split_ops op;
        struct genl_info info;
};

static inline const struct genl_dumpit_info *
genl_dumpit_info(struct netlink_callback *cb)
{
        return cb->data;
}

static inline const struct genl_info *
genl_info_dump(struct netlink_callback *cb)
{
        return &genl_dumpit_info(cb)->info;
}

/**
 * genl_info_init_ntf() - initialize genl_info for notifications
 * @info:   genl_info struct to set up
 * @family: pointer to the genetlink family
 * @cmd:    command to be used in the notification
 *
 * Initialize a locally declared struct genl_info to pass to various APIs.
 * Intended to be used when creating notifications.
 */
static inline void
genl_info_init_ntf(struct genl_info *info, const struct genl_family *family,
                   u8 cmd)
{
        struct genlmsghdr *hdr = (void *) &info->user_ptr[0];

        memset(info, 0, sizeof(*info));
        info->family = family;
        info->genlhdr = hdr;
        hdr->cmd = cmd;
}

static inline bool genl_info_is_ntf(const struct genl_info *info)
{
        return !info->nlhdr;
}

void *__genl_sk_priv_get(struct genl_family *family, struct sock *sk);
void *genl_sk_priv_get(struct genl_family *family, struct sock *sk);
int genl_register_family(struct genl_family *family);
int genl_unregister_family(const struct genl_family *family);
void genl_notify(const struct genl_family *family, struct sk_buff *skb,
                 struct genl_info *info, u32 group, gfp_t flags);

void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq,
                  const struct genl_family *family, int flags, u8 cmd);

static inline void *
__genlmsg_iput(struct sk_buff *skb, const struct genl_info *info, int flags)
{
        return genlmsg_put(skb, info->snd_portid, info->snd_seq, info->family,
                           flags, info->genlhdr->cmd);
}

/**
 * genlmsg_iput - start genetlink message based on genl_info
 * @skb: skb in which message header will be placed
 * @info: genl_info as provided to do/dump handlers
 *
 * Convenience wrapper which starts a genetlink message based on
 * information in user request. @info should be either the struct passed
 * by genetlink core to do/dump handlers (when constructing replies to
 * such requests) or a struct initialized by genl_info_init_ntf()
 * when constructing notifications.
 *
 * Returns pointer to new genetlink header.
 */
static inline void *
genlmsg_iput(struct sk_buff *skb, const struct genl_info *info)
{
        return __genlmsg_iput(skb, info, 0);
}

/**
 * genlmsg_nlhdr - Obtain netlink header from user specified header
 * @user_hdr: user header as returned from genlmsg_put()
 *
 * Returns pointer to netlink header.
 */
static inline struct nlmsghdr *genlmsg_nlhdr(void *user_hdr)
{
        return (struct nlmsghdr *)((char *)user_hdr -
                                   GENL_HDRLEN -
                                   NLMSG_HDRLEN);
}

/**
 * genlmsg_parse_deprecated - parse attributes of a genetlink message
 * @nlh: netlink message header
 * @family: genetlink message family
 * @tb: destination array with maxtype+1 elements
 * @maxtype: maximum attribute type to be expected
 * @policy: validation policy
 * @extack: extended ACK report struct
 */
static inline int genlmsg_parse_deprecated(const struct nlmsghdr *nlh,
                                           const struct genl_family *family,
                                           struct nlattr *tb[], int maxtype,
                                           const struct nla_policy *policy,
                                           struct netlink_ext_ack *extack)
{
        return __nlmsg_parse(nlh, family->hdrsize + GENL_HDRLEN, tb, maxtype,
                             policy, NL_VALIDATE_LIBERAL, extack);
}

/**
 * genlmsg_parse - parse attributes of a genetlink message
 * @nlh: netlink message header
 * @family: genetlink message family
 * @tb: destination array with maxtype+1 elements
 * @maxtype: maximum attribute type to be expected
 * @policy: validation policy
 * @extack: extended ACK report struct
 */
static inline int genlmsg_parse(const struct nlmsghdr *nlh,
                                const struct genl_family *family,
                                struct nlattr *tb[], int maxtype,
                                const struct nla_policy *policy,
                                struct netlink_ext_ack *extack)
{
        return __nlmsg_parse(nlh, family->hdrsize + GENL_HDRLEN, tb, maxtype,
                             policy, NL_VALIDATE_STRICT, extack);
}

/**
 * genl_dump_check_consistent - check if sequence is consistent and advertise if not
 * @cb: netlink callback structure that stores the sequence number
 * @user_hdr: user header as returned from genlmsg_put()
 *
 * Cf. nl_dump_check_consistent(), this just provides a wrapper to make it
 * simpler to use with generic netlink.
 */
static inline void genl_dump_check_consistent(struct netlink_callback *cb,
                                              void *user_hdr)
{
        nl_dump_check_consistent(cb, genlmsg_nlhdr(user_hdr));
}

/**
 * genlmsg_put_reply - Add generic netlink header to a reply message
 * @skb: socket buffer holding the message
 * @info: receiver info
 * @family: generic netlink family
 * @flags: netlink message flags
 * @cmd: generic netlink command
 *
 * Returns pointer to user specific header
 */
static inline void *genlmsg_put_reply(struct sk_buff *skb,
                                      struct genl_info *info,
                                      const struct genl_family *family,
                                      int flags, u8 cmd)
{
        return genlmsg_put(skb, info->snd_portid, info->snd_seq, family,
                           flags, cmd);
}

/**
 * genlmsg_end - Finalize a generic netlink message
 * @skb: socket buffer the message is stored in
 * @hdr: user specific header
 */
static inline void genlmsg_end(struct sk_buff *skb, void *hdr)
{
        nlmsg_end(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
}

/**
 * genlmsg_cancel - Cancel construction of a generic netlink message
 * @skb: socket buffer the message is stored in
 * @hdr: generic netlink message header
 */
static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
{
        if (hdr)
                nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
}

/**
 * genlmsg_multicast_netns_filtered - multicast a netlink message
 *                                      to a specific netns with filter
 *                                      function
 * @family: the generic netlink family
 * @net: the net namespace
 * @skb: netlink message as socket buffer
 * @portid: own netlink portid to avoid sending to yourself
 * @group: offset of multicast group in groups array
 * @flags: allocation flags
 * @filter: filter function
 * @filter_data: filter function private data
 *
 * Return: 0 on success, negative error code for failure.
 */
static inline int
genlmsg_multicast_netns_filtered(const struct genl_family *family,
                                 struct net *net, struct sk_buff *skb,
                                 u32 portid, unsigned int group, gfp_t flags,
                                 netlink_filter_fn filter,
                                 void *filter_data)
{
        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                return -EINVAL;
        group = family->mcgrp_offset + group;
        return nlmsg_multicast_filtered(net->genl_sock, skb, portid, group,
                                        flags, filter, filter_data);
}

/**
 * genlmsg_multicast_netns - multicast a netlink message to a specific netns
 * @family: the generic netlink family
 * @net: the net namespace
 * @skb: netlink message as socket buffer
 * @portid: own netlink portid to avoid sending to yourself
 * @group: offset of multicast group in groups array
 * @flags: allocation flags
 */
static inline int genlmsg_multicast_netns(const struct genl_family *family,
                                          struct net *net, struct sk_buff *skb,
                                          u32 portid, unsigned int group, gfp_t flags)
{
        return genlmsg_multicast_netns_filtered(family, net, skb, portid,
                                                group, flags, NULL, NULL);
}

/**
 * genlmsg_multicast - multicast a netlink message to the default netns
 * @family: the generic netlink family
 * @skb: netlink message as socket buffer
 * @portid: own netlink portid to avoid sending to yourself
 * @group: offset of multicast group in groups array
 * @flags: allocation flags
 */
static inline int genlmsg_multicast(const struct genl_family *family,
                                    struct sk_buff *skb, u32 portid,
                                    unsigned int group, gfp_t flags)
{
        return genlmsg_multicast_netns(family, &init_net, skb,
                                       portid, group, flags);
}

/**
 * genlmsg_multicast_allns - multicast a netlink message to all net namespaces
 * @family: the generic netlink family
 * @skb: netlink message as socket buffer
 * @portid: own netlink portid to avoid sending to yourself
 * @group: offset of multicast group in groups array
 * @flags: allocation flags
 *
 * This function must hold the RTNL or rcu_read_lock().
 */
int genlmsg_multicast_allns(const struct genl_family *family,
                            struct sk_buff *skb, u32 portid,
                            unsigned int group, gfp_t flags);

/**
 * genlmsg_unicast - unicast a netlink message
 * @net: network namespace to look up @portid in
 * @skb: netlink message as socket buffer
 * @portid: netlink portid of the destination socket
 */
static inline int genlmsg_unicast(struct net *net, struct sk_buff *skb, u32 portid)
{
        return nlmsg_unicast(net->genl_sock, skb, portid);
}

/**
 * genlmsg_reply - reply to a request
 * @skb: netlink message to be sent back
 * @info: receiver information
 */
static inline int genlmsg_reply(struct sk_buff *skb, struct genl_info *info)
{
        return genlmsg_unicast(genl_info_net(info), skb, info->snd_portid);
}

/**
 * genlmsg_data - head of message payload
 * @gnlh: genetlink message header
 */
static inline void *genlmsg_data(const struct genlmsghdr *gnlh)
{
        return ((unsigned char *) gnlh + GENL_HDRLEN);
}

/**
 * genlmsg_len - length of message payload
 * @gnlh: genetlink message header
 */
static inline int genlmsg_len(const struct genlmsghdr *gnlh)
{
        struct nlmsghdr *nlh = (struct nlmsghdr *)((unsigned char *)gnlh -
                                                        NLMSG_HDRLEN);
        return (nlh->nlmsg_len - GENL_HDRLEN - NLMSG_HDRLEN);
}

/**
 * genlmsg_msg_size - length of genetlink message not including padding
 * @payload: length of message payload
 */
static inline int genlmsg_msg_size(int payload)
{
        return GENL_HDRLEN + payload;
}

/**
 * genlmsg_total_size - length of genetlink message including padding
 * @payload: length of message payload
 */
static inline int genlmsg_total_size(int payload)
{
        return NLMSG_ALIGN(genlmsg_msg_size(payload));
}

/**
 * genlmsg_new - Allocate a new generic netlink message
 * @payload: size of the message payload
 * @flags: the type of memory to allocate.
 */
static inline struct sk_buff *genlmsg_new(size_t payload, gfp_t flags)
{
        return nlmsg_new(genlmsg_total_size(payload), flags);
}

/**
 * genl_set_err - report error to genetlink broadcast listeners
 * @family: the generic netlink family
 * @net: the network namespace to report the error to
 * @portid: the PORTID of a process that we want to skip (if any)
 * @group: the broadcast group that will notice the error
 *         (this is the offset of the multicast group in the groups array)
 * @code: error code, must be negative (as usual in kernelspace)
 *
 * This function returns the number of broadcast listeners that have set the
 * NETLINK_RECV_NO_ENOBUFS socket option.
 */
static inline int genl_set_err(const struct genl_family *family,
                               struct net *net, u32 portid,
                               u32 group, int code)
{
        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                return -EINVAL;
        group = family->mcgrp_offset + group;
        return netlink_set_err(net->genl_sock, portid, group, code);
}

static inline int genl_has_listeners(const struct genl_family *family,
                                     struct net *net, unsigned int group)
{
        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                return -EINVAL;
        group = family->mcgrp_offset + group;
        return netlink_has_listeners(net->genl_sock, group);
}
#endif        /* __NET_GENERIC_NETLINK_H */






































































































   28 














   28 





















   27 




   17 































   26 









   12 
















   23 
    2 







   28 

   28 

   28 
   28 
    3 























































































































  233 




  231 
    1 







   51 
  204 







    2 



   41 







    3 



















  187 


























    1 















































































































































































































    8 


















    8 






















































































   30 
    7 
    7 

   30 




   30 

    2 


























  205 






















  205 
   33 









   25 
  205 





    1 






  205 

















































  205 










   28 












    2 


    9 






   20 











    2 



    4 


  201 



   17 



   24 











  205 











    6 
   30 







  205 

















   30 














   30 







   30 
   17 



   15 
   24 

















    4 

   19 















  205 
























   27 































   27 











    8 


    1 











   20 
































    5 



   22 



   18 

    6 














   33 


















    5 


   30 


















   22 









   21 

























   21 








































    2 
   19 















   19 

















   19 












   19 










   18 













   18 












   19 
   17 

















   14 
    5 






   52 









   22 

   39 
























   33 






   33 
   33 












   33 








































  101 
    4 


    2 













   55 

   51 
    8 










   45 
   45 

   45 










   45 
    1 
   45 

   18 

   11 












   21 



   21 



































    4 










    4 









































    4 


















  206 

  206 
    5 


















  206 

  205 

   21 

  205 























  206 

  206 



   55 





  205 
    2 
  205 
    3 











  205 














  205 


















  216 
















  205 




    4 

    4 





  216 






  216 





    9 






  204 
   71 















  205 
























  205 

    1 










  205 

  204 














  207 


































  206 
  206 

  206 
  205 






  206 

  205 
  206 




  206 





  205 























  206 




  206 






















  208 









  196 
  208 




    4 
  207 







  206 
















  206 
    3 










  205 




  205 











  205 

































































  208 





    3 











  187 
    4 



  207 



  196 














   25 













   25 







   51 










   51 
    3 







   14 

































   44 


















    3 















   51 




































   39 




















    1 






   22 














   22 









   51 





   51 



   51 



   51 








   26 






















   23 
   26 







   26 








   26 



   13 













   13 

    6 
   13 









   22 

    2 
   22 










   26 





    8 









  133 

  414 


























































    2 





































































































  447 








   44 











  197 












  197 











  197 








   15 
  184 











  197 












    9 








   57 


  111 




  181 

   69 
  163 





  122 
  167 




  197 





  184 










  184 





  184 



  170 
   14 










   35 
  149 









  184 
















































   32 














    3 














  203 










    8 


















  205 











































































  205 

















  205 
  204 
























  205 
















   11 




  205 




















































































    1 















  205 



























   22 
    1 

















   22 

   22 















  205 









  205 
































  205 
    8 










  205 
















   78 











   38 


   61 





















   61 













  370 




   81 
























   25 


  298 


   81 

   78 






   87 




























   59 


















   31 














    3 

   30 



   31 












































  104 
   70 






  423 
   73 













































  429 
  107 






















































































































  163 













  448 





  164 

  448 










  446 






  448 









































































































































































































  448 













  174 










  175 







  448 











  448 

































































   11 






















   12 
  436 
  162 


  448 



   12 



   12 










   11 
   11 
   11 


   12 




   11 







   11 














   10 




   11 




   12 







   11 















  447 
























  448 







   11 




  447 

































































  448 




































  447 







  448 


















  447 






  448 







  448 



  447 


  435 









    4 


    4 












  158 









  438 





  438 






    8 
    1 
    8 
    3 



  437 







  438 























  448 

  447 










  163 














  447 



  448 





















  447 




















  448 
  448 


  175 

    1 






  175 




  448 
   12 







    1 
   11 



























































  448 








  448 

  446 













  414 
  133 



























    3 









    3 









   33 










   33 






  205 















  205 







   45 




















   45 








    1 












   44 
    2 








































  206 

  206 





















    1 











  205 









    5 



  205 














   34 








   31 

    3 















































































































  413 
    5 


































  141 



   79 



  308 



















  413 





























  414 








    5 






  413 










  309 






    5 




















































































    3 





    3 















    3 














    3 
































































































    3 


    3 










    3 
    3 
    3 
    3 


    3 




    3 







    3 


    3 
    3 

























































































































    3 

    3 

















































    3 





























    3 










































    3 








    3 






    3 





    3 









    3 





    3 








    3 
    3 
    3 







    3 




    3 














    3 



    3 
    3 

    3 



























    3 



    3 


    3 















































    3 

    3 
    2 








    2 










    2 






    2 




    2 







    2 
    2 


    2 


































    3 




    3 

    3 


    3 


    3 





    3 





























    3 



    3 
    2 
    3 


    2 









    2 

























    3 














    3 



















    3 
























    3 

































































    2 


















    2 









    2 












































    2 




























    2 


    2 









    2 









    2 









    2 














































































   15 

























































    4 
























    4 







    1 










    4 




















    8 





















    8 




    6 

    3 






    1 
    3 

    4 




















    6 
    1 




    5 



    6 


    6 
















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014
4015
4016
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214
4215
4216
4217
4218
4219
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
4249
4250
4251
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287
4288
4289
4290
4291
4292
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379
4380
4381
4382
4383
4384
4385
4386
4387
4388
4389
4390
4391
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404
4405
4406
4407
4408
4409
4410
4411
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485
4486
4487
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524
4525
4526
4527
4528
4529
4530
4531
4532
4533
4534
4535
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607
4608
4609
4610
4611
4612
4613
4614
4615
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637
4638
4639
4640
4641
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713
4714
4715
4716
4717
4718
4719
4720
4721
4722
4723
4724
4725
4726
4727
4728
4729
4730
4731
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826
4827
4828
4829
4830
4831
4832
4833
4834
4835
4836
4837
4838
4839
4840
4841
4842
4843
4844
4845
4846
4847
4848
4849
4850
4851
4852
4853
4854
4855
4856
4857
4858
4859
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962
4963
4964
4965
4966
4967
4968
4969
4970
4971
4972
4973
4974
4975
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
5080
5081
5082
5083
5084
5085
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139
5140
5141
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170
5171
5172
5173
5174
5175
5176
5177
5178
5179
5180
5181
5182
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
5198
5199
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209
5210
5211
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225
5226
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252
5253
5254
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284
5285
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335
5336
5337
5338
5339
5340
5341
5342
5343
5344
5345
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358
5359
5360
5361
5362
5363
5364
5365
5366
5367
5368
5369
5370
5371
5372
5373
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396
5397
5398
5399
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411
5412
5413
5414
5415
5416
5417
5418
5419
5420
5421
5422
5423
5424
5425
5426
5427
5428
5429
5430
5431
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513
5514
5515
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529
5530
5531
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
5545
5546
5547
5548
5549
5550
5551
5552
5553
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
5585
5586
5587
5588
5589
5590
5591
5592
5593
5594
5595
5596
5597
5598
5599
5600
5601
5602
5603
5604
5605
5606
5607
5608
5609
5610
5611
5612
5613
5614
5615
5616
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629
5630
5631
5632
5633
5634
5635
5636
5637
5638
5639
5640
5641
5642
5643
5644
5645
5646
5647
5648
5649
5650
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662
5663
5664
5665
5666
5667
5668
5669
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679
5680
5681
5682
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699
5700
5701
5702
5703
5704
5705
5706
5707
5708
5709
5710
5711
5712
5713
5714
5715
5716
5717
5718
5719
5720
5721
5722
5723
5724
5725
5726
5727
5728
5729
5730
5731
5732
5733
5734
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751
5752
5753
5754
5755
5756
5757
5758
5759
5760
5761
5762
5763
5764
5765
5766
5767
5768
5769
5770
5771
5772
5773
5774
5775
5776
5777
5778
5779
5780
5781
5782
5783
5784
5785
5786
5787
5788
5789
5790
5791
5792
5793
5794
5795
5796
5797
5798
5799
5800
5801
5802
5803
5804
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
5815
5816
5817
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827
5828
5829
5830
5831
5832
5833
5834
5835
5836
5837
5838
5839
5840
5841
5842
5843
5844
5845
5846
5847
5848
5849
5850
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865
5866
5867
5868
5869
5870
5871
5872
5873
5874
5875
5876
5877
5878
5879
5880
5881
5882
5883
5884
5885
5886
5887
5888
5889
5890
5891
5892
5893
5894
5895
5896
5897
5898
5899
5900
5901
5902
5903
5904
5905
5906
5907
5908
5909
5910
5911
5912
5913
5914
5915
5916
5917
5918
5919
5920
5921
5922
5923
5924
5925
5926
5927
5928
5929
5930
5931
5932
5933
5934
5935
5936
5937
5938
5939
5940
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
5959
5960
5961
5962
5963
5964
5965
5966
5967
5968
5969
5970
5971
5972
5973
5974
5975
5976
5977
5978
5979
5980
5981
5982
5983
5984
5985
5986
5987
5988
5989
5990
5991
5992
5993
5994
5995
5996
5997
5998
5999
6000
6001
6002
6003
6004
6005
6006
6007
6008
6009
6010
6011
6012
6013
6014
6015
6016
6017
6018
6019
6020
6021
6022
6023
6024
6025
6026
6027
6028
6029
6030
6031
6032
6033
6034
6035
6036
6037
6038
6039
6040
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074
6075
6076
6077
6078
6079
6080
6081
6082
6083
6084
6085
6086
6087
6088
6089
6090
6091
6092
6093
6094
6095
6096
6097
6098
6099
6100
6101
6102
6103
6104
6105
6106
6107
6108
6109
6110
6111
6112
6113
6114
6115
6116
6117
6118
6119
6120
6121
6122
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
6135
6136
6137
6138
6139
6140
6141
6142
6143
6144
6145
6146
6147
6148
6149
6150
6151
6152
6153
6154
6155
6156
6157
6158
6159
6160
6161
6162
6163
6164
6165
6166
6167
6168
6169
6170
6171
6172
6173
6174
6175
6176
6177
6178
6179
6180
6181
6182
6183
6184
6185
6186
6187
6188
6189
6190
6191
6192
6193
6194
6195
6196
6197
6198
6199
6200
6201
6202
6203
6204
6205
6206
6207
6208
6209
6210
6211
6212
6213
6214
6215
6216
6217
6218
6219
6220
6221
6222
6223
6224
6225
6226
6227
6228
6229
6230
6231
6232
6233
6234
6235
6236
6237
6238
6239
6240
6241
6242
6243
6244
6245
6246
6247
6248
6249
6250
6251
6252
6253
6254
6255
6256
6257
6258
6259
6260
6261
6262
6263
6264
6265
6266
6267
6268
6269
6270
6271
6272
6273
6274
6275
6276
6277
6278
6279
6280
6281
6282
6283
6284
6285
6286
6287
6288
6289
6290
6291
6292
6293
6294
6295
6296
6297
6298
6299
6300
6301
6302
6303
6304
6305
6306
6307
6308
6309
6310
6311
6312
6313
6314
6315
6316
6317
6318
6319
6320
6321
6322
6323
6324
6325
6326
6327
6328
6329
6330
6331
6332
6333
6334
6335
6336
6337
6338
6339
6340
6341
6342
6343
6344
6345
6346
6347
6348
6349
6350
6351
6352
6353
6354
6355
6356
6357
6358
6359
6360
6361
6362
6363
6364
6365
6366
6367
6368
6369
6370
6371
6372
6373
6374
6375
6376
6377
6378
6379
6380
6381
6382
6383
6384
6385
6386
6387
6388
6389
6390
6391
6392
6393
6394
6395
6396
6397
6398
6399
6400
6401
6402
6403
6404
6405
6406
6407
6408
6409
6410
6411
6412
6413
6414
6415
6416
6417
6418
6419
6420
6421
6422
6423
6424
6425
6426
6427
6428
6429
6430
6431
6432
6433
6434
6435
6436
6437
6438
6439
6440
6441
6442
6443
6444
6445
6446
6447
6448
6449
6450
6451
6452
6453
6454
6455
6456
6457
6458
6459
6460
6461
6462
6463
6464
6465
6466
6467
6468
6469
6470
6471
6472
6473
6474
6475
6476
6477
6478
6479
6480
6481
6482
6483
6484
6485
6486
6487
6488
6489
6490
6491
6492
6493
6494
6495
6496
6497
6498
6499
6500
6501
6502
6503
6504
6505
6506
6507
6508
6509
6510
6511
6512
6513
6514
6515
6516
6517
6518
6519
6520
6521
6522
6523
6524
6525
6526
6527
6528
6529
6530
6531
6532
6533
6534
6535
6536
6537
6538
6539
6540
6541
6542
6543
6544
6545
6546
6547
6548
6549
6550
6551
6552
6553
6554
6555
6556
6557
6558
6559
6560
6561
6562
6563
6564
6565
6566
6567
6568
6569
6570
6571
6572
// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) 2007 Oracle.  All rights reserved.
 */

#include <linux/sched.h>
#include <linux/sched/signal.h>
#include <linux/pagemap.h>
#include <linux/writeback.h>
#include <linux/blkdev.h>
#include <linux/sort.h>
#include <linux/rcupdate.h>
#include <linux/kthread.h>
#include <linux/slab.h>
#include <linux/ratelimit.h>
#include <linux/percpu_counter.h>
#include <linux/lockdep.h>
#include <linux/crc32c.h>
#include "ctree.h"
#include "extent-tree.h"
#include "transaction.h"
#include "disk-io.h"
#include "print-tree.h"
#include "volumes.h"
#include "raid56.h"
#include "locking.h"
#include "free-space-cache.h"
#include "free-space-tree.h"
#include "qgroup.h"
#include "ref-verify.h"
#include "space-info.h"
#include "block-rsv.h"
#include "discard.h"
#include "zoned.h"
#include "dev-replace.h"
#include "fs.h"
#include "accessors.h"
#include "root-tree.h"
#include "file-item.h"
#include "orphan.h"
#include "tree-checker.h"
#include "raid-stripe-tree.h"

#undef SCRAMBLE_DELAYED_REFS


static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
                               struct btrfs_delayed_ref_head *href,
                               struct btrfs_delayed_ref_node *node,
                               struct btrfs_delayed_extent_op *extra_op);
static void __run_delayed_extent_op(struct btrfs_delayed_extent_op *extent_op,
                                    struct extent_buffer *leaf,
                                    struct btrfs_extent_item *ei);
static int alloc_reserved_file_extent(struct btrfs_trans_handle *trans,
                                      u64 parent, u64 root_objectid,
                                      u64 flags, u64 owner, u64 offset,
                                      struct btrfs_key *ins, int ref_mod, u64 oref_root);
static int alloc_reserved_tree_block(struct btrfs_trans_handle *trans,
                                     struct btrfs_delayed_ref_node *node,
                                     struct btrfs_delayed_extent_op *extent_op);
static int find_next_key(struct btrfs_path *path, int level,
                         struct btrfs_key *key);

static int block_group_bits(struct btrfs_block_group *cache, u64 bits)
{
        return (cache->flags & bits) == bits;
}

/* simple helper to search for an existing data extent at a given offset */
int btrfs_lookup_data_extent(struct btrfs_fs_info *fs_info, u64 start, u64 len)
{
        struct btrfs_root *root = btrfs_extent_root(fs_info, start);
        int ret;
        struct btrfs_key key;
        struct btrfs_path *path;

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        key.objectid = start;
        key.offset = len;
        key.type = BTRFS_EXTENT_ITEM_KEY;
        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
        btrfs_free_path(path);
        return ret;
}

/*
 * helper function to lookup reference count and flags of a tree block.
 *
 * the head node for delayed ref is used to store the sum of all the
 * reference count modifications queued up in the rbtree. the head
 * node may also store the extent flags to set. This way you can check
 * to see what the reference count and extent flags would be if all of
 * the delayed refs are not processed.
 */
int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
                             struct btrfs_fs_info *fs_info, u64 bytenr,
                             u64 offset, int metadata, u64 *refs, u64 *flags,
                             u64 *owning_root)
{
        struct btrfs_root *extent_root;
        struct btrfs_delayed_ref_head *head;
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_path *path;
        struct btrfs_key key;
        u64 num_refs;
        u64 extent_flags;
        u64 owner = 0;
        int ret;

        /*
         * If we don't have skinny metadata, don't bother doing anything
         * different
         */
        if (metadata && !btrfs_fs_incompat(fs_info, SKINNY_METADATA)) {
                offset = fs_info->nodesize;
                metadata = 0;
        }

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

search_again:
        key.objectid = bytenr;
        key.offset = offset;
        if (metadata)
                key.type = BTRFS_METADATA_ITEM_KEY;
        else
                key.type = BTRFS_EXTENT_ITEM_KEY;

        extent_root = btrfs_extent_root(fs_info, bytenr);
        ret = btrfs_search_slot(NULL, extent_root, &key, path, 0, 0);
        if (ret < 0)
                goto out_free;

        if (ret > 0 && key.type == BTRFS_METADATA_ITEM_KEY) {
                if (path->slots[0]) {
                        path->slots[0]--;
                        btrfs_item_key_to_cpu(path->nodes[0], &key,
                                              path->slots[0]);
                        if (key.objectid == bytenr &&
                            key.type == BTRFS_EXTENT_ITEM_KEY &&
                            key.offset == fs_info->nodesize)
                                ret = 0;
                }
        }

        if (ret == 0) {
                struct extent_buffer *leaf = path->nodes[0];
                struct btrfs_extent_item *ei;
                const u32 item_size = btrfs_item_size(leaf, path->slots[0]);

                if (unlikely(item_size < sizeof(*ei))) {
                        ret = -EUCLEAN;
                        btrfs_err(fs_info,
                        "unexpected extent item size, has %u expect >= %zu",
                                  item_size, sizeof(*ei));
                        btrfs_abort_transaction(trans, ret);
                        goto out_free;
                }

                ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
                num_refs = btrfs_extent_refs(leaf, ei);
                if (unlikely(num_refs == 0)) {
                        ret = -EUCLEAN;
                        btrfs_err(fs_info,
                "unexpected zero reference count for extent item (%llu %u %llu)",
                                  key.objectid, key.type, key.offset);
                        btrfs_abort_transaction(trans, ret);
                        goto out_free;
                }
                extent_flags = btrfs_extent_flags(leaf, ei);
                owner = btrfs_get_extent_owner_root(fs_info, leaf, path->slots[0]);
        } else {
                num_refs = 0;
                extent_flags = 0;
                ret = 0;
        }

        delayed_refs = &trans->transaction->delayed_refs;
        spin_lock(&delayed_refs->lock);
        head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
        if (head) {
                if (!mutex_trylock(&head->mutex)) {
                        refcount_inc(&head->refs);
                        spin_unlock(&delayed_refs->lock);

                        btrfs_release_path(path);

                        /*
                         * Mutex was contended, block until it's released and try
                         * again
                         */
                        mutex_lock(&head->mutex);
                        mutex_unlock(&head->mutex);
                        btrfs_put_delayed_ref_head(head);
                        goto search_again;
                }
                spin_lock(&head->lock);
                if (head->extent_op && head->extent_op->update_flags)
                        extent_flags |= head->extent_op->flags_to_set;

                num_refs += head->ref_mod;
                spin_unlock(&head->lock);
                mutex_unlock(&head->mutex);
        }
        spin_unlock(&delayed_refs->lock);

        WARN_ON(num_refs == 0);
        if (refs)
                *refs = num_refs;
        if (flags)
                *flags = extent_flags;
        if (owning_root)
                *owning_root = owner;
out_free:
        btrfs_free_path(path);
        return ret;
}

/*
 * Back reference rules.  Back refs have three main goals:
 *
 * 1) differentiate between all holders of references to an extent so that
 *    when a reference is dropped we can make sure it was a valid reference
 *    before freeing the extent.
 *
 * 2) Provide enough information to quickly find the holders of an extent
 *    if we notice a given block is corrupted or bad.
 *
 * 3) Make it easy to migrate blocks for FS shrinking or storage pool
 *    maintenance.  This is actually the same as #2, but with a slightly
 *    different use case.
 *
 * There are two kinds of back refs. The implicit back refs is optimized
 * for pointers in non-shared tree blocks. For a given pointer in a block,
 * back refs of this kind provide information about the block's owner tree
 * and the pointer's key. These information allow us to find the block by
 * b-tree searching. The full back refs is for pointers in tree blocks not
 * referenced by their owner trees. The location of tree block is recorded
 * in the back refs. Actually the full back refs is generic, and can be
 * used in all cases the implicit back refs is used. The major shortcoming
 * of the full back refs is its overhead. Every time a tree block gets
 * COWed, we have to update back refs entry for all pointers in it.
 *
 * For a newly allocated tree block, we use implicit back refs for
 * pointers in it. This means most tree related operations only involve
 * implicit back refs. For a tree block created in old transaction, the
 * only way to drop a reference to it is COW it. So we can detect the
 * event that tree block loses its owner tree's reference and do the
 * back refs conversion.
 *
 * When a tree block is COWed through a tree, there are four cases:
 *
 * The reference count of the block is one and the tree is the block's
 * owner tree. Nothing to do in this case.
 *
 * The reference count of the block is one and the tree is not the
 * block's owner tree. In this case, full back refs is used for pointers
 * in the block. Remove these full back refs, add implicit back refs for
 * every pointers in the new block.
 *
 * The reference count of the block is greater than one and the tree is
 * the block's owner tree. In this case, implicit back refs is used for
 * pointers in the block. Add full back refs for every pointers in the
 * block, increase lower level extents' reference counts. The original
 * implicit back refs are entailed to the new block.
 *
 * The reference count of the block is greater than one and the tree is
 * not the block's owner tree. Add implicit back refs for every pointer in
 * the new block, increase lower level extents' reference count.
 *
 * Back Reference Key composing:
 *
 * The key objectid corresponds to the first byte in the extent,
 * The key type is used to differentiate between types of back refs.
 * There are different meanings of the key offset for different types
 * of back refs.
 *
 * File extents can be referenced by:
 *
 * - multiple snapshots, subvolumes, or different generations in one subvol
 * - different files inside a single subvolume
 * - different offsets inside a file (bookend extents in file.c)
 *
 * The extent ref structure for the implicit back refs has fields for:
 *
 * - Objectid of the subvolume root
 * - objectid of the file holding the reference
 * - original offset in the file
 * - how many bookend extents
 *
 * The key offset for the implicit back refs is hash of the first
 * three fields.
 *
 * The extent ref structure for the full back refs has field for:
 *
 * - number of pointers in the tree leaf
 *
 * The key offset for the implicit back refs is the first byte of
 * the tree leaf
 *
 * When a file extent is allocated, The implicit back refs is used.
 * the fields are filled in:
 *
 *     (root_key.objectid, inode objectid, offset in file, 1)
 *
 * When a file extent is removed file truncation, we find the
 * corresponding implicit back refs and check the following fields:
 *
 *     (btrfs_header_owner(leaf), inode objectid, offset in file)
 *
 * Btree extents can be referenced by:
 *
 * - Different subvolumes
 *
 * Both the implicit back refs and the full back refs for tree blocks
 * only consist of key. The key offset for the implicit back refs is
 * objectid of block's owner tree. The key offset for the full back refs
 * is the first byte of parent block.
 *
 * When implicit back refs is used, information about the lowest key and
 * level of the tree block are required. These information are stored in
 * tree block info structure.
 */

/*
 * is_data == BTRFS_REF_TYPE_BLOCK, tree block type is required,
 * is_data == BTRFS_REF_TYPE_DATA, data type is requiried,
 * is_data == BTRFS_REF_TYPE_ANY, either type is OK.
 */
int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
                                     struct btrfs_extent_inline_ref *iref,
                                     enum btrfs_inline_ref_type is_data)
{
        struct btrfs_fs_info *fs_info = eb->fs_info;
        int type = btrfs_extent_inline_ref_type(eb, iref);
        u64 offset = btrfs_extent_inline_ref_offset(eb, iref);

        if (type == BTRFS_EXTENT_OWNER_REF_KEY) {
                ASSERT(btrfs_fs_incompat(fs_info, SIMPLE_QUOTA));
                return type;
        }

        if (type == BTRFS_TREE_BLOCK_REF_KEY ||
            type == BTRFS_SHARED_BLOCK_REF_KEY ||
            type == BTRFS_SHARED_DATA_REF_KEY ||
            type == BTRFS_EXTENT_DATA_REF_KEY) {
                if (is_data == BTRFS_REF_TYPE_BLOCK) {
                        if (type == BTRFS_TREE_BLOCK_REF_KEY)
                                return type;
                        if (type == BTRFS_SHARED_BLOCK_REF_KEY) {
                                ASSERT(fs_info);
                                /*
                                 * Every shared one has parent tree block,
                                 * which must be aligned to sector size.
                                 */
                                if (offset && IS_ALIGNED(offset, fs_info->sectorsize))
                                        return type;
                        }
                } else if (is_data == BTRFS_REF_TYPE_DATA) {
                        if (type == BTRFS_EXTENT_DATA_REF_KEY)
                                return type;
                        if (type == BTRFS_SHARED_DATA_REF_KEY) {
                                ASSERT(fs_info);
                                /*
                                 * Every shared one has parent tree block,
                                 * which must be aligned to sector size.
                                 */
                                if (offset &&
                                    IS_ALIGNED(offset, fs_info->sectorsize))
                                        return type;
                        }
                } else {
                        ASSERT(is_data == BTRFS_REF_TYPE_ANY);
                        return type;
                }
        }

        WARN_ON(1);
        btrfs_print_leaf(eb);
        btrfs_err(fs_info,
                  "eb %llu iref 0x%lx invalid extent inline ref type %d",
                  eb->start, (unsigned long)iref, type);

        return BTRFS_REF_TYPE_INVALID;
}

u64 hash_extent_data_ref(u64 root_objectid, u64 owner, u64 offset)
{
        u32 high_crc = ~(u32)0;
        u32 low_crc = ~(u32)0;
        __le64 lenum;

        lenum = cpu_to_le64(root_objectid);
        high_crc = crc32c(high_crc, &lenum, sizeof(lenum));
        lenum = cpu_to_le64(owner);
        low_crc = crc32c(low_crc, &lenum, sizeof(lenum));
        lenum = cpu_to_le64(offset);
        low_crc = crc32c(low_crc, &lenum, sizeof(lenum));

        return ((u64)high_crc << 31) ^ (u64)low_crc;
}

static u64 hash_extent_data_ref_item(struct extent_buffer *leaf,
                                     struct btrfs_extent_data_ref *ref)
{
        return hash_extent_data_ref(btrfs_extent_data_ref_root(leaf, ref),
                                    btrfs_extent_data_ref_objectid(leaf, ref),
                                    btrfs_extent_data_ref_offset(leaf, ref));
}

static int match_extent_data_ref(struct extent_buffer *leaf,
                                 struct btrfs_extent_data_ref *ref,
                                 u64 root_objectid, u64 owner, u64 offset)
{
        if (btrfs_extent_data_ref_root(leaf, ref) != root_objectid ||
            btrfs_extent_data_ref_objectid(leaf, ref) != owner ||
            btrfs_extent_data_ref_offset(leaf, ref) != offset)
                return 0;
        return 1;
}

static noinline int lookup_extent_data_ref(struct btrfs_trans_handle *trans,
                                           struct btrfs_path *path,
                                           u64 bytenr, u64 parent,
                                           u64 root_objectid,
                                           u64 owner, u64 offset)
{
        struct btrfs_root *root = btrfs_extent_root(trans->fs_info, bytenr);
        struct btrfs_key key;
        struct btrfs_extent_data_ref *ref;
        struct extent_buffer *leaf;
        u32 nritems;
        int recow;
        int ret;

        key.objectid = bytenr;
        if (parent) {
                key.type = BTRFS_SHARED_DATA_REF_KEY;
                key.offset = parent;
        } else {
                key.type = BTRFS_EXTENT_DATA_REF_KEY;
                key.offset = hash_extent_data_ref(root_objectid,
                                                  owner, offset);
        }
again:
        recow = 0;
        ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
        if (ret < 0)
                return ret;

        if (parent) {
                if (ret)
                        return -ENOENT;
                return 0;
        }

        ret = -ENOENT;
        leaf = path->nodes[0];
        nritems = btrfs_header_nritems(leaf);
        while (1) {
                if (path->slots[0] >= nritems) {
                        ret = btrfs_next_leaf(root, path);
                        if (ret) {
                                if (ret > 0)
                                        return -ENOENT;
                                return ret;
                        }

                        leaf = path->nodes[0];
                        nritems = btrfs_header_nritems(leaf);
                        recow = 1;
                }

                btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
                if (key.objectid != bytenr ||
                    key.type != BTRFS_EXTENT_DATA_REF_KEY)
                        goto fail;

                ref = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_extent_data_ref);

                if (match_extent_data_ref(leaf, ref, root_objectid,
                                          owner, offset)) {
                        if (recow) {
                                btrfs_release_path(path);
                                goto again;
                        }
                        ret = 0;
                        break;
                }
                path->slots[0]++;
        }
fail:
        return ret;
}

static noinline int insert_extent_data_ref(struct btrfs_trans_handle *trans,
                                           struct btrfs_path *path,
                                           struct btrfs_delayed_ref_node *node,
                                           u64 bytenr)
{
        struct btrfs_root *root = btrfs_extent_root(trans->fs_info, bytenr);
        struct btrfs_key key;
        struct extent_buffer *leaf;
        u64 owner = btrfs_delayed_ref_owner(node);
        u64 offset = btrfs_delayed_ref_offset(node);
        u32 size;
        u32 num_refs;
        int ret;

        key.objectid = bytenr;
        if (node->parent) {
                key.type = BTRFS_SHARED_DATA_REF_KEY;
                key.offset = node->parent;
                size = sizeof(struct btrfs_shared_data_ref);
        } else {
                key.type = BTRFS_EXTENT_DATA_REF_KEY;
                key.offset = hash_extent_data_ref(node->ref_root, owner, offset);
                size = sizeof(struct btrfs_extent_data_ref);
        }

        ret = btrfs_insert_empty_item(trans, root, path, &key, size);
        if (ret && ret != -EEXIST)
                goto fail;

        leaf = path->nodes[0];
        if (node->parent) {
                struct btrfs_shared_data_ref *ref;
                ref = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_shared_data_ref);
                if (ret == 0) {
                        btrfs_set_shared_data_ref_count(leaf, ref, node->ref_mod);
                } else {
                        num_refs = btrfs_shared_data_ref_count(leaf, ref);
                        num_refs += node->ref_mod;
                        btrfs_set_shared_data_ref_count(leaf, ref, num_refs);
                }
        } else {
                struct btrfs_extent_data_ref *ref;
                while (ret == -EEXIST) {
                        ref = btrfs_item_ptr(leaf, path->slots[0],
                                             struct btrfs_extent_data_ref);
                        if (match_extent_data_ref(leaf, ref, node->ref_root,
                                                  owner, offset))
                                break;
                        btrfs_release_path(path);
                        key.offset++;
                        ret = btrfs_insert_empty_item(trans, root, path, &key,
                                                      size);
                        if (ret && ret != -EEXIST)
                                goto fail;

                        leaf = path->nodes[0];
                }
                ref = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_extent_data_ref);
                if (ret == 0) {
                        btrfs_set_extent_data_ref_root(leaf, ref, node->ref_root);
                        btrfs_set_extent_data_ref_objectid(leaf, ref, owner);
                        btrfs_set_extent_data_ref_offset(leaf, ref, offset);
                        btrfs_set_extent_data_ref_count(leaf, ref, node->ref_mod);
                } else {
                        num_refs = btrfs_extent_data_ref_count(leaf, ref);
                        num_refs += node->ref_mod;
                        btrfs_set_extent_data_ref_count(leaf, ref, num_refs);
                }
        }
        btrfs_mark_buffer_dirty(trans, leaf);
        ret = 0;
fail:
        btrfs_release_path(path);
        return ret;
}

static noinline int remove_extent_data_ref(struct btrfs_trans_handle *trans,
                                           struct btrfs_root *root,
                                           struct btrfs_path *path,
                                           int refs_to_drop)
{
        struct btrfs_key key;
        struct btrfs_extent_data_ref *ref1 = NULL;
        struct btrfs_shared_data_ref *ref2 = NULL;
        struct extent_buffer *leaf;
        u32 num_refs = 0;
        int ret = 0;

        leaf = path->nodes[0];
        btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);

        if (key.type == BTRFS_EXTENT_DATA_REF_KEY) {
                ref1 = btrfs_item_ptr(leaf, path->slots[0],
                                      struct btrfs_extent_data_ref);
                num_refs = btrfs_extent_data_ref_count(leaf, ref1);
        } else if (key.type == BTRFS_SHARED_DATA_REF_KEY) {
                ref2 = btrfs_item_ptr(leaf, path->slots[0],
                                      struct btrfs_shared_data_ref);
                num_refs = btrfs_shared_data_ref_count(leaf, ref2);
        } else {
                btrfs_err(trans->fs_info,
                          "unrecognized backref key (%llu %u %llu)",
                          key.objectid, key.type, key.offset);
                btrfs_abort_transaction(trans, -EUCLEAN);
                return -EUCLEAN;
        }

        BUG_ON(num_refs < refs_to_drop);
        num_refs -= refs_to_drop;

        if (num_refs == 0) {
                ret = btrfs_del_item(trans, root, path);
        } else {
                if (key.type == BTRFS_EXTENT_DATA_REF_KEY)
                        btrfs_set_extent_data_ref_count(leaf, ref1, num_refs);
                else if (key.type == BTRFS_SHARED_DATA_REF_KEY)
                        btrfs_set_shared_data_ref_count(leaf, ref2, num_refs);
                btrfs_mark_buffer_dirty(trans, leaf);
        }
        return ret;
}

static noinline u32 extent_data_ref_count(struct btrfs_path *path,
                                          struct btrfs_extent_inline_ref *iref)
{
        struct btrfs_key key;
        struct extent_buffer *leaf;
        struct btrfs_extent_data_ref *ref1;
        struct btrfs_shared_data_ref *ref2;
        u32 num_refs = 0;
        int type;

        leaf = path->nodes[0];
        btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);

        if (iref) {
                /*
                 * If type is invalid, we should have bailed out earlier than
                 * this call.
                 */
                type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
                ASSERT(type != BTRFS_REF_TYPE_INVALID);
                if (type == BTRFS_EXTENT_DATA_REF_KEY) {
                        ref1 = (struct btrfs_extent_data_ref *)(&iref->offset);
                        num_refs = btrfs_extent_data_ref_count(leaf, ref1);
                } else {
                        ref2 = (struct btrfs_shared_data_ref *)(iref + 1);
                        num_refs = btrfs_shared_data_ref_count(leaf, ref2);
                }
        } else if (key.type == BTRFS_EXTENT_DATA_REF_KEY) {
                ref1 = btrfs_item_ptr(leaf, path->slots[0],
                                      struct btrfs_extent_data_ref);
                num_refs = btrfs_extent_data_ref_count(leaf, ref1);
        } else if (key.type == BTRFS_SHARED_DATA_REF_KEY) {
                ref2 = btrfs_item_ptr(leaf, path->slots[0],
                                      struct btrfs_shared_data_ref);
                num_refs = btrfs_shared_data_ref_count(leaf, ref2);
        } else {
                WARN_ON(1);
        }
        return num_refs;
}

static noinline int lookup_tree_block_ref(struct btrfs_trans_handle *trans,
                                          struct btrfs_path *path,
                                          u64 bytenr, u64 parent,
                                          u64 root_objectid)
{
        struct btrfs_root *root = btrfs_extent_root(trans->fs_info, bytenr);
        struct btrfs_key key;
        int ret;

        key.objectid = bytenr;
        if (parent) {
                key.type = BTRFS_SHARED_BLOCK_REF_KEY;
                key.offset = parent;
        } else {
                key.type = BTRFS_TREE_BLOCK_REF_KEY;
                key.offset = root_objectid;
        }

        ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
        if (ret > 0)
                ret = -ENOENT;
        return ret;
}

static noinline int insert_tree_block_ref(struct btrfs_trans_handle *trans,
                                          struct btrfs_path *path,
                                          struct btrfs_delayed_ref_node *node,
                                          u64 bytenr)
{
        struct btrfs_root *root = btrfs_extent_root(trans->fs_info, bytenr);
        struct btrfs_key key;
        int ret;

        key.objectid = bytenr;
        if (node->parent) {
                key.type = BTRFS_SHARED_BLOCK_REF_KEY;
                key.offset = node->parent;
        } else {
                key.type = BTRFS_TREE_BLOCK_REF_KEY;
                key.offset = node->ref_root;
        }

        ret = btrfs_insert_empty_item(trans, root, path, &key, 0);
        btrfs_release_path(path);
        return ret;
}

static inline int extent_ref_type(u64 parent, u64 owner)
{
        int type;
        if (owner < BTRFS_FIRST_FREE_OBJECTID) {
                if (parent > 0)
                        type = BTRFS_SHARED_BLOCK_REF_KEY;
                else
                        type = BTRFS_TREE_BLOCK_REF_KEY;
        } else {
                if (parent > 0)
                        type = BTRFS_SHARED_DATA_REF_KEY;
                else
                        type = BTRFS_EXTENT_DATA_REF_KEY;
        }
        return type;
}

static int find_next_key(struct btrfs_path *path, int level,
                         struct btrfs_key *key)

{
        for (; level < BTRFS_MAX_LEVEL; level++) {
                if (!path->nodes[level])
                        break;
                if (path->slots[level] + 1 >=
                    btrfs_header_nritems(path->nodes[level]))
                        continue;
                if (level == 0)
                        btrfs_item_key_to_cpu(path->nodes[level], key,
                                              path->slots[level] + 1);
                else
                        btrfs_node_key_to_cpu(path->nodes[level], key,
                                              path->slots[level] + 1);
                return 0;
        }
        return 1;
}

/*
 * look for inline back ref. if back ref is found, *ref_ret is set
 * to the address of inline back ref, and 0 is returned.
 *
 * if back ref isn't found, *ref_ret is set to the address where it
 * should be inserted, and -ENOENT is returned.
 *
 * if insert is true and there are too many inline back refs, the path
 * points to the extent item, and -EAGAIN is returned.
 *
 * NOTE: inline back refs are ordered in the same way that back ref
 *         items in the tree are ordered.
 */
static noinline_for_stack
int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
                                 struct btrfs_path *path,
                                 struct btrfs_extent_inline_ref **ref_ret,
                                 u64 bytenr, u64 num_bytes,
                                 u64 parent, u64 root_objectid,
                                 u64 owner, u64 offset, int insert)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_root *root = btrfs_extent_root(fs_info, bytenr);
        struct btrfs_key key;
        struct extent_buffer *leaf;
        struct btrfs_extent_item *ei;
        struct btrfs_extent_inline_ref *iref;
        u64 flags;
        u64 item_size;
        unsigned long ptr;
        unsigned long end;
        int extra_size;
        int type;
        int want;
        int ret;
        bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);
        int needed;

        key.objectid = bytenr;
        key.type = BTRFS_EXTENT_ITEM_KEY;
        key.offset = num_bytes;

        want = extent_ref_type(parent, owner);
        if (insert) {
                extra_size = btrfs_extent_inline_ref_size(want);
                path->search_for_extension = 1;
                path->keep_locks = 1;
        } else
                extra_size = -1;

        /*
         * Owner is our level, so we can just add one to get the level for the
         * block we are interested in.
         */
        if (skinny_metadata && owner < BTRFS_FIRST_FREE_OBJECTID) {
                key.type = BTRFS_METADATA_ITEM_KEY;
                key.offset = owner;
        }

again:
        ret = btrfs_search_slot(trans, root, &key, path, extra_size, 1);
        if (ret < 0)
                goto out;

        /*
         * We may be a newly converted file system which still has the old fat
         * extent entries for metadata, so try and see if we have one of those.
         */
        if (ret > 0 && skinny_metadata) {
                skinny_metadata = false;
                if (path->slots[0]) {
                        path->slots[0]--;
                        btrfs_item_key_to_cpu(path->nodes[0], &key,
                                              path->slots[0]);
                        if (key.objectid == bytenr &&
                            key.type == BTRFS_EXTENT_ITEM_KEY &&
                            key.offset == num_bytes)
                                ret = 0;
                }
                if (ret) {
                        key.objectid = bytenr;
                        key.type = BTRFS_EXTENT_ITEM_KEY;
                        key.offset = num_bytes;
                        btrfs_release_path(path);
                        goto again;
                }
        }

        if (ret && !insert) {
                ret = -ENOENT;
                goto out;
        } else if (WARN_ON(ret)) {
                btrfs_print_leaf(path->nodes[0]);
                btrfs_err(fs_info,
"extent item not found for insert, bytenr %llu num_bytes %llu parent %llu root_objectid %llu owner %llu offset %llu",
                          bytenr, num_bytes, parent, root_objectid, owner,
                          offset);
                ret = -EUCLEAN;
                goto out;
        }

        leaf = path->nodes[0];
        item_size = btrfs_item_size(leaf, path->slots[0]);
        if (unlikely(item_size < sizeof(*ei))) {
                ret = -EUCLEAN;
                btrfs_err(fs_info,
                          "unexpected extent item size, has %llu expect >= %zu",
                          item_size, sizeof(*ei));
                btrfs_abort_transaction(trans, ret);
                goto out;
        }

        ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        flags = btrfs_extent_flags(leaf, ei);

        ptr = (unsigned long)(ei + 1);
        end = (unsigned long)ei + item_size;

        if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK && !skinny_metadata) {
                ptr += sizeof(struct btrfs_tree_block_info);
                BUG_ON(ptr > end);
        }

        if (owner >= BTRFS_FIRST_FREE_OBJECTID)
                needed = BTRFS_REF_TYPE_DATA;
        else
                needed = BTRFS_REF_TYPE_BLOCK;

        ret = -ENOENT;
        while (ptr < end) {
                iref = (struct btrfs_extent_inline_ref *)ptr;
                type = btrfs_get_extent_inline_ref_type(leaf, iref, needed);
                if (type == BTRFS_EXTENT_OWNER_REF_KEY) {
                        ASSERT(btrfs_fs_incompat(fs_info, SIMPLE_QUOTA));
                        ptr += btrfs_extent_inline_ref_size(type);
                        continue;
                }
                if (type == BTRFS_REF_TYPE_INVALID) {
                        ret = -EUCLEAN;
                        goto out;
                }

                if (want < type)
                        break;
                if (want > type) {
                        ptr += btrfs_extent_inline_ref_size(type);
                        continue;
                }

                if (type == BTRFS_EXTENT_DATA_REF_KEY) {
                        struct btrfs_extent_data_ref *dref;
                        dref = (struct btrfs_extent_data_ref *)(&iref->offset);
                        if (match_extent_data_ref(leaf, dref, root_objectid,
                                                  owner, offset)) {
                                ret = 0;
                                break;
                        }
                        if (hash_extent_data_ref_item(leaf, dref) <
                            hash_extent_data_ref(root_objectid, owner, offset))
                                break;
                } else {
                        u64 ref_offset;
                        ref_offset = btrfs_extent_inline_ref_offset(leaf, iref);
                        if (parent > 0) {
                                if (parent == ref_offset) {
                                        ret = 0;
                                        break;
                                }
                                if (ref_offset < parent)
                                        break;
                        } else {
                                if (root_objectid == ref_offset) {
                                        ret = 0;
                                        break;
                                }
                                if (ref_offset < root_objectid)
                                        break;
                        }
                }
                ptr += btrfs_extent_inline_ref_size(type);
        }

        if (unlikely(ptr > end)) {
                ret = -EUCLEAN;
                btrfs_print_leaf(path->nodes[0]);
                btrfs_crit(fs_info,
"overrun extent record at slot %d while looking for inline extent for root %llu owner %llu offset %llu parent %llu",
                           path->slots[0], root_objectid, owner, offset, parent);
                goto out;
        }

        if (ret == -ENOENT && insert) {
                if (item_size + extra_size >=
                    BTRFS_MAX_EXTENT_ITEM_SIZE(root)) {
                        ret = -EAGAIN;
                        goto out;
                }
                /*
                 * To add new inline back ref, we have to make sure
                 * there is no corresponding back ref item.
                 * For simplicity, we just do not add new inline back
                 * ref if there is any kind of item for this block
                 */
                if (find_next_key(path, 0, &key) == 0 &&
                    key.objectid == bytenr &&
                    key.type < BTRFS_BLOCK_GROUP_ITEM_KEY) {
                        ret = -EAGAIN;
                        goto out;
                }
        }
        *ref_ret = (struct btrfs_extent_inline_ref *)ptr;
out:
        if (insert) {
                path->keep_locks = 0;
                path->search_for_extension = 0;
                btrfs_unlock_up_safe(path, 1);
        }
        return ret;
}

/*
 * helper to add new inline back ref
 */
static noinline_for_stack
void setup_inline_extent_backref(struct btrfs_trans_handle *trans,
                                 struct btrfs_path *path,
                                 struct btrfs_extent_inline_ref *iref,
                                 u64 parent, u64 root_objectid,
                                 u64 owner, u64 offset, int refs_to_add,
                                 struct btrfs_delayed_extent_op *extent_op)
{
        struct extent_buffer *leaf;
        struct btrfs_extent_item *ei;
        unsigned long ptr;
        unsigned long end;
        unsigned long item_offset;
        u64 refs;
        int size;
        int type;

        leaf = path->nodes[0];
        ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        item_offset = (unsigned long)iref - (unsigned long)ei;

        type = extent_ref_type(parent, owner);
        size = btrfs_extent_inline_ref_size(type);

        btrfs_extend_item(trans, path, size);

        ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        refs = btrfs_extent_refs(leaf, ei);
        refs += refs_to_add;
        btrfs_set_extent_refs(leaf, ei, refs);
        if (extent_op)
                __run_delayed_extent_op(extent_op, leaf, ei);

        ptr = (unsigned long)ei + item_offset;
        end = (unsigned long)ei + btrfs_item_size(leaf, path->slots[0]);
        if (ptr < end - size)
                memmove_extent_buffer(leaf, ptr + size, ptr,
                                      end - size - ptr);

        iref = (struct btrfs_extent_inline_ref *)ptr;
        btrfs_set_extent_inline_ref_type(leaf, iref, type);
        if (type == BTRFS_EXTENT_DATA_REF_KEY) {
                struct btrfs_extent_data_ref *dref;
                dref = (struct btrfs_extent_data_ref *)(&iref->offset);
                btrfs_set_extent_data_ref_root(leaf, dref, root_objectid);
                btrfs_set_extent_data_ref_objectid(leaf, dref, owner);
                btrfs_set_extent_data_ref_offset(leaf, dref, offset);
                btrfs_set_extent_data_ref_count(leaf, dref, refs_to_add);
        } else if (type == BTRFS_SHARED_DATA_REF_KEY) {
                struct btrfs_shared_data_ref *sref;
                sref = (struct btrfs_shared_data_ref *)(iref + 1);
                btrfs_set_shared_data_ref_count(leaf, sref, refs_to_add);
                btrfs_set_extent_inline_ref_offset(leaf, iref, parent);
        } else if (type == BTRFS_SHARED_BLOCK_REF_KEY) {
                btrfs_set_extent_inline_ref_offset(leaf, iref, parent);
        } else {
                btrfs_set_extent_inline_ref_offset(leaf, iref, root_objectid);
        }
        btrfs_mark_buffer_dirty(trans, leaf);
}

static int lookup_extent_backref(struct btrfs_trans_handle *trans,
                                 struct btrfs_path *path,
                                 struct btrfs_extent_inline_ref **ref_ret,
                                 u64 bytenr, u64 num_bytes, u64 parent,
                                 u64 root_objectid, u64 owner, u64 offset)
{
        int ret;

        ret = lookup_inline_extent_backref(trans, path, ref_ret, bytenr,
                                           num_bytes, parent, root_objectid,
                                           owner, offset, 0);
        if (ret != -ENOENT)
                return ret;

        btrfs_release_path(path);
        *ref_ret = NULL;

        if (owner < BTRFS_FIRST_FREE_OBJECTID) {
                ret = lookup_tree_block_ref(trans, path, bytenr, parent,
                                            root_objectid);
        } else {
                ret = lookup_extent_data_ref(trans, path, bytenr, parent,
                                             root_objectid, owner, offset);
        }
        return ret;
}

/*
 * helper to update/remove inline back ref
 */
static noinline_for_stack int update_inline_extent_backref(
                                  struct btrfs_trans_handle *trans,
                                  struct btrfs_path *path,
                                  struct btrfs_extent_inline_ref *iref,
                                  int refs_to_mod,
                                  struct btrfs_delayed_extent_op *extent_op)
{
        struct extent_buffer *leaf = path->nodes[0];
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_extent_item *ei;
        struct btrfs_extent_data_ref *dref = NULL;
        struct btrfs_shared_data_ref *sref = NULL;
        unsigned long ptr;
        unsigned long end;
        u32 item_size;
        int size;
        int type;
        u64 refs;

        ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        refs = btrfs_extent_refs(leaf, ei);
        if (unlikely(refs_to_mod < 0 && refs + refs_to_mod <= 0)) {
                struct btrfs_key key;
                u32 extent_size;

                btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
                if (key.type == BTRFS_METADATA_ITEM_KEY)
                        extent_size = fs_info->nodesize;
                else
                        extent_size = key.offset;
                btrfs_print_leaf(leaf);
                btrfs_err(fs_info,
        "invalid refs_to_mod for extent %llu num_bytes %u, has %d expect >= -%llu",
                          key.objectid, extent_size, refs_to_mod, refs);
                return -EUCLEAN;
        }
        refs += refs_to_mod;
        btrfs_set_extent_refs(leaf, ei, refs);
        if (extent_op)
                __run_delayed_extent_op(extent_op, leaf, ei);

        type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_ANY);
        /*
         * Function btrfs_get_extent_inline_ref_type() has already printed
         * error messages.
         */
        if (unlikely(type == BTRFS_REF_TYPE_INVALID))
                return -EUCLEAN;

        if (type == BTRFS_EXTENT_DATA_REF_KEY) {
                dref = (struct btrfs_extent_data_ref *)(&iref->offset);
                refs = btrfs_extent_data_ref_count(leaf, dref);
        } else if (type == BTRFS_SHARED_DATA_REF_KEY) {
                sref = (struct btrfs_shared_data_ref *)(iref + 1);
                refs = btrfs_shared_data_ref_count(leaf, sref);
        } else {
                refs = 1;
                /*
                 * For tree blocks we can only drop one ref for it, and tree
                 * blocks should not have refs > 1.
                 *
                 * Furthermore if we're inserting a new inline backref, we
                 * won't reach this path either. That would be
                 * setup_inline_extent_backref().
                 */
                if (unlikely(refs_to_mod != -1)) {
                        struct btrfs_key key;

                        btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);

                        btrfs_print_leaf(leaf);
                        btrfs_err(fs_info,
                        "invalid refs_to_mod for tree block %llu, has %d expect -1",
                                  key.objectid, refs_to_mod);
                        return -EUCLEAN;
                }
        }

        if (unlikely(refs_to_mod < 0 && refs < -refs_to_mod)) {
                struct btrfs_key key;
                u32 extent_size;

                btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
                if (key.type == BTRFS_METADATA_ITEM_KEY)
                        extent_size = fs_info->nodesize;
                else
                        extent_size = key.offset;
                btrfs_print_leaf(leaf);
                btrfs_err(fs_info,
"invalid refs_to_mod for backref entry, iref %lu extent %llu num_bytes %u, has %d expect >= -%llu",
                          (unsigned long)iref, key.objectid, extent_size,
                          refs_to_mod, refs);
                return -EUCLEAN;
        }
        refs += refs_to_mod;

        if (refs > 0) {
                if (type == BTRFS_EXTENT_DATA_REF_KEY)
                        btrfs_set_extent_data_ref_count(leaf, dref, refs);
                else
                        btrfs_set_shared_data_ref_count(leaf, sref, refs);
        } else {
                size =  btrfs_extent_inline_ref_size(type);
                item_size = btrfs_item_size(leaf, path->slots[0]);
                ptr = (unsigned long)iref;
                end = (unsigned long)ei + item_size;
                if (ptr + size < end)
                        memmove_extent_buffer(leaf, ptr, ptr + size,
                                              end - ptr - size);
                item_size -= size;
                btrfs_truncate_item(trans, path, item_size, 1);
        }
        btrfs_mark_buffer_dirty(trans, leaf);
        return 0;
}

static noinline_for_stack
int insert_inline_extent_backref(struct btrfs_trans_handle *trans,
                                 struct btrfs_path *path,
                                 u64 bytenr, u64 num_bytes, u64 parent,
                                 u64 root_objectid, u64 owner,
                                 u64 offset, int refs_to_add,
                                 struct btrfs_delayed_extent_op *extent_op)
{
        struct btrfs_extent_inline_ref *iref;
        int ret;

        ret = lookup_inline_extent_backref(trans, path, &iref, bytenr,
                                           num_bytes, parent, root_objectid,
                                           owner, offset, 1);
        if (ret == 0) {
                /*
                 * We're adding refs to a tree block we already own, this
                 * should not happen at all.
                 */
                if (owner < BTRFS_FIRST_FREE_OBJECTID) {
                        btrfs_print_leaf(path->nodes[0]);
                        btrfs_crit(trans->fs_info,
"adding refs to an existing tree ref, bytenr %llu num_bytes %llu root_objectid %llu slot %u",
                                   bytenr, num_bytes, root_objectid, path->slots[0]);
                        return -EUCLEAN;
                }
                ret = update_inline_extent_backref(trans, path, iref,
                                                   refs_to_add, extent_op);
        } else if (ret == -ENOENT) {
                setup_inline_extent_backref(trans, path, iref, parent,
                                            root_objectid, owner, offset,
                                            refs_to_add, extent_op);
                ret = 0;
        }
        return ret;
}

static int remove_extent_backref(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 struct btrfs_path *path,
                                 struct btrfs_extent_inline_ref *iref,
                                 int refs_to_drop, int is_data)
{
        int ret = 0;

        BUG_ON(!is_data && refs_to_drop != 1);
        if (iref)
                ret = update_inline_extent_backref(trans, path, iref,
                                                   -refs_to_drop, NULL);
        else if (is_data)
                ret = remove_extent_data_ref(trans, root, path, refs_to_drop);
        else
                ret = btrfs_del_item(trans, root, path);
        return ret;
}

static int btrfs_issue_discard(struct block_device *bdev, u64 start, u64 len,
                               u64 *discarded_bytes)
{
        int j, ret = 0;
        u64 bytes_left, end;
        u64 aligned_start = ALIGN(start, 1 << SECTOR_SHIFT);

        /* Adjust the range to be aligned to 512B sectors if necessary. */
        if (start != aligned_start) {
                len -= aligned_start - start;
                len = round_down(len, 1 << SECTOR_SHIFT);
                start = aligned_start;
        }

        *discarded_bytes = 0;

        if (!len)
                return 0;

        end = start + len;
        bytes_left = len;

        /* Skip any superblocks on this device. */
        for (j = 0; j < BTRFS_SUPER_MIRROR_MAX; j++) {
                u64 sb_start = btrfs_sb_offset(j);
                u64 sb_end = sb_start + BTRFS_SUPER_INFO_SIZE;
                u64 size = sb_start - start;

                if (!in_range(sb_start, start, bytes_left) &&
                    !in_range(sb_end, start, bytes_left) &&
                    !in_range(start, sb_start, BTRFS_SUPER_INFO_SIZE))
                        continue;

                /*
                 * Superblock spans beginning of range.  Adjust start and
                 * try again.
                 */
                if (sb_start <= start) {
                        start += sb_end - start;
                        if (start > end) {
                                bytes_left = 0;
                                break;
                        }
                        bytes_left = end - start;
                        continue;
                }

                if (size) {
                        ret = blkdev_issue_discard(bdev, start >> SECTOR_SHIFT,
                                                   size >> SECTOR_SHIFT,
                                                   GFP_NOFS);
                        if (!ret)
                                *discarded_bytes += size;
                        else if (ret != -EOPNOTSUPP)
                                return ret;
                }

                start = sb_end;
                if (start > end) {
                        bytes_left = 0;
                        break;
                }
                bytes_left = end - start;
        }

        if (bytes_left) {
                ret = blkdev_issue_discard(bdev, start >> SECTOR_SHIFT,
                                           bytes_left >> SECTOR_SHIFT,
                                           GFP_NOFS);
                if (!ret)
                        *discarded_bytes += bytes_left;
        }
        return ret;
}

static int do_discard_extent(struct btrfs_discard_stripe *stripe, u64 *bytes)
{
        struct btrfs_device *dev = stripe->dev;
        struct btrfs_fs_info *fs_info = dev->fs_info;
        struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
        u64 phys = stripe->physical;
        u64 len = stripe->length;
        u64 discarded = 0;
        int ret = 0;

        /* Zone reset on a zoned filesystem */
        if (btrfs_can_zone_reset(dev, phys, len)) {
                u64 src_disc;

                ret = btrfs_reset_device_zone(dev, phys, len, &discarded);
                if (ret)
                        goto out;

                if (!btrfs_dev_replace_is_ongoing(dev_replace) ||
                    dev != dev_replace->srcdev)
                        goto out;

                src_disc = discarded;

                /* Send to replace target as well */
                ret = btrfs_reset_device_zone(dev_replace->tgtdev, phys, len,
                                              &discarded);
                discarded += src_disc;
        } else if (bdev_max_discard_sectors(stripe->dev->bdev)) {
                ret = btrfs_issue_discard(dev->bdev, phys, len, &discarded);
        } else {
                ret = 0;
                *bytes = 0;
        }

out:
        *bytes = discarded;
        return ret;
}

int btrfs_discard_extent(struct btrfs_fs_info *fs_info, u64 bytenr,
                         u64 num_bytes, u64 *actual_bytes)
{
        int ret = 0;
        u64 discarded_bytes = 0;
        u64 end = bytenr + num_bytes;
        u64 cur = bytenr;

        /*
         * Avoid races with device replace and make sure the devices in the
         * stripes don't go away while we are discarding.
         */
        btrfs_bio_counter_inc_blocked(fs_info);
        while (cur < end) {
                struct btrfs_discard_stripe *stripes;
                unsigned int num_stripes;
                int i;

                num_bytes = end - cur;
                stripes = btrfs_map_discard(fs_info, cur, &num_bytes, &num_stripes);
                if (IS_ERR(stripes)) {
                        ret = PTR_ERR(stripes);
                        if (ret == -EOPNOTSUPP)
                                ret = 0;
                        break;
                }

                for (i = 0; i < num_stripes; i++) {
                        struct btrfs_discard_stripe *stripe = stripes + i;
                        u64 bytes;

                        if (!stripe->dev->bdev) {
                                ASSERT(btrfs_test_opt(fs_info, DEGRADED));
                                continue;
                        }

                        if (!test_bit(BTRFS_DEV_STATE_WRITEABLE,
                                        &stripe->dev->dev_state))
                                continue;

                        ret = do_discard_extent(stripe, &bytes);
                        if (ret) {
                                /*
                                 * Keep going if discard is not supported by the
                                 * device.
                                 */
                                if (ret != -EOPNOTSUPP)
                                        break;
                                ret = 0;
                        } else {
                                discarded_bytes += bytes;
                        }
                }
                kfree(stripes);
                if (ret)
                        break;
                cur += num_bytes;
        }
        btrfs_bio_counter_dec(fs_info);
        if (actual_bytes)
                *actual_bytes = discarded_bytes;
        return ret;
}

/* Can return -ENOMEM */
int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
                         struct btrfs_ref *generic_ref)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        int ret;

        ASSERT(generic_ref->type != BTRFS_REF_NOT_SET &&
               generic_ref->action);
        BUG_ON(generic_ref->type == BTRFS_REF_METADATA &&
               generic_ref->ref_root == BTRFS_TREE_LOG_OBJECTID);

        if (generic_ref->type == BTRFS_REF_METADATA)
                ret = btrfs_add_delayed_tree_ref(trans, generic_ref, NULL);
        else
                ret = btrfs_add_delayed_data_ref(trans, generic_ref, 0);

        btrfs_ref_tree_mod(fs_info, generic_ref);

        return ret;
}

/*
 * Insert backreference for a given extent.
 *
 * The counterpart is in __btrfs_free_extent(), with examples and more details
 * how it works.
 *
 * @trans:            Handle of transaction
 *
 * @node:            The delayed ref node used to get the bytenr/length for
 *                    extent whose references are incremented.
 *
 * @extent_op       Pointer to a structure, holding information necessary when
 *                  updating a tree block's flags
 *
 */
static int __btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
                                  struct btrfs_delayed_ref_node *node,
                                  struct btrfs_delayed_extent_op *extent_op)
{
        struct btrfs_path *path;
        struct extent_buffer *leaf;
        struct btrfs_extent_item *item;
        struct btrfs_key key;
        u64 bytenr = node->bytenr;
        u64 num_bytes = node->num_bytes;
        u64 owner = btrfs_delayed_ref_owner(node);
        u64 offset = btrfs_delayed_ref_offset(node);
        u64 refs;
        int refs_to_add = node->ref_mod;
        int ret;

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        /* this will setup the path even if it fails to insert the back ref */
        ret = insert_inline_extent_backref(trans, path, bytenr, num_bytes,
                                           node->parent, node->ref_root, owner,
                                           offset, refs_to_add, extent_op);
        if ((ret < 0 && ret != -EAGAIN) || !ret)
                goto out;

        /*
         * Ok we had -EAGAIN which means we didn't have space to insert and
         * inline extent ref, so just update the reference count and add a
         * normal backref.
         */
        leaf = path->nodes[0];
        btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
        item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        refs = btrfs_extent_refs(leaf, item);
        btrfs_set_extent_refs(leaf, item, refs + refs_to_add);
        if (extent_op)
                __run_delayed_extent_op(extent_op, leaf, item);

        btrfs_mark_buffer_dirty(trans, leaf);
        btrfs_release_path(path);

        /* now insert the actual backref */
        if (owner < BTRFS_FIRST_FREE_OBJECTID)
                ret = insert_tree_block_ref(trans, path, node, bytenr);
        else
                ret = insert_extent_data_ref(trans, path, node, bytenr);

        if (ret)
                btrfs_abort_transaction(trans, ret);
out:
        btrfs_free_path(path);
        return ret;
}

static void free_head_ref_squota_rsv(struct btrfs_fs_info *fs_info,
                                     struct btrfs_delayed_ref_head *href)
{
        u64 root = href->owning_root;

        /*
         * Don't check must_insert_reserved, as this is called from contexts
         * where it has already been unset.
         */
        if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_SIMPLE ||
            !href->is_data || !is_fstree(root))
                return;

        btrfs_qgroup_free_refroot(fs_info, root, href->reserved_bytes,
                                  BTRFS_QGROUP_RSV_DATA);
}

static int run_delayed_data_ref(struct btrfs_trans_handle *trans,
                                struct btrfs_delayed_ref_head *href,
                                struct btrfs_delayed_ref_node *node,
                                struct btrfs_delayed_extent_op *extent_op,
                                bool insert_reserved)
{
        int ret = 0;
        u64 parent = 0;
        u64 flags = 0;

        trace_run_delayed_data_ref(trans->fs_info, node);

        if (node->type == BTRFS_SHARED_DATA_REF_KEY)
                parent = node->parent;

        if (node->action == BTRFS_ADD_DELAYED_REF && insert_reserved) {
                struct btrfs_key key;
                struct btrfs_squota_delta delta = {
                        .root = href->owning_root,
                        .num_bytes = node->num_bytes,
                        .is_data = true,
                        .is_inc        = true,
                        .generation = trans->transid,
                };
                u64 owner = btrfs_delayed_ref_owner(node);
                u64 offset = btrfs_delayed_ref_offset(node);

                if (extent_op)
                        flags |= extent_op->flags_to_set;

                key.objectid = node->bytenr;
                key.type = BTRFS_EXTENT_ITEM_KEY;
                key.offset = node->num_bytes;

                ret = alloc_reserved_file_extent(trans, parent, node->ref_root,
                                                 flags, owner, offset, &key,
                                                 node->ref_mod,
                                                 href->owning_root);
                free_head_ref_squota_rsv(trans->fs_info, href);
                if (!ret)
                        ret = btrfs_record_squota_delta(trans->fs_info, &delta);
        } else if (node->action == BTRFS_ADD_DELAYED_REF) {
                ret = __btrfs_inc_extent_ref(trans, node, extent_op);
        } else if (node->action == BTRFS_DROP_DELAYED_REF) {
                ret = __btrfs_free_extent(trans, href, node, extent_op);
        } else {
                BUG();
        }
        return ret;
}

static void __run_delayed_extent_op(struct btrfs_delayed_extent_op *extent_op,
                                    struct extent_buffer *leaf,
                                    struct btrfs_extent_item *ei)
{
        u64 flags = btrfs_extent_flags(leaf, ei);
        if (extent_op->update_flags) {
                flags |= extent_op->flags_to_set;
                btrfs_set_extent_flags(leaf, ei, flags);
        }

        if (extent_op->update_key) {
                struct btrfs_tree_block_info *bi;
                BUG_ON(!(flags & BTRFS_EXTENT_FLAG_TREE_BLOCK));
                bi = (struct btrfs_tree_block_info *)(ei + 1);
                btrfs_set_tree_block_key(leaf, bi, &extent_op->key);
        }
}

static int run_delayed_extent_op(struct btrfs_trans_handle *trans,
                                 struct btrfs_delayed_ref_head *head,
                                 struct btrfs_delayed_extent_op *extent_op)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_root *root;
        struct btrfs_key key;
        struct btrfs_path *path;
        struct btrfs_extent_item *ei;
        struct extent_buffer *leaf;
        u32 item_size;
        int ret;
        int metadata = 1;

        if (TRANS_ABORTED(trans))
                return 0;

        if (!btrfs_fs_incompat(fs_info, SKINNY_METADATA))
                metadata = 0;

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        key.objectid = head->bytenr;

        if (metadata) {
                key.type = BTRFS_METADATA_ITEM_KEY;
                key.offset = head->level;
        } else {
                key.type = BTRFS_EXTENT_ITEM_KEY;
                key.offset = head->num_bytes;
        }

        root = btrfs_extent_root(fs_info, key.objectid);
again:
        ret = btrfs_search_slot(trans, root, &key, path, 0, 1);
        if (ret < 0) {
                goto out;
        } else if (ret > 0) {
                if (metadata) {
                        if (path->slots[0] > 0) {
                                path->slots[0]--;
                                btrfs_item_key_to_cpu(path->nodes[0], &key,
                                                      path->slots[0]);
                                if (key.objectid == head->bytenr &&
                                    key.type == BTRFS_EXTENT_ITEM_KEY &&
                                    key.offset == head->num_bytes)
                                        ret = 0;
                        }
                        if (ret > 0) {
                                btrfs_release_path(path);
                                metadata = 0;

                                key.objectid = head->bytenr;
                                key.offset = head->num_bytes;
                                key.type = BTRFS_EXTENT_ITEM_KEY;
                                goto again;
                        }
                } else {
                        ret = -EUCLEAN;
                        btrfs_err(fs_info,
                  "missing extent item for extent %llu num_bytes %llu level %d",
                                  head->bytenr, head->num_bytes, head->level);
                        goto out;
                }
        }

        leaf = path->nodes[0];
        item_size = btrfs_item_size(leaf, path->slots[0]);

        if (unlikely(item_size < sizeof(*ei))) {
                ret = -EUCLEAN;
                btrfs_err(fs_info,
                          "unexpected extent item size, has %u expect >= %zu",
                          item_size, sizeof(*ei));
                btrfs_abort_transaction(trans, ret);
                goto out;
        }

        ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        __run_delayed_extent_op(extent_op, leaf, ei);

        btrfs_mark_buffer_dirty(trans, leaf);
out:
        btrfs_free_path(path);
        return ret;
}

static int run_delayed_tree_ref(struct btrfs_trans_handle *trans,
                                struct btrfs_delayed_ref_head *href,
                                struct btrfs_delayed_ref_node *node,
                                struct btrfs_delayed_extent_op *extent_op,
                                bool insert_reserved)
{
        int ret = 0;
        struct btrfs_fs_info *fs_info = trans->fs_info;
        u64 parent = 0;
        u64 ref_root = 0;

        trace_run_delayed_tree_ref(trans->fs_info, node);

        if (node->type == BTRFS_SHARED_BLOCK_REF_KEY)
                parent = node->parent;
        ref_root = node->ref_root;

        if (unlikely(node->ref_mod != 1)) {
                btrfs_err(trans->fs_info,
        "btree block %llu has %d references rather than 1: action %d ref_root %llu parent %llu",
                          node->bytenr, node->ref_mod, node->action, ref_root,
                          parent);
                return -EUCLEAN;
        }
        if (node->action == BTRFS_ADD_DELAYED_REF && insert_reserved) {
                struct btrfs_squota_delta delta = {
                        .root = href->owning_root,
                        .num_bytes = fs_info->nodesize,
                        .is_data = false,
                        .is_inc = true,
                        .generation = trans->transid,
                };

                ret = alloc_reserved_tree_block(trans, node, extent_op);
                if (!ret)
                        btrfs_record_squota_delta(fs_info, &delta);
        } else if (node->action == BTRFS_ADD_DELAYED_REF) {
                ret = __btrfs_inc_extent_ref(trans, node, extent_op);
        } else if (node->action == BTRFS_DROP_DELAYED_REF) {
                ret = __btrfs_free_extent(trans, href, node, extent_op);
        } else {
                BUG();
        }
        return ret;
}

/* helper function to actually process a single delayed ref entry */
static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
                               struct btrfs_delayed_ref_head *href,
                               struct btrfs_delayed_ref_node *node,
                               struct btrfs_delayed_extent_op *extent_op,
                               bool insert_reserved)
{
        int ret = 0;

        if (TRANS_ABORTED(trans)) {
                if (insert_reserved) {
                        btrfs_pin_extent(trans, node->bytenr, node->num_bytes, 1);
                        free_head_ref_squota_rsv(trans->fs_info, href);
                }
                return 0;
        }

        if (node->type == BTRFS_TREE_BLOCK_REF_KEY ||
            node->type == BTRFS_SHARED_BLOCK_REF_KEY)
                ret = run_delayed_tree_ref(trans, href, node, extent_op,
                                           insert_reserved);
        else if (node->type == BTRFS_EXTENT_DATA_REF_KEY ||
                 node->type == BTRFS_SHARED_DATA_REF_KEY)
                ret = run_delayed_data_ref(trans, href, node, extent_op,
                                           insert_reserved);
        else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY)
                ret = 0;
        else
                BUG();
        if (ret && insert_reserved)
                btrfs_pin_extent(trans, node->bytenr, node->num_bytes, 1);
        if (ret < 0)
                btrfs_err(trans->fs_info,
"failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d",
                          node->bytenr, node->num_bytes, node->type,
                          node->action, node->ref_mod, ret);
        return ret;
}

static inline struct btrfs_delayed_ref_node *
select_delayed_ref(struct btrfs_delayed_ref_head *head)
{
        struct btrfs_delayed_ref_node *ref;

        if (RB_EMPTY_ROOT(&head->ref_tree.rb_root))
                return NULL;

        /*
         * Select a delayed ref of type BTRFS_ADD_DELAYED_REF first.
         * This is to prevent a ref count from going down to zero, which deletes
         * the extent item from the extent tree, when there still are references
         * to add, which would fail because they would not find the extent item.
         */
        if (!list_empty(&head->ref_add_list))
                return list_first_entry(&head->ref_add_list,
                                struct btrfs_delayed_ref_node, add_list);

        ref = rb_entry(rb_first_cached(&head->ref_tree),
                       struct btrfs_delayed_ref_node, ref_node);
        ASSERT(list_empty(&ref->add_list));
        return ref;
}

static void unselect_delayed_ref_head(struct btrfs_delayed_ref_root *delayed_refs,
                                      struct btrfs_delayed_ref_head *head)
{
        spin_lock(&delayed_refs->lock);
        head->processing = false;
        delayed_refs->num_heads_ready++;
        spin_unlock(&delayed_refs->lock);
        btrfs_delayed_ref_unlock(head);
}

static struct btrfs_delayed_extent_op *cleanup_extent_op(
                                struct btrfs_delayed_ref_head *head)
{
        struct btrfs_delayed_extent_op *extent_op = head->extent_op;

        if (!extent_op)
                return NULL;

        if (head->must_insert_reserved) {
                head->extent_op = NULL;
                btrfs_free_delayed_extent_op(extent_op);
                return NULL;
        }
        return extent_op;
}

static int run_and_cleanup_extent_op(struct btrfs_trans_handle *trans,
                                     struct btrfs_delayed_ref_head *head)
{
        struct btrfs_delayed_extent_op *extent_op;
        int ret;

        extent_op = cleanup_extent_op(head);
        if (!extent_op)
                return 0;
        head->extent_op = NULL;
        spin_unlock(&head->lock);
        ret = run_delayed_extent_op(trans, head, extent_op);
        btrfs_free_delayed_extent_op(extent_op);
        return ret ? ret : 1;
}

u64 btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
                                  struct btrfs_delayed_ref_root *delayed_refs,
                                  struct btrfs_delayed_ref_head *head)
{
        u64 ret = 0;

        /*
         * We had csum deletions accounted for in our delayed refs rsv, we need
         * to drop the csum leaves for this update from our delayed_refs_rsv.
         */
        if (head->total_ref_mod < 0 && head->is_data) {
                int nr_csums;

                spin_lock(&delayed_refs->lock);
                delayed_refs->pending_csums -= head->num_bytes;
                spin_unlock(&delayed_refs->lock);
                nr_csums = btrfs_csum_bytes_to_leaves(fs_info, head->num_bytes);

                btrfs_delayed_refs_rsv_release(fs_info, 0, nr_csums);

                ret = btrfs_calc_delayed_ref_csum_bytes(fs_info, nr_csums);
        }
        /* must_insert_reserved can be set only if we didn't run the head ref. */
        if (head->must_insert_reserved)
                free_head_ref_squota_rsv(fs_info, head);

        return ret;
}

static int cleanup_ref_head(struct btrfs_trans_handle *trans,
                            struct btrfs_delayed_ref_head *head,
                            u64 *bytes_released)
{

        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_delayed_ref_root *delayed_refs;
        int ret;

        delayed_refs = &trans->transaction->delayed_refs;

        ret = run_and_cleanup_extent_op(trans, head);
        if (ret < 0) {
                unselect_delayed_ref_head(delayed_refs, head);
                btrfs_debug(fs_info, "run_delayed_extent_op returned %d", ret);
                return ret;
        } else if (ret) {
                return ret;
        }

        /*
         * Need to drop our head ref lock and re-acquire the delayed ref lock
         * and then re-check to make sure nobody got added.
         */
        spin_unlock(&head->lock);
        spin_lock(&delayed_refs->lock);
        spin_lock(&head->lock);
        if (!RB_EMPTY_ROOT(&head->ref_tree.rb_root) || head->extent_op) {
                spin_unlock(&head->lock);
                spin_unlock(&delayed_refs->lock);
                return 1;
        }
        btrfs_delete_ref_head(delayed_refs, head);
        spin_unlock(&head->lock);
        spin_unlock(&delayed_refs->lock);

        if (head->must_insert_reserved) {
                btrfs_pin_extent(trans, head->bytenr, head->num_bytes, 1);
                if (head->is_data) {
                        struct btrfs_root *csum_root;

                        csum_root = btrfs_csum_root(fs_info, head->bytenr);
                        ret = btrfs_del_csums(trans, csum_root, head->bytenr,
                                              head->num_bytes);
                }
        }

        *bytes_released += btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);

        trace_run_delayed_ref_head(fs_info, head, 0);
        btrfs_delayed_ref_unlock(head);
        btrfs_put_delayed_ref_head(head);
        return ret;
}

static struct btrfs_delayed_ref_head *btrfs_obtain_ref_head(
                                        struct btrfs_trans_handle *trans)
{
        struct btrfs_delayed_ref_root *delayed_refs =
                &trans->transaction->delayed_refs;
        struct btrfs_delayed_ref_head *head = NULL;
        int ret;

        spin_lock(&delayed_refs->lock);
        head = btrfs_select_ref_head(delayed_refs);
        if (!head) {
                spin_unlock(&delayed_refs->lock);
                return head;
        }

        /*
         * Grab the lock that says we are going to process all the refs for
         * this head
         */
        ret = btrfs_delayed_ref_lock(delayed_refs, head);
        spin_unlock(&delayed_refs->lock);

        /*
         * We may have dropped the spin lock to get the head mutex lock, and
         * that might have given someone else time to free the head.  If that's
         * true, it has been removed from our list and we can move on.
         */
        if (ret == -EAGAIN)
                head = ERR_PTR(-EAGAIN);

        return head;
}

static int btrfs_run_delayed_refs_for_head(struct btrfs_trans_handle *trans,
                                           struct btrfs_delayed_ref_head *locked_ref,
                                           u64 *bytes_released)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_delayed_extent_op *extent_op;
        struct btrfs_delayed_ref_node *ref;
        bool must_insert_reserved;
        int ret;

        delayed_refs = &trans->transaction->delayed_refs;

        lockdep_assert_held(&locked_ref->mutex);
        lockdep_assert_held(&locked_ref->lock);

        while ((ref = select_delayed_ref(locked_ref))) {
                if (ref->seq &&
                    btrfs_check_delayed_seq(fs_info, ref->seq)) {
                        spin_unlock(&locked_ref->lock);
                        unselect_delayed_ref_head(delayed_refs, locked_ref);
                        return -EAGAIN;
                }

                rb_erase_cached(&ref->ref_node, &locked_ref->ref_tree);
                RB_CLEAR_NODE(&ref->ref_node);
                if (!list_empty(&ref->add_list))
                        list_del(&ref->add_list);
                /*
                 * When we play the delayed ref, also correct the ref_mod on
                 * head
                 */
                switch (ref->action) {
                case BTRFS_ADD_DELAYED_REF:
                case BTRFS_ADD_DELAYED_EXTENT:
                        locked_ref->ref_mod -= ref->ref_mod;
                        break;
                case BTRFS_DROP_DELAYED_REF:
                        locked_ref->ref_mod += ref->ref_mod;
                        break;
                default:
                        WARN_ON(1);
                }
                atomic_dec(&delayed_refs->num_entries);

                /*
                 * Record the must_insert_reserved flag before we drop the
                 * spin lock.
                 */
                must_insert_reserved = locked_ref->must_insert_reserved;
                /*
                 * Unsetting this on the head ref relinquishes ownership of
                 * the rsv_bytes, so it is critical that every possible code
                 * path from here forward frees all reserves including qgroup
                 * reserve.
                 */
                locked_ref->must_insert_reserved = false;

                extent_op = locked_ref->extent_op;
                locked_ref->extent_op = NULL;
                spin_unlock(&locked_ref->lock);

                ret = run_one_delayed_ref(trans, locked_ref, ref, extent_op,
                                          must_insert_reserved);
                btrfs_delayed_refs_rsv_release(fs_info, 1, 0);
                *bytes_released += btrfs_calc_delayed_ref_bytes(fs_info, 1);

                btrfs_free_delayed_extent_op(extent_op);
                if (ret) {
                        unselect_delayed_ref_head(delayed_refs, locked_ref);
                        btrfs_put_delayed_ref(ref);
                        return ret;
                }

                btrfs_put_delayed_ref(ref);
                cond_resched();

                spin_lock(&locked_ref->lock);
                btrfs_merge_delayed_refs(fs_info, delayed_refs, locked_ref);
        }

        return 0;
}

/*
 * Returns 0 on success or if called with an already aborted transaction.
 * Returns -ENOMEM or -EIO on failure and will abort the transaction.
 */
static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                                             u64 min_bytes)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_delayed_ref_head *locked_ref = NULL;
        int ret;
        unsigned long count = 0;
        unsigned long max_count = 0;
        u64 bytes_processed = 0;

        delayed_refs = &trans->transaction->delayed_refs;
        if (min_bytes == 0) {
                max_count = delayed_refs->num_heads_ready;
                min_bytes = U64_MAX;
        }

        do {
                if (!locked_ref) {
                        locked_ref = btrfs_obtain_ref_head(trans);
                        if (IS_ERR_OR_NULL(locked_ref)) {
                                if (PTR_ERR(locked_ref) == -EAGAIN) {
                                        continue;
                                } else {
                                        break;
                                }
                        }
                        count++;
                }
                /*
                 * We need to try and merge add/drops of the same ref since we
                 * can run into issues with relocate dropping the implicit ref
                 * and then it being added back again before the drop can
                 * finish.  If we merged anything we need to re-loop so we can
                 * get a good ref.
                 * Or we can get node references of the same type that weren't
                 * merged when created due to bumps in the tree mod seq, and
                 * we need to merge them to prevent adding an inline extent
                 * backref before dropping it (triggering a BUG_ON at
                 * insert_inline_extent_backref()).
                 */
                spin_lock(&locked_ref->lock);
                btrfs_merge_delayed_refs(fs_info, delayed_refs, locked_ref);

                ret = btrfs_run_delayed_refs_for_head(trans, locked_ref, &bytes_processed);
                if (ret < 0 && ret != -EAGAIN) {
                        /*
                         * Error, btrfs_run_delayed_refs_for_head already
                         * unlocked everything so just bail out
                         */
                        return ret;
                } else if (!ret) {
                        /*
                         * Success, perform the usual cleanup of a processed
                         * head
                         */
                        ret = cleanup_ref_head(trans, locked_ref, &bytes_processed);
                        if (ret > 0 ) {
                                /* We dropped our lock, we need to loop. */
                                ret = 0;
                                continue;
                        } else if (ret) {
                                return ret;
                        }
                }

                /*
                 * Either success case or btrfs_run_delayed_refs_for_head
                 * returned -EAGAIN, meaning we need to select another head
                 */

                locked_ref = NULL;
                cond_resched();
        } while ((min_bytes != U64_MAX && bytes_processed < min_bytes) ||
                 (max_count > 0 && count < max_count) ||
                 locked_ref);

        return 0;
}

#ifdef SCRAMBLE_DELAYED_REFS
/*
 * Normally delayed refs get processed in ascending bytenr order. This
 * correlates in most cases to the order added. To expose dependencies on this
 * order, we start to process the tree in the middle instead of the beginning
 */
static u64 find_middle(struct rb_root *root)
{
        struct rb_node *n = root->rb_node;
        struct btrfs_delayed_ref_node *entry;
        int alt = 1;
        u64 middle;
        u64 first = 0, last = 0;

        n = rb_first(root);
        if (n) {
                entry = rb_entry(n, struct btrfs_delayed_ref_node, rb_node);
                first = entry->bytenr;
        }
        n = rb_last(root);
        if (n) {
                entry = rb_entry(n, struct btrfs_delayed_ref_node, rb_node);
                last = entry->bytenr;
        }
        n = root->rb_node;

        while (n) {
                entry = rb_entry(n, struct btrfs_delayed_ref_node, rb_node);
                WARN_ON(!entry->in_tree);

                middle = entry->bytenr;

                if (alt)
                        n = n->rb_left;
                else
                        n = n->rb_right;

                alt = 1 - alt;
        }
        return middle;
}
#endif

/*
 * Start processing the delayed reference count updates and extent insertions
 * we have queued up so far.
 *
 * @trans:        Transaction handle.
 * @min_bytes:        How many bytes of delayed references to process. After this
 *                many bytes we stop processing delayed references if there are
 *                any more. If 0 it means to run all existing delayed references,
 *                but not new ones added after running all existing ones.
 *                Use (u64)-1 (U64_MAX) to run all existing delayed references
 *                plus any new ones that are added.
 *
 * Returns 0 on success or if called with an aborted transaction
 * Returns <0 on error and aborts the transaction
 */
int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans, u64 min_bytes)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_delayed_ref_root *delayed_refs;
        int ret;

        /* We'll clean this up in btrfs_cleanup_transaction */
        if (TRANS_ABORTED(trans))
                return 0;

        if (test_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags))
                return 0;

        delayed_refs = &trans->transaction->delayed_refs;
again:
#ifdef SCRAMBLE_DELAYED_REFS
        delayed_refs->run_delayed_start = find_middle(&delayed_refs->root);
#endif
        ret = __btrfs_run_delayed_refs(trans, min_bytes);
        if (ret < 0) {
                btrfs_abort_transaction(trans, ret);
                return ret;
        }

        if (min_bytes == U64_MAX) {
                btrfs_create_pending_block_groups(trans);

                spin_lock(&delayed_refs->lock);
                if (RB_EMPTY_ROOT(&delayed_refs->href_root.rb_root)) {
                        spin_unlock(&delayed_refs->lock);
                        return 0;
                }
                spin_unlock(&delayed_refs->lock);

                cond_resched();
                goto again;
        }

        return 0;
}

int btrfs_set_disk_extent_flags(struct btrfs_trans_handle *trans,
                                struct extent_buffer *eb, u64 flags)
{
        struct btrfs_delayed_extent_op *extent_op;
        int ret;

        extent_op = btrfs_alloc_delayed_extent_op();
        if (!extent_op)
                return -ENOMEM;

        extent_op->flags_to_set = flags;
        extent_op->update_flags = true;
        extent_op->update_key = false;

        ret = btrfs_add_delayed_extent_op(trans, eb->start, eb->len,
                                          btrfs_header_level(eb), extent_op);
        if (ret)
                btrfs_free_delayed_extent_op(extent_op);
        return ret;
}

static noinline int check_delayed_ref(struct btrfs_root *root,
                                      struct btrfs_path *path,
                                      u64 objectid, u64 offset, u64 bytenr)
{
        struct btrfs_delayed_ref_head *head;
        struct btrfs_delayed_ref_node *ref;
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_transaction *cur_trans;
        struct rb_node *node;
        int ret = 0;

        spin_lock(&root->fs_info->trans_lock);
        cur_trans = root->fs_info->running_transaction;
        if (cur_trans)
                refcount_inc(&cur_trans->use_count);
        spin_unlock(&root->fs_info->trans_lock);
        if (!cur_trans)
                return 0;

        delayed_refs = &cur_trans->delayed_refs;
        spin_lock(&delayed_refs->lock);
        head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
        if (!head) {
                spin_unlock(&delayed_refs->lock);
                btrfs_put_transaction(cur_trans);
                return 0;
        }

        if (!mutex_trylock(&head->mutex)) {
                if (path->nowait) {
                        spin_unlock(&delayed_refs->lock);
                        btrfs_put_transaction(cur_trans);
                        return -EAGAIN;
                }

                refcount_inc(&head->refs);
                spin_unlock(&delayed_refs->lock);

                btrfs_release_path(path);

                /*
                 * Mutex was contended, block until it's released and let
                 * caller try again
                 */
                mutex_lock(&head->mutex);
                mutex_unlock(&head->mutex);
                btrfs_put_delayed_ref_head(head);
                btrfs_put_transaction(cur_trans);
                return -EAGAIN;
        }
        spin_unlock(&delayed_refs->lock);

        spin_lock(&head->lock);
        /*
         * XXX: We should replace this with a proper search function in the
         * future.
         */
        for (node = rb_first_cached(&head->ref_tree); node;
             node = rb_next(node)) {
                u64 ref_owner;
                u64 ref_offset;

                ref = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
                /* If it's a shared ref we know a cross reference exists */
                if (ref->type != BTRFS_EXTENT_DATA_REF_KEY) {
                        ret = 1;
                        break;
                }

                ref_owner = btrfs_delayed_ref_owner(ref);
                ref_offset = btrfs_delayed_ref_offset(ref);

                /*
                 * If our ref doesn't match the one we're currently looking at
                 * then we have a cross reference.
                 */
                if (ref->ref_root != btrfs_root_id(root) ||
                    ref_owner != objectid || ref_offset != offset) {
                        ret = 1;
                        break;
                }
        }
        spin_unlock(&head->lock);
        mutex_unlock(&head->mutex);
        btrfs_put_transaction(cur_trans);
        return ret;
}

static noinline int check_committed_ref(struct btrfs_root *root,
                                        struct btrfs_path *path,
                                        u64 objectid, u64 offset, u64 bytenr,
                                        bool strict)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        struct btrfs_root *extent_root = btrfs_extent_root(fs_info, bytenr);
        struct extent_buffer *leaf;
        struct btrfs_extent_data_ref *ref;
        struct btrfs_extent_inline_ref *iref;
        struct btrfs_extent_item *ei;
        struct btrfs_key key;
        u32 item_size;
        u32 expected_size;
        int type;
        int ret;

        key.objectid = bytenr;
        key.offset = (u64)-1;
        key.type = BTRFS_EXTENT_ITEM_KEY;

        ret = btrfs_search_slot(NULL, extent_root, &key, path, 0, 0);
        if (ret < 0)
                goto out;
        if (ret == 0) {
                /*
                 * Key with offset -1 found, there would have to exist an extent
                 * item with such offset, but this is out of the valid range.
                 */
                ret = -EUCLEAN;
                goto out;
        }

        ret = -ENOENT;
        if (path->slots[0] == 0)
                goto out;

        path->slots[0]--;
        leaf = path->nodes[0];
        btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);

        if (key.objectid != bytenr || key.type != BTRFS_EXTENT_ITEM_KEY)
                goto out;

        ret = 1;
        item_size = btrfs_item_size(leaf, path->slots[0]);
        ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item);
        expected_size = sizeof(*ei) + btrfs_extent_inline_ref_size(BTRFS_EXTENT_DATA_REF_KEY);

        /* No inline refs; we need to bail before checking for owner ref. */
        if (item_size == sizeof(*ei))
                goto out;

        /* Check for an owner ref; skip over it to the real inline refs. */
        iref = (struct btrfs_extent_inline_ref *)(ei + 1);
        type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
        if (btrfs_fs_incompat(fs_info, SIMPLE_QUOTA) && type == BTRFS_EXTENT_OWNER_REF_KEY) {
                expected_size += btrfs_extent_inline_ref_size(BTRFS_EXTENT_OWNER_REF_KEY);
                iref = (struct btrfs_extent_inline_ref *)(iref + 1);
        }

        /* If extent item has more than 1 inline ref then it's shared */
        if (item_size != expected_size)
                goto out;

        /*
         * If extent created before last snapshot => it's shared unless the
         * snapshot has been deleted. Use the heuristic if strict is false.
         */
        if (!strict &&
            (btrfs_extent_generation(leaf, ei) <=
             btrfs_root_last_snapshot(&root->root_item)))
                goto out;

        /* If this extent has SHARED_DATA_REF then it's shared */
        type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
        if (type != BTRFS_EXTENT_DATA_REF_KEY)
                goto out;

        ref = (struct btrfs_extent_data_ref *)(&iref->offset);
        if (btrfs_extent_refs(leaf, ei) !=
            btrfs_extent_data_ref_count(leaf, ref) ||
            btrfs_extent_data_ref_root(leaf, ref) != btrfs_root_id(root) ||
            btrfs_extent_data_ref_objectid(leaf, ref) != objectid ||
            btrfs_extent_data_ref_offset(leaf, ref) != offset)
                goto out;

        ret = 0;
out:
        return ret;
}

int btrfs_cross_ref_exist(struct btrfs_root *root, u64 objectid, u64 offset,
                          u64 bytenr, bool strict, struct btrfs_path *path)
{
        int ret;

        do {
                ret = check_committed_ref(root, path, objectid,
                                          offset, bytenr, strict);
                if (ret && ret != -ENOENT)
                        goto out;

                ret = check_delayed_ref(root, path, objectid, offset, bytenr);
        } while (ret == -EAGAIN);

out:
        btrfs_release_path(path);
        if (btrfs_is_data_reloc_root(root))
                WARN_ON(ret > 0);
        return ret;
}

static int __btrfs_mod_ref(struct btrfs_trans_handle *trans,
                           struct btrfs_root *root,
                           struct extent_buffer *buf,
                           int full_backref, int inc)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        u64 parent;
        u64 ref_root;
        u32 nritems;
        struct btrfs_key key;
        struct btrfs_file_extent_item *fi;
        bool for_reloc = btrfs_header_flag(buf, BTRFS_HEADER_FLAG_RELOC);
        int i;
        int action;
        int level;
        int ret = 0;

        if (btrfs_is_testing(fs_info))
                return 0;

        ref_root = btrfs_header_owner(buf);
        nritems = btrfs_header_nritems(buf);
        level = btrfs_header_level(buf);

        if (!test_bit(BTRFS_ROOT_SHAREABLE, &root->state) && level == 0)
                return 0;

        if (full_backref)
                parent = buf->start;
        else
                parent = 0;
        if (inc)
                action = BTRFS_ADD_DELAYED_REF;
        else
                action = BTRFS_DROP_DELAYED_REF;

        for (i = 0; i < nritems; i++) {
                struct btrfs_ref ref = {
                        .action = action,
                        .parent = parent,
                        .ref_root = ref_root,
                };

                if (level == 0) {
                        btrfs_item_key_to_cpu(buf, &key, i);
                        if (key.type != BTRFS_EXTENT_DATA_KEY)
                                continue;
                        fi = btrfs_item_ptr(buf, i,
                                            struct btrfs_file_extent_item);
                        if (btrfs_file_extent_type(buf, fi) ==
                            BTRFS_FILE_EXTENT_INLINE)
                                continue;
                        ref.bytenr = btrfs_file_extent_disk_bytenr(buf, fi);
                        if (ref.bytenr == 0)
                                continue;

                        ref.num_bytes = btrfs_file_extent_disk_num_bytes(buf, fi);
                        ref.owning_root = ref_root;

                        key.offset -= btrfs_file_extent_offset(buf, fi);
                        btrfs_init_data_ref(&ref, key.objectid, key.offset,
                                            btrfs_root_id(root), for_reloc);
                        if (inc)
                                ret = btrfs_inc_extent_ref(trans, &ref);
                        else
                                ret = btrfs_free_extent(trans, &ref);
                        if (ret)
                                goto fail;
                } else {
                        /* We don't know the owning_root, leave as 0. */
                        ref.bytenr = btrfs_node_blockptr(buf, i);
                        ref.num_bytes = fs_info->nodesize;

                        btrfs_init_tree_ref(&ref, level - 1,
                                            btrfs_root_id(root), for_reloc);
                        if (inc)
                                ret = btrfs_inc_extent_ref(trans, &ref);
                        else
                                ret = btrfs_free_extent(trans, &ref);
                        if (ret)
                                goto fail;
                }
        }
        return 0;
fail:
        return ret;
}

int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                  struct extent_buffer *buf, int full_backref)
{
        return __btrfs_mod_ref(trans, root, buf, full_backref, 1);
}

int btrfs_dec_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                  struct extent_buffer *buf, int full_backref)
{
        return __btrfs_mod_ref(trans, root, buf, full_backref, 0);
}

static u64 get_alloc_profile_by_root(struct btrfs_root *root, int data)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        u64 flags;
        u64 ret;

        if (data)
                flags = BTRFS_BLOCK_GROUP_DATA;
        else if (root == fs_info->chunk_root)
                flags = BTRFS_BLOCK_GROUP_SYSTEM;
        else
                flags = BTRFS_BLOCK_GROUP_METADATA;

        ret = btrfs_get_alloc_profile(fs_info, flags);
        return ret;
}

static u64 first_logical_byte(struct btrfs_fs_info *fs_info)
{
        struct rb_node *leftmost;
        u64 bytenr = 0;

        read_lock(&fs_info->block_group_cache_lock);
        /* Get the block group with the lowest logical start address. */
        leftmost = rb_first_cached(&fs_info->block_group_cache_tree);
        if (leftmost) {
                struct btrfs_block_group *bg;

                bg = rb_entry(leftmost, struct btrfs_block_group, cache_node);
                bytenr = bg->start;
        }
        read_unlock(&fs_info->block_group_cache_lock);

        return bytenr;
}

static int pin_down_extent(struct btrfs_trans_handle *trans,
                           struct btrfs_block_group *cache,
                           u64 bytenr, u64 num_bytes, int reserved)
{
        struct btrfs_fs_info *fs_info = cache->fs_info;

        spin_lock(&cache->space_info->lock);
        spin_lock(&cache->lock);
        cache->pinned += num_bytes;
        btrfs_space_info_update_bytes_pinned(fs_info, cache->space_info,
                                             num_bytes);
        if (reserved) {
                cache->reserved -= num_bytes;
                cache->space_info->bytes_reserved -= num_bytes;
        }
        spin_unlock(&cache->lock);
        spin_unlock(&cache->space_info->lock);

        set_extent_bit(&trans->transaction->pinned_extents, bytenr,
                       bytenr + num_bytes - 1, EXTENT_DIRTY, NULL);
        return 0;
}

int btrfs_pin_extent(struct btrfs_trans_handle *trans,
                     u64 bytenr, u64 num_bytes, int reserved)
{
        struct btrfs_block_group *cache;

        cache = btrfs_lookup_block_group(trans->fs_info, bytenr);
        BUG_ON(!cache); /* Logic error */

        pin_down_extent(trans, cache, bytenr, num_bytes, reserved);

        btrfs_put_block_group(cache);
        return 0;
}

int btrfs_pin_extent_for_log_replay(struct btrfs_trans_handle *trans,
                                    const struct extent_buffer *eb)
{
        struct btrfs_block_group *cache;
        int ret;

        cache = btrfs_lookup_block_group(trans->fs_info, eb->start);
        if (!cache)
                return -EINVAL;

        /*
         * Fully cache the free space first so that our pin removes the free space
         * from the cache.
         */
        ret = btrfs_cache_block_group(cache, true);
        if (ret)
                goto out;

        pin_down_extent(trans, cache, eb->start, eb->len, 0);

        /* remove us from the free space cache (if we're there at all) */
        ret = btrfs_remove_free_space(cache, eb->start, eb->len);
out:
        btrfs_put_block_group(cache);
        return ret;
}

static int __exclude_logged_extent(struct btrfs_fs_info *fs_info,
                                   u64 start, u64 num_bytes)
{
        int ret;
        struct btrfs_block_group *block_group;

        block_group = btrfs_lookup_block_group(fs_info, start);
        if (!block_group)
                return -EINVAL;

        ret = btrfs_cache_block_group(block_group, true);
        if (ret)
                goto out;

        ret = btrfs_remove_free_space(block_group, start, num_bytes);
out:
        btrfs_put_block_group(block_group);
        return ret;
}

int btrfs_exclude_logged_extents(struct extent_buffer *eb)
{
        struct btrfs_fs_info *fs_info = eb->fs_info;
        struct btrfs_file_extent_item *item;
        struct btrfs_key key;
        int found_type;
        int i;
        int ret = 0;

        if (!btrfs_fs_incompat(fs_info, MIXED_GROUPS))
                return 0;

        for (i = 0; i < btrfs_header_nritems(eb); i++) {
                btrfs_item_key_to_cpu(eb, &key, i);
                if (key.type != BTRFS_EXTENT_DATA_KEY)
                        continue;
                item = btrfs_item_ptr(eb, i, struct btrfs_file_extent_item);
                found_type = btrfs_file_extent_type(eb, item);
                if (found_type == BTRFS_FILE_EXTENT_INLINE)
                        continue;
                if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
                        continue;
                key.objectid = btrfs_file_extent_disk_bytenr(eb, item);
                key.offset = btrfs_file_extent_disk_num_bytes(eb, item);
                ret = __exclude_logged_extent(fs_info, key.objectid, key.offset);
                if (ret)
                        break;
        }

        return ret;
}

static void
btrfs_inc_block_group_reservations(struct btrfs_block_group *bg)
{
        atomic_inc(&bg->reservations);
}

/*
 * Returns the free cluster for the given space info and sets empty_cluster to
 * what it should be based on the mount options.
 */
static struct btrfs_free_cluster *
fetch_cluster_info(struct btrfs_fs_info *fs_info,
                   struct btrfs_space_info *space_info, u64 *empty_cluster)
{
        struct btrfs_free_cluster *ret = NULL;

        *empty_cluster = 0;
        if (btrfs_mixed_space_info(space_info))
                return ret;

        if (space_info->flags & BTRFS_BLOCK_GROUP_METADATA) {
                ret = &fs_info->meta_alloc_cluster;
                if (btrfs_test_opt(fs_info, SSD))
                        *empty_cluster = SZ_2M;
                else
                        *empty_cluster = SZ_64K;
        } else if ((space_info->flags & BTRFS_BLOCK_GROUP_DATA) &&
                   btrfs_test_opt(fs_info, SSD_SPREAD)) {
                *empty_cluster = SZ_2M;
                ret = &fs_info->data_alloc_cluster;
        }

        return ret;
}

static int unpin_extent_range(struct btrfs_fs_info *fs_info,
                              u64 start, u64 end,
                              const bool return_free_space)
{
        struct btrfs_block_group *cache = NULL;
        struct btrfs_space_info *space_info;
        struct btrfs_block_rsv *global_rsv = &fs_info->global_block_rsv;
        struct btrfs_free_cluster *cluster = NULL;
        u64 len;
        u64 total_unpinned = 0;
        u64 empty_cluster = 0;
        bool readonly;
        int ret = 0;

        while (start <= end) {
                readonly = false;
                if (!cache ||
                    start >= cache->start + cache->length) {
                        if (cache)
                                btrfs_put_block_group(cache);
                        total_unpinned = 0;
                        cache = btrfs_lookup_block_group(fs_info, start);
                        if (cache == NULL) {
                                /* Logic error, something removed the block group. */
                                ret = -EUCLEAN;
                                goto out;
                        }

                        cluster = fetch_cluster_info(fs_info,
                                                     cache->space_info,
                                                     &empty_cluster);
                        empty_cluster <<= 1;
                }

                len = cache->start + cache->length - start;
                len = min(len, end + 1 - start);

                if (return_free_space)
                        btrfs_add_free_space(cache, start, len);

                start += len;
                total_unpinned += len;
                space_info = cache->space_info;

                /*
                 * If this space cluster has been marked as fragmented and we've
                 * unpinned enough in this block group to potentially allow a
                 * cluster to be created inside of it go ahead and clear the
                 * fragmented check.
                 */
                if (cluster && cluster->fragmented &&
                    total_unpinned > empty_cluster) {
                        spin_lock(&cluster->lock);
                        cluster->fragmented = 0;
                        spin_unlock(&cluster->lock);
                }

                spin_lock(&space_info->lock);
                spin_lock(&cache->lock);
                cache->pinned -= len;
                btrfs_space_info_update_bytes_pinned(fs_info, space_info, -len);
                space_info->max_extent_size = 0;
                if (cache->ro) {
                        space_info->bytes_readonly += len;
                        readonly = true;
                } else if (btrfs_is_zoned(fs_info)) {
                        /* Need reset before reusing in a zoned block group */
                        btrfs_space_info_update_bytes_zone_unusable(fs_info, space_info,
                                                                    len);
                        readonly = true;
                }
                spin_unlock(&cache->lock);
                if (!readonly && return_free_space &&
                    global_rsv->space_info == space_info) {
                        spin_lock(&global_rsv->lock);
                        if (!global_rsv->full) {
                                u64 to_add = min(len, global_rsv->size -
                                                      global_rsv->reserved);

                                global_rsv->reserved += to_add;
                                btrfs_space_info_update_bytes_may_use(fs_info,
                                                space_info, to_add);
                                if (global_rsv->reserved >= global_rsv->size)
                                        global_rsv->full = 1;
                                len -= to_add;
                        }
                        spin_unlock(&global_rsv->lock);
                }
                /* Add to any tickets we may have */
                if (!readonly && return_free_space && len)
                        btrfs_try_granting_tickets(fs_info, space_info);
                spin_unlock(&space_info->lock);
        }

        if (cache)
                btrfs_put_block_group(cache);
out:
        return ret;
}

int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_block_group *block_group, *tmp;
        struct list_head *deleted_bgs;
        struct extent_io_tree *unpin;
        u64 start;
        u64 end;
        int ret;

        unpin = &trans->transaction->pinned_extents;

        while (!TRANS_ABORTED(trans)) {
                struct extent_state *cached_state = NULL;

                mutex_lock(&fs_info->unused_bg_unpin_mutex);
                if (!find_first_extent_bit(unpin, 0, &start, &end,
                                           EXTENT_DIRTY, &cached_state)) {
                        mutex_unlock(&fs_info->unused_bg_unpin_mutex);
                        break;
                }

                if (btrfs_test_opt(fs_info, DISCARD_SYNC))
                        ret = btrfs_discard_extent(fs_info, start,
                                                   end + 1 - start, NULL);

                clear_extent_dirty(unpin, start, end, &cached_state);
                ret = unpin_extent_range(fs_info, start, end, true);
                BUG_ON(ret);
                mutex_unlock(&fs_info->unused_bg_unpin_mutex);
                free_extent_state(cached_state);
                cond_resched();
        }

        if (btrfs_test_opt(fs_info, DISCARD_ASYNC)) {
                btrfs_discard_calc_delay(&fs_info->discard_ctl);
                btrfs_discard_schedule_work(&fs_info->discard_ctl, true);
        }

        /*
         * Transaction is finished.  We don't need the lock anymore.  We
         * do need to clean up the block groups in case of a transaction
         * abort.
         */
        deleted_bgs = &trans->transaction->deleted_bgs;
        list_for_each_entry_safe(block_group, tmp, deleted_bgs, bg_list) {
                u64 trimmed = 0;

                ret = -EROFS;
                if (!TRANS_ABORTED(trans))
                        ret = btrfs_discard_extent(fs_info,
                                                   block_group->start,
                                                   block_group->length,
                                                   &trimmed);

                list_del_init(&block_group->bg_list);
                btrfs_unfreeze_block_group(block_group);
                btrfs_put_block_group(block_group);

                if (ret) {
                        const char *errstr = btrfs_decode_error(ret);
                        btrfs_warn(fs_info,
                           "discard failed while removing blockgroup: errno=%d %s",
                                   ret, errstr);
                }
        }

        return 0;
}

/*
 * Parse an extent item's inline extents looking for a simple quotas owner ref.
 *
 * @fs_info:        the btrfs_fs_info for this mount
 * @leaf:        a leaf in the extent tree containing the extent item
 * @slot:        the slot in the leaf where the extent item is found
 *
 * Returns the objectid of the root that originally allocated the extent item
 * if the inline owner ref is expected and present, otherwise 0.
 *
 * If an extent item has an owner ref item, it will be the first inline ref
 * item. Therefore the logic is to check whether there are any inline ref
 * items, then check the type of the first one.
 */
u64 btrfs_get_extent_owner_root(struct btrfs_fs_info *fs_info,
                                struct extent_buffer *leaf, int slot)
{
        struct btrfs_extent_item *ei;
        struct btrfs_extent_inline_ref *iref;
        struct btrfs_extent_owner_ref *oref;
        unsigned long ptr;
        unsigned long end;
        int type;

        if (!btrfs_fs_incompat(fs_info, SIMPLE_QUOTA))
                return 0;

        ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
        ptr = (unsigned long)(ei + 1);
        end = (unsigned long)ei + btrfs_item_size(leaf, slot);

        /* No inline ref items of any kind, can't check type. */
        if (ptr == end)
                return 0;

        iref = (struct btrfs_extent_inline_ref *)ptr;
        type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_ANY);

        /* We found an owner ref, get the root out of it. */
        if (type == BTRFS_EXTENT_OWNER_REF_KEY) {
                oref = (struct btrfs_extent_owner_ref *)(&iref->offset);
                return btrfs_extent_owner_ref_root_id(leaf, oref);
        }

        /* We have inline refs, but not an owner ref. */
        return 0;
}

static int do_free_extent_accounting(struct btrfs_trans_handle *trans,
                                     u64 bytenr, struct btrfs_squota_delta *delta)
{
        int ret;
        u64 num_bytes = delta->num_bytes;

        if (delta->is_data) {
                struct btrfs_root *csum_root;

                csum_root = btrfs_csum_root(trans->fs_info, bytenr);
                ret = btrfs_del_csums(trans, csum_root, bytenr, num_bytes);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        return ret;
                }

                ret = btrfs_delete_raid_extent(trans, bytenr, num_bytes);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        return ret;
                }
        }

        ret = btrfs_record_squota_delta(trans->fs_info, delta);
        if (ret) {
                btrfs_abort_transaction(trans, ret);
                return ret;
        }

        ret = add_to_free_space_tree(trans, bytenr, num_bytes);
        if (ret) {
                btrfs_abort_transaction(trans, ret);
                return ret;
        }

        ret = btrfs_update_block_group(trans, bytenr, num_bytes, false);
        if (ret)
                btrfs_abort_transaction(trans, ret);

        return ret;
}

#define abort_and_dump(trans, path, fmt, args...)        \
({                                                        \
        btrfs_abort_transaction(trans, -EUCLEAN);        \
        btrfs_print_leaf(path->nodes[0]);                \
        btrfs_crit(trans->fs_info, fmt, ##args);        \
})

/*
 * Drop one or more refs of @node.
 *
 * 1. Locate the extent refs.
 *    It's either inline in EXTENT/METADATA_ITEM or in keyed SHARED_* item.
 *    Locate it, then reduce the refs number or remove the ref line completely.
 *
 * 2. Update the refs count in EXTENT/METADATA_ITEM
 *
 * Inline backref case:
 *
 * in extent tree we have:
 *
 *         item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 16201 itemsize 82
 *                refs 2 gen 6 flags DATA
 *                extent data backref root FS_TREE objectid 258 offset 0 count 1
 *                extent data backref root FS_TREE objectid 257 offset 0 count 1
 *
 * This function gets called with:
 *
 *    node->bytenr = 13631488
 *    node->num_bytes = 1048576
 *    root_objectid = FS_TREE
 *    owner_objectid = 257
 *    owner_offset = 0
 *    refs_to_drop = 1
 *
 * Then we should get some like:
 *
 *         item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 16201 itemsize 82
 *                refs 1 gen 6 flags DATA
 *                extent data backref root FS_TREE objectid 258 offset 0 count 1
 *
 * Keyed backref case:
 *
 * in extent tree we have:
 *
 *        item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 3971 itemsize 24
 *                refs 754 gen 6 flags DATA
 *        [...]
 *        item 2 key (13631488 EXTENT_DATA_REF <HASH>) itemoff 3915 itemsize 28
 *                extent data backref root FS_TREE objectid 866 offset 0 count 1
 *
 * This function get called with:
 *
 *    node->bytenr = 13631488
 *    node->num_bytes = 1048576
 *    root_objectid = FS_TREE
 *    owner_objectid = 866
 *    owner_offset = 0
 *    refs_to_drop = 1
 *
 * Then we should get some like:
 *
 *        item 0 key (13631488 EXTENT_ITEM 1048576) itemoff 3971 itemsize 24
 *                refs 753 gen 6 flags DATA
 *
 * And that (13631488 EXTENT_DATA_REF <HASH>) gets removed.
 */
static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
                               struct btrfs_delayed_ref_head *href,
                               struct btrfs_delayed_ref_node *node,
                               struct btrfs_delayed_extent_op *extent_op)
{
        struct btrfs_fs_info *info = trans->fs_info;
        struct btrfs_key key;
        struct btrfs_path *path;
        struct btrfs_root *extent_root;
        struct extent_buffer *leaf;
        struct btrfs_extent_item *ei;
        struct btrfs_extent_inline_ref *iref;
        int ret;
        int is_data;
        int extent_slot = 0;
        int found_extent = 0;
        int num_to_del = 1;
        int refs_to_drop = node->ref_mod;
        u32 item_size;
        u64 refs;
        u64 bytenr = node->bytenr;
        u64 num_bytes = node->num_bytes;
        u64 owner_objectid = btrfs_delayed_ref_owner(node);
        u64 owner_offset = btrfs_delayed_ref_offset(node);
        bool skinny_metadata = btrfs_fs_incompat(info, SKINNY_METADATA);
        u64 delayed_ref_root = href->owning_root;

        extent_root = btrfs_extent_root(info, bytenr);
        ASSERT(extent_root);

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        is_data = owner_objectid >= BTRFS_FIRST_FREE_OBJECTID;

        if (!is_data && refs_to_drop != 1) {
                btrfs_crit(info,
"invalid refs_to_drop, dropping more than 1 refs for tree block %llu refs_to_drop %u",
                           node->bytenr, refs_to_drop);
                ret = -EINVAL;
                btrfs_abort_transaction(trans, ret);
                goto out;
        }

        if (is_data)
                skinny_metadata = false;

        ret = lookup_extent_backref(trans, path, &iref, bytenr, num_bytes,
                                    node->parent, node->ref_root, owner_objectid,
                                    owner_offset);
        if (ret == 0) {
                /*
                 * Either the inline backref or the SHARED_DATA_REF/
                 * SHARED_BLOCK_REF is found
                 *
                 * Here is a quick path to locate EXTENT/METADATA_ITEM.
                 * It's possible the EXTENT/METADATA_ITEM is near current slot.
                 */
                extent_slot = path->slots[0];
                while (extent_slot >= 0) {
                        btrfs_item_key_to_cpu(path->nodes[0], &key,
                                              extent_slot);
                        if (key.objectid != bytenr)
                                break;
                        if (key.type == BTRFS_EXTENT_ITEM_KEY &&
                            key.offset == num_bytes) {
                                found_extent = 1;
                                break;
                        }
                        if (key.type == BTRFS_METADATA_ITEM_KEY &&
                            key.offset == owner_objectid) {
                                found_extent = 1;
                                break;
                        }

                        /* Quick path didn't find the EXTEMT/METADATA_ITEM */
                        if (path->slots[0] - extent_slot > 5)
                                break;
                        extent_slot--;
                }

                if (!found_extent) {
                        if (iref) {
                                abort_and_dump(trans, path,
"invalid iref slot %u, no EXTENT/METADATA_ITEM found but has inline extent ref",
                                           path->slots[0]);
                                ret = -EUCLEAN;
                                goto out;
                        }
                        /* Must be SHARED_* item, remove the backref first */
                        ret = remove_extent_backref(trans, extent_root, path,
                                                    NULL, refs_to_drop, is_data);
                        if (ret) {
                                btrfs_abort_transaction(trans, ret);
                                goto out;
                        }
                        btrfs_release_path(path);

                        /* Slow path to locate EXTENT/METADATA_ITEM */
                        key.objectid = bytenr;
                        key.type = BTRFS_EXTENT_ITEM_KEY;
                        key.offset = num_bytes;

                        if (!is_data && skinny_metadata) {
                                key.type = BTRFS_METADATA_ITEM_KEY;
                                key.offset = owner_objectid;
                        }

                        ret = btrfs_search_slot(trans, extent_root,
                                                &key, path, -1, 1);
                        if (ret > 0 && skinny_metadata && path->slots[0]) {
                                /*
                                 * Couldn't find our skinny metadata item,
                                 * see if we have ye olde extent item.
                                 */
                                path->slots[0]--;
                                btrfs_item_key_to_cpu(path->nodes[0], &key,
                                                      path->slots[0]);
                                if (key.objectid == bytenr &&
                                    key.type == BTRFS_EXTENT_ITEM_KEY &&
                                    key.offset == num_bytes)
                                        ret = 0;
                        }

                        if (ret > 0 && skinny_metadata) {
                                skinny_metadata = false;
                                key.objectid = bytenr;
                                key.type = BTRFS_EXTENT_ITEM_KEY;
                                key.offset = num_bytes;
                                btrfs_release_path(path);
                                ret = btrfs_search_slot(trans, extent_root,
                                                        &key, path, -1, 1);
                        }

                        if (ret) {
                                if (ret > 0)
                                        btrfs_print_leaf(path->nodes[0]);
                                btrfs_err(info,
                        "umm, got %d back from search, was looking for %llu, slot %d",
                                          ret, bytenr, path->slots[0]);
                        }
                        if (ret < 0) {
                                btrfs_abort_transaction(trans, ret);
                                goto out;
                        }
                        extent_slot = path->slots[0];
                }
        } else if (WARN_ON(ret == -ENOENT)) {
                abort_and_dump(trans, path,
"unable to find ref byte nr %llu parent %llu root %llu owner %llu offset %llu slot %d",
                               bytenr, node->parent, node->ref_root, owner_objectid,
                               owner_offset, path->slots[0]);
                goto out;
        } else {
                btrfs_abort_transaction(trans, ret);
                goto out;
        }

        leaf = path->nodes[0];
        item_size = btrfs_item_size(leaf, extent_slot);
        if (unlikely(item_size < sizeof(*ei))) {
                ret = -EUCLEAN;
                btrfs_err(trans->fs_info,
                          "unexpected extent item size, has %u expect >= %zu",
                          item_size, sizeof(*ei));
                btrfs_abort_transaction(trans, ret);
                goto out;
        }
        ei = btrfs_item_ptr(leaf, extent_slot,
                            struct btrfs_extent_item);
        if (owner_objectid < BTRFS_FIRST_FREE_OBJECTID &&
            key.type == BTRFS_EXTENT_ITEM_KEY) {
                struct btrfs_tree_block_info *bi;

                if (item_size < sizeof(*ei) + sizeof(*bi)) {
                        abort_and_dump(trans, path,
"invalid extent item size for key (%llu, %u, %llu) slot %u owner %llu, has %u expect >= %zu",
                                       key.objectid, key.type, key.offset,
                                       path->slots[0], owner_objectid, item_size,
                                       sizeof(*ei) + sizeof(*bi));
                        ret = -EUCLEAN;
                        goto out;
                }
                bi = (struct btrfs_tree_block_info *)(ei + 1);
                WARN_ON(owner_objectid != btrfs_tree_block_level(leaf, bi));
        }

        refs = btrfs_extent_refs(leaf, ei);
        if (refs < refs_to_drop) {
                abort_and_dump(trans, path,
                "trying to drop %d refs but we only have %llu for bytenr %llu slot %u",
                               refs_to_drop, refs, bytenr, path->slots[0]);
                ret = -EUCLEAN;
                goto out;
        }
        refs -= refs_to_drop;

        if (refs > 0) {
                if (extent_op)
                        __run_delayed_extent_op(extent_op, leaf, ei);
                /*
                 * In the case of inline back ref, reference count will
                 * be updated by remove_extent_backref
                 */
                if (iref) {
                        if (!found_extent) {
                                abort_and_dump(trans, path,
"invalid iref, got inlined extent ref but no EXTENT/METADATA_ITEM found, slot %u",
                                               path->slots[0]);
                                ret = -EUCLEAN;
                                goto out;
                        }
                } else {
                        btrfs_set_extent_refs(leaf, ei, refs);
                        btrfs_mark_buffer_dirty(trans, leaf);
                }
                if (found_extent) {
                        ret = remove_extent_backref(trans, extent_root, path,
                                                    iref, refs_to_drop, is_data);
                        if (ret) {
                                btrfs_abort_transaction(trans, ret);
                                goto out;
                        }
                }
        } else {
                struct btrfs_squota_delta delta = {
                        .root = delayed_ref_root,
                        .num_bytes = num_bytes,
                        .is_data = is_data,
                        .is_inc = false,
                        .generation = btrfs_extent_generation(leaf, ei),
                };

                /* In this branch refs == 1 */
                if (found_extent) {
                        if (is_data && refs_to_drop !=
                            extent_data_ref_count(path, iref)) {
                                abort_and_dump(trans, path,
                "invalid refs_to_drop, current refs %u refs_to_drop %u slot %u",
                                               extent_data_ref_count(path, iref),
                                               refs_to_drop, path->slots[0]);
                                ret = -EUCLEAN;
                                goto out;
                        }
                        if (iref) {
                                if (path->slots[0] != extent_slot) {
                                        abort_and_dump(trans, path,
"invalid iref, extent item key (%llu %u %llu) slot %u doesn't have wanted iref",
                                                       key.objectid, key.type,
                                                       key.offset, path->slots[0]);
                                        ret = -EUCLEAN;
                                        goto out;
                                }
                        } else {
                                /*
                                 * No inline ref, we must be at SHARED_* item,
                                 * And it's single ref, it must be:
                                 * |        extent_slot          ||extent_slot + 1|
                                 * [ EXTENT/METADATA_ITEM ][ SHARED_* ITEM ]
                                 */
                                if (path->slots[0] != extent_slot + 1) {
                                        abort_and_dump(trans, path,
        "invalid SHARED_* item slot %u, previous item is not EXTENT/METADATA_ITEM",
                                                       path->slots[0]);
                                        ret = -EUCLEAN;
                                        goto out;
                                }
                                path->slots[0] = extent_slot;
                                num_to_del = 2;
                        }
                }
                /*
                 * We can't infer the data owner from the delayed ref, so we need
                 * to try to get it from the owning ref item.
                 *
                 * If it is not present, then that extent was not written under
                 * simple quotas mode, so we don't need to account for its deletion.
                 */
                if (is_data)
                        delta.root = btrfs_get_extent_owner_root(trans->fs_info,
                                                                 leaf, extent_slot);

                ret = btrfs_del_items(trans, extent_root, path, path->slots[0],
                                      num_to_del);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        goto out;
                }
                btrfs_release_path(path);

                ret = do_free_extent_accounting(trans, bytenr, &delta);
        }
        btrfs_release_path(path);

out:
        btrfs_free_path(path);
        return ret;
}

/*
 * when we free an block, it is possible (and likely) that we free the last
 * delayed ref for that extent as well.  This searches the delayed ref tree for
 * a given extent, and if there are no other delayed refs to be processed, it
 * removes it from the tree.
 */
static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
                                      u64 bytenr)
{
        struct btrfs_delayed_ref_head *head;
        struct btrfs_delayed_ref_root *delayed_refs;
        int ret = 0;

        delayed_refs = &trans->transaction->delayed_refs;
        spin_lock(&delayed_refs->lock);
        head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
        if (!head)
                goto out_delayed_unlock;

        spin_lock(&head->lock);
        if (!RB_EMPTY_ROOT(&head->ref_tree.rb_root))
                goto out;

        if (cleanup_extent_op(head) != NULL)
                goto out;

        /*
         * waiting for the lock here would deadlock.  If someone else has it
         * locked they are already in the process of dropping it anyway
         */
        if (!mutex_trylock(&head->mutex))
                goto out;

        btrfs_delete_ref_head(delayed_refs, head);
        head->processing = false;

        spin_unlock(&head->lock);
        spin_unlock(&delayed_refs->lock);

        BUG_ON(head->extent_op);
        if (head->must_insert_reserved)
                ret = 1;

        btrfs_cleanup_ref_head_accounting(trans->fs_info, delayed_refs, head);
        mutex_unlock(&head->mutex);
        btrfs_put_delayed_ref_head(head);
        return ret;
out:
        spin_unlock(&head->lock);

out_delayed_unlock:
        spin_unlock(&delayed_refs->lock);
        return 0;
}

int btrfs_free_tree_block(struct btrfs_trans_handle *trans,
                          u64 root_id,
                          struct extent_buffer *buf,
                          u64 parent, int last_ref)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_block_group *bg;
        int ret;

        if (root_id != BTRFS_TREE_LOG_OBJECTID) {
                struct btrfs_ref generic_ref = {
                        .action = BTRFS_DROP_DELAYED_REF,
                        .bytenr = buf->start,
                        .num_bytes = buf->len,
                        .parent = parent,
                        .owning_root = btrfs_header_owner(buf),
                        .ref_root = root_id,
                };

                /*
                 * Assert that the extent buffer is not cleared due to
                 * EXTENT_BUFFER_ZONED_ZEROOUT. Please refer
                 * btrfs_clear_buffer_dirty() and btree_csum_one_bio() for
                 * detail.
                 */
                ASSERT(btrfs_header_bytenr(buf) != 0);

                btrfs_init_tree_ref(&generic_ref, btrfs_header_level(buf), 0, false);
                btrfs_ref_tree_mod(fs_info, &generic_ref);
                ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL);
                if (ret < 0)
                        return ret;
        }

        if (!last_ref)
                return 0;

        if (btrfs_header_generation(buf) != trans->transid)
                goto out;

        if (root_id != BTRFS_TREE_LOG_OBJECTID) {
                ret = check_ref_cleanup(trans, buf->start);
                if (!ret)
                        goto out;
        }

        bg = btrfs_lookup_block_group(fs_info, buf->start);

        if (btrfs_header_flag(buf, BTRFS_HEADER_FLAG_WRITTEN)) {
                pin_down_extent(trans, bg, buf->start, buf->len, 1);
                btrfs_put_block_group(bg);
                goto out;
        }

        /*
         * If there are tree mod log users we may have recorded mod log
         * operations for this node.  If we re-allocate this node we
         * could replay operations on this node that happened when it
         * existed in a completely different root.  For example if it
         * was part of root A, then was reallocated to root B, and we
         * are doing a btrfs_old_search_slot(root b), we could replay
         * operations that happened when the block was part of root A,
         * giving us an inconsistent view of the btree.
         *
         * We are safe from races here because at this point no other
         * node or root points to this extent buffer, so if after this
         * check a new tree mod log user joins we will not have an
         * existing log of operations on this node that we have to
         * contend with.
         */

        if (test_bit(BTRFS_FS_TREE_MOD_LOG_USERS, &fs_info->flags)
                     || btrfs_is_zoned(fs_info)) {
                pin_down_extent(trans, bg, buf->start, buf->len, 1);
                btrfs_put_block_group(bg);
                goto out;
        }

        WARN_ON(test_bit(EXTENT_BUFFER_DIRTY, &buf->bflags));

        btrfs_add_free_space(bg, buf->start, buf->len);
        btrfs_free_reserved_bytes(bg, buf->len, 0);
        btrfs_put_block_group(bg);
        trace_btrfs_reserved_extent_free(fs_info, buf->start, buf->len);

out:

        /*
         * Deleting the buffer, clear the corrupt flag since it doesn't
         * matter anymore.
         */
        clear_bit(EXTENT_BUFFER_CORRUPT, &buf->bflags);
        return 0;
}

/* Can return -ENOMEM */
int btrfs_free_extent(struct btrfs_trans_handle *trans, struct btrfs_ref *ref)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        int ret;

        if (btrfs_is_testing(fs_info))
                return 0;

        /*
         * tree log blocks never actually go into the extent allocation
         * tree, just update pinning info and exit early.
         */
        if (ref->ref_root == BTRFS_TREE_LOG_OBJECTID) {
                btrfs_pin_extent(trans, ref->bytenr, ref->num_bytes, 1);
                ret = 0;
        } else if (ref->type == BTRFS_REF_METADATA) {
                ret = btrfs_add_delayed_tree_ref(trans, ref, NULL);
        } else {
                ret = btrfs_add_delayed_data_ref(trans, ref, 0);
        }

        if (ref->ref_root != BTRFS_TREE_LOG_OBJECTID)
                btrfs_ref_tree_mod(fs_info, ref);

        return ret;
}

enum btrfs_loop_type {
        /*
         * Start caching block groups but do not wait for progress or for them
         * to be done.
         */
        LOOP_CACHING_NOWAIT,

        /*
         * Wait for the block group free_space >= the space we're waiting for if
         * the block group isn't cached.
         */
        LOOP_CACHING_WAIT,

        /*
         * Allow allocations to happen from block groups that do not yet have a
         * size classification.
         */
        LOOP_UNSET_SIZE_CLASS,

        /*
         * Allocate a chunk and then retry the allocation.
         */
        LOOP_ALLOC_CHUNK,

        /*
         * Ignore the size class restrictions for this allocation.
         */
        LOOP_WRONG_SIZE_CLASS,

        /*
         * Ignore the empty size, only try to allocate the number of bytes
         * needed for this allocation.
         */
        LOOP_NO_EMPTY_SIZE,
};

static inline void
btrfs_lock_block_group(struct btrfs_block_group *cache,
                       int delalloc)
{
        if (delalloc)
                down_read(&cache->data_rwsem);
}

static inline void btrfs_grab_block_group(struct btrfs_block_group *cache,
                       int delalloc)
{
        btrfs_get_block_group(cache);
        if (delalloc)
                down_read(&cache->data_rwsem);
}

static struct btrfs_block_group *btrfs_lock_cluster(
                   struct btrfs_block_group *block_group,
                   struct btrfs_free_cluster *cluster,
                   int delalloc)
        __acquires(&cluster->refill_lock)
{
        struct btrfs_block_group *used_bg = NULL;

        spin_lock(&cluster->refill_lock);
        while (1) {
                used_bg = cluster->block_group;
                if (!used_bg)
                        return NULL;

                if (used_bg == block_group)
                        return used_bg;

                btrfs_get_block_group(used_bg);

                if (!delalloc)
                        return used_bg;

                if (down_read_trylock(&used_bg->data_rwsem))
                        return used_bg;

                spin_unlock(&cluster->refill_lock);

                /* We should only have one-level nested. */
                down_read_nested(&used_bg->data_rwsem, SINGLE_DEPTH_NESTING);

                spin_lock(&cluster->refill_lock);
                if (used_bg == cluster->block_group)
                        return used_bg;

                up_read(&used_bg->data_rwsem);
                btrfs_put_block_group(used_bg);
        }
}

static inline void
btrfs_release_block_group(struct btrfs_block_group *cache,
                         int delalloc)
{
        if (delalloc)
                up_read(&cache->data_rwsem);
        btrfs_put_block_group(cache);
}

/*
 * Helper function for find_free_extent().
 *
 * Return -ENOENT to inform caller that we need fallback to unclustered mode.
 * Return >0 to inform caller that we find nothing
 * Return 0 means we have found a location and set ffe_ctl->found_offset.
 */
static int find_free_extent_clustered(struct btrfs_block_group *bg,
                                      struct find_free_extent_ctl *ffe_ctl,
                                      struct btrfs_block_group **cluster_bg_ret)
{
        struct btrfs_block_group *cluster_bg;
        struct btrfs_free_cluster *last_ptr = ffe_ctl->last_ptr;
        u64 aligned_cluster;
        u64 offset;
        int ret;

        cluster_bg = btrfs_lock_cluster(bg, last_ptr, ffe_ctl->delalloc);
        if (!cluster_bg)
                goto refill_cluster;
        if (cluster_bg != bg && (cluster_bg->ro ||
            !block_group_bits(cluster_bg, ffe_ctl->flags)))
                goto release_cluster;

        offset = btrfs_alloc_from_cluster(cluster_bg, last_ptr,
                        ffe_ctl->num_bytes, cluster_bg->start,
                        &ffe_ctl->max_extent_size);
        if (offset) {
                /* We have a block, we're done */
                spin_unlock(&last_ptr->refill_lock);
                trace_btrfs_reserve_extent_cluster(cluster_bg, ffe_ctl);
                *cluster_bg_ret = cluster_bg;
                ffe_ctl->found_offset = offset;
                return 0;
        }
        WARN_ON(last_ptr->block_group != cluster_bg);

release_cluster:
        /*
         * If we are on LOOP_NO_EMPTY_SIZE, we can't set up a new clusters, so
         * lets just skip it and let the allocator find whatever block it can
         * find. If we reach this point, we will have tried the cluster
         * allocator plenty of times and not have found anything, so we are
         * likely way too fragmented for the clustering stuff to find anything.
         *
         * However, if the cluster is taken from the current block group,
         * release the cluster first, so that we stand a better chance of
         * succeeding in the unclustered allocation.
         */
        if (ffe_ctl->loop >= LOOP_NO_EMPTY_SIZE && cluster_bg != bg) {
                spin_unlock(&last_ptr->refill_lock);
                btrfs_release_block_group(cluster_bg, ffe_ctl->delalloc);
                return -ENOENT;
        }

        /* This cluster didn't work out, free it and start over */
        btrfs_return_cluster_to_free_space(NULL, last_ptr);

        if (cluster_bg != bg)
                btrfs_release_block_group(cluster_bg, ffe_ctl->delalloc);

refill_cluster:
        if (ffe_ctl->loop >= LOOP_NO_EMPTY_SIZE) {
                spin_unlock(&last_ptr->refill_lock);
                return -ENOENT;
        }

        aligned_cluster = max_t(u64,
                        ffe_ctl->empty_cluster + ffe_ctl->empty_size,
                        bg->full_stripe_len);
        ret = btrfs_find_space_cluster(bg, last_ptr, ffe_ctl->search_start,
                        ffe_ctl->num_bytes, aligned_cluster);
        if (ret == 0) {
                /* Now pull our allocation out of this cluster */
                offset = btrfs_alloc_from_cluster(bg, last_ptr,
                                ffe_ctl->num_bytes, ffe_ctl->search_start,
                                &ffe_ctl->max_extent_size);
                if (offset) {
                        /* We found one, proceed */
                        spin_unlock(&last_ptr->refill_lock);
                        ffe_ctl->found_offset = offset;
                        trace_btrfs_reserve_extent_cluster(bg, ffe_ctl);
                        return 0;
                }
        }
        /*
         * At this point we either didn't find a cluster or we weren't able to
         * allocate a block from our cluster.  Free the cluster we've been
         * trying to use, and go to the next block group.
         */
        btrfs_return_cluster_to_free_space(NULL, last_ptr);
        spin_unlock(&last_ptr->refill_lock);
        return 1;
}

/*
 * Return >0 to inform caller that we find nothing
 * Return 0 when we found an free extent and set ffe_ctrl->found_offset
 */
static int find_free_extent_unclustered(struct btrfs_block_group *bg,
                                        struct find_free_extent_ctl *ffe_ctl)
{
        struct btrfs_free_cluster *last_ptr = ffe_ctl->last_ptr;
        u64 offset;

        /*
         * We are doing an unclustered allocation, set the fragmented flag so
         * we don't bother trying to setup a cluster again until we get more
         * space.
         */
        if (unlikely(last_ptr)) {
                spin_lock(&last_ptr->lock);
                last_ptr->fragmented = 1;
                spin_unlock(&last_ptr->lock);
        }
        if (ffe_ctl->cached) {
                struct btrfs_free_space_ctl *free_space_ctl;

                free_space_ctl = bg->free_space_ctl;
                spin_lock(&free_space_ctl->tree_lock);
                if (free_space_ctl->free_space <
                    ffe_ctl->num_bytes + ffe_ctl->empty_cluster +
                    ffe_ctl->empty_size) {
                        ffe_ctl->total_free_space = max_t(u64,
                                        ffe_ctl->total_free_space,
                                        free_space_ctl->free_space);
                        spin_unlock(&free_space_ctl->tree_lock);
                        return 1;
                }
                spin_unlock(&free_space_ctl->tree_lock);
        }

        offset = btrfs_find_space_for_alloc(bg, ffe_ctl->search_start,
                        ffe_ctl->num_bytes, ffe_ctl->empty_size,
                        &ffe_ctl->max_extent_size);
        if (!offset)
                return 1;
        ffe_ctl->found_offset = offset;
        return 0;
}

static int do_allocation_clustered(struct btrfs_block_group *block_group,
                                   struct find_free_extent_ctl *ffe_ctl,
                                   struct btrfs_block_group **bg_ret)
{
        int ret;

        /* We want to try and use the cluster allocator, so lets look there */
        if (ffe_ctl->last_ptr && ffe_ctl->use_cluster) {
                ret = find_free_extent_clustered(block_group, ffe_ctl, bg_ret);
                if (ret >= 0)
                        return ret;
                /* ret == -ENOENT case falls through */
        }

        return find_free_extent_unclustered(block_group, ffe_ctl);
}

/*
 * Tree-log block group locking
 * ============================
 *
 * fs_info::treelog_bg_lock protects the fs_info::treelog_bg which
 * indicates the starting address of a block group, which is reserved only
 * for tree-log metadata.
 *
 * Lock nesting
 * ============
 *
 * space_info::lock
 *   block_group::lock
 *     fs_info::treelog_bg_lock
 */

/*
 * Simple allocator for sequential-only block group. It only allows sequential
 * allocation. No need to play with trees. This function also reserves the
 * bytes as in btrfs_add_reserved_bytes.
 */
static int do_allocation_zoned(struct btrfs_block_group *block_group,
                               struct find_free_extent_ctl *ffe_ctl,
                               struct btrfs_block_group **bg_ret)
{
        struct btrfs_fs_info *fs_info = block_group->fs_info;
        struct btrfs_space_info *space_info = block_group->space_info;
        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
        u64 start = block_group->start;
        u64 num_bytes = ffe_ctl->num_bytes;
        u64 avail;
        u64 bytenr = block_group->start;
        u64 log_bytenr;
        u64 data_reloc_bytenr;
        int ret = 0;
        bool skip = false;

        ASSERT(btrfs_is_zoned(block_group->fs_info));

        /*
         * Do not allow non-tree-log blocks in the dedicated tree-log block
         * group, and vice versa.
         */
        spin_lock(&fs_info->treelog_bg_lock);
        log_bytenr = fs_info->treelog_bg;
        if (log_bytenr && ((ffe_ctl->for_treelog && bytenr != log_bytenr) ||
                           (!ffe_ctl->for_treelog && bytenr == log_bytenr)))
                skip = true;
        spin_unlock(&fs_info->treelog_bg_lock);
        if (skip)
                return 1;

        /*
         * Do not allow non-relocation blocks in the dedicated relocation block
         * group, and vice versa.
         */
        spin_lock(&fs_info->relocation_bg_lock);
        data_reloc_bytenr = fs_info->data_reloc_bg;
        if (data_reloc_bytenr &&
            ((ffe_ctl->for_data_reloc && bytenr != data_reloc_bytenr) ||
             (!ffe_ctl->for_data_reloc && bytenr == data_reloc_bytenr)))
                skip = true;
        spin_unlock(&fs_info->relocation_bg_lock);
        if (skip)
                return 1;

        /* Check RO and no space case before trying to activate it */
        spin_lock(&block_group->lock);
        if (block_group->ro || btrfs_zoned_bg_is_full(block_group)) {
                ret = 1;
                /*
                 * May need to clear fs_info->{treelog,data_reloc}_bg.
                 * Return the error after taking the locks.
                 */
        }
        spin_unlock(&block_group->lock);

        /* Metadata block group is activated at write time. */
        if (!ret && (block_group->flags & BTRFS_BLOCK_GROUP_DATA) &&
            !btrfs_zone_activate(block_group)) {
                ret = 1;
                /*
                 * May need to clear fs_info->{treelog,data_reloc}_bg.
                 * Return the error after taking the locks.
                 */
        }

        spin_lock(&space_info->lock);
        spin_lock(&block_group->lock);
        spin_lock(&fs_info->treelog_bg_lock);
        spin_lock(&fs_info->relocation_bg_lock);

        if (ret)
                goto out;

        ASSERT(!ffe_ctl->for_treelog ||
               block_group->start == fs_info->treelog_bg ||
               fs_info->treelog_bg == 0);
        ASSERT(!ffe_ctl->for_data_reloc ||
               block_group->start == fs_info->data_reloc_bg ||
               fs_info->data_reloc_bg == 0);

        if (block_group->ro ||
            (!ffe_ctl->for_data_reloc &&
             test_bit(BLOCK_GROUP_FLAG_ZONED_DATA_RELOC, &block_group->runtime_flags))) {
                ret = 1;
                goto out;
        }

        /*
         * Do not allow currently using block group to be tree-log dedicated
         * block group.
         */
        if (ffe_ctl->for_treelog && !fs_info->treelog_bg &&
            (block_group->used || block_group->reserved)) {
                ret = 1;
                goto out;
        }

        /*
         * Do not allow currently used block group to be the data relocation
         * dedicated block group.
         */
        if (ffe_ctl->for_data_reloc && !fs_info->data_reloc_bg &&
            (block_group->used || block_group->reserved)) {
                ret = 1;
                goto out;
        }

        WARN_ON_ONCE(block_group->alloc_offset > block_group->zone_capacity);
        avail = block_group->zone_capacity - block_group->alloc_offset;
        if (avail < num_bytes) {
                if (ffe_ctl->max_extent_size < avail) {
                        /*
                         * With sequential allocator, free space is always
                         * contiguous
                         */
                        ffe_ctl->max_extent_size = avail;
                        ffe_ctl->total_free_space = avail;
                }
                ret = 1;
                goto out;
        }

        if (ffe_ctl->for_treelog && !fs_info->treelog_bg)
                fs_info->treelog_bg = block_group->start;

        if (ffe_ctl->for_data_reloc) {
                if (!fs_info->data_reloc_bg)
                        fs_info->data_reloc_bg = block_group->start;
                /*
                 * Do not allow allocations from this block group, unless it is
                 * for data relocation. Compared to increasing the ->ro, setting
                 * the ->zoned_data_reloc_ongoing flag still allows nocow
                 * writers to come in. See btrfs_inc_nocow_writers().
                 *
                 * We need to disable an allocation to avoid an allocation of
                 * regular (non-relocation data) extent. With mix of relocation
                 * extents and regular extents, we can dispatch WRITE commands
                 * (for relocation extents) and ZONE APPEND commands (for
                 * regular extents) at the same time to the same zone, which
                 * easily break the write pointer.
                 *
                 * Also, this flag avoids this block group to be zone finished.
                 */
                set_bit(BLOCK_GROUP_FLAG_ZONED_DATA_RELOC, &block_group->runtime_flags);
        }

        ffe_ctl->found_offset = start + block_group->alloc_offset;
        block_group->alloc_offset += num_bytes;
        spin_lock(&ctl->tree_lock);
        ctl->free_space -= num_bytes;
        spin_unlock(&ctl->tree_lock);

        /*
         * We do not check if found_offset is aligned to stripesize. The
         * address is anyway rewritten when using zone append writing.
         */

        ffe_ctl->search_start = ffe_ctl->found_offset;

out:
        if (ret && ffe_ctl->for_treelog)
                fs_info->treelog_bg = 0;
        if (ret && ffe_ctl->for_data_reloc)
                fs_info->data_reloc_bg = 0;
        spin_unlock(&fs_info->relocation_bg_lock);
        spin_unlock(&fs_info->treelog_bg_lock);
        spin_unlock(&block_group->lock);
        spin_unlock(&space_info->lock);
        return ret;
}

static int do_allocation(struct btrfs_block_group *block_group,
                         struct find_free_extent_ctl *ffe_ctl,
                         struct btrfs_block_group **bg_ret)
{
        switch (ffe_ctl->policy) {
        case BTRFS_EXTENT_ALLOC_CLUSTERED:
                return do_allocation_clustered(block_group, ffe_ctl, bg_ret);
        case BTRFS_EXTENT_ALLOC_ZONED:
                return do_allocation_zoned(block_group, ffe_ctl, bg_ret);
        default:
                BUG();
        }
}

static void release_block_group(struct btrfs_block_group *block_group,
                                struct find_free_extent_ctl *ffe_ctl,
                                int delalloc)
{
        switch (ffe_ctl->policy) {
        case BTRFS_EXTENT_ALLOC_CLUSTERED:
                ffe_ctl->retry_uncached = false;
                break;
        case BTRFS_EXTENT_ALLOC_ZONED:
                /* Nothing to do */
                break;
        default:
                BUG();
        }

        BUG_ON(btrfs_bg_flags_to_raid_index(block_group->flags) !=
               ffe_ctl->index);
        btrfs_release_block_group(block_group, delalloc);
}

static void found_extent_clustered(struct find_free_extent_ctl *ffe_ctl,
                                   struct btrfs_key *ins)
{
        struct btrfs_free_cluster *last_ptr = ffe_ctl->last_ptr;

        if (!ffe_ctl->use_cluster && last_ptr) {
                spin_lock(&last_ptr->lock);
                last_ptr->window_start = ins->objectid;
                spin_unlock(&last_ptr->lock);
        }
}

static void found_extent(struct find_free_extent_ctl *ffe_ctl,
                         struct btrfs_key *ins)
{
        switch (ffe_ctl->policy) {
        case BTRFS_EXTENT_ALLOC_CLUSTERED:
                found_extent_clustered(ffe_ctl, ins);
                break;
        case BTRFS_EXTENT_ALLOC_ZONED:
                /* Nothing to do */
                break;
        default:
                BUG();
        }
}

static int can_allocate_chunk_zoned(struct btrfs_fs_info *fs_info,
                                    struct find_free_extent_ctl *ffe_ctl)
{
        /* Block group's activeness is not a requirement for METADATA block groups. */
        if (!(ffe_ctl->flags & BTRFS_BLOCK_GROUP_DATA))
                return 0;

        /* If we can activate new zone, just allocate a chunk and use it */
        if (btrfs_can_activate_zone(fs_info->fs_devices, ffe_ctl->flags))
                return 0;

        /*
         * We already reached the max active zones. Try to finish one block
         * group to make a room for a new block group. This is only possible
         * for a data block group because btrfs_zone_finish() may need to wait
         * for a running transaction which can cause a deadlock for metadata
         * allocation.
         */
        if (ffe_ctl->flags & BTRFS_BLOCK_GROUP_DATA) {
                int ret = btrfs_zone_finish_one_bg(fs_info);

                if (ret == 1)
                        return 0;
                else if (ret < 0)
                        return ret;
        }

        /*
         * If we have enough free space left in an already active block group
         * and we can't activate any other zone now, do not allow allocating a
         * new chunk and let find_free_extent() retry with a smaller size.
         */
        if (ffe_ctl->max_extent_size >= ffe_ctl->min_alloc_size)
                return -ENOSPC;

        /*
         * Even min_alloc_size is not left in any block groups. Since we cannot
         * activate a new block group, allocating it may not help. Let's tell a
         * caller to try again and hope it progress something by writing some
         * parts of the region. That is only possible for data block groups,
         * where a part of the region can be written.
         */
        if (ffe_ctl->flags & BTRFS_BLOCK_GROUP_DATA)
                return -EAGAIN;

        /*
         * We cannot activate a new block group and no enough space left in any
         * block groups. So, allocating a new block group may not help. But,
         * there is nothing to do anyway, so let's go with it.
         */
        return 0;
}

static int can_allocate_chunk(struct btrfs_fs_info *fs_info,
                              struct find_free_extent_ctl *ffe_ctl)
{
        switch (ffe_ctl->policy) {
        case BTRFS_EXTENT_ALLOC_CLUSTERED:
                return 0;
        case BTRFS_EXTENT_ALLOC_ZONED:
                return can_allocate_chunk_zoned(fs_info, ffe_ctl);
        default:
                BUG();
        }
}

/*
 * Return >0 means caller needs to re-search for free extent
 * Return 0 means we have the needed free extent.
 * Return <0 means we failed to locate any free extent.
 */
static int find_free_extent_update_loop(struct btrfs_fs_info *fs_info,
                                        struct btrfs_key *ins,
                                        struct find_free_extent_ctl *ffe_ctl,
                                        bool full_search)
{
        struct btrfs_root *root = fs_info->chunk_root;
        int ret;

        if ((ffe_ctl->loop == LOOP_CACHING_NOWAIT) &&
            ffe_ctl->have_caching_bg && !ffe_ctl->orig_have_caching_bg)
                ffe_ctl->orig_have_caching_bg = true;

        if (ins->objectid) {
                found_extent(ffe_ctl, ins);
                return 0;
        }

        if (ffe_ctl->loop >= LOOP_CACHING_WAIT && ffe_ctl->have_caching_bg)
                return 1;

        ffe_ctl->index++;
        if (ffe_ctl->index < BTRFS_NR_RAID_TYPES)
                return 1;

        /* See the comments for btrfs_loop_type for an explanation of the phases. */
        if (ffe_ctl->loop < LOOP_NO_EMPTY_SIZE) {
                ffe_ctl->index = 0;
                /*
                 * We want to skip the LOOP_CACHING_WAIT step if we don't have
                 * any uncached bgs and we've already done a full search
                 * through.
                 */
                if (ffe_ctl->loop == LOOP_CACHING_NOWAIT &&
                    (!ffe_ctl->orig_have_caching_bg && full_search))
                        ffe_ctl->loop++;
                ffe_ctl->loop++;

                if (ffe_ctl->loop == LOOP_ALLOC_CHUNK) {
                        struct btrfs_trans_handle *trans;
                        int exist = 0;

                        /* Check if allocation policy allows to create a new chunk */
                        ret = can_allocate_chunk(fs_info, ffe_ctl);
                        if (ret)
                                return ret;

                        trans = current->journal_info;
                        if (trans)
                                exist = 1;
                        else
                                trans = btrfs_join_transaction(root);

                        if (IS_ERR(trans)) {
                                ret = PTR_ERR(trans);
                                return ret;
                        }

                        ret = btrfs_chunk_alloc(trans, ffe_ctl->flags,
                                                CHUNK_ALLOC_FORCE_FOR_EXTENT);

                        /* Do not bail out on ENOSPC since we can do more. */
                        if (ret == -ENOSPC) {
                                ret = 0;
                                ffe_ctl->loop++;
                        }
                        else if (ret < 0)
                                btrfs_abort_transaction(trans, ret);
                        else
                                ret = 0;
                        if (!exist)
                                btrfs_end_transaction(trans);
                        if (ret)
                                return ret;
                }

                if (ffe_ctl->loop == LOOP_NO_EMPTY_SIZE) {
                        if (ffe_ctl->policy != BTRFS_EXTENT_ALLOC_CLUSTERED)
                                return -ENOSPC;

                        /*
                         * Don't loop again if we already have no empty_size and
                         * no empty_cluster.
                         */
                        if (ffe_ctl->empty_size == 0 &&
                            ffe_ctl->empty_cluster == 0)
                                return -ENOSPC;
                        ffe_ctl->empty_size = 0;
                        ffe_ctl->empty_cluster = 0;
                }
                return 1;
        }
        return -ENOSPC;
}

static bool find_free_extent_check_size_class(struct find_free_extent_ctl *ffe_ctl,
                                              struct btrfs_block_group *bg)
{
        if (ffe_ctl->policy == BTRFS_EXTENT_ALLOC_ZONED)
                return true;
        if (!btrfs_block_group_should_use_size_class(bg))
                return true;
        if (ffe_ctl->loop >= LOOP_WRONG_SIZE_CLASS)
                return true;
        if (ffe_ctl->loop >= LOOP_UNSET_SIZE_CLASS &&
            bg->size_class == BTRFS_BG_SZ_NONE)
                return true;
        return ffe_ctl->size_class == bg->size_class;
}

static int prepare_allocation_clustered(struct btrfs_fs_info *fs_info,
                                        struct find_free_extent_ctl *ffe_ctl,
                                        struct btrfs_space_info *space_info,
                                        struct btrfs_key *ins)
{
        /*
         * If our free space is heavily fragmented we may not be able to make
         * big contiguous allocations, so instead of doing the expensive search
         * for free space, simply return ENOSPC with our max_extent_size so we
         * can go ahead and search for a more manageable chunk.
         *
         * If our max_extent_size is large enough for our allocation simply
         * disable clustering since we will likely not be able to find enough
         * space to create a cluster and induce latency trying.
         */
        if (space_info->max_extent_size) {
                spin_lock(&space_info->lock);
                if (space_info->max_extent_size &&
                    ffe_ctl->num_bytes > space_info->max_extent_size) {
                        ins->offset = space_info->max_extent_size;
                        spin_unlock(&space_info->lock);
                        return -ENOSPC;
                } else if (space_info->max_extent_size) {
                        ffe_ctl->use_cluster = false;
                }
                spin_unlock(&space_info->lock);
        }

        ffe_ctl->last_ptr = fetch_cluster_info(fs_info, space_info,
                                               &ffe_ctl->empty_cluster);
        if (ffe_ctl->last_ptr) {
                struct btrfs_free_cluster *last_ptr = ffe_ctl->last_ptr;

                spin_lock(&last_ptr->lock);
                if (last_ptr->block_group)
                        ffe_ctl->hint_byte = last_ptr->window_start;
                if (last_ptr->fragmented) {
                        /*
                         * We still set window_start so we can keep track of the
                         * last place we found an allocation to try and save
                         * some time.
                         */
                        ffe_ctl->hint_byte = last_ptr->window_start;
                        ffe_ctl->use_cluster = false;
                }
                spin_unlock(&last_ptr->lock);
        }

        return 0;
}

static int prepare_allocation_zoned(struct btrfs_fs_info *fs_info,
                                    struct find_free_extent_ctl *ffe_ctl)
{
        if (ffe_ctl->for_treelog) {
                spin_lock(&fs_info->treelog_bg_lock);
                if (fs_info->treelog_bg)
                        ffe_ctl->hint_byte = fs_info->treelog_bg;
                spin_unlock(&fs_info->treelog_bg_lock);
        } else if (ffe_ctl->for_data_reloc) {
                spin_lock(&fs_info->relocation_bg_lock);
                if (fs_info->data_reloc_bg)
                        ffe_ctl->hint_byte = fs_info->data_reloc_bg;
                spin_unlock(&fs_info->relocation_bg_lock);
        } else if (ffe_ctl->flags & BTRFS_BLOCK_GROUP_DATA) {
                struct btrfs_block_group *block_group;

                spin_lock(&fs_info->zone_active_bgs_lock);
                list_for_each_entry(block_group, &fs_info->zone_active_bgs, active_bg_list) {
                        /*
                         * No lock is OK here because avail is monotinically
                         * decreasing, and this is just a hint.
                         */
                        u64 avail = block_group->zone_capacity - block_group->alloc_offset;

                        if (block_group_bits(block_group, ffe_ctl->flags) &&
                            avail >= ffe_ctl->num_bytes) {
                                ffe_ctl->hint_byte = block_group->start;
                                break;
                        }
                }
                spin_unlock(&fs_info->zone_active_bgs_lock);
        }

        return 0;
}

static int prepare_allocation(struct btrfs_fs_info *fs_info,
                              struct find_free_extent_ctl *ffe_ctl,
                              struct btrfs_space_info *space_info,
                              struct btrfs_key *ins)
{
        switch (ffe_ctl->policy) {
        case BTRFS_EXTENT_ALLOC_CLUSTERED:
                return prepare_allocation_clustered(fs_info, ffe_ctl,
                                                    space_info, ins);
        case BTRFS_EXTENT_ALLOC_ZONED:
                return prepare_allocation_zoned(fs_info, ffe_ctl);
        default:
                BUG();
        }
}

/*
 * walks the btree of allocated extents and find a hole of a given size.
 * The key ins is changed to record the hole:
 * ins->objectid == start position
 * ins->flags = BTRFS_EXTENT_ITEM_KEY
 * ins->offset == the size of the hole.
 * Any available blocks before search_start are skipped.
 *
 * If there is no suitable free space, we will record the max size of
 * the free space extent currently.
 *
 * The overall logic and call chain:
 *
 * find_free_extent()
 * |- Iterate through all block groups
 * |  |- Get a valid block group
 * |  |- Try to do clustered allocation in that block group
 * |  |- Try to do unclustered allocation in that block group
 * |  |- Check if the result is valid
 * |  |  |- If valid, then exit
 * |  |- Jump to next block group
 * |
 * |- Push harder to find free extents
 *    |- If not found, re-iterate all block groups
 */
static noinline int find_free_extent(struct btrfs_root *root,
                                     struct btrfs_key *ins,
                                     struct find_free_extent_ctl *ffe_ctl)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        int ret = 0;
        int cache_block_group_error = 0;
        struct btrfs_block_group *block_group = NULL;
        struct btrfs_space_info *space_info;
        bool full_search = false;

        WARN_ON(ffe_ctl->num_bytes < fs_info->sectorsize);

        ffe_ctl->search_start = 0;
        /* For clustered allocation */
        ffe_ctl->empty_cluster = 0;
        ffe_ctl->last_ptr = NULL;
        ffe_ctl->use_cluster = true;
        ffe_ctl->have_caching_bg = false;
        ffe_ctl->orig_have_caching_bg = false;
        ffe_ctl->index = btrfs_bg_flags_to_raid_index(ffe_ctl->flags);
        ffe_ctl->loop = 0;
        ffe_ctl->retry_uncached = false;
        ffe_ctl->cached = 0;
        ffe_ctl->max_extent_size = 0;
        ffe_ctl->total_free_space = 0;
        ffe_ctl->found_offset = 0;
        ffe_ctl->policy = BTRFS_EXTENT_ALLOC_CLUSTERED;
        ffe_ctl->size_class = btrfs_calc_block_group_size_class(ffe_ctl->num_bytes);

        if (btrfs_is_zoned(fs_info))
                ffe_ctl->policy = BTRFS_EXTENT_ALLOC_ZONED;

        ins->type = BTRFS_EXTENT_ITEM_KEY;
        ins->objectid = 0;
        ins->offset = 0;

        trace_find_free_extent(root, ffe_ctl);

        space_info = btrfs_find_space_info(fs_info, ffe_ctl->flags);
        if (!space_info) {
                btrfs_err(fs_info, "No space info for %llu", ffe_ctl->flags);
                return -ENOSPC;
        }

        ret = prepare_allocation(fs_info, ffe_ctl, space_info, ins);
        if (ret < 0)
                return ret;

        ffe_ctl->search_start = max(ffe_ctl->search_start,
                                    first_logical_byte(fs_info));
        ffe_ctl->search_start = max(ffe_ctl->search_start, ffe_ctl->hint_byte);
        if (ffe_ctl->search_start == ffe_ctl->hint_byte) {
                block_group = btrfs_lookup_block_group(fs_info,
                                                       ffe_ctl->search_start);
                /*
                 * we don't want to use the block group if it doesn't match our
                 * allocation bits, or if its not cached.
                 *
                 * However if we are re-searching with an ideal block group
                 * picked out then we don't care that the block group is cached.
                 */
                if (block_group && block_group_bits(block_group, ffe_ctl->flags) &&
                    block_group->cached != BTRFS_CACHE_NO) {
                        down_read(&space_info->groups_sem);
                        if (list_empty(&block_group->list) ||
                            block_group->ro) {
                                /*
                                 * someone is removing this block group,
                                 * we can't jump into the have_block_group
                                 * target because our list pointers are not
                                 * valid
                                 */
                                btrfs_put_block_group(block_group);
                                up_read(&space_info->groups_sem);
                        } else {
                                ffe_ctl->index = btrfs_bg_flags_to_raid_index(
                                                        block_group->flags);
                                btrfs_lock_block_group(block_group,
                                                       ffe_ctl->delalloc);
                                ffe_ctl->hinted = true;
                                goto have_block_group;
                        }
                } else if (block_group) {
                        btrfs_put_block_group(block_group);
                }
        }
search:
        trace_find_free_extent_search_loop(root, ffe_ctl);
        ffe_ctl->have_caching_bg = false;
        if (ffe_ctl->index == btrfs_bg_flags_to_raid_index(ffe_ctl->flags) ||
            ffe_ctl->index == 0)
                full_search = true;
        down_read(&space_info->groups_sem);
        list_for_each_entry(block_group,
                            &space_info->block_groups[ffe_ctl->index], list) {
                struct btrfs_block_group *bg_ret;

                ffe_ctl->hinted = false;
                /* If the block group is read-only, we can skip it entirely. */
                if (unlikely(block_group->ro)) {
                        if (ffe_ctl->for_treelog)
                                btrfs_clear_treelog_bg(block_group);
                        if (ffe_ctl->for_data_reloc)
                                btrfs_clear_data_reloc_bg(block_group);
                        continue;
                }

                btrfs_grab_block_group(block_group, ffe_ctl->delalloc);
                ffe_ctl->search_start = block_group->start;

                /*
                 * this can happen if we end up cycling through all the
                 * raid types, but we want to make sure we only allocate
                 * for the proper type.
                 */
                if (!block_group_bits(block_group, ffe_ctl->flags)) {
                        u64 extra = BTRFS_BLOCK_GROUP_DUP |
                                BTRFS_BLOCK_GROUP_RAID1_MASK |
                                BTRFS_BLOCK_GROUP_RAID56_MASK |
                                BTRFS_BLOCK_GROUP_RAID10;

                        /*
                         * if they asked for extra copies and this block group
                         * doesn't provide them, bail.  This does allow us to
                         * fill raid0 from raid1.
                         */
                        if ((ffe_ctl->flags & extra) && !(block_group->flags & extra))
                                goto loop;

                        /*
                         * This block group has different flags than we want.
                         * It's possible that we have MIXED_GROUP flag but no
                         * block group is mixed.  Just skip such block group.
                         */
                        btrfs_release_block_group(block_group, ffe_ctl->delalloc);
                        continue;
                }

have_block_group:
                trace_find_free_extent_have_block_group(root, ffe_ctl, block_group);
                ffe_ctl->cached = btrfs_block_group_done(block_group);
                if (unlikely(!ffe_ctl->cached)) {
                        ffe_ctl->have_caching_bg = true;
                        ret = btrfs_cache_block_group(block_group, false);

                        /*
                         * If we get ENOMEM here or something else we want to
                         * try other block groups, because it may not be fatal.
                         * However if we can't find anything else we need to
                         * save our return here so that we return the actual
                         * error that caused problems, not ENOSPC.
                         */
                        if (ret < 0) {
                                if (!cache_block_group_error)
                                        cache_block_group_error = ret;
                                ret = 0;
                                goto loop;
                        }
                        ret = 0;
                }

                if (unlikely(block_group->cached == BTRFS_CACHE_ERROR)) {
                        if (!cache_block_group_error)
                                cache_block_group_error = -EIO;
                        goto loop;
                }

                if (!find_free_extent_check_size_class(ffe_ctl, block_group))
                        goto loop;

                bg_ret = NULL;
                ret = do_allocation(block_group, ffe_ctl, &bg_ret);
                if (ret > 0)
                        goto loop;

                if (bg_ret && bg_ret != block_group) {
                        btrfs_release_block_group(block_group, ffe_ctl->delalloc);
                        block_group = bg_ret;
                }

                /* Checks */
                ffe_ctl->search_start = round_up(ffe_ctl->found_offset,
                                                 fs_info->stripesize);

                /* move on to the next group */
                if (ffe_ctl->search_start + ffe_ctl->num_bytes >
                    block_group->start + block_group->length) {
                        btrfs_add_free_space_unused(block_group,
                                            ffe_ctl->found_offset,
                                            ffe_ctl->num_bytes);
                        goto loop;
                }

                if (ffe_ctl->found_offset < ffe_ctl->search_start)
                        btrfs_add_free_space_unused(block_group,
                                        ffe_ctl->found_offset,
                                        ffe_ctl->search_start - ffe_ctl->found_offset);

                ret = btrfs_add_reserved_bytes(block_group, ffe_ctl->ram_bytes,
                                               ffe_ctl->num_bytes,
                                               ffe_ctl->delalloc,
                                               ffe_ctl->loop >= LOOP_WRONG_SIZE_CLASS);
                if (ret == -EAGAIN) {
                        btrfs_add_free_space_unused(block_group,
                                        ffe_ctl->found_offset,
                                        ffe_ctl->num_bytes);
                        goto loop;
                }
                btrfs_inc_block_group_reservations(block_group);

                /* we are all good, lets return */
                ins->objectid = ffe_ctl->search_start;
                ins->offset = ffe_ctl->num_bytes;

                trace_btrfs_reserve_extent(block_group, ffe_ctl);
                btrfs_release_block_group(block_group, ffe_ctl->delalloc);
                break;
loop:
                if (!ffe_ctl->cached && ffe_ctl->loop > LOOP_CACHING_NOWAIT &&
                    !ffe_ctl->retry_uncached) {
                        ffe_ctl->retry_uncached = true;
                        btrfs_wait_block_group_cache_progress(block_group,
                                                ffe_ctl->num_bytes +
                                                ffe_ctl->empty_cluster +
                                                ffe_ctl->empty_size);
                        goto have_block_group;
                }
                release_block_group(block_group, ffe_ctl, ffe_ctl->delalloc);
                cond_resched();
        }
        up_read(&space_info->groups_sem);

        ret = find_free_extent_update_loop(fs_info, ins, ffe_ctl, full_search);
        if (ret > 0)
                goto search;

        if (ret == -ENOSPC && !cache_block_group_error) {
                /*
                 * Use ffe_ctl->total_free_space as fallback if we can't find
                 * any contiguous hole.
                 */
                if (!ffe_ctl->max_extent_size)
                        ffe_ctl->max_extent_size = ffe_ctl->total_free_space;
                spin_lock(&space_info->lock);
                space_info->max_extent_size = ffe_ctl->max_extent_size;
                spin_unlock(&space_info->lock);
                ins->offset = ffe_ctl->max_extent_size;
        } else if (ret == -ENOSPC) {
                ret = cache_block_group_error;
        }
        return ret;
}

/*
 * Entry point to the extent allocator. Tries to find a hole that is at least
 * as big as @num_bytes.
 *
 * @root           -        The root that will contain this extent
 *
 * @ram_bytes      -        The amount of space in ram that @num_bytes take. This
 *                        is used for accounting purposes. This value differs
 *                        from @num_bytes only in the case of compressed extents.
 *
 * @num_bytes      -        Number of bytes to allocate on-disk.
 *
 * @min_alloc_size -        Indicates the minimum amount of space that the
 *                        allocator should try to satisfy. In some cases
 *                        @num_bytes may be larger than what is required and if
 *                        the filesystem is fragmented then allocation fails.
 *                        However, the presence of @min_alloc_size gives a
 *                        chance to try and satisfy the smaller allocation.
 *
 * @empty_size     -        A hint that you plan on doing more COW. This is the
 *                        size in bytes the allocator should try to find free
 *                        next to the block it returns.  This is just a hint and
 *                        may be ignored by the allocator.
 *
 * @hint_byte      -        Hint to the allocator to start searching above the byte
 *                        address passed. It might be ignored.
 *
 * @ins            -        This key is modified to record the found hole. It will
 *                        have the following values:
 *                        ins->objectid == start position
 *                        ins->flags = BTRFS_EXTENT_ITEM_KEY
 *                        ins->offset == the size of the hole.
 *
 * @is_data        -        Boolean flag indicating whether an extent is
 *                        allocated for data (true) or metadata (false)
 *
 * @delalloc       -        Boolean flag indicating whether this allocation is for
 *                        delalloc or not. If 'true' data_rwsem of block groups
 *                        is going to be acquired.
 *
 *
 * Returns 0 when an allocation succeeded or < 0 when an error occurred. In
 * case -ENOSPC is returned then @ins->offset will contain the size of the
 * largest available hole the allocator managed to find.
 */
int btrfs_reserve_extent(struct btrfs_root *root, u64 ram_bytes,
                         u64 num_bytes, u64 min_alloc_size,
                         u64 empty_size, u64 hint_byte,
                         struct btrfs_key *ins, int is_data, int delalloc)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        struct find_free_extent_ctl ffe_ctl = {};
        bool final_tried = num_bytes == min_alloc_size;
        u64 flags;
        int ret;
        bool for_treelog = (btrfs_root_id(root) == BTRFS_TREE_LOG_OBJECTID);
        bool for_data_reloc = (btrfs_is_data_reloc_root(root) && is_data);

        flags = get_alloc_profile_by_root(root, is_data);
again:
        WARN_ON(num_bytes < fs_info->sectorsize);

        ffe_ctl.ram_bytes = ram_bytes;
        ffe_ctl.num_bytes = num_bytes;
        ffe_ctl.min_alloc_size = min_alloc_size;
        ffe_ctl.empty_size = empty_size;
        ffe_ctl.flags = flags;
        ffe_ctl.delalloc = delalloc;
        ffe_ctl.hint_byte = hint_byte;
        ffe_ctl.for_treelog = for_treelog;
        ffe_ctl.for_data_reloc = for_data_reloc;

        ret = find_free_extent(root, ins, &ffe_ctl);
        if (!ret && !is_data) {
                btrfs_dec_block_group_reservations(fs_info, ins->objectid);
        } else if (ret == -ENOSPC) {
                if (!final_tried && ins->offset) {
                        num_bytes = min(num_bytes >> 1, ins->offset);
                        num_bytes = round_down(num_bytes,
                                               fs_info->sectorsize);
                        num_bytes = max(num_bytes, min_alloc_size);
                        ram_bytes = num_bytes;
                        if (num_bytes == min_alloc_size)
                                final_tried = true;
                        goto again;
                } else if (btrfs_test_opt(fs_info, ENOSPC_DEBUG)) {
                        struct btrfs_space_info *sinfo;

                        sinfo = btrfs_find_space_info(fs_info, flags);
                        btrfs_err(fs_info,
        "allocation failed flags %llu, wanted %llu tree-log %d, relocation: %d",
                                  flags, num_bytes, for_treelog, for_data_reloc);
                        if (sinfo)
                                btrfs_dump_space_info(fs_info, sinfo,
                                                      num_bytes, 1);
                }
        }

        return ret;
}

int btrfs_free_reserved_extent(struct btrfs_fs_info *fs_info,
                               u64 start, u64 len, int delalloc)
{
        struct btrfs_block_group *cache;

        cache = btrfs_lookup_block_group(fs_info, start);
        if (!cache) {
                btrfs_err(fs_info, "Unable to find block group for %llu",
                          start);
                return -ENOSPC;
        }

        btrfs_add_free_space(cache, start, len);
        btrfs_free_reserved_bytes(cache, len, delalloc);
        trace_btrfs_reserved_extent_free(fs_info, start, len);

        btrfs_put_block_group(cache);
        return 0;
}

int btrfs_pin_reserved_extent(struct btrfs_trans_handle *trans,
                              const struct extent_buffer *eb)
{
        struct btrfs_block_group *cache;
        int ret = 0;

        cache = btrfs_lookup_block_group(trans->fs_info, eb->start);
        if (!cache) {
                btrfs_err(trans->fs_info, "unable to find block group for %llu",
                          eb->start);
                return -ENOSPC;
        }

        ret = pin_down_extent(trans, cache, eb->start, eb->len, 1);
        btrfs_put_block_group(cache);
        return ret;
}

static int alloc_reserved_extent(struct btrfs_trans_handle *trans, u64 bytenr,
                                 u64 num_bytes)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        int ret;

        ret = remove_from_free_space_tree(trans, bytenr, num_bytes);
        if (ret)
                return ret;

        ret = btrfs_update_block_group(trans, bytenr, num_bytes, true);
        if (ret) {
                ASSERT(!ret);
                btrfs_err(fs_info, "update block group failed for %llu %llu",
                          bytenr, num_bytes);
                return ret;
        }

        trace_btrfs_reserved_extent_alloc(fs_info, bytenr, num_bytes);
        return 0;
}

static int alloc_reserved_file_extent(struct btrfs_trans_handle *trans,
                                      u64 parent, u64 root_objectid,
                                      u64 flags, u64 owner, u64 offset,
                                      struct btrfs_key *ins, int ref_mod, u64 oref_root)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_root *extent_root;
        int ret;
        struct btrfs_extent_item *extent_item;
        struct btrfs_extent_owner_ref *oref;
        struct btrfs_extent_inline_ref *iref;
        struct btrfs_path *path;
        struct extent_buffer *leaf;
        int type;
        u32 size;
        const bool simple_quota = (btrfs_qgroup_mode(fs_info) == BTRFS_QGROUP_MODE_SIMPLE);

        if (parent > 0)
                type = BTRFS_SHARED_DATA_REF_KEY;
        else
                type = BTRFS_EXTENT_DATA_REF_KEY;

        size = sizeof(*extent_item);
        if (simple_quota)
                size += btrfs_extent_inline_ref_size(BTRFS_EXTENT_OWNER_REF_KEY);
        size += btrfs_extent_inline_ref_size(type);

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        extent_root = btrfs_extent_root(fs_info, ins->objectid);
        ret = btrfs_insert_empty_item(trans, extent_root, path, ins, size);
        if (ret) {
                btrfs_free_path(path);
                return ret;
        }

        leaf = path->nodes[0];
        extent_item = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_extent_item);
        btrfs_set_extent_refs(leaf, extent_item, ref_mod);
        btrfs_set_extent_generation(leaf, extent_item, trans->transid);
        btrfs_set_extent_flags(leaf, extent_item,
                               flags | BTRFS_EXTENT_FLAG_DATA);

        iref = (struct btrfs_extent_inline_ref *)(extent_item + 1);
        if (simple_quota) {
                btrfs_set_extent_inline_ref_type(leaf, iref, BTRFS_EXTENT_OWNER_REF_KEY);
                oref = (struct btrfs_extent_owner_ref *)(&iref->offset);
                btrfs_set_extent_owner_ref_root_id(leaf, oref, oref_root);
                iref = (struct btrfs_extent_inline_ref *)(oref + 1);
        }
        btrfs_set_extent_inline_ref_type(leaf, iref, type);

        if (parent > 0) {
                struct btrfs_shared_data_ref *ref;
                ref = (struct btrfs_shared_data_ref *)(iref + 1);
                btrfs_set_extent_inline_ref_offset(leaf, iref, parent);
                btrfs_set_shared_data_ref_count(leaf, ref, ref_mod);
        } else {
                struct btrfs_extent_data_ref *ref;
                ref = (struct btrfs_extent_data_ref *)(&iref->offset);
                btrfs_set_extent_data_ref_root(leaf, ref, root_objectid);
                btrfs_set_extent_data_ref_objectid(leaf, ref, owner);
                btrfs_set_extent_data_ref_offset(leaf, ref, offset);
                btrfs_set_extent_data_ref_count(leaf, ref, ref_mod);
        }

        btrfs_mark_buffer_dirty(trans, path->nodes[0]);
        btrfs_free_path(path);

        return alloc_reserved_extent(trans, ins->objectid, ins->offset);
}

static int alloc_reserved_tree_block(struct btrfs_trans_handle *trans,
                                     struct btrfs_delayed_ref_node *node,
                                     struct btrfs_delayed_extent_op *extent_op)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        struct btrfs_root *extent_root;
        int ret;
        struct btrfs_extent_item *extent_item;
        struct btrfs_key extent_key;
        struct btrfs_tree_block_info *block_info;
        struct btrfs_extent_inline_ref *iref;
        struct btrfs_path *path;
        struct extent_buffer *leaf;
        u32 size = sizeof(*extent_item) + sizeof(*iref);
        const u64 flags = (extent_op ? extent_op->flags_to_set : 0);
        /* The owner of a tree block is the level. */
        int level = btrfs_delayed_ref_owner(node);
        bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);

        extent_key.objectid = node->bytenr;
        if (skinny_metadata) {
                /* The owner of a tree block is the level. */
                extent_key.offset = level;
                extent_key.type = BTRFS_METADATA_ITEM_KEY;
        } else {
                extent_key.offset = node->num_bytes;
                extent_key.type = BTRFS_EXTENT_ITEM_KEY;
                size += sizeof(*block_info);
        }

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        extent_root = btrfs_extent_root(fs_info, extent_key.objectid);
        ret = btrfs_insert_empty_item(trans, extent_root, path, &extent_key,
                                      size);
        if (ret) {
                btrfs_free_path(path);
                return ret;
        }

        leaf = path->nodes[0];
        extent_item = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_extent_item);
        btrfs_set_extent_refs(leaf, extent_item, 1);
        btrfs_set_extent_generation(leaf, extent_item, trans->transid);
        btrfs_set_extent_flags(leaf, extent_item,
                               flags | BTRFS_EXTENT_FLAG_TREE_BLOCK);

        if (skinny_metadata) {
                iref = (struct btrfs_extent_inline_ref *)(extent_item + 1);
        } else {
                block_info = (struct btrfs_tree_block_info *)(extent_item + 1);
                btrfs_set_tree_block_key(leaf, block_info, &extent_op->key);
                btrfs_set_tree_block_level(leaf, block_info, level);
                iref = (struct btrfs_extent_inline_ref *)(block_info + 1);
        }

        if (node->type == BTRFS_SHARED_BLOCK_REF_KEY) {
                btrfs_set_extent_inline_ref_type(leaf, iref,
                                                 BTRFS_SHARED_BLOCK_REF_KEY);
                btrfs_set_extent_inline_ref_offset(leaf, iref, node->parent);
        } else {
                btrfs_set_extent_inline_ref_type(leaf, iref,
                                                 BTRFS_TREE_BLOCK_REF_KEY);
                btrfs_set_extent_inline_ref_offset(leaf, iref, node->ref_root);
        }

        btrfs_mark_buffer_dirty(trans, leaf);
        btrfs_free_path(path);

        return alloc_reserved_extent(trans, node->bytenr, fs_info->nodesize);
}

int btrfs_alloc_reserved_file_extent(struct btrfs_trans_handle *trans,
                                     struct btrfs_root *root, u64 owner,
                                     u64 offset, u64 ram_bytes,
                                     struct btrfs_key *ins)
{
        struct btrfs_ref generic_ref = {
                .action = BTRFS_ADD_DELAYED_EXTENT,
                .bytenr = ins->objectid,
                .num_bytes = ins->offset,
                .owning_root = btrfs_root_id(root),
                .ref_root = btrfs_root_id(root),
        };

        ASSERT(generic_ref.ref_root != BTRFS_TREE_LOG_OBJECTID);

        if (btrfs_is_data_reloc_root(root) && is_fstree(root->relocation_src_root))
                generic_ref.owning_root = root->relocation_src_root;

        btrfs_init_data_ref(&generic_ref, owner, offset, 0, false);
        btrfs_ref_tree_mod(root->fs_info, &generic_ref);

        return btrfs_add_delayed_data_ref(trans, &generic_ref, ram_bytes);
}

/*
 * this is used by the tree logging recovery code.  It records that
 * an extent has been allocated and makes sure to clear the free
 * space cache bits as well
 */
int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
                                   u64 root_objectid, u64 owner, u64 offset,
                                   struct btrfs_key *ins)
{
        struct btrfs_fs_info *fs_info = trans->fs_info;
        int ret;
        struct btrfs_block_group *block_group;
        struct btrfs_space_info *space_info;
        struct btrfs_squota_delta delta = {
                .root = root_objectid,
                .num_bytes = ins->offset,
                .generation = trans->transid,
                .is_data = true,
                .is_inc = true,
        };

        /*
         * Mixed block groups will exclude before processing the log so we only
         * need to do the exclude dance if this fs isn't mixed.
         */
        if (!btrfs_fs_incompat(fs_info, MIXED_GROUPS)) {
                ret = __exclude_logged_extent(fs_info, ins->objectid,
                                              ins->offset);
                if (ret)
                        return ret;
        }

        block_group = btrfs_lookup_block_group(fs_info, ins->objectid);
        if (!block_group)
                return -EINVAL;

        space_info = block_group->space_info;
        spin_lock(&space_info->lock);
        spin_lock(&block_group->lock);
        space_info->bytes_reserved += ins->offset;
        block_group->reserved += ins->offset;
        spin_unlock(&block_group->lock);
        spin_unlock(&space_info->lock);

        ret = alloc_reserved_file_extent(trans, 0, root_objectid, 0, owner,
                                         offset, ins, 1, root_objectid);
        if (ret)
                btrfs_pin_extent(trans, ins->objectid, ins->offset, 1);
        ret = btrfs_record_squota_delta(fs_info, &delta);
        btrfs_put_block_group(block_group);
        return ret;
}

#ifdef CONFIG_BTRFS_DEBUG
/*
 * Extra safety check in case the extent tree is corrupted and extent allocator
 * chooses to use a tree block which is already used and locked.
 */
static bool check_eb_lock_owner(const struct extent_buffer *eb)
{
        if (eb->lock_owner == current->pid) {
                btrfs_err_rl(eb->fs_info,
"tree block %llu owner %llu already locked by pid=%d, extent tree corruption detected",
                             eb->start, btrfs_header_owner(eb), current->pid);
                return true;
        }
        return false;
}
#else
static bool check_eb_lock_owner(struct extent_buffer *eb)
{
        return false;
}
#endif

static struct extent_buffer *
btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                      u64 bytenr, int level, u64 owner,
                      enum btrfs_lock_nesting nest)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        struct extent_buffer *buf;
        u64 lockdep_owner = owner;

        buf = btrfs_find_create_tree_block(fs_info, bytenr, owner, level);
        if (IS_ERR(buf))
                return buf;

        if (check_eb_lock_owner(buf)) {
                free_extent_buffer(buf);
                return ERR_PTR(-EUCLEAN);
        }

        /*
         * The reloc trees are just snapshots, so we need them to appear to be
         * just like any other fs tree WRT lockdep.
         *
         * The exception however is in replace_path() in relocation, where we
         * hold the lock on the original fs root and then search for the reloc
         * root.  At that point we need to make sure any reloc root buffers are
         * set to the BTRFS_TREE_RELOC_OBJECTID lockdep class in order to make
         * lockdep happy.
         */
        if (lockdep_owner == BTRFS_TREE_RELOC_OBJECTID &&
            !test_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &root->state))
                lockdep_owner = BTRFS_FS_TREE_OBJECTID;

        /* btrfs_clear_buffer_dirty() accesses generation field. */
        btrfs_set_header_generation(buf, trans->transid);

        /*
         * This needs to stay, because we could allocate a freed block from an
         * old tree into a new tree, so we need to make sure this new block is
         * set to the appropriate level and owner.
         */
        btrfs_set_buffer_lockdep_class(lockdep_owner, buf, level);

        btrfs_tree_lock_nested(buf, nest);
        btrfs_clear_buffer_dirty(trans, buf);
        clear_bit(EXTENT_BUFFER_STALE, &buf->bflags);
        clear_bit(EXTENT_BUFFER_ZONED_ZEROOUT, &buf->bflags);

        set_extent_buffer_uptodate(buf);

        memzero_extent_buffer(buf, 0, sizeof(struct btrfs_header));
        btrfs_set_header_level(buf, level);
        btrfs_set_header_bytenr(buf, buf->start);
        btrfs_set_header_generation(buf, trans->transid);
        btrfs_set_header_backref_rev(buf, BTRFS_MIXED_BACKREF_REV);
        btrfs_set_header_owner(buf, owner);
        write_extent_buffer_fsid(buf, fs_info->fs_devices->metadata_uuid);
        write_extent_buffer_chunk_tree_uuid(buf, fs_info->chunk_tree_uuid);
        if (btrfs_root_id(root) == BTRFS_TREE_LOG_OBJECTID) {
                buf->log_index = root->log_transid % 2;
                /*
                 * we allow two log transactions at a time, use different
                 * EXTENT bit to differentiate dirty pages.
                 */
                if (buf->log_index == 0)
                        set_extent_bit(&root->dirty_log_pages, buf->start,
                                       buf->start + buf->len - 1,
                                       EXTENT_DIRTY, NULL);
                else
                        set_extent_bit(&root->dirty_log_pages, buf->start,
                                       buf->start + buf->len - 1,
                                       EXTENT_NEW, NULL);
        } else {
                buf->log_index = -1;
                set_extent_bit(&trans->transaction->dirty_pages, buf->start,
                               buf->start + buf->len - 1, EXTENT_DIRTY, NULL);
        }
        /* this returns a buffer locked for blocking */
        return buf;
}

/*
 * finds a free extent and does all the dirty work required for allocation
 * returns the tree buffer or an ERR_PTR on error.
 */
struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
                                             struct btrfs_root *root,
                                             u64 parent, u64 root_objectid,
                                             const struct btrfs_disk_key *key,
                                             int level, u64 hint,
                                             u64 empty_size,
                                             u64 reloc_src_root,
                                             enum btrfs_lock_nesting nest)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        struct btrfs_key ins;
        struct btrfs_block_rsv *block_rsv;
        struct extent_buffer *buf;
        u64 flags = 0;
        int ret;
        u32 blocksize = fs_info->nodesize;
        bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);
        u64 owning_root;

#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
        if (btrfs_is_testing(fs_info)) {
                buf = btrfs_init_new_buffer(trans, root, root->alloc_bytenr,
                                            level, root_objectid, nest);
                if (!IS_ERR(buf))
                        root->alloc_bytenr += blocksize;
                return buf;
        }
#endif

        block_rsv = btrfs_use_block_rsv(trans, root, blocksize);
        if (IS_ERR(block_rsv))
                return ERR_CAST(block_rsv);

        ret = btrfs_reserve_extent(root, blocksize, blocksize, blocksize,
                                   empty_size, hint, &ins, 0, 0);
        if (ret)
                goto out_unuse;

        buf = btrfs_init_new_buffer(trans, root, ins.objectid, level,
                                    root_objectid, nest);
        if (IS_ERR(buf)) {
                ret = PTR_ERR(buf);
                goto out_free_reserved;
        }
        owning_root = btrfs_header_owner(buf);

        if (root_objectid == BTRFS_TREE_RELOC_OBJECTID) {
                if (parent == 0)
                        parent = ins.objectid;
                flags |= BTRFS_BLOCK_FLAG_FULL_BACKREF;
                owning_root = reloc_src_root;
        } else
                BUG_ON(parent > 0);

        if (root_objectid != BTRFS_TREE_LOG_OBJECTID) {
                struct btrfs_delayed_extent_op *extent_op;
                struct btrfs_ref generic_ref = {
                        .action = BTRFS_ADD_DELAYED_EXTENT,
                        .bytenr = ins.objectid,
                        .num_bytes = ins.offset,
                        .parent = parent,
                        .owning_root = owning_root,
                        .ref_root = root_objectid,
                };

                if (!skinny_metadata || flags != 0) {
                        extent_op = btrfs_alloc_delayed_extent_op();
                        if (!extent_op) {
                                ret = -ENOMEM;
                                goto out_free_buf;
                        }
                        if (key)
                                memcpy(&extent_op->key, key, sizeof(extent_op->key));
                        else
                                memset(&extent_op->key, 0, sizeof(extent_op->key));
                        extent_op->flags_to_set = flags;
                        extent_op->update_key = (skinny_metadata ? false : true);
                        extent_op->update_flags = (flags != 0);
                } else {
                        extent_op = NULL;
                }

                btrfs_init_tree_ref(&generic_ref, level, btrfs_root_id(root), false);
                btrfs_ref_tree_mod(fs_info, &generic_ref);
                ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, extent_op);
                if (ret) {
                        btrfs_free_delayed_extent_op(extent_op);
                        goto out_free_buf;
                }
        }
        return buf;

out_free_buf:
        btrfs_tree_unlock(buf);
        free_extent_buffer(buf);
out_free_reserved:
        btrfs_free_reserved_extent(fs_info, ins.objectid, ins.offset, 0);
out_unuse:
        btrfs_unuse_block_rsv(fs_info, block_rsv, blocksize);
        return ERR_PTR(ret);
}

struct walk_control {
        u64 refs[BTRFS_MAX_LEVEL];
        u64 flags[BTRFS_MAX_LEVEL];
        struct btrfs_key update_progress;
        struct btrfs_key drop_progress;
        int drop_level;
        int stage;
        int level;
        int shared_level;
        int update_ref;
        int keep_locks;
        int reada_slot;
        int reada_count;
        int restarted;
        /* Indicate that extent info needs to be looked up when walking the tree. */
        int lookup_info;
};

/*
 * This is our normal stage.  We are traversing blocks the current snapshot owns
 * and we are dropping any of our references to any children we are able to, and
 * then freeing the block once we've processed all of the children.
 */
#define DROP_REFERENCE        1

/*
 * We enter this stage when we have to walk into a child block (meaning we can't
 * simply drop our reference to it from our current parent node) and there are
 * more than one reference on it.  If we are the owner of any of the children
 * blocks from the current parent node then we have to do the FULL_BACKREF dance
 * on them in order to drop our normal ref and add the shared ref.
 */
#define UPDATE_BACKREF        2

/*
 * Decide if we need to walk down into this node to adjust the references.
 *
 * @root:        the root we are currently deleting
 * @wc:                the walk control for this deletion
 * @eb:                the parent eb that we're currently visiting
 * @refs:        the number of refs for wc->level - 1
 * @flags:        the flags for wc->level - 1
 * @slot:        the slot in the eb that we're currently checking
 *
 * This is meant to be called when we're evaluating if a node we point to at
 * wc->level should be read and walked into, or if we can simply delete our
 * reference to it.  We return true if we should walk into the node, false if we
 * can skip it.
 *
 * We have assertions in here to make sure this is called correctly.  We assume
 * that sanity checking on the blocks read to this point has been done, so any
 * corrupted file systems must have been caught before calling this function.
 */
static bool visit_node_for_delete(struct btrfs_root *root, struct walk_control *wc,
                                  struct extent_buffer *eb, u64 refs, u64 flags, int slot)
{
        struct btrfs_key key;
        u64 generation;
        int level = wc->level;

        ASSERT(level > 0);
        ASSERT(wc->refs[level - 1] > 0);

        /*
         * The update backref stage we only want to skip if we already have
         * FULL_BACKREF set, otherwise we need to read.
         */
        if (wc->stage == UPDATE_BACKREF) {
                if (level == 1 && flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)
                        return false;
                return true;
        }

        /*
         * We're the last ref on this block, we must walk into it and process
         * any refs it's pointing at.
         */
        if (wc->refs[level - 1] == 1)
                return true;

        /*
         * If we're already FULL_BACKREF then we know we can just drop our
         * current reference.
         */
        if (level == 1 && flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)
                return false;

        /*
         * This block is older than our creation generation, we can drop our
         * reference to it.
         */
        generation = btrfs_node_ptr_generation(eb, slot);
        if (!wc->update_ref || generation <= root->root_key.offset)
                return false;

        /*
         * This block was processed from a previous snapshot deletion run, we
         * can skip it.
         */
        btrfs_node_key_to_cpu(eb, &key, slot);
        if (btrfs_comp_cpu_keys(&key, &wc->update_progress) < 0)
                return false;

        /* All other cases we need to wander into the node. */
        return true;
}

static noinline void reada_walk_down(struct btrfs_trans_handle *trans,
                                     struct btrfs_root *root,
                                     struct walk_control *wc,
                                     struct btrfs_path *path)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        u64 bytenr;
        u64 generation;
        u64 refs;
        u64 flags;
        u32 nritems;
        struct extent_buffer *eb;
        int ret;
        int slot;
        int nread = 0;

        if (path->slots[wc->level] < wc->reada_slot) {
                wc->reada_count = wc->reada_count * 2 / 3;
                wc->reada_count = max(wc->reada_count, 2);
        } else {
                wc->reada_count = wc->reada_count * 3 / 2;
                wc->reada_count = min_t(int, wc->reada_count,
                                        BTRFS_NODEPTRS_PER_BLOCK(fs_info));
        }

        eb = path->nodes[wc->level];
        nritems = btrfs_header_nritems(eb);

        for (slot = path->slots[wc->level]; slot < nritems; slot++) {
                if (nread >= wc->reada_count)
                        break;

                cond_resched();
                bytenr = btrfs_node_blockptr(eb, slot);
                generation = btrfs_node_ptr_generation(eb, slot);

                if (slot == path->slots[wc->level])
                        goto reada;

                if (wc->stage == UPDATE_BACKREF &&
                    generation <= root->root_key.offset)
                        continue;

                /* We don't lock the tree block, it's OK to be racy here */
                ret = btrfs_lookup_extent_info(trans, fs_info, bytenr,
                                               wc->level - 1, 1, &refs,
                                               &flags, NULL);
                /* We don't care about errors in readahead. */
                if (ret < 0)
                        continue;

                /*
                 * This could be racey, it's conceivable that we raced and end
                 * up with a bogus refs count, if that's the case just skip, if
                 * we are actually corrupt we will notice when we look up
                 * everything again with our locks.
                 */
                if (refs == 0)
                        continue;

                /* If we don't need to visit this node don't reada. */
                if (!visit_node_for_delete(root, wc, eb, refs, flags, slot))
                        continue;
reada:
                btrfs_readahead_node_child(eb, slot);
                nread++;
        }
        wc->reada_slot = slot;
}

/*
 * helper to process tree block while walking down the tree.
 *
 * when wc->stage == UPDATE_BACKREF, this function updates
 * back refs for pointers in the block.
 *
 * NOTE: return value 1 means we should stop walking down.
 */
static noinline int walk_down_proc(struct btrfs_trans_handle *trans,
                                   struct btrfs_root *root,
                                   struct btrfs_path *path,
                                   struct walk_control *wc)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        int level = wc->level;
        struct extent_buffer *eb = path->nodes[level];
        u64 flag = BTRFS_BLOCK_FLAG_FULL_BACKREF;
        int ret;

        if (wc->stage == UPDATE_BACKREF && btrfs_header_owner(eb) != btrfs_root_id(root))
                return 1;

        /*
         * when reference count of tree block is 1, it won't increase
         * again. once full backref flag is set, we never clear it.
         */
        if (wc->lookup_info &&
            ((wc->stage == DROP_REFERENCE && wc->refs[level] != 1) ||
             (wc->stage == UPDATE_BACKREF && !(wc->flags[level] & flag)))) {
                ASSERT(path->locks[level]);
                ret = btrfs_lookup_extent_info(trans, fs_info,
                                               eb->start, level, 1,
                                               &wc->refs[level],
                                               &wc->flags[level],
                                               NULL);
                if (ret)
                        return ret;
                if (unlikely(wc->refs[level] == 0)) {
                        btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0",
                                  eb->start);
                        return -EUCLEAN;
                }
        }

        if (wc->stage == DROP_REFERENCE) {
                if (wc->refs[level] > 1)
                        return 1;

                if (path->locks[level] && !wc->keep_locks) {
                        btrfs_tree_unlock_rw(eb, path->locks[level]);
                        path->locks[level] = 0;
                }
                return 0;
        }

        /* wc->stage == UPDATE_BACKREF */
        if (!(wc->flags[level] & flag)) {
                ASSERT(path->locks[level]);
                ret = btrfs_inc_ref(trans, root, eb, 1);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        return ret;
                }
                ret = btrfs_dec_ref(trans, root, eb, 0);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        return ret;
                }
                ret = btrfs_set_disk_extent_flags(trans, eb, flag);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        return ret;
                }
                wc->flags[level] |= flag;
        }

        /*
         * the block is shared by multiple trees, so it's not good to
         * keep the tree lock
         */
        if (path->locks[level] && level > 0) {
                btrfs_tree_unlock_rw(eb, path->locks[level]);
                path->locks[level] = 0;
        }
        return 0;
}

/*
 * This is used to verify a ref exists for this root to deal with a bug where we
 * would have a drop_progress key that hadn't been updated properly.
 */
static int check_ref_exists(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root, u64 bytenr, u64 parent,
                            int level)
{
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_delayed_ref_head *head;
        struct btrfs_path *path;
        struct btrfs_extent_inline_ref *iref;
        int ret;
        bool exists = false;

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;
again:
        ret = lookup_extent_backref(trans, path, &iref, bytenr,
                                    root->fs_info->nodesize, parent,
                                    btrfs_root_id(root), level, 0);
        if (ret != -ENOENT) {
                /*
                 * If we get 0 then we found our reference, return 1, else
                 * return the error if it's not -ENOENT;
                 */
                btrfs_free_path(path);
                return (ret < 0 ) ? ret : 1;
        }

        /*
         * We could have a delayed ref with this reference, so look it up while
         * we're holding the path open to make sure we don't race with the
         * delayed ref running.
         */
        delayed_refs = &trans->transaction->delayed_refs;
        spin_lock(&delayed_refs->lock);
        head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
        if (!head)
                goto out;
        if (!mutex_trylock(&head->mutex)) {
                /*
                 * We're contended, means that the delayed ref is running, get a
                 * reference and wait for the ref head to be complete and then
                 * try again.
                 */
                refcount_inc(&head->refs);
                spin_unlock(&delayed_refs->lock);

                btrfs_release_path(path);

                mutex_lock(&head->mutex);
                mutex_unlock(&head->mutex);
                btrfs_put_delayed_ref_head(head);
                goto again;
        }

        exists = btrfs_find_delayed_tree_ref(head, root->root_key.objectid, parent);
        mutex_unlock(&head->mutex);
out:
        spin_unlock(&delayed_refs->lock);
        btrfs_free_path(path);
        return exists ? 1 : 0;
}

/*
 * We may not have an uptodate block, so if we are going to walk down into this
 * block we need to drop the lock, read it off of the disk, re-lock it and
 * return to continue dropping the snapshot.
 */
static int check_next_block_uptodate(struct btrfs_trans_handle *trans,
                                     struct btrfs_root *root,
                                     struct btrfs_path *path,
                                     struct walk_control *wc,
                                     struct extent_buffer *next)
{
        struct btrfs_tree_parent_check check = { 0 };
        u64 generation;
        int level = wc->level;
        int ret;

        btrfs_assert_tree_write_locked(next);

        generation = btrfs_node_ptr_generation(path->nodes[level], path->slots[level]);

        if (btrfs_buffer_uptodate(next, generation, 0))
                return 0;

        check.level = level - 1;
        check.transid = generation;
        check.owner_root = btrfs_root_id(root);
        check.has_first_key = true;
        btrfs_node_key_to_cpu(path->nodes[level], &check.first_key, path->slots[level]);

        btrfs_tree_unlock(next);
        if (level == 1)
                reada_walk_down(trans, root, wc, path);
        ret = btrfs_read_extent_buffer(next, &check);
        if (ret) {
                free_extent_buffer(next);
                return ret;
        }
        btrfs_tree_lock(next);
        wc->lookup_info = 1;
        return 0;
}

/*
 * If we determine that we don't have to visit wc->level - 1 then we need to
 * determine if we can drop our reference.
 *
 * If we are UPDATE_BACKREF then we will not, we need to update our backrefs.
 *
 * If we are DROP_REFERENCE this will figure out if we need to drop our current
 * reference, skipping it if we dropped it from a previous incompleted drop, or
 * dropping it if we still have a reference to it.
 */
static int maybe_drop_reference(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                struct btrfs_path *path, struct walk_control *wc,
                                struct extent_buffer *next, u64 owner_root)
{
        struct btrfs_ref ref = {
                .action = BTRFS_DROP_DELAYED_REF,
                .bytenr = next->start,
                .num_bytes = root->fs_info->nodesize,
                .owning_root = owner_root,
                .ref_root = btrfs_root_id(root),
        };
        int level = wc->level;
        int ret;

        /* We are UPDATE_BACKREF, we're not dropping anything. */
        if (wc->stage == UPDATE_BACKREF)
                return 0;

        if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF) {
                ref.parent = path->nodes[level]->start;
        } else {
                ASSERT(btrfs_root_id(root) == btrfs_header_owner(path->nodes[level]));
                if (btrfs_root_id(root) != btrfs_header_owner(path->nodes[level])) {
                        btrfs_err(root->fs_info, "mismatched block owner");
                        return -EIO;
                }
        }

        /*
         * If we had a drop_progress we need to verify the refs are set as
         * expected.  If we find our ref then we know that from here on out
         * everything should be correct, and we can clear the
         * ->restarted flag.
         */
        if (wc->restarted) {
                ret = check_ref_exists(trans, root, next->start, ref.parent,
                                       level - 1);
                if (ret <= 0)
                        return ret;
                ret = 0;
                wc->restarted = 0;
        }

        /*
         * Reloc tree doesn't contribute to qgroup numbers, and we have already
         * accounted them at merge time (replace_path), thus we could skip
         * expensive subtree trace here.
         */
        if (btrfs_root_id(root) != BTRFS_TREE_RELOC_OBJECTID &&
            wc->refs[level - 1] > 1) {
                u64 generation = btrfs_node_ptr_generation(path->nodes[level],
                                                           path->slots[level]);

                ret = btrfs_qgroup_trace_subtree(trans, next, generation, level - 1);
                if (ret) {
                        btrfs_err_rl(root->fs_info,
"error %d accounting shared subtree, quota is out of sync, rescan required",
                                     ret);
                }
        }

        /*
         * We need to update the next key in our walk control so we can update
         * the drop_progress key accordingly.  We don't care if find_next_key
         * doesn't find a key because that means we're at the end and are going
         * to clean up now.
         */
        wc->drop_level = level;
        find_next_key(path, level, &wc->drop_progress);

        btrfs_init_tree_ref(&ref, level - 1, 0, false);
        return btrfs_free_extent(trans, &ref);
}

/*
 * helper to process tree block pointer.
 *
 * when wc->stage == DROP_REFERENCE, this function checks
 * reference count of the block pointed to. if the block
 * is shared and we need update back refs for the subtree
 * rooted at the block, this function changes wc->stage to
 * UPDATE_BACKREF. if the block is shared and there is no
 * need to update back, this function drops the reference
 * to the block.
 *
 * NOTE: return value 1 means we should stop walking down.
 */
static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 struct btrfs_path *path,
                                 struct walk_control *wc)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        u64 bytenr;
        u64 generation;
        u64 owner_root = 0;
        struct extent_buffer *next;
        int level = wc->level;
        int ret = 0;

        generation = btrfs_node_ptr_generation(path->nodes[level],
                                               path->slots[level]);
        /*
         * if the lower level block was created before the snapshot
         * was created, we know there is no need to update back refs
         * for the subtree
         */
        if (wc->stage == UPDATE_BACKREF &&
            generation <= root->root_key.offset) {
                wc->lookup_info = 1;
                return 1;
        }

        bytenr = btrfs_node_blockptr(path->nodes[level], path->slots[level]);

        next = btrfs_find_create_tree_block(fs_info, bytenr, btrfs_root_id(root),
                                            level - 1);
        if (IS_ERR(next))
                return PTR_ERR(next);

        btrfs_tree_lock(next);

        ret = btrfs_lookup_extent_info(trans, fs_info, bytenr, level - 1, 1,
                                       &wc->refs[level - 1],
                                       &wc->flags[level - 1],
                                       &owner_root);
        if (ret < 0)
                goto out_unlock;

        if (unlikely(wc->refs[level - 1] == 0)) {
                btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0",
                          bytenr);
                ret = -EUCLEAN;
                goto out_unlock;
        }
        wc->lookup_info = 0;

        /* If we don't have to walk into this node skip it. */
        if (!visit_node_for_delete(root, wc, path->nodes[level],
                                   wc->refs[level - 1], wc->flags[level - 1],
                                   path->slots[level]))
                goto skip;

        /*
         * We have to walk down into this node, and if we're currently at the
         * DROP_REFERNCE stage and this block is shared then we need to switch
         * to the UPDATE_BACKREF stage in order to convert to FULL_BACKREF.
         */
        if (wc->stage == DROP_REFERENCE && wc->refs[level - 1] > 1) {
                wc->stage = UPDATE_BACKREF;
                wc->shared_level = level - 1;
        }

        ret = check_next_block_uptodate(trans, root, path, wc, next);
        if (ret)
                return ret;

        level--;
        ASSERT(level == btrfs_header_level(next));
        if (level != btrfs_header_level(next)) {
                btrfs_err(root->fs_info, "mismatched level");
                ret = -EIO;
                goto out_unlock;
        }
        path->nodes[level] = next;
        path->slots[level] = 0;
        path->locks[level] = BTRFS_WRITE_LOCK;
        wc->level = level;
        if (wc->level == 1)
                wc->reada_slot = 0;
        return 0;
skip:
        ret = maybe_drop_reference(trans, root, path, wc, next, owner_root);
        if (ret)
                goto out_unlock;
        wc->refs[level - 1] = 0;
        wc->flags[level - 1] = 0;
        wc->lookup_info = 1;
        ret = 1;

out_unlock:
        btrfs_tree_unlock(next);
        free_extent_buffer(next);

        return ret;
}

/*
 * helper to process tree block while walking up the tree.
 *
 * when wc->stage == DROP_REFERENCE, this function drops
 * reference count on the block.
 *
 * when wc->stage == UPDATE_BACKREF, this function changes
 * wc->stage back to DROP_REFERENCE if we changed wc->stage
 * to UPDATE_BACKREF previously while processing the block.
 *
 * NOTE: return value 1 means we should stop walking up.
 */
static noinline int walk_up_proc(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 struct btrfs_path *path,
                                 struct walk_control *wc)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        int ret = 0;
        int level = wc->level;
        struct extent_buffer *eb = path->nodes[level];
        u64 parent = 0;

        if (wc->stage == UPDATE_BACKREF) {
                ASSERT(wc->shared_level >= level);
                if (level < wc->shared_level)
                        goto out;

                ret = find_next_key(path, level + 1, &wc->update_progress);
                if (ret > 0)
                        wc->update_ref = 0;

                wc->stage = DROP_REFERENCE;
                wc->shared_level = -1;
                path->slots[level] = 0;

                /*
                 * check reference count again if the block isn't locked.
                 * we should start walking down the tree again if reference
                 * count is one.
                 */
                if (!path->locks[level]) {
                        ASSERT(level > 0);
                        btrfs_tree_lock(eb);
                        path->locks[level] = BTRFS_WRITE_LOCK;

                        ret = btrfs_lookup_extent_info(trans, fs_info,
                                                       eb->start, level, 1,
                                                       &wc->refs[level],
                                                       &wc->flags[level],
                                                       NULL);
                        if (ret < 0) {
                                btrfs_tree_unlock_rw(eb, path->locks[level]);
                                path->locks[level] = 0;
                                return ret;
                        }
                        if (unlikely(wc->refs[level] == 0)) {
                                btrfs_tree_unlock_rw(eb, path->locks[level]);
                                btrfs_err(fs_info, "bytenr %llu has 0 references, expect > 0",
                                          eb->start);
                                return -EUCLEAN;
                        }
                        if (wc->refs[level] == 1) {
                                btrfs_tree_unlock_rw(eb, path->locks[level]);
                                path->locks[level] = 0;
                                return 1;
                        }
                }
        }

        /* wc->stage == DROP_REFERENCE */
        ASSERT(path->locks[level] || wc->refs[level] == 1);

        if (wc->refs[level] == 1) {
                if (level == 0) {
                        if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
                                ret = btrfs_dec_ref(trans, root, eb, 1);
                        else
                                ret = btrfs_dec_ref(trans, root, eb, 0);
                        if (ret) {
                                btrfs_abort_transaction(trans, ret);
                                return ret;
                        }
                        if (is_fstree(btrfs_root_id(root))) {
                                ret = btrfs_qgroup_trace_leaf_items(trans, eb);
                                if (ret) {
                                        btrfs_err_rl(fs_info,
        "error %d accounting leaf items, quota is out of sync, rescan required",
                                             ret);
                                }
                        }
                }
                /* Make block locked assertion in btrfs_clear_buffer_dirty happy. */
                if (!path->locks[level]) {
                        btrfs_tree_lock(eb);
                        path->locks[level] = BTRFS_WRITE_LOCK;
                }
                btrfs_clear_buffer_dirty(trans, eb);
        }

        if (eb == root->node) {
                if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
                        parent = eb->start;
                else if (btrfs_root_id(root) != btrfs_header_owner(eb))
                        goto owner_mismatch;
        } else {
                if (wc->flags[level + 1] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
                        parent = path->nodes[level + 1]->start;
                else if (btrfs_root_id(root) !=
                         btrfs_header_owner(path->nodes[level + 1]))
                        goto owner_mismatch;
        }

        ret = btrfs_free_tree_block(trans, btrfs_root_id(root), eb, parent,
                                    wc->refs[level] == 1);
        if (ret < 0)
                btrfs_abort_transaction(trans, ret);
out:
        wc->refs[level] = 0;
        wc->flags[level] = 0;
        return ret;

owner_mismatch:
        btrfs_err_rl(fs_info, "unexpected tree owner, have %llu expect %llu",
                     btrfs_header_owner(eb), btrfs_root_id(root));
        return -EUCLEAN;
}

/*
 * walk_down_tree consists of two steps.
 *
 * walk_down_proc().  Look up the reference count and reference of our current
 * wc->level.  At this point path->nodes[wc->level] should be populated and
 * uptodate, and in most cases should already be locked.  If we are in
 * DROP_REFERENCE and our refcount is > 1 then we've entered a shared node and
 * we can walk back up the tree.  If we are UPDATE_BACKREF we have to set
 * FULL_BACKREF on this node if it's not already set, and then do the
 * FULL_BACKREF conversion dance, which is to drop the root reference and add
 * the shared reference to all of this nodes children.
 *
 * do_walk_down().  This is where we actually start iterating on the children of
 * our current path->nodes[wc->level].  For DROP_REFERENCE that means dropping
 * our reference to the children that return false from visit_node_for_delete(),
 * which has various conditions where we know we can just drop our reference
 * without visiting the node.  For UPDATE_BACKREF we will skip any children that
 * visit_node_for_delete() returns false for, only walking down when necessary.
 * The bulk of the work for UPDATE_BACKREF occurs in the walk_up_tree() part of
 * snapshot deletion.
 */
static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                                   struct btrfs_root *root,
                                   struct btrfs_path *path,
                                   struct walk_control *wc)
{
        int level = wc->level;
        int ret = 0;

        wc->lookup_info = 1;
        while (level >= 0) {
                ret = walk_down_proc(trans, root, path, wc);
                if (ret)
                        break;

                if (level == 0)
                        break;

                if (path->slots[level] >=
                    btrfs_header_nritems(path->nodes[level]))
                        break;

                ret = do_walk_down(trans, root, path, wc);
                if (ret > 0) {
                        path->slots[level]++;
                        continue;
                } else if (ret < 0)
                        break;
                level = wc->level;
        }
        return (ret == 1) ? 0 : ret;
}

/*
 * walk_up_tree() is responsible for making sure we visit every slot on our
 * current node, and if we're at the end of that node then we call
 * walk_up_proc() on our current node which will do one of a few things based on
 * our stage.
 *
 * UPDATE_BACKREF.  If we wc->level is currently less than our wc->shared_level
 * then we need to walk back up the tree, and then going back down into the
 * other slots via walk_down_tree to update any other children from our original
 * wc->shared_level.  Once we're at or above our wc->shared_level we can switch
 * back to DROP_REFERENCE, lookup the current nodes refs and flags, and carry on.
 *
 * DROP_REFERENCE. If our refs == 1 then we're going to free this tree block.
 * If we're level 0 then we need to btrfs_dec_ref() on all of the data extents
 * in our current leaf.  After that we call btrfs_free_tree_block() on the
 * current node and walk up to the next node to walk down the next slot.
 */
static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
                                 struct btrfs_path *path,
                                 struct walk_control *wc, int max_level)
{
        int level = wc->level;
        int ret;

        path->slots[level] = btrfs_header_nritems(path->nodes[level]);
        while (level < max_level && path->nodes[level]) {
                wc->level = level;
                if (path->slots[level] + 1 <
                    btrfs_header_nritems(path->nodes[level])) {
                        path->slots[level]++;
                        return 0;
                } else {
                        ret = walk_up_proc(trans, root, path, wc);
                        if (ret > 0)
                                return 0;
                        if (ret < 0)
                                return ret;

                        if (path->locks[level]) {
                                btrfs_tree_unlock_rw(path->nodes[level],
                                                     path->locks[level]);
                                path->locks[level] = 0;
                        }
                        free_extent_buffer(path->nodes[level]);
                        path->nodes[level] = NULL;
                        level++;
                }
        }
        return 1;
}

/*
 * drop a subvolume tree.
 *
 * this function traverses the tree freeing any blocks that only
 * referenced by the tree.
 *
 * when a shared tree block is found. this function decreases its
 * reference count by one. if update_ref is true, this function
 * also make sure backrefs for the shared block and all lower level
 * blocks are properly updated.
 *
 * If called with for_reloc == 0, may exit early with -EAGAIN
 */
int btrfs_drop_snapshot(struct btrfs_root *root, int update_ref, int for_reloc)
{
        const bool is_reloc_root = (btrfs_root_id(root) == BTRFS_TREE_RELOC_OBJECTID);
        struct btrfs_fs_info *fs_info = root->fs_info;
        struct btrfs_path *path;
        struct btrfs_trans_handle *trans;
        struct btrfs_root *tree_root = fs_info->tree_root;
        struct btrfs_root_item *root_item = &root->root_item;
        struct walk_control *wc;
        struct btrfs_key key;
        const u64 rootid = btrfs_root_id(root);
        int ret = 0;
        int level;
        bool root_dropped = false;
        bool unfinished_drop = false;

        btrfs_debug(fs_info, "Drop subvolume %llu", btrfs_root_id(root));

        path = btrfs_alloc_path();
        if (!path) {
                ret = -ENOMEM;
                goto out;
        }

        wc = kzalloc(sizeof(*wc), GFP_NOFS);
        if (!wc) {
                btrfs_free_path(path);
                ret = -ENOMEM;
                goto out;
        }

        /*
         * Use join to avoid potential EINTR from transaction start. See
         * wait_reserve_ticket and the whole reservation callchain.
         */
        if (for_reloc)
                trans = btrfs_join_transaction(tree_root);
        else
                trans = btrfs_start_transaction(tree_root, 0);
        if (IS_ERR(trans)) {
                ret = PTR_ERR(trans);
                goto out_free;
        }

        ret = btrfs_run_delayed_items(trans);
        if (ret)
                goto out_end_trans;

        /*
         * This will help us catch people modifying the fs tree while we're
         * dropping it.  It is unsafe to mess with the fs tree while it's being
         * dropped as we unlock the root node and parent nodes as we walk down
         * the tree, assuming nothing will change.  If something does change
         * then we'll have stale information and drop references to blocks we've
         * already dropped.
         */
        set_bit(BTRFS_ROOT_DELETING, &root->state);
        unfinished_drop = test_bit(BTRFS_ROOT_UNFINISHED_DROP, &root->state);

        if (btrfs_disk_key_objectid(&root_item->drop_progress) == 0) {
                level = btrfs_header_level(root->node);
                path->nodes[level] = btrfs_lock_root_node(root);
                path->slots[level] = 0;
                path->locks[level] = BTRFS_WRITE_LOCK;
                memset(&wc->update_progress, 0,
                       sizeof(wc->update_progress));
        } else {
                btrfs_disk_key_to_cpu(&key, &root_item->drop_progress);
                memcpy(&wc->update_progress, &key,
                       sizeof(wc->update_progress));

                level = btrfs_root_drop_level(root_item);
                BUG_ON(level == 0);
                path->lowest_level = level;
                ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
                path->lowest_level = 0;
                if (ret < 0)
                        goto out_end_trans;

                WARN_ON(ret > 0);
                ret = 0;

                /*
                 * unlock our path, this is safe because only this
                 * function is allowed to delete this snapshot
                 */
                btrfs_unlock_up_safe(path, 0);

                level = btrfs_header_level(root->node);
                while (1) {
                        btrfs_tree_lock(path->nodes[level]);
                        path->locks[level] = BTRFS_WRITE_LOCK;

                        /*
                         * btrfs_lookup_extent_info() returns 0 for success,
                         * or < 0 for error.
                         */
                        ret = btrfs_lookup_extent_info(trans, fs_info,
                                                path->nodes[level]->start,
                                                level, 1, &wc->refs[level],
                                                &wc->flags[level], NULL);
                        if (ret < 0)
                                goto out_end_trans;

                        BUG_ON(wc->refs[level] == 0);

                        if (level == btrfs_root_drop_level(root_item))
                                break;

                        btrfs_tree_unlock(path->nodes[level]);
                        path->locks[level] = 0;
                        WARN_ON(wc->refs[level] != 1);
                        level--;
                }
        }

        wc->restarted = test_bit(BTRFS_ROOT_DEAD_TREE, &root->state);
        wc->level = level;
        wc->shared_level = -1;
        wc->stage = DROP_REFERENCE;
        wc->update_ref = update_ref;
        wc->keep_locks = 0;
        wc->reada_count = BTRFS_NODEPTRS_PER_BLOCK(fs_info);

        while (1) {

                ret = walk_down_tree(trans, root, path, wc);
                if (ret < 0) {
                        btrfs_abort_transaction(trans, ret);
                        break;
                }

                ret = walk_up_tree(trans, root, path, wc, BTRFS_MAX_LEVEL);
                if (ret < 0) {
                        btrfs_abort_transaction(trans, ret);
                        break;
                }

                if (ret > 0) {
                        BUG_ON(wc->stage != DROP_REFERENCE);
                        ret = 0;
                        break;
                }

                if (wc->stage == DROP_REFERENCE) {
                        wc->drop_level = wc->level;
                        btrfs_node_key_to_cpu(path->nodes[wc->drop_level],
                                              &wc->drop_progress,
                                              path->slots[wc->drop_level]);
                }
                btrfs_cpu_key_to_disk(&root_item->drop_progress,
                                      &wc->drop_progress);
                btrfs_set_root_drop_level(root_item, wc->drop_level);

                BUG_ON(wc->level == 0);
                if (btrfs_should_end_transaction(trans) ||
                    (!for_reloc && btrfs_need_cleaner_sleep(fs_info))) {
                        ret = btrfs_update_root(trans, tree_root,
                                                &root->root_key,
                                                root_item);
                        if (ret) {
                                btrfs_abort_transaction(trans, ret);
                                goto out_end_trans;
                        }

                        if (!is_reloc_root)
                                btrfs_set_last_root_drop_gen(fs_info, trans->transid);

                        btrfs_end_transaction_throttle(trans);
                        if (!for_reloc && btrfs_need_cleaner_sleep(fs_info)) {
                                btrfs_debug(fs_info,
                                            "drop snapshot early exit");
                                ret = -EAGAIN;
                                goto out_free;
                        }

                       /*
                        * Use join to avoid potential EINTR from transaction
                        * start. See wait_reserve_ticket and the whole
                        * reservation callchain.
                        */
                        if (for_reloc)
                                trans = btrfs_join_transaction(tree_root);
                        else
                                trans = btrfs_start_transaction(tree_root, 0);
                        if (IS_ERR(trans)) {
                                ret = PTR_ERR(trans);
                                goto out_free;
                        }
                }
        }
        btrfs_release_path(path);
        if (ret)
                goto out_end_trans;

        ret = btrfs_del_root(trans, &root->root_key);
        if (ret) {
                btrfs_abort_transaction(trans, ret);
                goto out_end_trans;
        }

        if (!is_reloc_root) {
                ret = btrfs_find_root(tree_root, &root->root_key, path,
                                      NULL, NULL);
                if (ret < 0) {
                        btrfs_abort_transaction(trans, ret);
                        goto out_end_trans;
                } else if (ret > 0) {
                        ret = 0;
                        /*
                         * If we fail to delete the orphan item this time
                         * around, it'll get picked up the next time.
                         *
                         * The most common failure here is just -ENOENT.
                         */
                        btrfs_del_orphan_item(trans, tree_root, btrfs_root_id(root));
                }
        }

        /*
         * This subvolume is going to be completely dropped, and won't be
         * recorded as dirty roots, thus pertrans meta rsv will not be freed at
         * commit transaction time.  So free it here manually.
         */
        btrfs_qgroup_convert_reserved_meta(root, INT_MAX);
        btrfs_qgroup_free_meta_all_pertrans(root);

        if (test_bit(BTRFS_ROOT_IN_RADIX, &root->state))
                btrfs_add_dropped_root(trans, root);
        else
                btrfs_put_root(root);
        root_dropped = true;
out_end_trans:
        if (!is_reloc_root)
                btrfs_set_last_root_drop_gen(fs_info, trans->transid);

        btrfs_end_transaction_throttle(trans);
out_free:
        kfree(wc);
        btrfs_free_path(path);
out:
        if (!ret && root_dropped) {
                ret = btrfs_qgroup_cleanup_dropped_subvolume(fs_info, rootid);
                if (ret < 0)
                        btrfs_warn_rl(fs_info,
                                      "failed to cleanup qgroup 0/%llu: %d",
                                      rootid, ret);
                ret = 0;
        }
        /*
         * We were an unfinished drop root, check to see if there are any
         * pending, and if not clear and wake up any waiters.
         */
        if (!ret && unfinished_drop)
                btrfs_maybe_wake_unfinished_drop(fs_info);

        /*
         * So if we need to stop dropping the snapshot for whatever reason we
         * need to make sure to add it back to the dead root list so that we
         * keep trying to do the work later.  This also cleans up roots if we
         * don't have it in the radix (like when we recover after a power fail
         * or unmount) so we don't leak memory.
         */
        if (!for_reloc && !root_dropped)
                btrfs_add_dead_root(root);
        return ret;
}

/*
 * drop subtree rooted at tree block 'node'.
 *
 * NOTE: this function will unlock and release tree block 'node'
 * only used by relocation code
 */
int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                        struct btrfs_root *root,
                        struct extent_buffer *node,
                        struct extent_buffer *parent)
{
        struct btrfs_fs_info *fs_info = root->fs_info;
        struct btrfs_path *path;
        struct walk_control *wc;
        int level;
        int parent_level;
        int ret = 0;

        BUG_ON(btrfs_root_id(root) != BTRFS_TREE_RELOC_OBJECTID);

        path = btrfs_alloc_path();
        if (!path)
                return -ENOMEM;

        wc = kzalloc(sizeof(*wc), GFP_NOFS);
        if (!wc) {
                btrfs_free_path(path);
                return -ENOMEM;
        }

        btrfs_assert_tree_write_locked(parent);
        parent_level = btrfs_header_level(parent);
        atomic_inc(&parent->refs);
        path->nodes[parent_level] = parent;
        path->slots[parent_level] = btrfs_header_nritems(parent);

        btrfs_assert_tree_write_locked(node);
        level = btrfs_header_level(node);
        path->nodes[level] = node;
        path->slots[level] = 0;
        path->locks[level] = BTRFS_WRITE_LOCK;

        wc->refs[parent_level] = 1;
        wc->flags[parent_level] = BTRFS_BLOCK_FLAG_FULL_BACKREF;
        wc->level = level;
        wc->shared_level = -1;
        wc->stage = DROP_REFERENCE;
        wc->update_ref = 0;
        wc->keep_locks = 1;
        wc->reada_count = BTRFS_NODEPTRS_PER_BLOCK(fs_info);

        while (1) {
                ret = walk_down_tree(trans, root, path, wc);
                if (ret < 0)
                        break;

                ret = walk_up_tree(trans, root, path, wc, parent_level);
                if (ret) {
                        if (ret > 0)
                                ret = 0;
                        break;
                }
        }

        kfree(wc);
        btrfs_free_path(path);
        return ret;
}

/*
 * Unpin the extent range in an error context and don't add the space back.
 * Errors are not propagated further.
 */
void btrfs_error_unpin_extent_range(struct btrfs_fs_info *fs_info, u64 start, u64 end)
{
        unpin_extent_range(fs_info, start, end, false);
}

/*
 * It used to be that old block groups would be left around forever.
 * Iterating over them would be enough to trim unused space.  Since we
 * now automatically remove them, we also need to iterate over unallocated
 * space.
 *
 * We don't want a transaction for this since the discard may take a
 * substantial amount of time.  We don't require that a transaction be
 * running, but we do need to take a running transaction into account
 * to ensure that we're not discarding chunks that were released or
 * allocated in the current transaction.
 *
 * Holding the chunks lock will prevent other threads from allocating
 * or releasing chunks, but it won't prevent a running transaction
 * from committing and releasing the memory that the pending chunks
 * list head uses.  For that, we need to take a reference to the
 * transaction and hold the commit root sem.  We only need to hold
 * it while performing the free space search since we have already
 * held back allocations.
 */
static int btrfs_trim_free_extents(struct btrfs_device *device, u64 *trimmed)
{
        u64 start = BTRFS_DEVICE_RANGE_RESERVED, len = 0, end = 0;
        int ret;

        *trimmed = 0;

        /* Discard not supported = nothing to do. */
        if (!bdev_max_discard_sectors(device->bdev))
                return 0;

        /* Not writable = nothing to do. */
        if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
                return 0;

        /* No free space = nothing to do. */
        if (device->total_bytes <= device->bytes_used)
                return 0;

        ret = 0;

        while (1) {
                struct btrfs_fs_info *fs_info = device->fs_info;
                u64 bytes;

                ret = mutex_lock_interruptible(&fs_info->chunk_mutex);
                if (ret)
                        break;

                find_first_clear_extent_bit(&device->alloc_state, start,
                                            &start, &end,
                                            CHUNK_TRIMMED | CHUNK_ALLOCATED);

                /* Check if there are any CHUNK_* bits left */
                if (start > device->total_bytes) {
                        WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
                        btrfs_warn_in_rcu(fs_info,
"ignoring attempt to trim beyond device size: offset %llu length %llu device %s device size %llu",
                                          start, end - start + 1,
                                          btrfs_dev_name(device),
                                          device->total_bytes);
                        mutex_unlock(&fs_info->chunk_mutex);
                        ret = 0;
                        break;
                }

                /* Ensure we skip the reserved space on each device. */
                start = max_t(u64, start, BTRFS_DEVICE_RANGE_RESERVED);

                /*
                 * If find_first_clear_extent_bit find a range that spans the
                 * end of the device it will set end to -1, in this case it's up
                 * to the caller to trim the value to the size of the device.
                 */
                end = min(end, device->total_bytes - 1);

                len = end - start + 1;

                /* We didn't find any extents */
                if (!len) {
                        mutex_unlock(&fs_info->chunk_mutex);
                        ret = 0;
                        break;
                }

                ret = btrfs_issue_discard(device->bdev, start, len,
                                          &bytes);
                if (!ret)
                        set_extent_bit(&device->alloc_state, start,
                                       start + bytes - 1, CHUNK_TRIMMED, NULL);
                mutex_unlock(&fs_info->chunk_mutex);

                if (ret)
                        break;

                start += len;
                *trimmed += bytes;

                if (fatal_signal_pending(current)) {
                        ret = -ERESTARTSYS;
                        break;
                }

                cond_resched();
        }

        return ret;
}

/*
 * Trim the whole filesystem by:
 * 1) trimming the free space in each block group
 * 2) trimming the unallocated space on each device
 *
 * This will also continue trimming even if a block group or device encounters
 * an error.  The return value will be the last error, or 0 if nothing bad
 * happens.
 */
int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
{
        struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
        struct btrfs_block_group *cache = NULL;
        struct btrfs_device *device;
        u64 group_trimmed;
        u64 range_end = U64_MAX;
        u64 start;
        u64 end;
        u64 trimmed = 0;
        u64 bg_failed = 0;
        u64 dev_failed = 0;
        int bg_ret = 0;
        int dev_ret = 0;
        int ret = 0;

        if (range->start == U64_MAX)
                return -EINVAL;

        /*
         * Check range overflow if range->len is set.
         * The default range->len is U64_MAX.
         */
        if (range->len != U64_MAX &&
            check_add_overflow(range->start, range->len, &range_end))
                return -EINVAL;

        cache = btrfs_lookup_first_block_group(fs_info, range->start);
        for (; cache; cache = btrfs_next_block_group(cache)) {
                if (cache->start >= range_end) {
                        btrfs_put_block_group(cache);
                        break;
                }

                start = max(range->start, cache->start);
                end = min(range_end, cache->start + cache->length);

                if (end - start >= range->minlen) {
                        if (!btrfs_block_group_done(cache)) {
                                ret = btrfs_cache_block_group(cache, true);
                                if (ret) {
                                        bg_failed++;
                                        bg_ret = ret;
                                        continue;
                                }
                        }
                        ret = btrfs_trim_block_group(cache,
                                                     &group_trimmed,
                                                     start,
                                                     end,
                                                     range->minlen);

                        trimmed += group_trimmed;
                        if (ret) {
                                bg_failed++;
                                bg_ret = ret;
                                continue;
                        }
                }
        }

        if (bg_failed)
                btrfs_warn(fs_info,
                        "failed to trim %llu block group(s), last error %d",
                        bg_failed, bg_ret);

        mutex_lock(&fs_devices->device_list_mutex);
        list_for_each_entry(device, &fs_devices->devices, dev_list) {
                if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
                        continue;

                ret = btrfs_trim_free_extents(device, &group_trimmed);

                trimmed += group_trimmed;
                if (ret) {
                        dev_failed++;
                        dev_ret = ret;
                        break;
                }
        }
        mutex_unlock(&fs_devices->device_list_mutex);

        if (dev_failed)
                btrfs_warn(fs_info,
                        "failed to trim %llu device(s), last error %d",
                        dev_failed, dev_ret);
        range->len = trimmed;
        if (bg_ret)
                return bg_ret;
        return dev_ret;
}



















































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Copyright (C) 2012 Fusion-io  All rights reserved.
 * Copyright (C) 2012 Intel Corp. All rights reserved.
 */

#ifndef BTRFS_RAID56_H
#define BTRFS_RAID56_H

#include <linux/types.h>
#include <linux/list.h>
#include <linux/spinlock.h>
#include <linux/bio.h>
#include <linux/refcount.h>
#include <linux/workqueue.h>
#include "volumes.h"

struct page;
struct sector_ptr;
struct btrfs_fs_info;

enum btrfs_rbio_ops {
        BTRFS_RBIO_WRITE,
        BTRFS_RBIO_READ_REBUILD,
        BTRFS_RBIO_PARITY_SCRUB,
};

struct btrfs_raid_bio {
        struct btrfs_io_context *bioc;

        /*
         * While we're doing RMW on a stripe we put it into a hash table so we
         * can lock the stripe and merge more rbios into it.
         */
        struct list_head hash_list;

        /* LRU list for the stripe cache */
        struct list_head stripe_cache;

        /* For scheduling work in the helper threads */
        struct work_struct work;

        /*
         * bio_list and bio_list_lock are used to add more bios into the stripe
         * in hopes of avoiding the full RMW
         */
        struct bio_list bio_list;
        spinlock_t bio_list_lock;

        /*
         * Also protected by the bio_list_lock, the plug list is used by the
         * plugging code to collect partial bios while plugged.  The stripe
         * locking code also uses it to hand off the stripe lock to the next
         * pending IO.
         */
        struct list_head plug_list;

        /* Flags that tell us if it is safe to merge with this bio. */
        unsigned long flags;

        /*
         * Set if we're doing a parity rebuild for a read from higher up, which
         * is handled differently from a parity rebuild as part of RMW.
         */
        enum btrfs_rbio_ops operation;

        /* How many pages there are for the full stripe including P/Q */
        u16 nr_pages;

        /* How many sectors there are for the full stripe including P/Q */
        u16 nr_sectors;

        /* Number of data stripes (no p/q) */
        u8 nr_data;

        /* Number of all stripes (including P/Q) */
        u8 real_stripes;

        /* How many pages there are for each stripe */
        u8 stripe_npages;

        /* How many sectors there are for each stripe */
        u8 stripe_nsectors;

        /* Stripe number that we're scrubbing  */
        u8 scrubp;

        /*
         * Size of all the bios in the bio_list.  This helps us decide if the
         * rbio maps to a full stripe or not.
         */
        int bio_list_bytes;

        refcount_t refs;

        atomic_t stripes_pending;

        wait_queue_head_t io_wait;

        /* Bitmap to record which horizontal stripe has data */
        unsigned long dbitmap;

        /* Allocated with stripe_nsectors-many bits for finish_*() calls */
        unsigned long finish_pbitmap;

        /*
         * These are two arrays of pointers.  We allocate the rbio big enough
         * to hold them both and setup their locations when the rbio is
         * allocated.
         */

        /*
         * Pointers to pages that we allocated for reading/writing stripes
         * directly from the disk (including P/Q).
         */
        struct page **stripe_pages;

        /* Pointers to the sectors in the bio_list, for faster lookup */
        struct sector_ptr *bio_sectors;

        /*
         * For subpage support, we need to map each sector to above
         * stripe_pages.
         */
        struct sector_ptr *stripe_sectors;

        /* Allocated with real_stripes-many pointers for finish_*() calls */
        void **finish_pointers;

        /*
         * The bitmap recording where IO errors happened.
         * Each bit is corresponding to one sector in either bio_sectors[] or
         * stripe_sectors[] array.
         *
         * The reason we don't use another bit in sector_ptr is, we have two
         * arrays of sectors, and a lot of IO can use sectors in both arrays.
         * Thus making it much harder to iterate.
         */
        unsigned long *error_bitmap;

        /*
         * Checksum buffer if the rbio is for data.  The buffer should cover
         * all data sectors (excluding P/Q sectors).
         */
        u8 *csum_buf;

        /*
         * Each bit represents if the corresponding sector has data csum found.
         * Should only cover data sectors (excluding P/Q sectors).
         */
        unsigned long *csum_bitmap;
};

/*
 * For trace event usage only. Records useful debug info for each bio submitted
 * by RAID56 to each physical device.
 *
 * No matter signed or not, (-1) is always the one indicating we can not grab
 * the proper stripe number.
 */
struct raid56_bio_trace_info {
        u64 devid;

        /* The offset inside the stripe. (<= STRIPE_LEN) */
        u32 offset;

        /*
         * Stripe number.
         * 0 is the first data stripe, and nr_data for P stripe,
         * nr_data + 1 for Q stripe.
         * >= real_stripes for
         */
        u8 stripe_nr;
};

static inline int nr_data_stripes(const struct btrfs_chunk_map *map)
{
        return map->num_stripes - btrfs_nr_parity_stripes(map->type);
}

static inline int nr_bioc_data_stripes(const struct btrfs_io_context *bioc)
{
        return bioc->num_stripes - btrfs_nr_parity_stripes(bioc->map_type);
}

#define RAID5_P_STRIPE ((u64)-2)
#define RAID6_Q_STRIPE ((u64)-1)

#define is_parity_stripe(x) (((x) == RAID5_P_STRIPE) ||                \
                             ((x) == RAID6_Q_STRIPE))

struct btrfs_device;

void raid56_parity_recover(struct bio *bio, struct btrfs_io_context *bioc,
                           int mirror_num);
void raid56_parity_write(struct bio *bio, struct btrfs_io_context *bioc);

struct btrfs_raid_bio *raid56_parity_alloc_scrub_rbio(struct bio *bio,
                                struct btrfs_io_context *bioc,
                                struct btrfs_device *scrub_dev,
                                unsigned long *dbitmap, int stripe_nsectors);
void raid56_parity_submit_scrub_rbio(struct btrfs_raid_bio *rbio);

void raid56_parity_cache_data_pages(struct btrfs_raid_bio *rbio,
                                    struct page **data_pages, u64 data_logical);

int btrfs_alloc_stripe_hash_table(struct btrfs_fs_info *info);
void btrfs_free_stripe_hash_table(struct btrfs_fs_info *info);

#endif
















































































































































































































































































































    4 





    4 





































































































    1 



    1 






























































































    4 
    4 

























































































































































    3 



    3 














    3 
    3 




















































































































































































































































































































































































































































































































































































































































































































































































































































    3 

















    3 






























    3 



    3 
    3 

































    3 









































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    1 


























































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * NET                An implementation of the SOCKET network access protocol.
 *
 * Version:        @(#)socket.c        1.1.93        18/02/95
 *
 * Authors:        Orest Zborowski, <obz@Kodak.COM>
 *                Ross Biro
 *                Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
 *
 * Fixes:
 *                Anonymous        :        NOTSOCK/BADF cleanup. Error fix in
 *                                        shutdown()
 *                Alan Cox        :        verify_area() fixes
 *                Alan Cox        :        Removed DDI
 *                Jonathan Kamens        :        SOCK_DGRAM reconnect bug
 *                Alan Cox        :        Moved a load of checks to the very
 *                                        top level.
 *                Alan Cox        :        Move address structures to/from user
 *                                        mode above the protocol layers.
 *                Rob Janssen        :        Allow 0 length sends.
 *                Alan Cox        :        Asynchronous I/O support (cribbed from the
 *                                        tty drivers).
 *                Niibe Yutaka        :        Asynchronous I/O for writes (4.4BSD style)
 *                Jeff Uphoff        :        Made max number of sockets command-line
 *                                        configurable.
 *                Matti Aarnio        :        Made the number of sockets dynamic,
 *                                        to be allocated when needed, and mr.
 *                                        Uphoff's max is used as max to be
 *                                        allowed to allocate.
 *                Linus                :        Argh. removed all the socket allocation
 *                                        altogether: it's in the inode now.
 *                Alan Cox        :        Made sock_alloc()/sock_release() public
 *                                        for NetROM and future kernel nfsd type
 *                                        stuff.
 *                Alan Cox        :        sendmsg/recvmsg basics.
 *                Tom Dyas        :        Export net symbols.
 *                Marcin Dalecki        :        Fixed problems with CONFIG_NET="n".
 *                Alan Cox        :        Added thread locking to sys_* calls
 *                                        for sockets. May have errors at the
 *                                        moment.
 *                Kevin Buhr        :        Fixed the dumb errors in the above.
 *                Andi Kleen        :        Some small cleanups, optimizations,
 *                                        and fixed a copy_from_user() bug.
 *                Tigran Aivazian        :        sys_send(args) calls sys_sendto(args, NULL, 0)
 *                Tigran Aivazian        :        Made listen(2) backlog sanity checks
 *                                        protocol-independent
 *
 *        This module is effectively the top level interface to the BSD socket
 *        paradigm.
 *
 *        Based upon Swansea University Computer Society NET3.039
 */

#include <linux/bpf-cgroup.h>
#include <linux/ethtool.h>
#include <linux/mm.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/splice.h>
#include <linux/net.h>
#include <linux/interrupt.h>
#include <linux/thread_info.h>
#include <linux/rcupdate.h>
#include <linux/netdevice.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/mutex.h>
#include <linux/if_bridge.h>
#include <linux/if_vlan.h>
#include <linux/ptp_classify.h>
#include <linux/init.h>
#include <linux/poll.h>
#include <linux/cache.h>
#include <linux/module.h>
#include <linux/highmem.h>
#include <linux/mount.h>
#include <linux/pseudo_fs.h>
#include <linux/security.h>
#include <linux/syscalls.h>
#include <linux/compat.h>
#include <linux/kmod.h>
#include <linux/audit.h>
#include <linux/wireless.h>
#include <linux/nsproxy.h>
#include <linux/magic.h>
#include <linux/slab.h>
#include <linux/xattr.h>
#include <linux/nospec.h>
#include <linux/indirect_call_wrapper.h>
#include <linux/io_uring/net.h>

#include <linux/uaccess.h>
#include <asm/unistd.h>

#include <net/compat.h>
#include <net/wext.h>
#include <net/cls_cgroup.h>

#include <net/sock.h>
#include <linux/netfilter.h>

#include <linux/if_tun.h>
#include <linux/ipv6_route.h>
#include <linux/route.h>
#include <linux/termios.h>
#include <linux/sockios.h>
#include <net/busy_poll.h>
#include <linux/errqueue.h>
#include <linux/ptp_clock_kernel.h>
#include <trace/events/sock.h>

#ifdef CONFIG_NET_RX_BUSY_POLL
unsigned int sysctl_net_busy_read __read_mostly;
unsigned int sysctl_net_busy_poll __read_mostly;
#endif

static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to);
static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
static int sock_mmap(struct file *file, struct vm_area_struct *vma);

static int sock_close(struct inode *inode, struct file *file);
static __poll_t sock_poll(struct file *file,
                              struct poll_table_struct *wait);
static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
#ifdef CONFIG_COMPAT
static long compat_sock_ioctl(struct file *file,
                              unsigned int cmd, unsigned long arg);
#endif
static int sock_fasync(int fd, struct file *filp, int on);
static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
                                struct pipe_inode_info *pipe, size_t len,
                                unsigned int flags);
static void sock_splice_eof(struct file *file);

#ifdef CONFIG_PROC_FS
static void sock_show_fdinfo(struct seq_file *m, struct file *f)
{
        struct socket *sock = f->private_data;
        const struct proto_ops *ops = READ_ONCE(sock->ops);

        if (ops->show_fdinfo)
                ops->show_fdinfo(m, sock);
}
#else
#define sock_show_fdinfo NULL
#endif

/*
 *        Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
 *        in the operation structures but are done directly via the socketcall() multiplexor.
 */

static const struct file_operations socket_file_ops = {
        .owner =        THIS_MODULE,
        .read_iter =        sock_read_iter,
        .write_iter =        sock_write_iter,
        .poll =                sock_poll,
        .unlocked_ioctl = sock_ioctl,
#ifdef CONFIG_COMPAT
        .compat_ioctl = compat_sock_ioctl,
#endif
        .uring_cmd =    io_uring_cmd_sock,
        .mmap =                sock_mmap,
        .release =        sock_close,
        .fasync =        sock_fasync,
        .splice_write = splice_to_socket,
        .splice_read =        sock_splice_read,
        .splice_eof =        sock_splice_eof,
        .show_fdinfo =        sock_show_fdinfo,
};

static const char * const pf_family_names[] = {
        [PF_UNSPEC]        = "PF_UNSPEC",
        [PF_UNIX]        = "PF_UNIX/PF_LOCAL",
        [PF_INET]        = "PF_INET",
        [PF_AX25]        = "PF_AX25",
        [PF_IPX]        = "PF_IPX",
        [PF_APPLETALK]        = "PF_APPLETALK",
        [PF_NETROM]        = "PF_NETROM",
        [PF_BRIDGE]        = "PF_BRIDGE",
        [PF_ATMPVC]        = "PF_ATMPVC",
        [PF_X25]        = "PF_X25",
        [PF_INET6]        = "PF_INET6",
        [PF_ROSE]        = "PF_ROSE",
        [PF_DECnet]        = "PF_DECnet",
        [PF_NETBEUI]        = "PF_NETBEUI",
        [PF_SECURITY]        = "PF_SECURITY",
        [PF_KEY]        = "PF_KEY",
        [PF_NETLINK]        = "PF_NETLINK/PF_ROUTE",
        [PF_PACKET]        = "PF_PACKET",
        [PF_ASH]        = "PF_ASH",
        [PF_ECONET]        = "PF_ECONET",
        [PF_ATMSVC]        = "PF_ATMSVC",
        [PF_RDS]        = "PF_RDS",
        [PF_SNA]        = "PF_SNA",
        [PF_IRDA]        = "PF_IRDA",
        [PF_PPPOX]        = "PF_PPPOX",
        [PF_WANPIPE]        = "PF_WANPIPE",
        [PF_LLC]        = "PF_LLC",
        [PF_IB]                = "PF_IB",
        [PF_MPLS]        = "PF_MPLS",
        [PF_CAN]        = "PF_CAN",
        [PF_TIPC]        = "PF_TIPC",
        [PF_BLUETOOTH]        = "PF_BLUETOOTH",
        [PF_IUCV]        = "PF_IUCV",
        [PF_RXRPC]        = "PF_RXRPC",
        [PF_ISDN]        = "PF_ISDN",
        [PF_PHONET]        = "PF_PHONET",
        [PF_IEEE802154]        = "PF_IEEE802154",
        [PF_CAIF]        = "PF_CAIF",
        [PF_ALG]        = "PF_ALG",
        [PF_NFC]        = "PF_NFC",
        [PF_VSOCK]        = "PF_VSOCK",
        [PF_KCM]        = "PF_KCM",
        [PF_QIPCRTR]        = "PF_QIPCRTR",
        [PF_SMC]        = "PF_SMC",
        [PF_XDP]        = "PF_XDP",
        [PF_MCTP]        = "PF_MCTP",
};

/*
 *        The protocol list. Each protocol is registered in here.
 */

static DEFINE_SPINLOCK(net_family_lock);
static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;

/*
 * Support routines.
 * Move socket addresses back and forth across the kernel/user
 * divide and look after the messy bits.
 */

/**
 *        move_addr_to_kernel        -        copy a socket address into kernel space
 *        @uaddr: Address in user space
 *        @kaddr: Address in kernel space
 *        @ulen: Length in user space
 *
 *        The address is copied into kernel space. If the provided address is
 *        too long an error code of -EINVAL is returned. If the copy gives
 *        invalid addresses -EFAULT is returned. On a success 0 is returned.
 */

int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr)
{
        if (ulen < 0 || ulen > sizeof(struct sockaddr_storage))
                return -EINVAL;
        if (ulen == 0)
                return 0;
        if (copy_from_user(kaddr, uaddr, ulen))
                return -EFAULT;
        return audit_sockaddr(ulen, kaddr);
}

/**
 *        move_addr_to_user        -        copy an address to user space
 *        @kaddr: kernel space address
 *        @klen: length of address in kernel
 *        @uaddr: user space address
 *        @ulen: pointer to user length field
 *
 *        The value pointed to by ulen on entry is the buffer length available.
 *        This is overwritten with the buffer space used. -EINVAL is returned
 *        if an overlong buffer is specified or a negative buffer size. -EFAULT
 *        is returned if either the buffer or the length field are not
 *        accessible.
 *        After copying the data up to the limit the user specifies, the true
 *        length of the data is written over the length limit the user
 *        specified. Zero is returned for a success.
 */

static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
                             void __user *uaddr, int __user *ulen)
{
        int err;
        int len;

        BUG_ON(klen > sizeof(struct sockaddr_storage));
        err = get_user(len, ulen);
        if (err)
                return err;
        if (len > klen)
                len = klen;
        if (len < 0)
                return -EINVAL;
        if (len) {
                if (audit_sockaddr(klen, kaddr))
                        return -ENOMEM;
                if (copy_to_user(uaddr, kaddr, len))
                        return -EFAULT;
        }
        /*
         *      "fromlen shall refer to the value before truncation.."
         *                      1003.1g
         */
        return __put_user(klen, ulen);
}

static struct kmem_cache *sock_inode_cachep __ro_after_init;

static struct inode *sock_alloc_inode(struct super_block *sb)
{
        struct socket_alloc *ei;

        ei = alloc_inode_sb(sb, sock_inode_cachep, GFP_KERNEL);
        if (!ei)
                return NULL;
        init_waitqueue_head(&ei->socket.wq.wait);
        ei->socket.wq.fasync_list = NULL;
        ei->socket.wq.flags = 0;

        ei->socket.state = SS_UNCONNECTED;
        ei->socket.flags = 0;
        ei->socket.ops = NULL;
        ei->socket.sk = NULL;
        ei->socket.file = NULL;

        return &ei->vfs_inode;
}

static void sock_free_inode(struct inode *inode)
{
        struct socket_alloc *ei;

        ei = container_of(inode, struct socket_alloc, vfs_inode);
        kmem_cache_free(sock_inode_cachep, ei);
}

static void init_once(void *foo)
{
        struct socket_alloc *ei = (struct socket_alloc *)foo;

        inode_init_once(&ei->vfs_inode);
}

static void init_inodecache(void)
{
        sock_inode_cachep = kmem_cache_create("sock_inode_cache",
                                              sizeof(struct socket_alloc),
                                              0,
                                              (SLAB_HWCACHE_ALIGN |
                                               SLAB_RECLAIM_ACCOUNT |
                                               SLAB_ACCOUNT),
                                              init_once);
        BUG_ON(sock_inode_cachep == NULL);
}

static const struct super_operations sockfs_ops = {
        .alloc_inode        = sock_alloc_inode,
        .free_inode        = sock_free_inode,
        .statfs                = simple_statfs,
};

/*
 * sockfs_dname() is called from d_path().
 */
static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
{
        return dynamic_dname(buffer, buflen, "socket:[%lu]",
                                d_inode(dentry)->i_ino);
}

static const struct dentry_operations sockfs_dentry_operations = {
        .d_dname  = sockfs_dname,
};

static int sockfs_xattr_get(const struct xattr_handler *handler,
                            struct dentry *dentry, struct inode *inode,
                            const char *suffix, void *value, size_t size)
{
        if (value) {
                if (dentry->d_name.len + 1 > size)
                        return -ERANGE;
                memcpy(value, dentry->d_name.name, dentry->d_name.len + 1);
        }
        return dentry->d_name.len + 1;
}

#define XATTR_SOCKPROTONAME_SUFFIX "sockprotoname"
#define XATTR_NAME_SOCKPROTONAME (XATTR_SYSTEM_PREFIX XATTR_SOCKPROTONAME_SUFFIX)
#define XATTR_NAME_SOCKPROTONAME_LEN (sizeof(XATTR_NAME_SOCKPROTONAME)-1)

static const struct xattr_handler sockfs_xattr_handler = {
        .name = XATTR_NAME_SOCKPROTONAME,
        .get = sockfs_xattr_get,
};

static int sockfs_security_xattr_set(const struct xattr_handler *handler,
                                     struct mnt_idmap *idmap,
                                     struct dentry *dentry, struct inode *inode,
                                     const char *suffix, const void *value,
                                     size_t size, int flags)
{
        /* Handled by LSM. */
        return -EAGAIN;
}

static const struct xattr_handler sockfs_security_xattr_handler = {
        .prefix = XATTR_SECURITY_PREFIX,
        .set = sockfs_security_xattr_set,
};

static const struct xattr_handler * const sockfs_xattr_handlers[] = {
        &sockfs_xattr_handler,
        &sockfs_security_xattr_handler,
        NULL
};

static int sockfs_init_fs_context(struct fs_context *fc)
{
        struct pseudo_fs_context *ctx = init_pseudo(fc, SOCKFS_MAGIC);
        if (!ctx)
                return -ENOMEM;
        ctx->ops = &sockfs_ops;
        ctx->dops = &sockfs_dentry_operations;
        ctx->xattr = sockfs_xattr_handlers;
        return 0;
}

static struct vfsmount *sock_mnt __read_mostly;

static struct file_system_type sock_fs_type = {
        .name =                "sockfs",
        .init_fs_context = sockfs_init_fs_context,
        .kill_sb =        kill_anon_super,
};

/*
 *        Obtains the first available file descriptor and sets it up for use.
 *
 *        These functions create file structures and maps them to fd space
 *        of the current process. On success it returns file descriptor
 *        and file struct implicitly stored in sock->file.
 *        Note that another thread may close file descriptor before we return
 *        from this function. We use the fact that now we do not refer
 *        to socket after mapping. If one day we will need it, this
 *        function will increment ref. count on file by 1.
 *
 *        In any case returned fd MAY BE not valid!
 *        This race condition is unavoidable
 *        with shared fd spaces, we cannot solve it inside kernel,
 *        but we take care of internal coherence yet.
 */

/**
 *        sock_alloc_file - Bind a &socket to a &file
 *        @sock: socket
 *        @flags: file status flags
 *        @dname: protocol name
 *
 *        Returns the &file bound with @sock, implicitly storing it
 *        in sock->file. If dname is %NULL, sets to "".
 *
 *        On failure @sock is released, and an ERR pointer is returned.
 *
 *        This function uses GFP_KERNEL internally.
 */

struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
{
        struct file *file;

        if (!dname)
                dname = sock->sk ? sock->sk->sk_prot_creator->name : "";

        file = alloc_file_pseudo(SOCK_INODE(sock), sock_mnt, dname,
                                O_RDWR | (flags & O_NONBLOCK),
                                &socket_file_ops);
        if (IS_ERR(file)) {
                sock_release(sock);
                return file;
        }

        file->f_mode |= FMODE_NOWAIT;
        sock->file = file;
        file->private_data = sock;
        stream_open(SOCK_INODE(sock), file);
        return file;
}
EXPORT_SYMBOL(sock_alloc_file);

static int sock_map_fd(struct socket *sock, int flags)
{
        struct file *newfile;
        int fd = get_unused_fd_flags(flags);
        if (unlikely(fd < 0)) {
                sock_release(sock);
                return fd;
        }

        newfile = sock_alloc_file(sock, flags, NULL);
        if (!IS_ERR(newfile)) {
                fd_install(fd, newfile);
                return fd;
        }

        put_unused_fd(fd);
        return PTR_ERR(newfile);
}

/**
 *        sock_from_file - Return the &socket bounded to @file.
 *        @file: file
 *
 *        On failure returns %NULL.
 */

struct socket *sock_from_file(struct file *file)
{
        if (file->f_op == &socket_file_ops)
                return file->private_data;        /* set in sock_alloc_file */

        return NULL;
}
EXPORT_SYMBOL(sock_from_file);

/**
 *        sockfd_lookup - Go from a file number to its socket slot
 *        @fd: file handle
 *        @err: pointer to an error code return
 *
 *        The file handle passed in is locked and the socket it is bound
 *        to is returned. If an error occurs the err pointer is overwritten
 *        with a negative errno code and NULL is returned. The function checks
 *        for both invalid handles and passing a handle which is not a socket.
 *
 *        On a success the socket object pointer is returned.
 */

struct socket *sockfd_lookup(int fd, int *err)
{
        struct file *file;
        struct socket *sock;

        file = fget(fd);
        if (!file) {
                *err = -EBADF;
                return NULL;
        }

        sock = sock_from_file(file);
        if (!sock) {
                *err = -ENOTSOCK;
                fput(file);
        }
        return sock;
}
EXPORT_SYMBOL(sockfd_lookup);

static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
{
        struct fd f = fdget(fd);
        struct socket *sock;

        *err = -EBADF;
        if (fd_file(f)) {
                sock = sock_from_file(fd_file(f));
                if (likely(sock)) {
                        *fput_needed = f.word & FDPUT_FPUT;
                        return sock;
                }
                *err = -ENOTSOCK;
                fdput(f);
        }
        return NULL;
}

static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
                                size_t size)
{
        ssize_t len;
        ssize_t used = 0;

        len = security_inode_listsecurity(d_inode(dentry), buffer, size);
        if (len < 0)
                return len;
        used += len;
        if (buffer) {
                if (size < used)
                        return -ERANGE;
                buffer += len;
        }

        len = (XATTR_NAME_SOCKPROTONAME_LEN + 1);
        used += len;
        if (buffer) {
                if (size < used)
                        return -ERANGE;
                memcpy(buffer, XATTR_NAME_SOCKPROTONAME, len);
                buffer += len;
        }

        return used;
}

static int sockfs_setattr(struct mnt_idmap *idmap,
                          struct dentry *dentry, struct iattr *iattr)
{
        int err = simple_setattr(&nop_mnt_idmap, dentry, iattr);

        if (!err && (iattr->ia_valid & ATTR_UID)) {
                struct socket *sock = SOCKET_I(d_inode(dentry));

                if (sock->sk)
                        sock->sk->sk_uid = iattr->ia_uid;
                else
                        err = -ENOENT;
        }

        return err;
}

static const struct inode_operations sockfs_inode_ops = {
        .listxattr = sockfs_listxattr,
        .setattr = sockfs_setattr,
};

/**
 *        sock_alloc - allocate a socket
 *
 *        Allocate a new inode and socket object. The two are bound together
 *        and initialised. The socket is then returned. If we are out of inodes
 *        NULL is returned. This functions uses GFP_KERNEL internally.
 */

struct socket *sock_alloc(void)
{
        struct inode *inode;
        struct socket *sock;

        inode = new_inode_pseudo(sock_mnt->mnt_sb);
        if (!inode)
                return NULL;

        sock = SOCKET_I(inode);

        inode->i_ino = get_next_ino();
        inode->i_mode = S_IFSOCK | S_IRWXUGO;
        inode->i_uid = current_fsuid();
        inode->i_gid = current_fsgid();
        inode->i_op = &sockfs_inode_ops;

        return sock;
}
EXPORT_SYMBOL(sock_alloc);

static void __sock_release(struct socket *sock, struct inode *inode)
{
        const struct proto_ops *ops = READ_ONCE(sock->ops);

        if (ops) {
                struct module *owner = ops->owner;

                if (inode)
                        inode_lock(inode);
                ops->release(sock);
                sock->sk = NULL;
                if (inode)
                        inode_unlock(inode);
                sock->ops = NULL;
                module_put(owner);
        }

        if (sock->wq.fasync_list)
                pr_err("%s: fasync list not empty!\n", __func__);

        if (!sock->file) {
                iput(SOCK_INODE(sock));
                return;
        }
        sock->file = NULL;
}

/**
 *        sock_release - close a socket
 *        @sock: socket to close
 *
 *        The socket is released from the protocol stack if it has a release
 *        callback, and the inode is then released if the socket is bound to
 *        an inode not a file.
 */
void sock_release(struct socket *sock)
{
        __sock_release(sock, NULL);
}
EXPORT_SYMBOL(sock_release);

void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
{
        u8 flags = *tx_flags;

        if (tsflags & SOF_TIMESTAMPING_TX_HARDWARE) {
                flags |= SKBTX_HW_TSTAMP;

                /* PTP hardware clocks can provide a free running cycle counter
                 * as a time base for virtual clocks. Tell driver to use the
                 * free running cycle counter for timestamp if socket is bound
                 * to virtual clock.
                 */
                if (tsflags & SOF_TIMESTAMPING_BIND_PHC)
                        flags |= SKBTX_HW_TSTAMP_USE_CYCLES;
        }

        if (tsflags & SOF_TIMESTAMPING_TX_SOFTWARE)
                flags |= SKBTX_SW_TSTAMP;

        if (tsflags & SOF_TIMESTAMPING_TX_SCHED)
                flags |= SKBTX_SCHED_TSTAMP;

        *tx_flags = flags;
}
EXPORT_SYMBOL(__sock_tx_timestamp);

INDIRECT_CALLABLE_DECLARE(int inet_sendmsg(struct socket *, struct msghdr *,
                                           size_t));
INDIRECT_CALLABLE_DECLARE(int inet6_sendmsg(struct socket *, struct msghdr *,
                                            size_t));

static noinline void call_trace_sock_send_length(struct sock *sk, int ret,
                                                 int flags)
{
        trace_sock_send_length(sk, ret, 0);
}

static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
{
        int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->sendmsg, inet6_sendmsg,
                                     inet_sendmsg, sock, msg,
                                     msg_data_left(msg));
        BUG_ON(ret == -EIOCBQUEUED);

        if (trace_sock_send_length_enabled())
                call_trace_sock_send_length(sock->sk, ret, 0);
        return ret;
}

static int __sock_sendmsg(struct socket *sock, struct msghdr *msg)
{
        int err = security_socket_sendmsg(sock, msg,
                                          msg_data_left(msg));

        return err ?: sock_sendmsg_nosec(sock, msg);
}

/**
 *        sock_sendmsg - send a message through @sock
 *        @sock: socket
 *        @msg: message to send
 *
 *        Sends @msg through @sock, passing through LSM.
 *        Returns the number of bytes sent, or an error code.
 */
int sock_sendmsg(struct socket *sock, struct msghdr *msg)
{
        struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name;
        struct sockaddr_storage address;
        int save_len = msg->msg_namelen;
        int ret;

        if (msg->msg_name) {
                memcpy(&address, msg->msg_name, msg->msg_namelen);
                msg->msg_name = &address;
        }

        ret = __sock_sendmsg(sock, msg);
        msg->msg_name = save_addr;
        msg->msg_namelen = save_len;

        return ret;
}
EXPORT_SYMBOL(sock_sendmsg);

/**
 *        kernel_sendmsg - send a message through @sock (kernel-space)
 *        @sock: socket
 *        @msg: message header
 *        @vec: kernel vec
 *        @num: vec array length
 *        @size: total message data size
 *
 *        Builds the message data with @vec and sends it through @sock.
 *        Returns the number of bytes sent, or an error code.
 */

int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
                   struct kvec *vec, size_t num, size_t size)
{
        iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size);
        return sock_sendmsg(sock, msg);
}
EXPORT_SYMBOL(kernel_sendmsg);

/**
 *        kernel_sendmsg_locked - send a message through @sock (kernel-space)
 *        @sk: sock
 *        @msg: message header
 *        @vec: output s/g array
 *        @num: output s/g array length
 *        @size: total message data size
 *
 *        Builds the message data with @vec and sends it through @sock.
 *        Returns the number of bytes sent, or an error code.
 *        Caller must hold @sk.
 */

int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
                          struct kvec *vec, size_t num, size_t size)
{
        struct socket *sock = sk->sk_socket;
        const struct proto_ops *ops = READ_ONCE(sock->ops);

        if (!ops->sendmsg_locked)
                return sock_no_sendmsg_locked(sk, msg, size);

        iov_iter_kvec(&msg->msg_iter, ITER_SOURCE, vec, num, size);

        return ops->sendmsg_locked(sk, msg, msg_data_left(msg));
}
EXPORT_SYMBOL(kernel_sendmsg_locked);

static bool skb_is_err_queue(const struct sk_buff *skb)
{
        /* pkt_type of skbs enqueued on the error queue are set to
         * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
         * in recvmsg, since skbs received on a local socket will never
         * have a pkt_type of PACKET_OUTGOING.
         */
        return skb->pkt_type == PACKET_OUTGOING;
}

/* On transmit, software and hardware timestamps are returned independently.
 * As the two skb clones share the hardware timestamp, which may be updated
 * before the software timestamp is received, a hardware TX timestamp may be
 * returned only if there is no software TX timestamp. Ignore false software
 * timestamps, which may be made in the __sock_recv_timestamp() call when the
 * option SO_TIMESTAMP_OLD(NS) is enabled on the socket, even when the skb has a
 * hardware timestamp.
 */
static bool skb_is_swtx_tstamp(const struct sk_buff *skb, int false_tstamp)
{
        return skb->tstamp && !false_tstamp && skb_is_err_queue(skb);
}

static ktime_t get_timestamp(struct sock *sk, struct sk_buff *skb, int *if_index)
{
        bool cycles = READ_ONCE(sk->sk_tsflags) & SOF_TIMESTAMPING_BIND_PHC;
        struct skb_shared_hwtstamps *shhwtstamps = skb_hwtstamps(skb);
        struct net_device *orig_dev;
        ktime_t hwtstamp;

        rcu_read_lock();
        orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
        if (orig_dev) {
                *if_index = orig_dev->ifindex;
                hwtstamp = netdev_get_tstamp(orig_dev, shhwtstamps, cycles);
        } else {
                hwtstamp = shhwtstamps->hwtstamp;
        }
        rcu_read_unlock();

        return hwtstamp;
}

static void put_ts_pktinfo(struct msghdr *msg, struct sk_buff *skb,
                           int if_index)
{
        struct scm_ts_pktinfo ts_pktinfo;
        struct net_device *orig_dev;

        if (!skb_mac_header_was_set(skb))
                return;

        memset(&ts_pktinfo, 0, sizeof(ts_pktinfo));

        if (!if_index) {
                rcu_read_lock();
                orig_dev = dev_get_by_napi_id(skb_napi_id(skb));
                if (orig_dev)
                        if_index = orig_dev->ifindex;
                rcu_read_unlock();
        }
        ts_pktinfo.if_index = if_index;

        ts_pktinfo.pkt_length = skb->len - skb_mac_offset(skb);
        put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_PKTINFO,
                 sizeof(ts_pktinfo), &ts_pktinfo);
}

/*
 * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
 */
void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
        struct sk_buff *skb)
{
        int need_software_tstamp = sock_flag(sk, SOCK_RCVTSTAMP);
        int new_tstamp = sock_flag(sk, SOCK_TSTAMP_NEW);
        struct scm_timestamping_internal tss;
        int empty = 1, false_tstamp = 0;
        struct skb_shared_hwtstamps *shhwtstamps =
                skb_hwtstamps(skb);
        int if_index;
        ktime_t hwtstamp;
        u32 tsflags;

        /* Race occurred between timestamp enabling and packet
           receiving.  Fill in the current time for now. */
        if (need_software_tstamp && skb->tstamp == 0) {
                __net_timestamp(skb);
                false_tstamp = 1;
        }

        if (need_software_tstamp) {
                if (!sock_flag(sk, SOCK_RCVTSTAMPNS)) {
                        if (new_tstamp) {
                                struct __kernel_sock_timeval tv;

                                skb_get_new_timestamp(skb, &tv);
                                put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_NEW,
                                         sizeof(tv), &tv);
                        } else {
                                struct __kernel_old_timeval tv;

                                skb_get_timestamp(skb, &tv);
                                put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP_OLD,
                                         sizeof(tv), &tv);
                        }
                } else {
                        if (new_tstamp) {
                                struct __kernel_timespec ts;

                                skb_get_new_timestampns(skb, &ts);
                                put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_NEW,
                                         sizeof(ts), &ts);
                        } else {
                                struct __kernel_old_timespec ts;

                                skb_get_timestampns(skb, &ts);
                                put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPNS_OLD,
                                         sizeof(ts), &ts);
                        }
                }
        }

        memset(&tss, 0, sizeof(tss));
        tsflags = READ_ONCE(sk->sk_tsflags);
        if ((tsflags & SOF_TIMESTAMPING_SOFTWARE &&
             (tsflags & SOF_TIMESTAMPING_RX_SOFTWARE ||
              skb_is_err_queue(skb) ||
              !(tsflags & SOF_TIMESTAMPING_OPT_RX_FILTER))) &&
            ktime_to_timespec64_cond(skb->tstamp, tss.ts + 0))
                empty = 0;
        if (shhwtstamps &&
            (tsflags & SOF_TIMESTAMPING_RAW_HARDWARE &&
             (tsflags & SOF_TIMESTAMPING_RX_HARDWARE ||
              skb_is_err_queue(skb) ||
              !(tsflags & SOF_TIMESTAMPING_OPT_RX_FILTER))) &&
            !skb_is_swtx_tstamp(skb, false_tstamp)) {
                if_index = 0;
                if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP_NETDEV)
                        hwtstamp = get_timestamp(sk, skb, &if_index);
                else
                        hwtstamp = shhwtstamps->hwtstamp;

                if (tsflags & SOF_TIMESTAMPING_BIND_PHC)
                        hwtstamp = ptp_convert_timestamp(&hwtstamp,
                                                         READ_ONCE(sk->sk_bind_phc));

                if (ktime_to_timespec64_cond(hwtstamp, tss.ts + 2)) {
                        empty = 0;

                        if ((tsflags & SOF_TIMESTAMPING_OPT_PKTINFO) &&
                            !skb_is_err_queue(skb))
                                put_ts_pktinfo(msg, skb, if_index);
                }
        }
        if (!empty) {
                if (sock_flag(sk, SOCK_TSTAMP_NEW))
                        put_cmsg_scm_timestamping64(msg, &tss);
                else
                        put_cmsg_scm_timestamping(msg, &tss);

                if (skb_is_err_queue(skb) && skb->len &&
                    SKB_EXT_ERR(skb)->opt_stats)
                        put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
                                 skb->len, skb->data);
        }
}
EXPORT_SYMBOL_GPL(__sock_recv_timestamp);

#ifdef CONFIG_WIRELESS
void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
        struct sk_buff *skb)
{
        int ack;

        if (!sock_flag(sk, SOCK_WIFI_STATUS))
                return;
        if (!skb->wifi_acked_valid)
                return;

        ack = skb->wifi_acked;

        put_cmsg(msg, SOL_SOCKET, SCM_WIFI_STATUS, sizeof(ack), &ack);
}
EXPORT_SYMBOL_GPL(__sock_recv_wifi_status);
#endif

static inline void sock_recv_drops(struct msghdr *msg, struct sock *sk,
                                   struct sk_buff *skb)
{
        if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && SOCK_SKB_CB(skb)->dropcount)
                put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
                        sizeof(__u32), &SOCK_SKB_CB(skb)->dropcount);
}

static void sock_recv_mark(struct msghdr *msg, struct sock *sk,
                           struct sk_buff *skb)
{
        if (sock_flag(sk, SOCK_RCVMARK) && skb) {
                /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
                __u32 mark = skb->mark;

                put_cmsg(msg, SOL_SOCKET, SO_MARK, sizeof(__u32), &mark);
        }
}

void __sock_recv_cmsgs(struct msghdr *msg, struct sock *sk,
                       struct sk_buff *skb)
{
        sock_recv_timestamp(msg, sk, skb);
        sock_recv_drops(msg, sk, skb);
        sock_recv_mark(msg, sk, skb);
}
EXPORT_SYMBOL_GPL(__sock_recv_cmsgs);

INDIRECT_CALLABLE_DECLARE(int inet_recvmsg(struct socket *, struct msghdr *,
                                           size_t, int));
INDIRECT_CALLABLE_DECLARE(int inet6_recvmsg(struct socket *, struct msghdr *,
                                            size_t, int));

static noinline void call_trace_sock_recv_length(struct sock *sk, int ret, int flags)
{
        trace_sock_recv_length(sk, ret, flags);
}

static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
                                     int flags)
{
        int ret = INDIRECT_CALL_INET(READ_ONCE(sock->ops)->recvmsg,
                                     inet6_recvmsg,
                                     inet_recvmsg, sock, msg,
                                     msg_data_left(msg), flags);
        if (trace_sock_recv_length_enabled())
                call_trace_sock_recv_length(sock->sk, ret, flags);
        return ret;
}

/**
 *        sock_recvmsg - receive a message from @sock
 *        @sock: socket
 *        @msg: message to receive
 *        @flags: message flags
 *
 *        Receives @msg from @sock, passing through LSM. Returns the total number
 *        of bytes received, or an error.
 */
int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
{
        int err = security_socket_recvmsg(sock, msg, msg_data_left(msg), flags);

        return err ?: sock_recvmsg_nosec(sock, msg, flags);
}
EXPORT_SYMBOL(sock_recvmsg);

/**
 *        kernel_recvmsg - Receive a message from a socket (kernel space)
 *        @sock: The socket to receive the message from
 *        @msg: Received message
 *        @vec: Input s/g array for message data
 *        @num: Size of input s/g array
 *        @size: Number of bytes to read
 *        @flags: Message flags (MSG_DONTWAIT, etc...)
 *
 *        On return the msg structure contains the scatter/gather array passed in the
 *        vec argument. The array is modified so that it consists of the unfilled
 *        portion of the original array.
 *
 *        The returned value is the total number of bytes received, or an error.
 */

int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
                   struct kvec *vec, size_t num, size_t size, int flags)
{
        msg->msg_control_is_user = false;
        iov_iter_kvec(&msg->msg_iter, ITER_DEST, vec, num, size);
        return sock_recvmsg(sock, msg, flags);
}
EXPORT_SYMBOL(kernel_recvmsg);

static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
                                struct pipe_inode_info *pipe, size_t len,
                                unsigned int flags)
{
        struct socket *sock = file->private_data;
        const struct proto_ops *ops;

        ops = READ_ONCE(sock->ops);
        if (unlikely(!ops->splice_read))
                return copy_splice_read(file, ppos, pipe, len, flags);

        return ops->splice_read(sock, ppos, pipe, len, flags);
}

static void sock_splice_eof(struct file *file)
{
        struct socket *sock = file->private_data;
        const struct proto_ops *ops;

        ops = READ_ONCE(sock->ops);
        if (ops->splice_eof)
                ops->splice_eof(sock);
}

static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
{
        struct file *file = iocb->ki_filp;
        struct socket *sock = file->private_data;
        struct msghdr msg = {.msg_iter = *to,
                             .msg_iocb = iocb};
        ssize_t res;

        if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
                msg.msg_flags = MSG_DONTWAIT;

        if (iocb->ki_pos != 0)
                return -ESPIPE;

        if (!iov_iter_count(to))        /* Match SYS5 behaviour */
                return 0;

        res = sock_recvmsg(sock, &msg, msg.msg_flags);
        *to = msg.msg_iter;
        return res;
}

static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
{
        struct file *file = iocb->ki_filp;
        struct socket *sock = file->private_data;
        struct msghdr msg = {.msg_iter = *from,
                             .msg_iocb = iocb};
        ssize_t res;

        if (iocb->ki_pos != 0)
                return -ESPIPE;

        if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
                msg.msg_flags = MSG_DONTWAIT;

        if (sock->type == SOCK_SEQPACKET)
                msg.msg_flags |= MSG_EOR;

        res = __sock_sendmsg(sock, &msg);
        *from = msg.msg_iter;
        return res;
}

/*
 * Atomic setting of ioctl hooks to avoid race
 * with module unload.
 */

static DEFINE_MUTEX(br_ioctl_mutex);
static int (*br_ioctl_hook)(struct net *net, struct net_bridge *br,
                            unsigned int cmd, struct ifreq *ifr,
                            void __user *uarg);

void brioctl_set(int (*hook)(struct net *net, struct net_bridge *br,
                             unsigned int cmd, struct ifreq *ifr,
                             void __user *uarg))
{
        mutex_lock(&br_ioctl_mutex);
        br_ioctl_hook = hook;
        mutex_unlock(&br_ioctl_mutex);
}
EXPORT_SYMBOL(brioctl_set);

int br_ioctl_call(struct net *net, struct net_bridge *br, unsigned int cmd,
                  struct ifreq *ifr, void __user *uarg)
{
        int err = -ENOPKG;

        if (!br_ioctl_hook)
                request_module("bridge");

        mutex_lock(&br_ioctl_mutex);
        if (br_ioctl_hook)
                err = br_ioctl_hook(net, br, cmd, ifr, uarg);
        mutex_unlock(&br_ioctl_mutex);

        return err;
}

static DEFINE_MUTEX(vlan_ioctl_mutex);
static int (*vlan_ioctl_hook) (struct net *, void __user *arg);

void vlan_ioctl_set(int (*hook) (struct net *, void __user *))
{
        mutex_lock(&vlan_ioctl_mutex);
        vlan_ioctl_hook = hook;
        mutex_unlock(&vlan_ioctl_mutex);
}
EXPORT_SYMBOL(vlan_ioctl_set);

static long sock_do_ioctl(struct net *net, struct socket *sock,
                          unsigned int cmd, unsigned long arg)
{
        const struct proto_ops *ops = READ_ONCE(sock->ops);
        struct ifreq ifr;
        bool need_copyout;
        int err;
        void __user *argp = (void __user *)arg;
        void __user *data;

        err = ops->ioctl(sock, cmd, arg);

        /*
         * If this ioctl is unknown try to hand it down
         * to the NIC driver.
         */
        if (err != -ENOIOCTLCMD)
                return err;

        if (!is_socket_ioctl_cmd(cmd))
                return -ENOTTY;

        if (get_user_ifreq(&ifr, &data, argp))
                return -EFAULT;
        err = dev_ioctl(net, cmd, &ifr, data, &need_copyout);
        if (!err && need_copyout)
                if (put_user_ifreq(&ifr, argp))
                        return -EFAULT;

        return err;
}

/*
 *        With an ioctl, arg may well be a user mode pointer, but we don't know
 *        what to do with it - that's up to the protocol still.
 */

static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
{
        const struct proto_ops  *ops;
        struct socket *sock;
        struct sock *sk;
        void __user *argp = (void __user *)arg;
        int pid, err;
        struct net *net;

        sock = file->private_data;
        ops = READ_ONCE(sock->ops);
        sk = sock->sk;
        net = sock_net(sk);
        if (unlikely(cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))) {
                struct ifreq ifr;
                void __user *data;
                bool need_copyout;
                if (get_user_ifreq(&ifr, &data, argp))
                        return -EFAULT;
                err = dev_ioctl(net, cmd, &ifr, data, &need_copyout);
                if (!err && need_copyout)
                        if (put_user_ifreq(&ifr, argp))
                                return -EFAULT;
        } else
#ifdef CONFIG_WEXT_CORE
        if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
                err = wext_handle_ioctl(net, cmd, argp);
        } else
#endif
                switch (cmd) {
                case FIOSETOWN:
                case SIOCSPGRP:
                        err = -EFAULT;
                        if (get_user(pid, (int __user *)argp))
                                break;
                        err = f_setown(sock->file, pid, 1);
                        break;
                case FIOGETOWN:
                case SIOCGPGRP:
                        err = put_user(f_getown(sock->file),
                                       (int __user *)argp);
                        break;
                case SIOCGIFBR:
                case SIOCSIFBR:
                case SIOCBRADDBR:
                case SIOCBRDELBR:
                        err = br_ioctl_call(net, NULL, cmd, NULL, argp);
                        break;
                case SIOCGIFVLAN:
                case SIOCSIFVLAN:
                        err = -ENOPKG;
                        if (!vlan_ioctl_hook)
                                request_module("8021q");

                        mutex_lock(&vlan_ioctl_mutex);
                        if (vlan_ioctl_hook)
                                err = vlan_ioctl_hook(net, argp);
                        mutex_unlock(&vlan_ioctl_mutex);
                        break;
                case SIOCGSKNS:
                        err = -EPERM;
                        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                                break;

                        err = open_related_ns(&net->ns, get_net_ns);
                        break;
                case SIOCGSTAMP_OLD:
                case SIOCGSTAMPNS_OLD:
                        if (!ops->gettstamp) {
                                err = -ENOIOCTLCMD;
                                break;
                        }
                        err = ops->gettstamp(sock, argp,
                                             cmd == SIOCGSTAMP_OLD,
                                             !IS_ENABLED(CONFIG_64BIT));
                        break;
                case SIOCGSTAMP_NEW:
                case SIOCGSTAMPNS_NEW:
                        if (!ops->gettstamp) {
                                err = -ENOIOCTLCMD;
                                break;
                        }
                        err = ops->gettstamp(sock, argp,
                                             cmd == SIOCGSTAMP_NEW,
                                             false);
                        break;

                case SIOCGIFCONF:
                        err = dev_ifconf(net, argp);
                        break;

                default:
                        err = sock_do_ioctl(net, sock, cmd, arg);
                        break;
                }
        return err;
}

/**
 *        sock_create_lite - creates a socket
 *        @family: protocol family (AF_INET, ...)
 *        @type: communication type (SOCK_STREAM, ...)
 *        @protocol: protocol (0, ...)
 *        @res: new socket
 *
 *        Creates a new socket and assigns it to @res, passing through LSM.
 *        The new socket initialization is not complete, see kernel_accept().
 *        Returns 0 or an error. On failure @res is set to %NULL.
 *        This function internally uses GFP_KERNEL.
 */

int sock_create_lite(int family, int type, int protocol, struct socket **res)
{
        int err;
        struct socket *sock = NULL;

        err = security_socket_create(family, type, protocol, 1);
        if (err)
                goto out;

        sock = sock_alloc();
        if (!sock) {
                err = -ENOMEM;
                goto out;
        }

        sock->type = type;
        err = security_socket_post_create(sock, family, type, protocol, 1);
        if (err)
                goto out_release;

out:
        *res = sock;
        return err;
out_release:
        sock_release(sock);
        sock = NULL;
        goto out;
}
EXPORT_SYMBOL(sock_create_lite);

/* No kernel lock held - perfect */
static __poll_t sock_poll(struct file *file, poll_table *wait)
{
        struct socket *sock = file->private_data;
        const struct proto_ops *ops = READ_ONCE(sock->ops);
        __poll_t events = poll_requested_events(wait), flag = 0;

        if (!ops->poll)
                return 0;

        if (sk_can_busy_loop(sock->sk)) {
                /* poll once if requested by the syscall */
                if (events & POLL_BUSY_LOOP)
                        sk_busy_loop(sock->sk, 1);

                /* if this socket can poll_ll, tell the system call */
                flag = POLL_BUSY_LOOP;
        }

        return ops->poll(file, sock, wait) | flag;
}

static int sock_mmap(struct file *file, struct vm_area_struct *vma)
{
        struct socket *sock = file->private_data;

        return READ_ONCE(sock->ops)->mmap(file, sock, vma);
}

static int sock_close(struct inode *inode, struct file *filp)
{
        __sock_release(SOCKET_I(inode), inode);
        return 0;
}

/*
 *        Update the socket async list
 *
 *        Fasync_list locking strategy.
 *
 *        1. fasync_list is modified only under process context socket lock
 *           i.e. under semaphore.
 *        2. fasync_list is used under read_lock(&sk->sk_callback_lock)
 *           or under socket lock
 */

static int sock_fasync(int fd, struct file *filp, int on)
{
        struct socket *sock = filp->private_data;
        struct sock *sk = sock->sk;
        struct socket_wq *wq = &sock->wq;

        if (sk == NULL)
                return -EINVAL;

        lock_sock(sk);
        fasync_helper(fd, filp, on, &wq->fasync_list);

        if (!wq->fasync_list)
                sock_reset_flag(sk, SOCK_FASYNC);
        else
                sock_set_flag(sk, SOCK_FASYNC);

        release_sock(sk);
        return 0;
}

/* This function may be called only under rcu_lock */

int sock_wake_async(struct socket_wq *wq, int how, int band)
{
        if (!wq || !wq->fasync_list)
                return -1;

        switch (how) {
        case SOCK_WAKE_WAITD:
                if (test_bit(SOCKWQ_ASYNC_WAITDATA, &wq->flags))
                        break;
                goto call_kill;
        case SOCK_WAKE_SPACE:
                if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags))
                        break;
                fallthrough;
        case SOCK_WAKE_IO:
call_kill:
                kill_fasync(&wq->fasync_list, SIGIO, band);
                break;
        case SOCK_WAKE_URG:
                kill_fasync(&wq->fasync_list, SIGURG, band);
        }

        return 0;
}
EXPORT_SYMBOL(sock_wake_async);

/**
 *        __sock_create - creates a socket
 *        @net: net namespace
 *        @family: protocol family (AF_INET, ...)
 *        @type: communication type (SOCK_STREAM, ...)
 *        @protocol: protocol (0, ...)
 *        @res: new socket
 *        @kern: boolean for kernel space sockets
 *
 *        Creates a new socket and assigns it to @res, passing through LSM.
 *        Returns 0 or an error. On failure @res is set to %NULL. @kern must
 *        be set to true if the socket resides in kernel space.
 *        This function internally uses GFP_KERNEL.
 */

int __sock_create(struct net *net, int family, int type, int protocol,
                         struct socket **res, int kern)
{
        int err;
        struct socket *sock;
        const struct net_proto_family *pf;

        /*
         *      Check protocol is in range
         */
        if (family < 0 || family >= NPROTO)
                return -EAFNOSUPPORT;
        if (type < 0 || type >= SOCK_MAX)
                return -EINVAL;

        /* Compatibility.

           This uglymoron is moved from INET layer to here to avoid
           deadlock in module load.
         */
        if (family == PF_INET && type == SOCK_PACKET) {
                pr_info_once("%s uses obsolete (PF_INET,SOCK_PACKET)\n",
                             current->comm);
                family = PF_PACKET;
        }

        err = security_socket_create(family, type, protocol, kern);
        if (err)
                return err;

        /*
         *        Allocate the socket and allow the family to set things up. if
         *        the protocol is 0, the family is instructed to select an appropriate
         *        default.
         */
        sock = sock_alloc();
        if (!sock) {
                net_warn_ratelimited("socket: no more sockets\n");
                return -ENFILE;        /* Not exactly a match, but its the
                                   closest posix thing */
        }

        sock->type = type;

#ifdef CONFIG_MODULES
        /* Attempt to load a protocol module if the find failed.
         *
         * 12/09/1996 Marcin: But! this makes REALLY only sense, if the user
         * requested real, full-featured networking support upon configuration.
         * Otherwise module support will break!
         */
        if (rcu_access_pointer(net_families[family]) == NULL)
                request_module("net-pf-%d", family);
#endif

        rcu_read_lock();
        pf = rcu_dereference(net_families[family]);
        err = -EAFNOSUPPORT;
        if (!pf)
                goto out_release;

        /*
         * We will call the ->create function, that possibly is in a loadable
         * module, so we have to bump that loadable module refcnt first.
         */
        if (!try_module_get(pf->owner))
                goto out_release;

        /* Now protected by module ref count */
        rcu_read_unlock();

        err = pf->create(net, sock, protocol, kern);
        if (err < 0)
                goto out_module_put;

        /*
         * Now to bump the refcnt of the [loadable] module that owns this
         * socket at sock_release time we decrement its refcnt.
         */
        if (!try_module_get(sock->ops->owner))
                goto out_module_busy;

        /*
         * Now that we're done with the ->create function, the [loadable]
         * module can have its refcnt decremented
         */
        module_put(pf->owner);
        err = security_socket_post_create(sock, family, type, protocol, kern);
        if (err)
                goto out_sock_release;
        *res = sock;

        return 0;

out_module_busy:
        err = -EAFNOSUPPORT;
out_module_put:
        sock->ops = NULL;
        module_put(pf->owner);
out_sock_release:
        sock_release(sock);
        return err;

out_release:
        rcu_read_unlock();
        goto out_sock_release;
}
EXPORT_SYMBOL(__sock_create);

/**
 *        sock_create - creates a socket
 *        @family: protocol family (AF_INET, ...)
 *        @type: communication type (SOCK_STREAM, ...)
 *        @protocol: protocol (0, ...)
 *        @res: new socket
 *
 *        A wrapper around __sock_create().
 *        Returns 0 or an error. This function internally uses GFP_KERNEL.
 */

int sock_create(int family, int type, int protocol, struct socket **res)
{
        return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
}
EXPORT_SYMBOL(sock_create);

/**
 *        sock_create_kern - creates a socket (kernel space)
 *        @net: net namespace
 *        @family: protocol family (AF_INET, ...)
 *        @type: communication type (SOCK_STREAM, ...)
 *        @protocol: protocol (0, ...)
 *        @res: new socket
 *
 *        A wrapper around __sock_create().
 *        Returns 0 or an error. This function internally uses GFP_KERNEL.
 */

int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
{
        return __sock_create(net, family, type, protocol, res, 1);
}
EXPORT_SYMBOL(sock_create_kern);

static struct socket *__sys_socket_create(int family, int type, int protocol)
{
        struct socket *sock;
        int retval;

        /* Check the SOCK_* constants for consistency.  */
        BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
        BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
        BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
        BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);

        if ((type & ~SOCK_TYPE_MASK) & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
                return ERR_PTR(-EINVAL);
        type &= SOCK_TYPE_MASK;

        retval = sock_create(family, type, protocol, &sock);
        if (retval < 0)
                return ERR_PTR(retval);

        return sock;
}

struct file *__sys_socket_file(int family, int type, int protocol)
{
        struct socket *sock;
        int flags;

        sock = __sys_socket_create(family, type, protocol);
        if (IS_ERR(sock))
                return ERR_CAST(sock);

        flags = type & ~SOCK_TYPE_MASK;
        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

        return sock_alloc_file(sock, flags, NULL);
}

/*        A hook for bpf progs to attach to and update socket protocol.
 *
 *        A static noinline declaration here could cause the compiler to
 *        optimize away the function. A global noinline declaration will
 *        keep the definition, but may optimize away the callsite.
 *        Therefore, __weak is needed to ensure that the call is still
 *        emitted, by telling the compiler that we don't know what the
 *        function might eventually be.
 */

__bpf_hook_start();

__weak noinline int update_socket_protocol(int family, int type, int protocol)
{
        return protocol;
}

__bpf_hook_end();

int __sys_socket(int family, int type, int protocol)
{
        struct socket *sock;
        int flags;

        sock = __sys_socket_create(family, type,
                                   update_socket_protocol(family, type, protocol));
        if (IS_ERR(sock))
                return PTR_ERR(sock);

        flags = type & ~SOCK_TYPE_MASK;
        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

        return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
}

SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
{
        return __sys_socket(family, type, protocol);
}

/*
 *        Create a pair of connected sockets.
 */

int __sys_socketpair(int family, int type, int protocol, int __user *usockvec)
{
        struct socket *sock1, *sock2;
        int fd1, fd2, err;
        struct file *newfile1, *newfile2;
        int flags;

        flags = type & ~SOCK_TYPE_MASK;
        if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
                return -EINVAL;
        type &= SOCK_TYPE_MASK;

        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

        /*
         * reserve descriptors and make sure we won't fail
         * to return them to userland.
         */
        fd1 = get_unused_fd_flags(flags);
        if (unlikely(fd1 < 0))
                return fd1;

        fd2 = get_unused_fd_flags(flags);
        if (unlikely(fd2 < 0)) {
                put_unused_fd(fd1);
                return fd2;
        }

        err = put_user(fd1, &usockvec[0]);
        if (err)
                goto out;

        err = put_user(fd2, &usockvec[1]);
        if (err)
                goto out;

        /*
         * Obtain the first socket and check if the underlying protocol
         * supports the socketpair call.
         */

        err = sock_create(family, type, protocol, &sock1);
        if (unlikely(err < 0))
                goto out;

        err = sock_create(family, type, protocol, &sock2);
        if (unlikely(err < 0)) {
                sock_release(sock1);
                goto out;
        }

        err = security_socket_socketpair(sock1, sock2);
        if (unlikely(err)) {
                sock_release(sock2);
                sock_release(sock1);
                goto out;
        }

        err = READ_ONCE(sock1->ops)->socketpair(sock1, sock2);
        if (unlikely(err < 0)) {
                sock_release(sock2);
                sock_release(sock1);
                goto out;
        }

        newfile1 = sock_alloc_file(sock1, flags, NULL);
        if (IS_ERR(newfile1)) {
                err = PTR_ERR(newfile1);
                sock_release(sock2);
                goto out;
        }

        newfile2 = sock_alloc_file(sock2, flags, NULL);
        if (IS_ERR(newfile2)) {
                err = PTR_ERR(newfile2);
                fput(newfile1);
                goto out;
        }

        audit_fd_pair(fd1, fd2);

        fd_install(fd1, newfile1);
        fd_install(fd2, newfile2);
        return 0;

out:
        put_unused_fd(fd2);
        put_unused_fd(fd1);
        return err;
}

SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
                int __user *, usockvec)
{
        return __sys_socketpair(family, type, protocol, usockvec);
}

int __sys_bind_socket(struct socket *sock, struct sockaddr_storage *address,
                      int addrlen)
{
        int err;

        err = security_socket_bind(sock, (struct sockaddr *)address,
                                   addrlen);
        if (!err)
                err = READ_ONCE(sock->ops)->bind(sock,
                                                 (struct sockaddr *)address,
                                                 addrlen);
        return err;
}

/*
 *        Bind a name to a socket. Nothing much to do here since it's
 *        the protocol's responsibility to handle the local address.
 *
 *        We move the socket address to kernel space before we call
 *        the protocol layer (having also checked the address is ok).
 */

int __sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
{
        struct socket *sock;
        struct sockaddr_storage address;
        int err, fput_needed;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (sock) {
                err = move_addr_to_kernel(umyaddr, addrlen, &address);
                if (!err)
                        err = __sys_bind_socket(sock, &address, addrlen);
                fput_light(sock->file, fput_needed);
        }
        return err;
}

SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
{
        return __sys_bind(fd, umyaddr, addrlen);
}

/*
 *        Perform a listen. Basically, we allow the protocol to do anything
 *        necessary for a listen, and if that works, we mark the socket as
 *        ready for listening.
 */
int __sys_listen_socket(struct socket *sock, int backlog)
{
        int somaxconn, err;

        somaxconn = READ_ONCE(sock_net(sock->sk)->core.sysctl_somaxconn);
        if ((unsigned int)backlog > somaxconn)
                backlog = somaxconn;

        err = security_socket_listen(sock, backlog);
        if (!err)
                err = READ_ONCE(sock->ops)->listen(sock, backlog);
        return err;
}

int __sys_listen(int fd, int backlog)
{
        struct socket *sock;
        int err, fput_needed;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (sock) {
                err = __sys_listen_socket(sock, backlog);
                fput_light(sock->file, fput_needed);
        }
        return err;
}

SYSCALL_DEFINE2(listen, int, fd, int, backlog)
{
        return __sys_listen(fd, backlog);
}

struct file *do_accept(struct file *file, struct proto_accept_arg *arg,
                       struct sockaddr __user *upeer_sockaddr,
                       int __user *upeer_addrlen, int flags)
{
        struct socket *sock, *newsock;
        struct file *newfile;
        int err, len;
        struct sockaddr_storage address;
        const struct proto_ops *ops;

        sock = sock_from_file(file);
        if (!sock)
                return ERR_PTR(-ENOTSOCK);

        newsock = sock_alloc();
        if (!newsock)
                return ERR_PTR(-ENFILE);
        ops = READ_ONCE(sock->ops);

        newsock->type = sock->type;
        newsock->ops = ops;

        /*
         * We don't need try_module_get here, as the listening socket (sock)
         * has the protocol module (sock->ops->owner) held.
         */
        __module_get(ops->owner);

        newfile = sock_alloc_file(newsock, flags, sock->sk->sk_prot_creator->name);
        if (IS_ERR(newfile))
                return newfile;

        err = security_socket_accept(sock, newsock);
        if (err)
                goto out_fd;

        arg->flags |= sock->file->f_flags;
        err = ops->accept(sock, newsock, arg);
        if (err < 0)
                goto out_fd;

        if (upeer_sockaddr) {
                len = ops->getname(newsock, (struct sockaddr *)&address, 2);
                if (len < 0) {
                        err = -ECONNABORTED;
                        goto out_fd;
                }
                err = move_addr_to_user(&address,
                                        len, upeer_sockaddr, upeer_addrlen);
                if (err < 0)
                        goto out_fd;
        }

        /* File flags are not inherited via accept() unlike another OSes. */
        return newfile;
out_fd:
        fput(newfile);
        return ERR_PTR(err);
}

static int __sys_accept4_file(struct file *file, struct sockaddr __user *upeer_sockaddr,
                              int __user *upeer_addrlen, int flags)
{
        struct proto_accept_arg arg = { };
        struct file *newfile;
        int newfd;

        if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
                return -EINVAL;

        if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
                flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;

        newfd = get_unused_fd_flags(flags);
        if (unlikely(newfd < 0))
                return newfd;

        newfile = do_accept(file, &arg, upeer_sockaddr, upeer_addrlen,
                            flags);
        if (IS_ERR(newfile)) {
                put_unused_fd(newfd);
                return PTR_ERR(newfile);
        }
        fd_install(newfd, newfile);
        return newfd;
}

/*
 *        For accept, we attempt to create a new socket, set up the link
 *        with the client, wake up the client, then return the new
 *        connected fd. We collect the address of the connector in kernel
 *        space and move it to user at the very end. This is unclean because
 *        we open the socket then return an error.
 *
 *        1003.1g adds the ability to recvmsg() to query connection pending
 *        status to recvmsg. We need to add that support in a way thats
 *        clean when we restructure accept also.
 */

int __sys_accept4(int fd, struct sockaddr __user *upeer_sockaddr,
                  int __user *upeer_addrlen, int flags)
{
        int ret = -EBADF;
        struct fd f;

        f = fdget(fd);
        if (fd_file(f)) {
                ret = __sys_accept4_file(fd_file(f), upeer_sockaddr,
                                         upeer_addrlen, flags);
                fdput(f);
        }

        return ret;
}

SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
                int __user *, upeer_addrlen, int, flags)
{
        return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, flags);
}

SYSCALL_DEFINE3(accept, int, fd, struct sockaddr __user *, upeer_sockaddr,
                int __user *, upeer_addrlen)
{
        return __sys_accept4(fd, upeer_sockaddr, upeer_addrlen, 0);
}

/*
 *        Attempt to connect to a socket with the server address.  The address
 *        is in user space so we verify it is OK and move it to kernel space.
 *
 *        For 1003.1g we need to add clean support for a bind to AF_UNSPEC to
 *        break bindings
 *
 *        NOTE: 1003.1g draft 6.3 is broken with respect to AX.25/NetROM and
 *        other SEQPACKET protocols that take time to connect() as it doesn't
 *        include the -EINPROGRESS status for such sockets.
 */

int __sys_connect_file(struct file *file, struct sockaddr_storage *address,
                       int addrlen, int file_flags)
{
        struct socket *sock;
        int err;

        sock = sock_from_file(file);
        if (!sock) {
                err = -ENOTSOCK;
                goto out;
        }

        err =
            security_socket_connect(sock, (struct sockaddr *)address, addrlen);
        if (err)
                goto out;

        err = READ_ONCE(sock->ops)->connect(sock, (struct sockaddr *)address,
                                addrlen, sock->file->f_flags | file_flags);
out:
        return err;
}

int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
{
        int ret = -EBADF;
        struct fd f;

        f = fdget(fd);
        if (fd_file(f)) {
                struct sockaddr_storage address;

                ret = move_addr_to_kernel(uservaddr, addrlen, &address);
                if (!ret)
                        ret = __sys_connect_file(fd_file(f), &address, addrlen, 0);
                fdput(f);
        }

        return ret;
}

SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
                int, addrlen)
{
        return __sys_connect(fd, uservaddr, addrlen);
}

/*
 *        Get the local address ('name') of a socket object. Move the obtained
 *        name to user space.
 */

int __sys_getsockname(int fd, struct sockaddr __user *usockaddr,
                      int __user *usockaddr_len)
{
        struct socket *sock;
        struct sockaddr_storage address;
        int err, fput_needed;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;

        err = security_socket_getsockname(sock);
        if (err)
                goto out_put;

        err = READ_ONCE(sock->ops)->getname(sock, (struct sockaddr *)&address, 0);
        if (err < 0)
                goto out_put;
        /* "err" is actually length in this case */
        err = move_addr_to_user(&address, err, usockaddr, usockaddr_len);

out_put:
        fput_light(sock->file, fput_needed);
out:
        return err;
}

SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
                int __user *, usockaddr_len)
{
        return __sys_getsockname(fd, usockaddr, usockaddr_len);
}

/*
 *        Get the remote address ('name') of a socket object. Move the obtained
 *        name to user space.
 */

int __sys_getpeername(int fd, struct sockaddr __user *usockaddr,
                      int __user *usockaddr_len)
{
        struct socket *sock;
        struct sockaddr_storage address;
        int err, fput_needed;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (sock != NULL) {
                const struct proto_ops *ops = READ_ONCE(sock->ops);

                err = security_socket_getpeername(sock);
                if (err) {
                        fput_light(sock->file, fput_needed);
                        return err;
                }

                err = ops->getname(sock, (struct sockaddr *)&address, 1);
                if (err >= 0)
                        /* "err" is actually length in this case */
                        err = move_addr_to_user(&address, err, usockaddr,
                                                usockaddr_len);
                fput_light(sock->file, fput_needed);
        }
        return err;
}

SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
                int __user *, usockaddr_len)
{
        return __sys_getpeername(fd, usockaddr, usockaddr_len);
}

/*
 *        Send a datagram to a given address. We move the address into kernel
 *        space and check the user space data area is readable before invoking
 *        the protocol.
 */
int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags,
                 struct sockaddr __user *addr,  int addr_len)
{
        struct socket *sock;
        struct sockaddr_storage address;
        int err;
        struct msghdr msg;
        int fput_needed;

        err = import_ubuf(ITER_SOURCE, buff, len, &msg.msg_iter);
        if (unlikely(err))
                return err;
        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;

        msg.msg_name = NULL;
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        msg.msg_namelen = 0;
        msg.msg_ubuf = NULL;
        if (addr) {
                err = move_addr_to_kernel(addr, addr_len, &address);
                if (err < 0)
                        goto out_put;
                msg.msg_name = (struct sockaddr *)&address;
                msg.msg_namelen = addr_len;
        }
        flags &= ~MSG_INTERNAL_SENDMSG_FLAGS;
        if (sock->file->f_flags & O_NONBLOCK)
                flags |= MSG_DONTWAIT;
        msg.msg_flags = flags;
        err = __sock_sendmsg(sock, &msg);

out_put:
        fput_light(sock->file, fput_needed);
out:
        return err;
}

SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
                unsigned int, flags, struct sockaddr __user *, addr,
                int, addr_len)
{
        return __sys_sendto(fd, buff, len, flags, addr, addr_len);
}

/*
 *        Send a datagram down a socket.
 */

SYSCALL_DEFINE4(send, int, fd, void __user *, buff, size_t, len,
                unsigned int, flags)
{
        return __sys_sendto(fd, buff, len, flags, NULL, 0);
}

/*
 *        Receive a frame from the socket and optionally record the address of the
 *        sender. We verify the buffers are writable and if needed move the
 *        sender address from kernel to user space.
 */
int __sys_recvfrom(int fd, void __user *ubuf, size_t size, unsigned int flags,
                   struct sockaddr __user *addr, int __user *addr_len)
{
        struct sockaddr_storage address;
        struct msghdr msg = {
                /* Save some cycles and don't copy the address if not needed */
                .msg_name = addr ? (struct sockaddr *)&address : NULL,
        };
        struct socket *sock;
        int err, err2;
        int fput_needed;

        err = import_ubuf(ITER_DEST, ubuf, size, &msg.msg_iter);
        if (unlikely(err))
                return err;
        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;

        if (sock->file->f_flags & O_NONBLOCK)
                flags |= MSG_DONTWAIT;
        err = sock_recvmsg(sock, &msg, flags);

        if (err >= 0 && addr != NULL) {
                err2 = move_addr_to_user(&address,
                                         msg.msg_namelen, addr, addr_len);
                if (err2 < 0)
                        err = err2;
        }

        fput_light(sock->file, fput_needed);
out:
        return err;
}

SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
                unsigned int, flags, struct sockaddr __user *, addr,
                int __user *, addr_len)
{
        return __sys_recvfrom(fd, ubuf, size, flags, addr, addr_len);
}

/*
 *        Receive a datagram from a socket.
 */

SYSCALL_DEFINE4(recv, int, fd, void __user *, ubuf, size_t, size,
                unsigned int, flags)
{
        return __sys_recvfrom(fd, ubuf, size, flags, NULL, NULL);
}

static bool sock_use_custom_sol_socket(const struct socket *sock)
{
        return test_bit(SOCK_CUSTOM_SOCKOPT, &sock->flags);
}

int do_sock_setsockopt(struct socket *sock, bool compat, int level,
                       int optname, sockptr_t optval, int optlen)
{
        const struct proto_ops *ops;
        char *kernel_optval = NULL;
        int err;

        if (optlen < 0)
                return -EINVAL;

        err = security_socket_setsockopt(sock, level, optname);
        if (err)
                goto out_put;

        if (!compat)
                err = BPF_CGROUP_RUN_PROG_SETSOCKOPT(sock->sk, &level, &optname,
                                                     optval, &optlen,
                                                     &kernel_optval);
        if (err < 0)
                goto out_put;
        if (err > 0) {
                err = 0;
                goto out_put;
        }

        if (kernel_optval)
                optval = KERNEL_SOCKPTR(kernel_optval);
        ops = READ_ONCE(sock->ops);
        if (level == SOL_SOCKET && !sock_use_custom_sol_socket(sock))
                err = sock_setsockopt(sock, level, optname, optval, optlen);
        else if (unlikely(!ops->setsockopt))
                err = -EOPNOTSUPP;
        else
                err = ops->setsockopt(sock, level, optname, optval,
                                            optlen);
        kfree(kernel_optval);
out_put:
        return err;
}
EXPORT_SYMBOL(do_sock_setsockopt);

/* Set a socket option. Because we don't know the option lengths we have
 * to pass the user mode parameter for the protocols to sort out.
 */
int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval,
                     int optlen)
{
        sockptr_t optval = USER_SOCKPTR(user_optval);
        bool compat = in_compat_syscall();
        int err, fput_needed;
        struct socket *sock;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                return err;

        err = do_sock_setsockopt(sock, compat, level, optname, optval, optlen);

        fput_light(sock->file, fput_needed);
        return err;
}

SYSCALL_DEFINE5(setsockopt, int, fd, int, level, int, optname,
                char __user *, optval, int, optlen)
{
        return __sys_setsockopt(fd, level, optname, optval, optlen);
}

INDIRECT_CALLABLE_DECLARE(bool tcp_bpf_bypass_getsockopt(int level,
                                                         int optname));

int do_sock_getsockopt(struct socket *sock, bool compat, int level,
                       int optname, sockptr_t optval, sockptr_t optlen)
{
        int max_optlen __maybe_unused = 0;
        const struct proto_ops *ops;
        int err;

        err = security_socket_getsockopt(sock, level, optname);
        if (err)
                return err;

        if (!compat)
                copy_from_sockptr(&max_optlen, optlen, sizeof(int));

        ops = READ_ONCE(sock->ops);
        if (level == SOL_SOCKET) {
                err = sk_getsockopt(sock->sk, level, optname, optval, optlen);
        } else if (unlikely(!ops->getsockopt)) {
                err = -EOPNOTSUPP;
        } else {
                if (WARN_ONCE(optval.is_kernel || optlen.is_kernel,
                              "Invalid argument type"))
                        return -EOPNOTSUPP;

                err = ops->getsockopt(sock, level, optname, optval.user,
                                      optlen.user);
        }

        if (!compat)
                err = BPF_CGROUP_RUN_PROG_GETSOCKOPT(sock->sk, level, optname,
                                                     optval, optlen, max_optlen,
                                                     err);

        return err;
}
EXPORT_SYMBOL(do_sock_getsockopt);

/*
 *        Get a socket option. Because we don't know the option lengths we have
 *        to pass a user mode parameter for the protocols to sort out.
 */
int __sys_getsockopt(int fd, int level, int optname, char __user *optval,
                int __user *optlen)
{
        int err, fput_needed;
        struct socket *sock;
        bool compat;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                return err;

        compat = in_compat_syscall();
        err = do_sock_getsockopt(sock, compat, level, optname,
                                 USER_SOCKPTR(optval), USER_SOCKPTR(optlen));

        fput_light(sock->file, fput_needed);
        return err;
}

SYSCALL_DEFINE5(getsockopt, int, fd, int, level, int, optname,
                char __user *, optval, int __user *, optlen)
{
        return __sys_getsockopt(fd, level, optname, optval, optlen);
}

/*
 *        Shutdown a socket.
 */

int __sys_shutdown_sock(struct socket *sock, int how)
{
        int err;

        err = security_socket_shutdown(sock, how);
        if (!err)
                err = READ_ONCE(sock->ops)->shutdown(sock, how);

        return err;
}

int __sys_shutdown(int fd, int how)
{
        int err, fput_needed;
        struct socket *sock;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (sock != NULL) {
                err = __sys_shutdown_sock(sock, how);
                fput_light(sock->file, fput_needed);
        }
        return err;
}

SYSCALL_DEFINE2(shutdown, int, fd, int, how)
{
        return __sys_shutdown(fd, how);
}

/* A couple of helpful macros for getting the address of the 32/64 bit
 * fields which are the same type (int / unsigned) on our platforms.
 */
#define COMPAT_MSG(msg, member)        ((MSG_CMSG_COMPAT & flags) ? &msg##_compat->member : &msg->member)
#define COMPAT_NAMELEN(msg)        COMPAT_MSG(msg, msg_namelen)
#define COMPAT_FLAGS(msg)        COMPAT_MSG(msg, msg_flags)

struct used_address {
        struct sockaddr_storage name;
        unsigned int name_len;
};

int __copy_msghdr(struct msghdr *kmsg,
                  struct user_msghdr *msg,
                  struct sockaddr __user **save_addr)
{
        ssize_t err;

        kmsg->msg_control_is_user = true;
        kmsg->msg_get_inq = 0;
        kmsg->msg_control_user = msg->msg_control;
        kmsg->msg_controllen = msg->msg_controllen;
        kmsg->msg_flags = msg->msg_flags;

        kmsg->msg_namelen = msg->msg_namelen;
        if (!msg->msg_name)
                kmsg->msg_namelen = 0;

        if (kmsg->msg_namelen < 0)
                return -EINVAL;

        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                kmsg->msg_namelen = sizeof(struct sockaddr_storage);

        if (save_addr)
                *save_addr = msg->msg_name;

        if (msg->msg_name && kmsg->msg_namelen) {
                if (!save_addr) {
                        err = move_addr_to_kernel(msg->msg_name,
                                                  kmsg->msg_namelen,
                                                  kmsg->msg_name);
                        if (err < 0)
                                return err;
                }
        } else {
                kmsg->msg_name = NULL;
                kmsg->msg_namelen = 0;
        }

        if (msg->msg_iovlen > UIO_MAXIOV)
                return -EMSGSIZE;

        kmsg->msg_iocb = NULL;
        kmsg->msg_ubuf = NULL;
        return 0;
}

static int copy_msghdr_from_user(struct msghdr *kmsg,
                                 struct user_msghdr __user *umsg,
                                 struct sockaddr __user **save_addr,
                                 struct iovec **iov)
{
        struct user_msghdr msg;
        ssize_t err;

        if (copy_from_user(&msg, umsg, sizeof(*umsg)))
                return -EFAULT;

        err = __copy_msghdr(kmsg, &msg, save_addr);
        if (err)
                return err;

        err = import_iovec(save_addr ? ITER_DEST : ITER_SOURCE,
                            msg.msg_iov, msg.msg_iovlen,
                            UIO_FASTIOV, iov, &kmsg->msg_iter);
        return err < 0 ? err : 0;
}

static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
                           unsigned int flags, struct used_address *used_address,
                           unsigned int allowed_msghdr_flags)
{
        unsigned char ctl[sizeof(struct cmsghdr) + 20]
                                __aligned(sizeof(__kernel_size_t));
        /* 20 is size of ipv6_pktinfo */
        unsigned char *ctl_buf = ctl;
        int ctl_len;
        ssize_t err;

        err = -ENOBUFS;

        if (msg_sys->msg_controllen > INT_MAX)
                goto out;
        flags |= (msg_sys->msg_flags & allowed_msghdr_flags);
        ctl_len = msg_sys->msg_controllen;
        if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
                err =
                    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
                                                     sizeof(ctl));
                if (err)
                        goto out;
                ctl_buf = msg_sys->msg_control;
                ctl_len = msg_sys->msg_controllen;
        } else if (ctl_len) {
                BUILD_BUG_ON(sizeof(struct cmsghdr) !=
                             CMSG_ALIGN(sizeof(struct cmsghdr)));
                if (ctl_len > sizeof(ctl)) {
                        ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
                        if (ctl_buf == NULL)
                                goto out;
                }
                err = -EFAULT;
                if (copy_from_user(ctl_buf, msg_sys->msg_control_user, ctl_len))
                        goto out_freectl;
                msg_sys->msg_control = ctl_buf;
                msg_sys->msg_control_is_user = false;
        }
        flags &= ~MSG_INTERNAL_SENDMSG_FLAGS;
        msg_sys->msg_flags = flags;

        if (sock->file->f_flags & O_NONBLOCK)
                msg_sys->msg_flags |= MSG_DONTWAIT;
        /*
         * If this is sendmmsg() and current destination address is same as
         * previously succeeded address, omit asking LSM's decision.
         * used_address->name_len is initialized to UINT_MAX so that the first
         * destination address never matches.
         */
        if (used_address && msg_sys->msg_name &&
            used_address->name_len == msg_sys->msg_namelen &&
            !memcmp(&used_address->name, msg_sys->msg_name,
                    used_address->name_len)) {
                err = sock_sendmsg_nosec(sock, msg_sys);
                goto out_freectl;
        }
        err = __sock_sendmsg(sock, msg_sys);
        /*
         * If this is sendmmsg() and sending to current destination address was
         * successful, remember it.
         */
        if (used_address && err >= 0) {
                used_address->name_len = msg_sys->msg_namelen;
                if (msg_sys->msg_name)
                        memcpy(&used_address->name, msg_sys->msg_name,
                               used_address->name_len);
        }

out_freectl:
        if (ctl_buf != ctl)
                sock_kfree_s(sock->sk, ctl_buf, ctl_len);
out:
        return err;
}

static int sendmsg_copy_msghdr(struct msghdr *msg,
                               struct user_msghdr __user *umsg, unsigned flags,
                               struct iovec **iov)
{
        int err;

        if (flags & MSG_CMSG_COMPAT) {
                struct compat_msghdr __user *msg_compat;

                msg_compat = (struct compat_msghdr __user *) umsg;
                err = get_compat_msghdr(msg, msg_compat, NULL, iov);
        } else {
                err = copy_msghdr_from_user(msg, umsg, NULL, iov);
        }
        if (err < 0)
                return err;

        return 0;
}

static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
                         struct msghdr *msg_sys, unsigned int flags,
                         struct used_address *used_address,
                         unsigned int allowed_msghdr_flags)
{
        struct sockaddr_storage address;
        struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
        ssize_t err;

        msg_sys->msg_name = &address;

        err = sendmsg_copy_msghdr(msg_sys, msg, flags, &iov);
        if (err < 0)
                return err;

        err = ____sys_sendmsg(sock, msg_sys, flags, used_address,
                                allowed_msghdr_flags);
        kfree(iov);
        return err;
}

/*
 *        BSD sendmsg interface
 */
long __sys_sendmsg_sock(struct socket *sock, struct msghdr *msg,
                        unsigned int flags)
{
        return ____sys_sendmsg(sock, msg, flags, NULL, 0);
}

long __sys_sendmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
                   bool forbid_cmsg_compat)
{
        int fput_needed, err;
        struct msghdr msg_sys;
        struct socket *sock;

        if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
                return -EINVAL;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;

        err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL, 0);

        fput_light(sock->file, fput_needed);
out:
        return err;
}

SYSCALL_DEFINE3(sendmsg, int, fd, struct user_msghdr __user *, msg, unsigned int, flags)
{
        return __sys_sendmsg(fd, msg, flags, true);
}

/*
 *        Linux sendmmsg interface
 */

int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                   unsigned int flags, bool forbid_cmsg_compat)
{
        int fput_needed, err, datagrams;
        struct socket *sock;
        struct mmsghdr __user *entry;
        struct compat_mmsghdr __user *compat_entry;
        struct msghdr msg_sys;
        struct used_address used_address;
        unsigned int oflags = flags;

        if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
                return -EINVAL;

        if (vlen > UIO_MAXIOV)
                vlen = UIO_MAXIOV;

        datagrams = 0;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                return err;

        used_address.name_len = UINT_MAX;
        entry = mmsg;
        compat_entry = (struct compat_mmsghdr __user *)mmsg;
        err = 0;
        flags |= MSG_BATCH;

        while (datagrams < vlen) {
                if (datagrams == vlen - 1)
                        flags = oflags;

                if (MSG_CMSG_COMPAT & flags) {
                        err = ___sys_sendmsg(sock, (struct user_msghdr __user *)compat_entry,
                                             &msg_sys, flags, &used_address, MSG_EOR);
                        if (err < 0)
                                break;
                        err = __put_user(err, &compat_entry->msg_len);
                        ++compat_entry;
                } else {
                        err = ___sys_sendmsg(sock,
                                             (struct user_msghdr __user *)entry,
                                             &msg_sys, flags, &used_address, MSG_EOR);
                        if (err < 0)
                                break;
                        err = put_user(err, &entry->msg_len);
                        ++entry;
                }

                if (err)
                        break;
                ++datagrams;
                if (msg_data_left(&msg_sys))
                        break;
                cond_resched();
        }

        fput_light(sock->file, fput_needed);

        /* We only return an error if no datagrams were able to be sent */
        if (datagrams != 0)
                return datagrams;

        return err;
}

SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
                unsigned int, vlen, unsigned int, flags)
{
        return __sys_sendmmsg(fd, mmsg, vlen, flags, true);
}

static int recvmsg_copy_msghdr(struct msghdr *msg,
                               struct user_msghdr __user *umsg, unsigned flags,
                               struct sockaddr __user **uaddr,
                               struct iovec **iov)
{
        ssize_t err;

        if (MSG_CMSG_COMPAT & flags) {
                struct compat_msghdr __user *msg_compat;

                msg_compat = (struct compat_msghdr __user *) umsg;
                err = get_compat_msghdr(msg, msg_compat, uaddr, iov);
        } else {
                err = copy_msghdr_from_user(msg, umsg, uaddr, iov);
        }
        if (err < 0)
                return err;

        return 0;
}

static int ____sys_recvmsg(struct socket *sock, struct msghdr *msg_sys,
                           struct user_msghdr __user *msg,
                           struct sockaddr __user *uaddr,
                           unsigned int flags, int nosec)
{
        struct compat_msghdr __user *msg_compat =
                                        (struct compat_msghdr __user *) msg;
        int __user *uaddr_len = COMPAT_NAMELEN(msg);
        struct sockaddr_storage addr;
        unsigned long cmsg_ptr;
        int len;
        ssize_t err;

        msg_sys->msg_name = &addr;
        cmsg_ptr = (unsigned long)msg_sys->msg_control;
        msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);

        /* We assume all kernel code knows the size of sockaddr_storage */
        msg_sys->msg_namelen = 0;

        if (sock->file->f_flags & O_NONBLOCK)
                flags |= MSG_DONTWAIT;

        if (unlikely(nosec))
                err = sock_recvmsg_nosec(sock, msg_sys, flags);
        else
                err = sock_recvmsg(sock, msg_sys, flags);

        if (err < 0)
                goto out;
        len = err;

        if (uaddr != NULL) {
                err = move_addr_to_user(&addr,
                                        msg_sys->msg_namelen, uaddr,
                                        uaddr_len);
                if (err < 0)
                        goto out;
        }
        err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
                         COMPAT_FLAGS(msg));
        if (err)
                goto out;
        if (MSG_CMSG_COMPAT & flags)
                err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
                                 &msg_compat->msg_controllen);
        else
                err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
                                 &msg->msg_controllen);
        if (err)
                goto out;
        err = len;
out:
        return err;
}

static int ___sys_recvmsg(struct socket *sock, struct user_msghdr __user *msg,
                         struct msghdr *msg_sys, unsigned int flags, int nosec)
{
        struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
        /* user mode address pointers */
        struct sockaddr __user *uaddr;
        ssize_t err;

        err = recvmsg_copy_msghdr(msg_sys, msg, flags, &uaddr, &iov);
        if (err < 0)
                return err;

        err = ____sys_recvmsg(sock, msg_sys, msg, uaddr, flags, nosec);
        kfree(iov);
        return err;
}

/*
 *        BSD recvmsg interface
 */

long __sys_recvmsg_sock(struct socket *sock, struct msghdr *msg,
                        struct user_msghdr __user *umsg,
                        struct sockaddr __user *uaddr, unsigned int flags)
{
        return ____sys_recvmsg(sock, msg, umsg, uaddr, flags, 0);
}

long __sys_recvmsg(int fd, struct user_msghdr __user *msg, unsigned int flags,
                   bool forbid_cmsg_compat)
{
        int fput_needed, err;
        struct msghdr msg_sys;
        struct socket *sock;

        if (forbid_cmsg_compat && (flags & MSG_CMSG_COMPAT))
                return -EINVAL;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;

        err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);

        fput_light(sock->file, fput_needed);
out:
        return err;
}

SYSCALL_DEFINE3(recvmsg, int, fd, struct user_msghdr __user *, msg,
                unsigned int, flags)
{
        return __sys_recvmsg(fd, msg, flags, true);
}

/*
 *     Linux recvmmsg interface
 */

static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
                          unsigned int vlen, unsigned int flags,
                          struct timespec64 *timeout)
{
        int fput_needed, err, datagrams;
        struct socket *sock;
        struct mmsghdr __user *entry;
        struct compat_mmsghdr __user *compat_entry;
        struct msghdr msg_sys;
        struct timespec64 end_time;
        struct timespec64 timeout64;

        if (timeout &&
            poll_select_set_timeout(&end_time, timeout->tv_sec,
                                    timeout->tv_nsec))
                return -EINVAL;

        datagrams = 0;

        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                return err;

        if (likely(!(flags & MSG_ERRQUEUE))) {
                err = sock_error(sock->sk);
                if (err) {
                        datagrams = err;
                        goto out_put;
                }
        }

        entry = mmsg;
        compat_entry = (struct compat_mmsghdr __user *)mmsg;

        while (datagrams < vlen) {
                /*
                 * No need to ask LSM for more than the first datagram.
                 */
                if (MSG_CMSG_COMPAT & flags) {
                        err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
                                             &msg_sys, flags & ~MSG_WAITFORONE,
                                             datagrams);
                        if (err < 0)
                                break;
                        err = __put_user(err, &compat_entry->msg_len);
                        ++compat_entry;
                } else {
                        err = ___sys_recvmsg(sock,
                                             (struct user_msghdr __user *)entry,
                                             &msg_sys, flags & ~MSG_WAITFORONE,
                                             datagrams);
                        if (err < 0)
                                break;
                        err = put_user(err, &entry->msg_len);
                        ++entry;
                }

                if (err)
                        break;
                ++datagrams;

                /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
                if (flags & MSG_WAITFORONE)
                        flags |= MSG_DONTWAIT;

                if (timeout) {
                        ktime_get_ts64(&timeout64);
                        *timeout = timespec64_sub(end_time, timeout64);
                        if (timeout->tv_sec < 0) {
                                timeout->tv_sec = timeout->tv_nsec = 0;
                                break;
                        }

                        /* Timeout, return less than vlen datagrams */
                        if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
                                break;
                }

                /* Out of band data, return right away */
                if (msg_sys.msg_flags & MSG_OOB)
                        break;
                cond_resched();
        }

        if (err == 0)
                goto out_put;

        if (datagrams == 0) {
                datagrams = err;
                goto out_put;
        }

        /*
         * We may return less entries than requested (vlen) if the
         * sock is non block and there aren't enough datagrams...
         */
        if (err != -EAGAIN) {
                /*
                 * ... or  if recvmsg returns an error after we
                 * received some datagrams, where we record the
                 * error to return on the next call or if the
                 * app asks about it using getsockopt(SO_ERROR).
                 */
                WRITE_ONCE(sock->sk->sk_err, -err);
        }
out_put:
        fput_light(sock->file, fput_needed);

        return datagrams;
}

int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg,
                   unsigned int vlen, unsigned int flags,
                   struct __kernel_timespec __user *timeout,
                   struct old_timespec32 __user *timeout32)
{
        int datagrams;
        struct timespec64 timeout_sys;

        if (timeout && get_timespec64(&timeout_sys, timeout))
                return -EFAULT;

        if (timeout32 && get_old_timespec32(&timeout_sys, timeout32))
                return -EFAULT;

        if (!timeout && !timeout32)
                return do_recvmmsg(fd, mmsg, vlen, flags, NULL);

        datagrams = do_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);

        if (datagrams <= 0)
                return datagrams;

        if (timeout && put_timespec64(&timeout_sys, timeout))
                datagrams = -EFAULT;

        if (timeout32 && put_old_timespec32(&timeout_sys, timeout32))
                datagrams = -EFAULT;

        return datagrams;
}

SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
                unsigned int, vlen, unsigned int, flags,
                struct __kernel_timespec __user *, timeout)
{
        if (flags & MSG_CMSG_COMPAT)
                return -EINVAL;

        return __sys_recvmmsg(fd, mmsg, vlen, flags, timeout, NULL);
}

#ifdef CONFIG_COMPAT_32BIT_TIME
SYSCALL_DEFINE5(recvmmsg_time32, int, fd, struct mmsghdr __user *, mmsg,
                unsigned int, vlen, unsigned int, flags,
                struct old_timespec32 __user *, timeout)
{
        if (flags & MSG_CMSG_COMPAT)
                return -EINVAL;

        return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL, timeout);
}
#endif

#ifdef __ARCH_WANT_SYS_SOCKETCALL
/* Argument list sizes for sys_socketcall */
#define AL(x) ((x) * sizeof(unsigned long))
static const unsigned char nargs[21] = {
        AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
        AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
        AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
        AL(4), AL(5), AL(4)
};

#undef AL

/*
 *        System call vectors.
 *
 *        Argument checking cleaned up. Saved 20% in size.
 *  This function doesn't need to set the kernel lock because
 *  it is set by the callees.
 */

SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
{
        unsigned long a[AUDITSC_ARGS];
        unsigned long a0, a1;
        int err;
        unsigned int len;

        if (call < 1 || call > SYS_SENDMMSG)
                return -EINVAL;
        call = array_index_nospec(call, SYS_SENDMMSG + 1);

        len = nargs[call];
        if (len > sizeof(a))
                return -EINVAL;

        /* copy_from_user should be SMP safe. */
        if (copy_from_user(a, args, len))
                return -EFAULT;

        err = audit_socketcall(nargs[call] / sizeof(unsigned long), a);
        if (err)
                return err;

        a0 = a[0];
        a1 = a[1];

        switch (call) {
        case SYS_SOCKET:
                err = __sys_socket(a0, a1, a[2]);
                break;
        case SYS_BIND:
                err = __sys_bind(a0, (struct sockaddr __user *)a1, a[2]);
                break;
        case SYS_CONNECT:
                err = __sys_connect(a0, (struct sockaddr __user *)a1, a[2]);
                break;
        case SYS_LISTEN:
                err = __sys_listen(a0, a1);
                break;
        case SYS_ACCEPT:
                err = __sys_accept4(a0, (struct sockaddr __user *)a1,
                                    (int __user *)a[2], 0);
                break;
        case SYS_GETSOCKNAME:
                err =
                    __sys_getsockname(a0, (struct sockaddr __user *)a1,
                                      (int __user *)a[2]);
                break;
        case SYS_GETPEERNAME:
                err =
                    __sys_getpeername(a0, (struct sockaddr __user *)a1,
                                      (int __user *)a[2]);
                break;
        case SYS_SOCKETPAIR:
                err = __sys_socketpair(a0, a1, a[2], (int __user *)a[3]);
                break;
        case SYS_SEND:
                err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
                                   NULL, 0);
                break;
        case SYS_SENDTO:
                err = __sys_sendto(a0, (void __user *)a1, a[2], a[3],
                                   (struct sockaddr __user *)a[4], a[5]);
                break;
        case SYS_RECV:
                err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
                                     NULL, NULL);
                break;
        case SYS_RECVFROM:
                err = __sys_recvfrom(a0, (void __user *)a1, a[2], a[3],
                                     (struct sockaddr __user *)a[4],
                                     (int __user *)a[5]);
                break;
        case SYS_SHUTDOWN:
                err = __sys_shutdown(a0, a1);
                break;
        case SYS_SETSOCKOPT:
                err = __sys_setsockopt(a0, a1, a[2], (char __user *)a[3],
                                       a[4]);
                break;
        case SYS_GETSOCKOPT:
                err =
                    __sys_getsockopt(a0, a1, a[2], (char __user *)a[3],
                                     (int __user *)a[4]);
                break;
        case SYS_SENDMSG:
                err = __sys_sendmsg(a0, (struct user_msghdr __user *)a1,
                                    a[2], true);
                break;
        case SYS_SENDMMSG:
                err = __sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2],
                                     a[3], true);
                break;
        case SYS_RECVMSG:
                err = __sys_recvmsg(a0, (struct user_msghdr __user *)a1,
                                    a[2], true);
                break;
        case SYS_RECVMMSG:
                if (IS_ENABLED(CONFIG_64BIT))
                        err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
                                             a[2], a[3],
                                             (struct __kernel_timespec __user *)a[4],
                                             NULL);
                else
                        err = __sys_recvmmsg(a0, (struct mmsghdr __user *)a1,
                                             a[2], a[3], NULL,
                                             (struct old_timespec32 __user *)a[4]);
                break;
        case SYS_ACCEPT4:
                err = __sys_accept4(a0, (struct sockaddr __user *)a1,
                                    (int __user *)a[2], a[3]);
                break;
        default:
                err = -EINVAL;
                break;
        }
        return err;
}

#endif                                /* __ARCH_WANT_SYS_SOCKETCALL */

/**
 *        sock_register - add a socket protocol handler
 *        @ops: description of protocol
 *
 *        This function is called by a protocol handler that wants to
 *        advertise its address family, and have it linked into the
 *        socket interface. The value ops->family corresponds to the
 *        socket system call protocol family.
 */
int sock_register(const struct net_proto_family *ops)
{
        int err;

        if (ops->family >= NPROTO) {
                pr_crit("protocol %d >= NPROTO(%d)\n", ops->family, NPROTO);
                return -ENOBUFS;
        }

        spin_lock(&net_family_lock);
        if (rcu_dereference_protected(net_families[ops->family],
                                      lockdep_is_held(&net_family_lock)))
                err = -EEXIST;
        else {
                rcu_assign_pointer(net_families[ops->family], ops);
                err = 0;
        }
        spin_unlock(&net_family_lock);

        pr_info("NET: Registered %s protocol family\n", pf_family_names[ops->family]);
        return err;
}
EXPORT_SYMBOL(sock_register);

/**
 *        sock_unregister - remove a protocol handler
 *        @family: protocol family to remove
 *
 *        This function is called by a protocol handler that wants to
 *        remove its address family, and have it unlinked from the
 *        new socket creation.
 *
 *        If protocol handler is a module, then it can use module reference
 *        counts to protect against new references. If protocol handler is not
 *        a module then it needs to provide its own protection in
 *        the ops->create routine.
 */
void sock_unregister(int family)
{
        BUG_ON(family < 0 || family >= NPROTO);

        spin_lock(&net_family_lock);
        RCU_INIT_POINTER(net_families[family], NULL);
        spin_unlock(&net_family_lock);

        synchronize_rcu();

        pr_info("NET: Unregistered %s protocol family\n", pf_family_names[family]);
}
EXPORT_SYMBOL(sock_unregister);

bool sock_is_registered(int family)
{
        return family < NPROTO && rcu_access_pointer(net_families[family]);
}

static int __init sock_init(void)
{
        int err;
        /*
         *      Initialize the network sysctl infrastructure.
         */
        err = net_sysctl_init();
        if (err)
                goto out;

        /*
         *      Initialize skbuff SLAB cache
         */
        skb_init();

        /*
         *      Initialize the protocols module.
         */

        init_inodecache();

        err = register_filesystem(&sock_fs_type);
        if (err)
                goto out;
        sock_mnt = kern_mount(&sock_fs_type);
        if (IS_ERR(sock_mnt)) {
                err = PTR_ERR(sock_mnt);
                goto out_mount;
        }

        /* The real protocol initialization is performed in later initcalls.
         */

#ifdef CONFIG_NETFILTER
        err = netfilter_init();
        if (err)
                goto out;
#endif

        ptp_classifier_init();

out:
        return err;

out_mount:
        unregister_filesystem(&sock_fs_type);
        goto out;
}

core_initcall(sock_init);        /* early initcall */

#ifdef CONFIG_PROC_FS
void socket_seq_show(struct seq_file *seq)
{
        seq_printf(seq, "sockets: used %d\n",
                   sock_inuse_get(seq->private));
}
#endif                                /* CONFIG_PROC_FS */

/* Handle the fact that while struct ifreq has the same *layout* on
 * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
 * which are handled elsewhere, it still has different *size* due to
 * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
 * resulting in struct ifreq being 32 and 40 bytes respectively).
 * As a result, if the struct happens to be at the end of a page and
 * the next page isn't readable/writable, we get a fault. To prevent
 * that, copy back and forth to the full size.
 */
int get_user_ifreq(struct ifreq *ifr, void __user **ifrdata, void __user *arg)
{
        if (in_compat_syscall()) {
                struct compat_ifreq *ifr32 = (struct compat_ifreq *)ifr;

                memset(ifr, 0, sizeof(*ifr));
                if (copy_from_user(ifr32, arg, sizeof(*ifr32)))
                        return -EFAULT;

                if (ifrdata)
                        *ifrdata = compat_ptr(ifr32->ifr_data);

                return 0;
        }

        if (copy_from_user(ifr, arg, sizeof(*ifr)))
                return -EFAULT;

        if (ifrdata)
                *ifrdata = ifr->ifr_data;

        return 0;
}
EXPORT_SYMBOL(get_user_ifreq);

int put_user_ifreq(struct ifreq *ifr, void __user *arg)
{
        size_t size = sizeof(*ifr);

        if (in_compat_syscall())
                size = sizeof(struct compat_ifreq);

        if (copy_to_user(arg, ifr, size))
                return -EFAULT;

        return 0;
}
EXPORT_SYMBOL(put_user_ifreq);

#ifdef CONFIG_COMPAT
static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
{
        compat_uptr_t uptr32;
        struct ifreq ifr;
        void __user *saved;
        int err;

        if (get_user_ifreq(&ifr, NULL, uifr32))
                return -EFAULT;

        if (get_user(uptr32, &uifr32->ifr_settings.ifs_ifsu))
                return -EFAULT;

        saved = ifr.ifr_settings.ifs_ifsu.raw_hdlc;
        ifr.ifr_settings.ifs_ifsu.raw_hdlc = compat_ptr(uptr32);

        err = dev_ioctl(net, SIOCWANDEV, &ifr, NULL, NULL);
        if (!err) {
                ifr.ifr_settings.ifs_ifsu.raw_hdlc = saved;
                if (put_user_ifreq(&ifr, uifr32))
                        err = -EFAULT;
        }
        return err;
}

/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
                                 struct compat_ifreq __user *u_ifreq32)
{
        struct ifreq ifreq;
        void __user *data;

        if (!is_socket_ioctl_cmd(cmd))
                return -ENOTTY;
        if (get_user_ifreq(&ifreq, &data, u_ifreq32))
                return -EFAULT;
        ifreq.ifr_data = data;

        return dev_ioctl(net, cmd, &ifreq, data, NULL);
}

static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
                         unsigned int cmd, unsigned long arg)
{
        void __user *argp = compat_ptr(arg);
        struct sock *sk = sock->sk;
        struct net *net = sock_net(sk);
        const struct proto_ops *ops;

        if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
                return sock_ioctl(file, cmd, (unsigned long)argp);

        switch (cmd) {
        case SIOCWANDEV:
                return compat_siocwandev(net, argp);
        case SIOCGSTAMP_OLD:
        case SIOCGSTAMPNS_OLD:
                ops = READ_ONCE(sock->ops);
                if (!ops->gettstamp)
                        return -ENOIOCTLCMD;
                return ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD,
                                      !COMPAT_USE_64BIT_TIME);

        case SIOCETHTOOL:
        case SIOCBONDSLAVEINFOQUERY:
        case SIOCBONDINFOQUERY:
        case SIOCSHWTSTAMP:
        case SIOCGHWTSTAMP:
                return compat_ifr_data_ioctl(net, cmd, argp);

        case FIOSETOWN:
        case SIOCSPGRP:
        case FIOGETOWN:
        case SIOCGPGRP:
        case SIOCBRADDBR:
        case SIOCBRDELBR:
        case SIOCGIFVLAN:
        case SIOCSIFVLAN:
        case SIOCGSKNS:
        case SIOCGSTAMP_NEW:
        case SIOCGSTAMPNS_NEW:
        case SIOCGIFCONF:
        case SIOCSIFBR:
        case SIOCGIFBR:
                return sock_ioctl(file, cmd, arg);

        case SIOCGIFFLAGS:
        case SIOCSIFFLAGS:
        case SIOCGIFMAP:
        case SIOCSIFMAP:
        case SIOCGIFMETRIC:
        case SIOCSIFMETRIC:
        case SIOCGIFMTU:
        case SIOCSIFMTU:
        case SIOCGIFMEM:
        case SIOCSIFMEM:
        case SIOCGIFHWADDR:
        case SIOCSIFHWADDR:
        case SIOCADDMULTI:
        case SIOCDELMULTI:
        case SIOCGIFINDEX:
        case SIOCGIFADDR:
        case SIOCSIFADDR:
        case SIOCSIFHWBROADCAST:
        case SIOCDIFADDR:
        case SIOCGIFBRDADDR:
        case SIOCSIFBRDADDR:
        case SIOCGIFDSTADDR:
        case SIOCSIFDSTADDR:
        case SIOCGIFNETMASK:
        case SIOCSIFNETMASK:
        case SIOCSIFPFLAGS:
        case SIOCGIFPFLAGS:
        case SIOCGIFTXQLEN:
        case SIOCSIFTXQLEN:
        case SIOCBRADDIF:
        case SIOCBRDELIF:
        case SIOCGIFNAME:
        case SIOCSIFNAME:
        case SIOCGMIIPHY:
        case SIOCGMIIREG:
        case SIOCSMIIREG:
        case SIOCBONDENSLAVE:
        case SIOCBONDRELEASE:
        case SIOCBONDSETHWADDR:
        case SIOCBONDCHANGEACTIVE:
        case SIOCSARP:
        case SIOCGARP:
        case SIOCDARP:
        case SIOCOUTQ:
        case SIOCOUTQNSD:
        case SIOCATMARK:
                return sock_do_ioctl(net, sock, cmd, arg);
        }

        return -ENOIOCTLCMD;
}

static long compat_sock_ioctl(struct file *file, unsigned int cmd,
                              unsigned long arg)
{
        struct socket *sock = file->private_data;
        const struct proto_ops *ops = READ_ONCE(sock->ops);
        int ret = -ENOIOCTLCMD;
        struct sock *sk;
        struct net *net;

        sk = sock->sk;
        net = sock_net(sk);

        if (ops->compat_ioctl)
                ret = ops->compat_ioctl(sock, cmd, arg);

        if (ret == -ENOIOCTLCMD &&
            (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST))
                ret = compat_wext_handle_ioctl(net, cmd, arg);

        if (ret == -ENOIOCTLCMD)
                ret = compat_sock_ioctl_trans(file, sock, cmd, arg);

        return ret;
}
#endif

/**
 *        kernel_bind - bind an address to a socket (kernel space)
 *        @sock: socket
 *        @addr: address
 *        @addrlen: length of address
 *
 *        Returns 0 or an error.
 */

int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
{
        struct sockaddr_storage address;

        memcpy(&address, addr, addrlen);

        return READ_ONCE(sock->ops)->bind(sock, (struct sockaddr *)&address,
                                          addrlen);
}
EXPORT_SYMBOL(kernel_bind);

/**
 *        kernel_listen - move socket to listening state (kernel space)
 *        @sock: socket
 *        @backlog: pending connections queue size
 *
 *        Returns 0 or an error.
 */

int kernel_listen(struct socket *sock, int backlog)
{
        return READ_ONCE(sock->ops)->listen(sock, backlog);
}
EXPORT_SYMBOL(kernel_listen);

/**
 *        kernel_accept - accept a connection (kernel space)
 *        @sock: listening socket
 *        @newsock: new connected socket
 *        @flags: flags
 *
 *        @flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0.
 *        If it fails, @newsock is guaranteed to be %NULL.
 *        Returns 0 or an error.
 */

int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
{
        struct sock *sk = sock->sk;
        const struct proto_ops *ops = READ_ONCE(sock->ops);
        struct proto_accept_arg arg = {
                .flags = flags,
                .kern = true,
        };
        int err;

        err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
                               newsock);
        if (err < 0)
                goto done;

        err = ops->accept(sock, *newsock, &arg);
        if (err < 0) {
                sock_release(*newsock);
                *newsock = NULL;
                goto done;
        }

        (*newsock)->ops = ops;
        __module_get(ops->owner);

done:
        return err;
}
EXPORT_SYMBOL(kernel_accept);

/**
 *        kernel_connect - connect a socket (kernel space)
 *        @sock: socket
 *        @addr: address
 *        @addrlen: address length
 *        @flags: flags (O_NONBLOCK, ...)
 *
 *        For datagram sockets, @addr is the address to which datagrams are sent
 *        by default, and the only address from which datagrams are received.
 *        For stream sockets, attempts to connect to @addr.
 *        Returns 0 or an error code.
 */

int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
                   int flags)
{
        struct sockaddr_storage address;

        memcpy(&address, addr, addrlen);

        return READ_ONCE(sock->ops)->connect(sock, (struct sockaddr *)&address,
                                             addrlen, flags);
}
EXPORT_SYMBOL(kernel_connect);

/**
 *        kernel_getsockname - get the address which the socket is bound (kernel space)
 *        @sock: socket
 *        @addr: address holder
 *
 *         Fills the @addr pointer with the address which the socket is bound.
 *        Returns the length of the address in bytes or an error code.
 */

int kernel_getsockname(struct socket *sock, struct sockaddr *addr)
{
        return READ_ONCE(sock->ops)->getname(sock, addr, 0);
}
EXPORT_SYMBOL(kernel_getsockname);

/**
 *        kernel_getpeername - get the address which the socket is connected (kernel space)
 *        @sock: socket
 *        @addr: address holder
 *
 *         Fills the @addr pointer with the address which the socket is connected.
 *        Returns the length of the address in bytes or an error code.
 */

int kernel_getpeername(struct socket *sock, struct sockaddr *addr)
{
        return READ_ONCE(sock->ops)->getname(sock, addr, 1);
}
EXPORT_SYMBOL(kernel_getpeername);

/**
 *        kernel_sock_shutdown - shut down part of a full-duplex connection (kernel space)
 *        @sock: socket
 *        @how: connection part
 *
 *        Returns 0 or an error.
 */

int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
{
        return READ_ONCE(sock->ops)->shutdown(sock, how);
}
EXPORT_SYMBOL(kernel_sock_shutdown);

/**
 *        kernel_sock_ip_overhead - returns the IP overhead imposed by a socket
 *        @sk: socket
 *
 *        This routine returns the IP overhead imposed by a socket i.e.
 *        the length of the underlying IP header, depending on whether
 *        this is an IPv4 or IPv6 socket and the length from IP options turned
 *        on at the socket. Assumes that the caller has a lock on the socket.
 */

u32 kernel_sock_ip_overhead(struct sock *sk)
{
        struct inet_sock *inet;
        struct ip_options_rcu *opt;
        u32 overhead = 0;
#if IS_ENABLED(CONFIG_IPV6)
        struct ipv6_pinfo *np;
        struct ipv6_txoptions *optv6 = NULL;
#endif /* IS_ENABLED(CONFIG_IPV6) */

        if (!sk)
                return overhead;

        switch (sk->sk_family) {
        case AF_INET:
                inet = inet_sk(sk);
                overhead += sizeof(struct iphdr);
                opt = rcu_dereference_protected(inet->inet_opt,
                                                sock_owned_by_user(sk));
                if (opt)
                        overhead += opt->opt.optlen;
                return overhead;
#if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
                np = inet6_sk(sk);
                overhead += sizeof(struct ipv6hdr);
                if (np)
                        optv6 = rcu_dereference_protected(np->opt,
                                                          sock_owned_by_user(sk));
                if (optv6)
                        overhead += (optv6->opt_flen + optv6->opt_nflen);
                return overhead;
#endif /* IS_ENABLED(CONFIG_IPV6) */
        default: /* Returns 0 overhead if the socket is not ipv4 or ipv6 */
                return overhead;
        }
}
EXPORT_SYMBOL(kernel_sock_ip_overhead);























































































































































  134 







































   89 

   51 








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
/* SPDX-License-Identifier: GPL-2.0 */
#include <linux/fs.h>
#include <linux/buffer_head.h>
#include <linux/exportfs.h>
#include <linux/iso_fs.h>
#include <linux/unaligned.h>

enum isofs_file_format {
        isofs_file_normal = 0,
        isofs_file_sparse = 1,
        isofs_file_compressed = 2,
};
        
/*
 * iso fs inode data in memory
 */
struct iso_inode_info {
        unsigned long i_iget5_block;
        unsigned long i_iget5_offset;
        unsigned int i_first_extent;
        unsigned char i_file_format;
        unsigned char i_format_parm[3];
        unsigned long i_next_section_block;
        unsigned long i_next_section_offset;
        off_t i_section_size;
        struct inode vfs_inode;
};

/*
 * iso9660 super-block data in memory
 */
struct isofs_sb_info {
        unsigned long s_ninodes;
        unsigned long s_nzones;
        unsigned long s_firstdatazone;
        unsigned long s_log_zone_size;
        unsigned long s_max_size;
        
        int           s_rock_offset; /* offset of SUSP fields within SU area */
        s32           s_sbsector;
        unsigned char s_joliet_level;
        unsigned char s_mapping;
        unsigned char s_check;
        unsigned char s_session;
        unsigned int  s_high_sierra:1;
        unsigned int  s_rock:2;
        unsigned int  s_cruft:1; /* Broken disks with high byte of length
                                  * containing junk */
        unsigned int  s_nocompress:1;
        unsigned int  s_hide:1;
        unsigned int  s_showassoc:1;
        unsigned int  s_overriderockperm:1;
        unsigned int  s_uid_set:1;
        unsigned int  s_gid_set:1;

        umode_t s_fmode;
        umode_t s_dmode;
        kgid_t s_gid;
        kuid_t s_uid;
        struct nls_table *s_nls_iocharset; /* Native language support table */
};

#define ISOFS_INVALID_MODE ((umode_t) -1)

static inline struct isofs_sb_info *ISOFS_SB(struct super_block *sb)
{
        return sb->s_fs_info;
}

static inline struct iso_inode_info *ISOFS_I(struct inode *inode)
{
        return container_of(inode, struct iso_inode_info, vfs_inode);
}

static inline int isonum_711(u8 *p)
{
        return *p;
}
static inline int isonum_712(s8 *p)
{
        return *p;
}
static inline unsigned int isonum_721(u8 *p)
{
        return get_unaligned_le16(p);
}
static inline unsigned int isonum_722(u8 *p)
{
        return get_unaligned_be16(p);
}
static inline unsigned int isonum_723(u8 *p)
{
        /* Ignore bigendian datum due to broken mastering programs */
        return get_unaligned_le16(p);
}
static inline unsigned int isonum_731(u8 *p)
{
        return get_unaligned_le32(p);
}
static inline unsigned int isonum_732(u8 *p)
{
        return get_unaligned_be32(p);
}
static inline unsigned int isonum_733(u8 *p)
{
        /* Ignore bigendian datum due to broken mastering programs */
        return get_unaligned_le32(p);
}
extern int iso_date(u8 *, int);

struct inode;                /* To make gcc happy */

extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *, int relocated);
extern int get_rock_ridge_filename(struct iso_directory_record *, char *, struct inode *);
extern int isofs_name_translate(struct iso_directory_record *, char *, struct inode *);

int get_joliet_filename(struct iso_directory_record *, unsigned char *, struct inode *);
int get_acorn_filename(struct iso_directory_record *, char *, struct inode *);

extern struct dentry *isofs_lookup(struct inode *, struct dentry *, unsigned int flags);
extern struct buffer_head *isofs_bread(struct inode *, sector_t);
extern int isofs_get_blocks(struct inode *, sector_t, struct buffer_head **, unsigned long);

struct inode *__isofs_iget(struct super_block *sb,
                           unsigned long block,
                           unsigned long offset,
                           int relocated);

static inline struct inode *isofs_iget(struct super_block *sb,
                                       unsigned long block,
                                       unsigned long offset)
{
        return __isofs_iget(sb, block, offset, 0);
}

static inline struct inode *isofs_iget_reloc(struct super_block *sb,
                                             unsigned long block,
                                             unsigned long offset)
{
        return __isofs_iget(sb, block, offset, 1);
}

/* Because the inode number is no longer relevant to finding the
 * underlying meta-data for an inode, we are free to choose a more
 * convenient 32-bit number as the inode number.  The inode numbering
 * scheme was recommended by Sergey Vlasov and Eric Lammerts. */
static inline unsigned long isofs_get_ino(unsigned long block,
                                          unsigned long offset,
                                          unsigned long bufbits)
{
        return (block << (bufbits - 5)) | (offset >> 5);
}

/* Every directory can have many redundant directory entries scattered
 * throughout the directory tree.  First there is the directory entry
 * with the name of the directory stored in the parent directory.
 * Then, there is the "." directory entry stored in the directory
 * itself.  Finally, there are possibly many ".." directory entries
 * stored in all the subdirectories.
 *
 * In order for the NFS get_parent() method to work and for the
 * general consistency of the dcache, we need to make sure the
 * "i_iget5_block" and "i_iget5_offset" all point to exactly one of
 * the many redundant entries for each directory.  We normalize the
 * block and offset by always making them point to the "."  directory.
 *
 * Notice that we do not use the entry for the directory with the name
 * that is located in the parent directory.  Even though choosing this
 * first directory is more natural, it is much easier to find the "."
 * entry in the NFS get_parent() method because it is implicitly
 * encoded in the "extent + ext_attr_length" fields of _all_ the
 * redundant entries for the directory.  Thus, it can always be
 * reached regardless of which directory entry you have in hand.
 *
 * This works because the "." entry is simply the first directory
 * record when you start reading the file that holds all the directory
 * records, and this file starts at "extent + ext_attr_length" blocks.
 * Because the "." entry is always the first entry listed in the
 * directories file, the normalized "offset" value is always 0.
 *
 * You should pass the directory entry in "de".  On return, "block"
 * and "offset" will hold normalized values.  Only directories are
 * affected making it safe to call even for non-directory file
 * types. */
static inline void
isofs_normalize_block_and_offset(struct iso_directory_record* de,
                                 unsigned long *block,
                                 unsigned long *offset)
{
        /* Only directories are normalized. */
        if (de->flags[0] & 2) {
                *offset = 0;
                *block = (unsigned long)isonum_733(de->extent)
                        + (unsigned long)isonum_711(de->ext_attr_length);
        }
}

extern const struct inode_operations isofs_dir_inode_operations;
extern const struct file_operations isofs_dir_operations;
extern const struct address_space_operations isofs_symlink_aops;
extern const struct export_operations isofs_export_ops;






















































































   10 







   10 




   10 














































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
// SPDX-License-Identifier: GPL-2.0
/*
 * IA-32 Huge TLB Page Support for Kernel.
 *
 * Copyright (C) 2002, Rohit Seth <rohit.seth@intel.com>
 */

#include <linux/init.h>
#include <linux/fs.h>
#include <linux/mm.h>
#include <linux/sched/mm.h>
#include <linux/hugetlb.h>
#include <linux/pagemap.h>
#include <linux/err.h>
#include <linux/sysctl.h>
#include <linux/compat.h>
#include <asm/mman.h>
#include <asm/tlb.h>
#include <asm/tlbflush.h>
#include <asm/elf.h>

#ifdef CONFIG_HUGETLB_PAGE
static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
                unsigned long addr, unsigned long len,
                unsigned long pgoff, unsigned long flags)
{
        struct hstate *h = hstate_file(file);
        struct vm_unmapped_area_info info = {};

        info.length = len;
        info.low_limit = get_mmap_base(1);

        /*
         * If hint address is above DEFAULT_MAP_WINDOW, look for unmapped area
         * in the full address space.
         */
        info.high_limit = in_32bit_syscall() ?
                task_size_32bit() : task_size_64bit(addr > DEFAULT_MAP_WINDOW);

        info.align_mask = PAGE_MASK & ~huge_page_mask(h);
        return vm_unmapped_area(&info);
}

static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
                unsigned long addr, unsigned long len,
                unsigned long pgoff, unsigned long flags)
{
        struct hstate *h = hstate_file(file);
        struct vm_unmapped_area_info info = {};

        info.flags = VM_UNMAPPED_AREA_TOPDOWN;
        info.length = len;
        info.low_limit = PAGE_SIZE;
        info.high_limit = get_mmap_base(0);

        /*
         * If hint address is above DEFAULT_MAP_WINDOW, look for unmapped area
         * in the full address space.
         */
        if (addr > DEFAULT_MAP_WINDOW && !in_32bit_syscall())
                info.high_limit += TASK_SIZE_MAX - DEFAULT_MAP_WINDOW;

        info.align_mask = PAGE_MASK & ~huge_page_mask(h);
        addr = vm_unmapped_area(&info);

        /*
         * A failed mmap() very likely causes application failure,
         * so fall back to the bottom-up function here. This scenario
         * can happen with large stack limits and large mmap()
         * allocations.
         */
        if (addr & ~PAGE_MASK) {
                VM_BUG_ON(addr != -ENOMEM);
                info.flags = 0;
                info.low_limit = TASK_UNMAPPED_BASE;
                info.high_limit = TASK_SIZE_LOW;
                addr = vm_unmapped_area(&info);
        }

        return addr;
}

unsigned long
hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                unsigned long len, unsigned long pgoff, unsigned long flags)
{
        struct hstate *h = hstate_file(file);
        struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma;

        if (len & ~huge_page_mask(h))
                return -EINVAL;

        if (len > TASK_SIZE)
                return -ENOMEM;

        /* No address checking. See comment at mmap_address_hint_valid() */
        if (flags & MAP_FIXED) {
                if (prepare_hugepage_range(file, addr, len))
                        return -EINVAL;
                return addr;
        }

        if (addr) {
                addr &= huge_page_mask(h);
                if (!mmap_address_hint_valid(addr, len))
                        goto get_unmapped_area;

                vma = find_vma(mm, addr);
                if (!vma || addr + len <= vm_start_gap(vma))
                        return addr;
        }

get_unmapped_area:
        if (!test_bit(MMF_TOPDOWN, &mm->flags))
                return hugetlb_get_unmapped_area_bottomup(file, addr, len,
                                pgoff, flags);
        else
                return hugetlb_get_unmapped_area_topdown(file, addr, len,
                                pgoff, flags);
}
#endif /* CONFIG_HUGETLB_PAGE */

#ifdef CONFIG_X86_64
bool __init arch_hugetlb_valid_size(unsigned long size)
{
        if (size == PMD_SIZE)
                return true;
        else if (size == PUD_SIZE && boot_cpu_has(X86_FEATURE_GBPAGES))
                return true;
        else
                return false;
}

#ifdef CONFIG_CONTIG_ALLOC
static __init int gigantic_pages_init(void)
{
        /* With compaction or CMA we can allocate gigantic pages at runtime */
        if (boot_cpu_has(X86_FEATURE_GBPAGES))
                hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
        return 0;
}
arch_initcall(gigantic_pages_init);
#endif
#endif























































   12 






   11 


















    1 

























































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
// SPDX-License-Identifier: GPL-2.0
/*
 * Verification of builtin signatures
 *
 * Copyright 2019 Google LLC
 */

/*
 * This file implements verification of fs-verity builtin signatures.  Please
 * take great care before using this feature.  It is not the only way to do
 * signatures with fs-verity, and the alternatives (such as userspace signature
 * verification, and IMA appraisal) can be much better.  For details about the
 * limitations of this feature, see Documentation/filesystems/fsverity.rst.
 */

#include "fsverity_private.h"

#include <linux/cred.h>
#include <linux/key.h>
#include <linux/security.h>
#include <linux/slab.h>
#include <linux/verification.h>

/*
 * /proc/sys/fs/verity/require_signatures
 * If 1, all verity files must have a valid builtin signature.
 */
int fsverity_require_signatures;

/*
 * Keyring that contains the trusted X.509 certificates.
 *
 * Only root (kuid=0) can modify this.  Also, root may use
 * keyctl_restrict_keyring() to prevent any more additions.
 */
static struct key *fsverity_keyring;

/**
 * fsverity_verify_signature() - check a verity file's signature
 * @vi: the file's fsverity_info
 * @signature: the file's built-in signature
 * @sig_size: size of signature in bytes, or 0 if no signature
 *
 * If the file includes a signature of its fs-verity file digest, verify it
 * against the certificates in the fs-verity keyring. Note that signatures
 * are verified regardless of the state of the 'fsverity_require_signatures'
 * variable and the LSM subsystem relies on this behavior to help enforce
 * file integrity policies. Please discuss changes with the LSM list
 * (thank you!).
 *
 * Return: 0 on success (signature valid or not required); -errno on failure
 */
int fsverity_verify_signature(const struct fsverity_info *vi,
                              const u8 *signature, size_t sig_size)
{
        const struct inode *inode = vi->inode;
        const struct fsverity_hash_alg *hash_alg = vi->tree_params.hash_alg;
        struct fsverity_formatted_digest *d;
        int err;

        if (sig_size == 0) {
                if (fsverity_require_signatures) {
                        fsverity_err(inode,
                                     "require_signatures=1, rejecting unsigned file!");
                        return -EPERM;
                }
                return 0;
        }

        if (fsverity_keyring->keys.nr_leaves_on_tree == 0) {
                /*
                 * The ".fs-verity" keyring is empty, due to builtin signatures
                 * being supported by the kernel but not actually being used.
                 * In this case, verify_pkcs7_signature() would always return an
                 * error, usually ENOKEY.  It could also be EBADMSG if the
                 * PKCS#7 is malformed, but that isn't very important to
                 * distinguish.  So, just skip to ENOKEY to avoid the attack
                 * surface of the PKCS#7 parser, which would otherwise be
                 * reachable by any task able to execute FS_IOC_ENABLE_VERITY.
                 */
                fsverity_err(inode,
                             "fs-verity keyring is empty, rejecting signed file!");
                return -ENOKEY;
        }

        d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);
        if (!d)
                return -ENOMEM;
        memcpy(d->magic, "FSVerity", 8);
        d->digest_algorithm = cpu_to_le16(hash_alg - fsverity_hash_algs);
        d->digest_size = cpu_to_le16(hash_alg->digest_size);
        memcpy(d->digest, vi->file_digest, hash_alg->digest_size);

        err = verify_pkcs7_signature(d, sizeof(*d) + hash_alg->digest_size,
                                     signature, sig_size, fsverity_keyring,
                                     VERIFYING_UNSPECIFIED_SIGNATURE,
                                     NULL, NULL);
        kfree(d);

        if (err) {
                if (err == -ENOKEY)
                        fsverity_err(inode,
                                     "File's signing cert isn't in the fs-verity keyring");
                else if (err == -EKEYREJECTED)
                        fsverity_err(inode, "Incorrect file signature");
                else if (err == -EBADMSG)
                        fsverity_err(inode, "Malformed file signature");
                else
                        fsverity_err(inode, "Error %d verifying file signature",
                                     err);
                return err;
        }

        err = security_inode_setintegrity(inode,
                                          LSM_INT_FSVERITY_BUILTINSIG_VALID,
                                          signature,
                                          sig_size);

        if (err) {
                fsverity_err(inode, "Error %d exposing file signature to LSMs",
                             err);
                return err;
        }

        return 0;
}

void __init fsverity_init_signature(void)
{
        fsverity_keyring =
                keyring_alloc(".fs-verity", KUIDT_INIT(0), KGIDT_INIT(0),
                              current_cred(), KEY_POS_SEARCH |
                                KEY_USR_VIEW | KEY_USR_READ | KEY_USR_WRITE |
                                KEY_USR_SEARCH | KEY_USR_SETATTR,
                              KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
        if (IS_ERR(fsverity_keyring))
                panic("failed to allocate \".fs-verity\" keyring");
}





















   67 
















    3 














   43 


   56 
   59 







   33 

   33 


   35 
   29 







   10 



















   11 










   63 


   13 




   10 

   39 

   17 






















   49 



















   35 













    1 






    1 








    4 



   27 



   13 





    7 


















    7 
   11 

















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
// SPDX-License-Identifier: GPL-2.0
/*
 *  linux/fs/hfsplus/bitmap.c
 *
 * Copyright (C) 2001
 * Brad Boyer (flar@allandria.com)
 * (C) 2003 Ardis Technologies <roman@ardistech.com>
 *
 * Handling of allocation file
 */

#include <linux/pagemap.h>

#include "hfsplus_fs.h"
#include "hfsplus_raw.h"

#define PAGE_CACHE_BITS        (PAGE_SIZE * 8)

int hfsplus_block_allocate(struct super_block *sb, u32 size,
                u32 offset, u32 *max)
{
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
        struct page *page;
        struct address_space *mapping;
        __be32 *pptr, *curr, *end;
        u32 mask, start, len, n;
        __be32 val;
        int i;

        len = *max;
        if (!len)
                return size;

        hfs_dbg(BITMAP, "block_allocate: %u,%u,%u\n", size, offset, len);
        mutex_lock(&sbi->alloc_mutex);
        mapping = sbi->alloc_file->i_mapping;
        page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL);
        if (IS_ERR(page)) {
                start = size;
                goto out;
        }
        pptr = kmap_local_page(page);
        curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
        i = offset % 32;
        offset &= ~(PAGE_CACHE_BITS - 1);
        if ((size ^ offset) / PAGE_CACHE_BITS)
                end = pptr + PAGE_CACHE_BITS / 32;
        else
                end = pptr + ((size + 31) & (PAGE_CACHE_BITS - 1)) / 32;

        /* scan the first partial u32 for zero bits */
        val = *curr;
        if (~val) {
                n = be32_to_cpu(val);
                mask = (1U << 31) >> i;
                for (; i < 32; mask >>= 1, i++) {
                        if (!(n & mask))
                                goto found;
                }
        }
        curr++;

        /* scan complete u32s for the first zero bit */
        while (1) {
                while (curr < end) {
                        val = *curr;
                        if (~val) {
                                n = be32_to_cpu(val);
                                mask = 1 << 31;
                                for (i = 0; i < 32; mask >>= 1, i++) {
                                        if (!(n & mask))
                                                goto found;
                                }
                        }
                        curr++;
                }
                kunmap_local(pptr);
                offset += PAGE_CACHE_BITS;
                if (offset >= size)
                        break;
                page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
                                         NULL);
                if (IS_ERR(page)) {
                        start = size;
                        goto out;
                }
                curr = pptr = kmap_local_page(page);
                if ((size ^ offset) / PAGE_CACHE_BITS)
                        end = pptr + PAGE_CACHE_BITS / 32;
                else
                        end = pptr + ((size + 31) & (PAGE_CACHE_BITS - 1)) / 32;
        }
        hfs_dbg(BITMAP, "bitmap full\n");
        start = size;
        goto out;

found:
        start = offset + (curr - pptr) * 32 + i;
        if (start >= size) {
                hfs_dbg(BITMAP, "bitmap full\n");
                goto out;
        }
        /* do any partial u32 at the start */
        len = min(size - start, len);
        while (1) {
                n |= mask;
                if (++i >= 32)
                        break;
                mask >>= 1;
                if (!--len || n & mask)
                        goto done;
        }
        if (!--len)
                goto done;
        *curr++ = cpu_to_be32(n);
        /* do full u32s */
        while (1) {
                while (curr < end) {
                        n = be32_to_cpu(*curr);
                        if (len < 32)
                                goto last;
                        if (n) {
                                len = 32;
                                goto last;
                        }
                        *curr++ = cpu_to_be32(0xffffffff);
                        len -= 32;
                }
                set_page_dirty(page);
                kunmap_local(pptr);
                offset += PAGE_CACHE_BITS;
                page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS,
                                         NULL);
                if (IS_ERR(page)) {
                        start = size;
                        goto out;
                }
                pptr = kmap_local_page(page);
                curr = pptr;
                end = pptr + PAGE_CACHE_BITS / 32;
        }
last:
        /* do any partial u32 at end */
        mask = 1U << 31;
        for (i = 0; i < len; i++) {
                if (n & mask)
                        break;
                n |= mask;
                mask >>= 1;
        }
done:
        *curr = cpu_to_be32(n);
        set_page_dirty(page);
        kunmap_local(pptr);
        *max = offset + (curr - pptr) * 32 + i - start;
        sbi->free_blocks -= *max;
        hfsplus_mark_mdb_dirty(sb);
        hfs_dbg(BITMAP, "-> %u,%u\n", start, *max);
out:
        mutex_unlock(&sbi->alloc_mutex);
        return start;
}

int hfsplus_block_free(struct super_block *sb, u32 offset, u32 count)
{
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
        struct page *page;
        struct address_space *mapping;
        __be32 *pptr, *curr, *end;
        u32 mask, len, pnr;
        int i;

        /* is there any actual work to be done? */
        if (!count)
                return 0;

        hfs_dbg(BITMAP, "block_free: %u,%u\n", offset, count);
        /* are all of the bits in range? */
        if ((offset + count) > sbi->total_blocks)
                return -ENOENT;

        mutex_lock(&sbi->alloc_mutex);
        mapping = sbi->alloc_file->i_mapping;
        pnr = offset / PAGE_CACHE_BITS;
        page = read_mapping_page(mapping, pnr, NULL);
        if (IS_ERR(page))
                goto kaboom;
        pptr = kmap_local_page(page);
        curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
        end = pptr + PAGE_CACHE_BITS / 32;
        len = count;

        /* do any partial u32 at the start */
        i = offset % 32;
        if (i) {
                int j = 32 - i;
                mask = 0xffffffffU << j;
                if (j > count) {
                        mask |= 0xffffffffU >> (i + count);
                        *curr++ &= cpu_to_be32(mask);
                        goto out;
                }
                *curr++ &= cpu_to_be32(mask);
                count -= j;
        }

        /* do full u32s */
        while (1) {
                while (curr < end) {
                        if (count < 32)
                                goto done;
                        *curr++ = 0;
                        count -= 32;
                }
                if (!count)
                        break;
                set_page_dirty(page);
                kunmap_local(pptr);
                page = read_mapping_page(mapping, ++pnr, NULL);
                if (IS_ERR(page))
                        goto kaboom;
                pptr = kmap_local_page(page);
                curr = pptr;
                end = pptr + PAGE_CACHE_BITS / 32;
        }
done:
        /* do any partial u32 at end */
        if (count) {
                mask = 0xffffffffU >> count;
                *curr &= cpu_to_be32(mask);
        }
out:
        set_page_dirty(page);
        kunmap_local(pptr);
        sbi->free_blocks += len;
        hfsplus_mark_mdb_dirty(sb);
        mutex_unlock(&sbi->alloc_mutex);

        return 0;

kaboom:
        pr_crit("unable to mark blocks free: error %ld\n", PTR_ERR(page));
        mutex_unlock(&sbi->alloc_mutex);

        return -EIO;
}

























































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * linux/include/linux/sunrpc/addr.h
 *
 * Various routines for copying and comparing sockaddrs and for
 * converting them to and from presentation format.
 */
#ifndef _LINUX_SUNRPC_ADDR_H
#define _LINUX_SUNRPC_ADDR_H

#include <linux/socket.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <net/ipv6.h>

size_t                rpc_ntop(const struct sockaddr *, char *, const size_t);
size_t                rpc_pton(struct net *, const char *, const size_t,
                         struct sockaddr *, const size_t);
char *                rpc_sockaddr2uaddr(const struct sockaddr *, gfp_t);
size_t                rpc_uaddr2sockaddr(struct net *, const char *, const size_t,
                                   struct sockaddr *, const size_t);

static inline unsigned short rpc_get_port(const struct sockaddr *sap)
{
        switch (sap->sa_family) {
        case AF_INET:
                return ntohs(((struct sockaddr_in *)sap)->sin_port);
        case AF_INET6:
                return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
        }
        return 0;
}

static inline void rpc_set_port(struct sockaddr *sap,
                                const unsigned short port)
{
        switch (sap->sa_family) {
        case AF_INET:
                ((struct sockaddr_in *)sap)->sin_port = htons(port);
                break;
        case AF_INET6:
                ((struct sockaddr_in6 *)sap)->sin6_port = htons(port);
                break;
        }
}

#define IPV6_SCOPE_DELIMITER                '%'
#define IPV6_SCOPE_ID_LEN                sizeof("%nnnnnnnnnn")

static inline bool rpc_cmp_addr4(const struct sockaddr *sap1,
                                 const struct sockaddr *sap2)
{
        const struct sockaddr_in *sin1 = (const struct sockaddr_in *)sap1;
        const struct sockaddr_in *sin2 = (const struct sockaddr_in *)sap2;

        return sin1->sin_addr.s_addr == sin2->sin_addr.s_addr;
}

static inline bool __rpc_copy_addr4(struct sockaddr *dst,
                                    const struct sockaddr *src)
{
        const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
        struct sockaddr_in *dsin = (struct sockaddr_in *) dst;

        dsin->sin_family = ssin->sin_family;
        dsin->sin_addr.s_addr = ssin->sin_addr.s_addr;
        return true;
}

#if IS_ENABLED(CONFIG_IPV6)
static inline bool rpc_cmp_addr6(const struct sockaddr *sap1,
                                 const struct sockaddr *sap2)
{
        const struct sockaddr_in6 *sin1 = (const struct sockaddr_in6 *)sap1;
        const struct sockaddr_in6 *sin2 = (const struct sockaddr_in6 *)sap2;

        if (!ipv6_addr_equal(&sin1->sin6_addr, &sin2->sin6_addr))
                return false;
        else if (ipv6_addr_type(&sin1->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                return sin1->sin6_scope_id == sin2->sin6_scope_id;

        return true;
}

static inline bool __rpc_copy_addr6(struct sockaddr *dst,
                                    const struct sockaddr *src)
{
        const struct sockaddr_in6 *ssin6 = (const struct sockaddr_in6 *) src;
        struct sockaddr_in6 *dsin6 = (struct sockaddr_in6 *) dst;

        dsin6->sin6_family = ssin6->sin6_family;
        dsin6->sin6_addr = ssin6->sin6_addr;
        dsin6->sin6_scope_id = ssin6->sin6_scope_id;
        return true;
}
#else        /* !(IS_ENABLED(CONFIG_IPV6) */
static inline bool rpc_cmp_addr6(const struct sockaddr *sap1,
                                   const struct sockaddr *sap2)
{
        return false;
}

static inline bool __rpc_copy_addr6(struct sockaddr *dst,
                                    const struct sockaddr *src)
{
        return false;
}
#endif        /* !(IS_ENABLED(CONFIG_IPV6) */

/**
 * rpc_cmp_addr - compare the address portion of two sockaddrs.
 * @sap1: first sockaddr
 * @sap2: second sockaddr
 *
 * Just compares the family and address portion. Ignores port, but
 * compares the scope if it's a link-local address.
 *
 * Returns true if the addrs are equal, false if they aren't.
 */
static inline bool rpc_cmp_addr(const struct sockaddr *sap1,
                                const struct sockaddr *sap2)
{
        if (sap1->sa_family == sap2->sa_family) {
                switch (sap1->sa_family) {
                case AF_INET:
                        return rpc_cmp_addr4(sap1, sap2);
                case AF_INET6:
                        return rpc_cmp_addr6(sap1, sap2);
                }
        }
        return false;
}

/**
 * rpc_cmp_addr_port - compare the address and port number of two sockaddrs.
 * @sap1: first sockaddr
 * @sap2: second sockaddr
 */
static inline bool rpc_cmp_addr_port(const struct sockaddr *sap1,
                                     const struct sockaddr *sap2)
{
        if (!rpc_cmp_addr(sap1, sap2))
                return false;
        return rpc_get_port(sap1) == rpc_get_port(sap2);
}

/**
 * rpc_copy_addr - copy the address portion of one sockaddr to another
 * @dst: destination sockaddr
 * @src: source sockaddr
 *
 * Just copies the address portion and family. Ignores port, scope, etc.
 * Caller is responsible for making certain that dst is large enough to hold
 * the address in src. Returns true if address family is supported. Returns
 * false otherwise.
 */
static inline bool rpc_copy_addr(struct sockaddr *dst,
                                 const struct sockaddr *src)
{
        switch (src->sa_family) {
        case AF_INET:
                return __rpc_copy_addr4(dst, src);
        case AF_INET6:
                return __rpc_copy_addr6(dst, src);
        }
        return false;
}

/**
 * rpc_get_scope_id - return scopeid for a given sockaddr
 * @sa: sockaddr to get scopeid from
 *
 * Returns the value of the sin6_scope_id for AF_INET6 addrs, or 0 if
 * not an AF_INET6 address.
 */
static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
{
        if (sa->sa_family != AF_INET6)
                return 0;

        return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
}

#endif /* _LINUX_SUNRPC_ADDR_H */























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    4 
    4 





    2 





    2 


    2 


    2 
















    2 




    2 













    4 

    4 







































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
// SPDX-License-Identifier: GPL-2.0

#define pr_fmt(fmt)  "irq: " fmt

#include <linux/acpi.h>
#include <linux/debugfs.h>
#include <linux/hardirq.h>
#include <linux/interrupt.h>
#include <linux/irq.h>
#include <linux/irqdesc.h>
#include <linux/irqdomain.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/of_address.h>
#include <linux/of_irq.h>
#include <linux/topology.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include <linux/smp.h>
#include <linux/fs.h>

static LIST_HEAD(irq_domain_list);
static DEFINE_MUTEX(irq_domain_mutex);

static struct irq_domain *irq_default_domain;

static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base,
                                        unsigned int nr_irqs, int node, void *arg,
                                        bool realloc, const struct irq_affinity_desc *affinity);
static void irq_domain_check_hierarchy(struct irq_domain *domain);
static void irq_domain_free_one_irq(struct irq_domain *domain, unsigned int virq);

struct irqchip_fwid {
        struct fwnode_handle        fwnode;
        unsigned int                type;
        char                        *name;
        phys_addr_t                *pa;
};

#ifdef CONFIG_GENERIC_IRQ_DEBUGFS
static void debugfs_add_domain_dir(struct irq_domain *d);
static void debugfs_remove_domain_dir(struct irq_domain *d);
#else
static inline void debugfs_add_domain_dir(struct irq_domain *d) { }
static inline void debugfs_remove_domain_dir(struct irq_domain *d) { }
#endif

static const char *irqchip_fwnode_get_name(const struct fwnode_handle *fwnode)
{
        struct irqchip_fwid *fwid = container_of(fwnode, struct irqchip_fwid, fwnode);

        return fwid->name;
}

const struct fwnode_operations irqchip_fwnode_ops = {
        .get_name = irqchip_fwnode_get_name,
};
EXPORT_SYMBOL_GPL(irqchip_fwnode_ops);

/**
 * __irq_domain_alloc_fwnode - Allocate a fwnode_handle suitable for
 *                           identifying an irq domain
 * @type:        Type of irqchip_fwnode. See linux/irqdomain.h
 * @id:                Optional user provided id if name != NULL
 * @name:        Optional user provided domain name
 * @pa:                Optional user-provided physical address
 *
 * Allocate a struct irqchip_fwid, and return a pointer to the embedded
 * fwnode_handle (or NULL on failure).
 *
 * Note: The types IRQCHIP_FWNODE_NAMED and IRQCHIP_FWNODE_NAMED_ID are
 * solely to transport name information to irqdomain creation code. The
 * node is not stored. For other types the pointer is kept in the irq
 * domain struct.
 */
struct fwnode_handle *__irq_domain_alloc_fwnode(unsigned int type, int id,
                                                const char *name,
                                                phys_addr_t *pa)
{
        struct irqchip_fwid *fwid;
        char *n;

        fwid = kzalloc(sizeof(*fwid), GFP_KERNEL);

        switch (type) {
        case IRQCHIP_FWNODE_NAMED:
                n = kasprintf(GFP_KERNEL, "%s", name);
                break;
        case IRQCHIP_FWNODE_NAMED_ID:
                n = kasprintf(GFP_KERNEL, "%s-%d", name, id);
                break;
        default:
                n = kasprintf(GFP_KERNEL, "irqchip@%pa", pa);
                break;
        }

        if (!fwid || !n) {
                kfree(fwid);
                kfree(n);
                return NULL;
        }

        fwid->type = type;
        fwid->name = n;
        fwid->pa = pa;
        fwnode_init(&fwid->fwnode, &irqchip_fwnode_ops);
        return &fwid->fwnode;
}
EXPORT_SYMBOL_GPL(__irq_domain_alloc_fwnode);

/**
 * irq_domain_free_fwnode - Free a non-OF-backed fwnode_handle
 * @fwnode: fwnode_handle to free
 *
 * Free a fwnode_handle allocated with irq_domain_alloc_fwnode.
 */
void irq_domain_free_fwnode(struct fwnode_handle *fwnode)
{
        struct irqchip_fwid *fwid;

        if (!fwnode || WARN_ON(!is_fwnode_irqchip(fwnode)))
                return;

        fwid = container_of(fwnode, struct irqchip_fwid, fwnode);
        kfree(fwid->name);
        kfree(fwid);
}
EXPORT_SYMBOL_GPL(irq_domain_free_fwnode);

static int alloc_name(struct irq_domain *domain, char *base, enum irq_domain_bus_token bus_token)
{
        if (bus_token == DOMAIN_BUS_ANY)
                domain->name = kasprintf(GFP_KERNEL, "%s", base);
        else
                domain->name = kasprintf(GFP_KERNEL, "%s-%d", base, bus_token);
        if (!domain->name)
                return -ENOMEM;

        domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;
        return 0;
}

static int alloc_fwnode_name(struct irq_domain *domain, const struct fwnode_handle *fwnode,
                             enum irq_domain_bus_token bus_token, const char *suffix)
{
        const char *sep = suffix ? "-" : "";
        const char *suf = suffix ? : "";
        char *name;

        if (bus_token == DOMAIN_BUS_ANY)
                name = kasprintf(GFP_KERNEL, "%pfw%s%s", fwnode, sep, suf);
        else
                name = kasprintf(GFP_KERNEL, "%pfw%s%s-%d", fwnode, sep, suf, bus_token);
        if (!name)
                return -ENOMEM;

        /*
         * fwnode paths contain '/', which debugfs is legitimately unhappy
         * about. Replace them with ':', which does the trick and is not as
         * offensive as '\'...
         */
        domain->name = strreplace(name, '/', ':');
        domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;
        return 0;
}

static int alloc_unknown_name(struct irq_domain *domain, enum irq_domain_bus_token bus_token)
{
        static atomic_t unknown_domains;
        int id = atomic_inc_return(&unknown_domains);

        if (bus_token == DOMAIN_BUS_ANY)
                domain->name = kasprintf(GFP_KERNEL, "unknown-%d", id);
        else
                domain->name = kasprintf(GFP_KERNEL, "unknown-%d-%d", id, bus_token);
        if (!domain->name)
                return -ENOMEM;

        domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;
        return 0;
}

static int irq_domain_set_name(struct irq_domain *domain, const struct irq_domain_info *info)
{
        enum irq_domain_bus_token bus_token = info->bus_token;
        const struct fwnode_handle *fwnode = info->fwnode;

        if (is_fwnode_irqchip(fwnode)) {
                struct irqchip_fwid *fwid = container_of(fwnode, struct irqchip_fwid, fwnode);

                /*
                 * The name_suffix is only intended to be used to avoid a name
                 * collision when multiple domains are created for a single
                 * device and the name is picked using a real device node.
                 * (Typical use-case is regmap-IRQ controllers for devices
                 * providing more than one physical IRQ.) There should be no
                 * need to use name_suffix with irqchip-fwnode.
                 */
                if (info->name_suffix)
                        return -EINVAL;

                switch (fwid->type) {
                case IRQCHIP_FWNODE_NAMED:
                case IRQCHIP_FWNODE_NAMED_ID:
                        return alloc_name(domain, fwid->name, bus_token);
                default:
                        domain->name = fwid->name;
                        if (bus_token != DOMAIN_BUS_ANY)
                                return alloc_name(domain, fwid->name, bus_token);
                }

        } else if (is_of_node(fwnode) || is_acpi_device_node(fwnode) || is_software_node(fwnode)) {
                return alloc_fwnode_name(domain, fwnode, bus_token, info->name_suffix);
        }

        if (domain->name)
                return 0;

        if (fwnode)
                pr_err("Invalid fwnode type for irqdomain\n");
        return alloc_unknown_name(domain, bus_token);
}

static struct irq_domain *__irq_domain_create(const struct irq_domain_info *info)
{
        struct irq_domain *domain;
        int err;

        if (WARN_ON((info->size && info->direct_max) ||
                    (!IS_ENABLED(CONFIG_IRQ_DOMAIN_NOMAP) && info->direct_max) ||
                    (info->direct_max && info->direct_max != info->hwirq_max)))
                return ERR_PTR(-EINVAL);

        domain = kzalloc_node(struct_size(domain, revmap, info->size),
                              GFP_KERNEL, of_node_to_nid(to_of_node(info->fwnode)));
        if (!domain)
                return ERR_PTR(-ENOMEM);

        err = irq_domain_set_name(domain, info);
        if (err) {
                kfree(domain);
                return ERR_PTR(err);
        }

        domain->fwnode = fwnode_handle_get(info->fwnode);
        fwnode_dev_initialized(domain->fwnode, true);

        /* Fill structure */
        INIT_RADIX_TREE(&domain->revmap_tree, GFP_KERNEL);
        domain->ops = info->ops;
        domain->host_data = info->host_data;
        domain->bus_token = info->bus_token;
        domain->hwirq_max = info->hwirq_max;

        if (info->direct_max)
                domain->flags |= IRQ_DOMAIN_FLAG_NO_MAP;

        domain->revmap_size = info->size;

        /*
         * Hierarchical domains use the domain lock of the root domain
         * (innermost domain).
         *
         * For non-hierarchical domains (as for root domains), the root
         * pointer is set to the domain itself so that &domain->root->mutex
         * always points to the right lock.
         */
        mutex_init(&domain->mutex);
        domain->root = domain;

        irq_domain_check_hierarchy(domain);

        return domain;
}

static void __irq_domain_publish(struct irq_domain *domain)
{
        mutex_lock(&irq_domain_mutex);
        debugfs_add_domain_dir(domain);
        list_add(&domain->link, &irq_domain_list);
        mutex_unlock(&irq_domain_mutex);

        pr_debug("Added domain %s\n", domain->name);
}

static void irq_domain_free(struct irq_domain *domain)
{
        fwnode_dev_initialized(domain->fwnode, false);
        fwnode_handle_put(domain->fwnode);
        if (domain->flags & IRQ_DOMAIN_NAME_ALLOCATED)
                kfree(domain->name);
        kfree(domain);
}

static void irq_domain_instantiate_descs(const struct irq_domain_info *info)
{
        if (!IS_ENABLED(CONFIG_SPARSE_IRQ))
                return;

        if (irq_alloc_descs(info->virq_base, info->virq_base, info->size,
                            of_node_to_nid(to_of_node(info->fwnode))) < 0) {
                pr_info("Cannot allocate irq_descs @ IRQ%d, assuming pre-allocated\n",
                        info->virq_base);
        }
}

static struct irq_domain *__irq_domain_instantiate(const struct irq_domain_info *info,
                                                   bool cond_alloc_descs, bool force_associate)
{
        struct irq_domain *domain;
        int err;

        domain = __irq_domain_create(info);
        if (IS_ERR(domain))
                return domain;

        domain->flags |= info->domain_flags;
        domain->exit = info->exit;

#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
        if (info->parent) {
                domain->root = info->parent->root;
                domain->parent = info->parent;
        }
#endif

        if (info->dgc_info) {
                err = irq_domain_alloc_generic_chips(domain, info->dgc_info);
                if (err)
                        goto err_domain_free;
        }

        if (info->init) {
                err = info->init(domain);
                if (err)
                        goto err_domain_gc_remove;
        }

        __irq_domain_publish(domain);

        if (cond_alloc_descs && info->virq_base > 0)
                irq_domain_instantiate_descs(info);

        /*
         * Legacy interrupt domains have a fixed Linux interrupt number
         * associated. Other interrupt domains can request association by
         * providing a Linux interrupt number > 0.
         */
        if (force_associate || info->virq_base > 0) {
                irq_domain_associate_many(domain, info->virq_base, info->hwirq_base,
                                          info->size - info->hwirq_base);
        }

        return domain;

err_domain_gc_remove:
        if (info->dgc_info)
                irq_domain_remove_generic_chips(domain);
err_domain_free:
        irq_domain_free(domain);
        return ERR_PTR(err);
}

/**
 * irq_domain_instantiate() - Instantiate a new irq domain data structure
 * @info: Domain information pointer pointing to the information for this domain
 *
 * Return: A pointer to the instantiated irq domain or an ERR_PTR value.
 */
struct irq_domain *irq_domain_instantiate(const struct irq_domain_info *info)
{
        return __irq_domain_instantiate(info, false, false);
}
EXPORT_SYMBOL_GPL(irq_domain_instantiate);

/**
 * irq_domain_remove() - Remove an irq domain.
 * @domain: domain to remove
 *
 * This routine is used to remove an irq domain. The caller must ensure
 * that all mappings within the domain have been disposed of prior to
 * use, depending on the revmap type.
 */
void irq_domain_remove(struct irq_domain *domain)
{
        if (domain->exit)
                domain->exit(domain);

        mutex_lock(&irq_domain_mutex);
        debugfs_remove_domain_dir(domain);

        WARN_ON(!radix_tree_empty(&domain->revmap_tree));

        list_del(&domain->link);

        /*
         * If the going away domain is the default one, reset it.
         */
        if (unlikely(irq_default_domain == domain))
                irq_set_default_host(NULL);

        mutex_unlock(&irq_domain_mutex);

        if (domain->flags & IRQ_DOMAIN_FLAG_DESTROY_GC)
                irq_domain_remove_generic_chips(domain);

        pr_debug("Removed domain %s\n", domain->name);
        irq_domain_free(domain);
}
EXPORT_SYMBOL_GPL(irq_domain_remove);

void irq_domain_update_bus_token(struct irq_domain *domain,
                                 enum irq_domain_bus_token bus_token)
{
        char *name;

        if (domain->bus_token == bus_token)
                return;

        mutex_lock(&irq_domain_mutex);

        domain->bus_token = bus_token;

        name = kasprintf(GFP_KERNEL, "%s-%d", domain->name, bus_token);
        if (!name) {
                mutex_unlock(&irq_domain_mutex);
                return;
        }

        debugfs_remove_domain_dir(domain);

        if (domain->flags & IRQ_DOMAIN_NAME_ALLOCATED)
                kfree(domain->name);
        else
                domain->flags |= IRQ_DOMAIN_NAME_ALLOCATED;

        domain->name = name;
        debugfs_add_domain_dir(domain);

        mutex_unlock(&irq_domain_mutex);
}
EXPORT_SYMBOL_GPL(irq_domain_update_bus_token);

/**
 * irq_domain_create_simple() - Register an irq_domain and optionally map a range of irqs
 * @fwnode: firmware node for the interrupt controller
 * @size: total number of irqs in mapping
 * @first_irq: first number of irq block assigned to the domain,
 *        pass zero to assign irqs on-the-fly. If first_irq is non-zero, then
 *        pre-map all of the irqs in the domain to virqs starting at first_irq.
 * @ops: domain callbacks
 * @host_data: Controller private data pointer
 *
 * Allocates an irq_domain, and optionally if first_irq is positive then also
 * allocate irq_descs and map all of the hwirqs to virqs starting at first_irq.
 *
 * This is intended to implement the expected behaviour for most
 * interrupt controllers. If device tree is used, then first_irq will be 0 and
 * irqs get mapped dynamically on the fly. However, if the controller requires
 * static virq assignments (non-DT boot) then it will set that up correctly.
 */
struct irq_domain *irq_domain_create_simple(struct fwnode_handle *fwnode,
                                            unsigned int size,
                                            unsigned int first_irq,
                                            const struct irq_domain_ops *ops,
                                            void *host_data)
{
        struct irq_domain_info info = {
                .fwnode                = fwnode,
                .size                = size,
                .hwirq_max        = size,
                .virq_base        = first_irq,
                .ops                = ops,
                .host_data        = host_data,
        };
        struct irq_domain *domain = __irq_domain_instantiate(&info, true, false);

        return IS_ERR(domain) ? NULL : domain;
}
EXPORT_SYMBOL_GPL(irq_domain_create_simple);

/**
 * irq_domain_add_legacy() - Allocate and register a legacy revmap irq_domain.
 * @of_node: pointer to interrupt controller's device tree node.
 * @size: total number of irqs in legacy mapping
 * @first_irq: first number of irq block assigned to the domain
 * @first_hwirq: first hwirq number to use for the translation. Should normally
 *               be '0', but a positive integer can be used if the effective
 *               hwirqs numbering does not begin at zero.
 * @ops: map/unmap domain callbacks
 * @host_data: Controller private data pointer
 *
 * Note: the map() callback will be called before this function returns
 * for all legacy interrupts except 0 (which is always the invalid irq for
 * a legacy controller).
 */
struct irq_domain *irq_domain_add_legacy(struct device_node *of_node,
                                         unsigned int size,
                                         unsigned int first_irq,
                                         irq_hw_number_t first_hwirq,
                                         const struct irq_domain_ops *ops,
                                         void *host_data)
{
        return irq_domain_create_legacy(of_node_to_fwnode(of_node), size,
                                        first_irq, first_hwirq, ops, host_data);
}
EXPORT_SYMBOL_GPL(irq_domain_add_legacy);

struct irq_domain *irq_domain_create_legacy(struct fwnode_handle *fwnode,
                                         unsigned int size,
                                         unsigned int first_irq,
                                         irq_hw_number_t first_hwirq,
                                         const struct irq_domain_ops *ops,
                                         void *host_data)
{
        struct irq_domain_info info = {
                .fwnode                = fwnode,
                .size                = first_hwirq + size,
                .hwirq_max        = first_hwirq + size,
                .hwirq_base        = first_hwirq,
                .virq_base        = first_irq,
                .ops                = ops,
                .host_data        = host_data,
        };
        struct irq_domain *domain = __irq_domain_instantiate(&info, false, true);

        return IS_ERR(domain) ? NULL : domain;
}
EXPORT_SYMBOL_GPL(irq_domain_create_legacy);

/**
 * irq_find_matching_fwspec() - Locates a domain for a given fwspec
 * @fwspec: FW specifier for an interrupt
 * @bus_token: domain-specific data
 */
struct irq_domain *irq_find_matching_fwspec(struct irq_fwspec *fwspec,
                                            enum irq_domain_bus_token bus_token)
{
        struct irq_domain *h, *found = NULL;
        struct fwnode_handle *fwnode = fwspec->fwnode;
        int rc;

        /*
         * We might want to match the legacy controller last since
         * it might potentially be set to match all interrupts in
         * the absence of a device node. This isn't a problem so far
         * yet though...
         *
         * bus_token == DOMAIN_BUS_ANY matches any domain, any other
         * values must generate an exact match for the domain to be
         * selected.
         */
        mutex_lock(&irq_domain_mutex);
        list_for_each_entry(h, &irq_domain_list, link) {
                if (h->ops->select && bus_token != DOMAIN_BUS_ANY)
                        rc = h->ops->select(h, fwspec, bus_token);
                else if (h->ops->match)
                        rc = h->ops->match(h, to_of_node(fwnode), bus_token);
                else
                        rc = ((fwnode != NULL) && (h->fwnode == fwnode) &&
                              ((bus_token == DOMAIN_BUS_ANY) ||
                               (h->bus_token == bus_token)));

                if (rc) {
                        found = h;
                        break;
                }
        }
        mutex_unlock(&irq_domain_mutex);
        return found;
}
EXPORT_SYMBOL_GPL(irq_find_matching_fwspec);

/**
 * irq_set_default_host() - Set a "default" irq domain
 * @domain: default domain pointer
 *
 * For convenience, it's possible to set a "default" domain that will be used
 * whenever NULL is passed to irq_create_mapping(). It makes life easier for
 * platforms that want to manipulate a few hard coded interrupt numbers that
 * aren't properly represented in the device-tree.
 */
void irq_set_default_host(struct irq_domain *domain)
{
        pr_debug("Default domain set to @0x%p\n", domain);

        irq_default_domain = domain;
}
EXPORT_SYMBOL_GPL(irq_set_default_host);

/**
 * irq_get_default_host() - Retrieve the "default" irq domain
 *
 * Returns: the default domain, if any.
 *
 * Modern code should never use this. This should only be used on
 * systems that cannot implement a firmware->fwnode mapping (which
 * both DT and ACPI provide).
 */
struct irq_domain *irq_get_default_host(void)
{
        return irq_default_domain;
}
EXPORT_SYMBOL_GPL(irq_get_default_host);

static bool irq_domain_is_nomap(struct irq_domain *domain)
{
        return IS_ENABLED(CONFIG_IRQ_DOMAIN_NOMAP) &&
               (domain->flags & IRQ_DOMAIN_FLAG_NO_MAP);
}

static void irq_domain_clear_mapping(struct irq_domain *domain,
                                     irq_hw_number_t hwirq)
{
        lockdep_assert_held(&domain->root->mutex);

        if (irq_domain_is_nomap(domain))
                return;

        if (hwirq < domain->revmap_size)
                rcu_assign_pointer(domain->revmap[hwirq], NULL);
        else
                radix_tree_delete(&domain->revmap_tree, hwirq);
}

static void irq_domain_set_mapping(struct irq_domain *domain,
                                   irq_hw_number_t hwirq,
                                   struct irq_data *irq_data)
{
        /*
         * This also makes sure that all domains point to the same root when
         * called from irq_domain_insert_irq() for each domain in a hierarchy.
         */
        lockdep_assert_held(&domain->root->mutex);

        if (irq_domain_is_nomap(domain))
                return;

        if (hwirq < domain->revmap_size)
                rcu_assign_pointer(domain->revmap[hwirq], irq_data);
        else
                radix_tree_insert(&domain->revmap_tree, hwirq, irq_data);
}

static void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq)
{
        struct irq_data *irq_data = irq_get_irq_data(irq);
        irq_hw_number_t hwirq;

        if (WARN(!irq_data || irq_data->domain != domain,
                 "virq%i doesn't exist; cannot disassociate\n", irq))
                return;

        hwirq = irq_data->hwirq;

        mutex_lock(&domain->root->mutex);

        irq_set_status_flags(irq, IRQ_NOREQUEST);

        /* remove chip and handler */
        irq_set_chip_and_handler(irq, NULL, NULL);

        /* Make sure it's completed */
        synchronize_irq(irq);

        /* Tell the PIC about it */
        if (domain->ops->unmap)
                domain->ops->unmap(domain, irq);
        smp_mb();

        irq_data->domain = NULL;
        irq_data->hwirq = 0;
        domain->mapcount--;

        /* Clear reverse map for this hwirq */
        irq_domain_clear_mapping(domain, hwirq);

        mutex_unlock(&domain->root->mutex);
}

static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq,
                                       irq_hw_number_t hwirq)
{
        struct irq_data *irq_data = irq_get_irq_data(virq);
        int ret;

        if (WARN(hwirq >= domain->hwirq_max,
                 "error: hwirq 0x%x is too large for %s\n", (int)hwirq, domain->name))
                return -EINVAL;
        if (WARN(!irq_data, "error: virq%i is not allocated", virq))
                return -EINVAL;
        if (WARN(irq_data->domain, "error: virq%i is already associated", virq))
                return -EINVAL;

        irq_data->hwirq = hwirq;
        irq_data->domain = domain;
        if (domain->ops->map) {
                ret = domain->ops->map(domain, virq, hwirq);
                if (ret != 0) {
                        /*
                         * If map() returns -EPERM, this interrupt is protected
                         * by the firmware or some other service and shall not
                         * be mapped. Don't bother telling the user about it.
                         */
                        if (ret != -EPERM) {
                                pr_info("%s didn't like hwirq-0x%lx to VIRQ%i mapping (rc=%d)\n",
                                       domain->name, hwirq, virq, ret);
                        }
                        irq_data->domain = NULL;
                        irq_data->hwirq = 0;
                        return ret;
                }
        }

        domain->mapcount++;
        irq_domain_set_mapping(domain, hwirq, irq_data);

        irq_clear_status_flags(virq, IRQ_NOREQUEST);

        return 0;
}

int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
                         irq_hw_number_t hwirq)
{
        int ret;

        mutex_lock(&domain->root->mutex);
        ret = irq_domain_associate_locked(domain, virq, hwirq);
        mutex_unlock(&domain->root->mutex);

        return ret;
}
EXPORT_SYMBOL_GPL(irq_domain_associate);

void irq_domain_associate_many(struct irq_domain *domain, unsigned int irq_base,
                               irq_hw_number_t hwirq_base, int count)
{
        struct device_node *of_node;
        int i;

        of_node = irq_domain_get_of_node(domain);
        pr_debug("%s(%s, irqbase=%i, hwbase=%i, count=%i)\n", __func__,
                of_node_full_name(of_node), irq_base, (int)hwirq_base, count);

        for (i = 0; i < count; i++)
                irq_domain_associate(domain, irq_base + i, hwirq_base + i);
}
EXPORT_SYMBOL_GPL(irq_domain_associate_many);

#ifdef CONFIG_IRQ_DOMAIN_NOMAP
/**
 * irq_create_direct_mapping() - Allocate an irq for direct mapping
 * @domain: domain to allocate the irq for or NULL for default domain
 *
 * This routine is used for irq controllers which can choose the hardware
 * interrupt numbers they generate. In such a case it's simplest to use
 * the linux irq as the hardware interrupt number. It still uses the linear
 * or radix tree to store the mapping, but the irq controller can optimize
 * the revmap path by using the hwirq directly.
 */
unsigned int irq_create_direct_mapping(struct irq_domain *domain)
{
        struct device_node *of_node;
        unsigned int virq;

        if (domain == NULL)
                domain = irq_default_domain;

        of_node = irq_domain_get_of_node(domain);
        virq = irq_alloc_desc_from(1, of_node_to_nid(of_node));
        if (!virq) {
                pr_debug("create_direct virq allocation failed\n");
                return 0;
        }
        if (virq >= domain->hwirq_max) {
                pr_err("ERROR: no free irqs available below %lu maximum\n",
                        domain->hwirq_max);
                irq_free_desc(virq);
                return 0;
        }
        pr_debug("create_direct obtained virq %d\n", virq);

        if (irq_domain_associate(domain, virq, virq)) {
                irq_free_desc(virq);
                return 0;
        }

        return virq;
}
EXPORT_SYMBOL_GPL(irq_create_direct_mapping);
#endif

static unsigned int irq_create_mapping_affinity_locked(struct irq_domain *domain,
                                                       irq_hw_number_t hwirq,
                                                       const struct irq_affinity_desc *affinity)
{
        struct device_node *of_node = irq_domain_get_of_node(domain);
        int virq;

        pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq);

        /* Allocate a virtual interrupt number */
        virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node),
                                      affinity);
        if (virq <= 0) {
                pr_debug("-> virq allocation failed\n");
                return 0;
        }

        if (irq_domain_associate_locked(domain, virq, hwirq)) {
                irq_free_desc(virq);
                return 0;
        }

        pr_debug("irq %lu on domain %s mapped to virtual irq %u\n",
                hwirq, of_node_full_name(of_node), virq);

        return virq;
}

/**
 * irq_create_mapping_affinity() - Map a hardware interrupt into linux irq space
 * @domain: domain owning this hardware interrupt or NULL for default domain
 * @hwirq: hardware irq number in that domain space
 * @affinity: irq affinity
 *
 * Only one mapping per hardware interrupt is permitted. Returns a linux
 * irq number.
 * If the sense/trigger is to be specified, set_irq_type() should be called
 * on the number returned from that call.
 */
unsigned int irq_create_mapping_affinity(struct irq_domain *domain,
                                         irq_hw_number_t hwirq,
                                         const struct irq_affinity_desc *affinity)
{
        int virq;

        /* Look for default domain if necessary */
        if (domain == NULL)
                domain = irq_default_domain;
        if (domain == NULL) {
                WARN(1, "%s(, %lx) called with NULL domain\n", __func__, hwirq);
                return 0;
        }

        mutex_lock(&domain->root->mutex);

        /* Check if mapping already exists */
        virq = irq_find_mapping(domain, hwirq);
        if (virq) {
                pr_debug("existing mapping on virq %d\n", virq);
                goto out;
        }

        virq = irq_create_mapping_affinity_locked(domain, hwirq, affinity);
out:
        mutex_unlock(&domain->root->mutex);

        return virq;
}
EXPORT_SYMBOL_GPL(irq_create_mapping_affinity);

static int irq_domain_translate(struct irq_domain *d,
                                struct irq_fwspec *fwspec,
                                irq_hw_number_t *hwirq, unsigned int *type)
{
#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
        if (d->ops->translate)
                return d->ops->translate(d, fwspec, hwirq, type);
#endif
        if (d->ops->xlate)
                return d->ops->xlate(d, to_of_node(fwspec->fwnode),
                                     fwspec->param, fwspec->param_count,
                                     hwirq, type);

        /* If domain has no translation, then we assume interrupt line */
        *hwirq = fwspec->param[0];
        return 0;
}

void of_phandle_args_to_fwspec(struct device_node *np, const u32 *args,
                               unsigned int count, struct irq_fwspec *fwspec)
{
        int i;

        fwspec->fwnode = of_node_to_fwnode(np);
        fwspec->param_count = count;

        for (i = 0; i < count; i++)
                fwspec->param[i] = args[i];
}
EXPORT_SYMBOL_GPL(of_phandle_args_to_fwspec);

unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec)
{
        struct irq_domain *domain;
        struct irq_data *irq_data;
        irq_hw_number_t hwirq;
        unsigned int type = IRQ_TYPE_NONE;
        int virq;

        if (fwspec->fwnode) {
                domain = irq_find_matching_fwspec(fwspec, DOMAIN_BUS_WIRED);
                if (!domain)
                        domain = irq_find_matching_fwspec(fwspec, DOMAIN_BUS_ANY);
        } else {
                domain = irq_default_domain;
        }

        if (!domain) {
                pr_warn("no irq domain found for %s !\n",
                        of_node_full_name(to_of_node(fwspec->fwnode)));
                return 0;
        }

        if (irq_domain_translate(domain, fwspec, &hwirq, &type))
                return 0;

        /*
         * WARN if the irqchip returns a type with bits
         * outside the sense mask set and clear these bits.
         */
        if (WARN_ON(type & ~IRQ_TYPE_SENSE_MASK))
                type &= IRQ_TYPE_SENSE_MASK;

        mutex_lock(&domain->root->mutex);

        /*
         * If we've already configured this interrupt,
         * don't do it again, or hell will break loose.
         */
        virq = irq_find_mapping(domain, hwirq);
        if (virq) {
                /*
                 * If the trigger type is not specified or matches the
                 * current trigger type then we are done so return the
                 * interrupt number.
                 */
                if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq))
                        goto out;

                /*
                 * If the trigger type has not been set yet, then set
                 * it now and return the interrupt number.
                 */
                if (irq_get_trigger_type(virq) == IRQ_TYPE_NONE) {
                        irq_data = irq_get_irq_data(virq);
                        if (!irq_data) {
                                virq = 0;
                                goto out;
                        }

                        irqd_set_trigger_type(irq_data, type);
                        goto out;
                }

                pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n",
                        hwirq, of_node_full_name(to_of_node(fwspec->fwnode)));
                virq = 0;
                goto out;
        }

        if (irq_domain_is_hierarchy(domain)) {
                if (irq_domain_is_msi_device(domain)) {
                        mutex_unlock(&domain->root->mutex);
                        virq = msi_device_domain_alloc_wired(domain, hwirq, type);
                        mutex_lock(&domain->root->mutex);
                } else
                        virq = irq_domain_alloc_irqs_locked(domain, -1, 1, NUMA_NO_NODE,
                                                            fwspec, false, NULL);
                if (virq <= 0) {
                        virq = 0;
                        goto out;
                }
        } else {
                /* Create mapping */
                virq = irq_create_mapping_affinity_locked(domain, hwirq, NULL);
                if (!virq)
                        goto out;
        }

        irq_data = irq_get_irq_data(virq);
        if (WARN_ON(!irq_data)) {
                virq = 0;
                goto out;
        }

        /* Store trigger type */
        irqd_set_trigger_type(irq_data, type);
out:
        mutex_unlock(&domain->root->mutex);

        return virq;
}
EXPORT_SYMBOL_GPL(irq_create_fwspec_mapping);

unsigned int irq_create_of_mapping(struct of_phandle_args *irq_data)
{
        struct irq_fwspec fwspec;

        of_phandle_args_to_fwspec(irq_data->np, irq_data->args,
                                  irq_data->args_count, &fwspec);

        return irq_create_fwspec_mapping(&fwspec);
}
EXPORT_SYMBOL_GPL(irq_create_of_mapping);

/**
 * irq_dispose_mapping() - Unmap an interrupt
 * @virq: linux irq number of the interrupt to unmap
 */
void irq_dispose_mapping(unsigned int virq)
{
        struct irq_data *irq_data;
        struct irq_domain *domain;

        irq_data = virq ? irq_get_irq_data(virq) : NULL;
        if (!irq_data)
                return;

        domain = irq_data->domain;
        if (WARN_ON(domain == NULL))
                return;

        if (irq_domain_is_hierarchy(domain)) {
                irq_domain_free_one_irq(domain, virq);
        } else {
                irq_domain_disassociate(domain, virq);
                irq_free_desc(virq);
        }
}
EXPORT_SYMBOL_GPL(irq_dispose_mapping);

/**
 * __irq_resolve_mapping() - Find a linux irq from a hw irq number.
 * @domain: domain owning this hardware interrupt
 * @hwirq: hardware irq number in that domain space
 * @irq: optional pointer to return the Linux irq if required
 *
 * Returns the interrupt descriptor.
 */
struct irq_desc *__irq_resolve_mapping(struct irq_domain *domain,
                                       irq_hw_number_t hwirq,
                                       unsigned int *irq)
{
        struct irq_desc *desc = NULL;
        struct irq_data *data;

        /* Look for default domain if necessary */
        if (domain == NULL)
                domain = irq_default_domain;
        if (domain == NULL)
                return desc;

        if (irq_domain_is_nomap(domain)) {
                if (hwirq < domain->hwirq_max) {
                        data = irq_domain_get_irq_data(domain, hwirq);
                        if (data && data->hwirq == hwirq)
                                desc = irq_data_to_desc(data);
                        if (irq && desc)
                                *irq = hwirq;
                }

                return desc;
        }

        rcu_read_lock();
        /* Check if the hwirq is in the linear revmap. */
        if (hwirq < domain->revmap_size)
                data = rcu_dereference(domain->revmap[hwirq]);
        else
                data = radix_tree_lookup(&domain->revmap_tree, hwirq);

        if (likely(data)) {
                desc = irq_data_to_desc(data);
                if (irq)
                        *irq = data->irq;
        }

        rcu_read_unlock();
        return desc;
}
EXPORT_SYMBOL_GPL(__irq_resolve_mapping);

/**
 * irq_domain_xlate_onecell() - Generic xlate for direct one cell bindings
 * @d:                Interrupt domain involved in the translation
 * @ctrlr:        The device tree node for the device whose interrupt is translated
 * @intspec:        The interrupt specifier data from the device tree
 * @intsize:        The number of entries in @intspec
 * @out_hwirq:        Pointer to storage for the hardware interrupt number
 * @out_type:        Pointer to storage for the interrupt type
 *
 * Device Tree IRQ specifier translation function which works with one cell
 * bindings where the cell value maps directly to the hwirq number.
 */
int irq_domain_xlate_onecell(struct irq_domain *d, struct device_node *ctrlr,
                             const u32 *intspec, unsigned int intsize,
                             unsigned long *out_hwirq, unsigned int *out_type)
{
        if (WARN_ON(intsize < 1))
                return -EINVAL;
        *out_hwirq = intspec[0];
        *out_type = IRQ_TYPE_NONE;
        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_xlate_onecell);

/**
 * irq_domain_xlate_twocell() - Generic xlate for direct two cell bindings
 * @d:                Interrupt domain involved in the translation
 * @ctrlr:        The device tree node for the device whose interrupt is translated
 * @intspec:        The interrupt specifier data from the device tree
 * @intsize:        The number of entries in @intspec
 * @out_hwirq:        Pointer to storage for the hardware interrupt number
 * @out_type:        Pointer to storage for the interrupt type
 *
 * Device Tree IRQ specifier translation function which works with two cell
 * bindings where the cell values map directly to the hwirq number
 * and linux irq flags.
 */
int irq_domain_xlate_twocell(struct irq_domain *d, struct device_node *ctrlr,
                        const u32 *intspec, unsigned int intsize,
                        irq_hw_number_t *out_hwirq, unsigned int *out_type)
{
        struct irq_fwspec fwspec;

        of_phandle_args_to_fwspec(ctrlr, intspec, intsize, &fwspec);
        return irq_domain_translate_twocell(d, &fwspec, out_hwirq, out_type);
}
EXPORT_SYMBOL_GPL(irq_domain_xlate_twocell);

/**
 * irq_domain_xlate_onetwocell() - Generic xlate for one or two cell bindings
 * @d:                Interrupt domain involved in the translation
 * @ctrlr:        The device tree node for the device whose interrupt is translated
 * @intspec:        The interrupt specifier data from the device tree
 * @intsize:        The number of entries in @intspec
 * @out_hwirq:        Pointer to storage for the hardware interrupt number
 * @out_type:        Pointer to storage for the interrupt type
 *
 * Device Tree IRQ specifier translation function which works with either one
 * or two cell bindings where the cell values map directly to the hwirq number
 * and linux irq flags.
 *
 * Note: don't use this function unless your interrupt controller explicitly
 * supports both one and two cell bindings.  For the majority of controllers
 * the _onecell() or _twocell() variants above should be used.
 */
int irq_domain_xlate_onetwocell(struct irq_domain *d,
                                struct device_node *ctrlr,
                                const u32 *intspec, unsigned int intsize,
                                unsigned long *out_hwirq, unsigned int *out_type)
{
        if (WARN_ON(intsize < 1))
                return -EINVAL;
        *out_hwirq = intspec[0];
        if (intsize > 1)
                *out_type = intspec[1] & IRQ_TYPE_SENSE_MASK;
        else
                *out_type = IRQ_TYPE_NONE;
        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_xlate_onetwocell);

const struct irq_domain_ops irq_domain_simple_ops = {
        .xlate = irq_domain_xlate_onetwocell,
};
EXPORT_SYMBOL_GPL(irq_domain_simple_ops);

/**
 * irq_domain_translate_onecell() - Generic translate for direct one cell
 * bindings
 * @d:                Interrupt domain involved in the translation
 * @fwspec:        The firmware interrupt specifier to translate
 * @out_hwirq:        Pointer to storage for the hardware interrupt number
 * @out_type:        Pointer to storage for the interrupt type
 */
int irq_domain_translate_onecell(struct irq_domain *d,
                                 struct irq_fwspec *fwspec,
                                 unsigned long *out_hwirq,
                                 unsigned int *out_type)
{
        if (WARN_ON(fwspec->param_count < 1))
                return -EINVAL;
        *out_hwirq = fwspec->param[0];
        *out_type = IRQ_TYPE_NONE;
        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_translate_onecell);

/**
 * irq_domain_translate_twocell() - Generic translate for direct two cell
 * bindings
 * @d:                Interrupt domain involved in the translation
 * @fwspec:        The firmware interrupt specifier to translate
 * @out_hwirq:        Pointer to storage for the hardware interrupt number
 * @out_type:        Pointer to storage for the interrupt type
 *
 * Device Tree IRQ specifier translation function which works with two cell
 * bindings where the cell values map directly to the hwirq number
 * and linux irq flags.
 */
int irq_domain_translate_twocell(struct irq_domain *d,
                                 struct irq_fwspec *fwspec,
                                 unsigned long *out_hwirq,
                                 unsigned int *out_type)
{
        if (WARN_ON(fwspec->param_count < 2))
                return -EINVAL;
        *out_hwirq = fwspec->param[0];
        *out_type = fwspec->param[1] & IRQ_TYPE_SENSE_MASK;
        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_translate_twocell);

int irq_domain_alloc_descs(int virq, unsigned int cnt, irq_hw_number_t hwirq,
                           int node, const struct irq_affinity_desc *affinity)
{
        unsigned int hint;

        if (virq >= 0) {
                virq = __irq_alloc_descs(virq, virq, cnt, node, THIS_MODULE,
                                         affinity);
        } else {
                hint = hwirq % nr_irqs;
                if (hint == 0)
                        hint++;
                virq = __irq_alloc_descs(-1, hint, cnt, node, THIS_MODULE,
                                         affinity);
                if (virq <= 0 && hint > 1) {
                        virq = __irq_alloc_descs(-1, 1, cnt, node, THIS_MODULE,
                                                 affinity);
                }
        }

        return virq;
}

/**
 * irq_domain_reset_irq_data - Clear hwirq, chip and chip_data in @irq_data
 * @irq_data:        The pointer to irq_data
 */
void irq_domain_reset_irq_data(struct irq_data *irq_data)
{
        irq_data->hwirq = 0;
        irq_data->chip = &no_irq_chip;
        irq_data->chip_data = NULL;
}
EXPORT_SYMBOL_GPL(irq_domain_reset_irq_data);

#ifdef        CONFIG_IRQ_DOMAIN_HIERARCHY
/**
 * irq_domain_create_hierarchy - Add a irqdomain into the hierarchy
 * @parent:        Parent irq domain to associate with the new domain
 * @flags:        Irq domain flags associated to the domain
 * @size:        Size of the domain. See below
 * @fwnode:        Optional fwnode of the interrupt controller
 * @ops:        Pointer to the interrupt domain callbacks
 * @host_data:        Controller private data pointer
 *
 * If @size is 0 a tree domain is created, otherwise a linear domain.
 *
 * If successful the parent is associated to the new domain and the
 * domain flags are set.
 * Returns pointer to IRQ domain, or NULL on failure.
 */
struct irq_domain *irq_domain_create_hierarchy(struct irq_domain *parent,
                                            unsigned int flags,
                                            unsigned int size,
                                            struct fwnode_handle *fwnode,
                                            const struct irq_domain_ops *ops,
                                            void *host_data)
{
        struct irq_domain_info info = {
                .fwnode                = fwnode,
                .size                = size,
                .hwirq_max        = size,
                .ops                = ops,
                .host_data        = host_data,
                .domain_flags        = flags,
                .parent                = parent,
        };
        struct irq_domain *d;

        if (!info.size)
                info.hwirq_max = ~0U;

        d = irq_domain_instantiate(&info);
        return IS_ERR(d) ? NULL : d;
}
EXPORT_SYMBOL_GPL(irq_domain_create_hierarchy);

static void irq_domain_insert_irq(int virq)
{
        struct irq_data *data;

        for (data = irq_get_irq_data(virq); data; data = data->parent_data) {
                struct irq_domain *domain = data->domain;

                domain->mapcount++;
                irq_domain_set_mapping(domain, data->hwirq, data);
        }

        irq_clear_status_flags(virq, IRQ_NOREQUEST);
}

static void irq_domain_remove_irq(int virq)
{
        struct irq_data *data;

        irq_set_status_flags(virq, IRQ_NOREQUEST);
        irq_set_chip_and_handler(virq, NULL, NULL);
        synchronize_irq(virq);
        smp_mb();

        for (data = irq_get_irq_data(virq); data; data = data->parent_data) {
                struct irq_domain *domain = data->domain;
                irq_hw_number_t hwirq = data->hwirq;

                domain->mapcount--;
                irq_domain_clear_mapping(domain, hwirq);
        }
}

static struct irq_data *irq_domain_insert_irq_data(struct irq_domain *domain,
                                                   struct irq_data *child)
{
        struct irq_data *irq_data;

        irq_data = kzalloc_node(sizeof(*irq_data), GFP_KERNEL,
                                irq_data_get_node(child));
        if (irq_data) {
                child->parent_data = irq_data;
                irq_data->irq = child->irq;
                irq_data->common = child->common;
                irq_data->domain = domain;
        }

        return irq_data;
}

static void __irq_domain_free_hierarchy(struct irq_data *irq_data)
{
        struct irq_data *tmp;

        while (irq_data) {
                tmp = irq_data;
                irq_data = irq_data->parent_data;
                kfree(tmp);
        }
}

static void irq_domain_free_irq_data(unsigned int virq, unsigned int nr_irqs)
{
        struct irq_data *irq_data, *tmp;
        int i;

        for (i = 0; i < nr_irqs; i++) {
                irq_data = irq_get_irq_data(virq + i);
                tmp = irq_data->parent_data;
                irq_data->parent_data = NULL;
                irq_data->domain = NULL;

                __irq_domain_free_hierarchy(tmp);
        }
}

/**
 * irq_domain_disconnect_hierarchy - Mark the first unused level of a hierarchy
 * @domain:        IRQ domain from which the hierarchy is to be disconnected
 * @virq:        IRQ number where the hierarchy is to be trimmed
 *
 * Marks the @virq level belonging to @domain as disconnected.
 * Returns -EINVAL if @virq doesn't have a valid irq_data pointing
 * to @domain.
 *
 * Its only use is to be able to trim levels of hierarchy that do not
 * have any real meaning for this interrupt, and that the driver marks
 * as such from its .alloc() callback.
 */
int irq_domain_disconnect_hierarchy(struct irq_domain *domain,
                                    unsigned int virq)
{
        struct irq_data *irqd;

        irqd = irq_domain_get_irq_data(domain, virq);
        if (!irqd)
                return -EINVAL;

        irqd->chip = ERR_PTR(-ENOTCONN);
        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_disconnect_hierarchy);

static int irq_domain_trim_hierarchy(unsigned int virq)
{
        struct irq_data *tail, *irqd, *irq_data;

        irq_data = irq_get_irq_data(virq);
        tail = NULL;

        /* The first entry must have a valid irqchip */
        if (IS_ERR_OR_NULL(irq_data->chip))
                return -EINVAL;

        /*
         * Validate that the irq_data chain is sane in the presence of
         * a hierarchy trimming marker.
         */
        for (irqd = irq_data->parent_data; irqd; irq_data = irqd, irqd = irqd->parent_data) {
                /* Can't have a valid irqchip after a trim marker */
                if (irqd->chip && tail)
                        return -EINVAL;

                /* Can't have an empty irqchip before a trim marker */
                if (!irqd->chip && !tail)
                        return -EINVAL;

                if (IS_ERR(irqd->chip)) {
                        /* Only -ENOTCONN is a valid trim marker */
                        if (PTR_ERR(irqd->chip) != -ENOTCONN)
                                return -EINVAL;

                        tail = irq_data;
                }
        }

        /* No trim marker, nothing to do */
        if (!tail)
                return 0;

        pr_info("IRQ%d: trimming hierarchy from %s\n",
                virq, tail->parent_data->domain->name);

        /* Sever the inner part of the hierarchy...  */
        irqd = tail;
        tail = tail->parent_data;
        irqd->parent_data = NULL;
        __irq_domain_free_hierarchy(tail);

        return 0;
}

static int irq_domain_alloc_irq_data(struct irq_domain *domain,
                                     unsigned int virq, unsigned int nr_irqs)
{
        struct irq_data *irq_data;
        struct irq_domain *parent;
        int i;

        /* The outermost irq_data is embedded in struct irq_desc */
        for (i = 0; i < nr_irqs; i++) {
                irq_data = irq_get_irq_data(virq + i);
                irq_data->domain = domain;

                for (parent = domain->parent; parent; parent = parent->parent) {
                        irq_data = irq_domain_insert_irq_data(parent, irq_data);
                        if (!irq_data) {
                                irq_domain_free_irq_data(virq, i + 1);
                                return -ENOMEM;
                        }
                }
        }

        return 0;
}

/**
 * irq_domain_get_irq_data - Get irq_data associated with @virq and @domain
 * @domain:        domain to match
 * @virq:        IRQ number to get irq_data
 */
struct irq_data *irq_domain_get_irq_data(struct irq_domain *domain,
                                         unsigned int virq)
{
        struct irq_data *irq_data;

        for (irq_data = irq_get_irq_data(virq); irq_data;
             irq_data = irq_data->parent_data)
                if (irq_data->domain == domain)
                        return irq_data;

        return NULL;
}
EXPORT_SYMBOL_GPL(irq_domain_get_irq_data);

/**
 * irq_domain_set_hwirq_and_chip - Set hwirq and irqchip of @virq at @domain
 * @domain:        Interrupt domain to match
 * @virq:        IRQ number
 * @hwirq:        The hwirq number
 * @chip:        The associated interrupt chip
 * @chip_data:        The associated chip data
 */
int irq_domain_set_hwirq_and_chip(struct irq_domain *domain, unsigned int virq,
                                  irq_hw_number_t hwirq,
                                  const struct irq_chip *chip,
                                  void *chip_data)
{
        struct irq_data *irq_data = irq_domain_get_irq_data(domain, virq);

        if (!irq_data)
                return -ENOENT;

        irq_data->hwirq = hwirq;
        irq_data->chip = (struct irq_chip *)(chip ? chip : &no_irq_chip);
        irq_data->chip_data = chip_data;

        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_set_hwirq_and_chip);

/**
 * irq_domain_set_info - Set the complete data for a @virq in @domain
 * @domain:                Interrupt domain to match
 * @virq:                IRQ number
 * @hwirq:                The hardware interrupt number
 * @chip:                The associated interrupt chip
 * @chip_data:                The associated interrupt chip data
 * @handler:                The interrupt flow handler
 * @handler_data:        The interrupt flow handler data
 * @handler_name:        The interrupt handler name
 */
void irq_domain_set_info(struct irq_domain *domain, unsigned int virq,
                         irq_hw_number_t hwirq, const struct irq_chip *chip,
                         void *chip_data, irq_flow_handler_t handler,
                         void *handler_data, const char *handler_name)
{
        irq_domain_set_hwirq_and_chip(domain, virq, hwirq, chip, chip_data);
        __irq_set_handler(virq, handler, 0, handler_name);
        irq_set_handler_data(virq, handler_data);
}
EXPORT_SYMBOL(irq_domain_set_info);

/**
 * irq_domain_free_irqs_common - Clear irq_data and free the parent
 * @domain:        Interrupt domain to match
 * @virq:        IRQ number to start with
 * @nr_irqs:        The number of irqs to free
 */
void irq_domain_free_irqs_common(struct irq_domain *domain, unsigned int virq,
                                 unsigned int nr_irqs)
{
        struct irq_data *irq_data;
        int i;

        for (i = 0; i < nr_irqs; i++) {
                irq_data = irq_domain_get_irq_data(domain, virq + i);
                if (irq_data)
                        irq_domain_reset_irq_data(irq_data);
        }
        irq_domain_free_irqs_parent(domain, virq, nr_irqs);
}
EXPORT_SYMBOL_GPL(irq_domain_free_irqs_common);

/**
 * irq_domain_free_irqs_top - Clear handler and handler data, clear irqdata and free parent
 * @domain:        Interrupt domain to match
 * @virq:        IRQ number to start with
 * @nr_irqs:        The number of irqs to free
 */
void irq_domain_free_irqs_top(struct irq_domain *domain, unsigned int virq,
                              unsigned int nr_irqs)
{
        int i;

        for (i = 0; i < nr_irqs; i++) {
                irq_set_handler_data(virq + i, NULL);
                irq_set_handler(virq + i, NULL);
        }
        irq_domain_free_irqs_common(domain, virq, nr_irqs);
}

static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
                                           unsigned int irq_base,
                                           unsigned int nr_irqs)
{
        unsigned int i;

        if (!domain->ops->free)
                return;

        for (i = 0; i < nr_irqs; i++) {
                if (irq_domain_get_irq_data(domain, irq_base + i))
                        domain->ops->free(domain, irq_base + i, 1);
        }
}

int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
                                    unsigned int irq_base,
                                    unsigned int nr_irqs, void *arg)
{
        if (!domain->ops->alloc) {
                pr_debug("domain->ops->alloc() is NULL\n");
                return -ENOSYS;
        }

        return domain->ops->alloc(domain, irq_base, nr_irqs, arg);
}

static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base,
                                        unsigned int nr_irqs, int node, void *arg,
                                        bool realloc, const struct irq_affinity_desc *affinity)
{
        int i, ret, virq;

        if (realloc && irq_base >= 0) {
                virq = irq_base;
        } else {
                virq = irq_domain_alloc_descs(irq_base, nr_irqs, 0, node,
                                              affinity);
                if (virq < 0) {
                        pr_debug("cannot allocate IRQ(base %d, count %d)\n",
                                 irq_base, nr_irqs);
                        return virq;
                }
        }

        if (irq_domain_alloc_irq_data(domain, virq, nr_irqs)) {
                pr_debug("cannot allocate memory for IRQ%d\n", virq);
                ret = -ENOMEM;
                goto out_free_desc;
        }

        ret = irq_domain_alloc_irqs_hierarchy(domain, virq, nr_irqs, arg);
        if (ret < 0)
                goto out_free_irq_data;

        for (i = 0; i < nr_irqs; i++) {
                ret = irq_domain_trim_hierarchy(virq + i);
                if (ret)
                        goto out_free_irq_data;
        }

        for (i = 0; i < nr_irqs; i++)
                irq_domain_insert_irq(virq + i);

        return virq;

out_free_irq_data:
        irq_domain_free_irq_data(virq, nr_irqs);
out_free_desc:
        irq_free_descs(virq, nr_irqs);
        return ret;
}

/**
 * __irq_domain_alloc_irqs - Allocate IRQs from domain
 * @domain:        domain to allocate from
 * @irq_base:        allocate specified IRQ number if irq_base >= 0
 * @nr_irqs:        number of IRQs to allocate
 * @node:        NUMA node id for memory allocation
 * @arg:        domain specific argument
 * @realloc:        IRQ descriptors have already been allocated if true
 * @affinity:        Optional irq affinity mask for multiqueue devices
 *
 * Allocate IRQ numbers and initialized all data structures to support
 * hierarchy IRQ domains.
 * Parameter @realloc is mainly to support legacy IRQs.
 * Returns error code or allocated IRQ number
 *
 * The whole process to setup an IRQ has been split into two steps.
 * The first step, __irq_domain_alloc_irqs(), is to allocate IRQ
 * descriptor and required hardware resources. The second step,
 * irq_domain_activate_irq(), is to program the hardware with preallocated
 * resources. In this way, it's easier to rollback when failing to
 * allocate resources.
 */
int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
                            unsigned int nr_irqs, int node, void *arg,
                            bool realloc, const struct irq_affinity_desc *affinity)
{
        int ret;

        if (domain == NULL) {
                domain = irq_default_domain;
                if (WARN(!domain, "domain is NULL; cannot allocate IRQ\n"))
                        return -EINVAL;
        }

        mutex_lock(&domain->root->mutex);
        ret = irq_domain_alloc_irqs_locked(domain, irq_base, nr_irqs, node, arg,
                                           realloc, affinity);
        mutex_unlock(&domain->root->mutex);

        return ret;
}
EXPORT_SYMBOL_GPL(__irq_domain_alloc_irqs);

/* The irq_data was moved, fix the revmap to refer to the new location */
static void irq_domain_fix_revmap(struct irq_data *d)
{
        void __rcu **slot;

        lockdep_assert_held(&d->domain->root->mutex);

        if (irq_domain_is_nomap(d->domain))
                return;

        /* Fix up the revmap. */
        if (d->hwirq < d->domain->revmap_size) {
                /* Not using radix tree */
                rcu_assign_pointer(d->domain->revmap[d->hwirq], d);
        } else {
                slot = radix_tree_lookup_slot(&d->domain->revmap_tree, d->hwirq);
                if (slot)
                        radix_tree_replace_slot(&d->domain->revmap_tree, slot, d);
        }
}

/**
 * irq_domain_push_irq() - Push a domain in to the top of a hierarchy.
 * @domain:        Domain to push.
 * @virq:        Irq to push the domain in to.
 * @arg:        Passed to the irq_domain_ops alloc() function.
 *
 * For an already existing irqdomain hierarchy, as might be obtained
 * via a call to pci_enable_msix(), add an additional domain to the
 * head of the processing chain.  Must be called before request_irq()
 * has been called.
 */
int irq_domain_push_irq(struct irq_domain *domain, int virq, void *arg)
{
        struct irq_data *irq_data = irq_get_irq_data(virq);
        struct irq_data *parent_irq_data;
        struct irq_desc *desc;
        int rv = 0;

        /*
         * Check that no action has been set, which indicates the virq
         * is in a state where this function doesn't have to deal with
         * races between interrupt handling and maintaining the
         * hierarchy.  This will catch gross misuse.  Attempting to
         * make the check race free would require holding locks across
         * calls to struct irq_domain_ops->alloc(), which could lead
         * to deadlock, so we just do a simple check before starting.
         */
        desc = irq_to_desc(virq);
        if (!desc)
                return -EINVAL;
        if (WARN_ON(desc->action))
                return -EBUSY;

        if (domain == NULL)
                return -EINVAL;

        if (WARN_ON(!irq_domain_is_hierarchy(domain)))
                return -EINVAL;

        if (!irq_data)
                return -EINVAL;

        if (domain->parent != irq_data->domain)
                return -EINVAL;

        parent_irq_data = kzalloc_node(sizeof(*parent_irq_data), GFP_KERNEL,
                                       irq_data_get_node(irq_data));
        if (!parent_irq_data)
                return -ENOMEM;

        mutex_lock(&domain->root->mutex);

        /* Copy the original irq_data. */
        *parent_irq_data = *irq_data;

        /*
         * Overwrite the irq_data, which is embedded in struct irq_desc, with
         * values for this domain.
         */
        irq_data->parent_data = parent_irq_data;
        irq_data->domain = domain;
        irq_data->mask = 0;
        irq_data->hwirq = 0;
        irq_data->chip = NULL;
        irq_data->chip_data = NULL;

        /* May (probably does) set hwirq, chip, etc. */
        rv = irq_domain_alloc_irqs_hierarchy(domain, virq, 1, arg);
        if (rv) {
                /* Restore the original irq_data. */
                *irq_data = *parent_irq_data;
                kfree(parent_irq_data);
                goto error;
        }

        irq_domain_fix_revmap(parent_irq_data);
        irq_domain_set_mapping(domain, irq_data->hwirq, irq_data);
error:
        mutex_unlock(&domain->root->mutex);

        return rv;
}
EXPORT_SYMBOL_GPL(irq_domain_push_irq);

/**
 * irq_domain_pop_irq() - Remove a domain from the top of a hierarchy.
 * @domain:        Domain to remove.
 * @virq:        Irq to remove the domain from.
 *
 * Undo the effects of a call to irq_domain_push_irq().  Must be
 * called either before request_irq() or after free_irq().
 */
int irq_domain_pop_irq(struct irq_domain *domain, int virq)
{
        struct irq_data *irq_data = irq_get_irq_data(virq);
        struct irq_data *parent_irq_data;
        struct irq_data *tmp_irq_data;
        struct irq_desc *desc;

        /*
         * Check that no action is set, which indicates the virq is in
         * a state where this function doesn't have to deal with races
         * between interrupt handling and maintaining the hierarchy.
         * This will catch gross misuse.  Attempting to make the check
         * race free would require holding locks across calls to
         * struct irq_domain_ops->free(), which could lead to
         * deadlock, so we just do a simple check before starting.
         */
        desc = irq_to_desc(virq);
        if (!desc)
                return -EINVAL;
        if (WARN_ON(desc->action))
                return -EBUSY;

        if (domain == NULL)
                return -EINVAL;

        if (!irq_data)
                return -EINVAL;

        tmp_irq_data = irq_domain_get_irq_data(domain, virq);

        /* We can only "pop" if this domain is at the top of the list */
        if (WARN_ON(irq_data != tmp_irq_data))
                return -EINVAL;

        if (WARN_ON(irq_data->domain != domain))
                return -EINVAL;

        parent_irq_data = irq_data->parent_data;
        if (WARN_ON(!parent_irq_data))
                return -EINVAL;

        mutex_lock(&domain->root->mutex);

        irq_data->parent_data = NULL;

        irq_domain_clear_mapping(domain, irq_data->hwirq);
        irq_domain_free_irqs_hierarchy(domain, virq, 1);

        /* Restore the original irq_data. */
        *irq_data = *parent_irq_data;

        irq_domain_fix_revmap(irq_data);

        mutex_unlock(&domain->root->mutex);

        kfree(parent_irq_data);

        return 0;
}
EXPORT_SYMBOL_GPL(irq_domain_pop_irq);

/**
 * irq_domain_free_irqs - Free IRQ number and associated data structures
 * @virq:        base IRQ number
 * @nr_irqs:        number of IRQs to free
 */
void irq_domain_free_irqs(unsigned int virq, unsigned int nr_irqs)
{
        struct irq_data *data = irq_get_irq_data(virq);
        struct irq_domain *domain;
        int i;

        if (WARN(!data || !data->domain || !data->domain->ops->free,
                 "NULL pointer, cannot free irq\n"))
                return;

        domain = data->domain;

        mutex_lock(&domain->root->mutex);
        for (i = 0; i < nr_irqs; i++)
                irq_domain_remove_irq(virq + i);
        irq_domain_free_irqs_hierarchy(domain, virq, nr_irqs);
        mutex_unlock(&domain->root->mutex);

        irq_domain_free_irq_data(virq, nr_irqs);
        irq_free_descs(virq, nr_irqs);
}

static void irq_domain_free_one_irq(struct irq_domain *domain, unsigned int virq)
{
        if (irq_domain_is_msi_device(domain))
                msi_device_domain_free_wired(domain, virq);
        else
                irq_domain_free_irqs(virq, 1);
}

/**
 * irq_domain_alloc_irqs_parent - Allocate interrupts from parent domain
 * @domain:        Domain below which interrupts must be allocated
 * @irq_base:        Base IRQ number
 * @nr_irqs:        Number of IRQs to allocate
 * @arg:        Allocation data (arch/domain specific)
 */
int irq_domain_alloc_irqs_parent(struct irq_domain *domain,
                                 unsigned int irq_base, unsigned int nr_irqs,
                                 void *arg)
{
        if (!domain->parent)
                return -ENOSYS;

        return irq_domain_alloc_irqs_hierarchy(domain->parent, irq_base,
                                               nr_irqs, arg);
}
EXPORT_SYMBOL_GPL(irq_domain_alloc_irqs_parent);

/**
 * irq_domain_free_irqs_parent - Free interrupts from parent domain
 * @domain:        Domain below which interrupts must be freed
 * @irq_base:        Base IRQ number
 * @nr_irqs:        Number of IRQs to free
 */
void irq_domain_free_irqs_parent(struct irq_domain *domain,
                                 unsigned int irq_base, unsigned int nr_irqs)
{
        if (!domain->parent)
                return;

        irq_domain_free_irqs_hierarchy(domain->parent, irq_base, nr_irqs);
}
EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);

static void __irq_domain_deactivate_irq(struct irq_data *irq_data)
{
        if (irq_data && irq_data->domain) {
                struct irq_domain *domain = irq_data->domain;

                if (domain->ops->deactivate)
                        domain->ops->deactivate(domain, irq_data);
                if (irq_data->parent_data)
                        __irq_domain_deactivate_irq(irq_data->parent_data);
        }
}

static int __irq_domain_activate_irq(struct irq_data *irqd, bool reserve)
{
        int ret = 0;

        if (irqd && irqd->domain) {
                struct irq_domain *domain = irqd->domain;

                if (irqd->parent_data)
                        ret = __irq_domain_activate_irq(irqd->parent_data,
                                                        reserve);
                if (!ret && domain->ops->activate) {
                        ret = domain->ops->activate(domain, irqd, reserve);
                        /* Rollback in case of error */
                        if (ret && irqd->parent_data)
                                __irq_domain_deactivate_irq(irqd->parent_data);
                }
        }
        return ret;
}

/**
 * irq_domain_activate_irq - Call domain_ops->activate recursively to activate
 *                             interrupt
 * @irq_data:        Outermost irq_data associated with interrupt
 * @reserve:        If set only reserve an interrupt vector instead of assigning one
 *
 * This is the second step to call domain_ops->activate to program interrupt
 * controllers, so the interrupt could actually get delivered.
 */
int irq_domain_activate_irq(struct irq_data *irq_data, bool reserve)
{
        int ret = 0;

        if (!irqd_is_activated(irq_data))
                ret = __irq_domain_activate_irq(irq_data, reserve);
        if (!ret)
                irqd_set_activated(irq_data);
        return ret;
}

/**
 * irq_domain_deactivate_irq - Call domain_ops->deactivate recursively to
 *                               deactivate interrupt
 * @irq_data: outermost irq_data associated with interrupt
 *
 * It calls domain_ops->deactivate to program interrupt controllers to disable
 * interrupt delivery.
 */
void irq_domain_deactivate_irq(struct irq_data *irq_data)
{
        if (irqd_is_activated(irq_data)) {
                __irq_domain_deactivate_irq(irq_data);
                irqd_clr_activated(irq_data);
        }
}

static void irq_domain_check_hierarchy(struct irq_domain *domain)
{
        /* Hierarchy irq_domains must implement callback alloc() */
        if (domain->ops->alloc)
                domain->flags |= IRQ_DOMAIN_FLAG_HIERARCHY;
}
#else        /* CONFIG_IRQ_DOMAIN_HIERARCHY */
/**
 * irq_domain_get_irq_data - Get irq_data associated with @virq and @domain
 * @domain:        domain to match
 * @virq:        IRQ number to get irq_data
 */
struct irq_data *irq_domain_get_irq_data(struct irq_domain *domain,
                                         unsigned int virq)
{
        struct irq_data *irq_data = irq_get_irq_data(virq);

        return (irq_data && irq_data->domain == domain) ? irq_data : NULL;
}
EXPORT_SYMBOL_GPL(irq_domain_get_irq_data);

/**
 * irq_domain_set_info - Set the complete data for a @virq in @domain
 * @domain:                Interrupt domain to match
 * @virq:                IRQ number
 * @hwirq:                The hardware interrupt number
 * @chip:                The associated interrupt chip
 * @chip_data:                The associated interrupt chip data
 * @handler:                The interrupt flow handler
 * @handler_data:        The interrupt flow handler data
 * @handler_name:        The interrupt handler name
 */
void irq_domain_set_info(struct irq_domain *domain, unsigned int virq,
                         irq_hw_number_t hwirq, const struct irq_chip *chip,
                         void *chip_data, irq_flow_handler_t handler,
                         void *handler_data, const char *handler_name)
{
        irq_set_chip_and_handler_name(virq, chip, handler, handler_name);
        irq_set_chip_data(virq, chip_data);
        irq_set_handler_data(virq, handler_data);
}

static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base,
                                        unsigned int nr_irqs, int node, void *arg,
                                        bool realloc, const struct irq_affinity_desc *affinity)
{
        return -EINVAL;
}

static void irq_domain_check_hierarchy(struct irq_domain *domain) { }
static void irq_domain_free_one_irq(struct irq_domain *domain, unsigned int virq) { }

#endif        /* CONFIG_IRQ_DOMAIN_HIERARCHY */

#ifdef CONFIG_GENERIC_IRQ_DEBUGFS
#include "internals.h"

static struct dentry *domain_dir;

static const struct irq_bit_descr irqdomain_flags[] = {
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_HIERARCHY),
        BIT_MASK_DESCR(IRQ_DOMAIN_NAME_ALLOCATED),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_IPI_PER_CPU),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_IPI_SINGLE),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_MSI),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_ISOLATED_MSI),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_NO_MAP),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_MSI_PARENT),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_MSI_DEVICE),
        BIT_MASK_DESCR(IRQ_DOMAIN_FLAG_NONCORE),
};

static void irq_domain_debug_show_one(struct seq_file *m, struct irq_domain *d, int ind)
{
        seq_printf(m, "%*sname:   %s\n", ind, "", d->name);
        seq_printf(m, "%*ssize:   %u\n", ind + 1, "", d->revmap_size);
        seq_printf(m, "%*smapped: %u\n", ind + 1, "", d->mapcount);
        seq_printf(m, "%*sflags:  0x%08x\n", ind +1 , "", d->flags);
        irq_debug_show_bits(m, ind, d->flags, irqdomain_flags, ARRAY_SIZE(irqdomain_flags));
        if (d->ops && d->ops->debug_show)
                d->ops->debug_show(m, d, NULL, ind + 1);
#ifdef        CONFIG_IRQ_DOMAIN_HIERARCHY
        if (!d->parent)
                return;
        seq_printf(m, "%*sparent: %s\n", ind + 1, "", d->parent->name);
        irq_domain_debug_show_one(m, d->parent, ind + 4);
#endif
}

static int irq_domain_debug_show(struct seq_file *m, void *p)
{
        struct irq_domain *d = m->private;

        /* Default domain? Might be NULL */
        if (!d) {
                if (!irq_default_domain)
                        return 0;
                d = irq_default_domain;
        }
        irq_domain_debug_show_one(m, d, 0);
        return 0;
}
DEFINE_SHOW_ATTRIBUTE(irq_domain_debug);

static void debugfs_add_domain_dir(struct irq_domain *d)
{
        if (!d->name || !domain_dir)
                return;
        debugfs_create_file(d->name, 0444, domain_dir, d,
                            &irq_domain_debug_fops);
}

static void debugfs_remove_domain_dir(struct irq_domain *d)
{
        debugfs_lookup_and_remove(d->name, domain_dir);
}

void __init irq_domain_debugfs_init(struct dentry *root)
{
        struct irq_domain *d;

        domain_dir = debugfs_create_dir("domains", root);

        debugfs_create_file("default", 0444, domain_dir, NULL,
                            &irq_domain_debug_fops);
        mutex_lock(&irq_domain_mutex);
        list_for_each_entry(d, &irq_domain_list, link)
                debugfs_add_domain_dir(d);
        mutex_unlock(&irq_domain_mutex);
}
#endif





























    1 





    2 





    2 


   11 










    7 




    2 
    1 


    8 
    7 


    3 











    5 







    8 






    1 


















    3 
   10 



    1 


    9 




    3 






    9 










   49 








   49 






















   10 


   13 

    4 







   29 



   22 
   26 

    9 
   36 












    4 



   33 

   11 
























   23 










    5 




    9 


   26 







   52 














   62 





    2 


   41 

   22 
   10 

    5 




   43 
    1 
    1 








   42 

    3 
   42 

    2 
   30 










   12 



   21 
   22 






    3 









   19 


   21 













    1 




































    9 

    3 







   11 

















    1 


   10 

   10 


























    1 


    7 












    4 






   26 



    2 

    1 

   11 

    4 

    8 














   32 



    1 



    3 






   28 



   14 








   11 








    7 
















   54 












    3 


   44 

    9 
    2 



   11 




   10 







   40 















    3 







    1 






    1 

    2 

















    2 
    2 






















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright (C) 2012-2013 Samsung Electronics Co., Ltd.
 */

#include <linux/slab.h>
#include <linux/compat.h>
#include <linux/cred.h>
#include <linux/buffer_head.h>
#include <linux/blkdev.h>
#include <linux/fsnotify.h>
#include <linux/security.h>
#include <linux/msdos_fs.h>
#include <linux/writeback.h>

#include "exfat_raw.h"
#include "exfat_fs.h"

static int exfat_cont_expand(struct inode *inode, loff_t size)
{
        int ret;
        unsigned int num_clusters, new_num_clusters, last_clu;
        struct exfat_inode_info *ei = EXFAT_I(inode);
        struct super_block *sb = inode->i_sb;
        struct exfat_sb_info *sbi = EXFAT_SB(sb);
        struct exfat_chain clu;

        ret = inode_newsize_ok(inode, size);
        if (ret)
                return ret;

        num_clusters = EXFAT_B_TO_CLU(exfat_ondisk_size(inode), sbi);
        new_num_clusters = EXFAT_B_TO_CLU_ROUND_UP(size, sbi);

        if (new_num_clusters == num_clusters)
                goto out;

        if (num_clusters) {
                exfat_chain_set(&clu, ei->start_clu, num_clusters, ei->flags);
                ret = exfat_find_last_cluster(sb, &clu, &last_clu);
                if (ret)
                        return ret;

                clu.dir = last_clu + 1;
        } else {
                last_clu = EXFAT_EOF_CLUSTER;
                clu.dir = EXFAT_EOF_CLUSTER;
        }

        clu.size = 0;
        clu.flags = ei->flags;

        ret = exfat_alloc_cluster(inode, new_num_clusters - num_clusters,
                        &clu, inode_needs_sync(inode));
        if (ret)
                return ret;

        /* Append new clusters to chain */
        if (num_clusters) {
                if (clu.flags != ei->flags)
                        if (exfat_chain_cont_cluster(sb, ei->start_clu, num_clusters))
                                goto free_clu;

                if (clu.flags == ALLOC_FAT_CHAIN)
                        if (exfat_ent_set(sb, last_clu, clu.dir))
                                goto free_clu;
        } else
                ei->start_clu = clu.dir;

        ei->flags = clu.flags;

out:
        inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
        /* Expanded range not zeroed, do not update valid_size */
        i_size_write(inode, size);

        inode->i_blocks = round_up(size, sbi->cluster_size) >> 9;
        mark_inode_dirty(inode);

        if (IS_SYNC(inode))
                return write_inode_now(inode, 1);

        return 0;

free_clu:
        exfat_free_cluster(inode, &clu);
        return -EIO;
}

static bool exfat_allow_set_time(struct mnt_idmap *idmap,
                                 struct exfat_sb_info *sbi, struct inode *inode)
{
        mode_t allow_utime = sbi->options.allow_utime;

        if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode),
                            current_fsuid())) {
                if (vfsgid_in_group_p(i_gid_into_vfsgid(idmap, inode)))
                        allow_utime >>= 3;
                if (allow_utime & MAY_WRITE)
                        return true;
        }

        /* use a default check */
        return false;
}

static int exfat_sanitize_mode(const struct exfat_sb_info *sbi,
                struct inode *inode, umode_t *mode_ptr)
{
        mode_t i_mode, mask, perm;

        i_mode = inode->i_mode;

        mask = (S_ISREG(i_mode) || S_ISLNK(i_mode)) ?
                sbi->options.fs_fmask : sbi->options.fs_dmask;
        perm = *mode_ptr & ~(S_IFMT | mask);

        /* Of the r and x bits, all (subject to umask) must be present.*/
        if ((perm & 0555) != (i_mode & 0555))
                return -EPERM;

        if (exfat_mode_can_hold_ro(inode)) {
                /*
                 * Of the w bits, either all (subject to umask) or none must
                 * be present.
                 */
                if ((perm & 0222) && ((perm & 0222) != (0222 & ~mask)))
                        return -EPERM;
        } else {
                /*
                 * If exfat_mode_can_hold_ro(inode) is false, can't change
                 * w bits.
                 */
                if ((perm & 0222) != (0222 & ~mask))
                        return -EPERM;
        }

        *mode_ptr &= S_IFMT | perm;

        return 0;
}

/* resize the file length */
int __exfat_truncate(struct inode *inode)
{
        unsigned int num_clusters_new, num_clusters_phys;
        unsigned int last_clu = EXFAT_FREE_CLUSTER;
        struct exfat_chain clu;
        struct super_block *sb = inode->i_sb;
        struct exfat_sb_info *sbi = EXFAT_SB(sb);
        struct exfat_inode_info *ei = EXFAT_I(inode);

        /* check if the given file ID is opened */
        if (ei->type != TYPE_FILE && ei->type != TYPE_DIR)
                return -EPERM;

        exfat_set_volume_dirty(sb);

        num_clusters_new = EXFAT_B_TO_CLU_ROUND_UP(i_size_read(inode), sbi);
        num_clusters_phys = EXFAT_B_TO_CLU(exfat_ondisk_size(inode), sbi);

        exfat_chain_set(&clu, ei->start_clu, num_clusters_phys, ei->flags);

        if (i_size_read(inode) > 0) {
                /*
                 * Truncate FAT chain num_clusters after the first cluster
                 * num_clusters = min(new, phys);
                 */
                unsigned int num_clusters =
                        min(num_clusters_new, num_clusters_phys);

                /*
                 * Follow FAT chain
                 * (defensive coding - works fine even with corrupted FAT table
                 */
                if (clu.flags == ALLOC_NO_FAT_CHAIN) {
                        clu.dir += num_clusters;
                        clu.size -= num_clusters;
                } else {
                        while (num_clusters > 0) {
                                last_clu = clu.dir;
                                if (exfat_get_next_cluster(sb, &(clu.dir)))
                                        return -EIO;

                                num_clusters--;
                                clu.size--;
                        }
                }
        } else {
                ei->flags = ALLOC_NO_FAT_CHAIN;
                ei->start_clu = EXFAT_EOF_CLUSTER;
        }

        if (i_size_read(inode) < ei->valid_size)
                ei->valid_size = i_size_read(inode);

        if (ei->type == TYPE_FILE)
                ei->attr |= EXFAT_ATTR_ARCHIVE;

        /*
         * update the directory entry
         *
         * If the directory entry is updated by mark_inode_dirty(), the
         * directory entry will be written after a writeback cycle of
         * updating the bitmap/FAT, which may result in clusters being
         * freed but referenced by the directory entry in the event of a
         * sudden power failure.
         * __exfat_write_inode() is called for directory entry, bitmap
         * and FAT to be written in a same writeback.
         */
        if (__exfat_write_inode(inode, inode_needs_sync(inode)))
                return -EIO;

        /* cut off from the FAT chain */
        if (ei->flags == ALLOC_FAT_CHAIN && last_clu != EXFAT_FREE_CLUSTER &&
                        last_clu != EXFAT_EOF_CLUSTER) {
                if (exfat_ent_set(sb, last_clu, EXFAT_EOF_CLUSTER))
                        return -EIO;
        }

        /* invalidate cache and free the clusters */
        /* clear exfat cache */
        exfat_cache_inval_inode(inode);

        /* hint information */
        ei->hint_bmap.off = EXFAT_EOF_CLUSTER;
        ei->hint_bmap.clu = EXFAT_EOF_CLUSTER;

        /* hint_stat will be used if this is directory. */
        ei->hint_stat.eidx = 0;
        ei->hint_stat.clu = ei->start_clu;
        ei->hint_femp.eidx = EXFAT_HINT_NONE;

        /* free the clusters */
        if (exfat_free_cluster(inode, &clu))
                return -EIO;

        return 0;
}

void exfat_truncate(struct inode *inode)
{
        struct super_block *sb = inode->i_sb;
        struct exfat_sb_info *sbi = EXFAT_SB(sb);
        struct exfat_inode_info *ei = EXFAT_I(inode);
        int err;

        mutex_lock(&sbi->s_lock);
        if (ei->start_clu == 0) {
                /*
                 * Empty start_clu != ~0 (not allocated)
                 */
                exfat_fs_error(sb, "tried to truncate zeroed cluster.");
                goto write_size;
        }

        err = __exfat_truncate(inode);
        if (err)
                goto write_size;

        inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9;
write_size:
        mutex_unlock(&sbi->s_lock);
}

int exfat_getattr(struct mnt_idmap *idmap, const struct path *path,
                  struct kstat *stat, unsigned int request_mask,
                  unsigned int query_flags)
{
        struct inode *inode = d_backing_inode(path->dentry);
        struct exfat_inode_info *ei = EXFAT_I(inode);

        generic_fillattr(idmap, request_mask, inode, stat);
        exfat_truncate_atime(&stat->atime);
        stat->result_mask |= STATX_BTIME;
        stat->btime.tv_sec = ei->i_crtime.tv_sec;
        stat->btime.tv_nsec = ei->i_crtime.tv_nsec;
        stat->blksize = EXFAT_SB(inode->i_sb)->cluster_size;
        return 0;
}

int exfat_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
                  struct iattr *attr)
{
        struct exfat_sb_info *sbi = EXFAT_SB(dentry->d_sb);
        struct inode *inode = dentry->d_inode;
        unsigned int ia_valid;
        int error;

        if (unlikely(exfat_forced_shutdown(inode->i_sb)))
                return -EIO;

        if ((attr->ia_valid & ATTR_SIZE) &&
            attr->ia_size > i_size_read(inode)) {
                error = exfat_cont_expand(inode, attr->ia_size);
                if (error || attr->ia_valid == ATTR_SIZE)
                        return error;
                attr->ia_valid &= ~ATTR_SIZE;
        }

        /* Check for setting the inode time. */
        ia_valid = attr->ia_valid;
        if ((ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) &&
            exfat_allow_set_time(idmap, sbi, inode)) {
                attr->ia_valid &= ~(ATTR_MTIME_SET | ATTR_ATIME_SET |
                                ATTR_TIMES_SET);
        }

        error = setattr_prepare(idmap, dentry, attr);
        attr->ia_valid = ia_valid;
        if (error)
                goto out;

        if (((attr->ia_valid & ATTR_UID) &&
              (!uid_eq(from_vfsuid(idmap, i_user_ns(inode), attr->ia_vfsuid),
               sbi->options.fs_uid))) ||
            ((attr->ia_valid & ATTR_GID) &&
              (!gid_eq(from_vfsgid(idmap, i_user_ns(inode), attr->ia_vfsgid),
               sbi->options.fs_gid))) ||
            ((attr->ia_valid & ATTR_MODE) &&
             (attr->ia_mode & ~(S_IFREG | S_IFLNK | S_IFDIR | 0777)))) {
                error = -EPERM;
                goto out;
        }

        /*
         * We don't return -EPERM here. Yes, strange, but this is too
         * old behavior.
         */
        if (attr->ia_valid & ATTR_MODE) {
                if (exfat_sanitize_mode(sbi, inode, &attr->ia_mode) < 0)
                        attr->ia_valid &= ~ATTR_MODE;
        }

        if (attr->ia_valid & ATTR_SIZE)
                inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));

        setattr_copy(idmap, inode, attr);
        exfat_truncate_inode_atime(inode);

        if (attr->ia_valid & ATTR_SIZE) {
                error = exfat_block_truncate_page(inode, attr->ia_size);
                if (error)
                        goto out;

                down_write(&EXFAT_I(inode)->truncate_lock);
                truncate_setsize(inode, attr->ia_size);

                /*
                 * __exfat_write_inode() is called from exfat_truncate(), inode
                 * is already written by it, so mark_inode_dirty() is unneeded.
                 */
                exfat_truncate(inode);
                up_write(&EXFAT_I(inode)->truncate_lock);
        } else
                mark_inode_dirty(inode);

out:
        return error;
}

/*
 * modified ioctls from fat/file.c by Welmer Almesberger
 */
static int exfat_ioctl_get_attributes(struct inode *inode, u32 __user *user_attr)
{
        u32 attr;

        inode_lock_shared(inode);
        attr = exfat_make_attr(inode);
        inode_unlock_shared(inode);

        return put_user(attr, user_attr);
}

static int exfat_ioctl_set_attributes(struct file *file, u32 __user *user_attr)
{
        struct inode *inode = file_inode(file);
        struct exfat_sb_info *sbi = EXFAT_SB(inode->i_sb);
        int is_dir = S_ISDIR(inode->i_mode);
        u32 attr, oldattr;
        struct iattr ia;
        int err;

        err = get_user(attr, user_attr);
        if (err)
                goto out;

        err = mnt_want_write_file(file);
        if (err)
                goto out;
        inode_lock(inode);

        oldattr = exfat_make_attr(inode);

        /*
         * Mask attributes so we don't set reserved fields.
         */
        attr &= (EXFAT_ATTR_READONLY | EXFAT_ATTR_HIDDEN | EXFAT_ATTR_SYSTEM |
                 EXFAT_ATTR_ARCHIVE);
        attr |= (is_dir ? EXFAT_ATTR_SUBDIR : 0);

        /* Equivalent to a chmod() */
        ia.ia_valid = ATTR_MODE | ATTR_CTIME;
        ia.ia_ctime = current_time(inode);
        if (is_dir)
                ia.ia_mode = exfat_make_mode(sbi, attr, 0777);
        else
                ia.ia_mode = exfat_make_mode(sbi, attr, 0666 | (inode->i_mode & 0111));

        /* The root directory has no attributes */
        if (inode->i_ino == EXFAT_ROOT_INO && attr != EXFAT_ATTR_SUBDIR) {
                err = -EINVAL;
                goto out_unlock_inode;
        }

        if (((attr | oldattr) & EXFAT_ATTR_SYSTEM) &&
            !capable(CAP_LINUX_IMMUTABLE)) {
                err = -EPERM;
                goto out_unlock_inode;
        }

        /*
         * The security check is questionable...  We single
         * out the RO attribute for checking by the security
         * module, just because it maps to a file mode.
         */
        err = security_inode_setattr(file_mnt_idmap(file),
                                     file->f_path.dentry, &ia);
        if (err)
                goto out_unlock_inode;

        /* This MUST be done before doing anything irreversible... */
        err = exfat_setattr(file_mnt_idmap(file), file->f_path.dentry, &ia);
        if (err)
                goto out_unlock_inode;

        fsnotify_change(file->f_path.dentry, ia.ia_valid);

        exfat_save_attr(inode, attr);
        mark_inode_dirty(inode);
out_unlock_inode:
        inode_unlock(inode);
        mnt_drop_write_file(file);
out:
        return err;
}

static int exfat_ioctl_fitrim(struct inode *inode, unsigned long arg)
{
        struct fstrim_range range;
        int ret = 0;

        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;

        if (!bdev_max_discard_sectors(inode->i_sb->s_bdev))
                return -EOPNOTSUPP;

        if (copy_from_user(&range, (struct fstrim_range __user *)arg, sizeof(range)))
                return -EFAULT;

        range.minlen = max_t(unsigned int, range.minlen,
                                bdev_discard_granularity(inode->i_sb->s_bdev));

        ret = exfat_trim_fs(inode, &range);
        if (ret < 0)
                return ret;

        if (copy_to_user((struct fstrim_range __user *)arg, &range, sizeof(range)))
                return -EFAULT;

        return 0;
}

static int exfat_ioctl_shutdown(struct super_block *sb, unsigned long arg)
{
        u32 flags;

        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;

        if (get_user(flags, (__u32 __user *)arg))
                return -EFAULT;

        return exfat_force_shutdown(sb, flags);
}

long exfat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
        struct inode *inode = file_inode(filp);
        u32 __user *user_attr = (u32 __user *)arg;

        switch (cmd) {
        case FAT_IOCTL_GET_ATTRIBUTES:
                return exfat_ioctl_get_attributes(inode, user_attr);
        case FAT_IOCTL_SET_ATTRIBUTES:
                return exfat_ioctl_set_attributes(filp, user_attr);
        case EXFAT_IOC_SHUTDOWN:
                return exfat_ioctl_shutdown(inode->i_sb, arg);
        case FITRIM:
                return exfat_ioctl_fitrim(inode, arg);
        default:
                return -ENOTTY;
        }
}

#ifdef CONFIG_COMPAT
long exfat_compat_ioctl(struct file *filp, unsigned int cmd,
                                unsigned long arg)
{
        return exfat_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
}
#endif

int exfat_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
{
        struct inode *inode = filp->f_mapping->host;
        int err;

        if (unlikely(exfat_forced_shutdown(inode->i_sb)))
                return -EIO;

        err = __generic_file_fsync(filp, start, end, datasync);
        if (err)
                return err;

        err = sync_blockdev(inode->i_sb->s_bdev);
        if (err)
                return err;

        return blkdev_issue_flush(inode->i_sb->s_bdev);
}

static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)
{
        int err;
        loff_t pos;
        struct inode *inode = file_inode(file);
        struct exfat_inode_info *ei = EXFAT_I(inode);
        struct address_space *mapping = inode->i_mapping;
        const struct address_space_operations *ops = mapping->a_ops;

        pos = ei->valid_size;
        while (pos < new_valid_size) {
                u32 len;
                struct folio *folio;

                len = PAGE_SIZE - (pos & (PAGE_SIZE - 1));
                if (pos + len > new_valid_size)
                        len = new_valid_size - pos;

                err = ops->write_begin(file, mapping, pos, len, &folio, NULL);
                if (err)
                        goto out;

                err = ops->write_end(file, mapping, pos, len, len, folio, NULL);
                if (err < 0)
                        goto out;
                pos += len;

                balance_dirty_pages_ratelimited(mapping);
                cond_resched();
        }

out:
        return err;
}

static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
{
        ssize_t ret;
        struct file *file = iocb->ki_filp;
        struct inode *inode = file_inode(file);
        struct exfat_inode_info *ei = EXFAT_I(inode);
        loff_t pos = iocb->ki_pos;
        loff_t valid_size;

        inode_lock(inode);

        valid_size = ei->valid_size;

        ret = generic_write_checks(iocb, iter);
        if (ret < 0)
                goto unlock;

        if (pos > valid_size) {
                ret = exfat_extend_valid_size(file, pos);
                if (ret < 0 && ret != -ENOSPC) {
                        exfat_err(inode->i_sb,
                                "write: fail to zero from %llu to %llu(%zd)",
                                valid_size, pos, ret);
                }
                if (ret < 0)
                        goto unlock;
        }

        ret = __generic_file_write_iter(iocb, iter);
        if (ret < 0)
                goto unlock;

        inode_unlock(inode);

        if (pos > valid_size)
                pos = valid_size;

        if (iocb_is_dsync(iocb) && iocb->ki_pos > pos) {
                ssize_t err = vfs_fsync_range(file, pos, iocb->ki_pos - 1,
                                iocb->ki_flags & IOCB_SYNC);
                if (err < 0)
                        return err;
        }

        return ret;

unlock:
        inode_unlock(inode);

        return ret;
}

static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
{
        int err;
        struct vm_area_struct *vma = vmf->vma;
        struct file *file = vma->vm_file;
        struct inode *inode = file_inode(file);
        struct exfat_inode_info *ei = EXFAT_I(inode);
        loff_t start, end;

        if (!inode_trylock(inode))
                return VM_FAULT_RETRY;

        start = ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
        end = min_t(loff_t, i_size_read(inode),
                        start + vma->vm_end - vma->vm_start);

        if (ei->valid_size < end) {
                err = exfat_extend_valid_size(file, end);
                if (err < 0) {
                        inode_unlock(inode);
                        return vmf_fs_error(err);
                }
        }

        inode_unlock(inode);

        return filemap_page_mkwrite(vmf);
}

static const struct vm_operations_struct exfat_file_vm_ops = {
        .fault                = filemap_fault,
        .map_pages        = filemap_map_pages,
        .page_mkwrite        = exfat_page_mkwrite,
};

static int exfat_file_mmap(struct file *file, struct vm_area_struct *vma)
{
        file_accessed(file);
        vma->vm_ops = &exfat_file_vm_ops;
        return 0;
}

const struct file_operations exfat_file_operations = {
        .llseek                = generic_file_llseek,
        .read_iter        = generic_file_read_iter,
        .write_iter        = exfat_file_write_iter,
        .unlocked_ioctl = exfat_ioctl,
#ifdef CONFIG_COMPAT
        .compat_ioctl = exfat_compat_ioctl,
#endif
        .mmap                = exfat_file_mmap,
        .fsync                = exfat_file_fsync,
        .splice_read        = filemap_splice_read,
        .splice_write        = iter_file_splice_write,
};

const struct inode_operations exfat_file_inode_operations = {
        .setattr     = exfat_setattr,
        .getattr     = exfat_getattr,
};








































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































   23 
   26 



   13 
   13 







































































































































































































































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
/* SPDX-License-Identifier: GPL-2.0-or-later */
/* internal AFS stuff
 *
 * Copyright (C) 2002, 2007 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#include <linux/compiler.h>
#include <linux/kernel.h>
#include <linux/ktime.h>
#include <linux/fs.h>
#include <linux/filelock.h>
#include <linux/pagemap.h>
#include <linux/rxrpc.h>
#include <linux/key.h>
#include <linux/workqueue.h>
#include <linux/sched.h>
#include <linux/fscache.h>
#include <linux/backing-dev.h>
#include <linux/uuid.h>
#include <linux/mm_types.h>
#include <linux/dns_resolver.h>
#include <net/net_namespace.h>
#include <net/netns/generic.h>
#include <net/sock.h>
#include <net/af_rxrpc.h>

#include "afs.h"
#include "afs_vl.h"

#define AFS_CELL_MAX_ADDRS 15

struct pagevec;
struct afs_call;
struct afs_vnode;
struct afs_server_probe;

/*
 * Partial file-locking emulation mode.  (The problem being that AFS3 only
 * allows whole-file locks and no upgrading/downgrading).
 */
enum afs_flock_mode {
        afs_flock_mode_unset,
        afs_flock_mode_local,        /* Local locking only */
        afs_flock_mode_openafs,        /* Don't get server lock for a partial lock */
        afs_flock_mode_strict,        /* Always get a server lock for a partial lock */
        afs_flock_mode_write,        /* Get an exclusive server lock for a partial lock */
};

struct afs_fs_context {
        bool                        force;                /* T to force cell type */
        bool                        autocell;        /* T if set auto mount operation */
        bool                        dyn_root;        /* T if dynamic root */
        bool                        no_cell;        /* T if the source is "none" (for dynroot) */
        enum afs_flock_mode        flock_mode;        /* Partial file-locking emulation mode */
        afs_voltype_t                type;                /* type of volume requested */
        unsigned int                volnamesz;        /* size of volume name */
        const char                *volname;        /* name of volume to mount */
        struct afs_net                *net;                /* the AFS net namespace stuff */
        struct afs_cell                *cell;                /* cell in which to find volume */
        struct afs_volume        *volume;        /* volume record */
        struct key                *key;                /* key to use for secure mounting */
};

enum afs_call_state {
        AFS_CALL_CL_REQUESTING,                /* Client: Request is being sent */
        AFS_CALL_CL_AWAIT_REPLY,        /* Client: Awaiting reply */
        AFS_CALL_CL_PROC_REPLY,                /* Client: rxrpc call complete; processing reply */
        AFS_CALL_SV_AWAIT_OP_ID,        /* Server: Awaiting op ID */
        AFS_CALL_SV_AWAIT_REQUEST,        /* Server: Awaiting request data */
        AFS_CALL_SV_REPLYING,                /* Server: Replying */
        AFS_CALL_SV_AWAIT_ACK,                /* Server: Awaiting final ACK */
        AFS_CALL_COMPLETE,                /* Completed or failed */
};

/*
 * Address preferences.
 */
struct afs_addr_preference {
        union {
                struct in_addr        ipv4_addr;        /* AF_INET address to compare against */
                struct in6_addr        ipv6_addr;        /* AF_INET6 address to compare against */
        };
        sa_family_t                family;                /* Which address to use */
        u16                        prio;                /* Priority */
        u8                        subnet_mask;        /* How many bits to compare */
};

struct afs_addr_preference_list {
        struct rcu_head                rcu;
        u16                        version;        /* Incremented when prefs list changes */
        u8                        ipv6_off;        /* Offset of IPv6 addresses */
        u8                        nr;                /* Number of addresses in total */
        u8                        max_prefs;        /* Number of prefs allocated */
        struct afs_addr_preference prefs[] __counted_by(max_prefs);
};

struct afs_address {
        struct rxrpc_peer        *peer;
        short                        last_error;        /* Last error from this address */
        u16                        prio;                /* Address priority */
};

/*
 * List of server addresses.
 */
struct afs_addr_list {
        struct rcu_head                rcu;
        refcount_t                usage;
        u32                        version;        /* Version */
        unsigned int                debug_id;
        unsigned int                addr_pref_version; /* Version of address preference list */
        unsigned char                max_addrs;
        unsigned char                nr_addrs;
        unsigned char                preferred;        /* Preferred address */
        unsigned char                nr_ipv4;        /* Number of IPv4 addresses */
        enum dns_record_source        source:8;
        enum dns_lookup_status        status:8;
        unsigned long                probe_failed;        /* Mask of addrs that failed locally/ICMP */
        unsigned long                responded;        /* Mask of addrs that responded */
        struct afs_address        addrs[] __counted_by(max_addrs);
#define AFS_MAX_ADDRESSES ((unsigned int)(sizeof(unsigned long) * 8))
};

/*
 * a record of an in-progress RxRPC call
 */
struct afs_call {
        const struct afs_call_type *type;        /* type of call */
        wait_queue_head_t        waitq;                /* processes awaiting completion */
        struct work_struct        async_work;        /* async I/O processor */
        struct work_struct        work;                /* actual work processor */
        struct rxrpc_call        *rxcall;        /* RxRPC call handle */
        struct rxrpc_peer        *peer;                /* Remote endpoint */
        struct key                *key;                /* security for this call */
        struct afs_net                *net;                /* The network namespace */
        struct afs_server        *server;        /* The fileserver record if fs op (pins ref) */
        struct afs_vlserver        *vlserver;        /* The vlserver record if vl op */
        void                        *request;        /* request data (first part) */
        size_t                        iov_len;        /* Size of *iter to be used */
        struct iov_iter                def_iter;        /* Default buffer/data iterator */
        struct iov_iter                *write_iter;        /* Iterator defining write to be made */
        struct iov_iter                *iter;                /* Iterator currently in use */
        union {        /* Convenience for ->def_iter */
                struct kvec        kvec[1];
                struct bio_vec        bvec[1];
        };
        void                        *buffer;        /* reply receive buffer */
        union {
                struct afs_endpoint_state *probe;
                struct afs_addr_list        *vl_probe;
                struct afs_addr_list        *ret_alist;
                struct afs_vldb_entry        *ret_vldb;
                char                        *ret_str;
        };
        struct afs_fid                fid;                /* Primary vnode ID (or all zeroes) */
        unsigned char                probe_index;        /* Address in ->probe_alist */
        struct afs_operation        *op;
        unsigned int                server_index;
        refcount_t                ref;
        enum afs_call_state        state;
        spinlock_t                state_lock;
        int                        error;                /* error code */
        u32                        abort_code;        /* Remote abort ID or 0 */
        unsigned int                max_lifespan;        /* Maximum lifespan in secs to set if not 0 */
        unsigned                request_size;        /* size of request data */
        unsigned                reply_max;        /* maximum size of reply */
        unsigned                count2;                /* count used in unmarshalling */
        unsigned char                unmarshall;        /* unmarshalling phase */
        bool                        drop_ref;        /* T if need to drop ref for incoming call */
        bool                        need_attention;        /* T if RxRPC poked us */
        bool                        async;                /* T if asynchronous */
        bool                        upgrade;        /* T to request service upgrade */
        bool                        intr;                /* T if interruptible */
        bool                        unmarshalling_error; /* T if an unmarshalling error occurred */
        bool                        responded;        /* Got a response from the call (may be abort) */
        u16                        service_id;        /* Actual service ID (after upgrade) */
        unsigned int                debug_id;        /* Trace ID */
        u32                        operation_ID;        /* operation ID for an incoming call */
        u32                        count;                /* count for use in unmarshalling */
        union {                                        /* place to extract temporary data */
                struct {
                        __be32        tmp_u;
                        __be32        tmp;
                } __attribute__((packed));
                __be64                tmp64;
        };
        ktime_t                        issue_time;        /* Time of issue of operation */
};

struct afs_call_type {
        const char *name;
        unsigned int op; /* Really enum afs_fs_operation */

        /* deliver request or reply data to an call
         * - returning an error will cause the call to be aborted
         */
        int (*deliver)(struct afs_call *call);

        /* clean up a call */
        void (*destructor)(struct afs_call *call);

        /* Work function */
        void (*work)(struct work_struct *work);

        /* Call done function (gets called immediately on success or failure) */
        void (*done)(struct afs_call *call);
};

/*
 * Key available for writeback on a file.
 */
struct afs_wb_key {
        refcount_t                usage;
        struct key                *key;
        struct list_head        vnode_link;        /* Link in vnode->wb_keys */
};

/*
 * AFS open file information record.  Pointed to by file->private_data.
 */
struct afs_file {
        struct key                *key;                /* The key this file was opened with */
        struct afs_wb_key        *wb;                /* Writeback key record for this file */
};

static inline struct key *afs_file_key(struct file *file)
{
        struct afs_file *af = file->private_data;

        return af->key;
}

/*
 * Record of an outstanding read operation on a vnode.
 */
struct afs_read {
        loff_t                        pos;                /* Where to start reading */
        loff_t                        len;                /* How much we're asking for */
        loff_t                        actual_len;        /* How much we're actually getting */
        loff_t                        file_size;        /* File size returned by server */
        struct key                *key;                /* The key to use to reissue the read */
        struct afs_vnode        *vnode;                /* The file being read into. */
        struct netfs_io_subrequest *subreq;        /* Fscache helper read request this belongs to */
        afs_dataversion_t        data_version;        /* Version number returned by server */
        refcount_t                usage;
        unsigned int                call_debug_id;
        unsigned int                nr_pages;
        int                        error;
        void (*done)(struct afs_read *);
        void (*cleanup)(struct afs_read *);
        struct iov_iter                *iter;                /* Iterator representing the buffer */
        struct iov_iter                def_iter;        /* Default iterator */
};

/*
 * AFS superblock private data
 * - there's one superblock per volume
 */
struct afs_super_info {
        struct net                *net_ns;        /* Network namespace */
        struct afs_cell                *cell;                /* The cell in which the volume resides */
        struct afs_volume        *volume;        /* volume record */
        enum afs_flock_mode        flock_mode:8;        /* File locking emulation mode */
        bool                        dyn_root;        /* True if dynamic root */
};

static inline struct afs_super_info *AFS_FS_S(struct super_block *sb)
{
        return sb->s_fs_info;
}

extern struct file_system_type afs_fs_type;

/*
 * Set of substitutes for @sys.
 */
struct afs_sysnames {
#define AFS_NR_SYSNAME 16
        char                        *subs[AFS_NR_SYSNAME];
        refcount_t                usage;
        unsigned short                nr;
        char                        blank[1];
};

/*
 * AFS network namespace record.
 */
struct afs_net {
        struct net                *net;                /* Backpointer to the owning net namespace */
        struct afs_uuid                uuid;
        bool                        live;                /* F if this namespace is being removed */

        /* AF_RXRPC I/O stuff */
        struct socket                *socket;
        struct afs_call                *spare_incoming_call;
        struct work_struct        charge_preallocation_work;
        struct mutex                socket_mutex;
        atomic_t                nr_outstanding_calls;
        atomic_t                nr_superblocks;

        /* Cell database */
        struct rb_root                cells;
        struct afs_cell                *ws_cell;
        struct work_struct        cells_manager;
        struct timer_list        cells_timer;
        atomic_t                cells_outstanding;
        struct rw_semaphore        cells_lock;
        struct mutex                cells_alias_lock;

        struct mutex                proc_cells_lock;
        struct hlist_head        proc_cells;

        /* Known servers.  Theoretically each fileserver can only be in one
         * cell, but in practice, people create aliases and subsets and there's
         * no easy way to distinguish them.
         */
        seqlock_t                fs_lock;        /* For fs_servers, fs_probe_*, fs_proc */
        struct rb_root                fs_servers;        /* afs_server (by server UUID or address) */
        struct list_head        fs_probe_fast;        /* List of afs_server to probe at 30s intervals */
        struct list_head        fs_probe_slow;        /* List of afs_server to probe at 5m intervals */
        struct hlist_head        fs_proc;        /* procfs servers list */

        struct hlist_head        fs_addresses;        /* afs_server (by lowest IPv6 addr) */
        seqlock_t                fs_addr_lock;        /* For fs_addresses[46] */

        struct work_struct        fs_manager;
        struct timer_list        fs_timer;

        struct work_struct        fs_prober;
        struct timer_list        fs_probe_timer;
        atomic_t                servers_outstanding;

        /* File locking renewal management */
        struct mutex                lock_manager_mutex;

        /* Misc */
        struct super_block        *dynroot_sb;        /* Dynamic root mount superblock */
        struct proc_dir_entry        *proc_afs;        /* /proc/net/afs directory */
        struct afs_sysnames        *sysnames;
        rwlock_t                sysnames_lock;
        struct afs_addr_preference_list __rcu *address_prefs;
        u16                        address_pref_version;

        /* Statistics counters */
        atomic_t                n_lookup;        /* Number of lookups done */
        atomic_t                n_reval;        /* Number of dentries needing revalidation */
        atomic_t                n_inval;        /* Number of invalidations by the server */
        atomic_t                n_relpg;        /* Number of invalidations by release_folio */
        atomic_t                n_read_dir;        /* Number of directory pages read */
        atomic_t                n_dir_cr;        /* Number of directory entry creation edits */
        atomic_t                n_dir_rm;        /* Number of directory entry removal edits */
        atomic_t                n_stores;        /* Number of store ops */
        atomic_long_t                n_store_bytes;        /* Number of bytes stored */
        atomic_long_t                n_fetch_bytes;        /* Number of bytes fetched */
        atomic_t                n_fetches;        /* Number of data fetch ops */
};

extern const char afs_init_sysname[];

enum afs_cell_state {
        AFS_CELL_UNSET,
        AFS_CELL_ACTIVATING,
        AFS_CELL_ACTIVE,
        AFS_CELL_DEACTIVATING,
        AFS_CELL_INACTIVE,
        AFS_CELL_FAILED,
        AFS_CELL_REMOVED,
};

/*
 * AFS cell record.
 *
 * This is a tricky concept to get right as it is possible to create aliases
 * simply by pointing AFSDB/SRV records for two names at the same set of VL
 * servers; it is also possible to do things like setting up two sets of VL
 * servers, one of which provides a superset of the volumes provided by the
 * other (for internal/external division, for example).
 *
 * Cells only exist in the sense that (a) a cell's name maps to a set of VL
 * servers and (b) a cell's name is used by the client to select the key to use
 * for authentication and encryption.  The cell name is not typically used in
 * the protocol.
 *
 * Two cells are determined to be aliases if they have an explicit alias (YFS
 * only), share any VL servers in common or have at least one volume in common.
 * "In common" means that the address list of the VL servers or the fileservers
 * share at least one endpoint.
 */
struct afs_cell {
        union {
                struct rcu_head        rcu;
                struct rb_node        net_node;        /* Node in net->cells */
        };
        struct afs_net                *net;
        struct afs_cell                *alias_of;        /* The cell this is an alias of */
        struct afs_volume        *root_volume;        /* The root.cell volume if there is one */
        struct key                *anonymous_key;        /* anonymous user key for this cell */
        struct work_struct        manager;        /* Manager for init/deinit/dns */
        struct hlist_node        proc_link;        /* /proc cell list link */
        time64_t                dns_expiry;        /* Time AFSDB/SRV record expires */
        time64_t                last_inactive;        /* Time of last drop of usage count */
        refcount_t                ref;                /* Struct refcount */
        atomic_t                active;                /* Active usage counter */
        unsigned long                flags;
#define AFS_CELL_FL_NO_GC        0                /* The cell was added manually, don't auto-gc */
#define AFS_CELL_FL_DO_LOOKUP        1                /* DNS lookup requested */
#define AFS_CELL_FL_CHECK_ALIAS        2                /* Need to check for aliases */
        enum afs_cell_state        state;
        short                        error;
        enum dns_record_source        dns_source:8;        /* Latest source of data from lookup */
        enum dns_lookup_status        dns_status:8;        /* Latest status of data from lookup */
        unsigned int                dns_lookup_count; /* Counter of DNS lookups */
        unsigned int                debug_id;

        /* The volumes belonging to this cell */
        struct rw_semaphore        vs_lock;        /* Lock for server->volumes */
        struct rb_root                volumes;        /* Tree of volumes on this server */
        struct hlist_head        proc_volumes;        /* procfs volume list */
        seqlock_t                volume_lock;        /* For volumes */

        /* Active fileserver interaction state. */
        struct rb_root                fs_servers;        /* afs_server (by server UUID) */
        seqlock_t                fs_lock;        /* For fs_servers  */

        /* VL server list. */
        rwlock_t                vl_servers_lock; /* Lock on vl_servers */
        struct afs_vlserver_list __rcu *vl_servers;

        u8                        name_len;        /* Length of name */
        char                        *name;                /* Cell name, case-flattened and NUL-padded */
};

/*
 * Volume Location server record.
 */
struct afs_vlserver {
        struct rcu_head                rcu;
        struct afs_addr_list        __rcu *addresses; /* List of addresses for this VL server */
        unsigned long                flags;
#define AFS_VLSERVER_FL_PROBED        0                /* The VL server has been probed */
#define AFS_VLSERVER_FL_PROBING        1                /* VL server is being probed */
#define AFS_VLSERVER_FL_IS_YFS        2                /* Server is YFS not AFS */
#define AFS_VLSERVER_FL_RESPONDING 3                /* VL server is responding */
        rwlock_t                lock;                /* Lock on addresses */
        refcount_t                ref;
        unsigned int                rtt;                /* Server's current RTT in uS */
        unsigned int                debug_id;

        /* Probe state */
        wait_queue_head_t        probe_wq;
        atomic_t                probe_outstanding;
        spinlock_t                probe_lock;
        struct {
                unsigned int        rtt;                /* Best RTT in uS (or UINT_MAX) */
                u32                abort_code;
                short                error;
                unsigned short        flags;
#define AFS_VLSERVER_PROBE_RESPONDED                0x01 /* At least once response (may be abort) */
#define AFS_VLSERVER_PROBE_IS_YFS                0x02 /* The peer appears to be YFS */
#define AFS_VLSERVER_PROBE_NOT_YFS                0x04 /* The peer appears not to be YFS */
#define AFS_VLSERVER_PROBE_LOCAL_FAILURE        0x08 /* A local failure prevented a probe */
        } probe;

        u16                        service_id;        /* Service ID we're using */
        u16                        port;
        u16                        name_len;        /* Length of name */
        char                        name[];                /* Server name, case-flattened */
};

/*
 * Weighted list of Volume Location servers.
 */
struct afs_vlserver_entry {
        u16                        priority;        /* Preference (as SRV) */
        u16                        weight;                /* Weight (as SRV) */
        enum dns_record_source        source:8;
        enum dns_lookup_status        status:8;
        struct afs_vlserver        *server;
};

struct afs_vlserver_list {
        struct rcu_head                rcu;
        refcount_t                ref;
        u8                        nr_servers;
        u8                        index;                /* Server currently in use */
        u8                        preferred;        /* Preferred server */
        enum dns_record_source        source:8;
        enum dns_lookup_status        status:8;
        rwlock_t                lock;
        struct afs_vlserver_entry servers[];
};

/*
 * Cached VLDB entry.
 *
 * This is pointed to by cell->vldb_entries, indexed by name.
 */
struct afs_vldb_entry {
        afs_volid_t                vid[3];                /* Volume IDs for R/W, R/O and Bak volumes */

        unsigned long                flags;
#define AFS_VLDB_HAS_RW                0                /* - R/W volume exists */
#define AFS_VLDB_HAS_RO                1                /* - R/O volume exists */
#define AFS_VLDB_HAS_BAK        2                /* - Backup volume exists */
#define AFS_VLDB_QUERY_VALID        3                /* - Record is valid */
#define AFS_VLDB_QUERY_ERROR        4                /* - VL server returned error */

        uuid_t                        fs_server[AFS_NMAXNSERVERS];
        u32                        addr_version[AFS_NMAXNSERVERS]; /* Registration change counters */
        u8                        fs_mask[AFS_NMAXNSERVERS];
#define AFS_VOL_VTM_RW        0x01 /* R/W version of the volume is available (on this server) */
#define AFS_VOL_VTM_RO        0x02 /* R/O version of the volume is available (on this server) */
#define AFS_VOL_VTM_BAK        0x04 /* backup version of the volume is available (on this server) */
        u8                        vlsf_flags[AFS_NMAXNSERVERS];
        short                        error;
        u8                        nr_servers;        /* Number of server records */
        u8                        name_len;
        u8                        name[AFS_MAXVOLNAME + 1]; /* NUL-padded volume name */
};

/*
 * Fileserver endpoint state.  The records the addresses of a fileserver's
 * endpoints and the state and result of a round of probing on them.  This
 * allows the rotation algorithm to access those results without them being
 * erased by a subsequent round of probing.
 */
struct afs_endpoint_state {
        struct rcu_head                rcu;
        struct afs_addr_list        *addresses;        /* The addresses being probed */
        unsigned long                responsive_set;        /* Bitset of responsive endpoints */
        unsigned long                failed_set;        /* Bitset of endpoints we failed to probe */
        refcount_t                ref;
        unsigned int                server_id;        /* Debug ID of server */
        unsigned int                probe_seq;        /* Probe sequence (from server::probe_counter) */
        atomic_t                nr_probing;        /* Number of outstanding probes */
        unsigned int                rtt;                /* Best RTT in uS (or UINT_MAX) */
        s32                        abort_code;
        short                        error;
        unsigned long                flags;
#define AFS_ESTATE_RESPONDED        0                /* Set if the server responded */
#define AFS_ESTATE_SUPERSEDED        1                /* Set if this record has been superseded */
#define AFS_ESTATE_IS_YFS        2                /* Set if probe upgraded to YFS */
#define AFS_ESTATE_NOT_YFS        3                /* Set if probe didn't upgrade to YFS */
#define AFS_ESTATE_LOCAL_FAILURE 4                /* Set if there was a local failure (eg. ENOMEM) */
};

/*
 * Record of fileserver with which we're actively communicating.
 */
struct afs_server {
        struct rcu_head                rcu;
        union {
                uuid_t                uuid;                /* Server ID */
                struct afs_uuid        _uuid;
        };

        struct afs_cell                *cell;                /* Cell to which belongs (pins ref) */
        struct rb_node                uuid_rb;        /* Link in net->fs_servers */
        struct afs_server __rcu        *uuid_next;        /* Next server with same UUID */
        struct afs_server        *uuid_prev;        /* Previous server with same UUID */
        struct list_head        probe_link;        /* Link in net->fs_probe_list */
        struct hlist_node        addr_link;        /* Link in net->fs_addresses6 */
        struct hlist_node        proc_link;        /* Link in net->fs_proc */
        struct list_head        volumes;        /* RCU list of afs_server_entry objects */
        struct afs_server        *gc_next;        /* Next server in manager's list */
        time64_t                unuse_time;        /* Time at which last unused */
        unsigned long                flags;
#define AFS_SERVER_FL_RESPONDING 0                /* The server is responding */
#define AFS_SERVER_FL_UPDATING        1
#define AFS_SERVER_FL_NEEDS_UPDATE 2                /* Fileserver address list is out of date */
#define AFS_SERVER_FL_NOT_READY        4                /* The record is not ready for use */
#define AFS_SERVER_FL_NOT_FOUND        5                /* VL server says no such server */
#define AFS_SERVER_FL_VL_FAIL        6                /* Failed to access VL server */
#define AFS_SERVER_FL_MAY_HAVE_CB 8                /* May have callbacks on this fileserver */
#define AFS_SERVER_FL_IS_YFS        16                /* Server is YFS not AFS */
#define AFS_SERVER_FL_NO_IBULK        17                /* Fileserver doesn't support FS.InlineBulkStatus */
#define AFS_SERVER_FL_NO_RM2        18                /* Fileserver doesn't support YFS.RemoveFile2 */
#define AFS_SERVER_FL_HAS_FS64        19                /* Fileserver supports FS.{Fetch,Store}Data64 */
        refcount_t                ref;                /* Object refcount */
        atomic_t                active;                /* Active user count */
        u32                        addr_version;        /* Address list version */
        u16                        service_id;        /* Service ID we're using. */
        unsigned int                rtt;                /* Server's current RTT in uS */
        unsigned int                debug_id;        /* Debugging ID for traces */

        /* file service access */
        rwlock_t                fs_lock;        /* access lock */

        /* Probe state */
        struct afs_endpoint_state __rcu *endpoint_state; /* Latest endpoint/probe state */
        unsigned long                probed_at;        /* Time last probe was dispatched (jiffies) */
        wait_queue_head_t        probe_wq;
        unsigned int                probe_counter;        /* Number of probes issued */
        spinlock_t                probe_lock;
};

enum afs_ro_replicating {
        AFS_RO_NOT_REPLICATING,                        /* Not doing replication */
        AFS_RO_REPLICATING_USE_OLD,                /* Replicating; use old version */
        AFS_RO_REPLICATING_USE_NEW,                /* Replicating; switch to new version */
} __mode(byte);

/*
 * Replaceable volume server list.
 */
struct afs_server_entry {
        struct afs_server        *server;
        struct afs_volume        *volume;
        struct list_head        slink;                /* Link in server->volumes */
        time64_t                cb_expires_at;        /* Time at which volume-level callback expires */
        unsigned long                flags;
#define AFS_SE_EXCLUDED                0                /* Set if server is to be excluded in rotation */
#define AFS_SE_VOLUME_OFFLINE        1                /* Set if volume offline notice given */
#define AFS_SE_VOLUME_BUSY        2                /* Set if volume busy notice given */
};

struct afs_server_list {
        struct rcu_head                rcu;
        refcount_t                usage;
        bool                        attached;        /* T if attached to servers */
        enum afs_ro_replicating        ro_replicating;        /* RW->RO update (probably) in progress */
        unsigned char                nr_servers;
        unsigned short                vnovol_mask;        /* Servers to be skipped due to VNOVOL */
        unsigned int                seq;                /* Set to ->servers_seq when installed */
        rwlock_t                lock;
        struct afs_server_entry        servers[];
};

/*
 * Live AFS volume management.
 */
struct afs_volume {
        struct rcu_head        rcu;
        afs_volid_t                vid;                /* The volume ID of this volume */
        afs_volid_t                vids[AFS_MAXTYPES]; /* All associated volume IDs */
        refcount_t                ref;
        time64_t                update_at;        /* Time at which to next update */
        struct afs_cell                *cell;                /* Cell to which belongs (pins ref) */
        struct rb_node                cell_node;        /* Link in cell->volumes */
        struct hlist_node        proc_link;        /* Link in cell->proc_volumes */
        struct super_block __rcu *sb;                /* Superblock on which inodes reside */
        struct work_struct        destructor;        /* Deferred destructor */
        unsigned long                flags;
#define AFS_VOLUME_NEEDS_UPDATE        0        /* - T if an update needs performing */
#define AFS_VOLUME_UPDATING        1        /* - T if an update is in progress */
#define AFS_VOLUME_WAIT                2        /* - T if users must wait for update */
#define AFS_VOLUME_DELETED        3        /* - T if volume appears deleted */
#define AFS_VOLUME_MAYBE_NO_IBULK 4        /* - T if some servers don't have InlineBulkStatus */
#define AFS_VOLUME_RM_TREE        5        /* - Set if volume removed from cell->volumes */
#ifdef CONFIG_AFS_FSCACHE
        struct fscache_volume        *cache;                /* Caching cookie */
#endif
        struct afs_server_list __rcu *servers;        /* List of servers on which volume resides */
        rwlock_t                servers_lock;        /* Lock for ->servers */
        unsigned int                servers_seq;        /* Incremented each time ->servers changes */

        /* RO release tracking */
        struct mutex                volsync_lock;        /* Time/state evaluation lock */
        time64_t                creation_time;        /* Volume creation time (or TIME64_MIN) */
        time64_t                update_time;        /* Volume update time (or TIME64_MIN) */

        /* Callback management */
        struct mutex                cb_check_lock;        /* Lock to control race to check after v_break */
        time64_t                cb_expires_at;        /* Earliest volume callback expiry time */
        atomic_t                cb_ro_snapshot;        /* RO volume update-from-snapshot counter */
        atomic_t                cb_v_break;        /* Volume-break event counter. */
        atomic_t                cb_v_check;        /* Volume-break has-been-checked counter. */
        atomic_t                cb_scrub;        /* Scrub-all-data event counter. */
        rwlock_t                cb_v_break_lock;
        struct rw_semaphore        open_mmaps_lock;
        struct list_head        open_mmaps;        /* List of vnodes that are mmapped */

        afs_voltype_t                type;                /* type of volume */
        char                        type_force;        /* force volume type (suppress R/O -> R/W) */
        u8                        name_len;
        u8                        name[AFS_MAXVOLNAME + 1]; /* NUL-padded volume name */
};

enum afs_lock_state {
        AFS_VNODE_LOCK_NONE,                /* The vnode has no lock on the server */
        AFS_VNODE_LOCK_WAITING_FOR_CB,        /* We're waiting for the server to break the callback */
        AFS_VNODE_LOCK_SETTING,                /* We're asking the server for a lock */
        AFS_VNODE_LOCK_GRANTED,                /* We have a lock on the server */
        AFS_VNODE_LOCK_EXTENDING,        /* We're extending a lock on the server */
        AFS_VNODE_LOCK_NEED_UNLOCK,        /* We need to unlock on the server */
        AFS_VNODE_LOCK_UNLOCKING,        /* We're telling the server to unlock */
        AFS_VNODE_LOCK_DELETED,                /* The vnode has been deleted whilst we have a lock */
};

/*
 * AFS inode private data.
 *
 * Note that afs_alloc_inode() *must* reset anything that could incorrectly
 * leak from one inode to another.
 */
struct afs_vnode {
        struct netfs_inode        netfs;                /* Netfslib context and vfs inode */
        struct afs_volume        *volume;        /* volume on which vnode resides */
        struct afs_fid                fid;                /* the file identifier for this inode */
        struct afs_file_status        status;                /* AFS status info for this file */
        afs_dataversion_t        invalid_before;        /* Child dentries are invalid before this */
        struct afs_permits __rcu *permit_cache;        /* cache of permits so far obtained */
        struct mutex                io_lock;        /* Lock for serialising I/O on this mutex */
        struct rw_semaphore        validate_lock;        /* lock for validating this vnode */
        struct rw_semaphore        rmdir_lock;        /* Lock for rmdir vs sillyrename */
        struct key                *silly_key;        /* Silly rename key */
        spinlock_t                wb_lock;        /* lock for wb_keys */
        spinlock_t                lock;                /* waitqueue/flags lock */
        unsigned long                flags;
#define AFS_VNODE_UNSET                1                /* set if vnode attributes not yet set */
#define AFS_VNODE_DIR_VALID        2                /* Set if dir contents are valid */
#define AFS_VNODE_ZAP_DATA        3                /* set if vnode's data should be invalidated */
#define AFS_VNODE_DELETED        4                /* set if vnode deleted on server */
#define AFS_VNODE_MOUNTPOINT        5                /* set if vnode is a mountpoint symlink */
#define AFS_VNODE_AUTOCELL        6                /* set if Vnode is an auto mount point */
#define AFS_VNODE_PSEUDODIR        7                 /* set if Vnode is a pseudo directory */
#define AFS_VNODE_NEW_CONTENT        8                /* Set if file has new content (create/trunc-0) */
#define AFS_VNODE_SILLY_DELETED        9                /* Set if file has been silly-deleted */
#define AFS_VNODE_MODIFYING        10                /* Set if we're performing a modification op */

        struct list_head        wb_keys;        /* List of keys available for writeback */
        struct list_head        pending_locks;        /* locks waiting to be granted */
        struct list_head        granted_locks;        /* locks granted on this file */
        struct delayed_work        lock_work;        /* work to be done in locking */
        struct key                *lock_key;        /* Key to be used in lock ops */
        ktime_t                        locked_at;        /* Time at which lock obtained */
        enum afs_lock_state        lock_state : 8;
        afs_lock_type_t                lock_type : 8;

        /* outstanding callback notification on this file */
        struct work_struct        cb_work;        /* Work for mmap'd files */
        struct list_head        cb_mmap_link;        /* Link in cell->fs_open_mmaps */
        void                        *cb_server;        /* Server with callback/filelock */
        atomic_t                cb_nr_mmap;        /* Number of mmaps */
        unsigned int                cb_ro_snapshot;        /* RO volume release counter on ->volume */
        unsigned int                cb_scrub;        /* Scrub counter on ->volume */
        unsigned int                cb_break;        /* Break counter on vnode */
        unsigned int                cb_v_check;        /* Break check counter on ->volume */
        seqlock_t                cb_lock;        /* Lock for ->cb_server, ->status, ->cb_*break */

        atomic64_t                cb_expires_at;        /* time at which callback expires */
#define AFS_NO_CB_PROMISE TIME64_MIN
};

static inline struct fscache_cookie *afs_vnode_cache(struct afs_vnode *vnode)
{
#ifdef CONFIG_AFS_FSCACHE
        return netfs_i_cookie(&vnode->netfs);
#else
        return NULL;
#endif
}

static inline void afs_vnode_set_cache(struct afs_vnode *vnode,
                                       struct fscache_cookie *cookie)
{
#ifdef CONFIG_AFS_FSCACHE
        vnode->netfs.cache = cookie;
        if (cookie)
                mapping_set_release_always(vnode->netfs.inode.i_mapping);
#endif
}

/*
 * cached security record for one user's attempt to access a vnode
 */
struct afs_permit {
        struct key                *key;                /* RxRPC ticket holding a security context */
        afs_access_t                access;                /* CallerAccess value for this key */
};

/*
 * Immutable cache of CallerAccess records from attempts to access vnodes.
 * These may be shared between multiple vnodes.
 */
struct afs_permits {
        struct rcu_head                rcu;
        struct hlist_node        hash_node;        /* Link in hash */
        unsigned long                h;                /* Hash value for this permit list */
        refcount_t                usage;
        unsigned short                nr_permits;        /* Number of records */
        bool                        invalidated;        /* Invalidated due to key change */
        struct afs_permit        permits[] __counted_by(nr_permits);        /* List of permits sorted by key pointer */
};

/*
 * Error prioritisation and accumulation.
 */
struct afs_error {
        s32        abort_code;                /* Cumulative abort code */
        short        error;                        /* Cumulative error */
        bool        responded;                /* T if server responded */
        bool        aborted;                /* T if ->error is from an abort */
};

/*
 * Cursor for iterating over a set of volume location servers.
 */
struct afs_vl_cursor {
        struct afs_cell                *cell;                /* The cell we're querying */
        struct afs_vlserver_list *server_list;        /* Current server list (pins ref) */
        struct afs_vlserver        *server;        /* Server on which this resides */
        struct afs_addr_list        *alist;                /* Current address list (pins ref) */
        struct key                *key;                /* Key for the server */
        unsigned long                untried_servers; /* Bitmask of untried servers */
        unsigned long                addr_tried;        /* Tried addresses */
        struct afs_error        cumul_error;        /* Cumulative error */
        unsigned int                debug_id;
        s32                        call_abort_code;
        short                        call_error;        /* Error from single call */
        short                        server_index;        /* Current server */
        signed char                addr_index;        /* Current address */
        unsigned short                flags;
#define AFS_VL_CURSOR_STOP        0x0001                /* Set to cease iteration */
#define AFS_VL_CURSOR_RETRY        0x0002                /* Set to do a retry */
#define AFS_VL_CURSOR_RETRIED        0x0004                /* Set if started a retry */
        short                        nr_iterations;        /* Number of server iterations */
        bool                        call_responded;        /* T if the current address responded */
};

/*
 * Fileserver state tracking for an operation.  An array of these is kept,
 * indexed by server index.
 */
struct afs_server_state {
        /* Tracking of fileserver probe state.  Other operations may interfere
         * by probing a fileserver when accessing other volumes.
         */
        unsigned int                probe_seq;
        unsigned long                untried_addrs;        /* Addresses we haven't tried yet */
        struct wait_queue_entry        probe_waiter;
        struct afs_endpoint_state *endpoint_state; /* Endpoint state being monitored */
};

/*
 * Fileserver operation methods.
 */
struct afs_operation_ops {
        void (*issue_afs_rpc)(struct afs_operation *op);
        void (*issue_yfs_rpc)(struct afs_operation *op);
        void (*success)(struct afs_operation *op);
        void (*aborted)(struct afs_operation *op);
        void (*failed)(struct afs_operation *op);
        void (*edit_dir)(struct afs_operation *op);
        void (*put)(struct afs_operation *op);
};

struct afs_vnode_param {
        struct afs_vnode        *vnode;
        struct afs_fid                fid;                /* Fid to access */
        struct afs_status_cb        scb;                /* Returned status and callback promise */
        afs_dataversion_t        dv_before;        /* Data version before the call */
        unsigned int                cb_break_before; /* cb_break before the call */
        u8                        dv_delta;        /* Expected change in data version */
        bool                        put_vnode:1;        /* T if we have a ref on the vnode */
        bool                        need_io_lock:1;        /* T if we need the I/O lock on this */
        bool                        update_ctime:1;        /* Need to update the ctime */
        bool                        set_size:1;        /* Must update i_size */
        bool                        op_unlinked:1;        /* True if file was unlinked by op */
        bool                        speculative:1;        /* T if speculative status fetch (no vnode lock) */
        bool                        modification:1;        /* Set if the content gets modified */
};

/*
 * Fileserver operation wrapper, handling server and address rotation
 * asynchronously.  May make simultaneous calls to multiple servers.
 */
struct afs_operation {
        struct afs_net                *net;                /* Network namespace */
        struct key                *key;                /* Key for the cell */
        const struct afs_call_type *type;        /* Type of call done */
        const struct afs_operation_ops *ops;

        /* Parameters/results for the operation */
        struct afs_volume        *volume;        /* Volume being accessed */
        struct afs_vnode_param        file[2];
        struct afs_vnode_param        *more_files;
        struct afs_volsync        pre_volsync;        /* Volsync before op */
        struct afs_volsync        volsync;        /* Volsync returned by op */
        struct dentry                *dentry;        /* Dentry to be altered */
        struct dentry                *dentry_2;        /* Second dentry to be altered */
        struct timespec64        mtime;                /* Modification time to record */
        struct timespec64        ctime;                /* Change time to set */
        struct afs_error        cumul_error;        /* Cumulative error */
        short                        nr_files;        /* Number of entries in file[], more_files */
        unsigned int                debug_id;

        unsigned int                cb_v_break;        /* Volume break counter before op */

        union {
                struct {
                        int        which;                /* Which ->file[] to fetch for */
                } fetch_status;
                struct {
                        int        reason;                /* enum afs_edit_dir_reason */
                        mode_t        mode;
                        const char *symlink;
                } create;
                struct {
                        bool        need_rehash;
                } unlink;
                struct {
                        struct dentry *rehash;
                        struct dentry *tmp;
                        bool        new_negative;
                } rename;
                struct {
                        struct afs_read *req;
                } fetch;
                struct {
                        afs_lock_type_t type;
                } lock;
                struct {
                        struct iov_iter        *write_iter;
                        loff_t        pos;
                        loff_t        size;
                        loff_t        i_size;
                } store;
                struct {
                        struct iattr        *attr;
                        loff_t                old_i_size;
                } setattr;
                struct afs_acl        *acl;
                struct yfs_acl        *yacl;
                struct {
                        struct afs_volume_status vs;
                        struct kstatfs                *buf;
                } volstatus;
        };

        /* Fileserver iteration state */
        struct afs_server_list        *server_list;        /* Current server list (pins ref) */
        struct afs_server        *server;        /* Server we're using (ref pinned by server_list) */
        struct afs_endpoint_state *estate;        /* Current endpoint state (doesn't pin ref) */
        struct afs_server_state        *server_states;        /* States of the servers involved */
        struct afs_call                *call;
        unsigned long                untried_servers; /* Bitmask of untried servers */
        unsigned long                addr_tried;        /* Tried addresses */
        s32                        call_abort_code; /* Abort code from single call */
        short                        call_error;        /* Error from single call */
        short                        server_index;        /* Current server */
        short                        nr_iterations;        /* Number of server iterations */
        signed char                addr_index;        /* Current address */
        bool                        call_responded;        /* T if the current address responded */

        unsigned int                flags;
#define AFS_OPERATION_STOP                0x0001        /* Set to cease iteration */
#define AFS_OPERATION_VBUSY                0x0002        /* Set if seen VBUSY */
#define AFS_OPERATION_VMOVED                0x0004        /* Set if seen VMOVED */
#define AFS_OPERATION_VNOVOL                0x0008        /* Set if seen VNOVOL */
#define AFS_OPERATION_CUR_ONLY                0x0010        /* Set if current server only (file lock held) */
#define AFS_OPERATION_NO_VSLEEP                0x0020        /* Set to prevent sleep on VBUSY, VOFFLINE, ... */
#define AFS_OPERATION_UNINTR                0x0040        /* Set if op is uninterruptible */
#define AFS_OPERATION_DOWNGRADE                0x0080        /* Set to retry with downgraded opcode */
#define AFS_OPERATION_LOCK_0                0x0100        /* Set if have io_lock on file[0] */
#define AFS_OPERATION_LOCK_1                0x0200        /* Set if have io_lock on file[1] */
#define AFS_OPERATION_TRIED_ALL                0x0400        /* Set if we've tried all the fileservers */
#define AFS_OPERATION_RETRY_SERVER        0x0800        /* Set if we should retry the current server */
#define AFS_OPERATION_DIR_CONFLICT        0x1000        /* Set if we detected a 3rd-party dir change */
};

/*
 * Cache auxiliary data.
 */
struct afs_vnode_cache_aux {
        __be64                        data_version;
} __packed;

static inline void afs_set_cache_aux(struct afs_vnode *vnode,
                                     struct afs_vnode_cache_aux *aux)
{
        aux->data_version = cpu_to_be64(vnode->status.data_version);
}

static inline void afs_invalidate_cache(struct afs_vnode *vnode, unsigned int flags)
{
        struct afs_vnode_cache_aux aux;

        afs_set_cache_aux(vnode, &aux);
        fscache_invalidate(afs_vnode_cache(vnode), &aux,
                           i_size_read(&vnode->netfs.inode), flags);
}

#include <trace/events/afs.h>

/*****************************************************************************/
/*
 * addr_list.c
 */
struct afs_addr_list *afs_get_addrlist(struct afs_addr_list *alist, enum afs_alist_trace reason);
extern struct afs_addr_list *afs_alloc_addrlist(unsigned int nr);
extern void afs_put_addrlist(struct afs_addr_list *alist, enum afs_alist_trace reason);
extern struct afs_vlserver_list *afs_parse_text_addrs(struct afs_net *,
                                                      const char *, size_t, char,
                                                      unsigned short, unsigned short);
bool afs_addr_list_same(const struct afs_addr_list *a,
                        const struct afs_addr_list *b);
extern struct afs_vlserver_list *afs_dns_query(struct afs_cell *, time64_t *);

extern int afs_merge_fs_addr4(struct afs_net *net, struct afs_addr_list *addr,
                              __be32 xdr, u16 port);
extern int afs_merge_fs_addr6(struct afs_net *net, struct afs_addr_list *addr,
                              __be32 *xdr, u16 port);

/*
 * addr_prefs.c
 */
int afs_proc_addr_prefs_write(struct file *file, char *buf, size_t size);
void afs_get_address_preferences_rcu(struct afs_net *net, struct afs_addr_list *alist);
void afs_get_address_preferences(struct afs_net *net, struct afs_addr_list *alist);

/*
 * callback.c
 */
extern void afs_invalidate_mmap_work(struct work_struct *);
extern void afs_init_callback_state(struct afs_server *);
extern void __afs_break_callback(struct afs_vnode *, enum afs_cb_break_reason);
extern void afs_break_callback(struct afs_vnode *, enum afs_cb_break_reason);
extern void afs_break_callbacks(struct afs_server *, size_t, struct afs_callback_break *);

static inline unsigned int afs_calc_vnode_cb_break(struct afs_vnode *vnode)
{
        return vnode->cb_break + vnode->cb_ro_snapshot + vnode->cb_scrub;
}

static inline bool afs_cb_is_broken(unsigned int cb_break,
                                    const struct afs_vnode *vnode)
{
        return cb_break != (vnode->cb_break +
                            atomic_read(&vnode->volume->cb_ro_snapshot) +
                            atomic_read(&vnode->volume->cb_scrub));
}

/*
 * cell.c
 */
extern int afs_cell_init(struct afs_net *, const char *);
extern struct afs_cell *afs_find_cell(struct afs_net *, const char *, unsigned,
                                      enum afs_cell_trace);
extern struct afs_cell *afs_lookup_cell(struct afs_net *, const char *, unsigned,
                                        const char *, bool);
extern struct afs_cell *afs_use_cell(struct afs_cell *, enum afs_cell_trace);
extern void afs_unuse_cell(struct afs_net *, struct afs_cell *, enum afs_cell_trace);
extern struct afs_cell *afs_get_cell(struct afs_cell *, enum afs_cell_trace);
extern void afs_see_cell(struct afs_cell *, enum afs_cell_trace);
extern void afs_put_cell(struct afs_cell *, enum afs_cell_trace);
extern void afs_queue_cell(struct afs_cell *, enum afs_cell_trace);
extern void afs_manage_cells(struct work_struct *);
extern void afs_cells_timer(struct timer_list *);
extern void __net_exit afs_cell_purge(struct afs_net *);

/*
 * cmservice.c
 */
extern bool afs_cm_incoming_call(struct afs_call *);

/*
 * dir.c
 */
extern const struct file_operations afs_dir_file_operations;
extern const struct inode_operations afs_dir_inode_operations;
extern const struct address_space_operations afs_dir_aops;
extern const struct dentry_operations afs_fs_dentry_operations;

extern void afs_d_release(struct dentry *);
extern void afs_check_for_remote_deletion(struct afs_operation *);

/*
 * dir_edit.c
 */
extern void afs_edit_dir_add(struct afs_vnode *, struct qstr *, struct afs_fid *,
                             enum afs_edit_dir_reason);
extern void afs_edit_dir_remove(struct afs_vnode *, struct qstr *, enum afs_edit_dir_reason);

/*
 * dir_silly.c
 */
extern int afs_sillyrename(struct afs_vnode *, struct afs_vnode *,
                           struct dentry *, struct key *);
extern int afs_silly_iput(struct dentry *, struct inode *);

/*
 * dynroot.c
 */
extern const struct inode_operations afs_dynroot_inode_operations;
extern const struct dentry_operations afs_dynroot_dentry_operations;

extern struct inode *afs_try_auto_mntpt(struct dentry *, struct inode *);
extern int afs_dynroot_mkdir(struct afs_net *, struct afs_cell *);
extern void afs_dynroot_rmdir(struct afs_net *, struct afs_cell *);
extern int afs_dynroot_populate(struct super_block *);
extern void afs_dynroot_depopulate(struct super_block *);

/*
 * file.c
 */
extern const struct address_space_operations afs_file_aops;
extern const struct address_space_operations afs_symlink_aops;
extern const struct inode_operations afs_file_inode_operations;
extern const struct file_operations afs_file_operations;
extern const struct netfs_request_ops afs_req_ops;

extern int afs_cache_wb_key(struct afs_vnode *, struct afs_file *);
extern void afs_put_wb_key(struct afs_wb_key *);
extern int afs_open(struct inode *, struct file *);
extern int afs_release(struct inode *, struct file *);
extern int afs_fetch_data(struct afs_vnode *, struct afs_read *);
extern struct afs_read *afs_alloc_read(gfp_t);
extern void afs_put_read(struct afs_read *);

static inline struct afs_read *afs_get_read(struct afs_read *req)
{
        refcount_inc(&req->usage);
        return req;
}

/*
 * flock.c
 */
extern struct workqueue_struct *afs_lock_manager;

extern void afs_lock_op_done(struct afs_call *);
extern void afs_lock_work(struct work_struct *);
extern void afs_lock_may_be_available(struct afs_vnode *);
extern int afs_lock(struct file *, int, struct file_lock *);
extern int afs_flock(struct file *, int, struct file_lock *);

/*
 * fsclient.c
 */
extern void afs_fs_fetch_status(struct afs_operation *);
extern void afs_fs_fetch_data(struct afs_operation *);
extern void afs_fs_create_file(struct afs_operation *);
extern void afs_fs_make_dir(struct afs_operation *);
extern void afs_fs_remove_file(struct afs_operation *);
extern void afs_fs_remove_dir(struct afs_operation *);
extern void afs_fs_link(struct afs_operation *);
extern void afs_fs_symlink(struct afs_operation *);
extern void afs_fs_rename(struct afs_operation *);
extern void afs_fs_store_data(struct afs_operation *);
extern void afs_fs_setattr(struct afs_operation *);
extern void afs_fs_get_volume_status(struct afs_operation *);
extern void afs_fs_set_lock(struct afs_operation *);
extern void afs_fs_extend_lock(struct afs_operation *);
extern void afs_fs_release_lock(struct afs_operation *);
int afs_fs_give_up_all_callbacks(struct afs_net *net, struct afs_server *server,
                                 struct afs_address *addr, struct key *key);
bool afs_fs_get_capabilities(struct afs_net *net, struct afs_server *server,
                             struct afs_endpoint_state *estate, unsigned int addr_index,
                             struct key *key);
extern void afs_fs_inline_bulk_status(struct afs_operation *);

struct afs_acl {
        u32        size;
        u8        data[] __counted_by(size);
};

extern void afs_fs_fetch_acl(struct afs_operation *);
extern void afs_fs_store_acl(struct afs_operation *);

/*
 * fs_operation.c
 */
extern struct afs_operation *afs_alloc_operation(struct key *, struct afs_volume *);
extern int afs_put_operation(struct afs_operation *);
extern bool afs_begin_vnode_operation(struct afs_operation *);
extern void afs_wait_for_operation(struct afs_operation *);
extern int afs_do_sync_operation(struct afs_operation *);

static inline void afs_op_set_vnode(struct afs_operation *op, unsigned int n,
                                    struct afs_vnode *vnode)
{
        op->file[n].vnode = vnode;
        op->file[n].need_io_lock = true;
}

static inline void afs_op_set_fid(struct afs_operation *op, unsigned int n,
                                  const struct afs_fid *fid)
{
        op->file[n].fid = *fid;
}

/*
 * fs_probe.c
 */
struct afs_endpoint_state *afs_get_endpoint_state(struct afs_endpoint_state *estate,
                                                  enum afs_estate_trace where);
void afs_put_endpoint_state(struct afs_endpoint_state *estate, enum afs_estate_trace where);
extern void afs_fileserver_probe_result(struct afs_call *);
void afs_fs_probe_fileserver(struct afs_net *net, struct afs_server *server,
                             struct afs_addr_list *new_addrs, struct key *key);
int afs_wait_for_fs_probes(struct afs_operation *op, struct afs_server_state *states, bool intr);
extern void afs_probe_fileserver(struct afs_net *, struct afs_server *);
extern void afs_fs_probe_dispatcher(struct work_struct *);
int afs_wait_for_one_fs_probe(struct afs_server *server, struct afs_endpoint_state *estate,
                              unsigned long exclude, bool is_intr);
extern void afs_fs_probe_cleanup(struct afs_net *);

/*
 * inode.c
 */
extern const struct afs_operation_ops afs_fetch_status_operation;

extern void afs_vnode_commit_status(struct afs_operation *, struct afs_vnode_param *);
extern int afs_fetch_status(struct afs_vnode *, struct key *, bool, afs_access_t *);
extern int afs_ilookup5_test_by_fid(struct inode *, void *);
extern struct inode *afs_iget_pseudo_dir(struct super_block *, bool);
extern struct inode *afs_iget(struct afs_operation *, struct afs_vnode_param *);
extern struct inode *afs_root_iget(struct super_block *, struct key *);
extern int afs_getattr(struct mnt_idmap *idmap, const struct path *,
                       struct kstat *, u32, unsigned int);
extern int afs_setattr(struct mnt_idmap *idmap, struct dentry *, struct iattr *);
extern void afs_evict_inode(struct inode *);
extern int afs_drop_inode(struct inode *);

/*
 * main.c
 */
extern struct workqueue_struct *afs_wq;
extern int afs_net_id;

static inline struct afs_net *afs_net(struct net *net)
{
        return net_generic(net, afs_net_id);
}

static inline struct afs_net *afs_sb2net(struct super_block *sb)
{
        return afs_net(AFS_FS_S(sb)->net_ns);
}

static inline struct afs_net *afs_d2net(struct dentry *dentry)
{
        return afs_sb2net(dentry->d_sb);
}

static inline struct afs_net *afs_i2net(struct inode *inode)
{
        return afs_sb2net(inode->i_sb);
}

static inline struct afs_net *afs_v2net(struct afs_vnode *vnode)
{
        return afs_i2net(&vnode->netfs.inode);
}

static inline struct afs_net *afs_sock2net(struct sock *sk)
{
        return net_generic(sock_net(sk), afs_net_id);
}

static inline void __afs_stat(atomic_t *s)
{
        atomic_inc(s);
}

#define afs_stat_v(vnode, n) __afs_stat(&afs_v2net(vnode)->n)

/*
 * misc.c
 */
extern int afs_abort_to_error(u32);
extern void afs_prioritise_error(struct afs_error *, int, u32);

static inline void afs_op_nomem(struct afs_operation *op)
{
        op->cumul_error.error = -ENOMEM;
}

static inline int afs_op_error(const struct afs_operation *op)
{
        return op->cumul_error.error;
}

static inline s32 afs_op_abort_code(const struct afs_operation *op)
{
        return op->cumul_error.abort_code;
}

static inline int afs_op_set_error(struct afs_operation *op, int error)
{
        return op->cumul_error.error = error;
}

static inline void afs_op_accumulate_error(struct afs_operation *op, int error, s32 abort_code)
{
        afs_prioritise_error(&op->cumul_error, error, abort_code);
}

/*
 * mntpt.c
 */
extern const struct inode_operations afs_mntpt_inode_operations;
extern const struct inode_operations afs_autocell_inode_operations;
extern const struct file_operations afs_mntpt_file_operations;

extern struct vfsmount *afs_d_automount(struct path *);
extern void afs_mntpt_kill_timer(void);

/*
 * proc.c
 */
#ifdef CONFIG_PROC_FS
extern int __net_init afs_proc_init(struct afs_net *);
extern void __net_exit afs_proc_cleanup(struct afs_net *);
extern int afs_proc_cell_setup(struct afs_cell *);
extern void afs_proc_cell_remove(struct afs_cell *);
extern void afs_put_sysnames(struct afs_sysnames *);
#else
static inline int afs_proc_init(struct afs_net *net) { return 0; }
static inline void afs_proc_cleanup(struct afs_net *net) {}
static inline int afs_proc_cell_setup(struct afs_cell *cell) { return 0; }
static inline void afs_proc_cell_remove(struct afs_cell *cell) {}
static inline void afs_put_sysnames(struct afs_sysnames *sysnames) {}
#endif

/*
 * rotate.c
 */
void afs_clear_server_states(struct afs_operation *op);
extern bool afs_select_fileserver(struct afs_operation *);
extern void afs_dump_edestaddrreq(const struct afs_operation *);

/*
 * rxrpc.c
 */
extern struct workqueue_struct *afs_async_calls;

extern int __net_init afs_open_socket(struct afs_net *);
extern void __net_exit afs_close_socket(struct afs_net *);
extern void afs_charge_preallocation(struct work_struct *);
extern void afs_put_call(struct afs_call *);
void afs_make_call(struct afs_call *call, gfp_t gfp);
void afs_wait_for_call_to_complete(struct afs_call *call);
extern struct afs_call *afs_alloc_flat_call(struct afs_net *,
                                            const struct afs_call_type *,
                                            size_t, size_t);
extern void afs_flat_call_destructor(struct afs_call *);
extern void afs_send_empty_reply(struct afs_call *);
extern void afs_send_simple_reply(struct afs_call *, const void *, size_t);
extern int afs_extract_data(struct afs_call *, bool);
extern int afs_protocol_error(struct afs_call *, enum afs_eproto_cause);

static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *call,
                                    gfp_t gfp)
{
        struct afs_addr_list *alist = op->estate->addresses;

        op->call        = call;
        op->type        = call->type;
        call->op        = op;
        call->key        = op->key;
        call->intr        = !(op->flags & AFS_OPERATION_UNINTR);
        call->peer        = rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer);
        call->service_id = op->server->service_id;
        afs_make_call(call, gfp);
}

static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t size)
{
        call->iov_len = size;
        call->kvec[0].iov_base = buf;
        call->kvec[0].iov_len = size;
        iov_iter_kvec(&call->def_iter, ITER_DEST, call->kvec, 1, size);
}

static inline void afs_extract_to_tmp(struct afs_call *call)
{
        call->iov_len = sizeof(call->tmp);
        afs_extract_begin(call, &call->tmp, sizeof(call->tmp));
}

static inline void afs_extract_to_tmp64(struct afs_call *call)
{
        call->iov_len = sizeof(call->tmp64);
        afs_extract_begin(call, &call->tmp64, sizeof(call->tmp64));
}

static inline void afs_extract_discard(struct afs_call *call, size_t size)
{
        call->iov_len = size;
        iov_iter_discard(&call->def_iter, ITER_DEST, size);
}

static inline void afs_extract_to_buf(struct afs_call *call, size_t size)
{
        call->iov_len = size;
        afs_extract_begin(call, call->buffer, size);
}

static inline int afs_transfer_reply(struct afs_call *call)
{
        return afs_extract_data(call, false);
}

static inline bool afs_check_call_state(struct afs_call *call,
                                        enum afs_call_state state)
{
        return READ_ONCE(call->state) == state;
}

static inline bool afs_set_call_state(struct afs_call *call,
                                      enum afs_call_state from,
                                      enum afs_call_state to)
{
        bool ok = false;

        spin_lock_bh(&call->state_lock);
        if (call->state == from) {
                call->state = to;
                trace_afs_call_state(call, from, to, 0, 0);
                ok = true;
        }
        spin_unlock_bh(&call->state_lock);
        return ok;
}

static inline void afs_set_call_complete(struct afs_call *call,
                                         int error, u32 remote_abort)
{
        enum afs_call_state state;
        bool ok = false;

        spin_lock_bh(&call->state_lock);
        state = call->state;
        if (state != AFS_CALL_COMPLETE) {
                call->abort_code = remote_abort;
                call->error = error;
                call->state = AFS_CALL_COMPLETE;
                trace_afs_call_state(call, state, AFS_CALL_COMPLETE,
                                     error, remote_abort);
                ok = true;
        }
        spin_unlock_bh(&call->state_lock);
        if (ok) {
                trace_afs_call_done(call);

                /* Asynchronous calls have two refs to release - one from the alloc and
                 * one queued with the work item - and we can't just deallocate the
                 * call because the work item may be queued again.
                 */
                if (call->drop_ref)
                        afs_put_call(call);
        }
}

/*
 * security.c
 */
extern void afs_put_permits(struct afs_permits *);
extern void afs_clear_permits(struct afs_vnode *);
extern void afs_cache_permit(struct afs_vnode *, struct key *, unsigned int,
                             struct afs_status_cb *);
extern struct key *afs_request_key(struct afs_cell *);
extern struct key *afs_request_key_rcu(struct afs_cell *);
extern int afs_check_permit(struct afs_vnode *, struct key *, afs_access_t *);
extern int afs_permission(struct mnt_idmap *, struct inode *, int);
extern void __exit afs_clean_up_permit_cache(void);

/*
 * server.c
 */
extern spinlock_t afs_server_peer_lock;

extern struct afs_server *afs_find_server(struct afs_net *, const struct rxrpc_peer *);
extern struct afs_server *afs_find_server_by_uuid(struct afs_net *, const uuid_t *);
extern struct afs_server *afs_lookup_server(struct afs_cell *, struct key *, const uuid_t *, u32);
extern struct afs_server *afs_get_server(struct afs_server *, enum afs_server_trace);
extern struct afs_server *afs_use_server(struct afs_server *, enum afs_server_trace);
extern void afs_unuse_server(struct afs_net *, struct afs_server *, enum afs_server_trace);
extern void afs_unuse_server_notime(struct afs_net *, struct afs_server *, enum afs_server_trace);
extern void afs_put_server(struct afs_net *, struct afs_server *, enum afs_server_trace);
extern void afs_manage_servers(struct work_struct *);
extern void afs_servers_timer(struct timer_list *);
extern void afs_fs_probe_timer(struct timer_list *);
extern void __net_exit afs_purge_servers(struct afs_net *);
bool afs_check_server_record(struct afs_operation *op, struct afs_server *server, struct key *key);

static inline void afs_inc_servers_outstanding(struct afs_net *net)
{
        atomic_inc(&net->servers_outstanding);
}

static inline void afs_dec_servers_outstanding(struct afs_net *net)
{
        if (atomic_dec_and_test(&net->servers_outstanding))
                wake_up_var(&net->servers_outstanding);
}

static inline bool afs_is_probing_server(struct afs_server *server)
{
        return list_empty(&server->probe_link);
}

/*
 * server_list.c
 */
static inline struct afs_server_list *afs_get_serverlist(struct afs_server_list *slist)
{
        refcount_inc(&slist->usage);
        return slist;
}

extern void afs_put_serverlist(struct afs_net *, struct afs_server_list *);
struct afs_server_list *afs_alloc_server_list(struct afs_volume *volume,
                                              struct key *key,
                                              struct afs_vldb_entry *vldb);
extern bool afs_annotate_server_list(struct afs_server_list *, struct afs_server_list *);
void afs_attach_volume_to_servers(struct afs_volume *volume, struct afs_server_list *slist);
void afs_reattach_volume_to_servers(struct afs_volume *volume, struct afs_server_list *slist,
                                    struct afs_server_list *old);
void afs_detach_volume_from_servers(struct afs_volume *volume, struct afs_server_list *slist);

/*
 * super.c
 */
extern int __init afs_fs_init(void);
extern void afs_fs_exit(void);

/*
 * validation.c
 */
bool afs_check_validity(const struct afs_vnode *vnode);
int afs_update_volume_state(struct afs_operation *op);
int afs_validate(struct afs_vnode *vnode, struct key *key);

/*
 * vlclient.c
 */
extern struct afs_vldb_entry *afs_vl_get_entry_by_name_u(struct afs_vl_cursor *,
                                                         const char *, int);
extern struct afs_addr_list *afs_vl_get_addrs_u(struct afs_vl_cursor *, const uuid_t *);
struct afs_call *afs_vl_get_capabilities(struct afs_net *net,
                                         struct afs_addr_list *alist,
                                         unsigned int addr_index,
                                         struct key *key,
                                         struct afs_vlserver *server,
                                         unsigned int server_index);
extern struct afs_addr_list *afs_yfsvl_get_endpoints(struct afs_vl_cursor *, const uuid_t *);
extern char *afs_yfsvl_get_cell_name(struct afs_vl_cursor *);

/*
 * vl_alias.c
 */
extern int afs_cell_detect_alias(struct afs_cell *, struct key *);

/*
 * vl_probe.c
 */
extern void afs_vlserver_probe_result(struct afs_call *);
extern int afs_send_vl_probes(struct afs_net *, struct key *, struct afs_vlserver_list *);
extern int afs_wait_for_vl_probes(struct afs_vlserver_list *, unsigned long);

/*
 * vl_rotate.c
 */
extern bool afs_begin_vlserver_operation(struct afs_vl_cursor *,
                                         struct afs_cell *, struct key *);
extern bool afs_select_vlserver(struct afs_vl_cursor *);
extern bool afs_select_current_vlserver(struct afs_vl_cursor *);
extern int afs_end_vlserver_operation(struct afs_vl_cursor *);

/*
 * vlserver_list.c
 */
static inline struct afs_vlserver *afs_get_vlserver(struct afs_vlserver *vlserver)
{
        refcount_inc(&vlserver->ref);
        return vlserver;
}

static inline struct afs_vlserver_list *afs_get_vlserverlist(struct afs_vlserver_list *vllist)
{
        if (vllist)
                refcount_inc(&vllist->ref);
        return vllist;
}

extern struct afs_vlserver *afs_alloc_vlserver(const char *, size_t, unsigned short);
extern void afs_put_vlserver(struct afs_net *, struct afs_vlserver *);
extern struct afs_vlserver_list *afs_alloc_vlserver_list(unsigned int);
extern void afs_put_vlserverlist(struct afs_net *, struct afs_vlserver_list *);
extern struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *,
                                                           const void *, size_t);

/*
 * volume.c
 */
extern struct afs_volume *afs_create_volume(struct afs_fs_context *);
extern int afs_activate_volume(struct afs_volume *);
extern void afs_deactivate_volume(struct afs_volume *);
bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason);
extern struct afs_volume *afs_get_volume(struct afs_volume *, enum afs_volume_trace);
void afs_put_volume(struct afs_volume *volume, enum afs_volume_trace reason);
extern int afs_check_volume_status(struct afs_volume *, struct afs_operation *);

/*
 * write.c
 */
void afs_prepare_write(struct netfs_io_subrequest *subreq);
void afs_issue_write(struct netfs_io_subrequest *subreq);
void afs_begin_writeback(struct netfs_io_request *wreq);
void afs_retry_request(struct netfs_io_request *wreq, struct netfs_io_stream *stream);
extern int afs_writepages(struct address_space *, struct writeback_control *);
extern int afs_fsync(struct file *, loff_t, loff_t, int);
extern vm_fault_t afs_page_mkwrite(struct vm_fault *vmf);
extern void afs_prune_wb_keys(struct afs_vnode *);

/*
 * xattr.c
 */
extern const struct xattr_handler * const afs_xattr_handlers[];

/*
 * yfsclient.c
 */
extern void yfs_fs_fetch_data(struct afs_operation *);
extern void yfs_fs_create_file(struct afs_operation *);
extern void yfs_fs_make_dir(struct afs_operation *);
extern void yfs_fs_remove_file2(struct afs_operation *);
extern void yfs_fs_remove_file(struct afs_operation *);
extern void yfs_fs_remove_dir(struct afs_operation *);
extern void yfs_fs_link(struct afs_operation *);
extern void yfs_fs_symlink(struct afs_operation *);
extern void yfs_fs_rename(struct afs_operation *);
extern void yfs_fs_store_data(struct afs_operation *);
extern void yfs_fs_setattr(struct afs_operation *);
extern void yfs_fs_get_volume_status(struct afs_operation *);
extern void yfs_fs_set_lock(struct afs_operation *);
extern void yfs_fs_extend_lock(struct afs_operation *);
extern void yfs_fs_release_lock(struct afs_operation *);
extern void yfs_fs_fetch_status(struct afs_operation *);
extern void yfs_fs_inline_bulk_status(struct afs_operation *);

struct yfs_acl {
        struct afs_acl        *acl;                /* Dir/file/symlink ACL */
        struct afs_acl        *vol_acl;        /* Whole volume ACL */
        u32                inherit_flag;        /* True if ACL is inherited from parent dir */
        u32                num_cleaned;        /* Number of ACEs removed due to subject removal */
        unsigned int        flags;
#define YFS_ACL_WANT_ACL        0x01        /* Set if caller wants ->acl */
#define YFS_ACL_WANT_VOL_ACL        0x02        /* Set if caller wants ->vol_acl */
};

extern void yfs_free_opaque_acl(struct yfs_acl *);
extern void yfs_fs_fetch_opaque_acl(struct afs_operation *);
extern void yfs_fs_store_opaque_acl2(struct afs_operation *);

/*
 * Miscellaneous inline functions.
 */
static inline struct afs_vnode *AFS_FS_I(struct inode *inode)
{
        return container_of(inode, struct afs_vnode, netfs.inode);
}

static inline struct inode *AFS_VNODE_TO_I(struct afs_vnode *vnode)
{
        return &vnode->netfs.inode;
}

/*
 * Note that a dentry got changed.  We need to set d_fsdata to the data version
 * number derived from the result of the operation.  It doesn't matter if
 * d_fsdata goes backwards as we'll just revalidate.
 */
static inline void afs_update_dentry_version(struct afs_operation *op,
                                             struct afs_vnode_param *dir_vp,
                                             struct dentry *dentry)
{
        if (!op->cumul_error.error)
                dentry->d_fsdata =
                        (void *)(unsigned long)dir_vp->scb.status.data_version;
}

/*
 * Set the file size and block count.  Estimate the number of 512 bytes blocks
 * used, rounded up to nearest 1K for consistency with other AFS clients.
 */
static inline void afs_set_i_size(struct afs_vnode *vnode, u64 size)
{
        i_size_write(&vnode->netfs.inode, size);
        vnode->netfs.inode.i_blocks = ((size + 1023) >> 10) << 1;
}

/*
 * Check for a conflicting operation on a directory that we just unlinked from.
 * If someone managed to sneak a link or an unlink in on the file we just
 * unlinked, we won't be able to trust nlink on an AFS file (but not YFS).
 */
static inline void afs_check_dir_conflict(struct afs_operation *op,
                                          struct afs_vnode_param *dvp)
{
        if (dvp->dv_before + dvp->dv_delta != dvp->scb.status.data_version)
                op->flags |= AFS_OPERATION_DIR_CONFLICT;
}

static inline int afs_io_error(struct afs_call *call, enum afs_io_error where)
{
        trace_afs_io_error(call->debug_id, -EIO, where);
        return -EIO;
}

static inline int afs_bad(struct afs_vnode *vnode, enum afs_file_error where)
{
        trace_afs_file_error(vnode, -EIO, where);
        return -EIO;
}

/*****************************************************************************/
/*
 * debug tracing
 */
extern unsigned afs_debug;

#define dbgprintk(FMT,...) \
        printk("[%-6.6s] "FMT"\n", current->comm ,##__VA_ARGS__)

#define kenter(FMT,...)        dbgprintk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
#define kleave(FMT,...)        dbgprintk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
#define kdebug(FMT,...)        dbgprintk("    "FMT ,##__VA_ARGS__)


#if defined(__KDEBUG)
#define _enter(FMT,...)        kenter(FMT,##__VA_ARGS__)
#define _leave(FMT,...)        kleave(FMT,##__VA_ARGS__)
#define _debug(FMT,...)        kdebug(FMT,##__VA_ARGS__)

#elif defined(CONFIG_AFS_DEBUG)
#define AFS_DEBUG_KENTER        0x01
#define AFS_DEBUG_KLEAVE        0x02
#define AFS_DEBUG_KDEBUG        0x04

#define _enter(FMT,...)                                        \
do {                                                        \
        if (unlikely(afs_debug & AFS_DEBUG_KENTER))        \
                kenter(FMT,##__VA_ARGS__);                \
} while (0)

#define _leave(FMT,...)                                        \
do {                                                        \
        if (unlikely(afs_debug & AFS_DEBUG_KLEAVE))        \
                kleave(FMT,##__VA_ARGS__);                \
} while (0)

#define _debug(FMT,...)                                        \
do {                                                        \
        if (unlikely(afs_debug & AFS_DEBUG_KDEBUG))        \
                kdebug(FMT,##__VA_ARGS__);                \
} while (0)

#else
#define _enter(FMT,...)        no_printk("==> %s("FMT")",__func__ ,##__VA_ARGS__)
#define _leave(FMT,...)        no_printk("<== %s()"FMT"",__func__ ,##__VA_ARGS__)
#define _debug(FMT,...)        no_printk("    "FMT ,##__VA_ARGS__)
#endif

/*
 * debug assertion checking
 */
#if 1 // defined(__KDEBUGALL)

#define ASSERT(X)                                                \
do {                                                                \
        if (unlikely(!(X))) {                                        \
                printk(KERN_ERR "\n");                                \
                printk(KERN_ERR "AFS: Assertion failed\n");        \
                BUG();                                                \
        }                                                        \
} while(0)

#define ASSERTCMP(X, OP, Y)                                                \
do {                                                                        \
        if (unlikely(!((X) OP (Y)))) {                                        \
                printk(KERN_ERR "\n");                                        \
                printk(KERN_ERR "AFS: Assertion failed\n");                \
                printk(KERN_ERR "%lu " #OP " %lu is false\n",                \
                       (unsigned long)(X), (unsigned long)(Y));                \
                printk(KERN_ERR "0x%lx " #OP " 0x%lx is false\n",        \
                       (unsigned long)(X), (unsigned long)(Y));                \
                BUG();                                                        \
        }                                                                \
} while(0)

#define ASSERTRANGE(L, OP1, N, OP2, H)                                        \
do {                                                                        \
        if (unlikely(!((L) OP1 (N)) || !((N) OP2 (H)))) {                \
                printk(KERN_ERR "\n");                                        \
                printk(KERN_ERR "AFS: Assertion failed\n");                \
                printk(KERN_ERR "%lu "#OP1" %lu "#OP2" %lu is false\n",        \
                       (unsigned long)(L), (unsigned long)(N),                \
                       (unsigned long)(H));                                \
                printk(KERN_ERR "0x%lx "#OP1" 0x%lx "#OP2" 0x%lx is false\n", \
                       (unsigned long)(L), (unsigned long)(N),                \
                       (unsigned long)(H));                                \
                BUG();                                                        \
        }                                                                \
} while(0)

#define ASSERTIF(C, X)                                                \
do {                                                                \
        if (unlikely((C) && !(X))) {                                \
                printk(KERN_ERR "\n");                                \
                printk(KERN_ERR "AFS: Assertion failed\n");        \
                BUG();                                                \
        }                                                        \
} while(0)

#define ASSERTIFCMP(C, X, OP, Y)                                        \
do {                                                                        \
        if (unlikely((C) && !((X) OP (Y)))) {                                \
                printk(KERN_ERR "\n");                                        \
                printk(KERN_ERR "AFS: Assertion failed\n");                \
                printk(KERN_ERR "%lu " #OP " %lu is false\n",                \
                       (unsigned long)(X), (unsigned long)(Y));                \
                printk(KERN_ERR "0x%lx " #OP " 0x%lx is false\n",        \
                       (unsigned long)(X), (unsigned long)(Y));                \
                BUG();                                                        \
        }                                                                \
} while(0)

#else

#define ASSERT(X)                                \
do {                                                \
} while(0)

#define ASSERTCMP(X, OP, Y)                        \
do {                                                \
} while(0)

#define ASSERTRANGE(L, OP1, N, OP2, H)                \
do {                                                \
} while(0)

#define ASSERTIF(C, X)                                \
do {                                                \
} while(0)

#define ASSERTIFCMP(C, X, OP, Y)                \
do {                                                \
} while(0)

#endif /* __KDEBUGALL */


































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    2 









    2 



































    1 





    1 













































































































































































































































    2 




    2 



















































































































































    3 


    3 


















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
// SPDX-License-Identifier: GPL-2.0
/*
 * Interface for controlling IO bandwidth on a request queue
 *
 * Copyright (C) 2010 Vivek Goyal <vgoyal@redhat.com>
 */

#include <linux/module.h>
#include <linux/slab.h>
#include <linux/blkdev.h>
#include <linux/bio.h>
#include <linux/blktrace_api.h>
#include "blk.h"
#include "blk-cgroup-rwstat.h"
#include "blk-stat.h"
#include "blk-throttle.h"

/* Max dispatch from a group in 1 round */
#define THROTL_GRP_QUANTUM 8

/* Total max dispatch from all groups in one round */
#define THROTL_QUANTUM 32

/* Throttling is performed over a slice and after that slice is renewed */
#define DFL_THROTL_SLICE_HD (HZ / 10)
#define DFL_THROTL_SLICE_SSD (HZ / 50)
#define MAX_THROTL_SLICE (HZ)

/* A workqueue to queue throttle related work */
static struct workqueue_struct *kthrotld_workqueue;

#define rb_entry_tg(node)        rb_entry((node), struct throtl_grp, rb_node)

struct throtl_data
{
        /* service tree for active throtl groups */
        struct throtl_service_queue service_queue;

        struct request_queue *queue;

        /* Total Number of queued bios on READ and WRITE lists */
        unsigned int nr_queued[2];

        unsigned int throtl_slice;

        /* Work for dispatching throttled bios */
        struct work_struct dispatch_work;

        bool track_bio_latency;
};

static void throtl_pending_timer_fn(struct timer_list *t);

static inline struct blkcg_gq *tg_to_blkg(struct throtl_grp *tg)
{
        return pd_to_blkg(&tg->pd);
}

/**
 * sq_to_tg - return the throl_grp the specified service queue belongs to
 * @sq: the throtl_service_queue of interest
 *
 * Return the throtl_grp @sq belongs to.  If @sq is the top-level one
 * embedded in throtl_data, %NULL is returned.
 */
static struct throtl_grp *sq_to_tg(struct throtl_service_queue *sq)
{
        if (sq && sq->parent_sq)
                return container_of(sq, struct throtl_grp, service_queue);
        else
                return NULL;
}

/**
 * sq_to_td - return throtl_data the specified service queue belongs to
 * @sq: the throtl_service_queue of interest
 *
 * A service_queue can be embedded in either a throtl_grp or throtl_data.
 * Determine the associated throtl_data accordingly and return it.
 */
static struct throtl_data *sq_to_td(struct throtl_service_queue *sq)
{
        struct throtl_grp *tg = sq_to_tg(sq);

        if (tg)
                return tg->td;
        else
                return container_of(sq, struct throtl_data, service_queue);
}

static uint64_t tg_bps_limit(struct throtl_grp *tg, int rw)
{
        struct blkcg_gq *blkg = tg_to_blkg(tg);

        if (cgroup_subsys_on_dfl(io_cgrp_subsys) && !blkg->parent)
                return U64_MAX;

        return tg->bps[rw];
}

static unsigned int tg_iops_limit(struct throtl_grp *tg, int rw)
{
        struct blkcg_gq *blkg = tg_to_blkg(tg);

        if (cgroup_subsys_on_dfl(io_cgrp_subsys) && !blkg->parent)
                return UINT_MAX;

        return tg->iops[rw];
}

/**
 * throtl_log - log debug message via blktrace
 * @sq: the service_queue being reported
 * @fmt: printf format string
 * @args: printf args
 *
 * The messages are prefixed with "throtl BLKG_NAME" if @sq belongs to a
 * throtl_grp; otherwise, just "throtl".
 */
#define throtl_log(sq, fmt, args...)        do {                                \
        struct throtl_grp *__tg = sq_to_tg((sq));                        \
        struct throtl_data *__td = sq_to_td((sq));                        \
                                                                        \
        (void)__td;                                                        \
        if (likely(!blk_trace_note_message_enabled(__td->queue)))        \
                break;                                                        \
        if ((__tg)) {                                                        \
                blk_add_cgroup_trace_msg(__td->queue,                        \
                        &tg_to_blkg(__tg)->blkcg->css, "throtl " fmt, ##args);\
        } else {                                                        \
                blk_add_trace_msg(__td->queue, "throtl " fmt, ##args);        \
        }                                                                \
} while (0)

static inline unsigned int throtl_bio_data_size(struct bio *bio)
{
        /* assume it's one sector */
        if (unlikely(bio_op(bio) == REQ_OP_DISCARD))
                return 512;
        return bio->bi_iter.bi_size;
}

static void throtl_qnode_init(struct throtl_qnode *qn, struct throtl_grp *tg)
{
        INIT_LIST_HEAD(&qn->node);
        bio_list_init(&qn->bios);
        qn->tg = tg;
}

/**
 * throtl_qnode_add_bio - add a bio to a throtl_qnode and activate it
 * @bio: bio being added
 * @qn: qnode to add bio to
 * @queued: the service_queue->queued[] list @qn belongs to
 *
 * Add @bio to @qn and put @qn on @queued if it's not already on.
 * @qn->tg's reference count is bumped when @qn is activated.  See the
 * comment on top of throtl_qnode definition for details.
 */
static void throtl_qnode_add_bio(struct bio *bio, struct throtl_qnode *qn,
                                 struct list_head *queued)
{
        bio_list_add(&qn->bios, bio);
        if (list_empty(&qn->node)) {
                list_add_tail(&qn->node, queued);
                blkg_get(tg_to_blkg(qn->tg));
        }
}

/**
 * throtl_peek_queued - peek the first bio on a qnode list
 * @queued: the qnode list to peek
 */
static struct bio *throtl_peek_queued(struct list_head *queued)
{
        struct throtl_qnode *qn;
        struct bio *bio;

        if (list_empty(queued))
                return NULL;

        qn = list_first_entry(queued, struct throtl_qnode, node);
        bio = bio_list_peek(&qn->bios);
        WARN_ON_ONCE(!bio);
        return bio;
}

/**
 * throtl_pop_queued - pop the first bio form a qnode list
 * @queued: the qnode list to pop a bio from
 * @tg_to_put: optional out argument for throtl_grp to put
 *
 * Pop the first bio from the qnode list @queued.  After popping, the first
 * qnode is removed from @queued if empty or moved to the end of @queued so
 * that the popping order is round-robin.
 *
 * When the first qnode is removed, its associated throtl_grp should be put
 * too.  If @tg_to_put is NULL, this function automatically puts it;
 * otherwise, *@tg_to_put is set to the throtl_grp to put and the caller is
 * responsible for putting it.
 */
static struct bio *throtl_pop_queued(struct list_head *queued,
                                     struct throtl_grp **tg_to_put)
{
        struct throtl_qnode *qn;
        struct bio *bio;

        if (list_empty(queued))
                return NULL;

        qn = list_first_entry(queued, struct throtl_qnode, node);
        bio = bio_list_pop(&qn->bios);
        WARN_ON_ONCE(!bio);

        if (bio_list_empty(&qn->bios)) {
                list_del_init(&qn->node);
                if (tg_to_put)
                        *tg_to_put = qn->tg;
                else
                        blkg_put(tg_to_blkg(qn->tg));
        } else {
                list_move_tail(&qn->node, queued);
        }

        return bio;
}

/* init a service_queue, assumes the caller zeroed it */
static void throtl_service_queue_init(struct throtl_service_queue *sq)
{
        INIT_LIST_HEAD(&sq->queued[READ]);
        INIT_LIST_HEAD(&sq->queued[WRITE]);
        sq->pending_tree = RB_ROOT_CACHED;
        timer_setup(&sq->pending_timer, throtl_pending_timer_fn, 0);
}

static struct blkg_policy_data *throtl_pd_alloc(struct gendisk *disk,
                struct blkcg *blkcg, gfp_t gfp)
{
        struct throtl_grp *tg;
        int rw;

        tg = kzalloc_node(sizeof(*tg), gfp, disk->node_id);
        if (!tg)
                return NULL;

        if (blkg_rwstat_init(&tg->stat_bytes, gfp))
                goto err_free_tg;

        if (blkg_rwstat_init(&tg->stat_ios, gfp))
                goto err_exit_stat_bytes;

        throtl_service_queue_init(&tg->service_queue);

        for (rw = READ; rw <= WRITE; rw++) {
                throtl_qnode_init(&tg->qnode_on_self[rw], tg);
                throtl_qnode_init(&tg->qnode_on_parent[rw], tg);
        }

        RB_CLEAR_NODE(&tg->rb_node);
        tg->bps[READ] = U64_MAX;
        tg->bps[WRITE] = U64_MAX;
        tg->iops[READ] = UINT_MAX;
        tg->iops[WRITE] = UINT_MAX;

        return &tg->pd;

err_exit_stat_bytes:
        blkg_rwstat_exit(&tg->stat_bytes);
err_free_tg:
        kfree(tg);
        return NULL;
}

static void throtl_pd_init(struct blkg_policy_data *pd)
{
        struct throtl_grp *tg = pd_to_tg(pd);
        struct blkcg_gq *blkg = tg_to_blkg(tg);
        struct throtl_data *td = blkg->q->td;
        struct throtl_service_queue *sq = &tg->service_queue;

        /*
         * If on the default hierarchy, we switch to properly hierarchical
         * behavior where limits on a given throtl_grp are applied to the
         * whole subtree rather than just the group itself.  e.g. If 16M
         * read_bps limit is set on a parent group, summary bps of
         * parent group and its subtree groups can't exceed 16M for the
         * device.
         *
         * If not on the default hierarchy, the broken flat hierarchy
         * behavior is retained where all throtl_grps are treated as if
         * they're all separate root groups right below throtl_data.
         * Limits of a group don't interact with limits of other groups
         * regardless of the position of the group in the hierarchy.
         */
        sq->parent_sq = &td->service_queue;
        if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent)
                sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue;
        tg->td = td;
}

/*
 * Set has_rules[] if @tg or any of its parents have limits configured.
 * This doesn't require walking up to the top of the hierarchy as the
 * parent's has_rules[] is guaranteed to be correct.
 */
static void tg_update_has_rules(struct throtl_grp *tg)
{
        struct throtl_grp *parent_tg = sq_to_tg(tg->service_queue.parent_sq);
        int rw;

        for (rw = READ; rw <= WRITE; rw++) {
                tg->has_rules_iops[rw] =
                        (parent_tg && parent_tg->has_rules_iops[rw]) ||
                        tg_iops_limit(tg, rw) != UINT_MAX;
                tg->has_rules_bps[rw] =
                        (parent_tg && parent_tg->has_rules_bps[rw]) ||
                        tg_bps_limit(tg, rw) != U64_MAX;
        }
}

static void throtl_pd_online(struct blkg_policy_data *pd)
{
        struct throtl_grp *tg = pd_to_tg(pd);
        /*
         * We don't want new groups to escape the limits of its ancestors.
         * Update has_rules[] after a new group is brought online.
         */
        tg_update_has_rules(tg);
}

static void throtl_pd_free(struct blkg_policy_data *pd)
{
        struct throtl_grp *tg = pd_to_tg(pd);

        del_timer_sync(&tg->service_queue.pending_timer);
        blkg_rwstat_exit(&tg->stat_bytes);
        blkg_rwstat_exit(&tg->stat_ios);
        kfree(tg);
}

static struct throtl_grp *
throtl_rb_first(struct throtl_service_queue *parent_sq)
{
        struct rb_node *n;

        n = rb_first_cached(&parent_sq->pending_tree);
        WARN_ON_ONCE(!n);
        if (!n)
                return NULL;
        return rb_entry_tg(n);
}

static void throtl_rb_erase(struct rb_node *n,
                            struct throtl_service_queue *parent_sq)
{
        rb_erase_cached(n, &parent_sq->pending_tree);
        RB_CLEAR_NODE(n);
}

static void update_min_dispatch_time(struct throtl_service_queue *parent_sq)
{
        struct throtl_grp *tg;

        tg = throtl_rb_first(parent_sq);
        if (!tg)
                return;

        parent_sq->first_pending_disptime = tg->disptime;
}

static void tg_service_queue_add(struct throtl_grp *tg)
{
        struct throtl_service_queue *parent_sq = tg->service_queue.parent_sq;
        struct rb_node **node = &parent_sq->pending_tree.rb_root.rb_node;
        struct rb_node *parent = NULL;
        struct throtl_grp *__tg;
        unsigned long key = tg->disptime;
        bool leftmost = true;

        while (*node != NULL) {
                parent = *node;
                __tg = rb_entry_tg(parent);

                if (time_before(key, __tg->disptime))
                        node = &parent->rb_left;
                else {
                        node = &parent->rb_right;
                        leftmost = false;
                }
        }

        rb_link_node(&tg->rb_node, parent, node);
        rb_insert_color_cached(&tg->rb_node, &parent_sq->pending_tree,
                               leftmost);
}

static void throtl_enqueue_tg(struct throtl_grp *tg)
{
        if (!(tg->flags & THROTL_TG_PENDING)) {
                tg_service_queue_add(tg);
                tg->flags |= THROTL_TG_PENDING;
                tg->service_queue.parent_sq->nr_pending++;
        }
}

static void throtl_dequeue_tg(struct throtl_grp *tg)
{
        if (tg->flags & THROTL_TG_PENDING) {
                struct throtl_service_queue *parent_sq =
                        tg->service_queue.parent_sq;

                throtl_rb_erase(&tg->rb_node, parent_sq);
                --parent_sq->nr_pending;
                tg->flags &= ~THROTL_TG_PENDING;
        }
}

/* Call with queue lock held */
static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
                                          unsigned long expires)
{
        unsigned long max_expire = jiffies + 8 * sq_to_td(sq)->throtl_slice;

        /*
         * Since we are adjusting the throttle limit dynamically, the sleep
         * time calculated according to previous limit might be invalid. It's
         * possible the cgroup sleep time is very long and no other cgroups
         * have IO running so notify the limit changes. Make sure the cgroup
         * doesn't sleep too long to avoid the missed notification.
         */
        if (time_after(expires, max_expire))
                expires = max_expire;
        mod_timer(&sq->pending_timer, expires);
        throtl_log(sq, "schedule timer. delay=%lu jiffies=%lu",
                   expires - jiffies, jiffies);
}

/**
 * throtl_schedule_next_dispatch - schedule the next dispatch cycle
 * @sq: the service_queue to schedule dispatch for
 * @force: force scheduling
 *
 * Arm @sq->pending_timer so that the next dispatch cycle starts on the
 * dispatch time of the first pending child.  Returns %true if either timer
 * is armed or there's no pending child left.  %false if the current
 * dispatch window is still open and the caller should continue
 * dispatching.
 *
 * If @force is %true, the dispatch timer is always scheduled and this
 * function is guaranteed to return %true.  This is to be used when the
 * caller can't dispatch itself and needs to invoke pending_timer
 * unconditionally.  Note that forced scheduling is likely to induce short
 * delay before dispatch starts even if @sq->first_pending_disptime is not
 * in the future and thus shouldn't be used in hot paths.
 */
static bool throtl_schedule_next_dispatch(struct throtl_service_queue *sq,
                                          bool force)
{
        /* any pending children left? */
        if (!sq->nr_pending)
                return true;

        update_min_dispatch_time(sq);

        /* is the next dispatch time in the future? */
        if (force || time_after(sq->first_pending_disptime, jiffies)) {
                throtl_schedule_pending_timer(sq, sq->first_pending_disptime);
                return true;
        }

        /* tell the caller to continue dispatching */
        return false;
}

static inline void throtl_start_new_slice_with_credit(struct throtl_grp *tg,
                bool rw, unsigned long start)
{
        tg->bytes_disp[rw] = 0;
        tg->io_disp[rw] = 0;
        tg->carryover_bytes[rw] = 0;
        tg->carryover_ios[rw] = 0;

        /*
         * Previous slice has expired. We must have trimmed it after last
         * bio dispatch. That means since start of last slice, we never used
         * that bandwidth. Do try to make use of that bandwidth while giving
         * credit.
         */
        if (time_after(start, tg->slice_start[rw]))
                tg->slice_start[rw] = start;

        tg->slice_end[rw] = jiffies + tg->td->throtl_slice;
        throtl_log(&tg->service_queue,
                   "[%c] new slice with credit start=%lu end=%lu jiffies=%lu",
                   rw == READ ? 'R' : 'W', tg->slice_start[rw],
                   tg->slice_end[rw], jiffies);
}

static inline void throtl_start_new_slice(struct throtl_grp *tg, bool rw,
                                          bool clear_carryover)
{
        tg->bytes_disp[rw] = 0;
        tg->io_disp[rw] = 0;
        tg->slice_start[rw] = jiffies;
        tg->slice_end[rw] = jiffies + tg->td->throtl_slice;
        if (clear_carryover) {
                tg->carryover_bytes[rw] = 0;
                tg->carryover_ios[rw] = 0;
        }

        throtl_log(&tg->service_queue,
                   "[%c] new slice start=%lu end=%lu jiffies=%lu",
                   rw == READ ? 'R' : 'W', tg->slice_start[rw],
                   tg->slice_end[rw], jiffies);
}

static inline void throtl_set_slice_end(struct throtl_grp *tg, bool rw,
                                        unsigned long jiffy_end)
{
        tg->slice_end[rw] = roundup(jiffy_end, tg->td->throtl_slice);
}

static inline void throtl_extend_slice(struct throtl_grp *tg, bool rw,
                                       unsigned long jiffy_end)
{
        throtl_set_slice_end(tg, rw, jiffy_end);
        throtl_log(&tg->service_queue,
                   "[%c] extend slice start=%lu end=%lu jiffies=%lu",
                   rw == READ ? 'R' : 'W', tg->slice_start[rw],
                   tg->slice_end[rw], jiffies);
}

/* Determine if previously allocated or extended slice is complete or not */
static bool throtl_slice_used(struct throtl_grp *tg, bool rw)
{
        if (time_in_range(jiffies, tg->slice_start[rw], tg->slice_end[rw]))
                return false;

        return true;
}

static unsigned int calculate_io_allowed(u32 iops_limit,
                                         unsigned long jiffy_elapsed)
{
        unsigned int io_allowed;
        u64 tmp;

        /*
         * jiffy_elapsed should not be a big value as minimum iops can be
         * 1 then at max jiffy elapsed should be equivalent of 1 second as we
         * will allow dispatch after 1 second and after that slice should
         * have been trimmed.
         */

        tmp = (u64)iops_limit * jiffy_elapsed;
        do_div(tmp, HZ);

        if (tmp > UINT_MAX)
                io_allowed = UINT_MAX;
        else
                io_allowed = tmp;

        return io_allowed;
}

static u64 calculate_bytes_allowed(u64 bps_limit, unsigned long jiffy_elapsed)
{
        /*
         * Can result be wider than 64 bits?
         * We check against 62, not 64, due to ilog2 truncation.
         */
        if (ilog2(bps_limit) + ilog2(jiffy_elapsed) - ilog2(HZ) > 62)
                return U64_MAX;
        return mul_u64_u64_div_u64(bps_limit, (u64)jiffy_elapsed, (u64)HZ);
}

/* Trim the used slices and adjust slice start accordingly */
static inline void throtl_trim_slice(struct throtl_grp *tg, bool rw)
{
        unsigned long time_elapsed;
        long long bytes_trim;
        int io_trim;

        BUG_ON(time_before(tg->slice_end[rw], tg->slice_start[rw]));

        /*
         * If bps are unlimited (-1), then time slice don't get
         * renewed. Don't try to trim the slice if slice is used. A new
         * slice will start when appropriate.
         */
        if (throtl_slice_used(tg, rw))
                return;

        /*
         * A bio has been dispatched. Also adjust slice_end. It might happen
         * that initially cgroup limit was very low resulting in high
         * slice_end, but later limit was bumped up and bio was dispatched
         * sooner, then we need to reduce slice_end. A high bogus slice_end
         * is bad because it does not allow new slice to start.
         */

        throtl_set_slice_end(tg, rw, jiffies + tg->td->throtl_slice);

        time_elapsed = rounddown(jiffies - tg->slice_start[rw],
                                 tg->td->throtl_slice);
        if (!time_elapsed)
                return;

        bytes_trim = calculate_bytes_allowed(tg_bps_limit(tg, rw),
                                             time_elapsed) +
                     tg->carryover_bytes[rw];
        io_trim = calculate_io_allowed(tg_iops_limit(tg, rw), time_elapsed) +
                  tg->carryover_ios[rw];
        if (bytes_trim <= 0 && io_trim <= 0)
                return;

        tg->carryover_bytes[rw] = 0;
        if ((long long)tg->bytes_disp[rw] >= bytes_trim)
                tg->bytes_disp[rw] -= bytes_trim;
        else
                tg->bytes_disp[rw] = 0;

        tg->carryover_ios[rw] = 0;
        if ((int)tg->io_disp[rw] >= io_trim)
                tg->io_disp[rw] -= io_trim;
        else
                tg->io_disp[rw] = 0;

        tg->slice_start[rw] += time_elapsed;

        throtl_log(&tg->service_queue,
                   "[%c] trim slice nr=%lu bytes=%lld io=%d start=%lu end=%lu jiffies=%lu",
                   rw == READ ? 'R' : 'W', time_elapsed / tg->td->throtl_slice,
                   bytes_trim, io_trim, tg->slice_start[rw], tg->slice_end[rw],
                   jiffies);
}

static void __tg_update_carryover(struct throtl_grp *tg, bool rw)
{
        unsigned long jiffy_elapsed = jiffies - tg->slice_start[rw];
        u64 bps_limit = tg_bps_limit(tg, rw);
        u32 iops_limit = tg_iops_limit(tg, rw);

        /*
         * If config is updated while bios are still throttled, calculate and
         * accumulate how many bytes/ios are waited across changes. And
         * carryover_bytes/ios will be used to calculate new wait time under new
         * configuration.
         */
        if (bps_limit != U64_MAX)
                tg->carryover_bytes[rw] +=
                        calculate_bytes_allowed(bps_limit, jiffy_elapsed) -
                        tg->bytes_disp[rw];
        if (iops_limit != UINT_MAX)
                tg->carryover_ios[rw] +=
                        calculate_io_allowed(iops_limit, jiffy_elapsed) -
                        tg->io_disp[rw];
}

static void tg_update_carryover(struct throtl_grp *tg)
{
        if (tg->service_queue.nr_queued[READ])
                __tg_update_carryover(tg, READ);
        if (tg->service_queue.nr_queued[WRITE])
                __tg_update_carryover(tg, WRITE);

        /* see comments in struct throtl_grp for meaning of these fields. */
        throtl_log(&tg->service_queue, "%s: %lld %lld %d %d\n", __func__,
                   tg->carryover_bytes[READ], tg->carryover_bytes[WRITE],
                   tg->carryover_ios[READ], tg->carryover_ios[WRITE]);
}

static unsigned long tg_within_iops_limit(struct throtl_grp *tg, struct bio *bio,
                                 u32 iops_limit)
{
        bool rw = bio_data_dir(bio);
        int io_allowed;
        unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;

        if (iops_limit == UINT_MAX) {
                return 0;
        }

        jiffy_elapsed = jiffies - tg->slice_start[rw];

        /* Round up to the next throttle slice, wait time must be nonzero */
        jiffy_elapsed_rnd = roundup(jiffy_elapsed + 1, tg->td->throtl_slice);
        io_allowed = calculate_io_allowed(iops_limit, jiffy_elapsed_rnd) +
                     tg->carryover_ios[rw];
        if (io_allowed > 0 && tg->io_disp[rw] + 1 <= io_allowed)
                return 0;

        /* Calc approx time to dispatch */
        jiffy_wait = jiffy_elapsed_rnd - jiffy_elapsed;

        /* make sure at least one io can be dispatched after waiting */
        jiffy_wait = max(jiffy_wait, HZ / iops_limit + 1);
        return jiffy_wait;
}

static unsigned long tg_within_bps_limit(struct throtl_grp *tg, struct bio *bio,
                                u64 bps_limit)
{
        bool rw = bio_data_dir(bio);
        long long bytes_allowed;
        u64 extra_bytes;
        unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;
        unsigned int bio_size = throtl_bio_data_size(bio);

        /* no need to throttle if this bio's bytes have been accounted */
        if (bps_limit == U64_MAX || bio_flagged(bio, BIO_BPS_THROTTLED)) {
                return 0;
        }

        jiffy_elapsed = jiffy_elapsed_rnd = jiffies - tg->slice_start[rw];

        /* Slice has just started. Consider one slice interval */
        if (!jiffy_elapsed)
                jiffy_elapsed_rnd = tg->td->throtl_slice;

        jiffy_elapsed_rnd = roundup(jiffy_elapsed_rnd, tg->td->throtl_slice);
        bytes_allowed = calculate_bytes_allowed(bps_limit, jiffy_elapsed_rnd) +
                        tg->carryover_bytes[rw];
        if (bytes_allowed > 0 && tg->bytes_disp[rw] + bio_size <= bytes_allowed)
                return 0;

        /* Calc approx time to dispatch */
        extra_bytes = tg->bytes_disp[rw] + bio_size - bytes_allowed;
        jiffy_wait = div64_u64(extra_bytes * HZ, bps_limit);

        if (!jiffy_wait)
                jiffy_wait = 1;

        /*
         * This wait time is without taking into consideration the rounding
         * up we did. Add that time also.
         */
        jiffy_wait = jiffy_wait + (jiffy_elapsed_rnd - jiffy_elapsed);
        return jiffy_wait;
}

/*
 * Returns whether one can dispatch a bio or not. Also returns approx number
 * of jiffies to wait before this bio is with-in IO rate and can be dispatched
 */
static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio,
                            unsigned long *wait)
{
        bool rw = bio_data_dir(bio);
        unsigned long bps_wait = 0, iops_wait = 0, max_wait = 0;
        u64 bps_limit = tg_bps_limit(tg, rw);
        u32 iops_limit = tg_iops_limit(tg, rw);

        /*
          * Currently whole state machine of group depends on first bio
         * queued in the group bio list. So one should not be calling
         * this function with a different bio if there are other bios
         * queued.
         */
        BUG_ON(tg->service_queue.nr_queued[rw] &&
               bio != throtl_peek_queued(&tg->service_queue.queued[rw]));

        /* If tg->bps = -1, then BW is unlimited */
        if ((bps_limit == U64_MAX && iops_limit == UINT_MAX) ||
            tg->flags & THROTL_TG_CANCELING) {
                if (wait)
                        *wait = 0;
                return true;
        }

        /*
         * If previous slice expired, start a new one otherwise renew/extend
         * existing slice to make sure it is at least throtl_slice interval
         * long since now. New slice is started only for empty throttle group.
         * If there is queued bio, that means there should be an active
         * slice and it should be extended instead.
         */
        if (throtl_slice_used(tg, rw) && !(tg->service_queue.nr_queued[rw]))
                throtl_start_new_slice(tg, rw, true);
        else {
                if (time_before(tg->slice_end[rw],
                    jiffies + tg->td->throtl_slice))
                        throtl_extend_slice(tg, rw,
                                jiffies + tg->td->throtl_slice);
        }

        bps_wait = tg_within_bps_limit(tg, bio, bps_limit);
        iops_wait = tg_within_iops_limit(tg, bio, iops_limit);
        if (bps_wait + iops_wait == 0) {
                if (wait)
                        *wait = 0;
                return true;
        }

        max_wait = max(bps_wait, iops_wait);

        if (wait)
                *wait = max_wait;

        if (time_before(tg->slice_end[rw], jiffies + max_wait))
                throtl_extend_slice(tg, rw, jiffies + max_wait);

        return false;
}

static void throtl_charge_bio(struct throtl_grp *tg, struct bio *bio)
{
        bool rw = bio_data_dir(bio);
        unsigned int bio_size = throtl_bio_data_size(bio);

        /* Charge the bio to the group */
        if (!bio_flagged(bio, BIO_BPS_THROTTLED)) {
                tg->bytes_disp[rw] += bio_size;
                tg->last_bytes_disp[rw] += bio_size;
        }

        tg->io_disp[rw]++;
        tg->last_io_disp[rw]++;
}

/**
 * throtl_add_bio_tg - add a bio to the specified throtl_grp
 * @bio: bio to add
 * @qn: qnode to use
 * @tg: the target throtl_grp
 *
 * Add @bio to @tg's service_queue using @qn.  If @qn is not specified,
 * tg->qnode_on_self[] is used.
 */
static void throtl_add_bio_tg(struct bio *bio, struct throtl_qnode *qn,
                              struct throtl_grp *tg)
{
        struct throtl_service_queue *sq = &tg->service_queue;
        bool rw = bio_data_dir(bio);

        if (!qn)
                qn = &tg->qnode_on_self[rw];

        /*
         * If @tg doesn't currently have any bios queued in the same
         * direction, queueing @bio can change when @tg should be
         * dispatched.  Mark that @tg was empty.  This is automatically
         * cleared on the next tg_update_disptime().
         */
        if (!sq->nr_queued[rw])
                tg->flags |= THROTL_TG_WAS_EMPTY;

        throtl_qnode_add_bio(bio, qn, &sq->queued[rw]);

        sq->nr_queued[rw]++;
        throtl_enqueue_tg(tg);
}

static void tg_update_disptime(struct throtl_grp *tg)
{
        struct throtl_service_queue *sq = &tg->service_queue;
        unsigned long read_wait = -1, write_wait = -1, min_wait = -1, disptime;
        struct bio *bio;

        bio = throtl_peek_queued(&sq->queued[READ]);
        if (bio)
                tg_may_dispatch(tg, bio, &read_wait);

        bio = throtl_peek_queued(&sq->queued[WRITE]);
        if (bio)
                tg_may_dispatch(tg, bio, &write_wait);

        min_wait = min(read_wait, write_wait);
        disptime = jiffies + min_wait;

        /* Update dispatch time */
        throtl_rb_erase(&tg->rb_node, tg->service_queue.parent_sq);
        tg->disptime = disptime;
        tg_service_queue_add(tg);

        /* see throtl_add_bio_tg() */
        tg->flags &= ~THROTL_TG_WAS_EMPTY;
}

static void start_parent_slice_with_credit(struct throtl_grp *child_tg,
                                        struct throtl_grp *parent_tg, bool rw)
{
        if (throtl_slice_used(parent_tg, rw)) {
                throtl_start_new_slice_with_credit(parent_tg, rw,
                                child_tg->slice_start[rw]);
        }

}

static void tg_dispatch_one_bio(struct throtl_grp *tg, bool rw)
{
        struct throtl_service_queue *sq = &tg->service_queue;
        struct throtl_service_queue *parent_sq = sq->parent_sq;
        struct throtl_grp *parent_tg = sq_to_tg(parent_sq);
        struct throtl_grp *tg_to_put = NULL;
        struct bio *bio;

        /*
         * @bio is being transferred from @tg to @parent_sq.  Popping a bio
         * from @tg may put its reference and @parent_sq might end up
         * getting released prematurely.  Remember the tg to put and put it
         * after @bio is transferred to @parent_sq.
         */
        bio = throtl_pop_queued(&sq->queued[rw], &tg_to_put);
        sq->nr_queued[rw]--;

        throtl_charge_bio(tg, bio);

        /*
         * If our parent is another tg, we just need to transfer @bio to
         * the parent using throtl_add_bio_tg().  If our parent is
         * @td->service_queue, @bio is ready to be issued.  Put it on its
         * bio_lists[] and decrease total number queued.  The caller is
         * responsible for issuing these bios.
         */
        if (parent_tg) {
                throtl_add_bio_tg(bio, &tg->qnode_on_parent[rw], parent_tg);
                start_parent_slice_with_credit(tg, parent_tg, rw);
        } else {
                bio_set_flag(bio, BIO_BPS_THROTTLED);
                throtl_qnode_add_bio(bio, &tg->qnode_on_parent[rw],
                                     &parent_sq->queued[rw]);
                BUG_ON(tg->td->nr_queued[rw] <= 0);
                tg->td->nr_queued[rw]--;
        }

        throtl_trim_slice(tg, rw);

        if (tg_to_put)
                blkg_put(tg_to_blkg(tg_to_put));
}

static int throtl_dispatch_tg(struct throtl_grp *tg)
{
        struct throtl_service_queue *sq = &tg->service_queue;
        unsigned int nr_reads = 0, nr_writes = 0;
        unsigned int max_nr_reads = THROTL_GRP_QUANTUM * 3 / 4;
        unsigned int max_nr_writes = THROTL_GRP_QUANTUM - max_nr_reads;
        struct bio *bio;

        /* Try to dispatch 75% READS and 25% WRITES */

        while ((bio = throtl_peek_queued(&sq->queued[READ])) &&
               tg_may_dispatch(tg, bio, NULL)) {

                tg_dispatch_one_bio(tg, READ);
                nr_reads++;

                if (nr_reads >= max_nr_reads)
                        break;
        }

        while ((bio = throtl_peek_queued(&sq->queued[WRITE])) &&
               tg_may_dispatch(tg, bio, NULL)) {

                tg_dispatch_one_bio(tg, WRITE);
                nr_writes++;

                if (nr_writes >= max_nr_writes)
                        break;
        }

        return nr_reads + nr_writes;
}

static int throtl_select_dispatch(struct throtl_service_queue *parent_sq)
{
        unsigned int nr_disp = 0;

        while (1) {
                struct throtl_grp *tg;
                struct throtl_service_queue *sq;

                if (!parent_sq->nr_pending)
                        break;

                tg = throtl_rb_first(parent_sq);
                if (!tg)
                        break;

                if (time_before(jiffies, tg->disptime))
                        break;

                nr_disp += throtl_dispatch_tg(tg);

                sq = &tg->service_queue;
                if (sq->nr_queued[READ] || sq->nr_queued[WRITE])
                        tg_update_disptime(tg);
                else
                        throtl_dequeue_tg(tg);

                if (nr_disp >= THROTL_QUANTUM)
                        break;
        }

        return nr_disp;
}

/**
 * throtl_pending_timer_fn - timer function for service_queue->pending_timer
 * @t: the pending_timer member of the throtl_service_queue being serviced
 *
 * This timer is armed when a child throtl_grp with active bio's become
 * pending and queued on the service_queue's pending_tree and expires when
 * the first child throtl_grp should be dispatched.  This function
 * dispatches bio's from the children throtl_grps to the parent
 * service_queue.
 *
 * If the parent's parent is another throtl_grp, dispatching is propagated
 * by either arming its pending_timer or repeating dispatch directly.  If
 * the top-level service_tree is reached, throtl_data->dispatch_work is
 * kicked so that the ready bio's are issued.
 */
static void throtl_pending_timer_fn(struct timer_list *t)
{
        struct throtl_service_queue *sq = from_timer(sq, t, pending_timer);
        struct throtl_grp *tg = sq_to_tg(sq);
        struct throtl_data *td = sq_to_td(sq);
        struct throtl_service_queue *parent_sq;
        struct request_queue *q;
        bool dispatched;
        int ret;

        /* throtl_data may be gone, so figure out request queue by blkg */
        if (tg)
                q = tg->pd.blkg->q;
        else
                q = td->queue;

        spin_lock_irq(&q->queue_lock);

        if (!q->root_blkg)
                goto out_unlock;

again:
        parent_sq = sq->parent_sq;
        dispatched = false;

        while (true) {
                throtl_log(sq, "dispatch nr_queued=%u read=%u write=%u",
                           sq->nr_queued[READ] + sq->nr_queued[WRITE],
                           sq->nr_queued[READ], sq->nr_queued[WRITE]);

                ret = throtl_select_dispatch(sq);
                if (ret) {
                        throtl_log(sq, "bios disp=%u", ret);
                        dispatched = true;
                }

                if (throtl_schedule_next_dispatch(sq, false))
                        break;

                /* this dispatch windows is still open, relax and repeat */
                spin_unlock_irq(&q->queue_lock);
                cpu_relax();
                spin_lock_irq(&q->queue_lock);
        }

        if (!dispatched)
                goto out_unlock;

        if (parent_sq) {
                /* @parent_sq is another throl_grp, propagate dispatch */
                if (tg->flags & THROTL_TG_WAS_EMPTY) {
                        tg_update_disptime(tg);
                        if (!throtl_schedule_next_dispatch(parent_sq, false)) {
                                /* window is already open, repeat dispatching */
                                sq = parent_sq;
                                tg = sq_to_tg(sq);
                                goto again;
                        }
                }
        } else {
                /* reached the top-level, queue issuing */
                queue_work(kthrotld_workqueue, &td->dispatch_work);
        }
out_unlock:
        spin_unlock_irq(&q->queue_lock);
}

/**
 * blk_throtl_dispatch_work_fn - work function for throtl_data->dispatch_work
 * @work: work item being executed
 *
 * This function is queued for execution when bios reach the bio_lists[]
 * of throtl_data->service_queue.  Those bios are ready and issued by this
 * function.
 */
static void blk_throtl_dispatch_work_fn(struct work_struct *work)
{
        struct throtl_data *td = container_of(work, struct throtl_data,
                                              dispatch_work);
        struct throtl_service_queue *td_sq = &td->service_queue;
        struct request_queue *q = td->queue;
        struct bio_list bio_list_on_stack;
        struct bio *bio;
        struct blk_plug plug;
        int rw;

        bio_list_init(&bio_list_on_stack);

        spin_lock_irq(&q->queue_lock);
        for (rw = READ; rw <= WRITE; rw++)
                while ((bio = throtl_pop_queued(&td_sq->queued[rw], NULL)))
                        bio_list_add(&bio_list_on_stack, bio);
        spin_unlock_irq(&q->queue_lock);

        if (!bio_list_empty(&bio_list_on_stack)) {
                blk_start_plug(&plug);
                while ((bio = bio_list_pop(&bio_list_on_stack)))
                        submit_bio_noacct_nocheck(bio);
                blk_finish_plug(&plug);
        }
}

static u64 tg_prfill_conf_u64(struct seq_file *sf, struct blkg_policy_data *pd,
                              int off)
{
        struct throtl_grp *tg = pd_to_tg(pd);
        u64 v = *(u64 *)((void *)tg + off);

        if (v == U64_MAX)
                return 0;
        return __blkg_prfill_u64(sf, pd, v);
}

static u64 tg_prfill_conf_uint(struct seq_file *sf, struct blkg_policy_data *pd,
                               int off)
{
        struct throtl_grp *tg = pd_to_tg(pd);
        unsigned int v = *(unsigned int *)((void *)tg + off);

        if (v == UINT_MAX)
                return 0;
        return __blkg_prfill_u64(sf, pd, v);
}

static int tg_print_conf_u64(struct seq_file *sf, void *v)
{
        blkcg_print_blkgs(sf, css_to_blkcg(seq_css(sf)), tg_prfill_conf_u64,
                          &blkcg_policy_throtl, seq_cft(sf)->private, false);
        return 0;
}

static int tg_print_conf_uint(struct seq_file *sf, void *v)
{
        blkcg_print_blkgs(sf, css_to_blkcg(seq_css(sf)), tg_prfill_conf_uint,
                          &blkcg_policy_throtl, seq_cft(sf)->private, false);
        return 0;
}

static void tg_conf_updated(struct throtl_grp *tg, bool global)
{
        struct throtl_service_queue *sq = &tg->service_queue;
        struct cgroup_subsys_state *pos_css;
        struct blkcg_gq *blkg;

        throtl_log(&tg->service_queue,
                   "limit change rbps=%llu wbps=%llu riops=%u wiops=%u",
                   tg_bps_limit(tg, READ), tg_bps_limit(tg, WRITE),
                   tg_iops_limit(tg, READ), tg_iops_limit(tg, WRITE));

        rcu_read_lock();
        /*
         * Update has_rules[] flags for the updated tg's subtree.  A tg is
         * considered to have rules if either the tg itself or any of its
         * ancestors has rules.  This identifies groups without any
         * restrictions in the whole hierarchy and allows them to bypass
         * blk-throttle.
         */
        blkg_for_each_descendant_pre(blkg, pos_css,
                        global ? tg->td->queue->root_blkg : tg_to_blkg(tg)) {
                struct throtl_grp *this_tg = blkg_to_tg(blkg);

                tg_update_has_rules(this_tg);
                /* ignore root/second level */
                if (!cgroup_subsys_on_dfl(io_cgrp_subsys) || !blkg->parent ||
                    !blkg->parent->parent)
                        continue;
        }
        rcu_read_unlock();

        /*
         * We're already holding queue_lock and know @tg is valid.  Let's
         * apply the new config directly.
         *
         * Restart the slices for both READ and WRITES. It might happen
         * that a group's limit are dropped suddenly and we don't want to
         * account recently dispatched IO with new low rate.
         */
        throtl_start_new_slice(tg, READ, false);
        throtl_start_new_slice(tg, WRITE, false);

        if (tg->flags & THROTL_TG_PENDING) {
                tg_update_disptime(tg);
                throtl_schedule_next_dispatch(sq->parent_sq, true);
        }
}

static int blk_throtl_init(struct gendisk *disk)
{
        struct request_queue *q = disk->queue;
        struct throtl_data *td;
        int ret;

        td = kzalloc_node(sizeof(*td), GFP_KERNEL, q->node);
        if (!td)
                return -ENOMEM;

        INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn);
        throtl_service_queue_init(&td->service_queue);

        /*
         * Freeze queue before activating policy, to synchronize with IO path,
         * which is protected by 'q_usage_counter'.
         */
        blk_mq_freeze_queue(disk->queue);
        blk_mq_quiesce_queue(disk->queue);

        q->td = td;
        td->queue = q;

        /* activate policy */
        ret = blkcg_activate_policy(disk, &blkcg_policy_throtl);
        if (ret) {
                q->td = NULL;
                kfree(td);
                goto out;
        }

        if (blk_queue_nonrot(q))
                td->throtl_slice = DFL_THROTL_SLICE_SSD;
        else
                td->throtl_slice = DFL_THROTL_SLICE_HD;
        td->track_bio_latency = !queue_is_mq(q);
        if (!td->track_bio_latency)
                blk_stat_enable_accounting(q);

out:
        blk_mq_unquiesce_queue(disk->queue);
        blk_mq_unfreeze_queue(disk->queue);

        return ret;
}


static ssize_t tg_set_conf(struct kernfs_open_file *of,
                           char *buf, size_t nbytes, loff_t off, bool is_u64)
{
        struct blkcg *blkcg = css_to_blkcg(of_css(of));
        struct blkg_conf_ctx ctx;
        struct throtl_grp *tg;
        int ret;
        u64 v;

        blkg_conf_init(&ctx, buf);

        ret = blkg_conf_open_bdev(&ctx);
        if (ret)
                goto out_finish;

        if (!blk_throtl_activated(ctx.bdev->bd_queue)) {
                ret = blk_throtl_init(ctx.bdev->bd_disk);
                if (ret)
                        goto out_finish;
        }

        ret = blkg_conf_prep(blkcg, &blkcg_policy_throtl, &ctx);
        if (ret)
                goto out_finish;

        ret = -EINVAL;
        if (sscanf(ctx.body, "%llu", &v) != 1)
                goto out_finish;
        if (!v)
                v = U64_MAX;

        tg = blkg_to_tg(ctx.blkg);
        tg_update_carryover(tg);

        if (is_u64)
                *(u64 *)((void *)tg + of_cft(of)->private) = v;
        else
                *(unsigned int *)((void *)tg + of_cft(of)->private) = v;

        tg_conf_updated(tg, false);
        ret = 0;
out_finish:
        blkg_conf_exit(&ctx);
        return ret ?: nbytes;
}

static ssize_t tg_set_conf_u64(struct kernfs_open_file *of,
                               char *buf, size_t nbytes, loff_t off)
{
        return tg_set_conf(of, buf, nbytes, off, true);
}

static ssize_t tg_set_conf_uint(struct kernfs_open_file *of,
                                char *buf, size_t nbytes, loff_t off)
{
        return tg_set_conf(of, buf, nbytes, off, false);
}

static int tg_print_rwstat(struct seq_file *sf, void *v)
{
        blkcg_print_blkgs(sf, css_to_blkcg(seq_css(sf)),
                          blkg_prfill_rwstat, &blkcg_policy_throtl,
                          seq_cft(sf)->private, true);
        return 0;
}

static u64 tg_prfill_rwstat_recursive(struct seq_file *sf,
                                      struct blkg_policy_data *pd, int off)
{
        struct blkg_rwstat_sample sum;

        blkg_rwstat_recursive_sum(pd_to_blkg(pd), &blkcg_policy_throtl, off,
                                  &sum);
        return __blkg_prfill_rwstat(sf, pd, &sum);
}

static int tg_print_rwstat_recursive(struct seq_file *sf, void *v)
{
        blkcg_print_blkgs(sf, css_to_blkcg(seq_css(sf)),
                          tg_prfill_rwstat_recursive, &blkcg_policy_throtl,
                          seq_cft(sf)->private, true);
        return 0;
}

static struct cftype throtl_legacy_files[] = {
        {
                .name = "throttle.read_bps_device",
                .private = offsetof(struct throtl_grp, bps[READ]),
                .seq_show = tg_print_conf_u64,
                .write = tg_set_conf_u64,
        },
        {
                .name = "throttle.write_bps_device",
                .private = offsetof(struct throtl_grp, bps[WRITE]),
                .seq_show = tg_print_conf_u64,
                .write = tg_set_conf_u64,
        },
        {
                .name = "throttle.read_iops_device",
                .private = offsetof(struct throtl_grp, iops[READ]),
                .seq_show = tg_print_conf_uint,
                .write = tg_set_conf_uint,
        },
        {
                .name = "throttle.write_iops_device",
                .private = offsetof(struct throtl_grp, iops[WRITE]),
                .seq_show = tg_print_conf_uint,
                .write = tg_set_conf_uint,
        },
        {
                .name = "throttle.io_service_bytes",
                .private = offsetof(struct throtl_grp, stat_bytes),
                .seq_show = tg_print_rwstat,
        },
        {
                .name = "throttle.io_service_bytes_recursive",
                .private = offsetof(struct throtl_grp, stat_bytes),
                .seq_show = tg_print_rwstat_recursive,
        },
        {
                .name = "throttle.io_serviced",
                .private = offsetof(struct throtl_grp, stat_ios),
                .seq_show = tg_print_rwstat,
        },
        {
                .name = "throttle.io_serviced_recursive",
                .private = offsetof(struct throtl_grp, stat_ios),
                .seq_show = tg_print_rwstat_recursive,
        },
        { }        /* terminate */
};

static u64 tg_prfill_limit(struct seq_file *sf, struct blkg_policy_data *pd,
                         int off)
{
        struct throtl_grp *tg = pd_to_tg(pd);
        const char *dname = blkg_dev_name(pd->blkg);
        u64 bps_dft;
        unsigned int iops_dft;

        if (!dname)
                return 0;

        bps_dft = U64_MAX;
        iops_dft = UINT_MAX;

        if (tg->bps[READ] == bps_dft &&
            tg->bps[WRITE] == bps_dft &&
            tg->iops[READ] == iops_dft &&
            tg->iops[WRITE] == iops_dft)
                return 0;

        seq_printf(sf, "%s", dname);
        if (tg->bps[READ] == U64_MAX)
                seq_printf(sf, " rbps=max");
        else
                seq_printf(sf, " rbps=%llu", tg->bps[READ]);

        if (tg->bps[WRITE] == U64_MAX)
                seq_printf(sf, " wbps=max");
        else
                seq_printf(sf, " wbps=%llu", tg->bps[WRITE]);

        if (tg->iops[READ] == UINT_MAX)
                seq_printf(sf, " riops=max");
        else
                seq_printf(sf, " riops=%u", tg->iops[READ]);

        if (tg->iops[WRITE] == UINT_MAX)
                seq_printf(sf, " wiops=max");
        else
                seq_printf(sf, " wiops=%u", tg->iops[WRITE]);

        seq_printf(sf, "\n");
        return 0;
}

static int tg_print_limit(struct seq_file *sf, void *v)
{
        blkcg_print_blkgs(sf, css_to_blkcg(seq_css(sf)), tg_prfill_limit,
                          &blkcg_policy_throtl, seq_cft(sf)->private, false);
        return 0;
}

static ssize_t tg_set_limit(struct kernfs_open_file *of,
                          char *buf, size_t nbytes, loff_t off)
{
        struct blkcg *blkcg = css_to_blkcg(of_css(of));
        struct blkg_conf_ctx ctx;
        struct throtl_grp *tg;
        u64 v[4];
        int ret;

        blkg_conf_init(&ctx, buf);

        ret = blkg_conf_open_bdev(&ctx);
        if (ret)
                goto out_finish;

        if (!blk_throtl_activated(ctx.bdev->bd_queue)) {
                ret = blk_throtl_init(ctx.bdev->bd_disk);
                if (ret)
                        goto out_finish;
        }

        ret = blkg_conf_prep(blkcg, &blkcg_policy_throtl, &ctx);
        if (ret)
                goto out_finish;

        tg = blkg_to_tg(ctx.blkg);
        tg_update_carryover(tg);

        v[0] = tg->bps[READ];
        v[1] = tg->bps[WRITE];
        v[2] = tg->iops[READ];
        v[3] = tg->iops[WRITE];

        while (true) {
                char tok[27];        /* wiops=18446744073709551616 */
                char *p;
                u64 val = U64_MAX;
                int len;

                if (sscanf(ctx.body, "%26s%n", tok, &len) != 1)
                        break;
                if (tok[0] == '\0')
                        break;
                ctx.body += len;

                ret = -EINVAL;
                p = tok;
                strsep(&p, "=");
                if (!p || (sscanf(p, "%llu", &val) != 1 && strcmp(p, "max")))
                        goto out_finish;

                ret = -ERANGE;
                if (!val)
                        goto out_finish;

                ret = -EINVAL;
                if (!strcmp(tok, "rbps") && val > 1)
                        v[0] = val;
                else if (!strcmp(tok, "wbps") && val > 1)
                        v[1] = val;
                else if (!strcmp(tok, "riops") && val > 1)
                        v[2] = min_t(u64, val, UINT_MAX);
                else if (!strcmp(tok, "wiops") && val > 1)
                        v[3] = min_t(u64, val, UINT_MAX);
                else
                        goto out_finish;
        }

        tg->bps[READ] = v[0];
        tg->bps[WRITE] = v[1];
        tg->iops[READ] = v[2];
        tg->iops[WRITE] = v[3];

        tg_conf_updated(tg, false);
        ret = 0;
out_finish:
        blkg_conf_exit(&ctx);
        return ret ?: nbytes;
}

static struct cftype throtl_files[] = {
        {
                .name = "max",
                .flags = CFTYPE_NOT_ON_ROOT,
                .seq_show = tg_print_limit,
                .write = tg_set_limit,
        },
        { }        /* terminate */
};

static void throtl_shutdown_wq(struct request_queue *q)
{
        struct throtl_data *td = q->td;

        cancel_work_sync(&td->dispatch_work);
}

struct blkcg_policy blkcg_policy_throtl = {
        .dfl_cftypes                = throtl_files,
        .legacy_cftypes                = throtl_legacy_files,

        .pd_alloc_fn                = throtl_pd_alloc,
        .pd_init_fn                = throtl_pd_init,
        .pd_online_fn                = throtl_pd_online,
        .pd_free_fn                = throtl_pd_free,
};

void blk_throtl_cancel_bios(struct gendisk *disk)
{
        struct request_queue *q = disk->queue;
        struct cgroup_subsys_state *pos_css;
        struct blkcg_gq *blkg;

        if (!blk_throtl_activated(q))
                return;

        spin_lock_irq(&q->queue_lock);
        /*
         * queue_lock is held, rcu lock is not needed here technically.
         * However, rcu lock is still held to emphasize that following
         * path need RCU protection and to prevent warning from lockdep.
         */
        rcu_read_lock();
        blkg_for_each_descendant_post(blkg, pos_css, q->root_blkg) {
                struct throtl_grp *tg = blkg_to_tg(blkg);
                struct throtl_service_queue *sq = &tg->service_queue;

                /*
                 * Set the flag to make sure throtl_pending_timer_fn() won't
                 * stop until all throttled bios are dispatched.
                 */
                tg->flags |= THROTL_TG_CANCELING;

                /*
                 * Do not dispatch cgroup without THROTL_TG_PENDING or cgroup
                 * will be inserted to service queue without THROTL_TG_PENDING
                 * set in tg_update_disptime below. Then IO dispatched from
                 * child in tg_dispatch_one_bio will trigger double insertion
                 * and corrupt the tree.
                 */
                if (!(tg->flags & THROTL_TG_PENDING))
                        continue;

                /*
                 * Update disptime after setting the above flag to make sure
                 * throtl_select_dispatch() won't exit without dispatching.
                 */
                tg_update_disptime(tg);

                throtl_schedule_pending_timer(sq, jiffies + 1);
        }
        rcu_read_unlock();
        spin_unlock_irq(&q->queue_lock);
}

static bool tg_within_limit(struct throtl_grp *tg, struct bio *bio, bool rw)
{
        /* throtl is FIFO - if bios are already queued, should queue */
        if (tg->service_queue.nr_queued[rw])
                return false;

        return tg_may_dispatch(tg, bio, NULL);
}

static void tg_dispatch_in_debt(struct throtl_grp *tg, struct bio *bio, bool rw)
{
        if (!bio_flagged(bio, BIO_BPS_THROTTLED))
                tg->carryover_bytes[rw] -= throtl_bio_data_size(bio);
        tg->carryover_ios[rw]--;
}

bool __blk_throtl_bio(struct bio *bio)
{
        struct request_queue *q = bdev_get_queue(bio->bi_bdev);
        struct blkcg_gq *blkg = bio->bi_blkg;
        struct throtl_qnode *qn = NULL;
        struct throtl_grp *tg = blkg_to_tg(blkg);
        struct throtl_service_queue *sq;
        bool rw = bio_data_dir(bio);
        bool throttled = false;
        struct throtl_data *td = tg->td;

        rcu_read_lock();
        spin_lock_irq(&q->queue_lock);
        sq = &tg->service_queue;

        while (true) {
                if (tg_within_limit(tg, bio, rw)) {
                        /* within limits, let's charge and dispatch directly */
                        throtl_charge_bio(tg, bio);

                        /*
                         * We need to trim slice even when bios are not being
                         * queued otherwise it might happen that a bio is not
                         * queued for a long time and slice keeps on extending
                         * and trim is not called for a long time. Now if limits
                         * are reduced suddenly we take into account all the IO
                         * dispatched so far at new low rate and * newly queued
                         * IO gets a really long dispatch time.
                         *
                         * So keep on trimming slice even if bio is not queued.
                         */
                        throtl_trim_slice(tg, rw);
                } else if (bio_issue_as_root_blkg(bio)) {
                        /*
                         * IOs which may cause priority inversions are
                         * dispatched directly, even if they're over limit.
                         * Debts are handled by carryover_bytes/ios while
                         * calculating wait time.
                         */
                        tg_dispatch_in_debt(tg, bio, rw);
                } else {
                        /* if above limits, break to queue */
                        break;
                }

                /*
                 * @bio passed through this layer without being throttled.
                 * Climb up the ladder.  If we're already at the top, it
                 * can be executed directly.
                 */
                qn = &tg->qnode_on_parent[rw];
                sq = sq->parent_sq;
                tg = sq_to_tg(sq);
                if (!tg) {
                        bio_set_flag(bio, BIO_BPS_THROTTLED);
                        goto out_unlock;
                }
        }

        /* out-of-limit, queue to @tg */
        throtl_log(sq, "[%c] bio. bdisp=%llu sz=%u bps=%llu iodisp=%u iops=%u queued=%d/%d",
                   rw == READ ? 'R' : 'W',
                   tg->bytes_disp[rw], bio->bi_iter.bi_size,
                   tg_bps_limit(tg, rw),
                   tg->io_disp[rw], tg_iops_limit(tg, rw),
                   sq->nr_queued[READ], sq->nr_queued[WRITE]);

        td->nr_queued[rw]++;
        throtl_add_bio_tg(bio, qn, tg);
        throttled = true;

        /*
         * Update @tg's dispatch time and force schedule dispatch if @tg
         * was empty before @bio.  The forced scheduling isn't likely to
         * cause undue delay as @bio is likely to be dispatched directly if
         * its @tg's disptime is not in the future.
         */
        if (tg->flags & THROTL_TG_WAS_EMPTY) {
                tg_update_disptime(tg);
                throtl_schedule_next_dispatch(tg->service_queue.parent_sq, true);
        }

out_unlock:
        spin_unlock_irq(&q->queue_lock);

        rcu_read_unlock();
        return throttled;
}

void blk_throtl_exit(struct gendisk *disk)
{
        struct request_queue *q = disk->queue;

        if (!blk_throtl_activated(q))
                return;

        del_timer_sync(&q->td->service_queue.pending_timer);
        throtl_shutdown_wq(q);
        blkcg_deactivate_policy(disk, &blkcg_policy_throtl);
        kfree(q->td);
}

static int __init throtl_init(void)
{
        kthrotld_workqueue = alloc_workqueue("kthrotld", WQ_MEM_RECLAIM, 0);
        if (!kthrotld_workqueue)
                panic("Failed to create kthrotld\n");

        return blkcg_policy_register(&blkcg_policy_throtl);
}

module_init(throtl_init);




















   34 






















   56 

  100 

   10 


   25 



   25 


























   37 



    7 








   13 




   13 




   30 



   20 
    2 
   19 














   33 











   32 
   10 















  126 





   59 

    5 



  124 


   28 

  115 






   32 

  123 
   25 















   38 



   33 


   33 













    8 














   30 

   30 




   29 



   22 

    4 
   10 






   30 

    4 










   49 
   35 
   46 







   30 




   28 

   19 



   12 

   17 






   23 














   64 


   17 
    1 



   33 





   30 
   21 

    9 

    2 



   30 



   14 




   62 


   10 



   48 









   43 

   36 








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
// SPDX-License-Identifier: GPL-2.0
/* Generic part */

typedef struct {
        block_t        *p;
        block_t        key;
        struct buffer_head *bh;
} Indirect;

static DEFINE_RWLOCK(pointers_lock);

static inline void add_chain(Indirect *p, struct buffer_head *bh, block_t *v)
{
        p->key = *(p->p = v);
        p->bh = bh;
}

static inline int verify_chain(Indirect *from, Indirect *to)
{
        while (from <= to && from->key == *from->p)
                from++;
        return (from > to);
}

static inline block_t *block_end(struct buffer_head *bh)
{
        return (block_t *)((char*)bh->b_data + bh->b_size);
}

static inline Indirect *get_branch(struct inode *inode,
                                        int depth,
                                        int *offsets,
                                        Indirect chain[DEPTH],
                                        int *err)
{
        struct super_block *sb = inode->i_sb;
        Indirect *p = chain;
        struct buffer_head *bh;

        *err = 0;
        /* i_data is not going away, no lock needed */
        add_chain (chain, NULL, i_data(inode) + *offsets);
        if (!p->key)
                goto no_block;
        while (--depth) {
                bh = sb_bread(sb, block_to_cpu(p->key));
                if (!bh)
                        goto failure;
                read_lock(&pointers_lock);
                if (!verify_chain(chain, p))
                        goto changed;
                add_chain(++p, bh, (block_t *)bh->b_data + *++offsets);
                read_unlock(&pointers_lock);
                if (!p->key)
                        goto no_block;
        }
        return NULL;

changed:
        read_unlock(&pointers_lock);
        brelse(bh);
        *err = -EAGAIN;
        goto no_block;
failure:
        *err = -EIO;
no_block:
        return p;
}

static int alloc_branch(struct inode *inode,
                             int num,
                             int *offsets,
                             Indirect *branch)
{
        int n = 0;
        int i;
        int parent = minix_new_block(inode);
        int err = -ENOSPC;

        branch[0].key = cpu_to_block(parent);
        if (parent) for (n = 1; n < num; n++) {
                struct buffer_head *bh;
                /* Allocate the next block */
                int nr = minix_new_block(inode);
                if (!nr)
                        break;
                branch[n].key = cpu_to_block(nr);
                bh = sb_getblk(inode->i_sb, parent);
                if (!bh) {
                        minix_free_block(inode, nr);
                        err = -ENOMEM;
                        break;
                }
                lock_buffer(bh);
                memset(bh->b_data, 0, bh->b_size);
                branch[n].bh = bh;
                branch[n].p = (block_t*) bh->b_data + offsets[n];
                *branch[n].p = branch[n].key;
                set_buffer_uptodate(bh);
                unlock_buffer(bh);
                mark_buffer_dirty_inode(bh, inode);
                parent = nr;
        }
        if (n == num)
                return 0;

        /* Allocation failed, free what we already allocated */
        for (i = 1; i < n; i++)
                bforget(branch[i].bh);
        for (i = 0; i < n; i++)
                minix_free_block(inode, block_to_cpu(branch[i].key));
        return err;
}

static inline int splice_branch(struct inode *inode,
                                     Indirect chain[DEPTH],
                                     Indirect *where,
                                     int num)
{
        int i;

        write_lock(&pointers_lock);

        /* Verify that place we are splicing to is still there and vacant */
        if (!verify_chain(chain, where-1) || *where->p)
                goto changed;

        *where->p = where->key;

        write_unlock(&pointers_lock);

        /* We are done with atomic stuff, now do the rest of housekeeping */

        inode_set_ctime_current(inode);

        /* had we spliced it onto indirect block? */
        if (where->bh)
                mark_buffer_dirty_inode(where->bh, inode);

        mark_inode_dirty(inode);
        return 0;

changed:
        write_unlock(&pointers_lock);
        for (i = 1; i < num; i++)
                bforget(where[i].bh);
        for (i = 0; i < num; i++)
                minix_free_block(inode, block_to_cpu(where[i].key));
        return -EAGAIN;
}

static int get_block(struct inode * inode, sector_t block,
                        struct buffer_head *bh, int create)
{
        int err = -EIO;
        int offsets[DEPTH];
        Indirect chain[DEPTH];
        Indirect *partial;
        int left;
        int depth = block_to_path(inode, block, offsets);

        if (depth == 0)
                goto out;

reread:
        partial = get_branch(inode, depth, offsets, chain, &err);

        /* Simplest case - block found, no allocation needed */
        if (!partial) {
got_it:
                map_bh(bh, inode->i_sb, block_to_cpu(chain[depth-1].key));
                /* Clean up and exit */
                partial = chain+depth-1; /* the whole chain */
                goto cleanup;
        }

        /* Next simple case - plain lookup or failed read of indirect block */
        if (!create || err == -EIO) {
cleanup:
                while (partial > chain) {
                        brelse(partial->bh);
                        partial--;
                }
out:
                return err;
        }

        /*
         * Indirect block might be removed by truncate while we were
         * reading it. Handling of that case (forget what we've got and
         * reread) is taken out of the main path.
         */
        if (err == -EAGAIN)
                goto changed;

        left = (chain + depth) - partial;
        err = alloc_branch(inode, left, offsets+(partial-chain), partial);
        if (err)
                goto cleanup;

        if (splice_branch(inode, chain, partial, left) < 0)
                goto changed;

        set_buffer_new(bh);
        goto got_it;

changed:
        while (partial > chain) {
                brelse(partial->bh);
                partial--;
        }
        goto reread;
}

static inline int all_zeroes(block_t *p, block_t *q)
{
        while (p < q)
                if (*p++)
                        return 0;
        return 1;
}

static Indirect *find_shared(struct inode *inode,
                                int depth,
                                int offsets[DEPTH],
                                Indirect chain[DEPTH],
                                block_t *top)
{
        Indirect *partial, *p;
        int k, err;

        *top = 0;
        for (k = depth; k > 1 && !offsets[k-1]; k--)
                ;
        partial = get_branch(inode, k, offsets, chain, &err);

        write_lock(&pointers_lock);
        if (!partial)
                partial = chain + k-1;
        if (!partial->key && *partial->p) {
                write_unlock(&pointers_lock);
                goto no_top;
        }
        for (p=partial;p>chain && all_zeroes((block_t*)p->bh->b_data,p->p);p--)
                ;
        if (p == chain + k - 1 && p > chain) {
                p->p--;
        } else {
                *top = *p->p;
                *p->p = 0;
        }
        write_unlock(&pointers_lock);

        while(partial > p)
        {
                brelse(partial->bh);
                partial--;
        }
no_top:
        return partial;
}

static inline void free_data(struct inode *inode, block_t *p, block_t *q)
{
        unsigned long nr;

        for ( ; p < q ; p++) {
                nr = block_to_cpu(*p);
                if (nr) {
                        *p = 0;
                        minix_free_block(inode, nr);
                }
        }
}

static void free_branches(struct inode *inode, block_t *p, block_t *q, int depth)
{
        struct buffer_head * bh;
        unsigned long nr;

        if (depth--) {
                for ( ; p < q ; p++) {
                        nr = block_to_cpu(*p);
                        if (!nr)
                                continue;
                        *p = 0;
                        bh = sb_bread(inode->i_sb, nr);
                        if (!bh)
                                continue;
                        free_branches(inode, (block_t*)bh->b_data,
                                      block_end(bh), depth);
                        bforget(bh);
                        minix_free_block(inode, nr);
                        mark_inode_dirty(inode);
                }
        } else
                free_data(inode, p, q);
}

static inline void truncate (struct inode * inode)
{
        struct super_block *sb = inode->i_sb;
        block_t *idata = i_data(inode);
        int offsets[DEPTH];
        Indirect chain[DEPTH];
        Indirect *partial;
        block_t nr = 0;
        int n;
        int first_whole;
        long iblock;

        iblock = (inode->i_size + sb->s_blocksize -1) >> sb->s_blocksize_bits;
        block_truncate_page(inode->i_mapping, inode->i_size, get_block);

        n = block_to_path(inode, iblock, offsets);
        if (!n)
                return;

        if (n == 1) {
                free_data(inode, idata+offsets[0], idata + DIRECT);
                first_whole = 0;
                goto do_indirects;
        }

        first_whole = offsets[0] + 1 - DIRECT;
        partial = find_shared(inode, n, offsets, chain, &nr);
        if (nr) {
                if (partial == chain)
                        mark_inode_dirty(inode);
                else
                        mark_buffer_dirty_inode(partial->bh, inode);
                free_branches(inode, &nr, &nr+1, (chain+n-1) - partial);
        }
        /* Clear the ends of indirect blocks on the shared branch */
        while (partial > chain) {
                free_branches(inode, partial->p + 1, block_end(partial->bh),
                                (chain+n-1) - partial);
                mark_buffer_dirty_inode(partial->bh, inode);
                brelse (partial->bh);
                partial--;
        }
do_indirects:
        /* Kill the remaining (whole) subtrees */
        while (first_whole < DEPTH-1) {
                nr = idata[DIRECT+first_whole];
                if (nr) {
                        idata[DIRECT+first_whole] = 0;
                        mark_inode_dirty(inode);
                        free_branches(inode, &nr, &nr+1, first_whole+1);
                }
                first_whole++;
        }
        inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
        mark_inode_dirty(inode);
}

static inline unsigned nblocks(loff_t size, struct super_block *sb)
{
        int k = sb->s_blocksize_bits - 10;
        unsigned blocks, res, direct = DIRECT, i = DEPTH;
        blocks = (size + sb->s_blocksize - 1) >> (BLOCK_SIZE_BITS + k);
        res = blocks;
        while (--i && blocks > direct) {
                blocks -= direct;
                blocks += sb->s_blocksize/sizeof(block_t) - 1;
                blocks /= sb->s_blocksize/sizeof(block_t);
                res += blocks;
                direct = 1;
        }
        return res;
}




















  197 


    6 








    2 









  194 






    1 




  193 

    1 











  198 

  196 





  140 














   54 








  165 
    3 


   10 






  159 

    3 

    9 











  166 




   10 


  166 
  166 

  160 



   15 
    4 



   15 

    4 
    4 




  166 


  166 









   12 




   12 







    4 

    2 


    1 








  165 
  166 





  159 

    3 



  165 





  121 


    3 



  165 


    1 






   11 






    1 
    4 






  199 


















   74 



  165 

    7 
    7 








    3 

  164 

  198 
    7 




  190 

  189 





   49 
  160 
    9 



    9 



    2 




  160 






  200 

  200 
  200 











   29 







  134 


   25 










    1 






  130 


   25 















  134 


  134 



   42 
  121 


  121 



  134 




  134 



  134 



  134 



   45 




  106 
   25 




  134 



   46 


  107 
   25 





  105 




    8 


    5 


  103 







   30 

   30 










   30 


   30 


    2 











    8 


   25 






  160 







   82 







   22 
  157 




  198 







   66 







   54 
  197 


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
// SPDX-License-Identifier: GPL-2.0-only
/*
 * directory.c
 *
 * PURPOSE
 *        Directory related functions
 *
 */

#include "udfdecl.h"
#include "udf_i.h"

#include <linux/fs.h>
#include <linux/string.h>
#include <linux/bio.h>
#include <linux/crc-itu-t.h>
#include <linux/iversion.h>

static int udf_verify_fi(struct udf_fileident_iter *iter)
{
        unsigned int len;

        if (iter->fi.descTag.tagIdent != cpu_to_le16(TAG_IDENT_FID)) {
                udf_err(iter->dir->i_sb,
                        "directory (ino %lu) has entry at pos %llu with incorrect tag %x\n",
                        iter->dir->i_ino, (unsigned long long)iter->pos,
                        le16_to_cpu(iter->fi.descTag.tagIdent));
                return -EFSCORRUPTED;
        }
        len = udf_dir_entry_len(&iter->fi);
        if (le16_to_cpu(iter->fi.lengthOfImpUse) & 3) {
                udf_err(iter->dir->i_sb,
                        "directory (ino %lu) has entry at pos %llu with unaligned length of impUse field\n",
                        iter->dir->i_ino, (unsigned long long)iter->pos);
                return -EFSCORRUPTED;
        }
        /*
         * This is in fact allowed by the spec due to long impUse field but
         * we don't support it. If there is real media with this large impUse
         * field, support can be added.
         */
        if (len > 1 << iter->dir->i_blkbits) {
                udf_err(iter->dir->i_sb,
                        "directory (ino %lu) has too big (%u) entry at pos %llu\n",
                        iter->dir->i_ino, len, (unsigned long long)iter->pos);
                return -EFSCORRUPTED;
        }
        if (iter->pos + len > iter->dir->i_size) {
                udf_err(iter->dir->i_sb,
                        "directory (ino %lu) has entry past directory size at pos %llu\n",
                        iter->dir->i_ino, (unsigned long long)iter->pos);
                return -EFSCORRUPTED;
        }
        if (udf_dir_entry_len(&iter->fi) !=
            sizeof(struct tag) + le16_to_cpu(iter->fi.descTag.descCRCLength)) {
                udf_err(iter->dir->i_sb,
                        "directory (ino %lu) has entry where CRC length (%u) does not match entry length (%u)\n",
                        iter->dir->i_ino,
                        (unsigned)le16_to_cpu(iter->fi.descTag.descCRCLength),
                        (unsigned)(udf_dir_entry_len(&iter->fi) -
                                                        sizeof(struct tag)));
                return -EFSCORRUPTED;
        }
        return 0;
}

static int udf_copy_fi(struct udf_fileident_iter *iter)
{
        struct udf_inode_info *iinfo = UDF_I(iter->dir);
        u32 blksize = 1 << iter->dir->i_blkbits;
        u32 off, len, nameoff;
        int err;

        /* Skip copying when we are at EOF */
        if (iter->pos >= iter->dir->i_size) {
                iter->name = NULL;
                return 0;
        }
        if (iter->dir->i_size < iter->pos + sizeof(struct fileIdentDesc)) {
                udf_err(iter->dir->i_sb,
                        "directory (ino %lu) has entry straddling EOF\n",
                        iter->dir->i_ino);
                return -EFSCORRUPTED;
        }
        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                memcpy(&iter->fi, iinfo->i_data + iinfo->i_lenEAttr + iter->pos,
                       sizeof(struct fileIdentDesc));
                err = udf_verify_fi(iter);
                if (err < 0)
                        return err;
                iter->name = iinfo->i_data + iinfo->i_lenEAttr + iter->pos +
                        sizeof(struct fileIdentDesc) +
                        le16_to_cpu(iter->fi.lengthOfImpUse);
                return 0;
        }

        off = iter->pos & (blksize - 1);
        len = min_t(u32, sizeof(struct fileIdentDesc), blksize - off);
        memcpy(&iter->fi, iter->bh[0]->b_data + off, len);
        if (len < sizeof(struct fileIdentDesc))
                memcpy((char *)(&iter->fi) + len, iter->bh[1]->b_data,
                       sizeof(struct fileIdentDesc) - len);
        err = udf_verify_fi(iter);
        if (err < 0)
                return err;

        /* Handle directory entry name */
        nameoff = off + sizeof(struct fileIdentDesc) +
                                le16_to_cpu(iter->fi.lengthOfImpUse);
        if (off + udf_dir_entry_len(&iter->fi) <= blksize) {
                iter->name = iter->bh[0]->b_data + nameoff;
        } else if (nameoff >= blksize) {
                iter->name = iter->bh[1]->b_data + (nameoff - blksize);
        } else {
                iter->name = iter->namebuf;
                len = blksize - nameoff;
                memcpy(iter->name, iter->bh[0]->b_data + nameoff, len);
                memcpy(iter->name + len, iter->bh[1]->b_data,
                       iter->fi.lengthFileIdent - len);
        }
        return 0;
}

/* Readahead 8k once we are at 8k boundary */
static void udf_readahead_dir(struct udf_fileident_iter *iter)
{
        unsigned int ralen = 16 >> (iter->dir->i_blkbits - 9);
        struct buffer_head *tmp, *bha[16];
        int i, num;
        udf_pblk_t blk;

        if (iter->loffset & (ralen - 1))
                return;

        if (iter->loffset + ralen > (iter->elen >> iter->dir->i_blkbits))
                ralen = (iter->elen >> iter->dir->i_blkbits) - iter->loffset;
        num = 0;
        for (i = 0; i < ralen; i++) {
                blk = udf_get_lb_pblock(iter->dir->i_sb, &iter->eloc,
                                        iter->loffset + i);
                tmp = sb_getblk(iter->dir->i_sb, blk);
                if (tmp && !buffer_uptodate(tmp) && !buffer_locked(tmp))
                        bha[num++] = tmp;
                else
                        brelse(tmp);
        }
        if (num) {
                bh_readahead_batch(num, bha, REQ_RAHEAD);
                for (i = 0; i < num; i++)
                        brelse(bha[i]);
        }
}

static struct buffer_head *udf_fiiter_bread_blk(struct udf_fileident_iter *iter)
{
        udf_pblk_t blk;

        udf_readahead_dir(iter);
        blk = udf_get_lb_pblock(iter->dir->i_sb, &iter->eloc, iter->loffset);
        return sb_bread(iter->dir->i_sb, blk);
}

/*
 * Updates loffset to point to next directory block; eloc, elen & epos are
 * updated if we need to traverse to the next extent as well.
 */
static int udf_fiiter_advance_blk(struct udf_fileident_iter *iter)
{
        int8_t etype = -1;
        int err = 0;

        iter->loffset++;
        if (iter->loffset < DIV_ROUND_UP(iter->elen, 1<<iter->dir->i_blkbits))
                return 0;

        iter->loffset = 0;
        err = udf_next_aext(iter->dir, &iter->epos, &iter->eloc,
                            &iter->elen, &etype, 1);
        if (err < 0)
                return err;
        else if (err == 0 || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
                if (iter->pos == iter->dir->i_size) {
                        iter->elen = 0;
                        return 0;
                }
                udf_err(iter->dir->i_sb,
                        "extent after position %llu not allocated in directory (ino %lu)\n",
                        (unsigned long long)iter->pos, iter->dir->i_ino);
                return -EFSCORRUPTED;
        }
        return 0;
}

static int udf_fiiter_load_bhs(struct udf_fileident_iter *iter)
{
        int blksize = 1 << iter->dir->i_blkbits;
        int off = iter->pos & (blksize - 1);
        int err;
        struct fileIdentDesc *fi;

        /* Is there any further extent we can map from? */
        if (!iter->bh[0] && iter->elen) {
                iter->bh[0] = udf_fiiter_bread_blk(iter);
                if (!iter->bh[0]) {
                        err = -ENOMEM;
                        goto out_brelse;
                }
                if (!buffer_uptodate(iter->bh[0])) {
                        err = -EIO;
                        goto out_brelse;
                }
        }
        /* There's no next block so we are done */
        if (iter->pos >= iter->dir->i_size)
                return 0;
        /* Need to fetch next block as well? */
        if (off + sizeof(struct fileIdentDesc) > blksize)
                goto fetch_next;
        fi = (struct fileIdentDesc *)(iter->bh[0]->b_data + off);
        /* Need to fetch next block to get name? */
        if (off + udf_dir_entry_len(fi) > blksize) {
fetch_next:
                err = udf_fiiter_advance_blk(iter);
                if (err)
                        goto out_brelse;
                iter->bh[1] = udf_fiiter_bread_blk(iter);
                if (!iter->bh[1]) {
                        err = -ENOMEM;
                        goto out_brelse;
                }
                if (!buffer_uptodate(iter->bh[1])) {
                        err = -EIO;
                        goto out_brelse;
                }
        }
        return 0;
out_brelse:
        brelse(iter->bh[0]);
        brelse(iter->bh[1]);
        iter->bh[0] = iter->bh[1] = NULL;
        return err;
}

int udf_fiiter_init(struct udf_fileident_iter *iter, struct inode *dir,
                    loff_t pos)
{
        struct udf_inode_info *iinfo = UDF_I(dir);
        int err = 0;
        int8_t etype;

        iter->dir = dir;
        iter->bh[0] = iter->bh[1] = NULL;
        iter->pos = pos;
        iter->elen = 0;
        iter->epos.bh = NULL;
        iter->name = NULL;
        /*
         * When directory is verified, we don't expect directory iteration to
         * fail and it can be difficult to undo without corrupting filesystem.
         * So just do not allow memory allocation failures here.
         */
        iter->namebuf = kmalloc(UDF_NAME_LEN_CS0, GFP_KERNEL | __GFP_NOFAIL);

        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                err = udf_copy_fi(iter);
                goto out;
        }

        err = inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos,
                         &iter->eloc, &iter->elen, &iter->loffset, &etype);
        if (err <= 0 || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
                if (pos == dir->i_size)
                        return 0;
                udf_err(dir->i_sb,
                        "position %llu not allocated in directory (ino %lu)\n",
                        (unsigned long long)pos, dir->i_ino);
                err = -EFSCORRUPTED;
                goto out;
        }
        err = udf_fiiter_load_bhs(iter);
        if (err < 0)
                goto out;
        err = udf_copy_fi(iter);
out:
        if (err < 0)
                udf_fiiter_release(iter);
        return err;
}

int udf_fiiter_advance(struct udf_fileident_iter *iter)
{
        unsigned int oldoff, len;
        int blksize = 1 << iter->dir->i_blkbits;
        int err;

        oldoff = iter->pos & (blksize - 1);
        len = udf_dir_entry_len(&iter->fi);
        iter->pos += len;
        if (UDF_I(iter->dir)->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
                if (oldoff + len >= blksize) {
                        brelse(iter->bh[0]);
                        iter->bh[0] = NULL;
                        /* Next block already loaded? */
                        if (iter->bh[1]) {
                                iter->bh[0] = iter->bh[1];
                                iter->bh[1] = NULL;
                        } else {
                                err = udf_fiiter_advance_blk(iter);
                                if (err < 0)
                                        return err;
                        }
                }
                err = udf_fiiter_load_bhs(iter);
                if (err < 0)
                        return err;
        }
        return udf_copy_fi(iter);
}

void udf_fiiter_release(struct udf_fileident_iter *iter)
{
        iter->dir = NULL;
        brelse(iter->bh[0]);
        brelse(iter->bh[1]);
        iter->bh[0] = iter->bh[1] = NULL;
        kfree(iter->namebuf);
        iter->namebuf = NULL;
}

static void udf_copy_to_bufs(void *buf1, int len1, void *buf2, int len2,
                             int off, void *src, int len)
{
        int copy;

        if (off >= len1) {
                off -= len1;
        } else {
                copy = min(off + len, len1) - off;
                memcpy(buf1 + off, src, copy);
                src += copy;
                len -= copy;
                off = 0;
        }
        if (len > 0) {
                if (WARN_ON_ONCE(off + len > len2 || !buf2))
                        return;
                memcpy(buf2 + off, src, len);
        }
}

static uint16_t udf_crc_fi_bufs(void *buf1, int len1, void *buf2, int len2,
                                int off, int len)
{
        int copy;
        uint16_t crc = 0;

        if (off >= len1) {
                off -= len1;
        } else {
                copy = min(off + len, len1) - off;
                crc = crc_itu_t(crc, buf1 + off, copy);
                len -= copy;
                off = 0;
        }
        if (len > 0) {
                if (WARN_ON_ONCE(off + len > len2 || !buf2))
                        return 0;
                crc = crc_itu_t(crc, buf2 + off, len);
        }
        return crc;
}

static void udf_copy_fi_to_bufs(char *buf1, int len1, char *buf2, int len2,
                                int off, struct fileIdentDesc *fi,
                                uint8_t *impuse, uint8_t *name)
{
        uint16_t crc;
        int fioff = off;
        int crcoff = off + sizeof(struct tag);
        unsigned int crclen = udf_dir_entry_len(fi) - sizeof(struct tag);
        char zeros[UDF_NAME_PAD] = {};
        int endoff = off + udf_dir_entry_len(fi);

        udf_copy_to_bufs(buf1, len1, buf2, len2, off, fi,
                         sizeof(struct fileIdentDesc));
        off += sizeof(struct fileIdentDesc);
        if (impuse)
                udf_copy_to_bufs(buf1, len1, buf2, len2, off, impuse,
                                 le16_to_cpu(fi->lengthOfImpUse));
        off += le16_to_cpu(fi->lengthOfImpUse);
        if (name) {
                udf_copy_to_bufs(buf1, len1, buf2, len2, off, name,
                                 fi->lengthFileIdent);
                off += fi->lengthFileIdent;
                udf_copy_to_bufs(buf1, len1, buf2, len2, off, zeros,
                                 endoff - off);
        }

        crc = udf_crc_fi_bufs(buf1, len1, buf2, len2, crcoff, crclen);
        fi->descTag.descCRC = cpu_to_le16(crc);
        fi->descTag.descCRCLength = cpu_to_le16(crclen);
        fi->descTag.tagChecksum = udf_tag_checksum(&fi->descTag);

        udf_copy_to_bufs(buf1, len1, buf2, len2, fioff, fi, sizeof(struct tag));
}

void udf_fiiter_write_fi(struct udf_fileident_iter *iter, uint8_t *impuse)
{
        struct udf_inode_info *iinfo = UDF_I(iter->dir);
        void *buf1, *buf2 = NULL;
        int len1, len2 = 0, off;
        int blksize = 1 << iter->dir->i_blkbits;

        off = iter->pos & (blksize - 1);
        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                buf1 = iinfo->i_data + iinfo->i_lenEAttr;
                len1 = iter->dir->i_size;
        } else {
                buf1 = iter->bh[0]->b_data;
                len1 = blksize;
                if (iter->bh[1]) {
                        buf2 = iter->bh[1]->b_data;
                        len2 = blksize;
                }
        }

        udf_copy_fi_to_bufs(buf1, len1, buf2, len2, off, &iter->fi, impuse,
                            iter->name == iter->namebuf ? iter->name : NULL);

        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
                mark_inode_dirty(iter->dir);
        } else {
                mark_buffer_dirty_inode(iter->bh[0], iter->dir);
                if (iter->bh[1])
                        mark_buffer_dirty_inode(iter->bh[1], iter->dir);
        }
        inode_inc_iversion(iter->dir);
}

void udf_fiiter_update_elen(struct udf_fileident_iter *iter, uint32_t new_elen)
{
        struct udf_inode_info *iinfo = UDF_I(iter->dir);
        int diff = new_elen - iter->elen;

        /* Skip update when we already went past the last extent */
        if (!iter->elen)
                return;
        iter->elen = new_elen;
        if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
                iter->epos.offset -= sizeof(struct short_ad);
        else if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
                iter->epos.offset -= sizeof(struct long_ad);
        udf_write_aext(iter->dir, &iter->epos, &iter->eloc, iter->elen, 1);
        iinfo->i_lenExtents += diff;
        mark_inode_dirty(iter->dir);
}

/* Append new block to directory. @iter is expected to point at EOF */
int udf_fiiter_append_blk(struct udf_fileident_iter *iter)
{
        struct udf_inode_info *iinfo = UDF_I(iter->dir);
        int blksize = 1 << iter->dir->i_blkbits;
        struct buffer_head *bh;
        sector_t block;
        uint32_t old_elen = iter->elen;
        int err;
        int8_t etype;

        if (WARN_ON_ONCE(iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB))
                return -EINVAL;

        /* Round up last extent in the file */
        udf_fiiter_update_elen(iter, ALIGN(iter->elen, blksize));

        /* Allocate new block and refresh mapping information */
        block = iinfo->i_lenExtents >> iter->dir->i_blkbits;
        bh = udf_bread(iter->dir, block, 1, &err);
        if (!bh) {
                udf_fiiter_update_elen(iter, old_elen);
                return err;
        }
        err = inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
                   &iter->loffset, &etype);
        if (err <= 0 || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
                udf_err(iter->dir->i_sb,
                        "block %llu not allocated in directory (ino %lu)\n",
                        (unsigned long long)block, iter->dir->i_ino);
                return -EFSCORRUPTED;
        }
        if (!(iter->pos & (blksize - 1))) {
                brelse(iter->bh[0]);
                iter->bh[0] = bh;
        } else {
                iter->bh[1] = bh;
        }
        return 0;
}

struct short_ad *udf_get_fileshortad(uint8_t *ptr, int maxoffset, uint32_t *offset,
                              int inc)
{
        struct short_ad *sa;

        if ((!ptr) || (!offset)) {
                pr_err("%s: invalidparms\n", __func__);
                return NULL;
        }

        if ((*offset + sizeof(struct short_ad)) > maxoffset)
                return NULL;
        else {
                sa = (struct short_ad *)ptr;
                if (sa->extLength == 0)
                        return NULL;
        }

        if (inc)
                *offset += sizeof(struct short_ad);
        return sa;
}

struct long_ad *udf_get_filelongad(uint8_t *ptr, int maxoffset, uint32_t *offset, int inc)
{
        struct long_ad *la;

        if ((!ptr) || (!offset)) {
                pr_err("%s: invalidparms\n", __func__);
                return NULL;
        }

        if ((*offset + sizeof(struct long_ad)) > maxoffset)
                return NULL;
        else {
                la = (struct long_ad *)ptr;
                if (la->extLength == 0)
                        return NULL;
        }

        if (inc)
                *offset += sizeof(struct long_ad);
        return la;
}





































































    5 


    5 










   83 



























   83 

   83 
















   92 





   92 


    8 


    1 










   81 

   83 









   83 











   82 

    5 















   12 


  172 









   77 



   76 







   77 



    1 









   22 



   23 

    1 


   22 

   22 



































   23 



   23 

   23 












   45 




   45 

    1 





   23 

   23 

   15 
   38 










   25 





   25 

    3 


   22 




    6 
   20 















  168 










   49 



    8 



  158 


  158 






  165 


   10 



























  136 







    2 



   33 
    8 

















   41 
    2 
   40 














   70 





   70 

    2 


   22 








   58 








   53 

    7 










   51 





















    8 




    2 























   54 



    1 



    3 







   36 
   18 







   53 

























   28 











   14 
   14 






    1 







    3 
    3 





    2 








   12 
   22 










   22 

   11 





   27 









   79 



    5 


   28 
   54 















































   99 








   99 




    7 


   94 














    1 



   90 
    3 












   95 

   16 
   83 

   83 








  170 





  172 

    1 


    4 





   96 






   79 
   77 








  100 


    2 

   64 

   44 















   34 















   27 

   43 








    8 




    8 






    1 



    1 

    5 







   25 




   25 










    1 


   24 
   24 

























   15 

   15 



   15 

   12 
    3 



    2 





    1 

   11 








    9 




    5 
    4 



    1 



    1 

    6 








   31 











   17 
   14 



    6 

   25 













   89 

























    1 




    6 


    8 


   25 


   15 


    9 


   31 






   40 
   50 












    1 
    1 

























   60 












    5 


    1 





   15 


   39 



    4 








   13 
   24 









   36 












  131 


  131 







  181 




    4 










  175 
    3 












   31 







    5 











   20 

    3 
    3 




























   12 
    5 



   10 

    3 










   40 


























    6 







    1 

    1 


    4 



    1 

    4 

















































    9 








    9 








    9 


    9 


















   32 


   32 


    9 


   30 













   30 


   30 



















    9 




























    4 

    4 





    4 


    3 

    3 






































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (c) 2000-2005 Silicon Graphics, Inc.
 * All Rights Reserved.
 */
#include "xfs.h"
#include "xfs_fs.h"
#include "xfs_shared.h"
#include "xfs_format.h"
#include "xfs_log_format.h"
#include "xfs_trans_resv.h"
#include "xfs_mount.h"
#include "xfs_inode.h"
#include "xfs_trans.h"
#include "xfs_inode_item.h"
#include "xfs_bmap.h"
#include "xfs_bmap_util.h"
#include "xfs_dir2.h"
#include "xfs_dir2_priv.h"
#include "xfs_ioctl.h"
#include "xfs_trace.h"
#include "xfs_log.h"
#include "xfs_icache.h"
#include "xfs_pnfs.h"
#include "xfs_iomap.h"
#include "xfs_reflink.h"
#include "xfs_file.h"

#include <linux/dax.h>
#include <linux/falloc.h>
#include <linux/backing-dev.h>
#include <linux/mman.h>
#include <linux/fadvise.h>
#include <linux/mount.h>

static const struct vm_operations_struct xfs_file_vm_ops;

/*
 * Decide if the given file range is aligned to the size of the fundamental
 * allocation unit for the file.
 */
bool
xfs_is_falloc_aligned(
        struct xfs_inode        *ip,
        loff_t                        pos,
        long long int                len)
{
        unsigned int                alloc_unit = xfs_inode_alloc_unitsize(ip);

        if (!is_power_of_2(alloc_unit))
                return isaligned_64(pos, alloc_unit) &&
                       isaligned_64(len, alloc_unit);

        return !((pos | len) & (alloc_unit - 1));
}

/*
 * Fsync operations on directories are much simpler than on regular files,
 * as there is no file data to flush, and thus also no need for explicit
 * cache flush operations, and there are no non-transaction metadata updates
 * on directories either.
 */
STATIC int
xfs_dir_fsync(
        struct file                *file,
        loff_t                        start,
        loff_t                        end,
        int                        datasync)
{
        struct xfs_inode        *ip = XFS_I(file->f_mapping->host);

        trace_xfs_dir_fsync(ip);
        return xfs_log_force_inode(ip);
}

static xfs_csn_t
xfs_fsync_seq(
        struct xfs_inode        *ip,
        bool                        datasync)
{
        if (!xfs_ipincount(ip))
                return 0;
        if (datasync && !(ip->i_itemp->ili_fsync_fields & ~XFS_ILOG_TIMESTAMP))
                return 0;
        return ip->i_itemp->ili_commit_seq;
}

/*
 * All metadata updates are logged, which means that we just have to flush the
 * log up to the latest LSN that touched the inode.
 *
 * If we have concurrent fsync/fdatasync() calls, we need them to all block on
 * the log force before we clear the ili_fsync_fields field. This ensures that
 * we don't get a racing sync operation that does not wait for the metadata to
 * hit the journal before returning.  If we race with clearing ili_fsync_fields,
 * then all that will happen is the log force will do nothing as the lsn will
 * already be on disk.  We can't race with setting ili_fsync_fields because that
 * is done under XFS_ILOCK_EXCL, and that can't happen because we hold the lock
 * shared until after the ili_fsync_fields is cleared.
 */
static  int
xfs_fsync_flush_log(
        struct xfs_inode        *ip,
        bool                        datasync,
        int                        *log_flushed)
{
        int                        error = 0;
        xfs_csn_t                seq;

        xfs_ilock(ip, XFS_ILOCK_SHARED);
        seq = xfs_fsync_seq(ip, datasync);
        if (seq) {
                error = xfs_log_force_seq(ip->i_mount, seq, XFS_LOG_SYNC,
                                          log_flushed);

                spin_lock(&ip->i_itemp->ili_lock);
                ip->i_itemp->ili_fsync_fields = 0;
                spin_unlock(&ip->i_itemp->ili_lock);
        }
        xfs_iunlock(ip, XFS_ILOCK_SHARED);
        return error;
}

STATIC int
xfs_file_fsync(
        struct file                *file,
        loff_t                        start,
        loff_t                        end,
        int                        datasync)
{
        struct xfs_inode        *ip = XFS_I(file->f_mapping->host);
        struct xfs_mount        *mp = ip->i_mount;
        int                        error, err2;
        int                        log_flushed = 0;

        trace_xfs_file_fsync(ip);

        error = file_write_and_wait_range(file, start, end);
        if (error)
                return error;

        if (xfs_is_shutdown(mp))
                return -EIO;

        xfs_iflags_clear(ip, XFS_ITRUNCATED);

        /*
         * If we have an RT and/or log subvolume we need to make sure to flush
         * the write cache the device used for file data first.  This is to
         * ensure newly written file data make it to disk before logging the new
         * inode size in case of an extending write.
         */
        if (XFS_IS_REALTIME_INODE(ip))
                error = blkdev_issue_flush(mp->m_rtdev_targp->bt_bdev);
        else if (mp->m_logdev_targp != mp->m_ddev_targp)
                error = blkdev_issue_flush(mp->m_ddev_targp->bt_bdev);

        /*
         * Any inode that has dirty modifications in the log is pinned.  The
         * racy check here for a pinned inode will not catch modifications
         * that happen concurrently to the fsync call, but fsync semantics
         * only require to sync previously completed I/O.
         */
        if (xfs_ipincount(ip)) {
                err2 = xfs_fsync_flush_log(ip, datasync, &log_flushed);
                if (err2 && !error)
                        error = err2;
        }

        /*
         * If we only have a single device, and the log force about was
         * a no-op we might have to flush the data device cache here.
         * This can only happen for fdatasync/O_DSYNC if we were overwriting
         * an already allocated file and thus do not have any metadata to
         * commit.
         */
        if (!log_flushed && !XFS_IS_REALTIME_INODE(ip) &&
            mp->m_logdev_targp == mp->m_ddev_targp) {
                err2 = blkdev_issue_flush(mp->m_ddev_targp->bt_bdev);
                if (err2 && !error)
                        error = err2;
        }

        return error;
}

static int
xfs_ilock_iocb(
        struct kiocb                *iocb,
        unsigned int                lock_mode)
{
        struct xfs_inode        *ip = XFS_I(file_inode(iocb->ki_filp));

        if (iocb->ki_flags & IOCB_NOWAIT) {
                if (!xfs_ilock_nowait(ip, lock_mode))
                        return -EAGAIN;
        } else {
                xfs_ilock(ip, lock_mode);
        }

        return 0;
}

static int
xfs_ilock_iocb_for_write(
        struct kiocb                *iocb,
        unsigned int                *lock_mode)
{
        ssize_t                        ret;
        struct xfs_inode        *ip = XFS_I(file_inode(iocb->ki_filp));

        ret = xfs_ilock_iocb(iocb, *lock_mode);
        if (ret)
                return ret;

        /*
         * If a reflink remap is in progress we always need to take the iolock
         * exclusively to wait for it to finish.
         */
        if (*lock_mode == XFS_IOLOCK_SHARED &&
            xfs_iflags_test(ip, XFS_IREMAPPING)) {
                xfs_iunlock(ip, *lock_mode);
                *lock_mode = XFS_IOLOCK_EXCL;
                return xfs_ilock_iocb(iocb, *lock_mode);
        }

        return 0;
}

STATIC ssize_t
xfs_file_dio_read(
        struct kiocb                *iocb,
        struct iov_iter                *to)
{
        struct xfs_inode        *ip = XFS_I(file_inode(iocb->ki_filp));
        ssize_t                        ret;

        trace_xfs_file_direct_read(iocb, to);

        if (!iov_iter_count(to))
                return 0; /* skip atime */

        file_accessed(iocb->ki_filp);

        ret = xfs_ilock_iocb(iocb, XFS_IOLOCK_SHARED);
        if (ret)
                return ret;
        ret = iomap_dio_rw(iocb, to, &xfs_read_iomap_ops, NULL, 0, NULL, 0);
        xfs_iunlock(ip, XFS_IOLOCK_SHARED);

        return ret;
}

static noinline ssize_t
xfs_file_dax_read(
        struct kiocb                *iocb,
        struct iov_iter                *to)
{
        struct xfs_inode        *ip = XFS_I(iocb->ki_filp->f_mapping->host);
        ssize_t                        ret = 0;

        trace_xfs_file_dax_read(iocb, to);

        if (!iov_iter_count(to))
                return 0; /* skip atime */

        ret = xfs_ilock_iocb(iocb, XFS_IOLOCK_SHARED);
        if (ret)
                return ret;
        ret = dax_iomap_rw(iocb, to, &xfs_read_iomap_ops);
        xfs_iunlock(ip, XFS_IOLOCK_SHARED);

        file_accessed(iocb->ki_filp);
        return ret;
}

STATIC ssize_t
xfs_file_buffered_read(
        struct kiocb                *iocb,
        struct iov_iter                *to)
{
        struct xfs_inode        *ip = XFS_I(file_inode(iocb->ki_filp));
        ssize_t                        ret;

        trace_xfs_file_buffered_read(iocb, to);

        ret = xfs_ilock_iocb(iocb, XFS_IOLOCK_SHARED);
        if (ret)
                return ret;
        ret = generic_file_read_iter(iocb, to);
        xfs_iunlock(ip, XFS_IOLOCK_SHARED);

        return ret;
}

STATIC ssize_t
xfs_file_read_iter(
        struct kiocb                *iocb,
        struct iov_iter                *to)
{
        struct inode                *inode = file_inode(iocb->ki_filp);
        struct xfs_mount        *mp = XFS_I(inode)->i_mount;
        ssize_t                        ret = 0;

        XFS_STATS_INC(mp, xs_read_calls);

        if (xfs_is_shutdown(mp))
                return -EIO;

        if (IS_DAX(inode))
                ret = xfs_file_dax_read(iocb, to);
        else if (iocb->ki_flags & IOCB_DIRECT)
                ret = xfs_file_dio_read(iocb, to);
        else
                ret = xfs_file_buffered_read(iocb, to);

        if (ret > 0)
                XFS_STATS_ADD(mp, xs_read_bytes, ret);
        return ret;
}

STATIC ssize_t
xfs_file_splice_read(
        struct file                *in,
        loff_t                        *ppos,
        struct pipe_inode_info        *pipe,
        size_t                        len,
        unsigned int                flags)
{
        struct inode                *inode = file_inode(in);
        struct xfs_inode        *ip = XFS_I(inode);
        struct xfs_mount        *mp = ip->i_mount;
        ssize_t                        ret = 0;

        XFS_STATS_INC(mp, xs_read_calls);

        if (xfs_is_shutdown(mp))
                return -EIO;

        trace_xfs_file_splice_read(ip, *ppos, len);

        xfs_ilock(ip, XFS_IOLOCK_SHARED);
        ret = filemap_splice_read(in, ppos, pipe, len, flags);
        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
        if (ret > 0)
                XFS_STATS_ADD(mp, xs_read_bytes, ret);
        return ret;
}

/*
 * Common pre-write limit and setup checks.
 *
 * Called with the iolocked held either shared and exclusive according to
 * @iolock, and returns with it held.  Might upgrade the iolock to exclusive
 * if called for a direct write beyond i_size.
 */
STATIC ssize_t
xfs_file_write_checks(
        struct kiocb                *iocb,
        struct iov_iter                *from,
        unsigned int                *iolock)
{
        struct file                *file = iocb->ki_filp;
        struct inode                *inode = file->f_mapping->host;
        struct xfs_inode        *ip = XFS_I(inode);
        ssize_t                        error = 0;
        size_t                        count = iov_iter_count(from);
        bool                        drained_dio = false;
        loff_t                        isize;

restart:
        error = generic_write_checks(iocb, from);
        if (error <= 0)
                return error;

        if (iocb->ki_flags & IOCB_NOWAIT) {
                error = break_layout(inode, false);
                if (error == -EWOULDBLOCK)
                        error = -EAGAIN;
        } else {
                error = xfs_break_layouts(inode, iolock, BREAK_WRITE);
        }

        if (error)
                return error;

        /*
         * For changing security info in file_remove_privs() we need i_rwsem
         * exclusively.
         */
        if (*iolock == XFS_IOLOCK_SHARED && !IS_NOSEC(inode)) {
                xfs_iunlock(ip, *iolock);
                *iolock = XFS_IOLOCK_EXCL;
                error = xfs_ilock_iocb(iocb, *iolock);
                if (error) {
                        *iolock = 0;
                        return error;
                }
                goto restart;
        }

        /*
         * If the offset is beyond the size of the file, we need to zero any
         * blocks that fall between the existing EOF and the start of this
         * write.  If zeroing is needed and we are currently holding the iolock
         * shared, we need to update it to exclusive which implies having to
         * redo all checks before.
         *
         * We need to serialise against EOF updates that occur in IO completions
         * here. We want to make sure that nobody is changing the size while we
         * do this check until we have placed an IO barrier (i.e.  hold the
         * XFS_IOLOCK_EXCL) that prevents new IO from being dispatched.  The
         * spinlock effectively forms a memory barrier once we have the
         * XFS_IOLOCK_EXCL so we are guaranteed to see the latest EOF value and
         * hence be able to correctly determine if we need to run zeroing.
         *
         * We can do an unlocked check here safely as IO completion can only
         * extend EOF. Truncate is locked out at this point, so the EOF can
         * not move backwards, only forwards. Hence we only need to take the
         * slow path and spin locks when we are at or beyond the current EOF.
         */
        if (iocb->ki_pos <= i_size_read(inode))
                goto out;

        spin_lock(&ip->i_flags_lock);
        isize = i_size_read(inode);
        if (iocb->ki_pos > isize) {
                spin_unlock(&ip->i_flags_lock);

                if (iocb->ki_flags & IOCB_NOWAIT)
                        return -EAGAIN;

                if (!drained_dio) {
                        if (*iolock == XFS_IOLOCK_SHARED) {
                                xfs_iunlock(ip, *iolock);
                                *iolock = XFS_IOLOCK_EXCL;
                                xfs_ilock(ip, *iolock);
                                iov_iter_reexpand(from, count);
                        }
                        /*
                         * We now have an IO submission barrier in place, but
                         * AIO can do EOF updates during IO completion and hence
                         * we now need to wait for all of them to drain. Non-AIO
                         * DIO will have drained before we are given the
                         * XFS_IOLOCK_EXCL, and so for most cases this wait is a
                         * no-op.
                         */
                        inode_dio_wait(inode);
                        drained_dio = true;
                        goto restart;
                }

                trace_xfs_zero_eof(ip, isize, iocb->ki_pos - isize);
                error = xfs_zero_range(ip, isize, iocb->ki_pos - isize, NULL);
                if (error)
                        return error;
        } else
                spin_unlock(&ip->i_flags_lock);

out:
        return kiocb_modified(iocb);
}

static int
xfs_dio_write_end_io(
        struct kiocb                *iocb,
        ssize_t                        size,
        int                        error,
        unsigned                flags)
{
        struct inode                *inode = file_inode(iocb->ki_filp);
        struct xfs_inode        *ip = XFS_I(inode);
        loff_t                        offset = iocb->ki_pos;
        unsigned int                nofs_flag;

        trace_xfs_end_io_direct_write(ip, offset, size);

        if (xfs_is_shutdown(ip->i_mount))
                return -EIO;

        if (error)
                return error;
        if (!size)
                return 0;

        /*
         * Capture amount written on completion as we can't reliably account
         * for it on submission.
         */
        XFS_STATS_ADD(ip->i_mount, xs_write_bytes, size);

        /*
         * We can allocate memory here while doing writeback on behalf of
         * memory reclaim.  To avoid memory allocation deadlocks set the
         * task-wide nofs context for the following operations.
         */
        nofs_flag = memalloc_nofs_save();

        if (flags & IOMAP_DIO_COW) {
                error = xfs_reflink_end_cow(ip, offset, size);
                if (error)
                        goto out;
        }

        /*
         * Unwritten conversion updates the in-core isize after extent
         * conversion but before updating the on-disk size. Updating isize any
         * earlier allows a racing dio read to find unwritten extents before
         * they are converted.
         */
        if (flags & IOMAP_DIO_UNWRITTEN) {
                error = xfs_iomap_write_unwritten(ip, offset, size, true);
                goto out;
        }

        /*
         * We need to update the in-core inode size here so that we don't end up
         * with the on-disk inode size being outside the in-core inode size. We
         * have no other method of updating EOF for AIO, so always do it here
         * if necessary.
         *
         * We need to lock the test/set EOF update as we can be racing with
         * other IO completions here to update the EOF. Failing to serialise
         * here can result in EOF moving backwards and Bad Things Happen when
         * that occurs.
         *
         * As IO completion only ever extends EOF, we can do an unlocked check
         * here to avoid taking the spinlock. If we land within the current EOF,
         * then we do not need to do an extending update at all, and we don't
         * need to take the lock to check this. If we race with an update moving
         * EOF, then we'll either still be beyond EOF and need to take the lock,
         * or we'll be within EOF and we don't need to take it at all.
         */
        if (offset + size <= i_size_read(inode))
                goto out;

        spin_lock(&ip->i_flags_lock);
        if (offset + size > i_size_read(inode)) {
                i_size_write(inode, offset + size);
                spin_unlock(&ip->i_flags_lock);
                error = xfs_setfilesize(ip, offset, size);
        } else {
                spin_unlock(&ip->i_flags_lock);
        }

out:
        memalloc_nofs_restore(nofs_flag);
        return error;
}

static const struct iomap_dio_ops xfs_dio_write_ops = {
        .end_io                = xfs_dio_write_end_io,
};

/*
 * Handle block aligned direct I/O writes
 */
static noinline ssize_t
xfs_file_dio_write_aligned(
        struct xfs_inode        *ip,
        struct kiocb                *iocb,
        struct iov_iter                *from)
{
        unsigned int                iolock = XFS_IOLOCK_SHARED;
        ssize_t                        ret;

        ret = xfs_ilock_iocb_for_write(iocb, &iolock);
        if (ret)
                return ret;
        ret = xfs_file_write_checks(iocb, from, &iolock);
        if (ret)
                goto out_unlock;

        /*
         * We don't need to hold the IOLOCK exclusively across the IO, so demote
         * the iolock back to shared if we had to take the exclusive lock in
         * xfs_file_write_checks() for other reasons.
         */
        if (iolock == XFS_IOLOCK_EXCL) {
                xfs_ilock_demote(ip, XFS_IOLOCK_EXCL);
                iolock = XFS_IOLOCK_SHARED;
        }
        trace_xfs_file_direct_write(iocb, from);
        ret = iomap_dio_rw(iocb, from, &xfs_direct_write_iomap_ops,
                           &xfs_dio_write_ops, 0, NULL, 0);
out_unlock:
        if (iolock)
                xfs_iunlock(ip, iolock);
        return ret;
}

/*
 * Handle block unaligned direct I/O writes
 *
 * In most cases direct I/O writes will be done holding IOLOCK_SHARED, allowing
 * them to be done in parallel with reads and other direct I/O writes.  However,
 * if the I/O is not aligned to filesystem blocks, the direct I/O layer may need
 * to do sub-block zeroing and that requires serialisation against other direct
 * I/O to the same block.  In this case we need to serialise the submission of
 * the unaligned I/O so that we don't get racing block zeroing in the dio layer.
 * In the case where sub-block zeroing is not required, we can do concurrent
 * sub-block dios to the same block successfully.
 *
 * Optimistically submit the I/O using the shared lock first, but use the
 * IOMAP_DIO_OVERWRITE_ONLY flag to tell the lower layers to return -EAGAIN
 * if block allocation or partial block zeroing would be required.  In that case
 * we try again with the exclusive lock.
 */
static noinline ssize_t
xfs_file_dio_write_unaligned(
        struct xfs_inode        *ip,
        struct kiocb                *iocb,
        struct iov_iter                *from)
{
        size_t                        isize = i_size_read(VFS_I(ip));
        size_t                        count = iov_iter_count(from);
        unsigned int                iolock = XFS_IOLOCK_SHARED;
        unsigned int                flags = IOMAP_DIO_OVERWRITE_ONLY;
        ssize_t                        ret;

        /*
         * Extending writes need exclusivity because of the sub-block zeroing
         * that the DIO code always does for partial tail blocks beyond EOF, so
         * don't even bother trying the fast path in this case.
         */
        if (iocb->ki_pos > isize || iocb->ki_pos + count >= isize) {
                if (iocb->ki_flags & IOCB_NOWAIT)
                        return -EAGAIN;
retry_exclusive:
                iolock = XFS_IOLOCK_EXCL;
                flags = IOMAP_DIO_FORCE_WAIT;
        }

        ret = xfs_ilock_iocb_for_write(iocb, &iolock);
        if (ret)
                return ret;

        /*
         * We can't properly handle unaligned direct I/O to reflink files yet,
         * as we can't unshare a partial block.
         */
        if (xfs_is_cow_inode(ip)) {
                trace_xfs_reflink_bounce_dio_write(iocb, from);
                ret = -ENOTBLK;
                goto out_unlock;
        }

        ret = xfs_file_write_checks(iocb, from, &iolock);
        if (ret)
                goto out_unlock;

        /*
         * If we are doing exclusive unaligned I/O, this must be the only I/O
         * in-flight.  Otherwise we risk data corruption due to unwritten extent
         * conversions from the AIO end_io handler.  Wait for all other I/O to
         * drain first.
         */
        if (flags & IOMAP_DIO_FORCE_WAIT)
                inode_dio_wait(VFS_I(ip));

        trace_xfs_file_direct_write(iocb, from);
        ret = iomap_dio_rw(iocb, from, &xfs_direct_write_iomap_ops,
                           &xfs_dio_write_ops, flags, NULL, 0);

        /*
         * Retry unaligned I/O with exclusive blocking semantics if the DIO
         * layer rejected it for mapping or locking reasons. If we are doing
         * nonblocking user I/O, propagate the error.
         */
        if (ret == -EAGAIN && !(iocb->ki_flags & IOCB_NOWAIT)) {
                ASSERT(flags & IOMAP_DIO_OVERWRITE_ONLY);
                xfs_iunlock(ip, iolock);
                goto retry_exclusive;
        }

out_unlock:
        if (iolock)
                xfs_iunlock(ip, iolock);
        return ret;
}

static ssize_t
xfs_file_dio_write(
        struct kiocb                *iocb,
        struct iov_iter                *from)
{
        struct xfs_inode        *ip = XFS_I(file_inode(iocb->ki_filp));
        struct xfs_buftarg      *target = xfs_inode_buftarg(ip);
        size_t                        count = iov_iter_count(from);

        /* direct I/O must be aligned to device logical sector size */
        if ((iocb->ki_pos | count) & target->bt_logical_sectormask)
                return -EINVAL;
        if ((iocb->ki_pos | count) & ip->i_mount->m_blockmask)
                return xfs_file_dio_write_unaligned(ip, iocb, from);
        return xfs_file_dio_write_aligned(ip, iocb, from);
}

static noinline ssize_t
xfs_file_dax_write(
        struct kiocb                *iocb,
        struct iov_iter                *from)
{
        struct inode                *inode = iocb->ki_filp->f_mapping->host;
        struct xfs_inode        *ip = XFS_I(inode);
        unsigned int                iolock = XFS_IOLOCK_EXCL;
        ssize_t                        ret, error = 0;
        loff_t                        pos;

        ret = xfs_ilock_iocb(iocb, iolock);
        if (ret)
                return ret;
        ret = xfs_file_write_checks(iocb, from, &iolock);
        if (ret)
                goto out;

        pos = iocb->ki_pos;

        trace_xfs_file_dax_write(iocb, from);
        ret = dax_iomap_rw(iocb, from, &xfs_dax_write_iomap_ops);
        if (ret > 0 && iocb->ki_pos > i_size_read(inode)) {
                i_size_write(inode, iocb->ki_pos);
                error = xfs_setfilesize(ip, pos, ret);
        }
out:
        if (iolock)
                xfs_iunlock(ip, iolock);
        if (error)
                return error;

        if (ret > 0) {
                XFS_STATS_ADD(ip->i_mount, xs_write_bytes, ret);

                /* Handle various SYNC-type writes */
                ret = generic_write_sync(iocb, ret);
        }
        return ret;
}

STATIC ssize_t
xfs_file_buffered_write(
        struct kiocb                *iocb,
        struct iov_iter                *from)
{
        struct inode                *inode = iocb->ki_filp->f_mapping->host;
        struct xfs_inode        *ip = XFS_I(inode);
        ssize_t                        ret;
        bool                        cleared_space = false;
        unsigned int                iolock;

write_retry:
        iolock = XFS_IOLOCK_EXCL;
        ret = xfs_ilock_iocb(iocb, iolock);
        if (ret)
                return ret;

        ret = xfs_file_write_checks(iocb, from, &iolock);
        if (ret)
                goto out;

        trace_xfs_file_buffered_write(iocb, from);
        ret = iomap_file_buffered_write(iocb, from,
                        &xfs_buffered_write_iomap_ops, NULL);

        /*
         * If we hit a space limit, try to free up some lingering preallocated
         * space before returning an error. In the case of ENOSPC, first try to
         * write back all dirty inodes to free up some of the excess reserved
         * metadata space. This reduces the chances that the eofblocks scan
         * waits on dirty mappings. Since xfs_flush_inodes() is serialized, this
         * also behaves as a filter to prevent too many eofblocks scans from
         * running at the same time.  Use a synchronous scan to increase the
         * effectiveness of the scan.
         */
        if (ret == -EDQUOT && !cleared_space) {
                xfs_iunlock(ip, iolock);
                xfs_blockgc_free_quota(ip, XFS_ICWALK_FLAG_SYNC);
                cleared_space = true;
                goto write_retry;
        } else if (ret == -ENOSPC && !cleared_space) {
                struct xfs_icwalk        icw = {0};

                cleared_space = true;
                xfs_flush_inodes(ip->i_mount);

                xfs_iunlock(ip, iolock);
                icw.icw_flags = XFS_ICWALK_FLAG_SYNC;
                xfs_blockgc_free_space(ip->i_mount, &icw);
                goto write_retry;
        }

out:
        if (iolock)
                xfs_iunlock(ip, iolock);

        if (ret > 0) {
                XFS_STATS_ADD(ip->i_mount, xs_write_bytes, ret);
                /* Handle various SYNC-type writes */
                ret = generic_write_sync(iocb, ret);
        }
        return ret;
}

STATIC ssize_t
xfs_file_write_iter(
        struct kiocb                *iocb,
        struct iov_iter                *from)
{
        struct inode                *inode = iocb->ki_filp->f_mapping->host;
        struct xfs_inode        *ip = XFS_I(inode);
        ssize_t                        ret;
        size_t                        ocount = iov_iter_count(from);

        XFS_STATS_INC(ip->i_mount, xs_write_calls);

        if (ocount == 0)
                return 0;

        if (xfs_is_shutdown(ip->i_mount))
                return -EIO;

        if (IS_DAX(inode))
                return xfs_file_dax_write(iocb, from);

        if (iocb->ki_flags & IOCB_DIRECT) {
                /*
                 * Allow a directio write to fall back to a buffered
                 * write *only* in the case that we're doing a reflink
                 * CoW.  In all other directio scenarios we do not
                 * allow an operation to fall back to buffered mode.
                 */
                ret = xfs_file_dio_write(iocb, from);
                if (ret != -ENOTBLK)
                        return ret;
        }

        return xfs_file_buffered_write(iocb, from);
}

/* Does this file, inode, or mount want synchronous writes? */
static inline bool xfs_file_sync_writes(struct file *filp)
{
        struct xfs_inode        *ip = XFS_I(file_inode(filp));

        if (xfs_has_wsync(ip->i_mount))
                return true;
        if (filp->f_flags & (__O_SYNC | O_DSYNC))
                return true;
        if (IS_SYNC(file_inode(filp)))
                return true;

        return false;
}

static int
xfs_falloc_newsize(
        struct file                *file,
        int                        mode,
        loff_t                        offset,
        loff_t                        len,
        loff_t                        *new_size)
{
        struct inode                *inode = file_inode(file);

        if ((mode & FALLOC_FL_KEEP_SIZE) || offset + len <= i_size_read(inode))
                return 0;
        *new_size = offset + len;
        return inode_newsize_ok(inode, *new_size);
}

static int
xfs_falloc_setsize(
        struct file                *file,
        loff_t                        new_size)
{
        struct iattr iattr = {
                .ia_valid        = ATTR_SIZE,
                .ia_size        = new_size,
        };

        if (!new_size)
                return 0;
        return xfs_vn_setattr_size(file_mnt_idmap(file), file_dentry(file),
                        &iattr);
}

static int
xfs_falloc_collapse_range(
        struct file                *file,
        loff_t                        offset,
        loff_t                        len)
{
        struct inode                *inode = file_inode(file);
        loff_t                        new_size = i_size_read(inode) - len;
        int                        error;

        if (!xfs_is_falloc_aligned(XFS_I(inode), offset, len))
                return -EINVAL;

        /*
         * There is no need to overlap collapse range with EOF, in which case it
         * is effectively a truncate operation
         */
        if (offset + len >= i_size_read(inode))
                return -EINVAL;

        error = xfs_collapse_file_space(XFS_I(inode), offset, len);
        if (error)
                return error;
        return xfs_falloc_setsize(file, new_size);
}

static int
xfs_falloc_insert_range(
        struct file                *file,
        loff_t                        offset,
        loff_t                        len)
{
        struct inode                *inode = file_inode(file);
        loff_t                        isize = i_size_read(inode);
        int                        error;

        if (!xfs_is_falloc_aligned(XFS_I(inode), offset, len))
                return -EINVAL;

        /*
         * New inode size must not exceed ->s_maxbytes, accounting for
         * possible signed overflow.
         */
        if (inode->i_sb->s_maxbytes - isize < len)
                return -EFBIG;

        /* Offset should be less than i_size */
        if (offset >= isize)
                return -EINVAL;

        error = xfs_falloc_setsize(file, isize + len);
        if (error)
                return error;

        /*
         * Perform hole insertion now that the file size has been updated so
         * that if we crash during the operation we don't leave shifted extents
         * past EOF and hence losing access to the data that is contained within
         * them.
         */
        return xfs_insert_file_space(XFS_I(inode), offset, len);
}

/*
 * Punch a hole and prealloc the range.  We use a hole punch rather than
 * unwritten extent conversion for two reasons:
 *
 *   1.) Hole punch handles partial block zeroing for us.
 *   2.) If prealloc returns ENOSPC, the file range is still zero-valued by
 *         virtue of the hole punch.
 */
static int
xfs_falloc_zero_range(
        struct file                *file,
        int                        mode,
        loff_t                        offset,
        loff_t                        len)
{
        struct inode                *inode = file_inode(file);
        unsigned int                blksize = i_blocksize(inode);
        loff_t                        new_size = 0;
        int                        error;

        trace_xfs_zero_file_space(XFS_I(inode));

        error = xfs_falloc_newsize(file, mode, offset, len, &new_size);
        if (error)
                return error;

        error = xfs_free_file_space(XFS_I(inode), offset, len);
        if (error)
                return error;

        len = round_up(offset + len, blksize) - round_down(offset, blksize);
        offset = round_down(offset, blksize);
        error = xfs_alloc_file_space(XFS_I(inode), offset, len);
        if (error)
                return error;
        return xfs_falloc_setsize(file, new_size);
}

static int
xfs_falloc_unshare_range(
        struct file                *file,
        int                        mode,
        loff_t                        offset,
        loff_t                        len)
{
        struct inode                *inode = file_inode(file);
        loff_t                        new_size = 0;
        int                        error;

        error = xfs_falloc_newsize(file, mode, offset, len, &new_size);
        if (error)
                return error;

        error = xfs_reflink_unshare(XFS_I(inode), offset, len);
        if (error)
                return error;

        error = xfs_alloc_file_space(XFS_I(inode), offset, len);
        if (error)
                return error;
        return xfs_falloc_setsize(file, new_size);
}

static int
xfs_falloc_allocate_range(
        struct file                *file,
        int                        mode,
        loff_t                        offset,
        loff_t                        len)
{
        struct inode                *inode = file_inode(file);
        loff_t                        new_size = 0;
        int                        error;

        /*
         * If always_cow mode we can't use preallocations and thus should not
         * create them.
         */
        if (xfs_is_always_cow_inode(XFS_I(inode)))
                return -EOPNOTSUPP;

        error = xfs_falloc_newsize(file, mode, offset, len, &new_size);
        if (error)
                return error;

        error = xfs_alloc_file_space(XFS_I(inode), offset, len);
        if (error)
                return error;
        return xfs_falloc_setsize(file, new_size);
}

#define        XFS_FALLOC_FL_SUPPORTED                                                \
                (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE |                \
                 FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_ZERO_RANGE |        \
                 FALLOC_FL_INSERT_RANGE | FALLOC_FL_UNSHARE_RANGE)

STATIC long
xfs_file_fallocate(
        struct file                *file,
        int                        mode,
        loff_t                        offset,
        loff_t                        len)
{
        struct inode                *inode = file_inode(file);
        struct xfs_inode        *ip = XFS_I(inode);
        long                        error;
        uint                        iolock = XFS_IOLOCK_EXCL | XFS_MMAPLOCK_EXCL;

        if (!S_ISREG(inode->i_mode))
                return -EINVAL;
        if (mode & ~XFS_FALLOC_FL_SUPPORTED)
                return -EOPNOTSUPP;

        xfs_ilock(ip, iolock);
        error = xfs_break_layouts(inode, &iolock, BREAK_UNMAP);
        if (error)
                goto out_unlock;

        /*
         * Must wait for all AIO to complete before we continue as AIO can
         * change the file size on completion without holding any locks we
         * currently hold. We must do this first because AIO can update both
         * the on disk and in memory inode sizes, and the operations that follow
         * require the in-memory size to be fully up-to-date.
         */
        inode_dio_wait(inode);

        error = file_modified(file);
        if (error)
                goto out_unlock;

        switch (mode & FALLOC_FL_MODE_MASK) {
        case FALLOC_FL_PUNCH_HOLE:
                error = xfs_free_file_space(ip, offset, len);
                break;
        case FALLOC_FL_COLLAPSE_RANGE:
                error = xfs_falloc_collapse_range(file, offset, len);
                break;
        case FALLOC_FL_INSERT_RANGE:
                error = xfs_falloc_insert_range(file, offset, len);
                break;
        case FALLOC_FL_ZERO_RANGE:
                error = xfs_falloc_zero_range(file, mode, offset, len);
                break;
        case FALLOC_FL_UNSHARE_RANGE:
                error = xfs_falloc_unshare_range(file, mode, offset, len);
                break;
        case FALLOC_FL_ALLOCATE_RANGE:
                error = xfs_falloc_allocate_range(file, mode, offset, len);
                break;
        default:
                error = -EOPNOTSUPP;
                break;
        }

        if (!error && xfs_file_sync_writes(file))
                error = xfs_log_force_inode(ip);

out_unlock:
        xfs_iunlock(ip, iolock);
        return error;
}

STATIC int
xfs_file_fadvise(
        struct file        *file,
        loff_t                start,
        loff_t                end,
        int                advice)
{
        struct xfs_inode *ip = XFS_I(file_inode(file));
        int ret;
        int lockflags = 0;

        /*
         * Operations creating pages in page cache need protection from hole
         * punching and similar ops
         */
        if (advice == POSIX_FADV_WILLNEED) {
                lockflags = XFS_IOLOCK_SHARED;
                xfs_ilock(ip, lockflags);
        }
        ret = generic_fadvise(file, start, end, advice);
        if (lockflags)
                xfs_iunlock(ip, lockflags);
        return ret;
}

STATIC loff_t
xfs_file_remap_range(
        struct file                *file_in,
        loff_t                        pos_in,
        struct file                *file_out,
        loff_t                        pos_out,
        loff_t                        len,
        unsigned int                remap_flags)
{
        struct inode                *inode_in = file_inode(file_in);
        struct xfs_inode        *src = XFS_I(inode_in);
        struct inode                *inode_out = file_inode(file_out);
        struct xfs_inode        *dest = XFS_I(inode_out);
        struct xfs_mount        *mp = src->i_mount;
        loff_t                        remapped = 0;
        xfs_extlen_t                cowextsize;
        int                        ret;

        if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY))
                return -EINVAL;

        if (!xfs_has_reflink(mp))
                return -EOPNOTSUPP;

        if (xfs_is_shutdown(mp))
                return -EIO;

        /* Prepare and then clone file data. */
        ret = xfs_reflink_remap_prep(file_in, pos_in, file_out, pos_out,
                        &len, remap_flags);
        if (ret || len == 0)
                return ret;

        trace_xfs_reflink_remap_range(src, pos_in, len, dest, pos_out);

        ret = xfs_reflink_remap_blocks(src, pos_in, dest, pos_out, len,
                        &remapped);
        if (ret)
                goto out_unlock;

        /*
         * Carry the cowextsize hint from src to dest if we're sharing the
         * entire source file to the entire destination file, the source file
         * has a cowextsize hint, and the destination file does not.
         */
        cowextsize = 0;
        if (pos_in == 0 && len == i_size_read(inode_in) &&
            (src->i_diflags2 & XFS_DIFLAG2_COWEXTSIZE) &&
            pos_out == 0 && len >= i_size_read(inode_out) &&
            !(dest->i_diflags2 & XFS_DIFLAG2_COWEXTSIZE))
                cowextsize = src->i_cowextsize;

        ret = xfs_reflink_update_dest(dest, pos_out + len, cowextsize,
                        remap_flags);
        if (ret)
                goto out_unlock;

        if (xfs_file_sync_writes(file_in) || xfs_file_sync_writes(file_out))
                xfs_log_force_inode(dest);
out_unlock:
        xfs_iunlock2_remapping(src, dest);
        if (ret)
                trace_xfs_reflink_remap_range_error(dest, ret, _RET_IP_);
        return remapped > 0 ? remapped : ret;
}

STATIC int
xfs_file_open(
        struct inode        *inode,
        struct file        *file)
{
        if (xfs_is_shutdown(XFS_M(inode->i_sb)))
                return -EIO;
        file->f_mode |= FMODE_NOWAIT | FMODE_CAN_ODIRECT;
        return generic_file_open(inode, file);
}

STATIC int
xfs_dir_open(
        struct inode        *inode,
        struct file        *file)
{
        struct xfs_inode *ip = XFS_I(inode);
        unsigned int        mode;
        int                error;

        if (xfs_is_shutdown(ip->i_mount))
                return -EIO;
        error = generic_file_open(inode, file);
        if (error)
                return error;

        /*
         * If there are any blocks, read-ahead block 0 as we're almost
         * certain to have the next operation be a read there.
         */
        mode = xfs_ilock_data_map_shared(ip);
        if (ip->i_df.if_nextents > 0)
                error = xfs_dir3_data_readahead(ip, 0, 0);
        xfs_iunlock(ip, mode);
        return error;
}

/*
 * Don't bother propagating errors.  We're just doing cleanup, and the caller
 * ignores the return value anyway.
 */
STATIC int
xfs_file_release(
        struct inode                *inode,
        struct file                *file)
{
        struct xfs_inode        *ip = XFS_I(inode);
        struct xfs_mount        *mp = ip->i_mount;

        /*
         * If this is a read-only mount or the file system has been shut down,
         * don't generate I/O.
         */
        if (xfs_is_readonly(mp) || xfs_is_shutdown(mp))
                return 0;

        /*
         * If we previously truncated this file and removed old data in the
         * process, we want to initiate "early" writeout on the last close.
         * This is an attempt to combat the notorious NULL files problem which
         * is particularly noticeable from a truncate down, buffered (re-)write
         * (delalloc), followed by a crash.  What we are effectively doing here
         * is significantly reducing the time window where we'd otherwise be
         * exposed to that problem.
         */
        if (xfs_iflags_test_and_clear(ip, XFS_ITRUNCATED)) {
                xfs_iflags_clear(ip, XFS_EOFBLOCKS_RELEASED);
                if (ip->i_delayed_blks > 0)
                        filemap_flush(inode->i_mapping);
        }

        /*
         * XFS aggressively preallocates post-EOF space to generate contiguous
         * allocations for writers that append to the end of the file.
         *
         * To support workloads that close and reopen the file frequently, these
         * preallocations usually persist after a close unless it is the first
         * close for the inode.  This is a tradeoff to generate tightly packed
         * data layouts for unpacking tarballs or similar archives that write
         * one file after another without going back to it while keeping the
         * preallocation for files that have recurring open/write/close cycles.
         *
         * This heuristic is skipped for inodes with the append-only flag as
         * that flag is rather pointless for inodes written only once.
         *
         * There is no point in freeing blocks here for open but unlinked files
         * as they will be taken care of by the inactivation path soon.
         *
         * When releasing a read-only context, don't flush data or trim post-EOF
         * blocks.  This avoids open/read/close workloads from removing EOF
         * blocks that other writers depend upon to reduce fragmentation.
         *
         * If we can't get the iolock just skip truncating the blocks past EOF
         * because we could deadlock with the mmap_lock otherwise. We'll get
         * another chance to drop them once the last reference to the inode is
         * dropped, so we'll never leak blocks permanently.
         */
        if (inode->i_nlink &&
            (file->f_mode & FMODE_WRITE) &&
            !(ip->i_diflags & XFS_DIFLAG_APPEND) &&
            !xfs_iflags_test(ip, XFS_EOFBLOCKS_RELEASED) &&
            xfs_ilock_nowait(ip, XFS_IOLOCK_EXCL)) {
                if (xfs_can_free_eofblocks(ip) &&
                    !xfs_iflags_test_and_set(ip, XFS_EOFBLOCKS_RELEASED))
                        xfs_free_eofblocks(ip);
                xfs_iunlock(ip, XFS_IOLOCK_EXCL);
        }

        return 0;
}

STATIC int
xfs_file_readdir(
        struct file        *file,
        struct dir_context *ctx)
{
        struct inode        *inode = file_inode(file);
        xfs_inode_t        *ip = XFS_I(inode);
        size_t                bufsize;

        /*
         * The Linux API doesn't pass down the total size of the buffer
         * we read into down to the filesystem.  With the filldir concept
         * it's not needed for correct information, but the XFS dir2 leaf
         * code wants an estimate of the buffer size to calculate it's
         * readahead window and size the buffers used for mapping to
         * physical blocks.
         *
         * Try to give it an estimate that's good enough, maybe at some
         * point we can change the ->readdir prototype to include the
         * buffer size.  For now we use the current glibc buffer size.
         */
        bufsize = (size_t)min_t(loff_t, XFS_READDIR_BUFSIZE, ip->i_disk_size);

        return xfs_readdir(NULL, ip, ctx, bufsize);
}

STATIC loff_t
xfs_file_llseek(
        struct file        *file,
        loff_t                offset,
        int                whence)
{
        struct inode                *inode = file->f_mapping->host;

        if (xfs_is_shutdown(XFS_I(inode)->i_mount))
                return -EIO;

        switch (whence) {
        default:
                return generic_file_llseek(file, offset, whence);
        case SEEK_HOLE:
                offset = iomap_seek_hole(inode, offset, &xfs_seek_iomap_ops);
                break;
        case SEEK_DATA:
                offset = iomap_seek_data(inode, offset, &xfs_seek_iomap_ops);
                break;
        }

        if (offset < 0)
                return offset;
        return vfs_setpos(file, offset, inode->i_sb->s_maxbytes);
}

static inline vm_fault_t
xfs_dax_fault_locked(
        struct vm_fault                *vmf,
        unsigned int                order,
        bool                        write_fault)
{
        vm_fault_t                ret;
        pfn_t                        pfn;

        if (!IS_ENABLED(CONFIG_FS_DAX)) {
                ASSERT(0);
                return VM_FAULT_SIGBUS;
        }
        ret = dax_iomap_fault(vmf, order, &pfn, NULL,
                        (write_fault && !vmf->cow_page) ?
                                &xfs_dax_write_iomap_ops :
                                &xfs_read_iomap_ops);
        if (ret & VM_FAULT_NEEDDSYNC)
                ret = dax_finish_sync_fault(vmf, order, pfn);
        return ret;
}

static vm_fault_t
xfs_dax_read_fault(
        struct vm_fault                *vmf,
        unsigned int                order)
{
        struct xfs_inode        *ip = XFS_I(file_inode(vmf->vma->vm_file));
        vm_fault_t                ret;

        xfs_ilock(ip, XFS_MMAPLOCK_SHARED);
        ret = xfs_dax_fault_locked(vmf, order, false);
        xfs_iunlock(ip, XFS_MMAPLOCK_SHARED);

        return ret;
}

static vm_fault_t
xfs_write_fault(
        struct vm_fault                *vmf,
        unsigned int                order)
{
        struct inode                *inode = file_inode(vmf->vma->vm_file);
        struct xfs_inode        *ip = XFS_I(inode);
        unsigned int                lock_mode = XFS_MMAPLOCK_SHARED;
        vm_fault_t                ret;

        sb_start_pagefault(inode->i_sb);
        file_update_time(vmf->vma->vm_file);

        /*
         * Normally we only need the shared mmaplock, but if a reflink remap is
         * in progress we take the exclusive lock to wait for the remap to
         * finish before taking a write fault.
         */
        xfs_ilock(ip, XFS_MMAPLOCK_SHARED);
        if (xfs_iflags_test(ip, XFS_IREMAPPING)) {
                xfs_iunlock(ip, XFS_MMAPLOCK_SHARED);
                xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
                lock_mode = XFS_MMAPLOCK_EXCL;
        }

        if (IS_DAX(inode))
                ret = xfs_dax_fault_locked(vmf, order, true);
        else
                ret = iomap_page_mkwrite(vmf, &xfs_page_mkwrite_iomap_ops);
        xfs_iunlock(ip, lock_mode);

        sb_end_pagefault(inode->i_sb);
        return ret;
}

/*
 * Locking for serialisation of IO during page faults. This results in a lock
 * ordering of:
 *
 * mmap_lock (MM)
 *   sb_start_pagefault(vfs, freeze)
 *     invalidate_lock (vfs/XFS_MMAPLOCK - truncate serialisation)
 *       page_lock (MM)
 *         i_lock (XFS - extent map serialisation)
 */
static vm_fault_t
__xfs_filemap_fault(
        struct vm_fault                *vmf,
        unsigned int                order,
        bool                        write_fault)
{
        struct inode                *inode = file_inode(vmf->vma->vm_file);

        trace_xfs_filemap_fault(XFS_I(inode), order, write_fault);

        if (write_fault)
                return xfs_write_fault(vmf, order);
        if (IS_DAX(inode))
                return xfs_dax_read_fault(vmf, order);
        return filemap_fault(vmf);
}

static inline bool
xfs_is_write_fault(
        struct vm_fault                *vmf)
{
        return (vmf->flags & FAULT_FLAG_WRITE) &&
               (vmf->vma->vm_flags & VM_SHARED);
}

static vm_fault_t
xfs_filemap_fault(
        struct vm_fault                *vmf)
{
        /* DAX can shortcut the normal fault path on write faults! */
        return __xfs_filemap_fault(vmf, 0,
                        IS_DAX(file_inode(vmf->vma->vm_file)) &&
                        xfs_is_write_fault(vmf));
}

static vm_fault_t
xfs_filemap_huge_fault(
        struct vm_fault                *vmf,
        unsigned int                order)
{
        if (!IS_DAX(file_inode(vmf->vma->vm_file)))
                return VM_FAULT_FALLBACK;

        /* DAX can shortcut the normal fault path on write faults! */
        return __xfs_filemap_fault(vmf, order,
                        xfs_is_write_fault(vmf));
}

static vm_fault_t
xfs_filemap_page_mkwrite(
        struct vm_fault                *vmf)
{
        return __xfs_filemap_fault(vmf, 0, true);
}

/*
 * pfn_mkwrite was originally intended to ensure we capture time stamp updates
 * on write faults. In reality, it needs to serialise against truncate and
 * prepare memory for writing so handle is as standard write fault.
 */
static vm_fault_t
xfs_filemap_pfn_mkwrite(
        struct vm_fault                *vmf)
{

        return __xfs_filemap_fault(vmf, 0, true);
}

static const struct vm_operations_struct xfs_file_vm_ops = {
        .fault                = xfs_filemap_fault,
        .huge_fault        = xfs_filemap_huge_fault,
        .map_pages        = filemap_map_pages,
        .page_mkwrite        = xfs_filemap_page_mkwrite,
        .pfn_mkwrite        = xfs_filemap_pfn_mkwrite,
};

STATIC int
xfs_file_mmap(
        struct file                *file,
        struct vm_area_struct        *vma)
{
        struct inode                *inode = file_inode(file);
        struct xfs_buftarg        *target = xfs_inode_buftarg(XFS_I(inode));

        /*
         * We don't support synchronous mappings for non-DAX files and
         * for DAX files if underneath dax_device is not synchronous.
         */
        if (!daxdev_mapping_supported(vma, target->bt_daxdev))
                return -EOPNOTSUPP;

        file_accessed(file);
        vma->vm_ops = &xfs_file_vm_ops;
        if (IS_DAX(inode))
                vm_flags_set(vma, VM_HUGEPAGE);
        return 0;
}

const struct file_operations xfs_file_operations = {
        .llseek                = xfs_file_llseek,
        .read_iter        = xfs_file_read_iter,
        .write_iter        = xfs_file_write_iter,
        .splice_read        = xfs_file_splice_read,
        .splice_write        = iter_file_splice_write,
        .iopoll                = iocb_bio_iopoll,
        .unlocked_ioctl        = xfs_file_ioctl,
#ifdef CONFIG_COMPAT
        .compat_ioctl        = xfs_file_compat_ioctl,
#endif
        .mmap                = xfs_file_mmap,
        .open                = xfs_file_open,
        .release        = xfs_file_release,
        .fsync                = xfs_file_fsync,
        .get_unmapped_area = thp_get_unmapped_area,
        .fallocate        = xfs_file_fallocate,
        .fadvise        = xfs_file_fadvise,
        .remap_file_range = xfs_file_remap_range,
        .fop_flags        = FOP_MMAP_SYNC | FOP_BUFFER_RASYNC |
                          FOP_BUFFER_WASYNC | FOP_DIO_PARALLEL_WRITE,
};

const struct file_operations xfs_dir_file_operations = {
        .open                = xfs_dir_open,
        .read                = generic_read_dir,
        .iterate_shared        = xfs_file_readdir,
        .llseek                = generic_file_llseek,
        .unlocked_ioctl        = xfs_file_ioctl,
#ifdef CONFIG_COMPAT
        .compat_ioctl        = xfs_file_compat_ioctl,
#endif
        .fsync                = xfs_dir_fsync,
};
















































































  134 























   60 




























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
/* SPDX-License-Identifier: GPL-2.0 */
#undef TRACE_SYSTEM
#define TRACE_SYSTEM fuse

#if !defined(_TRACE_FUSE_H) || defined(TRACE_HEADER_MULTI_READ)
#define _TRACE_FUSE_H

#include <linux/tracepoint.h>

#define OPCODES                                                        \
        EM( FUSE_LOOKUP,                "FUSE_LOOKUP")                \
        EM( FUSE_FORGET,                "FUSE_FORGET")                \
        EM( FUSE_GETATTR,                "FUSE_GETATTR")                \
        EM( FUSE_SETATTR,                "FUSE_SETATTR")                \
        EM( FUSE_READLINK,                "FUSE_READLINK")        \
        EM( FUSE_SYMLINK,                "FUSE_SYMLINK")                \
        EM( FUSE_MKNOD,                        "FUSE_MKNOD")                \
        EM( FUSE_MKDIR,                        "FUSE_MKDIR")                \
        EM( FUSE_UNLINK,                "FUSE_UNLINK")                \
        EM( FUSE_RMDIR,                        "FUSE_RMDIR")                \
        EM( FUSE_RENAME,                "FUSE_RENAME")                \
        EM( FUSE_LINK,                        "FUSE_LINK")                \
        EM( FUSE_OPEN,                        "FUSE_OPEN")                \
        EM( FUSE_READ,                        "FUSE_READ")                \
        EM( FUSE_WRITE,                        "FUSE_WRITE")                \
        EM( FUSE_STATFS,                "FUSE_STATFS")                \
        EM( FUSE_RELEASE,                "FUSE_RELEASE")                \
        EM( FUSE_FSYNC,                        "FUSE_FSYNC")                \
        EM( FUSE_SETXATTR,                "FUSE_SETXATTR")        \
        EM( FUSE_GETXATTR,                "FUSE_GETXATTR")        \
        EM( FUSE_LISTXATTR,                "FUSE_LISTXATTR")        \
        EM( FUSE_REMOVEXATTR,                "FUSE_REMOVEXATTR")        \
        EM( FUSE_FLUSH,                        "FUSE_FLUSH")                \
        EM( FUSE_INIT,                        "FUSE_INIT")                \
        EM( FUSE_OPENDIR,                "FUSE_OPENDIR")                \
        EM( FUSE_READDIR,                "FUSE_READDIR")                \
        EM( FUSE_RELEASEDIR,                "FUSE_RELEASEDIR")        \
        EM( FUSE_FSYNCDIR,                "FUSE_FSYNCDIR")        \
        EM( FUSE_GETLK,                        "FUSE_GETLK")                \
        EM( FUSE_SETLK,                        "FUSE_SETLK")                \
        EM( FUSE_SETLKW,                "FUSE_SETLKW")                \
        EM( FUSE_ACCESS,                "FUSE_ACCESS")                \
        EM( FUSE_CREATE,                "FUSE_CREATE")                \
        EM( FUSE_INTERRUPT,                "FUSE_INTERRUPT")        \
        EM( FUSE_BMAP,                        "FUSE_BMAP")                \
        EM( FUSE_DESTROY,                "FUSE_DESTROY")                \
        EM( FUSE_IOCTL,                        "FUSE_IOCTL")                \
        EM( FUSE_POLL,                        "FUSE_POLL")                \
        EM( FUSE_NOTIFY_REPLY,                "FUSE_NOTIFY_REPLY")        \
        EM( FUSE_BATCH_FORGET,                "FUSE_BATCH_FORGET")        \
        EM( FUSE_FALLOCATE,                "FUSE_FALLOCATE")        \
        EM( FUSE_READDIRPLUS,                "FUSE_READDIRPLUS")        \
        EM( FUSE_RENAME2,                "FUSE_RENAME2")                \
        EM( FUSE_LSEEK,                        "FUSE_LSEEK")                \
        EM( FUSE_COPY_FILE_RANGE,        "FUSE_COPY_FILE_RANGE")        \
        EM( FUSE_SETUPMAPPING,                "FUSE_SETUPMAPPING")        \
        EM( FUSE_REMOVEMAPPING,                "FUSE_REMOVEMAPPING")        \
        EM( FUSE_SYNCFS,                "FUSE_SYNCFS")                \
        EM( FUSE_TMPFILE,                "FUSE_TMPFILE")                \
        EM( FUSE_STATX,                        "FUSE_STATX")                \
        EMe(CUSE_INIT,                        "CUSE_INIT")

/*
 * This will turn the above table into TRACE_DEFINE_ENUM() for each of the
 * entries.
 */
#undef EM
#undef EMe
#define EM(a, b)        TRACE_DEFINE_ENUM(a);
#define EMe(a, b)        TRACE_DEFINE_ENUM(a);

OPCODES

/* Now we redfine it with the table that __print_symbolic needs. */
#undef EM
#undef EMe
#define EM(a, b)        {a, b},
#define EMe(a, b)        {a, b}

TRACE_EVENT(fuse_request_send,
        TP_PROTO(const struct fuse_req *req),

        TP_ARGS(req),

        TP_STRUCT__entry(
                __field(dev_t,                        connection)
                __field(uint64_t,                unique)
                __field(enum fuse_opcode,        opcode)
                __field(uint32_t,                len)
        ),

        TP_fast_assign(
                __entry->connection        =        req->fm->fc->dev;
                __entry->unique                =        req->in.h.unique;
                __entry->opcode                =        req->in.h.opcode;
                __entry->len                =        req->in.h.len;
        ),

        TP_printk("connection %u req %llu opcode %u (%s) len %u ",
                  __entry->connection, __entry->unique, __entry->opcode,
                  __print_symbolic(__entry->opcode, OPCODES), __entry->len)
);

TRACE_EVENT(fuse_request_end,
        TP_PROTO(const struct fuse_req *req),

        TP_ARGS(req),

        TP_STRUCT__entry(
                __field(dev_t,                connection)
                __field(uint64_t,        unique)
                __field(uint32_t,        len)
                __field(int32_t,        error)
        ),

        TP_fast_assign(
                __entry->connection        =        req->fm->fc->dev;
                __entry->unique                =        req->in.h.unique;
                __entry->len                =        req->out.h.len;
                __entry->error                =        req->out.h.error;
        ),

        TP_printk("connection %u req %llu len %u error %d", __entry->connection,
                  __entry->unique, __entry->len, __entry->error)
);

#endif /* _TRACE_FUSE_H */

#undef TRACE_INCLUDE_PATH
#define TRACE_INCLUDE_PATH .
#define TRACE_INCLUDE_FILE fuse_trace
#include <trace/define_trace.h>





















































































































































































 1325 
 1329 



























  172 

  171 
  172 


  170 









   19 

















    7 

  172 
   19 


  178 





























  179 
























  199 






























  186 

    8 




  197 




   21 











  179 
  178 





  198 











  199 






  141 
   57 





    4 







  199 



    4 


    4 








    1 
  198 


    9 



  291 





















  266 




  264 






   24 






   24 















  247 



  247 
  235 











































































































  605 





  377 

   11 

  366 

















































  436 





    5 


    1 
    6 






    3 





















    3 

    3 

    3 







































































































































































































































































































































































  869 











  869 



  867 


















































































































































































































































































































































































  196 


















































   57 
   48 
   13 





   57 

   57 


  183 









   13 


  229 


  235 


























  115 





  116 



  235 
  236 






  235 



   30 




  221 

































  238 


   26 




  237 



























































  247 





  247 
   13 


  247 







  247 
   13 























  260 
    6 









  219 



  247 


  262 















  270 







   10 

  262 


  270 

















  272 









  270 




  271 





  272 

  270 







  269 









  197 
   82 

  271 















    3 

    2 




  271 




























  199 









  197 



  199 


  198 

  199 
  199 













   75 







   76 

   76 
   76 





   76 

   76 

























   12 









   12 


   12 



   12 













































   12 
   12 









   12 







   12 
   12 





   12 




   12 


   12 



























































   12 


   12 








   12 











   12 



   12 
























   12 





   12 

   12 


   12 





































































































































































































































































































































































































































































































































































































































  252 
  249 

  252 













  250 

  251 


  252 





  252 















  252 
  249 
  249 















  253 

  252 

  247 














  251 
  251 















  253 



  251 


























  251 




  253 











  250 





















  253 



  251 













  250 





















































































































































 1611 
  473 















   75 





   75 






   14 







    1 

   67 









   72 


   72 

   72 












   68 
   17 










    5 


   69 


   52 

















   29 




   29 


   29 











   28 


   29 












  174 





















    2 



  856 

    2 
  223 




    2 
  223 

































  212 

  211 
    1 
  211 
   98 







  211 


    1 


















  212 




  212 







    1 




  210 



  212 







  212 












  212 
  211 

  211 






















    1 





  212 





  212 

  211 
    1 
  211 

    1 
    1 


  212 





























   25 
   24 













   25 





































    1 


   30 
   30 








    8 



   25 









   26 














    1 











    1 





    1 











































  243 






  242 
























  244 







   35 





  239 









   31 










    4 
    3 





    3 








  212 

    1 


  212 













   21 



   91 
























    6 





    6 


    6 


























   19 









  766 
   75 
























  834 











  836 


























































































 1595 

  455 
































































































































































































































































































































































































































































































































































































































































































































  824 

  822 









































































 1589 





  954 





  954 







  954 







  824 
  126 


  828 





  828 







  826 

  828 


  825 




  823 




















  827 





 1595 





 1590 














  213 



















  200 

   22 




  188 



   86 
















    1 

   86 



















    4 
    4 






    4 


    4 





































































  388 






  388 






  336 
   51 



   51 






  388 





























   85 





   52 













   80 

    6 



   73 
   20 

    4 




   20 




   85 
   85 






   81 

    4 




























   85 











   85 




   85 
















































































  361 

   32 



  384 



  384 








    7 



















    7 
  385 
  385 



  149 




  141 



   33 

   33 












    1 
    1 









    1 


















    1 














   49 


   54 





   16 


   49 

    6 












   52 









































  391 

    1 

   65 


  429 
   45 








    2 










    2 






    2 








    2 


    2 



    2 


    2 









    2 


    2 
    2 


    2 
    2 
















































    2 


















    2 





    2 

    2 


    2 




    2 



    2 
































    2 





    2 


    2 



































































































 2053 









  316 















  247 
 1975 





 2030 

  245 



    2 








  244 


    2 





















    2 


















 2061 












 2062 



 2054 
   30 








 2058 
















 2059 







 2055 
  316 














 2052 








































 2070 
















  125 



















  201 



   65 

 1827 



































 1335 




  955 

























 2063 







 2066 



 2073 












 1852 
  231 




    7 

 2068 













 1853 
  232 






  233 



 2074 










 2507 
























































 2497 


 2507 



 1876 






  700 















































  417 



  419 


  187 























  231 





  187 

























































   30 







   30 





































































































































































































































   13 



   13 



   13 


   13 



   13 



   13 








































   13 


   13 





   13 


















   13 






















































 10419 
    2 




 10423 




























   11 





















   11 









































   11 
   11 

   11 


   11 



































































































  318 





  318 




  170 





  251 
  242 
    6 



  252 
  246 
    6 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014
4015
4016
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214
4215
4216
4217
4218
4219
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
4249
4250
4251
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287
4288
4289
4290
4291
4292
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379
4380
4381
4382
4383
4384
4385
4386
4387
4388
4389
4390
4391
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404
4405
4406
4407
4408
4409
4410
4411
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485
4486
4487
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524
4525
4526
4527
4528
4529
4530
4531
4532
4533
4534
4535
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607
4608
4609
4610
4611
4612
4613
4614
4615
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637
4638
4639
4640
4641
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713
4714
4715
4716
4717
4718
4719
4720
4721
4722
4723
4724
4725
4726
4727
4728
4729
4730
4731
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826
4827
4828
4829
4830
4831
4832
4833
4834
4835
4836
4837
4838
4839
4840
4841
4842
4843
4844
4845
4846
4847
4848
4849
4850
4851
4852
4853
4854
4855
4856
4857
4858
4859
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962
4963
4964
4965
4966
4967
4968
4969
4970
4971
4972
4973
4974
4975
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
5080
5081
5082
5083
5084
5085
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139
5140
5141
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170
5171
5172
5173
5174
5175
5176
5177
5178
5179
5180
5181
5182
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
5198
5199
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209
5210
5211
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225
5226
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252
5253
5254
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284
5285
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335
5336
5337
5338
5339
5340
5341
5342
5343
5344
5345
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358
5359
5360
5361
5362
5363
5364
5365
5366
5367
5368
5369
5370
5371
5372
5373
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396
5397
5398
5399
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411
5412
5413
5414
5415
5416
5417
5418
5419
5420
5421
5422
5423
5424
5425
5426
5427
5428
5429
5430
5431
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513
5514
5515
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529
5530
5531
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
5545
5546
5547
5548
5549
5550
5551
5552
5553
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
5585
5586
5587
5588
5589
5590
5591
5592
5593
5594
5595
5596
5597
5598
5599
5600
5601
5602
5603
5604
5605
5606
5607
5608
5609
5610
5611
5612
5613
5614
5615
5616
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629
5630
5631
5632
5633
5634
5635
5636
5637
5638
5639
5640
5641
5642
5643
5644
5645
5646
5647
5648
5649
5650
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662
5663
5664
5665
5666
5667
5668
5669
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679
5680
5681
5682
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699
5700
5701
5702
5703
5704
5705
5706
5707
5708
5709
5710
5711
5712
5713
5714
5715
5716
5717
5718
5719
5720
5721
5722
5723
5724
5725
5726
5727
5728
5729
5730
5731
5732
5733
5734
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751
5752
5753
5754
5755
5756
5757
5758
5759
5760
5761
5762
5763
5764
5765
5766
5767
5768
5769
5770
5771
5772
5773
5774
5775
5776
5777
5778
5779
5780
5781
5782
5783
5784
5785
5786
5787
5788
5789
5790
5791
5792
5793
5794
5795
5796
5797
5798
5799
5800
5801
5802
5803
5804
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
5815
5816
5817
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827
5828
5829
5830
5831
5832
5833
5834
5835
5836
5837
5838
5839
5840
5841
5842
5843
5844
5845
5846
5847
5848
5849
5850
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865
5866
5867
5868
5869
5870
5871
5872
5873
5874
5875
5876
5877
5878
5879
5880
5881
5882
5883
5884
5885
5886
5887
5888
5889
5890
5891
5892
5893
5894
5895
5896
5897
5898
5899
5900
5901
5902
5903
5904
5905
5906
5907
5908
5909
5910
5911
5912
5913
5914
5915
5916
5917
5918
5919
5920
5921
5922
5923
5924
5925
5926
5927
5928
5929
5930
5931
5932
5933
5934
5935
5936
5937
5938
5939
5940
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
5959
5960
5961
5962
5963
5964
5965
5966
5967
5968
5969
5970
5971
5972
5973
5974
5975
5976
5977
5978
5979
5980
5981
5982
5983
5984
5985
5986
5987
5988
5989
5990
5991
5992
5993
5994
5995
5996
5997
5998
5999
6000
6001
6002
6003
6004
6005
6006
6007
6008
6009
6010
6011
6012
6013
6014
6015
6016
6017
6018
6019
6020
6021
6022
6023
6024
6025
6026
6027
6028
6029
6030
6031
6032
6033
6034
6035
6036
6037
6038
6039
6040
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074
6075
6076
6077
6078
6079
6080
6081
6082
6083
6084
6085
6086
6087
6088
6089
6090
6091
6092
6093
6094
6095
6096
6097
6098
6099
6100
6101
6102
6103
6104
6105
6106
6107
6108
6109
6110
6111
6112
6113
6114
6115
6116
6117
6118
6119
6120
6121
6122
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
6135
6136
6137
6138
6139
6140
6141
6142
6143
6144
6145
6146
6147
6148
6149
6150
6151
6152
6153
6154
6155
6156
6157
6158
6159
6160
6161
6162
6163
6164
6165
6166
6167
6168
6169
6170
6171
6172
6173
6174
6175
6176
6177
6178
6179
6180
6181
6182
6183
6184
6185
6186
6187
6188
6189
6190
6191
6192
6193
6194
6195
6196
6197
6198
6199
6200
6201
6202
6203
6204
6205
6206
6207
6208
6209
6210
6211
6212
6213
6214
6215
6216
6217
6218
6219
6220
6221
6222
6223
6224
6225
6226
6227
6228
6229
6230
6231
6232
6233
6234
6235
6236
6237
6238
6239
6240
6241
6242
6243
6244
6245
6246
6247
6248
6249
6250
6251
6252
6253
6254
6255
6256
6257
6258
6259
6260
6261
6262
6263
6264
6265
6266
6267
6268
6269
6270
6271
6272
6273
6274
6275
6276
6277
6278
6279
6280
6281
6282
6283
6284
6285
6286
6287
6288
6289
6290
6291
6292
6293
6294
6295
6296
6297
6298
6299
6300
6301
6302
6303
6304
6305
6306
6307
6308
6309
6310
6311
6312
6313
6314
6315
6316
6317
6318
6319
6320
6321
6322
6323
6324
6325
6326
6327
6328
6329
6330
6331
6332
6333
6334
6335
6336
6337
6338
6339
6340
6341
6342
6343
6344
6345
6346
6347
6348
6349
6350
6351
6352
6353
6354
6355
6356
6357
6358
6359
6360
6361
6362
6363
6364
6365
6366
6367
6368
6369
6370
6371
6372
6373
6374
6375
6376
6377
6378
6379
6380
6381
6382
6383
6384
6385
6386
6387
6388
6389
6390
6391
6392
6393
6394
6395
6396
6397
6398
6399
6400
6401
6402
6403
6404
6405
6406
6407
6408
6409
6410
6411
6412
6413
6414
6415
6416
6417
6418
6419
6420
6421
6422
6423
6424
6425
6426
6427
6428
6429
6430
6431
6432
6433
6434
6435
6436
6437
6438
6439
6440
6441
6442
6443
6444
6445
6446
6447
6448
6449
6450
6451
6452
6453
6454
6455
6456
6457
6458
6459
6460
6461
6462
6463
6464
6465
6466
6467
6468
6469
6470
6471
6472
6473
6474
6475
6476
6477
6478
6479
6480
6481
6482
6483
6484
6485
6486
6487
6488
6489
6490
6491
6492
6493
6494
6495
6496
6497
6498
6499
6500
6501
6502
6503
6504
6505
6506
6507
6508
6509
6510
6511
6512
6513
6514
6515
6516
6517
6518
6519
6520
6521
6522
6523
6524
6525
6526
6527
6528
6529
6530
6531
6532
6533
6534
6535
6536
6537
6538
6539
6540
6541
6542
6543
6544
6545
6546
6547
6548
6549
6550
6551
6552
6553
6554
6555
6556
6557
6558
6559
6560
6561
6562
6563
6564
6565
6566
6567
6568
6569
6570
6571
6572
6573
6574
6575
6576
6577
6578
6579
6580
6581
6582
6583
6584
6585
6586
6587
6588
6589
6590
6591
6592
6593
6594
6595
6596
6597
6598
6599
6600
6601
6602
6603
6604
6605
6606
6607
6608
6609
6610
6611
6612
6613
6614
6615
6616
6617
6618
6619
6620
6621
6622
6623
6624
6625
6626
6627
6628
6629
6630
6631
6632
6633
6634
6635
6636
6637
6638
6639
6640
6641
6642
6643
6644
6645
6646
6647
6648
6649
6650
6651
6652
6653
6654
6655
6656
6657
6658
6659
6660
6661
6662
6663
6664
6665
6666
6667
6668
6669
6670
6671
6672
6673
6674
6675
6676
6677
6678
6679
6680
6681
6682
6683
6684
6685
6686
6687
6688
6689
6690
6691
6692
6693
6694
6695
6696
6697
6698
6699
6700
6701
6702
6703
6704
6705
6706
6707
6708
6709
6710
6711
6712
6713
6714
6715
6716
6717
6718
6719
6720
6721
6722
6723
6724
6725
6726
6727
6728
6729
6730
6731
6732
6733
6734
6735
6736
6737
6738
6739
6740
6741
6742
6743
6744
6745
6746
6747
6748
6749
6750
6751
6752
6753
6754
6755
6756
6757
6758
6759
6760
6761
6762
6763
6764
6765
6766
6767
6768
6769
6770
6771
6772
6773
6774
6775
6776
6777
6778
6779
6780
6781
6782
6783
6784
6785
6786
6787
6788
6789
6790
6791
6792
6793
6794
6795
6796
6797
6798
6799
6800
6801
6802
6803
6804
6805
6806
6807
6808
6809
6810
6811
6812
6813
6814
6815
6816
6817
6818
6819
6820
6821
6822
6823
6824
6825
6826
6827
6828
6829
6830
6831
6832
6833
6834
6835
6836
6837
6838
6839
6840
6841
6842
6843
6844
6845
6846
6847
6848
6849
6850
6851
6852
6853
6854
6855
6856
6857
6858
6859
6860
6861
6862
6863
6864
6865
6866
6867
6868
6869
6870
6871
6872
6873
6874
6875
6876
6877
6878
6879
6880
6881
6882
6883
6884
6885
6886
6887
6888
6889
6890
6891
6892
6893
6894
6895
6896
6897
6898
6899
6900
6901
6902
6903
6904
6905
6906
6907
6908
6909
6910
6911
6912
6913
6914
6915
6916
6917
6918
6919
6920
6921
6922
6923
6924
6925

// SPDX-License-Identifier: GPL-2.0-only
/*
 *  linux/mm/memory.c
 *
 *  Copyright (C) 1991, 1992, 1993, 1994  Linus Torvalds
 */

/*
 * demand-loading started 01.12.91 - seems it is high on the list of
 * things wanted, and it should be easy to implement. - Linus
 */

/*
 * Ok, demand-loading was easy, shared pages a little bit tricker. Shared
 * pages started 02.12.91, seems to work. - Linus.
 *
 * Tested sharing by executing about 30 /bin/sh: under the old kernel it
 * would have taken more than the 6M I have free, but it worked well as
 * far as I could see.
 *
 * Also corrected some "invalidate()"s - I wasn't doing enough of them.
 */

/*
 * Real VM (paging to/from disk) started 18.12.91. Much more work and
 * thought has to go into this. Oh, well..
 * 19.12.91  -  works, somewhat. Sometimes I get faults, don't know why.
 *                Found it. Everything seems to work now.
 * 20.12.91  -  Ok, making the swap-device changeable like the root.
 */

/*
 * 05.04.94  -  Multi-page memory management added for v1.1.
 *              Idea by Alex Bligh (alex@cconcepts.co.uk)
 *
 * 16.07.99  -  Support of BIGMEM added by Gerhard Wichert, Siemens AG
 *                (Gerhard.Wichert@pdb.siemens.de)
 *
 * Aug/Sep 2004 Changed to four level page tables (Andi Kleen)
 */

#include <linux/kernel_stat.h>
#include <linux/mm.h>
#include <linux/mm_inline.h>
#include <linux/sched/mm.h>
#include <linux/sched/coredump.h>
#include <linux/sched/numa_balancing.h>
#include <linux/sched/task.h>
#include <linux/hugetlb.h>
#include <linux/mman.h>
#include <linux/swap.h>
#include <linux/highmem.h>
#include <linux/pagemap.h>
#include <linux/memremap.h>
#include <linux/kmsan.h>
#include <linux/ksm.h>
#include <linux/rmap.h>
#include <linux/export.h>
#include <linux/delayacct.h>
#include <linux/init.h>
#include <linux/pfn_t.h>
#include <linux/writeback.h>
#include <linux/memcontrol.h>
#include <linux/mmu_notifier.h>
#include <linux/swapops.h>
#include <linux/elf.h>
#include <linux/gfp.h>
#include <linux/migrate.h>
#include <linux/string.h>
#include <linux/memory-tiers.h>
#include <linux/debugfs.h>
#include <linux/userfaultfd_k.h>
#include <linux/dax.h>
#include <linux/oom.h>
#include <linux/numa.h>
#include <linux/perf_event.h>
#include <linux/ptrace.h>
#include <linux/vmalloc.h>
#include <linux/sched/sysctl.h>

#include <trace/events/kmem.h>

#include <asm/io.h>
#include <asm/mmu_context.h>
#include <asm/pgalloc.h>
#include <linux/uaccess.h>
#include <asm/tlb.h>
#include <asm/tlbflush.h>

#include "pgalloc-track.h"
#include "internal.h"
#include "swap.h"

#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST)
#warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid.
#endif

#ifndef CONFIG_NUMA
unsigned long max_mapnr;
EXPORT_SYMBOL(max_mapnr);

struct page *mem_map;
EXPORT_SYMBOL(mem_map);
#endif

static vm_fault_t do_fault(struct vm_fault *vmf);
static vm_fault_t do_anonymous_page(struct vm_fault *vmf);
static bool vmf_pte_changed(struct vm_fault *vmf);

/*
 * Return true if the original pte was a uffd-wp pte marker (so the pte was
 * wr-protected).
 */
static __always_inline bool vmf_orig_pte_uffd_wp(struct vm_fault *vmf)
{
        if (!userfaultfd_wp(vmf->vma))
                return false;
        if (!(vmf->flags & FAULT_FLAG_ORIG_PTE_VALID))
                return false;

        return pte_marker_uffd_wp(vmf->orig_pte);
}

/*
 * A number of key systems in x86 including ioremap() rely on the assumption
 * that high_memory defines the upper bound on direct map memory, then end
 * of ZONE_NORMAL.
 */
void *high_memory;
EXPORT_SYMBOL(high_memory);

/*
 * Randomize the address space (stacks, mmaps, brk, etc.).
 *
 * ( When CONFIG_COMPAT_BRK=y we exclude brk from randomization,
 *   as ancient (libc5 based) binaries can segfault. )
 */
int randomize_va_space __read_mostly =
#ifdef CONFIG_COMPAT_BRK
                                        1;
#else
                                        2;
#endif

#ifndef arch_wants_old_prefaulted_pte
static inline bool arch_wants_old_prefaulted_pte(void)
{
        /*
         * Transitioning a PTE from 'old' to 'young' can be expensive on
         * some architectures, even if it's performed in hardware. By
         * default, "false" means prefaulted entries will be 'young'.
         */
        return false;
}
#endif

static int __init disable_randmaps(char *s)
{
        randomize_va_space = 0;
        return 1;
}
__setup("norandmaps", disable_randmaps);

unsigned long zero_pfn __read_mostly;
EXPORT_SYMBOL(zero_pfn);

unsigned long highest_memmap_pfn __read_mostly;

/*
 * CONFIG_MMU architectures set up ZERO_PAGE in their paging_init()
 */
static int __init init_zero_pfn(void)
{
        zero_pfn = page_to_pfn(ZERO_PAGE(0));
        return 0;
}
early_initcall(init_zero_pfn);

void mm_trace_rss_stat(struct mm_struct *mm, int member)
{
        trace_rss_stat(mm, member);
}

/*
 * Note: this doesn't free the actual pages themselves. That
 * has been handled earlier when unmapping all the memory regions.
 */
static void free_pte_range(struct mmu_gather *tlb, pmd_t *pmd,
                           unsigned long addr)
{
        pgtable_t token = pmd_pgtable(*pmd);
        pmd_clear(pmd);
        pte_free_tlb(tlb, token, addr);
        mm_dec_nr_ptes(tlb->mm);
}

static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
                                unsigned long addr, unsigned long end,
                                unsigned long floor, unsigned long ceiling)
{
        pmd_t *pmd;
        unsigned long next;
        unsigned long start;

        start = addr;
        pmd = pmd_offset(pud, addr);
        do {
                next = pmd_addr_end(addr, end);
                if (pmd_none_or_clear_bad(pmd))
                        continue;
                free_pte_range(tlb, pmd, addr);
        } while (pmd++, addr = next, addr != end);

        start &= PUD_MASK;
        if (start < floor)
                return;
        if (ceiling) {
                ceiling &= PUD_MASK;
                if (!ceiling)
                        return;
        }
        if (end - 1 > ceiling - 1)
                return;

        pmd = pmd_offset(pud, start);
        pud_clear(pud);
        pmd_free_tlb(tlb, pmd, start);
        mm_dec_nr_pmds(tlb->mm);
}

static inline void free_pud_range(struct mmu_gather *tlb, p4d_t *p4d,
                                unsigned long addr, unsigned long end,
                                unsigned long floor, unsigned long ceiling)
{
        pud_t *pud;
        unsigned long next;
        unsigned long start;

        start = addr;
        pud = pud_offset(p4d, addr);
        do {
                next = pud_addr_end(addr, end);
                if (pud_none_or_clear_bad(pud))
                        continue;
                free_pmd_range(tlb, pud, addr, next, floor, ceiling);
        } while (pud++, addr = next, addr != end);

        start &= P4D_MASK;
        if (start < floor)
                return;
        if (ceiling) {
                ceiling &= P4D_MASK;
                if (!ceiling)
                        return;
        }
        if (end - 1 > ceiling - 1)
                return;

        pud = pud_offset(p4d, start);
        p4d_clear(p4d);
        pud_free_tlb(tlb, pud, start);
        mm_dec_nr_puds(tlb->mm);
}

static inline void free_p4d_range(struct mmu_gather *tlb, pgd_t *pgd,
                                unsigned long addr, unsigned long end,
                                unsigned long floor, unsigned long ceiling)
{
        p4d_t *p4d;
        unsigned long next;
        unsigned long start;

        start = addr;
        p4d = p4d_offset(pgd, addr);
        do {
                next = p4d_addr_end(addr, end);
                if (p4d_none_or_clear_bad(p4d))
                        continue;
                free_pud_range(tlb, p4d, addr, next, floor, ceiling);
        } while (p4d++, addr = next, addr != end);

        start &= PGDIR_MASK;
        if (start < floor)
                return;
        if (ceiling) {
                ceiling &= PGDIR_MASK;
                if (!ceiling)
                        return;
        }
        if (end - 1 > ceiling - 1)
                return;

        p4d = p4d_offset(pgd, start);
        pgd_clear(pgd);
        p4d_free_tlb(tlb, p4d, start);
}

/*
 * This function frees user-level page tables of a process.
 */
void free_pgd_range(struct mmu_gather *tlb,
                        unsigned long addr, unsigned long end,
                        unsigned long floor, unsigned long ceiling)
{
        pgd_t *pgd;
        unsigned long next;

        /*
         * The next few lines have given us lots of grief...
         *
         * Why are we testing PMD* at this top level?  Because often
         * there will be no work to do at all, and we'd prefer not to
         * go all the way down to the bottom just to discover that.
         *
         * Why all these "- 1"s?  Because 0 represents both the bottom
         * of the address space and the top of it (using -1 for the
         * top wouldn't help much: the masks would do the wrong thing).
         * The rule is that addr 0 and floor 0 refer to the bottom of
         * the address space, but end 0 and ceiling 0 refer to the top
         * Comparisons need to use "end - 1" and "ceiling - 1" (though
         * that end 0 case should be mythical).
         *
         * Wherever addr is brought up or ceiling brought down, we must
         * be careful to reject "the opposite 0" before it confuses the
         * subsequent tests.  But what about where end is brought down
         * by PMD_SIZE below? no, end can't go down to 0 there.
         *
         * Whereas we round start (addr) and ceiling down, by different
         * masks at different levels, in order to test whether a table
         * now has no other vmas using it, so can be freed, we don't
         * bother to round floor or end up - the tests don't need that.
         */

        addr &= PMD_MASK;
        if (addr < floor) {
                addr += PMD_SIZE;
                if (!addr)
                        return;
        }
        if (ceiling) {
                ceiling &= PMD_MASK;
                if (!ceiling)
                        return;
        }
        if (end - 1 > ceiling - 1)
                end -= PMD_SIZE;
        if (addr > end - 1)
                return;
        /*
         * We add page table cache pages with PAGE_SIZE,
         * (see pte_free_tlb()), flush the tlb if we need
         */
        tlb_change_page_size(tlb, PAGE_SIZE);
        pgd = pgd_offset(tlb->mm, addr);
        do {
                next = pgd_addr_end(addr, end);
                if (pgd_none_or_clear_bad(pgd))
                        continue;
                free_p4d_range(tlb, pgd, addr, next, floor, ceiling);
        } while (pgd++, addr = next, addr != end);
}

void free_pgtables(struct mmu_gather *tlb, struct ma_state *mas,
                   struct vm_area_struct *vma, unsigned long floor,
                   unsigned long ceiling, bool mm_wr_locked)
{
        struct unlink_vma_file_batch vb;

        do {
                unsigned long addr = vma->vm_start;
                struct vm_area_struct *next;

                /*
                 * Note: USER_PGTABLES_CEILING may be passed as ceiling and may
                 * be 0.  This will underflow and is okay.
                 */
                next = mas_find(mas, ceiling - 1);
                if (unlikely(xa_is_zero(next)))
                        next = NULL;

                /*
                 * Hide vma from rmap and truncate_pagecache before freeing
                 * pgtables
                 */
                if (mm_wr_locked)
                        vma_start_write(vma);
                unlink_anon_vmas(vma);

                if (is_vm_hugetlb_page(vma)) {
                        unlink_file_vma(vma);
                        hugetlb_free_pgd_range(tlb, addr, vma->vm_end,
                                floor, next ? next->vm_start : ceiling);
                } else {
                        unlink_file_vma_batch_init(&vb);
                        unlink_file_vma_batch_add(&vb, vma);

                        /*
                         * Optimization: gather nearby vmas into one call down
                         */
                        while (next && next->vm_start <= vma->vm_end + PMD_SIZE
                               && !is_vm_hugetlb_page(next)) {
                                vma = next;
                                next = mas_find(mas, ceiling - 1);
                                if (unlikely(xa_is_zero(next)))
                                        next = NULL;
                                if (mm_wr_locked)
                                        vma_start_write(vma);
                                unlink_anon_vmas(vma);
                                unlink_file_vma_batch_add(&vb, vma);
                        }
                        unlink_file_vma_batch_final(&vb);
                        free_pgd_range(tlb, addr, vma->vm_end,
                                floor, next ? next->vm_start : ceiling);
                }
                vma = next;
        } while (vma);
}

void pmd_install(struct mm_struct *mm, pmd_t *pmd, pgtable_t *pte)
{
        spinlock_t *ptl = pmd_lock(mm, pmd);

        if (likely(pmd_none(*pmd))) {        /* Has another populated it ? */
                mm_inc_nr_ptes(mm);
                /*
                 * Ensure all pte setup (eg. pte page lock and page clearing) are
                 * visible before the pte is made visible to other CPUs by being
                 * put into page tables.
                 *
                 * The other side of the story is the pointer chasing in the page
                 * table walking code (when walking the page table without locking;
                 * ie. most of the time). Fortunately, these data accesses consist
                 * of a chain of data-dependent loads, meaning most CPUs (alpha
                 * being the notable exception) will already guarantee loads are
                 * seen in-order. See the alpha page table accessors for the
                 * smp_rmb() barriers in page table walking code.
                 */
                smp_wmb(); /* Could be smp_wmb__xxx(before|after)_spin_lock */
                pmd_populate(mm, pmd, *pte);
                *pte = NULL;
        }
        spin_unlock(ptl);
}

int __pte_alloc(struct mm_struct *mm, pmd_t *pmd)
{
        pgtable_t new = pte_alloc_one(mm);
        if (!new)
                return -ENOMEM;

        pmd_install(mm, pmd, &new);
        if (new)
                pte_free(mm, new);
        return 0;
}

int __pte_alloc_kernel(pmd_t *pmd)
{
        pte_t *new = pte_alloc_one_kernel(&init_mm);
        if (!new)
                return -ENOMEM;

        spin_lock(&init_mm.page_table_lock);
        if (likely(pmd_none(*pmd))) {        /* Has another populated it ? */
                smp_wmb(); /* See comment in pmd_install() */
                pmd_populate_kernel(&init_mm, pmd, new);
                new = NULL;
        }
        spin_unlock(&init_mm.page_table_lock);
        if (new)
                pte_free_kernel(&init_mm, new);
        return 0;
}

static inline void init_rss_vec(int *rss)
{
        memset(rss, 0, sizeof(int) * NR_MM_COUNTERS);
}

static inline void add_mm_rss_vec(struct mm_struct *mm, int *rss)
{
        int i;

        for (i = 0; i < NR_MM_COUNTERS; i++)
                if (rss[i])
                        add_mm_counter(mm, i, rss[i]);
}

/*
 * This function is called to print an error when a bad pte
 * is found. For example, we might have a PFN-mapped pte in
 * a region that doesn't allow it.
 *
 * The calling function must still handle the error.
 */
static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr,
                          pte_t pte, struct page *page)
{
        pgd_t *pgd = pgd_offset(vma->vm_mm, addr);
        p4d_t *p4d = p4d_offset(pgd, addr);
        pud_t *pud = pud_offset(p4d, addr);
        pmd_t *pmd = pmd_offset(pud, addr);
        struct address_space *mapping;
        pgoff_t index;
        static unsigned long resume;
        static unsigned long nr_shown;
        static unsigned long nr_unshown;

        /*
         * Allow a burst of 60 reports, then keep quiet for that minute;
         * or allow a steady drip of one report per second.
         */
        if (nr_shown == 60) {
                if (time_before(jiffies, resume)) {
                        nr_unshown++;
                        return;
                }
                if (nr_unshown) {
                        pr_alert("BUG: Bad page map: %lu messages suppressed\n",
                                 nr_unshown);
                        nr_unshown = 0;
                }
                nr_shown = 0;
        }
        if (nr_shown++ == 0)
                resume = jiffies + 60 * HZ;

        mapping = vma->vm_file ? vma->vm_file->f_mapping : NULL;
        index = linear_page_index(vma, addr);

        pr_alert("BUG: Bad page map in process %s  pte:%08llx pmd:%08llx\n",
                 current->comm,
                 (long long)pte_val(pte), (long long)pmd_val(*pmd));
        if (page)
                dump_page(page, "bad pte");
        pr_alert("addr:%px vm_flags:%08lx anon_vma:%px mapping:%px index:%lx\n",
                 (void *)addr, vma->vm_flags, vma->anon_vma, mapping, index);
        pr_alert("file:%pD fault:%ps mmap:%ps read_folio:%ps\n",
                 vma->vm_file,
                 vma->vm_ops ? vma->vm_ops->fault : NULL,
                 vma->vm_file ? vma->vm_file->f_op->mmap : NULL,
                 mapping ? mapping->a_ops->read_folio : NULL);
        dump_stack();
        add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
}

/*
 * vm_normal_page -- This function gets the "struct page" associated with a pte.
 *
 * "Special" mappings do not wish to be associated with a "struct page" (either
 * it doesn't exist, or it exists but they don't want to touch it). In this
 * case, NULL is returned here. "Normal" mappings do have a struct page.
 *
 * There are 2 broad cases. Firstly, an architecture may define a pte_special()
 * pte bit, in which case this function is trivial. Secondly, an architecture
 * may not have a spare pte bit, which requires a more complicated scheme,
 * described below.
 *
 * A raw VM_PFNMAP mapping (ie. one that is not COWed) is always considered a
 * special mapping (even if there are underlying and valid "struct pages").
 * COWed pages of a VM_PFNMAP are always normal.
 *
 * The way we recognize COWed pages within VM_PFNMAP mappings is through the
 * rules set up by "remap_pfn_range()": the vma will have the VM_PFNMAP bit
 * set, and the vm_pgoff will point to the first PFN mapped: thus every special
 * mapping will always honor the rule
 *
 *        pfn_of_page == vma->vm_pgoff + ((addr - vma->vm_start) >> PAGE_SHIFT)
 *
 * And for normal mappings this is false.
 *
 * This restricts such mappings to be a linear translation from virtual address
 * to pfn. To get around this restriction, we allow arbitrary mappings so long
 * as the vma is not a COW mapping; in that case, we know that all ptes are
 * special (because none can have been COWed).
 *
 *
 * In order to support COW of arbitrary special mappings, we have VM_MIXEDMAP.
 *
 * VM_MIXEDMAP mappings can likewise contain memory with or without "struct
 * page" backing, however the difference is that _all_ pages with a struct
 * page (that is, those where pfn_valid is true) are refcounted and considered
 * normal pages by the VM. The only exception are zeropages, which are
 * *never* refcounted.
 *
 * The disadvantage is that pages are refcounted (which can be slower and
 * simply not an option for some PFNMAP users). The advantage is that we
 * don't have to follow the strict linearity rule of PFNMAP mappings in
 * order to support COWable mappings.
 *
 */
struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
                            pte_t pte)
{
        unsigned long pfn = pte_pfn(pte);

        if (IS_ENABLED(CONFIG_ARCH_HAS_PTE_SPECIAL)) {
                if (likely(!pte_special(pte)))
                        goto check_pfn;
                if (vma->vm_ops && vma->vm_ops->find_special_page)
                        return vma->vm_ops->find_special_page(vma, addr);
                if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
                        return NULL;
                if (is_zero_pfn(pfn))
                        return NULL;
                if (pte_devmap(pte))
                /*
                 * NOTE: New users of ZONE_DEVICE will not set pte_devmap()
                 * and will have refcounts incremented on their struct pages
                 * when they are inserted into PTEs, thus they are safe to
                 * return here. Legacy ZONE_DEVICE pages that set pte_devmap()
                 * do not have refcounts. Example of legacy ZONE_DEVICE is
                 * MEMORY_DEVICE_FS_DAX type in pmem or virtio_fs drivers.
                 */
                        return NULL;

                print_bad_pte(vma, addr, pte, NULL);
                return NULL;
        }

        /* !CONFIG_ARCH_HAS_PTE_SPECIAL case follows: */

        if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
                if (vma->vm_flags & VM_MIXEDMAP) {
                        if (!pfn_valid(pfn))
                                return NULL;
                        if (is_zero_pfn(pfn))
                                return NULL;
                        goto out;
                } else {
                        unsigned long off;
                        off = (addr - vma->vm_start) >> PAGE_SHIFT;
                        if (pfn == vma->vm_pgoff + off)
                                return NULL;
                        if (!is_cow_mapping(vma->vm_flags))
                                return NULL;
                }
        }

        if (is_zero_pfn(pfn))
                return NULL;

check_pfn:
        if (unlikely(pfn > highest_memmap_pfn)) {
                print_bad_pte(vma, addr, pte, NULL);
                return NULL;
        }

        /*
         * NOTE! We still have PageReserved() pages in the page tables.
         * eg. VDSO mappings can cause them to exist.
         */
out:
        VM_WARN_ON_ONCE(is_zero_pfn(pfn));
        return pfn_to_page(pfn);
}

struct folio *vm_normal_folio(struct vm_area_struct *vma, unsigned long addr,
                            pte_t pte)
{
        struct page *page = vm_normal_page(vma, addr, pte);

        if (page)
                return page_folio(page);
        return NULL;
}

#ifdef CONFIG_PGTABLE_HAS_HUGE_LEAVES
struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr,
                                pmd_t pmd)
{
        unsigned long pfn = pmd_pfn(pmd);

        /* Currently it's only used for huge pfnmaps */
        if (unlikely(pmd_special(pmd)))
                return NULL;

        if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
                if (vma->vm_flags & VM_MIXEDMAP) {
                        if (!pfn_valid(pfn))
                                return NULL;
                        goto out;
                } else {
                        unsigned long off;
                        off = (addr - vma->vm_start) >> PAGE_SHIFT;
                        if (pfn == vma->vm_pgoff + off)
                                return NULL;
                        if (!is_cow_mapping(vma->vm_flags))
                                return NULL;
                }
        }

        if (pmd_devmap(pmd))
                return NULL;
        if (is_huge_zero_pmd(pmd))
                return NULL;
        if (unlikely(pfn > highest_memmap_pfn))
                return NULL;

        /*
         * NOTE! We still have PageReserved() pages in the page tables.
         * eg. VDSO mappings can cause them to exist.
         */
out:
        return pfn_to_page(pfn);
}

struct folio *vm_normal_folio_pmd(struct vm_area_struct *vma,
                                  unsigned long addr, pmd_t pmd)
{
        struct page *page = vm_normal_page_pmd(vma, addr, pmd);

        if (page)
                return page_folio(page);
        return NULL;
}
#endif

static void restore_exclusive_pte(struct vm_area_struct *vma,
                                  struct page *page, unsigned long address,
                                  pte_t *ptep)
{
        struct folio *folio = page_folio(page);
        pte_t orig_pte;
        pte_t pte;
        swp_entry_t entry;

        orig_pte = ptep_get(ptep);
        pte = pte_mkold(mk_pte(page, READ_ONCE(vma->vm_page_prot)));
        if (pte_swp_soft_dirty(orig_pte))
                pte = pte_mksoft_dirty(pte);

        entry = pte_to_swp_entry(orig_pte);
        if (pte_swp_uffd_wp(orig_pte))
                pte = pte_mkuffd_wp(pte);
        else if (is_writable_device_exclusive_entry(entry))
                pte = maybe_mkwrite(pte_mkdirty(pte), vma);

        VM_BUG_ON_FOLIO(pte_write(pte) && (!folio_test_anon(folio) &&
                                           PageAnonExclusive(page)), folio);

        /*
         * No need to take a page reference as one was already
         * created when the swap entry was made.
         */
        if (folio_test_anon(folio))
                folio_add_anon_rmap_pte(folio, page, vma, address, RMAP_NONE);
        else
                /*
                 * Currently device exclusive access only supports anonymous
                 * memory so the entry shouldn't point to a filebacked page.
                 */
                WARN_ON_ONCE(1);

        set_pte_at(vma->vm_mm, address, ptep, pte);

        /*
         * No need to invalidate - it was non-present before. However
         * secondary CPUs may have mappings that need invalidating.
         */
        update_mmu_cache(vma, address, ptep);
}

/*
 * Tries to restore an exclusive pte if the page lock can be acquired without
 * sleeping.
 */
static int
try_restore_exclusive_pte(pte_t *src_pte, struct vm_area_struct *vma,
                        unsigned long addr)
{
        swp_entry_t entry = pte_to_swp_entry(ptep_get(src_pte));
        struct page *page = pfn_swap_entry_to_page(entry);

        if (trylock_page(page)) {
                restore_exclusive_pte(vma, page, addr, src_pte);
                unlock_page(page);
                return 0;
        }

        return -EBUSY;
}

/*
 * copy one vm_area from one task to the other. Assumes the page tables
 * already present in the new task to be cleared in the whole range
 * covered by this vma.
 */

static unsigned long
copy_nonpresent_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                pte_t *dst_pte, pte_t *src_pte, struct vm_area_struct *dst_vma,
                struct vm_area_struct *src_vma, unsigned long addr, int *rss)
{
        unsigned long vm_flags = dst_vma->vm_flags;
        pte_t orig_pte = ptep_get(src_pte);
        pte_t pte = orig_pte;
        struct folio *folio;
        struct page *page;
        swp_entry_t entry = pte_to_swp_entry(orig_pte);

        if (likely(!non_swap_entry(entry))) {
                if (swap_duplicate(entry) < 0)
                        return -EIO;

                /* make sure dst_mm is on swapoff's mmlist. */
                if (unlikely(list_empty(&dst_mm->mmlist))) {
                        spin_lock(&mmlist_lock);
                        if (list_empty(&dst_mm->mmlist))
                                list_add(&dst_mm->mmlist,
                                                &src_mm->mmlist);
                        spin_unlock(&mmlist_lock);
                }
                /* Mark the swap entry as shared. */
                if (pte_swp_exclusive(orig_pte)) {
                        pte = pte_swp_clear_exclusive(orig_pte);
                        set_pte_at(src_mm, addr, src_pte, pte);
                }
                rss[MM_SWAPENTS]++;
        } else if (is_migration_entry(entry)) {
                folio = pfn_swap_entry_folio(entry);

                rss[mm_counter(folio)]++;

                if (!is_readable_migration_entry(entry) &&
                                is_cow_mapping(vm_flags)) {
                        /*
                         * COW mappings require pages in both parent and child
                         * to be set to read. A previously exclusive entry is
                         * now shared.
                         */
                        entry = make_readable_migration_entry(
                                                        swp_offset(entry));
                        pte = swp_entry_to_pte(entry);
                        if (pte_swp_soft_dirty(orig_pte))
                                pte = pte_swp_mksoft_dirty(pte);
                        if (pte_swp_uffd_wp(orig_pte))
                                pte = pte_swp_mkuffd_wp(pte);
                        set_pte_at(src_mm, addr, src_pte, pte);
                }
        } else if (is_device_private_entry(entry)) {
                page = pfn_swap_entry_to_page(entry);
                folio = page_folio(page);

                /*
                 * Update rss count even for unaddressable pages, as
                 * they should treated just like normal pages in this
                 * respect.
                 *
                 * We will likely want to have some new rss counters
                 * for unaddressable pages, at some point. But for now
                 * keep things as they are.
                 */
                folio_get(folio);
                rss[mm_counter(folio)]++;
                /* Cannot fail as these pages cannot get pinned. */
                folio_try_dup_anon_rmap_pte(folio, page, src_vma);

                /*
                 * We do not preserve soft-dirty information, because so
                 * far, checkpoint/restore is the only feature that
                 * requires that. And checkpoint/restore does not work
                 * when a device driver is involved (you cannot easily
                 * save and restore device driver state).
                 */
                if (is_writable_device_private_entry(entry) &&
                    is_cow_mapping(vm_flags)) {
                        entry = make_readable_device_private_entry(
                                                        swp_offset(entry));
                        pte = swp_entry_to_pte(entry);
                        if (pte_swp_uffd_wp(orig_pte))
                                pte = pte_swp_mkuffd_wp(pte);
                        set_pte_at(src_mm, addr, src_pte, pte);
                }
        } else if (is_device_exclusive_entry(entry)) {
                /*
                 * Make device exclusive entries present by restoring the
                 * original entry then copying as for a present pte. Device
                 * exclusive entries currently only support private writable
                 * (ie. COW) mappings.
                 */
                VM_BUG_ON(!is_cow_mapping(src_vma->vm_flags));
                if (try_restore_exclusive_pte(src_pte, src_vma, addr))
                        return -EBUSY;
                return -ENOENT;
        } else if (is_pte_marker_entry(entry)) {
                pte_marker marker = copy_pte_marker(entry, dst_vma);

                if (marker)
                        set_pte_at(dst_mm, addr, dst_pte,
                                   make_pte_marker(marker));
                return 0;
        }
        if (!userfaultfd_wp(dst_vma))
                pte = pte_swp_clear_uffd_wp(pte);
        set_pte_at(dst_mm, addr, dst_pte, pte);
        return 0;
}

/*
 * Copy a present and normal page.
 *
 * NOTE! The usual case is that this isn't required;
 * instead, the caller can just increase the page refcount
 * and re-use the pte the traditional way.
 *
 * And if we need a pre-allocated page but don't yet have
 * one, return a negative error to let the preallocation
 * code know so that it can do so outside the page table
 * lock.
 */
static inline int
copy_present_page(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
                  pte_t *dst_pte, pte_t *src_pte, unsigned long addr, int *rss,
                  struct folio **prealloc, struct page *page)
{
        struct folio *new_folio;
        pte_t pte;

        new_folio = *prealloc;
        if (!new_folio)
                return -EAGAIN;

        /*
         * We have a prealloc page, all good!  Take it
         * over and copy the page & arm it.
         */

        if (copy_mc_user_highpage(&new_folio->page, page, addr, src_vma))
                return -EHWPOISON;

        *prealloc = NULL;
        __folio_mark_uptodate(new_folio);
        folio_add_new_anon_rmap(new_folio, dst_vma, addr, RMAP_EXCLUSIVE);
        folio_add_lru_vma(new_folio, dst_vma);
        rss[MM_ANONPAGES]++;

        /* All done, just insert the new page copy in the child */
        pte = mk_pte(&new_folio->page, dst_vma->vm_page_prot);
        pte = maybe_mkwrite(pte_mkdirty(pte), dst_vma);
        if (userfaultfd_pte_wp(dst_vma, ptep_get(src_pte)))
                /* Uffd-wp needs to be delivered to dest pte as well */
                pte = pte_mkuffd_wp(pte);
        set_pte_at(dst_vma->vm_mm, addr, dst_pte, pte);
        return 0;
}

static __always_inline void __copy_present_ptes(struct vm_area_struct *dst_vma,
                struct vm_area_struct *src_vma, pte_t *dst_pte, pte_t *src_pte,
                pte_t pte, unsigned long addr, int nr)
{
        struct mm_struct *src_mm = src_vma->vm_mm;

        /* If it's a COW mapping, write protect it both processes. */
        if (is_cow_mapping(src_vma->vm_flags) && pte_write(pte)) {
                wrprotect_ptes(src_mm, addr, src_pte, nr);
                pte = pte_wrprotect(pte);
        }

        /* If it's a shared mapping, mark it clean in the child. */
        if (src_vma->vm_flags & VM_SHARED)
                pte = pte_mkclean(pte);
        pte = pte_mkold(pte);

        if (!userfaultfd_wp(dst_vma))
                pte = pte_clear_uffd_wp(pte);

        set_ptes(dst_vma->vm_mm, addr, dst_pte, pte, nr);
}

/*
 * Copy one present PTE, trying to batch-process subsequent PTEs that map
 * consecutive pages of the same folio by copying them as well.
 *
 * Returns -EAGAIN if one preallocated page is required to copy the next PTE.
 * Otherwise, returns the number of copied PTEs (at least 1).
 */
static inline int
copy_present_ptes(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
                 pte_t *dst_pte, pte_t *src_pte, pte_t pte, unsigned long addr,
                 int max_nr, int *rss, struct folio **prealloc)
{
        struct page *page;
        struct folio *folio;
        bool any_writable;
        fpb_t flags = 0;
        int err, nr;

        page = vm_normal_page(src_vma, addr, pte);
        if (unlikely(!page))
                goto copy_pte;

        folio = page_folio(page);

        /*
         * If we likely have to copy, just don't bother with batching. Make
         * sure that the common "small folio" case is as fast as possible
         * by keeping the batching logic separate.
         */
        if (unlikely(!*prealloc && folio_test_large(folio) && max_nr != 1)) {
                if (src_vma->vm_flags & VM_SHARED)
                        flags |= FPB_IGNORE_DIRTY;
                if (!vma_soft_dirty_enabled(src_vma))
                        flags |= FPB_IGNORE_SOFT_DIRTY;

                nr = folio_pte_batch(folio, addr, src_pte, pte, max_nr, flags,
                                     &any_writable, NULL, NULL);
                folio_ref_add(folio, nr);
                if (folio_test_anon(folio)) {
                        if (unlikely(folio_try_dup_anon_rmap_ptes(folio, page,
                                                                  nr, src_vma))) {
                                folio_ref_sub(folio, nr);
                                return -EAGAIN;
                        }
                        rss[MM_ANONPAGES] += nr;
                        VM_WARN_ON_FOLIO(PageAnonExclusive(page), folio);
                } else {
                        folio_dup_file_rmap_ptes(folio, page, nr);
                        rss[mm_counter_file(folio)] += nr;
                }
                if (any_writable)
                        pte = pte_mkwrite(pte, src_vma);
                __copy_present_ptes(dst_vma, src_vma, dst_pte, src_pte, pte,
                                    addr, nr);
                return nr;
        }

        folio_get(folio);
        if (folio_test_anon(folio)) {
                /*
                 * If this page may have been pinned by the parent process,
                 * copy the page immediately for the child so that we'll always
                 * guarantee the pinned page won't be randomly replaced in the
                 * future.
                 */
                if (unlikely(folio_try_dup_anon_rmap_pte(folio, page, src_vma))) {
                        /* Page may be pinned, we have to copy. */
                        folio_put(folio);
                        err = copy_present_page(dst_vma, src_vma, dst_pte, src_pte,
                                                addr, rss, prealloc, page);
                        return err ? err : 1;
                }
                rss[MM_ANONPAGES]++;
                VM_WARN_ON_FOLIO(PageAnonExclusive(page), folio);
        } else {
                folio_dup_file_rmap_pte(folio, page);
                rss[mm_counter_file(folio)]++;
        }

copy_pte:
        __copy_present_ptes(dst_vma, src_vma, dst_pte, src_pte, pte, addr, 1);
        return 1;
}

static inline struct folio *folio_prealloc(struct mm_struct *src_mm,
                struct vm_area_struct *vma, unsigned long addr, bool need_zero)
{
        struct folio *new_folio;

        if (need_zero)
                new_folio = vma_alloc_zeroed_movable_folio(vma, addr);
        else
                new_folio = vma_alloc_folio(GFP_HIGHUSER_MOVABLE, 0, vma,
                                            addr, false);

        if (!new_folio)
                return NULL;

        if (mem_cgroup_charge(new_folio, src_mm, GFP_KERNEL)) {
                folio_put(new_folio);
                return NULL;
        }
        folio_throttle_swaprate(new_folio, GFP_KERNEL);

        return new_folio;
}

static int
copy_pte_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
               pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long addr,
               unsigned long end)
{
        struct mm_struct *dst_mm = dst_vma->vm_mm;
        struct mm_struct *src_mm = src_vma->vm_mm;
        pte_t *orig_src_pte, *orig_dst_pte;
        pte_t *src_pte, *dst_pte;
        pte_t ptent;
        spinlock_t *src_ptl, *dst_ptl;
        int progress, max_nr, ret = 0;
        int rss[NR_MM_COUNTERS];
        swp_entry_t entry = (swp_entry_t){0};
        struct folio *prealloc = NULL;
        int nr;

again:
        progress = 0;
        init_rss_vec(rss);

        /*
         * copy_pmd_range()'s prior pmd_none_or_clear_bad(src_pmd), and the
         * error handling here, assume that exclusive mmap_lock on dst and src
         * protects anon from unexpected THP transitions; with shmem and file
         * protected by mmap_lock-less collapse skipping areas with anon_vma
         * (whereas vma_needs_copy() skips areas without anon_vma).  A rework
         * can remove such assumptions later, but this is good enough for now.
         */
        dst_pte = pte_alloc_map_lock(dst_mm, dst_pmd, addr, &dst_ptl);
        if (!dst_pte) {
                ret = -ENOMEM;
                goto out;
        }
        src_pte = pte_offset_map_nolock(src_mm, src_pmd, addr, &src_ptl);
        if (!src_pte) {
                pte_unmap_unlock(dst_pte, dst_ptl);
                /* ret == 0 */
                goto out;
        }
        spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
        orig_src_pte = src_pte;
        orig_dst_pte = dst_pte;
        arch_enter_lazy_mmu_mode();

        do {
                nr = 1;

                /*
                 * We are holding two locks at this point - either of them
                 * could generate latencies in another task on another CPU.
                 */
                if (progress >= 32) {
                        progress = 0;
                        if (need_resched() ||
                            spin_needbreak(src_ptl) || spin_needbreak(dst_ptl))
                                break;
                }
                ptent = ptep_get(src_pte);
                if (pte_none(ptent)) {
                        progress++;
                        continue;
                }
                if (unlikely(!pte_present(ptent))) {
                        ret = copy_nonpresent_pte(dst_mm, src_mm,
                                                  dst_pte, src_pte,
                                                  dst_vma, src_vma,
                                                  addr, rss);
                        if (ret == -EIO) {
                                entry = pte_to_swp_entry(ptep_get(src_pte));
                                break;
                        } else if (ret == -EBUSY) {
                                break;
                        } else if (!ret) {
                                progress += 8;
                                continue;
                        }
                        ptent = ptep_get(src_pte);
                        VM_WARN_ON_ONCE(!pte_present(ptent));

                        /*
                         * Device exclusive entry restored, continue by copying
                         * the now present pte.
                         */
                        WARN_ON_ONCE(ret != -ENOENT);
                }
                /* copy_present_ptes() will clear `*prealloc' if consumed */
                max_nr = (end - addr) / PAGE_SIZE;
                ret = copy_present_ptes(dst_vma, src_vma, dst_pte, src_pte,
                                        ptent, addr, max_nr, rss, &prealloc);
                /*
                 * If we need a pre-allocated page for this pte, drop the
                 * locks, allocate, and try again.
                 * If copy failed due to hwpoison in source page, break out.
                 */
                if (unlikely(ret == -EAGAIN || ret == -EHWPOISON))
                        break;
                if (unlikely(prealloc)) {
                        /*
                         * pre-alloc page cannot be reused by next time so as
                         * to strictly follow mempolicy (e.g., alloc_page_vma()
                         * will allocate page according to address).  This
                         * could only happen if one pinned pte changed.
                         */
                        folio_put(prealloc);
                        prealloc = NULL;
                }
                nr = ret;
                progress += 8 * nr;
        } while (dst_pte += nr, src_pte += nr, addr += PAGE_SIZE * nr,
                 addr != end);

        arch_leave_lazy_mmu_mode();
        pte_unmap_unlock(orig_src_pte, src_ptl);
        add_mm_rss_vec(dst_mm, rss);
        pte_unmap_unlock(orig_dst_pte, dst_ptl);
        cond_resched();

        if (ret == -EIO) {
                VM_WARN_ON_ONCE(!entry.val);
                if (add_swap_count_continuation(entry, GFP_KERNEL) < 0) {
                        ret = -ENOMEM;
                        goto out;
                }
                entry.val = 0;
        } else if (ret == -EBUSY || unlikely(ret == -EHWPOISON)) {
                goto out;
        } else if (ret ==  -EAGAIN) {
                prealloc = folio_prealloc(src_mm, src_vma, addr, false);
                if (!prealloc)
                        return -ENOMEM;
        } else if (ret < 0) {
                VM_WARN_ON_ONCE(1);
        }

        /* We've captured and resolved the error. Reset, try again. */
        ret = 0;

        if (addr != end)
                goto again;
out:
        if (unlikely(prealloc))
                folio_put(prealloc);
        return ret;
}

static inline int
copy_pmd_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
               pud_t *dst_pud, pud_t *src_pud, unsigned long addr,
               unsigned long end)
{
        struct mm_struct *dst_mm = dst_vma->vm_mm;
        struct mm_struct *src_mm = src_vma->vm_mm;
        pmd_t *src_pmd, *dst_pmd;
        unsigned long next;

        dst_pmd = pmd_alloc(dst_mm, dst_pud, addr);
        if (!dst_pmd)
                return -ENOMEM;
        src_pmd = pmd_offset(src_pud, addr);
        do {
                next = pmd_addr_end(addr, end);
                if (is_swap_pmd(*src_pmd) || pmd_trans_huge(*src_pmd)
                        || pmd_devmap(*src_pmd)) {
                        int err;
                        VM_BUG_ON_VMA(next-addr != HPAGE_PMD_SIZE, src_vma);
                        err = copy_huge_pmd(dst_mm, src_mm, dst_pmd, src_pmd,
                                            addr, dst_vma, src_vma);
                        if (err == -ENOMEM)
                                return -ENOMEM;
                        if (!err)
                                continue;
                        /* fall through */
                }
                if (pmd_none_or_clear_bad(src_pmd))
                        continue;
                if (copy_pte_range(dst_vma, src_vma, dst_pmd, src_pmd,
                                   addr, next))
                        return -ENOMEM;
        } while (dst_pmd++, src_pmd++, addr = next, addr != end);
        return 0;
}

static inline int
copy_pud_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
               p4d_t *dst_p4d, p4d_t *src_p4d, unsigned long addr,
               unsigned long end)
{
        struct mm_struct *dst_mm = dst_vma->vm_mm;
        struct mm_struct *src_mm = src_vma->vm_mm;
        pud_t *src_pud, *dst_pud;
        unsigned long next;

        dst_pud = pud_alloc(dst_mm, dst_p4d, addr);
        if (!dst_pud)
                return -ENOMEM;
        src_pud = pud_offset(src_p4d, addr);
        do {
                next = pud_addr_end(addr, end);
                if (pud_trans_huge(*src_pud) || pud_devmap(*src_pud)) {
                        int err;

                        VM_BUG_ON_VMA(next-addr != HPAGE_PUD_SIZE, src_vma);
                        err = copy_huge_pud(dst_mm, src_mm,
                                            dst_pud, src_pud, addr, src_vma);
                        if (err == -ENOMEM)
                                return -ENOMEM;
                        if (!err)
                                continue;
                        /* fall through */
                }
                if (pud_none_or_clear_bad(src_pud))
                        continue;
                if (copy_pmd_range(dst_vma, src_vma, dst_pud, src_pud,
                                   addr, next))
                        return -ENOMEM;
        } while (dst_pud++, src_pud++, addr = next, addr != end);
        return 0;
}

static inline int
copy_p4d_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
               pgd_t *dst_pgd, pgd_t *src_pgd, unsigned long addr,
               unsigned long end)
{
        struct mm_struct *dst_mm = dst_vma->vm_mm;
        p4d_t *src_p4d, *dst_p4d;
        unsigned long next;

        dst_p4d = p4d_alloc(dst_mm, dst_pgd, addr);
        if (!dst_p4d)
                return -ENOMEM;
        src_p4d = p4d_offset(src_pgd, addr);
        do {
                next = p4d_addr_end(addr, end);
                if (p4d_none_or_clear_bad(src_p4d))
                        continue;
                if (copy_pud_range(dst_vma, src_vma, dst_p4d, src_p4d,
                                   addr, next))
                        return -ENOMEM;
        } while (dst_p4d++, src_p4d++, addr = next, addr != end);
        return 0;
}

/*
 * Return true if the vma needs to copy the pgtable during this fork().  Return
 * false when we can speed up fork() by allowing lazy page faults later until
 * when the child accesses the memory range.
 */
static bool
vma_needs_copy(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
{
        /*
         * Always copy pgtables when dst_vma has uffd-wp enabled even if it's
         * file-backed (e.g. shmem). Because when uffd-wp is enabled, pgtable
         * contains uffd-wp protection information, that's something we can't
         * retrieve from page cache, and skip copying will lose those info.
         */
        if (userfaultfd_wp(dst_vma))
                return true;

        if (src_vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
                return true;

        if (src_vma->anon_vma)
                return true;

        /*
         * Don't copy ptes where a page fault will fill them correctly.  Fork
         * becomes much lighter when there are big shared or private readonly
         * mappings. The tradeoff is that copy_page_range is more efficient
         * than faulting.
         */
        return false;
}

int
copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
{
        pgd_t *src_pgd, *dst_pgd;
        unsigned long next;
        unsigned long addr = src_vma->vm_start;
        unsigned long end = src_vma->vm_end;
        struct mm_struct *dst_mm = dst_vma->vm_mm;
        struct mm_struct *src_mm = src_vma->vm_mm;
        struct mmu_notifier_range range;
        bool is_cow;
        int ret;

        if (!vma_needs_copy(dst_vma, src_vma))
                return 0;

        if (is_vm_hugetlb_page(src_vma))
                return copy_hugetlb_page_range(dst_mm, src_mm, dst_vma, src_vma);

        if (unlikely(src_vma->vm_flags & VM_PFNMAP)) {
                /*
                 * We do not free on error cases below as remove_vma
                 * gets called on error from higher level routine
                 */
                ret = track_pfn_copy(src_vma);
                if (ret)
                        return ret;
        }

        /*
         * We need to invalidate the secondary MMU mappings only when
         * there could be a permission downgrade on the ptes of the
         * parent mm. And a permission downgrade will only happen if
         * is_cow_mapping() returns true.
         */
        is_cow = is_cow_mapping(src_vma->vm_flags);

        if (is_cow) {
                mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_PAGE,
                                        0, src_mm, addr, end);
                mmu_notifier_invalidate_range_start(&range);
                /*
                 * Disabling preemption is not needed for the write side, as
                 * the read side doesn't spin, but goes to the mmap_lock.
                 *
                 * Use the raw variant of the seqcount_t write API to avoid
                 * lockdep complaining about preemptibility.
                 */
                vma_assert_write_locked(src_vma);
                raw_write_seqcount_begin(&src_mm->write_protect_seq);
        }

        ret = 0;
        dst_pgd = pgd_offset(dst_mm, addr);
        src_pgd = pgd_offset(src_mm, addr);
        do {
                next = pgd_addr_end(addr, end);
                if (pgd_none_or_clear_bad(src_pgd))
                        continue;
                if (unlikely(copy_p4d_range(dst_vma, src_vma, dst_pgd, src_pgd,
                                            addr, next))) {
                        untrack_pfn_clear(dst_vma);
                        ret = -ENOMEM;
                        break;
                }
        } while (dst_pgd++, src_pgd++, addr = next, addr != end);

        if (is_cow) {
                raw_write_seqcount_end(&src_mm->write_protect_seq);
                mmu_notifier_invalidate_range_end(&range);
        }
        return ret;
}

/* Whether we should zap all COWed (private) pages too */
static inline bool should_zap_cows(struct zap_details *details)
{
        /* By default, zap all pages */
        if (!details)
                return true;

        /* Or, we zap COWed pages only if the caller wants to */
        return details->even_cows;
}

/* Decides whether we should zap this folio with the folio pointer specified */
static inline bool should_zap_folio(struct zap_details *details,
                                    struct folio *folio)
{
        /* If we can make a decision without *folio.. */
        if (should_zap_cows(details))
                return true;

        /* Otherwise we should only zap non-anon folios */
        return !folio_test_anon(folio);
}

static inline bool zap_drop_file_uffd_wp(struct zap_details *details)
{
        if (!details)
                return false;

        return details->zap_flags & ZAP_FLAG_DROP_MARKER;
}

/*
 * This function makes sure that we'll replace the none pte with an uffd-wp
 * swap special pte marker when necessary. Must be with the pgtable lock held.
 */
static inline void
zap_install_uffd_wp_if_needed(struct vm_area_struct *vma,
                              unsigned long addr, pte_t *pte, int nr,
                              struct zap_details *details, pte_t pteval)
{
        /* Zap on anonymous always means dropping everything */
        if (vma_is_anonymous(vma))
                return;

        if (zap_drop_file_uffd_wp(details))
                return;

        for (;;) {
                /* the PFN in the PTE is irrelevant. */
                pte_install_uffd_wp_if_needed(vma, addr, pte, pteval);
                if (--nr == 0)
                        break;
                pte++;
                addr += PAGE_SIZE;
        }
}

static __always_inline void zap_present_folio_ptes(struct mmu_gather *tlb,
                struct vm_area_struct *vma, struct folio *folio,
                struct page *page, pte_t *pte, pte_t ptent, unsigned int nr,
                unsigned long addr, struct zap_details *details, int *rss,
                bool *force_flush, bool *force_break)
{
        struct mm_struct *mm = tlb->mm;
        bool delay_rmap = false;

        if (!folio_test_anon(folio)) {
                ptent = get_and_clear_full_ptes(mm, addr, pte, nr, tlb->fullmm);
                if (pte_dirty(ptent)) {
                        folio_mark_dirty(folio);
                        if (tlb_delay_rmap(tlb)) {
                                delay_rmap = true;
                                *force_flush = true;
                        }
                }
                if (pte_young(ptent) && likely(vma_has_recency(vma)))
                        folio_mark_accessed(folio);
                rss[mm_counter(folio)] -= nr;
        } else {
                /* We don't need up-to-date accessed/dirty bits. */
                clear_full_ptes(mm, addr, pte, nr, tlb->fullmm);
                rss[MM_ANONPAGES] -= nr;
        }
        /* Checking a single PTE in a batch is sufficient. */
        arch_check_zapped_pte(vma, ptent);
        tlb_remove_tlb_entries(tlb, pte, nr, addr);
        if (unlikely(userfaultfd_pte_wp(vma, ptent)))
                zap_install_uffd_wp_if_needed(vma, addr, pte, nr, details,
                                              ptent);

        if (!delay_rmap) {
                folio_remove_rmap_ptes(folio, page, nr, vma);

                if (unlikely(folio_mapcount(folio) < 0))
                        print_bad_pte(vma, addr, ptent, page);
        }
        if (unlikely(__tlb_remove_folio_pages(tlb, page, nr, delay_rmap))) {
                *force_flush = true;
                *force_break = true;
        }
}

/*
 * Zap or skip at least one present PTE, trying to batch-process subsequent
 * PTEs that map consecutive pages of the same folio.
 *
 * Returns the number of processed (skipped or zapped) PTEs (at least 1).
 */
static inline int zap_present_ptes(struct mmu_gather *tlb,
                struct vm_area_struct *vma, pte_t *pte, pte_t ptent,
                unsigned int max_nr, unsigned long addr,
                struct zap_details *details, int *rss, bool *force_flush,
                bool *force_break)
{
        const fpb_t fpb_flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY;
        struct mm_struct *mm = tlb->mm;
        struct folio *folio;
        struct page *page;
        int nr;

        page = vm_normal_page(vma, addr, ptent);
        if (!page) {
                /* We don't need up-to-date accessed/dirty bits. */
                ptep_get_and_clear_full(mm, addr, pte, tlb->fullmm);
                arch_check_zapped_pte(vma, ptent);
                tlb_remove_tlb_entry(tlb, pte, addr);
                if (userfaultfd_pte_wp(vma, ptent))
                        zap_install_uffd_wp_if_needed(vma, addr, pte, 1,
                                                      details, ptent);
                ksm_might_unmap_zero_page(mm, ptent);
                return 1;
        }

        folio = page_folio(page);
        if (unlikely(!should_zap_folio(details, folio)))
                return 1;

        /*
         * Make sure that the common "small folio" case is as fast as possible
         * by keeping the batching logic separate.
         */
        if (unlikely(folio_test_large(folio) && max_nr != 1)) {
                nr = folio_pte_batch(folio, addr, pte, ptent, max_nr, fpb_flags,
                                     NULL, NULL, NULL);

                zap_present_folio_ptes(tlb, vma, folio, page, pte, ptent, nr,
                                       addr, details, rss, force_flush,
                                       force_break);
                return nr;
        }
        zap_present_folio_ptes(tlb, vma, folio, page, pte, ptent, 1, addr,
                               details, rss, force_flush, force_break);
        return 1;
}

static unsigned long zap_pte_range(struct mmu_gather *tlb,
                                struct vm_area_struct *vma, pmd_t *pmd,
                                unsigned long addr, unsigned long end,
                                struct zap_details *details)
{
        bool force_flush = false, force_break = false;
        struct mm_struct *mm = tlb->mm;
        int rss[NR_MM_COUNTERS];
        spinlock_t *ptl;
        pte_t *start_pte;
        pte_t *pte;
        swp_entry_t entry;
        int nr;

        tlb_change_page_size(tlb, PAGE_SIZE);
        init_rss_vec(rss);
        start_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
        if (!pte)
                return addr;

        flush_tlb_batched_pending(mm);
        arch_enter_lazy_mmu_mode();
        do {
                pte_t ptent = ptep_get(pte);
                struct folio *folio;
                struct page *page;
                int max_nr;

                nr = 1;
                if (pte_none(ptent))
                        continue;

                if (need_resched())
                        break;

                if (pte_present(ptent)) {
                        max_nr = (end - addr) / PAGE_SIZE;
                        nr = zap_present_ptes(tlb, vma, pte, ptent, max_nr,
                                              addr, details, rss, &force_flush,
                                              &force_break);
                        if (unlikely(force_break)) {
                                addr += nr * PAGE_SIZE;
                                break;
                        }
                        continue;
                }

                entry = pte_to_swp_entry(ptent);
                if (is_device_private_entry(entry) ||
                    is_device_exclusive_entry(entry)) {
                        page = pfn_swap_entry_to_page(entry);
                        folio = page_folio(page);
                        if (unlikely(!should_zap_folio(details, folio)))
                                continue;
                        /*
                         * Both device private/exclusive mappings should only
                         * work with anonymous page so far, so we don't need to
                         * consider uffd-wp bit when zap. For more information,
                         * see zap_install_uffd_wp_if_needed().
                         */
                        WARN_ON_ONCE(!vma_is_anonymous(vma));
                        rss[mm_counter(folio)]--;
                        if (is_device_private_entry(entry))
                                folio_remove_rmap_pte(folio, page, vma);
                        folio_put(folio);
                } else if (!non_swap_entry(entry)) {
                        max_nr = (end - addr) / PAGE_SIZE;
                        nr = swap_pte_batch(pte, max_nr, ptent);
                        /* Genuine swap entries, hence a private anon pages */
                        if (!should_zap_cows(details))
                                continue;
                        rss[MM_SWAPENTS] -= nr;
                        free_swap_and_cache_nr(entry, nr);
                } else if (is_migration_entry(entry)) {
                        folio = pfn_swap_entry_folio(entry);
                        if (!should_zap_folio(details, folio))
                                continue;
                        rss[mm_counter(folio)]--;
                } else if (pte_marker_entry_uffd_wp(entry)) {
                        /*
                         * For anon: always drop the marker; for file: only
                         * drop the marker if explicitly requested.
                         */
                        if (!vma_is_anonymous(vma) &&
                            !zap_drop_file_uffd_wp(details))
                                continue;
                } else if (is_hwpoison_entry(entry) ||
                           is_poisoned_swp_entry(entry)) {
                        if (!should_zap_cows(details))
                                continue;
                } else {
                        /* We should have covered all the swap entry types */
                        pr_alert("unrecognized swap entry 0x%lx\n", entry.val);
                        WARN_ON_ONCE(1);
                }
                clear_not_present_full_ptes(mm, addr, pte, nr, tlb->fullmm);
                zap_install_uffd_wp_if_needed(vma, addr, pte, nr, details, ptent);
        } while (pte += nr, addr += PAGE_SIZE * nr, addr != end);

        add_mm_rss_vec(mm, rss);
        arch_leave_lazy_mmu_mode();

        /* Do the actual TLB flush before dropping ptl */
        if (force_flush) {
                tlb_flush_mmu_tlbonly(tlb);
                tlb_flush_rmaps(tlb, vma);
        }
        pte_unmap_unlock(start_pte, ptl);

        /*
         * If we forced a TLB flush (either due to running out of
         * batch buffers or because we needed to flush dirty TLB
         * entries before releasing the ptl), free the batched
         * memory too. Come back again if we didn't do everything.
         */
        if (force_flush)
                tlb_flush_mmu(tlb);

        return addr;
}

static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
                                struct vm_area_struct *vma, pud_t *pud,
                                unsigned long addr, unsigned long end,
                                struct zap_details *details)
{
        pmd_t *pmd;
        unsigned long next;

        pmd = pmd_offset(pud, addr);
        do {
                next = pmd_addr_end(addr, end);
                if (is_swap_pmd(*pmd) || pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) {
                        if (next - addr != HPAGE_PMD_SIZE)
                                __split_huge_pmd(vma, pmd, addr, false, NULL);
                        else if (zap_huge_pmd(tlb, vma, pmd, addr)) {
                                addr = next;
                                continue;
                        }
                        /* fall through */
                } else if (details && details->single_folio &&
                           folio_test_pmd_mappable(details->single_folio) &&
                           next - addr == HPAGE_PMD_SIZE && pmd_none(*pmd)) {
                        spinlock_t *ptl = pmd_lock(tlb->mm, pmd);
                        /*
                         * Take and drop THP pmd lock so that we cannot return
                         * prematurely, while zap_huge_pmd() has cleared *pmd,
                         * but not yet decremented compound_mapcount().
                         */
                        spin_unlock(ptl);
                }
                if (pmd_none(*pmd)) {
                        addr = next;
                        continue;
                }
                addr = zap_pte_range(tlb, vma, pmd, addr, next, details);
                if (addr != next)
                        pmd--;
        } while (pmd++, cond_resched(), addr != end);

        return addr;
}

static inline unsigned long zap_pud_range(struct mmu_gather *tlb,
                                struct vm_area_struct *vma, p4d_t *p4d,
                                unsigned long addr, unsigned long end,
                                struct zap_details *details)
{
        pud_t *pud;
        unsigned long next;

        pud = pud_offset(p4d, addr);
        do {
                next = pud_addr_end(addr, end);
                if (pud_trans_huge(*pud) || pud_devmap(*pud)) {
                        if (next - addr != HPAGE_PUD_SIZE) {
                                mmap_assert_locked(tlb->mm);
                                split_huge_pud(vma, pud, addr);
                        } else if (zap_huge_pud(tlb, vma, pud, addr))
                                goto next;
                        /* fall through */
                }
                if (pud_none_or_clear_bad(pud))
                        continue;
                next = zap_pmd_range(tlb, vma, pud, addr, next, details);
next:
                cond_resched();
        } while (pud++, addr = next, addr != end);

        return addr;
}

static inline unsigned long zap_p4d_range(struct mmu_gather *tlb,
                                struct vm_area_struct *vma, pgd_t *pgd,
                                unsigned long addr, unsigned long end,
                                struct zap_details *details)
{
        p4d_t *p4d;
        unsigned long next;

        p4d = p4d_offset(pgd, addr);
        do {
                next = p4d_addr_end(addr, end);
                if (p4d_none_or_clear_bad(p4d))
                        continue;
                next = zap_pud_range(tlb, vma, p4d, addr, next, details);
        } while (p4d++, addr = next, addr != end);

        return addr;
}

void unmap_page_range(struct mmu_gather *tlb,
                             struct vm_area_struct *vma,
                             unsigned long addr, unsigned long end,
                             struct zap_details *details)
{
        pgd_t *pgd;
        unsigned long next;

        BUG_ON(addr >= end);
        tlb_start_vma(tlb, vma);
        pgd = pgd_offset(vma->vm_mm, addr);
        do {
                next = pgd_addr_end(addr, end);
                if (pgd_none_or_clear_bad(pgd))
                        continue;
                next = zap_p4d_range(tlb, vma, pgd, addr, next, details);
        } while (pgd++, addr = next, addr != end);
        tlb_end_vma(tlb, vma);
}


static void unmap_single_vma(struct mmu_gather *tlb,
                struct vm_area_struct *vma, unsigned long start_addr,
                unsigned long end_addr,
                struct zap_details *details, bool mm_wr_locked)
{
        unsigned long start = max(vma->vm_start, start_addr);
        unsigned long end;

        if (start >= vma->vm_end)
                return;
        end = min(vma->vm_end, end_addr);
        if (end <= vma->vm_start)
                return;

        if (vma->vm_file)
                uprobe_munmap(vma, start, end);

        if (unlikely(vma->vm_flags & VM_PFNMAP))
                untrack_pfn(vma, 0, 0, mm_wr_locked);

        if (start != end) {
                if (unlikely(is_vm_hugetlb_page(vma))) {
                        /*
                         * It is undesirable to test vma->vm_file as it
                         * should be non-null for valid hugetlb area.
                         * However, vm_file will be NULL in the error
                         * cleanup path of mmap_region. When
                         * hugetlbfs ->mmap method fails,
                         * mmap_region() nullifies vma->vm_file
                         * before calling this function to clean up.
                         * Since no pte has actually been setup, it is
                         * safe to do nothing in this case.
                         */
                        if (vma->vm_file) {
                                zap_flags_t zap_flags = details ?
                                    details->zap_flags : 0;
                                __unmap_hugepage_range(tlb, vma, start, end,
                                                             NULL, zap_flags);
                        }
                } else
                        unmap_page_range(tlb, vma, start, end, details);
        }
}

/**
 * unmap_vmas - unmap a range of memory covered by a list of vma's
 * @tlb: address of the caller's struct mmu_gather
 * @mas: the maple state
 * @vma: the starting vma
 * @start_addr: virtual address at which to start unmapping
 * @end_addr: virtual address at which to end unmapping
 * @tree_end: The maximum index to check
 * @mm_wr_locked: lock flag
 *
 * Unmap all pages in the vma list.
 *
 * Only addresses between `start' and `end' will be unmapped.
 *
 * The VMA list must be sorted in ascending virtual address order.
 *
 * unmap_vmas() assumes that the caller will flush the whole unmapped address
 * range after unmap_vmas() returns.  So the only responsibility here is to
 * ensure that any thus-far unmapped pages are flushed before unmap_vmas()
 * drops the lock and schedules.
 */
void unmap_vmas(struct mmu_gather *tlb, struct ma_state *mas,
                struct vm_area_struct *vma, unsigned long start_addr,
                unsigned long end_addr, unsigned long tree_end,
                bool mm_wr_locked)
{
        struct mmu_notifier_range range;
        struct zap_details details = {
                .zap_flags = ZAP_FLAG_DROP_MARKER | ZAP_FLAG_UNMAP,
                /* Careful - we need to zap private pages too! */
                .even_cows = true,
        };

        mmu_notifier_range_init(&range, MMU_NOTIFY_UNMAP, 0, vma->vm_mm,
                                start_addr, end_addr);
        mmu_notifier_invalidate_range_start(&range);
        do {
                unsigned long start = start_addr;
                unsigned long end = end_addr;
                hugetlb_zap_begin(vma, &start, &end);
                unmap_single_vma(tlb, vma, start, end, &details,
                                 mm_wr_locked);
                hugetlb_zap_end(vma, &details);
                vma = mas_find(mas, tree_end - 1);
        } while (vma && likely(!xa_is_zero(vma)));
        mmu_notifier_invalidate_range_end(&range);
}

/**
 * zap_page_range_single - remove user pages in a given range
 * @vma: vm_area_struct holding the applicable pages
 * @address: starting address of pages to zap
 * @size: number of bytes to zap
 * @details: details of shared cache invalidation
 *
 * The range must fit into one VMA.
 */
void zap_page_range_single(struct vm_area_struct *vma, unsigned long address,
                unsigned long size, struct zap_details *details)
{
        const unsigned long end = address + size;
        struct mmu_notifier_range range;
        struct mmu_gather tlb;

        lru_add_drain();
        mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma->vm_mm,
                                address, end);
        hugetlb_zap_begin(vma, &range.start, &range.end);
        tlb_gather_mmu(&tlb, vma->vm_mm);
        update_hiwater_rss(vma->vm_mm);
        mmu_notifier_invalidate_range_start(&range);
        /*
         * unmap 'address-end' not 'range.start-range.end' as range
         * could have been expanded for hugetlb pmd sharing.
         */
        unmap_single_vma(&tlb, vma, address, end, details, false);
        mmu_notifier_invalidate_range_end(&range);
        tlb_finish_mmu(&tlb);
        hugetlb_zap_end(vma, details);
}

/**
 * zap_vma_ptes - remove ptes mapping the vma
 * @vma: vm_area_struct holding ptes to be zapped
 * @address: starting address of pages to zap
 * @size: number of bytes to zap
 *
 * This function only unmaps ptes assigned to VM_PFNMAP vmas.
 *
 * The entire address range must be fully contained within the vma.
 *
 */
void zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
                unsigned long size)
{
        if (!range_in_vma(vma, address, address + size) ||
                            !(vma->vm_flags & VM_PFNMAP))
                return;

        zap_page_range_single(vma, address, size, NULL);
}
EXPORT_SYMBOL_GPL(zap_vma_ptes);

static pmd_t *walk_to_pmd(struct mm_struct *mm, unsigned long addr)
{
        pgd_t *pgd;
        p4d_t *p4d;
        pud_t *pud;
        pmd_t *pmd;

        pgd = pgd_offset(mm, addr);
        p4d = p4d_alloc(mm, pgd, addr);
        if (!p4d)
                return NULL;
        pud = pud_alloc(mm, p4d, addr);
        if (!pud)
                return NULL;
        pmd = pmd_alloc(mm, pud, addr);
        if (!pmd)
                return NULL;

        VM_BUG_ON(pmd_trans_huge(*pmd));
        return pmd;
}

pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                        spinlock_t **ptl)
{
        pmd_t *pmd = walk_to_pmd(mm, addr);

        if (!pmd)
                return NULL;
        return pte_alloc_map_lock(mm, pmd, addr, ptl);
}

static bool vm_mixed_zeropage_allowed(struct vm_area_struct *vma)
{
        VM_WARN_ON_ONCE(vma->vm_flags & VM_PFNMAP);
        /*
         * Whoever wants to forbid the zeropage after some zeropages
         * might already have been mapped has to scan the page tables and
         * bail out on any zeropages. Zeropages in COW mappings can
         * be unshared using FAULT_FLAG_UNSHARE faults.
         */
        if (mm_forbids_zeropage(vma->vm_mm))
                return false;
        /* zeropages in COW mappings are common and unproblematic. */
        if (is_cow_mapping(vma->vm_flags))
                return true;
        /* Mappings that do not allow for writable PTEs are unproblematic. */
        if (!(vma->vm_flags & (VM_WRITE | VM_MAYWRITE)))
                return true;
        /*
         * Why not allow any VMA that has vm_ops->pfn_mkwrite? GUP could
         * find the shared zeropage and longterm-pin it, which would
         * be problematic as soon as the zeropage gets replaced by a different
         * page due to vma->vm_ops->pfn_mkwrite, because what's mapped would
         * now differ to what GUP looked up. FSDAX is incompatible to
         * FOLL_LONGTERM and VM_IO is incompatible to GUP completely (see
         * check_vma_flags).
         */
        return vma->vm_ops && vma->vm_ops->pfn_mkwrite &&
               (vma_is_fsdax(vma) || vma->vm_flags & VM_IO);
}

static int validate_page_before_insert(struct vm_area_struct *vma,
                                       struct page *page)
{
        struct folio *folio = page_folio(page);

        if (!folio_ref_count(folio))
                return -EINVAL;
        if (unlikely(is_zero_folio(folio))) {
                if (!vm_mixed_zeropage_allowed(vma))
                        return -EINVAL;
                return 0;
        }
        if (folio_test_anon(folio) || folio_test_slab(folio) ||
            page_has_type(page))
                return -EINVAL;
        flush_dcache_folio(folio);
        return 0;
}

static int insert_page_into_pte_locked(struct vm_area_struct *vma, pte_t *pte,
                        unsigned long addr, struct page *page, pgprot_t prot)
{
        struct folio *folio = page_folio(page);
        pte_t pteval;

        if (!pte_none(ptep_get(pte)))
                return -EBUSY;
        /* Ok, finally just insert the thing.. */
        pteval = mk_pte(page, prot);
        if (unlikely(is_zero_folio(folio))) {
                pteval = pte_mkspecial(pteval);
        } else {
                folio_get(folio);
                inc_mm_counter(vma->vm_mm, mm_counter_file(folio));
                folio_add_file_rmap_pte(folio, page, vma);
        }
        set_pte_at(vma->vm_mm, addr, pte, pteval);
        return 0;
}

static int insert_page(struct vm_area_struct *vma, unsigned long addr,
                        struct page *page, pgprot_t prot)
{
        int retval;
        pte_t *pte;
        spinlock_t *ptl;

        retval = validate_page_before_insert(vma, page);
        if (retval)
                goto out;
        retval = -ENOMEM;
        pte = get_locked_pte(vma->vm_mm, addr, &ptl);
        if (!pte)
                goto out;
        retval = insert_page_into_pte_locked(vma, pte, addr, page, prot);
        pte_unmap_unlock(pte, ptl);
out:
        return retval;
}

static int insert_page_in_batch_locked(struct vm_area_struct *vma, pte_t *pte,
                        unsigned long addr, struct page *page, pgprot_t prot)
{
        int err;

        err = validate_page_before_insert(vma, page);
        if (err)
                return err;
        return insert_page_into_pte_locked(vma, pte, addr, page, prot);
}

/* insert_pages() amortizes the cost of spinlock operations
 * when inserting pages in a loop.
 */
static int insert_pages(struct vm_area_struct *vma, unsigned long addr,
                        struct page **pages, unsigned long *num, pgprot_t prot)
{
        pmd_t *pmd = NULL;
        pte_t *start_pte, *pte;
        spinlock_t *pte_lock;
        struct mm_struct *const mm = vma->vm_mm;
        unsigned long curr_page_idx = 0;
        unsigned long remaining_pages_total = *num;
        unsigned long pages_to_write_in_pmd;
        int ret;
more:
        ret = -EFAULT;
        pmd = walk_to_pmd(mm, addr);
        if (!pmd)
                goto out;

        pages_to_write_in_pmd = min_t(unsigned long,
                remaining_pages_total, PTRS_PER_PTE - pte_index(addr));

        /* Allocate the PTE if necessary; takes PMD lock once only. */
        ret = -ENOMEM;
        if (pte_alloc(mm, pmd))
                goto out;

        while (pages_to_write_in_pmd) {
                int pte_idx = 0;
                const int batch_size = min_t(int, pages_to_write_in_pmd, 8);

                start_pte = pte_offset_map_lock(mm, pmd, addr, &pte_lock);
                if (!start_pte) {
                        ret = -EFAULT;
                        goto out;
                }
                for (pte = start_pte; pte_idx < batch_size; ++pte, ++pte_idx) {
                        int err = insert_page_in_batch_locked(vma, pte,
                                addr, pages[curr_page_idx], prot);
                        if (unlikely(err)) {
                                pte_unmap_unlock(start_pte, pte_lock);
                                ret = err;
                                remaining_pages_total -= pte_idx;
                                goto out;
                        }
                        addr += PAGE_SIZE;
                        ++curr_page_idx;
                }
                pte_unmap_unlock(start_pte, pte_lock);
                pages_to_write_in_pmd -= batch_size;
                remaining_pages_total -= batch_size;
        }
        if (remaining_pages_total)
                goto more;
        ret = 0;
out:
        *num = remaining_pages_total;
        return ret;
}

/**
 * vm_insert_pages - insert multiple pages into user vma, batching the pmd lock.
 * @vma: user vma to map to
 * @addr: target start user address of these pages
 * @pages: source kernel pages
 * @num: in: number of pages to map. out: number of pages that were *not*
 * mapped. (0 means all pages were successfully mapped).
 *
 * Preferred over vm_insert_page() when inserting multiple pages.
 *
 * In case of error, we may have mapped a subset of the provided
 * pages. It is the caller's responsibility to account for this case.
 *
 * The same restrictions apply as in vm_insert_page().
 */
int vm_insert_pages(struct vm_area_struct *vma, unsigned long addr,
                        struct page **pages, unsigned long *num)
{
        const unsigned long end_addr = addr + (*num * PAGE_SIZE) - 1;

        if (addr < vma->vm_start || end_addr >= vma->vm_end)
                return -EFAULT;
        if (!(vma->vm_flags & VM_MIXEDMAP)) {
                BUG_ON(mmap_read_trylock(vma->vm_mm));
                BUG_ON(vma->vm_flags & VM_PFNMAP);
                vm_flags_set(vma, VM_MIXEDMAP);
        }
        /* Defer page refcount checking till we're about to map that page. */
        return insert_pages(vma, addr, pages, num, vma->vm_page_prot);
}
EXPORT_SYMBOL(vm_insert_pages);

/**
 * vm_insert_page - insert single page into user vma
 * @vma: user vma to map to
 * @addr: target user address of this page
 * @page: source kernel page
 *
 * This allows drivers to insert individual pages they've allocated
 * into a user vma. The zeropage is supported in some VMAs,
 * see vm_mixed_zeropage_allowed().
 *
 * The page has to be a nice clean _individual_ kernel allocation.
 * If you allocate a compound page, you need to have marked it as
 * such (__GFP_COMP), or manually just split the page up yourself
 * (see split_page()).
 *
 * NOTE! Traditionally this was done with "remap_pfn_range()" which
 * took an arbitrary page protection parameter. This doesn't allow
 * that. Your vma protection will have to be set up correctly, which
 * means that if you want a shared writable mapping, you'd better
 * ask for a shared writable mapping!
 *
 * The page does not need to be reserved.
 *
 * Usually this function is called from f_op->mmap() handler
 * under mm->mmap_lock write-lock, so it can change vma->vm_flags.
 * Caller must set VM_MIXEDMAP on vma if it wants to call this
 * function from other places, for example from page-fault handler.
 *
 * Return: %0 on success, negative error code otherwise.
 */
int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
                        struct page *page)
{
        if (addr < vma->vm_start || addr >= vma->vm_end)
                return -EFAULT;
        if (!(vma->vm_flags & VM_MIXEDMAP)) {
                BUG_ON(mmap_read_trylock(vma->vm_mm));
                BUG_ON(vma->vm_flags & VM_PFNMAP);
                vm_flags_set(vma, VM_MIXEDMAP);
        }
        return insert_page(vma, addr, page, vma->vm_page_prot);
}
EXPORT_SYMBOL(vm_insert_page);

/*
 * __vm_map_pages - maps range of kernel pages into user vma
 * @vma: user vma to map to
 * @pages: pointer to array of source kernel pages
 * @num: number of pages in page array
 * @offset: user's requested vm_pgoff
 *
 * This allows drivers to map range of kernel pages into a user vma.
 * The zeropage is supported in some VMAs, see
 * vm_mixed_zeropage_allowed().
 *
 * Return: 0 on success and error code otherwise.
 */
static int __vm_map_pages(struct vm_area_struct *vma, struct page **pages,
                                unsigned long num, unsigned long offset)
{
        unsigned long count = vma_pages(vma);
        unsigned long uaddr = vma->vm_start;
        int ret, i;

        /* Fail if the user requested offset is beyond the end of the object */
        if (offset >= num)
                return -ENXIO;

        /* Fail if the user requested size exceeds available object size */
        if (count > num - offset)
                return -ENXIO;

        for (i = 0; i < count; i++) {
                ret = vm_insert_page(vma, uaddr, pages[offset + i]);
                if (ret < 0)
                        return ret;
                uaddr += PAGE_SIZE;
        }

        return 0;
}

/**
 * vm_map_pages - maps range of kernel pages starts with non zero offset
 * @vma: user vma to map to
 * @pages: pointer to array of source kernel pages
 * @num: number of pages in page array
 *
 * Maps an object consisting of @num pages, catering for the user's
 * requested vm_pgoff
 *
 * If we fail to insert any page into the vma, the function will return
 * immediately leaving any previously inserted pages present.  Callers
 * from the mmap handler may immediately return the error as their caller
 * will destroy the vma, removing any successfully inserted pages. Other
 * callers should make their own arrangements for calling unmap_region().
 *
 * Context: Process context. Called by mmap handlers.
 * Return: 0 on success and error code otherwise.
 */
int vm_map_pages(struct vm_area_struct *vma, struct page **pages,
                                unsigned long num)
{
        return __vm_map_pages(vma, pages, num, vma->vm_pgoff);
}
EXPORT_SYMBOL(vm_map_pages);

/**
 * vm_map_pages_zero - map range of kernel pages starts with zero offset
 * @vma: user vma to map to
 * @pages: pointer to array of source kernel pages
 * @num: number of pages in page array
 *
 * Similar to vm_map_pages(), except that it explicitly sets the offset
 * to 0. This function is intended for the drivers that did not consider
 * vm_pgoff.
 *
 * Context: Process context. Called by mmap handlers.
 * Return: 0 on success and error code otherwise.
 */
int vm_map_pages_zero(struct vm_area_struct *vma, struct page **pages,
                                unsigned long num)
{
        return __vm_map_pages(vma, pages, num, 0);
}
EXPORT_SYMBOL(vm_map_pages_zero);

static vm_fault_t insert_pfn(struct vm_area_struct *vma, unsigned long addr,
                        pfn_t pfn, pgprot_t prot, bool mkwrite)
{
        struct mm_struct *mm = vma->vm_mm;
        pte_t *pte, entry;
        spinlock_t *ptl;

        pte = get_locked_pte(mm, addr, &ptl);
        if (!pte)
                return VM_FAULT_OOM;
        entry = ptep_get(pte);
        if (!pte_none(entry)) {
                if (mkwrite) {
                        /*
                         * For read faults on private mappings the PFN passed
                         * in may not match the PFN we have mapped if the
                         * mapped PFN is a writeable COW page.  In the mkwrite
                         * case we are creating a writable PTE for a shared
                         * mapping and we expect the PFNs to match. If they
                         * don't match, we are likely racing with block
                         * allocation and mapping invalidation so just skip the
                         * update.
                         */
                        if (pte_pfn(entry) != pfn_t_to_pfn(pfn)) {
                                WARN_ON_ONCE(!is_zero_pfn(pte_pfn(entry)));
                                goto out_unlock;
                        }
                        entry = pte_mkyoung(entry);
                        entry = maybe_mkwrite(pte_mkdirty(entry), vma);
                        if (ptep_set_access_flags(vma, addr, pte, entry, 1))
                                update_mmu_cache(vma, addr, pte);
                }
                goto out_unlock;
        }

        /* Ok, finally just insert the thing.. */
        if (pfn_t_devmap(pfn))
                entry = pte_mkdevmap(pfn_t_pte(pfn, prot));
        else
                entry = pte_mkspecial(pfn_t_pte(pfn, prot));

        if (mkwrite) {
                entry = pte_mkyoung(entry);
                entry = maybe_mkwrite(pte_mkdirty(entry), vma);
        }

        set_pte_at(mm, addr, pte, entry);
        update_mmu_cache(vma, addr, pte); /* XXX: why not for insert_page? */

out_unlock:
        pte_unmap_unlock(pte, ptl);
        return VM_FAULT_NOPAGE;
}

/**
 * vmf_insert_pfn_prot - insert single pfn into user vma with specified pgprot
 * @vma: user vma to map to
 * @addr: target user address of this page
 * @pfn: source kernel pfn
 * @pgprot: pgprot flags for the inserted page
 *
 * This is exactly like vmf_insert_pfn(), except that it allows drivers
 * to override pgprot on a per-page basis.
 *
 * This only makes sense for IO mappings, and it makes no sense for
 * COW mappings.  In general, using multiple vmas is preferable;
 * vmf_insert_pfn_prot should only be used if using multiple VMAs is
 * impractical.
 *
 * pgprot typically only differs from @vma->vm_page_prot when drivers set
 * caching- and encryption bits different than those of @vma->vm_page_prot,
 * because the caching- or encryption mode may not be known at mmap() time.
 *
 * This is ok as long as @vma->vm_page_prot is not used by the core vm
 * to set caching and encryption bits for those vmas (except for COW pages).
 * This is ensured by core vm only modifying these page table entries using
 * functions that don't touch caching- or encryption bits, using pte_modify()
 * if needed. (See for example mprotect()).
 *
 * Also when new page-table entries are created, this is only done using the
 * fault() callback, and never using the value of vma->vm_page_prot,
 * except for page-table entries that point to anonymous pages as the result
 * of COW.
 *
 * Context: Process context.  May allocate using %GFP_KERNEL.
 * Return: vm_fault_t value.
 */
vm_fault_t vmf_insert_pfn_prot(struct vm_area_struct *vma, unsigned long addr,
                        unsigned long pfn, pgprot_t pgprot)
{
        /*
         * Technically, architectures with pte_special can avoid all these
         * restrictions (same for remap_pfn_range).  However we would like
         * consistency in testing and feature parity among all, so we should
         * try to keep these invariants in place for everybody.
         */
        BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
        BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
                                                (VM_PFNMAP|VM_MIXEDMAP));
        BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
        BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn));

        if (addr < vma->vm_start || addr >= vma->vm_end)
                return VM_FAULT_SIGBUS;

        if (!pfn_modify_allowed(pfn, pgprot))
                return VM_FAULT_SIGBUS;

        track_pfn_insert(vma, &pgprot, __pfn_to_pfn_t(pfn, PFN_DEV));

        return insert_pfn(vma, addr, __pfn_to_pfn_t(pfn, PFN_DEV), pgprot,
                        false);
}
EXPORT_SYMBOL(vmf_insert_pfn_prot);

/**
 * vmf_insert_pfn - insert single pfn into user vma
 * @vma: user vma to map to
 * @addr: target user address of this page
 * @pfn: source kernel pfn
 *
 * Similar to vm_insert_page, this allows drivers to insert individual pages
 * they've allocated into a user vma. Same comments apply.
 *
 * This function should only be called from a vm_ops->fault handler, and
 * in that case the handler should return the result of this function.
 *
 * vma cannot be a COW mapping.
 *
 * As this is called only for pages that do not currently exist, we
 * do not need to flush old virtual caches or the TLB.
 *
 * Context: Process context.  May allocate using %GFP_KERNEL.
 * Return: vm_fault_t value.
 */
vm_fault_t vmf_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
                        unsigned long pfn)
{
        return vmf_insert_pfn_prot(vma, addr, pfn, vma->vm_page_prot);
}
EXPORT_SYMBOL(vmf_insert_pfn);

static bool vm_mixed_ok(struct vm_area_struct *vma, pfn_t pfn, bool mkwrite)
{
        if (unlikely(is_zero_pfn(pfn_t_to_pfn(pfn))) &&
            (mkwrite || !vm_mixed_zeropage_allowed(vma)))
                return false;
        /* these checks mirror the abort conditions in vm_normal_page */
        if (vma->vm_flags & VM_MIXEDMAP)
                return true;
        if (pfn_t_devmap(pfn))
                return true;
        if (pfn_t_special(pfn))
                return true;
        if (is_zero_pfn(pfn_t_to_pfn(pfn)))
                return true;
        return false;
}

static vm_fault_t __vm_insert_mixed(struct vm_area_struct *vma,
                unsigned long addr, pfn_t pfn, bool mkwrite)
{
        pgprot_t pgprot = vma->vm_page_prot;
        int err;

        if (!vm_mixed_ok(vma, pfn, mkwrite))
                return VM_FAULT_SIGBUS;

        if (addr < vma->vm_start || addr >= vma->vm_end)
                return VM_FAULT_SIGBUS;

        track_pfn_insert(vma, &pgprot, pfn);

        if (!pfn_modify_allowed(pfn_t_to_pfn(pfn), pgprot))
                return VM_FAULT_SIGBUS;

        /*
         * If we don't have pte special, then we have to use the pfn_valid()
         * based VM_MIXEDMAP scheme (see vm_normal_page), and thus we *must*
         * refcount the page if pfn_valid is true (hence insert_page rather
         * than insert_pfn).  If a zero_pfn were inserted into a VM_MIXEDMAP
         * without pte special, it would there be refcounted as a normal page.
         */
        if (!IS_ENABLED(CONFIG_ARCH_HAS_PTE_SPECIAL) &&
            !pfn_t_devmap(pfn) && pfn_t_valid(pfn)) {
                struct page *page;

                /*
                 * At this point we are committed to insert_page()
                 * regardless of whether the caller specified flags that
                 * result in pfn_t_has_page() == false.
                 */
                page = pfn_to_page(pfn_t_to_pfn(pfn));
                err = insert_page(vma, addr, page, pgprot);
        } else {
                return insert_pfn(vma, addr, pfn, pgprot, mkwrite);
        }

        if (err == -ENOMEM)
                return VM_FAULT_OOM;
        if (err < 0 && err != -EBUSY)
                return VM_FAULT_SIGBUS;

        return VM_FAULT_NOPAGE;
}

vm_fault_t vmf_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
                pfn_t pfn)
{
        return __vm_insert_mixed(vma, addr, pfn, false);
}
EXPORT_SYMBOL(vmf_insert_mixed);

/*
 *  If the insertion of PTE failed because someone else already added a
 *  different entry in the mean time, we treat that as success as we assume
 *  the same entry was actually inserted.
 */
vm_fault_t vmf_insert_mixed_mkwrite(struct vm_area_struct *vma,
                unsigned long addr, pfn_t pfn)
{
        return __vm_insert_mixed(vma, addr, pfn, true);
}

/*
 * maps a range of physical memory into the requested pages. the old
 * mappings are removed. any references to nonexistent pages results
 * in null mappings (currently treated as "copy-on-access")
 */
static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
                        unsigned long addr, unsigned long end,
                        unsigned long pfn, pgprot_t prot)
{
        pte_t *pte, *mapped_pte;
        spinlock_t *ptl;
        int err = 0;

        mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
        if (!pte)
                return -ENOMEM;
        arch_enter_lazy_mmu_mode();
        do {
                BUG_ON(!pte_none(ptep_get(pte)));
                if (!pfn_modify_allowed(pfn, prot)) {
                        err = -EACCES;
                        break;
                }
                set_pte_at(mm, addr, pte, pte_mkspecial(pfn_pte(pfn, prot)));
                pfn++;
        } while (pte++, addr += PAGE_SIZE, addr != end);
        arch_leave_lazy_mmu_mode();
        pte_unmap_unlock(mapped_pte, ptl);
        return err;
}

static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud,
                        unsigned long addr, unsigned long end,
                        unsigned long pfn, pgprot_t prot)
{
        pmd_t *pmd;
        unsigned long next;
        int err;

        pfn -= addr >> PAGE_SHIFT;
        pmd = pmd_alloc(mm, pud, addr);
        if (!pmd)
                return -ENOMEM;
        VM_BUG_ON(pmd_trans_huge(*pmd));
        do {
                next = pmd_addr_end(addr, end);
                err = remap_pte_range(mm, pmd, addr, next,
                                pfn + (addr >> PAGE_SHIFT), prot);
                if (err)
                        return err;
        } while (pmd++, addr = next, addr != end);
        return 0;
}

static inline int remap_pud_range(struct mm_struct *mm, p4d_t *p4d,
                        unsigned long addr, unsigned long end,
                        unsigned long pfn, pgprot_t prot)
{
        pud_t *pud;
        unsigned long next;
        int err;

        pfn -= addr >> PAGE_SHIFT;
        pud = pud_alloc(mm, p4d, addr);
        if (!pud)
                return -ENOMEM;
        do {
                next = pud_addr_end(addr, end);
                err = remap_pmd_range(mm, pud, addr, next,
                                pfn + (addr >> PAGE_SHIFT), prot);
                if (err)
                        return err;
        } while (pud++, addr = next, addr != end);
        return 0;
}

static inline int remap_p4d_range(struct mm_struct *mm, pgd_t *pgd,
                        unsigned long addr, unsigned long end,
                        unsigned long pfn, pgprot_t prot)
{
        p4d_t *p4d;
        unsigned long next;
        int err;

        pfn -= addr >> PAGE_SHIFT;
        p4d = p4d_alloc(mm, pgd, addr);
        if (!p4d)
                return -ENOMEM;
        do {
                next = p4d_addr_end(addr, end);
                err = remap_pud_range(mm, p4d, addr, next,
                                pfn + (addr >> PAGE_SHIFT), prot);
                if (err)
                        return err;
        } while (p4d++, addr = next, addr != end);
        return 0;
}

static int remap_pfn_range_internal(struct vm_area_struct *vma, unsigned long addr,
                unsigned long pfn, unsigned long size, pgprot_t prot)
{
        pgd_t *pgd;
        unsigned long next;
        unsigned long end = addr + PAGE_ALIGN(size);
        struct mm_struct *mm = vma->vm_mm;
        int err;

        if (WARN_ON_ONCE(!PAGE_ALIGNED(addr)))
                return -EINVAL;

        /*
         * Physically remapped pages are special. Tell the
         * rest of the world about it:
         *   VM_IO tells people not to look at these pages
         *        (accesses can have side effects).
         *   VM_PFNMAP tells the core MM that the base pages are just
         *        raw PFN mappings, and do not have a "struct page" associated
         *        with them.
         *   VM_DONTEXPAND
         *      Disable vma merging and expanding with mremap().
         *   VM_DONTDUMP
         *      Omit vma from core dump, even when VM_IO turned off.
         *
         * There's a horrible special case to handle copy-on-write
         * behaviour that some programs depend on. We mark the "original"
         * un-COW'ed pages by matching them up with "vma->vm_pgoff".
         * See vm_normal_page() for details.
         */
        if (is_cow_mapping(vma->vm_flags)) {
                if (addr != vma->vm_start || end != vma->vm_end)
                        return -EINVAL;
                vma->vm_pgoff = pfn;
        }

        vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);

        BUG_ON(addr >= end);
        pfn -= addr >> PAGE_SHIFT;
        pgd = pgd_offset(mm, addr);
        flush_cache_range(vma, addr, end);
        do {
                next = pgd_addr_end(addr, end);
                err = remap_p4d_range(mm, pgd, addr, next,
                                pfn + (addr >> PAGE_SHIFT), prot);
                if (err)
                        return err;
        } while (pgd++, addr = next, addr != end);

        return 0;
}

/*
 * Variant of remap_pfn_range that does not call track_pfn_remap.  The caller
 * must have pre-validated the caching bits of the pgprot_t.
 */
int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr,
                unsigned long pfn, unsigned long size, pgprot_t prot)
{
        int error = remap_pfn_range_internal(vma, addr, pfn, size, prot);

        if (!error)
                return 0;

        /*
         * A partial pfn range mapping is dangerous: it does not
         * maintain page reference counts, and callers may free
         * pages due to the error. So zap it early.
         */
        zap_page_range_single(vma, addr, size, NULL);
        return error;
}

/**
 * remap_pfn_range - remap kernel memory to userspace
 * @vma: user vma to map to
 * @addr: target page aligned user address to start at
 * @pfn: page frame number of kernel physical memory address
 * @size: size of mapping area
 * @prot: page protection flags for this mapping
 *
 * Note: this is only safe if the mm semaphore is held when called.
 *
 * Return: %0 on success, negative error code otherwise.
 */
int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
                    unsigned long pfn, unsigned long size, pgprot_t prot)
{
        int err;

        err = track_pfn_remap(vma, &prot, pfn, addr, PAGE_ALIGN(size));
        if (err)
                return -EINVAL;

        err = remap_pfn_range_notrack(vma, addr, pfn, size, prot);
        if (err)
                untrack_pfn(vma, pfn, PAGE_ALIGN(size), true);
        return err;
}
EXPORT_SYMBOL(remap_pfn_range);

/**
 * vm_iomap_memory - remap memory to userspace
 * @vma: user vma to map to
 * @start: start of the physical memory to be mapped
 * @len: size of area
 *
 * This is a simplified io_remap_pfn_range() for common driver use. The
 * driver just needs to give us the physical memory range to be mapped,
 * we'll figure out the rest from the vma information.
 *
 * NOTE! Some drivers might want to tweak vma->vm_page_prot first to get
 * whatever write-combining details or similar.
 *
 * Return: %0 on success, negative error code otherwise.
 */
int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
{
        unsigned long vm_len, pfn, pages;

        /* Check that the physical memory area passed in looks valid */
        if (start + len < start)
                return -EINVAL;
        /*
         * You *really* shouldn't map things that aren't page-aligned,
         * but we've historically allowed it because IO memory might
         * just have smaller alignment.
         */
        len += start & ~PAGE_MASK;
        pfn = start >> PAGE_SHIFT;
        pages = (len + ~PAGE_MASK) >> PAGE_SHIFT;
        if (pfn + pages < pfn)
                return -EINVAL;

        /* We start the mapping 'vm_pgoff' pages into the area */
        if (vma->vm_pgoff > pages)
                return -EINVAL;
        pfn += vma->vm_pgoff;
        pages -= vma->vm_pgoff;

        /* Can we fit all of the mapping? */
        vm_len = vma->vm_end - vma->vm_start;
        if (vm_len >> PAGE_SHIFT > pages)
                return -EINVAL;

        /* Ok, let it rip */
        return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
}
EXPORT_SYMBOL(vm_iomap_memory);

static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
                                     unsigned long addr, unsigned long end,
                                     pte_fn_t fn, void *data, bool create,
                                     pgtbl_mod_mask *mask)
{
        pte_t *pte, *mapped_pte;
        int err = 0;
        spinlock_t *ptl;

        if (create) {
                mapped_pte = pte = (mm == &init_mm) ?
                        pte_alloc_kernel_track(pmd, addr, mask) :
                        pte_alloc_map_lock(mm, pmd, addr, &ptl);
                if (!pte)
                        return -ENOMEM;
        } else {
                mapped_pte = pte = (mm == &init_mm) ?
                        pte_offset_kernel(pmd, addr) :
                        pte_offset_map_lock(mm, pmd, addr, &ptl);
                if (!pte)
                        return -EINVAL;
        }

        arch_enter_lazy_mmu_mode();

        if (fn) {
                do {
                        if (create || !pte_none(ptep_get(pte))) {
                                err = fn(pte++, addr, data);
                                if (err)
                                        break;
                        }
                } while (addr += PAGE_SIZE, addr != end);
        }
        *mask |= PGTBL_PTE_MODIFIED;

        arch_leave_lazy_mmu_mode();

        if (mm != &init_mm)
                pte_unmap_unlock(mapped_pte, ptl);
        return err;
}

static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
                                     unsigned long addr, unsigned long end,
                                     pte_fn_t fn, void *data, bool create,
                                     pgtbl_mod_mask *mask)
{
        pmd_t *pmd;
        unsigned long next;
        int err = 0;

        BUG_ON(pud_leaf(*pud));

        if (create) {
                pmd = pmd_alloc_track(mm, pud, addr, mask);
                if (!pmd)
                        return -ENOMEM;
        } else {
                pmd = pmd_offset(pud, addr);
        }
        do {
                next = pmd_addr_end(addr, end);
                if (pmd_none(*pmd) && !create)
                        continue;
                if (WARN_ON_ONCE(pmd_leaf(*pmd)))
                        return -EINVAL;
                if (!pmd_none(*pmd) && WARN_ON_ONCE(pmd_bad(*pmd))) {
                        if (!create)
                                continue;
                        pmd_clear_bad(pmd);
                }
                err = apply_to_pte_range(mm, pmd, addr, next,
                                         fn, data, create, mask);
                if (err)
                        break;
        } while (pmd++, addr = next, addr != end);

        return err;
}

static int apply_to_pud_range(struct mm_struct *mm, p4d_t *p4d,
                                     unsigned long addr, unsigned long end,
                                     pte_fn_t fn, void *data, bool create,
                                     pgtbl_mod_mask *mask)
{
        pud_t *pud;
        unsigned long next;
        int err = 0;

        if (create) {
                pud = pud_alloc_track(mm, p4d, addr, mask);
                if (!pud)
                        return -ENOMEM;
        } else {
                pud = pud_offset(p4d, addr);
        }
        do {
                next = pud_addr_end(addr, end);
                if (pud_none(*pud) && !create)
                        continue;
                if (WARN_ON_ONCE(pud_leaf(*pud)))
                        return -EINVAL;
                if (!pud_none(*pud) && WARN_ON_ONCE(pud_bad(*pud))) {
                        if (!create)
                                continue;
                        pud_clear_bad(pud);
                }
                err = apply_to_pmd_range(mm, pud, addr, next,
                                         fn, data, create, mask);
                if (err)
                        break;
        } while (pud++, addr = next, addr != end);

        return err;
}

static int apply_to_p4d_range(struct mm_struct *mm, pgd_t *pgd,
                                     unsigned long addr, unsigned long end,
                                     pte_fn_t fn, void *data, bool create,
                                     pgtbl_mod_mask *mask)
{
        p4d_t *p4d;
        unsigned long next;
        int err = 0;

        if (create) {
                p4d = p4d_alloc_track(mm, pgd, addr, mask);
                if (!p4d)
                        return -ENOMEM;
        } else {
                p4d = p4d_offset(pgd, addr);
        }
        do {
                next = p4d_addr_end(addr, end);
                if (p4d_none(*p4d) && !create)
                        continue;
                if (WARN_ON_ONCE(p4d_leaf(*p4d)))
                        return -EINVAL;
                if (!p4d_none(*p4d) && WARN_ON_ONCE(p4d_bad(*p4d))) {
                        if (!create)
                                continue;
                        p4d_clear_bad(p4d);
                }
                err = apply_to_pud_range(mm, p4d, addr, next,
                                         fn, data, create, mask);
                if (err)
                        break;
        } while (p4d++, addr = next, addr != end);

        return err;
}

static int __apply_to_page_range(struct mm_struct *mm, unsigned long addr,
                                 unsigned long size, pte_fn_t fn,
                                 void *data, bool create)
{
        pgd_t *pgd;
        unsigned long start = addr, next;
        unsigned long end = addr + size;
        pgtbl_mod_mask mask = 0;
        int err = 0;

        if (WARN_ON(addr >= end))
                return -EINVAL;

        pgd = pgd_offset(mm, addr);
        do {
                next = pgd_addr_end(addr, end);
                if (pgd_none(*pgd) && !create)
                        continue;
                if (WARN_ON_ONCE(pgd_leaf(*pgd)))
                        return -EINVAL;
                if (!pgd_none(*pgd) && WARN_ON_ONCE(pgd_bad(*pgd))) {
                        if (!create)
                                continue;
                        pgd_clear_bad(pgd);
                }
                err = apply_to_p4d_range(mm, pgd, addr, next,
                                         fn, data, create, &mask);
                if (err)
                        break;
        } while (pgd++, addr = next, addr != end);

        if (mask & ARCH_PAGE_TABLE_SYNC_MASK)
                arch_sync_kernel_mappings(start, start + size);

        return err;
}

/*
 * Scan a region of virtual memory, filling in page tables as necessary
 * and calling a provided function on each leaf page table.
 */
int apply_to_page_range(struct mm_struct *mm, unsigned long addr,
                        unsigned long size, pte_fn_t fn, void *data)
{
        return __apply_to_page_range(mm, addr, size, fn, data, true);
}
EXPORT_SYMBOL_GPL(apply_to_page_range);

/*
 * Scan a region of virtual memory, calling a provided function on
 * each leaf page table where it exists.
 *
 * Unlike apply_to_page_range, this does _not_ fill in page tables
 * where they are absent.
 */
int apply_to_existing_page_range(struct mm_struct *mm, unsigned long addr,
                                 unsigned long size, pte_fn_t fn, void *data)
{
        return __apply_to_page_range(mm, addr, size, fn, data, false);
}
EXPORT_SYMBOL_GPL(apply_to_existing_page_range);

/*
 * handle_pte_fault chooses page fault handler according to an entry which was
 * read non-atomically.  Before making any commitment, on those architectures
 * or configurations (e.g. i386 with PAE) which might give a mix of unmatched
 * parts, do_swap_page must check under lock before unmapping the pte and
 * proceeding (but do_wp_page is only called after already making such a check;
 * and do_anonymous_page can safely check later on).
 */
static inline int pte_unmap_same(struct vm_fault *vmf)
{
        int same = 1;
#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPTION)
        if (sizeof(pte_t) > sizeof(unsigned long)) {
                spin_lock(vmf->ptl);
                same = pte_same(ptep_get(vmf->pte), vmf->orig_pte);
                spin_unlock(vmf->ptl);
        }
#endif
        pte_unmap(vmf->pte);
        vmf->pte = NULL;
        return same;
}

/*
 * Return:
 *        0:                copied succeeded
 *        -EHWPOISON:        copy failed due to hwpoison in source page
 *        -EAGAIN:        copied failed (some other reason)
 */
static inline int __wp_page_copy_user(struct page *dst, struct page *src,
                                      struct vm_fault *vmf)
{
        int ret;
        void *kaddr;
        void __user *uaddr;
        struct vm_area_struct *vma = vmf->vma;
        struct mm_struct *mm = vma->vm_mm;
        unsigned long addr = vmf->address;

        if (likely(src)) {
                if (copy_mc_user_highpage(dst, src, addr, vma))
                        return -EHWPOISON;
                return 0;
        }

        /*
         * If the source page was a PFN mapping, we don't have
         * a "struct page" for it. We do a best-effort copy by
         * just copying from the original user address. If that
         * fails, we just zero-fill it. Live with it.
         */
        kaddr = kmap_local_page(dst);
        pagefault_disable();
        uaddr = (void __user *)(addr & PAGE_MASK);

        /*
         * On architectures with software "accessed" bits, we would
         * take a double page fault, so mark it accessed here.
         */
        vmf->pte = NULL;
        if (!arch_has_hw_pte_young() && !pte_young(vmf->orig_pte)) {
                pte_t entry;

                vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
                if (unlikely(!vmf->pte || !pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
                        /*
                         * Other thread has already handled the fault
                         * and update local tlb only
                         */
                        if (vmf->pte)
                                update_mmu_tlb(vma, addr, vmf->pte);
                        ret = -EAGAIN;
                        goto pte_unlock;
                }

                entry = pte_mkyoung(vmf->orig_pte);
                if (ptep_set_access_flags(vma, addr, vmf->pte, entry, 0))
                        update_mmu_cache_range(vmf, vma, addr, vmf->pte, 1);
        }

        /*
         * This really shouldn't fail, because the page is there
         * in the page tables. But it might just be unreadable,
         * in which case we just give up and fill the result with
         * zeroes.
         */
        if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) {
                if (vmf->pte)
                        goto warn;

                /* Re-validate under PTL if the page is still mapped */
                vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
                if (unlikely(!vmf->pte || !pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
                        /* The PTE changed under us, update local tlb */
                        if (vmf->pte)
                                update_mmu_tlb(vma, addr, vmf->pte);
                        ret = -EAGAIN;
                        goto pte_unlock;
                }

                /*
                 * The same page can be mapped back since last copy attempt.
                 * Try to copy again under PTL.
                 */
                if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) {
                        /*
                         * Give a warn in case there can be some obscure
                         * use-case
                         */
warn:
                        WARN_ON_ONCE(1);
                        clear_page(kaddr);
                }
        }

        ret = 0;

pte_unlock:
        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        pagefault_enable();
        kunmap_local(kaddr);
        flush_dcache_page(dst);

        return ret;
}

static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma)
{
        struct file *vm_file = vma->vm_file;

        if (vm_file)
                return mapping_gfp_mask(vm_file->f_mapping) | __GFP_FS | __GFP_IO;

        /*
         * Special mappings (e.g. VDSO) do not have any file so fake
         * a default GFP_KERNEL for them.
         */
        return GFP_KERNEL;
}

/*
 * Notify the address space that the page is about to become writable so that
 * it can prohibit this or wait for the page to get into an appropriate state.
 *
 * We do this without the lock held, so that it can sleep if it needs to.
 */
static vm_fault_t do_page_mkwrite(struct vm_fault *vmf, struct folio *folio)
{
        vm_fault_t ret;
        unsigned int old_flags = vmf->flags;

        vmf->flags = FAULT_FLAG_WRITE|FAULT_FLAG_MKWRITE;

        if (vmf->vma->vm_file &&
            IS_SWAPFILE(vmf->vma->vm_file->f_mapping->host))
                return VM_FAULT_SIGBUS;

        ret = vmf->vma->vm_ops->page_mkwrite(vmf);
        /* Restore original flags so that caller is not surprised */
        vmf->flags = old_flags;
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE)))
                return ret;
        if (unlikely(!(ret & VM_FAULT_LOCKED))) {
                folio_lock(folio);
                if (!folio->mapping) {
                        folio_unlock(folio);
                        return 0; /* retry */
                }
                ret |= VM_FAULT_LOCKED;
        } else
                VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
        return ret;
}

/*
 * Handle dirtying of a page in shared file mapping on a write fault.
 *
 * The function expects the page to be locked and unlocks it.
 */
static vm_fault_t fault_dirty_shared_page(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct address_space *mapping;
        struct folio *folio = page_folio(vmf->page);
        bool dirtied;
        bool page_mkwrite = vma->vm_ops && vma->vm_ops->page_mkwrite;

        dirtied = folio_mark_dirty(folio);
        VM_BUG_ON_FOLIO(folio_test_anon(folio), folio);
        /*
         * Take a local copy of the address_space - folio.mapping may be zeroed
         * by truncate after folio_unlock().   The address_space itself remains
         * pinned by vma->vm_file's reference.  We rely on folio_unlock()'s
         * release semantics to prevent the compiler from undoing this copying.
         */
        mapping = folio_raw_mapping(folio);
        folio_unlock(folio);

        if (!page_mkwrite)
                file_update_time(vma->vm_file);

        /*
         * Throttle page dirtying rate down to writeback speed.
         *
         * mapping may be NULL here because some device drivers do not
         * set page.mapping but still dirty their pages
         *
         * Drop the mmap_lock before waiting on IO, if we can. The file
         * is pinning the mapping, as per above.
         */
        if ((dirtied || page_mkwrite) && mapping) {
                struct file *fpin;

                fpin = maybe_unlock_mmap_for_io(vmf, NULL);
                balance_dirty_pages_ratelimited(mapping);
                if (fpin) {
                        fput(fpin);
                        return VM_FAULT_COMPLETED;
                }
        }

        return 0;
}

/*
 * Handle write page faults for pages that can be reused in the current vma
 *
 * This can happen either due to the mapping being with the VM_SHARED flag,
 * or due to us being the last reference standing to the page. In either
 * case, all we need to do here is to mark the page as writable and update
 * any related book-keeping.
 */
static inline void wp_page_reuse(struct vm_fault *vmf, struct folio *folio)
        __releases(vmf->ptl)
{
        struct vm_area_struct *vma = vmf->vma;
        pte_t entry;

        VM_BUG_ON(!(vmf->flags & FAULT_FLAG_WRITE));
        VM_WARN_ON(is_zero_pfn(pte_pfn(vmf->orig_pte)));

        if (folio) {
                VM_BUG_ON(folio_test_anon(folio) &&
                          !PageAnonExclusive(vmf->page));
                /*
                 * Clear the folio's cpupid information as the existing
                 * information potentially belongs to a now completely
                 * unrelated process.
                 */
                folio_xchg_last_cpupid(folio, (1 << LAST_CPUPID_SHIFT) - 1);
        }

        flush_cache_page(vma, vmf->address, pte_pfn(vmf->orig_pte));
        entry = pte_mkyoung(vmf->orig_pte);
        entry = maybe_mkwrite(pte_mkdirty(entry), vma);
        if (ptep_set_access_flags(vma, vmf->address, vmf->pte, entry, 1))
                update_mmu_cache_range(vmf, vma, vmf->address, vmf->pte, 1);
        pte_unmap_unlock(vmf->pte, vmf->ptl);
        count_vm_event(PGREUSE);
}

/*
 * We could add a bitflag somewhere, but for now, we know that all
 * vm_ops that have a ->map_pages have been audited and don't need
 * the mmap_lock to be held.
 */
static inline vm_fault_t vmf_can_call_fault(const struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;

        if (vma->vm_ops->map_pages || !(vmf->flags & FAULT_FLAG_VMA_LOCK))
                return 0;
        vma_end_read(vma);
        return VM_FAULT_RETRY;
}

/**
 * __vmf_anon_prepare - Prepare to handle an anonymous fault.
 * @vmf: The vm_fault descriptor passed from the fault handler.
 *
 * When preparing to insert an anonymous page into a VMA from a
 * fault handler, call this function rather than anon_vma_prepare().
 * If this vma does not already have an associated anon_vma and we are
 * only protected by the per-VMA lock, the caller must retry with the
 * mmap_lock held.  __anon_vma_prepare() will look at adjacent VMAs to
 * determine if this VMA can share its anon_vma, and that's not safe to
 * do with only the per-VMA lock held for this VMA.
 *
 * Return: 0 if fault handling can proceed.  Any other value should be
 * returned to the caller.
 */
vm_fault_t __vmf_anon_prepare(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        vm_fault_t ret = 0;

        if (likely(vma->anon_vma))
                return 0;
        if (vmf->flags & FAULT_FLAG_VMA_LOCK) {
                if (!mmap_read_trylock(vma->vm_mm))
                        return VM_FAULT_RETRY;
        }
        if (__anon_vma_prepare(vma))
                ret = VM_FAULT_OOM;
        if (vmf->flags & FAULT_FLAG_VMA_LOCK)
                mmap_read_unlock(vma->vm_mm);
        return ret;
}

/*
 * Handle the case of a page which we actually need to copy to a new page,
 * either due to COW or unsharing.
 *
 * Called with mmap_lock locked and the old page referenced, but
 * without the ptl held.
 *
 * High level logic flow:
 *
 * - Allocate a page, copy the content of the old page to the new one.
 * - Handle book keeping and accounting - cgroups, mmu-notifiers, etc.
 * - Take the PTL. If the pte changed, bail out and release the allocated page
 * - If the pte is still the way we remember it, update the page table and all
 *   relevant references. This includes dropping the reference the page-table
 *   held to the old page, as well as updating the rmap.
 * - In any case, unlock the PTL and drop the reference we took to the old page.
 */
static vm_fault_t wp_page_copy(struct vm_fault *vmf)
{
        const bool unshare = vmf->flags & FAULT_FLAG_UNSHARE;
        struct vm_area_struct *vma = vmf->vma;
        struct mm_struct *mm = vma->vm_mm;
        struct folio *old_folio = NULL;
        struct folio *new_folio = NULL;
        pte_t entry;
        int page_copied = 0;
        struct mmu_notifier_range range;
        vm_fault_t ret;
        bool pfn_is_zero;

        delayacct_wpcopy_start();

        if (vmf->page)
                old_folio = page_folio(vmf->page);
        ret = vmf_anon_prepare(vmf);
        if (unlikely(ret))
                goto out;

        pfn_is_zero = is_zero_pfn(pte_pfn(vmf->orig_pte));
        new_folio = folio_prealloc(mm, vma, vmf->address, pfn_is_zero);
        if (!new_folio)
                goto oom;

        if (!pfn_is_zero) {
                int err;

                err = __wp_page_copy_user(&new_folio->page, vmf->page, vmf);
                if (err) {
                        /*
                         * COW failed, if the fault was solved by other,
                         * it's fine. If not, userspace would re-fault on
                         * the same address and we will handle the fault
                         * from the second attempt.
                         * The -EHWPOISON case will not be retried.
                         */
                        folio_put(new_folio);
                        if (old_folio)
                                folio_put(old_folio);

                        delayacct_wpcopy_end();
                        return err == -EHWPOISON ? VM_FAULT_HWPOISON : 0;
                }
                kmsan_copy_page_meta(&new_folio->page, vmf->page);
        }

        __folio_mark_uptodate(new_folio);

        mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm,
                                vmf->address & PAGE_MASK,
                                (vmf->address & PAGE_MASK) + PAGE_SIZE);
        mmu_notifier_invalidate_range_start(&range);

        /*
         * Re-check the pte - we dropped the lock
         */
        vmf->pte = pte_offset_map_lock(mm, vmf->pmd, vmf->address, &vmf->ptl);
        if (likely(vmf->pte && pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
                if (old_folio) {
                        if (!folio_test_anon(old_folio)) {
                                dec_mm_counter(mm, mm_counter_file(old_folio));
                                inc_mm_counter(mm, MM_ANONPAGES);
                        }
                } else {
                        ksm_might_unmap_zero_page(mm, vmf->orig_pte);
                        inc_mm_counter(mm, MM_ANONPAGES);
                }
                flush_cache_page(vma, vmf->address, pte_pfn(vmf->orig_pte));
                entry = mk_pte(&new_folio->page, vma->vm_page_prot);
                entry = pte_sw_mkyoung(entry);
                if (unlikely(unshare)) {
                        if (pte_soft_dirty(vmf->orig_pte))
                                entry = pte_mksoft_dirty(entry);
                        if (pte_uffd_wp(vmf->orig_pte))
                                entry = pte_mkuffd_wp(entry);
                } else {
                        entry = maybe_mkwrite(pte_mkdirty(entry), vma);
                }

                /*
                 * Clear the pte entry and flush it first, before updating the
                 * pte with the new entry, to keep TLBs on different CPUs in
                 * sync. This code used to set the new PTE then flush TLBs, but
                 * that left a window where the new PTE could be loaded into
                 * some TLBs while the old PTE remains in others.
                 */
                ptep_clear_flush(vma, vmf->address, vmf->pte);
                folio_add_new_anon_rmap(new_folio, vma, vmf->address, RMAP_EXCLUSIVE);
                folio_add_lru_vma(new_folio, vma);
                BUG_ON(unshare && pte_write(entry));
                set_pte_at(mm, vmf->address, vmf->pte, entry);
                update_mmu_cache_range(vmf, vma, vmf->address, vmf->pte, 1);
                if (old_folio) {
                        /*
                         * Only after switching the pte to the new page may
                         * we remove the mapcount here. Otherwise another
                         * process may come and find the rmap count decremented
                         * before the pte is switched to the new page, and
                         * "reuse" the old page writing into it while our pte
                         * here still points into it and can be read by other
                         * threads.
                         *
                         * The critical issue is to order this
                         * folio_remove_rmap_pte() with the ptp_clear_flush
                         * above. Those stores are ordered by (if nothing else,)
                         * the barrier present in the atomic_add_negative
                         * in folio_remove_rmap_pte();
                         *
                         * Then the TLB flush in ptep_clear_flush ensures that
                         * no process can access the old page before the
                         * decremented mapcount is visible. And the old page
                         * cannot be reused until after the decremented
                         * mapcount is visible. So transitively, TLBs to
                         * old page will be flushed before it can be reused.
                         */
                        folio_remove_rmap_pte(old_folio, vmf->page, vma);
                }

                /* Free the old page.. */
                new_folio = old_folio;
                page_copied = 1;
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        } else if (vmf->pte) {
                update_mmu_tlb(vma, vmf->address, vmf->pte);
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        }

        mmu_notifier_invalidate_range_end(&range);

        if (new_folio)
                folio_put(new_folio);
        if (old_folio) {
                if (page_copied)
                        free_swap_cache(old_folio);
                folio_put(old_folio);
        }

        delayacct_wpcopy_end();
        return 0;
oom:
        ret = VM_FAULT_OOM;
out:
        if (old_folio)
                folio_put(old_folio);

        delayacct_wpcopy_end();
        return ret;
}

/**
 * finish_mkwrite_fault - finish page fault for a shared mapping, making PTE
 *                          writeable once the page is prepared
 *
 * @vmf: structure describing the fault
 * @folio: the folio of vmf->page
 *
 * This function handles all that is needed to finish a write page fault in a
 * shared mapping due to PTE being read-only once the mapped page is prepared.
 * It handles locking of PTE and modifying it.
 *
 * The function expects the page to be locked or other protection against
 * concurrent faults / writeback (such as DAX radix tree locks).
 *
 * Return: %0 on success, %VM_FAULT_NOPAGE when PTE got changed before
 * we acquired PTE lock.
 */
static vm_fault_t finish_mkwrite_fault(struct vm_fault *vmf, struct folio *folio)
{
        WARN_ON_ONCE(!(vmf->vma->vm_flags & VM_SHARED));
        vmf->pte = pte_offset_map_lock(vmf->vma->vm_mm, vmf->pmd, vmf->address,
                                       &vmf->ptl);
        if (!vmf->pte)
                return VM_FAULT_NOPAGE;
        /*
         * We might have raced with another page fault while we released the
         * pte_offset_map_lock.
         */
        if (!pte_same(ptep_get(vmf->pte), vmf->orig_pte)) {
                update_mmu_tlb(vmf->vma, vmf->address, vmf->pte);
                pte_unmap_unlock(vmf->pte, vmf->ptl);
                return VM_FAULT_NOPAGE;
        }
        wp_page_reuse(vmf, folio);
        return 0;
}

/*
 * Handle write page faults for VM_MIXEDMAP or VM_PFNMAP for a VM_SHARED
 * mapping
 */
static vm_fault_t wp_pfn_shared(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;

        if (vma->vm_ops && vma->vm_ops->pfn_mkwrite) {
                vm_fault_t ret;

                pte_unmap_unlock(vmf->pte, vmf->ptl);
                ret = vmf_can_call_fault(vmf);
                if (ret)
                        return ret;

                vmf->flags |= FAULT_FLAG_MKWRITE;
                ret = vma->vm_ops->pfn_mkwrite(vmf);
                if (ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE))
                        return ret;
                return finish_mkwrite_fault(vmf, NULL);
        }
        wp_page_reuse(vmf, NULL);
        return 0;
}

static vm_fault_t wp_page_shared(struct vm_fault *vmf, struct folio *folio)
        __releases(vmf->ptl)
{
        struct vm_area_struct *vma = vmf->vma;
        vm_fault_t ret = 0;

        folio_get(folio);

        if (vma->vm_ops && vma->vm_ops->page_mkwrite) {
                vm_fault_t tmp;

                pte_unmap_unlock(vmf->pte, vmf->ptl);
                tmp = vmf_can_call_fault(vmf);
                if (tmp) {
                        folio_put(folio);
                        return tmp;
                }

                tmp = do_page_mkwrite(vmf, folio);
                if (unlikely(!tmp || (tmp &
                                      (VM_FAULT_ERROR | VM_FAULT_NOPAGE)))) {
                        folio_put(folio);
                        return tmp;
                }
                tmp = finish_mkwrite_fault(vmf, folio);
                if (unlikely(tmp & (VM_FAULT_ERROR | VM_FAULT_NOPAGE))) {
                        folio_unlock(folio);
                        folio_put(folio);
                        return tmp;
                }
        } else {
                wp_page_reuse(vmf, folio);
                folio_lock(folio);
        }
        ret |= fault_dirty_shared_page(vmf);
        folio_put(folio);

        return ret;
}

static bool wp_can_reuse_anon_folio(struct folio *folio,
                                    struct vm_area_struct *vma)
{
        /*
         * We could currently only reuse a subpage of a large folio if no
         * other subpages of the large folios are still mapped. However,
         * let's just consistently not reuse subpages even if we could
         * reuse in that scenario, and give back a large folio a bit
         * sooner.
         */
        if (folio_test_large(folio))
                return false;

        /*
         * We have to verify under folio lock: these early checks are
         * just an optimization to avoid locking the folio and freeing
         * the swapcache if there is little hope that we can reuse.
         *
         * KSM doesn't necessarily raise the folio refcount.
         */
        if (folio_test_ksm(folio) || folio_ref_count(folio) > 3)
                return false;
        if (!folio_test_lru(folio))
                /*
                 * We cannot easily detect+handle references from
                 * remote LRU caches or references to LRU folios.
                 */
                lru_add_drain();
        if (folio_ref_count(folio) > 1 + folio_test_swapcache(folio))
                return false;
        if (!folio_trylock(folio))
                return false;
        if (folio_test_swapcache(folio))
                folio_free_swap(folio);
        if (folio_test_ksm(folio) || folio_ref_count(folio) != 1) {
                folio_unlock(folio);
                return false;
        }
        /*
         * Ok, we've got the only folio reference from our mapping
         * and the folio is locked, it's dark out, and we're wearing
         * sunglasses. Hit it.
         */
        folio_move_anon_rmap(folio, vma);
        folio_unlock(folio);
        return true;
}

/*
 * This routine handles present pages, when
 * * users try to write to a shared page (FAULT_FLAG_WRITE)
 * * GUP wants to take a R/O pin on a possibly shared anonymous page
 *   (FAULT_FLAG_UNSHARE)
 *
 * It is done by copying the page to a new address and decrementing the
 * shared-page counter for the old page.
 *
 * Note that this routine assumes that the protection checks have been
 * done by the caller (the low-level page fault routine in most cases).
 * Thus, with FAULT_FLAG_WRITE, we can safely just mark it writable once we've
 * done any necessary COW.
 *
 * In case of FAULT_FLAG_WRITE, we also mark the page dirty at this point even
 * though the page will change only once the write actually happens. This
 * avoids a few races, and potentially makes it more efficient.
 *
 * We enter with non-exclusive mmap_lock (to exclude vma changes,
 * but allow concurrent faults), with pte both mapped and locked.
 * We return with mmap_lock still held, but pte unmapped and unlocked.
 */
static vm_fault_t do_wp_page(struct vm_fault *vmf)
        __releases(vmf->ptl)
{
        const bool unshare = vmf->flags & FAULT_FLAG_UNSHARE;
        struct vm_area_struct *vma = vmf->vma;
        struct folio *folio = NULL;
        pte_t pte;

        if (likely(!unshare)) {
                if (userfaultfd_pte_wp(vma, ptep_get(vmf->pte))) {
                        if (!userfaultfd_wp_async(vma)) {
                                pte_unmap_unlock(vmf->pte, vmf->ptl);
                                return handle_userfault(vmf, VM_UFFD_WP);
                        }

                        /*
                         * Nothing needed (cache flush, TLB invalidations,
                         * etc.) because we're only removing the uffd-wp bit,
                         * which is completely invisible to the user.
                         */
                        pte = pte_clear_uffd_wp(ptep_get(vmf->pte));

                        set_pte_at(vma->vm_mm, vmf->address, vmf->pte, pte);
                        /*
                         * Update this to be prepared for following up CoW
                         * handling
                         */
                        vmf->orig_pte = pte;
                }

                /*
                 * Userfaultfd write-protect can defer flushes. Ensure the TLB
                 * is flushed in this case before copying.
                 */
                if (unlikely(userfaultfd_wp(vmf->vma) &&
                             mm_tlb_flush_pending(vmf->vma->vm_mm)))
                        flush_tlb_page(vmf->vma, vmf->address);
        }

        vmf->page = vm_normal_page(vma, vmf->address, vmf->orig_pte);

        if (vmf->page)
                folio = page_folio(vmf->page);

        /*
         * Shared mapping: we are guaranteed to have VM_WRITE and
         * FAULT_FLAG_WRITE set at this point.
         */
        if (vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) {
                /*
                 * VM_MIXEDMAP !pfn_valid() case, or VM_SOFTDIRTY clear on a
                 * VM_PFNMAP VMA.
                 *
                 * We should not cow pages in a shared writeable mapping.
                 * Just mark the pages writable and/or call ops->pfn_mkwrite.
                 */
                if (!vmf->page)
                        return wp_pfn_shared(vmf);
                return wp_page_shared(vmf, folio);
        }

        /*
         * Private mapping: create an exclusive anonymous page copy if reuse
         * is impossible. We might miss VM_WRITE for FOLL_FORCE handling.
         *
         * If we encounter a page that is marked exclusive, we must reuse
         * the page without further checks.
         */
        if (folio && folio_test_anon(folio) &&
            (PageAnonExclusive(vmf->page) || wp_can_reuse_anon_folio(folio, vma))) {
                if (!PageAnonExclusive(vmf->page))
                        SetPageAnonExclusive(vmf->page);
                if (unlikely(unshare)) {
                        pte_unmap_unlock(vmf->pte, vmf->ptl);
                        return 0;
                }
                wp_page_reuse(vmf, folio);
                return 0;
        }
        /*
         * Ok, we need to copy. Oh, well..
         */
        if (folio)
                folio_get(folio);

        pte_unmap_unlock(vmf->pte, vmf->ptl);
#ifdef CONFIG_KSM
        if (folio && folio_test_ksm(folio))
                count_vm_event(COW_KSM);
#endif
        return wp_page_copy(vmf);
}

static void unmap_mapping_range_vma(struct vm_area_struct *vma,
                unsigned long start_addr, unsigned long end_addr,
                struct zap_details *details)
{
        zap_page_range_single(vma, start_addr, end_addr - start_addr, details);
}

static inline void unmap_mapping_range_tree(struct rb_root_cached *root,
                                            pgoff_t first_index,
                                            pgoff_t last_index,
                                            struct zap_details *details)
{
        struct vm_area_struct *vma;
        pgoff_t vba, vea, zba, zea;

        vma_interval_tree_foreach(vma, root, first_index, last_index) {
                vba = vma->vm_pgoff;
                vea = vba + vma_pages(vma) - 1;
                zba = max(first_index, vba);
                zea = min(last_index, vea);

                unmap_mapping_range_vma(vma,
                        ((zba - vba) << PAGE_SHIFT) + vma->vm_start,
                        ((zea - vba + 1) << PAGE_SHIFT) + vma->vm_start,
                                details);
        }
}

/**
 * unmap_mapping_folio() - Unmap single folio from processes.
 * @folio: The locked folio to be unmapped.
 *
 * Unmap this folio from any userspace process which still has it mmaped.
 * Typically, for efficiency, the range of nearby pages has already been
 * unmapped by unmap_mapping_pages() or unmap_mapping_range().  But once
 * truncation or invalidation holds the lock on a folio, it may find that
 * the page has been remapped again: and then uses unmap_mapping_folio()
 * to unmap it finally.
 */
void unmap_mapping_folio(struct folio *folio)
{
        struct address_space *mapping = folio->mapping;
        struct zap_details details = { };
        pgoff_t        first_index;
        pgoff_t        last_index;

        VM_BUG_ON(!folio_test_locked(folio));

        first_index = folio->index;
        last_index = folio_next_index(folio) - 1;

        details.even_cows = false;
        details.single_folio = folio;
        details.zap_flags = ZAP_FLAG_DROP_MARKER;

        i_mmap_lock_read(mapping);
        if (unlikely(!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root)))
                unmap_mapping_range_tree(&mapping->i_mmap, first_index,
                                         last_index, &details);
        i_mmap_unlock_read(mapping);
}

/**
 * unmap_mapping_pages() - Unmap pages from processes.
 * @mapping: The address space containing pages to be unmapped.
 * @start: Index of first page to be unmapped.
 * @nr: Number of pages to be unmapped.  0 to unmap to end of file.
 * @even_cows: Whether to unmap even private COWed pages.
 *
 * Unmap the pages in this address space from any userspace process which
 * has them mmaped.  Generally, you want to remove COWed pages as well when
 * a file is being truncated, but not when invalidating pages from the page
 * cache.
 */
void unmap_mapping_pages(struct address_space *mapping, pgoff_t start,
                pgoff_t nr, bool even_cows)
{
        struct zap_details details = { };
        pgoff_t        first_index = start;
        pgoff_t        last_index = start + nr - 1;

        details.even_cows = even_cows;
        if (last_index < first_index)
                last_index = ULONG_MAX;

        i_mmap_lock_read(mapping);
        if (unlikely(!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root)))
                unmap_mapping_range_tree(&mapping->i_mmap, first_index,
                                         last_index, &details);
        i_mmap_unlock_read(mapping);
}
EXPORT_SYMBOL_GPL(unmap_mapping_pages);

/**
 * unmap_mapping_range - unmap the portion of all mmaps in the specified
 * address_space corresponding to the specified byte range in the underlying
 * file.
 *
 * @mapping: the address space containing mmaps to be unmapped.
 * @holebegin: byte in first page to unmap, relative to the start of
 * the underlying file.  This will be rounded down to a PAGE_SIZE
 * boundary.  Note that this is different from truncate_pagecache(), which
 * must keep the partial page.  In contrast, we must get rid of
 * partial pages.
 * @holelen: size of prospective hole in bytes.  This will be rounded
 * up to a PAGE_SIZE boundary.  A holelen of zero truncates to the
 * end of the file.
 * @even_cows: 1 when truncating a file, unmap even private COWed pages;
 * but 0 when invalidating pagecache, don't throw away private data.
 */
void unmap_mapping_range(struct address_space *mapping,
                loff_t const holebegin, loff_t const holelen, int even_cows)
{
        pgoff_t hba = (pgoff_t)(holebegin) >> PAGE_SHIFT;
        pgoff_t hlen = ((pgoff_t)(holelen) + PAGE_SIZE - 1) >> PAGE_SHIFT;

        /* Check for overflow. */
        if (sizeof(holelen) > sizeof(hlen)) {
                long long holeend =
                        (holebegin + holelen + PAGE_SIZE - 1) >> PAGE_SHIFT;
                if (holeend & ~(long long)ULONG_MAX)
                        hlen = ULONG_MAX - hba + 1;
        }

        unmap_mapping_pages(mapping, hba, hlen, even_cows);
}
EXPORT_SYMBOL(unmap_mapping_range);

/*
 * Restore a potential device exclusive pte to a working pte entry
 */
static vm_fault_t remove_device_exclusive_entry(struct vm_fault *vmf)
{
        struct folio *folio = page_folio(vmf->page);
        struct vm_area_struct *vma = vmf->vma;
        struct mmu_notifier_range range;
        vm_fault_t ret;

        /*
         * We need a reference to lock the folio because we don't hold
         * the PTL so a racing thread can remove the device-exclusive
         * entry and unmap it. If the folio is free the entry must
         * have been removed already. If it happens to have already
         * been re-allocated after being freed all we do is lock and
         * unlock it.
         */
        if (!folio_try_get(folio))
                return 0;

        ret = folio_lock_or_retry(folio, vmf);
        if (ret) {
                folio_put(folio);
                return ret;
        }
        mmu_notifier_range_init_owner(&range, MMU_NOTIFY_EXCLUSIVE, 0,
                                vma->vm_mm, vmf->address & PAGE_MASK,
                                (vmf->address & PAGE_MASK) + PAGE_SIZE, NULL);
        mmu_notifier_invalidate_range_start(&range);

        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address,
                                &vmf->ptl);
        if (likely(vmf->pte && pte_same(ptep_get(vmf->pte), vmf->orig_pte)))
                restore_exclusive_pte(vma, vmf->page, vmf->address, vmf->pte);

        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        folio_unlock(folio);
        folio_put(folio);

        mmu_notifier_invalidate_range_end(&range);
        return 0;
}

static inline bool should_try_to_free_swap(struct folio *folio,
                                           struct vm_area_struct *vma,
                                           unsigned int fault_flags)
{
        if (!folio_test_swapcache(folio))
                return false;
        if (mem_cgroup_swap_full(folio) || (vma->vm_flags & VM_LOCKED) ||
            folio_test_mlocked(folio))
                return true;
        /*
         * If we want to map a page that's in the swapcache writable, we
         * have to detect via the refcount if we're really the exclusive
         * user. Try freeing the swapcache to get rid of the swapcache
         * reference only in case it's likely that we'll be the exlusive user.
         */
        return (fault_flags & FAULT_FLAG_WRITE) && !folio_test_ksm(folio) &&
                folio_ref_count(folio) == (1 + folio_nr_pages(folio));
}

static vm_fault_t pte_marker_clear(struct vm_fault *vmf)
{
        vmf->pte = pte_offset_map_lock(vmf->vma->vm_mm, vmf->pmd,
                                       vmf->address, &vmf->ptl);
        if (!vmf->pte)
                return 0;
        /*
         * Be careful so that we will only recover a special uffd-wp pte into a
         * none pte.  Otherwise it means the pte could have changed, so retry.
         *
         * This should also cover the case where e.g. the pte changed
         * quickly from a PTE_MARKER_UFFD_WP into PTE_MARKER_POISONED.
         * So is_pte_marker() check is not enough to safely drop the pte.
         */
        if (pte_same(vmf->orig_pte, ptep_get(vmf->pte)))
                pte_clear(vmf->vma->vm_mm, vmf->address, vmf->pte);
        pte_unmap_unlock(vmf->pte, vmf->ptl);
        return 0;
}

static vm_fault_t do_pte_missing(struct vm_fault *vmf)
{
        if (vma_is_anonymous(vmf->vma))
                return do_anonymous_page(vmf);
        else
                return do_fault(vmf);
}

/*
 * This is actually a page-missing access, but with uffd-wp special pte
 * installed.  It means this pte was wr-protected before being unmapped.
 */
static vm_fault_t pte_marker_handle_uffd_wp(struct vm_fault *vmf)
{
        /*
         * Just in case there're leftover special ptes even after the region
         * got unregistered - we can simply clear them.
         */
        if (unlikely(!userfaultfd_wp(vmf->vma)))
                return pte_marker_clear(vmf);

        return do_pte_missing(vmf);
}

static vm_fault_t handle_pte_marker(struct vm_fault *vmf)
{
        swp_entry_t entry = pte_to_swp_entry(vmf->orig_pte);
        unsigned long marker = pte_marker_get(entry);

        /*
         * PTE markers should never be empty.  If anything weird happened,
         * the best thing to do is to kill the process along with its mm.
         */
        if (WARN_ON_ONCE(!marker))
                return VM_FAULT_SIGBUS;

        /* Higher priority than uffd-wp when data corrupted */
        if (marker & PTE_MARKER_POISONED)
                return VM_FAULT_HWPOISON;

        if (pte_marker_entry_uffd_wp(entry))
                return pte_marker_handle_uffd_wp(vmf);

        /* This is an unknown pte marker */
        return VM_FAULT_SIGBUS;
}

static struct folio *__alloc_swap_folio(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct folio *folio;
        swp_entry_t entry;

        folio = vma_alloc_folio(GFP_HIGHUSER_MOVABLE, 0, vma,
                                vmf->address, false);
        if (!folio)
                return NULL;

        entry = pte_to_swp_entry(vmf->orig_pte);
        if (mem_cgroup_swapin_charge_folio(folio, vma->vm_mm,
                                           GFP_KERNEL, entry)) {
                folio_put(folio);
                return NULL;
        }

        return folio;
}

#ifdef CONFIG_TRANSPARENT_HUGEPAGE
static inline int non_swapcache_batch(swp_entry_t entry, int max_nr)
{
        struct swap_info_struct *si = swp_swap_info(entry);
        pgoff_t offset = swp_offset(entry);
        int i;

        /*
         * While allocating a large folio and doing swap_read_folio, which is
         * the case the being faulted pte doesn't have swapcache. We need to
         * ensure all PTEs have no cache as well, otherwise, we might go to
         * swap devices while the content is in swapcache.
         */
        for (i = 0; i < max_nr; i++) {
                if ((si->swap_map[offset + i] & SWAP_HAS_CACHE))
                        return i;
        }

        return i;
}

/*
 * Check if the PTEs within a range are contiguous swap entries
 * and have consistent swapcache, zeromap.
 */
static bool can_swapin_thp(struct vm_fault *vmf, pte_t *ptep, int nr_pages)
{
        unsigned long addr;
        swp_entry_t entry;
        int idx;
        pte_t pte;

        addr = ALIGN_DOWN(vmf->address, nr_pages * PAGE_SIZE);
        idx = (vmf->address - addr) / PAGE_SIZE;
        pte = ptep_get(ptep);

        if (!pte_same(pte, pte_move_swp_offset(vmf->orig_pte, -idx)))
                return false;
        entry = pte_to_swp_entry(pte);
        if (swap_pte_batch(ptep, nr_pages, pte) != nr_pages)
                return false;

        /*
         * swap_read_folio() can't handle the case a large folio is hybridly
         * from different backends. And they are likely corner cases. Similar
         * things might be added once zswap support large folios.
         */
        if (unlikely(swap_zeromap_batch(entry, nr_pages, NULL) != nr_pages))
                return false;
        if (unlikely(non_swapcache_batch(entry, nr_pages) != nr_pages))
                return false;

        return true;
}

static inline unsigned long thp_swap_suitable_orders(pgoff_t swp_offset,
                                                     unsigned long addr,
                                                     unsigned long orders)
{
        int order, nr;

        order = highest_order(orders);

        /*
         * To swap in a THP with nr pages, we require that its first swap_offset
         * is aligned with that number, as it was when the THP was swapped out.
         * This helps filter out most invalid entries.
         */
        while (orders) {
                nr = 1 << order;
                if ((addr >> PAGE_SHIFT) % nr == swp_offset % nr)
                        break;
                order = next_order(&orders, order);
        }

        return orders;
}

static struct folio *alloc_swap_folio(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        unsigned long orders;
        struct folio *folio;
        unsigned long addr;
        swp_entry_t entry;
        spinlock_t *ptl;
        pte_t *pte;
        gfp_t gfp;
        int order;

        /*
         * If uffd is active for the vma we need per-page fault fidelity to
         * maintain the uffd semantics.
         */
        if (unlikely(userfaultfd_armed(vma)))
                goto fallback;

        /*
         * A large swapped out folio could be partially or fully in zswap. We
         * lack handling for such cases, so fallback to swapping in order-0
         * folio.
         */
        if (!zswap_never_enabled())
                goto fallback;

        entry = pte_to_swp_entry(vmf->orig_pte);
        /*
         * Get a list of all the (large) orders below PMD_ORDER that are enabled
         * and suitable for swapping THP.
         */
        orders = thp_vma_allowable_orders(vma, vma->vm_flags,
                        TVA_IN_PF | TVA_ENFORCE_SYSFS, BIT(PMD_ORDER) - 1);
        orders = thp_vma_suitable_orders(vma, vmf->address, orders);
        orders = thp_swap_suitable_orders(swp_offset(entry),
                                          vmf->address, orders);

        if (!orders)
                goto fallback;

        pte = pte_offset_map_lock(vmf->vma->vm_mm, vmf->pmd,
                                  vmf->address & PMD_MASK, &ptl);
        if (unlikely(!pte))
                goto fallback;

        /*
         * For do_swap_page, find the highest order where the aligned range is
         * completely swap entries with contiguous swap offsets.
         */
        order = highest_order(orders);
        while (orders) {
                addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order);
                if (can_swapin_thp(vmf, pte + pte_index(addr), 1 << order))
                        break;
                order = next_order(&orders, order);
        }

        pte_unmap_unlock(pte, ptl);

        /* Try allocating the highest of the remaining orders. */
        gfp = vma_thp_gfp_mask(vma);
        while (orders) {
                addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order);
                folio = vma_alloc_folio(gfp, order, vma, addr, true);
                if (folio) {
                        if (!mem_cgroup_swapin_charge_folio(folio, vma->vm_mm,
                                                            gfp, entry))
                                return folio;
                        folio_put(folio);
                }
                order = next_order(&orders, order);
        }

fallback:
        return __alloc_swap_folio(vmf);
}
#else /* !CONFIG_TRANSPARENT_HUGEPAGE */
static inline bool can_swapin_thp(struct vm_fault *vmf, pte_t *ptep, int nr_pages)
{
        return false;
}

static struct folio *alloc_swap_folio(struct vm_fault *vmf)
{
        return __alloc_swap_folio(vmf);
}
#endif /* CONFIG_TRANSPARENT_HUGEPAGE */

/*
 * We enter with non-exclusive mmap_lock (to exclude vma changes,
 * but allow concurrent faults), and pte mapped but not yet locked.
 * We return with pte unmapped and unlocked.
 *
 * We return with the mmap_lock locked or unlocked in the same cases
 * as does filemap_fault().
 */
vm_fault_t do_swap_page(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct folio *swapcache, *folio = NULL;
        struct page *page;
        struct swap_info_struct *si = NULL;
        rmap_t rmap_flags = RMAP_NONE;
        bool need_clear_cache = false;
        bool exclusive = false;
        swp_entry_t entry;
        pte_t pte;
        vm_fault_t ret = 0;
        void *shadow = NULL;
        int nr_pages;
        unsigned long page_idx;
        unsigned long address;
        pte_t *ptep;

        if (!pte_unmap_same(vmf))
                goto out;

        entry = pte_to_swp_entry(vmf->orig_pte);
        if (unlikely(non_swap_entry(entry))) {
                if (is_migration_entry(entry)) {
                        migration_entry_wait(vma->vm_mm, vmf->pmd,
                                             vmf->address);
                } else if (is_device_exclusive_entry(entry)) {
                        vmf->page = pfn_swap_entry_to_page(entry);
                        ret = remove_device_exclusive_entry(vmf);
                } else if (is_device_private_entry(entry)) {
                        if (vmf->flags & FAULT_FLAG_VMA_LOCK) {
                                /*
                                 * migrate_to_ram is not yet ready to operate
                                 * under VMA lock.
                                 */
                                vma_end_read(vma);
                                ret = VM_FAULT_RETRY;
                                goto out;
                        }

                        vmf->page = pfn_swap_entry_to_page(entry);
                        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
                                        vmf->address, &vmf->ptl);
                        if (unlikely(!vmf->pte ||
                                     !pte_same(ptep_get(vmf->pte),
                                                        vmf->orig_pte)))
                                goto unlock;

                        /*
                         * Get a page reference while we know the page can't be
                         * freed.
                         */
                        get_page(vmf->page);
                        pte_unmap_unlock(vmf->pte, vmf->ptl);
                        ret = vmf->page->pgmap->ops->migrate_to_ram(vmf);
                        put_page(vmf->page);
                } else if (is_hwpoison_entry(entry)) {
                        ret = VM_FAULT_HWPOISON;
                } else if (is_pte_marker_entry(entry)) {
                        ret = handle_pte_marker(vmf);
                } else {
                        print_bad_pte(vma, vmf->address, vmf->orig_pte, NULL);
                        ret = VM_FAULT_SIGBUS;
                }
                goto out;
        }

        /* Prevent swapoff from happening to us. */
        si = get_swap_device(entry);
        if (unlikely(!si))
                goto out;

        folio = swap_cache_get_folio(entry, vma, vmf->address);
        if (folio)
                page = folio_file_page(folio, swp_offset(entry));
        swapcache = folio;

        if (!folio) {
                if (data_race(si->flags & SWP_SYNCHRONOUS_IO) &&
                    __swap_count(entry) == 1) {
                        /* skip swapcache */
                        folio = alloc_swap_folio(vmf);
                        if (folio) {
                                __folio_set_locked(folio);
                                __folio_set_swapbacked(folio);

                                nr_pages = folio_nr_pages(folio);
                                if (folio_test_large(folio))
                                        entry.val = ALIGN_DOWN(entry.val, nr_pages);
                                /*
                                 * Prevent parallel swapin from proceeding with
                                 * the cache flag. Otherwise, another thread
                                 * may finish swapin first, free the entry, and
                                 * swapout reusing the same entry. It's
                                 * undetectable as pte_same() returns true due
                                 * to entry reuse.
                                 */
                                if (swapcache_prepare(entry, nr_pages)) {
                                        /*
                                         * Relax a bit to prevent rapid
                                         * repeated page faults.
                                         */
                                        schedule_timeout_uninterruptible(1);
                                        goto out_page;
                                }
                                need_clear_cache = true;

                                mem_cgroup_swapin_uncharge_swap(entry, nr_pages);

                                shadow = get_shadow_from_swap_cache(entry);
                                if (shadow)
                                        workingset_refault(folio, shadow);

                                folio_add_lru(folio);

                                /* To provide entry to swap_read_folio() */
                                folio->swap = entry;
                                swap_read_folio(folio, NULL);
                                folio->private = NULL;
                        }
                } else {
                        folio = swapin_readahead(entry, GFP_HIGHUSER_MOVABLE,
                                                vmf);
                        swapcache = folio;
                }

                if (!folio) {
                        /*
                         * Back out if somebody else faulted in this pte
                         * while we released the pte lock.
                         */
                        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
                                        vmf->address, &vmf->ptl);
                        if (likely(vmf->pte &&
                                   pte_same(ptep_get(vmf->pte), vmf->orig_pte)))
                                ret = VM_FAULT_OOM;
                        goto unlock;
                }

                /* Had to read the page from swap area: Major fault */
                ret = VM_FAULT_MAJOR;
                count_vm_event(PGMAJFAULT);
                count_memcg_event_mm(vma->vm_mm, PGMAJFAULT);
                page = folio_file_page(folio, swp_offset(entry));
        } else if (PageHWPoison(page)) {
                /*
                 * hwpoisoned dirty swapcache pages are kept for killing
                 * owner processes (which may be unknown at hwpoison time)
                 */
                ret = VM_FAULT_HWPOISON;
                goto out_release;
        }

        ret |= folio_lock_or_retry(folio, vmf);
        if (ret & VM_FAULT_RETRY)
                goto out_release;

        if (swapcache) {
                /*
                 * Make sure folio_free_swap() or swapoff did not release the
                 * swapcache from under us.  The page pin, and pte_same test
                 * below, are not enough to exclude that.  Even if it is still
                 * swapcache, we need to check that the page's swap has not
                 * changed.
                 */
                if (unlikely(!folio_test_swapcache(folio) ||
                             page_swap_entry(page).val != entry.val))
                        goto out_page;

                /*
                 * KSM sometimes has to copy on read faults, for example, if
                 * page->index of !PageKSM() pages would be nonlinear inside the
                 * anon VMA -- PageKSM() is lost on actual swapout.
                 */
                folio = ksm_might_need_to_copy(folio, vma, vmf->address);
                if (unlikely(!folio)) {
                        ret = VM_FAULT_OOM;
                        folio = swapcache;
                        goto out_page;
                } else if (unlikely(folio == ERR_PTR(-EHWPOISON))) {
                        ret = VM_FAULT_HWPOISON;
                        folio = swapcache;
                        goto out_page;
                }
                if (folio != swapcache)
                        page = folio_page(folio, 0);

                /*
                 * If we want to map a page that's in the swapcache writable, we
                 * have to detect via the refcount if we're really the exclusive
                 * owner. Try removing the extra reference from the local LRU
                 * caches if required.
                 */
                if ((vmf->flags & FAULT_FLAG_WRITE) && folio == swapcache &&
                    !folio_test_ksm(folio) && !folio_test_lru(folio))
                        lru_add_drain();
        }

        folio_throttle_swaprate(folio, GFP_KERNEL);

        /*
         * Back out if somebody else already faulted in this pte.
         */
        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address,
                        &vmf->ptl);
        if (unlikely(!vmf->pte || !pte_same(ptep_get(vmf->pte), vmf->orig_pte)))
                goto out_nomap;

        if (unlikely(!folio_test_uptodate(folio))) {
                ret = VM_FAULT_SIGBUS;
                goto out_nomap;
        }

        /* allocated large folios for SWP_SYNCHRONOUS_IO */
        if (folio_test_large(folio) && !folio_test_swapcache(folio)) {
                unsigned long nr = folio_nr_pages(folio);
                unsigned long folio_start = ALIGN_DOWN(vmf->address, nr * PAGE_SIZE);
                unsigned long idx = (vmf->address - folio_start) / PAGE_SIZE;
                pte_t *folio_ptep = vmf->pte - idx;
                pte_t folio_pte = ptep_get(folio_ptep);

                if (!pte_same(folio_pte, pte_move_swp_offset(vmf->orig_pte, -idx)) ||
                    swap_pte_batch(folio_ptep, nr, folio_pte) != nr)
                        goto out_nomap;

                page_idx = idx;
                address = folio_start;
                ptep = folio_ptep;
                goto check_folio;
        }

        nr_pages = 1;
        page_idx = 0;
        address = vmf->address;
        ptep = vmf->pte;
        if (folio_test_large(folio) && folio_test_swapcache(folio)) {
                int nr = folio_nr_pages(folio);
                unsigned long idx = folio_page_idx(folio, page);
                unsigned long folio_start = address - idx * PAGE_SIZE;
                unsigned long folio_end = folio_start + nr * PAGE_SIZE;
                pte_t *folio_ptep;
                pte_t folio_pte;

                if (unlikely(folio_start < max(address & PMD_MASK, vma->vm_start)))
                        goto check_folio;
                if (unlikely(folio_end > pmd_addr_end(address, vma->vm_end)))
                        goto check_folio;

                folio_ptep = vmf->pte - idx;
                folio_pte = ptep_get(folio_ptep);
                if (!pte_same(folio_pte, pte_move_swp_offset(vmf->orig_pte, -idx)) ||
                    swap_pte_batch(folio_ptep, nr, folio_pte) != nr)
                        goto check_folio;

                page_idx = idx;
                address = folio_start;
                ptep = folio_ptep;
                nr_pages = nr;
                entry = folio->swap;
                page = &folio->page;
        }

check_folio:
        /*
         * PG_anon_exclusive reuses PG_mappedtodisk for anon pages. A swap pte
         * must never point at an anonymous page in the swapcache that is
         * PG_anon_exclusive. Sanity check that this holds and especially, that
         * no filesystem set PG_mappedtodisk on a page in the swapcache. Sanity
         * check after taking the PT lock and making sure that nobody
         * concurrently faulted in this page and set PG_anon_exclusive.
         */
        BUG_ON(!folio_test_anon(folio) && folio_test_mappedtodisk(folio));
        BUG_ON(folio_test_anon(folio) && PageAnonExclusive(page));

        /*
         * Check under PT lock (to protect against concurrent fork() sharing
         * the swap entry concurrently) for certainly exclusive pages.
         */
        if (!folio_test_ksm(folio)) {
                exclusive = pte_swp_exclusive(vmf->orig_pte);
                if (folio != swapcache) {
                        /*
                         * We have a fresh page that is not exposed to the
                         * swapcache -> certainly exclusive.
                         */
                        exclusive = true;
                } else if (exclusive && folio_test_writeback(folio) &&
                          data_race(si->flags & SWP_STABLE_WRITES)) {
                        /*
                         * This is tricky: not all swap backends support
                         * concurrent page modifications while under writeback.
                         *
                         * So if we stumble over such a page in the swapcache
                         * we must not set the page exclusive, otherwise we can
                         * map it writable without further checks and modify it
                         * while still under writeback.
                         *
                         * For these problematic swap backends, simply drop the
                         * exclusive marker: this is perfectly fine as we start
                         * writeback only if we fully unmapped the page and
                         * there are no unexpected references on the page after
                         * unmapping succeeded. After fully unmapped, no
                         * further GUP references (FOLL_GET and FOLL_PIN) can
                         * appear, so dropping the exclusive marker and mapping
                         * it only R/O is fine.
                         */
                        exclusive = false;
                }
        }

        /*
         * Some architectures may have to restore extra metadata to the page
         * when reading from swap. This metadata may be indexed by swap entry
         * so this must be called before swap_free().
         */
        arch_swap_restore(folio_swap(entry, folio), folio);

        /*
         * Remove the swap entry and conditionally try to free up the swapcache.
         * We're already holding a reference on the page but haven't mapped it
         * yet.
         */
        swap_free_nr(entry, nr_pages);
        if (should_try_to_free_swap(folio, vma, vmf->flags))
                folio_free_swap(folio);

        add_mm_counter(vma->vm_mm, MM_ANONPAGES, nr_pages);
        add_mm_counter(vma->vm_mm, MM_SWAPENTS, -nr_pages);
        pte = mk_pte(page, vma->vm_page_prot);
        if (pte_swp_soft_dirty(vmf->orig_pte))
                pte = pte_mksoft_dirty(pte);
        if (pte_swp_uffd_wp(vmf->orig_pte))
                pte = pte_mkuffd_wp(pte);

        /*
         * Same logic as in do_wp_page(); however, optimize for pages that are
         * certainly not shared either because we just allocated them without
         * exposing them to the swapcache or because the swap entry indicates
         * exclusivity.
         */
        if (!folio_test_ksm(folio) &&
            (exclusive || folio_ref_count(folio) == 1)) {
                if ((vma->vm_flags & VM_WRITE) && !userfaultfd_pte_wp(vma, pte) &&
                    !pte_needs_soft_dirty_wp(vma, pte)) {
                        pte = pte_mkwrite(pte, vma);
                        if (vmf->flags & FAULT_FLAG_WRITE) {
                                pte = pte_mkdirty(pte);
                                vmf->flags &= ~FAULT_FLAG_WRITE;
                        }
                }
                rmap_flags |= RMAP_EXCLUSIVE;
        }
        folio_ref_add(folio, nr_pages - 1);
        flush_icache_pages(vma, page, nr_pages);
        vmf->orig_pte = pte_advance_pfn(pte, page_idx);

        /* ksm created a completely new copy */
        if (unlikely(folio != swapcache && swapcache)) {
                folio_add_new_anon_rmap(folio, vma, address, RMAP_EXCLUSIVE);
                folio_add_lru_vma(folio, vma);
        } else if (!folio_test_anon(folio)) {
                /*
                 * We currently only expect small !anon folios which are either
                 * fully exclusive or fully shared, or new allocated large
                 * folios which are fully exclusive. If we ever get large
                 * folios within swapcache here, we have to be careful.
                 */
                VM_WARN_ON_ONCE(folio_test_large(folio) && folio_test_swapcache(folio));
                VM_WARN_ON_FOLIO(!folio_test_locked(folio), folio);
                folio_add_new_anon_rmap(folio, vma, address, rmap_flags);
        } else {
                folio_add_anon_rmap_ptes(folio, page, nr_pages, vma, address,
                                        rmap_flags);
        }

        VM_BUG_ON(!folio_test_anon(folio) ||
                        (pte_write(pte) && !PageAnonExclusive(page)));
        set_ptes(vma->vm_mm, address, ptep, pte, nr_pages);
        arch_do_swap_page_nr(vma->vm_mm, vma, address,
                        pte, pte, nr_pages);

        folio_unlock(folio);
        if (folio != swapcache && swapcache) {
                /*
                 * Hold the lock to avoid the swap entry to be reused
                 * until we take the PT lock for the pte_same() check
                 * (to avoid false positives from pte_same). For
                 * further safety release the lock after the swap_free
                 * so that the swap count won't change under a
                 * parallel locked swapcache.
                 */
                folio_unlock(swapcache);
                folio_put(swapcache);
        }

        if (vmf->flags & FAULT_FLAG_WRITE) {
                ret |= do_wp_page(vmf);
                if (ret & VM_FAULT_ERROR)
                        ret &= VM_FAULT_ERROR;
                goto out;
        }

        /* No need to invalidate - it was non-present before */
        update_mmu_cache_range(vmf, vma, address, ptep, nr_pages);
unlock:
        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
out:
        /* Clear the swap cache pin for direct swapin after PTL unlock */
        if (need_clear_cache)
                swapcache_clear(si, entry, nr_pages);
        if (si)
                put_swap_device(si);
        return ret;
out_nomap:
        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
out_page:
        folio_unlock(folio);
out_release:
        folio_put(folio);
        if (folio != swapcache && swapcache) {
                folio_unlock(swapcache);
                folio_put(swapcache);
        }
        if (need_clear_cache)
                swapcache_clear(si, entry, nr_pages);
        if (si)
                put_swap_device(si);
        return ret;
}

static bool pte_range_none(pte_t *pte, int nr_pages)
{
        int i;

        for (i = 0; i < nr_pages; i++) {
                if (!pte_none(ptep_get_lockless(pte + i)))
                        return false;
        }

        return true;
}

static struct folio *alloc_anon_folio(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
        unsigned long orders;
        struct folio *folio;
        unsigned long addr;
        pte_t *pte;
        gfp_t gfp;
        int order;

        /*
         * If uffd is active for the vma we need per-page fault fidelity to
         * maintain the uffd semantics.
         */
        if (unlikely(userfaultfd_armed(vma)))
                goto fallback;

        /*
         * Get a list of all the (large) orders below PMD_ORDER that are enabled
         * for this vma. Then filter out the orders that can't be allocated over
         * the faulting address and still be fully contained in the vma.
         */
        orders = thp_vma_allowable_orders(vma, vma->vm_flags,
                        TVA_IN_PF | TVA_ENFORCE_SYSFS, BIT(PMD_ORDER) - 1);
        orders = thp_vma_suitable_orders(vma, vmf->address, orders);

        if (!orders)
                goto fallback;

        pte = pte_offset_map(vmf->pmd, vmf->address & PMD_MASK);
        if (!pte)
                return ERR_PTR(-EAGAIN);

        /*
         * Find the highest order where the aligned range is completely
         * pte_none(). Note that all remaining orders will be completely
         * pte_none().
         */
        order = highest_order(orders);
        while (orders) {
                addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order);
                if (pte_range_none(pte + pte_index(addr), 1 << order))
                        break;
                order = next_order(&orders, order);
        }

        pte_unmap(pte);

        if (!orders)
                goto fallback;

        /* Try allocating the highest of the remaining orders. */
        gfp = vma_thp_gfp_mask(vma);
        while (orders) {
                addr = ALIGN_DOWN(vmf->address, PAGE_SIZE << order);
                folio = vma_alloc_folio(gfp, order, vma, addr, true);
                if (folio) {
                        if (mem_cgroup_charge(folio, vma->vm_mm, gfp)) {
                                count_mthp_stat(order, MTHP_STAT_ANON_FAULT_FALLBACK_CHARGE);
                                folio_put(folio);
                                goto next;
                        }
                        folio_throttle_swaprate(folio, gfp);
                        folio_zero_user(folio, vmf->address);
                        return folio;
                }
next:
                count_mthp_stat(order, MTHP_STAT_ANON_FAULT_FALLBACK);
                order = next_order(&orders, order);
        }

fallback:
#endif
        return folio_prealloc(vma->vm_mm, vma, vmf->address, true);
}

/*
 * We enter with non-exclusive mmap_lock (to exclude vma changes,
 * but allow concurrent faults), and pte mapped but not yet locked.
 * We return with mmap_lock still held, but pte unmapped and unlocked.
 */
static vm_fault_t do_anonymous_page(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        unsigned long addr = vmf->address;
        struct folio *folio;
        vm_fault_t ret = 0;
        int nr_pages = 1;
        pte_t entry;

        /* File mapping without ->vm_ops ? */
        if (vma->vm_flags & VM_SHARED)
                return VM_FAULT_SIGBUS;

        /*
         * Use pte_alloc() instead of pte_alloc_map(), so that OOM can
         * be distinguished from a transient failure of pte_offset_map().
         */
        if (pte_alloc(vma->vm_mm, vmf->pmd))
                return VM_FAULT_OOM;

        /* Use the zero-page for reads */
        if (!(vmf->flags & FAULT_FLAG_WRITE) &&
                        !mm_forbids_zeropage(vma->vm_mm)) {
                entry = pte_mkspecial(pfn_pte(my_zero_pfn(vmf->address),
                                                vma->vm_page_prot));
                vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
                                vmf->address, &vmf->ptl);
                if (!vmf->pte)
                        goto unlock;
                if (vmf_pte_changed(vmf)) {
                        update_mmu_tlb(vma, vmf->address, vmf->pte);
                        goto unlock;
                }
                ret = check_stable_address_space(vma->vm_mm);
                if (ret)
                        goto unlock;
                /* Deliver the page fault to userland, check inside PT lock */
                if (userfaultfd_missing(vma)) {
                        pte_unmap_unlock(vmf->pte, vmf->ptl);
                        return handle_userfault(vmf, VM_UFFD_MISSING);
                }
                goto setpte;
        }

        /* Allocate our own private page. */
        ret = vmf_anon_prepare(vmf);
        if (ret)
                return ret;
        /* Returns NULL on OOM or ERR_PTR(-EAGAIN) if we must retry the fault */
        folio = alloc_anon_folio(vmf);
        if (IS_ERR(folio))
                return 0;
        if (!folio)
                goto oom;

        nr_pages = folio_nr_pages(folio);
        addr = ALIGN_DOWN(vmf->address, nr_pages * PAGE_SIZE);

        /*
         * The memory barrier inside __folio_mark_uptodate makes sure that
         * preceding stores to the page contents become visible before
         * the set_pte_at() write.
         */
        __folio_mark_uptodate(folio);

        entry = mk_pte(&folio->page, vma->vm_page_prot);
        entry = pte_sw_mkyoung(entry);
        if (vma->vm_flags & VM_WRITE)
                entry = pte_mkwrite(pte_mkdirty(entry), vma);

        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, addr, &vmf->ptl);
        if (!vmf->pte)
                goto release;
        if (nr_pages == 1 && vmf_pte_changed(vmf)) {
                update_mmu_tlb(vma, addr, vmf->pte);
                goto release;
        } else if (nr_pages > 1 && !pte_range_none(vmf->pte, nr_pages)) {
                update_mmu_tlb_range(vma, addr, vmf->pte, nr_pages);
                goto release;
        }

        ret = check_stable_address_space(vma->vm_mm);
        if (ret)
                goto release;

        /* Deliver the page fault to userland, check inside PT lock */
        if (userfaultfd_missing(vma)) {
                pte_unmap_unlock(vmf->pte, vmf->ptl);
                folio_put(folio);
                return handle_userfault(vmf, VM_UFFD_MISSING);
        }

        folio_ref_add(folio, nr_pages - 1);
        add_mm_counter(vma->vm_mm, MM_ANONPAGES, nr_pages);
        count_mthp_stat(folio_order(folio), MTHP_STAT_ANON_FAULT_ALLOC);
        folio_add_new_anon_rmap(folio, vma, addr, RMAP_EXCLUSIVE);
        folio_add_lru_vma(folio, vma);
setpte:
        if (vmf_orig_pte_uffd_wp(vmf))
                entry = pte_mkuffd_wp(entry);
        set_ptes(vma->vm_mm, addr, vmf->pte, entry, nr_pages);

        /* No need to invalidate - it was non-present before */
        update_mmu_cache_range(vmf, vma, addr, vmf->pte, nr_pages);
unlock:
        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        return ret;
release:
        folio_put(folio);
        goto unlock;
oom:
        return VM_FAULT_OOM;
}

/*
 * The mmap_lock must have been held on entry, and may have been
 * released depending on flags and vma->vm_ops->fault() return value.
 * See filemap_fault() and __lock_page_retry().
 */
static vm_fault_t __do_fault(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct folio *folio;
        vm_fault_t ret;

        /*
         * Preallocate pte before we take page_lock because this might lead to
         * deadlocks for memcg reclaim which waits for pages under writeback:
         *                                lock_page(A)
         *                                SetPageWriteback(A)
         *                                unlock_page(A)
         * lock_page(B)
         *                                lock_page(B)
         * pte_alloc_one
         *   shrink_folio_list
         *     wait_on_page_writeback(A)
         *                                SetPageWriteback(B)
         *                                unlock_page(B)
         *                                # flush A, B to clear the writeback
         */
        if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
                vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
                if (!vmf->prealloc_pte)
                        return VM_FAULT_OOM;
        }

        ret = vma->vm_ops->fault(vmf);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
                            VM_FAULT_DONE_COW)))
                return ret;

        folio = page_folio(vmf->page);
        if (unlikely(PageHWPoison(vmf->page))) {
                vm_fault_t poisonret = VM_FAULT_HWPOISON;
                if (ret & VM_FAULT_LOCKED) {
                        if (page_mapped(vmf->page))
                                unmap_mapping_folio(folio);
                        /* Retry if a clean folio was removed from the cache. */
                        if (mapping_evict_folio(folio->mapping, folio))
                                poisonret = VM_FAULT_NOPAGE;
                        folio_unlock(folio);
                }
                folio_put(folio);
                vmf->page = NULL;
                return poisonret;
        }

        if (unlikely(!(ret & VM_FAULT_LOCKED)))
                folio_lock(folio);
        else
                VM_BUG_ON_PAGE(!folio_test_locked(folio), vmf->page);

        return ret;
}

#ifdef CONFIG_TRANSPARENT_HUGEPAGE
static void deposit_prealloc_pte(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;

        pgtable_trans_huge_deposit(vma->vm_mm, vmf->pmd, vmf->prealloc_pte);
        /*
         * We are going to consume the prealloc table,
         * count that as nr_ptes.
         */
        mm_inc_nr_ptes(vma->vm_mm);
        vmf->prealloc_pte = NULL;
}

vm_fault_t do_set_pmd(struct vm_fault *vmf, struct page *page)
{
        struct folio *folio = page_folio(page);
        struct vm_area_struct *vma = vmf->vma;
        bool write = vmf->flags & FAULT_FLAG_WRITE;
        unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
        pmd_t entry;
        vm_fault_t ret = VM_FAULT_FALLBACK;

        if (!thp_vma_suitable_order(vma, haddr, PMD_ORDER))
                return ret;

        if (folio_order(folio) != HPAGE_PMD_ORDER)
                return ret;
        page = &folio->page;

        /*
         * Just backoff if any subpage of a THP is corrupted otherwise
         * the corrupted page may mapped by PMD silently to escape the
         * check.  This kind of THP just can be PTE mapped.  Access to
         * the corrupted subpage should trigger SIGBUS as expected.
         */
        if (unlikely(folio_test_has_hwpoisoned(folio)))
                return ret;

        /*
         * Archs like ppc64 need additional space to store information
         * related to pte entry. Use the preallocated table for that.
         */
        if (arch_needs_pgtable_deposit() && !vmf->prealloc_pte) {
                vmf->prealloc_pte = pte_alloc_one(vma->vm_mm);
                if (!vmf->prealloc_pte)
                        return VM_FAULT_OOM;
        }

        vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
        if (unlikely(!pmd_none(*vmf->pmd)))
                goto out;

        flush_icache_pages(vma, page, HPAGE_PMD_NR);

        entry = mk_huge_pmd(page, vma->vm_page_prot);
        if (write)
                entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);

        add_mm_counter(vma->vm_mm, mm_counter_file(folio), HPAGE_PMD_NR);
        folio_add_file_rmap_pmd(folio, page, vma);

        /*
         * deposit and withdraw with pmd lock held
         */
        if (arch_needs_pgtable_deposit())
                deposit_prealloc_pte(vmf);

        set_pmd_at(vma->vm_mm, haddr, vmf->pmd, entry);

        update_mmu_cache_pmd(vma, haddr, vmf->pmd);

        /* fault is handled */
        ret = 0;
        count_vm_event(THP_FILE_MAPPED);
out:
        spin_unlock(vmf->ptl);
        return ret;
}
#else
vm_fault_t do_set_pmd(struct vm_fault *vmf, struct page *page)
{
        return VM_FAULT_FALLBACK;
}
#endif

/**
 * set_pte_range - Set a range of PTEs to point to pages in a folio.
 * @vmf: Fault decription.
 * @folio: The folio that contains @page.
 * @page: The first page to create a PTE for.
 * @nr: The number of PTEs to create.
 * @addr: The first address to create a PTE for.
 */
void set_pte_range(struct vm_fault *vmf, struct folio *folio,
                struct page *page, unsigned int nr, unsigned long addr)
{
        struct vm_area_struct *vma = vmf->vma;
        bool write = vmf->flags & FAULT_FLAG_WRITE;
        bool prefault = !in_range(vmf->address, addr, nr * PAGE_SIZE);
        pte_t entry;

        flush_icache_pages(vma, page, nr);
        entry = mk_pte(page, vma->vm_page_prot);

        if (prefault && arch_wants_old_prefaulted_pte())
                entry = pte_mkold(entry);
        else
                entry = pte_sw_mkyoung(entry);

        if (write)
                entry = maybe_mkwrite(pte_mkdirty(entry), vma);
        if (unlikely(vmf_orig_pte_uffd_wp(vmf)))
                entry = pte_mkuffd_wp(entry);
        /* copy-on-write page */
        if (write && !(vma->vm_flags & VM_SHARED)) {
                VM_BUG_ON_FOLIO(nr != 1, folio);
                folio_add_new_anon_rmap(folio, vma, addr, RMAP_EXCLUSIVE);
                folio_add_lru_vma(folio, vma);
        } else {
                folio_add_file_rmap_ptes(folio, page, nr, vma);
        }
        set_ptes(vma->vm_mm, addr, vmf->pte, entry, nr);

        /* no need to invalidate: a not-present page won't be cached */
        update_mmu_cache_range(vmf, vma, addr, vmf->pte, nr);
}

static bool vmf_pte_changed(struct vm_fault *vmf)
{
        if (vmf->flags & FAULT_FLAG_ORIG_PTE_VALID)
                return !pte_same(ptep_get(vmf->pte), vmf->orig_pte);

        return !pte_none(ptep_get(vmf->pte));
}

/**
 * finish_fault - finish page fault once we have prepared the page to fault
 *
 * @vmf: structure describing the fault
 *
 * This function handles all that is needed to finish a page fault once the
 * page to fault in is prepared. It handles locking of PTEs, inserts PTE for
 * given page, adds reverse page mapping, handles memcg charges and LRU
 * addition.
 *
 * The function expects the page to be locked and on success it consumes a
 * reference of a page being mapped (for the PTE which maps it).
 *
 * Return: %0 on success, %VM_FAULT_ code in case of error.
 */
vm_fault_t finish_fault(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct page *page;
        struct folio *folio;
        vm_fault_t ret;
        bool is_cow = (vmf->flags & FAULT_FLAG_WRITE) &&
                      !(vma->vm_flags & VM_SHARED);
        int type, nr_pages;
        unsigned long addr = vmf->address;

        /* Did we COW the page? */
        if (is_cow)
                page = vmf->cow_page;
        else
                page = vmf->page;

        /*
         * check even for read faults because we might have lost our CoWed
         * page
         */
        if (!(vma->vm_flags & VM_SHARED)) {
                ret = check_stable_address_space(vma->vm_mm);
                if (ret)
                        return ret;
        }

        if (pmd_none(*vmf->pmd)) {
                if (PageTransCompound(page)) {
                        ret = do_set_pmd(vmf, page);
                        if (ret != VM_FAULT_FALLBACK)
                                return ret;
                }

                if (vmf->prealloc_pte)
                        pmd_install(vma->vm_mm, vmf->pmd, &vmf->prealloc_pte);
                else if (unlikely(pte_alloc(vma->vm_mm, vmf->pmd)))
                        return VM_FAULT_OOM;
        }

        folio = page_folio(page);
        nr_pages = folio_nr_pages(folio);

        /*
         * Using per-page fault to maintain the uffd semantics, and same
         * approach also applies to non-anonymous-shmem faults to avoid
         * inflating the RSS of the process.
         */
        if (!vma_is_anon_shmem(vma) || unlikely(userfaultfd_armed(vma))) {
                nr_pages = 1;
        } else if (nr_pages > 1) {
                pgoff_t idx = folio_page_idx(folio, page);
                /* The page offset of vmf->address within the VMA. */
                pgoff_t vma_off = vmf->pgoff - vmf->vma->vm_pgoff;
                /* The index of the entry in the pagetable for fault page. */
                pgoff_t pte_off = pte_index(vmf->address);

                /*
                 * Fallback to per-page fault in case the folio size in page
                 * cache beyond the VMA limits and PMD pagetable limits.
                 */
                if (unlikely(vma_off < idx ||
                            vma_off + (nr_pages - idx) > vma_pages(vma) ||
                            pte_off < idx ||
                            pte_off + (nr_pages - idx)  > PTRS_PER_PTE)) {
                        nr_pages = 1;
                } else {
                        /* Now we can set mappings for the whole large folio. */
                        addr = vmf->address - idx * PAGE_SIZE;
                        page = &folio->page;
                }
        }

        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
                                       addr, &vmf->ptl);
        if (!vmf->pte)
                return VM_FAULT_NOPAGE;

        /* Re-check under ptl */
        if (nr_pages == 1 && unlikely(vmf_pte_changed(vmf))) {
                update_mmu_tlb(vma, addr, vmf->pte);
                ret = VM_FAULT_NOPAGE;
                goto unlock;
        } else if (nr_pages > 1 && !pte_range_none(vmf->pte, nr_pages)) {
                update_mmu_tlb_range(vma, addr, vmf->pte, nr_pages);
                ret = VM_FAULT_NOPAGE;
                goto unlock;
        }

        folio_ref_add(folio, nr_pages - 1);
        set_pte_range(vmf, folio, page, nr_pages, addr);
        type = is_cow ? MM_ANONPAGES : mm_counter_file(folio);
        add_mm_counter(vma->vm_mm, type, nr_pages);
        ret = 0;

unlock:
        pte_unmap_unlock(vmf->pte, vmf->ptl);
        return ret;
}

static unsigned long fault_around_pages __read_mostly =
        65536 >> PAGE_SHIFT;

#ifdef CONFIG_DEBUG_FS
static int fault_around_bytes_get(void *data, u64 *val)
{
        *val = fault_around_pages << PAGE_SHIFT;
        return 0;
}

/*
 * fault_around_bytes must be rounded down to the nearest page order as it's
 * what do_fault_around() expects to see.
 */
static int fault_around_bytes_set(void *data, u64 val)
{
        if (val / PAGE_SIZE > PTRS_PER_PTE)
                return -EINVAL;

        /*
         * The minimum value is 1 page, however this results in no fault-around
         * at all. See should_fault_around().
         */
        val = max(val, PAGE_SIZE);
        fault_around_pages = rounddown_pow_of_two(val) >> PAGE_SHIFT;

        return 0;
}
DEFINE_DEBUGFS_ATTRIBUTE(fault_around_bytes_fops,
                fault_around_bytes_get, fault_around_bytes_set, "%llu\n");

static int __init fault_around_debugfs(void)
{
        debugfs_create_file_unsafe("fault_around_bytes", 0644, NULL, NULL,
                                   &fault_around_bytes_fops);
        return 0;
}
late_initcall(fault_around_debugfs);
#endif

/*
 * do_fault_around() tries to map few pages around the fault address. The hope
 * is that the pages will be needed soon and this will lower the number of
 * faults to handle.
 *
 * It uses vm_ops->map_pages() to map the pages, which skips the page if it's
 * not ready to be mapped: not up-to-date, locked, etc.
 *
 * This function doesn't cross VMA or page table boundaries, in order to call
 * map_pages() and acquire a PTE lock only once.
 *
 * fault_around_pages defines how many pages we'll try to map.
 * do_fault_around() expects it to be set to a power of two less than or equal
 * to PTRS_PER_PTE.
 *
 * The virtual address of the area that we map is naturally aligned to
 * fault_around_pages * PAGE_SIZE rounded down to the machine page size
 * (and therefore to page order).  This way it's easier to guarantee
 * that we don't cross page table boundaries.
 */
static vm_fault_t do_fault_around(struct vm_fault *vmf)
{
        pgoff_t nr_pages = READ_ONCE(fault_around_pages);
        pgoff_t pte_off = pte_index(vmf->address);
        /* The page offset of vmf->address within the VMA. */
        pgoff_t vma_off = vmf->pgoff - vmf->vma->vm_pgoff;
        pgoff_t from_pte, to_pte;
        vm_fault_t ret;

        /* The PTE offset of the start address, clamped to the VMA. */
        from_pte = max(ALIGN_DOWN(pte_off, nr_pages),
                       pte_off - min(pte_off, vma_off));

        /* The PTE offset of the end address, clamped to the VMA and PTE. */
        to_pte = min3(from_pte + nr_pages, (pgoff_t)PTRS_PER_PTE,
                      pte_off + vma_pages(vmf->vma) - vma_off) - 1;

        if (pmd_none(*vmf->pmd)) {
                vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm);
                if (!vmf->prealloc_pte)
                        return VM_FAULT_OOM;
        }

        rcu_read_lock();
        ret = vmf->vma->vm_ops->map_pages(vmf,
                        vmf->pgoff + from_pte - pte_off,
                        vmf->pgoff + to_pte - pte_off);
        rcu_read_unlock();

        return ret;
}

/* Return true if we should do read fault-around, false otherwise */
static inline bool should_fault_around(struct vm_fault *vmf)
{
        /* No ->map_pages?  No way to fault around... */
        if (!vmf->vma->vm_ops->map_pages)
                return false;

        if (uffd_disable_fault_around(vmf->vma))
                return false;

        /* A single page implies no faulting 'around' at all. */
        return fault_around_pages > 1;
}

static vm_fault_t do_read_fault(struct vm_fault *vmf)
{
        vm_fault_t ret = 0;
        struct folio *folio;

        /*
         * Let's call ->map_pages() first and use ->fault() as fallback
         * if page by the offset is not ready to be mapped (cold cache or
         * something).
         */
        if (should_fault_around(vmf)) {
                ret = do_fault_around(vmf);
                if (ret)
                        return ret;
        }

        ret = vmf_can_call_fault(vmf);
        if (ret)
                return ret;

        ret = __do_fault(vmf);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
                return ret;

        ret |= finish_fault(vmf);
        folio = page_folio(vmf->page);
        folio_unlock(folio);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
                folio_put(folio);
        return ret;
}

static vm_fault_t do_cow_fault(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct folio *folio;
        vm_fault_t ret;

        ret = vmf_can_call_fault(vmf);
        if (!ret)
                ret = vmf_anon_prepare(vmf);
        if (ret)
                return ret;

        folio = folio_prealloc(vma->vm_mm, vma, vmf->address, false);
        if (!folio)
                return VM_FAULT_OOM;

        vmf->cow_page = &folio->page;

        ret = __do_fault(vmf);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
                goto uncharge_out;
        if (ret & VM_FAULT_DONE_COW)
                return ret;

        if (copy_mc_user_highpage(vmf->cow_page, vmf->page, vmf->address, vma)) {
                ret = VM_FAULT_HWPOISON;
                goto unlock;
        }
        __folio_mark_uptodate(folio);

        ret |= finish_fault(vmf);
unlock:
        unlock_page(vmf->page);
        put_page(vmf->page);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
                goto uncharge_out;
        return ret;
uncharge_out:
        folio_put(folio);
        return ret;
}

static vm_fault_t do_shared_fault(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        vm_fault_t ret, tmp;
        struct folio *folio;

        ret = vmf_can_call_fault(vmf);
        if (ret)
                return ret;

        ret = __do_fault(vmf);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
                return ret;

        folio = page_folio(vmf->page);

        /*
         * Check if the backing address space wants to know that the page is
         * about to become writable
         */
        if (vma->vm_ops->page_mkwrite) {
                folio_unlock(folio);
                tmp = do_page_mkwrite(vmf, folio);
                if (unlikely(!tmp ||
                                (tmp & (VM_FAULT_ERROR | VM_FAULT_NOPAGE)))) {
                        folio_put(folio);
                        return tmp;
                }
        }

        ret |= finish_fault(vmf);
        if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE |
                                        VM_FAULT_RETRY))) {
                folio_unlock(folio);
                folio_put(folio);
                return ret;
        }

        ret |= fault_dirty_shared_page(vmf);
        return ret;
}

/*
 * We enter with non-exclusive mmap_lock (to exclude vma changes,
 * but allow concurrent faults).
 * The mmap_lock may have been released depending on flags and our
 * return value.  See filemap_fault() and __folio_lock_or_retry().
 * If mmap_lock is released, vma may become invalid (for example
 * by other thread calling munmap()).
 */
static vm_fault_t do_fault(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct mm_struct *vm_mm = vma->vm_mm;
        vm_fault_t ret;

        /*
         * The VMA was not fully populated on mmap() or missing VM_DONTEXPAND
         */
        if (!vma->vm_ops->fault) {
                vmf->pte = pte_offset_map_lock(vmf->vma->vm_mm, vmf->pmd,
                                               vmf->address, &vmf->ptl);
                if (unlikely(!vmf->pte))
                        ret = VM_FAULT_SIGBUS;
                else {
                        /*
                         * Make sure this is not a temporary clearing of pte
                         * by holding ptl and checking again. A R/M/W update
                         * of pte involves: take ptl, clearing the pte so that
                         * we don't have concurrent modification by hardware
                         * followed by an update.
                         */
                        if (unlikely(pte_none(ptep_get(vmf->pte))))
                                ret = VM_FAULT_SIGBUS;
                        else
                                ret = VM_FAULT_NOPAGE;

                        pte_unmap_unlock(vmf->pte, vmf->ptl);
                }
        } else if (!(vmf->flags & FAULT_FLAG_WRITE))
                ret = do_read_fault(vmf);
        else if (!(vma->vm_flags & VM_SHARED))
                ret = do_cow_fault(vmf);
        else
                ret = do_shared_fault(vmf);

        /* preallocated pagetable is unused: free it */
        if (vmf->prealloc_pte) {
                pte_free(vm_mm, vmf->prealloc_pte);
                vmf->prealloc_pte = NULL;
        }
        return ret;
}

int numa_migrate_check(struct folio *folio, struct vm_fault *vmf,
                      unsigned long addr, int *flags,
                      bool writable, int *last_cpupid)
{
        struct vm_area_struct *vma = vmf->vma;

        /*
         * Avoid grouping on RO pages in general. RO pages shouldn't hurt as
         * much anyway since they can be in shared cache state. This misses
         * the case where a mapping is writable but the process never writes
         * to it but pte_write gets cleared during protection updates and
         * pte_dirty has unpredictable behaviour between PTE scan updates,
         * background writeback, dirty balancing and application behaviour.
         */
        if (!writable)
                *flags |= TNF_NO_GROUP;

        /*
         * Flag if the folio is shared between multiple address spaces. This
         * is later used when determining whether to group tasks together
         */
        if (folio_likely_mapped_shared(folio) && (vma->vm_flags & VM_SHARED))
                *flags |= TNF_SHARED;
        /*
         * For memory tiering mode, cpupid of slow memory page is used
         * to record page access time.  So use default value.
         */
        if (folio_use_access_time(folio))
                *last_cpupid = (-1 & LAST_CPUPID_MASK);
        else
                *last_cpupid = folio_last_cpupid(folio);

        /* Record the current PID acceesing VMA */
        vma_set_access_pid_bit(vma);

        count_vm_numa_event(NUMA_HINT_FAULTS);
#ifdef CONFIG_NUMA_BALANCING
        count_memcg_folio_events(folio, NUMA_HINT_FAULTS, 1);
#endif
        if (folio_nid(folio) == numa_node_id()) {
                count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
                *flags |= TNF_FAULT_LOCAL;
        }

        return mpol_misplaced(folio, vmf, addr);
}

static void numa_rebuild_single_mapping(struct vm_fault *vmf, struct vm_area_struct *vma,
                                        unsigned long fault_addr, pte_t *fault_pte,
                                        bool writable)
{
        pte_t pte, old_pte;

        old_pte = ptep_modify_prot_start(vma, fault_addr, fault_pte);
        pte = pte_modify(old_pte, vma->vm_page_prot);
        pte = pte_mkyoung(pte);
        if (writable)
                pte = pte_mkwrite(pte, vma);
        ptep_modify_prot_commit(vma, fault_addr, fault_pte, old_pte, pte);
        update_mmu_cache_range(vmf, vma, fault_addr, fault_pte, 1);
}

static void numa_rebuild_large_mapping(struct vm_fault *vmf, struct vm_area_struct *vma,
                                       struct folio *folio, pte_t fault_pte,
                                       bool ignore_writable, bool pte_write_upgrade)
{
        int nr = pte_pfn(fault_pte) - folio_pfn(folio);
        unsigned long start, end, addr = vmf->address;
        unsigned long addr_start = addr - (nr << PAGE_SHIFT);
        unsigned long pt_start = ALIGN_DOWN(addr, PMD_SIZE);
        pte_t *start_ptep;

        /* Stay within the VMA and within the page table. */
        start = max3(addr_start, pt_start, vma->vm_start);
        end = min3(addr_start + folio_size(folio), pt_start + PMD_SIZE,
                   vma->vm_end);
        start_ptep = vmf->pte - ((addr - start) >> PAGE_SHIFT);

        /* Restore all PTEs' mapping of the large folio */
        for (addr = start; addr != end; start_ptep++, addr += PAGE_SIZE) {
                pte_t ptent = ptep_get(start_ptep);
                bool writable = false;

                if (!pte_present(ptent) || !pte_protnone(ptent))
                        continue;

                if (pfn_folio(pte_pfn(ptent)) != folio)
                        continue;

                if (!ignore_writable) {
                        ptent = pte_modify(ptent, vma->vm_page_prot);
                        writable = pte_write(ptent);
                        if (!writable && pte_write_upgrade &&
                            can_change_pte_writable(vma, addr, ptent))
                                writable = true;
                }

                numa_rebuild_single_mapping(vmf, vma, addr, start_ptep, writable);
        }
}

static vm_fault_t do_numa_page(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        struct folio *folio = NULL;
        int nid = NUMA_NO_NODE;
        bool writable = false, ignore_writable = false;
        bool pte_write_upgrade = vma_wants_manual_pte_write_upgrade(vma);
        int last_cpupid;
        int target_nid;
        pte_t pte, old_pte;
        int flags = 0, nr_pages;

        /*
         * The pte cannot be used safely until we verify, while holding the page
         * table lock, that its contents have not changed during fault handling.
         */
        spin_lock(vmf->ptl);
        /* Read the live PTE from the page tables: */
        old_pte = ptep_get(vmf->pte);

        if (unlikely(!pte_same(old_pte, vmf->orig_pte))) {
                pte_unmap_unlock(vmf->pte, vmf->ptl);
                return 0;
        }

        pte = pte_modify(old_pte, vma->vm_page_prot);

        /*
         * Detect now whether the PTE could be writable; this information
         * is only valid while holding the PT lock.
         */
        writable = pte_write(pte);
        if (!writable && pte_write_upgrade &&
            can_change_pte_writable(vma, vmf->address, pte))
                writable = true;

        folio = vm_normal_folio(vma, vmf->address, pte);
        if (!folio || folio_is_zone_device(folio))
                goto out_map;

        nid = folio_nid(folio);
        nr_pages = folio_nr_pages(folio);

        target_nid = numa_migrate_check(folio, vmf, vmf->address, &flags,
                                        writable, &last_cpupid);
        if (target_nid == NUMA_NO_NODE)
                goto out_map;
        if (migrate_misplaced_folio_prepare(folio, vma, target_nid)) {
                flags |= TNF_MIGRATE_FAIL;
                goto out_map;
        }
        /* The folio is isolated and isolation code holds a folio reference. */
        pte_unmap_unlock(vmf->pte, vmf->ptl);
        writable = false;
        ignore_writable = true;

        /* Migrate to the requested node */
        if (!migrate_misplaced_folio(folio, vma, target_nid)) {
                nid = target_nid;
                flags |= TNF_MIGRATED;
                task_numa_fault(last_cpupid, nid, nr_pages, flags);
                return 0;
        }

        flags |= TNF_MIGRATE_FAIL;
        vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd,
                                       vmf->address, &vmf->ptl);
        if (unlikely(!vmf->pte))
                return 0;
        if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) {
                pte_unmap_unlock(vmf->pte, vmf->ptl);
                return 0;
        }
out_map:
        /*
         * Make it present again, depending on how arch implements
         * non-accessible ptes, some can allow access by kernel mode.
         */
        if (folio && folio_test_large(folio))
                numa_rebuild_large_mapping(vmf, vma, folio, pte, ignore_writable,
                                           pte_write_upgrade);
        else
                numa_rebuild_single_mapping(vmf, vma, vmf->address, vmf->pte,
                                            writable);
        pte_unmap_unlock(vmf->pte, vmf->ptl);

        if (nid != NUMA_NO_NODE)
                task_numa_fault(last_cpupid, nid, nr_pages, flags);
        return 0;
}

static inline vm_fault_t create_huge_pmd(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        if (vma_is_anonymous(vma))
                return do_huge_pmd_anonymous_page(vmf);
        if (vma->vm_ops->huge_fault)
                return vma->vm_ops->huge_fault(vmf, PMD_ORDER);
        return VM_FAULT_FALLBACK;
}

/* `inline' is required to avoid gcc 4.1.2 build error */
static inline vm_fault_t wp_huge_pmd(struct vm_fault *vmf)
{
        struct vm_area_struct *vma = vmf->vma;
        const bool unshare = vmf->flags & FAULT_FLAG_UNSHARE;
        vm_fault_t ret;

        if (vma_is_anonymous(vma)) {
                if (likely(!unshare) &&
                    userfaultfd_huge_pmd_wp(vma, vmf->orig_pmd)) {
                        if (userfaultfd_wp_async(vmf->vma))
                                goto split;
                        return handle_userfault(vmf, VM_UFFD_WP);
                }
                return do_huge_pmd_wp_page(vmf);
        }

        if (vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) {
                if (vma->vm_ops->huge_fault) {
                        ret = vma->vm_ops->huge_fault(vmf, PMD_ORDER);
                        if (!(ret & VM_FAULT_FALLBACK))
                                return ret;
                }
        }

split:
        /* COW or write-notify handled on pte level: split pmd. */
        __split_huge_pmd(vma, vmf->pmd, vmf->address, false, NULL);

        return VM_FAULT_FALLBACK;
}

static vm_fault_t create_huge_pud(struct vm_fault *vmf)
{
#if defined(CONFIG_TRANSPARENT_HUGEPAGE) &&                        \
        defined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)
        struct vm_area_struct *vma = vmf->vma;
        /* No support for anonymous transparent PUD pages yet */
        if (vma_is_anonymous(vma))
                return VM_FAULT_FALLBACK;
        if (vma->vm_ops->huge_fault)
                return vma->vm_ops->huge_fault(vmf, PUD_ORDER);
#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
        return VM_FAULT_FALLBACK;
}

static vm_fault_t wp_huge_pud(struct vm_fault *vmf, pud_t orig_pud)
{
#if defined(CONFIG_TRANSPARENT_HUGEPAGE) &&                        \
        defined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD)
        struct vm_area_struct *vma = vmf->vma;
        vm_fault_t ret;

        /* No support for anonymous transparent PUD pages yet */
        if (vma_is_anonymous(vma))
                goto split;
        if (vma->vm_flags & (VM_SHARED | VM_MAYSHARE)) {
                if (vma->vm_ops->huge_fault) {
                        ret = vma->vm_ops->huge_fault(vmf, PUD_ORDER);
                        if (!(ret & VM_FAULT_FALLBACK))
                                return ret;
                }
        }
split:
        /* COW or write-notify not handled on PUD level: split pud.*/
        __split_huge_pud(vma, vmf->pud, vmf->address);
#endif /* CONFIG_TRANSPARENT_HUGEPAGE && CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */
        return VM_FAULT_FALLBACK;
}

/*
 * These routines also need to handle stuff like marking pages dirty
 * and/or accessed for architectures that don't do it in hardware (most
 * RISC architectures).  The early dirtying is also good on the i386.
 *
 * There is also a hook called "update_mmu_cache()" that architectures
 * with external mmu caches can use to update those (ie the Sparc or
 * PowerPC hashed page tables that act as extended TLBs).
 *
 * We enter with non-exclusive mmap_lock (to exclude vma changes, but allow
 * concurrent faults).
 *
 * The mmap_lock may have been released depending on flags and our return value.
 * See filemap_fault() and __folio_lock_or_retry().
 */
static vm_fault_t handle_pte_fault(struct vm_fault *vmf)
{
        pte_t entry;

        if (unlikely(pmd_none(*vmf->pmd))) {
                /*
                 * Leave __pte_alloc() until later: because vm_ops->fault may
                 * want to allocate huge page, and if we expose page table
                 * for an instant, it will be difficult to retract from
                 * concurrent faults and from rmap lookups.
                 */
                vmf->pte = NULL;
                vmf->flags &= ~FAULT_FLAG_ORIG_PTE_VALID;
        } else {
                /*
                 * A regular pmd is established and it can't morph into a huge
                 * pmd by anon khugepaged, since that takes mmap_lock in write
                 * mode; but shmem or file collapse to THP could still morph
                 * it into a huge pmd: just retry later if so.
                 */
                vmf->pte = pte_offset_map_nolock(vmf->vma->vm_mm, vmf->pmd,
                                                 vmf->address, &vmf->ptl);
                if (unlikely(!vmf->pte))
                        return 0;
                vmf->orig_pte = ptep_get_lockless(vmf->pte);
                vmf->flags |= FAULT_FLAG_ORIG_PTE_VALID;

                if (pte_none(vmf->orig_pte)) {
                        pte_unmap(vmf->pte);
                        vmf->pte = NULL;
                }
        }

        if (!vmf->pte)
                return do_pte_missing(vmf);

        if (!pte_present(vmf->orig_pte))
                return do_swap_page(vmf);

        if (pte_protnone(vmf->orig_pte) && vma_is_accessible(vmf->vma))
                return do_numa_page(vmf);

        spin_lock(vmf->ptl);
        entry = vmf->orig_pte;
        if (unlikely(!pte_same(ptep_get(vmf->pte), entry))) {
                update_mmu_tlb(vmf->vma, vmf->address, vmf->pte);
                goto unlock;
        }
        if (vmf->flags & (FAULT_FLAG_WRITE|FAULT_FLAG_UNSHARE)) {
                if (!pte_write(entry))
                        return do_wp_page(vmf);
                else if (likely(vmf->flags & FAULT_FLAG_WRITE))
                        entry = pte_mkdirty(entry);
        }
        entry = pte_mkyoung(entry);
        if (ptep_set_access_flags(vmf->vma, vmf->address, vmf->pte, entry,
                                vmf->flags & FAULT_FLAG_WRITE)) {
                update_mmu_cache_range(vmf, vmf->vma, vmf->address,
                                vmf->pte, 1);
        } else {
                /* Skip spurious TLB flush for retried page fault */
                if (vmf->flags & FAULT_FLAG_TRIED)
                        goto unlock;
                /*
                 * This is needed only for protection faults but the arch code
                 * is not yet telling us if this is a protection fault or not.
                 * This still avoids useless tlb flushes for .text page faults
                 * with threads.
                 */
                if (vmf->flags & FAULT_FLAG_WRITE)
                        flush_tlb_fix_spurious_fault(vmf->vma, vmf->address,
                                                     vmf->pte);
        }
unlock:
        pte_unmap_unlock(vmf->pte, vmf->ptl);
        return 0;
}

/*
 * On entry, we hold either the VMA lock or the mmap_lock
 * (FAULT_FLAG_VMA_LOCK tells you which).  If VM_FAULT_RETRY is set in
 * the result, the mmap_lock is not held on exit.  See filemap_fault()
 * and __folio_lock_or_retry().
 */
static vm_fault_t __handle_mm_fault(struct vm_area_struct *vma,
                unsigned long address, unsigned int flags)
{
        struct vm_fault vmf = {
                .vma = vma,
                .address = address & PAGE_MASK,
                .real_address = address,
                .flags = flags,
                .pgoff = linear_page_index(vma, address),
                .gfp_mask = __get_fault_gfp_mask(vma),
        };
        struct mm_struct *mm = vma->vm_mm;
        unsigned long vm_flags = vma->vm_flags;
        pgd_t *pgd;
        p4d_t *p4d;
        vm_fault_t ret;

        pgd = pgd_offset(mm, address);
        p4d = p4d_alloc(mm, pgd, address);
        if (!p4d)
                return VM_FAULT_OOM;

        vmf.pud = pud_alloc(mm, p4d, address);
        if (!vmf.pud)
                return VM_FAULT_OOM;
retry_pud:
        if (pud_none(*vmf.pud) &&
            thp_vma_allowable_order(vma, vm_flags,
                                TVA_IN_PF | TVA_ENFORCE_SYSFS, PUD_ORDER)) {
                ret = create_huge_pud(&vmf);
                if (!(ret & VM_FAULT_FALLBACK))
                        return ret;
        } else {
                pud_t orig_pud = *vmf.pud;

                barrier();
                if (pud_trans_huge(orig_pud) || pud_devmap(orig_pud)) {

                        /*
                         * TODO once we support anonymous PUDs: NUMA case and
                         * FAULT_FLAG_UNSHARE handling.
                         */
                        if ((flags & FAULT_FLAG_WRITE) && !pud_write(orig_pud)) {
                                ret = wp_huge_pud(&vmf, orig_pud);
                                if (!(ret & VM_FAULT_FALLBACK))
                                        return ret;
                        } else {
                                huge_pud_set_accessed(&vmf, orig_pud);
                                return 0;
                        }
                }
        }

        vmf.pmd = pmd_alloc(mm, vmf.pud, address);
        if (!vmf.pmd)
                return VM_FAULT_OOM;

        /* Huge pud page fault raced with pmd_alloc? */
        if (pud_trans_unstable(vmf.pud))
                goto retry_pud;

        if (pmd_none(*vmf.pmd) &&
            thp_vma_allowable_order(vma, vm_flags,
                                TVA_IN_PF | TVA_ENFORCE_SYSFS, PMD_ORDER)) {
                ret = create_huge_pmd(&vmf);
                if (!(ret & VM_FAULT_FALLBACK))
                        return ret;
        } else {
                vmf.orig_pmd = pmdp_get_lockless(vmf.pmd);

                if (unlikely(is_swap_pmd(vmf.orig_pmd))) {
                        VM_BUG_ON(thp_migration_supported() &&
                                          !is_pmd_migration_entry(vmf.orig_pmd));
                        if (is_pmd_migration_entry(vmf.orig_pmd))
                                pmd_migration_entry_wait(mm, vmf.pmd);
                        return 0;
                }
                if (pmd_trans_huge(vmf.orig_pmd) || pmd_devmap(vmf.orig_pmd)) {
                        if (pmd_protnone(vmf.orig_pmd) && vma_is_accessible(vma))
                                return do_huge_pmd_numa_page(&vmf);

                        if ((flags & (FAULT_FLAG_WRITE|FAULT_FLAG_UNSHARE)) &&
                            !pmd_write(vmf.orig_pmd)) {
                                ret = wp_huge_pmd(&vmf);
                                if (!(ret & VM_FAULT_FALLBACK))
                                        return ret;
                        } else {
                                huge_pmd_set_accessed(&vmf);
                                return 0;
                        }
                }
        }

        return handle_pte_fault(&vmf);
}

/**
 * mm_account_fault - Do page fault accounting
 * @mm: mm from which memcg should be extracted. It can be NULL.
 * @regs: the pt_regs struct pointer.  When set to NULL, will skip accounting
 *        of perf event counters, but we'll still do the per-task accounting to
 *        the task who triggered this page fault.
 * @address: the faulted address.
 * @flags: the fault flags.
 * @ret: the fault retcode.
 *
 * This will take care of most of the page fault accounting.  Meanwhile, it
 * will also include the PERF_COUNT_SW_PAGE_FAULTS_[MAJ|MIN] perf counter
 * updates.  However, note that the handling of PERF_COUNT_SW_PAGE_FAULTS should
 * still be in per-arch page fault handlers at the entry of page fault.
 */
static inline void mm_account_fault(struct mm_struct *mm, struct pt_regs *regs,
                                    unsigned long address, unsigned int flags,
                                    vm_fault_t ret)
{
        bool major;

        /* Incomplete faults will be accounted upon completion. */
        if (ret & VM_FAULT_RETRY)
                return;

        /*
         * To preserve the behavior of older kernels, PGFAULT counters record
         * both successful and failed faults, as opposed to perf counters,
         * which ignore failed cases.
         */
        count_vm_event(PGFAULT);
        count_memcg_event_mm(mm, PGFAULT);

        /*
         * Do not account for unsuccessful faults (e.g. when the address wasn't
         * valid).  That includes arch_vma_access_permitted() failing before
         * reaching here. So this is not a "this many hardware page faults"
         * counter.  We should use the hw profiling for that.
         */
        if (ret & VM_FAULT_ERROR)
                return;

        /*
         * We define the fault as a major fault when the final successful fault
         * is VM_FAULT_MAJOR, or if it retried (which implies that we couldn't
         * handle it immediately previously).
         */
        major = (ret & VM_FAULT_MAJOR) || (flags & FAULT_FLAG_TRIED);

        if (major)
                current->maj_flt++;
        else
                current->min_flt++;

        /*
         * If the fault is done for GUP, regs will be NULL.  We only do the
         * accounting for the per thread fault counters who triggered the
         * fault, and we skip the perf event updates.
         */
        if (!regs)
                return;

        if (major)
                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
        else
                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
}

#ifdef CONFIG_LRU_GEN
static void lru_gen_enter_fault(struct vm_area_struct *vma)
{
        /* the LRU algorithm only applies to accesses with recency */
        current->in_lru_fault = vma_has_recency(vma);
}

static void lru_gen_exit_fault(void)
{
        current->in_lru_fault = false;
}
#else
static void lru_gen_enter_fault(struct vm_area_struct *vma)
{
}

static void lru_gen_exit_fault(void)
{
}
#endif /* CONFIG_LRU_GEN */

static vm_fault_t sanitize_fault_flags(struct vm_area_struct *vma,
                                       unsigned int *flags)
{
        if (unlikely(*flags & FAULT_FLAG_UNSHARE)) {
                if (WARN_ON_ONCE(*flags & FAULT_FLAG_WRITE))
                        return VM_FAULT_SIGSEGV;
                /*
                 * FAULT_FLAG_UNSHARE only applies to COW mappings. Let's
                 * just treat it like an ordinary read-fault otherwise.
                 */
                if (!is_cow_mapping(vma->vm_flags))
                        *flags &= ~FAULT_FLAG_UNSHARE;
        } else if (*flags & FAULT_FLAG_WRITE) {
                /* Write faults on read-only mappings are impossible ... */
                if (WARN_ON_ONCE(!(vma->vm_flags & VM_MAYWRITE)))
                        return VM_FAULT_SIGSEGV;
                /* ... and FOLL_FORCE only applies to COW mappings. */
                if (WARN_ON_ONCE(!(vma->vm_flags & VM_WRITE) &&
                                 !is_cow_mapping(vma->vm_flags)))
                        return VM_FAULT_SIGSEGV;
        }
#ifdef CONFIG_PER_VMA_LOCK
        /*
         * Per-VMA locks can't be used with FAULT_FLAG_RETRY_NOWAIT because of
         * the assumption that lock is dropped on VM_FAULT_RETRY.
         */
        if (WARN_ON_ONCE((*flags &
                        (FAULT_FLAG_VMA_LOCK | FAULT_FLAG_RETRY_NOWAIT)) ==
                        (FAULT_FLAG_VMA_LOCK | FAULT_FLAG_RETRY_NOWAIT)))
                return VM_FAULT_SIGSEGV;
#endif

        return 0;
}

/*
 * By the time we get here, we already hold the mm semaphore
 *
 * The mmap_lock may have been released depending on flags and our
 * return value.  See filemap_fault() and __folio_lock_or_retry().
 */
vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                           unsigned int flags, struct pt_regs *regs)
{
        /* If the fault handler drops the mmap_lock, vma may be freed */
        struct mm_struct *mm = vma->vm_mm;
        vm_fault_t ret;
        bool is_droppable;

        __set_current_state(TASK_RUNNING);

        ret = sanitize_fault_flags(vma, &flags);
        if (ret)
                goto out;

        if (!arch_vma_access_permitted(vma, flags & FAULT_FLAG_WRITE,
                                            flags & FAULT_FLAG_INSTRUCTION,
                                            flags & FAULT_FLAG_REMOTE)) {
                ret = VM_FAULT_SIGSEGV;
                goto out;
        }

        is_droppable = !!(vma->vm_flags & VM_DROPPABLE);

        /*
         * Enable the memcg OOM handling for faults triggered in user
         * space.  Kernel faults are handled more gracefully.
         */
        if (flags & FAULT_FLAG_USER)
                mem_cgroup_enter_user_fault();

        lru_gen_enter_fault(vma);

        if (unlikely(is_vm_hugetlb_page(vma)))
                ret = hugetlb_fault(vma->vm_mm, vma, address, flags);
        else
                ret = __handle_mm_fault(vma, address, flags);

        /*
         * Warning: It is no longer safe to dereference vma-> after this point,
         * because mmap_lock might have been dropped by __handle_mm_fault(), so
         * vma might be destroyed from underneath us.
         */

        lru_gen_exit_fault();

        /* If the mapping is droppable, then errors due to OOM aren't fatal. */
        if (is_droppable)
                ret &= ~VM_FAULT_OOM;

        if (flags & FAULT_FLAG_USER) {
                mem_cgroup_exit_user_fault();
                /*
                 * The task may have entered a memcg OOM situation but
                 * if the allocation error was handled gracefully (no
                 * VM_FAULT_OOM), there is no need to kill anything.
                 * Just clean up the OOM state peacefully.
                 */
                if (task_in_memcg_oom(current) && !(ret & VM_FAULT_OOM))
                        mem_cgroup_oom_synchronize(false);
        }
out:
        mm_account_fault(mm, regs, address, flags, ret);

        return ret;
}
EXPORT_SYMBOL_GPL(handle_mm_fault);

#ifdef CONFIG_LOCK_MM_AND_FIND_VMA
#include <linux/extable.h>

static inline bool get_mmap_lock_carefully(struct mm_struct *mm, struct pt_regs *regs)
{
        if (likely(mmap_read_trylock(mm)))
                return true;

        if (regs && !user_mode(regs)) {
                unsigned long ip = exception_ip(regs);
                if (!search_exception_tables(ip))
                        return false;
        }

        return !mmap_read_lock_killable(mm);
}

static inline bool mmap_upgrade_trylock(struct mm_struct *mm)
{
        /*
         * We don't have this operation yet.
         *
         * It should be easy enough to do: it's basically a
         *    atomic_long_try_cmpxchg_acquire()
         * from RWSEM_READER_BIAS -> RWSEM_WRITER_LOCKED, but
         * it also needs the proper lockdep magic etc.
         */
        return false;
}

static inline bool upgrade_mmap_lock_carefully(struct mm_struct *mm, struct pt_regs *regs)
{
        mmap_read_unlock(mm);
        if (regs && !user_mode(regs)) {
                unsigned long ip = exception_ip(regs);
                if (!search_exception_tables(ip))
                        return false;
        }
        return !mmap_write_lock_killable(mm);
}

/*
 * Helper for page fault handling.
 *
 * This is kind of equivalend to "mmap_read_lock()" followed
 * by "find_extend_vma()", except it's a lot more careful about
 * the locking (and will drop the lock on failure).
 *
 * For example, if we have a kernel bug that causes a page
 * fault, we don't want to just use mmap_read_lock() to get
 * the mm lock, because that would deadlock if the bug were
 * to happen while we're holding the mm lock for writing.
 *
 * So this checks the exception tables on kernel faults in
 * order to only do this all for instructions that are actually
 * expected to fault.
 *
 * We can also actually take the mm lock for writing if we
 * need to extend the vma, which helps the VM layer a lot.
 */
struct vm_area_struct *lock_mm_and_find_vma(struct mm_struct *mm,
                        unsigned long addr, struct pt_regs *regs)
{
        struct vm_area_struct *vma;

        if (!get_mmap_lock_carefully(mm, regs))
                return NULL;

        vma = find_vma(mm, addr);
        if (likely(vma && (vma->vm_start <= addr)))
                return vma;

        /*
         * Well, dang. We might still be successful, but only
         * if we can extend a vma to do so.
         */
        if (!vma || !(vma->vm_flags & VM_GROWSDOWN)) {
                mmap_read_unlock(mm);
                return NULL;
        }

        /*
         * We can try to upgrade the mmap lock atomically,
         * in which case we can continue to use the vma
         * we already looked up.
         *
         * Otherwise we'll have to drop the mmap lock and
         * re-take it, and also look up the vma again,
         * re-checking it.
         */
        if (!mmap_upgrade_trylock(mm)) {
                if (!upgrade_mmap_lock_carefully(mm, regs))
                        return NULL;

                vma = find_vma(mm, addr);
                if (!vma)
                        goto fail;
                if (vma->vm_start <= addr)
                        goto success;
                if (!(vma->vm_flags & VM_GROWSDOWN))
                        goto fail;
        }

        if (expand_stack_locked(vma, addr))
                goto fail;

success:
        mmap_write_downgrade(mm);
        return vma;

fail:
        mmap_write_unlock(mm);
        return NULL;
}
#endif

#ifdef CONFIG_PER_VMA_LOCK
/*
 * Lookup and lock a VMA under RCU protection. Returned VMA is guaranteed to be
 * stable and not isolated. If the VMA is not found or is being modified the
 * function returns NULL.
 */
struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm,
                                          unsigned long address)
{
        MA_STATE(mas, &mm->mm_mt, address, address);
        struct vm_area_struct *vma;

        rcu_read_lock();
retry:
        vma = mas_walk(&mas);
        if (!vma)
                goto inval;

        if (!vma_start_read(vma))
                goto inval;

        /* Check if the VMA got isolated after we found it */
        if (vma->detached) {
                vma_end_read(vma);
                count_vm_vma_lock_event(VMA_LOCK_MISS);
                /* The area was replaced with another one */
                goto retry;
        }
        /*
         * At this point, we have a stable reference to a VMA: The VMA is
         * locked and we know it hasn't already been isolated.
         * From here on, we can access the VMA without worrying about which
         * fields are accessible for RCU readers.
         */

        /* Check since vm_start/vm_end might change before we lock the VMA */
        if (unlikely(address < vma->vm_start || address >= vma->vm_end))
                goto inval_end_read;

        rcu_read_unlock();
        return vma;

inval_end_read:
        vma_end_read(vma);
inval:
        rcu_read_unlock();
        count_vm_vma_lock_event(VMA_LOCK_ABORT);
        return NULL;
}
#endif /* CONFIG_PER_VMA_LOCK */

#ifndef __PAGETABLE_P4D_FOLDED
/*
 * Allocate p4d page table.
 * We've already handled the fast-path in-line.
 */
int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
{
        p4d_t *new = p4d_alloc_one(mm, address);
        if (!new)
                return -ENOMEM;

        spin_lock(&mm->page_table_lock);
        if (pgd_present(*pgd)) {        /* Another has populated it */
                p4d_free(mm, new);
        } else {
                smp_wmb(); /* See comment in pmd_install() */
                pgd_populate(mm, pgd, new);
        }
        spin_unlock(&mm->page_table_lock);
        return 0;
}
#endif /* __PAGETABLE_P4D_FOLDED */

#ifndef __PAGETABLE_PUD_FOLDED
/*
 * Allocate page upper directory.
 * We've already handled the fast-path in-line.
 */
int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address)
{
        pud_t *new = pud_alloc_one(mm, address);
        if (!new)
                return -ENOMEM;

        spin_lock(&mm->page_table_lock);
        if (!p4d_present(*p4d)) {
                mm_inc_nr_puds(mm);
                smp_wmb(); /* See comment in pmd_install() */
                p4d_populate(mm, p4d, new);
        } else        /* Another has populated it */
                pud_free(mm, new);
        spin_unlock(&mm->page_table_lock);
        return 0;
}
#endif /* __PAGETABLE_PUD_FOLDED */

#ifndef __PAGETABLE_PMD_FOLDED
/*
 * Allocate page middle directory.
 * We've already handled the fast-path in-line.
 */
int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
{
        spinlock_t *ptl;
        pmd_t *new = pmd_alloc_one(mm, address);
        if (!new)
                return -ENOMEM;

        ptl = pud_lock(mm, pud);
        if (!pud_present(*pud)) {
                mm_inc_nr_pmds(mm);
                smp_wmb(); /* See comment in pmd_install() */
                pud_populate(mm, pud, new);
        } else {        /* Another has populated it */
                pmd_free(mm, new);
        }
        spin_unlock(ptl);
        return 0;
}
#endif /* __PAGETABLE_PMD_FOLDED */

static inline void pfnmap_args_setup(struct follow_pfnmap_args *args,
                                     spinlock_t *lock, pte_t *ptep,
                                     pgprot_t pgprot, unsigned long pfn_base,
                                     unsigned long addr_mask, bool writable,
                                     bool special)
{
        args->lock = lock;
        args->ptep = ptep;
        args->pfn = pfn_base + ((args->address & ~addr_mask) >> PAGE_SHIFT);
        args->pgprot = pgprot;
        args->writable = writable;
        args->special = special;
}

static inline void pfnmap_lockdep_assert(struct vm_area_struct *vma)
{
#ifdef CONFIG_LOCKDEP
        struct address_space *mapping = vma->vm_file->f_mapping;

        if (mapping)
                lockdep_assert(lockdep_is_held(&vma->vm_file->f_mapping->i_mmap_rwsem) ||
                               lockdep_is_held(&vma->vm_mm->mmap_lock));
        else
                lockdep_assert(lockdep_is_held(&vma->vm_mm->mmap_lock));
#endif
}

/**
 * follow_pfnmap_start() - Look up a pfn mapping at a user virtual address
 * @args: Pointer to struct @follow_pfnmap_args
 *
 * The caller needs to setup args->vma and args->address to point to the
 * virtual address as the target of such lookup.  On a successful return,
 * the results will be put into other output fields.
 *
 * After the caller finished using the fields, the caller must invoke
 * another follow_pfnmap_end() to proper releases the locks and resources
 * of such look up request.
 *
 * During the start() and end() calls, the results in @args will be valid
 * as proper locks will be held.  After the end() is called, all the fields
 * in @follow_pfnmap_args will be invalid to be further accessed.  Further
 * use of such information after end() may require proper synchronizations
 * by the caller with page table updates, otherwise it can create a
 * security bug.
 *
 * If the PTE maps a refcounted page, callers are responsible to protect
 * against invalidation with MMU notifiers; otherwise access to the PFN at
 * a later point in time can trigger use-after-free.
 *
 * Only IO mappings and raw PFN mappings are allowed.  The mmap semaphore
 * should be taken for read, and the mmap semaphore cannot be released
 * before the end() is invoked.
 *
 * This function must not be used to modify PTE content.
 *
 * Return: zero on success, negative otherwise.
 */
int follow_pfnmap_start(struct follow_pfnmap_args *args)
{
        struct vm_area_struct *vma = args->vma;
        unsigned long address = args->address;
        struct mm_struct *mm = vma->vm_mm;
        spinlock_t *lock;
        pgd_t *pgdp;
        p4d_t *p4dp, p4d;
        pud_t *pudp, pud;
        pmd_t *pmdp, pmd;
        pte_t *ptep, pte;

        pfnmap_lockdep_assert(vma);

        if (unlikely(address < vma->vm_start || address >= vma->vm_end))
                goto out;

        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
                goto out;
retry:
        pgdp = pgd_offset(mm, address);
        if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
                goto out;

        p4dp = p4d_offset(pgdp, address);
        p4d = READ_ONCE(*p4dp);
        if (p4d_none(p4d) || unlikely(p4d_bad(p4d)))
                goto out;

        pudp = pud_offset(p4dp, address);
        pud = READ_ONCE(*pudp);
        if (pud_none(pud))
                goto out;
        if (pud_leaf(pud)) {
                lock = pud_lock(mm, pudp);
                if (!unlikely(pud_leaf(pud))) {
                        spin_unlock(lock);
                        goto retry;
                }
                pfnmap_args_setup(args, lock, NULL, pud_pgprot(pud),
                                  pud_pfn(pud), PUD_MASK, pud_write(pud),
                                  pud_special(pud));
                return 0;
        }

        pmdp = pmd_offset(pudp, address);
        pmd = pmdp_get_lockless(pmdp);
        if (pmd_leaf(pmd)) {
                lock = pmd_lock(mm, pmdp);
                if (!unlikely(pmd_leaf(pmd))) {
                        spin_unlock(lock);
                        goto retry;
                }
                pfnmap_args_setup(args, lock, NULL, pmd_pgprot(pmd),
                                  pmd_pfn(pmd), PMD_MASK, pmd_write(pmd),
                                  pmd_special(pmd));
                return 0;
        }

        ptep = pte_offset_map_lock(mm, pmdp, address, &lock);
        if (!ptep)
                goto out;
        pte = ptep_get(ptep);
        if (!pte_present(pte))
                goto unlock;
        pfnmap_args_setup(args, lock, ptep, pte_pgprot(pte),
                          pte_pfn(pte), PAGE_MASK, pte_write(pte),
                          pte_special(pte));
        return 0;
unlock:
        pte_unmap_unlock(ptep, lock);
out:
        return -EINVAL;
}
EXPORT_SYMBOL_GPL(follow_pfnmap_start);

/**
 * follow_pfnmap_end(): End a follow_pfnmap_start() process
 * @args: Pointer to struct @follow_pfnmap_args
 *
 * Must be used in pair of follow_pfnmap_start().  See the start() function
 * above for more information.
 */
void follow_pfnmap_end(struct follow_pfnmap_args *args)
{
        if (args->lock)
                spin_unlock(args->lock);
        if (args->ptep)
                pte_unmap(args->ptep);
}
EXPORT_SYMBOL_GPL(follow_pfnmap_end);

#ifdef CONFIG_HAVE_IOREMAP_PROT
/**
 * generic_access_phys - generic implementation for iomem mmap access
 * @vma: the vma to access
 * @addr: userspace address, not relative offset within @vma
 * @buf: buffer to read/write
 * @len: length of transfer
 * @write: set to FOLL_WRITE when writing, otherwise reading
 *
 * This is a generic implementation for &vm_operations_struct.access for an
 * iomem mapping. This callback is used by access_process_vm() when the @vma is
 * not page based.
 */
int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
                        void *buf, int len, int write)
{
        resource_size_t phys_addr;
        unsigned long prot = 0;
        void __iomem *maddr;
        int offset = offset_in_page(addr);
        int ret = -EINVAL;
        bool writable;
        struct follow_pfnmap_args args = { .vma = vma, .address = addr };

retry:
        if (follow_pfnmap_start(&args))
                return -EINVAL;
        prot = pgprot_val(args.pgprot);
        phys_addr = (resource_size_t)args.pfn << PAGE_SHIFT;
        writable = args.writable;
        follow_pfnmap_end(&args);

        if ((write & FOLL_WRITE) && !writable)
                return -EINVAL;

        maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
        if (!maddr)
                return -ENOMEM;

        if (follow_pfnmap_start(&args))
                goto out_unmap;

        if ((prot != pgprot_val(args.pgprot)) ||
            (phys_addr != (args.pfn << PAGE_SHIFT)) ||
            (writable != args.writable)) {
                follow_pfnmap_end(&args);
                iounmap(maddr);
                goto retry;
        }

        if (write)
                memcpy_toio(maddr + offset, buf, len);
        else
                memcpy_fromio(buf, maddr + offset, len);
        ret = len;
        follow_pfnmap_end(&args);
out_unmap:
        iounmap(maddr);

        return ret;
}
EXPORT_SYMBOL_GPL(generic_access_phys);
#endif

/*
 * Access another process' address space as given in mm.
 */
static int __access_remote_vm(struct mm_struct *mm, unsigned long addr,
                              void *buf, int len, unsigned int gup_flags)
{
        void *old_buf = buf;
        int write = gup_flags & FOLL_WRITE;

        if (mmap_read_lock_killable(mm))
                return 0;

        /* Untag the address before looking up the VMA */
        addr = untagged_addr_remote(mm, addr);

        /* Avoid triggering the temporary warning in __get_user_pages */
        if (!vma_lookup(mm, addr) && !expand_stack(mm, addr))
                return 0;

        /* ignore errors, just check how much was successfully transferred */
        while (len) {
                int bytes, offset;
                void *maddr;
                struct vm_area_struct *vma = NULL;
                struct page *page = get_user_page_vma_remote(mm, addr,
                                                             gup_flags, &vma);

                if (IS_ERR(page)) {
                        /* We might need to expand the stack to access it */
                        vma = vma_lookup(mm, addr);
                        if (!vma) {
                                vma = expand_stack(mm, addr);

                                /* mmap_lock was dropped on failure */
                                if (!vma)
                                        return buf - old_buf;

                                /* Try again if stack expansion worked */
                                continue;
                        }

                        /*
                         * Check if this is a VM_IO | VM_PFNMAP VMA, which
                         * we can access using slightly different code.
                         */
                        bytes = 0;
#ifdef CONFIG_HAVE_IOREMAP_PROT
                        if (vma->vm_ops && vma->vm_ops->access)
                                bytes = vma->vm_ops->access(vma, addr, buf,
                                                            len, write);
#endif
                        if (bytes <= 0)
                                break;
                } else {
                        bytes = len;
                        offset = addr & (PAGE_SIZE-1);
                        if (bytes > PAGE_SIZE-offset)
                                bytes = PAGE_SIZE-offset;

                        maddr = kmap_local_page(page);
                        if (write) {
                                copy_to_user_page(vma, page, addr,
                                                  maddr + offset, buf, bytes);
                                set_page_dirty_lock(page);
                        } else {
                                copy_from_user_page(vma, page, addr,
                                                    buf, maddr + offset, bytes);
                        }
                        unmap_and_put_page(page, maddr);
                }
                len -= bytes;
                buf += bytes;
                addr += bytes;
        }
        mmap_read_unlock(mm);

        return buf - old_buf;
}

/**
 * access_remote_vm - access another process' address space
 * @mm:                the mm_struct of the target address space
 * @addr:        start address to access
 * @buf:        source or destination buffer
 * @len:        number of bytes to transfer
 * @gup_flags:        flags modifying lookup behaviour
 *
 * The caller must hold a reference on @mm.
 *
 * Return: number of bytes copied from source to destination.
 */
int access_remote_vm(struct mm_struct *mm, unsigned long addr,
                void *buf, int len, unsigned int gup_flags)
{
        return __access_remote_vm(mm, addr, buf, len, gup_flags);
}

/*
 * Access another process' address space.
 * Source/target buffer must be kernel space,
 * Do not walk the page table directly, use get_user_pages
 */
int access_process_vm(struct task_struct *tsk, unsigned long addr,
                void *buf, int len, unsigned int gup_flags)
{
        struct mm_struct *mm;
        int ret;

        mm = get_task_mm(tsk);
        if (!mm)
                return 0;

        ret = __access_remote_vm(mm, addr, buf, len, gup_flags);

        mmput(mm);

        return ret;
}
EXPORT_SYMBOL_GPL(access_process_vm);

/*
 * Print the name of a VMA.
 */
void print_vma_addr(char *prefix, unsigned long ip)
{
        struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma;

        /*
         * we might be running from an atomic context so we cannot sleep
         */
        if (!mmap_read_trylock(mm))
                return;

        vma = vma_lookup(mm, ip);
        if (vma && vma->vm_file) {
                struct file *f = vma->vm_file;
                ip -= vma->vm_start;
                ip += vma->vm_pgoff << PAGE_SHIFT;
                printk("%s%pD[%lx,%lx+%lx]", prefix, f, ip,
                                vma->vm_start,
                                vma->vm_end - vma->vm_start);
        }
        mmap_read_unlock(mm);
}

#if defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_DEBUG_ATOMIC_SLEEP)
void __might_fault(const char *file, int line)
{
        if (pagefault_disabled())
                return;
        __might_sleep(file, line);
#if defined(CONFIG_DEBUG_ATOMIC_SLEEP)
        if (current->mm)
                might_lock_read(&current->mm->mmap_lock);
#endif
}
EXPORT_SYMBOL(__might_fault);
#endif

#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLBFS)
/*
 * Process all subpages of the specified huge page with the specified
 * operation.  The target subpage will be processed last to keep its
 * cache lines hot.
 */
static inline int process_huge_page(
        unsigned long addr_hint, unsigned int nr_pages,
        int (*process_subpage)(unsigned long addr, int idx, void *arg),
        void *arg)
{
        int i, n, base, l, ret;
        unsigned long addr = addr_hint &
                ~(((unsigned long)nr_pages << PAGE_SHIFT) - 1);

        /* Process target subpage last to keep its cache lines hot */
        might_sleep();
        n = (addr_hint - addr) / PAGE_SIZE;
        if (2 * n <= nr_pages) {
                /* If target subpage in first half of huge page */
                base = 0;
                l = n;
                /* Process subpages at the end of huge page */
                for (i = nr_pages - 1; i >= 2 * n; i--) {
                        cond_resched();
                        ret = process_subpage(addr + i * PAGE_SIZE, i, arg);
                        if (ret)
                                return ret;
                }
        } else {
                /* If target subpage in second half of huge page */
                base = nr_pages - 2 * (nr_pages - n);
                l = nr_pages - n;
                /* Process subpages at the begin of huge page */
                for (i = 0; i < base; i++) {
                        cond_resched();
                        ret = process_subpage(addr + i * PAGE_SIZE, i, arg);
                        if (ret)
                                return ret;
                }
        }
        /*
         * Process remaining subpages in left-right-left-right pattern
         * towards the target subpage
         */
        for (i = 0; i < l; i++) {
                int left_idx = base + i;
                int right_idx = base + 2 * l - 1 - i;

                cond_resched();
                ret = process_subpage(addr + left_idx * PAGE_SIZE, left_idx, arg);
                if (ret)
                        return ret;
                cond_resched();
                ret = process_subpage(addr + right_idx * PAGE_SIZE, right_idx, arg);
                if (ret)
                        return ret;
        }
        return 0;
}

static void clear_gigantic_page(struct folio *folio, unsigned long addr,
                                unsigned int nr_pages)
{
        int i;

        might_sleep();
        for (i = 0; i < nr_pages; i++) {
                cond_resched();
                clear_user_highpage(folio_page(folio, i), addr + i * PAGE_SIZE);
        }
}

static int clear_subpage(unsigned long addr, int idx, void *arg)
{
        struct folio *folio = arg;

        clear_user_highpage(folio_page(folio, idx), addr);
        return 0;
}

/**
 * folio_zero_user - Zero a folio which will be mapped to userspace.
 * @folio: The folio to zero.
 * @addr_hint: The address will be accessed or the base address if uncelar.
 */
void folio_zero_user(struct folio *folio, unsigned long addr_hint)
{
        unsigned int nr_pages = folio_nr_pages(folio);

        if (unlikely(nr_pages > MAX_ORDER_NR_PAGES))
                clear_gigantic_page(folio, addr_hint, nr_pages);
        else
                process_huge_page(addr_hint, nr_pages, clear_subpage, folio);
}

static int copy_user_gigantic_page(struct folio *dst, struct folio *src,
                                   unsigned long addr,
                                   struct vm_area_struct *vma,
                                   unsigned int nr_pages)
{
        int i;
        struct page *dst_page;
        struct page *src_page;

        for (i = 0; i < nr_pages; i++) {
                dst_page = folio_page(dst, i);
                src_page = folio_page(src, i);

                cond_resched();
                if (copy_mc_user_highpage(dst_page, src_page,
                                          addr + i*PAGE_SIZE, vma))
                        return -EHWPOISON;
        }
        return 0;
}

struct copy_subpage_arg {
        struct folio *dst;
        struct folio *src;
        struct vm_area_struct *vma;
};

static int copy_subpage(unsigned long addr, int idx, void *arg)
{
        struct copy_subpage_arg *copy_arg = arg;
        struct page *dst = folio_page(copy_arg->dst, idx);
        struct page *src = folio_page(copy_arg->src, idx);

        if (copy_mc_user_highpage(dst, src, addr, copy_arg->vma))
                return -EHWPOISON;
        return 0;
}

int copy_user_large_folio(struct folio *dst, struct folio *src,
                          unsigned long addr_hint, struct vm_area_struct *vma)
{
        unsigned int nr_pages = folio_nr_pages(dst);
        struct copy_subpage_arg arg = {
                .dst = dst,
                .src = src,
                .vma = vma,
        };

        if (unlikely(nr_pages > MAX_ORDER_NR_PAGES))
                return copy_user_gigantic_page(dst, src, addr_hint, vma, nr_pages);

        return process_huge_page(addr_hint, nr_pages, copy_subpage, &arg);
}

long copy_folio_from_user(struct folio *dst_folio,
                           const void __user *usr_src,
                           bool allow_pagefault)
{
        void *kaddr;
        unsigned long i, rc = 0;
        unsigned int nr_pages = folio_nr_pages(dst_folio);
        unsigned long ret_val = nr_pages * PAGE_SIZE;
        struct page *subpage;

        for (i = 0; i < nr_pages; i++) {
                subpage = folio_page(dst_folio, i);
                kaddr = kmap_local_page(subpage);
                if (!allow_pagefault)
                        pagefault_disable();
                rc = copy_from_user(kaddr, usr_src + i * PAGE_SIZE, PAGE_SIZE);
                if (!allow_pagefault)
                        pagefault_enable();
                kunmap_local(kaddr);

                ret_val -= (PAGE_SIZE - rc);
                if (rc)
                        break;

                flush_dcache_page(subpage);

                cond_resched();
        }
        return ret_val;
}
#endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */

#if defined(CONFIG_SPLIT_PTE_PTLOCKS) && ALLOC_SPLIT_PTLOCKS

static struct kmem_cache *page_ptl_cachep;

void __init ptlock_cache_init(void)
{
        page_ptl_cachep = kmem_cache_create("page->ptl", sizeof(spinlock_t), 0,
                        SLAB_PANIC, NULL);
}

bool ptlock_alloc(struct ptdesc *ptdesc)
{
        spinlock_t *ptl;

        ptl = kmem_cache_alloc(page_ptl_cachep, GFP_KERNEL);
        if (!ptl)
                return false;
        ptdesc->ptl = ptl;
        return true;
}

void ptlock_free(struct ptdesc *ptdesc)
{
        kmem_cache_free(page_ptl_cachep, ptdesc->ptl);
}
#endif

void vma_pgtable_walk_begin(struct vm_area_struct *vma)
{
        if (is_vm_hugetlb_page(vma))
                hugetlb_vma_lock_read(vma);
}

void vma_pgtable_walk_end(struct vm_area_struct *vma)
{
        if (is_vm_hugetlb_page(vma))
                hugetlb_vma_unlock_read(vma);
}
























































































































































    1 

















    1 



















































































































































































































































































































































































































































































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *
 *   Copyright (c) International Business Machines  Corp., 2002,2008
 *   Author(s): Steve French (sfrench@us.ibm.com)
 *
 *   Error mapping routines from Samba libsmb/errormap.c
 *   Copyright (C) Andrew Tridgell 2001
 */

#include <linux/net.h>
#include <linux/string.h>
#include <linux/in.h>
#include <linux/ctype.h>
#include <linux/fs.h>
#include <asm/div64.h>
#include <asm/byteorder.h>
#include <linux/inet.h>
#include "cifsfs.h"
#include "cifspdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "smberr.h"
#include "cifs_debug.h"
#include "nterr.h"

struct smb_to_posix_error {
        __u16 smb_err;
        int posix_code;
};

static const struct smb_to_posix_error mapping_table_ERRDOS[] = {
        {ERRbadfunc, -EINVAL},
        {ERRbadfile, -ENOENT},
        {ERRbadpath, -ENOTDIR},
        {ERRnofids, -EMFILE},
        {ERRnoaccess, -EACCES},
        {ERRbadfid, -EBADF},
        {ERRbadmcb, -EIO},
        {ERRnomem, -EREMOTEIO},
        {ERRbadmem, -EFAULT},
        {ERRbadenv, -EFAULT},
        {ERRbadformat, -EINVAL},
        {ERRbadaccess, -EACCES},
        {ERRbaddata, -EIO},
        {ERRbaddrive, -ENXIO},
        {ERRremcd, -EACCES},
        {ERRdiffdevice, -EXDEV},
        {ERRnofiles, -ENOENT},
        {ERRwriteprot, -EROFS},
        {ERRbadshare, -EBUSY},
        {ERRlock, -EACCES},
        {ERRunsup, -EINVAL},
        {ERRnosuchshare, -ENXIO},
        {ERRfilexists, -EEXIST},
        {ERRinvparm, -EINVAL},
        {ERRdiskfull, -ENOSPC},
        {ERRinvname, -ENOENT},
        {ERRinvlevel, -EOPNOTSUPP},
        {ERRdirnotempty, -ENOTEMPTY},
        {ERRnotlocked, -ENOLCK},
        {ERRcancelviolation, -ENOLCK},
        {ERRalreadyexists, -EEXIST},
        {ERRmoredata, -EOVERFLOW},
        {ERReasnotsupported, -EOPNOTSUPP},
        {ErrQuota, -EDQUOT},
        {ErrNotALink, -ENOLINK},
        {ERRnetlogonNotStarted, -ENOPROTOOPT},
        {ERRsymlink, -EOPNOTSUPP},
        {ErrTooManyLinks, -EMLINK},
        {0, 0}
};

static const struct smb_to_posix_error mapping_table_ERRSRV[] = {
        {ERRerror, -EIO},
        {ERRbadpw, -EACCES},  /* was EPERM */
        {ERRbadtype, -EREMOTE},
        {ERRaccess, -EACCES},
        {ERRinvtid, -ENXIO},
        {ERRinvnetname, -ENXIO},
        {ERRinvdevice, -ENXIO},
        {ERRqfull, -ENOSPC},
        {ERRqtoobig, -ENOSPC},
        {ERRqeof, -EIO},
        {ERRinvpfid, -EBADF},
        {ERRsmbcmd, -EBADRQC},
        {ERRsrverror, -EIO},
        {ERRbadBID, -EIO},
        {ERRfilespecs, -EINVAL},
        {ERRbadLink, -EIO},
        {ERRbadpermits, -EINVAL},
        {ERRbadPID, -ESRCH},
        {ERRsetattrmode, -EINVAL},
        {ERRpaused, -EHOSTDOWN},
        {ERRmsgoff, -EHOSTDOWN},
        {ERRnoroom, -ENOSPC},
        {ERRrmuns, -EUSERS},
        {ERRtimeout, -ETIME},
        {ERRnoresource, -EREMOTEIO},
        {ERRtoomanyuids, -EUSERS},
        {ERRbaduid, -EACCES},
        {ERRusempx, -EIO},
        {ERRusestd, -EIO},
        {ERR_NOTIFY_ENUM_DIR, -ENOBUFS},
        {ERRnoSuchUser, -EACCES},
/*        {ERRaccountexpired, -EACCES},
        {ERRbadclient, -EACCES},
        {ERRbadLogonTime, -EACCES},
        {ERRpasswordExpired, -EACCES},*/
        {ERRaccountexpired, -EKEYEXPIRED},
        {ERRbadclient, -EACCES},
        {ERRbadLogonTime, -EACCES},
        {ERRpasswordExpired, -EKEYEXPIRED},

        {ERRnosupport, -EINVAL},
        {0, 0}
};

/*
 * Convert a string containing text IPv4 or IPv6 address to binary form.
 *
 * Returns 0 on failure.
 */
static int
cifs_inet_pton(const int address_family, const char *cp, int len, void *dst)
{
        int ret = 0;

        /* calculate length by finding first slash or NULL */
        if (address_family == AF_INET)
                ret = in4_pton(cp, len, dst, '\\', NULL);
        else if (address_family == AF_INET6)
                ret = in6_pton(cp, len, dst , '\\', NULL);

        cifs_dbg(NOISY, "address conversion returned %d for %*.*s\n",
                 ret, len, len, cp);
        if (ret > 0)
                ret = 1;
        return ret;
}

/*
 * Try to convert a string to an IPv4 address and then attempt to convert
 * it to an IPv6 address if that fails. Set the family field if either
 * succeeds. If it's an IPv6 address and it has a '%' sign in it, try to
 * treat the part following it as a numeric sin6_scope_id.
 *
 * Returns 0 on failure.
 */
int
cifs_convert_address(struct sockaddr *dst, const char *src, int len)
{
        int rc, alen, slen;
        const char *pct;
        char scope_id[13];
        struct sockaddr_in *s4 = (struct sockaddr_in *) dst;
        struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) dst;

        /* IPv4 address */
        if (cifs_inet_pton(AF_INET, src, len, &s4->sin_addr.s_addr)) {
                s4->sin_family = AF_INET;
                return 1;
        }

        /* attempt to exclude the scope ID from the address part */
        pct = memchr(src, '%', len);
        alen = pct ? pct - src : len;

        rc = cifs_inet_pton(AF_INET6, src, alen, &s6->sin6_addr.s6_addr);
        if (!rc)
                return rc;

        s6->sin6_family = AF_INET6;
        if (pct) {
                /* grab the scope ID */
                slen = len - (alen + 1);
                if (slen <= 0 || slen > 12)
                        return 0;
                memcpy(scope_id, pct + 1, slen);
                scope_id[slen] = '\0';

                rc = kstrtouint(scope_id, 0, &s6->sin6_scope_id);
                rc = (rc == 0) ? 1 : 0;
        }

        return rc;
}

void
cifs_set_port(struct sockaddr *addr, const unsigned short int port)
{
        switch (addr->sa_family) {
        case AF_INET:
                ((struct sockaddr_in *)addr)->sin_port = htons(port);
                break;
        case AF_INET6:
                ((struct sockaddr_in6 *)addr)->sin6_port = htons(port);
                break;
        }
}

/*****************************************************************************
convert a NT status code to a dos class/code
 *****************************************************************************/
/* NT status -> dos error map */
static const struct {
        __u8 dos_class;
        __u16 dos_code;
        __u32 ntstatus;
} ntstatus_to_dos_map[] = {
        {
        ERRDOS, ERRgeneral, NT_STATUS_UNSUCCESSFUL}, {
        ERRDOS, ERRbadfunc, NT_STATUS_NOT_IMPLEMENTED}, {
        ERRDOS, ERRinvlevel, NT_STATUS_INVALID_INFO_CLASS}, {
        ERRDOS, 24, NT_STATUS_INFO_LENGTH_MISMATCH}, {
        ERRHRD, ERRgeneral, NT_STATUS_ACCESS_VIOLATION}, {
        ERRHRD, ERRgeneral, NT_STATUS_IN_PAGE_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_PAGEFILE_QUOTA}, {
        ERRDOS, ERRbadfid, NT_STATUS_INVALID_HANDLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_INITIAL_STACK}, {
        ERRDOS, 193, NT_STATUS_BAD_INITIAL_PC}, {
        ERRDOS, 87, NT_STATUS_INVALID_CID}, {
        ERRHRD, ERRgeneral, NT_STATUS_TIMER_NOT_CANCELED}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER}, {
        ERRDOS, ERRbadfile, NT_STATUS_NO_SUCH_DEVICE}, {
        ERRDOS, ERRbadfile, NT_STATUS_NO_SUCH_FILE}, {
        ERRDOS, ERRbadfunc, NT_STATUS_INVALID_DEVICE_REQUEST}, {
        ERRDOS, 38, NT_STATUS_END_OF_FILE}, {
        ERRDOS, 34, NT_STATUS_WRONG_VOLUME}, {
        ERRDOS, 21, NT_STATUS_NO_MEDIA_IN_DEVICE}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNRECOGNIZED_MEDIA}, {
        ERRDOS, 27, NT_STATUS_NONEXISTENT_SECTOR},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_MORE_PROCESSING_REQUIRED to NT_STATUS_OK
         during the session setup } */
        {
        ERRDOS, ERRnomem, NT_STATUS_NO_MEMORY}, {
        ERRDOS, 487, NT_STATUS_CONFLICTING_ADDRESSES}, {
        ERRDOS, 487, NT_STATUS_NOT_MAPPED_VIEW}, {
        ERRDOS, 87, NT_STATUS_UNABLE_TO_FREE_VM}, {
        ERRDOS, 87, NT_STATUS_UNABLE_TO_DELETE_SECTION}, {
        ERRDOS, 2142, NT_STATUS_INVALID_SYSTEM_SERVICE}, {
        ERRHRD, ERRgeneral, NT_STATUS_ILLEGAL_INSTRUCTION}, {
        ERRDOS, ERRnoaccess, NT_STATUS_INVALID_LOCK_SEQUENCE}, {
        ERRDOS, ERRnoaccess, NT_STATUS_INVALID_VIEW_SIZE}, {
        ERRDOS, 193, NT_STATUS_INVALID_FILE_FOR_SECTION}, {
        ERRDOS, ERRnoaccess, NT_STATUS_ALREADY_COMMITTED},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_ACCESS_DENIED to NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
         during the session setup }   */
        {
        ERRDOS, ERRnoaccess, NT_STATUS_ACCESS_DENIED}, {
        ERRDOS, 111, NT_STATUS_BUFFER_TOO_SMALL}, {
        ERRDOS, ERRbadfid, NT_STATUS_OBJECT_TYPE_MISMATCH}, {
        ERRHRD, ERRgeneral, NT_STATUS_NONCONTINUABLE_EXCEPTION}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_DISPOSITION}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNWIND}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_STACK}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_UNWIND_TARGET}, {
        ERRDOS, 158, NT_STATUS_NOT_LOCKED}, {
        ERRHRD, ERRgeneral, NT_STATUS_PARITY_ERROR}, {
        ERRDOS, 487, NT_STATUS_UNABLE_TO_DECOMMIT_VM}, {
        ERRDOS, 487, NT_STATUS_NOT_COMMITTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_PORT_ATTRIBUTES}, {
        ERRHRD, ERRgeneral, NT_STATUS_PORT_MESSAGE_TOO_LONG}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_MIX}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_QUOTA_LOWER}, {
        ERRHRD, ERRgeneral, NT_STATUS_DISK_CORRUPT_ERROR}, {
         /* mapping changed since shell does lookup on * expects FileNotFound */
        ERRDOS, ERRbadfile, NT_STATUS_OBJECT_NAME_INVALID}, {
        ERRDOS, ERRbadfile, NT_STATUS_OBJECT_NAME_NOT_FOUND}, {
        ERRDOS, ERRalreadyexists, NT_STATUS_OBJECT_NAME_COLLISION}, {
        ERRHRD, ERRgeneral, NT_STATUS_HANDLE_NOT_WAITABLE}, {
        ERRDOS, ERRbadfid, NT_STATUS_PORT_DISCONNECTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_DEVICE_ALREADY_ATTACHED}, {
        ERRDOS, 161, NT_STATUS_OBJECT_PATH_INVALID}, {
        ERRDOS, ERRbadpath, NT_STATUS_OBJECT_PATH_NOT_FOUND}, {
        ERRDOS, 161, NT_STATUS_OBJECT_PATH_SYNTAX_BAD}, {
        ERRHRD, ERRgeneral, NT_STATUS_DATA_OVERRUN}, {
        ERRHRD, ERRgeneral, NT_STATUS_DATA_LATE_ERROR}, {
        ERRDOS, 23, NT_STATUS_DATA_ERROR}, {
        ERRDOS, 23, NT_STATUS_CRC_ERROR}, {
        ERRDOS, ERRnomem, NT_STATUS_SECTION_TOO_BIG}, {
        ERRDOS, ERRnoaccess, NT_STATUS_PORT_CONNECTION_REFUSED}, {
        ERRDOS, ERRbadfid, NT_STATUS_INVALID_PORT_HANDLE}, {
        ERRDOS, ERRbadshare, NT_STATUS_SHARING_VIOLATION}, {
        ERRHRD, ERRgeneral, NT_STATUS_QUOTA_EXCEEDED}, {
        ERRDOS, 87, NT_STATUS_INVALID_PAGE_PROTECTION}, {
        ERRDOS, 288, NT_STATUS_MUTANT_NOT_OWNED}, {
        ERRDOS, 298, NT_STATUS_SEMAPHORE_LIMIT_EXCEEDED}, {
        ERRDOS, 87, NT_STATUS_PORT_ALREADY_SET}, {
        ERRDOS, 87, NT_STATUS_SECTION_NOT_IMAGE}, {
        ERRDOS, 156, NT_STATUS_SUSPEND_COUNT_EXCEEDED}, {
        ERRDOS, ERRnoaccess, NT_STATUS_THREAD_IS_TERMINATING}, {
        ERRDOS, 87, NT_STATUS_BAD_WORKING_SET_LIMIT}, {
        ERRDOS, 87, NT_STATUS_INCOMPATIBLE_FILE_MAP}, {
        ERRDOS, 87, NT_STATUS_SECTION_PROTECTION}, {
        ERRDOS, ERReasnotsupported, NT_STATUS_EAS_NOT_SUPPORTED}, {
        ERRDOS, 255, NT_STATUS_EA_TOO_LARGE}, {
        ERRHRD, ERRgeneral, NT_STATUS_NONEXISTENT_EA_ENTRY}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_EAS_ON_FILE}, {
        ERRHRD, ERRgeneral, NT_STATUS_EA_CORRUPT_ERROR}, {
        ERRDOS, ERRlock, NT_STATUS_FILE_LOCK_CONFLICT}, {
        ERRDOS, ERRlock, NT_STATUS_LOCK_NOT_GRANTED}, {
        ERRDOS, ERRbadfile, NT_STATUS_DELETE_PENDING}, {
        ERRDOS, ERRunsup, NT_STATUS_CTL_FILE_NOT_SUPPORTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNKNOWN_REVISION}, {
        ERRHRD, ERRgeneral, NT_STATUS_REVISION_MISMATCH}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_OWNER}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_PRIMARY_GROUP}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_IMPERSONATION_TOKEN}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANT_DISABLE_MANDATORY}, {
        ERRDOS, 2215, NT_STATUS_NO_LOGON_SERVERS}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_LOGON_SESSION}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_PRIVILEGE}, {
        ERRDOS, ERRnoaccess, NT_STATUS_PRIVILEGE_NOT_HELD}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_ACCOUNT_NAME}, {
        ERRHRD, ERRgeneral, NT_STATUS_USER_EXISTS},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_NO_SUCH_USER to NT_STATUS_LOGON_FAILURE
         during the session setup } */
        {
        ERRDOS, ERRnoaccess, NT_STATUS_NO_SUCH_USER}, { /* could map to 2238 */
        ERRHRD, ERRgeneral, NT_STATUS_GROUP_EXISTS}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_GROUP}, {
        ERRHRD, ERRgeneral, NT_STATUS_MEMBER_IN_GROUP}, {
        ERRHRD, ERRgeneral, NT_STATUS_MEMBER_NOT_IN_GROUP}, {
        ERRHRD, ERRgeneral, NT_STATUS_LAST_ADMIN},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_WRONG_PASSWORD to NT_STATUS_LOGON_FAILURE
         during the session setup } */
        {
        ERRSRV, ERRbadpw, NT_STATUS_WRONG_PASSWORD}, {
        ERRHRD, ERRgeneral, NT_STATUS_ILL_FORMED_PASSWORD}, {
        ERRHRD, ERRgeneral, NT_STATUS_PASSWORD_RESTRICTION}, {
        ERRDOS, ERRnoaccess, NT_STATUS_LOGON_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_ACCOUNT_RESTRICTION}, {
        ERRSRV, ERRbadLogonTime, NT_STATUS_INVALID_LOGON_HOURS}, {
        ERRSRV, ERRbadclient, NT_STATUS_INVALID_WORKSTATION}, {
        ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_EXPIRED}, {
        ERRSRV, ERRaccountexpired, NT_STATUS_ACCOUNT_DISABLED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NONE_MAPPED}, {
        ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_LUIDS_REQUESTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_LUIDS_EXHAUSTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_SUB_AUTHORITY}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_ACL}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_SID}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_SECURITY_DESCR}, {
        ERRDOS, 127, NT_STATUS_PROCEDURE_NOT_FOUND}, {
        ERRDOS, 193, NT_STATUS_INVALID_IMAGE_FORMAT}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_TOKEN}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_INHERITANCE_ACL}, {
        ERRDOS, 158, NT_STATUS_RANGE_NOT_LOCKED}, {
        ERRDOS, 112, NT_STATUS_DISK_FULL}, {
        ERRHRD, ERRgeneral, NT_STATUS_SERVER_DISABLED}, {
        ERRHRD, ERRgeneral, NT_STATUS_SERVER_NOT_DISABLED}, {
        ERRDOS, 68, NT_STATUS_TOO_MANY_GUIDS_REQUESTED}, {
        ERRDOS, 259, NT_STATUS_GUIDS_EXHAUSTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_ID_AUTHORITY}, {
        ERRDOS, 259, NT_STATUS_AGENTS_EXHAUSTED}, {
        ERRDOS, 154, NT_STATUS_INVALID_VOLUME_LABEL}, {
        ERRDOS, 14, NT_STATUS_SECTION_NOT_EXTENDED}, {
        ERRDOS, 487, NT_STATUS_NOT_MAPPED_DATA}, {
        ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_DATA_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_TYPE_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_NAME_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_ARRAY_BOUNDS_EXCEEDED}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_DENORMAL_OPERAND}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_DIVIDE_BY_ZERO}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_INEXACT_RESULT}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_INVALID_OPERATION}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_OVERFLOW}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_STACK_CHECK}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOAT_UNDERFLOW}, {
        ERRHRD, ERRgeneral, NT_STATUS_INTEGER_DIVIDE_BY_ZERO}, {
        ERRDOS, 534, NT_STATUS_INTEGER_OVERFLOW}, {
        ERRHRD, ERRgeneral, NT_STATUS_PRIVILEGED_INSTRUCTION}, {
        ERRDOS, ERRnomem, NT_STATUS_TOO_MANY_PAGING_FILES}, {
        ERRHRD, ERRgeneral, NT_STATUS_FILE_INVALID}, {
        ERRHRD, ERRgeneral, NT_STATUS_ALLOTTED_SPACE_EXCEEDED},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_INSUFFICIENT_RESOURCES to
         NT_STATUS_INSUFF_SERVER_RESOURCES during the session setup } */
        {
        ERRDOS, ERRnoresource, NT_STATUS_INSUFFICIENT_RESOURCES}, {
        ERRDOS, ERRbadpath, NT_STATUS_DFS_EXIT_PATH_FOUND}, {
        ERRDOS, 23, NT_STATUS_DEVICE_DATA_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_DEVICE_NOT_CONNECTED}, {
        ERRDOS, 21, NT_STATUS_DEVICE_POWER_FAILURE}, {
        ERRDOS, 487, NT_STATUS_FREE_VM_NOT_AT_BASE}, {
        ERRDOS, 487, NT_STATUS_MEMORY_NOT_ALLOCATED}, {
        ERRHRD, ERRgeneral, NT_STATUS_WORKING_SET_QUOTA}, {
        ERRDOS, 19, NT_STATUS_MEDIA_WRITE_PROTECTED}, {
        ERRDOS, 21, NT_STATUS_DEVICE_NOT_READY}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_GROUP_ATTRIBUTES}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_IMPERSONATION_LEVEL}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANT_OPEN_ANONYMOUS}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_VALIDATION_CLASS}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_TOKEN_TYPE}, {
        ERRDOS, 87, NT_STATUS_BAD_MASTER_BOOT_RECORD}, {
        ERRHRD, ERRgeneral, NT_STATUS_INSTRUCTION_MISALIGNMENT}, {
        ERRDOS, ERRpipebusy, NT_STATUS_INSTANCE_NOT_AVAILABLE}, {
        ERRDOS, ERRpipebusy, NT_STATUS_PIPE_NOT_AVAILABLE}, {
        ERRDOS, ERRbadpipe, NT_STATUS_INVALID_PIPE_STATE}, {
        ERRDOS, ERRpipebusy, NT_STATUS_PIPE_BUSY}, {
        ERRDOS, ERRbadfunc, NT_STATUS_ILLEGAL_FUNCTION}, {
        ERRDOS, ERRnotconnected, NT_STATUS_PIPE_DISCONNECTED}, {
        ERRDOS, ERRpipeclosing, NT_STATUS_PIPE_CLOSING}, {
        ERRHRD, ERRgeneral, NT_STATUS_PIPE_CONNECTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_PIPE_LISTENING}, {
        ERRDOS, ERRbadpipe, NT_STATUS_INVALID_READ_MODE}, {
        ERRDOS, 121, NT_STATUS_IO_TIMEOUT}, {
        ERRDOS, 38, NT_STATUS_FILE_FORCED_CLOSED}, {
        ERRHRD, ERRgeneral, NT_STATUS_PROFILING_NOT_STARTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_PROFILING_NOT_STOPPED}, {
        ERRHRD, ERRgeneral, NT_STATUS_COULD_NOT_INTERPRET}, {
        ERRDOS, ERRnoaccess, NT_STATUS_FILE_IS_A_DIRECTORY}, {
        ERRDOS, ERRunsup, NT_STATUS_NOT_SUPPORTED}, {
        ERRDOS, 51, NT_STATUS_REMOTE_NOT_LISTENING}, {
        ERRDOS, 52, NT_STATUS_DUPLICATE_NAME}, {
        ERRDOS, 53, NT_STATUS_BAD_NETWORK_PATH}, {
        ERRDOS, 54, NT_STATUS_NETWORK_BUSY}, {
        ERRDOS, 55, NT_STATUS_DEVICE_DOES_NOT_EXIST}, {
        ERRDOS, 56, NT_STATUS_TOO_MANY_COMMANDS}, {
        ERRDOS, 57, NT_STATUS_ADAPTER_HARDWARE_ERROR}, {
        ERRDOS, 58, NT_STATUS_INVALID_NETWORK_RESPONSE}, {
        ERRDOS, 59, NT_STATUS_UNEXPECTED_NETWORK_ERROR}, {
        ERRDOS, 60, NT_STATUS_BAD_REMOTE_ADAPTER}, {
        ERRDOS, 61, NT_STATUS_PRINT_QUEUE_FULL}, {
        ERRDOS, 62, NT_STATUS_NO_SPOOL_SPACE}, {
        ERRDOS, 63, NT_STATUS_PRINT_CANCELLED}, {
        ERRDOS, 64, NT_STATUS_NETWORK_NAME_DELETED}, {
        ERRDOS, 65, NT_STATUS_NETWORK_ACCESS_DENIED}, {
        ERRDOS, 66, NT_STATUS_BAD_DEVICE_TYPE}, {
        ERRDOS, ERRnosuchshare, NT_STATUS_BAD_NETWORK_NAME}, {
        ERRDOS, 68, NT_STATUS_TOO_MANY_NAMES}, {
        ERRDOS, 69, NT_STATUS_TOO_MANY_SESSIONS}, {
        ERRDOS, 70, NT_STATUS_SHARING_PAUSED}, {
        ERRDOS, 71, NT_STATUS_REQUEST_NOT_ACCEPTED}, {
        ERRDOS, 72, NT_STATUS_REDIRECTOR_PAUSED}, {
        ERRDOS, 88, NT_STATUS_NET_WRITE_FAULT}, {
        ERRHRD, ERRgeneral, NT_STATUS_PROFILING_AT_LIMIT}, {
        ERRDOS, ERRdiffdevice, NT_STATUS_NOT_SAME_DEVICE}, {
        ERRDOS, ERRnoaccess, NT_STATUS_FILE_RENAMED}, {
        ERRDOS, 240, NT_STATUS_VIRTUAL_CIRCUIT_CLOSED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SECURITY_ON_OBJECT}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANT_WAIT}, {
        ERRDOS, ERRpipeclosing, NT_STATUS_PIPE_EMPTY}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANT_ACCESS_DOMAIN_INFO}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANT_TERMINATE_SELF}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_SERVER_STATE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_DOMAIN_STATE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_DOMAIN_ROLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_DOMAIN}, {
        ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_EXISTS}, {
        ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_LIMIT_EXCEEDED}, {
        ERRDOS, 300, NT_STATUS_OPLOCK_NOT_GRANTED}, {
        ERRDOS, 301, NT_STATUS_INVALID_OPLOCK_PROTOCOL}, {
        ERRHRD, ERRgeneral, NT_STATUS_INTERNAL_DB_CORRUPTION}, {
        ERRHRD, ERRgeneral, NT_STATUS_INTERNAL_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_GENERIC_NOT_MAPPED}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_DESCRIPTOR_FORMAT}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_USER_BUFFER}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_IO_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_MM_CREATE_ERR}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_MM_MAP_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNEXPECTED_MM_EXTEND_ERR}, {
        ERRHRD, ERRgeneral, NT_STATUS_NOT_LOGON_PROCESS}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOGON_SESSION_EXISTS}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_1}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_2}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_3}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_4}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_5}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_6}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_7}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_8}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_9}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_10}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_11}, {
        ERRDOS, 87, NT_STATUS_INVALID_PARAMETER_12}, {
        ERRDOS, ERRbadpath, NT_STATUS_REDIRECTOR_NOT_STARTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_REDIRECTOR_STARTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_STACK_OVERFLOW}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_PACKAGE}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_FUNCTION_TABLE}, {
        ERRDOS, 203, 0xc0000100}, {
        ERRDOS, 145, NT_STATUS_DIRECTORY_NOT_EMPTY}, {
        ERRHRD, ERRgeneral, NT_STATUS_FILE_CORRUPT_ERROR}, {
        ERRDOS, 267, NT_STATUS_NOT_A_DIRECTORY}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_LOGON_SESSION_STATE}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOGON_SESSION_COLLISION}, {
        ERRDOS, 206, NT_STATUS_NAME_TOO_LONG}, {
        ERRDOS, 2401, NT_STATUS_FILES_OPEN}, {
        ERRDOS, 2404, NT_STATUS_CONNECTION_IN_USE}, {
        ERRHRD, ERRgeneral, NT_STATUS_MESSAGE_NOT_FOUND}, {
        ERRDOS, ERRnoaccess, NT_STATUS_PROCESS_IS_TERMINATING}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_LOGON_TYPE}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_GUID_TRANSLATION}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANNOT_IMPERSONATE}, {
        ERRHRD, ERRgeneral, NT_STATUS_IMAGE_ALREADY_LOADED}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_NOT_PRESENT}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_LID_NOT_EXIST}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_LID_ALREADY_OWNED}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_NOT_LID_OWNER}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_INVALID_COMMAND}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_INVALID_LID}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_SELECTOR_NOT_AVAILABLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_ABIOS_INVALID_SELECTOR}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_LDT}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_LDT_SIZE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_LDT_OFFSET}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_LDT_DESCRIPTOR}, {
        ERRDOS, 193, NT_STATUS_INVALID_IMAGE_NE_FORMAT}, {
        ERRHRD, ERRgeneral, NT_STATUS_RXACT_INVALID_STATE}, {
        ERRHRD, ERRgeneral, NT_STATUS_RXACT_COMMIT_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_MAPPED_FILE_SIZE_ZERO}, {
        ERRDOS, ERRnofids, NT_STATUS_TOO_MANY_OPENED_FILES}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANCELLED}, {
        ERRDOS, ERRnoaccess, NT_STATUS_CANNOT_DELETE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_COMPUTER_NAME}, {
        ERRDOS, ERRnoaccess, NT_STATUS_FILE_DELETED}, {
        ERRHRD, ERRgeneral, NT_STATUS_SPECIAL_ACCOUNT}, {
        ERRHRD, ERRgeneral, NT_STATUS_SPECIAL_GROUP}, {
        ERRHRD, ERRgeneral, NT_STATUS_SPECIAL_USER}, {
        ERRHRD, ERRgeneral, NT_STATUS_MEMBERS_PRIMARY_GROUP}, {
        ERRDOS, ERRbadfid, NT_STATUS_FILE_CLOSED}, {
        ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_THREADS}, {
        ERRHRD, ERRgeneral, NT_STATUS_THREAD_NOT_IN_PROCESS}, {
        ERRHRD, ERRgeneral, NT_STATUS_TOKEN_ALREADY_IN_USE}, {
        ERRHRD, ERRgeneral, NT_STATUS_PAGEFILE_QUOTA_EXCEEDED}, {
        ERRHRD, ERRgeneral, NT_STATUS_COMMITMENT_LIMIT}, {
        ERRDOS, 193, NT_STATUS_INVALID_IMAGE_LE_FORMAT}, {
        ERRDOS, 193, NT_STATUS_INVALID_IMAGE_NOT_MZ}, {
        ERRDOS, 193, NT_STATUS_INVALID_IMAGE_PROTECT}, {
        ERRDOS, 193, NT_STATUS_INVALID_IMAGE_WIN_16}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOGON_SERVER_CONFLICT}, {
        ERRHRD, ERRgeneral, NT_STATUS_TIME_DIFFERENCE_AT_DC}, {
        ERRHRD, ERRgeneral, NT_STATUS_SYNCHRONIZATION_REQUIRED}, {
        ERRDOS, 126, NT_STATUS_DLL_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_OPEN_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_IO_PRIVILEGE_FAILED}, {
        ERRDOS, 182, NT_STATUS_ORDINAL_NOT_FOUND}, {
        ERRDOS, 127, NT_STATUS_ENTRYPOINT_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONTROL_C_EXIT}, {
        ERRDOS, 64, NT_STATUS_LOCAL_DISCONNECT}, {
        ERRDOS, 64, NT_STATUS_REMOTE_DISCONNECT}, {
        ERRDOS, 51, NT_STATUS_REMOTE_RESOURCES}, {
        ERRDOS, 59, NT_STATUS_LINK_FAILED}, {
        ERRDOS, 59, NT_STATUS_LINK_TIMEOUT}, {
        ERRDOS, 59, NT_STATUS_INVALID_CONNECTION}, {
        ERRDOS, 59, NT_STATUS_INVALID_ADDRESS}, {
        ERRHRD, ERRgeneral, NT_STATUS_DLL_INIT_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_MISSING_SYSTEMFILE}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNHANDLED_EXCEPTION}, {
        ERRHRD, ERRgeneral, NT_STATUS_APP_INIT_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_PAGEFILE_CREATE_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_PAGEFILE}, {
        ERRDOS, 124, NT_STATUS_INVALID_LEVEL}, {
        ERRDOS, 86, NT_STATUS_WRONG_PASSWORD_CORE}, {
        ERRHRD, ERRgeneral, NT_STATUS_ILLEGAL_FLOAT_CONTEXT}, {
        ERRDOS, 109, NT_STATUS_PIPE_BROKEN}, {
        ERRHRD, ERRgeneral, NT_STATUS_REGISTRY_CORRUPT}, {
        ERRHRD, ERRgeneral, NT_STATUS_REGISTRY_IO_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_EVENT_PAIR}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNRECOGNIZED_VOLUME}, {
        ERRHRD, ERRgeneral, NT_STATUS_SERIAL_NO_DEVICE_INITED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_ALIAS}, {
        ERRHRD, ERRgeneral, NT_STATUS_MEMBER_NOT_IN_ALIAS}, {
        ERRHRD, ERRgeneral, NT_STATUS_MEMBER_IN_ALIAS}, {
        ERRHRD, ERRgeneral, NT_STATUS_ALIAS_EXISTS}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOGON_NOT_GRANTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_SECRETS}, {
        ERRHRD, ERRgeneral, NT_STATUS_SECRET_TOO_LONG}, {
        ERRHRD, ERRgeneral, NT_STATUS_INTERNAL_DB_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_FULLSCREEN_MODE}, {
        ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_CONTEXT_IDS}, {
        ERRDOS, ERRnoaccess, NT_STATUS_LOGON_TYPE_NOT_GRANTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NOT_REGISTRY_FILE}, {
        ERRHRD, ERRgeneral, NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED}, {
        ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_CTRLR_CONFIG_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_FT_MISSING_MEMBER}, {
        ERRHRD, ERRgeneral, NT_STATUS_ILL_FORMED_SERVICE_ENTRY}, {
        ERRHRD, ERRgeneral, NT_STATUS_ILLEGAL_CHARACTER}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNMAPPABLE_CHARACTER}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNDEFINED_CHARACTER}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_VOLUME}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_ID_MARK_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_WRONG_CYLINDER}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_UNKNOWN_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_FLOPPY_BAD_REGISTERS}, {
        ERRHRD, ERRgeneral, NT_STATUS_DISK_RECALIBRATE_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_DISK_OPERATION_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_DISK_RESET_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_SHARED_IRQ_BUSY}, {
        ERRHRD, ERRgeneral, NT_STATUS_FT_ORPHANING}, {
        ERRHRD, ERRgeneral, 0xc000016e}, {
        ERRHRD, ERRgeneral, 0xc000016f}, {
        ERRHRD, ERRgeneral, 0xc0000170}, {
        ERRHRD, ERRgeneral, 0xc0000171}, {
        ERRHRD, ERRgeneral, NT_STATUS_PARTITION_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_BLOCK_LENGTH}, {
        ERRHRD, ERRgeneral, NT_STATUS_DEVICE_NOT_PARTITIONED}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNABLE_TO_LOCK_MEDIA}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNABLE_TO_UNLOAD_MEDIA}, {
        ERRHRD, ERRgeneral, NT_STATUS_EOM_OVERFLOW}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_MEDIA}, {
        ERRHRD, ERRgeneral, 0xc0000179}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_MEMBER}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_MEMBER}, {
        ERRHRD, ERRgeneral, NT_STATUS_KEY_DELETED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_LOG_SPACE}, {
        ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_SIDS}, {
        ERRHRD, ERRgeneral, NT_STATUS_LM_CROSS_ENCRYPTION_REQUIRED}, {
        ERRHRD, ERRgeneral, NT_STATUS_KEY_HAS_CHILDREN}, {
        ERRHRD, ERRgeneral, NT_STATUS_CHILD_MUST_BE_VOLATILE}, {
        ERRDOS, 87, NT_STATUS_DEVICE_CONFIGURATION_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_DRIVER_INTERNAL_ERROR}, {
        ERRDOS, 22, NT_STATUS_INVALID_DEVICE_STATE}, {
        ERRHRD, ERRgeneral, NT_STATUS_IO_DEVICE_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_DEVICE_PROTOCOL_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_BACKUP_CONTROLLER}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOG_FILE_FULL}, {
        ERRDOS, 19, NT_STATUS_TOO_LATE}, {
        ERRDOS, ERRnoaccess, NT_STATUS_NO_TRUST_LSA_SECRET},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_NO_TRUST_SAM_ACCOUNT to
         NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE during the session setup } */
        {
        ERRDOS, ERRnoaccess, NT_STATUS_NO_TRUST_SAM_ACCOUNT}, {
        ERRDOS, ERRnoaccess, NT_STATUS_TRUSTED_DOMAIN_FAILURE}, {
        ERRDOS, ERRnoaccess, NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_EVENTLOG_FILE_CORRUPT}, {
        ERRHRD, ERRgeneral, NT_STATUS_EVENTLOG_CANT_START}, {
        ERRDOS, ERRnoaccess, NT_STATUS_TRUST_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_MUTANT_LIMIT_EXCEEDED}, {
        ERRDOS, ERRnetlogonNotStarted, NT_STATUS_NETLOGON_NOT_STARTED}, {
        ERRSRV, ERRaccountexpired, NT_STATUS_ACCOUNT_EXPIRED}, {
        ERRHRD, ERRgeneral, NT_STATUS_POSSIBLE_DEADLOCK}, {
        ERRHRD, ERRgeneral, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT}, {
        ERRHRD, ERRgeneral, NT_STATUS_REMOTE_SESSION_LIMIT}, {
        ERRHRD, ERRgeneral, NT_STATUS_EVENTLOG_FILE_CHANGED}, {
        ERRDOS, ERRnoaccess, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT}, {
        ERRDOS, ERRnoaccess, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT}, {
        ERRDOS, ERRnoaccess, NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT},
/*        { This NT error code was 'sqashed'
         from NT_STATUS_DOMAIN_TRUST_INCONSISTENT to NT_STATUS_LOGON_FAILURE
         during the session setup }  */
        {
        ERRDOS, ERRnoaccess, NT_STATUS_DOMAIN_TRUST_INCONSISTENT}, {
        ERRHRD, ERRgeneral, NT_STATUS_FS_DRIVER_REQUIRED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_USER_SESSION_KEY}, {
        ERRDOS, 59, NT_STATUS_USER_SESSION_DELETED}, {
        ERRHRD, ERRgeneral, NT_STATUS_RESOURCE_LANG_NOT_FOUND}, {
        ERRDOS, ERRnoresource, NT_STATUS_INSUFF_SERVER_RESOURCES}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_BUFFER_SIZE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_ADDRESS_COMPONENT}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_ADDRESS_WILDCARD}, {
        ERRDOS, 68, NT_STATUS_TOO_MANY_ADDRESSES}, {
        ERRDOS, 52, NT_STATUS_ADDRESS_ALREADY_EXISTS}, {
        ERRDOS, 64, NT_STATUS_ADDRESS_CLOSED}, {
        ERRDOS, 64, NT_STATUS_CONNECTION_DISCONNECTED}, {
        ERRDOS, 64, NT_STATUS_CONNECTION_RESET}, {
        ERRDOS, 68, NT_STATUS_TOO_MANY_NODES}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_ABORTED}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_TIMED_OUT}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_NO_RELEASE}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_NO_MATCH}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_RESPONDED}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_INVALID_ID}, {
        ERRDOS, 59, NT_STATUS_TRANSACTION_INVALID_TYPE}, {
        ERRDOS, ERRunsup, NT_STATUS_NOT_SERVER_SESSION}, {
        ERRDOS, ERRunsup, NT_STATUS_NOT_CLIENT_SESSION}, {
        ERRHRD, ERRgeneral, NT_STATUS_CANNOT_LOAD_REGISTRY_FILE}, {
        ERRHRD, ERRgeneral, NT_STATUS_DEBUG_ATTACH_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_SYSTEM_PROCESS_TERMINATED}, {
        ERRHRD, ERRgeneral, NT_STATUS_DATA_NOT_ACCEPTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_BROWSER_SERVERS_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_VDM_HARD_ERROR}, {
        ERRHRD, ERRgeneral, NT_STATUS_DRIVER_CANCEL_TIMEOUT}, {
        ERRHRD, ERRgeneral, NT_STATUS_REPLY_MESSAGE_MISMATCH}, {
        ERRHRD, ERRgeneral, NT_STATUS_MAPPED_ALIGNMENT}, {
        ERRDOS, 193, NT_STATUS_IMAGE_CHECKSUM_MISMATCH}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOST_WRITEBEHIND_DATA}, {
        ERRHRD, ERRgeneral, NT_STATUS_CLIENT_SERVER_PARAMETERS_INVALID}, {
        ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_MUST_CHANGE}, {
        ERRHRD, ERRgeneral, NT_STATUS_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_NOT_TINY_STREAM}, {
        ERRHRD, ERRgeneral, NT_STATUS_RECOVERY_FAILURE}, {
        ERRHRD, ERRgeneral, NT_STATUS_STACK_OVERFLOW_READ}, {
        ERRHRD, ERRgeneral, NT_STATUS_FAIL_CHECK}, {
        ERRHRD, ERRgeneral, NT_STATUS_DUPLICATE_OBJECTID}, {
        ERRHRD, ERRgeneral, NT_STATUS_OBJECTID_EXISTS}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONVERT_TO_LARGE}, {
        ERRHRD, ERRgeneral, NT_STATUS_RETRY}, {
        ERRHRD, ERRgeneral, NT_STATUS_FOUND_OUT_OF_SCOPE}, {
        ERRHRD, ERRgeneral, NT_STATUS_ALLOCATE_BUCKET}, {
        ERRHRD, ERRgeneral, NT_STATUS_PROPSET_NOT_FOUND}, {
        ERRHRD, ERRgeneral, NT_STATUS_MARSHALL_OVERFLOW}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_VARIANT}, {
        ERRHRD, ERRgeneral, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND}, {
        ERRDOS, ERRnoaccess, NT_STATUS_ACCOUNT_LOCKED_OUT}, {
        ERRDOS, ERRbadfid, NT_STATUS_HANDLE_NOT_CLOSABLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_REFUSED}, {
        ERRHRD, ERRgeneral, NT_STATUS_GRACEFUL_DISCONNECT}, {
        ERRHRD, ERRgeneral, NT_STATUS_ADDRESS_ALREADY_ASSOCIATED}, {
        ERRHRD, ERRgeneral, NT_STATUS_ADDRESS_NOT_ASSOCIATED}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_INVALID}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_ACTIVE}, {
        ERRHRD, ERRgeneral, NT_STATUS_NETWORK_UNREACHABLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_HOST_UNREACHABLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_PROTOCOL_UNREACHABLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_PORT_UNREACHABLE}, {
        ERRHRD, ERRgeneral, NT_STATUS_REQUEST_ABORTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_ABORTED}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_COMPRESSION_BUFFER}, {
        ERRHRD, ERRgeneral, NT_STATUS_USER_MAPPED_FILE}, {
        ERRHRD, ERRgeneral, NT_STATUS_AUDIT_FAILED}, {
        ERRHRD, ERRgeneral, NT_STATUS_TIMER_RESOLUTION_NOT_SET}, {
        ERRHRD, ERRgeneral, NT_STATUS_CONNECTION_COUNT_LIMIT}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOGIN_TIME_RESTRICTION}, {
        ERRHRD, ERRgeneral, NT_STATUS_LOGIN_WKSTA_RESTRICTION}, {
        ERRDOS, 193, NT_STATUS_IMAGE_MP_UP_MISMATCH}, {
        ERRHRD, ERRgeneral, 0xc000024a}, {
        ERRHRD, ERRgeneral, 0xc000024b}, {
        ERRHRD, ERRgeneral, 0xc000024c}, {
        ERRHRD, ERRgeneral, 0xc000024d}, {
        ERRHRD, ERRgeneral, 0xc000024e}, {
        ERRHRD, ERRgeneral, 0xc000024f}, {
        ERRHRD, ERRgeneral, NT_STATUS_INSUFFICIENT_LOGON_INFO}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_DLL_ENTRYPOINT}, {
        ERRHRD, ERRgeneral, NT_STATUS_BAD_SERVICE_ENTRYPOINT}, {
        ERRHRD, ERRgeneral, NT_STATUS_LPC_REPLY_LOST}, {
        ERRHRD, ERRgeneral, NT_STATUS_IP_ADDRESS_CONFLICT1}, {
        ERRHRD, ERRgeneral, NT_STATUS_IP_ADDRESS_CONFLICT2}, {
        ERRHRD, ERRgeneral, NT_STATUS_REGISTRY_QUOTA_LIMIT}, {
        ERRSRV, 3, NT_STATUS_PATH_NOT_COVERED}, {
        ERRHRD, ERRgeneral, NT_STATUS_NO_CALLBACK_ACTIVE}, {
        ERRHRD, ERRgeneral, NT_STATUS_LICENSE_QUOTA_EXCEEDED}, {
        ERRHRD, ERRgeneral, NT_STATUS_PWD_TOO_SHORT}, {
        ERRHRD, ERRgeneral, NT_STATUS_PWD_TOO_RECENT}, {
        ERRHRD, ERRgeneral, NT_STATUS_PWD_HISTORY_CONFLICT}, {
        ERRHRD, ERRgeneral, 0xc000025d}, {
        ERRHRD, ERRgeneral, NT_STATUS_PLUGPLAY_NO_DEVICE}, {
        ERRHRD, ERRgeneral, NT_STATUS_UNSUPPORTED_COMPRESSION}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_HW_PROFILE}, {
        ERRHRD, ERRgeneral, NT_STATUS_INVALID_PLUGPLAY_DEVICE_PATH}, {
        ERRDOS, 182, NT_STATUS_DRIVER_ORDINAL_NOT_FOUND}, {
        ERRDOS, 127, NT_STATUS_DRIVER_ENTRYPOINT_NOT_FOUND}, {
        ERRDOS, 288, NT_STATUS_RESOURCE_NOT_OWNED}, {
        ERRDOS, ErrTooManyLinks, NT_STATUS_TOO_MANY_LINKS}, {
        ERRHRD, ERRgeneral, NT_STATUS_QUOTA_LIST_INCONSISTENT}, {
        ERRHRD, ERRgeneral, NT_STATUS_FILE_IS_OFFLINE}, {
        ERRDOS, 21, 0xc000026e}, {
        ERRDOS, 161, 0xc0000281}, {
        ERRDOS, ERRnoaccess, 0xc000028a}, {
        ERRDOS, ERRnoaccess, 0xc000028b}, {
        ERRHRD, ERRgeneral, 0xc000028c}, {
        ERRDOS, ERRnoaccess, 0xc000028d}, {
        ERRDOS, ERRnoaccess, 0xc000028e}, {
        ERRDOS, ERRnoaccess, 0xc000028f}, {
        ERRDOS, ERRnoaccess, 0xc0000290}, {
        ERRDOS, ERRbadfunc, 0xc000029c}, {
        ERRDOS, ERRsymlink, NT_STATUS_STOPPED_ON_SYMLINK}, {
        ERRDOS, ERRinvlevel, 0x007c0001}, {
        0, 0, 0 }
};

/*****************************************************************************
 Print an error message from the status code
 *****************************************************************************/
static void
cifs_print_status(__u32 status_code)
{
        int idx = 0;

        while (nt_errs[idx].nt_errstr != NULL) {
                if (((nt_errs[idx].nt_errcode) & 0xFFFFFF) ==
                    (status_code & 0xFFFFFF)) {
                        pr_notice("Status code returned 0x%08x %s\n",
                                  status_code, nt_errs[idx].nt_errstr);
                }
                idx++;
        }
        return;
}


static void
ntstatus_to_dos(__u32 ntstatus, __u8 *eclass, __u16 *ecode)
{
        int i;
        if (ntstatus == 0) {
                *eclass = 0;
                *ecode = 0;
                return;
        }
        for (i = 0; ntstatus_to_dos_map[i].ntstatus; i++) {
                if (ntstatus == ntstatus_to_dos_map[i].ntstatus) {
                        *eclass = ntstatus_to_dos_map[i].dos_class;
                        *ecode = ntstatus_to_dos_map[i].dos_code;
                        return;
                }
        }
        *eclass = ERRHRD;
        *ecode = ERRgeneral;
}

int
map_smb_to_linux_error(char *buf, bool logErr)
{
        struct smb_hdr *smb = (struct smb_hdr *)buf;
        unsigned int i;
        int rc = -EIO;        /* if transport error smb error may not be set */
        __u8 smberrclass;
        __u16 smberrcode;

        /* BB if NT Status codes - map NT BB */

        /* old style smb error codes */
        if (smb->Status.CifsError == 0)
                return 0;

        if (smb->Flags2 & SMBFLG2_ERR_STATUS) {
                /* translate the newer STATUS codes to old style SMB errors
                 * and then to POSIX errors */
                __u32 err = le32_to_cpu(smb->Status.CifsError);
                if (logErr && (err != (NT_STATUS_MORE_PROCESSING_REQUIRED)))
                        cifs_print_status(err);
                else if (cifsFYI & CIFS_RC)
                        cifs_print_status(err);
                ntstatus_to_dos(err, &smberrclass, &smberrcode);
        } else {
                smberrclass = smb->Status.DosError.ErrorClass;
                smberrcode = le16_to_cpu(smb->Status.DosError.Error);
        }

        /* old style errors */

        /* DOS class smb error codes - map DOS */
        if (smberrclass == ERRDOS) {
                /* 1 byte field no need to byte reverse */
                for (i = 0;
                     i <
                     sizeof(mapping_table_ERRDOS) /
                     sizeof(struct smb_to_posix_error); i++) {
                        if (mapping_table_ERRDOS[i].smb_err == 0)
                                break;
                        else if (mapping_table_ERRDOS[i].smb_err ==
                                                                smberrcode) {
                                rc = mapping_table_ERRDOS[i].posix_code;
                                break;
                        }
                        /* else try next error mapping one to see if match */
                }
        } else if (smberrclass == ERRSRV) {
                /* server class of error codes */
                for (i = 0;
                     i <
                     sizeof(mapping_table_ERRSRV) /
                     sizeof(struct smb_to_posix_error); i++) {
                        if (mapping_table_ERRSRV[i].smb_err == 0)
                                break;
                        else if (mapping_table_ERRSRV[i].smb_err ==
                                                                smberrcode) {
                                rc = mapping_table_ERRSRV[i].posix_code;
                                break;
                        }
                        /* else try next error mapping to see if match */
                }
        }
        /* else ERRHRD class errors or junk  - return EIO */

        cifs_dbg(FYI, "Mapping smb error code 0x%x to POSIX err %d\n",
                 le32_to_cpu(smb->Status.CifsError), rc);

        /* generic corrective action e.g. reconnect SMB session on
         * ERRbaduid could be added */

        return rc;
}

int
map_and_check_smb_error(struct mid_q_entry *mid, bool logErr)
{
        int rc;
        struct smb_hdr *smb = (struct smb_hdr *)mid->resp_buf;

        rc = map_smb_to_linux_error((char *)smb, logErr);
        if (rc == -EACCES && !(smb->Flags2 & SMBFLG2_ERR_STATUS)) {
                /* possible ERRBaduid */
                __u8 class = smb->Status.DosError.ErrorClass;
                __u16 code = le16_to_cpu(smb->Status.DosError.Error);

                /* switch can be used to handle different errors */
                if (class == ERRSRV && code == ERRbaduid) {
                        cifs_dbg(FYI, "Server returned 0x%x, reconnecting session...\n",
                                code);
                        cifs_signal_cifsd_for_reconnect(mid->server, false);
                }
        }

        return rc;
}


/*
 * calculate the size of the SMB message based on the fixed header
 * portion, the number of word parameters and the data portion of the message
 */
unsigned int
smbCalcSize(void *buf)
{
        struct smb_hdr *ptr = buf;
        return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
                2 /* size of the bcc field */ + get_bcc(ptr));
}

/* The following are taken from fs/ntfs/util.c */

#define NTFS_TIME_OFFSET ((u64)(369*365 + 89) * 24 * 3600 * 10000000)

/*
 * Convert the NT UTC (based 1601-01-01, in hundred nanosecond units)
 * into Unix UTC (based 1970-01-01, in seconds).
 */
struct timespec64
cifs_NTtimeToUnix(__le64 ntutc)
{
        struct timespec64 ts;
        /* BB what about the timezone? BB */

        /* Subtract the NTFS time offset, then convert to 1s intervals. */
        s64 t = le64_to_cpu(ntutc) - NTFS_TIME_OFFSET;
        u64 abs_t;

        /*
         * Unfortunately can not use normal 64 bit division on 32 bit arch, but
         * the alternative, do_div, does not work with negative numbers so have
         * to special case them
         */
        if (t < 0) {
                abs_t = -t;
                ts.tv_nsec = (time64_t)(do_div(abs_t, 10000000) * 100);
                ts.tv_nsec = -ts.tv_nsec;
                ts.tv_sec = -abs_t;
        } else {
                abs_t = t;
                ts.tv_nsec = (time64_t)do_div(abs_t, 10000000) * 100;
                ts.tv_sec = abs_t;
        }

        return ts;
}

/* Convert the Unix UTC into NT UTC. */
u64
cifs_UnixTimeToNT(struct timespec64 t)
{
        /* Convert to 100ns intervals and then add the NTFS time offset. */
        return (u64) t.tv_sec * 10000000 + t.tv_nsec/100 + NTFS_TIME_OFFSET;
}

static const int total_days_of_prev_months[] = {
        0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334
};

struct timespec64 cnvrtDosUnixTm(__le16 le_date, __le16 le_time, int offset)
{
        struct timespec64 ts;
        time64_t sec, days;
        int min, day, month, year;
        u16 date = le16_to_cpu(le_date);
        u16 time = le16_to_cpu(le_time);
        SMB_TIME *st = (SMB_TIME *)&time;
        SMB_DATE *sd = (SMB_DATE *)&date;

        cifs_dbg(FYI, "date %d time %d\n", date, time);

        sec = 2 * st->TwoSeconds;
        min = st->Minutes;
        if ((sec > 59) || (min > 59))
                cifs_dbg(VFS, "Invalid time min %d sec %lld\n", min, sec);
        sec += (min * 60);
        sec += 60 * 60 * st->Hours;
        if (st->Hours > 24)
                cifs_dbg(VFS, "Invalid hours %d\n", st->Hours);
        day = sd->Day;
        month = sd->Month;
        if (day < 1 || day > 31 || month < 1 || month > 12) {
                cifs_dbg(VFS, "Invalid date, month %d day: %d\n", month, day);
                day = clamp(day, 1, 31);
                month = clamp(month, 1, 12);
        }
        month -= 1;
        days = day + total_days_of_prev_months[month];
        days += 3652; /* account for difference in days between 1980 and 1970 */
        year = sd->Year;
        days += year * 365;
        days += (year/4); /* leap year */
        /* generalized leap year calculation is more complex, ie no leap year
        for years/100 except for years/400, but since the maximum number for DOS
         year is 2**7, the last year is 1980+127, which means we need only
         consider 2 special case years, ie the years 2000 and 2100, and only
         adjust for the lack of leap year for the year 2100, as 2000 was a
         leap year (divisible by 400) */
        if (year >= 120)  /* the year 2100 */
                days = days - 1;  /* do not count leap year for the year 2100 */

        /* adjust for leap year where we are still before leap day */
        if (year != 120)
                days -= ((year & 0x03) == 0) && (month < 2 ? 1 : 0);
        sec += 24 * 60 * 60 * days;

        ts.tv_sec = sec + offset;

        /* cifs_dbg(FYI, "sec after cnvrt dos to unix time %d\n",sec); */

        ts.tv_nsec = 0;
        return ts;
}












































































































































































































    4 


    4 
























































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
// SPDX-License-Identifier: GPL-2.0-only
/* Miscellaneous routines.
 *
 * Copyright (C) 2023 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 */

#include <linux/swap.h>
#include "internal.h"

/*
 * Make sure there's space in the rolling queue.
 */
struct folio_queue *netfs_buffer_make_space(struct netfs_io_request *rreq)
{
        struct folio_queue *tail = rreq->buffer_tail, *prev;
        unsigned int prev_nr_slots = 0;

        if (WARN_ON_ONCE(!rreq->buffer && tail) ||
            WARN_ON_ONCE(rreq->buffer && !tail))
                return ERR_PTR(-EIO);

        prev = tail;
        if (prev) {
                if (!folioq_full(tail))
                        return tail;
                prev_nr_slots = folioq_nr_slots(tail);
        }

        tail = kmalloc(sizeof(*tail), GFP_NOFS);
        if (!tail)
                return ERR_PTR(-ENOMEM);
        netfs_stat(&netfs_n_folioq);
        folioq_init(tail);
        tail->prev = prev;
        if (prev)
                /* [!] NOTE: After we set prev->next, the consumer is entirely
                 * at liberty to delete prev.
                 */
                WRITE_ONCE(prev->next, tail);

        rreq->buffer_tail = tail;
        if (!rreq->buffer) {
                rreq->buffer = tail;
                iov_iter_folio_queue(&rreq->io_iter, ITER_SOURCE, tail, 0, 0, 0);
        } else {
                /* Make sure we don't leave the master iterator pointing to a
                 * block that might get immediately consumed.
                 */
                if (rreq->io_iter.folioq == prev &&
                    rreq->io_iter.folioq_slot == prev_nr_slots) {
                        rreq->io_iter.folioq = tail;
                        rreq->io_iter.folioq_slot = 0;
                }
        }
        rreq->buffer_tail_slot = 0;
        return tail;
}

/*
 * Append a folio to the rolling queue.
 */
int netfs_buffer_append_folio(struct netfs_io_request *rreq, struct folio *folio,
                              bool needs_put)
{
        struct folio_queue *tail;
        unsigned int slot, order = folio_order(folio);

        tail = netfs_buffer_make_space(rreq);
        if (IS_ERR(tail))
                return PTR_ERR(tail);

        rreq->io_iter.count += PAGE_SIZE << order;

        slot = folioq_append(tail, folio);
        /* Store the counter after setting the slot. */
        smp_store_release(&rreq->buffer_tail_slot, slot);
        return 0;
}

/*
 * Delete the head of a rolling queue.
 */
struct folio_queue *netfs_delete_buffer_head(struct netfs_io_request *wreq)
{
        struct folio_queue *head = wreq->buffer, *next = head->next;

        if (next)
                next->prev = NULL;
        netfs_stat_d(&netfs_n_folioq);
        kfree(head);
        wreq->buffer = next;
        return next;
}

/*
 * Clear out a rolling queue.
 */
void netfs_clear_buffer(struct netfs_io_request *rreq)
{
        struct folio_queue *p;

        while ((p = rreq->buffer)) {
                rreq->buffer = p->next;
                for (int slot = 0; slot < folioq_count(p); slot++) {
                        struct folio *folio = folioq_folio(p, slot);
                        if (!folio)
                                continue;
                        if (folioq_is_marked(p, slot)) {
                                trace_netfs_folio(folio, netfs_folio_trace_put);
                                folio_put(folio);
                        }
                }
                netfs_stat_d(&netfs_n_folioq);
                kfree(p);
        }
}

/*
 * Reset the subrequest iterator to refer just to the region remaining to be
 * read.  The iterator may or may not have been advanced by socket ops or
 * extraction ops to an extent that may or may not match the amount actually
 * read.
 */
void netfs_reset_iter(struct netfs_io_subrequest *subreq)
{
        struct iov_iter *io_iter = &subreq->io_iter;
        size_t remain = subreq->len - subreq->transferred;

        if (io_iter->count > remain)
                iov_iter_advance(io_iter, io_iter->count - remain);
        else if (io_iter->count < remain)
                iov_iter_revert(io_iter, remain - io_iter->count);
        iov_iter_truncate(&subreq->io_iter, remain);
}

/**
 * netfs_dirty_folio - Mark folio dirty and pin a cache object for writeback
 * @mapping: The mapping the folio belongs to.
 * @folio: The folio being dirtied.
 *
 * Set the dirty flag on a folio and pin an in-use cache object in memory so
 * that writeback can later write to it.  This is intended to be called from
 * the filesystem's ->dirty_folio() method.
 *
 * Return: true if the dirty flag was set on the folio, false otherwise.
 */
bool netfs_dirty_folio(struct address_space *mapping, struct folio *folio)
{
        struct inode *inode = mapping->host;
        struct netfs_inode *ictx = netfs_inode(inode);
        struct fscache_cookie *cookie = netfs_i_cookie(ictx);
        bool need_use = false;

        _enter("");

        if (!filemap_dirty_folio(mapping, folio))
                return false;
        if (!fscache_cookie_valid(cookie))
                return true;

        if (!(inode->i_state & I_PINNING_NETFS_WB)) {
                spin_lock(&inode->i_lock);
                if (!(inode->i_state & I_PINNING_NETFS_WB)) {
                        inode->i_state |= I_PINNING_NETFS_WB;
                        need_use = true;
                }
                spin_unlock(&inode->i_lock);

                if (need_use)
                        fscache_use_cookie(cookie, true);
        }
        return true;
}
EXPORT_SYMBOL(netfs_dirty_folio);

/**
 * netfs_unpin_writeback - Unpin writeback resources
 * @inode: The inode on which the cookie resides
 * @wbc: The writeback control
 *
 * Unpin the writeback resources pinned by netfs_dirty_folio().  This is
 * intended to be called as/by the netfs's ->write_inode() method.
 */
int netfs_unpin_writeback(struct inode *inode, struct writeback_control *wbc)
{
        struct fscache_cookie *cookie = netfs_i_cookie(netfs_inode(inode));

        if (wbc->unpinned_netfs_wb)
                fscache_unuse_cookie(cookie, NULL, NULL);
        return 0;
}
EXPORT_SYMBOL(netfs_unpin_writeback);

/**
 * netfs_clear_inode_writeback - Clear writeback resources pinned by an inode
 * @inode: The inode to clean up
 * @aux: Auxiliary data to apply to the inode
 *
 * Clear any writeback resources held by an inode when the inode is evicted.
 * This must be called before clear_inode() is called.
 */
void netfs_clear_inode_writeback(struct inode *inode, const void *aux)
{
        struct fscache_cookie *cookie = netfs_i_cookie(netfs_inode(inode));

        if (inode->i_state & I_PINNING_NETFS_WB) {
                loff_t i_size = i_size_read(inode);
                fscache_unuse_cookie(cookie, aux, &i_size);
        }
}
EXPORT_SYMBOL(netfs_clear_inode_writeback);

/**
 * netfs_invalidate_folio - Invalidate or partially invalidate a folio
 * @folio: Folio proposed for release
 * @offset: Offset of the invalidated region
 * @length: Length of the invalidated region
 *
 * Invalidate part or all of a folio for a network filesystem.  The folio will
 * be removed afterwards if the invalidated region covers the entire folio.
 */
void netfs_invalidate_folio(struct folio *folio, size_t offset, size_t length)
{
        struct netfs_folio *finfo;
        struct netfs_inode *ctx = netfs_inode(folio_inode(folio));
        size_t flen = folio_size(folio);

        _enter("{%lx},%zx,%zx", folio->index, offset, length);

        if (offset == 0 && length == flen) {
                unsigned long long i_size = i_size_read(&ctx->inode);
                unsigned long long fpos = folio_pos(folio), end;

                end = umin(fpos + flen, i_size);
                if (fpos < i_size && end > ctx->zero_point)
                        ctx->zero_point = end;
        }

        folio_wait_private_2(folio); /* [DEPRECATED] */

        if (!folio_test_private(folio))
                return;

        finfo = netfs_folio_info(folio);

        if (offset == 0 && length >= flen)
                goto erase_completely;

        if (finfo) {
                /* We have a partially uptodate page from a streaming write. */
                unsigned int fstart = finfo->dirty_offset;
                unsigned int fend = fstart + finfo->dirty_len;
                unsigned int iend = offset + length;

                if (offset >= fend)
                        return;
                if (iend <= fstart)
                        return;

                /* The invalidation region overlaps the data.  If the region
                 * covers the start of the data, we either move along the start
                 * or just erase the data entirely.
                 */
                if (offset <= fstart) {
                        if (iend >= fend)
                                goto erase_completely;
                        /* Move the start of the data. */
                        finfo->dirty_len = fend - iend;
                        finfo->dirty_offset = offset;
                        return;
                }

                /* Reduce the length of the data if the invalidation region
                 * covers the tail part.
                 */
                if (iend >= fend) {
                        finfo->dirty_len = offset - fstart;
                        return;
                }

                /* A partial write was split.  The caller has already zeroed
                 * it, so just absorb the hole.
                 */
        }
        return;

erase_completely:
        netfs_put_group(netfs_folio_group(folio));
        folio_detach_private(folio);
        folio_clear_uptodate(folio);
        kfree(finfo);
        return;
}
EXPORT_SYMBOL(netfs_invalidate_folio);

/**
 * netfs_release_folio - Try to release a folio
 * @folio: Folio proposed for release
 * @gfp: Flags qualifying the release
 *
 * Request release of a folio and clean up its private state if it's not busy.
 * Returns true if the folio can now be released, false if not
 */
bool netfs_release_folio(struct folio *folio, gfp_t gfp)
{
        struct netfs_inode *ctx = netfs_inode(folio_inode(folio));
        unsigned long long end;

        if (folio_test_dirty(folio))
                return false;

        end = umin(folio_pos(folio) + folio_size(folio), i_size_read(&ctx->inode));
        if (end > ctx->zero_point)
                ctx->zero_point = end;

        if (folio_test_private(folio))
                return false;
        if (unlikely(folio_test_private_2(folio))) { /* [DEPRECATED] */
                if (current_is_kswapd() || !(gfp & __GFP_FS))
                        return false;
                folio_wait_private_2(folio);
        }
        fscache_note_page_release(netfs_i_cookie(ctx));
        return true;
}
EXPORT_SYMBOL(netfs_release_folio);




































































   32 
   32 






    2 
    1 

    1 








   13 


   12 










    2 






    2 
    2 























    5 














   10 


























































    1 





   12 




















   95 



   95 


















































   55 











   31 



   36 


    2 
    4 



    1 
    4 




    3 
   28 
    1 



   28 






   37 

















   10 








    1 

















    1 









   10 











   10 






























   13 















    3 
   10 



   10 








   13 





















    1 














    1 




























   13 








    1 



















   13 


    3 
















   10 


   13 


































































































































    6 




















    6 











    2 




    4 









    4 















   25 








   17 



   17 




   17 





















    8 



    9 























    6 









    6 




























    2 


    3 














    3 










    3 




















    3 



















    3 











    3 























    3 








    3 

























    8 








    1 












    7 





    2 




    1 

    4 






    4 
















    5 





    2 


    3 













    2 





    1 





    7 


    7 


























    5 





    1 





    1 








    3 




















    1 












    1 























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
// SPDX-License-Identifier: GPL-2.0
/*
 * Filesystem-level keyring for fscrypt
 *
 * Copyright 2019 Google LLC
 */

/*
 * This file implements management of fscrypt master keys in the
 * filesystem-level keyring, including the ioctls:
 *
 * - FS_IOC_ADD_ENCRYPTION_KEY
 * - FS_IOC_REMOVE_ENCRYPTION_KEY
 * - FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS
 * - FS_IOC_GET_ENCRYPTION_KEY_STATUS
 *
 * See the "User API" section of Documentation/filesystems/fscrypt.rst for more
 * information about these ioctls.
 */

#include <linux/unaligned.h>
#include <crypto/skcipher.h>
#include <linux/key-type.h>
#include <linux/random.h>
#include <linux/seq_file.h>

#include "fscrypt_private.h"

/* The master encryption keys for a filesystem (->s_master_keys) */
struct fscrypt_keyring {
        /*
         * Lock that protects ->key_hashtable.  It does *not* protect the
         * fscrypt_master_key structs themselves.
         */
        spinlock_t lock;

        /* Hash table that maps fscrypt_key_specifier to fscrypt_master_key */
        struct hlist_head key_hashtable[128];
};

static void wipe_master_key_secret(struct fscrypt_master_key_secret *secret)
{
        fscrypt_destroy_hkdf(&secret->hkdf);
        memzero_explicit(secret, sizeof(*secret));
}

static void move_master_key_secret(struct fscrypt_master_key_secret *dst,
                                   struct fscrypt_master_key_secret *src)
{
        memcpy(dst, src, sizeof(*dst));
        memzero_explicit(src, sizeof(*src));
}

static void fscrypt_free_master_key(struct rcu_head *head)
{
        struct fscrypt_master_key *mk =
                container_of(head, struct fscrypt_master_key, mk_rcu_head);
        /*
         * The master key secret and any embedded subkeys should have already
         * been wiped when the last active reference to the fscrypt_master_key
         * struct was dropped; doing it here would be unnecessarily late.
         * Nevertheless, use kfree_sensitive() in case anything was missed.
         */
        kfree_sensitive(mk);
}

void fscrypt_put_master_key(struct fscrypt_master_key *mk)
{
        if (!refcount_dec_and_test(&mk->mk_struct_refs))
                return;
        /*
         * No structural references left, so free ->mk_users, and also free the
         * fscrypt_master_key struct itself after an RCU grace period ensures
         * that concurrent keyring lookups can no longer find it.
         */
        WARN_ON_ONCE(refcount_read(&mk->mk_active_refs) != 0);
        if (mk->mk_users) {
                /* Clear the keyring so the quota gets released right away. */
                keyring_clear(mk->mk_users);
                key_put(mk->mk_users);
                mk->mk_users = NULL;
        }
        call_rcu(&mk->mk_rcu_head, fscrypt_free_master_key);
}

void fscrypt_put_master_key_activeref(struct super_block *sb,
                                      struct fscrypt_master_key *mk)
{
        size_t i;

        if (!refcount_dec_and_test(&mk->mk_active_refs))
                return;
        /*
         * No active references left, so complete the full removal of this
         * fscrypt_master_key struct by removing it from the keyring and
         * destroying any subkeys embedded in it.
         */

        if (WARN_ON_ONCE(!sb->s_master_keys))
                return;
        spin_lock(&sb->s_master_keys->lock);
        hlist_del_rcu(&mk->mk_node);
        spin_unlock(&sb->s_master_keys->lock);

        /*
         * ->mk_active_refs == 0 implies that ->mk_present is false and
         * ->mk_decrypted_inodes is empty.
         */
        WARN_ON_ONCE(mk->mk_present);
        WARN_ON_ONCE(!list_empty(&mk->mk_decrypted_inodes));

        for (i = 0; i <= FSCRYPT_MODE_MAX; i++) {
                fscrypt_destroy_prepared_key(
                                sb, &mk->mk_direct_keys[i]);
                fscrypt_destroy_prepared_key(
                                sb, &mk->mk_iv_ino_lblk_64_keys[i]);
                fscrypt_destroy_prepared_key(
                                sb, &mk->mk_iv_ino_lblk_32_keys[i]);
        }
        memzero_explicit(&mk->mk_ino_hash_key,
                         sizeof(mk->mk_ino_hash_key));
        mk->mk_ino_hash_key_initialized = false;

        /* Drop the structural ref associated with the active refs. */
        fscrypt_put_master_key(mk);
}

/*
 * This transitions the key state from present to incompletely removed, and then
 * potentially to absent (depending on whether inodes remain).
 */
static void fscrypt_initiate_key_removal(struct super_block *sb,
                                         struct fscrypt_master_key *mk)
{
        WRITE_ONCE(mk->mk_present, false);
        wipe_master_key_secret(&mk->mk_secret);
        fscrypt_put_master_key_activeref(sb, mk);
}

static inline bool valid_key_spec(const struct fscrypt_key_specifier *spec)
{
        if (spec->__reserved)
                return false;
        return master_key_spec_len(spec) != 0;
}

static int fscrypt_user_key_instantiate(struct key *key,
                                        struct key_preparsed_payload *prep)
{
        /*
         * We just charge FSCRYPT_MAX_KEY_SIZE bytes to the user's key quota for
         * each key, regardless of the exact key size.  The amount of memory
         * actually used is greater than the size of the raw key anyway.
         */
        return key_payload_reserve(key, FSCRYPT_MAX_KEY_SIZE);
}

static void fscrypt_user_key_describe(const struct key *key, struct seq_file *m)
{
        seq_puts(m, key->description);
}

/*
 * Type of key in ->mk_users.  Each key of this type represents a particular
 * user who has added a particular master key.
 *
 * Note that the name of this key type really should be something like
 * ".fscrypt-user" instead of simply ".fscrypt".  But the shorter name is chosen
 * mainly for simplicity of presentation in /proc/keys when read by a non-root
 * user.  And it is expected to be rare that a key is actually added by multiple
 * users, since users should keep their encryption keys confidential.
 */
static struct key_type key_type_fscrypt_user = {
        .name                        = ".fscrypt",
        .instantiate                = fscrypt_user_key_instantiate,
        .describe                = fscrypt_user_key_describe,
};

#define FSCRYPT_MK_USERS_DESCRIPTION_SIZE        \
        (CONST_STRLEN("fscrypt-") + 2 * FSCRYPT_KEY_IDENTIFIER_SIZE + \
         CONST_STRLEN("-users") + 1)

#define FSCRYPT_MK_USER_DESCRIPTION_SIZE        \
        (2 * FSCRYPT_KEY_IDENTIFIER_SIZE + CONST_STRLEN(".uid.") + 10 + 1)

static void format_mk_users_keyring_description(
                        char description[FSCRYPT_MK_USERS_DESCRIPTION_SIZE],
                        const u8 mk_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE])
{
        sprintf(description, "fscrypt-%*phN-users",
                FSCRYPT_KEY_IDENTIFIER_SIZE, mk_identifier);
}

static void format_mk_user_description(
                        char description[FSCRYPT_MK_USER_DESCRIPTION_SIZE],
                        const u8 mk_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE])
{

        sprintf(description, "%*phN.uid.%u", FSCRYPT_KEY_IDENTIFIER_SIZE,
                mk_identifier, __kuid_val(current_fsuid()));
}

/* Create ->s_master_keys if needed.  Synchronized by fscrypt_add_key_mutex. */
static int allocate_filesystem_keyring(struct super_block *sb)
{
        struct fscrypt_keyring *keyring;

        if (sb->s_master_keys)
                return 0;

        keyring = kzalloc(sizeof(*keyring), GFP_KERNEL);
        if (!keyring)
                return -ENOMEM;
        spin_lock_init(&keyring->lock);
        /*
         * Pairs with the smp_load_acquire() in fscrypt_find_master_key().
         * I.e., here we publish ->s_master_keys with a RELEASE barrier so that
         * concurrent tasks can ACQUIRE it.
         */
        smp_store_release(&sb->s_master_keys, keyring);
        return 0;
}

/*
 * Release all encryption keys that have been added to the filesystem, along
 * with the keyring that contains them.
 *
 * This is called at unmount time, after all potentially-encrypted inodes have
 * been evicted.  The filesystem's underlying block device(s) are still
 * available at this time; this is important because after user file accesses
 * have been allowed, this function may need to evict keys from the keyslots of
 * an inline crypto engine, which requires the block device(s).
 */
void fscrypt_destroy_keyring(struct super_block *sb)
{
        struct fscrypt_keyring *keyring = sb->s_master_keys;
        size_t i;

        if (!keyring)
                return;

        for (i = 0; i < ARRAY_SIZE(keyring->key_hashtable); i++) {
                struct hlist_head *bucket = &keyring->key_hashtable[i];
                struct fscrypt_master_key *mk;
                struct hlist_node *tmp;

                hlist_for_each_entry_safe(mk, tmp, bucket, mk_node) {
                        /*
                         * Since all potentially-encrypted inodes were already
                         * evicted, every key remaining in the keyring should
                         * have an empty inode list, and should only still be in
                         * the keyring due to the single active ref associated
                         * with ->mk_present.  There should be no structural
                         * refs beyond the one associated with the active ref.
                         */
                        WARN_ON_ONCE(refcount_read(&mk->mk_active_refs) != 1);
                        WARN_ON_ONCE(refcount_read(&mk->mk_struct_refs) != 1);
                        WARN_ON_ONCE(!mk->mk_present);
                        fscrypt_initiate_key_removal(sb, mk);
                }
        }
        kfree_sensitive(keyring);
        sb->s_master_keys = NULL;
}

static struct hlist_head *
fscrypt_mk_hash_bucket(struct fscrypt_keyring *keyring,
                       const struct fscrypt_key_specifier *mk_spec)
{
        /*
         * Since key specifiers should be "random" values, it is sufficient to
         * use a trivial hash function that just takes the first several bits of
         * the key specifier.
         */
        unsigned long i = get_unaligned((unsigned long *)&mk_spec->u);

        return &keyring->key_hashtable[i % ARRAY_SIZE(keyring->key_hashtable)];
}

/*
 * Find the specified master key struct in ->s_master_keys and take a structural
 * ref to it.  The structural ref guarantees that the key struct continues to
 * exist, but it does *not* guarantee that ->s_master_keys continues to contain
 * the key struct.  The structural ref needs to be dropped by
 * fscrypt_put_master_key().  Returns NULL if the key struct is not found.
 */
struct fscrypt_master_key *
fscrypt_find_master_key(struct super_block *sb,
                        const struct fscrypt_key_specifier *mk_spec)
{
        struct fscrypt_keyring *keyring;
        struct hlist_head *bucket;
        struct fscrypt_master_key *mk;

        /*
         * Pairs with the smp_store_release() in allocate_filesystem_keyring().
         * I.e., another task can publish ->s_master_keys concurrently,
         * executing a RELEASE barrier.  We need to use smp_load_acquire() here
         * to safely ACQUIRE the memory the other task published.
         */
        keyring = smp_load_acquire(&sb->s_master_keys);
        if (keyring == NULL)
                return NULL; /* No keyring yet, so no keys yet. */

        bucket = fscrypt_mk_hash_bucket(keyring, mk_spec);
        rcu_read_lock();
        switch (mk_spec->type) {
        case FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR:
                hlist_for_each_entry_rcu(mk, bucket, mk_node) {
                        if (mk->mk_spec.type ==
                                FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR &&
                            memcmp(mk->mk_spec.u.descriptor,
                                   mk_spec->u.descriptor,
                                   FSCRYPT_KEY_DESCRIPTOR_SIZE) == 0 &&
                            refcount_inc_not_zero(&mk->mk_struct_refs))
                                goto out;
                }
                break;
        case FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER:
                hlist_for_each_entry_rcu(mk, bucket, mk_node) {
                        if (mk->mk_spec.type ==
                                FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER &&
                            memcmp(mk->mk_spec.u.identifier,
                                   mk_spec->u.identifier,
                                   FSCRYPT_KEY_IDENTIFIER_SIZE) == 0 &&
                            refcount_inc_not_zero(&mk->mk_struct_refs))
                                goto out;
                }
                break;
        }
        mk = NULL;
out:
        rcu_read_unlock();
        return mk;
}

static int allocate_master_key_users_keyring(struct fscrypt_master_key *mk)
{
        char description[FSCRYPT_MK_USERS_DESCRIPTION_SIZE];
        struct key *keyring;

        format_mk_users_keyring_description(description,
                                            mk->mk_spec.u.identifier);
        keyring = keyring_alloc(description, GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
                                current_cred(), KEY_POS_SEARCH |
                                  KEY_USR_SEARCH | KEY_USR_READ | KEY_USR_VIEW,
                                KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
        if (IS_ERR(keyring))
                return PTR_ERR(keyring);

        mk->mk_users = keyring;
        return 0;
}

/*
 * Find the current user's "key" in the master key's ->mk_users.
 * Returns ERR_PTR(-ENOKEY) if not found.
 */
static struct key *find_master_key_user(struct fscrypt_master_key *mk)
{
        char description[FSCRYPT_MK_USER_DESCRIPTION_SIZE];
        key_ref_t keyref;

        format_mk_user_description(description, mk->mk_spec.u.identifier);

        /*
         * We need to mark the keyring reference as "possessed" so that we
         * acquire permission to search it, via the KEY_POS_SEARCH permission.
         */
        keyref = keyring_search(make_key_ref(mk->mk_users, true /*possessed*/),
                                &key_type_fscrypt_user, description, false);
        if (IS_ERR(keyref)) {
                if (PTR_ERR(keyref) == -EAGAIN || /* not found */
                    PTR_ERR(keyref) == -EKEYREVOKED) /* recently invalidated */
                        keyref = ERR_PTR(-ENOKEY);
                return ERR_CAST(keyref);
        }
        return key_ref_to_ptr(keyref);
}

/*
 * Give the current user a "key" in ->mk_users.  This charges the user's quota
 * and marks the master key as added by the current user, so that it cannot be
 * removed by another user with the key.  Either ->mk_sem must be held for
 * write, or the master key must be still undergoing initialization.
 */
static int add_master_key_user(struct fscrypt_master_key *mk)
{
        char description[FSCRYPT_MK_USER_DESCRIPTION_SIZE];
        struct key *mk_user;
        int err;

        format_mk_user_description(description, mk->mk_spec.u.identifier);
        mk_user = key_alloc(&key_type_fscrypt_user, description,
                            current_fsuid(), current_gid(), current_cred(),
                            KEY_POS_SEARCH | KEY_USR_VIEW, 0, NULL);
        if (IS_ERR(mk_user))
                return PTR_ERR(mk_user);

        err = key_instantiate_and_link(mk_user, NULL, 0, mk->mk_users, NULL);
        key_put(mk_user);
        return err;
}

/*
 * Remove the current user's "key" from ->mk_users.
 * ->mk_sem must be held for write.
 *
 * Returns 0 if removed, -ENOKEY if not found, or another -errno code.
 */
static int remove_master_key_user(struct fscrypt_master_key *mk)
{
        struct key *mk_user;
        int err;

        mk_user = find_master_key_user(mk);
        if (IS_ERR(mk_user))
                return PTR_ERR(mk_user);
        err = key_unlink(mk->mk_users, mk_user);
        key_put(mk_user);
        return err;
}

/*
 * Allocate a new fscrypt_master_key, transfer the given secret over to it, and
 * insert it into sb->s_master_keys.
 */
static int add_new_master_key(struct super_block *sb,
                              struct fscrypt_master_key_secret *secret,
                              const struct fscrypt_key_specifier *mk_spec)
{
        struct fscrypt_keyring *keyring = sb->s_master_keys;
        struct fscrypt_master_key *mk;
        int err;

        mk = kzalloc(sizeof(*mk), GFP_KERNEL);
        if (!mk)
                return -ENOMEM;

        init_rwsem(&mk->mk_sem);
        refcount_set(&mk->mk_struct_refs, 1);
        mk->mk_spec = *mk_spec;

        INIT_LIST_HEAD(&mk->mk_decrypted_inodes);
        spin_lock_init(&mk->mk_decrypted_inodes_lock);

        if (mk_spec->type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) {
                err = allocate_master_key_users_keyring(mk);
                if (err)
                        goto out_put;
                err = add_master_key_user(mk);
                if (err)
                        goto out_put;
        }

        move_master_key_secret(&mk->mk_secret, secret);
        mk->mk_present = true;
        refcount_set(&mk->mk_active_refs, 1); /* ->mk_present is true */

        spin_lock(&keyring->lock);
        hlist_add_head_rcu(&mk->mk_node,
                           fscrypt_mk_hash_bucket(keyring, mk_spec));
        spin_unlock(&keyring->lock);
        return 0;

out_put:
        fscrypt_put_master_key(mk);
        return err;
}

#define KEY_DEAD        1

static int add_existing_master_key(struct fscrypt_master_key *mk,
                                   struct fscrypt_master_key_secret *secret)
{
        int err;

        /*
         * If the current user is already in ->mk_users, then there's nothing to
         * do.  Otherwise, we need to add the user to ->mk_users.  (Neither is
         * applicable for v1 policy keys, which have NULL ->mk_users.)
         */
        if (mk->mk_users) {
                struct key *mk_user = find_master_key_user(mk);

                if (mk_user != ERR_PTR(-ENOKEY)) {
                        if (IS_ERR(mk_user))
                                return PTR_ERR(mk_user);
                        key_put(mk_user);
                        return 0;
                }
                err = add_master_key_user(mk);
                if (err)
                        return err;
        }

        /* If the key is incompletely removed, make it present again. */
        if (!mk->mk_present) {
                if (!refcount_inc_not_zero(&mk->mk_active_refs)) {
                        /*
                         * Raced with the last active ref being dropped, so the
                         * key has become, or is about to become, "absent".
                         * Therefore, we need to allocate a new key struct.
                         */
                        return KEY_DEAD;
                }
                move_master_key_secret(&mk->mk_secret, secret);
                WRITE_ONCE(mk->mk_present, true);
        }

        return 0;
}

static int do_add_master_key(struct super_block *sb,
                             struct fscrypt_master_key_secret *secret,
                             const struct fscrypt_key_specifier *mk_spec)
{
        static DEFINE_MUTEX(fscrypt_add_key_mutex);
        struct fscrypt_master_key *mk;
        int err;

        mutex_lock(&fscrypt_add_key_mutex); /* serialize find + link */

        mk = fscrypt_find_master_key(sb, mk_spec);
        if (!mk) {
                /* Didn't find the key in ->s_master_keys.  Add it. */
                err = allocate_filesystem_keyring(sb);
                if (!err)
                        err = add_new_master_key(sb, secret, mk_spec);
        } else {
                /*
                 * Found the key in ->s_master_keys.  Add the user to ->mk_users
                 * if needed, and make the key "present" again if possible.
                 */
                down_write(&mk->mk_sem);
                err = add_existing_master_key(mk, secret);
                up_write(&mk->mk_sem);
                if (err == KEY_DEAD) {
                        /*
                         * We found a key struct, but it's already been fully
                         * removed.  Ignore the old struct and add a new one.
                         * fscrypt_add_key_mutex means we don't need to worry
                         * about concurrent adds.
                         */
                        err = add_new_master_key(sb, secret, mk_spec);
                }
                fscrypt_put_master_key(mk);
        }
        mutex_unlock(&fscrypt_add_key_mutex);
        return err;
}

static int add_master_key(struct super_block *sb,
                          struct fscrypt_master_key_secret *secret,
                          struct fscrypt_key_specifier *key_spec)
{
        int err;

        if (key_spec->type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) {
                err = fscrypt_init_hkdf(&secret->hkdf, secret->raw,
                                        secret->size);
                if (err)
                        return err;

                /*
                 * Now that the HKDF context is initialized, the raw key is no
                 * longer needed.
                 */
                memzero_explicit(secret->raw, secret->size);

                /* Calculate the key identifier */
                err = fscrypt_hkdf_expand(&secret->hkdf,
                                          HKDF_CONTEXT_KEY_IDENTIFIER, NULL, 0,
                                          key_spec->u.identifier,
                                          FSCRYPT_KEY_IDENTIFIER_SIZE);
                if (err)
                        return err;
        }
        return do_add_master_key(sb, secret, key_spec);
}

static int fscrypt_provisioning_key_preparse(struct key_preparsed_payload *prep)
{
        const struct fscrypt_provisioning_key_payload *payload = prep->data;

        if (prep->datalen < sizeof(*payload) + FSCRYPT_MIN_KEY_SIZE ||
            prep->datalen > sizeof(*payload) + FSCRYPT_MAX_KEY_SIZE)
                return -EINVAL;

        if (payload->type != FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR &&
            payload->type != FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER)
                return -EINVAL;

        if (payload->__reserved)
                return -EINVAL;

        prep->payload.data[0] = kmemdup(payload, prep->datalen, GFP_KERNEL);
        if (!prep->payload.data[0])
                return -ENOMEM;

        prep->quotalen = prep->datalen;
        return 0;
}

static void fscrypt_provisioning_key_free_preparse(
                                        struct key_preparsed_payload *prep)
{
        kfree_sensitive(prep->payload.data[0]);
}

static void fscrypt_provisioning_key_describe(const struct key *key,
                                              struct seq_file *m)
{
        seq_puts(m, key->description);
        if (key_is_positive(key)) {
                const struct fscrypt_provisioning_key_payload *payload =
                        key->payload.data[0];

                seq_printf(m, ": %u [%u]", key->datalen, payload->type);
        }
}

static void fscrypt_provisioning_key_destroy(struct key *key)
{
        kfree_sensitive(key->payload.data[0]);
}

static struct key_type key_type_fscrypt_provisioning = {
        .name                        = "fscrypt-provisioning",
        .preparse                = fscrypt_provisioning_key_preparse,
        .free_preparse                = fscrypt_provisioning_key_free_preparse,
        .instantiate                = generic_key_instantiate,
        .describe                = fscrypt_provisioning_key_describe,
        .destroy                = fscrypt_provisioning_key_destroy,
};

/*
 * Retrieve the raw key from the Linux keyring key specified by 'key_id', and
 * store it into 'secret'.
 *
 * The key must be of type "fscrypt-provisioning" and must have the field
 * fscrypt_provisioning_key_payload::type set to 'type', indicating that it's
 * only usable with fscrypt with the particular KDF version identified by
 * 'type'.  We don't use the "logon" key type because there's no way to
 * completely restrict the use of such keys; they can be used by any kernel API
 * that accepts "logon" keys and doesn't require a specific service prefix.
 *
 * The ability to specify the key via Linux keyring key is intended for cases
 * where userspace needs to re-add keys after the filesystem is unmounted and
 * re-mounted.  Most users should just provide the raw key directly instead.
 */
static int get_keyring_key(u32 key_id, u32 type,
                           struct fscrypt_master_key_secret *secret)
{
        key_ref_t ref;
        struct key *key;
        const struct fscrypt_provisioning_key_payload *payload;
        int err;

        ref = lookup_user_key(key_id, 0, KEY_NEED_SEARCH);
        if (IS_ERR(ref))
                return PTR_ERR(ref);
        key = key_ref_to_ptr(ref);

        if (key->type != &key_type_fscrypt_provisioning)
                goto bad_key;
        payload = key->payload.data[0];

        /* Don't allow fscrypt v1 keys to be used as v2 keys and vice versa. */
        if (payload->type != type)
                goto bad_key;

        secret->size = key->datalen - sizeof(*payload);
        memcpy(secret->raw, payload->raw, secret->size);
        err = 0;
        goto out_put;

bad_key:
        err = -EKEYREJECTED;
out_put:
        key_ref_put(ref);
        return err;
}

/*
 * Add a master encryption key to the filesystem, causing all files which were
 * encrypted with it to appear "unlocked" (decrypted) when accessed.
 *
 * When adding a key for use by v1 encryption policies, this ioctl is
 * privileged, and userspace must provide the 'key_descriptor'.
 *
 * When adding a key for use by v2+ encryption policies, this ioctl is
 * unprivileged.  This is needed, in general, to allow non-root users to use
 * encryption without encountering the visibility problems of process-subscribed
 * keyrings and the inability to properly remove keys.  This works by having
 * each key identified by its cryptographically secure hash --- the
 * 'key_identifier'.  The cryptographic hash ensures that a malicious user
 * cannot add the wrong key for a given identifier.  Furthermore, each added key
 * is charged to the appropriate user's quota for the keyrings service, which
 * prevents a malicious user from adding too many keys.  Finally, we forbid a
 * user from removing a key while other users have added it too, which prevents
 * a user who knows another user's key from causing a denial-of-service by
 * removing it at an inopportune time.  (We tolerate that a user who knows a key
 * can prevent other users from removing it.)
 *
 * For more details, see the "FS_IOC_ADD_ENCRYPTION_KEY" section of
 * Documentation/filesystems/fscrypt.rst.
 */
int fscrypt_ioctl_add_key(struct file *filp, void __user *_uarg)
{
        struct super_block *sb = file_inode(filp)->i_sb;
        struct fscrypt_add_key_arg __user *uarg = _uarg;
        struct fscrypt_add_key_arg arg;
        struct fscrypt_master_key_secret secret;
        int err;

        if (copy_from_user(&arg, uarg, sizeof(arg)))
                return -EFAULT;

        if (!valid_key_spec(&arg.key_spec))
                return -EINVAL;

        if (memchr_inv(arg.__reserved, 0, sizeof(arg.__reserved)))
                return -EINVAL;

        /*
         * Only root can add keys that are identified by an arbitrary descriptor
         * rather than by a cryptographic hash --- since otherwise a malicious
         * user could add the wrong key.
         */
        if (arg.key_spec.type == FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR &&
            !capable(CAP_SYS_ADMIN))
                return -EACCES;

        memset(&secret, 0, sizeof(secret));
        if (arg.key_id) {
                if (arg.raw_size != 0)
                        return -EINVAL;
                err = get_keyring_key(arg.key_id, arg.key_spec.type, &secret);
                if (err)
                        goto out_wipe_secret;
        } else {
                if (arg.raw_size < FSCRYPT_MIN_KEY_SIZE ||
                    arg.raw_size > FSCRYPT_MAX_KEY_SIZE)
                        return -EINVAL;
                secret.size = arg.raw_size;
                err = -EFAULT;
                if (copy_from_user(secret.raw, uarg->raw, secret.size))
                        goto out_wipe_secret;
        }

        err = add_master_key(sb, &secret, &arg.key_spec);
        if (err)
                goto out_wipe_secret;

        /* Return the key identifier to userspace, if applicable */
        err = -EFAULT;
        if (arg.key_spec.type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER &&
            copy_to_user(uarg->key_spec.u.identifier, arg.key_spec.u.identifier,
                         FSCRYPT_KEY_IDENTIFIER_SIZE))
                goto out_wipe_secret;
        err = 0;
out_wipe_secret:
        wipe_master_key_secret(&secret);
        return err;
}
EXPORT_SYMBOL_GPL(fscrypt_ioctl_add_key);

static void
fscrypt_get_test_dummy_secret(struct fscrypt_master_key_secret *secret)
{
        static u8 test_key[FSCRYPT_MAX_KEY_SIZE];

        get_random_once(test_key, FSCRYPT_MAX_KEY_SIZE);

        memset(secret, 0, sizeof(*secret));
        secret->size = FSCRYPT_MAX_KEY_SIZE;
        memcpy(secret->raw, test_key, FSCRYPT_MAX_KEY_SIZE);
}

int fscrypt_get_test_dummy_key_identifier(
                                u8 key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE])
{
        struct fscrypt_master_key_secret secret;
        int err;

        fscrypt_get_test_dummy_secret(&secret);

        err = fscrypt_init_hkdf(&secret.hkdf, secret.raw, secret.size);
        if (err)
                goto out;
        err = fscrypt_hkdf_expand(&secret.hkdf, HKDF_CONTEXT_KEY_IDENTIFIER,
                                  NULL, 0, key_identifier,
                                  FSCRYPT_KEY_IDENTIFIER_SIZE);
out:
        wipe_master_key_secret(&secret);
        return err;
}

/**
 * fscrypt_add_test_dummy_key() - add the test dummy encryption key
 * @sb: the filesystem instance to add the key to
 * @key_spec: the key specifier of the test dummy encryption key
 *
 * Add the key for the test_dummy_encryption mount option to the filesystem.  To
 * prevent misuse of this mount option, a per-boot random key is used instead of
 * a hardcoded one.  This makes it so that any encrypted files created using
 * this option won't be accessible after a reboot.
 *
 * Return: 0 on success, -errno on failure
 */
int fscrypt_add_test_dummy_key(struct super_block *sb,
                               struct fscrypt_key_specifier *key_spec)
{
        struct fscrypt_master_key_secret secret;
        int err;

        fscrypt_get_test_dummy_secret(&secret);
        err = add_master_key(sb, &secret, key_spec);
        wipe_master_key_secret(&secret);
        return err;
}

/*
 * Verify that the current user has added a master key with the given identifier
 * (returns -ENOKEY if not).  This is needed to prevent a user from encrypting
 * their files using some other user's key which they don't actually know.
 * Cryptographically this isn't much of a problem, but the semantics of this
 * would be a bit weird, so it's best to just forbid it.
 *
 * The system administrator (CAP_FOWNER) can override this, which should be
 * enough for any use cases where encryption policies are being set using keys
 * that were chosen ahead of time but aren't available at the moment.
 *
 * Note that the key may have already removed by the time this returns, but
 * that's okay; we just care whether the key was there at some point.
 *
 * Return: 0 if the key is added, -ENOKEY if it isn't, or another -errno code
 */
int fscrypt_verify_key_added(struct super_block *sb,
                             const u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE])
{
        struct fscrypt_key_specifier mk_spec;
        struct fscrypt_master_key *mk;
        struct key *mk_user;
        int err;

        mk_spec.type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER;
        memcpy(mk_spec.u.identifier, identifier, FSCRYPT_KEY_IDENTIFIER_SIZE);

        mk = fscrypt_find_master_key(sb, &mk_spec);
        if (!mk) {
                err = -ENOKEY;
                goto out;
        }
        down_read(&mk->mk_sem);
        mk_user = find_master_key_user(mk);
        if (IS_ERR(mk_user)) {
                err = PTR_ERR(mk_user);
        } else {
                key_put(mk_user);
                err = 0;
        }
        up_read(&mk->mk_sem);
        fscrypt_put_master_key(mk);
out:
        if (err == -ENOKEY && capable(CAP_FOWNER))
                err = 0;
        return err;
}

/*
 * Try to evict the inode's dentries from the dentry cache.  If the inode is a
 * directory, then it can have at most one dentry; however, that dentry may be
 * pinned by child dentries, so first try to evict the children too.
 */
static void shrink_dcache_inode(struct inode *inode)
{
        struct dentry *dentry;

        if (S_ISDIR(inode->i_mode)) {
                dentry = d_find_any_alias(inode);
                if (dentry) {
                        shrink_dcache_parent(dentry);
                        dput(dentry);
                }
        }
        d_prune_aliases(inode);
}

static void evict_dentries_for_decrypted_inodes(struct fscrypt_master_key *mk)
{
        struct fscrypt_inode_info *ci;
        struct inode *inode;
        struct inode *toput_inode = NULL;

        spin_lock(&mk->mk_decrypted_inodes_lock);

        list_for_each_entry(ci, &mk->mk_decrypted_inodes, ci_master_key_link) {
                inode = ci->ci_inode;
                spin_lock(&inode->i_lock);
                if (inode->i_state & (I_FREEING | I_WILL_FREE | I_NEW)) {
                        spin_unlock(&inode->i_lock);
                        continue;
                }
                __iget(inode);
                spin_unlock(&inode->i_lock);
                spin_unlock(&mk->mk_decrypted_inodes_lock);

                shrink_dcache_inode(inode);
                iput(toput_inode);
                toput_inode = inode;

                spin_lock(&mk->mk_decrypted_inodes_lock);
        }

        spin_unlock(&mk->mk_decrypted_inodes_lock);
        iput(toput_inode);
}

static int check_for_busy_inodes(struct super_block *sb,
                                 struct fscrypt_master_key *mk)
{
        struct list_head *pos;
        size_t busy_count = 0;
        unsigned long ino;
        char ino_str[50] = "";

        spin_lock(&mk->mk_decrypted_inodes_lock);

        list_for_each(pos, &mk->mk_decrypted_inodes)
                busy_count++;

        if (busy_count == 0) {
                spin_unlock(&mk->mk_decrypted_inodes_lock);
                return 0;
        }

        {
                /* select an example file to show for debugging purposes */
                struct inode *inode =
                        list_first_entry(&mk->mk_decrypted_inodes,
                                         struct fscrypt_inode_info,
                                         ci_master_key_link)->ci_inode;
                ino = inode->i_ino;
        }
        spin_unlock(&mk->mk_decrypted_inodes_lock);

        /* If the inode is currently being created, ino may still be 0. */
        if (ino)
                snprintf(ino_str, sizeof(ino_str), ", including ino %lu", ino);

        fscrypt_warn(NULL,
                     "%s: %zu inode(s) still busy after removing key with %s %*phN%s",
                     sb->s_id, busy_count, master_key_spec_type(&mk->mk_spec),
                     master_key_spec_len(&mk->mk_spec), (u8 *)&mk->mk_spec.u,
                     ino_str);
        return -EBUSY;
}

static int try_to_lock_encrypted_files(struct super_block *sb,
                                       struct fscrypt_master_key *mk)
{
        int err1;
        int err2;

        /*
         * An inode can't be evicted while it is dirty or has dirty pages.
         * Thus, we first have to clean the inodes in ->mk_decrypted_inodes.
         *
         * Just do it the easy way: call sync_filesystem().  It's overkill, but
         * it works, and it's more important to minimize the amount of caches we
         * drop than the amount of data we sync.  Also, unprivileged users can
         * already call sync_filesystem() via sys_syncfs() or sys_sync().
         */
        down_read(&sb->s_umount);
        err1 = sync_filesystem(sb);
        up_read(&sb->s_umount);
        /* If a sync error occurs, still try to evict as much as possible. */

        /*
         * Inodes are pinned by their dentries, so we have to evict their
         * dentries.  shrink_dcache_sb() would suffice, but would be overkill
         * and inappropriate for use by unprivileged users.  So instead go
         * through the inodes' alias lists and try to evict each dentry.
         */
        evict_dentries_for_decrypted_inodes(mk);

        /*
         * evict_dentries_for_decrypted_inodes() already iput() each inode in
         * the list; any inodes for which that dropped the last reference will
         * have been evicted due to fscrypt_drop_inode() detecting the key
         * removal and telling the VFS to evict the inode.  So to finish, we
         * just need to check whether any inodes couldn't be evicted.
         */
        err2 = check_for_busy_inodes(sb, mk);

        return err1 ?: err2;
}

/*
 * Try to remove an fscrypt master encryption key.
 *
 * FS_IOC_REMOVE_ENCRYPTION_KEY (all_users=false) removes the current user's
 * claim to the key, then removes the key itself if no other users have claims.
 * FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS (all_users=true) always removes the
 * key itself.
 *
 * To "remove the key itself", first we transition the key to the "incompletely
 * removed" state, so that no more inodes can be unlocked with it.  Then we try
 * to evict all cached inodes that had been unlocked with the key.
 *
 * If all inodes were evicted, then we unlink the fscrypt_master_key from the
 * keyring.  Otherwise it remains in the keyring in the "incompletely removed"
 * state where it tracks the list of remaining inodes.  Userspace can execute
 * the ioctl again later to retry eviction, or alternatively can re-add the key.
 *
 * For more details, see the "Removing keys" section of
 * Documentation/filesystems/fscrypt.rst.
 */
static int do_remove_key(struct file *filp, void __user *_uarg, bool all_users)
{
        struct super_block *sb = file_inode(filp)->i_sb;
        struct fscrypt_remove_key_arg __user *uarg = _uarg;
        struct fscrypt_remove_key_arg arg;
        struct fscrypt_master_key *mk;
        u32 status_flags = 0;
        int err;
        bool inodes_remain;

        if (copy_from_user(&arg, uarg, sizeof(arg)))
                return -EFAULT;

        if (!valid_key_spec(&arg.key_spec))
                return -EINVAL;

        if (memchr_inv(arg.__reserved, 0, sizeof(arg.__reserved)))
                return -EINVAL;

        /*
         * Only root can add and remove keys that are identified by an arbitrary
         * descriptor rather than by a cryptographic hash.
         */
        if (arg.key_spec.type == FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR &&
            !capable(CAP_SYS_ADMIN))
                return -EACCES;

        /* Find the key being removed. */
        mk = fscrypt_find_master_key(sb, &arg.key_spec);
        if (!mk)
                return -ENOKEY;
        down_write(&mk->mk_sem);

        /* If relevant, remove current user's (or all users) claim to the key */
        if (mk->mk_users && mk->mk_users->keys.nr_leaves_on_tree != 0) {
                if (all_users)
                        err = keyring_clear(mk->mk_users);
                else
                        err = remove_master_key_user(mk);
                if (err) {
                        up_write(&mk->mk_sem);
                        goto out_put_key;
                }
                if (mk->mk_users->keys.nr_leaves_on_tree != 0) {
                        /*
                         * Other users have still added the key too.  We removed
                         * the current user's claim to the key, but we still
                         * can't remove the key itself.
                         */
                        status_flags |=
                                FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS;
                        err = 0;
                        up_write(&mk->mk_sem);
                        goto out_put_key;
                }
        }

        /* No user claims remaining.  Initiate removal of the key. */
        err = -ENOKEY;
        if (mk->mk_present) {
                fscrypt_initiate_key_removal(sb, mk);
                err = 0;
        }
        inodes_remain = refcount_read(&mk->mk_active_refs) > 0;
        up_write(&mk->mk_sem);

        if (inodes_remain) {
                /* Some inodes still reference this key; try to evict them. */
                err = try_to_lock_encrypted_files(sb, mk);
                if (err == -EBUSY) {
                        status_flags |=
                                FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY;
                        err = 0;
                }
        }
        /*
         * We return 0 if we successfully did something: removed a claim to the
         * key, initiated removal of the key, or tried locking the files again.
         * Users need to check the informational status flags if they care
         * whether the key has been fully removed including all files locked.
         */
out_put_key:
        fscrypt_put_master_key(mk);
        if (err == 0)
                err = put_user(status_flags, &uarg->removal_status_flags);
        return err;
}

int fscrypt_ioctl_remove_key(struct file *filp, void __user *uarg)
{
        return do_remove_key(filp, uarg, false);
}
EXPORT_SYMBOL_GPL(fscrypt_ioctl_remove_key);

int fscrypt_ioctl_remove_key_all_users(struct file *filp, void __user *uarg)
{
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
        return do_remove_key(filp, uarg, true);
}
EXPORT_SYMBOL_GPL(fscrypt_ioctl_remove_key_all_users);

/*
 * Retrieve the status of an fscrypt master encryption key.
 *
 * We set ->status to indicate whether the key is absent, present, or
 * incompletely removed.  (For an explanation of what these statuses mean and
 * how they are represented internally, see struct fscrypt_master_key.)  This
 * field allows applications to easily determine the status of an encrypted
 * directory without using a hack such as trying to open a regular file in it
 * (which can confuse the "incompletely removed" status with absent or present).
 *
 * In addition, for v2 policy keys we allow applications to determine, via
 * ->status_flags and ->user_count, whether the key has been added by the
 * current user, by other users, or by both.  Most applications should not need
 * this, since ordinarily only one user should know a given key.  However, if a
 * secret key is shared by multiple users, applications may wish to add an
 * already-present key to prevent other users from removing it.  This ioctl can
 * be used to check whether that really is the case before the work is done to
 * add the key --- which might e.g. require prompting the user for a passphrase.
 *
 * For more details, see the "FS_IOC_GET_ENCRYPTION_KEY_STATUS" section of
 * Documentation/filesystems/fscrypt.rst.
 */
int fscrypt_ioctl_get_key_status(struct file *filp, void __user *uarg)
{
        struct super_block *sb = file_inode(filp)->i_sb;
        struct fscrypt_get_key_status_arg arg;
        struct fscrypt_master_key *mk;
        int err;

        if (copy_from_user(&arg, uarg, sizeof(arg)))
                return -EFAULT;

        if (!valid_key_spec(&arg.key_spec))
                return -EINVAL;

        if (memchr_inv(arg.__reserved, 0, sizeof(arg.__reserved)))
                return -EINVAL;

        arg.status_flags = 0;
        arg.user_count = 0;
        memset(arg.__out_reserved, 0, sizeof(arg.__out_reserved));

        mk = fscrypt_find_master_key(sb, &arg.key_spec);
        if (!mk) {
                arg.status = FSCRYPT_KEY_STATUS_ABSENT;
                err = 0;
                goto out;
        }
        down_read(&mk->mk_sem);

        if (!mk->mk_present) {
                arg.status = refcount_read(&mk->mk_active_refs) > 0 ?
                        FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED :
                        FSCRYPT_KEY_STATUS_ABSENT /* raced with full removal */;
                err = 0;
                goto out_release_key;
        }

        arg.status = FSCRYPT_KEY_STATUS_PRESENT;
        if (mk->mk_users) {
                struct key *mk_user;

                arg.user_count = mk->mk_users->keys.nr_leaves_on_tree;
                mk_user = find_master_key_user(mk);
                if (!IS_ERR(mk_user)) {
                        arg.status_flags |=
                                FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF;
                        key_put(mk_user);
                } else if (mk_user != ERR_PTR(-ENOKEY)) {
                        err = PTR_ERR(mk_user);
                        goto out_release_key;
                }
        }
        err = 0;
out_release_key:
        up_read(&mk->mk_sem);
        fscrypt_put_master_key(mk);
out:
        if (!err && copy_to_user(uarg, &arg, sizeof(arg)))
                err = -EFAULT;
        return err;
}
EXPORT_SYMBOL_GPL(fscrypt_ioctl_get_key_status);

int __init fscrypt_init_keyring(void)
{
        int err;

        err = register_key_type(&key_type_fscrypt_user);
        if (err)
                return err;

        err = register_key_type(&key_type_fscrypt_provisioning);
        if (err)
                goto err_unregister_fscrypt_user;

        return 0;

err_unregister_fscrypt_user:
        unregister_key_type(&key_type_fscrypt_user);
        return err;
}




































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    3 




    3 










































































































































































































































































































    3 






    3 


    3 







    2 







    2 






1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright (c) 2016 Mellanox Technologies. All rights reserved.
 * Copyright (c) 2016 Jiri Pirko <jiri@mellanox.com>
 */

#include "devl_internal.h"

#define DEVLINK_PORT_FN_CAPS_VALID_MASK \
        (_BITUL(__DEVLINK_PORT_FN_ATTR_CAPS_MAX) - 1)

static const struct nla_policy devlink_function_nl_policy[DEVLINK_PORT_FUNCTION_ATTR_MAX + 1] = {
        [DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR] = { .type = NLA_BINARY },
        [DEVLINK_PORT_FN_ATTR_STATE] =
                NLA_POLICY_RANGE(NLA_U8, DEVLINK_PORT_FN_STATE_INACTIVE,
                                 DEVLINK_PORT_FN_STATE_ACTIVE),
        [DEVLINK_PORT_FN_ATTR_CAPS] =
                NLA_POLICY_BITFIELD32(DEVLINK_PORT_FN_CAPS_VALID_MASK),
        [DEVLINK_PORT_FN_ATTR_MAX_IO_EQS] = { .type = NLA_U32 },
};

#define ASSERT_DEVLINK_PORT_REGISTERED(devlink_port)                                \
        WARN_ON_ONCE(!(devlink_port)->registered)
#define ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port)                        \
        WARN_ON_ONCE((devlink_port)->registered)

struct devlink_port *devlink_port_get_by_index(struct devlink *devlink,
                                               unsigned int port_index)
{
        return xa_load(&devlink->ports, port_index);
}

struct devlink_port *devlink_port_get_from_attrs(struct devlink *devlink,
                                                 struct nlattr **attrs)
{
        if (attrs[DEVLINK_ATTR_PORT_INDEX]) {
                u32 port_index = nla_get_u32(attrs[DEVLINK_ATTR_PORT_INDEX]);
                struct devlink_port *devlink_port;

                devlink_port = devlink_port_get_by_index(devlink, port_index);
                if (!devlink_port)
                        return ERR_PTR(-ENODEV);
                return devlink_port;
        }
        return ERR_PTR(-EINVAL);
}

struct devlink_port *devlink_port_get_from_info(struct devlink *devlink,
                                                struct genl_info *info)
{
        return devlink_port_get_from_attrs(devlink, info->attrs);
}

static void devlink_port_fn_cap_fill(struct nla_bitfield32 *caps,
                                     u32 cap, bool is_enable)
{
        caps->selector |= cap;
        if (is_enable)
                caps->value |= cap;
}

static int devlink_port_fn_roce_fill(struct devlink_port *devlink_port,
                                     struct nla_bitfield32 *caps,
                                     struct netlink_ext_ack *extack)
{
        bool is_enable;
        int err;

        if (!devlink_port->ops->port_fn_roce_get)
                return 0;

        err = devlink_port->ops->port_fn_roce_get(devlink_port, &is_enable,
                                                  extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }

        devlink_port_fn_cap_fill(caps, DEVLINK_PORT_FN_CAP_ROCE, is_enable);
        return 0;
}

static int devlink_port_fn_migratable_fill(struct devlink_port *devlink_port,
                                           struct nla_bitfield32 *caps,
                                           struct netlink_ext_ack *extack)
{
        bool is_enable;
        int err;

        if (!devlink_port->ops->port_fn_migratable_get ||
            devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_VF)
                return 0;

        err = devlink_port->ops->port_fn_migratable_get(devlink_port,
                                                        &is_enable, extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }

        devlink_port_fn_cap_fill(caps, DEVLINK_PORT_FN_CAP_MIGRATABLE, is_enable);
        return 0;
}

static int devlink_port_fn_ipsec_crypto_fill(struct devlink_port *devlink_port,
                                             struct nla_bitfield32 *caps,
                                             struct netlink_ext_ack *extack)
{
        bool is_enable;
        int err;

        if (!devlink_port->ops->port_fn_ipsec_crypto_get ||
            devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_VF)
                return 0;

        err = devlink_port->ops->port_fn_ipsec_crypto_get(devlink_port, &is_enable, extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }

        devlink_port_fn_cap_fill(caps, DEVLINK_PORT_FN_CAP_IPSEC_CRYPTO, is_enable);
        return 0;
}

static int devlink_port_fn_ipsec_packet_fill(struct devlink_port *devlink_port,
                                             struct nla_bitfield32 *caps,
                                             struct netlink_ext_ack *extack)
{
        bool is_enable;
        int err;

        if (!devlink_port->ops->port_fn_ipsec_packet_get ||
            devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_VF)
                return 0;

        err = devlink_port->ops->port_fn_ipsec_packet_get(devlink_port, &is_enable, extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }

        devlink_port_fn_cap_fill(caps, DEVLINK_PORT_FN_CAP_IPSEC_PACKET, is_enable);
        return 0;
}

static int devlink_port_fn_caps_fill(struct devlink_port *devlink_port,
                                     struct sk_buff *msg,
                                     struct netlink_ext_ack *extack,
                                     bool *msg_updated)
{
        struct nla_bitfield32 caps = {};
        int err;

        err = devlink_port_fn_roce_fill(devlink_port, &caps, extack);
        if (err)
                return err;

        err = devlink_port_fn_migratable_fill(devlink_port, &caps, extack);
        if (err)
                return err;

        err = devlink_port_fn_ipsec_crypto_fill(devlink_port, &caps, extack);
        if (err)
                return err;

        err = devlink_port_fn_ipsec_packet_fill(devlink_port, &caps, extack);
        if (err)
                return err;

        if (!caps.selector)
                return 0;
        err = nla_put_bitfield32(msg, DEVLINK_PORT_FN_ATTR_CAPS, caps.value,
                                 caps.selector);
        if (err)
                return err;

        *msg_updated = true;
        return 0;
}

static int devlink_port_fn_max_io_eqs_fill(struct devlink_port *port,
                                           struct sk_buff *msg,
                                           struct netlink_ext_ack *extack,
                                           bool *msg_updated)
{
        u32 max_io_eqs;
        int err;

        if (!port->ops->port_fn_max_io_eqs_get)
                return 0;

        err = port->ops->port_fn_max_io_eqs_get(port, &max_io_eqs, extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }
        err = nla_put_u32(msg, DEVLINK_PORT_FN_ATTR_MAX_IO_EQS, max_io_eqs);
        if (err)
                return err;
        *msg_updated = true;
        return 0;
}

int devlink_nl_port_handle_fill(struct sk_buff *msg, struct devlink_port *devlink_port)
{
        if (devlink_nl_put_handle(msg, devlink_port->devlink))
                return -EMSGSIZE;
        if (nla_put_u32(msg, DEVLINK_ATTR_PORT_INDEX, devlink_port->index))
                return -EMSGSIZE;
        return 0;
}

size_t devlink_nl_port_handle_size(struct devlink_port *devlink_port)
{
        struct devlink *devlink = devlink_port->devlink;

        return nla_total_size(strlen(devlink->dev->bus->name) + 1) /* DEVLINK_ATTR_BUS_NAME */
             + nla_total_size(strlen(dev_name(devlink->dev)) + 1) /* DEVLINK_ATTR_DEV_NAME */
             + nla_total_size(4); /* DEVLINK_ATTR_PORT_INDEX */
}

static int devlink_nl_port_attrs_put(struct sk_buff *msg,
                                     struct devlink_port *devlink_port)
{
        struct devlink_port_attrs *attrs = &devlink_port->attrs;

        if (!devlink_port->attrs_set)
                return 0;
        if (attrs->lanes) {
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_LANES, attrs->lanes))
                        return -EMSGSIZE;
        }
        if (nla_put_u8(msg, DEVLINK_ATTR_PORT_SPLITTABLE, attrs->splittable))
                return -EMSGSIZE;
        if (nla_put_u16(msg, DEVLINK_ATTR_PORT_FLAVOUR, attrs->flavour))
                return -EMSGSIZE;
        switch (devlink_port->attrs.flavour) {
        case DEVLINK_PORT_FLAVOUR_PCI_PF:
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_CONTROLLER_NUMBER,
                                attrs->pci_pf.controller) ||
                    nla_put_u16(msg, DEVLINK_ATTR_PORT_PCI_PF_NUMBER, attrs->pci_pf.pf))
                        return -EMSGSIZE;
                if (nla_put_u8(msg, DEVLINK_ATTR_PORT_EXTERNAL, attrs->pci_pf.external))
                        return -EMSGSIZE;
                break;
        case DEVLINK_PORT_FLAVOUR_PCI_VF:
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_CONTROLLER_NUMBER,
                                attrs->pci_vf.controller) ||
                    nla_put_u16(msg, DEVLINK_ATTR_PORT_PCI_PF_NUMBER, attrs->pci_vf.pf) ||
                    nla_put_u16(msg, DEVLINK_ATTR_PORT_PCI_VF_NUMBER, attrs->pci_vf.vf))
                        return -EMSGSIZE;
                if (nla_put_u8(msg, DEVLINK_ATTR_PORT_EXTERNAL, attrs->pci_vf.external))
                        return -EMSGSIZE;
                break;
        case DEVLINK_PORT_FLAVOUR_PCI_SF:
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_CONTROLLER_NUMBER,
                                attrs->pci_sf.controller) ||
                    nla_put_u16(msg, DEVLINK_ATTR_PORT_PCI_PF_NUMBER,
                                attrs->pci_sf.pf) ||
                    nla_put_u32(msg, DEVLINK_ATTR_PORT_PCI_SF_NUMBER,
                                attrs->pci_sf.sf))
                        return -EMSGSIZE;
                break;
        case DEVLINK_PORT_FLAVOUR_PHYSICAL:
        case DEVLINK_PORT_FLAVOUR_CPU:
        case DEVLINK_PORT_FLAVOUR_DSA:
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_NUMBER,
                                attrs->phys.port_number))
                        return -EMSGSIZE;
                if (!attrs->split)
                        return 0;
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_SPLIT_GROUP,
                                attrs->phys.port_number))
                        return -EMSGSIZE;
                if (nla_put_u32(msg, DEVLINK_ATTR_PORT_SPLIT_SUBPORT_NUMBER,
                                attrs->phys.split_subport_number))
                        return -EMSGSIZE;
                break;
        default:
                break;
        }
        return 0;
}

static int devlink_port_fn_hw_addr_fill(struct devlink_port *port,
                                        struct sk_buff *msg,
                                        struct netlink_ext_ack *extack,
                                        bool *msg_updated)
{
        u8 hw_addr[MAX_ADDR_LEN];
        int hw_addr_len;
        int err;

        if (!port->ops->port_fn_hw_addr_get)
                return 0;

        err = port->ops->port_fn_hw_addr_get(port, hw_addr, &hw_addr_len,
                                             extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }
        err = nla_put(msg, DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR, hw_addr_len, hw_addr);
        if (err)
                return err;
        *msg_updated = true;
        return 0;
}

static bool
devlink_port_fn_state_valid(enum devlink_port_fn_state state)
{
        return state == DEVLINK_PORT_FN_STATE_INACTIVE ||
               state == DEVLINK_PORT_FN_STATE_ACTIVE;
}

static bool
devlink_port_fn_opstate_valid(enum devlink_port_fn_opstate opstate)
{
        return opstate == DEVLINK_PORT_FN_OPSTATE_DETACHED ||
               opstate == DEVLINK_PORT_FN_OPSTATE_ATTACHED;
}

static int devlink_port_fn_state_fill(struct devlink_port *port,
                                      struct sk_buff *msg,
                                      struct netlink_ext_ack *extack,
                                      bool *msg_updated)
{
        enum devlink_port_fn_opstate opstate;
        enum devlink_port_fn_state state;
        int err;

        if (!port->ops->port_fn_state_get)
                return 0;

        err = port->ops->port_fn_state_get(port, &state, &opstate, extack);
        if (err) {
                if (err == -EOPNOTSUPP)
                        return 0;
                return err;
        }
        if (!devlink_port_fn_state_valid(state)) {
                WARN_ON_ONCE(1);
                NL_SET_ERR_MSG(extack, "Invalid state read from driver");
                return -EINVAL;
        }
        if (!devlink_port_fn_opstate_valid(opstate)) {
                WARN_ON_ONCE(1);
                NL_SET_ERR_MSG(extack, "Invalid operational state read from driver");
                return -EINVAL;
        }
        if (nla_put_u8(msg, DEVLINK_PORT_FN_ATTR_STATE, state) ||
            nla_put_u8(msg, DEVLINK_PORT_FN_ATTR_OPSTATE, opstate))
                return -EMSGSIZE;
        *msg_updated = true;
        return 0;
}

static int
devlink_port_fn_mig_set(struct devlink_port *devlink_port, bool enable,
                        struct netlink_ext_ack *extack)
{
        return devlink_port->ops->port_fn_migratable_set(devlink_port, enable,
                                                         extack);
}

static int
devlink_port_fn_roce_set(struct devlink_port *devlink_port, bool enable,
                         struct netlink_ext_ack *extack)
{
        return devlink_port->ops->port_fn_roce_set(devlink_port, enable,
                                                   extack);
}

static int
devlink_port_fn_ipsec_crypto_set(struct devlink_port *devlink_port, bool enable,
                                 struct netlink_ext_ack *extack)
{
        return devlink_port->ops->port_fn_ipsec_crypto_set(devlink_port, enable, extack);
}

static int
devlink_port_fn_ipsec_packet_set(struct devlink_port *devlink_port, bool enable,
                                 struct netlink_ext_ack *extack)
{
        return devlink_port->ops->port_fn_ipsec_packet_set(devlink_port, enable, extack);
}

static int devlink_port_fn_caps_set(struct devlink_port *devlink_port,
                                    const struct nlattr *attr,
                                    struct netlink_ext_ack *extack)
{
        struct nla_bitfield32 caps;
        u32 caps_value;
        int err;

        caps = nla_get_bitfield32(attr);
        caps_value = caps.value & caps.selector;
        if (caps.selector & DEVLINK_PORT_FN_CAP_ROCE) {
                err = devlink_port_fn_roce_set(devlink_port,
                                               caps_value & DEVLINK_PORT_FN_CAP_ROCE,
                                               extack);
                if (err)
                        return err;
        }
        if (caps.selector & DEVLINK_PORT_FN_CAP_MIGRATABLE) {
                err = devlink_port_fn_mig_set(devlink_port, caps_value &
                                              DEVLINK_PORT_FN_CAP_MIGRATABLE,
                                              extack);
                if (err)
                        return err;
        }
        if (caps.selector & DEVLINK_PORT_FN_CAP_IPSEC_CRYPTO) {
                err = devlink_port_fn_ipsec_crypto_set(devlink_port, caps_value &
                                                       DEVLINK_PORT_FN_CAP_IPSEC_CRYPTO,
                                                       extack);
                if (err)
                        return err;
        }
        if (caps.selector & DEVLINK_PORT_FN_CAP_IPSEC_PACKET) {
                err = devlink_port_fn_ipsec_packet_set(devlink_port, caps_value &
                                                       DEVLINK_PORT_FN_CAP_IPSEC_PACKET,
                                                       extack);
                if (err)
                        return err;
        }
        return 0;
}

static int
devlink_port_fn_max_io_eqs_set(struct devlink_port *devlink_port,
                               const struct nlattr *attr,
                               struct netlink_ext_ack *extack)
{
        u32 max_io_eqs;

        max_io_eqs = nla_get_u32(attr);
        return devlink_port->ops->port_fn_max_io_eqs_set(devlink_port,
                                                         max_io_eqs, extack);
}

static int
devlink_nl_port_function_attrs_put(struct sk_buff *msg, struct devlink_port *port,
                                   struct netlink_ext_ack *extack)
{
        struct nlattr *function_attr;
        bool msg_updated = false;
        int err;

        function_attr = nla_nest_start_noflag(msg, DEVLINK_ATTR_PORT_FUNCTION);
        if (!function_attr)
                return -EMSGSIZE;

        err = devlink_port_fn_hw_addr_fill(port, msg, extack, &msg_updated);
        if (err)
                goto out;
        err = devlink_port_fn_caps_fill(port, msg, extack, &msg_updated);
        if (err)
                goto out;
        err = devlink_port_fn_state_fill(port, msg, extack, &msg_updated);
        if (err)
                goto out;
        err = devlink_port_fn_max_io_eqs_fill(port, msg, extack, &msg_updated);
        if (err)
                goto out;
        err = devlink_rel_devlink_handle_put(msg, port->devlink,
                                             port->rel_index,
                                             DEVLINK_PORT_FN_ATTR_DEVLINK,
                                             &msg_updated);

out:
        if (err || !msg_updated)
                nla_nest_cancel(msg, function_attr);
        else
                nla_nest_end(msg, function_attr);
        return err;
}

static int devlink_nl_port_fill(struct sk_buff *msg,
                                struct devlink_port *devlink_port,
                                enum devlink_command cmd, u32 portid, u32 seq,
                                int flags, struct netlink_ext_ack *extack)
{
        struct devlink *devlink = devlink_port->devlink;
        void *hdr;

        hdr = genlmsg_put(msg, portid, seq, &devlink_nl_family, flags, cmd);
        if (!hdr)
                return -EMSGSIZE;

        if (devlink_nl_put_handle(msg, devlink))
                goto nla_put_failure;
        if (nla_put_u32(msg, DEVLINK_ATTR_PORT_INDEX, devlink_port->index))
                goto nla_put_failure;

        spin_lock_bh(&devlink_port->type_lock);
        if (nla_put_u16(msg, DEVLINK_ATTR_PORT_TYPE, devlink_port->type))
                goto nla_put_failure_type_locked;
        if (devlink_port->desired_type != DEVLINK_PORT_TYPE_NOTSET &&
            nla_put_u16(msg, DEVLINK_ATTR_PORT_DESIRED_TYPE,
                        devlink_port->desired_type))
                goto nla_put_failure_type_locked;
        if (devlink_port->type == DEVLINK_PORT_TYPE_ETH) {
                if (devlink_port->type_eth.netdev &&
                    (nla_put_u32(msg, DEVLINK_ATTR_PORT_NETDEV_IFINDEX,
                                 devlink_port->type_eth.ifindex) ||
                     nla_put_string(msg, DEVLINK_ATTR_PORT_NETDEV_NAME,
                                    devlink_port->type_eth.ifname)))
                        goto nla_put_failure_type_locked;
        }
        if (devlink_port->type == DEVLINK_PORT_TYPE_IB) {
                struct ib_device *ibdev = devlink_port->type_ib.ibdev;

                if (ibdev &&
                    nla_put_string(msg, DEVLINK_ATTR_PORT_IBDEV_NAME,
                                   ibdev->name))
                        goto nla_put_failure_type_locked;
        }
        spin_unlock_bh(&devlink_port->type_lock);
        if (devlink_nl_port_attrs_put(msg, devlink_port))
                goto nla_put_failure;
        if (devlink_nl_port_function_attrs_put(msg, devlink_port, extack))
                goto nla_put_failure;
        if (devlink_port->linecard &&
            nla_put_u32(msg, DEVLINK_ATTR_LINECARD_INDEX,
                        devlink_linecard_index(devlink_port->linecard)))
                goto nla_put_failure;

        genlmsg_end(msg, hdr);
        return 0;

nla_put_failure_type_locked:
        spin_unlock_bh(&devlink_port->type_lock);
nla_put_failure:
        genlmsg_cancel(msg, hdr);
        return -EMSGSIZE;
}

static void devlink_port_notify(struct devlink_port *devlink_port,
                                enum devlink_command cmd)
{
        struct devlink *devlink = devlink_port->devlink;
        struct devlink_obj_desc desc;
        struct sk_buff *msg;
        int err;

        WARN_ON(cmd != DEVLINK_CMD_PORT_NEW && cmd != DEVLINK_CMD_PORT_DEL);

        if (!__devl_is_registered(devlink) || !devlink_nl_notify_need(devlink))
                return;

        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return;

        err = devlink_nl_port_fill(msg, devlink_port, cmd, 0, 0, 0, NULL);
        if (err) {
                nlmsg_free(msg);
                return;
        }

        devlink_nl_obj_desc_init(&desc, devlink);
        devlink_nl_obj_desc_port_set(&desc, devlink_port);
        devlink_nl_notify_send_desc(devlink, msg, &desc);
}

static void devlink_ports_notify(struct devlink *devlink,
                                 enum devlink_command cmd)
{
        struct devlink_port *devlink_port;
        unsigned long port_index;

        xa_for_each(&devlink->ports, port_index, devlink_port)
                devlink_port_notify(devlink_port, cmd);
}

void devlink_ports_notify_register(struct devlink *devlink)
{
        devlink_ports_notify(devlink, DEVLINK_CMD_PORT_NEW);
}

void devlink_ports_notify_unregister(struct devlink *devlink)
{
        devlink_ports_notify(devlink, DEVLINK_CMD_PORT_DEL);
}

int devlink_nl_port_get_doit(struct sk_buff *skb, struct genl_info *info)
{
        struct devlink_port *devlink_port = info->user_ptr[1];
        struct sk_buff *msg;
        int err;

        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return -ENOMEM;

        err = devlink_nl_port_fill(msg, devlink_port, DEVLINK_CMD_PORT_NEW,
                                   info->snd_portid, info->snd_seq, 0,
                                   info->extack);
        if (err) {
                nlmsg_free(msg);
                return err;
        }

        return genlmsg_reply(msg, info);
}

static int
devlink_nl_port_get_dump_one(struct sk_buff *msg, struct devlink *devlink,
                             struct netlink_callback *cb, int flags)
{
        struct devlink_nl_dump_state *state = devlink_dump_state(cb);
        struct devlink_port *devlink_port;
        unsigned long port_index;
        int err = 0;

        xa_for_each_start(&devlink->ports, port_index, devlink_port, state->idx) {
                err = devlink_nl_port_fill(msg, devlink_port,
                                           DEVLINK_CMD_PORT_NEW,
                                           NETLINK_CB(cb->skb).portid,
                                           cb->nlh->nlmsg_seq, flags,
                                           cb->extack);
                if (err) {
                        state->idx = port_index;
                        break;
                }
        }

        return err;
}

int devlink_nl_port_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
{
        return devlink_nl_dumpit(skb, cb, devlink_nl_port_get_dump_one);
}

static int devlink_port_type_set(struct devlink_port *devlink_port,
                                 enum devlink_port_type port_type)

{
        int err;

        if (!devlink_port->ops->port_type_set)
                return -EOPNOTSUPP;

        if (port_type == devlink_port->type)
                return 0;

        err = devlink_port->ops->port_type_set(devlink_port, port_type);
        if (err)
                return err;

        devlink_port->desired_type = port_type;
        devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_NEW);
        return 0;
}

static int devlink_port_function_hw_addr_set(struct devlink_port *port,
                                             const struct nlattr *attr,
                                             struct netlink_ext_ack *extack)
{
        const u8 *hw_addr;
        int hw_addr_len;

        hw_addr = nla_data(attr);
        hw_addr_len = nla_len(attr);
        if (hw_addr_len > MAX_ADDR_LEN) {
                NL_SET_ERR_MSG(extack, "Port function hardware address too long");
                return -EINVAL;
        }
        if (port->type == DEVLINK_PORT_TYPE_ETH) {
                if (hw_addr_len != ETH_ALEN) {
                        NL_SET_ERR_MSG(extack, "Address must be 6 bytes for Ethernet device");
                        return -EINVAL;
                }
                if (!is_unicast_ether_addr(hw_addr)) {
                        NL_SET_ERR_MSG(extack, "Non-unicast hardware address unsupported");
                        return -EINVAL;
                }
        }

        return port->ops->port_fn_hw_addr_set(port, hw_addr, hw_addr_len,
                                              extack);
}

static int devlink_port_fn_state_set(struct devlink_port *port,
                                     const struct nlattr *attr,
                                     struct netlink_ext_ack *extack)
{
        enum devlink_port_fn_state state;

        state = nla_get_u8(attr);
        return port->ops->port_fn_state_set(port, state, extack);
}

static int devlink_port_function_validate(struct devlink_port *devlink_port,
                                          struct nlattr **tb,
                                          struct netlink_ext_ack *extack)
{
        const struct devlink_port_ops *ops = devlink_port->ops;
        struct nlattr *attr;

        if (tb[DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR] &&
            !ops->port_fn_hw_addr_set) {
                NL_SET_ERR_MSG_ATTR(extack, tb[DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR],
                                    "Port doesn't support function attributes");
                return -EOPNOTSUPP;
        }
        if (tb[DEVLINK_PORT_FN_ATTR_STATE] && !ops->port_fn_state_set) {
                NL_SET_ERR_MSG_ATTR(extack, tb[DEVLINK_PORT_FN_ATTR_STATE],
                                    "Function does not support state setting");
                return -EOPNOTSUPP;
        }
        attr = tb[DEVLINK_PORT_FN_ATTR_CAPS];
        if (attr) {
                struct nla_bitfield32 caps;

                caps = nla_get_bitfield32(attr);
                if (caps.selector & DEVLINK_PORT_FN_CAP_ROCE &&
                    !ops->port_fn_roce_set) {
                        NL_SET_ERR_MSG_ATTR(extack, attr,
                                            "Port doesn't support RoCE function attribute");
                        return -EOPNOTSUPP;
                }
                if (caps.selector & DEVLINK_PORT_FN_CAP_MIGRATABLE) {
                        if (!ops->port_fn_migratable_set) {
                                NL_SET_ERR_MSG_ATTR(extack, attr,
                                                    "Port doesn't support migratable function attribute");
                                return -EOPNOTSUPP;
                        }
                        if (devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_VF) {
                                NL_SET_ERR_MSG_ATTR(extack, attr,
                                                    "migratable function attribute supported for VFs only");
                                return -EOPNOTSUPP;
                        }
                }
                if (caps.selector & DEVLINK_PORT_FN_CAP_IPSEC_CRYPTO) {
                        if (!ops->port_fn_ipsec_crypto_set) {
                                NL_SET_ERR_MSG_ATTR(extack, attr,
                                                    "Port doesn't support ipsec_crypto function attribute");
                                return -EOPNOTSUPP;
                        }
                        if (devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_VF) {
                                NL_SET_ERR_MSG_ATTR(extack, attr,
                                                    "ipsec_crypto function attribute supported for VFs only");
                                return -EOPNOTSUPP;
                        }
                }
                if (caps.selector & DEVLINK_PORT_FN_CAP_IPSEC_PACKET) {
                        if (!ops->port_fn_ipsec_packet_set) {
                                NL_SET_ERR_MSG_ATTR(extack, attr,
                                                    "Port doesn't support ipsec_packet function attribute");
                                return -EOPNOTSUPP;
                        }
                        if (devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_VF) {
                                NL_SET_ERR_MSG_ATTR(extack, attr,
                                                    "ipsec_packet function attribute supported for VFs only");
                                return -EOPNOTSUPP;
                        }
                }
        }
        if (tb[DEVLINK_PORT_FN_ATTR_MAX_IO_EQS] &&
            !ops->port_fn_max_io_eqs_set) {
                NL_SET_ERR_MSG_ATTR(extack, tb[DEVLINK_PORT_FN_ATTR_MAX_IO_EQS],
                                    "Function does not support max_io_eqs setting");
                return -EOPNOTSUPP;
        }
        return 0;
}

static int devlink_port_function_set(struct devlink_port *port,
                                     const struct nlattr *attr,
                                     struct netlink_ext_ack *extack)
{
        struct nlattr *tb[DEVLINK_PORT_FUNCTION_ATTR_MAX + 1];
        int err;

        err = nla_parse_nested(tb, DEVLINK_PORT_FUNCTION_ATTR_MAX, attr,
                               devlink_function_nl_policy, extack);
        if (err < 0) {
                NL_SET_ERR_MSG(extack, "Fail to parse port function attributes");
                return err;
        }

        err = devlink_port_function_validate(port, tb, extack);
        if (err)
                return err;

        attr = tb[DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR];
        if (attr) {
                err = devlink_port_function_hw_addr_set(port, attr, extack);
                if (err)
                        return err;
        }

        attr = tb[DEVLINK_PORT_FN_ATTR_CAPS];
        if (attr) {
                err = devlink_port_fn_caps_set(port, attr, extack);
                if (err)
                        return err;
        }

        attr = tb[DEVLINK_PORT_FN_ATTR_MAX_IO_EQS];
        if (attr) {
                err = devlink_port_fn_max_io_eqs_set(port, attr, extack);
                if (err)
                        return err;
        }

        /* Keep this as the last function attribute set, so that when
         * multiple port function attributes are set along with state,
         * Those can be applied first before activating the state.
         */
        attr = tb[DEVLINK_PORT_FN_ATTR_STATE];
        if (attr)
                err = devlink_port_fn_state_set(port, attr, extack);

        if (!err)
                devlink_port_notify(port, DEVLINK_CMD_PORT_NEW);
        return err;
}

int devlink_nl_port_set_doit(struct sk_buff *skb, struct genl_info *info)
{
        struct devlink_port *devlink_port = info->user_ptr[1];
        int err;

        if (info->attrs[DEVLINK_ATTR_PORT_TYPE]) {
                enum devlink_port_type port_type;

                port_type = nla_get_u16(info->attrs[DEVLINK_ATTR_PORT_TYPE]);
                err = devlink_port_type_set(devlink_port, port_type);
                if (err)
                        return err;
        }

        if (info->attrs[DEVLINK_ATTR_PORT_FUNCTION]) {
                struct nlattr *attr = info->attrs[DEVLINK_ATTR_PORT_FUNCTION];
                struct netlink_ext_ack *extack = info->extack;

                err = devlink_port_function_set(devlink_port, attr, extack);
                if (err)
                        return err;
        }

        return 0;
}

int devlink_nl_port_split_doit(struct sk_buff *skb, struct genl_info *info)
{
        struct devlink_port *devlink_port = info->user_ptr[1];
        struct devlink *devlink = info->user_ptr[0];
        u32 count;

        if (GENL_REQ_ATTR_CHECK(info, DEVLINK_ATTR_PORT_SPLIT_COUNT))
                return -EINVAL;
        if (!devlink_port->ops->port_split)
                return -EOPNOTSUPP;

        count = nla_get_u32(info->attrs[DEVLINK_ATTR_PORT_SPLIT_COUNT]);

        if (!devlink_port->attrs.splittable) {
                /* Split ports cannot be split. */
                if (devlink_port->attrs.split)
                        NL_SET_ERR_MSG(info->extack, "Port cannot be split further");
                else
                        NL_SET_ERR_MSG(info->extack, "Port cannot be split");
                return -EINVAL;
        }

        if (count < 2 || !is_power_of_2(count) || count > devlink_port->attrs.lanes) {
                NL_SET_ERR_MSG(info->extack, "Invalid split count");
                return -EINVAL;
        }

        return devlink_port->ops->port_split(devlink, devlink_port, count,
                                             info->extack);
}

int devlink_nl_port_unsplit_doit(struct sk_buff *skb, struct genl_info *info)
{
        struct devlink_port *devlink_port = info->user_ptr[1];
        struct devlink *devlink = info->user_ptr[0];

        if (!devlink_port->ops->port_unsplit)
                return -EOPNOTSUPP;
        return devlink_port->ops->port_unsplit(devlink, devlink_port, info->extack);
}

int devlink_nl_port_new_doit(struct sk_buff *skb, struct genl_info *info)
{
        struct netlink_ext_ack *extack = info->extack;
        struct devlink_port_new_attrs new_attrs = {};
        struct devlink *devlink = info->user_ptr[0];
        struct devlink_port *devlink_port;
        struct sk_buff *msg;
        int err;

        if (!devlink->ops->port_new)
                return -EOPNOTSUPP;

        if (!info->attrs[DEVLINK_ATTR_PORT_FLAVOUR] ||
            !info->attrs[DEVLINK_ATTR_PORT_PCI_PF_NUMBER]) {
                NL_SET_ERR_MSG(extack, "Port flavour or PCI PF are not specified");
                return -EINVAL;
        }
        new_attrs.flavour = nla_get_u16(info->attrs[DEVLINK_ATTR_PORT_FLAVOUR]);
        new_attrs.pfnum =
                nla_get_u16(info->attrs[DEVLINK_ATTR_PORT_PCI_PF_NUMBER]);

        if (info->attrs[DEVLINK_ATTR_PORT_INDEX]) {
                /* Port index of the new port being created by driver. */
                new_attrs.port_index =
                        nla_get_u32(info->attrs[DEVLINK_ATTR_PORT_INDEX]);
                new_attrs.port_index_valid = true;
        }
        if (info->attrs[DEVLINK_ATTR_PORT_CONTROLLER_NUMBER]) {
                new_attrs.controller =
                        nla_get_u16(info->attrs[DEVLINK_ATTR_PORT_CONTROLLER_NUMBER]);
                new_attrs.controller_valid = true;
        }
        if (new_attrs.flavour == DEVLINK_PORT_FLAVOUR_PCI_SF &&
            info->attrs[DEVLINK_ATTR_PORT_PCI_SF_NUMBER]) {
                new_attrs.sfnum = nla_get_u32(info->attrs[DEVLINK_ATTR_PORT_PCI_SF_NUMBER]);
                new_attrs.sfnum_valid = true;
        }

        err = devlink->ops->port_new(devlink, &new_attrs,
                                     extack, &devlink_port);
        if (err)
                return err;

        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg) {
                err = -ENOMEM;
                goto err_out_port_del;
        }
        err = devlink_nl_port_fill(msg, devlink_port, DEVLINK_CMD_PORT_NEW,
                                   info->snd_portid, info->snd_seq, 0, NULL);
        if (WARN_ON_ONCE(err))
                goto err_out_msg_free;
        err = genlmsg_reply(msg, info);
        if (err)
                goto err_out_port_del;
        return 0;

err_out_msg_free:
        nlmsg_free(msg);
err_out_port_del:
        devlink_port->ops->port_del(devlink, devlink_port, NULL);
        return err;
}

int devlink_nl_port_del_doit(struct sk_buff *skb, struct genl_info *info)
{
        struct devlink_port *devlink_port = info->user_ptr[1];
        struct netlink_ext_ack *extack = info->extack;
        struct devlink *devlink = info->user_ptr[0];

        if (!devlink_port->ops->port_del)
                return -EOPNOTSUPP;

        return devlink_port->ops->port_del(devlink, devlink_port, extack);
}

static void devlink_port_type_warn(struct work_struct *work)
{
        struct devlink_port *port = container_of(to_delayed_work(work),
                                                 struct devlink_port,
                                                 type_warn_dw);
        dev_warn(port->devlink->dev, "Type was not set for devlink port.");
}

static bool devlink_port_type_should_warn(struct devlink_port *devlink_port)
{
        /* Ignore CPU and DSA flavours. */
        return devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_CPU &&
               devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_DSA &&
               devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_UNUSED;
}

#define DEVLINK_PORT_TYPE_WARN_TIMEOUT (HZ * 3600)

static void devlink_port_type_warn_schedule(struct devlink_port *devlink_port)
{
        if (!devlink_port_type_should_warn(devlink_port))
                return;
        /* Schedule a work to WARN in case driver does not set port
         * type within timeout.
         */
        schedule_delayed_work(&devlink_port->type_warn_dw,
                              DEVLINK_PORT_TYPE_WARN_TIMEOUT);
}

static void devlink_port_type_warn_cancel(struct devlink_port *devlink_port)
{
        if (!devlink_port_type_should_warn(devlink_port))
                return;
        cancel_delayed_work_sync(&devlink_port->type_warn_dw);
}

/**
 * devlink_port_init() - Init devlink port
 *
 * @devlink: devlink
 * @devlink_port: devlink port
 *
 * Initialize essential stuff that is needed for functions
 * that may be called before devlink port registration.
 * Call to this function is optional and not needed
 * in case the driver does not use such functions.
 */
void devlink_port_init(struct devlink *devlink,
                       struct devlink_port *devlink_port)
{
        if (devlink_port->initialized)
                return;
        devlink_port->devlink = devlink;
        INIT_LIST_HEAD(&devlink_port->region_list);
        devlink_port->initialized = true;
}
EXPORT_SYMBOL_GPL(devlink_port_init);

/**
 * devlink_port_fini() - Deinitialize devlink port
 *
 * @devlink_port: devlink port
 *
 * Deinitialize essential stuff that is in use for functions
 * that may be called after devlink port unregistration.
 * Call to this function is optional and not needed
 * in case the driver does not use such functions.
 */
void devlink_port_fini(struct devlink_port *devlink_port)
{
        WARN_ON(!list_empty(&devlink_port->region_list));
}
EXPORT_SYMBOL_GPL(devlink_port_fini);

static const struct devlink_port_ops devlink_port_dummy_ops = {};

/**
 * devl_port_register_with_ops() - Register devlink port
 *
 * @devlink: devlink
 * @devlink_port: devlink port
 * @port_index: driver-specific numerical identifier of the port
 * @ops: port ops
 *
 * Register devlink port with provided port index. User can use
 * any indexing, even hw-related one. devlink_port structure
 * is convenient to be embedded inside user driver private structure.
 * Note that the caller should take care of zeroing the devlink_port
 * structure.
 */
int devl_port_register_with_ops(struct devlink *devlink,
                                struct devlink_port *devlink_port,
                                unsigned int port_index,
                                const struct devlink_port_ops *ops)
{
        int err;

        devl_assert_locked(devlink);

        ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port);

        devlink_port_init(devlink, devlink_port);
        devlink_port->registered = true;
        devlink_port->index = port_index;
        devlink_port->ops = ops ? ops : &devlink_port_dummy_ops;
        spin_lock_init(&devlink_port->type_lock);
        INIT_LIST_HEAD(&devlink_port->reporter_list);
        err = xa_insert(&devlink->ports, port_index, devlink_port, GFP_KERNEL);
        if (err) {
                devlink_port->registered = false;
                return err;
        }

        INIT_DELAYED_WORK(&devlink_port->type_warn_dw, &devlink_port_type_warn);
        devlink_port_type_warn_schedule(devlink_port);
        devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_NEW);
        return 0;
}
EXPORT_SYMBOL_GPL(devl_port_register_with_ops);

/**
 *        devlink_port_register_with_ops - Register devlink port
 *
 *        @devlink: devlink
 *        @devlink_port: devlink port
 *        @port_index: driver-specific numerical identifier of the port
 *        @ops: port ops
 *
 *        Register devlink port with provided port index. User can use
 *        any indexing, even hw-related one. devlink_port structure
 *        is convenient to be embedded inside user driver private structure.
 *        Note that the caller should take care of zeroing the devlink_port
 *        structure.
 *
 *        Context: Takes and release devlink->lock <mutex>.
 */
int devlink_port_register_with_ops(struct devlink *devlink,
                                   struct devlink_port *devlink_port,
                                   unsigned int port_index,
                                   const struct devlink_port_ops *ops)
{
        int err;

        devl_lock(devlink);
        err = devl_port_register_with_ops(devlink, devlink_port,
                                          port_index, ops);
        devl_unlock(devlink);
        return err;
}
EXPORT_SYMBOL_GPL(devlink_port_register_with_ops);

/**
 * devl_port_unregister() - Unregister devlink port
 *
 * @devlink_port: devlink port
 */
void devl_port_unregister(struct devlink_port *devlink_port)
{
        lockdep_assert_held(&devlink_port->devlink->lock);
        WARN_ON(devlink_port->type != DEVLINK_PORT_TYPE_NOTSET);

        devlink_port_type_warn_cancel(devlink_port);
        devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_DEL);
        xa_erase(&devlink_port->devlink->ports, devlink_port->index);
        WARN_ON(!list_empty(&devlink_port->reporter_list));
        devlink_port->registered = false;
}
EXPORT_SYMBOL_GPL(devl_port_unregister);

/**
 *        devlink_port_unregister - Unregister devlink port
 *
 *        @devlink_port: devlink port
 *
 *        Context: Takes and release devlink->lock <mutex>.
 */
void devlink_port_unregister(struct devlink_port *devlink_port)
{
        struct devlink *devlink = devlink_port->devlink;

        devl_lock(devlink);
        devl_port_unregister(devlink_port);
        devl_unlock(devlink);
}
EXPORT_SYMBOL_GPL(devlink_port_unregister);

static void devlink_port_type_netdev_checks(struct devlink_port *devlink_port,
                                            struct net_device *netdev)
{
        const struct net_device_ops *ops = netdev->netdev_ops;

        /* If driver registers devlink port, it should set devlink port
         * attributes accordingly so the compat functions are called
         * and the original ops are not used.
         */
        if (ops->ndo_get_phys_port_name) {
                /* Some drivers use the same set of ndos for netdevs
                 * that have devlink_port registered and also for
                 * those who don't. Make sure that ndo_get_phys_port_name
                 * returns -EOPNOTSUPP here in case it is defined.
                 * Warn if not.
                 */
                char name[IFNAMSIZ];
                int err;

                err = ops->ndo_get_phys_port_name(netdev, name, sizeof(name));
                WARN_ON(err != -EOPNOTSUPP);
        }
        if (ops->ndo_get_port_parent_id) {
                /* Some drivers use the same set of ndos for netdevs
                 * that have devlink_port registered and also for
                 * those who don't. Make sure that ndo_get_port_parent_id
                 * returns -EOPNOTSUPP here in case it is defined.
                 * Warn if not.
                 */
                struct netdev_phys_item_id ppid;
                int err;

                err = ops->ndo_get_port_parent_id(netdev, &ppid);
                WARN_ON(err != -EOPNOTSUPP);
        }
}

static void __devlink_port_type_set(struct devlink_port *devlink_port,
                                    enum devlink_port_type type,
                                    void *type_dev)
{
        struct net_device *netdev = type_dev;

        ASSERT_DEVLINK_PORT_REGISTERED(devlink_port);

        if (type == DEVLINK_PORT_TYPE_NOTSET) {
                devlink_port_type_warn_schedule(devlink_port);
        } else {
                devlink_port_type_warn_cancel(devlink_port);
                if (type == DEVLINK_PORT_TYPE_ETH && netdev)
                        devlink_port_type_netdev_checks(devlink_port, netdev);
        }

        spin_lock_bh(&devlink_port->type_lock);
        devlink_port->type = type;
        switch (type) {
        case DEVLINK_PORT_TYPE_ETH:
                devlink_port->type_eth.netdev = netdev;
                if (netdev) {
                        ASSERT_RTNL();
                        devlink_port->type_eth.ifindex = netdev->ifindex;
                        BUILD_BUG_ON(sizeof(devlink_port->type_eth.ifname) !=
                                     sizeof(netdev->name));
                        strcpy(devlink_port->type_eth.ifname, netdev->name);
                }
                break;
        case DEVLINK_PORT_TYPE_IB:
                devlink_port->type_ib.ibdev = type_dev;
                break;
        default:
                break;
        }
        spin_unlock_bh(&devlink_port->type_lock);
        devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_NEW);
}

/**
 *        devlink_port_type_eth_set - Set port type to Ethernet
 *
 *        @devlink_port: devlink port
 *
 *        If driver is calling this, most likely it is doing something wrong.
 */
void devlink_port_type_eth_set(struct devlink_port *devlink_port)
{
        dev_warn(devlink_port->devlink->dev,
                 "devlink port type for port %d set to Ethernet without a software interface reference, device type not supported by the kernel?\n",
                 devlink_port->index);
        __devlink_port_type_set(devlink_port, DEVLINK_PORT_TYPE_ETH, NULL);
}
EXPORT_SYMBOL_GPL(devlink_port_type_eth_set);

/**
 *        devlink_port_type_ib_set - Set port type to InfiniBand
 *
 *        @devlink_port: devlink port
 *        @ibdev: related IB device
 */
void devlink_port_type_ib_set(struct devlink_port *devlink_port,
                              struct ib_device *ibdev)
{
        __devlink_port_type_set(devlink_port, DEVLINK_PORT_TYPE_IB, ibdev);
}
EXPORT_SYMBOL_GPL(devlink_port_type_ib_set);

/**
 *        devlink_port_type_clear - Clear port type
 *
 *        @devlink_port: devlink port
 *
 *        If driver is calling this for clearing Ethernet type, most likely
 *        it is doing something wrong.
 */
void devlink_port_type_clear(struct devlink_port *devlink_port)
{
        if (devlink_port->type == DEVLINK_PORT_TYPE_ETH)
                dev_warn(devlink_port->devlink->dev,
                         "devlink port type for port %d cleared without a software interface reference, device type not supported by the kernel?\n",
                         devlink_port->index);
        __devlink_port_type_set(devlink_port, DEVLINK_PORT_TYPE_NOTSET, NULL);
}
EXPORT_SYMBOL_GPL(devlink_port_type_clear);

int devlink_port_netdevice_event(struct notifier_block *nb,
                                 unsigned long event, void *ptr)
{
        struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
        struct devlink_port *devlink_port = netdev->devlink_port;
        struct devlink *devlink;

        if (!devlink_port)
                return NOTIFY_OK;
        devlink = devlink_port->devlink;

        switch (event) {
        case NETDEV_POST_INIT:
                /* Set the type but not netdev pointer. It is going to be set
                 * later on by NETDEV_REGISTER event. Happens once during
                 * netdevice register
                 */
                __devlink_port_type_set(devlink_port, DEVLINK_PORT_TYPE_ETH,
                                        NULL);
                break;
        case NETDEV_REGISTER:
        case NETDEV_CHANGENAME:
                if (devlink_net(devlink) != dev_net(netdev))
                        return NOTIFY_OK;
                /* Set the netdev on top of previously set type. Note this
                 * event happens also during net namespace change so here
                 * we take into account netdev pointer appearing in this
                 * namespace.
                 */
                __devlink_port_type_set(devlink_port, devlink_port->type,
                                        netdev);
                break;
        case NETDEV_UNREGISTER:
                if (devlink_net(devlink) != dev_net(netdev))
                        return NOTIFY_OK;
                /* Clear netdev pointer, but not the type. This event happens
                 * also during net namespace change so we need to clear
                 * pointer to netdev that is going to another net namespace.
                 */
                __devlink_port_type_set(devlink_port, devlink_port->type,
                                        NULL);
                break;
        case NETDEV_PRE_UNINIT:
                /* Clear the type and the netdev pointer. Happens one during
                 * netdevice unregister.
                 */
                __devlink_port_type_set(devlink_port, DEVLINK_PORT_TYPE_NOTSET,
                                        NULL);
                break;
        }

        return NOTIFY_OK;
}

static int __devlink_port_attrs_set(struct devlink_port *devlink_port,
                                    enum devlink_port_flavour flavour)
{
        struct devlink_port_attrs *attrs = &devlink_port->attrs;

        devlink_port->attrs_set = true;
        attrs->flavour = flavour;
        if (attrs->switch_id.id_len) {
                devlink_port->switch_port = true;
                if (WARN_ON(attrs->switch_id.id_len > MAX_PHYS_ITEM_ID_LEN))
                        attrs->switch_id.id_len = MAX_PHYS_ITEM_ID_LEN;
        } else {
                devlink_port->switch_port = false;
        }
        return 0;
}

/**
 *        devlink_port_attrs_set - Set port attributes
 *
 *        @devlink_port: devlink port
 *        @attrs: devlink port attrs
 */
void devlink_port_attrs_set(struct devlink_port *devlink_port,
                            struct devlink_port_attrs *attrs)
{
        int ret;

        ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port);

        devlink_port->attrs = *attrs;
        ret = __devlink_port_attrs_set(devlink_port, attrs->flavour);
        if (ret)
                return;
        WARN_ON(attrs->splittable && attrs->split);
}
EXPORT_SYMBOL_GPL(devlink_port_attrs_set);

/**
 *        devlink_port_attrs_pci_pf_set - Set PCI PF port attributes
 *
 *        @devlink_port: devlink port
 *        @controller: associated controller number for the devlink port instance
 *        @pf: associated PF for the devlink port instance
 *        @external: indicates if the port is for an external controller
 */
void devlink_port_attrs_pci_pf_set(struct devlink_port *devlink_port, u32 controller,
                                   u16 pf, bool external)
{
        struct devlink_port_attrs *attrs = &devlink_port->attrs;
        int ret;

        ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port);

        ret = __devlink_port_attrs_set(devlink_port,
                                       DEVLINK_PORT_FLAVOUR_PCI_PF);
        if (ret)
                return;
        attrs->pci_pf.controller = controller;
        attrs->pci_pf.pf = pf;
        attrs->pci_pf.external = external;
}
EXPORT_SYMBOL_GPL(devlink_port_attrs_pci_pf_set);

/**
 *        devlink_port_attrs_pci_vf_set - Set PCI VF port attributes
 *
 *        @devlink_port: devlink port
 *        @controller: associated controller number for the devlink port instance
 *        @pf: associated PF for the devlink port instance
 *        @vf: associated VF of a PF for the devlink port instance
 *        @external: indicates if the port is for an external controller
 */
void devlink_port_attrs_pci_vf_set(struct devlink_port *devlink_port, u32 controller,
                                   u16 pf, u16 vf, bool external)
{
        struct devlink_port_attrs *attrs = &devlink_port->attrs;
        int ret;

        ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port);

        ret = __devlink_port_attrs_set(devlink_port,
                                       DEVLINK_PORT_FLAVOUR_PCI_VF);
        if (ret)
                return;
        attrs->pci_vf.controller = controller;
        attrs->pci_vf.pf = pf;
        attrs->pci_vf.vf = vf;
        attrs->pci_vf.external = external;
}
EXPORT_SYMBOL_GPL(devlink_port_attrs_pci_vf_set);

/**
 *        devlink_port_attrs_pci_sf_set - Set PCI SF port attributes
 *
 *        @devlink_port: devlink port
 *        @controller: associated controller number for the devlink port instance
 *        @pf: associated PF for the devlink port instance
 *        @sf: associated SF of a PF for the devlink port instance
 *        @external: indicates if the port is for an external controller
 */
void devlink_port_attrs_pci_sf_set(struct devlink_port *devlink_port, u32 controller,
                                   u16 pf, u32 sf, bool external)
{
        struct devlink_port_attrs *attrs = &devlink_port->attrs;
        int ret;

        ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port);

        ret = __devlink_port_attrs_set(devlink_port,
                                       DEVLINK_PORT_FLAVOUR_PCI_SF);
        if (ret)
                return;
        attrs->pci_sf.controller = controller;
        attrs->pci_sf.pf = pf;
        attrs->pci_sf.sf = sf;
        attrs->pci_sf.external = external;
}
EXPORT_SYMBOL_GPL(devlink_port_attrs_pci_sf_set);

static void devlink_port_rel_notify_cb(struct devlink *devlink, u32 port_index)
{
        struct devlink_port *devlink_port;

        devlink_port = devlink_port_get_by_index(devlink, port_index);
        if (!devlink_port)
                return;
        devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_NEW);
}

static void devlink_port_rel_cleanup_cb(struct devlink *devlink, u32 port_index,
                                        u32 rel_index)
{
        struct devlink_port *devlink_port;

        devlink_port = devlink_port_get_by_index(devlink, port_index);
        if (devlink_port && devlink_port->rel_index == rel_index)
                devlink_port->rel_index = 0;
}

/**
 * devl_port_fn_devlink_set - Attach peer devlink
 *                              instance to port function.
 * @devlink_port: devlink port
 * @fn_devlink: devlink instance to attach
 */
int devl_port_fn_devlink_set(struct devlink_port *devlink_port,
                             struct devlink *fn_devlink)
{
        ASSERT_DEVLINK_PORT_REGISTERED(devlink_port);

        if (WARN_ON(devlink_port->attrs.flavour != DEVLINK_PORT_FLAVOUR_PCI_SF ||
                    devlink_port->attrs.pci_sf.external))
                return -EINVAL;

        return devlink_rel_nested_in_add(&devlink_port->rel_index,
                                         devlink_port->devlink->index,
                                         devlink_port->index,
                                         devlink_port_rel_notify_cb,
                                         devlink_port_rel_cleanup_cb,
                                         fn_devlink);
}
EXPORT_SYMBOL_GPL(devl_port_fn_devlink_set);

/**
 *        devlink_port_linecard_set - Link port with a linecard
 *
 *        @devlink_port: devlink port
 *        @linecard: devlink linecard
 */
void devlink_port_linecard_set(struct devlink_port *devlink_port,
                               struct devlink_linecard *linecard)
{
        ASSERT_DEVLINK_PORT_NOT_REGISTERED(devlink_port);

        devlink_port->linecard = linecard;
}
EXPORT_SYMBOL_GPL(devlink_port_linecard_set);

static int __devlink_port_phys_port_name_get(struct devlink_port *devlink_port,
                                             char *name, size_t len)
{
        struct devlink_port_attrs *attrs = &devlink_port->attrs;
        int n = 0;

        if (!devlink_port->attrs_set)
                return -EOPNOTSUPP;

        switch (attrs->flavour) {
        case DEVLINK_PORT_FLAVOUR_PHYSICAL:
                if (devlink_port->linecard)
                        n = snprintf(name, len, "l%u",
                                     devlink_linecard_index(devlink_port->linecard));
                if (n < len)
                        n += snprintf(name + n, len - n, "p%u",
                                      attrs->phys.port_number);
                if (n < len && attrs->split)
                        n += snprintf(name + n, len - n, "s%u",
                                      attrs->phys.split_subport_number);
                break;
        case DEVLINK_PORT_FLAVOUR_CPU:
        case DEVLINK_PORT_FLAVOUR_DSA:
        case DEVLINK_PORT_FLAVOUR_UNUSED:
                /* As CPU and DSA ports do not have a netdevice associated
                 * case should not ever happen.
                 */
                WARN_ON(1);
                return -EINVAL;
        case DEVLINK_PORT_FLAVOUR_PCI_PF:
                if (attrs->pci_pf.external) {
                        n = snprintf(name, len, "c%u", attrs->pci_pf.controller);
                        if (n >= len)
                                return -EINVAL;
                        len -= n;
                        name += n;
                }
                n = snprintf(name, len, "pf%u", attrs->pci_pf.pf);
                break;
        case DEVLINK_PORT_FLAVOUR_PCI_VF:
                if (attrs->pci_vf.external) {
                        n = snprintf(name, len, "c%u", attrs->pci_vf.controller);
                        if (n >= len)
                                return -EINVAL;
                        len -= n;
                        name += n;
                }
                n = snprintf(name, len, "pf%uvf%u",
                             attrs->pci_vf.pf, attrs->pci_vf.vf);
                break;
        case DEVLINK_PORT_FLAVOUR_PCI_SF:
                if (attrs->pci_sf.external) {
                        n = snprintf(name, len, "c%u", attrs->pci_sf.controller);
                        if (n >= len)
                                return -EINVAL;
                        len -= n;
                        name += n;
                }
                n = snprintf(name, len, "pf%usf%u", attrs->pci_sf.pf,
                             attrs->pci_sf.sf);
                break;
        case DEVLINK_PORT_FLAVOUR_VIRTUAL:
                return -EOPNOTSUPP;
        }

        if (n >= len)
                return -EINVAL;

        return 0;
}

int devlink_compat_phys_port_name_get(struct net_device *dev,
                                      char *name, size_t len)
{
        struct devlink_port *devlink_port;

        /* RTNL mutex is held here which ensures that devlink_port
         * instance cannot disappear in the middle. No need to take
         * any devlink lock as only permanent values are accessed.
         */
        ASSERT_RTNL();

        devlink_port = dev->devlink_port;
        if (!devlink_port)
                return -EOPNOTSUPP;

        return __devlink_port_phys_port_name_get(devlink_port, name, len);
}

int devlink_compat_switch_id_get(struct net_device *dev,
                                 struct netdev_phys_item_id *ppid)
{
        struct devlink_port *devlink_port;

        /* Caller must hold RTNL mutex or reference to dev, which ensures that
         * devlink_port instance cannot disappear in the middle. No need to take
         * any devlink lock as only permanent values are accessed.
         */
        devlink_port = dev->devlink_port;
        if (!devlink_port || !devlink_port->switch_port)
                return -EOPNOTSUPP;

        memcpy(ppid, &devlink_port->attrs.switch_id, sizeof(*ppid));

        return 0;
}


















    9 


    9 


    9 








   22 


   22 

   22 



























   18 




















   12 







   12 


















    3 
    2 

    3 





    1 
    1 








    9 
    1 





    7 









    2 

    6 


    4 



    2 



    8 








    1 

    8 



    2 
    8 












   12 









   12 
   12 


   12 

















   12 

    8 

    3 

    2 


   10 


















   10 




















































   13 





















   13 









   13 






    4 

    9 












   13 



















   13 
   13 




   13 















   13 
    4 















   13 







   13 




   13 






   13 






   13 











   13 











   13 












   13 


    7 
    6 

   13 















   13 





   13 




    7 








   12 
















   13 

    6 







    7 



    7 












   13 







   20 


    3 










    1 

   13 


    1 

    1 


































   21 






    1 

   21 
   20 








   18 

























   18 











   15 

    1 

    1 









   13 


   13 





    7 

    6 





1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
// SPDX-License-Identifier: GPL-2.0+
/*
 * Copyright (C) 2017 Oracle.  All Rights Reserved.
 *
 * Author: Darrick J. Wong <darrick.wong@oracle.com>
 */
#include "ext4.h"
#include <linux/fsmap.h>
#include "fsmap.h"
#include "mballoc.h"
#include <linux/sort.h>
#include <linux/list_sort.h>
#include <trace/events/ext4.h>

/* Convert an ext4_fsmap to an fsmap. */
void ext4_fsmap_from_internal(struct super_block *sb, struct fsmap *dest,
                              struct ext4_fsmap *src)
{
        dest->fmr_device = src->fmr_device;
        dest->fmr_flags = src->fmr_flags;
        dest->fmr_physical = src->fmr_physical << sb->s_blocksize_bits;
        dest->fmr_owner = src->fmr_owner;
        dest->fmr_offset = 0;
        dest->fmr_length = src->fmr_length << sb->s_blocksize_bits;
        dest->fmr_reserved[0] = 0;
        dest->fmr_reserved[1] = 0;
        dest->fmr_reserved[2] = 0;
}

/* Convert an fsmap to an ext4_fsmap. */
void ext4_fsmap_to_internal(struct super_block *sb, struct ext4_fsmap *dest,
                            struct fsmap *src)
{
        dest->fmr_device = src->fmr_device;
        dest->fmr_flags = src->fmr_flags;
        dest->fmr_physical = src->fmr_physical >> sb->s_blocksize_bits;
        dest->fmr_owner = src->fmr_owner;
        dest->fmr_length = src->fmr_length >> sb->s_blocksize_bits;
}

/* getfsmap query state */
struct ext4_getfsmap_info {
        struct ext4_fsmap_head        *gfi_head;
        ext4_fsmap_format_t        gfi_formatter;        /* formatting fn */
        void                        *gfi_format_arg;/* format buffer */
        ext4_fsblk_t                gfi_next_fsblk;        /* next fsblock we expect */
        u32                        gfi_dev;        /* device id */
        ext4_group_t                gfi_agno;        /* bg number, if applicable */
        struct ext4_fsmap        gfi_low;        /* low rmap key */
        struct ext4_fsmap        gfi_high;        /* high rmap key */
        struct ext4_fsmap        gfi_lastfree;        /* free ext at end of last bg */
        struct list_head        gfi_meta_list;        /* fixed metadata list */
        bool                        gfi_last;        /* last extent? */
};

/* Associate a device with a getfsmap handler. */
struct ext4_getfsmap_dev {
        int                        (*gfd_fn)(struct super_block *sb,
                                      struct ext4_fsmap *keys,
                                      struct ext4_getfsmap_info *info);
        u32                        gfd_dev;
};

/* Compare two getfsmap device handlers. */
static int ext4_getfsmap_dev_compare(const void *p1, const void *p2)
{
        const struct ext4_getfsmap_dev *d1 = p1;
        const struct ext4_getfsmap_dev *d2 = p2;

        return d1->gfd_dev - d2->gfd_dev;
}

/* Compare a record against our starting point */
static bool ext4_getfsmap_rec_before_low_key(struct ext4_getfsmap_info *info,
                                             struct ext4_fsmap *rec)
{
        return rec->fmr_physical < info->gfi_low.fmr_physical;
}

/*
 * Format a reverse mapping for getfsmap, having translated rm_startblock
 * into the appropriate daddr units.
 */
static int ext4_getfsmap_helper(struct super_block *sb,
                                struct ext4_getfsmap_info *info,
                                struct ext4_fsmap *rec)
{
        struct ext4_fsmap fmr;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
        ext4_fsblk_t rec_fsblk = rec->fmr_physical;
        ext4_group_t agno;
        ext4_grpblk_t cno;
        int error;

        if (fatal_signal_pending(current))
                return -EINTR;

        /*
         * Filter out records that start before our startpoint, if the
         * caller requested that.
         */
        if (ext4_getfsmap_rec_before_low_key(info, rec)) {
                rec_fsblk += rec->fmr_length;
                if (info->gfi_next_fsblk < rec_fsblk)
                        info->gfi_next_fsblk = rec_fsblk;
                return EXT4_QUERY_RANGE_CONTINUE;
        }

        /* Are we just counting mappings? */
        if (info->gfi_head->fmh_count == 0) {
                if (info->gfi_head->fmh_entries == UINT_MAX)
                        return EXT4_QUERY_RANGE_ABORT;

                if (rec_fsblk > info->gfi_next_fsblk)
                        info->gfi_head->fmh_entries++;

                if (info->gfi_last)
                        return EXT4_QUERY_RANGE_CONTINUE;

                info->gfi_head->fmh_entries++;

                rec_fsblk += rec->fmr_length;
                if (info->gfi_next_fsblk < rec_fsblk)
                        info->gfi_next_fsblk = rec_fsblk;
                return EXT4_QUERY_RANGE_CONTINUE;
        }

        /*
         * If the record starts past the last physical block we saw,
         * then we've found a gap.  Report the gap as being owned by
         * whatever the caller specified is the missing owner.
         */
        if (rec_fsblk > info->gfi_next_fsblk) {
                if (info->gfi_head->fmh_entries >= info->gfi_head->fmh_count)
                        return EXT4_QUERY_RANGE_ABORT;

                ext4_get_group_no_and_offset(sb, info->gfi_next_fsblk,
                                &agno, &cno);
                trace_ext4_fsmap_mapping(sb, info->gfi_dev, agno,
                                EXT4_C2B(sbi, cno),
                                rec_fsblk - info->gfi_next_fsblk,
                                EXT4_FMR_OWN_UNKNOWN);

                fmr.fmr_device = info->gfi_dev;
                fmr.fmr_physical = info->gfi_next_fsblk;
                fmr.fmr_owner = EXT4_FMR_OWN_UNKNOWN;
                fmr.fmr_length = rec_fsblk - info->gfi_next_fsblk;
                fmr.fmr_flags = FMR_OF_SPECIAL_OWNER;
                error = info->gfi_formatter(&fmr, info->gfi_format_arg);
                if (error)
                        return error;
                info->gfi_head->fmh_entries++;
        }

        if (info->gfi_last)
                goto out;

        /* Fill out the extent we found */
        if (info->gfi_head->fmh_entries >= info->gfi_head->fmh_count)
                return EXT4_QUERY_RANGE_ABORT;

        ext4_get_group_no_and_offset(sb, rec_fsblk, &agno, &cno);
        trace_ext4_fsmap_mapping(sb, info->gfi_dev, agno, EXT4_C2B(sbi, cno),
                        rec->fmr_length, rec->fmr_owner);

        fmr.fmr_device = info->gfi_dev;
        fmr.fmr_physical = rec_fsblk;
        fmr.fmr_owner = rec->fmr_owner;
        fmr.fmr_flags = FMR_OF_SPECIAL_OWNER;
        fmr.fmr_length = rec->fmr_length;
        error = info->gfi_formatter(&fmr, info->gfi_format_arg);
        if (error)
                return error;
        info->gfi_head->fmh_entries++;

out:
        rec_fsblk += rec->fmr_length;
        if (info->gfi_next_fsblk < rec_fsblk)
                info->gfi_next_fsblk = rec_fsblk;
        return EXT4_QUERY_RANGE_CONTINUE;
}

static inline ext4_fsblk_t ext4_fsmap_next_pblk(struct ext4_fsmap *fmr)
{
        return fmr->fmr_physical + fmr->fmr_length;
}

/* Transform a blockgroup's free record into a fsmap */
static int ext4_getfsmap_datadev_helper(struct super_block *sb,
                                        ext4_group_t agno, ext4_grpblk_t start,
                                        ext4_grpblk_t len, void *priv)
{
        struct ext4_fsmap irec;
        struct ext4_getfsmap_info *info = priv;
        struct ext4_fsmap *p;
        struct ext4_fsmap *tmp;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
        ext4_fsblk_t fsb;
        ext4_fsblk_t fslen;
        int error;

        fsb = (EXT4_C2B(sbi, start) + ext4_group_first_block_no(sb, agno));
        fslen = EXT4_C2B(sbi, len);

        /* If the retained free extent record is set... */
        if (info->gfi_lastfree.fmr_owner) {
                /* ...and abuts this one, lengthen it and return. */
                if (ext4_fsmap_next_pblk(&info->gfi_lastfree) == fsb) {
                        info->gfi_lastfree.fmr_length += fslen;
                        return 0;
                }

                /*
                 * There's a gap between the two free extents; emit the
                 * retained extent prior to merging the meta_list.
                 */
                error = ext4_getfsmap_helper(sb, info, &info->gfi_lastfree);
                if (error)
                        return error;
                info->gfi_lastfree.fmr_owner = 0;
        }

        /* Merge in any relevant extents from the meta_list */
        list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) {
                if (p->fmr_physical + p->fmr_length <= info->gfi_next_fsblk) {
                        list_del(&p->fmr_list);
                        kfree(p);
                } else if (p->fmr_physical < fsb) {
                        error = ext4_getfsmap_helper(sb, info, p);
                        if (error)
                                return error;

                        list_del(&p->fmr_list);
                        kfree(p);
                }
        }

        irec.fmr_device = 0;
        irec.fmr_physical = fsb;
        irec.fmr_length = fslen;
        irec.fmr_owner = EXT4_FMR_OWN_FREE;
        irec.fmr_flags = 0;

        /* If this is a free extent at the end of a bg, buffer it. */
        if (ext4_fsmap_next_pblk(&irec) ==
                        ext4_group_first_block_no(sb, agno + 1)) {
                info->gfi_lastfree = irec;
                return 0;
        }

        /* Otherwise, emit it */
        return ext4_getfsmap_helper(sb, info, &irec);
}

/* Execute a getfsmap query against the log device. */
static int ext4_getfsmap_logdev(struct super_block *sb, struct ext4_fsmap *keys,
                                struct ext4_getfsmap_info *info)
{
        journal_t *journal = EXT4_SB(sb)->s_journal;
        struct ext4_fsmap irec;

        /* Set up search keys */
        info->gfi_low = keys[0];
        info->gfi_low.fmr_length = 0;

        memset(&info->gfi_high, 0xFF, sizeof(info->gfi_high));

        trace_ext4_fsmap_low_key(sb, info->gfi_dev, 0,
                        info->gfi_low.fmr_physical,
                        info->gfi_low.fmr_length,
                        info->gfi_low.fmr_owner);

        trace_ext4_fsmap_high_key(sb, info->gfi_dev, 0,
                        info->gfi_high.fmr_physical,
                        info->gfi_high.fmr_length,
                        info->gfi_high.fmr_owner);

        if (keys[0].fmr_physical > 0)
                return 0;

        /* Fabricate an rmap entry for the external log device. */
        irec.fmr_physical = journal->j_blk_offset;
        irec.fmr_length = journal->j_total_len;
        irec.fmr_owner = EXT4_FMR_OWN_LOG;
        irec.fmr_flags = 0;

        return ext4_getfsmap_helper(sb, info, &irec);
}

/* Helper to fill out an ext4_fsmap. */
static inline int ext4_getfsmap_fill(struct list_head *meta_list,
                                     ext4_fsblk_t fsb, ext4_fsblk_t len,
                                     uint64_t owner)
{
        struct ext4_fsmap *fsm;

        fsm = kmalloc(sizeof(*fsm), GFP_NOFS);
        if (!fsm)
                return -ENOMEM;
        fsm->fmr_device = 0;
        fsm->fmr_flags = 0;
        fsm->fmr_physical = fsb;
        fsm->fmr_owner = owner;
        fsm->fmr_length = len;
        list_add_tail(&fsm->fmr_list, meta_list);

        return 0;
}

/*
 * This function returns the number of file system metadata blocks at
 * the beginning of a block group, including the reserved gdt blocks.
 */
static unsigned int ext4_getfsmap_find_sb(struct super_block *sb,
                                          ext4_group_t agno,
                                          struct list_head *meta_list)
{
        struct ext4_sb_info *sbi = EXT4_SB(sb);
        ext4_fsblk_t fsb = ext4_group_first_block_no(sb, agno);
        ext4_fsblk_t len;
        unsigned long first_meta_bg = le32_to_cpu(sbi->s_es->s_first_meta_bg);
        unsigned long metagroup = agno / EXT4_DESC_PER_BLOCK(sb);
        int error;

        /* Record the superblock. */
        if (ext4_bg_has_super(sb, agno)) {
                error = ext4_getfsmap_fill(meta_list, fsb, 1, EXT4_FMR_OWN_FS);
                if (error)
                        return error;
                fsb++;
        }

        /* Record the group descriptors. */
        len = ext4_bg_num_gdb(sb, agno);
        if (!len)
                return 0;
        error = ext4_getfsmap_fill(meta_list, fsb, len,
                                   EXT4_FMR_OWN_GDT);
        if (error)
                return error;
        fsb += len;

        /* Reserved GDT blocks */
        if (!ext4_has_feature_meta_bg(sb) || metagroup < first_meta_bg) {
                len = le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks);
                error = ext4_getfsmap_fill(meta_list, fsb, len,
                                           EXT4_FMR_OWN_RESV_GDT);
                if (error)
                        return error;
        }

        return 0;
}

/* Compare two fsmap items. */
static int ext4_getfsmap_compare(void *priv,
                                 const struct list_head *a,
                                 const struct list_head *b)
{
        struct ext4_fsmap *fa;
        struct ext4_fsmap *fb;

        fa = container_of(a, struct ext4_fsmap, fmr_list);
        fb = container_of(b, struct ext4_fsmap, fmr_list);
        if (fa->fmr_physical < fb->fmr_physical)
                return -1;
        else if (fa->fmr_physical > fb->fmr_physical)
                return 1;
        return 0;
}

/* Merge adjacent extents of fixed metadata. */
static void ext4_getfsmap_merge_fixed_metadata(struct list_head *meta_list)
{
        struct ext4_fsmap *p;
        struct ext4_fsmap *prev = NULL;
        struct ext4_fsmap *tmp;

        list_for_each_entry_safe(p, tmp, meta_list, fmr_list) {
                if (!prev) {
                        prev = p;
                        continue;
                }

                if (prev->fmr_owner == p->fmr_owner &&
                    prev->fmr_physical + prev->fmr_length == p->fmr_physical) {
                        prev->fmr_length += p->fmr_length;
                        list_del(&p->fmr_list);
                        kfree(p);
                } else
                        prev = p;
        }
}

/* Free a list of fixed metadata. */
static void ext4_getfsmap_free_fixed_metadata(struct list_head *meta_list)
{
        struct ext4_fsmap *p;
        struct ext4_fsmap *tmp;

        list_for_each_entry_safe(p, tmp, meta_list, fmr_list) {
                list_del(&p->fmr_list);
                kfree(p);
        }
}

/* Find all the fixed metadata in the filesystem. */
static int ext4_getfsmap_find_fixed_metadata(struct super_block *sb,
                                             struct list_head *meta_list)
{
        struct ext4_group_desc *gdp;
        ext4_group_t agno;
        int error;

        INIT_LIST_HEAD(meta_list);

        /* Collect everything. */
        for (agno = 0; agno < EXT4_SB(sb)->s_groups_count; agno++) {
                gdp = ext4_get_group_desc(sb, agno, NULL);
                if (!gdp) {
                        error = -EFSCORRUPTED;
                        goto err;
                }

                /* Superblock & GDT */
                error = ext4_getfsmap_find_sb(sb, agno, meta_list);
                if (error)
                        goto err;

                /* Block bitmap */
                error = ext4_getfsmap_fill(meta_list,
                                           ext4_block_bitmap(sb, gdp), 1,
                                           EXT4_FMR_OWN_BLKBM);
                if (error)
                        goto err;

                /* Inode bitmap */
                error = ext4_getfsmap_fill(meta_list,
                                           ext4_inode_bitmap(sb, gdp), 1,
                                           EXT4_FMR_OWN_INOBM);
                if (error)
                        goto err;

                /* Inodes */
                error = ext4_getfsmap_fill(meta_list,
                                           ext4_inode_table(sb, gdp),
                                           EXT4_SB(sb)->s_itb_per_group,
                                           EXT4_FMR_OWN_INODES);
                if (error)
                        goto err;
        }

        /* Sort the list */
        list_sort(NULL, meta_list, ext4_getfsmap_compare);

        /* Merge adjacent extents */
        ext4_getfsmap_merge_fixed_metadata(meta_list);

        return 0;
err:
        ext4_getfsmap_free_fixed_metadata(meta_list);
        return error;
}

/* Execute a getfsmap query against the buddy bitmaps */
static int ext4_getfsmap_datadev(struct super_block *sb,
                                 struct ext4_fsmap *keys,
                                 struct ext4_getfsmap_info *info)
{
        struct ext4_sb_info *sbi = EXT4_SB(sb);
        ext4_fsblk_t start_fsb;
        ext4_fsblk_t end_fsb;
        ext4_fsblk_t bofs;
        ext4_fsblk_t eofs;
        ext4_group_t start_ag;
        ext4_group_t end_ag;
        ext4_grpblk_t first_cluster;
        ext4_grpblk_t last_cluster;
        int error = 0;

        bofs = le32_to_cpu(sbi->s_es->s_first_data_block);
        eofs = ext4_blocks_count(sbi->s_es);
        if (keys[0].fmr_physical >= eofs)
                return 0;
        else if (keys[0].fmr_physical < bofs)
                keys[0].fmr_physical = bofs;
        if (keys[1].fmr_physical >= eofs)
                keys[1].fmr_physical = eofs - 1;
        if (keys[1].fmr_physical < keys[0].fmr_physical)
                return 0;
        start_fsb = keys[0].fmr_physical;
        end_fsb = keys[1].fmr_physical;

        /* Determine first and last group to examine based on start and end */
        ext4_get_group_no_and_offset(sb, start_fsb, &start_ag, &first_cluster);
        ext4_get_group_no_and_offset(sb, end_fsb, &end_ag, &last_cluster);

        /*
         * Convert the fsmap low/high keys to bg based keys.  Initialize
         * low to the fsmap low key and max out the high key to the end
         * of the bg.
         */
        info->gfi_low = keys[0];
        info->gfi_low.fmr_physical = EXT4_C2B(sbi, first_cluster);
        info->gfi_low.fmr_length = 0;

        memset(&info->gfi_high, 0xFF, sizeof(info->gfi_high));

        /* Assemble a list of all the fixed-location metadata. */
        error = ext4_getfsmap_find_fixed_metadata(sb, &info->gfi_meta_list);
        if (error)
                goto err;

        /* Query each bg */
        for (info->gfi_agno = start_ag;
             info->gfi_agno <= end_ag;
             info->gfi_agno++) {
                /*
                 * Set the bg high key from the fsmap high key if this
                 * is the last bg that we're querying.
                 */
                if (info->gfi_agno == end_ag) {
                        info->gfi_high = keys[1];
                        info->gfi_high.fmr_physical = EXT4_C2B(sbi,
                                        last_cluster);
                        info->gfi_high.fmr_length = 0;
                }

                trace_ext4_fsmap_low_key(sb, info->gfi_dev, info->gfi_agno,
                                info->gfi_low.fmr_physical,
                                info->gfi_low.fmr_length,
                                info->gfi_low.fmr_owner);

                trace_ext4_fsmap_high_key(sb, info->gfi_dev, info->gfi_agno,
                                info->gfi_high.fmr_physical,
                                info->gfi_high.fmr_length,
                                info->gfi_high.fmr_owner);

                error = ext4_mballoc_query_range(sb, info->gfi_agno,
                                EXT4_B2C(sbi, info->gfi_low.fmr_physical),
                                EXT4_B2C(sbi, info->gfi_high.fmr_physical),
                                ext4_getfsmap_datadev_helper, info);
                if (error)
                        goto err;

                /*
                 * Set the bg low key to the start of the bg prior to
                 * moving on to the next bg.
                 */
                if (info->gfi_agno == start_ag)
                        memset(&info->gfi_low, 0, sizeof(info->gfi_low));
        }

        /* Do we have a retained free extent? */
        if (info->gfi_lastfree.fmr_owner) {
                error = ext4_getfsmap_helper(sb, info, &info->gfi_lastfree);
                if (error)
                        goto err;
        }

        /* Report any gaps at the end of the bg */
        info->gfi_last = true;
        error = ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster, 0, info);
        if (error)
                goto err;

err:
        ext4_getfsmap_free_fixed_metadata(&info->gfi_meta_list);
        return error;
}

/* Do we recognize the device? */
static bool ext4_getfsmap_is_valid_device(struct super_block *sb,
                                          struct ext4_fsmap *fm)
{
        if (fm->fmr_device == 0 || fm->fmr_device == UINT_MAX ||
            fm->fmr_device == new_encode_dev(sb->s_bdev->bd_dev))
                return true;
        if (EXT4_SB(sb)->s_journal_bdev_file &&
            fm->fmr_device ==
            new_encode_dev(file_bdev(EXT4_SB(sb)->s_journal_bdev_file)->bd_dev))
                return true;
        return false;
}

/* Ensure that the low key is less than the high key. */
static bool ext4_getfsmap_check_keys(struct ext4_fsmap *low_key,
                                     struct ext4_fsmap *high_key)
{
        if (low_key->fmr_device > high_key->fmr_device)
                return false;
        if (low_key->fmr_device < high_key->fmr_device)
                return true;

        if (low_key->fmr_physical > high_key->fmr_physical)
                return false;
        if (low_key->fmr_physical < high_key->fmr_physical)
                return true;

        if (low_key->fmr_owner > high_key->fmr_owner)
                return false;
        if (low_key->fmr_owner < high_key->fmr_owner)
                return true;

        return false;
}

#define EXT4_GETFSMAP_DEVS        2
/*
 * Get filesystem's extents as described in head, and format for
 * output.  Calls formatter to fill the user's buffer until all
 * extents are mapped, until the passed-in head->fmh_count slots have
 * been filled, or until the formatter short-circuits the loop, if it
 * is tracking filled-in extents on its own.
 *
 * Key to Confusion
 * ----------------
 * There are multiple levels of keys and counters at work here:
 * _fsmap_head.fmh_keys                -- low and high fsmap keys passed in;
 *                                    these reflect fs-wide block addrs.
 * dkeys                        -- fmh_keys used to query each device;
 *                                    these are fmh_keys but w/ the low key
 *                                    bumped up by fmr_length.
 * _getfsmap_info.gfi_next_fsblk-- next fs block we expect to see; this
 *                                   is how we detect gaps in the fsmap
 *                                   records and report them.
 * _getfsmap_info.gfi_low/high        -- per-bg low/high keys computed from
 *                                    dkeys; used to query the free space.
 */
int ext4_getfsmap(struct super_block *sb, struct ext4_fsmap_head *head,
                  ext4_fsmap_format_t formatter, void *arg)
{
        struct ext4_fsmap dkeys[2];        /* per-dev keys */
        struct ext4_getfsmap_dev handlers[EXT4_GETFSMAP_DEVS];
        struct ext4_getfsmap_info info = { NULL };
        int i;
        int error = 0;

        if (head->fmh_iflags & ~FMH_IF_VALID)
                return -EINVAL;
        if (!ext4_getfsmap_is_valid_device(sb, &head->fmh_keys[0]) ||
            !ext4_getfsmap_is_valid_device(sb, &head->fmh_keys[1]))
                return -EINVAL;

        head->fmh_entries = 0;

        /* Set up our device handlers. */
        memset(handlers, 0, sizeof(handlers));
        handlers[0].gfd_dev = new_encode_dev(sb->s_bdev->bd_dev);
        handlers[0].gfd_fn = ext4_getfsmap_datadev;
        if (EXT4_SB(sb)->s_journal_bdev_file) {
                handlers[1].gfd_dev = new_encode_dev(
                        file_bdev(EXT4_SB(sb)->s_journal_bdev_file)->bd_dev);
                handlers[1].gfd_fn = ext4_getfsmap_logdev;
        }

        sort(handlers, EXT4_GETFSMAP_DEVS, sizeof(struct ext4_getfsmap_dev),
                        ext4_getfsmap_dev_compare, NULL);

        /*
         * To continue where we left off, we allow userspace to use the
         * last mapping from a previous call as the low key of the next.
         * This is identified by a non-zero length in the low key. We
         * have to increment the low key in this scenario to ensure we
         * don't return the same mapping again, and instead return the
         * very next mapping.
         *
         * Bump the physical offset as there can be no other mapping for
         * the same physical block range.
         */
        dkeys[0] = head->fmh_keys[0];
        dkeys[0].fmr_physical += dkeys[0].fmr_length;
        dkeys[0].fmr_owner = 0;
        dkeys[0].fmr_length = 0;
        memset(&dkeys[1], 0xFF, sizeof(struct ext4_fsmap));

        if (!ext4_getfsmap_check_keys(dkeys, &head->fmh_keys[1]))
                return -EINVAL;

        info.gfi_next_fsblk = head->fmh_keys[0].fmr_physical +
                          head->fmh_keys[0].fmr_length;
        info.gfi_formatter = formatter;
        info.gfi_format_arg = arg;
        info.gfi_head = head;

        /* For each device we support... */
        for (i = 0; i < EXT4_GETFSMAP_DEVS; i++) {
                /* Is this device within the range the user asked for? */
                if (!handlers[i].gfd_fn)
                        continue;
                if (head->fmh_keys[0].fmr_device > handlers[i].gfd_dev)
                        continue;
                if (head->fmh_keys[1].fmr_device < handlers[i].gfd_dev)
                        break;

                /*
                 * If this device number matches the high key, we have
                 * to pass the high key to the handler to limit the
                 * query results.  If the device number exceeds the
                 * low key, zero out the low key so that we get
                 * everything from the beginning.
                 */
                if (handlers[i].gfd_dev == head->fmh_keys[1].fmr_device)
                        dkeys[1] = head->fmh_keys[1];
                if (handlers[i].gfd_dev > head->fmh_keys[0].fmr_device)
                        memset(&dkeys[0], 0, sizeof(struct ext4_fsmap));

                info.gfi_dev = handlers[i].gfd_dev;
                info.gfi_last = false;
                info.gfi_agno = -1;
                error = handlers[i].gfd_fn(sb, dkeys, &info);
                if (error)
                        break;
                info.gfi_next_fsblk = 0;
        }

        head->fmh_oflags = FMH_OF_DEV_T;
        return error;
}








































   21 


    5 











  107 



    3 



  103 













   24 





    2 








   20 

    2 










    4 





    1 






    3 











    6 






    1 



    1 


















    3 

    1 






    1 









    3 





    1 








    2 












   15 





    1 






    1 









    1 



    2 


   11 





    4 
















   12 















   12 






   12 



   12 







    7 










    7 









    8 









    4 


    5 


















   17 









    1 



    1 










    3 













    3 


    3 


    2 
    1 


    3 

    5 


    1 












    6 

    2 


    8 









    3 

    7 




























    1 



    1 





    1 

    2 








    6 


    1 




    5 
















    5 








    1 




    4 

















































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
// SPDX-License-Identifier: GPL-2.0+
/*
 * NILFS pathname lookup operations.
 *
 * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
 *
 * Modified for NILFS by Amagai Yoshiji and Ryusuke Konishi.
 */
/*
 *  linux/fs/ext2/namei.c
 *
 * Copyright (C) 1992, 1993, 1994, 1995
 * Remy Card (card@masi.ibp.fr)
 * Laboratoire MASI - Institut Blaise Pascal
 * Universite Pierre et Marie Curie (Paris VI)
 *
 *  from
 *
 *  linux/fs/minix/namei.c
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 *
 *  Big-endian to little-endian byte-swapping/bitmaps by
 *        David S. Miller (davem@caip.rutgers.edu), 1995
 */

#include <linux/pagemap.h>
#include "nilfs.h"
#include "export.h"

#define NILFS_FID_SIZE_NON_CONNECTABLE \
        (offsetof(struct nilfs_fid, parent_gen) / 4)
#define NILFS_FID_SIZE_CONNECTABLE        (sizeof(struct nilfs_fid) / 4)

static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode)
{
        int err = nilfs_add_link(dentry, inode);

        if (!err) {
                d_instantiate_new(dentry, inode);
                return 0;
        }
        inode_dec_link_count(inode);
        unlock_new_inode(inode);
        iput(inode);
        return err;
}

/*
 * Methods themselves.
 */

static struct dentry *
nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
{
        struct inode *inode;
        ino_t ino;

        if (dentry->d_name.len > NILFS_NAME_LEN)
                return ERR_PTR(-ENAMETOOLONG);

        ino = nilfs_inode_by_name(dir, &dentry->d_name);
        inode = ino ? nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino) : NULL;
        return d_splice_alias(inode, dentry);
}

/*
 * By the time this is called, we already have created
 * the directory cache entry for the new file, but it
 * is so far negative - it has no inode.
 *
 * If the create succeeds, we fill in the inode information
 * with d_instantiate().
 */
static int nilfs_create(struct mnt_idmap *idmap, struct inode *dir,
                        struct dentry *dentry, umode_t mode, bool excl)
{
        struct inode *inode;
        struct nilfs_transaction_info ti;
        int err;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 1);
        if (err)
                return err;
        inode = nilfs_new_inode(dir, mode);
        err = PTR_ERR(inode);
        if (!IS_ERR(inode)) {
                inode->i_op = &nilfs_file_inode_operations;
                inode->i_fop = &nilfs_file_operations;
                inode->i_mapping->a_ops = &nilfs_aops;
                nilfs_mark_inode_dirty(inode);
                err = nilfs_add_nondir(dentry, inode);
        }
        if (!err)
                err = nilfs_transaction_commit(dir->i_sb);
        else
                nilfs_transaction_abort(dir->i_sb);

        return err;
}

static int
nilfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
            struct dentry *dentry, umode_t mode, dev_t rdev)
{
        struct inode *inode;
        struct nilfs_transaction_info ti;
        int err;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 1);
        if (err)
                return err;
        inode = nilfs_new_inode(dir, mode);
        err = PTR_ERR(inode);
        if (!IS_ERR(inode)) {
                init_special_inode(inode, inode->i_mode, rdev);
                nilfs_mark_inode_dirty(inode);
                err = nilfs_add_nondir(dentry, inode);
        }
        if (!err)
                err = nilfs_transaction_commit(dir->i_sb);
        else
                nilfs_transaction_abort(dir->i_sb);

        return err;
}

static int nilfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
                         struct dentry *dentry, const char *symname)
{
        struct nilfs_transaction_info ti;
        struct super_block *sb = dir->i_sb;
        unsigned int l = strlen(symname) + 1;
        struct inode *inode;
        int err;

        if (l > sb->s_blocksize)
                return -ENAMETOOLONG;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 1);
        if (err)
                return err;

        inode = nilfs_new_inode(dir, S_IFLNK | 0777);
        err = PTR_ERR(inode);
        if (IS_ERR(inode))
                goto out;

        /* slow symlink */
        inode->i_op = &nilfs_symlink_inode_operations;
        inode_nohighmem(inode);
        inode->i_mapping->a_ops = &nilfs_aops;
        err = page_symlink(inode, symname, l);
        if (err)
                goto out_fail;

        /* mark_inode_dirty(inode); */
        /* page_symlink() do this */

        err = nilfs_add_nondir(dentry, inode);
out:
        if (!err)
                err = nilfs_transaction_commit(dir->i_sb);
        else
                nilfs_transaction_abort(dir->i_sb);

        return err;

out_fail:
        drop_nlink(inode);
        nilfs_mark_inode_dirty(inode);
        unlock_new_inode(inode);
        iput(inode);
        goto out;
}

static int nilfs_link(struct dentry *old_dentry, struct inode *dir,
                      struct dentry *dentry)
{
        struct inode *inode = d_inode(old_dentry);
        struct nilfs_transaction_info ti;
        int err;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 1);
        if (err)
                return err;

        inode_set_ctime_current(inode);
        inode_inc_link_count(inode);
        ihold(inode);

        err = nilfs_add_link(dentry, inode);
        if (!err) {
                d_instantiate(dentry, inode);
                err = nilfs_transaction_commit(dir->i_sb);
        } else {
                inode_dec_link_count(inode);
                iput(inode);
                nilfs_transaction_abort(dir->i_sb);
        }

        return err;
}

static int nilfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
                       struct dentry *dentry, umode_t mode)
{
        struct inode *inode;
        struct nilfs_transaction_info ti;
        int err;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 1);
        if (err)
                return err;

        inc_nlink(dir);

        inode = nilfs_new_inode(dir, S_IFDIR | mode);
        err = PTR_ERR(inode);
        if (IS_ERR(inode))
                goto out_dir;

        inode->i_op = &nilfs_dir_inode_operations;
        inode->i_fop = &nilfs_dir_operations;
        inode->i_mapping->a_ops = &nilfs_aops;

        inc_nlink(inode);

        err = nilfs_make_empty(inode, dir);
        if (err)
                goto out_fail;

        err = nilfs_add_link(dentry, inode);
        if (err)
                goto out_fail;

        nilfs_mark_inode_dirty(inode);
        d_instantiate_new(dentry, inode);
out:
        if (!err)
                err = nilfs_transaction_commit(dir->i_sb);
        else
                nilfs_transaction_abort(dir->i_sb);

        return err;

out_fail:
        drop_nlink(inode);
        drop_nlink(inode);
        nilfs_mark_inode_dirty(inode);
        unlock_new_inode(inode);
        iput(inode);
out_dir:
        drop_nlink(dir);
        nilfs_mark_inode_dirty(dir);
        goto out;
}

static int nilfs_do_unlink(struct inode *dir, struct dentry *dentry)
{
        struct inode *inode;
        struct nilfs_dir_entry *de;
        struct folio *folio;
        int err;

        err = -ENOENT;
        de = nilfs_find_entry(dir, &dentry->d_name, &folio);
        if (!de)
                goto out;

        inode = d_inode(dentry);
        err = -EIO;
        if (le64_to_cpu(de->inode) != inode->i_ino)
                goto out;

        if (!inode->i_nlink) {
                nilfs_warn(inode->i_sb,
                           "deleting nonexistent file (ino=%lu), %d",
                           inode->i_ino, inode->i_nlink);
                set_nlink(inode, 1);
        }
        err = nilfs_delete_entry(de, folio);
        folio_release_kmap(folio, de);
        if (err)
                goto out;

        inode_set_ctime_to_ts(inode, inode_get_ctime(dir));
        drop_nlink(inode);
        err = 0;
out:
        return err;
}

static int nilfs_unlink(struct inode *dir, struct dentry *dentry)
{
        struct nilfs_transaction_info ti;
        int err;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 0);
        if (err)
                return err;

        err = nilfs_do_unlink(dir, dentry);

        if (!err) {
                nilfs_mark_inode_dirty(dir);
                nilfs_mark_inode_dirty(d_inode(dentry));
                err = nilfs_transaction_commit(dir->i_sb);
        } else
                nilfs_transaction_abort(dir->i_sb);

        return err;
}

static int nilfs_rmdir(struct inode *dir, struct dentry *dentry)
{
        struct inode *inode = d_inode(dentry);
        struct nilfs_transaction_info ti;
        int err;

        err = nilfs_transaction_begin(dir->i_sb, &ti, 0);
        if (err)
                return err;

        err = -ENOTEMPTY;
        if (nilfs_empty_dir(inode)) {
                err = nilfs_do_unlink(dir, dentry);
                if (!err) {
                        inode->i_size = 0;
                        drop_nlink(inode);
                        nilfs_mark_inode_dirty(inode);
                        drop_nlink(dir);
                        nilfs_mark_inode_dirty(dir);
                }
        }
        if (!err)
                err = nilfs_transaction_commit(dir->i_sb);
        else
                nilfs_transaction_abort(dir->i_sb);

        return err;
}

static int nilfs_rename(struct mnt_idmap *idmap,
                        struct inode *old_dir, struct dentry *old_dentry,
                        struct inode *new_dir, struct dentry *new_dentry,
                        unsigned int flags)
{
        struct inode *old_inode = d_inode(old_dentry);
        struct inode *new_inode = d_inode(new_dentry);
        struct folio *dir_folio = NULL;
        struct nilfs_dir_entry *dir_de = NULL;
        struct folio *old_folio;
        struct nilfs_dir_entry *old_de;
        struct nilfs_transaction_info ti;
        int err;

        if (flags & ~RENAME_NOREPLACE)
                return -EINVAL;

        err = nilfs_transaction_begin(old_dir->i_sb, &ti, 1);
        if (unlikely(err))
                return err;

        err = -ENOENT;
        old_de = nilfs_find_entry(old_dir, &old_dentry->d_name, &old_folio);
        if (!old_de)
                goto out;

        if (S_ISDIR(old_inode->i_mode)) {
                err = -EIO;
                dir_de = nilfs_dotdot(old_inode, &dir_folio);
                if (!dir_de)
                        goto out_old;
        }

        if (new_inode) {
                struct folio *new_folio;
                struct nilfs_dir_entry *new_de;

                err = -ENOTEMPTY;
                if (dir_de && !nilfs_empty_dir(new_inode))
                        goto out_dir;

                err = -ENOENT;
                new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, &new_folio);
                if (!new_de)
                        goto out_dir;
                nilfs_set_link(new_dir, new_de, new_folio, old_inode);
                folio_release_kmap(new_folio, new_de);
                nilfs_mark_inode_dirty(new_dir);
                inode_set_ctime_current(new_inode);
                if (dir_de)
                        drop_nlink(new_inode);
                drop_nlink(new_inode);
                nilfs_mark_inode_dirty(new_inode);
        } else {
                err = nilfs_add_link(new_dentry, old_inode);
                if (err)
                        goto out_dir;
                if (dir_de) {
                        inc_nlink(new_dir);
                        nilfs_mark_inode_dirty(new_dir);
                }
        }

        /*
         * Like most other Unix systems, set the ctime for inodes on a
         * rename.
         */
        inode_set_ctime_current(old_inode);

        nilfs_delete_entry(old_de, old_folio);

        if (dir_de) {
                nilfs_set_link(old_inode, dir_de, dir_folio, new_dir);
                folio_release_kmap(dir_folio, dir_de);
                drop_nlink(old_dir);
        }
        folio_release_kmap(old_folio, old_de);

        nilfs_mark_inode_dirty(old_dir);
        nilfs_mark_inode_dirty(old_inode);

        err = nilfs_transaction_commit(old_dir->i_sb);
        return err;

out_dir:
        if (dir_de)
                folio_release_kmap(dir_folio, dir_de);
out_old:
        folio_release_kmap(old_folio, old_de);
out:
        nilfs_transaction_abort(old_dir->i_sb);
        return err;
}

/*
 * Export operations
 */
static struct dentry *nilfs_get_parent(struct dentry *child)
{
        unsigned long ino;
        struct nilfs_root *root;

        ino = nilfs_inode_by_name(d_inode(child), &dotdot_name);
        if (!ino)
                return ERR_PTR(-ENOENT);

        root = NILFS_I(d_inode(child))->i_root;

        return d_obtain_alias(nilfs_iget(child->d_sb, root, ino));
}

static struct dentry *nilfs_get_dentry(struct super_block *sb, u64 cno,
                                       u64 ino, u32 gen)
{
        struct nilfs_root *root;
        struct inode *inode;

        if (ino < NILFS_FIRST_INO(sb) && ino != NILFS_ROOT_INO)
                return ERR_PTR(-ESTALE);

        root = nilfs_lookup_root(sb->s_fs_info, cno);
        if (!root)
                return ERR_PTR(-ESTALE);

        inode = nilfs_iget(sb, root, ino);
        nilfs_put_root(root);

        if (IS_ERR(inode))
                return ERR_CAST(inode);
        if (gen && inode->i_generation != gen) {
                iput(inode);
                return ERR_PTR(-ESTALE);
        }
        return d_obtain_alias(inode);
}

static struct dentry *nilfs_fh_to_dentry(struct super_block *sb, struct fid *fh,
                                         int fh_len, int fh_type)
{
        struct nilfs_fid *fid = (struct nilfs_fid *)fh;

        if (fh_len < NILFS_FID_SIZE_NON_CONNECTABLE ||
            (fh_type != FILEID_NILFS_WITH_PARENT &&
             fh_type != FILEID_NILFS_WITHOUT_PARENT))
                return NULL;

        return nilfs_get_dentry(sb, fid->cno, fid->ino, fid->gen);
}

static struct dentry *nilfs_fh_to_parent(struct super_block *sb, struct fid *fh,
                                         int fh_len, int fh_type)
{
        struct nilfs_fid *fid = (struct nilfs_fid *)fh;

        if (fh_len < NILFS_FID_SIZE_CONNECTABLE ||
            fh_type != FILEID_NILFS_WITH_PARENT)
                return NULL;

        return nilfs_get_dentry(sb, fid->cno, fid->parent_ino, fid->parent_gen);
}

static int nilfs_encode_fh(struct inode *inode, __u32 *fh, int *lenp,
                           struct inode *parent)
{
        struct nilfs_fid *fid = (struct nilfs_fid *)fh;
        struct nilfs_root *root = NILFS_I(inode)->i_root;
        int type;

        if (parent && *lenp < NILFS_FID_SIZE_CONNECTABLE) {
                *lenp = NILFS_FID_SIZE_CONNECTABLE;
                return FILEID_INVALID;
        }
        if (*lenp < NILFS_FID_SIZE_NON_CONNECTABLE) {
                *lenp = NILFS_FID_SIZE_NON_CONNECTABLE;
                return FILEID_INVALID;
        }

        fid->cno = root->cno;
        fid->ino = inode->i_ino;
        fid->gen = inode->i_generation;

        if (parent) {
                fid->parent_ino = parent->i_ino;
                fid->parent_gen = parent->i_generation;
                type = FILEID_NILFS_WITH_PARENT;
                *lenp = NILFS_FID_SIZE_CONNECTABLE;
        } else {
                type = FILEID_NILFS_WITHOUT_PARENT;
                *lenp = NILFS_FID_SIZE_NON_CONNECTABLE;
        }

        return type;
}

const struct inode_operations nilfs_dir_inode_operations = {
        .create                = nilfs_create,
        .lookup                = nilfs_lookup,
        .link                = nilfs_link,
        .unlink                = nilfs_unlink,
        .symlink        = nilfs_symlink,
        .mkdir                = nilfs_mkdir,
        .rmdir                = nilfs_rmdir,
        .mknod                = nilfs_mknod,
        .rename                = nilfs_rename,
        .setattr        = nilfs_setattr,
        .permission        = nilfs_permission,
        .fiemap                = nilfs_fiemap,
        .fileattr_get        = nilfs_fileattr_get,
        .fileattr_set        = nilfs_fileattr_set,
};

const struct inode_operations nilfs_special_inode_operations = {
        .setattr        = nilfs_setattr,
        .permission        = nilfs_permission,
};

const struct inode_operations nilfs_symlink_inode_operations = {
        .get_link        = page_get_link,
        .permission     = nilfs_permission,
};

const struct export_operations nilfs_export_ops = {
        .encode_fh = nilfs_encode_fh,
        .fh_to_dentry = nilfs_fh_to_dentry,
        .fh_to_parent = nilfs_fh_to_parent,
        .get_parent = nilfs_get_parent,
};







































































































   14 






















   12 


   14 




   14 





   14 
































   20 




















   20 

   20 












   20 







   20 





   20 

































   17 
























































































































   17 














   17 

































   17 

   17 





   17 









   17 























   17 







   17 





   17 

















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
/*
 * xxHash - Extremely Fast Hash algorithm
 * Copyright (C) 2012-2016, Yann Collet.
 *
 * BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php)
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *   * Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *   * Redistributions in binary form must reproduce the above
 *     copyright notice, this list of conditions and the following disclaimer
 *     in the documentation and/or other materials provided with the
 *     distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * This program is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License version 2 as published by the
 * Free Software Foundation. This program is dual-licensed; you may select
 * either version 2 of the GNU General Public License ("GPL") or BSD license
 * ("BSD").
 *
 * You can contact the author at:
 * - xxHash homepage: https://cyan4973.github.io/xxHash/
 * - xxHash source repository: https://github.com/Cyan4973/xxHash
 */

#include <linux/unaligned.h>
#include <linux/errno.h>
#include <linux/compiler.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/string.h>
#include <linux/xxhash.h>

/*-*************************************
 * Macros
 **************************************/
#define xxh_rotl32(x, r) ((x << r) | (x >> (32 - r)))
#define xxh_rotl64(x, r) ((x << r) | (x >> (64 - r)))

#ifdef __LITTLE_ENDIAN
# define XXH_CPU_LITTLE_ENDIAN 1
#else
# define XXH_CPU_LITTLE_ENDIAN 0
#endif

/*-*************************************
 * Constants
 **************************************/
static const uint32_t PRIME32_1 = 2654435761U;
static const uint32_t PRIME32_2 = 2246822519U;
static const uint32_t PRIME32_3 = 3266489917U;
static const uint32_t PRIME32_4 =  668265263U;
static const uint32_t PRIME32_5 =  374761393U;

static const uint64_t PRIME64_1 = 11400714785074694791ULL;
static const uint64_t PRIME64_2 = 14029467366897019727ULL;
static const uint64_t PRIME64_3 =  1609587929392839161ULL;
static const uint64_t PRIME64_4 =  9650029242287828579ULL;
static const uint64_t PRIME64_5 =  2870177450012600261ULL;

/*-**************************
 *  Utils
 ***************************/
void xxh32_copy_state(struct xxh32_state *dst, const struct xxh32_state *src)
{
        memcpy(dst, src, sizeof(*dst));
}
EXPORT_SYMBOL(xxh32_copy_state);

void xxh64_copy_state(struct xxh64_state *dst, const struct xxh64_state *src)
{
        memcpy(dst, src, sizeof(*dst));
}
EXPORT_SYMBOL(xxh64_copy_state);

/*-***************************
 * Simple Hash Functions
 ****************************/
static uint32_t xxh32_round(uint32_t seed, const uint32_t input)
{
        seed += input * PRIME32_2;
        seed = xxh_rotl32(seed, 13);
        seed *= PRIME32_1;
        return seed;
}

uint32_t xxh32(const void *input, const size_t len, const uint32_t seed)
{
        const uint8_t *p = (const uint8_t *)input;
        const uint8_t *b_end = p + len;
        uint32_t h32;

        if (len >= 16) {
                const uint8_t *const limit = b_end - 16;
                uint32_t v1 = seed + PRIME32_1 + PRIME32_2;
                uint32_t v2 = seed + PRIME32_2;
                uint32_t v3 = seed + 0;
                uint32_t v4 = seed - PRIME32_1;

                do {
                        v1 = xxh32_round(v1, get_unaligned_le32(p));
                        p += 4;
                        v2 = xxh32_round(v2, get_unaligned_le32(p));
                        p += 4;
                        v3 = xxh32_round(v3, get_unaligned_le32(p));
                        p += 4;
                        v4 = xxh32_round(v4, get_unaligned_le32(p));
                        p += 4;
                } while (p <= limit);

                h32 = xxh_rotl32(v1, 1) + xxh_rotl32(v2, 7) +
                        xxh_rotl32(v3, 12) + xxh_rotl32(v4, 18);
        } else {
                h32 = seed + PRIME32_5;
        }

        h32 += (uint32_t)len;

        while (p + 4 <= b_end) {
                h32 += get_unaligned_le32(p) * PRIME32_3;
                h32 = xxh_rotl32(h32, 17) * PRIME32_4;
                p += 4;
        }

        while (p < b_end) {
                h32 += (*p) * PRIME32_5;
                h32 = xxh_rotl32(h32, 11) * PRIME32_1;
                p++;
        }

        h32 ^= h32 >> 15;
        h32 *= PRIME32_2;
        h32 ^= h32 >> 13;
        h32 *= PRIME32_3;
        h32 ^= h32 >> 16;

        return h32;
}
EXPORT_SYMBOL(xxh32);

static uint64_t xxh64_round(uint64_t acc, const uint64_t input)
{
        acc += input * PRIME64_2;
        acc = xxh_rotl64(acc, 31);
        acc *= PRIME64_1;
        return acc;
}

static uint64_t xxh64_merge_round(uint64_t acc, uint64_t val)
{
        val = xxh64_round(0, val);
        acc ^= val;
        acc = acc * PRIME64_1 + PRIME64_4;
        return acc;
}

uint64_t xxh64(const void *input, const size_t len, const uint64_t seed)
{
        const uint8_t *p = (const uint8_t *)input;
        const uint8_t *const b_end = p + len;
        uint64_t h64;

        if (len >= 32) {
                const uint8_t *const limit = b_end - 32;
                uint64_t v1 = seed + PRIME64_1 + PRIME64_2;
                uint64_t v2 = seed + PRIME64_2;
                uint64_t v3 = seed + 0;
                uint64_t v4 = seed - PRIME64_1;

                do {
                        v1 = xxh64_round(v1, get_unaligned_le64(p));
                        p += 8;
                        v2 = xxh64_round(v2, get_unaligned_le64(p));
                        p += 8;
                        v3 = xxh64_round(v3, get_unaligned_le64(p));
                        p += 8;
                        v4 = xxh64_round(v4, get_unaligned_le64(p));
                        p += 8;
                } while (p <= limit);

                h64 = xxh_rotl64(v1, 1) + xxh_rotl64(v2, 7) +
                        xxh_rotl64(v3, 12) + xxh_rotl64(v4, 18);
                h64 = xxh64_merge_round(h64, v1);
                h64 = xxh64_merge_round(h64, v2);
                h64 = xxh64_merge_round(h64, v3);
                h64 = xxh64_merge_round(h64, v4);

        } else {
                h64  = seed + PRIME64_5;
        }

        h64 += (uint64_t)len;

        while (p + 8 <= b_end) {
                const uint64_t k1 = xxh64_round(0, get_unaligned_le64(p));

                h64 ^= k1;
                h64 = xxh_rotl64(h64, 27) * PRIME64_1 + PRIME64_4;
                p += 8;
        }

        if (p + 4 <= b_end) {
                h64 ^= (uint64_t)(get_unaligned_le32(p)) * PRIME64_1;
                h64 = xxh_rotl64(h64, 23) * PRIME64_2 + PRIME64_3;
                p += 4;
        }

        while (p < b_end) {
                h64 ^= (*p) * PRIME64_5;
                h64 = xxh_rotl64(h64, 11) * PRIME64_1;
                p++;
        }

        h64 ^= h64 >> 33;
        h64 *= PRIME64_2;
        h64 ^= h64 >> 29;
        h64 *= PRIME64_3;
        h64 ^= h64 >> 32;

        return h64;
}
EXPORT_SYMBOL(xxh64);

/*-**************************************************
 * Advanced Hash Functions
 ***************************************************/
void xxh32_reset(struct xxh32_state *statePtr, const uint32_t seed)
{
        /* use a local state for memcpy() to avoid strict-aliasing warnings */
        struct xxh32_state state;

        memset(&state, 0, sizeof(state));
        state.v1 = seed + PRIME32_1 + PRIME32_2;
        state.v2 = seed + PRIME32_2;
        state.v3 = seed + 0;
        state.v4 = seed - PRIME32_1;
        memcpy(statePtr, &state, sizeof(state));
}
EXPORT_SYMBOL(xxh32_reset);

void xxh64_reset(struct xxh64_state *statePtr, const uint64_t seed)
{
        /* use a local state for memcpy() to avoid strict-aliasing warnings */
        struct xxh64_state state;

        memset(&state, 0, sizeof(state));
        state.v1 = seed + PRIME64_1 + PRIME64_2;
        state.v2 = seed + PRIME64_2;
        state.v3 = seed + 0;
        state.v4 = seed - PRIME64_1;
        memcpy(statePtr, &state, sizeof(state));
}
EXPORT_SYMBOL(xxh64_reset);

int xxh32_update(struct xxh32_state *state, const void *input, const size_t len)
{
        const uint8_t *p = (const uint8_t *)input;
        const uint8_t *const b_end = p + len;

        if (input == NULL)
                return -EINVAL;

        state->total_len_32 += (uint32_t)len;
        state->large_len |= (len >= 16) | (state->total_len_32 >= 16);

        if (state->memsize + len < 16) { /* fill in tmp buffer */
                memcpy((uint8_t *)(state->mem32) + state->memsize, input, len);
                state->memsize += (uint32_t)len;
                return 0;
        }

        if (state->memsize) { /* some data left from previous update */
                const uint32_t *p32 = state->mem32;

                memcpy((uint8_t *)(state->mem32) + state->memsize, input,
                        16 - state->memsize);

                state->v1 = xxh32_round(state->v1, get_unaligned_le32(p32));
                p32++;
                state->v2 = xxh32_round(state->v2, get_unaligned_le32(p32));
                p32++;
                state->v3 = xxh32_round(state->v3, get_unaligned_le32(p32));
                p32++;
                state->v4 = xxh32_round(state->v4, get_unaligned_le32(p32));
                p32++;

                p += 16-state->memsize;
                state->memsize = 0;
        }

        if (p <= b_end - 16) {
                const uint8_t *const limit = b_end - 16;
                uint32_t v1 = state->v1;
                uint32_t v2 = state->v2;
                uint32_t v3 = state->v3;
                uint32_t v4 = state->v4;

                do {
                        v1 = xxh32_round(v1, get_unaligned_le32(p));
                        p += 4;
                        v2 = xxh32_round(v2, get_unaligned_le32(p));
                        p += 4;
                        v3 = xxh32_round(v3, get_unaligned_le32(p));
                        p += 4;
                        v4 = xxh32_round(v4, get_unaligned_le32(p));
                        p += 4;
                } while (p <= limit);

                state->v1 = v1;
                state->v2 = v2;
                state->v3 = v3;
                state->v4 = v4;
        }

        if (p < b_end) {
                memcpy(state->mem32, p, (size_t)(b_end-p));
                state->memsize = (uint32_t)(b_end-p);
        }

        return 0;
}
EXPORT_SYMBOL(xxh32_update);

uint32_t xxh32_digest(const struct xxh32_state *state)
{
        const uint8_t *p = (const uint8_t *)state->mem32;
        const uint8_t *const b_end = (const uint8_t *)(state->mem32) +
                state->memsize;
        uint32_t h32;

        if (state->large_len) {
                h32 = xxh_rotl32(state->v1, 1) + xxh_rotl32(state->v2, 7) +
                        xxh_rotl32(state->v3, 12) + xxh_rotl32(state->v4, 18);
        } else {
                h32 = state->v3 /* == seed */ + PRIME32_5;
        }

        h32 += state->total_len_32;

        while (p + 4 <= b_end) {
                h32 += get_unaligned_le32(p) * PRIME32_3;
                h32 = xxh_rotl32(h32, 17) * PRIME32_4;
                p += 4;
        }

        while (p < b_end) {
                h32 += (*p) * PRIME32_5;
                h32 = xxh_rotl32(h32, 11) * PRIME32_1;
                p++;
        }

        h32 ^= h32 >> 15;
        h32 *= PRIME32_2;
        h32 ^= h32 >> 13;
        h32 *= PRIME32_3;
        h32 ^= h32 >> 16;

        return h32;
}
EXPORT_SYMBOL(xxh32_digest);

int xxh64_update(struct xxh64_state *state, const void *input, const size_t len)
{
        const uint8_t *p = (const uint8_t *)input;
        const uint8_t *const b_end = p + len;

        if (input == NULL)
                return -EINVAL;

        state->total_len += len;

        if (state->memsize + len < 32) { /* fill in tmp buffer */
                memcpy(((uint8_t *)state->mem64) + state->memsize, input, len);
                state->memsize += (uint32_t)len;
                return 0;
        }

        if (state->memsize) { /* tmp buffer is full */
                uint64_t *p64 = state->mem64;

                memcpy(((uint8_t *)p64) + state->memsize, input,
                        32 - state->memsize);

                state->v1 = xxh64_round(state->v1, get_unaligned_le64(p64));
                p64++;
                state->v2 = xxh64_round(state->v2, get_unaligned_le64(p64));
                p64++;
                state->v3 = xxh64_round(state->v3, get_unaligned_le64(p64));
                p64++;
                state->v4 = xxh64_round(state->v4, get_unaligned_le64(p64));

                p += 32 - state->memsize;
                state->memsize = 0;
        }

        if (p + 32 <= b_end) {
                const uint8_t *const limit = b_end - 32;
                uint64_t v1 = state->v1;
                uint64_t v2 = state->v2;
                uint64_t v3 = state->v3;
                uint64_t v4 = state->v4;

                do {
                        v1 = xxh64_round(v1, get_unaligned_le64(p));
                        p += 8;
                        v2 = xxh64_round(v2, get_unaligned_le64(p));
                        p += 8;
                        v3 = xxh64_round(v3, get_unaligned_le64(p));
                        p += 8;
                        v4 = xxh64_round(v4, get_unaligned_le64(p));
                        p += 8;
                } while (p <= limit);

                state->v1 = v1;
                state->v2 = v2;
                state->v3 = v3;
                state->v4 = v4;
        }

        if (p < b_end) {
                memcpy(state->mem64, p, (size_t)(b_end-p));
                state->memsize = (uint32_t)(b_end - p);
        }

        return 0;
}
EXPORT_SYMBOL(xxh64_update);

uint64_t xxh64_digest(const struct xxh64_state *state)
{
        const uint8_t *p = (const uint8_t *)state->mem64;
        const uint8_t *const b_end = (const uint8_t *)state->mem64 +
                state->memsize;
        uint64_t h64;

        if (state->total_len >= 32) {
                const uint64_t v1 = state->v1;
                const uint64_t v2 = state->v2;
                const uint64_t v3 = state->v3;
                const uint64_t v4 = state->v4;

                h64 = xxh_rotl64(v1, 1) + xxh_rotl64(v2, 7) +
                        xxh_rotl64(v3, 12) + xxh_rotl64(v4, 18);
                h64 = xxh64_merge_round(h64, v1);
                h64 = xxh64_merge_round(h64, v2);
                h64 = xxh64_merge_round(h64, v3);
                h64 = xxh64_merge_round(h64, v4);
        } else {
                h64  = state->v3 + PRIME64_5;
        }

        h64 += (uint64_t)state->total_len;

        while (p + 8 <= b_end) {
                const uint64_t k1 = xxh64_round(0, get_unaligned_le64(p));

                h64 ^= k1;
                h64 = xxh_rotl64(h64, 27) * PRIME64_1 + PRIME64_4;
                p += 8;
        }

        if (p + 4 <= b_end) {
                h64 ^= (uint64_t)(get_unaligned_le32(p)) * PRIME64_1;
                h64 = xxh_rotl64(h64, 23) * PRIME64_2 + PRIME64_3;
                p += 4;
        }

        while (p < b_end) {
                h64 ^= (*p) * PRIME64_5;
                h64 = xxh_rotl64(h64, 11) * PRIME64_1;
                p++;
        }

        h64 ^= h64 >> 33;
        h64 *= PRIME64_2;
        h64 ^= h64 >> 29;
        h64 *= PRIME64_3;
        h64 ^= h64 >> 32;

        return h64;
}
EXPORT_SYMBOL(xxh64_digest);

MODULE_LICENSE("Dual BSD/GPL");
MODULE_DESCRIPTION("xxHash");






















































































































































































































































































































































    2 


    2 










    2 
























































































































































































































































































    2 





















































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
// SPDX-License-Identifier: GPL-2.0-only
/*
 * HID raw devices, giving access to raw HID events.
 *
 * In comparison to hiddev, this device does not process the
 * hid events at all (no parsing, no lookups). This lets applications
 * to work on raw hid events as they want to, and avoids a need to
 * use a transport-specific userspace libhid/libusb libraries.
 *
 *  Copyright (c) 2007-2014 Jiri Kosina
 */


#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/fs.h>
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/cdev.h>
#include <linux/poll.h>
#include <linux/device.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/hid.h>
#include <linux/mutex.h>
#include <linux/sched/signal.h>
#include <linux/string.h>

#include <linux/hidraw.h>

static int hidraw_major;
static struct cdev hidraw_cdev;
static const struct class hidraw_class = {
        .name = "hidraw",
};
static struct hidraw *hidraw_table[HIDRAW_MAX_DEVICES];
static DECLARE_RWSEM(minors_rwsem);

static inline bool hidraw_is_revoked(struct hidraw_list *list)
{
        return list->revoked;
}

static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
{
        struct hidraw_list *list = file->private_data;
        int ret = 0, len;
        DECLARE_WAITQUEUE(wait, current);

        if (hidraw_is_revoked(list))
                return -ENODEV;

        mutex_lock(&list->read_mutex);

        while (ret == 0) {
                if (list->head == list->tail) {
                        add_wait_queue(&list->hidraw->wait, &wait);
                        set_current_state(TASK_INTERRUPTIBLE);

                        while (list->head == list->tail) {
                                if (signal_pending(current)) {
                                        ret = -ERESTARTSYS;
                                        break;
                                }
                                if (!list->hidraw->exist) {
                                        ret = -EIO;
                                        break;
                                }
                                if (file->f_flags & O_NONBLOCK) {
                                        ret = -EAGAIN;
                                        break;
                                }

                                /* allow O_NONBLOCK to work well from other threads */
                                mutex_unlock(&list->read_mutex);
                                schedule();
                                mutex_lock(&list->read_mutex);
                                set_current_state(TASK_INTERRUPTIBLE);
                        }

                        set_current_state(TASK_RUNNING);
                        remove_wait_queue(&list->hidraw->wait, &wait);
                }

                if (ret)
                        goto out;

                len = list->buffer[list->tail].len > count ?
                        count : list->buffer[list->tail].len;

                if (list->buffer[list->tail].value) {
                        if (copy_to_user(buffer, list->buffer[list->tail].value, len)) {
                                ret = -EFAULT;
                                goto out;
                        }
                        ret = len;
                }

                kfree(list->buffer[list->tail].value);
                list->buffer[list->tail].value = NULL;
                list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
        }
out:
        mutex_unlock(&list->read_mutex);
        return ret;
}

/*
 * The first byte of the report buffer is expected to be a report number.
 */
static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, size_t count, unsigned char report_type)
{
        unsigned int minor = iminor(file_inode(file));
        struct hid_device *dev;
        __u8 *buf;
        int ret = 0;

        lockdep_assert_held(&minors_rwsem);

        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                ret = -ENODEV;
                goto out;
        }

        dev = hidraw_table[minor]->hid;

        if (count > HID_MAX_BUFFER_SIZE) {
                hid_warn(dev, "pid %d passed too large report\n",
                         task_pid_nr(current));
                ret = -EINVAL;
                goto out;
        }

        if (count < 2) {
                hid_warn(dev, "pid %d passed too short report\n",
                         task_pid_nr(current));
                ret = -EINVAL;
                goto out;
        }

        buf = memdup_user(buffer, count);
        if (IS_ERR(buf)) {
                ret = PTR_ERR(buf);
                goto out;
        }

        if ((report_type == HID_OUTPUT_REPORT) &&
            !(dev->quirks & HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP)) {
                ret = __hid_hw_output_report(dev, buf, count, (u64)(long)file, false);
                /*
                 * compatibility with old implementation of USB-HID and I2C-HID:
                 * if the device does not support receiving output reports,
                 * on an interrupt endpoint, fallback to SET_REPORT HID command.
                 */
                if (ret != -ENOSYS)
                        goto out_free;
        }

        ret = __hid_hw_raw_request(dev, buf[0], buf, count, report_type,
                                   HID_REQ_SET_REPORT, (u64)(long)file, false);

out_free:
        kfree(buf);
out:
        return ret;
}

static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
{
        struct hidraw_list *list = file->private_data;
        ssize_t ret;
        down_read(&minors_rwsem);
        if (hidraw_is_revoked(list))
                ret = -ENODEV;
        else
                ret = hidraw_send_report(file, buffer, count, HID_OUTPUT_REPORT);
        up_read(&minors_rwsem);
        return ret;
}


/*
 * This function performs a Get_Report transfer over the control endpoint
 * per section 7.2.1 of the HID specification, version 1.1.  The first byte
 * of buffer is the report number to request, or 0x0 if the device does not
 * use numbered reports. The report_type parameter can be HID_FEATURE_REPORT
 * or HID_INPUT_REPORT.
 */
static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t count, unsigned char report_type)
{
        unsigned int minor = iminor(file_inode(file));
        struct hid_device *dev;
        __u8 *buf;
        int ret = 0, len;
        unsigned char report_number;

        lockdep_assert_held(&minors_rwsem);

        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                ret = -ENODEV;
                goto out;
        }

        dev = hidraw_table[minor]->hid;

        if (!dev->ll_driver->raw_request) {
                ret = -ENODEV;
                goto out;
        }

        if (count > HID_MAX_BUFFER_SIZE) {
                hid_warn(dev, "pid %d passed too large report\n",
                        task_pid_nr(current));
                ret = -EINVAL;
                goto out;
        }

        if (count < 2) {
                hid_warn(dev, "pid %d passed too short report\n",
                        task_pid_nr(current));
                ret = -EINVAL;
                goto out;
        }

        buf = kmalloc(count, GFP_KERNEL);
        if (!buf) {
                ret = -ENOMEM;
                goto out;
        }

        /*
         * Read the first byte from the user. This is the report number,
         * which is passed to hid_hw_raw_request().
         */
        if (copy_from_user(&report_number, buffer, 1)) {
                ret = -EFAULT;
                goto out_free;
        }

        ret = __hid_hw_raw_request(dev, report_number, buf, count, report_type,
                                   HID_REQ_GET_REPORT, (u64)(long)file, false);

        if (ret < 0)
                goto out_free;

        len = (ret < count) ? ret : count;

        if (copy_to_user(buffer, buf, len)) {
                ret = -EFAULT;
                goto out_free;
        }

        ret = len;

out_free:
        kfree(buf);
out:
        return ret;
}

static __poll_t hidraw_poll(struct file *file, poll_table *wait)
{
        struct hidraw_list *list = file->private_data;
        __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */

        poll_wait(file, &list->hidraw->wait, wait);
        if (list->head != list->tail)
                mask |= EPOLLIN | EPOLLRDNORM;
        if (!list->hidraw->exist || hidraw_is_revoked(list))
                mask |= EPOLLERR | EPOLLHUP;
        return mask;
}

static int hidraw_open(struct inode *inode, struct file *file)
{
        unsigned int minor = iminor(inode);
        struct hidraw *dev;
        struct hidraw_list *list;
        unsigned long flags;
        int err = 0;

        if (!(list = kzalloc(sizeof(struct hidraw_list), GFP_KERNEL))) {
                err = -ENOMEM;
                goto out;
        }

        /*
         * Technically not writing to the hidraw_table but a write lock is
         * required to protect the device refcount. This is symmetrical to
         * hidraw_release().
         */
        down_write(&minors_rwsem);
        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
                err = -ENODEV;
                goto out_unlock;
        }

        dev = hidraw_table[minor];
        if (!dev->open++) {
                err = hid_hw_power(dev->hid, PM_HINT_FULLON);
                if (err < 0) {
                        dev->open--;
                        goto out_unlock;
                }

                err = hid_hw_open(dev->hid);
                if (err < 0) {
                        hid_hw_power(dev->hid, PM_HINT_NORMAL);
                        dev->open--;
                        goto out_unlock;
                }
        }

        list->hidraw = hidraw_table[minor];
        mutex_init(&list->read_mutex);
        spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
        list_add_tail(&list->node, &hidraw_table[minor]->list);
        spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
        file->private_data = list;
out_unlock:
        up_write(&minors_rwsem);
out:
        if (err < 0)
                kfree(list);
        return err;

}

static int hidraw_fasync(int fd, struct file *file, int on)
{
        struct hidraw_list *list = file->private_data;

        if (hidraw_is_revoked(list))
                return -ENODEV;

        return fasync_helper(fd, file, on, &list->fasync);
}

static void drop_ref(struct hidraw *hidraw, int exists_bit)
{
        if (exists_bit) {
                hidraw->exist = 0;
                if (hidraw->open) {
                        hid_hw_close(hidraw->hid);
                        wake_up_interruptible(&hidraw->wait);
                }
                device_destroy(&hidraw_class,
                               MKDEV(hidraw_major, hidraw->minor));
        } else {
                --hidraw->open;
        }
        if (!hidraw->open) {
                if (!hidraw->exist) {
                        hidraw_table[hidraw->minor] = NULL;
                        kfree(hidraw);
                } else {
                        /* close device for last reader */
                        hid_hw_close(hidraw->hid);
                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                }
        }
}

static int hidraw_release(struct inode * inode, struct file * file)
{
        unsigned int minor = iminor(inode);
        struct hidraw_list *list = file->private_data;
        unsigned long flags;

        down_write(&minors_rwsem);

        spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
        while (list->tail != list->head) {
                kfree(list->buffer[list->tail].value);
                list->buffer[list->tail].value = NULL;
                list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
        }
        list_del(&list->node);
        spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
        kfree(list);

        drop_ref(hidraw_table[minor], 0);

        up_write(&minors_rwsem);
        return 0;
}

static int hidraw_revoke(struct hidraw_list *list)
{
        list->revoked = true;

        return 0;
}

static long hidraw_ioctl(struct file *file, unsigned int cmd,
                                                        unsigned long arg)
{
        struct inode *inode = file_inode(file);
        unsigned int minor = iminor(inode);
        long ret = 0;
        struct hidraw *dev;
        struct hidraw_list *list = file->private_data;
        void __user *user_arg = (void __user*) arg;

        down_read(&minors_rwsem);
        dev = hidraw_table[minor];
        if (!dev || !dev->exist || hidraw_is_revoked(list)) {
                ret = -ENODEV;
                goto out;
        }

        switch (cmd) {
                case HIDIOCGRDESCSIZE:
                        if (put_user(dev->hid->rsize, (int __user *)arg))
                                ret = -EFAULT;
                        break;

                case HIDIOCGRDESC:
                        {
                                __u32 len;

                                if (get_user(len, (int __user *)arg))
                                        ret = -EFAULT;
                                else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
                                        ret = -EINVAL;
                                else if (copy_to_user(user_arg + offsetof(
                                        struct hidraw_report_descriptor,
                                        value[0]),
                                        dev->hid->rdesc,
                                        min(dev->hid->rsize, len)))
                                        ret = -EFAULT;
                                break;
                        }
                case HIDIOCGRAWINFO:
                        {
                                struct hidraw_devinfo dinfo;

                                dinfo.bustype = dev->hid->bus;
                                dinfo.vendor = dev->hid->vendor;
                                dinfo.product = dev->hid->product;
                                if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
                                        ret = -EFAULT;
                                break;
                        }
                case HIDIOCREVOKE:
                        {
                                if (user_arg)
                                        ret = -EINVAL;
                                else
                                        ret = hidraw_revoke(list);
                                break;
                        }
                default:
                        {
                                struct hid_device *hid = dev->hid;
                                if (_IOC_TYPE(cmd) != 'H') {
                                        ret = -EINVAL;
                                        break;
                                }

                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
                                        int len = _IOC_SIZE(cmd);
                                        ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
                                        break;
                                }
                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
                                        int len = _IOC_SIZE(cmd);
                                        ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
                                        break;
                                }

                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
                                        int len = _IOC_SIZE(cmd);
                                        ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
                                        break;
                                }
                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
                                        int len = _IOC_SIZE(cmd);
                                        ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
                                        break;
                                }

                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
                                        int len = _IOC_SIZE(cmd);
                                        ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
                                        break;
                                }
                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
                                        int len = _IOC_SIZE(cmd);
                                        ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
                                        break;
                                }

                                /* Begin Read-only ioctls. */
                                if (_IOC_DIR(cmd) != _IOC_READ) {
                                        ret = -EINVAL;
                                        break;
                                }

                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
                                        int len = strlen(hid->name) + 1;
                                        if (len > _IOC_SIZE(cmd))
                                                len = _IOC_SIZE(cmd);
                                        ret = copy_to_user(user_arg, hid->name, len) ?
                                                -EFAULT : len;
                                        break;
                                }

                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
                                        int len = strlen(hid->phys) + 1;
                                        if (len > _IOC_SIZE(cmd))
                                                len = _IOC_SIZE(cmd);
                                        ret = copy_to_user(user_arg, hid->phys, len) ?
                                                -EFAULT : len;
                                        break;
                                }

                                if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
                                        int len = strlen(hid->uniq) + 1;
                                        if (len > _IOC_SIZE(cmd))
                                                len = _IOC_SIZE(cmd);
                                        ret = copy_to_user(user_arg, hid->uniq, len) ?
                                                -EFAULT : len;
                                        break;
                                }
                        }

                ret = -ENOTTY;
        }
out:
        up_read(&minors_rwsem);
        return ret;
}

static const struct file_operations hidraw_ops = {
        .owner =        THIS_MODULE,
        .read =         hidraw_read,
        .write =        hidraw_write,
        .poll =         hidraw_poll,
        .open =         hidraw_open,
        .release =      hidraw_release,
        .unlocked_ioctl = hidraw_ioctl,
        .fasync =        hidraw_fasync,
        .compat_ioctl   = compat_ptr_ioctl,
        .llseek =        noop_llseek,
};

int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
{
        struct hidraw *dev = hid->hidraw;
        struct hidraw_list *list;
        int ret = 0;
        unsigned long flags;

        spin_lock_irqsave(&dev->list_lock, flags);
        list_for_each_entry(list, &dev->list, node) {
                int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);

                if (hidraw_is_revoked(list) || new_head == list->tail)
                        continue;

                if (!(list->buffer[list->head].value = kmemdup(data, len, GFP_ATOMIC))) {
                        ret = -ENOMEM;
                        break;
                }
                list->buffer[list->head].len = len;
                list->head = new_head;
                kill_fasync(&list->fasync, SIGIO, POLL_IN);
        }
        spin_unlock_irqrestore(&dev->list_lock, flags);

        wake_up_interruptible(&dev->wait);
        return ret;
}
EXPORT_SYMBOL_GPL(hidraw_report_event);

int hidraw_connect(struct hid_device *hid)
{
        int minor, result;
        struct hidraw *dev;

        /* we accept any HID device, all applications */

        dev = kzalloc(sizeof(struct hidraw), GFP_KERNEL);
        if (!dev)
                return -ENOMEM;

        result = -EINVAL;

        down_write(&minors_rwsem);

        for (minor = 0; minor < HIDRAW_MAX_DEVICES; minor++) {
                if (hidraw_table[minor])
                        continue;
                hidraw_table[minor] = dev;
                result = 0;
                break;
        }

        if (result) {
                up_write(&minors_rwsem);
                kfree(dev);
                goto out;
        }

        dev->dev = device_create(&hidraw_class, &hid->dev, MKDEV(hidraw_major, minor),
                                 NULL, "%s%d", "hidraw", minor);

        if (IS_ERR(dev->dev)) {
                hidraw_table[minor] = NULL;
                up_write(&minors_rwsem);
                result = PTR_ERR(dev->dev);
                kfree(dev);
                goto out;
        }

        init_waitqueue_head(&dev->wait);
        spin_lock_init(&dev->list_lock);
        INIT_LIST_HEAD(&dev->list);

        dev->hid = hid;
        dev->minor = minor;

        dev->exist = 1;
        hid->hidraw = dev;

        up_write(&minors_rwsem);
out:
        return result;

}
EXPORT_SYMBOL_GPL(hidraw_connect);

void hidraw_disconnect(struct hid_device *hid)
{
        struct hidraw *hidraw = hid->hidraw;

        down_write(&minors_rwsem);

        drop_ref(hidraw, 1);

        up_write(&minors_rwsem);
}
EXPORT_SYMBOL_GPL(hidraw_disconnect);

int __init hidraw_init(void)
{
        int result;
        dev_t dev_id;

        result = alloc_chrdev_region(&dev_id, HIDRAW_FIRST_MINOR,
                        HIDRAW_MAX_DEVICES, "hidraw");
        if (result < 0) {
                pr_warn("can't get major number\n");
                goto out;
        }

        hidraw_major = MAJOR(dev_id);

        result = class_register(&hidraw_class);
        if (result)
                goto error_cdev;

        cdev_init(&hidraw_cdev, &hidraw_ops);
        result = cdev_add(&hidraw_cdev, dev_id, HIDRAW_MAX_DEVICES);
        if (result < 0)
                goto error_class;

        pr_info("raw HID events driver (C) Jiri Kosina\n");
out:
        return result;

error_class:
        class_unregister(&hidraw_class);
error_cdev:
        unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);
        goto out;
}

void hidraw_exit(void)
{
        dev_t dev_id = MKDEV(hidraw_major, 0);

        cdev_del(&hidraw_cdev);
        class_unregister(&hidraw_class);
        unregister_chrdev_region(dev_id, HIDRAW_MAX_DEVICES);

}





























    3 















    1 



    1 













   13 





   10 


    3 



    1 




    7 
    5 




















   12 
    6 






   12 



































    7 


    6 






   33 



    2 

    3 

   15 

    1 

   13 






    5 
    4 

    1 







   27 




    4 






   23 


















   17 





   12 




    4 















    1 
















   13 









    1 














    5 



    1 

    5 



    2 



    5 













    5 




   62 




   31 
   34 






   20 
    1 




   41 


   34 




    4 







   16 


    2 



    1 
    9 



   12 





   42 






   66 








   27 
   50 

   66 

   66 





  120 






  116 

    4 


  119 
    1 






























    1 

   14 
   10 


    3 













    1 



    1 













   55 







   52 
    2 






    2 










   25 


   17 

    9 

    2 



   41 

    3 
   40 

    3 
   25 














   15 



   23 

    2 

   15 









   33 
    4 
    5 
   31 
   22 
   15 














1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
// SPDX-License-Identifier: GPL-2.0-only
/*
 *  linux/fs/fat/file.c
 *
 *  Written 1992,1993 by Werner Almesberger
 *
 *  regular file handling primitives for fat-based filesystems
 */

#include <linux/capability.h>
#include <linux/module.h>
#include <linux/compat.h>
#include <linux/mount.h>
#include <linux/blkdev.h>
#include <linux/backing-dev.h>
#include <linux/fsnotify.h>
#include <linux/security.h>
#include <linux/falloc.h>
#include "fat.h"

static long fat_fallocate(struct file *file, int mode,
                          loff_t offset, loff_t len);

static int fat_ioctl_get_attributes(struct inode *inode, u32 __user *user_attr)
{
        u32 attr;

        inode_lock_shared(inode);
        attr = fat_make_attrs(inode);
        inode_unlock_shared(inode);

        return put_user(attr, user_attr);
}

static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr)
{
        struct inode *inode = file_inode(file);
        struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
        int is_dir = S_ISDIR(inode->i_mode);
        u32 attr, oldattr;
        struct iattr ia;
        int err;

        err = get_user(attr, user_attr);
        if (err)
                goto out;

        err = mnt_want_write_file(file);
        if (err)
                goto out;
        inode_lock(inode);

        /*
         * ATTR_VOLUME and ATTR_DIR cannot be changed; this also
         * prevents the user from turning us into a VFAT
         * longname entry.  Also, we obviously can't set
         * any of the NTFS attributes in the high 24 bits.
         */
        attr &= 0xff & ~(ATTR_VOLUME | ATTR_DIR);
        /* Merge in ATTR_VOLUME and ATTR_DIR */
        attr |= (MSDOS_I(inode)->i_attrs & ATTR_VOLUME) |
                (is_dir ? ATTR_DIR : 0);
        oldattr = fat_make_attrs(inode);

        /* Equivalent to a chmod() */
        ia.ia_valid = ATTR_MODE | ATTR_CTIME;
        ia.ia_ctime = current_time(inode);
        if (is_dir)
                ia.ia_mode = fat_make_mode(sbi, attr, S_IRWXUGO);
        else {
                ia.ia_mode = fat_make_mode(sbi, attr,
                        S_IRUGO | S_IWUGO | (inode->i_mode & S_IXUGO));
        }

        /* The root directory has no attributes */
        if (inode->i_ino == MSDOS_ROOT_INO && attr != ATTR_DIR) {
                err = -EINVAL;
                goto out_unlock_inode;
        }

        if (sbi->options.sys_immutable &&
            ((attr | oldattr) & ATTR_SYS) &&
            !capable(CAP_LINUX_IMMUTABLE)) {
                err = -EPERM;
                goto out_unlock_inode;
        }

        /*
         * The security check is questionable...  We single
         * out the RO attribute for checking by the security
         * module, just because it maps to a file mode.
         */
        err = security_inode_setattr(file_mnt_idmap(file),
                                     file->f_path.dentry, &ia);
        if (err)
                goto out_unlock_inode;

        /* This MUST be done before doing anything irreversible... */
        err = fat_setattr(file_mnt_idmap(file), file->f_path.dentry, &ia);
        if (err)
                goto out_unlock_inode;

        fsnotify_change(file->f_path.dentry, ia.ia_valid);
        if (sbi->options.sys_immutable) {
                if (attr & ATTR_SYS)
                        inode->i_flags |= S_IMMUTABLE;
                else
                        inode->i_flags &= ~S_IMMUTABLE;
        }

        fat_save_attrs(inode, attr);
        mark_inode_dirty(inode);
out_unlock_inode:
        inode_unlock(inode);
        mnt_drop_write_file(file);
out:
        return err;
}

static int fat_ioctl_get_volume_id(struct inode *inode, u32 __user *user_attr)
{
        struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
        return put_user(sbi->vol_id, user_attr);
}

static int fat_ioctl_fitrim(struct inode *inode, unsigned long arg)
{
        struct super_block *sb = inode->i_sb;
        struct fstrim_range __user *user_range;
        struct fstrim_range range;
        int err;

        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;

        if (!bdev_max_discard_sectors(sb->s_bdev))
                return -EOPNOTSUPP;

        user_range = (struct fstrim_range __user *)arg;
        if (copy_from_user(&range, user_range, sizeof(range)))
                return -EFAULT;

        range.minlen = max_t(unsigned int, range.minlen,
                             bdev_discard_granularity(sb->s_bdev));

        err = fat_trim_fs(inode, &range);
        if (err < 0)
                return err;

        if (copy_to_user(user_range, &range, sizeof(range)))
                return -EFAULT;

        return 0;
}

long fat_generic_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
        struct inode *inode = file_inode(filp);
        u32 __user *user_attr = (u32 __user *)arg;

        switch (cmd) {
        case FAT_IOCTL_GET_ATTRIBUTES:
                return fat_ioctl_get_attributes(inode, user_attr);
        case FAT_IOCTL_SET_ATTRIBUTES:
                return fat_ioctl_set_attributes(filp, user_attr);
        case FAT_IOCTL_GET_VOLUME_ID:
                return fat_ioctl_get_volume_id(inode, user_attr);
        case FITRIM:
                return fat_ioctl_fitrim(inode, arg);
        default:
                return -ENOTTY;        /* Inappropriate ioctl for device */
        }
}

static int fat_file_release(struct inode *inode, struct file *filp)
{
        if ((filp->f_mode & FMODE_WRITE) &&
            MSDOS_SB(inode->i_sb)->options.flush) {
                fat_flush_inodes(inode->i_sb, inode, NULL);
                set_current_state(TASK_UNINTERRUPTIBLE);
                io_schedule_timeout(HZ/10);
        }
        return 0;
}

int fat_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
{
        struct inode *inode = filp->f_mapping->host;
        int err;

        err = __generic_file_fsync(filp, start, end, datasync);
        if (err)
                return err;

        err = sync_mapping_buffers(MSDOS_SB(inode->i_sb)->fat_inode->i_mapping);
        if (err)
                return err;

        return blkdev_issue_flush(inode->i_sb->s_bdev);
}


const struct file_operations fat_file_operations = {
        .llseek                = generic_file_llseek,
        .read_iter        = generic_file_read_iter,
        .write_iter        = generic_file_write_iter,
        .mmap                = generic_file_mmap,
        .release        = fat_file_release,
        .unlocked_ioctl        = fat_generic_ioctl,
        .compat_ioctl        = compat_ptr_ioctl,
        .fsync                = fat_file_fsync,
        .splice_read        = filemap_splice_read,
        .splice_write        = iter_file_splice_write,
        .fallocate        = fat_fallocate,
};

static int fat_cont_expand(struct inode *inode, loff_t size)
{
        struct address_space *mapping = inode->i_mapping;
        loff_t start = inode->i_size, count = size - inode->i_size;
        int err;

        err = generic_cont_expand_simple(inode, size);
        if (err)
                goto out;

        fat_truncate_time(inode, NULL, S_CTIME|S_MTIME);
        mark_inode_dirty(inode);
        if (IS_SYNC(inode)) {
                int err2;

                /*
                 * Opencode syncing since we don't have a file open to use
                 * standard fsync path.
                 */
                err = filemap_fdatawrite_range(mapping, start,
                                               start + count - 1);
                err2 = sync_mapping_buffers(mapping);
                if (!err)
                        err = err2;
                err2 = write_inode_now(inode, 1);
                if (!err)
                        err = err2;
                if (!err) {
                        err =  filemap_fdatawait_range(mapping, start,
                                                       start + count - 1);
                }
        }
out:
        return err;
}

/*
 * Preallocate space for a file. This implements fat's fallocate file
 * operation, which gets called from sys_fallocate system call. User
 * space requests len bytes at offset. If FALLOC_FL_KEEP_SIZE is set
 * we just allocate clusters without zeroing them out. Otherwise we
 * allocate and zero out clusters via an expanding truncate.
 */
static long fat_fallocate(struct file *file, int mode,
                          loff_t offset, loff_t len)
{
        int nr_cluster; /* Number of clusters to be allocated */
        loff_t mm_bytes; /* Number of bytes to be allocated for file */
        loff_t ondisksize; /* block aligned on-disk size in bytes*/
        struct inode *inode = file->f_mapping->host;
        struct super_block *sb = inode->i_sb;
        struct msdos_sb_info *sbi = MSDOS_SB(sb);
        int err = 0;

        /* No support for hole punch or other fallocate flags. */
        if (mode & ~FALLOC_FL_KEEP_SIZE)
                return -EOPNOTSUPP;

        /* No support for dir */
        if (!S_ISREG(inode->i_mode))
                return -EOPNOTSUPP;

        inode_lock(inode);
        if (mode & FALLOC_FL_KEEP_SIZE) {
                ondisksize = inode->i_blocks << 9;
                if ((offset + len) <= ondisksize)
                        goto error;

                /* First compute the number of clusters to be allocated */
                mm_bytes = offset + len - ondisksize;
                nr_cluster = (mm_bytes + (sbi->cluster_size - 1)) >>
                        sbi->cluster_bits;

                /* Start the allocation.We are not zeroing out the clusters */
                while (nr_cluster-- > 0) {
                        err = fat_add_cluster(inode);
                        if (err)
                                goto error;
                }
        } else {
                if ((offset + len) <= i_size_read(inode))
                        goto error;

                /* This is just an expanding truncate */
                err = fat_cont_expand(inode, (offset + len));
        }

error:
        inode_unlock(inode);
        return err;
}

/* Free all clusters after the skip'th cluster. */
static int fat_free(struct inode *inode, int skip)
{
        struct super_block *sb = inode->i_sb;
        int err, wait, free_start, i_start, i_logstart;

        if (MSDOS_I(inode)->i_start == 0)
                return 0;

        fat_cache_inval_inode(inode);

        wait = IS_DIRSYNC(inode);
        i_start = free_start = MSDOS_I(inode)->i_start;
        i_logstart = MSDOS_I(inode)->i_logstart;

        /* First, we write the new file size. */
        if (!skip) {
                MSDOS_I(inode)->i_start = 0;
                MSDOS_I(inode)->i_logstart = 0;
        }
        MSDOS_I(inode)->i_attrs |= ATTR_ARCH;
        fat_truncate_time(inode, NULL, S_CTIME|S_MTIME);
        if (wait) {
                err = fat_sync_inode(inode);
                if (err) {
                        MSDOS_I(inode)->i_start = i_start;
                        MSDOS_I(inode)->i_logstart = i_logstart;
                        return err;
                }
        } else
                mark_inode_dirty(inode);

        /* Write a new EOF, and get the remaining cluster chain for freeing. */
        if (skip) {
                struct fat_entry fatent;
                int ret, fclus, dclus;

                ret = fat_get_cluster(inode, skip - 1, &fclus, &dclus);
                if (ret < 0)
                        return ret;
                else if (ret == FAT_ENT_EOF)
                        return 0;

                fatent_init(&fatent);
                ret = fat_ent_read(inode, &fatent, dclus);
                if (ret == FAT_ENT_EOF) {
                        fatent_brelse(&fatent);
                        return 0;
                } else if (ret == FAT_ENT_FREE) {
                        fat_fs_error(sb,
                                     "%s: invalid cluster chain (i_pos %lld)",
                                     __func__, MSDOS_I(inode)->i_pos);
                        ret = -EIO;
                } else if (ret > 0) {
                        err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, wait);
                        if (err)
                                ret = err;
                }
                fatent_brelse(&fatent);
                if (ret < 0)
                        return ret;

                free_start = ret;
        }
        inode->i_blocks = skip << (MSDOS_SB(sb)->cluster_bits - 9);

        /* Freeing the remained cluster chain */
        return fat_free_clusters(inode, free_start);
}

void fat_truncate_blocks(struct inode *inode, loff_t offset)
{
        struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
        const unsigned int cluster_size = sbi->cluster_size;
        int nr_clusters;

        /*
         * This protects against truncating a file bigger than it was then
         * trying to write into the hole.
         */
        if (MSDOS_I(inode)->mmu_private > offset)
                MSDOS_I(inode)->mmu_private = offset;

        nr_clusters = (offset + (cluster_size - 1)) >> sbi->cluster_bits;

        fat_free(inode, nr_clusters);
        fat_flush_inodes(inode->i_sb, inode, NULL);
}

int fat_getattr(struct mnt_idmap *idmap, const struct path *path,
                struct kstat *stat, u32 request_mask, unsigned int flags)
{
        struct inode *inode = d_inode(path->dentry);
        struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);

        generic_fillattr(idmap, request_mask, inode, stat);
        stat->blksize = sbi->cluster_size;

        if (sbi->options.nfs == FAT_NFS_NOSTALE_RO) {
                /* Use i_pos for ino. This is used as fileid of nfs. */
                stat->ino = fat_i_pos_read(sbi, inode);
        }

        if (sbi->options.isvfat && request_mask & STATX_BTIME) {
                stat->result_mask |= STATX_BTIME;
                stat->btime = MSDOS_I(inode)->i_crtime;
        }

        return 0;
}
EXPORT_SYMBOL_GPL(fat_getattr);

static int fat_sanitize_mode(const struct msdos_sb_info *sbi,
                             struct inode *inode, umode_t *mode_ptr)
{
        umode_t mask, perm;

        /*
         * Note, the basic check is already done by a caller of
         * (attr->ia_mode & ~FAT_VALID_MODE)
         */

        if (S_ISREG(inode->i_mode))
                mask = sbi->options.fs_fmask;
        else
                mask = sbi->options.fs_dmask;

        perm = *mode_ptr & ~(S_IFMT | mask);

        /*
         * Of the r and x bits, all (subject to umask) must be present. Of the
         * w bits, either all (subject to umask) or none must be present.
         *
         * If fat_mode_can_hold_ro(inode) is false, can't change w bits.
         */
        if ((perm & (S_IRUGO | S_IXUGO)) != (inode->i_mode & (S_IRUGO|S_IXUGO)))
                return -EPERM;
        if (fat_mode_can_hold_ro(inode)) {
                if ((perm & S_IWUGO) && ((perm & S_IWUGO) != (S_IWUGO & ~mask)))
                        return -EPERM;
        } else {
                if ((perm & S_IWUGO) != (S_IWUGO & ~mask))
                        return -EPERM;
        }

        *mode_ptr &= S_IFMT | perm;

        return 0;
}

static int fat_allow_set_time(struct mnt_idmap *idmap,
                              struct msdos_sb_info *sbi, struct inode *inode)
{
        umode_t allow_utime = sbi->options.allow_utime;

        if (!vfsuid_eq_kuid(i_uid_into_vfsuid(idmap, inode),
                            current_fsuid())) {
                if (vfsgid_in_group_p(i_gid_into_vfsgid(idmap, inode)))
                        allow_utime >>= 3;
                if (allow_utime & MAY_WRITE)
                        return 1;
        }

        /* use a default check */
        return 0;
}

#define TIMES_SET_FLAGS        (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)
/* valid file mode bits */
#define FAT_VALID_MODE        (S_IFREG | S_IFDIR | S_IRWXUGO)

int fat_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
                struct iattr *attr)
{
        struct msdos_sb_info *sbi = MSDOS_SB(dentry->d_sb);
        struct inode *inode = d_inode(dentry);
        unsigned int ia_valid;
        int error;

        /* Check for setting the inode time. */
        ia_valid = attr->ia_valid;
        if (ia_valid & TIMES_SET_FLAGS) {
                if (fat_allow_set_time(idmap, sbi, inode))
                        attr->ia_valid &= ~TIMES_SET_FLAGS;
        }

        error = setattr_prepare(idmap, dentry, attr);
        attr->ia_valid = ia_valid;
        if (error) {
                if (sbi->options.quiet)
                        error = 0;
                goto out;
        }

        /*
         * Expand the file. Since inode_setattr() updates ->i_size
         * before calling the ->truncate(), but FAT needs to fill the
         * hole before it. XXX: this is no longer true with new truncate
         * sequence.
         */
        if (attr->ia_valid & ATTR_SIZE) {
                inode_dio_wait(inode);

                if (attr->ia_size > inode->i_size) {
                        error = fat_cont_expand(inode, attr->ia_size);
                        if (error || attr->ia_valid == ATTR_SIZE)
                                goto out;
                        attr->ia_valid &= ~ATTR_SIZE;
                }
        }

        if (((attr->ia_valid & ATTR_UID) &&
             (!uid_eq(from_vfsuid(idmap, i_user_ns(inode), attr->ia_vfsuid),
                      sbi->options.fs_uid))) ||
            ((attr->ia_valid & ATTR_GID) &&
             (!gid_eq(from_vfsgid(idmap, i_user_ns(inode), attr->ia_vfsgid),
                      sbi->options.fs_gid))) ||
            ((attr->ia_valid & ATTR_MODE) &&
             (attr->ia_mode & ~FAT_VALID_MODE)))
                error = -EPERM;

        if (error) {
                if (sbi->options.quiet)
                        error = 0;
                goto out;
        }

        /*
         * We don't return -EPERM here. Yes, strange, but this is too
         * old behavior.
         */
        if (attr->ia_valid & ATTR_MODE) {
                if (fat_sanitize_mode(sbi, inode, &attr->ia_mode) < 0)
                        attr->ia_valid &= ~ATTR_MODE;
        }

        if (attr->ia_valid & ATTR_SIZE) {
                error = fat_block_truncate_page(inode, attr->ia_size);
                if (error)
                        goto out;
                down_write(&MSDOS_I(inode)->truncate_lock);
                truncate_setsize(inode, attr->ia_size);
                fat_truncate_blocks(inode, attr->ia_size);
                up_write(&MSDOS_I(inode)->truncate_lock);
        }

        /*
         * setattr_copy can't truncate these appropriately, so we'll
         * copy them ourselves
         */
        if (attr->ia_valid & ATTR_ATIME)
                fat_truncate_time(inode, &attr->ia_atime, S_ATIME);
        if (attr->ia_valid & ATTR_CTIME)
                fat_truncate_time(inode, &attr->ia_ctime, S_CTIME);
        if (attr->ia_valid & ATTR_MTIME)
                fat_truncate_time(inode, &attr->ia_mtime, S_MTIME);
        attr->ia_valid &= ~(ATTR_ATIME|ATTR_CTIME|ATTR_MTIME);

        setattr_copy(idmap, inode, attr);
        mark_inode_dirty(inode);
out:
        return error;
}
EXPORT_SYMBOL_GPL(fat_setattr);

const struct inode_operations fat_file_inode_operations = {
        .setattr        = fat_setattr,
        .getattr        = fat_getattr,
        .update_time        = fat_update_time,
};
































































































































    6 


   99 














































  311 

  126 



  310 









  309 


   93 




















































































    6 




   97 

















  166 




















  163 







  101 
  101 





















































  104 






   82 















  312 














  311 




















  312 















  310 












  309 








    5 









  190 















  310 




















  300 



















  211 

  190 




  211 











































































  300 












  297 












































































  189 
























  189 




































































  182 



















  182 













































































































  182 



















































   41 



































































   41 










































































   73 






  312 











  311 






















  310 
































































  309 













































































  187 







  189 
































































































  187 


  189 














  189 




















  189 









  189 










    5 














  187 



















  187 



    7 










    2 
























  189 
















  189 




  189 

  187 

  189 


























































































































  287 
































































































  160 






  160 




















  302 

  190 


  104 




  300 


  287 


  189 



   41 


   41 


  160 


  312 


  310 



  189 




















  312 


















































    1 


























  312 
























  312 


  312 































  312 












  311 










  136 



























  135 
















  136 












  136 


































































  609 
























  469 














  386 


  387 











1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) Qu Wenruo 2017.  All rights reserved.
 */

/*
 * The module is used to catch unexpected/corrupted tree block data.
 * Such behavior can be caused either by a fuzzed image or bugs.
 *
 * The objective is to do leaf/node validation checks when tree block is read
 * from disk, and check *every* possible member, so other code won't
 * need to checking them again.
 *
 * Due to the potential and unwanted damage, every checker needs to be
 * carefully reviewed otherwise so it does not prevent mount of valid images.
 */

#include <linux/types.h>
#include <linux/stddef.h>
#include <linux/error-injection.h>
#include "messages.h"
#include "ctree.h"
#include "tree-checker.h"
#include "compression.h"
#include "volumes.h"
#include "misc.h"
#include "fs.h"
#include "accessors.h"
#include "file-item.h"
#include "inode-item.h"
#include "dir-item.h"
#include "extent-tree.h"

/*
 * Error message should follow the following format:
 * corrupt <type>: <identifier>, <reason>[, <bad_value>]
 *
 * @type:        leaf or node
 * @identifier:        the necessary info to locate the leaf/node.
 *                 It's recommended to decode key.objecitd/offset if it's
 *                 meaningful.
 * @reason:        describe the error
 * @bad_value:        optional, it's recommended to output bad value and its
 *                expected value (range).
 *
 * Since comma is used to separate the components, only space is allowed
 * inside each component.
 */

/*
 * Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt.
 * Allows callers to customize the output.
 */
__printf(3, 4)
__cold
static void generic_err(const struct extent_buffer *eb, int slot,
                        const char *fmt, ...)
{
        const struct btrfs_fs_info *fs_info = eb->fs_info;
        struct va_format vaf;
        va_list args;

        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        dump_page(folio_page(eb->folios[0], 0), "eb page dump");
        btrfs_crit(fs_info,
                "corrupt %s: root=%llu block=%llu slot=%d, %pV",
                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot, &vaf);
        va_end(args);
}

/*
 * Customized reporter for extent data item, since its key objectid and
 * offset has its own meaning.
 */
__printf(3, 4)
__cold
static void file_extent_err(const struct extent_buffer *eb, int slot,
                            const char *fmt, ...)
{
        const struct btrfs_fs_info *fs_info = eb->fs_info;
        struct btrfs_key key;
        struct va_format vaf;
        va_list args;

        btrfs_item_key_to_cpu(eb, &key, slot);
        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        dump_page(folio_page(eb->folios[0], 0), "eb page dump");
        btrfs_crit(fs_info,
        "corrupt %s: root=%llu block=%llu slot=%d ino=%llu file_offset=%llu, %pV",
                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
                key.objectid, key.offset, &vaf);
        va_end(args);
}

/*
 * Return 0 if the btrfs_file_extent_##name is aligned to @alignment
 * Else return 1
 */
#define CHECK_FE_ALIGNED(leaf, slot, fi, name, alignment)                      \
({                                                                              \
        if (unlikely(!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)),      \
                                 (alignment))))                                      \
                file_extent_err((leaf), (slot),                                      \
        "invalid %s for file extent, have %llu, should be aligned to %u",     \
                        (#name), btrfs_file_extent_##name((leaf), (fi)),      \
                        (alignment));                                              \
        (!IS_ALIGNED(btrfs_file_extent_##name((leaf), (fi)), (alignment)));   \
})

static u64 file_extent_end(struct extent_buffer *leaf,
                           struct btrfs_key *key,
                           struct btrfs_file_extent_item *extent)
{
        u64 end;
        u64 len;

        if (btrfs_file_extent_type(leaf, extent) == BTRFS_FILE_EXTENT_INLINE) {
                len = btrfs_file_extent_ram_bytes(leaf, extent);
                end = ALIGN(key->offset + len, leaf->fs_info->sectorsize);
        } else {
                len = btrfs_file_extent_num_bytes(leaf, extent);
                end = key->offset + len;
        }
        return end;
}

/*
 * Customized report for dir_item, the only new important information is
 * key->objectid, which represents inode number
 */
__printf(3, 4)
__cold
static void dir_item_err(const struct extent_buffer *eb, int slot,
                         const char *fmt, ...)
{
        const struct btrfs_fs_info *fs_info = eb->fs_info;
        struct btrfs_key key;
        struct va_format vaf;
        va_list args;

        btrfs_item_key_to_cpu(eb, &key, slot);
        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        dump_page(folio_page(eb->folios[0], 0), "eb page dump");
        btrfs_crit(fs_info,
                "corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV",
                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
                key.objectid, &vaf);
        va_end(args);
}

/*
 * This functions checks prev_key->objectid, to ensure current key and prev_key
 * share the same objectid as inode number.
 *
 * This is to detect missing INODE_ITEM in subvolume trees.
 *
 * Return true if everything is OK or we don't need to check.
 * Return false if anything is wrong.
 */
static bool check_prev_ino(struct extent_buffer *leaf,
                           struct btrfs_key *key, int slot,
                           struct btrfs_key *prev_key)
{
        /* No prev key, skip check */
        if (slot == 0)
                return true;

        /* Only these key->types needs to be checked */
        ASSERT(key->type == BTRFS_XATTR_ITEM_KEY ||
               key->type == BTRFS_INODE_REF_KEY ||
               key->type == BTRFS_DIR_INDEX_KEY ||
               key->type == BTRFS_DIR_ITEM_KEY ||
               key->type == BTRFS_EXTENT_DATA_KEY);

        /*
         * Only subvolume trees along with their reloc trees need this check.
         * Things like log tree doesn't follow this ino requirement.
         */
        if (!is_fstree(btrfs_header_owner(leaf)))
                return true;

        if (key->objectid == prev_key->objectid)
                return true;

        /* Error found */
        dir_item_err(leaf, slot,
                "invalid previous key objectid, have %llu expect %llu",
                prev_key->objectid, key->objectid);
        return false;
}
static int check_extent_data_item(struct extent_buffer *leaf,
                                  struct btrfs_key *key, int slot,
                                  struct btrfs_key *prev_key)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_file_extent_item *fi;
        u32 sectorsize = fs_info->sectorsize;
        u32 item_size = btrfs_item_size(leaf, slot);
        u64 extent_end;

        if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) {
                file_extent_err(leaf, slot,
"unaligned file_offset for file extent, have %llu should be aligned to %u",
                        key->offset, sectorsize);
                return -EUCLEAN;
        }

        /*
         * Previous key must have the same key->objectid (ino).
         * It can be XATTR_ITEM, INODE_ITEM or just another EXTENT_DATA.
         * But if objectids mismatch, it means we have a missing
         * INODE_ITEM.
         */
        if (unlikely(!check_prev_ino(leaf, key, slot, prev_key)))
                return -EUCLEAN;

        fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);

        /*
         * Make sure the item contains at least inline header, so the file
         * extent type is not some garbage.
         */
        if (unlikely(item_size < BTRFS_FILE_EXTENT_INLINE_DATA_START)) {
                file_extent_err(leaf, slot,
                                "invalid item size, have %u expect [%zu, %u)",
                                item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START,
                                SZ_4K);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_file_extent_type(leaf, fi) >=
                     BTRFS_NR_FILE_EXTENT_TYPES)) {
                file_extent_err(leaf, slot,
                "invalid type for file extent, have %u expect range [0, %u]",
                        btrfs_file_extent_type(leaf, fi),
                        BTRFS_NR_FILE_EXTENT_TYPES - 1);
                return -EUCLEAN;
        }

        /*
         * Support for new compression/encryption must introduce incompat flag,
         * and must be caught in open_ctree().
         */
        if (unlikely(btrfs_file_extent_compression(leaf, fi) >=
                     BTRFS_NR_COMPRESS_TYPES)) {
                file_extent_err(leaf, slot,
        "invalid compression for file extent, have %u expect range [0, %u]",
                        btrfs_file_extent_compression(leaf, fi),
                        BTRFS_NR_COMPRESS_TYPES - 1);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_file_extent_encryption(leaf, fi))) {
                file_extent_err(leaf, slot,
                        "invalid encryption for file extent, have %u expect 0",
                        btrfs_file_extent_encryption(leaf, fi));
                return -EUCLEAN;
        }
        if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) {
                /* Inline extent must have 0 as key offset */
                if (unlikely(key->offset)) {
                        file_extent_err(leaf, slot,
                "invalid file_offset for inline file extent, have %llu expect 0",
                                key->offset);
                        return -EUCLEAN;
                }

                /* Compressed inline extent has no on-disk size, skip it */
                if (btrfs_file_extent_compression(leaf, fi) !=
                    BTRFS_COMPRESS_NONE)
                        return 0;

                /* Uncompressed inline extent size must match item size */
                if (unlikely(item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START +
                                          btrfs_file_extent_ram_bytes(leaf, fi))) {
                        file_extent_err(leaf, slot,
        "invalid ram_bytes for uncompressed inline extent, have %u expect %llu",
                                item_size, BTRFS_FILE_EXTENT_INLINE_DATA_START +
                                btrfs_file_extent_ram_bytes(leaf, fi));
                        return -EUCLEAN;
                }
                return 0;
        }

        /* Regular or preallocated extent has fixed item size */
        if (unlikely(item_size != sizeof(*fi))) {
                file_extent_err(leaf, slot,
        "invalid item size for reg/prealloc file extent, have %u expect %zu",
                        item_size, sizeof(*fi));
                return -EUCLEAN;
        }
        if (unlikely(CHECK_FE_ALIGNED(leaf, slot, fi, ram_bytes, sectorsize) ||
                     CHECK_FE_ALIGNED(leaf, slot, fi, disk_bytenr, sectorsize) ||
                     CHECK_FE_ALIGNED(leaf, slot, fi, disk_num_bytes, sectorsize) ||
                     CHECK_FE_ALIGNED(leaf, slot, fi, offset, sectorsize) ||
                     CHECK_FE_ALIGNED(leaf, slot, fi, num_bytes, sectorsize)))
                return -EUCLEAN;

        /* Catch extent end overflow */
        if (unlikely(check_add_overflow(btrfs_file_extent_num_bytes(leaf, fi),
                                        key->offset, &extent_end))) {
                file_extent_err(leaf, slot,
        "extent end overflow, have file offset %llu extent num bytes %llu",
                                key->offset,
                                btrfs_file_extent_num_bytes(leaf, fi));
                return -EUCLEAN;
        }

        /*
         * Check that no two consecutive file extent items, in the same leaf,
         * present ranges that overlap each other.
         */
        if (slot > 0 &&
            prev_key->objectid == key->objectid &&
            prev_key->type == BTRFS_EXTENT_DATA_KEY) {
                struct btrfs_file_extent_item *prev_fi;
                u64 prev_end;

                prev_fi = btrfs_item_ptr(leaf, slot - 1,
                                         struct btrfs_file_extent_item);
                prev_end = file_extent_end(leaf, prev_key, prev_fi);
                if (unlikely(prev_end > key->offset)) {
                        file_extent_err(leaf, slot - 1,
"file extent end range (%llu) goes beyond start offset (%llu) of the next file extent",
                                        prev_end, key->offset);
                        return -EUCLEAN;
                }
        }

        /*
         * For non-compressed data extents, ram_bytes should match its
         * disk_num_bytes.
         * However we do not really utilize ram_bytes in this case, so this check
         * is only optional for DEBUG builds for developers to catch the
         * unexpected behaviors.
         */
        if (IS_ENABLED(CONFIG_BTRFS_DEBUG) &&
            btrfs_file_extent_compression(leaf, fi) == BTRFS_COMPRESS_NONE &&
            btrfs_file_extent_disk_bytenr(leaf, fi)) {
                if (WARN_ON(btrfs_file_extent_ram_bytes(leaf, fi) !=
                            btrfs_file_extent_disk_num_bytes(leaf, fi)))
                        file_extent_err(leaf, slot,
"mismatch ram_bytes (%llu) and disk_num_bytes (%llu) for non-compressed extent",
                                        btrfs_file_extent_ram_bytes(leaf, fi),
                                        btrfs_file_extent_disk_num_bytes(leaf, fi));
        }

        return 0;
}

static int check_csum_item(struct extent_buffer *leaf, struct btrfs_key *key,
                           int slot, struct btrfs_key *prev_key)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        u32 sectorsize = fs_info->sectorsize;
        const u32 csumsize = fs_info->csum_size;

        if (unlikely(key->objectid != BTRFS_EXTENT_CSUM_OBJECTID)) {
                generic_err(leaf, slot,
                "invalid key objectid for csum item, have %llu expect %llu",
                        key->objectid, BTRFS_EXTENT_CSUM_OBJECTID);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) {
                generic_err(leaf, slot,
        "unaligned key offset for csum item, have %llu should be aligned to %u",
                        key->offset, sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(btrfs_item_size(leaf, slot), csumsize))) {
                generic_err(leaf, slot,
        "unaligned item size for csum item, have %u should be aligned to %u",
                        btrfs_item_size(leaf, slot), csumsize);
                return -EUCLEAN;
        }
        if (slot > 0 && prev_key->type == BTRFS_EXTENT_CSUM_KEY) {
                u64 prev_csum_end;
                u32 prev_item_size;

                prev_item_size = btrfs_item_size(leaf, slot - 1);
                prev_csum_end = (prev_item_size / csumsize) * sectorsize;
                prev_csum_end += prev_key->offset;
                if (unlikely(prev_csum_end > key->offset)) {
                        generic_err(leaf, slot - 1,
"csum end range (%llu) goes beyond the start range (%llu) of the next csum item",
                                    prev_csum_end, key->offset);
                        return -EUCLEAN;
                }
        }
        return 0;
}

/* Inode item error output has the same format as dir_item_err() */
#define inode_item_err(eb, slot, fmt, ...)                        \
        dir_item_err(eb, slot, fmt, __VA_ARGS__)

static int check_inode_key(struct extent_buffer *leaf, struct btrfs_key *key,
                           int slot)
{
        struct btrfs_key item_key;
        bool is_inode_item;

        btrfs_item_key_to_cpu(leaf, &item_key, slot);
        is_inode_item = (item_key.type == BTRFS_INODE_ITEM_KEY);

        /* For XATTR_ITEM, location key should be all 0 */
        if (item_key.type == BTRFS_XATTR_ITEM_KEY) {
                if (unlikely(key->objectid != 0 || key->type != 0 ||
                             key->offset != 0))
                        return -EUCLEAN;
                return 0;
        }

        if (unlikely((key->objectid < BTRFS_FIRST_FREE_OBJECTID ||
                      key->objectid > BTRFS_LAST_FREE_OBJECTID) &&
                     key->objectid != BTRFS_ROOT_TREE_DIR_OBJECTID &&
                     key->objectid != BTRFS_FREE_INO_OBJECTID)) {
                if (is_inode_item) {
                        generic_err(leaf, slot,
        "invalid key objectid: has %llu expect %llu or [%llu, %llu] or %llu",
                                key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID,
                                BTRFS_FIRST_FREE_OBJECTID,
                                BTRFS_LAST_FREE_OBJECTID,
                                BTRFS_FREE_INO_OBJECTID);
                } else {
                        dir_item_err(leaf, slot,
"invalid location key objectid: has %llu expect %llu or [%llu, %llu] or %llu",
                                key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID,
                                BTRFS_FIRST_FREE_OBJECTID,
                                BTRFS_LAST_FREE_OBJECTID,
                                BTRFS_FREE_INO_OBJECTID);
                }
                return -EUCLEAN;
        }
        if (unlikely(key->offset != 0)) {
                if (is_inode_item)
                        inode_item_err(leaf, slot,
                                       "invalid key offset: has %llu expect 0",
                                       key->offset);
                else
                        dir_item_err(leaf, slot,
                                "invalid location key offset:has %llu expect 0",
                                key->offset);
                return -EUCLEAN;
        }
        return 0;
}

static int check_root_key(struct extent_buffer *leaf, struct btrfs_key *key,
                          int slot)
{
        struct btrfs_key item_key;
        bool is_root_item;

        btrfs_item_key_to_cpu(leaf, &item_key, slot);
        is_root_item = (item_key.type == BTRFS_ROOT_ITEM_KEY);

        /*
         * Bad rootid for reloc trees.
         *
         * Reloc trees are only for subvolume trees, other trees only need
         * to be COWed to be relocated.
         */
        if (unlikely(is_root_item && key->objectid == BTRFS_TREE_RELOC_OBJECTID &&
                     !is_fstree(key->offset))) {
                generic_err(leaf, slot,
                "invalid reloc tree for root %lld, root id is not a subvolume tree",
                            key->offset);
                return -EUCLEAN;
        }

        /* No such tree id */
        if (unlikely(key->objectid == 0)) {
                if (is_root_item)
                        generic_err(leaf, slot, "invalid root id 0");
                else
                        dir_item_err(leaf, slot,
                                     "invalid location key root id 0");
                return -EUCLEAN;
        }

        /* DIR_ITEM/INDEX/INODE_REF is not allowed to point to non-fs trees */
        if (unlikely(!is_fstree(key->objectid) && !is_root_item)) {
                dir_item_err(leaf, slot,
                "invalid location key objectid, have %llu expect [%llu, %llu]",
                                key->objectid, BTRFS_FIRST_FREE_OBJECTID,
                                BTRFS_LAST_FREE_OBJECTID);
                return -EUCLEAN;
        }

        /*
         * ROOT_ITEM with non-zero offset means this is a snapshot, created at
         * @offset transid.
         * Furthermore, for location key in DIR_ITEM, its offset is always -1.
         *
         * So here we only check offset for reloc tree whose key->offset must
         * be a valid tree.
         */
        if (unlikely(key->objectid == BTRFS_TREE_RELOC_OBJECTID &&
                     key->offset == 0)) {
                generic_err(leaf, slot, "invalid root id 0 for reloc tree");
                return -EUCLEAN;
        }
        return 0;
}

static int check_dir_item(struct extent_buffer *leaf,
                          struct btrfs_key *key, struct btrfs_key *prev_key,
                          int slot)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_dir_item *di;
        u32 item_size = btrfs_item_size(leaf, slot);
        u32 cur = 0;

        if (unlikely(!check_prev_ino(leaf, key, slot, prev_key)))
                return -EUCLEAN;

        di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
        while (cur < item_size) {
                struct btrfs_key location_key;
                u32 name_len;
                u32 data_len;
                u32 max_name_len;
                u32 total_size;
                u32 name_hash;
                u8 dir_type;
                int ret;

                /* header itself should not cross item boundary */
                if (unlikely(cur + sizeof(*di) > item_size)) {
                        dir_item_err(leaf, slot,
                "dir item header crosses item boundary, have %zu boundary %u",
                                cur + sizeof(*di), item_size);
                        return -EUCLEAN;
                }

                /* Location key check */
                btrfs_dir_item_key_to_cpu(leaf, di, &location_key);
                if (location_key.type == BTRFS_ROOT_ITEM_KEY) {
                        ret = check_root_key(leaf, &location_key, slot);
                        if (unlikely(ret < 0))
                                return ret;
                } else if (location_key.type == BTRFS_INODE_ITEM_KEY ||
                           location_key.type == 0) {
                        ret = check_inode_key(leaf, &location_key, slot);
                        if (unlikely(ret < 0))
                                return ret;
                } else {
                        dir_item_err(leaf, slot,
                        "invalid location key type, have %u, expect %u or %u",
                                     location_key.type, BTRFS_ROOT_ITEM_KEY,
                                     BTRFS_INODE_ITEM_KEY);
                        return -EUCLEAN;
                }

                /* dir type check */
                dir_type = btrfs_dir_ftype(leaf, di);
                if (unlikely(dir_type <= BTRFS_FT_UNKNOWN ||
                             dir_type >= BTRFS_FT_MAX)) {
                        dir_item_err(leaf, slot,
                        "invalid dir item type, have %u expect (0, %u)",
                                dir_type, BTRFS_FT_MAX);
                        return -EUCLEAN;
                }

                if (unlikely(key->type == BTRFS_XATTR_ITEM_KEY &&
                             dir_type != BTRFS_FT_XATTR)) {
                        dir_item_err(leaf, slot,
                "invalid dir item type for XATTR key, have %u expect %u",
                                dir_type, BTRFS_FT_XATTR);
                        return -EUCLEAN;
                }
                if (unlikely(dir_type == BTRFS_FT_XATTR &&
                             key->type != BTRFS_XATTR_ITEM_KEY)) {
                        dir_item_err(leaf, slot,
                        "xattr dir type found for non-XATTR key");
                        return -EUCLEAN;
                }
                if (dir_type == BTRFS_FT_XATTR)
                        max_name_len = XATTR_NAME_MAX;
                else
                        max_name_len = BTRFS_NAME_LEN;

                /* Name/data length check */
                name_len = btrfs_dir_name_len(leaf, di);
                data_len = btrfs_dir_data_len(leaf, di);
                if (unlikely(name_len > max_name_len)) {
                        dir_item_err(leaf, slot,
                        "dir item name len too long, have %u max %u",
                                name_len, max_name_len);
                        return -EUCLEAN;
                }
                if (unlikely(name_len + data_len > BTRFS_MAX_XATTR_SIZE(fs_info))) {
                        dir_item_err(leaf, slot,
                        "dir item name and data len too long, have %u max %u",
                                name_len + data_len,
                                BTRFS_MAX_XATTR_SIZE(fs_info));
                        return -EUCLEAN;
                }

                if (unlikely(data_len && dir_type != BTRFS_FT_XATTR)) {
                        dir_item_err(leaf, slot,
                        "dir item with invalid data len, have %u expect 0",
                                data_len);
                        return -EUCLEAN;
                }

                total_size = sizeof(*di) + name_len + data_len;

                /* header and name/data should not cross item boundary */
                if (unlikely(cur + total_size > item_size)) {
                        dir_item_err(leaf, slot,
                "dir item data crosses item boundary, have %u boundary %u",
                                cur + total_size, item_size);
                        return -EUCLEAN;
                }

                /*
                 * Special check for XATTR/DIR_ITEM, as key->offset is name
                 * hash, should match its name
                 */
                if (key->type == BTRFS_DIR_ITEM_KEY ||
                    key->type == BTRFS_XATTR_ITEM_KEY) {
                        char namebuf[MAX(BTRFS_NAME_LEN, XATTR_NAME_MAX)];

                        read_extent_buffer(leaf, namebuf,
                                        (unsigned long)(di + 1), name_len);
                        name_hash = btrfs_name_hash(namebuf, name_len);
                        if (unlikely(key->offset != name_hash)) {
                                dir_item_err(leaf, slot,
                "name hash mismatch with key, have 0x%016x expect 0x%016llx",
                                        name_hash, key->offset);
                                return -EUCLEAN;
                        }
                }
                cur += total_size;
                di = (struct btrfs_dir_item *)((void *)di + total_size);
        }
        return 0;
}

__printf(3, 4)
__cold
static void block_group_err(const struct extent_buffer *eb, int slot,
                            const char *fmt, ...)
{
        const struct btrfs_fs_info *fs_info = eb->fs_info;
        struct btrfs_key key;
        struct va_format vaf;
        va_list args;

        btrfs_item_key_to_cpu(eb, &key, slot);
        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        dump_page(folio_page(eb->folios[0], 0), "eb page dump");
        btrfs_crit(fs_info,
        "corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV",
                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
                key.objectid, key.offset, &vaf);
        va_end(args);
}

static int check_block_group_item(struct extent_buffer *leaf,
                                  struct btrfs_key *key, int slot)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_block_group_item bgi;
        u32 item_size = btrfs_item_size(leaf, slot);
        u64 chunk_objectid;
        u64 flags;
        u64 type;

        /*
         * Here we don't really care about alignment since extent allocator can
         * handle it.  We care more about the size.
         */
        if (unlikely(key->offset == 0)) {
                block_group_err(leaf, slot,
                                "invalid block group size 0");
                return -EUCLEAN;
        }

        if (unlikely(item_size != sizeof(bgi))) {
                block_group_err(leaf, slot,
                        "invalid item size, have %u expect %zu",
                                item_size, sizeof(bgi));
                return -EUCLEAN;
        }

        read_extent_buffer(leaf, &bgi, btrfs_item_ptr_offset(leaf, slot),
                           sizeof(bgi));
        chunk_objectid = btrfs_stack_block_group_chunk_objectid(&bgi);
        if (btrfs_fs_incompat(fs_info, EXTENT_TREE_V2)) {
                /*
                 * We don't init the nr_global_roots until we load the global
                 * roots, so this could be 0 at mount time.  If it's 0 we'll
                 * just assume we're fine, and later we'll check against our
                 * actual value.
                 */
                if (unlikely(fs_info->nr_global_roots &&
                             chunk_objectid >= fs_info->nr_global_roots)) {
                        block_group_err(leaf, slot,
        "invalid block group global root id, have %llu, needs to be <= %llu",
                                        chunk_objectid,
                                        fs_info->nr_global_roots);
                        return -EUCLEAN;
                }
        } else if (unlikely(chunk_objectid != BTRFS_FIRST_CHUNK_TREE_OBJECTID)) {
                block_group_err(leaf, slot,
                "invalid block group chunk objectid, have %llu expect %llu",
                                btrfs_stack_block_group_chunk_objectid(&bgi),
                                BTRFS_FIRST_CHUNK_TREE_OBJECTID);
                return -EUCLEAN;
        }

        if (unlikely(btrfs_stack_block_group_used(&bgi) > key->offset)) {
                block_group_err(leaf, slot,
                        "invalid block group used, have %llu expect [0, %llu)",
                                btrfs_stack_block_group_used(&bgi), key->offset);
                return -EUCLEAN;
        }

        flags = btrfs_stack_block_group_flags(&bgi);
        if (unlikely(hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1)) {
                block_group_err(leaf, slot,
"invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set",
                        flags & BTRFS_BLOCK_GROUP_PROFILE_MASK,
                        hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK));
                return -EUCLEAN;
        }

        type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK;
        if (unlikely(type != BTRFS_BLOCK_GROUP_DATA &&
                     type != BTRFS_BLOCK_GROUP_METADATA &&
                     type != BTRFS_BLOCK_GROUP_SYSTEM &&
                     type != (BTRFS_BLOCK_GROUP_METADATA |
                              BTRFS_BLOCK_GROUP_DATA))) {
                block_group_err(leaf, slot,
"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx",
                        type, hweight64(type),
                        BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA,
                        BTRFS_BLOCK_GROUP_SYSTEM,
                        BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA);
                return -EUCLEAN;
        }
        return 0;
}

__printf(4, 5)
__cold
static void chunk_err(const struct extent_buffer *leaf,
                      const struct btrfs_chunk *chunk, u64 logical,
                      const char *fmt, ...)
{
        const struct btrfs_fs_info *fs_info = leaf->fs_info;
        bool is_sb;
        struct va_format vaf;
        va_list args;
        int i;
        int slot = -1;

        /* Only superblock eb is able to have such small offset */
        is_sb = (leaf->start == BTRFS_SUPER_INFO_OFFSET);

        if (!is_sb) {
                /*
                 * Get the slot number by iterating through all slots, this
                 * would provide better readability.
                 */
                for (i = 0; i < btrfs_header_nritems(leaf); i++) {
                        if (btrfs_item_ptr_offset(leaf, i) ==
                                        (unsigned long)chunk) {
                                slot = i;
                                break;
                        }
                }
        }
        va_start(args, fmt);
        vaf.fmt = fmt;
        vaf.va = &args;

        if (is_sb)
                btrfs_crit(fs_info,
                "corrupt superblock syschunk array: chunk_start=%llu, %pV",
                           logical, &vaf);
        else
                btrfs_crit(fs_info,
        "corrupt leaf: root=%llu block=%llu slot=%d chunk_start=%llu, %pV",
                           BTRFS_CHUNK_TREE_OBJECTID, leaf->start, slot,
                           logical, &vaf);
        va_end(args);
}

/*
 * The common chunk check which could also work on super block sys chunk array.
 *
 * Return -EUCLEAN if anything is corrupted.
 * Return 0 if everything is OK.
 */
int btrfs_check_chunk_valid(struct extent_buffer *leaf,
                            struct btrfs_chunk *chunk, u64 logical)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        u64 length;
        u64 chunk_end;
        u64 stripe_len;
        u16 num_stripes;
        u16 sub_stripes;
        u64 type;
        u64 features;
        bool mixed = false;
        int raid_index;
        int nparity;
        int ncopies;

        length = btrfs_chunk_length(leaf, chunk);
        stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
        num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
        sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
        type = btrfs_chunk_type(leaf, chunk);
        raid_index = btrfs_bg_flags_to_raid_index(type);
        ncopies = btrfs_raid_array[raid_index].ncopies;
        nparity = btrfs_raid_array[raid_index].nparity;

        if (unlikely(!num_stripes)) {
                chunk_err(leaf, chunk, logical,
                          "invalid chunk num_stripes, have %u", num_stripes);
                return -EUCLEAN;
        }
        if (unlikely(num_stripes < ncopies)) {
                chunk_err(leaf, chunk, logical,
                          "invalid chunk num_stripes < ncopies, have %u < %d",
                          num_stripes, ncopies);
                return -EUCLEAN;
        }
        if (unlikely(nparity && num_stripes == nparity)) {
                chunk_err(leaf, chunk, logical,
                          "invalid chunk num_stripes == nparity, have %u == %d",
                          num_stripes, nparity);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(logical, fs_info->sectorsize))) {
                chunk_err(leaf, chunk, logical,
                "invalid chunk logical, have %llu should aligned to %u",
                          logical, fs_info->sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize)) {
                chunk_err(leaf, chunk, logical,
                          "invalid chunk sectorsize, have %u expect %u",
                          btrfs_chunk_sector_size(leaf, chunk),
                          fs_info->sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(!length || !IS_ALIGNED(length, fs_info->sectorsize))) {
                chunk_err(leaf, chunk, logical,
                          "invalid chunk length, have %llu", length);
                return -EUCLEAN;
        }
        if (unlikely(check_add_overflow(logical, length, &chunk_end))) {
                chunk_err(leaf, chunk, logical,
"invalid chunk logical start and length, have logical start %llu length %llu",
                          logical, length);
                return -EUCLEAN;
        }
        if (unlikely(!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN)) {
                chunk_err(leaf, chunk, logical,
                          "invalid chunk stripe length: %llu",
                          stripe_len);
                return -EUCLEAN;
        }
        /*
         * We artificially limit the chunk size, so that the number of stripes
         * inside a chunk can be fit into a U32.  The current limit (256G) is
         * way too large for real world usage anyway, and it's also much larger
         * than our existing limit (10G).
         *
         * Thus it should be a good way to catch obvious bitflips.
         */
        if (unlikely(length >= btrfs_stripe_nr_to_offset(U32_MAX))) {
                chunk_err(leaf, chunk, logical,
                          "chunk length too large: have %llu limit %llu",
                          length, btrfs_stripe_nr_to_offset(U32_MAX));
                return -EUCLEAN;
        }
        if (unlikely(type & ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
                              BTRFS_BLOCK_GROUP_PROFILE_MASK))) {
                chunk_err(leaf, chunk, logical,
                          "unrecognized chunk type: 0x%llx",
                          ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
                            BTRFS_BLOCK_GROUP_PROFILE_MASK) &
                          btrfs_chunk_type(leaf, chunk));
                return -EUCLEAN;
        }

        if (unlikely(!has_single_bit_set(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) &&
                     (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0)) {
                chunk_err(leaf, chunk, logical,
                "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set",
                          type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
                return -EUCLEAN;
        }
        if (unlikely((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0)) {
                chunk_err(leaf, chunk, logical,
        "missing chunk type flag, have 0x%llx one bit must be set in 0x%llx",
                          type, BTRFS_BLOCK_GROUP_TYPE_MASK);
                return -EUCLEAN;
        }

        if (unlikely((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
                     (type & (BTRFS_BLOCK_GROUP_METADATA |
                              BTRFS_BLOCK_GROUP_DATA)))) {
                chunk_err(leaf, chunk, logical,
                          "system chunk with data or metadata type: 0x%llx",
                          type);
                return -EUCLEAN;
        }

        features = btrfs_super_incompat_flags(fs_info->super_copy);
        if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
                mixed = true;

        if (!mixed) {
                if (unlikely((type & BTRFS_BLOCK_GROUP_METADATA) &&
                             (type & BTRFS_BLOCK_GROUP_DATA))) {
                        chunk_err(leaf, chunk, logical,
                        "mixed chunk type in non-mixed mode: 0x%llx", type);
                        return -EUCLEAN;
                }
        }

        if (unlikely((type & BTRFS_BLOCK_GROUP_RAID10 &&
                      sub_stripes != btrfs_raid_array[BTRFS_RAID_RAID10].sub_stripes) ||
                     (type & BTRFS_BLOCK_GROUP_RAID1 &&
                      num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1].devs_min) ||
                     (type & BTRFS_BLOCK_GROUP_RAID1C3 &&
                      num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1C3].devs_min) ||
                     (type & BTRFS_BLOCK_GROUP_RAID1C4 &&
                      num_stripes != btrfs_raid_array[BTRFS_RAID_RAID1C4].devs_min) ||
                     (type & BTRFS_BLOCK_GROUP_RAID5 &&
                      num_stripes < btrfs_raid_array[BTRFS_RAID_RAID5].devs_min) ||
                     (type & BTRFS_BLOCK_GROUP_RAID6 &&
                      num_stripes < btrfs_raid_array[BTRFS_RAID_RAID6].devs_min) ||
                     (type & BTRFS_BLOCK_GROUP_DUP &&
                      num_stripes != btrfs_raid_array[BTRFS_RAID_DUP].dev_stripes) ||
                     ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
                      num_stripes != btrfs_raid_array[BTRFS_RAID_SINGLE].dev_stripes))) {
                chunk_err(leaf, chunk, logical,
                        "invalid num_stripes:sub_stripes %u:%u for profile %llu",
                        num_stripes, sub_stripes,
                        type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
                return -EUCLEAN;
        }

        return 0;
}

/*
 * Enhanced version of chunk item checker.
 *
 * The common btrfs_check_chunk_valid() doesn't check item size since it needs
 * to work on super block sys_chunk_array which doesn't have full item ptr.
 */
static int check_leaf_chunk_item(struct extent_buffer *leaf,
                                 struct btrfs_chunk *chunk,
                                 struct btrfs_key *key, int slot)
{
        int num_stripes;

        if (unlikely(btrfs_item_size(leaf, slot) < sizeof(struct btrfs_chunk))) {
                chunk_err(leaf, chunk, key->offset,
                        "invalid chunk item size: have %u expect [%zu, %u)",
                        btrfs_item_size(leaf, slot),
                        sizeof(struct btrfs_chunk),
                        BTRFS_LEAF_DATA_SIZE(leaf->fs_info));
                return -EUCLEAN;
        }

        num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
        /* Let btrfs_check_chunk_valid() handle this error type */
        if (num_stripes == 0)
                goto out;

        if (unlikely(btrfs_chunk_item_size(num_stripes) !=
                     btrfs_item_size(leaf, slot))) {
                chunk_err(leaf, chunk, key->offset,
                        "invalid chunk item size: have %u expect %lu",
                        btrfs_item_size(leaf, slot),
                        btrfs_chunk_item_size(num_stripes));
                return -EUCLEAN;
        }
out:
        return btrfs_check_chunk_valid(leaf, chunk, key->offset);
}

__printf(3, 4)
__cold
static void dev_item_err(const struct extent_buffer *eb, int slot,
                         const char *fmt, ...)
{
        struct btrfs_key key;
        struct va_format vaf;
        va_list args;

        btrfs_item_key_to_cpu(eb, &key, slot);
        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        dump_page(folio_page(eb->folios[0], 0), "eb page dump");
        btrfs_crit(eb->fs_info,
        "corrupt %s: root=%llu block=%llu slot=%d devid=%llu %pV",
                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
                key.objectid, &vaf);
        va_end(args);
}

static int check_dev_item(struct extent_buffer *leaf,
                          struct btrfs_key *key, int slot)
{
        struct btrfs_dev_item *ditem;
        const u32 item_size = btrfs_item_size(leaf, slot);

        if (unlikely(key->objectid != BTRFS_DEV_ITEMS_OBJECTID)) {
                dev_item_err(leaf, slot,
                             "invalid objectid: has=%llu expect=%llu",
                             key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
                return -EUCLEAN;
        }

        if (unlikely(item_size != sizeof(*ditem))) {
                dev_item_err(leaf, slot, "invalid item size: has %u expect %zu",
                             item_size, sizeof(*ditem));
                return -EUCLEAN;
        }

        ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
        if (unlikely(btrfs_device_id(leaf, ditem) != key->offset)) {
                dev_item_err(leaf, slot,
                             "devid mismatch: key has=%llu item has=%llu",
                             key->offset, btrfs_device_id(leaf, ditem));
                return -EUCLEAN;
        }

        /*
         * For device total_bytes, we don't have reliable way to check it, as
         * it can be 0 for device removal. Device size check can only be done
         * by dev extents check.
         */
        if (unlikely(btrfs_device_bytes_used(leaf, ditem) >
                     btrfs_device_total_bytes(leaf, ditem))) {
                dev_item_err(leaf, slot,
                             "invalid bytes used: have %llu expect [0, %llu]",
                             btrfs_device_bytes_used(leaf, ditem),
                             btrfs_device_total_bytes(leaf, ditem));
                return -EUCLEAN;
        }
        /*
         * Remaining members like io_align/type/gen/dev_group aren't really
         * utilized.  Skip them to make later usage of them easier.
         */
        return 0;
}

static int check_inode_item(struct extent_buffer *leaf,
                            struct btrfs_key *key, int slot)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_inode_item *iitem;
        u64 super_gen = btrfs_super_generation(fs_info->super_copy);
        u32 valid_mask = (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777);
        const u32 item_size = btrfs_item_size(leaf, slot);
        u32 mode;
        int ret;
        u32 flags;
        u32 ro_flags;

        ret = check_inode_key(leaf, key, slot);
        if (unlikely(ret < 0))
                return ret;

        if (unlikely(item_size != sizeof(*iitem))) {
                generic_err(leaf, slot, "invalid item size: has %u expect %zu",
                            item_size, sizeof(*iitem));
                return -EUCLEAN;
        }

        iitem = btrfs_item_ptr(leaf, slot, struct btrfs_inode_item);

        /* Here we use super block generation + 1 to handle log tree */
        if (unlikely(btrfs_inode_generation(leaf, iitem) > super_gen + 1)) {
                inode_item_err(leaf, slot,
                        "invalid inode generation: has %llu expect (0, %llu]",
                               btrfs_inode_generation(leaf, iitem),
                               super_gen + 1);
                return -EUCLEAN;
        }
        /* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */
        if (unlikely(btrfs_inode_transid(leaf, iitem) > super_gen + 1)) {
                inode_item_err(leaf, slot,
                        "invalid inode transid: has %llu expect [0, %llu]",
                               btrfs_inode_transid(leaf, iitem), super_gen + 1);
                return -EUCLEAN;
        }

        /*
         * For size and nbytes it's better not to be too strict, as for dir
         * item its size/nbytes can easily get wrong, but doesn't affect
         * anything in the fs. So here we skip the check.
         */
        mode = btrfs_inode_mode(leaf, iitem);
        if (unlikely(mode & ~valid_mask)) {
                inode_item_err(leaf, slot,
                               "unknown mode bit detected: 0x%x",
                               mode & ~valid_mask);
                return -EUCLEAN;
        }

        /*
         * S_IFMT is not bit mapped so we can't completely rely on
         * is_power_of_2/has_single_bit_set, but it can save us from checking
         * FIFO/CHR/DIR/REG.  Only needs to check BLK, LNK and SOCKS
         */
        if (!has_single_bit_set(mode & S_IFMT)) {
                if (unlikely(!S_ISLNK(mode) && !S_ISBLK(mode) && !S_ISSOCK(mode))) {
                        inode_item_err(leaf, slot,
                        "invalid mode: has 0%o expect valid S_IF* bit(s)",
                                       mode & S_IFMT);
                        return -EUCLEAN;
                }
        }
        if (unlikely(S_ISDIR(mode) && btrfs_inode_nlink(leaf, iitem) > 1)) {
                inode_item_err(leaf, slot,
                       "invalid nlink: has %u expect no more than 1 for dir",
                        btrfs_inode_nlink(leaf, iitem));
                return -EUCLEAN;
        }
        btrfs_inode_split_flags(btrfs_inode_flags(leaf, iitem), &flags, &ro_flags);
        if (unlikely(flags & ~BTRFS_INODE_FLAG_MASK)) {
                inode_item_err(leaf, slot,
                               "unknown incompat flags detected: 0x%x", flags);
                return -EUCLEAN;
        }
        if (unlikely(!sb_rdonly(fs_info->sb) &&
                     (ro_flags & ~BTRFS_INODE_RO_FLAG_MASK))) {
                inode_item_err(leaf, slot,
                        "unknown ro-compat flags detected on writeable mount: 0x%x",
                        ro_flags);
                return -EUCLEAN;
        }
        return 0;
}

static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key,
                           int slot)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_root_item ri = { 0 };
        const u64 valid_root_flags = BTRFS_ROOT_SUBVOL_RDONLY |
                                     BTRFS_ROOT_SUBVOL_DEAD;
        int ret;

        ret = check_root_key(leaf, key, slot);
        if (unlikely(ret < 0))
                return ret;

        if (unlikely(btrfs_item_size(leaf, slot) != sizeof(ri) &&
                     btrfs_item_size(leaf, slot) !=
                     btrfs_legacy_root_item_size())) {
                generic_err(leaf, slot,
                            "invalid root item size, have %u expect %zu or %u",
                            btrfs_item_size(leaf, slot), sizeof(ri),
                            btrfs_legacy_root_item_size());
                return -EUCLEAN;
        }

        /*
         * For legacy root item, the members starting at generation_v2 will be
         * all filled with 0.
         * And since we allow geneartion_v2 as 0, it will still pass the check.
         */
        read_extent_buffer(leaf, &ri, btrfs_item_ptr_offset(leaf, slot),
                           btrfs_item_size(leaf, slot));

        /* Generation related */
        if (unlikely(btrfs_root_generation(&ri) >
                     btrfs_super_generation(fs_info->super_copy) + 1)) {
                generic_err(leaf, slot,
                        "invalid root generation, have %llu expect (0, %llu]",
                            btrfs_root_generation(&ri),
                            btrfs_super_generation(fs_info->super_copy) + 1);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_root_generation_v2(&ri) >
                     btrfs_super_generation(fs_info->super_copy) + 1)) {
                generic_err(leaf, slot,
                "invalid root v2 generation, have %llu expect (0, %llu]",
                            btrfs_root_generation_v2(&ri),
                            btrfs_super_generation(fs_info->super_copy) + 1);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_root_last_snapshot(&ri) >
                     btrfs_super_generation(fs_info->super_copy) + 1)) {
                generic_err(leaf, slot,
                "invalid root last_snapshot, have %llu expect (0, %llu]",
                            btrfs_root_last_snapshot(&ri),
                            btrfs_super_generation(fs_info->super_copy) + 1);
                return -EUCLEAN;
        }

        /* Alignment and level check */
        if (unlikely(!IS_ALIGNED(btrfs_root_bytenr(&ri), fs_info->sectorsize))) {
                generic_err(leaf, slot,
                "invalid root bytenr, have %llu expect to be aligned to %u",
                            btrfs_root_bytenr(&ri), fs_info->sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_root_level(&ri) >= BTRFS_MAX_LEVEL)) {
                generic_err(leaf, slot,
                            "invalid root level, have %u expect [0, %u]",
                            btrfs_root_level(&ri), BTRFS_MAX_LEVEL - 1);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) {
                generic_err(leaf, slot,
                            "invalid root level, have %u expect [0, %u]",
                            btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);
                return -EUCLEAN;
        }

        /* Flags check */
        if (unlikely(btrfs_root_flags(&ri) & ~valid_root_flags)) {
                generic_err(leaf, slot,
                            "invalid root flags, have 0x%llx expect mask 0x%llx",
                            btrfs_root_flags(&ri), valid_root_flags);
                return -EUCLEAN;
        }
        return 0;
}

__printf(3,4)
__cold
static void extent_err(const struct extent_buffer *eb, int slot,
                       const char *fmt, ...)
{
        struct btrfs_key key;
        struct va_format vaf;
        va_list args;
        u64 bytenr;
        u64 len;

        btrfs_item_key_to_cpu(eb, &key, slot);
        bytenr = key.objectid;
        if (key.type == BTRFS_METADATA_ITEM_KEY ||
            key.type == BTRFS_TREE_BLOCK_REF_KEY ||
            key.type == BTRFS_SHARED_BLOCK_REF_KEY)
                len = eb->fs_info->nodesize;
        else
                len = key.offset;
        va_start(args, fmt);

        vaf.fmt = fmt;
        vaf.va = &args;

        dump_page(folio_page(eb->folios[0], 0), "eb page dump");
        btrfs_crit(eb->fs_info,
        "corrupt %s: block=%llu slot=%d extent bytenr=%llu len=%llu %pV",
                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                eb->start, slot, bytenr, len, &vaf);
        va_end(args);
}

static bool is_valid_dref_root(u64 rootid)
{
        /*
         * The following tree root objectids are allowed to have a data backref:
         * - subvolume trees
         * - data reloc tree
         * - tree root
         *   For v1 space cache
         */
        return is_fstree(rootid) || rootid == BTRFS_DATA_RELOC_TREE_OBJECTID ||
               rootid == BTRFS_ROOT_TREE_OBJECTID;
}

static int check_extent_item(struct extent_buffer *leaf,
                             struct btrfs_key *key, int slot,
                             struct btrfs_key *prev_key)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        struct btrfs_extent_item *ei;
        bool is_tree_block = false;
        unsigned long ptr;        /* Current pointer inside inline refs */
        unsigned long end;        /* Extent item end */
        const u32 item_size = btrfs_item_size(leaf, slot);
        u8 last_type = 0;
        u64 last_seq = U64_MAX;
        u64 flags;
        u64 generation;
        u64 total_refs;                /* Total refs in btrfs_extent_item */
        u64 inline_refs = 0;        /* found total inline refs */

        if (unlikely(key->type == BTRFS_METADATA_ITEM_KEY &&
                     !btrfs_fs_incompat(fs_info, SKINNY_METADATA))) {
                generic_err(leaf, slot,
"invalid key type, METADATA_ITEM type invalid when SKINNY_METADATA feature disabled");
                return -EUCLEAN;
        }
        /* key->objectid is the bytenr for both key types */
        if (unlikely(!IS_ALIGNED(key->objectid, fs_info->sectorsize))) {
                generic_err(leaf, slot,
                "invalid key objectid, have %llu expect to be aligned to %u",
                           key->objectid, fs_info->sectorsize);
                return -EUCLEAN;
        }

        /* key->offset is tree level for METADATA_ITEM_KEY */
        if (unlikely(key->type == BTRFS_METADATA_ITEM_KEY &&
                     key->offset >= BTRFS_MAX_LEVEL)) {
                extent_err(leaf, slot,
                           "invalid tree level, have %llu expect [0, %u]",
                           key->offset, BTRFS_MAX_LEVEL - 1);
                return -EUCLEAN;
        }

        /*
         * EXTENT/METADATA_ITEM consists of:
         * 1) One btrfs_extent_item
         *    Records the total refs, type and generation of the extent.
         *
         * 2) One btrfs_tree_block_info (for EXTENT_ITEM and tree backref only)
         *    Records the first key and level of the tree block.
         *
         * 2) Zero or more btrfs_extent_inline_ref(s)
         *    Each inline ref has one btrfs_extent_inline_ref shows:
         *    2.1) The ref type, one of the 4
         *         TREE_BLOCK_REF        Tree block only
         *         SHARED_BLOCK_REF        Tree block only
         *         EXTENT_DATA_REF        Data only
         *         SHARED_DATA_REF        Data only
         *    2.2) Ref type specific data
         *         Either using btrfs_extent_inline_ref::offset, or specific
         *         data structure.
         *
         *    All above inline items should follow the order:
         *
         *    - All btrfs_extent_inline_ref::type should be in an ascending
         *      order
         *
         *    - Within the same type, the items should follow a descending
         *      order by their sequence number. The sequence number is
         *      determined by:
         *      * btrfs_extent_inline_ref::offset for all types  other than
         *        EXTENT_DATA_REF
         *      * hash_extent_data_ref() for EXTENT_DATA_REF
         */
        if (unlikely(item_size < sizeof(*ei))) {
                extent_err(leaf, slot,
                           "invalid item size, have %u expect [%zu, %u)",
                           item_size, sizeof(*ei),
                           BTRFS_LEAF_DATA_SIZE(fs_info));
                return -EUCLEAN;
        }
        end = item_size + btrfs_item_ptr_offset(leaf, slot);

        /* Checks against extent_item */
        ei = btrfs_item_ptr(leaf, slot, struct btrfs_extent_item);
        flags = btrfs_extent_flags(leaf, ei);
        total_refs = btrfs_extent_refs(leaf, ei);
        generation = btrfs_extent_generation(leaf, ei);
        if (unlikely(generation >
                     btrfs_super_generation(fs_info->super_copy) + 1)) {
                extent_err(leaf, slot,
                           "invalid generation, have %llu expect (0, %llu]",
                           generation,
                           btrfs_super_generation(fs_info->super_copy) + 1);
                return -EUCLEAN;
        }
        if (unlikely(!has_single_bit_set(flags & (BTRFS_EXTENT_FLAG_DATA |
                                                  BTRFS_EXTENT_FLAG_TREE_BLOCK)))) {
                extent_err(leaf, slot,
                "invalid extent flag, have 0x%llx expect 1 bit set in 0x%llx",
                        flags, BTRFS_EXTENT_FLAG_DATA |
                        BTRFS_EXTENT_FLAG_TREE_BLOCK);
                return -EUCLEAN;
        }
        is_tree_block = !!(flags & BTRFS_EXTENT_FLAG_TREE_BLOCK);
        if (is_tree_block) {
                if (unlikely(key->type == BTRFS_EXTENT_ITEM_KEY &&
                             key->offset != fs_info->nodesize)) {
                        extent_err(leaf, slot,
                                   "invalid extent length, have %llu expect %u",
                                   key->offset, fs_info->nodesize);
                        return -EUCLEAN;
                }
        } else {
                if (unlikely(key->type != BTRFS_EXTENT_ITEM_KEY)) {
                        extent_err(leaf, slot,
                        "invalid key type, have %u expect %u for data backref",
                                   key->type, BTRFS_EXTENT_ITEM_KEY);
                        return -EUCLEAN;
                }
                if (unlikely(!IS_ALIGNED(key->offset, fs_info->sectorsize))) {
                        extent_err(leaf, slot,
                        "invalid extent length, have %llu expect aligned to %u",
                                   key->offset, fs_info->sectorsize);
                        return -EUCLEAN;
                }
                if (unlikely(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) {
                        extent_err(leaf, slot,
                        "invalid extent flag, data has full backref set");
                        return -EUCLEAN;
                }
        }
        ptr = (unsigned long)(struct btrfs_extent_item *)(ei + 1);

        /* Check the special case of btrfs_tree_block_info */
        if (is_tree_block && key->type != BTRFS_METADATA_ITEM_KEY) {
                struct btrfs_tree_block_info *info;

                info = (struct btrfs_tree_block_info *)ptr;
                if (unlikely(btrfs_tree_block_level(leaf, info) >= BTRFS_MAX_LEVEL)) {
                        extent_err(leaf, slot,
                        "invalid tree block info level, have %u expect [0, %u]",
                                   btrfs_tree_block_level(leaf, info),
                                   BTRFS_MAX_LEVEL - 1);
                        return -EUCLEAN;
                }
                ptr = (unsigned long)(struct btrfs_tree_block_info *)(info + 1);
        }

        /* Check inline refs */
        while (ptr < end) {
                struct btrfs_extent_inline_ref *iref;
                struct btrfs_extent_data_ref *dref;
                struct btrfs_shared_data_ref *sref;
                u64 seq;
                u64 dref_root;
                u64 dref_objectid;
                u64 dref_offset;
                u64 inline_offset;
                u8 inline_type;

                if (unlikely(ptr + sizeof(*iref) > end)) {
                        extent_err(leaf, slot,
"inline ref item overflows extent item, ptr %lu iref size %zu end %lu",
                                   ptr, sizeof(*iref), end);
                        return -EUCLEAN;
                }
                iref = (struct btrfs_extent_inline_ref *)ptr;
                inline_type = btrfs_extent_inline_ref_type(leaf, iref);
                inline_offset = btrfs_extent_inline_ref_offset(leaf, iref);
                seq = inline_offset;
                if (unlikely(ptr + btrfs_extent_inline_ref_size(inline_type) > end)) {
                        extent_err(leaf, slot,
"inline ref item overflows extent item, ptr %lu iref size %u end %lu",
                                   ptr, btrfs_extent_inline_ref_size(inline_type), end);
                        return -EUCLEAN;
                }

                switch (inline_type) {
                /* inline_offset is subvolid of the owner, no need to check */
                case BTRFS_TREE_BLOCK_REF_KEY:
                        inline_refs++;
                        break;
                /* Contains parent bytenr */
                case BTRFS_SHARED_BLOCK_REF_KEY:
                        if (unlikely(!IS_ALIGNED(inline_offset,
                                                 fs_info->sectorsize))) {
                                extent_err(leaf, slot,
                "invalid tree parent bytenr, have %llu expect aligned to %u",
                                           inline_offset, fs_info->sectorsize);
                                return -EUCLEAN;
                        }
                        inline_refs++;
                        break;
                /*
                 * Contains owner subvolid, owner key objectid, adjusted offset.
                 * The only obvious corruption can happen in that offset.
                 */
                case BTRFS_EXTENT_DATA_REF_KEY:
                        dref = (struct btrfs_extent_data_ref *)(&iref->offset);
                        dref_root = btrfs_extent_data_ref_root(leaf, dref);
                        dref_objectid = btrfs_extent_data_ref_objectid(leaf, dref);
                        dref_offset = btrfs_extent_data_ref_offset(leaf, dref);
                        seq = hash_extent_data_ref(
                                        btrfs_extent_data_ref_root(leaf, dref),
                                        btrfs_extent_data_ref_objectid(leaf, dref),
                                        btrfs_extent_data_ref_offset(leaf, dref));
                        if (unlikely(!is_valid_dref_root(dref_root))) {
                                extent_err(leaf, slot,
                                           "invalid data ref root value %llu",
                                           dref_root);
                                return -EUCLEAN;
                        }
                        if (unlikely(dref_objectid < BTRFS_FIRST_FREE_OBJECTID ||
                                     dref_objectid > BTRFS_LAST_FREE_OBJECTID)) {
                                extent_err(leaf, slot,
                                           "invalid data ref objectid value %llu",
                                           dref_objectid);
                                return -EUCLEAN;
                        }
                        if (unlikely(!IS_ALIGNED(dref_offset,
                                                 fs_info->sectorsize))) {
                                extent_err(leaf, slot,
                "invalid data ref offset, have %llu expect aligned to %u",
                                           dref_offset, fs_info->sectorsize);
                                return -EUCLEAN;
                        }
                        inline_refs += btrfs_extent_data_ref_count(leaf, dref);
                        break;
                /* Contains parent bytenr and ref count */
                case BTRFS_SHARED_DATA_REF_KEY:
                        sref = (struct btrfs_shared_data_ref *)(iref + 1);
                        if (unlikely(!IS_ALIGNED(inline_offset,
                                                 fs_info->sectorsize))) {
                                extent_err(leaf, slot,
                "invalid data parent bytenr, have %llu expect aligned to %u",
                                           inline_offset, fs_info->sectorsize);
                                return -EUCLEAN;
                        }
                        inline_refs += btrfs_shared_data_ref_count(leaf, sref);
                        break;
                case BTRFS_EXTENT_OWNER_REF_KEY:
                        WARN_ON(!btrfs_fs_incompat(fs_info, SIMPLE_QUOTA));
                        break;
                default:
                        extent_err(leaf, slot, "unknown inline ref type: %u",
                                   inline_type);
                        return -EUCLEAN;
                }
                if (inline_type < last_type) {
                        extent_err(leaf, slot,
                                   "inline ref out-of-order: has type %u, prev type %u",
                                   inline_type, last_type);
                        return -EUCLEAN;
                }
                /* Type changed, allow the sequence starts from U64_MAX again. */
                if (inline_type > last_type)
                        last_seq = U64_MAX;
                if (seq > last_seq) {
                        extent_err(leaf, slot,
"inline ref out-of-order: has type %u offset %llu seq 0x%llx, prev type %u seq 0x%llx",
                                   inline_type, inline_offset, seq,
                                   last_type, last_seq);
                        return -EUCLEAN;
                }
                last_type = inline_type;
                last_seq = seq;
                ptr += btrfs_extent_inline_ref_size(inline_type);
        }
        /* No padding is allowed */
        if (unlikely(ptr != end)) {
                extent_err(leaf, slot,
                           "invalid extent item size, padding bytes found");
                return -EUCLEAN;
        }

        /* Finally, check the inline refs against total refs */
        if (unlikely(inline_refs > total_refs)) {
                extent_err(leaf, slot,
                        "invalid extent refs, have %llu expect >= inline %llu",
                           total_refs, inline_refs);
                return -EUCLEAN;
        }

        if ((prev_key->type == BTRFS_EXTENT_ITEM_KEY) ||
            (prev_key->type == BTRFS_METADATA_ITEM_KEY)) {
                u64 prev_end = prev_key->objectid;

                if (prev_key->type == BTRFS_METADATA_ITEM_KEY)
                        prev_end += fs_info->nodesize;
                else
                        prev_end += prev_key->offset;

                if (unlikely(prev_end > key->objectid)) {
                        extent_err(leaf, slot,
        "previous extent [%llu %u %llu] overlaps current extent [%llu %u %llu]",
                                   prev_key->objectid, prev_key->type,
                                   prev_key->offset, key->objectid, key->type,
                                   key->offset);
                        return -EUCLEAN;
                }
        }

        return 0;
}

static int check_simple_keyed_refs(struct extent_buffer *leaf,
                                   struct btrfs_key *key, int slot)
{
        u32 expect_item_size = 0;

        if (key->type == BTRFS_SHARED_DATA_REF_KEY)
                expect_item_size = sizeof(struct btrfs_shared_data_ref);

        if (unlikely(btrfs_item_size(leaf, slot) != expect_item_size)) {
                generic_err(leaf, slot,
                "invalid item size, have %u expect %u for key type %u",
                            btrfs_item_size(leaf, slot),
                            expect_item_size, key->type);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) {
                generic_err(leaf, slot,
"invalid key objectid for shared block ref, have %llu expect aligned to %u",
                            key->objectid, leaf->fs_info->sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(key->type != BTRFS_TREE_BLOCK_REF_KEY &&
                     !IS_ALIGNED(key->offset, leaf->fs_info->sectorsize))) {
                extent_err(leaf, slot,
                "invalid tree parent bytenr, have %llu expect aligned to %u",
                           key->offset, leaf->fs_info->sectorsize);
                return -EUCLEAN;
        }
        return 0;
}

static int check_extent_data_ref(struct extent_buffer *leaf,
                                 struct btrfs_key *key, int slot)
{
        struct btrfs_extent_data_ref *dref;
        unsigned long ptr = btrfs_item_ptr_offset(leaf, slot);
        const unsigned long end = ptr + btrfs_item_size(leaf, slot);

        if (unlikely(btrfs_item_size(leaf, slot) % sizeof(*dref) != 0)) {
                generic_err(leaf, slot,
        "invalid item size, have %u expect aligned to %zu for key type %u",
                            btrfs_item_size(leaf, slot),
                            sizeof(*dref), key->type);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) {
                generic_err(leaf, slot,
"invalid key objectid for shared block ref, have %llu expect aligned to %u",
                            key->objectid, leaf->fs_info->sectorsize);
                return -EUCLEAN;
        }
        for (; ptr < end; ptr += sizeof(*dref)) {
                u64 root;
                u64 objectid;
                u64 offset;

                /*
                 * We cannot check the extent_data_ref hash due to possible
                 * overflow from the leaf due to hash collisions.
                 */
                dref = (struct btrfs_extent_data_ref *)ptr;
                root = btrfs_extent_data_ref_root(leaf, dref);
                objectid = btrfs_extent_data_ref_objectid(leaf, dref);
                offset = btrfs_extent_data_ref_offset(leaf, dref);
                if (unlikely(!is_valid_dref_root(root))) {
                        extent_err(leaf, slot,
                                   "invalid extent data backref root value %llu",
                                   root);
                        return -EUCLEAN;
                }
                if (unlikely(objectid < BTRFS_FIRST_FREE_OBJECTID ||
                             objectid > BTRFS_LAST_FREE_OBJECTID)) {
                        extent_err(leaf, slot,
                                   "invalid extent data backref objectid value %llu",
                                   root);
                        return -EUCLEAN;
                }
                if (unlikely(!IS_ALIGNED(offset, leaf->fs_info->sectorsize))) {
                        extent_err(leaf, slot,
        "invalid extent data backref offset, have %llu expect aligned to %u",
                                   offset, leaf->fs_info->sectorsize);
                        return -EUCLEAN;
                }
        }
        return 0;
}

#define inode_ref_err(eb, slot, fmt, args...)                        \
        inode_item_err(eb, slot, fmt, ##args)
static int check_inode_ref(struct extent_buffer *leaf,
                           struct btrfs_key *key, struct btrfs_key *prev_key,
                           int slot)
{
        struct btrfs_inode_ref *iref;
        unsigned long ptr;
        unsigned long end;

        if (unlikely(!check_prev_ino(leaf, key, slot, prev_key)))
                return -EUCLEAN;
        /* namelen can't be 0, so item_size == sizeof() is also invalid */
        if (unlikely(btrfs_item_size(leaf, slot) <= sizeof(*iref))) {
                inode_ref_err(leaf, slot,
                        "invalid item size, have %u expect (%zu, %u)",
                        btrfs_item_size(leaf, slot),
                        sizeof(*iref), BTRFS_LEAF_DATA_SIZE(leaf->fs_info));
                return -EUCLEAN;
        }

        ptr = btrfs_item_ptr_offset(leaf, slot);
        end = ptr + btrfs_item_size(leaf, slot);
        while (ptr < end) {
                u16 namelen;

                if (unlikely(ptr + sizeof(iref) > end)) {
                        inode_ref_err(leaf, slot,
                        "inode ref overflow, ptr %lu end %lu inode_ref_size %zu",
                                ptr, end, sizeof(iref));
                        return -EUCLEAN;
                }

                iref = (struct btrfs_inode_ref *)ptr;
                namelen = btrfs_inode_ref_name_len(leaf, iref);
                if (unlikely(ptr + sizeof(*iref) + namelen > end)) {
                        inode_ref_err(leaf, slot,
                                "inode ref overflow, ptr %lu end %lu namelen %u",
                                ptr, end, namelen);
                        return -EUCLEAN;
                }

                /*
                 * NOTE: In theory we should record all found index numbers
                 * to find any duplicated indexes, but that will be too time
                 * consuming for inodes with too many hard links.
                 */
                ptr += sizeof(*iref) + namelen;
        }
        return 0;
}

static int check_raid_stripe_extent(const struct extent_buffer *leaf,
                                    const struct btrfs_key *key, int slot)
{
        if (unlikely(!IS_ALIGNED(key->objectid, leaf->fs_info->sectorsize))) {
                generic_err(leaf, slot,
"invalid key objectid for raid stripe extent, have %llu expect aligned to %u",
                            key->objectid, leaf->fs_info->sectorsize);
                return -EUCLEAN;
        }

        if (unlikely(!btrfs_fs_incompat(leaf->fs_info, RAID_STRIPE_TREE))) {
                generic_err(leaf, slot,
        "RAID_STRIPE_EXTENT present but RAID_STRIPE_TREE incompat bit unset");
                return -EUCLEAN;
        }

        return 0;
}

static int check_dev_extent_item(const struct extent_buffer *leaf,
                                 const struct btrfs_key *key,
                                 int slot,
                                 struct btrfs_key *prev_key)
{
        struct btrfs_dev_extent *de;
        const u32 sectorsize = leaf->fs_info->sectorsize;

        de = btrfs_item_ptr(leaf, slot, struct btrfs_dev_extent);
        /* Basic fixed member checks. */
        if (unlikely(btrfs_dev_extent_chunk_tree(leaf, de) !=
                     BTRFS_CHUNK_TREE_OBJECTID)) {
                generic_err(leaf, slot,
                            "invalid dev extent chunk tree id, has %llu expect %llu",
                            btrfs_dev_extent_chunk_tree(leaf, de),
                            BTRFS_CHUNK_TREE_OBJECTID);
                return -EUCLEAN;
        }
        if (unlikely(btrfs_dev_extent_chunk_objectid(leaf, de) !=
                     BTRFS_FIRST_CHUNK_TREE_OBJECTID)) {
                generic_err(leaf, slot,
                            "invalid dev extent chunk objectid, has %llu expect %llu",
                            btrfs_dev_extent_chunk_objectid(leaf, de),
                            BTRFS_FIRST_CHUNK_TREE_OBJECTID);
                return -EUCLEAN;
        }
        /* Alignment check. */
        if (unlikely(!IS_ALIGNED(key->offset, sectorsize))) {
                generic_err(leaf, slot,
                            "invalid dev extent key.offset, has %llu not aligned to %u",
                            key->offset, sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(btrfs_dev_extent_chunk_offset(leaf, de),
                                 sectorsize))) {
                generic_err(leaf, slot,
                            "invalid dev extent chunk offset, has %llu not aligned to %u",
                            btrfs_dev_extent_chunk_objectid(leaf, de),
                            sectorsize);
                return -EUCLEAN;
        }
        if (unlikely(!IS_ALIGNED(btrfs_dev_extent_length(leaf, de),
                                 sectorsize))) {
                generic_err(leaf, slot,
                            "invalid dev extent length, has %llu not aligned to %u",
                            btrfs_dev_extent_length(leaf, de), sectorsize);
                return -EUCLEAN;
        }
        /* Overlap check with previous dev extent. */
        if (slot && prev_key->objectid == key->objectid &&
            prev_key->type == key->type) {
                struct btrfs_dev_extent *prev_de;
                u64 prev_len;

                prev_de = btrfs_item_ptr(leaf, slot - 1, struct btrfs_dev_extent);
                prev_len = btrfs_dev_extent_length(leaf, prev_de);
                if (unlikely(prev_key->offset + prev_len > key->offset)) {
                        generic_err(leaf, slot,
                "dev extent overlap, prev offset %llu len %llu current offset %llu",
                                    prev_key->objectid, prev_len, key->offset);
                        return -EUCLEAN;
                }
        }
        return 0;
}

/*
 * Common point to switch the item-specific validation.
 */
static enum btrfs_tree_block_status check_leaf_item(struct extent_buffer *leaf,
                                                    struct btrfs_key *key,
                                                    int slot,
                                                    struct btrfs_key *prev_key)
{
        int ret = 0;
        struct btrfs_chunk *chunk;

        switch (key->type) {
        case BTRFS_EXTENT_DATA_KEY:
                ret = check_extent_data_item(leaf, key, slot, prev_key);
                break;
        case BTRFS_EXTENT_CSUM_KEY:
                ret = check_csum_item(leaf, key, slot, prev_key);
                break;
        case BTRFS_DIR_ITEM_KEY:
        case BTRFS_DIR_INDEX_KEY:
        case BTRFS_XATTR_ITEM_KEY:
                ret = check_dir_item(leaf, key, prev_key, slot);
                break;
        case BTRFS_INODE_REF_KEY:
                ret = check_inode_ref(leaf, key, prev_key, slot);
                break;
        case BTRFS_BLOCK_GROUP_ITEM_KEY:
                ret = check_block_group_item(leaf, key, slot);
                break;
        case BTRFS_CHUNK_ITEM_KEY:
                chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
                ret = check_leaf_chunk_item(leaf, chunk, key, slot);
                break;
        case BTRFS_DEV_ITEM_KEY:
                ret = check_dev_item(leaf, key, slot);
                break;
        case BTRFS_DEV_EXTENT_KEY:
                ret = check_dev_extent_item(leaf, key, slot, prev_key);
                break;
        case BTRFS_INODE_ITEM_KEY:
                ret = check_inode_item(leaf, key, slot);
                break;
        case BTRFS_ROOT_ITEM_KEY:
                ret = check_root_item(leaf, key, slot);
                break;
        case BTRFS_EXTENT_ITEM_KEY:
        case BTRFS_METADATA_ITEM_KEY:
                ret = check_extent_item(leaf, key, slot, prev_key);
                break;
        case BTRFS_TREE_BLOCK_REF_KEY:
        case BTRFS_SHARED_DATA_REF_KEY:
        case BTRFS_SHARED_BLOCK_REF_KEY:
                ret = check_simple_keyed_refs(leaf, key, slot);
                break;
        case BTRFS_EXTENT_DATA_REF_KEY:
                ret = check_extent_data_ref(leaf, key, slot);
                break;
        case BTRFS_RAID_STRIPE_KEY:
                ret = check_raid_stripe_extent(leaf, key, slot);
                break;
        }

        if (ret)
                return BTRFS_TREE_BLOCK_INVALID_ITEM;
        return BTRFS_TREE_BLOCK_CLEAN;
}

enum btrfs_tree_block_status __btrfs_check_leaf(struct extent_buffer *leaf)
{
        struct btrfs_fs_info *fs_info = leaf->fs_info;
        /* No valid key type is 0, so all key should be larger than this key */
        struct btrfs_key prev_key = {0, 0, 0};
        struct btrfs_key key;
        u32 nritems = btrfs_header_nritems(leaf);
        int slot;

        if (unlikely(btrfs_header_level(leaf) != 0)) {
                generic_err(leaf, 0,
                        "invalid level for leaf, have %d expect 0",
                        btrfs_header_level(leaf));
                return BTRFS_TREE_BLOCK_INVALID_LEVEL;
        }

        if (unlikely(!btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_WRITTEN))) {
                generic_err(leaf, 0, "invalid flag for leaf, WRITTEN not set");
                return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET;
        }

        /*
         * Extent buffers from a relocation tree have a owner field that
         * corresponds to the subvolume tree they are based on. So just from an
         * extent buffer alone we can not find out what is the id of the
         * corresponding subvolume tree, so we can not figure out if the extent
         * buffer corresponds to the root of the relocation tree or not. So
         * skip this check for relocation trees.
         */
        if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) {
                u64 owner = btrfs_header_owner(leaf);

                /* These trees must never be empty */
                if (unlikely(owner == BTRFS_ROOT_TREE_OBJECTID ||
                             owner == BTRFS_CHUNK_TREE_OBJECTID ||
                             owner == BTRFS_DEV_TREE_OBJECTID ||
                             owner == BTRFS_FS_TREE_OBJECTID ||
                             owner == BTRFS_DATA_RELOC_TREE_OBJECTID)) {
                        generic_err(leaf, 0,
                        "invalid root, root %llu must never be empty",
                                    owner);
                        return BTRFS_TREE_BLOCK_INVALID_NRITEMS;
                }

                /* Unknown tree */
                if (unlikely(owner == 0)) {
                        generic_err(leaf, 0,
                                "invalid owner, root 0 is not defined");
                        return BTRFS_TREE_BLOCK_INVALID_OWNER;
                }

                /* EXTENT_TREE_V2 can have empty extent trees. */
                if (btrfs_fs_incompat(fs_info, EXTENT_TREE_V2))
                        return BTRFS_TREE_BLOCK_CLEAN;

                if (unlikely(owner == BTRFS_EXTENT_TREE_OBJECTID)) {
                        generic_err(leaf, 0,
                        "invalid root, root %llu must never be empty",
                                    owner);
                        return BTRFS_TREE_BLOCK_INVALID_NRITEMS;
                }

                return BTRFS_TREE_BLOCK_CLEAN;
        }

        if (unlikely(nritems == 0))
                return BTRFS_TREE_BLOCK_CLEAN;

        /*
         * Check the following things to make sure this is a good leaf, and
         * leaf users won't need to bother with similar sanity checks:
         *
         * 1) key ordering
         * 2) item offset and size
         *    No overlap, no hole, all inside the leaf.
         * 3) item content
         *    If possible, do comprehensive sanity check.
         *    NOTE: All checks must only rely on the item data itself.
         */
        for (slot = 0; slot < nritems; slot++) {
                u32 item_end_expected;
                u64 item_data_end;
                enum btrfs_tree_block_status ret;

                btrfs_item_key_to_cpu(leaf, &key, slot);

                /* Make sure the keys are in the right order */
                if (unlikely(btrfs_comp_cpu_keys(&prev_key, &key) >= 0)) {
                        generic_err(leaf, slot,
        "bad key order, prev (%llu %u %llu) current (%llu %u %llu)",
                                prev_key.objectid, prev_key.type,
                                prev_key.offset, key.objectid, key.type,
                                key.offset);
                        return BTRFS_TREE_BLOCK_BAD_KEY_ORDER;
                }

                item_data_end = (u64)btrfs_item_offset(leaf, slot) +
                                btrfs_item_size(leaf, slot);
                /*
                 * Make sure the offset and ends are right, remember that the
                 * item data starts at the end of the leaf and grows towards the
                 * front.
                 */
                if (slot == 0)
                        item_end_expected = BTRFS_LEAF_DATA_SIZE(fs_info);
                else
                        item_end_expected = btrfs_item_offset(leaf,
                                                                 slot - 1);
                if (unlikely(item_data_end != item_end_expected)) {
                        generic_err(leaf, slot,
                                "unexpected item end, have %llu expect %u",
                                item_data_end, item_end_expected);
                        return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
                }

                /*
                 * Check to make sure that we don't point outside of the leaf,
                 * just in case all the items are consistent to each other, but
                 * all point outside of the leaf.
                 */
                if (unlikely(item_data_end > BTRFS_LEAF_DATA_SIZE(fs_info))) {
                        generic_err(leaf, slot,
                        "slot end outside of leaf, have %llu expect range [0, %u]",
                                item_data_end, BTRFS_LEAF_DATA_SIZE(fs_info));
                        return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
                }

                /* Also check if the item pointer overlaps with btrfs item. */
                if (unlikely(btrfs_item_ptr_offset(leaf, slot) <
                             btrfs_item_nr_offset(leaf, slot) + sizeof(struct btrfs_item))) {
                        generic_err(leaf, slot,
                "slot overlaps with its data, item end %lu data start %lu",
                                btrfs_item_nr_offset(leaf, slot) +
                                sizeof(struct btrfs_item),
                                btrfs_item_ptr_offset(leaf, slot));
                        return BTRFS_TREE_BLOCK_INVALID_OFFSETS;
                }

                /* Check if the item size and content meet other criteria. */
                ret = check_leaf_item(leaf, &key, slot, &prev_key);
                if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
                        return ret;

                prev_key.objectid = key.objectid;
                prev_key.type = key.type;
                prev_key.offset = key.offset;
        }

        return BTRFS_TREE_BLOCK_CLEAN;
}

int btrfs_check_leaf(struct extent_buffer *leaf)
{
        enum btrfs_tree_block_status ret;

        ret = __btrfs_check_leaf(leaf);
        if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
                return -EUCLEAN;
        return 0;
}
ALLOW_ERROR_INJECTION(btrfs_check_leaf, ERRNO);

enum btrfs_tree_block_status __btrfs_check_node(struct extent_buffer *node)
{
        struct btrfs_fs_info *fs_info = node->fs_info;
        unsigned long nr = btrfs_header_nritems(node);
        struct btrfs_key key, next_key;
        int slot;
        int level = btrfs_header_level(node);
        u64 bytenr;

        if (unlikely(!btrfs_header_flag(node, BTRFS_HEADER_FLAG_WRITTEN))) {
                generic_err(node, 0, "invalid flag for node, WRITTEN not set");
                return BTRFS_TREE_BLOCK_WRITTEN_NOT_SET;
        }

        if (unlikely(level <= 0 || level >= BTRFS_MAX_LEVEL)) {
                generic_err(node, 0,
                        "invalid level for node, have %d expect [1, %d]",
                        level, BTRFS_MAX_LEVEL - 1);
                return BTRFS_TREE_BLOCK_INVALID_LEVEL;
        }
        if (unlikely(nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info))) {
                btrfs_crit(fs_info,
"corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]",
                           btrfs_header_owner(node), node->start,
                           nr == 0 ? "small" : "large", nr,
                           BTRFS_NODEPTRS_PER_BLOCK(fs_info));
                return BTRFS_TREE_BLOCK_INVALID_NRITEMS;
        }

        for (slot = 0; slot < nr - 1; slot++) {
                bytenr = btrfs_node_blockptr(node, slot);
                btrfs_node_key_to_cpu(node, &key, slot);
                btrfs_node_key_to_cpu(node, &next_key, slot + 1);

                if (unlikely(!bytenr)) {
                        generic_err(node, slot,
                                "invalid NULL node pointer");
                        return BTRFS_TREE_BLOCK_INVALID_BLOCKPTR;
                }
                if (unlikely(!IS_ALIGNED(bytenr, fs_info->sectorsize))) {
                        generic_err(node, slot,
                        "unaligned pointer, have %llu should be aligned to %u",
                                bytenr, fs_info->sectorsize);
                        return BTRFS_TREE_BLOCK_INVALID_BLOCKPTR;
                }

                if (unlikely(btrfs_comp_cpu_keys(&key, &next_key) >= 0)) {
                        generic_err(node, slot,
        "bad key order, current (%llu %u %llu) next (%llu %u %llu)",
                                key.objectid, key.type, key.offset,
                                next_key.objectid, next_key.type,
                                next_key.offset);
                        return BTRFS_TREE_BLOCK_BAD_KEY_ORDER;
                }
        }
        return BTRFS_TREE_BLOCK_CLEAN;
}

int btrfs_check_node(struct extent_buffer *node)
{
        enum btrfs_tree_block_status ret;

        ret = __btrfs_check_node(node);
        if (unlikely(ret != BTRFS_TREE_BLOCK_CLEAN))
                return -EUCLEAN;
        return 0;
}
ALLOW_ERROR_INJECTION(btrfs_check_node, ERRNO);

int btrfs_check_eb_owner(const struct extent_buffer *eb, u64 root_owner)
{
        const bool is_subvol = is_fstree(root_owner);
        const u64 eb_owner = btrfs_header_owner(eb);

        /*
         * Skip dummy fs, as selftests don't create unique ebs for each dummy
         * root.
         */
        if (btrfs_is_testing(eb->fs_info))
                return 0;
        /*
         * There are several call sites (backref walking, qgroup, and data
         * reloc) passing 0 as @root_owner, as they are not holding the
         * tree root.  In that case, we can not do a reliable ownership check,
         * so just exit.
         */
        if (root_owner == 0)
                return 0;
        /*
         * These trees use key.offset as their owner, our callers don't have
         * the extra capacity to pass key.offset here.  So we just skip them.
         */
        if (root_owner == BTRFS_TREE_LOG_OBJECTID ||
            root_owner == BTRFS_TREE_RELOC_OBJECTID)
                return 0;

        if (!is_subvol) {
                /* For non-subvolume trees, the eb owner should match root owner */
                if (unlikely(root_owner != eb_owner)) {
                        btrfs_crit(eb->fs_info,
"corrupted %s, root=%llu block=%llu owner mismatch, have %llu expect %llu",
                                btrfs_header_level(eb) == 0 ? "leaf" : "node",
                                root_owner, btrfs_header_bytenr(eb), eb_owner,
                                root_owner);
                        return -EUCLEAN;
                }
                return 0;
        }

        /*
         * For subvolume trees, owners can mismatch, but they should all belong
         * to subvolume trees.
         */
        if (unlikely(is_subvol != is_fstree(eb_owner))) {
                btrfs_crit(eb->fs_info,
"corrupted %s, root=%llu block=%llu owner mismatch, have %llu expect [%llu, %llu]",
                        btrfs_header_level(eb) == 0 ? "leaf" : "node",
                        root_owner, btrfs_header_bytenr(eb), eb_owner,
                        BTRFS_FIRST_FREE_OBJECTID, BTRFS_LAST_FREE_OBJECTID);
                return -EUCLEAN;
        }
        return 0;
}

int btrfs_verify_level_key(struct extent_buffer *eb, int level,
                           struct btrfs_key *first_key, u64 parent_transid)
{
        struct btrfs_fs_info *fs_info = eb->fs_info;
        int found_level;
        struct btrfs_key found_key;
        int ret;

        found_level = btrfs_header_level(eb);
        if (found_level != level) {
                WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
                     KERN_ERR "BTRFS: tree level check failed\n");
                btrfs_err(fs_info,
"tree level mismatch detected, bytenr=%llu level expected=%u has=%u",
                          eb->start, level, found_level);
                return -EIO;
        }

        if (!first_key)
                return 0;

        /*
         * For live tree block (new tree blocks in current transaction),
         * we need proper lock context to avoid race, which is impossible here.
         * So we only checks tree blocks which is read from disk, whose
         * generation <= fs_info->last_trans_committed.
         */
        if (btrfs_header_generation(eb) > btrfs_get_last_trans_committed(fs_info))
                return 0;

        /* We have @first_key, so this @eb must have at least one item */
        if (btrfs_header_nritems(eb) == 0) {
                btrfs_err(fs_info,
                "invalid tree nritems, bytenr=%llu nritems=0 expect >0",
                          eb->start);
                WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
                return -EUCLEAN;
        }

        if (found_level)
                btrfs_node_key_to_cpu(eb, &found_key, 0);
        else
                btrfs_item_key_to_cpu(eb, &found_key, 0);
        ret = btrfs_comp_cpu_keys(first_key, &found_key);

        if (ret) {
                WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
                     KERN_ERR "BTRFS: tree first key check failed\n");
                btrfs_err(fs_info,
"tree first key mismatch detected, bytenr=%llu parent_transid=%llu key expected=(%llu,%u,%llu) has=(%llu,%u,%llu)",
                          eb->start, parent_transid, first_key->objectid,
                          first_key->type, first_key->offset,
                          found_key.objectid, found_key.type,
                          found_key.offset);
        }
        return ret;
}

























































    1 








    1 




    1 















































































   41 




   41 





























   30 
   11 
























































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
// SPDX-License-Identifier: GPL-2.0-only
/*
 * linux/lib/cmdline.c
 * Helper functions generally used for parsing kernel command line
 * and module options.
 *
 * Code and copyrights come from init/main.c and arch/i386/kernel/setup.c.
 *
 * GNU Indent formatting options for this file: -kr -i8 -npsl -pcs
 */

#include <linux/export.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/ctype.h>

/*
 *        If a hyphen was found in get_option, this will handle the
 *        range of numbers, M-N.  This will expand the range and insert
 *        the values[M, M+1, ..., N] into the ints array in get_options.
 */

static int get_range(char **str, int *pint, int n)
{
        int x, inc_counter, upper_range;

        (*str)++;
        upper_range = simple_strtol((*str), NULL, 0);
        inc_counter = upper_range - *pint;
        for (x = *pint; n && x < upper_range; x++, n--)
                *pint++ = x;
        return inc_counter;
}

/**
 *        get_option - Parse integer from an option string
 *        @str: option string
 *        @pint: (optional output) integer value parsed from @str
 *
 *        Read an int from an option string; if available accept a subsequent
 *        comma as well.
 *
 *        When @pint is NULL the function can be used as a validator of
 *        the current option in the string.
 *
 *        Return values:
 *        0 - no int in string
 *        1 - int found, no subsequent comma
 *        2 - int found including a subsequent comma
 *        3 - hyphen found to denote a range
 *
 *        Leading hyphen without integer is no integer case, but we consume it
 *        for the sake of simplification.
 */

int get_option(char **str, int *pint)
{
        char *cur = *str;
        int value;

        if (!cur || !(*cur))
                return 0;
        if (*cur == '-')
                value = -simple_strtoull(++cur, str, 0);
        else
                value = simple_strtoull(cur, str, 0);
        if (pint)
                *pint = value;
        if (cur == *str)
                return 0;
        if (**str == ',') {
                (*str)++;
                return 2;
        }
        if (**str == '-')
                return 3;

        return 1;
}
EXPORT_SYMBOL(get_option);

/**
 *        get_options - Parse a string into a list of integers
 *        @str: String to be parsed
 *        @nints: size of integer array
 *        @ints: integer array (must have room for at least one element)
 *
 *        This function parses a string containing a comma-separated
 *        list of integers, a hyphen-separated range of _positive_ integers,
 *        or a combination of both.  The parse halts when the array is
 *        full, or when no more numbers can be retrieved from the
 *        string.
 *
 *        When @nints is 0, the function just validates the given @str and
 *        returns the amount of parseable integers as described below.
 *
 *        Returns:
 *
 *        The first element is filled by the number of collected integers
 *        in the range. The rest is what was parsed from the @str.
 *
 *        Return value is the character in the string which caused
 *        the parse to end (typically a null terminator, if @str is
 *        completely parseable).
 */

char *get_options(const char *str, int nints, int *ints)
{
        bool validate = (nints == 0);
        int res, i = 1;

        while (i < nints || validate) {
                int *pint = validate ? ints : ints + i;

                res = get_option((char **)&str, pint);
                if (res == 0)
                        break;
                if (res == 3) {
                        int n = validate ? 0 : nints - i;
                        int range_nums;

                        range_nums = get_range((char **)&str, pint, n);
                        if (range_nums < 0)
                                break;
                        /*
                         * Decrement the result by one to leave out the
                         * last number in the range.  The next iteration
                         * will handle the upper number in the range
                         */
                        i += (range_nums - 1);
                }
                i++;
                if (res == 1)
                        break;
        }
        ints[0] = i - 1;
        return (char *)str;
}
EXPORT_SYMBOL(get_options);

/**
 *        memparse - parse a string with mem suffixes into a number
 *        @ptr: Where parse begins
 *        @retptr: (output) Optional pointer to next char after parse completes
 *
 *        Parses a string into a number.  The number stored at @ptr is
 *        potentially suffixed with K, M, G, T, P, E.
 */

unsigned long long memparse(const char *ptr, char **retptr)
{
        char *endptr;        /* local pointer to end of parsed string */

        unsigned long long ret = simple_strtoull(ptr, &endptr, 0);

        switch (*endptr) {
        case 'E':
        case 'e':
                ret <<= 10;
                fallthrough;
        case 'P':
        case 'p':
                ret <<= 10;
                fallthrough;
        case 'T':
        case 't':
                ret <<= 10;
                fallthrough;
        case 'G':
        case 'g':
                ret <<= 10;
                fallthrough;
        case 'M':
        case 'm':
                ret <<= 10;
                fallthrough;
        case 'K':
        case 'k':
                ret <<= 10;
                endptr++;
                fallthrough;
        default:
                break;
        }

        if (retptr)
                *retptr = endptr;

        return ret;
}
EXPORT_SYMBOL(memparse);

/**
 *        parse_option_str - Parse a string and check an option is set or not
 *        @str: String to be parsed
 *        @option: option name
 *
 *        This function parses a string containing a comma-separated list of
 *        strings like a=b,c.
 *
 *        Return true if there's such option in the string, or return false.
 */
bool parse_option_str(const char *str, const char *option)
{
        while (*str) {
                if (!strncmp(str, option, strlen(option))) {
                        str += strlen(option);
                        if (!*str || *str == ',')
                                return true;
                }

                while (*str && *str != ',')
                        str++;

                if (*str == ',')
                        str++;
        }

        return false;
}

/*
 * Parse a string to get a param value pair.
 * You can use " around spaces, but can't escape ".
 * Hyphens and underscores equivalent in parameter names.
 */
char *next_arg(char *args, char **param, char **val)
{
        unsigned int i, equals = 0;
        int in_quote = 0, quoted = 0;

        if (*args == '"') {
                args++;
                in_quote = 1;
                quoted = 1;
        }

        for (i = 0; args[i]; i++) {
                if (isspace(args[i]) && !in_quote)
                        break;
                if (equals == 0) {
                        if (args[i] == '=')
                                equals = i;
                }
                if (args[i] == '"')
                        in_quote = !in_quote;
        }

        *param = args;
        if (!equals)
                *val = NULL;
        else {
                args[equals] = '\0';
                *val = args + equals + 1;

                /* Don't include quotes in value. */
                if (**val == '"') {
                        (*val)++;
                        if (args[i-1] == '"')
                                args[i-1] = '\0';
                }
        }
        if (quoted && i > 0 && args[i-1] == '"')
                args[i-1] = '\0';

        if (args[i]) {
                args[i] = '\0';
                args += i + 1;
        } else
                args += i;

        /* Chew up trailing spaces. */
        return skip_spaces(args);
}
EXPORT_SYMBOL(next_arg);













































































    2 















    2 






    2 












    2 







    2 

































































































    3 


    3 








































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
/*
   BlueZ - Bluetooth protocol stack for Linux

   Copyright (C) 2015  Intel Corporation

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

#include <linux/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include <net/bluetooth/hci_mon.h>
#include <net/bluetooth/mgmt.h>

#include "mgmt_util.h"

static struct sk_buff *create_monitor_ctrl_event(__le16 index, u32 cookie,
                                                 u16 opcode, u16 len, void *buf)
{
        struct hci_mon_hdr *hdr;
        struct sk_buff *skb;

        skb = bt_skb_alloc(6 + len, GFP_ATOMIC);
        if (!skb)
                return NULL;

        put_unaligned_le32(cookie, skb_put(skb, 4));
        put_unaligned_le16(opcode, skb_put(skb, 2));

        if (buf)
                skb_put_data(skb, buf, len);

        __net_timestamp(skb);

        hdr = skb_push(skb, HCI_MON_HDR_SIZE);
        hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT);
        hdr->index = index;
        hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);

        return skb;
}

struct sk_buff *mgmt_alloc_skb(struct hci_dev *hdev, u16 opcode,
                               unsigned int size)
{
        struct sk_buff *skb;

        skb = alloc_skb(sizeof(struct mgmt_hdr) + size, GFP_KERNEL);
        if (!skb)
                return skb;

        skb_reserve(skb, sizeof(struct mgmt_hdr));
        bt_cb(skb)->mgmt.hdev = hdev;
        bt_cb(skb)->mgmt.opcode = opcode;

        return skb;
}

int mgmt_send_event_skb(unsigned short channel, struct sk_buff *skb, int flag,
                        struct sock *skip_sk)
{
        struct hci_dev *hdev;
        struct mgmt_hdr *hdr;
        int len;

        if (!skb)
                return -EINVAL;

        len = skb->len;
        hdev = bt_cb(skb)->mgmt.hdev;

        /* Time stamp */
        __net_timestamp(skb);

        /* Send just the data, without headers, to the monitor */
        if (channel == HCI_CHANNEL_CONTROL)
                hci_send_monitor_ctrl_event(hdev, bt_cb(skb)->mgmt.opcode,
                                            skb->data, skb->len,
                                            skb_get_ktime(skb), flag, skip_sk);

        hdr = skb_push(skb, sizeof(*hdr));
        hdr->opcode = cpu_to_le16(bt_cb(skb)->mgmt.opcode);
        if (hdev)
                hdr->index = cpu_to_le16(hdev->id);
        else
                hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
        hdr->len = cpu_to_le16(len);

        hci_send_to_channel(channel, skb, flag, skip_sk);

        kfree_skb(skb);
        return 0;
}

int mgmt_send_event(u16 event, struct hci_dev *hdev, unsigned short channel,
                    void *data, u16 data_len, int flag, struct sock *skip_sk)
{
        struct sk_buff *skb;

        skb = mgmt_alloc_skb(hdev, event, data_len);
        if (!skb)
                return -ENOMEM;

        if (data)
                skb_put_data(skb, data, data_len);

        return mgmt_send_event_skb(channel, skb, flag, skip_sk);
}

int mgmt_cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
{
        struct sk_buff *skb, *mskb;
        struct mgmt_hdr *hdr;
        struct mgmt_ev_cmd_status *ev;
        int err;

        BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);

        skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
        if (!skb)
                return -ENOMEM;

        hdr = skb_put(skb, sizeof(*hdr));

        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
        hdr->index = cpu_to_le16(index);
        hdr->len = cpu_to_le16(sizeof(*ev));

        ev = skb_put(skb, sizeof(*ev));
        ev->status = status;
        ev->opcode = cpu_to_le16(cmd);

        mskb = create_monitor_ctrl_event(hdr->index, hci_sock_get_cookie(sk),
                                         MGMT_EV_CMD_STATUS, sizeof(*ev), ev);
        if (mskb)
                skb->tstamp = mskb->tstamp;
        else
                __net_timestamp(skb);

        err = sock_queue_rcv_skb(sk, skb);
        if (err < 0)
                kfree_skb(skb);

        if (mskb) {
                hci_send_to_channel(HCI_CHANNEL_MONITOR, mskb,
                                    HCI_SOCK_TRUSTED, NULL);
                kfree_skb(mskb);
        }

        return err;
}

int mgmt_cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
                      void *rp, size_t rp_len)
{
        struct sk_buff *skb, *mskb;
        struct mgmt_hdr *hdr;
        struct mgmt_ev_cmd_complete *ev;
        int err;

        BT_DBG("sock %p", sk);

        skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
        if (!skb)
                return -ENOMEM;

        hdr = skb_put(skb, sizeof(*hdr));

        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
        hdr->index = cpu_to_le16(index);
        hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);

        ev = skb_put(skb, sizeof(*ev) + rp_len);
        ev->opcode = cpu_to_le16(cmd);
        ev->status = status;

        if (rp)
                memcpy(ev->data, rp, rp_len);

        mskb = create_monitor_ctrl_event(hdr->index, hci_sock_get_cookie(sk),
                                         MGMT_EV_CMD_COMPLETE,
                                         sizeof(*ev) + rp_len, ev);
        if (mskb)
                skb->tstamp = mskb->tstamp;
        else
                __net_timestamp(skb);

        err = sock_queue_rcv_skb(sk, skb);
        if (err < 0)
                kfree_skb(skb);

        if (mskb) {
                hci_send_to_channel(HCI_CHANNEL_MONITOR, mskb,
                                    HCI_SOCK_TRUSTED, NULL);
                kfree_skb(mskb);
        }

        return err;
}

struct mgmt_pending_cmd *mgmt_pending_find(unsigned short channel, u16 opcode,
                                           struct hci_dev *hdev)
{
        struct mgmt_pending_cmd *cmd;

        list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
                if (hci_sock_get_channel(cmd->sk) != channel)
                        continue;
                if (cmd->opcode == opcode)
                        return cmd;
        }

        return NULL;
}

struct mgmt_pending_cmd *mgmt_pending_find_data(unsigned short channel,
                                                u16 opcode,
                                                struct hci_dev *hdev,
                                                const void *data)
{
        struct mgmt_pending_cmd *cmd;

        list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
                if (cmd->user_data != data)
                        continue;
                if (cmd->opcode == opcode)
                        return cmd;
        }

        return NULL;
}

void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
                          void (*cb)(struct mgmt_pending_cmd *cmd, void *data),
                          void *data)
{
        struct mgmt_pending_cmd *cmd, *tmp;

        list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
                if (opcode > 0 && cmd->opcode != opcode)
                        continue;

                cb(cmd, data);
        }
}

struct mgmt_pending_cmd *mgmt_pending_new(struct sock *sk, u16 opcode,
                                          struct hci_dev *hdev,
                                          void *data, u16 len)
{
        struct mgmt_pending_cmd *cmd;

        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
        if (!cmd)
                return NULL;

        cmd->opcode = opcode;
        cmd->index = hdev->id;

        cmd->param = kmemdup(data, len, GFP_KERNEL);
        if (!cmd->param) {
                kfree(cmd);
                return NULL;
        }

        cmd->param_len = len;

        cmd->sk = sk;
        sock_hold(sk);

        return cmd;
}

struct mgmt_pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
                                          struct hci_dev *hdev,
                                          void *data, u16 len)
{
        struct mgmt_pending_cmd *cmd;

        cmd = mgmt_pending_new(sk, opcode, hdev, data, len);
        if (!cmd)
                return NULL;

        list_add_tail(&cmd->list, &hdev->mgmt_pending);

        return cmd;
}

void mgmt_pending_free(struct mgmt_pending_cmd *cmd)
{
        sock_put(cmd->sk);
        kfree(cmd->param);
        kfree(cmd);
}

void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
{
        list_del(&cmd->list);
        mgmt_pending_free(cmd);
}

void mgmt_mesh_foreach(struct hci_dev *hdev,
                       void (*cb)(struct mgmt_mesh_tx *mesh_tx, void *data),
                       void *data, struct sock *sk)
{
        struct mgmt_mesh_tx *mesh_tx, *tmp;

        list_for_each_entry_safe(mesh_tx, tmp, &hdev->mgmt_pending, list) {
                if (!sk || mesh_tx->sk == sk)
                        cb(mesh_tx, data);
        }
}

struct mgmt_mesh_tx *mgmt_mesh_next(struct hci_dev *hdev, struct sock *sk)
{
        struct mgmt_mesh_tx *mesh_tx;

        if (list_empty(&hdev->mesh_pending))
                return NULL;

        list_for_each_entry(mesh_tx, &hdev->mesh_pending, list) {
                if (!sk || mesh_tx->sk == sk)
                        return mesh_tx;
        }

        return NULL;
}

struct mgmt_mesh_tx *mgmt_mesh_find(struct hci_dev *hdev, u8 handle)
{
        struct mgmt_mesh_tx *mesh_tx;

        if (list_empty(&hdev->mesh_pending))
                return NULL;

        list_for_each_entry(mesh_tx, &hdev->mesh_pending, list) {
                if (mesh_tx->handle == handle)
                        return mesh_tx;
        }

        return NULL;
}

struct mgmt_mesh_tx *mgmt_mesh_add(struct sock *sk, struct hci_dev *hdev,
                                   void *data, u16 len)
{
        struct mgmt_mesh_tx *mesh_tx;

        mesh_tx = kzalloc(sizeof(*mesh_tx), GFP_KERNEL);
        if (!mesh_tx)
                return NULL;

        hdev->mesh_send_ref++;
        if (!hdev->mesh_send_ref)
                hdev->mesh_send_ref++;

        mesh_tx->handle = hdev->mesh_send_ref;
        mesh_tx->index = hdev->id;
        memcpy(mesh_tx->param, data, len);
        mesh_tx->param_len = len;
        mesh_tx->sk = sk;
        sock_hold(sk);

        list_add_tail(&mesh_tx->list, &hdev->mesh_pending);

        return mesh_tx;
}

void mgmt_mesh_remove(struct mgmt_mesh_tx *mesh_tx)
{
        list_del(&mesh_tx->list);
        sock_put(mesh_tx->sk);
        kfree(mesh_tx);
}




































   79 












   78 
   78 












   79 





   79 






















   79 



   76 

















    2 



   39 














   76 






   39 


   75 





   36 





   76 


















   48 



   39 


   76 









   89 



   88 

   89 












   89 





   89 



   47 














   80 




   47 



   87 




















   89 












   59 









    3 















   63 
















   63 


   63 





   57 
   61 


    4 







   20 

   79 







   87 

   29 





1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Squashfs - a compressed read only filesystem for Linux
 *
 * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008
 * Phillip Lougher <phillip@squashfs.org.uk>
 *
 * block.c
 */

/*
 * This file implements the low-level routines to read and decompress
 * datablocks and metadata blocks.
 */

#include <linux/blkdev.h>
#include <linux/fs.h>
#include <linux/vfs.h>
#include <linux/slab.h>
#include <linux/pagemap.h>
#include <linux/string.h>
#include <linux/bio.h>

#include "squashfs_fs.h"
#include "squashfs_fs_sb.h"
#include "squashfs.h"
#include "decompressor.h"
#include "page_actor.h"

/*
 * Returns the amount of bytes copied to the page actor.
 */
static int copy_bio_to_actor(struct bio *bio,
                             struct squashfs_page_actor *actor,
                             int offset, int req_length)
{
        void *actor_addr;
        struct bvec_iter_all iter_all = {};
        struct bio_vec *bvec = bvec_init_iter_all(&iter_all);
        int copied_bytes = 0;
        int actor_offset = 0;

        squashfs_actor_nobuff(actor);
        actor_addr = squashfs_first_page(actor);

        if (WARN_ON_ONCE(!bio_next_segment(bio, &iter_all)))
                return 0;

        while (copied_bytes < req_length) {
                int bytes_to_copy = min_t(int, bvec->bv_len - offset,
                                          PAGE_SIZE - actor_offset);

                bytes_to_copy = min_t(int, bytes_to_copy,
                                      req_length - copied_bytes);
                if (!IS_ERR(actor_addr))
                        memcpy(actor_addr + actor_offset, bvec_virt(bvec) +
                                        offset, bytes_to_copy);

                actor_offset += bytes_to_copy;
                copied_bytes += bytes_to_copy;
                offset += bytes_to_copy;

                if (actor_offset >= PAGE_SIZE) {
                        actor_addr = squashfs_next_page(actor);
                        if (!actor_addr)
                                break;
                        actor_offset = 0;
                }
                if (offset >= bvec->bv_len) {
                        if (!bio_next_segment(bio, &iter_all))
                                break;
                        offset = 0;
                }
        }
        squashfs_finish_page(actor);
        return copied_bytes;
}

static int squashfs_bio_read_cached(struct bio *fullbio,
                struct address_space *cache_mapping, u64 index, int length,
                u64 read_start, u64 read_end, int page_count)
{
        struct page *head_to_cache = NULL, *tail_to_cache = NULL;
        struct block_device *bdev = fullbio->bi_bdev;
        int start_idx = 0, end_idx = 0;
        struct bvec_iter_all iter_all;
        struct bio *bio = NULL;
        struct bio_vec *bv;
        int idx = 0;
        int err = 0;

        bio_for_each_segment_all(bv, fullbio, iter_all) {
                struct page *page = bv->bv_page;

                if (page->mapping == cache_mapping) {
                        idx++;
                        continue;
                }

                /*
                 * We only use this when the device block size is the same as
                 * the page size, so read_start and read_end cover full pages.
                 *
                 * Compare these to the original required index and length to
                 * only cache pages which were requested partially, since these
                 * are the ones which are likely to be needed when reading
                 * adjacent blocks.
                 */
                if (idx == 0 && index != read_start)
                        head_to_cache = page;
                else if (idx == page_count - 1 && index + length != read_end)
                        tail_to_cache = page;

                if (!bio || idx != end_idx) {
                        struct bio *new = bio_alloc_clone(bdev, fullbio,
                                                          GFP_NOIO, &fs_bio_set);

                        if (bio) {
                                bio_trim(bio, start_idx * PAGE_SECTORS,
                                         (end_idx - start_idx) * PAGE_SECTORS);
                                bio_chain(bio, new);
                                submit_bio(bio);
                        }

                        bio = new;
                        start_idx = idx;
                }

                idx++;
                end_idx = idx;
        }

        if (bio) {
                bio_trim(bio, start_idx * PAGE_SECTORS,
                         (end_idx - start_idx) * PAGE_SECTORS);
                err = submit_bio_wait(bio);
                bio_put(bio);
        }

        if (err)
                return err;

        if (head_to_cache) {
                int ret = add_to_page_cache_lru(head_to_cache, cache_mapping,
                                                read_start >> PAGE_SHIFT,
                                                GFP_NOIO);

                if (!ret) {
                        SetPageUptodate(head_to_cache);
                        unlock_page(head_to_cache);
                }

        }

        if (tail_to_cache) {
                int ret = add_to_page_cache_lru(tail_to_cache, cache_mapping,
                                                (read_end >> PAGE_SHIFT) - 1,
                                                GFP_NOIO);

                if (!ret) {
                        SetPageUptodate(tail_to_cache);
                        unlock_page(tail_to_cache);
                }
        }

        return 0;
}

static struct page *squashfs_get_cache_page(struct address_space *mapping,
                                            pgoff_t index)
{
        struct page *page;

        if (!mapping)
                return NULL;

        page = find_get_page(mapping, index);
        if (!page)
                return NULL;

        if (!PageUptodate(page)) {
                put_page(page);
                return NULL;
        }

        return page;
}

static int squashfs_bio_read(struct super_block *sb, u64 index, int length,
                             struct bio **biop, int *block_offset)
{
        struct squashfs_sb_info *msblk = sb->s_fs_info;
        struct address_space *cache_mapping = msblk->cache_mapping;
        const u64 read_start = round_down(index, msblk->devblksize);
        const sector_t block = read_start >> msblk->devblksize_log2;
        const u64 read_end = round_up(index + length, msblk->devblksize);
        const sector_t block_end = read_end >> msblk->devblksize_log2;
        int offset = read_start - round_down(index, PAGE_SIZE);
        int total_len = (block_end - block) << msblk->devblksize_log2;
        const int page_count = DIV_ROUND_UP(total_len + offset, PAGE_SIZE);
        int error, i;
        struct bio *bio;

        bio = bio_kmalloc(page_count, GFP_NOIO);
        if (!bio)
                return -ENOMEM;
        bio_init(bio, sb->s_bdev, bio->bi_inline_vecs, page_count, REQ_OP_READ);
        bio->bi_iter.bi_sector = block * (msblk->devblksize >> SECTOR_SHIFT);

        for (i = 0; i < page_count; ++i) {
                unsigned int len =
                        min_t(unsigned int, PAGE_SIZE - offset, total_len);
                pgoff_t index = (read_start >> PAGE_SHIFT) + i;
                struct page *page;

                page = squashfs_get_cache_page(cache_mapping, index);
                if (!page)
                        page = alloc_page(GFP_NOIO);

                if (!page) {
                        error = -ENOMEM;
                        goto out_free_bio;
                }

                /*
                 * Use the __ version to avoid merging since we need each page
                 * to be separate when we check for and avoid cached pages.
                 */
                __bio_add_page(bio, page, len, offset);
                offset = 0;
                total_len -= len;
        }

        if (cache_mapping)
                error = squashfs_bio_read_cached(bio, cache_mapping, index,
                                                 length, read_start, read_end,
                                                 page_count);
        else
                error = submit_bio_wait(bio);
        if (error)
                goto out_free_bio;

        *biop = bio;
        *block_offset = index & ((1 << msblk->devblksize_log2) - 1);
        return 0;

out_free_bio:
        bio_free_pages(bio);
        bio_uninit(bio);
        kfree(bio);
        return error;
}

/*
 * Read and decompress a metadata block or datablock.  Length is non-zero
 * if a datablock is being read (the size is stored elsewhere in the
 * filesystem), otherwise the length is obtained from the first two bytes of
 * the metadata block.  A bit in the length field indicates if the block
 * is stored uncompressed in the filesystem (usually because compression
 * generated a larger block - this does occasionally happen with compression
 * algorithms).
 */
int squashfs_read_data(struct super_block *sb, u64 index, int length,
                       u64 *next_index, struct squashfs_page_actor *output)
{
        struct squashfs_sb_info *msblk = sb->s_fs_info;
        struct bio *bio = NULL;
        int compressed;
        int res;
        int offset;

        if (length) {
                /*
                 * Datablock.
                 */
                compressed = SQUASHFS_COMPRESSED_BLOCK(length);
                length = SQUASHFS_COMPRESSED_SIZE_BLOCK(length);
                TRACE("Block @ 0x%llx, %scompressed size %d, src size %d\n",
                        index, compressed ? "" : "un", length, output->length);
        } else {
                /*
                 * Metadata block.
                 */
                const u8 *data;
                struct bvec_iter_all iter_all = {};
                struct bio_vec *bvec = bvec_init_iter_all(&iter_all);

                if (index + 2 > msblk->bytes_used) {
                        res = -EIO;
                        goto out;
                }
                res = squashfs_bio_read(sb, index, 2, &bio, &offset);
                if (res)
                        goto out;

                if (WARN_ON_ONCE(!bio_next_segment(bio, &iter_all))) {
                        res = -EIO;
                        goto out_free_bio;
                }
                /* Extract the length of the metadata block */
                data = bvec_virt(bvec);
                length = data[offset];
                if (offset < bvec->bv_len - 1) {
                        length |= data[offset + 1] << 8;
                } else {
                        if (WARN_ON_ONCE(!bio_next_segment(bio, &iter_all))) {
                                res = -EIO;
                                goto out_free_bio;
                        }
                        data = bvec_virt(bvec);
                        length |= data[0] << 8;
                }
                bio_free_pages(bio);
                bio_uninit(bio);
                kfree(bio);

                compressed = SQUASHFS_COMPRESSED(length);
                length = SQUASHFS_COMPRESSED_SIZE(length);
                index += 2;

                TRACE("Block @ 0x%llx, %scompressed size %d\n", index - 2,
                      compressed ? "" : "un", length);
        }
        if (length <= 0 || length > output->length ||
                        (index + length) > msblk->bytes_used) {
                res = -EIO;
                goto out;
        }

        if (next_index)
                *next_index = index + length;

        res = squashfs_bio_read(sb, index, length, &bio, &offset);
        if (res)
                goto out;

        if (compressed) {
                if (!msblk->stream) {
                        res = -EIO;
                        goto out_free_bio;
                }
                res = msblk->thread_ops->decompress(msblk, bio, offset, length, output);
        } else {
                res = copy_bio_to_actor(bio, output, offset, length);
        }

out_free_bio:
        bio_free_pages(bio);
        bio_uninit(bio);
        kfree(bio);
out:
        if (res < 0) {
                ERROR("Failed to read block 0x%llx: %d\n", index, res);
                if (msblk->panic_on_errors)
                        panic("squashfs read failed");
        }

        return res;
}



















































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    2 





    3 




























































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright (c) 2007 Patrick McHardy <kaber@trash.net>
 *
 * The code this is based on carried the following copyright notice:
 * ---
 * (C) Copyright 2001-2006
 * Alex Zeffertt, Cambridge Broadband Ltd, ajz@cambridgebroadband.com
 * Re-worked by Ben Greear <greearb@candelatech.com>
 * ---
 */
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/errno.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/rculist.h>
#include <linux/notifier.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/net_tstamp.h>
#include <linux/ethtool.h>
#include <linux/if_arp.h>
#include <linux/if_vlan.h>
#include <linux/if_link.h>
#include <linux/if_macvlan.h>
#include <linux/hash.h>
#include <linux/workqueue.h>
#include <net/rtnetlink.h>
#include <net/xfrm.h>
#include <linux/netpoll.h>
#include <linux/phy.h>

#define MACVLAN_HASH_BITS        8
#define MACVLAN_HASH_SIZE        (1<<MACVLAN_HASH_BITS)
#define MACVLAN_DEFAULT_BC_QUEUE_LEN        1000

#define MACVLAN_F_PASSTHRU        1
#define MACVLAN_F_ADDRCHANGE        2

struct macvlan_port {
        struct net_device        *dev;
        struct hlist_head        vlan_hash[MACVLAN_HASH_SIZE];
        struct list_head        vlans;
        struct sk_buff_head        bc_queue;
        struct work_struct        bc_work;
        u32                        bc_queue_len_used;
        int                        bc_cutoff;
        u32                        flags;
        int                        count;
        struct hlist_head        vlan_source_hash[MACVLAN_HASH_SIZE];
        DECLARE_BITMAP(bc_filter, MACVLAN_MC_FILTER_SZ);
        DECLARE_BITMAP(mc_filter, MACVLAN_MC_FILTER_SZ);
        unsigned char           perm_addr[ETH_ALEN];
};

struct macvlan_source_entry {
        struct hlist_node        hlist;
        struct macvlan_dev        *vlan;
        unsigned char                addr[6+2] __aligned(sizeof(u16));
        struct rcu_head                rcu;
};

struct macvlan_skb_cb {
        const struct macvlan_dev *src;
};

#define MACVLAN_SKB_CB(__skb) ((struct macvlan_skb_cb *)&((__skb)->cb[0]))

static void macvlan_port_destroy(struct net_device *dev);
static void update_port_bc_queue_len(struct macvlan_port *port);

static inline bool macvlan_passthru(const struct macvlan_port *port)
{
        return port->flags & MACVLAN_F_PASSTHRU;
}

static inline void macvlan_set_passthru(struct macvlan_port *port)
{
        port->flags |= MACVLAN_F_PASSTHRU;
}

static inline bool macvlan_addr_change(const struct macvlan_port *port)
{
        return port->flags & MACVLAN_F_ADDRCHANGE;
}

static inline void macvlan_set_addr_change(struct macvlan_port *port)
{
        port->flags |= MACVLAN_F_ADDRCHANGE;
}

static inline void macvlan_clear_addr_change(struct macvlan_port *port)
{
        port->flags &= ~MACVLAN_F_ADDRCHANGE;
}

/* Hash Ethernet address */
static u32 macvlan_eth_hash(const unsigned char *addr)
{
        u64 value = get_unaligned((u64 *)addr);

        /* only want 6 bytes */
#ifdef __BIG_ENDIAN
        value >>= 16;
#else
        value <<= 16;
#endif
        return hash_64(value, MACVLAN_HASH_BITS);
}

static struct macvlan_port *macvlan_port_get_rcu(const struct net_device *dev)
{
        return rcu_dereference(dev->rx_handler_data);
}

static struct macvlan_port *macvlan_port_get_rtnl(const struct net_device *dev)
{
        return rtnl_dereference(dev->rx_handler_data);
}

static struct macvlan_dev *macvlan_hash_lookup(const struct macvlan_port *port,
                                               const unsigned char *addr)
{
        struct macvlan_dev *vlan;
        u32 idx = macvlan_eth_hash(addr);

        hlist_for_each_entry_rcu(vlan, &port->vlan_hash[idx], hlist,
                                 lockdep_rtnl_is_held()) {
                if (ether_addr_equal_64bits(vlan->dev->dev_addr, addr))
                        return vlan;
        }
        return NULL;
}

static struct macvlan_source_entry *macvlan_hash_lookup_source(
        const struct macvlan_dev *vlan,
        const unsigned char *addr)
{
        struct macvlan_source_entry *entry;
        u32 idx = macvlan_eth_hash(addr);
        struct hlist_head *h = &vlan->port->vlan_source_hash[idx];

        hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) {
                if (ether_addr_equal_64bits(entry->addr, addr) &&
                    entry->vlan == vlan)
                        return entry;
        }
        return NULL;
}

static int macvlan_hash_add_source(struct macvlan_dev *vlan,
                                   const unsigned char *addr)
{
        struct macvlan_port *port = vlan->port;
        struct macvlan_source_entry *entry;
        struct hlist_head *h;

        entry = macvlan_hash_lookup_source(vlan, addr);
        if (entry)
                return 0;

        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
        if (!entry)
                return -ENOMEM;

        ether_addr_copy(entry->addr, addr);
        entry->vlan = vlan;
        h = &port->vlan_source_hash[macvlan_eth_hash(addr)];
        hlist_add_head_rcu(&entry->hlist, h);
        vlan->macaddr_count++;

        return 0;
}

static void macvlan_hash_add(struct macvlan_dev *vlan)
{
        struct macvlan_port *port = vlan->port;
        const unsigned char *addr = vlan->dev->dev_addr;
        u32 idx = macvlan_eth_hash(addr);

        hlist_add_head_rcu(&vlan->hlist, &port->vlan_hash[idx]);
}

static void macvlan_hash_del_source(struct macvlan_source_entry *entry)
{
        hlist_del_rcu(&entry->hlist);
        kfree_rcu(entry, rcu);
}

static void macvlan_hash_del(struct macvlan_dev *vlan, bool sync)
{
        hlist_del_rcu(&vlan->hlist);
        if (sync)
                synchronize_rcu();
}

static void macvlan_hash_change_addr(struct macvlan_dev *vlan,
                                        const unsigned char *addr)
{
        macvlan_hash_del(vlan, true);
        /* Now that we are unhashed it is safe to change the device
         * address without confusing packet delivery.
         */
        eth_hw_addr_set(vlan->dev, addr);
        macvlan_hash_add(vlan);
}

static bool macvlan_addr_busy(const struct macvlan_port *port,
                              const unsigned char *addr)
{
        /* Test to see if the specified address is
         * currently in use by the underlying device or
         * another macvlan.
         */
        if (!macvlan_passthru(port) && !macvlan_addr_change(port) &&
            ether_addr_equal_64bits(port->dev->dev_addr, addr))
                return true;

        if (macvlan_hash_lookup(port, addr))
                return true;

        return false;
}


static int macvlan_broadcast_one(struct sk_buff *skb,
                                 const struct macvlan_dev *vlan,
                                 const struct ethhdr *eth, bool local)
{
        struct net_device *dev = vlan->dev;

        if (local)
                return __dev_forward_skb(dev, skb);

        skb->dev = dev;
        if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
                skb->pkt_type = PACKET_BROADCAST;
        else
                skb->pkt_type = PACKET_MULTICAST;

        return 0;
}

static u32 macvlan_hash_mix(const struct macvlan_dev *vlan)
{
        return (u32)(((unsigned long)vlan) >> L1_CACHE_SHIFT);
}


static unsigned int mc_hash(const struct macvlan_dev *vlan,
                            const unsigned char *addr)
{
        u32 val = __get_unaligned_cpu32(addr + 2);

        val ^= macvlan_hash_mix(vlan);
        return hash_32(val, MACVLAN_MC_FILTER_BITS);
}

static void macvlan_broadcast(struct sk_buff *skb,
                              const struct macvlan_port *port,
                              struct net_device *src,
                              enum macvlan_mode mode)
{
        const struct ethhdr *eth = eth_hdr(skb);
        const struct macvlan_dev *vlan;
        struct sk_buff *nskb;
        unsigned int i;
        int err;
        unsigned int hash;

        if (skb->protocol == htons(ETH_P_PAUSE))
                return;

        hash_for_each_rcu(port->vlan_hash, i, vlan, hlist) {
                if (vlan->dev == src || !(vlan->mode & mode))
                        continue;

                hash = mc_hash(vlan, eth->h_dest);
                if (!test_bit(hash, vlan->mc_filter))
                        continue;

                err = NET_RX_DROP;
                nskb = skb_clone(skb, GFP_ATOMIC);
                if (likely(nskb))
                        err = macvlan_broadcast_one(nskb, vlan, eth,
                                        mode == MACVLAN_MODE_BRIDGE) ?:
                              netif_rx(nskb);
                macvlan_count_rx(vlan, skb->len + ETH_HLEN,
                                 err == NET_RX_SUCCESS, true);
        }
}

static void macvlan_multicast_rx(const struct macvlan_port *port,
                                 const struct macvlan_dev *src,
                                 struct sk_buff *skb)
{
        if (!src)
                /* frame comes from an external address */
                macvlan_broadcast(skb, port, NULL,
                                  MACVLAN_MODE_PRIVATE |
                                  MACVLAN_MODE_VEPA    |
                                  MACVLAN_MODE_PASSTHRU|
                                  MACVLAN_MODE_BRIDGE);
        else if (src->mode == MACVLAN_MODE_VEPA)
                /* flood to everyone except source */
                macvlan_broadcast(skb, port, src->dev,
                                  MACVLAN_MODE_VEPA |
                                  MACVLAN_MODE_BRIDGE);
        else
                /*
                 * flood only to VEPA ports, bridge ports
                 * already saw the frame on the way out.
                 */
                macvlan_broadcast(skb, port, src->dev,
                                  MACVLAN_MODE_VEPA);
}

static void macvlan_process_broadcast(struct work_struct *w)
{
        struct macvlan_port *port = container_of(w, struct macvlan_port,
                                                 bc_work);
        struct sk_buff *skb;
        struct sk_buff_head list;

        __skb_queue_head_init(&list);

        spin_lock_bh(&port->bc_queue.lock);
        skb_queue_splice_tail_init(&port->bc_queue, &list);
        spin_unlock_bh(&port->bc_queue.lock);

        while ((skb = __skb_dequeue(&list))) {
                const struct macvlan_dev *src = MACVLAN_SKB_CB(skb)->src;

                rcu_read_lock();
                macvlan_multicast_rx(port, src, skb);
                rcu_read_unlock();

                if (src)
                        dev_put(src->dev);
                consume_skb(skb);

                cond_resched();
        }
}

static void macvlan_broadcast_enqueue(struct macvlan_port *port,
                                      const struct macvlan_dev *src,
                                      struct sk_buff *skb)
{
        struct sk_buff *nskb;
        int err = -ENOMEM;

        nskb = skb_clone(skb, GFP_ATOMIC);
        if (!nskb)
                goto err;

        MACVLAN_SKB_CB(nskb)->src = src;

        spin_lock(&port->bc_queue.lock);
        if (skb_queue_len(&port->bc_queue) < port->bc_queue_len_used) {
                if (src)
                        dev_hold(src->dev);
                __skb_queue_tail(&port->bc_queue, nskb);
                err = 0;
        }
        spin_unlock(&port->bc_queue.lock);

        queue_work(system_unbound_wq, &port->bc_work);

        if (err)
                goto free_nskb;

        return;

free_nskb:
        kfree_skb(nskb);
err:
        dev_core_stats_rx_dropped_inc(skb->dev);
}

static void macvlan_flush_sources(struct macvlan_port *port,
                                  struct macvlan_dev *vlan)
{
        struct macvlan_source_entry *entry;
        struct hlist_node *next;
        int i;

        hash_for_each_safe(port->vlan_source_hash, i, next, entry, hlist)
                if (entry->vlan == vlan)
                        macvlan_hash_del_source(entry);

        vlan->macaddr_count = 0;
}

static void macvlan_forward_source_one(struct sk_buff *skb,
                                       struct macvlan_dev *vlan)
{
        struct sk_buff *nskb;
        struct net_device *dev;
        int len;
        int ret;

        dev = vlan->dev;
        if (unlikely(!(dev->flags & IFF_UP)))
                return;

        nskb = skb_clone(skb, GFP_ATOMIC);
        if (!nskb)
                return;

        len = nskb->len + ETH_HLEN;
        nskb->dev = dev;

        if (ether_addr_equal_64bits(eth_hdr(skb)->h_dest, dev->dev_addr))
                nskb->pkt_type = PACKET_HOST;

        ret = __netif_rx(nskb);
        macvlan_count_rx(vlan, len, ret == NET_RX_SUCCESS, false);
}

static bool macvlan_forward_source(struct sk_buff *skb,
                                   struct macvlan_port *port,
                                   const unsigned char *addr)
{
        struct macvlan_source_entry *entry;
        u32 idx = macvlan_eth_hash(addr);
        struct hlist_head *h = &port->vlan_source_hash[idx];
        bool consume = false;

        hlist_for_each_entry_rcu(entry, h, hlist) {
                if (ether_addr_equal_64bits(entry->addr, addr)) {
                        if (entry->vlan->flags & MACVLAN_FLAG_NODST)
                                consume = true;
                        macvlan_forward_source_one(skb, entry->vlan);
                }
        }

        return consume;
}

/* called under rcu_read_lock() from netif_receive_skb */
static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
{
        struct macvlan_port *port;
        struct sk_buff *skb = *pskb;
        const struct ethhdr *eth = eth_hdr(skb);
        const struct macvlan_dev *vlan;
        const struct macvlan_dev *src;
        struct net_device *dev;
        unsigned int len = 0;
        int ret;
        rx_handler_result_t handle_res;

        /* Packets from dev_loopback_xmit() do not have L2 header, bail out */
        if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
                return RX_HANDLER_PASS;

        port = macvlan_port_get_rcu(skb->dev);
        if (is_multicast_ether_addr(eth->h_dest)) {
                unsigned int hash;

                skb = ip_check_defrag(dev_net(skb->dev), skb, IP_DEFRAG_MACVLAN);
                if (!skb)
                        return RX_HANDLER_CONSUMED;
                *pskb = skb;
                eth = eth_hdr(skb);
                if (macvlan_forward_source(skb, port, eth->h_source)) {
                        kfree_skb(skb);
                        return RX_HANDLER_CONSUMED;
                }
                src = macvlan_hash_lookup(port, eth->h_source);
                if (src && src->mode != MACVLAN_MODE_VEPA &&
                    src->mode != MACVLAN_MODE_BRIDGE) {
                        /* forward to original port. */
                        vlan = src;
                        ret = macvlan_broadcast_one(skb, vlan, eth, 0) ?:
                              __netif_rx(skb);
                        handle_res = RX_HANDLER_CONSUMED;
                        goto out;
                }

                hash = mc_hash(NULL, eth->h_dest);
                if (test_bit(hash, port->bc_filter))
                        macvlan_broadcast_enqueue(port, src, skb);
                else if (test_bit(hash, port->mc_filter))
                        macvlan_multicast_rx(port, src, skb);

                return RX_HANDLER_PASS;
        }

        if (macvlan_forward_source(skb, port, eth->h_source)) {
                kfree_skb(skb);
                return RX_HANDLER_CONSUMED;
        }
        if (macvlan_passthru(port))
                vlan = list_first_or_null_rcu(&port->vlans,
                                              struct macvlan_dev, list);
        else
                vlan = macvlan_hash_lookup(port, eth->h_dest);
        if (!vlan || vlan->mode == MACVLAN_MODE_SOURCE)
                return RX_HANDLER_PASS;

        dev = vlan->dev;
        if (unlikely(!(dev->flags & IFF_UP))) {
                kfree_skb(skb);
                return RX_HANDLER_CONSUMED;
        }
        len = skb->len + ETH_HLEN;
        skb = skb_share_check(skb, GFP_ATOMIC);
        if (!skb) {
                ret = NET_RX_DROP;
                handle_res = RX_HANDLER_CONSUMED;
                goto out;
        }

        *pskb = skb;
        skb->dev = dev;
        skb->pkt_type = PACKET_HOST;

        ret = NET_RX_SUCCESS;
        handle_res = RX_HANDLER_ANOTHER;
out:
        macvlan_count_rx(vlan, len, ret == NET_RX_SUCCESS, false);
        return handle_res;
}

static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
{
        const struct macvlan_dev *vlan = netdev_priv(dev);
        const struct macvlan_port *port = vlan->port;
        const struct macvlan_dev *dest;

        if (vlan->mode == MACVLAN_MODE_BRIDGE) {
                const struct ethhdr *eth = skb_eth_hdr(skb);

                /* send to other bridge ports directly */
                if (is_multicast_ether_addr(eth->h_dest)) {
                        skb_reset_mac_header(skb);
                        macvlan_broadcast(skb, port, dev, MACVLAN_MODE_BRIDGE);
                        goto xmit_world;
                }

                dest = macvlan_hash_lookup(port, eth->h_dest);
                if (dest && dest->mode == MACVLAN_MODE_BRIDGE) {
                        /* send to lowerdev first for its network taps */
                        dev_forward_skb(vlan->lowerdev, skb);

                        return NET_XMIT_SUCCESS;
                }
        }
xmit_world:
        skb->dev = vlan->lowerdev;
        return dev_queue_xmit_accel(skb,
                                    netdev_get_sb_channel(dev) ? dev : NULL);
}

static inline netdev_tx_t macvlan_netpoll_send_skb(struct macvlan_dev *vlan, struct sk_buff *skb)
{
#ifdef CONFIG_NET_POLL_CONTROLLER
        return netpoll_send_skb(vlan->netpoll, skb);
#else
        BUG();
        return NETDEV_TX_OK;
#endif
}

static netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
                                      struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        unsigned int len = skb->len;
        int ret;

        if (unlikely(netpoll_tx_running(dev)))
                return macvlan_netpoll_send_skb(vlan, skb);

        ret = macvlan_queue_xmit(skb, dev);

        if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
                struct vlan_pcpu_stats *pcpu_stats;

                pcpu_stats = this_cpu_ptr(vlan->pcpu_stats);
                u64_stats_update_begin(&pcpu_stats->syncp);
                u64_stats_inc(&pcpu_stats->tx_packets);
                u64_stats_add(&pcpu_stats->tx_bytes, len);
                u64_stats_update_end(&pcpu_stats->syncp);
        } else {
                this_cpu_inc(vlan->pcpu_stats->tx_dropped);
        }
        return ret;
}

static int macvlan_hard_header(struct sk_buff *skb, struct net_device *dev,
                               unsigned short type, const void *daddr,
                               const void *saddr, unsigned len)
{
        const struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;

        return dev_hard_header(skb, lowerdev, type, daddr,
                               saddr ? : dev->dev_addr, len);
}

static const struct header_ops macvlan_hard_header_ops = {
        .create          = macvlan_hard_header,
        .parse                = eth_header_parse,
        .cache                = eth_header_cache,
        .cache_update        = eth_header_cache_update,
        .parse_protocol        = eth_header_parse_protocol,
};

static int macvlan_open(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
        int err;

        if (macvlan_passthru(vlan->port)) {
                if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC)) {
                        err = dev_set_promiscuity(lowerdev, 1);
                        if (err < 0)
                                goto out;
                }
                goto hash_add;
        }

        err = -EADDRINUSE;
        if (macvlan_addr_busy(vlan->port, dev->dev_addr))
                goto out;

        /* Attempt to populate accel_priv which is used to offload the L2
         * forwarding requests for unicast packets.
         */
        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD)
                vlan->accel_priv =
                      lowerdev->netdev_ops->ndo_dfwd_add_station(lowerdev, dev);

        /* If earlier attempt to offload failed, or accel_priv is not
         * populated we must add the unicast address to the lower device.
         */
        if (IS_ERR_OR_NULL(vlan->accel_priv)) {
                vlan->accel_priv = NULL;
                err = dev_uc_add(lowerdev, dev->dev_addr);
                if (err < 0)
                        goto out;
        }

        if (dev->flags & IFF_ALLMULTI) {
                err = dev_set_allmulti(lowerdev, 1);
                if (err < 0)
                        goto del_unicast;
        }

        if (dev->flags & IFF_PROMISC) {
                err = dev_set_promiscuity(lowerdev, 1);
                if (err < 0)
                        goto clear_multi;
        }

hash_add:
        macvlan_hash_add(vlan);
        return 0;

clear_multi:
        if (dev->flags & IFF_ALLMULTI)
                dev_set_allmulti(lowerdev, -1);
del_unicast:
        if (vlan->accel_priv) {
                lowerdev->netdev_ops->ndo_dfwd_del_station(lowerdev,
                                                           vlan->accel_priv);
                vlan->accel_priv = NULL;
        } else {
                dev_uc_del(lowerdev, dev->dev_addr);
        }
out:
        return err;
}

static int macvlan_stop(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;

        if (vlan->accel_priv) {
                lowerdev->netdev_ops->ndo_dfwd_del_station(lowerdev,
                                                           vlan->accel_priv);
                vlan->accel_priv = NULL;
        }

        dev_uc_unsync(lowerdev, dev);
        dev_mc_unsync(lowerdev, dev);

        if (macvlan_passthru(vlan->port)) {
                if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
                        dev_set_promiscuity(lowerdev, -1);
                goto hash_del;
        }

        if (dev->flags & IFF_ALLMULTI)
                dev_set_allmulti(lowerdev, -1);

        if (dev->flags & IFF_PROMISC)
                dev_set_promiscuity(lowerdev, -1);

        dev_uc_del(lowerdev, dev->dev_addr);

hash_del:
        macvlan_hash_del(vlan, !dev->dismantle);
        return 0;
}

static int macvlan_sync_address(struct net_device *dev,
                                const unsigned char *addr)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
        struct macvlan_port *port = vlan->port;
        int err;

        if (!(dev->flags & IFF_UP)) {
                /* Just copy in the new address */
                eth_hw_addr_set(dev, addr);
        } else {
                /* Rehash and update the device filters */
                if (macvlan_addr_busy(vlan->port, addr))
                        return -EADDRINUSE;

                if (!macvlan_passthru(port)) {
                        err = dev_uc_add(lowerdev, addr);
                        if (err)
                                return err;

                        dev_uc_del(lowerdev, dev->dev_addr);
                }

                macvlan_hash_change_addr(vlan, addr);
        }
        if (macvlan_passthru(port) && !macvlan_addr_change(port)) {
                /* Since addr_change isn't set, we are here due to lower
                 * device change.  Save the lower-dev address so we can
                 * restore it later.
                 */
                ether_addr_copy(vlan->port->perm_addr,
                                lowerdev->dev_addr);
        }
        macvlan_clear_addr_change(port);
        return 0;
}

static int macvlan_set_mac_address(struct net_device *dev, void *p)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct sockaddr *addr = p;

        if (!is_valid_ether_addr(addr->sa_data))
                return -EADDRNOTAVAIL;

        /* If the addresses are the same, this is a no-op */
        if (ether_addr_equal(dev->dev_addr, addr->sa_data))
                return 0;

        if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
                macvlan_set_addr_change(vlan->port);
                return dev_set_mac_address(vlan->lowerdev, addr, NULL);
        }

        if (macvlan_addr_busy(vlan->port, addr->sa_data))
                return -EADDRINUSE;

        return macvlan_sync_address(dev, addr->sa_data);
}

static void macvlan_change_rx_flags(struct net_device *dev, int change)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;

        if (dev->flags & IFF_UP) {
                if (change & IFF_ALLMULTI)
                        dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
                if (!macvlan_passthru(vlan->port) && change & IFF_PROMISC)
                        dev_set_promiscuity(lowerdev,
                                            dev->flags & IFF_PROMISC ? 1 : -1);

        }
}

static void macvlan_compute_filter(unsigned long *mc_filter,
                                   struct net_device *dev,
                                   struct macvlan_dev *vlan, int cutoff)
{
        if (dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) {
                bitmap_fill(mc_filter, MACVLAN_MC_FILTER_SZ);
        } else {
                DECLARE_BITMAP(filter, MACVLAN_MC_FILTER_SZ);
                struct netdev_hw_addr *ha;

                bitmap_zero(filter, MACVLAN_MC_FILTER_SZ);
                netdev_for_each_mc_addr(ha, dev) {
                        if (!vlan && ha->synced <= cutoff)
                                continue;

                        __set_bit(mc_hash(vlan, ha->addr), filter);
                }

                __set_bit(mc_hash(vlan, dev->broadcast), filter);

                bitmap_copy(mc_filter, filter, MACVLAN_MC_FILTER_SZ);
        }
}

static void macvlan_recompute_bc_filter(struct macvlan_dev *vlan)
{
        if (vlan->port->bc_cutoff < 0) {
                bitmap_zero(vlan->port->bc_filter, MACVLAN_MC_FILTER_SZ);
                return;
        }

        macvlan_compute_filter(vlan->port->bc_filter, vlan->lowerdev, NULL,
                               vlan->port->bc_cutoff);
}

static void macvlan_set_mac_lists(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        macvlan_compute_filter(vlan->mc_filter, dev, vlan, 0);

        dev_uc_sync(vlan->lowerdev, dev);
        dev_mc_sync(vlan->lowerdev, dev);

        /* This is slightly inaccurate as we're including the subscription
         * list of vlan->lowerdev too.
         *
         * Bug alert: This only works if everyone has the same broadcast
         * address as lowerdev.  As soon as someone changes theirs this
         * will break.
         *
         * However, this is already broken as when you change your broadcast
         * address we don't get called.
         *
         * The solution is to maintain a list of broadcast addresses like
         * we do for uc/mc, if you care.
         */
        macvlan_compute_filter(vlan->port->mc_filter, vlan->lowerdev, NULL,
                               0);
        macvlan_recompute_bc_filter(vlan);
}

static void update_port_bc_cutoff(struct macvlan_dev *vlan, int cutoff)
{
        if (vlan->port->bc_cutoff == cutoff)
                return;

        vlan->port->bc_cutoff = cutoff;
        macvlan_recompute_bc_filter(vlan);
}

static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        if (vlan->lowerdev->mtu < new_mtu)
                return -EINVAL;
        WRITE_ONCE(dev->mtu, new_mtu);
        return 0;
}

static int macvlan_hwtstamp_get(struct net_device *dev,
                                struct kernel_hwtstamp_config *cfg)
{
        struct net_device *real_dev = macvlan_dev_real_dev(dev);

        return generic_hwtstamp_get_lower(real_dev, cfg);
}

static int macvlan_hwtstamp_set(struct net_device *dev,
                                struct kernel_hwtstamp_config *cfg,
                                struct netlink_ext_ack *extack)
{
        struct net_device *real_dev = macvlan_dev_real_dev(dev);

        if (!net_eq(dev_net(dev), &init_net))
                return -EOPNOTSUPP;

        return generic_hwtstamp_set_lower(real_dev, cfg, extack);
}

/*
 * macvlan network devices have devices nesting below it and are a special
 * "super class" of normal network devices; split their locks off into a
 * separate class since they always nest.
 */
static struct lock_class_key macvlan_netdev_addr_lock_key;

#define ALWAYS_ON_OFFLOADS \
        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
         NETIF_F_GSO_ROBUST | NETIF_F_GSO_ENCAP_ALL)

#define ALWAYS_ON_FEATURES ALWAYS_ON_OFFLOADS

#define MACVLAN_FEATURES \
        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
         NETIF_F_GSO | NETIF_F_TSO | NETIF_F_LRO | \
         NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
         NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)

#define MACVLAN_STATE_MASK \
        ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))

static void macvlan_set_lockdep_class(struct net_device *dev)
{
        netdev_lockdep_set_classes(dev);
        lockdep_set_class(&dev->addr_list_lock,
                          &macvlan_netdev_addr_lock_key);
}

static int macvlan_init(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
        struct macvlan_port *port = vlan->port;

        dev->state                = (dev->state & ~MACVLAN_STATE_MASK) |
                                  (lowerdev->state & MACVLAN_STATE_MASK);
        dev->features                 = lowerdev->features & MACVLAN_FEATURES;
        dev->features                |= ALWAYS_ON_FEATURES;
        dev->hw_features        |= NETIF_F_LRO;
        dev->vlan_features        = lowerdev->vlan_features & MACVLAN_FEATURES;
        dev->vlan_features        |= ALWAYS_ON_OFFLOADS;
        dev->hw_enc_features    |= dev->features;
        dev->lltx                = true;
        netif_inherit_tso_max(dev, lowerdev);
        dev->hard_header_len        = lowerdev->hard_header_len;
        macvlan_set_lockdep_class(dev);

        vlan->pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
        if (!vlan->pcpu_stats)
                return -ENOMEM;

        port->count += 1;

        /* Get macvlan's reference to lowerdev */
        netdev_hold(lowerdev, &vlan->dev_tracker, GFP_KERNEL);

        return 0;
}

static void macvlan_uninit(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct macvlan_port *port = vlan->port;

        free_percpu(vlan->pcpu_stats);

        macvlan_flush_sources(port, vlan);
        port->count -= 1;
        if (!port->count)
                macvlan_port_destroy(port->dev);
}

static void macvlan_dev_get_stats64(struct net_device *dev,
                                    struct rtnl_link_stats64 *stats)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        if (vlan->pcpu_stats) {
                struct vlan_pcpu_stats *p;
                u64 rx_packets, rx_bytes, rx_multicast, tx_packets, tx_bytes;
                u32 rx_errors = 0, tx_dropped = 0;
                unsigned int start;
                int i;

                for_each_possible_cpu(i) {
                        p = per_cpu_ptr(vlan->pcpu_stats, i);
                        do {
                                start = u64_stats_fetch_begin(&p->syncp);
                                rx_packets        = u64_stats_read(&p->rx_packets);
                                rx_bytes        = u64_stats_read(&p->rx_bytes);
                                rx_multicast        = u64_stats_read(&p->rx_multicast);
                                tx_packets        = u64_stats_read(&p->tx_packets);
                                tx_bytes        = u64_stats_read(&p->tx_bytes);
                        } while (u64_stats_fetch_retry(&p->syncp, start));

                        stats->rx_packets        += rx_packets;
                        stats->rx_bytes                += rx_bytes;
                        stats->multicast        += rx_multicast;
                        stats->tx_packets        += tx_packets;
                        stats->tx_bytes                += tx_bytes;
                        /* rx_errors & tx_dropped are u32, updated
                         * without syncp protection.
                         */
                        rx_errors        += READ_ONCE(p->rx_errors);
                        tx_dropped        += READ_ONCE(p->tx_dropped);
                }
                stats->rx_errors        = rx_errors;
                stats->rx_dropped        = rx_errors;
                stats->tx_dropped        = tx_dropped;
        }
}

static int macvlan_vlan_rx_add_vid(struct net_device *dev,
                                   __be16 proto, u16 vid)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;

        return vlan_vid_add(lowerdev, proto, vid);
}

static int macvlan_vlan_rx_kill_vid(struct net_device *dev,
                                    __be16 proto, u16 vid)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;

        vlan_vid_del(lowerdev, proto, vid);
        return 0;
}

static int macvlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                           struct net_device *dev,
                           const unsigned char *addr, u16 vid,
                           u16 flags,
                           struct netlink_ext_ack *extack)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        int err = -EINVAL;

        /* Support unicast filter only on passthru devices.
         * Multicast filter should be allowed on all devices.
         */
        if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
                return -EOPNOTSUPP;

        if (flags & NLM_F_REPLACE)
                return -EOPNOTSUPP;

        if (is_unicast_ether_addr(addr))
                err = dev_uc_add_excl(dev, addr);
        else if (is_multicast_ether_addr(addr))
                err = dev_mc_add_excl(dev, addr);

        return err;
}

static int macvlan_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
                           struct net_device *dev,
                           const unsigned char *addr, u16 vid,
                           struct netlink_ext_ack *extack)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        int err = -EINVAL;

        /* Support unicast filter only on passthru devices.
         * Multicast filter should be allowed on all devices.
         */
        if (!macvlan_passthru(vlan->port) && is_unicast_ether_addr(addr))
                return -EOPNOTSUPP;

        if (is_unicast_ether_addr(addr))
                err = dev_uc_del(dev, addr);
        else if (is_multicast_ether_addr(addr))
                err = dev_mc_del(dev, addr);

        return err;
}

static void macvlan_ethtool_get_drvinfo(struct net_device *dev,
                                        struct ethtool_drvinfo *drvinfo)
{
        strscpy(drvinfo->driver, "macvlan", sizeof(drvinfo->driver));
        strscpy(drvinfo->version, "0.1", sizeof(drvinfo->version));
}

static int macvlan_ethtool_get_link_ksettings(struct net_device *dev,
                                              struct ethtool_link_ksettings *cmd)
{
        const struct macvlan_dev *vlan = netdev_priv(dev);

        return __ethtool_get_link_ksettings(vlan->lowerdev, cmd);
}

static int macvlan_ethtool_get_ts_info(struct net_device *dev,
                                       struct kernel_ethtool_ts_info *info)
{
        struct net_device *real_dev = macvlan_dev_real_dev(dev);

        return ethtool_get_ts_info_by_layer(real_dev, info);
}

static netdev_features_t macvlan_fix_features(struct net_device *dev,
                                              netdev_features_t features)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        netdev_features_t lowerdev_features = vlan->lowerdev->features;
        netdev_features_t mask;

        features |= NETIF_F_ALL_FOR_ALL;
        features &= (vlan->set_features | ~MACVLAN_FEATURES);
        mask = features;

        lowerdev_features &= (features | ~NETIF_F_LRO);
        features = netdev_increment_features(lowerdev_features, features, mask);
        features |= ALWAYS_ON_FEATURES;
        features &= (ALWAYS_ON_FEATURES | MACVLAN_FEATURES);

        return features;
}

#ifdef CONFIG_NET_POLL_CONTROLLER
static void macvlan_dev_poll_controller(struct net_device *dev)
{
        return;
}

static int macvlan_dev_netpoll_setup(struct net_device *dev, struct netpoll_info *npinfo)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *real_dev = vlan->lowerdev;
        struct netpoll *netpoll;
        int err;

        netpoll = kzalloc(sizeof(*netpoll), GFP_KERNEL);
        err = -ENOMEM;
        if (!netpoll)
                goto out;

        err = __netpoll_setup(netpoll, real_dev);
        if (err) {
                kfree(netpoll);
                goto out;
        }

        vlan->netpoll = netpoll;

out:
        return err;
}

static void macvlan_dev_netpoll_cleanup(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct netpoll *netpoll = vlan->netpoll;

        if (!netpoll)
                return;

        vlan->netpoll = NULL;

        __netpoll_free(netpoll);
}
#endif        /* CONFIG_NET_POLL_CONTROLLER */

static int macvlan_dev_get_iflink(const struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        return READ_ONCE(vlan->lowerdev->ifindex);
}

static const struct ethtool_ops macvlan_ethtool_ops = {
        .get_link                = ethtool_op_get_link,
        .get_link_ksettings        = macvlan_ethtool_get_link_ksettings,
        .get_drvinfo                = macvlan_ethtool_get_drvinfo,
        .get_ts_info                = macvlan_ethtool_get_ts_info,
};

static const struct net_device_ops macvlan_netdev_ops = {
        .ndo_init                = macvlan_init,
        .ndo_uninit                = macvlan_uninit,
        .ndo_open                = macvlan_open,
        .ndo_stop                = macvlan_stop,
        .ndo_start_xmit                = macvlan_start_xmit,
        .ndo_change_mtu                = macvlan_change_mtu,
        .ndo_fix_features        = macvlan_fix_features,
        .ndo_change_rx_flags        = macvlan_change_rx_flags,
        .ndo_set_mac_address        = macvlan_set_mac_address,
        .ndo_set_rx_mode        = macvlan_set_mac_lists,
        .ndo_get_stats64        = macvlan_dev_get_stats64,
        .ndo_validate_addr        = eth_validate_addr,
        .ndo_vlan_rx_add_vid        = macvlan_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid        = macvlan_vlan_rx_kill_vid,
        .ndo_fdb_add                = macvlan_fdb_add,
        .ndo_fdb_del                = macvlan_fdb_del,
        .ndo_fdb_dump                = ndo_dflt_fdb_dump,
#ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller        = macvlan_dev_poll_controller,
        .ndo_netpoll_setup        = macvlan_dev_netpoll_setup,
        .ndo_netpoll_cleanup        = macvlan_dev_netpoll_cleanup,
#endif
        .ndo_get_iflink                = macvlan_dev_get_iflink,
        .ndo_features_check        = passthru_features_check,
        .ndo_hwtstamp_get        = macvlan_hwtstamp_get,
        .ndo_hwtstamp_set        = macvlan_hwtstamp_set,
};

static void macvlan_dev_free(struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        /* Get rid of the macvlan's reference to lowerdev */
        netdev_put(vlan->lowerdev, &vlan->dev_tracker);
}

void macvlan_common_setup(struct net_device *dev)
{
        ether_setup(dev);

        /* ether_setup() has set dev->min_mtu to ETH_MIN_MTU. */
        dev->max_mtu                = ETH_MAX_MTU;
        dev->priv_flags               &= ~IFF_TX_SKB_SHARING;
        netif_keep_dst(dev);
        dev->priv_flags               |= IFF_UNICAST_FLT;
        dev->change_proto_down        = true;
        dev->netdev_ops                = &macvlan_netdev_ops;
        dev->needs_free_netdev        = true;
        dev->priv_destructor        = macvlan_dev_free;
        dev->header_ops                = &macvlan_hard_header_ops;
        dev->ethtool_ops        = &macvlan_ethtool_ops;
}
EXPORT_SYMBOL_GPL(macvlan_common_setup);

static void macvlan_setup(struct net_device *dev)
{
        macvlan_common_setup(dev);
        dev->priv_flags |= IFF_NO_QUEUE;
}

static int macvlan_port_create(struct net_device *dev)
{
        struct macvlan_port *port;
        unsigned int i;
        int err;

        if (dev->type != ARPHRD_ETHER || dev->flags & IFF_LOOPBACK)
                return -EINVAL;

        if (netdev_is_rx_handler_busy(dev))
                return -EBUSY;

        port = kzalloc(sizeof(*port), GFP_KERNEL);
        if (port == NULL)
                return -ENOMEM;

        port->dev = dev;
        ether_addr_copy(port->perm_addr, dev->dev_addr);
        INIT_LIST_HEAD(&port->vlans);
        for (i = 0; i < MACVLAN_HASH_SIZE; i++)
                INIT_HLIST_HEAD(&port->vlan_hash[i]);
        for (i = 0; i < MACVLAN_HASH_SIZE; i++)
                INIT_HLIST_HEAD(&port->vlan_source_hash[i]);

        port->bc_queue_len_used = 0;
        port->bc_cutoff = 1;
        skb_queue_head_init(&port->bc_queue);
        INIT_WORK(&port->bc_work, macvlan_process_broadcast);

        err = netdev_rx_handler_register(dev, macvlan_handle_frame, port);
        if (err)
                kfree(port);
        else
                dev->priv_flags |= IFF_MACVLAN_PORT;
        return err;
}

static void macvlan_port_destroy(struct net_device *dev)
{
        struct macvlan_port *port = macvlan_port_get_rtnl(dev);
        struct sk_buff *skb;

        dev->priv_flags &= ~IFF_MACVLAN_PORT;
        netdev_rx_handler_unregister(dev);

        /* After this point, no packet can schedule bc_work anymore,
         * but we need to cancel it and purge left skbs if any.
         */
        cancel_work_sync(&port->bc_work);

        while ((skb = __skb_dequeue(&port->bc_queue))) {
                const struct macvlan_dev *src = MACVLAN_SKB_CB(skb)->src;

                if (src)
                        dev_put(src->dev);

                kfree_skb(skb);
        }

        /* If the lower device address has been changed by passthru
         * macvlan, put it back.
         */
        if (macvlan_passthru(port) &&
            !ether_addr_equal(port->dev->dev_addr, port->perm_addr)) {
                struct sockaddr sa;

                sa.sa_family = port->dev->type;
                memcpy(&sa.sa_data, port->perm_addr, port->dev->addr_len);
                dev_set_mac_address(port->dev, &sa, NULL);
        }

        kfree(port);
}

static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
                            struct netlink_ext_ack *extack)
{
        struct nlattr *nla, *head;
        int rem, len;

        if (tb[IFLA_ADDRESS]) {
                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
                        return -EINVAL;
                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
                        return -EADDRNOTAVAIL;
        }

        if (!data)
                return 0;

        if (data[IFLA_MACVLAN_FLAGS] &&
            nla_get_u16(data[IFLA_MACVLAN_FLAGS]) & ~(MACVLAN_FLAG_NOPROMISC |
                                                      MACVLAN_FLAG_NODST))
                return -EINVAL;

        if (data[IFLA_MACVLAN_MODE]) {
                switch (nla_get_u32(data[IFLA_MACVLAN_MODE])) {
                case MACVLAN_MODE_PRIVATE:
                case MACVLAN_MODE_VEPA:
                case MACVLAN_MODE_BRIDGE:
                case MACVLAN_MODE_PASSTHRU:
                case MACVLAN_MODE_SOURCE:
                        break;
                default:
                        return -EINVAL;
                }
        }

        if (data[IFLA_MACVLAN_MACADDR_MODE]) {
                switch (nla_get_u32(data[IFLA_MACVLAN_MACADDR_MODE])) {
                case MACVLAN_MACADDR_ADD:
                case MACVLAN_MACADDR_DEL:
                case MACVLAN_MACADDR_FLUSH:
                case MACVLAN_MACADDR_SET:
                        break;
                default:
                        return -EINVAL;
                }
        }

        if (data[IFLA_MACVLAN_MACADDR]) {
                if (nla_len(data[IFLA_MACVLAN_MACADDR]) != ETH_ALEN)
                        return -EINVAL;

                if (!is_valid_ether_addr(nla_data(data[IFLA_MACVLAN_MACADDR])))
                        return -EADDRNOTAVAIL;
        }

        if (data[IFLA_MACVLAN_MACADDR_DATA]) {
                head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]);
                len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);

                nla_for_each_attr(nla, head, len, rem) {
                        if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
                            nla_len(nla) != ETH_ALEN)
                                return -EINVAL;

                        if (!is_valid_ether_addr(nla_data(nla)))
                                return -EADDRNOTAVAIL;
                }
        }

        if (data[IFLA_MACVLAN_MACADDR_COUNT])
                return -EINVAL;

        return 0;
}

/*
 * reconfigure list of remote source mac address
 * (only for macvlan devices in source mode)
 * Note regarding alignment: all netlink data is aligned to 4 Byte, which
 * suffices for both ether_addr_copy and ether_addr_equal_64bits usage.
 */
static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode,
                                      struct nlattr *data[])
{
        char *addr = NULL;
        int ret, rem, len;
        struct nlattr *nla, *head;
        struct macvlan_source_entry *entry;

        if (data[IFLA_MACVLAN_MACADDR])
                addr = nla_data(data[IFLA_MACVLAN_MACADDR]);

        if (mode == MACVLAN_MACADDR_ADD) {
                if (!addr)
                        return -EINVAL;

                return macvlan_hash_add_source(vlan, addr);

        } else if (mode == MACVLAN_MACADDR_DEL) {
                if (!addr)
                        return -EINVAL;

                entry = macvlan_hash_lookup_source(vlan, addr);
                if (entry) {
                        macvlan_hash_del_source(entry);
                        vlan->macaddr_count--;
                }
        } else if (mode == MACVLAN_MACADDR_FLUSH) {
                macvlan_flush_sources(vlan->port, vlan);
        } else if (mode == MACVLAN_MACADDR_SET) {
                macvlan_flush_sources(vlan->port, vlan);

                if (addr) {
                        ret = macvlan_hash_add_source(vlan, addr);
                        if (ret)
                                return ret;
                }

                if (!data[IFLA_MACVLAN_MACADDR_DATA])
                        return 0;

                head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]);
                len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);

                nla_for_each_attr(nla, head, len, rem) {
                        addr = nla_data(nla);
                        ret = macvlan_hash_add_source(vlan, addr);
                        if (ret)
                                return ret;
                }
        } else {
                return -EINVAL;
        }

        return 0;
}

int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[],
                           struct netlink_ext_ack *extack)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct macvlan_port *port;
        struct net_device *lowerdev;
        int err;
        int macmode;
        bool create = false;

        if (!tb[IFLA_LINK])
                return -EINVAL;

        lowerdev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
        if (lowerdev == NULL)
                return -ENODEV;

        /* When creating macvlans or macvtaps on top of other macvlans - use
         * the real device as the lowerdev.
         */
        if (netif_is_macvlan(lowerdev))
                lowerdev = macvlan_dev_real_dev(lowerdev);

        if (!tb[IFLA_MTU])
                dev->mtu = lowerdev->mtu;
        else if (dev->mtu > lowerdev->mtu)
                return -EINVAL;

        /* MTU range: 68 - lowerdev->max_mtu */
        dev->min_mtu = ETH_MIN_MTU;
        dev->max_mtu = lowerdev->max_mtu;

        if (!tb[IFLA_ADDRESS])
                eth_hw_addr_random(dev);

        if (!netif_is_macvlan_port(lowerdev)) {
                err = macvlan_port_create(lowerdev);
                if (err < 0)
                        return err;
                create = true;
        }
        port = macvlan_port_get_rtnl(lowerdev);

        /* Only 1 macvlan device can be created in passthru mode */
        if (macvlan_passthru(port)) {
                /* The macvlan port must be not created this time,
                 * still goto destroy_macvlan_port for readability.
                 */
                err = -EINVAL;
                goto destroy_macvlan_port;
        }

        vlan->lowerdev = lowerdev;
        vlan->dev      = dev;
        vlan->port     = port;
        vlan->set_features = MACVLAN_FEATURES;

        vlan->mode     = MACVLAN_MODE_VEPA;
        if (data && data[IFLA_MACVLAN_MODE])
                vlan->mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);

        if (data && data[IFLA_MACVLAN_FLAGS])
                vlan->flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);

        if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
                if (port->count) {
                        err = -EINVAL;
                        goto destroy_macvlan_port;
                }
                macvlan_set_passthru(port);
                eth_hw_addr_inherit(dev, lowerdev);
        }

        if (data && data[IFLA_MACVLAN_MACADDR_MODE]) {
                if (vlan->mode != MACVLAN_MODE_SOURCE) {
                        err = -EINVAL;
                        goto destroy_macvlan_port;
                }
                macmode = nla_get_u32(data[IFLA_MACVLAN_MACADDR_MODE]);
                err = macvlan_changelink_sources(vlan, macmode, data);
                if (err)
                        goto destroy_macvlan_port;
        }

        vlan->bc_queue_len_req = MACVLAN_DEFAULT_BC_QUEUE_LEN;
        if (data && data[IFLA_MACVLAN_BC_QUEUE_LEN])
                vlan->bc_queue_len_req = nla_get_u32(data[IFLA_MACVLAN_BC_QUEUE_LEN]);

        if (data && data[IFLA_MACVLAN_BC_CUTOFF])
                update_port_bc_cutoff(
                        vlan, nla_get_s32(data[IFLA_MACVLAN_BC_CUTOFF]));

        err = register_netdevice(dev);
        if (err < 0)
                goto destroy_macvlan_port;

        dev->priv_flags |= IFF_MACVLAN;
        err = netdev_upper_dev_link(lowerdev, dev, extack);
        if (err)
                goto unregister_netdev;

        list_add_tail_rcu(&vlan->list, &port->vlans);
        update_port_bc_queue_len(vlan->port);
        netif_stacked_transfer_operstate(lowerdev, dev);
        linkwatch_fire_event(dev);

        return 0;

unregister_netdev:
        /* macvlan_uninit would free the macvlan port */
        unregister_netdevice(dev);
        return err;
destroy_macvlan_port:
        /* the macvlan port may be freed by macvlan_uninit when fail to register.
         * so we destroy the macvlan port only when it's valid.
         */
        if (create && macvlan_port_get_rtnl(lowerdev)) {
                macvlan_flush_sources(port, vlan);
                macvlan_port_destroy(port->dev);
        }
        return err;
}
EXPORT_SYMBOL_GPL(macvlan_common_newlink);

static int macvlan_newlink(struct net *src_net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[],
                           struct netlink_ext_ack *extack)
{
        return macvlan_common_newlink(src_net, dev, tb, data, extack);
}

void macvlan_dellink(struct net_device *dev, struct list_head *head)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        if (vlan->mode == MACVLAN_MODE_SOURCE)
                macvlan_flush_sources(vlan->port, vlan);
        list_del_rcu(&vlan->list);
        update_port_bc_queue_len(vlan->port);
        unregister_netdevice_queue(dev, head);
        netdev_upper_dev_unlink(vlan->lowerdev, dev);
}
EXPORT_SYMBOL_GPL(macvlan_dellink);

static int macvlan_changelink(struct net_device *dev,
                              struct nlattr *tb[], struct nlattr *data[],
                              struct netlink_ext_ack *extack)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        enum macvlan_mode mode;
        bool set_mode = false;
        enum macvlan_macaddr_mode macmode;
        int ret;

        /* Validate mode, but don't set yet: setting flags may fail. */
        if (data && data[IFLA_MACVLAN_MODE]) {
                set_mode = true;
                mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);
                /* Passthrough mode can't be set or cleared dynamically */
                if ((mode == MACVLAN_MODE_PASSTHRU) !=
                    (vlan->mode == MACVLAN_MODE_PASSTHRU))
                        return -EINVAL;
                if (vlan->mode == MACVLAN_MODE_SOURCE &&
                    vlan->mode != mode)
                        macvlan_flush_sources(vlan->port, vlan);
        }

        if (data && data[IFLA_MACVLAN_FLAGS]) {
                __u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
                bool promisc = (flags ^ vlan->flags) & MACVLAN_FLAG_NOPROMISC;
                if (macvlan_passthru(vlan->port) && promisc) {
                        int err;

                        if (flags & MACVLAN_FLAG_NOPROMISC)
                                err = dev_set_promiscuity(vlan->lowerdev, -1);
                        else
                                err = dev_set_promiscuity(vlan->lowerdev, 1);
                        if (err < 0)
                                return err;
                }
                vlan->flags = flags;
        }

        if (data && data[IFLA_MACVLAN_BC_QUEUE_LEN]) {
                vlan->bc_queue_len_req = nla_get_u32(data[IFLA_MACVLAN_BC_QUEUE_LEN]);
                update_port_bc_queue_len(vlan->port);
        }

        if (data && data[IFLA_MACVLAN_BC_CUTOFF])
                update_port_bc_cutoff(
                        vlan, nla_get_s32(data[IFLA_MACVLAN_BC_CUTOFF]));

        if (set_mode)
                vlan->mode = mode;
        if (data && data[IFLA_MACVLAN_MACADDR_MODE]) {
                if (vlan->mode != MACVLAN_MODE_SOURCE)
                        return -EINVAL;
                macmode = nla_get_u32(data[IFLA_MACVLAN_MACADDR_MODE]);
                ret = macvlan_changelink_sources(vlan, macmode, data);
                if (ret)
                        return ret;
        }
        return 0;
}

static size_t macvlan_get_size_mac(const struct macvlan_dev *vlan)
{
        if (vlan->macaddr_count == 0)
                return 0;
        return nla_total_size(0) /* IFLA_MACVLAN_MACADDR_DATA */
                + vlan->macaddr_count * nla_total_size(sizeof(u8) * ETH_ALEN);
}

static size_t macvlan_get_size(const struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);

        return (0
                + nla_total_size(4) /* IFLA_MACVLAN_MODE */
                + nla_total_size(2) /* IFLA_MACVLAN_FLAGS */
                + nla_total_size(4) /* IFLA_MACVLAN_MACADDR_COUNT */
                + macvlan_get_size_mac(vlan) /* IFLA_MACVLAN_MACADDR */
                + nla_total_size(4) /* IFLA_MACVLAN_BC_QUEUE_LEN */
                + nla_total_size(4) /* IFLA_MACVLAN_BC_QUEUE_LEN_USED */
                );
}

static int macvlan_fill_info_macaddr(struct sk_buff *skb,
                                     const struct macvlan_dev *vlan,
                                     const int i)
{
        struct hlist_head *h = &vlan->port->vlan_source_hash[i];
        struct macvlan_source_entry *entry;

        hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) {
                if (entry->vlan != vlan)
                        continue;
                if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr))
                        return 1;
        }
        return 0;
}

static int macvlan_fill_info(struct sk_buff *skb,
                                const struct net_device *dev)
{
        struct macvlan_dev *vlan = netdev_priv(dev);
        struct macvlan_port *port = vlan->port;
        int i;
        struct nlattr *nest;

        if (nla_put_u32(skb, IFLA_MACVLAN_MODE, vlan->mode))
                goto nla_put_failure;
        if (nla_put_u16(skb, IFLA_MACVLAN_FLAGS, vlan->flags))
                goto nla_put_failure;
        if (nla_put_u32(skb, IFLA_MACVLAN_MACADDR_COUNT, vlan->macaddr_count))
                goto nla_put_failure;
        if (vlan->macaddr_count > 0) {
                nest = nla_nest_start_noflag(skb, IFLA_MACVLAN_MACADDR_DATA);
                if (nest == NULL)
                        goto nla_put_failure;

                for (i = 0; i < MACVLAN_HASH_SIZE; i++) {
                        if (macvlan_fill_info_macaddr(skb, vlan, i))
                                goto nla_put_failure;
                }
                nla_nest_end(skb, nest);
        }
        if (nla_put_u32(skb, IFLA_MACVLAN_BC_QUEUE_LEN, vlan->bc_queue_len_req))
                goto nla_put_failure;
        if (nla_put_u32(skb, IFLA_MACVLAN_BC_QUEUE_LEN_USED, port->bc_queue_len_used))
                goto nla_put_failure;
        if (port->bc_cutoff != 1 &&
            nla_put_s32(skb, IFLA_MACVLAN_BC_CUTOFF, port->bc_cutoff))
                goto nla_put_failure;
        return 0;

nla_put_failure:
        return -EMSGSIZE;
}

static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
        [IFLA_MACVLAN_MODE]  = { .type = NLA_U32 },
        [IFLA_MACVLAN_FLAGS] = { .type = NLA_U16 },
        [IFLA_MACVLAN_MACADDR_MODE] = { .type = NLA_U32 },
        [IFLA_MACVLAN_MACADDR] = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
        [IFLA_MACVLAN_MACADDR_DATA] = { .type = NLA_NESTED },
        [IFLA_MACVLAN_MACADDR_COUNT] = { .type = NLA_U32 },
        [IFLA_MACVLAN_BC_QUEUE_LEN] = { .type = NLA_U32 },
        [IFLA_MACVLAN_BC_QUEUE_LEN_USED] = { .type = NLA_REJECT },
        [IFLA_MACVLAN_BC_CUTOFF] = { .type = NLA_S32 },
};

int macvlan_link_register(struct rtnl_link_ops *ops)
{
        /* common fields */
        ops->validate                = macvlan_validate;
        ops->maxtype                = IFLA_MACVLAN_MAX;
        ops->policy                = macvlan_policy;
        ops->changelink                = macvlan_changelink;
        ops->get_size                = macvlan_get_size;
        ops->fill_info                = macvlan_fill_info;

        return rtnl_link_register(ops);
};
EXPORT_SYMBOL_GPL(macvlan_link_register);

static struct net *macvlan_get_link_net(const struct net_device *dev)
{
        return dev_net(macvlan_dev_real_dev(dev));
}

static struct rtnl_link_ops macvlan_link_ops = {
        .kind                = "macvlan",
        .setup                = macvlan_setup,
        .newlink        = macvlan_newlink,
        .dellink        = macvlan_dellink,
        .get_link_net        = macvlan_get_link_net,
        .priv_size      = sizeof(struct macvlan_dev),
};

static void update_port_bc_queue_len(struct macvlan_port *port)
{
        u32 max_bc_queue_len_req = 0;
        struct macvlan_dev *vlan;

        list_for_each_entry(vlan, &port->vlans, list) {
                if (vlan->bc_queue_len_req > max_bc_queue_len_req)
                        max_bc_queue_len_req = vlan->bc_queue_len_req;
        }
        port->bc_queue_len_used = max_bc_queue_len_req;
}

static int macvlan_device_event(struct notifier_block *unused,
                                unsigned long event, void *ptr)
{
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct macvlan_dev *vlan, *next;
        struct macvlan_port *port;
        LIST_HEAD(list_kill);

        if (!netif_is_macvlan_port(dev))
                return NOTIFY_DONE;

        port = macvlan_port_get_rtnl(dev);

        switch (event) {
        case NETDEV_UP:
        case NETDEV_DOWN:
        case NETDEV_CHANGE:
                list_for_each_entry(vlan, &port->vlans, list)
                        netif_stacked_transfer_operstate(vlan->lowerdev,
                                                         vlan->dev);
                break;
        case NETDEV_FEAT_CHANGE:
                list_for_each_entry(vlan, &port->vlans, list) {
                        netif_inherit_tso_max(vlan->dev, dev);
                        netdev_update_features(vlan->dev);
                }
                break;
        case NETDEV_CHANGEMTU:
                list_for_each_entry(vlan, &port->vlans, list) {
                        if (vlan->dev->mtu <= dev->mtu)
                                continue;
                        dev_set_mtu(vlan->dev, dev->mtu);
                }
                break;
        case NETDEV_CHANGEADDR:
                if (!macvlan_passthru(port))
                        return NOTIFY_DONE;

                vlan = list_first_entry_or_null(&port->vlans,
                                                struct macvlan_dev,
                                                list);

                if (vlan && macvlan_sync_address(vlan->dev, dev->dev_addr))
                        return NOTIFY_BAD;

                break;
        case NETDEV_UNREGISTER:
                /* twiddle thumbs on netns device moves */
                if (dev->reg_state != NETREG_UNREGISTERING)
                        break;

                list_for_each_entry_safe(vlan, next, &port->vlans, list)
                        vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
                unregister_netdevice_many(&list_kill);
                break;
        case NETDEV_PRE_TYPE_CHANGE:
                /* Forbid underlying device to change its type. */
                return NOTIFY_BAD;

        case NETDEV_NOTIFY_PEERS:
        case NETDEV_BONDING_FAILOVER:
        case NETDEV_RESEND_IGMP:
                /* Propagate to all vlans */
                list_for_each_entry(vlan, &port->vlans, list)
                        call_netdevice_notifiers(event, vlan->dev);
        }
        return NOTIFY_DONE;
}

static struct notifier_block macvlan_notifier_block __read_mostly = {
        .notifier_call        = macvlan_device_event,
};

static int __init macvlan_init_module(void)
{
        int err;

        register_netdevice_notifier(&macvlan_notifier_block);

        err = macvlan_link_register(&macvlan_link_ops);
        if (err < 0)
                goto err1;
        return 0;
err1:
        unregister_netdevice_notifier(&macvlan_notifier_block);
        return err;
}

static void __exit macvlan_cleanup_module(void)
{
        rtnl_link_unregister(&macvlan_link_ops);
        unregister_netdevice_notifier(&macvlan_notifier_block);
}

module_init(macvlan_init_module);
module_exit(macvlan_cleanup_module);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_DESCRIPTION("Driver for MAC address based VLANs");
MODULE_ALIAS_RTNL_LINK("macvlan");































































































































































































































































































































































































































































































































































































































































    1 








    1 




    1 















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Copyright (C) 2018 - 2021, 2023 - 2024 Intel Corporation
 */
#include <net/cfg80211.h>
#include "core.h"
#include "nl80211.h"
#include "rdev-ops.h"

static int pmsr_parse_ftm(struct cfg80211_registered_device *rdev,
                          struct nlattr *ftmreq,
                          struct cfg80211_pmsr_request_peer *out,
                          struct genl_info *info)
{
        const struct cfg80211_pmsr_capabilities *capa = rdev->wiphy.pmsr_capa;
        struct nlattr *tb[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1];
        u32 preamble = NL80211_PREAMBLE_DMG; /* only optional in DMG */

        /* validate existing data */
        if (!(rdev->wiphy.pmsr_capa->ftm.bandwidths & BIT(out->chandef.width))) {
                NL_SET_ERR_MSG(info->extack, "FTM: unsupported bandwidth");
                return -EINVAL;
        }

        /* no validation needed - was already done via nested policy */
        nla_parse_nested_deprecated(tb, NL80211_PMSR_FTM_REQ_ATTR_MAX, ftmreq,
                                    NULL, NULL);

        if (tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE])
                preamble = nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE]);

        /* set up values - struct is 0-initialized */
        out->ftm.requested = true;

        switch (out->chandef.chan->band) {
        case NL80211_BAND_60GHZ:
                /* optional */
                break;
        default:
                if (!tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE]) {
                        NL_SET_ERR_MSG(info->extack,
                                       "FTM: must specify preamble");
                        return -EINVAL;
                }
        }

        if (!(capa->ftm.preambles & BIT(preamble))) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],
                                    "FTM: invalid preamble");
                return -EINVAL;
        }

        out->ftm.preamble = preamble;

        out->ftm.burst_period = 0;
        if (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD])
                out->ftm.burst_period =
                        nla_get_u16(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD]);

        out->ftm.asap = !!tb[NL80211_PMSR_FTM_REQ_ATTR_ASAP];
        if (out->ftm.asap && !capa->ftm.asap) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_ASAP],
                                    "FTM: ASAP mode not supported");
                return -EINVAL;
        }

        if (!out->ftm.asap && !capa->ftm.non_asap) {
                NL_SET_ERR_MSG(info->extack,
                               "FTM: non-ASAP mode not supported");
                return -EINVAL;
        }

        out->ftm.num_bursts_exp = 0;
        if (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP])
                out->ftm.num_bursts_exp =
                        nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP]);

        if (capa->ftm.max_bursts_exponent >= 0 &&
            out->ftm.num_bursts_exp > capa->ftm.max_bursts_exponent) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP],
                                    "FTM: max NUM_BURSTS_EXP must be set lower than the device limit");
                return -EINVAL;
        }

        out->ftm.burst_duration = 15;
        if (tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION])
                out->ftm.burst_duration =
                        nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION]);

        out->ftm.ftms_per_burst = 0;
        if (tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST])
                out->ftm.ftms_per_burst =
                        nla_get_u32(tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST]);

        if (capa->ftm.max_ftms_per_burst &&
            (out->ftm.ftms_per_burst > capa->ftm.max_ftms_per_burst ||
             out->ftm.ftms_per_burst == 0)) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],
                                    "FTM: FTMs per burst must be set lower than the device limit but non-zero");
                return -EINVAL;
        }

        out->ftm.ftmr_retries = 3;
        if (tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES])
                out->ftm.ftmr_retries =
                        nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES]);

        out->ftm.request_lci = !!tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI];
        if (out->ftm.request_lci && !capa->ftm.request_lci) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI],
                                    "FTM: LCI request not supported");
        }

        out->ftm.request_civicloc =
                !!tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC];
        if (out->ftm.request_civicloc && !capa->ftm.request_civicloc) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC],
                            "FTM: civic location request not supported");
        }

        out->ftm.trigger_based =
                !!tb[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED];
        if (out->ftm.trigger_based && !capa->ftm.trigger_based) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED],
                                    "FTM: trigger based ranging is not supported");
                return -EINVAL;
        }

        out->ftm.non_trigger_based =
                !!tb[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED];
        if (out->ftm.non_trigger_based && !capa->ftm.non_trigger_based) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED],
                                    "FTM: trigger based ranging is not supported");
                return -EINVAL;
        }

        if (out->ftm.trigger_based && out->ftm.non_trigger_based) {
                NL_SET_ERR_MSG(info->extack,
                               "FTM: can't set both trigger based and non trigger based");
                return -EINVAL;
        }

        if (out->ftm.ftms_per_burst > 31 && !out->ftm.non_trigger_based &&
            !out->ftm.trigger_based) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST],
                                    "FTM: FTMs per burst must be set lower than 31");
                return -ERANGE;
        }

        if ((out->ftm.trigger_based || out->ftm.non_trigger_based) &&
            out->ftm.preamble != NL80211_PREAMBLE_HE) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE],
                                    "FTM: non EDCA based ranging must use HE preamble");
                return -EINVAL;
        }

        out->ftm.lmr_feedback =
                !!tb[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK];
        if (!out->ftm.trigger_based && !out->ftm.non_trigger_based &&
            out->ftm.lmr_feedback) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK],
                                    "FTM: LMR feedback set for EDCA based ranging");
                return -EINVAL;
        }

        if (tb[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR]) {
                if (!out->ftm.non_trigger_based && !out->ftm.trigger_based) {
                        NL_SET_ERR_MSG_ATTR(info->extack,
                                            tb[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR],
                                            "FTM: BSS color set for EDCA based ranging");
                        return -EINVAL;
                }

                out->ftm.bss_color =
                        nla_get_u8(tb[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR]);
        }

        return 0;
}

static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,
                           struct nlattr *peer,
                           struct cfg80211_pmsr_request_peer *out,
                           struct genl_info *info)
{
        struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
        struct nlattr *req[NL80211_PMSR_REQ_ATTR_MAX + 1];
        struct nlattr *treq;
        int err, rem;

        /* no validation needed - was already done via nested policy */
        nla_parse_nested_deprecated(tb, NL80211_PMSR_PEER_ATTR_MAX, peer,
                                    NULL, NULL);

        if (!tb[NL80211_PMSR_PEER_ATTR_ADDR] ||
            !tb[NL80211_PMSR_PEER_ATTR_CHAN] ||
            !tb[NL80211_PMSR_PEER_ATTR_REQ]) {
                NL_SET_ERR_MSG_ATTR(info->extack, peer,
                                    "insufficient peer data");
                return -EINVAL;
        }

        memcpy(out->addr, nla_data(tb[NL80211_PMSR_PEER_ATTR_ADDR]), ETH_ALEN);

        /* reuse info->attrs */
        memset(info->attrs, 0, sizeof(*info->attrs) * (NL80211_ATTR_MAX + 1));
        err = nla_parse_nested_deprecated(info->attrs, NL80211_ATTR_MAX,
                                          tb[NL80211_PMSR_PEER_ATTR_CHAN],
                                          NULL, info->extack);
        if (err)
                return err;

        err = nl80211_parse_chandef(rdev, info, &out->chandef);
        if (err)
                return err;

        /* no validation needed - was already done via nested policy */
        nla_parse_nested_deprecated(req, NL80211_PMSR_REQ_ATTR_MAX,
                                    tb[NL80211_PMSR_PEER_ATTR_REQ], NULL,
                                    NULL);

        if (!req[NL80211_PMSR_REQ_ATTR_DATA]) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    tb[NL80211_PMSR_PEER_ATTR_REQ],
                                    "missing request type/data");
                return -EINVAL;
        }

        if (req[NL80211_PMSR_REQ_ATTR_GET_AP_TSF])
                out->report_ap_tsf = true;

        if (out->report_ap_tsf && !rdev->wiphy.pmsr_capa->report_ap_tsf) {
                NL_SET_ERR_MSG_ATTR(info->extack,
                                    req[NL80211_PMSR_REQ_ATTR_GET_AP_TSF],
                                    "reporting AP TSF is not supported");
                return -EINVAL;
        }

        nla_for_each_nested(treq, req[NL80211_PMSR_REQ_ATTR_DATA], rem) {
                switch (nla_type(treq)) {
                case NL80211_PMSR_TYPE_FTM:
                        err = pmsr_parse_ftm(rdev, treq, out, info);
                        break;
                default:
                        NL_SET_ERR_MSG_ATTR(info->extack, treq,
                                            "unsupported measurement type");
                        err = -EINVAL;
                }
        }

        if (err)
                return err;

        return 0;
}

int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
{
        struct nlattr *reqattr = info->attrs[NL80211_ATTR_PEER_MEASUREMENTS];
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
        struct wireless_dev *wdev = info->user_ptr[1];
        struct cfg80211_pmsr_request *req;
        struct nlattr *peers, *peer;
        int count, rem, err, idx;

        if (!rdev->wiphy.pmsr_capa)
                return -EOPNOTSUPP;

        if (!reqattr)
                return -EINVAL;

        peers = nla_find(nla_data(reqattr), nla_len(reqattr),
                         NL80211_PMSR_ATTR_PEERS);
        if (!peers)
                return -EINVAL;

        count = 0;
        nla_for_each_nested(peer, peers, rem) {
                count++;

                if (count > rdev->wiphy.pmsr_capa->max_peers) {
                        NL_SET_ERR_MSG_ATTR(info->extack, peer,
                                            "Too many peers used");
                        return -EINVAL;
                }
        }

        req = kzalloc(struct_size(req, peers, count), GFP_KERNEL);
        if (!req)
                return -ENOMEM;
        req->n_peers = count;

        if (info->attrs[NL80211_ATTR_TIMEOUT])
                req->timeout = nla_get_u32(info->attrs[NL80211_ATTR_TIMEOUT]);

        if (info->attrs[NL80211_ATTR_MAC]) {
                if (!rdev->wiphy.pmsr_capa->randomize_mac_addr) {
                        NL_SET_ERR_MSG_ATTR(info->extack,
                                            info->attrs[NL80211_ATTR_MAC],
                                            "device cannot randomize MAC address");
                        err = -EINVAL;
                        goto out_err;
                }

                err = nl80211_parse_random_mac(info->attrs, req->mac_addr,
                                               req->mac_addr_mask);
                if (err)
                        goto out_err;
        } else {
                memcpy(req->mac_addr, wdev_address(wdev), ETH_ALEN);
                eth_broadcast_addr(req->mac_addr_mask);
        }

        idx = 0;
        nla_for_each_nested(peer, peers, rem) {
                /* NB: this reuses info->attrs, but we no longer need it */
                err = pmsr_parse_peer(rdev, peer, &req->peers[idx], info);
                if (err)
                        goto out_err;
                idx++;
        }
        req->cookie = cfg80211_assign_cookie(rdev);
        req->nl_portid = info->snd_portid;

        err = rdev_start_pmsr(rdev, wdev, req);
        if (err)
                goto out_err;

        list_add_tail(&req->list, &wdev->pmsr_list);

        nl_set_extack_cookie_u64(info->extack, req->cookie);
        return 0;
out_err:
        kfree(req);
        return err;
}

void cfg80211_pmsr_complete(struct wireless_dev *wdev,
                            struct cfg80211_pmsr_request *req,
                            gfp_t gfp)
{
        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
        struct cfg80211_pmsr_request *tmp, *prev, *to_free = NULL;
        struct sk_buff *msg;
        void *hdr;

        trace_cfg80211_pmsr_complete(wdev->wiphy, wdev, req->cookie);

        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                goto free_request;

        hdr = nl80211hdr_put(msg, 0, 0, 0,
                             NL80211_CMD_PEER_MEASUREMENT_COMPLETE);
        if (!hdr)
                goto free_msg;

        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
            nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
                              NL80211_ATTR_PAD))
                goto free_msg;

        if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->cookie,
                              NL80211_ATTR_PAD))
                goto free_msg;

        genlmsg_end(msg, hdr);
        genlmsg_unicast(wiphy_net(wdev->wiphy), msg, req->nl_portid);
        goto free_request;
free_msg:
        nlmsg_free(msg);
free_request:
        spin_lock_bh(&wdev->pmsr_lock);
        /*
         * cfg80211_pmsr_process_abort() may have already moved this request
         * to the free list, and will free it later. In this case, don't free
         * it here.
         */
        list_for_each_entry_safe(tmp, prev, &wdev->pmsr_list, list) {
                if (tmp == req) {
                        list_del(&req->list);
                        to_free = req;
                        break;
                }
        }
        spin_unlock_bh(&wdev->pmsr_lock);
        kfree(to_free);
}
EXPORT_SYMBOL_GPL(cfg80211_pmsr_complete);

static int nl80211_pmsr_send_ftm_res(struct sk_buff *msg,
                                     struct cfg80211_pmsr_result *res)
{
        if (res->status == NL80211_PMSR_STATUS_FAILURE) {
                if (nla_put_u32(msg, NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON,
                                res->ftm.failure_reason))
                        goto error;

                if (res->ftm.failure_reason ==
                        NL80211_PMSR_FTM_FAILURE_PEER_BUSY &&
                    res->ftm.busy_retry_time &&
                    nla_put_u32(msg, NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME,
                                res->ftm.busy_retry_time))
                        goto error;

                return 0;
        }

#define PUT(tp, attr, val)                                                \
        do {                                                                \
                if (nla_put_##tp(msg,                                        \
                                 NL80211_PMSR_FTM_RESP_ATTR_##attr,        \
                                 res->ftm.val))                                \
                        goto error;                                        \
        } while (0)

#define PUTOPT(tp, attr, val)                                                \
        do {                                                                \
                if (res->ftm.val##_valid)                                \
                        PUT(tp, attr, val);                                \
        } while (0)

#define PUT_U64(attr, val)                                                \
        do {                                                                \
                if (nla_put_u64_64bit(msg,                                \
                                      NL80211_PMSR_FTM_RESP_ATTR_##attr,\
                                      res->ftm.val,                        \
                                      NL80211_PMSR_FTM_RESP_ATTR_PAD))        \
                        goto error;                                        \
        } while (0)

#define PUTOPT_U64(attr, val)                                                \
        do {                                                                \
                if (res->ftm.val##_valid)                                \
                        PUT_U64(attr, val);                                \
        } while (0)

        if (res->ftm.burst_index >= 0)
                PUT(u32, BURST_INDEX, burst_index);
        PUTOPT(u32, NUM_FTMR_ATTEMPTS, num_ftmr_attempts);
        PUTOPT(u32, NUM_FTMR_SUCCESSES, num_ftmr_successes);
        PUT(u8, NUM_BURSTS_EXP, num_bursts_exp);
        PUT(u8, BURST_DURATION, burst_duration);
        PUT(u8, FTMS_PER_BURST, ftms_per_burst);
        PUTOPT(s32, RSSI_AVG, rssi_avg);
        PUTOPT(s32, RSSI_SPREAD, rssi_spread);
        if (res->ftm.tx_rate_valid &&
            !nl80211_put_sta_rate(msg, &res->ftm.tx_rate,
                                  NL80211_PMSR_FTM_RESP_ATTR_TX_RATE))
                goto error;
        if (res->ftm.rx_rate_valid &&
            !nl80211_put_sta_rate(msg, &res->ftm.rx_rate,
                                  NL80211_PMSR_FTM_RESP_ATTR_RX_RATE))
                goto error;
        PUTOPT_U64(RTT_AVG, rtt_avg);
        PUTOPT_U64(RTT_VARIANCE, rtt_variance);
        PUTOPT_U64(RTT_SPREAD, rtt_spread);
        PUTOPT_U64(DIST_AVG, dist_avg);
        PUTOPT_U64(DIST_VARIANCE, dist_variance);
        PUTOPT_U64(DIST_SPREAD, dist_spread);
        if (res->ftm.lci && res->ftm.lci_len &&
            nla_put(msg, NL80211_PMSR_FTM_RESP_ATTR_LCI,
                    res->ftm.lci_len, res->ftm.lci))
                goto error;
        if (res->ftm.civicloc && res->ftm.civicloc_len &&
            nla_put(msg, NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC,
                    res->ftm.civicloc_len, res->ftm.civicloc))
                goto error;
#undef PUT
#undef PUTOPT
#undef PUT_U64
#undef PUTOPT_U64

        return 0;
error:
        return -ENOSPC;
}

static int nl80211_pmsr_send_result(struct sk_buff *msg,
                                    struct cfg80211_pmsr_result *res)
{
        struct nlattr *pmsr, *peers, *peer, *resp, *data, *typedata;

        pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
        if (!pmsr)
                goto error;

        peers = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_PEERS);
        if (!peers)
                goto error;

        peer = nla_nest_start_noflag(msg, 1);
        if (!peer)
                goto error;

        if (nla_put(msg, NL80211_PMSR_PEER_ATTR_ADDR, ETH_ALEN, res->addr))
                goto error;

        resp = nla_nest_start_noflag(msg, NL80211_PMSR_PEER_ATTR_RESP);
        if (!resp)
                goto error;

        if (nla_put_u32(msg, NL80211_PMSR_RESP_ATTR_STATUS, res->status) ||
            nla_put_u64_64bit(msg, NL80211_PMSR_RESP_ATTR_HOST_TIME,
                              res->host_time, NL80211_PMSR_RESP_ATTR_PAD))
                goto error;

        if (res->ap_tsf_valid &&
            nla_put_u64_64bit(msg, NL80211_PMSR_RESP_ATTR_AP_TSF,
                              res->ap_tsf, NL80211_PMSR_RESP_ATTR_PAD))
                goto error;

        if (res->final && nla_put_flag(msg, NL80211_PMSR_RESP_ATTR_FINAL))
                goto error;

        data = nla_nest_start_noflag(msg, NL80211_PMSR_RESP_ATTR_DATA);
        if (!data)
                goto error;

        typedata = nla_nest_start_noflag(msg, res->type);
        if (!typedata)
                goto error;

        switch (res->type) {
        case NL80211_PMSR_TYPE_FTM:
                if (nl80211_pmsr_send_ftm_res(msg, res))
                        goto error;
                break;
        default:
                WARN_ON(1);
        }

        nla_nest_end(msg, typedata);
        nla_nest_end(msg, data);
        nla_nest_end(msg, resp);
        nla_nest_end(msg, peer);
        nla_nest_end(msg, peers);
        nla_nest_end(msg, pmsr);

        return 0;
error:
        return -ENOSPC;
}

void cfg80211_pmsr_report(struct wireless_dev *wdev,
                          struct cfg80211_pmsr_request *req,
                          struct cfg80211_pmsr_result *result,
                          gfp_t gfp)
{
        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
        struct sk_buff *msg;
        void *hdr;
        int err;

        trace_cfg80211_pmsr_report(wdev->wiphy, wdev, req->cookie,
                                   result->addr);

        /*
         * Currently, only variable items are LCI and civic location,
         * both of which are reasonably short so we don't need to
         * worry about them here for the allocation.
         */
        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
        if (!msg)
                return;

        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PEER_MEASUREMENT_RESULT);
        if (!hdr)
                goto free;

        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
            nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
                              NL80211_ATTR_PAD))
                goto free;

        if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->cookie,
                              NL80211_ATTR_PAD))
                goto free;

        err = nl80211_pmsr_send_result(msg, result);
        if (err) {
                pr_err_ratelimited("peer measurement result: message didn't fit!");
                goto free;
        }

        genlmsg_end(msg, hdr);
        genlmsg_unicast(wiphy_net(wdev->wiphy), msg, req->nl_portid);
        return;
free:
        nlmsg_free(msg);
}
EXPORT_SYMBOL_GPL(cfg80211_pmsr_report);

static void cfg80211_pmsr_process_abort(struct wireless_dev *wdev)
{
        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
        struct cfg80211_pmsr_request *req, *tmp;
        LIST_HEAD(free_list);

        lockdep_assert_wiphy(wdev->wiphy);

        spin_lock_bh(&wdev->pmsr_lock);
        list_for_each_entry_safe(req, tmp, &wdev->pmsr_list, list) {
                if (req->nl_portid)
                        continue;
                list_move_tail(&req->list, &free_list);
        }
        spin_unlock_bh(&wdev->pmsr_lock);

        list_for_each_entry_safe(req, tmp, &free_list, list) {
                rdev_abort_pmsr(rdev, wdev, req);

                kfree(req);
        }
}

void cfg80211_pmsr_free_wk(struct work_struct *work)
{
        struct wireless_dev *wdev = container_of(work, struct wireless_dev,
                                                 pmsr_free_wk);

        wiphy_lock(wdev->wiphy);
        cfg80211_pmsr_process_abort(wdev);
        wiphy_unlock(wdev->wiphy);
}

void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev)
{
        struct cfg80211_pmsr_request *req;
        bool found = false;

        spin_lock_bh(&wdev->pmsr_lock);
        list_for_each_entry(req, &wdev->pmsr_list, list) {
                found = true;
                req->nl_portid = 0;
        }
        spin_unlock_bh(&wdev->pmsr_lock);

        if (found)
                cfg80211_pmsr_process_abort(wdev);

        WARN_ON(!list_empty(&wdev->pmsr_list));
}

void cfg80211_release_pmsr(struct wireless_dev *wdev, u32 portid)
{
        struct cfg80211_pmsr_request *req;

        spin_lock_bh(&wdev->pmsr_lock);
        list_for_each_entry(req, &wdev->pmsr_list, list) {
                if (req->nl_portid == portid) {
                        req->nl_portid = 0;
                        schedule_work(&wdev->pmsr_free_wk);
                }
        }
        spin_unlock_bh(&wdev->pmsr_lock);
}




























   73 
   76 


























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
/* SPDX-License-Identifier: GPL-2.0+ */
/*
 * Buffer/page management specific to NILFS
 *
 * Copyright (C) 2005-2008 Nippon Telegraph and Telephone Corporation.
 *
 * Written by Ryusuke Konishi and Seiji Kihara.
 */

#ifndef _NILFS_PAGE_H
#define _NILFS_PAGE_H

#include <linux/buffer_head.h>
#include "nilfs.h"

/*
 * Extended buffer state bits
 */
enum {
        BH_NILFS_Allocated = BH_PrivateStart,
        BH_NILFS_Node,
        BH_NILFS_Volatile,
        BH_NILFS_Checked,
        BH_NILFS_Redirected,
};

BUFFER_FNS(NILFS_Node, nilfs_node)                /* nilfs node buffers */
BUFFER_FNS(NILFS_Volatile, nilfs_volatile)
BUFFER_FNS(NILFS_Checked, nilfs_checked)        /* buffer is verified */
BUFFER_FNS(NILFS_Redirected, nilfs_redirected)        /* redirected to a copy */


void __nilfs_clear_folio_dirty(struct folio *);

struct buffer_head *nilfs_grab_buffer(struct inode *, struct address_space *,
                                      unsigned long, unsigned long);
void nilfs_forget_buffer(struct buffer_head *);
void nilfs_copy_buffer(struct buffer_head *, struct buffer_head *);
bool nilfs_folio_buffers_clean(struct folio *);
void nilfs_folio_bug(struct folio *);

int nilfs_copy_dirty_pages(struct address_space *, struct address_space *);
void nilfs_copy_back_pages(struct address_space *, struct address_space *);
void nilfs_clear_folio_dirty(struct folio *folio);
void nilfs_clear_dirty_pages(struct address_space *mapping);
unsigned int nilfs_page_count_clean_buffers(struct page *, unsigned int,
                                            unsigned int);
unsigned long nilfs_find_uncommitted_extent(struct inode *inode,
                                            sector_t start_blk,
                                            sector_t *blkoff);

#define NILFS_FOLIO_BUG(folio, m, a...) \
        do { nilfs_folio_bug(folio); BUG(); } while (0)

#endif /* _NILFS_PAGE_H */


































   21 



   17 

   17 








    6 

   17 







   17 




   17 
    4 




   17 











  341 




  128 

  300 




  169 





   11 

  159 
   77 
   82 





  182 




  182 
   34 




   78 

  135 





1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
// SPDX-License-Identifier: GPL-2.0
/*
 *
 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
 *
 */

#include <linux/types.h>

#include "ntfs_fs.h"

#define BITS_IN_SIZE_T (sizeof(size_t) * 8)

/*
 * fill_mask[i] - first i bits are '1' , i = 0,1,2,3,4,5,6,7,8
 * fill_mask[i] = 0xFF >> (8-i)
 */
static const u8 fill_mask[] = { 0x00, 0x01, 0x03, 0x07, 0x0F,
                                0x1F, 0x3F, 0x7F, 0xFF };

/*
 * zero_mask[i] - first i bits are '0' , i = 0,1,2,3,4,5,6,7,8
 * zero_mask[i] = 0xFF << i
 */
static const u8 zero_mask[] = { 0xFF, 0xFE, 0xFC, 0xF8, 0xF0,
                                0xE0, 0xC0, 0x80, 0x00 };

/*
 * are_bits_clear
 *
 * Return: True if all bits [bit, bit+nbits) are zeros "0".
 */
bool are_bits_clear(const void *lmap, size_t bit, size_t nbits)
{
        size_t pos = bit & 7;
        const u8 *map = (u8 *)lmap + (bit >> 3);

        if (pos) {
                if (8 - pos >= nbits)
                        return !nbits || !(*map & fill_mask[pos + nbits] &
                                           zero_mask[pos]);

                if (*map++ & zero_mask[pos])
                        return false;
                nbits -= 8 - pos;
        }

        pos = ((size_t)map) & (sizeof(size_t) - 1);
        if (pos) {
                pos = sizeof(size_t) - pos;
                if (nbits >= pos * 8) {
                        for (nbits -= pos * 8; pos; pos--, map++) {
                                if (*map)
                                        return false;
                        }
                }
        }

        for (pos = nbits / BITS_IN_SIZE_T; pos; pos--, map += sizeof(size_t)) {
                if (*((size_t *)map))
                        return false;
        }

        for (pos = (nbits % BITS_IN_SIZE_T) >> 3; pos; pos--, map++) {
                if (*map)
                        return false;
        }

        pos = nbits & 7;
        if (pos && (*map & fill_mask[pos]))
                return false;

        return true;
}

/*
 * are_bits_set
 *
 * Return: True if all bits [bit, bit+nbits) are ones "1".
 */
bool are_bits_set(const void *lmap, size_t bit, size_t nbits)
{
        u8 mask;
        size_t pos = bit & 7;
        const u8 *map = (u8 *)lmap + (bit >> 3);

        if (pos) {
                if (8 - pos >= nbits) {
                        mask = fill_mask[pos + nbits] & zero_mask[pos];
                        return !nbits || (*map & mask) == mask;
                }

                mask = zero_mask[pos];
                if ((*map++ & mask) != mask)
                        return false;
                nbits -= 8 - pos;
        }

        pos = ((size_t)map) & (sizeof(size_t) - 1);
        if (pos) {
                pos = sizeof(size_t) - pos;
                if (nbits >= pos * 8) {
                        for (nbits -= pos * 8; pos; pos--, map++) {
                                if (*map != 0xFF)
                                        return false;
                        }
                }
        }

        for (pos = nbits / BITS_IN_SIZE_T; pos; pos--, map += sizeof(size_t)) {
                if (*((size_t *)map) != MINUS_ONE_T)
                        return false;
        }

        for (pos = (nbits % BITS_IN_SIZE_T) >> 3; pos; pos--, map++) {
                if (*map != 0xFF)
                        return false;
        }

        pos = nbits & 7;
        if (pos) {
                mask = fill_mask[pos];
                if ((*map & mask) != mask)
                        return false;
        }

        return true;
}




















































    1 




    1 









    1 
    1 
















    1 
    1 






    1 









    1 





































































    1 




    1 


    1 


    1 















    1 

    1 



















































































































    1 
    1 









































































































































    3 



    2 


    1 


    1 
























    1 



































    1 

























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *        LAPB release 002
 *
 *        This code REQUIRES 2.1.15 or higher/ NET3.038
 *
 *        History
 *        LAPB 001        Jonathan Naylor        Started Coding
 *        LAPB 002        Jonathan Naylor        New timer architecture.
 *        2000-10-29        Henner Eisen        lapb_data_indication() return status.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/kernel.h>
#include <linux/jiffies.h>
#include <linux/timer.h>
#include <linux/string.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/inet.h>
#include <linux/if_arp.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <net/sock.h>
#include <linux/uaccess.h>
#include <linux/fcntl.h>
#include <linux/mm.h>
#include <linux/interrupt.h>
#include <linux/stat.h>
#include <linux/init.h>
#include <net/lapb.h>

static LIST_HEAD(lapb_list);
static DEFINE_RWLOCK(lapb_list_lock);

/*
 *        Free an allocated lapb control block.
 */
static void lapb_free_cb(struct lapb_cb *lapb)
{
        kfree(lapb);
}

static __inline__ void lapb_hold(struct lapb_cb *lapb)
{
        refcount_inc(&lapb->refcnt);
}

static __inline__ void lapb_put(struct lapb_cb *lapb)
{
        if (refcount_dec_and_test(&lapb->refcnt))
                lapb_free_cb(lapb);
}

/*
 *        Socket removal during an interrupt is now safe.
 */
static void __lapb_remove_cb(struct lapb_cb *lapb)
{
        if (lapb->node.next) {
                list_del(&lapb->node);
                lapb_put(lapb);
        }
}

/*
 *        Add a socket to the bound sockets list.
 */
static void __lapb_insert_cb(struct lapb_cb *lapb)
{
        list_add(&lapb->node, &lapb_list);
        lapb_hold(lapb);
}

static struct lapb_cb *__lapb_devtostruct(struct net_device *dev)
{
        struct lapb_cb *lapb, *use = NULL;

        list_for_each_entry(lapb, &lapb_list, node) {
                if (lapb->dev == dev) {
                        use = lapb;
                        break;
                }
        }

        if (use)
                lapb_hold(use);

        return use;
}

static struct lapb_cb *lapb_devtostruct(struct net_device *dev)
{
        struct lapb_cb *rc;

        read_lock_bh(&lapb_list_lock);
        rc = __lapb_devtostruct(dev);
        read_unlock_bh(&lapb_list_lock);

        return rc;
}
/*
 *        Create an empty LAPB control block.
 */
static struct lapb_cb *lapb_create_cb(void)
{
        struct lapb_cb *lapb = kzalloc(sizeof(*lapb), GFP_ATOMIC);

        if (!lapb)
                goto out;

        skb_queue_head_init(&lapb->write_queue);
        skb_queue_head_init(&lapb->ack_queue);

        timer_setup(&lapb->t1timer, NULL, 0);
        timer_setup(&lapb->t2timer, NULL, 0);
        lapb->t1timer_running = false;
        lapb->t2timer_running = false;

        lapb->t1      = LAPB_DEFAULT_T1;
        lapb->t2      = LAPB_DEFAULT_T2;
        lapb->n2      = LAPB_DEFAULT_N2;
        lapb->mode    = LAPB_DEFAULT_MODE;
        lapb->window  = LAPB_DEFAULT_WINDOW;
        lapb->state   = LAPB_STATE_0;

        spin_lock_init(&lapb->lock);
        refcount_set(&lapb->refcnt, 1);
out:
        return lapb;
}

int lapb_register(struct net_device *dev,
                  const struct lapb_register_struct *callbacks)
{
        struct lapb_cb *lapb;
        int rc = LAPB_BADTOKEN;

        write_lock_bh(&lapb_list_lock);

        lapb = __lapb_devtostruct(dev);
        if (lapb) {
                lapb_put(lapb);
                goto out;
        }

        lapb = lapb_create_cb();
        rc = LAPB_NOMEM;
        if (!lapb)
                goto out;

        lapb->dev       = dev;
        lapb->callbacks = callbacks;

        __lapb_insert_cb(lapb);

        lapb_start_t1timer(lapb);

        rc = LAPB_OK;
out:
        write_unlock_bh(&lapb_list_lock);
        return rc;
}
EXPORT_SYMBOL(lapb_register);

int lapb_unregister(struct net_device *dev)
{
        struct lapb_cb *lapb;
        int rc = LAPB_BADTOKEN;

        write_lock_bh(&lapb_list_lock);
        lapb = __lapb_devtostruct(dev);
        if (!lapb)
                goto out;
        lapb_put(lapb);

        /* Wait for other refs to "lapb" to drop */
        while (refcount_read(&lapb->refcnt) > 2)
                usleep_range(1, 10);

        spin_lock_bh(&lapb->lock);

        lapb_stop_t1timer(lapb);
        lapb_stop_t2timer(lapb);

        lapb_clear_queues(lapb);

        spin_unlock_bh(&lapb->lock);

        /* Wait for running timers to stop */
        del_timer_sync(&lapb->t1timer);
        del_timer_sync(&lapb->t2timer);

        __lapb_remove_cb(lapb);

        lapb_put(lapb);
        rc = LAPB_OK;
out:
        write_unlock_bh(&lapb_list_lock);
        return rc;
}
EXPORT_SYMBOL(lapb_unregister);

int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms)
{
        int rc = LAPB_BADTOKEN;
        struct lapb_cb *lapb = lapb_devtostruct(dev);

        if (!lapb)
                goto out;

        spin_lock_bh(&lapb->lock);

        parms->t1      = lapb->t1 / HZ;
        parms->t2      = lapb->t2 / HZ;
        parms->n2      = lapb->n2;
        parms->n2count = lapb->n2count;
        parms->state   = lapb->state;
        parms->window  = lapb->window;
        parms->mode    = lapb->mode;

        if (!timer_pending(&lapb->t1timer))
                parms->t1timer = 0;
        else
                parms->t1timer = (lapb->t1timer.expires - jiffies) / HZ;

        if (!timer_pending(&lapb->t2timer))
                parms->t2timer = 0;
        else
                parms->t2timer = (lapb->t2timer.expires - jiffies) / HZ;

        spin_unlock_bh(&lapb->lock);
        lapb_put(lapb);
        rc = LAPB_OK;
out:
        return rc;
}
EXPORT_SYMBOL(lapb_getparms);

int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms)
{
        int rc = LAPB_BADTOKEN;
        struct lapb_cb *lapb = lapb_devtostruct(dev);

        if (!lapb)
                goto out;

        spin_lock_bh(&lapb->lock);

        rc = LAPB_INVALUE;
        if (parms->t1 < 1 || parms->t2 < 1 || parms->n2 < 1)
                goto out_put;

        if (lapb->state == LAPB_STATE_0) {
                if (parms->mode & LAPB_EXTENDED) {
                        if (parms->window < 1 || parms->window > 127)
                                goto out_put;
                } else {
                        if (parms->window < 1 || parms->window > 7)
                                goto out_put;
                }
                lapb->mode    = parms->mode;
                lapb->window  = parms->window;
        }

        lapb->t1    = parms->t1 * HZ;
        lapb->t2    = parms->t2 * HZ;
        lapb->n2    = parms->n2;

        rc = LAPB_OK;
out_put:
        spin_unlock_bh(&lapb->lock);
        lapb_put(lapb);
out:
        return rc;
}
EXPORT_SYMBOL(lapb_setparms);

int lapb_connect_request(struct net_device *dev)
{
        struct lapb_cb *lapb = lapb_devtostruct(dev);
        int rc = LAPB_BADTOKEN;

        if (!lapb)
                goto out;

        spin_lock_bh(&lapb->lock);

        rc = LAPB_OK;
        if (lapb->state == LAPB_STATE_1)
                goto out_put;

        rc = LAPB_CONNECTED;
        if (lapb->state == LAPB_STATE_3 || lapb->state == LAPB_STATE_4)
                goto out_put;

        lapb_establish_data_link(lapb);

        lapb_dbg(0, "(%p) S0 -> S1\n", lapb->dev);
        lapb->state = LAPB_STATE_1;

        rc = LAPB_OK;
out_put:
        spin_unlock_bh(&lapb->lock);
        lapb_put(lapb);
out:
        return rc;
}
EXPORT_SYMBOL(lapb_connect_request);

static int __lapb_disconnect_request(struct lapb_cb *lapb)
{
        switch (lapb->state) {
        case LAPB_STATE_0:
                return LAPB_NOTCONNECTED;

        case LAPB_STATE_1:
                lapb_dbg(1, "(%p) S1 TX DISC(1)\n", lapb->dev);
                lapb_dbg(0, "(%p) S1 -> S0\n", lapb->dev);
                lapb_send_control(lapb, LAPB_DISC, LAPB_POLLON, LAPB_COMMAND);
                lapb->state = LAPB_STATE_0;
                lapb_start_t1timer(lapb);
                return LAPB_NOTCONNECTED;

        case LAPB_STATE_2:
                return LAPB_OK;
        }

        lapb_clear_queues(lapb);
        lapb->n2count = 0;
        lapb_send_control(lapb, LAPB_DISC, LAPB_POLLON, LAPB_COMMAND);
        lapb_start_t1timer(lapb);
        lapb_stop_t2timer(lapb);
        lapb->state = LAPB_STATE_2;

        lapb_dbg(1, "(%p) S3 DISC(1)\n", lapb->dev);
        lapb_dbg(0, "(%p) S3 -> S2\n", lapb->dev);

        return LAPB_OK;
}

int lapb_disconnect_request(struct net_device *dev)
{
        struct lapb_cb *lapb = lapb_devtostruct(dev);
        int rc = LAPB_BADTOKEN;

        if (!lapb)
                goto out;

        spin_lock_bh(&lapb->lock);

        rc = __lapb_disconnect_request(lapb);

        spin_unlock_bh(&lapb->lock);
        lapb_put(lapb);
out:
        return rc;
}
EXPORT_SYMBOL(lapb_disconnect_request);

int lapb_data_request(struct net_device *dev, struct sk_buff *skb)
{
        struct lapb_cb *lapb = lapb_devtostruct(dev);
        int rc = LAPB_BADTOKEN;

        if (!lapb)
                goto out;

        spin_lock_bh(&lapb->lock);

        rc = LAPB_NOTCONNECTED;
        if (lapb->state != LAPB_STATE_3 && lapb->state != LAPB_STATE_4)
                goto out_put;

        skb_queue_tail(&lapb->write_queue, skb);
        lapb_kick(lapb);
        rc = LAPB_OK;
out_put:
        spin_unlock_bh(&lapb->lock);
        lapb_put(lapb);
out:
        return rc;
}
EXPORT_SYMBOL(lapb_data_request);

int lapb_data_received(struct net_device *dev, struct sk_buff *skb)
{
        struct lapb_cb *lapb = lapb_devtostruct(dev);
        int rc = LAPB_BADTOKEN;

        if (lapb) {
                spin_lock_bh(&lapb->lock);
                lapb_data_input(lapb, skb);
                spin_unlock_bh(&lapb->lock);
                lapb_put(lapb);
                rc = LAPB_OK;
        }

        return rc;
}
EXPORT_SYMBOL(lapb_data_received);

void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
{
        if (lapb->callbacks->connect_confirmation)
                lapb->callbacks->connect_confirmation(lapb->dev, reason);
}

void lapb_connect_indication(struct lapb_cb *lapb, int reason)
{
        if (lapb->callbacks->connect_indication)
                lapb->callbacks->connect_indication(lapb->dev, reason);
}

void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
{
        if (lapb->callbacks->disconnect_confirmation)
                lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
}

void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
{
        if (lapb->callbacks->disconnect_indication)
                lapb->callbacks->disconnect_indication(lapb->dev, reason);
}

int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
{
        if (lapb->callbacks->data_indication)
                return lapb->callbacks->data_indication(lapb->dev, skb);

        kfree_skb(skb);
        return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
}

int lapb_data_transmit(struct lapb_cb *lapb, struct sk_buff *skb)
{
        int used = 0;

        if (lapb->callbacks->data_transmit) {
                lapb->callbacks->data_transmit(lapb->dev, skb);
                used = 1;
        }

        return used;
}

/* Handle device status changes. */
static int lapb_device_event(struct notifier_block *this, unsigned long event,
                             void *ptr)
{
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct lapb_cb *lapb;

        if (!net_eq(dev_net(dev), &init_net))
                return NOTIFY_DONE;

        if (dev->type != ARPHRD_X25)
                return NOTIFY_DONE;

        lapb = lapb_devtostruct(dev);
        if (!lapb)
                return NOTIFY_DONE;

        spin_lock_bh(&lapb->lock);

        switch (event) {
        case NETDEV_UP:
                lapb_dbg(0, "(%p) Interface up: %s\n", dev, dev->name);

                if (netif_carrier_ok(dev)) {
                        lapb_dbg(0, "(%p): Carrier is already up: %s\n", dev,
                                 dev->name);
                        if (lapb->mode & LAPB_DCE) {
                                lapb_start_t1timer(lapb);
                        } else {
                                if (lapb->state == LAPB_STATE_0) {
                                        lapb->state = LAPB_STATE_1;
                                        lapb_establish_data_link(lapb);
                                }
                        }
                }
                break;
        case NETDEV_GOING_DOWN:
                if (netif_carrier_ok(dev))
                        __lapb_disconnect_request(lapb);
                break;
        case NETDEV_DOWN:
                lapb_dbg(0, "(%p) Interface down: %s\n", dev, dev->name);
                lapb_dbg(0, "(%p) S%d -> S0\n", dev, lapb->state);
                lapb_clear_queues(lapb);
                lapb->state = LAPB_STATE_0;
                lapb->n2count   = 0;
                lapb_stop_t1timer(lapb);
                lapb_stop_t2timer(lapb);
                break;
        case NETDEV_CHANGE:
                if (netif_carrier_ok(dev)) {
                        lapb_dbg(0, "(%p): Carrier detected: %s\n", dev,
                                 dev->name);
                        if (lapb->mode & LAPB_DCE) {
                                lapb_start_t1timer(lapb);
                        } else {
                                if (lapb->state == LAPB_STATE_0) {
                                        lapb->state = LAPB_STATE_1;
                                        lapb_establish_data_link(lapb);
                                }
                        }
                } else {
                        lapb_dbg(0, "(%p) Carrier lost: %s\n", dev, dev->name);
                        lapb_dbg(0, "(%p) S%d -> S0\n", dev, lapb->state);
                        lapb_clear_queues(lapb);
                        lapb->state = LAPB_STATE_0;
                        lapb->n2count   = 0;
                        lapb_stop_t1timer(lapb);
                        lapb_stop_t2timer(lapb);
                }
                break;
        }

        spin_unlock_bh(&lapb->lock);
        lapb_put(lapb);
        return NOTIFY_DONE;
}

static struct notifier_block lapb_dev_notifier = {
        .notifier_call = lapb_device_event,
};

static int __init lapb_init(void)
{
        return register_netdevice_notifier(&lapb_dev_notifier);
}

static void __exit lapb_exit(void)
{
        WARN_ON(!list_empty(&lapb_list));

        unregister_netdevice_notifier(&lapb_dev_notifier);
}

MODULE_AUTHOR("Jonathan Naylor <g4klx@g4klx.demon.co.uk>");
MODULE_DESCRIPTION("The X.25 Link Access Procedure B link layer protocol");
MODULE_LICENSE("GPL");

module_init(lapb_init);
module_exit(lapb_exit);
































    6 





    6 









































    6 































    6 



    6 
    6 



    6 

    6 









    6 

















































    6 






    6 

    6 




















    5 



    6 



    6 


    5 
    6 


    6 








    6 


    6 
















































    6 



    5 
    6 



    6 

    5 






    6 
    6 
    6 

    5 
    6 












    6 


    5 
    6 


    6 



    5 


    6 



    6 





















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
// SPDX-License-Identifier: GPL-2.0
/*
 * List pending timers
 *
 * Copyright(C) 2006, Red Hat, Inc., Ingo Molnar
 */

#include <linux/proc_fs.h>
#include <linux/module.h>
#include <linux/spinlock.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
#include <linux/kallsyms.h>
#include <linux/nmi.h>

#include <linux/uaccess.h>

#include "tick-internal.h"

struct timer_list_iter {
        int cpu;
        bool second_pass;
        u64 now;
};

/*
 * This allows printing both to /proc/timer_list and
 * to the console (on SysRq-Q):
 */
__printf(2, 3)
static void SEQ_printf(struct seq_file *m, const char *fmt, ...)
{
        va_list args;

        va_start(args, fmt);

        if (m)
                seq_vprintf(m, fmt, args);
        else
                vprintk(fmt, args);

        va_end(args);
}

static void
print_timer(struct seq_file *m, struct hrtimer *taddr, struct hrtimer *timer,
            int idx, u64 now)
{
        SEQ_printf(m, " #%d: <%pK>, %ps", idx, taddr, timer->function);
        SEQ_printf(m, ", S:%02x", timer->state);
        SEQ_printf(m, "\n");
        SEQ_printf(m, " # expires at %Lu-%Lu nsecs [in %Ld to %Ld nsecs]\n",
                (unsigned long long)ktime_to_ns(hrtimer_get_softexpires(timer)),
                (unsigned long long)ktime_to_ns(hrtimer_get_expires(timer)),
                (long long)(ktime_to_ns(hrtimer_get_softexpires(timer)) - now),
                (long long)(ktime_to_ns(hrtimer_get_expires(timer)) - now));
}

static void
print_active_timers(struct seq_file *m, struct hrtimer_clock_base *base,
                    u64 now)
{
        struct hrtimer *timer, tmp;
        unsigned long next = 0, i;
        struct timerqueue_node *curr;
        unsigned long flags;

next_one:
        i = 0;

        touch_nmi_watchdog();

        raw_spin_lock_irqsave(&base->cpu_base->lock, flags);

        curr = timerqueue_getnext(&base->active);
        /*
         * Crude but we have to do this O(N*N) thing, because
         * we have to unlock the base when printing:
         */
        while (curr && i < next) {
                curr = timerqueue_iterate_next(curr);
                i++;
        }

        if (curr) {

                timer = container_of(curr, struct hrtimer, node);
                tmp = *timer;
                raw_spin_unlock_irqrestore(&base->cpu_base->lock, flags);

                print_timer(m, timer, &tmp, i, now);
                next++;
                goto next_one;
        }
        raw_spin_unlock_irqrestore(&base->cpu_base->lock, flags);
}

static void
print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
{
        SEQ_printf(m, "  .base:       %pK\n", base);
        SEQ_printf(m, "  .index:      %d\n", base->index);

        SEQ_printf(m, "  .resolution: %u nsecs\n", hrtimer_resolution);

        SEQ_printf(m,   "  .get_time:   %ps\n", base->get_time);
#ifdef CONFIG_HIGH_RES_TIMERS
        SEQ_printf(m, "  .offset:     %Lu nsecs\n",
                   (unsigned long long) ktime_to_ns(base->offset));
#endif
        SEQ_printf(m,   "active timers:\n");
        print_active_timers(m, base, now + ktime_to_ns(base->offset));
}

static void print_cpu(struct seq_file *m, int cpu, u64 now)
{
        struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
        int i;

        SEQ_printf(m, "cpu: %d\n", cpu);
        for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
                SEQ_printf(m, " clock %d:\n", i);
                print_base(m, cpu_base->clock_base + i, now);
        }
#define P(x) \
        SEQ_printf(m, "  .%-15s: %Lu\n", #x, \
                   (unsigned long long)(cpu_base->x))
#define P_ns(x) \
        SEQ_printf(m, "  .%-15s: %Lu nsecs\n", #x, \
                   (unsigned long long)(ktime_to_ns(cpu_base->x)))

#ifdef CONFIG_HIGH_RES_TIMERS
        P_ns(expires_next);
        P(hres_active);
        P(nr_events);
        P(nr_retries);
        P(nr_hangs);
        P(max_hang_time);
#endif
#undef P
#undef P_ns

#ifdef CONFIG_TICK_ONESHOT
# define P(x) \
        SEQ_printf(m, "  .%-15s: %Lu\n", #x, \
                   (unsigned long long)(ts->x))
# define P_ns(x) \
        SEQ_printf(m, "  .%-15s: %Lu nsecs\n", #x, \
                   (unsigned long long)(ktime_to_ns(ts->x)))
# define P_flag(x, f)                            \
        SEQ_printf(m, "  .%-15s: %d\n", #x, !!(ts->flags & (f)))

        {
                struct tick_sched *ts = tick_get_tick_sched(cpu);
                P_flag(nohz, TS_FLAG_NOHZ);
                P_flag(highres, TS_FLAG_HIGHRES);
                P_ns(last_tick);
                P_flag(tick_stopped, TS_FLAG_STOPPED);
                P(idle_jiffies);
                P(idle_calls);
                P(idle_sleeps);
                P_ns(idle_entrytime);
                P_ns(idle_waketime);
                P_ns(idle_exittime);
                P_ns(idle_sleeptime);
                P_ns(iowait_sleeptime);
                P(last_jiffies);
                P(next_timer);
                P_ns(idle_expires);
                SEQ_printf(m, "jiffies: %Lu\n",
                           (unsigned long long)jiffies);
        }
#endif

#undef P
#undef P_ns
        SEQ_printf(m, "\n");
}

#ifdef CONFIG_GENERIC_CLOCKEVENTS
static void
print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu)
{
        struct clock_event_device *dev = td->evtdev;

        touch_nmi_watchdog();

        SEQ_printf(m, "Tick Device: mode:     %d\n", td->mode);
        if (cpu < 0)
                SEQ_printf(m, "Broadcast device\n");
        else
                SEQ_printf(m, "Per CPU device: %d\n", cpu);

        SEQ_printf(m, "Clock Event Device: ");
        if (!dev) {
                SEQ_printf(m, "<NULL>\n");
                return;
        }
        SEQ_printf(m, "%s\n", dev->name);
        SEQ_printf(m, " max_delta_ns:   %llu\n",
                   (unsigned long long) dev->max_delta_ns);
        SEQ_printf(m, " min_delta_ns:   %llu\n",
                   (unsigned long long) dev->min_delta_ns);
        SEQ_printf(m, " mult:           %u\n", dev->mult);
        SEQ_printf(m, " shift:          %u\n", dev->shift);
        SEQ_printf(m, " mode:           %d\n", clockevent_get_state(dev));
        SEQ_printf(m, " next_event:     %Ld nsecs\n",
                   (unsigned long long) ktime_to_ns(dev->next_event));

        SEQ_printf(m, " set_next_event: %ps\n", dev->set_next_event);

        if (dev->set_state_shutdown)
                SEQ_printf(m, " shutdown:       %ps\n",
                        dev->set_state_shutdown);

        if (dev->set_state_periodic)
                SEQ_printf(m, " periodic:       %ps\n",
                        dev->set_state_periodic);

        if (dev->set_state_oneshot)
                SEQ_printf(m, " oneshot:        %ps\n",
                        dev->set_state_oneshot);

        if (dev->set_state_oneshot_stopped)
                SEQ_printf(m, " oneshot stopped: %ps\n",
                        dev->set_state_oneshot_stopped);

        if (dev->tick_resume)
                SEQ_printf(m, " resume:         %ps\n",
                        dev->tick_resume);

        SEQ_printf(m, " event_handler:  %ps\n", dev->event_handler);
        SEQ_printf(m, "\n");
        SEQ_printf(m, " retries:        %lu\n", dev->retries);

#ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
        if (cpu >= 0) {
                const struct clock_event_device *wd = tick_get_wakeup_device(cpu);

                SEQ_printf(m, "Wakeup Device: %s\n", wd ? wd->name : "<NULL>");
        }
#endif
        SEQ_printf(m, "\n");
}

static void timer_list_show_tickdevices_header(struct seq_file *m)
{
#ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
        print_tickdevice(m, tick_get_broadcast_device(), -1);
        SEQ_printf(m, "tick_broadcast_mask: %*pb\n",
                   cpumask_pr_args(tick_get_broadcast_mask()));
#ifdef CONFIG_TICK_ONESHOT
        SEQ_printf(m, "tick_broadcast_oneshot_mask: %*pb\n",
                   cpumask_pr_args(tick_get_broadcast_oneshot_mask()));
#endif
        SEQ_printf(m, "\n");
#endif
}
#endif

static inline void timer_list_header(struct seq_file *m, u64 now)
{
        SEQ_printf(m, "Timer List Version: v0.10\n");
        SEQ_printf(m, "HRTIMER_MAX_CLOCK_BASES: %d\n", HRTIMER_MAX_CLOCK_BASES);
        SEQ_printf(m, "now at %Ld nsecs\n", (unsigned long long)now);
        SEQ_printf(m, "\n");
}

void sysrq_timer_list_show(void)
{
        u64 now = ktime_to_ns(ktime_get());
        int cpu;

        timer_list_header(NULL, now);

        for_each_online_cpu(cpu)
                print_cpu(NULL, cpu, now);

#ifdef CONFIG_GENERIC_CLOCKEVENTS
        timer_list_show_tickdevices_header(NULL);
        for_each_online_cpu(cpu)
                print_tickdevice(NULL, tick_get_device(cpu), cpu);
#endif
        return;
}

#ifdef CONFIG_PROC_FS
static int timer_list_show(struct seq_file *m, void *v)
{
        struct timer_list_iter *iter = v;

        if (iter->cpu == -1 && !iter->second_pass)
                timer_list_header(m, iter->now);
        else if (!iter->second_pass)
                print_cpu(m, iter->cpu, iter->now);
#ifdef CONFIG_GENERIC_CLOCKEVENTS
        else if (iter->cpu == -1 && iter->second_pass)
                timer_list_show_tickdevices_header(m);
        else
                print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
#endif
        return 0;
}

static void *move_iter(struct timer_list_iter *iter, loff_t offset)
{
        for (; offset; offset--) {
                iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
                if (iter->cpu >= nr_cpu_ids) {
#ifdef CONFIG_GENERIC_CLOCKEVENTS
                        if (!iter->second_pass) {
                                iter->cpu = -1;
                                iter->second_pass = true;
                        } else
                                return NULL;
#else
                        return NULL;
#endif
                }
        }
        return iter;
}

static void *timer_list_start(struct seq_file *file, loff_t *offset)
{
        struct timer_list_iter *iter = file->private;

        if (!*offset)
                iter->now = ktime_to_ns(ktime_get());
        iter->cpu = -1;
        iter->second_pass = false;
        return move_iter(iter, *offset);
}

static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset)
{
        struct timer_list_iter *iter = file->private;
        ++*offset;
        return move_iter(iter, 1);
}

static void timer_list_stop(struct seq_file *seq, void *v)
{
}

static const struct seq_operations timer_list_sops = {
        .start = timer_list_start,
        .next = timer_list_next,
        .stop = timer_list_stop,
        .show = timer_list_show,
};

static int __init init_timer_list_procfs(void)
{
        struct proc_dir_entry *pe;

        pe = proc_create_seq_private("timer_list", 0400, NULL, &timer_list_sops,
                        sizeof(struct timer_list_iter), NULL);
        if (!pe)
                return -ENOMEM;
        return 0;
}
__initcall(init_timer_list_procfs);
#endif






























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    2 






























    2 






























    3 




    3 














    2 






























































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *        TCP over IPv6
 *        Linux INET6 implementation
 *
 *        Authors:
 *        Pedro Roque                <roque@di.fc.ul.pt>
 *
 *        Based on:
 *        linux/net/ipv4/tcp.c
 *        linux/net/ipv4/tcp_input.c
 *        linux/net/ipv4/tcp_output.c
 *
 *        Fixes:
 *        Hideaki YOSHIFUJI        :        sin6_scope_id support
 *        YOSHIFUJI Hideaki @USAGI and:        Support IPV6_V6ONLY socket option, which
 *        Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
 *                                        a single port at the same time.
 *        YOSHIFUJI Hideaki @USAGI:        convert /proc/net/tcp6 to seq_file.
 */

#include <linux/bottom_half.h>
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/jiffies.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/init.h>
#include <linux/jhash.h>
#include <linux/ipsec.h>
#include <linux/times.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>
#include <linux/indirect_call_wrapper.h>

#include <net/tcp.h>
#include <net/ndisc.h>
#include <net/inet6_hashtables.h>
#include <net/inet6_connection_sock.h>
#include <net/ipv6.h>
#include <net/transp_v6.h>
#include <net/addrconf.h>
#include <net/ip6_route.h>
#include <net/ip6_checksum.h>
#include <net/inet_ecn.h>
#include <net/protocol.h>
#include <net/xfrm.h>
#include <net/snmp.h>
#include <net/dsfield.h>
#include <net/timewait_sock.h>
#include <net/inet_common.h>
#include <net/secure_seq.h>
#include <net/hotdata.h>
#include <net/busy_poll.h>
#include <net/rstreason.h>

#include <linux/proc_fs.h>
#include <linux/seq_file.h>

#include <crypto/hash.h>
#include <linux/scatterlist.h>

#include <trace/events/tcp.h>

static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
                              enum sk_rst_reason reason);
static void        tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
                                      struct request_sock *req);

INDIRECT_CALLABLE_SCOPE int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);

static const struct inet_connection_sock_af_ops ipv6_mapped;
const struct inet_connection_sock_af_ops ipv6_specific;
#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
#endif

/* Helper returning the inet6 address from a given tcp socket.
 * It can be used in TCP stack instead of inet6_sk(sk).
 * This avoids a dereference and allow compiler optimizations.
 * It is a specialized version of inet6_sk_generic().
 */
#define tcp_inet6_sk(sk) (&container_of_const(tcp_sk(sk), \
                                              struct tcp6_sock, tcp)->inet6)

static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
{
        struct dst_entry *dst = skb_dst(skb);

        if (dst && dst_hold_safe(dst)) {
                rcu_assign_pointer(sk->sk_rx_dst, dst);
                sk->sk_rx_dst_ifindex = skb->skb_iif;
                sk->sk_rx_dst_cookie = rt6_get_cookie(dst_rt6_info(dst));
        }
}

static u32 tcp_v6_init_seq(const struct sk_buff *skb)
{
        return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
                                ipv6_hdr(skb)->saddr.s6_addr32,
                                tcp_hdr(skb)->dest,
                                tcp_hdr(skb)->source);
}

static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
{
        return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
                                   ipv6_hdr(skb)->saddr.s6_addr32);
}

static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
                              int addr_len)
{
        /* This check is replicated from tcp_v6_connect() and intended to
         * prevent BPF program called below from accessing bytes that are out
         * of the bound specified by user in addr_len.
         */
        if (addr_len < SIN6_LEN_RFC2133)
                return -EINVAL;

        sock_owned_by_me(sk);

        return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr, &addr_len);
}

static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                          int addr_len)
{
        struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct in6_addr *saddr = NULL, *final_p, final;
        struct inet_timewait_death_row *tcp_death_row;
        struct ipv6_pinfo *np = tcp_inet6_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        struct net *net = sock_net(sk);
        struct ipv6_txoptions *opt;
        struct dst_entry *dst;
        struct flowi6 fl6;
        int addr_type;
        int err;

        if (addr_len < SIN6_LEN_RFC2133)
                return -EINVAL;

        if (usin->sin6_family != AF_INET6)
                return -EAFNOSUPPORT;

        memset(&fl6, 0, sizeof(fl6));

        if (inet6_test_bit(SNDFLOW, sk)) {
                fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
                IP6_ECN_flow_init(fl6.flowlabel);
                if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
                        struct ip6_flowlabel *flowlabel;
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (IS_ERR(flowlabel))
                                return -EINVAL;
                        fl6_sock_release(flowlabel);
                }
        }

        /*
         *        connect() to INADDR_ANY means loopback (BSD'ism).
         */

        if (ipv6_addr_any(&usin->sin6_addr)) {
                if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
                        ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
                                               &usin->sin6_addr);
                else
                        usin->sin6_addr = in6addr_loopback;
        }

        addr_type = ipv6_addr_type(&usin->sin6_addr);

        if (addr_type & IPV6_ADDR_MULTICAST)
                return -ENETUNREACH;

        if (addr_type&IPV6_ADDR_LINKLOCAL) {
                if (addr_len >= sizeof(struct sockaddr_in6) &&
                    usin->sin6_scope_id) {
                        /* If interface is set while binding, indices
                         * must coincide.
                         */
                        if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
                                return -EINVAL;

                        sk->sk_bound_dev_if = usin->sin6_scope_id;
                }

                /* Connect to link-local address requires an interface */
                if (!sk->sk_bound_dev_if)
                        return -EINVAL;
        }

        if (tp->rx_opt.ts_recent_stamp &&
            !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
                tp->rx_opt.ts_recent = 0;
                tp->rx_opt.ts_recent_stamp = 0;
                WRITE_ONCE(tp->write_seq, 0);
        }

        sk->sk_v6_daddr = usin->sin6_addr;
        np->flow_label = fl6.flowlabel;

        /*
         *        TCP over IPv4
         */

        if (addr_type & IPV6_ADDR_MAPPED) {
                u32 exthdrlen = icsk->icsk_ext_hdr_len;
                struct sockaddr_in sin;

                if (ipv6_only_sock(sk))
                        return -ENETUNREACH;

                sin.sin_family = AF_INET;
                sin.sin_port = usin->sin6_port;
                sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];

                /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */
                WRITE_ONCE(icsk->icsk_af_ops, &ipv6_mapped);
                if (sk_is_mptcp(sk))
                        mptcpv6_handle_mapped(sk, true);
                sk->sk_backlog_rcv = tcp_v4_do_rcv;
#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
                tp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif

                err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));

                if (err) {
                        icsk->icsk_ext_hdr_len = exthdrlen;
                        /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */
                        WRITE_ONCE(icsk->icsk_af_ops, &ipv6_specific);
                        if (sk_is_mptcp(sk))
                                mptcpv6_handle_mapped(sk, false);
                        sk->sk_backlog_rcv = tcp_v6_do_rcv;
#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
                        tp->af_specific = &tcp_sock_ipv6_specific;
#endif
                        goto failure;
                }
                np->saddr = sk->sk_v6_rcv_saddr;

                return err;
        }

        if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
                saddr = &sk->sk_v6_rcv_saddr;

        fl6.flowi6_proto = IPPROTO_TCP;
        fl6.daddr = sk->sk_v6_daddr;
        fl6.saddr = saddr ? *saddr : np->saddr;
        fl6.flowlabel = ip6_make_flowinfo(np->tclass, np->flow_label);
        fl6.flowi6_oif = sk->sk_bound_dev_if;
        fl6.flowi6_mark = sk->sk_mark;
        fl6.fl6_dport = usin->sin6_port;
        fl6.fl6_sport = inet->inet_sport;
        fl6.flowi6_uid = sk->sk_uid;

        opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
        final_p = fl6_update_dst(&fl6, opt, &final);

        security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6));

        dst = ip6_dst_lookup_flow(net, sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                goto failure;
        }

        tp->tcp_usec_ts = dst_tcp_usec_ts(dst);
        tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;

        if (!saddr) {
                saddr = &fl6.saddr;

                err = inet_bhash2_update_saddr(sk, saddr, AF_INET6);
                if (err)
                        goto failure;
        }

        /* set the source address */
        np->saddr = *saddr;
        inet->inet_rcv_saddr = LOOPBACK4_IPV6;

        sk->sk_gso_type = SKB_GSO_TCPV6;
        ip6_dst_store(sk, dst, NULL, NULL);

        icsk->icsk_ext_hdr_len = 0;
        if (opt)
                icsk->icsk_ext_hdr_len = opt->opt_flen +
                                         opt->opt_nflen;

        tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);

        inet->inet_dport = usin->sin6_port;

        tcp_set_state(sk, TCP_SYN_SENT);
        err = inet6_hash_connect(tcp_death_row, sk);
        if (err)
                goto late_failure;

        sk_set_txhash(sk);

        if (likely(!tp->repair)) {
                if (!tp->write_seq)
                        WRITE_ONCE(tp->write_seq,
                                   secure_tcpv6_seq(np->saddr.s6_addr32,
                                                    sk->sk_v6_daddr.s6_addr32,
                                                    inet->inet_sport,
                                                    inet->inet_dport));
                tp->tsoffset = secure_tcpv6_ts_off(net, np->saddr.s6_addr32,
                                                   sk->sk_v6_daddr.s6_addr32);
        }

        if (tcp_fastopen_defer_connect(sk, &err))
                return err;
        if (err)
                goto late_failure;

        err = tcp_connect(sk);
        if (err)
                goto late_failure;

        return 0;

late_failure:
        tcp_set_state(sk, TCP_CLOSE);
        inet_bhash2_reset_saddr(sk);
failure:
        inet->inet_dport = 0;
        sk->sk_route_caps = 0;
        return err;
}

static void tcp_v6_mtu_reduced(struct sock *sk)
{
        struct dst_entry *dst;
        u32 mtu;

        if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
                return;

        mtu = READ_ONCE(tcp_sk(sk)->mtu_info);

        /* Drop requests trying to increase our current mss.
         * Check done in __ip6_rt_update_pmtu() is too late.
         */
        if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
                return;

        dst = inet6_csk_update_pmtu(sk, mtu);
        if (!dst)
                return;

        if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
                tcp_sync_mss(sk, dst_mtu(dst));
                tcp_simple_retransmit(sk);
        }
}

static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                u8 type, u8 code, int offset, __be32 info)
{
        const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
        const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
        struct net *net = dev_net(skb->dev);
        struct request_sock *fastopen;
        struct ipv6_pinfo *np;
        struct tcp_sock *tp;
        __u32 seq, snd_una;
        struct sock *sk;
        bool fatal;
        int err;

        sk = __inet6_lookup_established(net, net->ipv4.tcp_death_row.hashinfo,
                                        &hdr->daddr, th->dest,
                                        &hdr->saddr, ntohs(th->source),
                                        skb->dev->ifindex, inet6_sdif(skb));

        if (!sk) {
                __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
                                  ICMP6_MIB_INERRORS);
                return -ENOENT;
        }

        if (sk->sk_state == TCP_TIME_WAIT) {
                /* To increase the counter of ignored icmps for TCP-AO */
                tcp_ao_ignore_icmp(sk, AF_INET6, type, code);
                inet_twsk_put(inet_twsk(sk));
                return 0;
        }
        seq = ntohl(th->seq);
        fatal = icmpv6_err_convert(type, code, &err);
        if (sk->sk_state == TCP_NEW_SYN_RECV) {
                tcp_req_err(sk, seq, fatal);
                return 0;
        }

        if (tcp_ao_ignore_icmp(sk, AF_INET6, type, code)) {
                sock_put(sk);
                return 0;
        }

        bh_lock_sock(sk);
        if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
                __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);

        if (sk->sk_state == TCP_CLOSE)
                goto out;

        if (static_branch_unlikely(&ip6_min_hopcount)) {
                /* min_hopcount can be changed concurrently from do_ipv6_setsockopt() */
                if (ipv6_hdr(skb)->hop_limit < READ_ONCE(tcp_inet6_sk(sk)->min_hopcount)) {
                        __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
                        goto out;
                }
        }

        tp = tcp_sk(sk);
        /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
        fastopen = rcu_dereference(tp->fastopen_rsk);
        snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
        if (sk->sk_state != TCP_LISTEN &&
            !between(seq, snd_una, tp->snd_nxt)) {
                __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
                goto out;
        }

        np = tcp_inet6_sk(sk);

        if (type == NDISC_REDIRECT) {
                if (!sock_owned_by_user(sk)) {
                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);

                        if (dst)
                                dst->ops->redirect(dst, sk, skb);
                }
                goto out;
        }

        if (type == ICMPV6_PKT_TOOBIG) {
                u32 mtu = ntohl(info);

                /* We are not interested in TCP_LISTEN and open_requests
                 * (SYN-ACKs send out by Linux are always <576bytes so
                 * they should go through unfragmented).
                 */
                if (sk->sk_state == TCP_LISTEN)
                        goto out;

                if (!ip6_sk_accept_pmtu(sk))
                        goto out;

                if (mtu < IPV6_MIN_MTU)
                        goto out;

                WRITE_ONCE(tp->mtu_info, mtu);

                if (!sock_owned_by_user(sk))
                        tcp_v6_mtu_reduced(sk);
                else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
                                           &sk->sk_tsq_flags))
                        sock_hold(sk);
                goto out;
        }


        /* Might be for an request_sock */
        switch (sk->sk_state) {
        case TCP_SYN_SENT:
        case TCP_SYN_RECV:
                /* Only in fast or simultaneous open. If a fast open socket is
                 * already accepted it is treated as a connected one below.
                 */
                if (fastopen && !fastopen->sk)
                        break;

                ipv6_icmp_error(sk, skb, err, th->dest, ntohl(info), (u8 *)th);

                if (!sock_owned_by_user(sk))
                        tcp_done_with_error(sk, err);
                else
                        WRITE_ONCE(sk->sk_err_soft, err);
                goto out;
        case TCP_LISTEN:
                break;
        default:
                /* check if this ICMP message allows revert of backoff.
                 * (see RFC 6069)
                 */
                if (!fastopen && type == ICMPV6_DEST_UNREACH &&
                    code == ICMPV6_NOROUTE)
                        tcp_ld_RTO_revert(sk, seq);
        }

        if (!sock_owned_by_user(sk) && inet6_test_bit(RECVERR6, sk)) {
                WRITE_ONCE(sk->sk_err, err);
                sk_error_report(sk);
        } else {
                WRITE_ONCE(sk->sk_err_soft, err);
        }
out:
        bh_unlock_sock(sk);
        sock_put(sk);
        return 0;
}


static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
                              struct flowi *fl,
                              struct request_sock *req,
                              struct tcp_fastopen_cookie *foc,
                              enum tcp_synack_type synack_type,
                              struct sk_buff *syn_skb)
{
        struct inet_request_sock *ireq = inet_rsk(req);
        const struct ipv6_pinfo *np = tcp_inet6_sk(sk);
        struct ipv6_txoptions *opt;
        struct flowi6 *fl6 = &fl->u.ip6;
        struct sk_buff *skb;
        int err = -ENOMEM;
        u8 tclass;

        /* First, grab a route. */
        if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
                                               IPPROTO_TCP)) == NULL)
                goto done;

        skb = tcp_make_synack(sk, dst, req, foc, synack_type, syn_skb);

        if (skb) {
                __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
                                    &ireq->ir_v6_rmt_addr);

                fl6->daddr = ireq->ir_v6_rmt_addr;
                if (inet6_test_bit(REPFLOW, sk) && ireq->pktopts)
                        fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));

                tclass = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) ?
                                (tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) |
                                (np->tclass & INET_ECN_MASK) :
                                np->tclass;

                if (!INET_ECN_is_capable(tclass) &&
                    tcp_bpf_ca_needs_ecn((struct sock *)req))
                        tclass |= INET_ECN_ECT_0;

                rcu_read_lock();
                opt = ireq->ipv6_opt;
                if (!opt)
                        opt = rcu_dereference(np->opt);
                err = ip6_xmit(sk, skb, fl6, skb->mark ? : READ_ONCE(sk->sk_mark),
                               opt, tclass, READ_ONCE(sk->sk_priority));
                rcu_read_unlock();
                err = net_xmit_eval(err);
        }

done:
        return err;
}


static void tcp_v6_reqsk_destructor(struct request_sock *req)
{
        kfree(inet_rsk(req)->ipv6_opt);
        consume_skb(inet_rsk(req)->pktopts);
}

#ifdef CONFIG_TCP_MD5SIG
static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
                                                   const struct in6_addr *addr,
                                                   int l3index)
{
        return tcp_md5_do_lookup(sk, l3index,
                                 (union tcp_md5_addr *)addr, AF_INET6);
}

static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
                                                const struct sock *addr_sk)
{
        int l3index;

        l3index = l3mdev_master_ifindex_by_index(sock_net(sk),
                                                 addr_sk->sk_bound_dev_if);
        return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr,
                                    l3index);
}

static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
                                 sockptr_t optval, int optlen)
{
        struct tcp_md5sig cmd;
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
        union tcp_ao_addr *addr;
        int l3index = 0;
        u8 prefixlen;
        bool l3flag;
        u8 flags;

        if (optlen < sizeof(cmd))
                return -EINVAL;

        if (copy_from_sockptr(&cmd, optval, sizeof(cmd)))
                return -EFAULT;

        if (sin6->sin6_family != AF_INET6)
                return -EINVAL;

        flags = cmd.tcpm_flags & TCP_MD5SIG_FLAG_IFINDEX;
        l3flag = cmd.tcpm_flags & TCP_MD5SIG_FLAG_IFINDEX;

        if (optname == TCP_MD5SIG_EXT &&
            cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
                prefixlen = cmd.tcpm_prefixlen;
                if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
                                        prefixlen > 32))
                        return -EINVAL;
        } else {
                prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
        }

        if (optname == TCP_MD5SIG_EXT && cmd.tcpm_ifindex &&
            cmd.tcpm_flags & TCP_MD5SIG_FLAG_IFINDEX) {
                struct net_device *dev;

                rcu_read_lock();
                dev = dev_get_by_index_rcu(sock_net(sk), cmd.tcpm_ifindex);
                if (dev && netif_is_l3_master(dev))
                        l3index = dev->ifindex;
                rcu_read_unlock();

                /* ok to reference set/not set outside of rcu;
                 * right now device MUST be an L3 master
                 */
                if (!dev || !l3index)
                        return -EINVAL;
        }

        if (!cmd.tcpm_keylen) {
                if (ipv6_addr_v4mapped(&sin6->sin6_addr))
                        return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
                                              AF_INET, prefixlen,
                                              l3index, flags);
                return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
                                      AF_INET6, prefixlen, l3index, flags);
        }

        if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
                return -EINVAL;

        if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
                addr = (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3];

                /* Don't allow keys for peers that have a matching TCP-AO key.
                 * See the comment in tcp_ao_add_cmd()
                 */
                if (tcp_ao_required(sk, addr, AF_INET,
                                    l3flag ? l3index : -1, false))
                        return -EKEYREJECTED;
                return tcp_md5_do_add(sk, addr,
                                      AF_INET, prefixlen, l3index, flags,
                                      cmd.tcpm_key, cmd.tcpm_keylen);
        }

        addr = (union tcp_md5_addr *)&sin6->sin6_addr;

        /* Don't allow keys for peers that have a matching TCP-AO key.
         * See the comment in tcp_ao_add_cmd()
         */
        if (tcp_ao_required(sk, addr, AF_INET6, l3flag ? l3index : -1, false))
                return -EKEYREJECTED;

        return tcp_md5_do_add(sk, addr, AF_INET6, prefixlen, l3index, flags,
                              cmd.tcpm_key, cmd.tcpm_keylen);
}

static int tcp_v6_md5_hash_headers(struct tcp_sigpool *hp,
                                   const struct in6_addr *daddr,
                                   const struct in6_addr *saddr,
                                   const struct tcphdr *th, int nbytes)
{
        struct tcp6_pseudohdr *bp;
        struct scatterlist sg;
        struct tcphdr *_th;

        bp = hp->scratch;
        /* 1. TCP pseudo-header (RFC2460) */
        bp->saddr = *saddr;
        bp->daddr = *daddr;
        bp->protocol = cpu_to_be32(IPPROTO_TCP);
        bp->len = cpu_to_be32(nbytes);

        _th = (struct tcphdr *)(bp + 1);
        memcpy(_th, th, sizeof(*th));
        _th->check = 0;

        sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
        ahash_request_set_crypt(hp->req, &sg, NULL,
                                sizeof(*bp) + sizeof(*th));
        return crypto_ahash_update(hp->req);
}

static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
                               const struct in6_addr *daddr, struct in6_addr *saddr,
                               const struct tcphdr *th)
{
        struct tcp_sigpool hp;

        if (tcp_sigpool_start(tcp_md5_sigpool_id, &hp))
                goto clear_hash_nostart;

        if (crypto_ahash_init(hp.req))
                goto clear_hash;
        if (tcp_v6_md5_hash_headers(&hp, daddr, saddr, th, th->doff << 2))
                goto clear_hash;
        if (tcp_md5_hash_key(&hp, key))
                goto clear_hash;
        ahash_request_set_crypt(hp.req, NULL, md5_hash, 0);
        if (crypto_ahash_final(hp.req))
                goto clear_hash;

        tcp_sigpool_end(&hp);
        return 0;

clear_hash:
        tcp_sigpool_end(&hp);
clear_hash_nostart:
        memset(md5_hash, 0, 16);
        return 1;
}

static int tcp_v6_md5_hash_skb(char *md5_hash,
                               const struct tcp_md5sig_key *key,
                               const struct sock *sk,
                               const struct sk_buff *skb)
{
        const struct tcphdr *th = tcp_hdr(skb);
        const struct in6_addr *saddr, *daddr;
        struct tcp_sigpool hp;

        if (sk) { /* valid for establish/request sockets */
                saddr = &sk->sk_v6_rcv_saddr;
                daddr = &sk->sk_v6_daddr;
        } else {
                const struct ipv6hdr *ip6h = ipv6_hdr(skb);
                saddr = &ip6h->saddr;
                daddr = &ip6h->daddr;
        }

        if (tcp_sigpool_start(tcp_md5_sigpool_id, &hp))
                goto clear_hash_nostart;

        if (crypto_ahash_init(hp.req))
                goto clear_hash;

        if (tcp_v6_md5_hash_headers(&hp, daddr, saddr, th, skb->len))
                goto clear_hash;
        if (tcp_sigpool_hash_skb_data(&hp, skb, th->doff << 2))
                goto clear_hash;
        if (tcp_md5_hash_key(&hp, key))
                goto clear_hash;
        ahash_request_set_crypt(hp.req, NULL, md5_hash, 0);
        if (crypto_ahash_final(hp.req))
                goto clear_hash;

        tcp_sigpool_end(&hp);
        return 0;

clear_hash:
        tcp_sigpool_end(&hp);
clear_hash_nostart:
        memset(md5_hash, 0, 16);
        return 1;
}
#endif

static void tcp_v6_init_req(struct request_sock *req,
                            const struct sock *sk_listener,
                            struct sk_buff *skb,
                            u32 tw_isn)
{
        bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
        struct inet_request_sock *ireq = inet_rsk(req);
        const struct ipv6_pinfo *np = tcp_inet6_sk(sk_listener);

        ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
        ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;

        /* So that link locals have meaning */
        if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
            ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
                ireq->ir_iif = tcp_v6_iif(skb);

        if (!tw_isn &&
            (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
             np->rxopt.bits.rxinfo ||
             np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
             np->rxopt.bits.rxohlim || inet6_test_bit(REPFLOW, sk_listener))) {
                refcount_inc(&skb->users);
                ireq->pktopts = skb;
        }
}

static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
                                          struct sk_buff *skb,
                                          struct flowi *fl,
                                          struct request_sock *req,
                                          u32 tw_isn)
{
        tcp_v6_init_req(req, sk, skb, tw_isn);

        if (security_inet_conn_request(sk, skb, req))
                return NULL;

        return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
}

struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
        .family                =        AF_INET6,
        .obj_size        =        sizeof(struct tcp6_request_sock),
        .rtx_syn_ack        =        tcp_rtx_synack,
        .send_ack        =        tcp_v6_reqsk_send_ack,
        .destructor        =        tcp_v6_reqsk_destructor,
        .send_reset        =        tcp_v6_send_reset,
        .syn_ack_timeout =        tcp_syn_ack_timeout,
};

const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
        .mss_clamp        =        IPV6_MIN_MTU - sizeof(struct tcphdr) -
                                sizeof(struct ipv6hdr),
#ifdef CONFIG_TCP_MD5SIG
        .req_md5_lookup        =        tcp_v6_md5_lookup,
        .calc_md5_hash        =        tcp_v6_md5_hash_skb,
#endif
#ifdef CONFIG_TCP_AO
        .ao_lookup        =        tcp_v6_ao_lookup_rsk,
        .ao_calc_key        =        tcp_v6_ao_calc_key_rsk,
        .ao_synack_hash =        tcp_v6_ao_synack_hash,
#endif
#ifdef CONFIG_SYN_COOKIES
        .cookie_init_seq =        cookie_v6_init_sequence,
#endif
        .route_req        =        tcp_v6_route_req,
        .init_seq        =        tcp_v6_init_seq,
        .init_ts_off        =        tcp_v6_init_ts_off,
        .send_synack        =        tcp_v6_send_synack,
};

static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
                                 u32 ack, u32 win, u32 tsval, u32 tsecr,
                                 int oif, int rst, u8 tclass, __be32 label,
                                 u32 priority, u32 txhash, struct tcp_key *key)
{
        const struct tcphdr *th = tcp_hdr(skb);
        struct tcphdr *t1;
        struct sk_buff *buff;
        struct flowi6 fl6;
        struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
        struct sock *ctl_sk = net->ipv6.tcp_sk;
        unsigned int tot_len = sizeof(struct tcphdr);
        __be32 mrst = 0, *topt;
        struct dst_entry *dst;
        __u32 mark = 0;

        if (tsecr)
                tot_len += TCPOLEN_TSTAMP_ALIGNED;
        if (tcp_key_is_md5(key))
                tot_len += TCPOLEN_MD5SIG_ALIGNED;
        if (tcp_key_is_ao(key))
                tot_len += tcp_ao_len_aligned(key->ao_key);

#ifdef CONFIG_MPTCP
        if (rst && !tcp_key_is_md5(key)) {
                mrst = mptcp_reset_option(skb);

                if (mrst)
                        tot_len += sizeof(__be32);
        }
#endif

        buff = alloc_skb(MAX_TCP_HEADER, GFP_ATOMIC);
        if (!buff)
                return;

        skb_reserve(buff, MAX_TCP_HEADER);

        t1 = skb_push(buff, tot_len);
        skb_reset_transport_header(buff);

        /* Swap the send and the receive. */
        memset(t1, 0, sizeof(*t1));
        t1->dest = th->source;
        t1->source = th->dest;
        t1->doff = tot_len / 4;
        t1->seq = htonl(seq);
        t1->ack_seq = htonl(ack);
        t1->ack = !rst || !th->ack;
        t1->rst = rst;
        t1->window = htons(win);

        topt = (__be32 *)(t1 + 1);

        if (tsecr) {
                *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
                *topt++ = htonl(tsval);
                *topt++ = htonl(tsecr);
        }

        if (mrst)
                *topt++ = mrst;

#ifdef CONFIG_TCP_MD5SIG
        if (tcp_key_is_md5(key)) {
                *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
                tcp_v6_md5_hash_hdr((__u8 *)topt, key->md5_key,
                                    &ipv6_hdr(skb)->saddr,
                                    &ipv6_hdr(skb)->daddr, t1);
        }
#endif
#ifdef CONFIG_TCP_AO
        if (tcp_key_is_ao(key)) {
                *topt++ = htonl((TCPOPT_AO << 24) |
                                (tcp_ao_len(key->ao_key) << 16) |
                                (key->ao_key->sndid << 8) |
                                (key->rcv_next));

                tcp_ao_hash_hdr(AF_INET6, (char *)topt, key->ao_key,
                                key->traffic_key,
                                (union tcp_ao_addr *)&ipv6_hdr(skb)->saddr,
                                (union tcp_ao_addr *)&ipv6_hdr(skb)->daddr,
                                t1, key->sne);
        }
#endif

        memset(&fl6, 0, sizeof(fl6));
        fl6.daddr = ipv6_hdr(skb)->saddr;
        fl6.saddr = ipv6_hdr(skb)->daddr;
        fl6.flowlabel = label;

        buff->ip_summed = CHECKSUM_PARTIAL;

        __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);

        fl6.flowi6_proto = IPPROTO_TCP;
        if (rt6_need_strict(&fl6.daddr) && !oif)
                fl6.flowi6_oif = tcp_v6_iif(skb);
        else {
                if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
                        oif = skb->skb_iif;

                fl6.flowi6_oif = oif;
        }

        if (sk) {
                if (sk->sk_state == TCP_TIME_WAIT)
                        mark = inet_twsk(sk)->tw_mark;
                else
                        mark = READ_ONCE(sk->sk_mark);
                skb_set_delivery_time(buff, tcp_transmit_time(sk), SKB_CLOCK_MONOTONIC);
        }
        if (txhash) {
                /* autoflowlabel/skb_get_hash_flowi6 rely on buff->hash */
                skb_set_hash(buff, txhash, PKT_HASH_TYPE_L4);
        }
        fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark) ?: mark;
        fl6.fl6_dport = t1->dest;
        fl6.fl6_sport = t1->source;
        fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
        security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6));

        /* Pass a socket to ip6_dst_lookup either it is for RST
         * Underlying function will use this to retrieve the network
         * namespace
         */
        if (sk && sk->sk_state != TCP_TIME_WAIT)
                dst = ip6_dst_lookup_flow(net, sk, &fl6, NULL); /*sk's xfrm_policy can be referred*/
        else
                dst = ip6_dst_lookup_flow(net, ctl_sk, &fl6, NULL);
        if (!IS_ERR(dst)) {
                skb_dst_set(buff, dst);
                ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL,
                         tclass & ~INET_ECN_MASK, priority);
                TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
                if (rst)
                        TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
                return;
        }

        kfree_skb(buff);
}

static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
                              enum sk_rst_reason reason)
{
        const struct tcphdr *th = tcp_hdr(skb);
        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
        const __u8 *md5_hash_location = NULL;
#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
        bool allocated_traffic_key = false;
#endif
        const struct tcp_ao_hdr *aoh;
        struct tcp_key key = {};
        u32 seq = 0, ack_seq = 0;
        __be32 label = 0;
        u32 priority = 0;
        struct net *net;
        u32 txhash = 0;
        int oif = 0;
#ifdef CONFIG_TCP_MD5SIG
        unsigned char newhash[16];
        int genhash;
        struct sock *sk1 = NULL;
#endif

        if (th->rst)
                return;

        /* If sk not NULL, it means we did a successful lookup and incoming
         * route had to be correct. prequeue might have dropped our dst.
         */
        if (!sk && !ipv6_unicast_destination(skb))
                return;

        net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
        /* Invalid TCP option size or twice included auth */
        if (tcp_parse_auth_options(th, &md5_hash_location, &aoh))
                return;
#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
        rcu_read_lock();
#endif
#ifdef CONFIG_TCP_MD5SIG
        if (sk && sk_fullsock(sk)) {
                int l3index;

                /* sdif set, means packet ingressed via a device
                 * in an L3 domain and inet_iif is set to it.
                 */
                l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0;
                key.md5_key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr, l3index);
                if (key.md5_key)
                        key.type = TCP_KEY_MD5;
        } else if (md5_hash_location) {
                int dif = tcp_v6_iif_l3_slave(skb);
                int sdif = tcp_v6_sdif(skb);
                int l3index;

                /*
                 * active side is lost. Try to find listening socket through
                 * source port, and then find md5 key through listening socket.
                 * we are not loose security here:
                 * Incoming packet is checked with md5 hash with finding key,
                 * no RST generated if md5 hash doesn't match.
                 */
                sk1 = inet6_lookup_listener(net, net->ipv4.tcp_death_row.hashinfo,
                                            NULL, 0, &ipv6h->saddr, th->source,
                                            &ipv6h->daddr, ntohs(th->source),
                                            dif, sdif);
                if (!sk1)
                        goto out;

                /* sdif set, means packet ingressed via a device
                 * in an L3 domain and dif is set to it.
                 */
                l3index = tcp_v6_sdif(skb) ? dif : 0;

                key.md5_key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr, l3index);
                if (!key.md5_key)
                        goto out;
                key.type = TCP_KEY_MD5;

                genhash = tcp_v6_md5_hash_skb(newhash, key.md5_key, NULL, skb);
                if (genhash || memcmp(md5_hash_location, newhash, 16) != 0)
                        goto out;
        }
#endif

        if (th->ack)
                seq = ntohl(th->ack_seq);
        else
                ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
                          (th->doff << 2);

#ifdef CONFIG_TCP_AO
        if (aoh) {
                int l3index;

                l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0;
                if (tcp_ao_prepare_reset(sk, skb, aoh, l3index, seq,
                                         &key.ao_key, &key.traffic_key,
                                         &allocated_traffic_key,
                                         &key.rcv_next, &key.sne))
                        goto out;
                key.type = TCP_KEY_AO;
        }
#endif

        if (sk) {
                oif = sk->sk_bound_dev_if;
                if (sk_fullsock(sk)) {
                        if (inet6_test_bit(REPFLOW, sk))
                                label = ip6_flowlabel(ipv6h);
                        priority = READ_ONCE(sk->sk_priority);
                        txhash = sk->sk_txhash;
                }
                if (sk->sk_state == TCP_TIME_WAIT) {
                        label = cpu_to_be32(inet_twsk(sk)->tw_flowlabel);
                        priority = inet_twsk(sk)->tw_priority;
                        txhash = inet_twsk(sk)->tw_txhash;
                }
        } else {
                if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET)
                        label = ip6_flowlabel(ipv6h);
        }

        trace_tcp_send_reset(sk, skb, reason);

        tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, 1,
                             ipv6_get_dsfield(ipv6h), label, priority, txhash,
                             &key);

#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
out:
        if (allocated_traffic_key)
                kfree(key.traffic_key);
        rcu_read_unlock();
#endif
}

static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
                            u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
                            struct tcp_key *key, u8 tclass,
                            __be32 label, u32 priority, u32 txhash)
{
        tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, 0,
                             tclass, label, priority, txhash, key);
}

static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
{
        struct inet_timewait_sock *tw = inet_twsk(sk);
        struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
        struct tcp_key key = {};
#ifdef CONFIG_TCP_AO
        struct tcp_ao_info *ao_info;

        if (static_branch_unlikely(&tcp_ao_needed.key)) {

                /* FIXME: the segment to-be-acked is not verified yet */
                ao_info = rcu_dereference(tcptw->ao_info);
                if (ao_info) {
                        const struct tcp_ao_hdr *aoh;

                        /* Invalid TCP option size or twice included auth */
                        if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
                                goto out;
                        if (aoh)
                                key.ao_key = tcp_ao_established_key(ao_info,
                                                aoh->rnext_keyid, -1);
                }
        }
        if (key.ao_key) {
                struct tcp_ao_key *rnext_key;

                key.traffic_key = snd_other_key(key.ao_key);
                /* rcv_next switches to our rcv_next */
                rnext_key = READ_ONCE(ao_info->rnext_key);
                key.rcv_next = rnext_key->rcvid;
                key.sne = READ_ONCE(ao_info->snd_sne);
                key.type = TCP_KEY_AO;
#else
        if (0) {
#endif
#ifdef CONFIG_TCP_MD5SIG
        } else if (static_branch_unlikely(&tcp_md5_needed.key)) {
                key.md5_key = tcp_twsk_md5_key(tcptw);
                if (key.md5_key)
                        key.type = TCP_KEY_MD5;
#endif
        }

        tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt,
                        READ_ONCE(tcptw->tw_rcv_nxt),
                        tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
                        tcp_tw_tsval(tcptw),
                        READ_ONCE(tcptw->tw_ts_recent), tw->tw_bound_dev_if,
                        &key, tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel),
                        tw->tw_priority, tw->tw_txhash);

#ifdef CONFIG_TCP_AO
out:
#endif
        inet_twsk_put(tw);
}

static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
                                  struct request_sock *req)
{
        struct tcp_key key = {};

#ifdef CONFIG_TCP_AO
        if (static_branch_unlikely(&tcp_ao_needed.key) &&
            tcp_rsk_used_ao(req)) {
                const struct in6_addr *addr = &ipv6_hdr(skb)->saddr;
                const struct tcp_ao_hdr *aoh;
                int l3index;

                l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0;
                /* Invalid TCP option size or twice included auth */
                if (tcp_parse_auth_options(tcp_hdr(skb), NULL, &aoh))
                        return;
                if (!aoh)
                        return;
                key.ao_key = tcp_ao_do_lookup(sk, l3index,
                                              (union tcp_ao_addr *)addr,
                                              AF_INET6, aoh->rnext_keyid, -1);
                if (unlikely(!key.ao_key)) {
                        /* Send ACK with any matching MKT for the peer */
                        key.ao_key = tcp_ao_do_lookup(sk, l3index,
                                                      (union tcp_ao_addr *)addr,
                                                      AF_INET6, -1, -1);
                        /* Matching key disappeared (user removed the key?)
                         * let the handshake timeout.
                         */
                        if (!key.ao_key) {
                                net_info_ratelimited("TCP-AO key for (%pI6, %d)->(%pI6, %d) suddenly disappeared, won't ACK new connection\n",
                                                     addr,
                                                     ntohs(tcp_hdr(skb)->source),
                                                     &ipv6_hdr(skb)->daddr,
                                                     ntohs(tcp_hdr(skb)->dest));
                                return;
                        }
                }
                key.traffic_key = kmalloc(tcp_ao_digest_size(key.ao_key), GFP_ATOMIC);
                if (!key.traffic_key)
                        return;

                key.type = TCP_KEY_AO;
                key.rcv_next = aoh->keyid;
                tcp_v6_ao_calc_key_rsk(key.ao_key, key.traffic_key, req);
#else
        if (0) {
#endif
#ifdef CONFIG_TCP_MD5SIG
        } else if (static_branch_unlikely(&tcp_md5_needed.key)) {
                int l3index = tcp_v6_sdif(skb) ? tcp_v6_iif_l3_slave(skb) : 0;

                key.md5_key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr,
                                                   l3index);
                if (key.md5_key)
                        key.type = TCP_KEY_MD5;
#endif
        }

        /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
         * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
         */
        tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
                        tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
                        tcp_rsk(req)->rcv_nxt,
                        tcp_synack_window(req) >> inet_rsk(req)->rcv_wscale,
                        tcp_rsk_tsval(tcp_rsk(req)),
                        READ_ONCE(req->ts_recent), sk->sk_bound_dev_if,
                        &key, ipv6_get_dsfield(ipv6_hdr(skb)), 0,
                        READ_ONCE(sk->sk_priority),
                        READ_ONCE(tcp_rsk(req)->txhash));
        if (tcp_key_is_ao(&key))
                kfree(key.traffic_key);
}


static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
{
#ifdef CONFIG_SYN_COOKIES
        const struct tcphdr *th = tcp_hdr(skb);

        if (!th->syn)
                sk = cookie_v6_check(sk, skb);
#endif
        return sk;
}

u16 tcp_v6_get_syncookie(struct sock *sk, struct ipv6hdr *iph,
                         struct tcphdr *th, u32 *cookie)
{
        u16 mss = 0;
#ifdef CONFIG_SYN_COOKIES
        mss = tcp_get_syncookie_mss(&tcp6_request_sock_ops,
                                    &tcp_request_sock_ipv6_ops, sk, th);
        if (mss) {
                *cookie = __cookie_v6_init_sequence(iph, th, &mss);
                tcp_synq_overflow(sk);
        }
#endif
        return mss;
}

static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
{
        if (skb->protocol == htons(ETH_P_IP))
                return tcp_v4_conn_request(sk, skb);

        if (!ipv6_unicast_destination(skb))
                goto drop;

        if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
                __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
                return 0;
        }

        return tcp_conn_request(&tcp6_request_sock_ops,
                                &tcp_request_sock_ipv6_ops, sk, skb);

drop:
        tcp_listendrop(sk);
        return 0; /* don't send reset */
}

static void tcp_v6_restore_cb(struct sk_buff *skb)
{
        /* We need to move header back to the beginning if xfrm6_policy_check()
         * and tcp_v6_fill_cb() are going to be called again.
         * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
         */
        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
                sizeof(struct inet6_skb_parm));
}

static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
                                         struct request_sock *req,
                                         struct dst_entry *dst,
                                         struct request_sock *req_unhash,
                                         bool *own_req)
{
        struct inet_request_sock *ireq;
        struct ipv6_pinfo *newnp;
        const struct ipv6_pinfo *np = tcp_inet6_sk(sk);
        struct ipv6_txoptions *opt;
        struct inet_sock *newinet;
        bool found_dup_sk = false;
        struct tcp_sock *newtp;
        struct sock *newsk;
#ifdef CONFIG_TCP_MD5SIG
        struct tcp_md5sig_key *key;
        int l3index;
#endif
        struct flowi6 fl6;

        if (skb->protocol == htons(ETH_P_IP)) {
                /*
                 *        v6 mapped
                 */

                newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
                                             req_unhash, own_req);

                if (!newsk)
                        return NULL;

                inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk);

                newnp = tcp_inet6_sk(newsk);
                newtp = tcp_sk(newsk);

                memcpy(newnp, np, sizeof(struct ipv6_pinfo));

                newnp->saddr = newsk->sk_v6_rcv_saddr;

                inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
                if (sk_is_mptcp(newsk))
                        mptcpv6_handle_mapped(newsk, true);
                newsk->sk_backlog_rcv = tcp_v4_do_rcv;
#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
                newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif

                newnp->ipv6_mc_list = NULL;
                newnp->ipv6_ac_list = NULL;
                newnp->ipv6_fl_list = NULL;
                newnp->pktoptions  = NULL;
                newnp->opt           = NULL;
                newnp->mcast_oif   = inet_iif(skb);
                newnp->mcast_hops  = ip_hdr(skb)->ttl;
                newnp->rcv_flowinfo = 0;
                if (inet6_test_bit(REPFLOW, sk))
                        newnp->flow_label = 0;

                /*
                 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
                 * here, tcp_create_openreq_child now does this for us, see the comment in
                 * that function for the gory details. -acme
                 */

                /* It is tricky place. Until this moment IPv4 tcp
                   worked with IPv6 icsk.icsk_af_ops.
                   Sync it now.
                 */
                tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);

                return newsk;
        }

        ireq = inet_rsk(req);

        if (sk_acceptq_is_full(sk))
                goto out_overflow;

        if (!dst) {
                dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
                if (!dst)
                        goto out;
        }

        newsk = tcp_create_openreq_child(sk, req, skb);
        if (!newsk)
                goto out_nonewsk;

        /*
         * No need to charge this sock to the relevant IPv6 refcnt debug socks
         * count here, tcp_create_openreq_child now does this for us, see the
         * comment in that function for the gory details. -acme
         */

        newsk->sk_gso_type = SKB_GSO_TCPV6;
        inet6_sk_rx_dst_set(newsk, skb);

        inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk);

        newtp = tcp_sk(newsk);
        newinet = inet_sk(newsk);
        newnp = tcp_inet6_sk(newsk);

        memcpy(newnp, np, sizeof(struct ipv6_pinfo));

        ip6_dst_store(newsk, dst, NULL, NULL);

        newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
        newnp->saddr = ireq->ir_v6_loc_addr;
        newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
        newsk->sk_bound_dev_if = ireq->ir_iif;

        /* Now IPv6 options...

           First: no IPv4 options.
         */
        newinet->inet_opt = NULL;
        newnp->ipv6_mc_list = NULL;
        newnp->ipv6_ac_list = NULL;
        newnp->ipv6_fl_list = NULL;

        /* Clone RX bits */
        newnp->rxopt.all = np->rxopt.all;

        newnp->pktoptions = NULL;
        newnp->opt          = NULL;
        newnp->mcast_oif  = tcp_v6_iif(skb);
        newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
        newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
        if (inet6_test_bit(REPFLOW, sk))
                newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));

        /* Set ToS of the new socket based upon the value of incoming SYN.
         * ECT bits are set later in tcp_init_transfer().
         */
        if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos))
                newnp->tclass = tcp_rsk(req)->syn_tos & ~INET_ECN_MASK;

        /* Clone native IPv6 options from listening socket (if any)

           Yes, keeping reference count would be much more clever,
           but we make one more one thing there: reattach optmem
           to newsk.
         */
        opt = ireq->ipv6_opt;
        if (!opt)
                opt = rcu_dereference(np->opt);
        if (opt) {
                opt = ipv6_dup_options(newsk, opt);
                RCU_INIT_POINTER(newnp->opt, opt);
        }
        inet_csk(newsk)->icsk_ext_hdr_len = 0;
        if (opt)
                inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
                                                    opt->opt_flen;

        tcp_ca_openreq_child(newsk, dst);

        tcp_sync_mss(newsk, dst_mtu(dst));
        newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));

        tcp_initialize_rcv_mss(newsk);

        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;

#ifdef CONFIG_TCP_MD5SIG
        l3index = l3mdev_master_ifindex_by_index(sock_net(sk), ireq->ir_iif);

        if (!tcp_rsk_used_ao(req)) {
                /* Copy over the MD5 key from the original socket */
                key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr, l3index);
                if (key) {
                        const union tcp_md5_addr *addr;

                        addr = (union tcp_md5_addr *)&newsk->sk_v6_daddr;
                        if (tcp_md5_key_copy(newsk, addr, AF_INET6, 128, l3index, key)) {
                                inet_csk_prepare_forced_close(newsk);
                                tcp_done(newsk);
                                goto out;
                        }
                }
        }
#endif
#ifdef CONFIG_TCP_AO
        /* Copy over tcp_ao_info if any */
        if (tcp_ao_copy_all_matching(sk, newsk, req, skb, AF_INET6))
                goto out; /* OOM */
#endif

        if (__inet_inherit_port(sk, newsk) < 0) {
                inet_csk_prepare_forced_close(newsk);
                tcp_done(newsk);
                goto out;
        }
        *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash),
                                       &found_dup_sk);
        if (*own_req) {
                tcp_move_syn(newtp, req);

                /* Clone pktoptions received with SYN, if we own the req */
                if (ireq->pktopts) {
                        newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
                        consume_skb(ireq->pktopts);
                        ireq->pktopts = NULL;
                        if (newnp->pktoptions)
                                tcp_v6_restore_cb(newnp->pktoptions);
                }
        } else {
                if (!req_unhash && found_dup_sk) {
                        /* This code path should only be executed in the
                         * syncookie case only
                         */
                        bh_unlock_sock(newsk);
                        sock_put(newsk);
                        newsk = NULL;
                }
        }

        return newsk;

out_overflow:
        __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
out_nonewsk:
        dst_release(dst);
out:
        tcp_listendrop(sk);
        return NULL;
}

INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
                                                           u32));
/* The socket must have it's spinlock held when we get
 * here, unless it is a TCP_LISTEN socket.
 *
 * We have a potential double-lock case here, so even when
 * doing backlog processing we use the BH locking scheme.
 * This is because we cannot sleep with the original spinlock
 * held.
 */
INDIRECT_CALLABLE_SCOPE
int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
{
        struct ipv6_pinfo *np = tcp_inet6_sk(sk);
        struct sk_buff *opt_skb = NULL;
        enum skb_drop_reason reason;
        struct tcp_sock *tp;

        /* Imagine: socket is IPv6. IPv4 packet arrives,
           goes to IPv4 receive handler and backlogged.
           From backlog it always goes here. Kerboom...
           Fortunately, tcp_rcv_established and rcv_established
           handle them correctly, but it is not case with
           tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
         */

        if (skb->protocol == htons(ETH_P_IP))
                return tcp_v4_do_rcv(sk, skb);

        /*
         *        socket locking is here for SMP purposes as backlog rcv
         *        is currently called with bh processing disabled.
         */

        /* Do Stevens' IPV6_PKTOPTIONS.

           Yes, guys, it is the only place in our code, where we
           may make it not affecting IPv4.
           The rest of code is protocol independent,
           and I do not like idea to uglify IPv4.

           Actually, all the idea behind IPV6_PKTOPTIONS
           looks not very well thought. For now we latch
           options, received in the last packet, enqueued
           by tcp. Feel free to propose better solution.
                                               --ANK (980728)
         */
        if (np->rxopt.all)
                opt_skb = skb_clone_and_charge_r(skb, sk);

        if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
                struct dst_entry *dst;

                dst = rcu_dereference_protected(sk->sk_rx_dst,
                                                lockdep_sock_is_held(sk));

                sock_rps_save_rxhash(sk, skb);
                sk_mark_napi_id(sk, skb);
                if (dst) {
                        if (sk->sk_rx_dst_ifindex != skb->skb_iif ||
                            INDIRECT_CALL_1(dst->ops->check, ip6_dst_check,
                                            dst, sk->sk_rx_dst_cookie) == NULL) {
                                RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
                                dst_release(dst);
                        }
                }

                tcp_rcv_established(sk, skb);
                if (opt_skb)
                        goto ipv6_pktoptions;
                return 0;
        }

        if (tcp_checksum_complete(skb))
                goto csum_err;

        if (sk->sk_state == TCP_LISTEN) {
                struct sock *nsk = tcp_v6_cookie_check(sk, skb);

                if (nsk != sk) {
                        if (nsk) {
                                reason = tcp_child_process(sk, nsk, skb);
                                if (reason)
                                        goto reset;
                        }
                        if (opt_skb)
                                __kfree_skb(opt_skb);
                        return 0;
                }
        } else
                sock_rps_save_rxhash(sk, skb);

        reason = tcp_rcv_state_process(sk, skb);
        if (reason)
                goto reset;
        if (opt_skb)
                goto ipv6_pktoptions;
        return 0;

reset:
        tcp_v6_send_reset(sk, skb, sk_rst_convert_drop_reason(reason));
discard:
        if (opt_skb)
                __kfree_skb(opt_skb);
        sk_skb_reason_drop(sk, skb, reason);
        return 0;
csum_err:
        reason = SKB_DROP_REASON_TCP_CSUM;
        trace_tcp_bad_csum(skb);
        TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
        TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
        goto discard;


ipv6_pktoptions:
        /* Do you ask, what is it?

           1. skb was enqueued by tcp.
           2. skb is added to tail of read queue, rather than out of order.
           3. socket is not in passive state.
           4. Finally, it really contains options, which user wants to receive.
         */
        tp = tcp_sk(sk);
        if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
            !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
                if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
                        WRITE_ONCE(np->mcast_oif, tcp_v6_iif(opt_skb));
                if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                        WRITE_ONCE(np->mcast_hops,
                                   ipv6_hdr(opt_skb)->hop_limit);
                if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
                        np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
                if (inet6_test_bit(REPFLOW, sk))
                        np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
                if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
                        tcp_v6_restore_cb(opt_skb);
                        opt_skb = xchg(&np->pktoptions, opt_skb);
                } else {
                        __kfree_skb(opt_skb);
                        opt_skb = xchg(&np->pktoptions, NULL);
                }
        }

        consume_skb(opt_skb);
        return 0;
}

static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
                           const struct tcphdr *th)
{
        /* This is tricky: we move IP6CB at its correct location into
         * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
         * _decode_session6() uses IP6CB().
         * barrier() makes sure compiler won't play aliasing games.
         */
        memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
                sizeof(struct inet6_skb_parm));
        barrier();

        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
                                    skb->len - th->doff*4);
        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
        TCP_SKB_CB(skb)->sacked = 0;
        TCP_SKB_CB(skb)->has_rxtstamp =
                        skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
}

INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb)
{
        enum skb_drop_reason drop_reason;
        int sdif = inet6_sdif(skb);
        int dif = inet6_iif(skb);
        const struct tcphdr *th;
        const struct ipv6hdr *hdr;
        struct sock *sk = NULL;
        bool refcounted;
        int ret;
        u32 isn;
        struct net *net = dev_net(skb->dev);

        drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
        if (skb->pkt_type != PACKET_HOST)
                goto discard_it;

        /*
         *        Count it even if it's bad.
         */
        __TCP_INC_STATS(net, TCP_MIB_INSEGS);

        if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
                goto discard_it;

        th = (const struct tcphdr *)skb->data;

        if (unlikely(th->doff < sizeof(struct tcphdr) / 4)) {
                drop_reason = SKB_DROP_REASON_PKT_TOO_SMALL;
                goto bad_packet;
        }
        if (!pskb_may_pull(skb, th->doff*4))
                goto discard_it;

        if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
                goto csum_error;

        th = (const struct tcphdr *)skb->data;
        hdr = ipv6_hdr(skb);

lookup:
        sk = __inet6_lookup_skb(net->ipv4.tcp_death_row.hashinfo, skb, __tcp_hdrlen(th),
                                th->source, th->dest, inet6_iif(skb), sdif,
                                &refcounted);
        if (!sk)
                goto no_tcp_socket;

        if (sk->sk_state == TCP_TIME_WAIT)
                goto do_time_wait;

        if (sk->sk_state == TCP_NEW_SYN_RECV) {
                struct request_sock *req = inet_reqsk(sk);
                bool req_stolen = false;
                struct sock *nsk;

                sk = req->rsk_listener;
                if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                        drop_reason = SKB_DROP_REASON_XFRM_POLICY;
                else
                        drop_reason = tcp_inbound_hash(sk, req, skb,
                                                       &hdr->saddr, &hdr->daddr,
                                                       AF_INET6, dif, sdif);
                if (drop_reason) {
                        sk_drops_add(sk, skb);
                        reqsk_put(req);
                        goto discard_it;
                }
                if (tcp_checksum_complete(skb)) {
                        reqsk_put(req);
                        goto csum_error;
                }
                if (unlikely(sk->sk_state != TCP_LISTEN)) {
                        nsk = reuseport_migrate_sock(sk, req_to_sk(req), skb);
                        if (!nsk) {
                                inet_csk_reqsk_queue_drop_and_put(sk, req);
                                goto lookup;
                        }
                        sk = nsk;
                        /* reuseport_migrate_sock() has already held one sk_refcnt
                         * before returning.
                         */
                } else {
                        sock_hold(sk);
                }
                refcounted = true;
                nsk = NULL;
                if (!tcp_filter(sk, skb)) {
                        th = (const struct tcphdr *)skb->data;
                        hdr = ipv6_hdr(skb);
                        tcp_v6_fill_cb(skb, hdr, th);
                        nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
                } else {
                        drop_reason = SKB_DROP_REASON_SOCKET_FILTER;
                }
                if (!nsk) {
                        reqsk_put(req);
                        if (req_stolen) {
                                /* Another cpu got exclusive access to req
                                 * and created a full blown socket.
                                 * Try to feed this packet to this socket
                                 * instead of discarding it.
                                 */
                                tcp_v6_restore_cb(skb);
                                sock_put(sk);
                                goto lookup;
                        }
                        goto discard_and_relse;
                }
                nf_reset_ct(skb);
                if (nsk == sk) {
                        reqsk_put(req);
                        tcp_v6_restore_cb(skb);
                } else {
                        drop_reason = tcp_child_process(sk, nsk, skb);
                        if (drop_reason) {
                                enum sk_rst_reason rst_reason;

                                rst_reason = sk_rst_convert_drop_reason(drop_reason);
                                tcp_v6_send_reset(nsk, skb, rst_reason);
                                goto discard_and_relse;
                        }
                        sock_put(sk);
                        return 0;
                }
        }

process:
        if (static_branch_unlikely(&ip6_min_hopcount)) {
                /* min_hopcount can be changed concurrently from do_ipv6_setsockopt() */
                if (unlikely(hdr->hop_limit < READ_ONCE(tcp_inet6_sk(sk)->min_hopcount))) {
                        __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
                        drop_reason = SKB_DROP_REASON_TCP_MINTTL;
                        goto discard_and_relse;
                }
        }

        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
                drop_reason = SKB_DROP_REASON_XFRM_POLICY;
                goto discard_and_relse;
        }

        drop_reason = tcp_inbound_hash(sk, NULL, skb, &hdr->saddr, &hdr->daddr,
                                       AF_INET6, dif, sdif);
        if (drop_reason)
                goto discard_and_relse;

        nf_reset_ct(skb);

        if (tcp_filter(sk, skb)) {
                drop_reason = SKB_DROP_REASON_SOCKET_FILTER;
                goto discard_and_relse;
        }
        th = (const struct tcphdr *)skb->data;
        hdr = ipv6_hdr(skb);
        tcp_v6_fill_cb(skb, hdr, th);

        skb->dev = NULL;

        if (sk->sk_state == TCP_LISTEN) {
                ret = tcp_v6_do_rcv(sk, skb);
                goto put_and_return;
        }

        sk_incoming_cpu_update(sk);

        bh_lock_sock_nested(sk);
        tcp_segs_in(tcp_sk(sk), skb);
        ret = 0;
        if (!sock_owned_by_user(sk)) {
                ret = tcp_v6_do_rcv(sk, skb);
        } else {
                if (tcp_add_backlog(sk, skb, &drop_reason))
                        goto discard_and_relse;
        }
        bh_unlock_sock(sk);
put_and_return:
        if (refcounted)
                sock_put(sk);
        return ret ? -1 : 0;

no_tcp_socket:
        drop_reason = SKB_DROP_REASON_NO_SOCKET;
        if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                goto discard_it;

        tcp_v6_fill_cb(skb, hdr, th);

        if (tcp_checksum_complete(skb)) {
csum_error:
                drop_reason = SKB_DROP_REASON_TCP_CSUM;
                trace_tcp_bad_csum(skb);
                __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
bad_packet:
                __TCP_INC_STATS(net, TCP_MIB_INERRS);
        } else {
                tcp_v6_send_reset(NULL, skb, sk_rst_convert_drop_reason(drop_reason));
        }

discard_it:
        SKB_DR_OR(drop_reason, NOT_SPECIFIED);
        sk_skb_reason_drop(sk, skb, drop_reason);
        return 0;

discard_and_relse:
        sk_drops_add(sk, skb);
        if (refcounted)
                sock_put(sk);
        goto discard_it;

do_time_wait:
        if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                drop_reason = SKB_DROP_REASON_XFRM_POLICY;
                inet_twsk_put(inet_twsk(sk));
                goto discard_it;
        }

        tcp_v6_fill_cb(skb, hdr, th);

        if (tcp_checksum_complete(skb)) {
                inet_twsk_put(inet_twsk(sk));
                goto csum_error;
        }

        switch (tcp_timewait_state_process(inet_twsk(sk), skb, th, &isn)) {
        case TCP_TW_SYN:
        {
                struct sock *sk2;

                sk2 = inet6_lookup_listener(net, net->ipv4.tcp_death_row.hashinfo,
                                            skb, __tcp_hdrlen(th),
                                            &ipv6_hdr(skb)->saddr, th->source,
                                            &ipv6_hdr(skb)->daddr,
                                            ntohs(th->dest),
                                            tcp_v6_iif_l3_slave(skb),
                                            sdif);
                if (sk2) {
                        struct inet_timewait_sock *tw = inet_twsk(sk);
                        inet_twsk_deschedule_put(tw);
                        sk = sk2;
                        tcp_v6_restore_cb(skb);
                        refcounted = false;
                        __this_cpu_write(tcp_tw_isn, isn);
                        goto process;
                }
        }
                /* to ACK */
                fallthrough;
        case TCP_TW_ACK:
                tcp_v6_timewait_ack(sk, skb);
                break;
        case TCP_TW_RST:
                tcp_v6_send_reset(sk, skb, SK_RST_REASON_TCP_TIMEWAIT_SOCKET);
                inet_twsk_deschedule_put(inet_twsk(sk));
                goto discard_it;
        case TCP_TW_SUCCESS:
                ;
        }
        goto discard_it;
}

void tcp_v6_early_demux(struct sk_buff *skb)
{
        struct net *net = dev_net(skb->dev);
        const struct ipv6hdr *hdr;
        const struct tcphdr *th;
        struct sock *sk;

        if (skb->pkt_type != PACKET_HOST)
                return;

        if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
                return;

        hdr = ipv6_hdr(skb);
        th = tcp_hdr(skb);

        if (th->doff < sizeof(struct tcphdr) / 4)
                return;

        /* Note : We use inet6_iif() here, not tcp_v6_iif() */
        sk = __inet6_lookup_established(net, net->ipv4.tcp_death_row.hashinfo,
                                        &hdr->saddr, th->source,
                                        &hdr->daddr, ntohs(th->dest),
                                        inet6_iif(skb), inet6_sdif(skb));
        if (sk) {
                skb->sk = sk;
                skb->destructor = sock_edemux;
                if (sk_fullsock(sk)) {
                        struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);

                        if (dst)
                                dst = dst_check(dst, sk->sk_rx_dst_cookie);
                        if (dst &&
                            sk->sk_rx_dst_ifindex == skb->skb_iif)
                                skb_dst_set_noref(skb, dst);
                }
        }
}

static struct timewait_sock_ops tcp6_timewait_sock_ops = {
        .twsk_obj_size        = sizeof(struct tcp6_timewait_sock),
        .twsk_destructor = tcp_twsk_destructor,
};

INDIRECT_CALLABLE_SCOPE void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
{
        __tcp_v6_send_check(skb, &sk->sk_v6_rcv_saddr, &sk->sk_v6_daddr);
}

const struct inet_connection_sock_af_ops ipv6_specific = {
        .queue_xmit           = inet6_csk_xmit,
        .send_check           = tcp_v6_send_check,
        .rebuild_header           = inet6_sk_rebuild_header,
        .sk_rx_dst_set           = inet6_sk_rx_dst_set,
        .conn_request           = tcp_v6_conn_request,
        .syn_recv_sock           = tcp_v6_syn_recv_sock,
        .net_header_len           = sizeof(struct ipv6hdr),
        .setsockopt           = ipv6_setsockopt,
        .getsockopt           = ipv6_getsockopt,
        .addr2sockaddr           = inet6_csk_addr2sockaddr,
        .sockaddr_len           = sizeof(struct sockaddr_in6),
        .mtu_reduced           = tcp_v6_mtu_reduced,
};

#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
#ifdef CONFIG_TCP_MD5SIG
        .md5_lookup        =        tcp_v6_md5_lookup,
        .calc_md5_hash        =        tcp_v6_md5_hash_skb,
        .md5_parse        =        tcp_v6_parse_md5_keys,
#endif
#ifdef CONFIG_TCP_AO
        .ao_lookup        =        tcp_v6_ao_lookup,
        .calc_ao_hash        =        tcp_v6_ao_hash_skb,
        .ao_parse        =        tcp_v6_parse_ao,
        .ao_calc_key_sk        =        tcp_v6_ao_calc_key_sk,
#endif
};
#endif

/*
 *        TCP over IPv4 via INET6 API
 */
static const struct inet_connection_sock_af_ops ipv6_mapped = {
        .queue_xmit           = ip_queue_xmit,
        .send_check           = tcp_v4_send_check,
        .rebuild_header           = inet_sk_rebuild_header,
        .sk_rx_dst_set           = inet_sk_rx_dst_set,
        .conn_request           = tcp_v6_conn_request,
        .syn_recv_sock           = tcp_v6_syn_recv_sock,
        .net_header_len           = sizeof(struct iphdr),
        .setsockopt           = ipv6_setsockopt,
        .getsockopt           = ipv6_getsockopt,
        .addr2sockaddr           = inet6_csk_addr2sockaddr,
        .sockaddr_len           = sizeof(struct sockaddr_in6),
        .mtu_reduced           = tcp_v4_mtu_reduced,
};

#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
#ifdef CONFIG_TCP_MD5SIG
        .md5_lookup        =        tcp_v4_md5_lookup,
        .calc_md5_hash        =        tcp_v4_md5_hash_skb,
        .md5_parse        =        tcp_v6_parse_md5_keys,
#endif
#ifdef CONFIG_TCP_AO
        .ao_lookup        =        tcp_v6_ao_lookup,
        .calc_ao_hash        =        tcp_v4_ao_hash_skb,
        .ao_parse        =        tcp_v6_parse_ao,
        .ao_calc_key_sk        =        tcp_v4_ao_calc_key_sk,
#endif
};
#endif

/* NOTE: A lot of things set to zero explicitly by call to
 *       sk_alloc() so need not be done here.
 */
static int tcp_v6_init_sock(struct sock *sk)
{
        struct inet_connection_sock *icsk = inet_csk(sk);

        tcp_init_sock(sk);

        icsk->icsk_af_ops = &ipv6_specific;

#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
        tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
#endif

        return 0;
}

#ifdef CONFIG_PROC_FS
/* Proc filesystem TCPv6 sock list dumping. */
static void get_openreq6(struct seq_file *seq,
                         const struct request_sock *req, int i)
{
        long ttd = req->rsk_timer.expires - jiffies;
        const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
        const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;

        if (ttd < 0)
                ttd = 0;

        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3],
                   inet_rsk(req)->ir_num,
                   dest->s6_addr32[0], dest->s6_addr32[1],
                   dest->s6_addr32[2], dest->s6_addr32[3],
                   ntohs(inet_rsk(req)->ir_rmt_port),
                   TCP_SYN_RECV,
                   0, 0, /* could print option size, but that is af dependent. */
                   1,   /* timers active (only the expire timer) */
                   jiffies_to_clock_t(ttd),
                   req->num_timeout,
                   from_kuid_munged(seq_user_ns(seq),
                                    sock_i_uid(req->rsk_listener)),
                   0,  /* non standard timer */
                   0, /* open_requests have no inode */
                   0, req);
}

static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
{
        const struct in6_addr *dest, *src;
        __u16 destp, srcp;
        int timer_active;
        unsigned long timer_expires;
        const struct inet_sock *inet = inet_sk(sp);
        const struct tcp_sock *tp = tcp_sk(sp);
        const struct inet_connection_sock *icsk = inet_csk(sp);
        const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
        int rx_queue;
        int state;

        dest  = &sp->sk_v6_daddr;
        src   = &sp->sk_v6_rcv_saddr;
        destp = ntohs(inet->inet_dport);
        srcp  = ntohs(inet->inet_sport);

        if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
            icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
            icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
                timer_active        = 1;
                timer_expires        = icsk->icsk_timeout;
        } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
                timer_active        = 4;
                timer_expires        = icsk->icsk_timeout;
        } else if (timer_pending(&sp->sk_timer)) {
                timer_active        = 2;
                timer_expires        = sp->sk_timer.expires;
        } else {
                timer_active        = 0;
                timer_expires = jiffies;
        }

        state = inet_sk_state_load(sp);
        if (state == TCP_LISTEN)
                rx_queue = READ_ONCE(sp->sk_ack_backlog);
        else
                /* Because we don't lock the socket,
                 * we might find a transient negative value.
                 */
                rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
                                      READ_ONCE(tp->copied_seq), 0);

        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
                   dest->s6_addr32[0], dest->s6_addr32[1],
                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
                   state,
                   READ_ONCE(tp->write_seq) - tp->snd_una,
                   rx_queue,
                   timer_active,
                   jiffies_delta_to_clock_t(timer_expires - jiffies),
                   icsk->icsk_retransmits,
                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
                   icsk->icsk_probes_out,
                   sock_i_ino(sp),
                   refcount_read(&sp->sk_refcnt), sp,
                   jiffies_to_clock_t(icsk->icsk_rto),
                   jiffies_to_clock_t(icsk->icsk_ack.ato),
                   (icsk->icsk_ack.quick << 1) | inet_csk_in_pingpong_mode(sp),
                   tcp_snd_cwnd(tp),
                   state == TCP_LISTEN ?
                        fastopenq->max_qlen :
                        (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
                   );
}

static void get_timewait6_sock(struct seq_file *seq,
                               struct inet_timewait_sock *tw, int i)
{
        long delta = tw->tw_timer.expires - jiffies;
        const struct in6_addr *dest, *src;
        __u16 destp, srcp;

        dest = &tw->tw_v6_daddr;
        src  = &tw->tw_v6_rcv_saddr;
        destp = ntohs(tw->tw_dport);
        srcp  = ntohs(tw->tw_sport);

        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
                   dest->s6_addr32[0], dest->s6_addr32[1],
                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
                   READ_ONCE(tw->tw_substate), 0, 0,
                   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
                   refcount_read(&tw->tw_refcnt), tw);
}

static int tcp6_seq_show(struct seq_file *seq, void *v)
{
        struct tcp_iter_state *st;
        struct sock *sk = v;

        if (v == SEQ_START_TOKEN) {
                seq_puts(seq,
                         "  sl  "
                         "local_address                         "
                         "remote_address                        "
                         "st tx_queue rx_queue tr tm->when retrnsmt"
                         "   uid  timeout inode\n");
                goto out;
        }
        st = seq->private;

        if (sk->sk_state == TCP_TIME_WAIT)
                get_timewait6_sock(seq, v, st->num);
        else if (sk->sk_state == TCP_NEW_SYN_RECV)
                get_openreq6(seq, v, st->num);
        else
                get_tcp6_sock(seq, v, st->num);
out:
        return 0;
}

static const struct seq_operations tcp6_seq_ops = {
        .show                = tcp6_seq_show,
        .start                = tcp_seq_start,
        .next                = tcp_seq_next,
        .stop                = tcp_seq_stop,
};

static struct tcp_seq_afinfo tcp6_seq_afinfo = {
        .family                = AF_INET6,
};

int __net_init tcp6_proc_init(struct net *net)
{
        if (!proc_create_net_data("tcp6", 0444, net->proc_net, &tcp6_seq_ops,
                        sizeof(struct tcp_iter_state), &tcp6_seq_afinfo))
                return -ENOMEM;
        return 0;
}

void tcp6_proc_exit(struct net *net)
{
        remove_proc_entry("tcp6", net->proc_net);
}
#endif

struct proto tcpv6_prot = {
        .name                        = "TCPv6",
        .owner                        = THIS_MODULE,
        .close                        = tcp_close,
        .pre_connect                = tcp_v6_pre_connect,
        .connect                = tcp_v6_connect,
        .disconnect                = tcp_disconnect,
        .accept                        = inet_csk_accept,
        .ioctl                        = tcp_ioctl,
        .init                        = tcp_v6_init_sock,
        .destroy                = tcp_v4_destroy_sock,
        .shutdown                = tcp_shutdown,
        .setsockopt                = tcp_setsockopt,
        .getsockopt                = tcp_getsockopt,
        .bpf_bypass_getsockopt        = tcp_bpf_bypass_getsockopt,
        .keepalive                = tcp_set_keepalive,
        .recvmsg                = tcp_recvmsg,
        .sendmsg                = tcp_sendmsg,
        .splice_eof                = tcp_splice_eof,
        .backlog_rcv                = tcp_v6_do_rcv,
        .release_cb                = tcp_release_cb,
        .hash                        = inet6_hash,
        .unhash                        = inet_unhash,
        .get_port                = inet_csk_get_port,
        .put_port                = inet_put_port,
#ifdef CONFIG_BPF_SYSCALL
        .psock_update_sk_prot        = tcp_bpf_update_proto,
#endif
        .enter_memory_pressure        = tcp_enter_memory_pressure,
        .leave_memory_pressure        = tcp_leave_memory_pressure,
        .stream_memory_free        = tcp_stream_memory_free,
        .sockets_allocated        = &tcp_sockets_allocated,

        .memory_allocated        = &tcp_memory_allocated,
        .per_cpu_fw_alloc        = &tcp_memory_per_cpu_fw_alloc,

        .memory_pressure        = &tcp_memory_pressure,
        .orphan_count                = &tcp_orphan_count,
        .sysctl_mem                = sysctl_tcp_mem,
        .sysctl_wmem_offset        = offsetof(struct net, ipv4.sysctl_tcp_wmem),
        .sysctl_rmem_offset        = offsetof(struct net, ipv4.sysctl_tcp_rmem),
        .max_header                = MAX_TCP_HEADER,
        .obj_size                = sizeof(struct tcp6_sock),
        .ipv6_pinfo_offset = offsetof(struct tcp6_sock, inet6),
        .slab_flags                = SLAB_TYPESAFE_BY_RCU,
        .twsk_prot                = &tcp6_timewait_sock_ops,
        .rsk_prot                = &tcp6_request_sock_ops,
        .h.hashinfo                = NULL,
        .no_autobind                = true,
        .diag_destroy                = tcp_abort,
};
EXPORT_SYMBOL_GPL(tcpv6_prot);


static struct inet_protosw tcpv6_protosw = {
        .type                =        SOCK_STREAM,
        .protocol        =        IPPROTO_TCP,
        .prot                =        &tcpv6_prot,
        .ops                =        &inet6_stream_ops,
        .flags                =        INET_PROTOSW_PERMANENT |
                                INET_PROTOSW_ICSK,
};

static int __net_init tcpv6_net_init(struct net *net)
{
        int res;

        res = inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
                                   SOCK_RAW, IPPROTO_TCP, net);
        if (!res)
                net->ipv6.tcp_sk->sk_clockid = CLOCK_MONOTONIC;

        return res;
}

static void __net_exit tcpv6_net_exit(struct net *net)
{
        inet_ctl_sock_destroy(net->ipv6.tcp_sk);
}

static struct pernet_operations tcpv6_net_ops = {
        .init            = tcpv6_net_init,
        .exit            = tcpv6_net_exit,
};

int __init tcpv6_init(void)
{
        int ret;

        net_hotdata.tcpv6_protocol = (struct inet6_protocol) {
                .handler     = tcp_v6_rcv,
                .err_handler = tcp_v6_err,
                .flags             = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
        };
        ret = inet6_add_protocol(&net_hotdata.tcpv6_protocol, IPPROTO_TCP);
        if (ret)
                goto out;

        /* register inet6 protocol */
        ret = inet6_register_protosw(&tcpv6_protosw);
        if (ret)
                goto out_tcpv6_protocol;

        ret = register_pernet_subsys(&tcpv6_net_ops);
        if (ret)
                goto out_tcpv6_protosw;

        ret = mptcpv6_init();
        if (ret)
                goto out_tcpv6_pernet_subsys;

out:
        return ret;

out_tcpv6_pernet_subsys:
        unregister_pernet_subsys(&tcpv6_net_ops);
out_tcpv6_protosw:
        inet6_unregister_protosw(&tcpv6_protosw);
out_tcpv6_protocol:
        inet6_del_protocol(&net_hotdata.tcpv6_protocol, IPPROTO_TCP);
        goto out;
}

void tcpv6_exit(void)
{
        unregister_pernet_subsys(&tcpv6_net_ops);
        inet6_unregister_protosw(&tcpv6_protosw);
        inet6_del_protocol(&net_hotdata.tcpv6_protocol, IPPROTO_TCP);
}































    1 








































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
#include <linux/rtnetlink.h>
#include <linux/notifier.h>
#include <linux/rcupdate.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <net/net_namespace.h>
#include <net/netns/generic.h>
#include <net/fib_notifier.h>

static unsigned int fib_notifier_net_id;

struct fib_notifier_net {
        struct list_head fib_notifier_ops;
        struct atomic_notifier_head fib_chain;
};

int call_fib_notifier(struct notifier_block *nb,
                      enum fib_event_type event_type,
                      struct fib_notifier_info *info)
{
        int err;

        err = nb->notifier_call(nb, event_type, info);
        return notifier_to_errno(err);
}
EXPORT_SYMBOL(call_fib_notifier);

int call_fib_notifiers(struct net *net, enum fib_event_type event_type,
                       struct fib_notifier_info *info)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);
        int err;

        err = atomic_notifier_call_chain(&fn_net->fib_chain, event_type, info);
        return notifier_to_errno(err);
}
EXPORT_SYMBOL(call_fib_notifiers);

static unsigned int fib_seq_sum(struct net *net)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);
        struct fib_notifier_ops *ops;
        unsigned int fib_seq = 0;

        rtnl_lock();
        rcu_read_lock();
        list_for_each_entry_rcu(ops, &fn_net->fib_notifier_ops, list) {
                if (!try_module_get(ops->owner))
                        continue;
                fib_seq += ops->fib_seq_read(net);
                module_put(ops->owner);
        }
        rcu_read_unlock();
        rtnl_unlock();

        return fib_seq;
}

static int fib_net_dump(struct net *net, struct notifier_block *nb,
                        struct netlink_ext_ack *extack)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);
        struct fib_notifier_ops *ops;
        int err = 0;

        rcu_read_lock();
        list_for_each_entry_rcu(ops, &fn_net->fib_notifier_ops, list) {
                if (!try_module_get(ops->owner))
                        continue;
                err = ops->fib_dump(net, nb, extack);
                module_put(ops->owner);
                if (err)
                        goto unlock;
        }

unlock:
        rcu_read_unlock();

        return err;
}

static bool fib_dump_is_consistent(struct net *net, struct notifier_block *nb,
                                   void (*cb)(struct notifier_block *nb),
                                   unsigned int fib_seq)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);

        atomic_notifier_chain_register(&fn_net->fib_chain, nb);
        if (fib_seq == fib_seq_sum(net))
                return true;
        atomic_notifier_chain_unregister(&fn_net->fib_chain, nb);
        if (cb)
                cb(nb);
        return false;
}

#define FIB_DUMP_MAX_RETRIES 5
int register_fib_notifier(struct net *net, struct notifier_block *nb,
                          void (*cb)(struct notifier_block *nb),
                          struct netlink_ext_ack *extack)
{
        int retries = 0;
        int err;

        do {
                unsigned int fib_seq = fib_seq_sum(net);

                err = fib_net_dump(net, nb, extack);
                if (err)
                        return err;

                if (fib_dump_is_consistent(net, nb, cb, fib_seq))
                        return 0;
        } while (++retries < FIB_DUMP_MAX_RETRIES);

        return -EBUSY;
}
EXPORT_SYMBOL(register_fib_notifier);

int unregister_fib_notifier(struct net *net, struct notifier_block *nb)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);

        return atomic_notifier_chain_unregister(&fn_net->fib_chain, nb);
}
EXPORT_SYMBOL(unregister_fib_notifier);

static int __fib_notifier_ops_register(struct fib_notifier_ops *ops,
                                       struct net *net)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);
        struct fib_notifier_ops *o;

        list_for_each_entry(o, &fn_net->fib_notifier_ops, list)
                if (ops->family == o->family)
                        return -EEXIST;
        list_add_tail_rcu(&ops->list, &fn_net->fib_notifier_ops);
        return 0;
}

struct fib_notifier_ops *
fib_notifier_ops_register(const struct fib_notifier_ops *tmpl, struct net *net)
{
        struct fib_notifier_ops *ops;
        int err;

        ops = kmemdup(tmpl, sizeof(*ops), GFP_KERNEL);
        if (!ops)
                return ERR_PTR(-ENOMEM);

        err = __fib_notifier_ops_register(ops, net);
        if (err)
                goto err_register;

        return ops;

err_register:
        kfree(ops);
        return ERR_PTR(err);
}
EXPORT_SYMBOL(fib_notifier_ops_register);

void fib_notifier_ops_unregister(struct fib_notifier_ops *ops)
{
        list_del_rcu(&ops->list);
        kfree_rcu(ops, rcu);
}
EXPORT_SYMBOL(fib_notifier_ops_unregister);

static int __net_init fib_notifier_net_init(struct net *net)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);

        INIT_LIST_HEAD(&fn_net->fib_notifier_ops);
        ATOMIC_INIT_NOTIFIER_HEAD(&fn_net->fib_chain);
        return 0;
}

static void __net_exit fib_notifier_net_exit(struct net *net)
{
        struct fib_notifier_net *fn_net = net_generic(net, fib_notifier_net_id);

        WARN_ON_ONCE(!list_empty(&fn_net->fib_notifier_ops));
}

static struct pernet_operations fib_notifier_net_ops = {
        .init = fib_notifier_net_init,
        .exit = fib_notifier_net_exit,
        .id = &fib_notifier_net_id,
        .size = sizeof(struct fib_notifier_net),
};

static int __init fib_notifier_init(void)
{
        return register_pernet_subsys(&fib_notifier_net_ops);
}

subsys_initcall(fib_notifier_init);



























   86 




   81 
    4 

    4 









   77 


    9 

   76 

   58 

    3 











   15 




    3 

   68 


    5 


   15 


   20 

   15 


    5 

   15 


    5 


    2 



    1 







   11 

   11 


   62 














   30 



   20 







   17 
    3 











   86 





   37 
   61 









   32 





    9 




   22 






   10 















   73 






   50 
   28 





   26 












   21 




















    3 



    9 


    9 







   22 











   12 

   11 


    1 






    2 


    8 




    8 












    4 







    1 

    3 






    3 















   20 











    9 

   11 


    1 






    3 









    6 

    1 



    5 









    1 








    6 






    6 






    6 




























    1 






    7 
    6 










    1 






























    4 

    2 









    6 









    6 

    6 


    5 




    4 

    2 




    4 




   11 



    6 


    5 

    6 

    4 
    1 



   14 
   14 
   14 










































   19 

















    5 



   14 

   14 



    3 
   11 
















   14 






   15 




   15 




   15 











   18 







   18 





























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
// SPDX-License-Identifier: GPL-2.0-only
/*
 *  linux/fs/msdos/namei.c
 *
 *  Written 1992,1993 by Werner Almesberger
 *  Hidden files 1995 by Albert Cahalan <albert@ccs.neu.edu> <adc@coe.neu.edu>
 *  Rewritten for constant inumbers 1999 by Al Viro
 */

#include <linux/module.h>
#include <linux/iversion.h>
#include "fat.h"

/* Characters that are undesirable in an MS-DOS file name */
static unsigned char bad_chars[] = "*?<>|\"";
static unsigned char bad_if_strict[] = "+=,; ";

/***** Formats an MS-DOS file name. Rejects invalid names. */
static int msdos_format_name(const unsigned char *name, int len,
                             unsigned char *res, struct fat_mount_options *opts)
        /*
         * name is the proposed name, len is its length, res is
         * the resulting name, opts->name_check is either (r)elaxed,
         * (n)ormal or (s)trict, opts->dotsOK allows dots at the
         * beginning of name (for hidden files)
         */
{
        unsigned char *walk;
        unsigned char c;
        int space;

        if (name[0] == '.') {        /* dotfile because . and .. already done */
                if (opts->dotsOK) {
                        /* Get rid of dot - test for it elsewhere */
                        name++;
                        len--;
                } else
                        return -EINVAL;
        }
        /*
         * disallow names that _really_ start with a dot
         */
        space = 1;
        c = 0;
        for (walk = res; len && walk - res < 8; walk++) {
                c = *name++;
                len--;
                if (opts->name_check != 'r' && strchr(bad_chars, c))
                        return -EINVAL;
                if (opts->name_check == 's' && strchr(bad_if_strict, c))
                        return -EINVAL;
                if (c >= 'A' && c <= 'Z' && opts->name_check == 's')
                        return -EINVAL;
                if (c < ' ' || c == ':' || c == '\\')
                        return -EINVAL;
        /*
         * 0xE5 is legal as a first character, but we must substitute
         * 0x05 because 0xE5 marks deleted files.  Yes, DOS really
         * does this.
         * It seems that Microsoft hacked DOS to support non-US
         * characters after the 0xE5 character was already in use to
         * mark deleted files.
         */
                if ((res == walk) && (c == 0xE5))
                        c = 0x05;
                if (c == '.')
                        break;
                space = (c == ' ');
                *walk = (!opts->nocase && c >= 'a' && c <= 'z') ? c - 32 : c;
        }
        if (space)
                return -EINVAL;
        if (opts->name_check == 's' && len && c != '.') {
                c = *name++;
                len--;
                if (c != '.')
                        return -EINVAL;
        }
        while (c != '.' && len--)
                c = *name++;
        if (c == '.') {
                while (walk - res < 8)
                        *walk++ = ' ';
                while (len > 0 && walk - res < MSDOS_NAME) {
                        c = *name++;
                        len--;
                        if (opts->name_check != 'r' && strchr(bad_chars, c))
                                return -EINVAL;
                        if (opts->name_check == 's' &&
                            strchr(bad_if_strict, c))
                                return -EINVAL;
                        if (c < ' ' || c == ':' || c == '\\')
                                return -EINVAL;
                        if (c == '.') {
                                if (opts->name_check == 's')
                                        return -EINVAL;
                                break;
                        }
                        if (c >= 'A' && c <= 'Z' && opts->name_check == 's')
                                return -EINVAL;
                        space = c == ' ';
                        if (!opts->nocase && c >= 'a' && c <= 'z')
                                *walk++ = c - 32;
                        else
                                *walk++ = c;
                }
                if (space)
                        return -EINVAL;
                if (opts->name_check == 's' && len)
                        return -EINVAL;
        }
        while (walk - res < MSDOS_NAME)
                *walk++ = ' ';

        return 0;
}

/***** Locates a directory entry.  Uses unformatted name. */
static int msdos_find(struct inode *dir, const unsigned char *name, int len,
                      struct fat_slot_info *sinfo)
{
        struct msdos_sb_info *sbi = MSDOS_SB(dir->i_sb);
        unsigned char msdos_name[MSDOS_NAME];
        int err;

        err = msdos_format_name(name, len, msdos_name, &sbi->options);
        if (err)
                return -ENOENT;

        err = fat_scan(dir, msdos_name, sinfo);
        if (!err && sbi->options.dotsOK) {
                if (name[0] == '.') {
                        if (!(sinfo->de->attr & ATTR_HIDDEN))
                                err = -ENOENT;
                } else {
                        if (sinfo->de->attr & ATTR_HIDDEN)
                                err = -ENOENT;
                }
                if (err)
                        brelse(sinfo->bh);
        }
        return err;
}

/*
 * Compute the hash for the msdos name corresponding to the dentry.
 * Note: if the name is invalid, we leave the hash code unchanged so
 * that the existing dentry can be used. The msdos fs routines will
 * return ENOENT or EINVAL as appropriate.
 */
static int msdos_hash(const struct dentry *dentry, struct qstr *qstr)
{
        struct fat_mount_options *options = &MSDOS_SB(dentry->d_sb)->options;
        unsigned char msdos_name[MSDOS_NAME];
        int error;

        error = msdos_format_name(qstr->name, qstr->len, msdos_name, options);
        if (!error)
                qstr->hash = full_name_hash(dentry, msdos_name, MSDOS_NAME);
        return 0;
}

/*
 * Compare two msdos names. If either of the names are invalid,
 * we fall back to doing the standard name comparison.
 */
static int msdos_cmp(const struct dentry *dentry,
                unsigned int len, const char *str, const struct qstr *name)
{
        struct fat_mount_options *options = &MSDOS_SB(dentry->d_sb)->options;
        unsigned char a_msdos_name[MSDOS_NAME], b_msdos_name[MSDOS_NAME];
        int error;

        error = msdos_format_name(name->name, name->len, a_msdos_name, options);
        if (error)
                goto old_compare;
        error = msdos_format_name(str, len, b_msdos_name, options);
        if (error)
                goto old_compare;
        error = memcmp(a_msdos_name, b_msdos_name, MSDOS_NAME);
out:
        return error;

old_compare:
        error = 1;
        if (name->len == len)
                error = memcmp(name->name, str, len);
        goto out;
}

static const struct dentry_operations msdos_dentry_operations = {
        .d_hash                = msdos_hash,
        .d_compare        = msdos_cmp,
};

/*
 * AV. Wrappers for FAT sb operations. Is it wise?
 */

/***** Get inode using directory and name */
static struct dentry *msdos_lookup(struct inode *dir, struct dentry *dentry,
                                   unsigned int flags)
{
        struct super_block *sb = dir->i_sb;
        struct fat_slot_info sinfo;
        struct inode *inode;
        int err;

        mutex_lock(&MSDOS_SB(sb)->s_lock);
        err = msdos_find(dir, dentry->d_name.name, dentry->d_name.len, &sinfo);
        switch (err) {
        case -ENOENT:
                inode = NULL;
                break;
        case 0:
                inode = fat_build_inode(sb, sinfo.de, sinfo.i_pos);
                brelse(sinfo.bh);
                break;
        default:
                inode = ERR_PTR(err);
        }
        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        return d_splice_alias(inode, dentry);
}

/***** Creates a directory entry (name is already formatted). */
static int msdos_add_entry(struct inode *dir, const unsigned char *name,
                           int is_dir, int is_hid, int cluster,
                           struct timespec64 *ts, struct fat_slot_info *sinfo)
{
        struct msdos_sb_info *sbi = MSDOS_SB(dir->i_sb);
        struct msdos_dir_entry de;
        __le16 time, date;
        int err;

        memcpy(de.name, name, MSDOS_NAME);
        de.attr = is_dir ? ATTR_DIR : ATTR_ARCH;
        if (is_hid)
                de.attr |= ATTR_HIDDEN;
        de.lcase = 0;
        fat_time_unix2fat(sbi, ts, &time, &date, NULL);
        de.cdate = de.adate = 0;
        de.ctime = 0;
        de.ctime_cs = 0;
        de.time = time;
        de.date = date;
        fat_set_start(&de, cluster);
        de.size = 0;

        err = fat_add_entries(dir, &de, 1, sinfo);
        if (err)
                return err;

        fat_truncate_time(dir, ts, S_CTIME|S_MTIME);
        if (IS_DIRSYNC(dir))
                (void)fat_sync_inode(dir);
        else
                mark_inode_dirty(dir);

        return 0;
}

/***** Create a file */
static int msdos_create(struct mnt_idmap *idmap, struct inode *dir,
                        struct dentry *dentry, umode_t mode, bool excl)
{
        struct super_block *sb = dir->i_sb;
        struct inode *inode = NULL;
        struct fat_slot_info sinfo;
        struct timespec64 ts;
        unsigned char msdos_name[MSDOS_NAME];
        int err, is_hid;

        mutex_lock(&MSDOS_SB(sb)->s_lock);

        err = msdos_format_name(dentry->d_name.name, dentry->d_name.len,
                                msdos_name, &MSDOS_SB(sb)->options);
        if (err)
                goto out;
        is_hid = (dentry->d_name.name[0] == '.') && (msdos_name[0] != '.');
        /* Have to do it due to foo vs. .foo conflicts */
        if (!fat_scan(dir, msdos_name, &sinfo)) {
                brelse(sinfo.bh);
                err = -EINVAL;
                goto out;
        }

        ts = current_time(dir);
        err = msdos_add_entry(dir, msdos_name, 0, is_hid, 0, &ts, &sinfo);
        if (err)
                goto out;
        inode = fat_build_inode(sb, sinfo.de, sinfo.i_pos);
        brelse(sinfo.bh);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                goto out;
        }
        fat_truncate_time(inode, &ts, S_ATIME|S_CTIME|S_MTIME);
        /* timestamp is already written, so mark_inode_dirty() is unneeded. */

        d_instantiate(dentry, inode);
out:
        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        if (!err)
                err = fat_flush_inodes(sb, dir, inode);
        return err;
}

/***** Remove a directory */
static int msdos_rmdir(struct inode *dir, struct dentry *dentry)
{
        struct super_block *sb = dir->i_sb;
        struct inode *inode = d_inode(dentry);
        struct fat_slot_info sinfo;
        int err;

        mutex_lock(&MSDOS_SB(sb)->s_lock);
        err = fat_dir_empty(inode);
        if (err)
                goto out;
        err = msdos_find(dir, dentry->d_name.name, dentry->d_name.len, &sinfo);
        if (err)
                goto out;

        err = fat_remove_entries(dir, &sinfo);        /* and releases bh */
        if (err)
                goto out;
        drop_nlink(dir);

        clear_nlink(inode);
        fat_truncate_time(inode, NULL, S_CTIME);
        fat_detach(inode);
out:
        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        if (!err)
                err = fat_flush_inodes(sb, dir, inode);

        return err;
}

/***** Make a directory */
static int msdos_mkdir(struct mnt_idmap *idmap, struct inode *dir,
                       struct dentry *dentry, umode_t mode)
{
        struct super_block *sb = dir->i_sb;
        struct fat_slot_info sinfo;
        struct inode *inode;
        unsigned char msdos_name[MSDOS_NAME];
        struct timespec64 ts;
        int err, is_hid, cluster;

        mutex_lock(&MSDOS_SB(sb)->s_lock);

        err = msdos_format_name(dentry->d_name.name, dentry->d_name.len,
                                msdos_name, &MSDOS_SB(sb)->options);
        if (err)
                goto out;
        is_hid = (dentry->d_name.name[0] == '.') && (msdos_name[0] != '.');
        /* foo vs .foo situation */
        if (!fat_scan(dir, msdos_name, &sinfo)) {
                brelse(sinfo.bh);
                err = -EINVAL;
                goto out;
        }

        ts = current_time(dir);
        cluster = fat_alloc_new_dir(dir, &ts);
        if (cluster < 0) {
                err = cluster;
                goto out;
        }
        err = msdos_add_entry(dir, msdos_name, 1, is_hid, cluster, &ts, &sinfo);
        if (err)
                goto out_free;
        inc_nlink(dir);

        inode = fat_build_inode(sb, sinfo.de, sinfo.i_pos);
        brelse(sinfo.bh);
        if (IS_ERR(inode)) {
                err = PTR_ERR(inode);
                /* the directory was completed, just return a error */
                goto out;
        }
        set_nlink(inode, 2);
        fat_truncate_time(inode, &ts, S_ATIME|S_CTIME|S_MTIME);
        /* timestamp is already written, so mark_inode_dirty() is unneeded. */

        d_instantiate(dentry, inode);

        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        fat_flush_inodes(sb, dir, inode);
        return 0;

out_free:
        fat_free_clusters(dir, cluster);
out:
        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        return err;
}

/***** Unlink a file */
static int msdos_unlink(struct inode *dir, struct dentry *dentry)
{
        struct inode *inode = d_inode(dentry);
        struct super_block *sb = inode->i_sb;
        struct fat_slot_info sinfo;
        int err;

        mutex_lock(&MSDOS_SB(sb)->s_lock);
        err = msdos_find(dir, dentry->d_name.name, dentry->d_name.len, &sinfo);
        if (err)
                goto out;

        err = fat_remove_entries(dir, &sinfo);        /* and releases bh */
        if (err)
                goto out;
        clear_nlink(inode);
        fat_truncate_time(inode, NULL, S_CTIME);
        fat_detach(inode);
out:
        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        if (!err)
                err = fat_flush_inodes(sb, dir, inode);

        return err;
}

static int do_msdos_rename(struct inode *old_dir, unsigned char *old_name,
                           struct dentry *old_dentry,
                           struct inode *new_dir, unsigned char *new_name,
                           struct dentry *new_dentry, int is_hid)
{
        struct buffer_head *dotdot_bh;
        struct msdos_dir_entry *dotdot_de;
        struct inode *old_inode, *new_inode;
        struct fat_slot_info old_sinfo, sinfo;
        struct timespec64 ts;
        loff_t new_i_pos;
        int err, old_attrs, is_dir, update_dotdot, corrupt = 0;

        old_sinfo.bh = sinfo.bh = dotdot_bh = NULL;
        old_inode = d_inode(old_dentry);
        new_inode = d_inode(new_dentry);

        err = fat_scan(old_dir, old_name, &old_sinfo);
        if (err) {
                err = -EIO;
                goto out;
        }

        is_dir = S_ISDIR(old_inode->i_mode);
        update_dotdot = (is_dir && old_dir != new_dir);
        if (update_dotdot) {
                if (fat_get_dotdot_entry(old_inode, &dotdot_bh, &dotdot_de)) {
                        err = -EIO;
                        goto out;
                }
        }

        old_attrs = MSDOS_I(old_inode)->i_attrs;
        err = fat_scan(new_dir, new_name, &sinfo);
        if (!err) {
                if (!new_inode) {
                        /* "foo" -> ".foo" case. just change the ATTR_HIDDEN */
                        if (sinfo.de != old_sinfo.de) {
                                err = -EINVAL;
                                goto out;
                        }
                        if (is_hid)
                                MSDOS_I(old_inode)->i_attrs |= ATTR_HIDDEN;
                        else
                                MSDOS_I(old_inode)->i_attrs &= ~ATTR_HIDDEN;
                        if (IS_DIRSYNC(old_dir)) {
                                err = fat_sync_inode(old_inode);
                                if (err) {
                                        MSDOS_I(old_inode)->i_attrs = old_attrs;
                                        goto out;
                                }
                        } else
                                mark_inode_dirty(old_inode);

                        inode_inc_iversion(old_dir);
                        fat_truncate_time(old_dir, NULL, S_CTIME|S_MTIME);
                        if (IS_DIRSYNC(old_dir))
                                (void)fat_sync_inode(old_dir);
                        else
                                mark_inode_dirty(old_dir);
                        goto out;
                }
        }

        ts = current_time(old_inode);
        if (new_inode) {
                if (err)
                        goto out;
                if (is_dir) {
                        err = fat_dir_empty(new_inode);
                        if (err)
                                goto out;
                }
                new_i_pos = MSDOS_I(new_inode)->i_pos;
                fat_detach(new_inode);
        } else {
                err = msdos_add_entry(new_dir, new_name, is_dir, is_hid, 0,
                                      &ts, &sinfo);
                if (err)
                        goto out;
                new_i_pos = sinfo.i_pos;
        }
        inode_inc_iversion(new_dir);

        fat_detach(old_inode);
        fat_attach(old_inode, new_i_pos);
        if (is_hid)
                MSDOS_I(old_inode)->i_attrs |= ATTR_HIDDEN;
        else
                MSDOS_I(old_inode)->i_attrs &= ~ATTR_HIDDEN;
        if (IS_DIRSYNC(new_dir)) {
                err = fat_sync_inode(old_inode);
                if (err)
                        goto error_inode;
        } else
                mark_inode_dirty(old_inode);

        if (update_dotdot) {
                fat_set_start(dotdot_de, MSDOS_I(new_dir)->i_logstart);
                mark_buffer_dirty_inode(dotdot_bh, old_inode);
                if (IS_DIRSYNC(new_dir)) {
                        err = sync_dirty_buffer(dotdot_bh);
                        if (err)
                                goto error_dotdot;
                }
                drop_nlink(old_dir);
                if (!new_inode)
                        inc_nlink(new_dir);
        }

        err = fat_remove_entries(old_dir, &old_sinfo);        /* and releases bh */
        old_sinfo.bh = NULL;
        if (err)
                goto error_dotdot;
        inode_inc_iversion(old_dir);
        fat_truncate_time(old_dir, &ts, S_CTIME|S_MTIME);
        if (IS_DIRSYNC(old_dir))
                (void)fat_sync_inode(old_dir);
        else
                mark_inode_dirty(old_dir);

        if (new_inode) {
                drop_nlink(new_inode);
                if (is_dir)
                        drop_nlink(new_inode);
                fat_truncate_time(new_inode, &ts, S_CTIME);
        }
out:
        brelse(sinfo.bh);
        brelse(dotdot_bh);
        brelse(old_sinfo.bh);
        return err;

error_dotdot:
        /* data cluster is shared, serious corruption */
        corrupt = 1;

        if (update_dotdot) {
                fat_set_start(dotdot_de, MSDOS_I(old_dir)->i_logstart);
                mark_buffer_dirty_inode(dotdot_bh, old_inode);
                corrupt |= sync_dirty_buffer(dotdot_bh);
        }
error_inode:
        fat_detach(old_inode);
        fat_attach(old_inode, old_sinfo.i_pos);
        MSDOS_I(old_inode)->i_attrs = old_attrs;
        if (new_inode) {
                fat_attach(new_inode, new_i_pos);
                if (corrupt)
                        corrupt |= fat_sync_inode(new_inode);
        } else {
                /*
                 * If new entry was not sharing the data cluster, it
                 * shouldn't be serious corruption.
                 */
                int err2 = fat_remove_entries(new_dir, &sinfo);
                if (corrupt)
                        corrupt |= err2;
                sinfo.bh = NULL;
        }
        if (corrupt < 0) {
                fat_fs_error(new_dir->i_sb,
                             "%s: Filesystem corrupted (i_pos %lld)",
                             __func__, sinfo.i_pos);
        }
        goto out;
}

/***** Rename, a wrapper for rename_same_dir & rename_diff_dir */
static int msdos_rename(struct mnt_idmap *idmap,
                        struct inode *old_dir, struct dentry *old_dentry,
                        struct inode *new_dir, struct dentry *new_dentry,
                        unsigned int flags)
{
        struct super_block *sb = old_dir->i_sb;
        unsigned char old_msdos_name[MSDOS_NAME], new_msdos_name[MSDOS_NAME];
        int err, is_hid;

        if (flags & ~RENAME_NOREPLACE)
                return -EINVAL;

        mutex_lock(&MSDOS_SB(sb)->s_lock);

        err = msdos_format_name(old_dentry->d_name.name,
                                old_dentry->d_name.len, old_msdos_name,
                                &MSDOS_SB(old_dir->i_sb)->options);
        if (err)
                goto out;
        err = msdos_format_name(new_dentry->d_name.name,
                                new_dentry->d_name.len, new_msdos_name,
                                &MSDOS_SB(new_dir->i_sb)->options);
        if (err)
                goto out;

        is_hid =
             (new_dentry->d_name.name[0] == '.') && (new_msdos_name[0] != '.');

        err = do_msdos_rename(old_dir, old_msdos_name, old_dentry,
                              new_dir, new_msdos_name, new_dentry, is_hid);
out:
        mutex_unlock(&MSDOS_SB(sb)->s_lock);
        if (!err)
                err = fat_flush_inodes(sb, old_dir, new_dir);
        return err;
}

static const struct inode_operations msdos_dir_inode_operations = {
        .create                = msdos_create,
        .lookup                = msdos_lookup,
        .unlink                = msdos_unlink,
        .mkdir                = msdos_mkdir,
        .rmdir                = msdos_rmdir,
        .rename                = msdos_rename,
        .setattr        = fat_setattr,
        .getattr        = fat_getattr,
        .update_time        = fat_update_time,
};

static void setup(struct super_block *sb)
{
        MSDOS_SB(sb)->dir_ops = &msdos_dir_inode_operations;
        sb->s_d_op = &msdos_dentry_operations;
        sb->s_flags |= SB_NOATIME;
}

static int msdos_fill_super(struct super_block *sb, struct fs_context *fc)
{
        return fat_fill_super(sb, fc, setup);
}

static int msdos_get_tree(struct fs_context *fc)
{
        return get_tree_bdev(fc, msdos_fill_super);
}

static int msdos_parse_param(struct fs_context *fc, struct fs_parameter *param)
{
        return fat_parse_param(fc, param, false);
}

static const struct fs_context_operations msdos_context_ops = {
        .parse_param        = msdos_parse_param,
        .get_tree        = msdos_get_tree,
        .reconfigure        = fat_reconfigure,
        .free                = fat_free_fc,
};

static int msdos_init_fs_context(struct fs_context *fc)
{
        int err;

        /* Initialize with is_vfat == false */
        err = fat_init_fs_context(fc, false);
        if (err)
                return err;

        fc->ops = &msdos_context_ops;
        return 0;
}

static struct file_system_type msdos_fs_type = {
        .owner                = THIS_MODULE,
        .name                = "msdos",
        .kill_sb        = kill_block_super,
        .fs_flags        = FS_REQUIRES_DEV | FS_ALLOW_IDMAP,
        .init_fs_context = msdos_init_fs_context,
        .parameters        = fat_param_spec,
};
MODULE_ALIAS_FS("msdos");

static int __init init_msdos_fs(void)
{
        return register_filesystem(&msdos_fs_type);
}

static void __exit exit_msdos_fs(void)
{
        unregister_filesystem(&msdos_fs_type);
}

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Werner Almesberger");
MODULE_DESCRIPTION("MS-DOS filesystem support");

module_init(init_msdos_fs)
module_exit(exit_msdos_fs)
























































































































































































































































































































































































































































































































































































    1 






















































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
// SPDX-License-Identifier: GPL-2.0
/*
 * (C) 2001 Clemson University and The University of Chicago
 *
 * Changes by Acxiom Corporation to add protocol version to kernel
 * communication, Copyright Acxiom Corporation, 2005.
 *
 * See COPYING in top-level directory.
 */

#include "protocol.h"
#include "orangefs-kernel.h"
#include "orangefs-dev-proto.h"
#include "orangefs-bufmap.h"
#include "orangefs-debugfs.h"

#include <linux/debugfs.h>
#include <linux/slab.h>

/* this file implements the /dev/pvfs2-req device node */

uint32_t orangefs_userspace_version;

static int open_access_count;

static DEFINE_MUTEX(devreq_mutex);

#define DUMP_DEVICE_ERROR()                                                   \
do {                                                                          \
        gossip_err("*****************************************************\n");\
        gossip_err("ORANGEFS Device Error:  You cannot open the device file ");  \
        gossip_err("\n/dev/%s more than once.  Please make sure that\nthere " \
                   "are no ", ORANGEFS_REQDEVICE_NAME);                          \
        gossip_err("instances of a program using this device\ncurrently "     \
                   "running. (You must verify this!)\n");                     \
        gossip_err("For example, you can use the lsof program as follows:\n");\
        gossip_err("'lsof | grep %s' (run this as root)\n",                   \
                   ORANGEFS_REQDEVICE_NAME);                                     \
        gossip_err("  open_access_count = %d\n", open_access_count);          \
        gossip_err("*****************************************************\n");\
} while (0)

static int hash_func(__u64 tag, int table_size)
{
        return do_div(tag, (unsigned int)table_size);
}

static void orangefs_devreq_add_op(struct orangefs_kernel_op_s *op)
{
        int index = hash_func(op->tag, hash_table_size);

        list_add_tail(&op->list, &orangefs_htable_ops_in_progress[index]);
}

/*
 * find the op with this tag and remove it from the in progress
 * hash table.
 */
static struct orangefs_kernel_op_s *orangefs_devreq_remove_op(__u64 tag)
{
        struct orangefs_kernel_op_s *op, *next;
        int index;

        index = hash_func(tag, hash_table_size);

        spin_lock(&orangefs_htable_ops_in_progress_lock);
        list_for_each_entry_safe(op,
                                 next,
                                 &orangefs_htable_ops_in_progress[index],
                                 list) {
                if (op->tag == tag && !op_state_purged(op) &&
                    !op_state_given_up(op)) {
                        list_del_init(&op->list);
                        spin_unlock(&orangefs_htable_ops_in_progress_lock);
                        return op;
                }
        }

        spin_unlock(&orangefs_htable_ops_in_progress_lock);
        return NULL;
}

/* Returns whether any FS are still pending remounted */
static int mark_all_pending_mounts(void)
{
        int unmounted = 1;
        struct orangefs_sb_info_s *orangefs_sb = NULL;

        spin_lock(&orangefs_superblocks_lock);
        list_for_each_entry(orangefs_sb, &orangefs_superblocks, list) {
                /* All of these file system require a remount */
                orangefs_sb->mount_pending = 1;
                unmounted = 0;
        }
        spin_unlock(&orangefs_superblocks_lock);
        return unmounted;
}

/*
 * Determine if a given file system needs to be remounted or not
 *  Returns -1 on error
 *           0 if already mounted
 *           1 if needs remount
 */
static int fs_mount_pending(__s32 fsid)
{
        int mount_pending = -1;
        struct orangefs_sb_info_s *orangefs_sb = NULL;

        spin_lock(&orangefs_superblocks_lock);
        list_for_each_entry(orangefs_sb, &orangefs_superblocks, list) {
                if (orangefs_sb->fs_id == fsid) {
                        mount_pending = orangefs_sb->mount_pending;
                        break;
                }
        }
        spin_unlock(&orangefs_superblocks_lock);
        return mount_pending;
}

static int orangefs_devreq_open(struct inode *inode, struct file *file)
{
        int ret = -EINVAL;

        /* in order to ensure that the filesystem driver sees correct UIDs */
        if (file->f_cred->user_ns != &init_user_ns) {
                gossip_err("%s: device cannot be opened outside init_user_ns\n",
                           __func__);
                goto out;
        }

        if (!(file->f_flags & O_NONBLOCK)) {
                gossip_err("%s: device cannot be opened in blocking mode\n",
                           __func__);
                goto out;
        }
        ret = -EACCES;
        gossip_debug(GOSSIP_DEV_DEBUG, "client-core: opening device\n");
        mutex_lock(&devreq_mutex);

        if (open_access_count == 0) {
                open_access_count = 1;
                ret = 0;
        } else {
                DUMP_DEVICE_ERROR();
        }
        mutex_unlock(&devreq_mutex);

out:

        gossip_debug(GOSSIP_DEV_DEBUG,
                     "pvfs2-client-core: open device complete (ret = %d)\n",
                     ret);
        return ret;
}

/* Function for read() callers into the device */
static ssize_t orangefs_devreq_read(struct file *file,
                                 char __user *buf,
                                 size_t count, loff_t *offset)
{
        struct orangefs_kernel_op_s *op, *temp;
        __s32 proto_ver = ORANGEFS_KERNEL_PROTO_VERSION;
        static __s32 magic = ORANGEFS_DEVREQ_MAGIC;
        struct orangefs_kernel_op_s *cur_op;
        unsigned long ret;

        /* We do not support blocking IO. */
        if (!(file->f_flags & O_NONBLOCK)) {
                gossip_err("%s: blocking read from client-core.\n",
                           __func__);
                return -EINVAL;
        }

        /*
         * The client will do an ioctl to find MAX_DEV_REQ_UPSIZE, then
         * always read with that size buffer.
         */
        if (count != MAX_DEV_REQ_UPSIZE) {
                gossip_err("orangefs: client-core tried to read wrong size\n");
                return -EINVAL;
        }

        /* Check for an empty list before locking. */
        if (list_empty(&orangefs_request_list))
                return -EAGAIN;

restart:
        cur_op = NULL;
        /* Get next op (if any) from top of list. */
        spin_lock(&orangefs_request_list_lock);
        list_for_each_entry_safe(op, temp, &orangefs_request_list, list) {
                __s32 fsid;
                /* This lock is held past the end of the loop when we break. */
                spin_lock(&op->lock);
                if (unlikely(op_state_purged(op) || op_state_given_up(op))) {
                        spin_unlock(&op->lock);
                        continue;
                }

                fsid = fsid_of_op(op);
                if (fsid != ORANGEFS_FS_ID_NULL) {
                        int ret;
                        /* Skip ops whose filesystem needs to be mounted. */
                        ret = fs_mount_pending(fsid);
                        if (ret == 1) {
                                gossip_debug(GOSSIP_DEV_DEBUG,
                                    "%s: mount pending, skipping op tag "
                                    "%llu %s\n",
                                    __func__,
                                    llu(op->tag),
                                    get_opname_string(op));
                                spin_unlock(&op->lock);
                                continue;
                        /*
                         * Skip ops whose filesystem we don't know about unless
                         * it is being mounted or unmounted.  It is possible for
                         * a filesystem we don't know about to be unmounted if
                         * it fails to mount in the kernel after userspace has
                         * been sent the mount request.
                         */
                        /* XXX: is there a better way to detect this? */
                        } else if (ret == -1 &&
                                   !(op->upcall.type ==
                                        ORANGEFS_VFS_OP_FS_MOUNT ||
                                     op->upcall.type ==
                                        ORANGEFS_VFS_OP_GETATTR ||
                                     op->upcall.type ==
                                        ORANGEFS_VFS_OP_FS_UMOUNT)) {
                                gossip_debug(GOSSIP_DEV_DEBUG,
                                    "orangefs: skipping op tag %llu %s\n",
                                    llu(op->tag), get_opname_string(op));
                                gossip_err(
                                    "orangefs: ERROR: fs_mount_pending %d\n",
                                    fsid);
                                spin_unlock(&op->lock);
                                continue;
                        }
                }
                /*
                 * Either this op does not pertain to a filesystem, is mounting
                 * a filesystem, or pertains to a mounted filesystem. Let it
                 * through.
                 */
                cur_op = op;
                break;
        }

        /*
         * At this point we either have a valid op and can continue or have not
         * found an op and must ask the client to try again later.
         */
        if (!cur_op) {
                spin_unlock(&orangefs_request_list_lock);
                return -EAGAIN;
        }

        gossip_debug(GOSSIP_DEV_DEBUG, "%s: reading op tag %llu %s\n",
                     __func__,
                     llu(cur_op->tag),
                     get_opname_string(cur_op));

        /*
         * Such an op should never be on the list in the first place. If so, we
         * will abort.
         */
        if (op_state_in_progress(cur_op) || op_state_serviced(cur_op)) {
                gossip_err("orangefs: ERROR: Current op already queued.\n");
                list_del_init(&cur_op->list);
                spin_unlock(&cur_op->lock);
                spin_unlock(&orangefs_request_list_lock);
                return -EAGAIN;
        }

        list_del_init(&cur_op->list);
        spin_unlock(&orangefs_request_list_lock);

        spin_unlock(&cur_op->lock);

        /* Push the upcall out. */
        ret = copy_to_user(buf, &proto_ver, sizeof(__s32));
        if (ret != 0)
                goto error;
        ret = copy_to_user(buf + sizeof(__s32), &magic, sizeof(__s32));
        if (ret != 0)
                goto error;
        ret = copy_to_user(buf + 2 * sizeof(__s32),
                &cur_op->tag,
                sizeof(__u64));
        if (ret != 0)
                goto error;
        ret = copy_to_user(buf + 2 * sizeof(__s32) + sizeof(__u64),
                &cur_op->upcall,
                sizeof(struct orangefs_upcall_s));
        if (ret != 0)
                goto error;

        spin_lock(&orangefs_htable_ops_in_progress_lock);
        spin_lock(&cur_op->lock);
        if (unlikely(op_state_given_up(cur_op))) {
                spin_unlock(&cur_op->lock);
                spin_unlock(&orangefs_htable_ops_in_progress_lock);
                complete(&cur_op->waitq);
                goto restart;
        }

        /*
         * Set the operation to be in progress and move it between lists since
         * it has been sent to the client.
         */
        set_op_state_inprogress(cur_op);
        gossip_debug(GOSSIP_DEV_DEBUG,
                     "%s: 1 op:%s: op_state:%d: process:%s:\n",
                     __func__,
                     get_opname_string(cur_op),
                     cur_op->op_state,
                     current->comm);
        orangefs_devreq_add_op(cur_op);
        spin_unlock(&cur_op->lock);
        spin_unlock(&orangefs_htable_ops_in_progress_lock);

        /* The client only asks to read one size buffer. */
        return MAX_DEV_REQ_UPSIZE;
error:
        /*
         * We were unable to copy the op data to the client. Put the op back in
         * list. If client has crashed, the op will be purged later when the
         * device is released.
         */
        gossip_err("orangefs: Failed to copy data to user space\n");
        spin_lock(&orangefs_request_list_lock);
        spin_lock(&cur_op->lock);
        if (likely(!op_state_given_up(cur_op))) {
                set_op_state_waiting(cur_op);
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "%s: 2 op:%s: op_state:%d: process:%s:\n",
                             __func__,
                             get_opname_string(cur_op),
                             cur_op->op_state,
                             current->comm);
                list_add(&cur_op->list, &orangefs_request_list);
                spin_unlock(&cur_op->lock);
        } else {
                spin_unlock(&cur_op->lock);
                complete(&cur_op->waitq);
        }
        spin_unlock(&orangefs_request_list_lock);
        return -EFAULT;
}

/*
 * Function for writev() callers into the device.
 *
 * Userspace should have written:
 *  - __u32 version
 *  - __u32 magic
 *  - __u64 tag
 *  - struct orangefs_downcall_s
 *  - trailer buffer (in the case of READDIR operations)
 */
static ssize_t orangefs_devreq_write_iter(struct kiocb *iocb,
                                      struct iov_iter *iter)
{
        ssize_t ret;
        struct orangefs_kernel_op_s *op = NULL;
        struct {
                __u32 version;
                __u32 magic;
                __u64 tag;
        } head;
        int total = ret = iov_iter_count(iter);
        int downcall_size = sizeof(struct orangefs_downcall_s);
        int head_size = sizeof(head);

        gossip_debug(GOSSIP_DEV_DEBUG, "%s: total:%d: ret:%zd:\n",
                     __func__,
                     total,
                     ret);

        if (total < MAX_DEV_REQ_DOWNSIZE) {
                gossip_err("%s: total:%d: must be at least:%u:\n",
                           __func__,
                           total,
                           (unsigned int) MAX_DEV_REQ_DOWNSIZE);
                return -EFAULT;
        }

        if (!copy_from_iter_full(&head, head_size, iter)) {
                gossip_err("%s: failed to copy head.\n", __func__);
                return -EFAULT;
        }

        if (head.version < ORANGEFS_MINIMUM_USERSPACE_VERSION) {
                gossip_err("%s: userspace claims version"
                           "%d, minimum version required: %d.\n",
                           __func__,
                           head.version,
                           ORANGEFS_MINIMUM_USERSPACE_VERSION);
                return -EPROTO;
        }

        if (head.magic != ORANGEFS_DEVREQ_MAGIC) {
                gossip_err("Error: Device magic number does not match.\n");
                return -EPROTO;
        }

        if (!orangefs_userspace_version) {
                orangefs_userspace_version = head.version;
        } else if (orangefs_userspace_version != head.version) {
                gossip_err("Error: userspace version changes\n");
                return -EPROTO;
        }

        /* remove the op from the in progress hash table */
        op = orangefs_devreq_remove_op(head.tag);
        if (!op) {
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "%s: No one's waiting for tag %llu\n",
                             __func__, llu(head.tag));
                return ret;
        }

        if (!copy_from_iter_full(&op->downcall, downcall_size, iter)) {
                gossip_err("%s: failed to copy downcall.\n", __func__);
                goto Efault;
        }

        if (op->downcall.status)
                goto wakeup;

        /*
         * We've successfully peeled off the head and the downcall.
         * Something has gone awry if total doesn't equal the
         * sum of head_size, downcall_size and trailer_size.
         */
        if ((head_size + downcall_size + op->downcall.trailer_size) != total) {
                gossip_err("%s: funky write, head_size:%d"
                           ": downcall_size:%d: trailer_size:%lld"
                           ": total size:%d:\n",
                           __func__,
                           head_size,
                           downcall_size,
                           op->downcall.trailer_size,
                           total);
                goto Efault;
        }

        /* Only READDIR operations should have trailers. */
        if ((op->downcall.type != ORANGEFS_VFS_OP_READDIR) &&
            (op->downcall.trailer_size != 0)) {
                gossip_err("%s: %x operation with trailer.",
                           __func__,
                           op->downcall.type);
                goto Efault;
        }

        /* READDIR operations should always have trailers. */
        if ((op->downcall.type == ORANGEFS_VFS_OP_READDIR) &&
            (op->downcall.trailer_size == 0)) {
                gossip_err("%s: %x operation with no trailer.",
                           __func__,
                           op->downcall.type);
                goto Efault;
        }

        if (op->downcall.type != ORANGEFS_VFS_OP_READDIR)
                goto wakeup;

        op->downcall.trailer_buf = vzalloc(op->downcall.trailer_size);
        if (!op->downcall.trailer_buf)
                goto Enomem;

        if (!copy_from_iter_full(op->downcall.trailer_buf,
                                 op->downcall.trailer_size, iter)) {
                gossip_err("%s: failed to copy trailer.\n", __func__);
                vfree(op->downcall.trailer_buf);
                goto Efault;
        }

wakeup:
        /*
         * Return to vfs waitqueue, and back to service_operation
         * through wait_for_matching_downcall.
         */
        spin_lock(&op->lock);
        if (unlikely(op_is_cancel(op))) {
                spin_unlock(&op->lock);
                put_cancel(op);
        } else if (unlikely(op_state_given_up(op))) {
                spin_unlock(&op->lock);
                complete(&op->waitq);
        } else {
                set_op_state_serviced(op);
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "%s: op:%s: op_state:%d: process:%s:\n",
                             __func__,
                             get_opname_string(op),
                             op->op_state,
                             current->comm);
                spin_unlock(&op->lock);
        }
        return ret;

Efault:
        op->downcall.status = -(ORANGEFS_ERROR_BIT | 9);
        ret = -EFAULT;
        goto wakeup;

Enomem:
        op->downcall.status = -(ORANGEFS_ERROR_BIT | 8);
        ret = -ENOMEM;
        goto wakeup;
}

/*
 * NOTE: gets called when the last reference to this device is dropped.
 * Using the open_access_count variable, we enforce a reference count
 * on this file so that it can be opened by only one process at a time.
 * the devreq_mutex is used to make sure all i/o has completed
 * before we call orangefs_bufmap_finalize, and similar such tricky
 * situations
 */
static int orangefs_devreq_release(struct inode *inode, struct file *file)
{
        int unmounted = 0;

        gossip_debug(GOSSIP_DEV_DEBUG,
                     "%s:pvfs2-client-core: exiting, closing device\n",
                     __func__);

        mutex_lock(&devreq_mutex);
        orangefs_bufmap_finalize();

        open_access_count = -1;

        unmounted = mark_all_pending_mounts();
        gossip_debug(GOSSIP_DEV_DEBUG, "ORANGEFS Device Close: Filesystem(s) %s\n",
                     (unmounted ? "UNMOUNTED" : "MOUNTED"));

        purge_waiting_ops();
        purge_inprogress_ops();

        orangefs_bufmap_run_down();

        gossip_debug(GOSSIP_DEV_DEBUG,
                     "pvfs2-client-core: device close complete\n");
        open_access_count = 0;
        orangefs_userspace_version = 0;
        mutex_unlock(&devreq_mutex);
        return 0;
}

int is_daemon_in_service(void)
{
        int in_service;

        /*
         * What this function does is checks if client-core is alive
         * based on the access count we maintain on the device.
         */
        mutex_lock(&devreq_mutex);
        in_service = open_access_count == 1 ? 0 : -EIO;
        mutex_unlock(&devreq_mutex);
        return in_service;
}

bool __is_daemon_in_service(void)
{
        return open_access_count == 1;
}

static inline long check_ioctl_command(unsigned int command)
{
        /* Check for valid ioctl codes */
        if (_IOC_TYPE(command) != ORANGEFS_DEV_MAGIC) {
                gossip_err("device ioctl magic numbers don't match! Did you rebuild pvfs2-client-core/libpvfs2? [cmd %x, magic %x != %x]\n",
                        command,
                        _IOC_TYPE(command),
                        ORANGEFS_DEV_MAGIC);
                return -EINVAL;
        }
        /* and valid ioctl commands */
        if (_IOC_NR(command) >= ORANGEFS_DEV_MAXNR || _IOC_NR(command) <= 0) {
                gossip_err("Invalid ioctl command number [%d >= %d]\n",
                           _IOC_NR(command), ORANGEFS_DEV_MAXNR);
                return -ENOIOCTLCMD;
        }
        return 0;
}

static long dispatch_ioctl_command(unsigned int command, unsigned long arg)
{
        static __s32 magic = ORANGEFS_DEVREQ_MAGIC;
        static __s32 max_up_size = MAX_DEV_REQ_UPSIZE;
        static __s32 max_down_size = MAX_DEV_REQ_DOWNSIZE;
        struct ORANGEFS_dev_map_desc user_desc;
        int ret = 0;
        int upstream_kmod = 1;
        struct orangefs_sb_info_s *orangefs_sb;

        /* mtmoore: add locking here */

        switch (command) {
        case ORANGEFS_DEV_GET_MAGIC:
                return ((put_user(magic, (__s32 __user *) arg) == -EFAULT) ?
                        -EIO :
                        0);
        case ORANGEFS_DEV_GET_MAX_UPSIZE:
                return ((put_user(max_up_size,
                                  (__s32 __user *) arg) == -EFAULT) ?
                                        -EIO :
                                        0);
        case ORANGEFS_DEV_GET_MAX_DOWNSIZE:
                return ((put_user(max_down_size,
                                  (__s32 __user *) arg) == -EFAULT) ?
                                        -EIO :
                                        0);
        case ORANGEFS_DEV_MAP:
                ret = copy_from_user(&user_desc,
                                     (struct ORANGEFS_dev_map_desc __user *)
                                     arg,
                                     sizeof(struct ORANGEFS_dev_map_desc));
                /* WTF -EIO and not -EFAULT? */
                return ret ? -EIO : orangefs_bufmap_initialize(&user_desc);
        case ORANGEFS_DEV_REMOUNT_ALL:
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "%s: got ORANGEFS_DEV_REMOUNT_ALL\n",
                             __func__);

                /*
                 * remount all mounted orangefs volumes to regain the lost
                 * dynamic mount tables (if any) -- NOTE: this is done
                 * without keeping the superblock list locked due to the
                 * upcall/downcall waiting.  also, the request mutex is
                 * used to ensure that no operations will be serviced until
                 * all of the remounts are serviced (to avoid ops between
                 * mounts to fail)
                 */
                ret = mutex_lock_interruptible(&orangefs_request_mutex);
                if (ret < 0)
                        return ret;
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "%s: priority remount in progress\n",
                             __func__);
                spin_lock(&orangefs_superblocks_lock);
                list_for_each_entry(orangefs_sb, &orangefs_superblocks, list) {
                        /*
                         * We have to drop the spinlock, so entries can be
                         * removed.  They can't be freed, though, so we just
                         * keep the forward pointers and zero the back ones -
                         * that way we can get to the rest of the list.
                         */
                        if (!orangefs_sb->list.prev)
                                continue;
                        gossip_debug(GOSSIP_DEV_DEBUG,
                                     "%s: Remounting SB %p\n",
                                     __func__,
                                     orangefs_sb);

                        spin_unlock(&orangefs_superblocks_lock);
                        ret = orangefs_remount(orangefs_sb);
                        spin_lock(&orangefs_superblocks_lock);
                        if (ret) {
                                gossip_debug(GOSSIP_DEV_DEBUG,
                                             "SB %p remount failed\n",
                                             orangefs_sb);
                                break;
                        }
                }
                spin_unlock(&orangefs_superblocks_lock);
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "%s: priority remount complete\n",
                             __func__);
                mutex_unlock(&orangefs_request_mutex);
                return ret;

        case ORANGEFS_DEV_UPSTREAM:
                ret = copy_to_user((void __user *)arg,
                                    &upstream_kmod,
                                    sizeof(upstream_kmod));

                if (ret != 0)
                        return -EIO;
                else
                        return ret;

        case ORANGEFS_DEV_CLIENT_MASK:
                return orangefs_debugfs_new_client_mask((void __user *)arg);
        case ORANGEFS_DEV_CLIENT_STRING:
                return orangefs_debugfs_new_client_string((void __user *)arg);
        case ORANGEFS_DEV_DEBUG:
                return orangefs_debugfs_new_debug((void __user *)arg);
        default:
                return -ENOIOCTLCMD;
        }
        return -ENOIOCTLCMD;
}

static long orangefs_devreq_ioctl(struct file *file,
                               unsigned int command, unsigned long arg)
{
        long ret;

        /* Check for properly constructed commands */
        ret = check_ioctl_command(command);
        if (ret < 0)
                return (int)ret;

        return (int)dispatch_ioctl_command(command, arg);
}

#ifdef CONFIG_COMPAT                /* CONFIG_COMPAT is in .config */

/*  Compat structure for the ORANGEFS_DEV_MAP ioctl */
struct ORANGEFS_dev_map_desc32 {
        compat_uptr_t ptr;
        __s32 total_size;
        __s32 size;
        __s32 count;
};

/*
 * 32 bit user-space apps' ioctl handlers when kernel modules
 * is compiled as a 64 bit one
 */
static long orangefs_devreq_compat_ioctl(struct file *filp, unsigned int cmd,
                                      unsigned long args)
{
        long ret;

        /* Check for properly constructed commands */
        ret = check_ioctl_command(cmd);
        if (ret < 0)
                return ret;
        if (cmd == ORANGEFS_DEV_MAP) {
                struct ORANGEFS_dev_map_desc desc;
                struct ORANGEFS_dev_map_desc32 d32;

                if (copy_from_user(&d32, (void __user *)args, sizeof(d32)))
                        return -EFAULT;

                desc.ptr = compat_ptr(d32.ptr);
                desc.total_size = d32.total_size;
                desc.size = d32.size;
                desc.count = d32.count;
                return orangefs_bufmap_initialize(&desc);
        }
        /* no other ioctl requires translation */
        return dispatch_ioctl_command(cmd, args);
}

#endif /* CONFIG_COMPAT is in .config */

static __poll_t orangefs_devreq_poll(struct file *file,
                                      struct poll_table_struct *poll_table)
{
        __poll_t poll_revent_mask = 0;

        poll_wait(file, &orangefs_request_list_waitq, poll_table);

        if (!list_empty(&orangefs_request_list))
                poll_revent_mask |= EPOLLIN;
        return poll_revent_mask;
}

/* the assigned character device major number */
static int orangefs_dev_major;

static const struct file_operations orangefs_devreq_file_operations = {
        .owner = THIS_MODULE,
        .read = orangefs_devreq_read,
        .write_iter = orangefs_devreq_write_iter,
        .open = orangefs_devreq_open,
        .release = orangefs_devreq_release,
        .unlocked_ioctl = orangefs_devreq_ioctl,

#ifdef CONFIG_COMPAT                /* CONFIG_COMPAT is in .config */
        .compat_ioctl = orangefs_devreq_compat_ioctl,
#endif
        .poll = orangefs_devreq_poll
};

/*
 * Initialize orangefs device specific state:
 * Must be called at module load time only
 */
int orangefs_dev_init(void)
{
        /* register orangefs-req device  */
        orangefs_dev_major = register_chrdev(0,
                                          ORANGEFS_REQDEVICE_NAME,
                                          &orangefs_devreq_file_operations);
        if (orangefs_dev_major < 0) {
                gossip_debug(GOSSIP_DEV_DEBUG,
                             "Failed to register /dev/%s (error %d)\n",
                             ORANGEFS_REQDEVICE_NAME, orangefs_dev_major);
                return orangefs_dev_major;
        }

        gossip_debug(GOSSIP_DEV_DEBUG,
                     "*** /dev/%s character device registered ***\n",
                     ORANGEFS_REQDEVICE_NAME);
        gossip_debug(GOSSIP_DEV_DEBUG, "'mknod /dev/%s c %d 0'.\n",
                     ORANGEFS_REQDEVICE_NAME, orangefs_dev_major);
        return 0;
}

void orangefs_dev_cleanup(void)
{
        unregister_chrdev(orangefs_dev_major, ORANGEFS_REQDEVICE_NAME);
        gossip_debug(GOSSIP_DEV_DEBUG,
                     "*** /dev/%s character device unregistered ***\n",
                     ORANGEFS_REQDEVICE_NAME);
}
















































































































   10 






   10 
    7 



    7 
    7 

    7 










    7 



    4 



















   12 




















    2 






    2 
    9 



    2 







    9 














    9 























    1 




    3 







    9 
    1 


    8 
    1 




    3 










    2 



    7 


    8 












    7 


















   12 






















    2 
   12 
















    2 

















   10 


   10 











   12 






   12 



   12 

   12 

   12 




   12 



   12 





































































































































































































































   16 











   15 
    1 




   16 







    1 






   15 









   15 
   14 







   12 




   12 





    2 


   10 





1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
// SPDX-License-Identifier: GPL-2.0
/*
 * Copyright (C) 2010, 2023 Red Hat, Inc.
 * All Rights Reserved.
 */
#include "xfs.h"
#include "xfs_shared.h"
#include "xfs_format.h"
#include "xfs_log_format.h"
#include "xfs_trans_resv.h"
#include "xfs_trans.h"
#include "xfs_mount.h"
#include "xfs_btree.h"
#include "xfs_alloc_btree.h"
#include "xfs_alloc.h"
#include "xfs_discard.h"
#include "xfs_error.h"
#include "xfs_extent_busy.h"
#include "xfs_trace.h"
#include "xfs_log.h"
#include "xfs_ag.h"
#include "xfs_health.h"
#include "xfs_rtbitmap.h"

/*
 * Notes on an efficient, low latency fstrim algorithm
 *
 * We need to walk the filesystem free space and issue discards on the free
 * space that meet the search criteria (size and location). We cannot issue
 * discards on extents that might be in use, or are so recently in use they are
 * still marked as busy. To serialise against extent state changes whilst we are
 * gathering extents to trim, we must hold the AGF lock to lock out other
 * allocations and extent free operations that might change extent state.
 *
 * However, we cannot just hold the AGF for the entire AG free space walk whilst
 * we issue discards on each free space that is found. Storage devices can have
 * extremely slow discard implementations (e.g. ceph RBD) and so walking a
 * couple of million free extents and issuing synchronous discards on each
 * extent can take a *long* time. Whilst we are doing this walk, nothing else
 * can access the AGF, and we can stall transactions and hence the log whilst
 * modifications wait for the AGF lock to be released. This can lead hung tasks
 * kicking the hung task timer and rebooting the system. This is bad.
 *
 * Hence we need to take a leaf from the bulkstat playbook. It takes the AGI
 * lock, gathers a range of inode cluster buffers that are allocated, drops the
 * AGI lock and then reads all the inode cluster buffers and processes them. It
 * loops doing this, using a cursor to keep track of where it is up to in the AG
 * for each iteration to restart the INOBT lookup from.
 *
 * We can't do this exactly with free space - once we drop the AGF lock, the
 * state of the free extent is out of our control and we cannot run a discard
 * safely on it in this situation. Unless, of course, we've marked the free
 * extent as busy and undergoing a discard operation whilst we held the AGF
 * locked.
 *
 * This is exactly how online discard works - free extents are marked busy when
 * they are freed, and once the extent free has been committed to the journal,
 * the busy extent record is marked as "undergoing discard" and the discard is
 * then issued on the free extent. Once the discard completes, the busy extent
 * record is removed and the extent is able to be allocated again.
 *
 * In the context of fstrim, if we find a free extent we need to discard, we
 * don't have to discard it immediately. All we need to do it record that free
 * extent as being busy and under discard, and all the allocation routines will
 * now avoid trying to allocate it. Hence if we mark the extent as busy under
 * the AGF lock, we can safely discard it without holding the AGF lock because
 * nothing will attempt to allocate that free space until the discard completes.
 *
 * This also allows us to issue discards asynchronously like we do with online
 * discard, and so for fast devices fstrim will run much faster as we can have
 * multiple discard operations in flight at once, as well as pipeline the free
 * extent search so that it overlaps in flight discard IO.
 */

struct workqueue_struct *xfs_discard_wq;

static void
xfs_discard_endio_work(
        struct work_struct        *work)
{
        struct xfs_busy_extents        *extents =
                container_of(work, struct xfs_busy_extents, endio_work);

        xfs_extent_busy_clear(extents->mount, &extents->extent_list, false);
        kfree(extents->owner);
}

/*
 * Queue up the actual completion to a thread to avoid IRQ-safe locking for
 * pagb_lock.
 */
static void
xfs_discard_endio(
        struct bio                *bio)
{
        struct xfs_busy_extents        *extents = bio->bi_private;

        INIT_WORK(&extents->endio_work, xfs_discard_endio_work);
        queue_work(xfs_discard_wq, &extents->endio_work);
        bio_put(bio);
}

/*
 * Walk the discard list and issue discards on all the busy extents in the
 * list. We plug and chain the bios so that we only need a single completion
 * call to clear all the busy extents once the discards are complete.
 */
int
xfs_discard_extents(
        struct xfs_mount        *mp,
        struct xfs_busy_extents        *extents)
{
        struct xfs_extent_busy        *busyp;
        struct bio                *bio = NULL;
        struct blk_plug                plug;
        int                        error = 0;

        blk_start_plug(&plug);
        list_for_each_entry(busyp, &extents->extent_list, list) {
                trace_xfs_discard_extent(mp, busyp->agno, busyp->bno,
                                         busyp->length);

                error = __blkdev_issue_discard(mp->m_ddev_targp->bt_bdev,
                                XFS_AGB_TO_DADDR(mp, busyp->agno, busyp->bno),
                                XFS_FSB_TO_BB(mp, busyp->length),
                                GFP_KERNEL, &bio);
                if (error && error != -EOPNOTSUPP) {
                        xfs_info(mp,
         "discard failed for extent [0x%llx,%u], error %d",
                                 (unsigned long long)busyp->bno,
                                 busyp->length,
                                 error);
                        break;
                }
        }

        if (bio) {
                bio->bi_private = extents;
                bio->bi_end_io = xfs_discard_endio;
                submit_bio(bio);
        } else {
                xfs_discard_endio_work(&extents->endio_work);
        }
        blk_finish_plug(&plug);

        return error;
}

struct xfs_trim_cur {
        xfs_agblock_t        start;
        xfs_extlen_t        count;
        xfs_agblock_t        end;
        xfs_extlen_t        minlen;
        bool                by_bno;
};

static int
xfs_trim_gather_extents(
        struct xfs_perag        *pag,
        struct xfs_trim_cur        *tcur,
        struct xfs_busy_extents        *extents)
{
        struct xfs_mount        *mp = pag->pag_mount;
        struct xfs_trans        *tp;
        struct xfs_btree_cur        *cur;
        struct xfs_buf                *agbp;
        int                        error;
        int                        i;
        int                        batch = 100;

        /*
         * Force out the log.  This means any transactions that might have freed
         * space before we take the AGF buffer lock are now on disk, and the
         * volatile disk cache is flushed.
         */
        xfs_log_force(mp, XFS_LOG_SYNC);

        error = xfs_trans_alloc_empty(mp, &tp);
        if (error)
                return error;

        error = xfs_alloc_read_agf(pag, tp, 0, &agbp);
        if (error)
                goto out_trans_cancel;

        if (tcur->by_bno) {
                /* sub-AG discard request always starts at tcur->start */
                cur = xfs_bnobt_init_cursor(mp, tp, agbp, pag);
                error = xfs_alloc_lookup_le(cur, tcur->start, 0, &i);
                if (!error && !i)
                        error = xfs_alloc_lookup_ge(cur, tcur->start, 0, &i);
        } else if (tcur->start == 0) {
                /* first time through a by-len starts with max length */
                cur = xfs_cntbt_init_cursor(mp, tp, agbp, pag);
                error = xfs_alloc_lookup_ge(cur, 0, tcur->count, &i);
        } else {
                /* nth time through a by-len starts where we left off */
                cur = xfs_cntbt_init_cursor(mp, tp, agbp, pag);
                error = xfs_alloc_lookup_le(cur, tcur->start, tcur->count, &i);
        }
        if (error)
                goto out_del_cursor;
        if (i == 0) {
                /* nothing of that length left in the AG, we are done */
                tcur->count = 0;
                goto out_del_cursor;
        }

        /*
         * Loop until we are done with all extents that are large
         * enough to be worth discarding or we hit batch limits.
         */
        while (i) {
                xfs_agblock_t        fbno;
                xfs_extlen_t        flen;

                error = xfs_alloc_get_rec(cur, &fbno, &flen, &i);
                if (error)
                        break;
                if (XFS_IS_CORRUPT(mp, i != 1)) {
                        xfs_btree_mark_sick(cur);
                        error = -EFSCORRUPTED;
                        break;
                }

                if (--batch <= 0) {
                        /*
                         * Update the cursor to point at this extent so we
                         * restart the next batch from this extent.
                         */
                        tcur->start = fbno;
                        tcur->count = flen;
                        break;
                }

                /*
                 * If the extent is entirely outside of the range we are
                 * supposed to skip it.  Do not bother to trim down partially
                 * overlapping ranges for now.
                 */
                if (fbno + flen < tcur->start) {
                        trace_xfs_discard_exclude(mp, pag->pag_agno, fbno, flen);
                        goto next_extent;
                }
                if (fbno > tcur->end) {
                        trace_xfs_discard_exclude(mp, pag->pag_agno, fbno, flen);
                        if (tcur->by_bno) {
                                tcur->count = 0;
                                break;
                        }
                        goto next_extent;
                }

                /* Trim the extent returned to the range we want. */
                if (fbno < tcur->start) {
                        flen -= tcur->start - fbno;
                        fbno = tcur->start;
                }
                if (fbno + flen > tcur->end + 1)
                        flen = tcur->end - fbno + 1;

                /* Too small?  Give up. */
                if (flen < tcur->minlen) {
                        trace_xfs_discard_toosmall(mp, pag->pag_agno, fbno, flen);
                        if (tcur->by_bno)
                                goto next_extent;
                        tcur->count = 0;
                        break;
                }

                /*
                 * If any blocks in the range are still busy, skip the
                 * discard and try again the next time.
                 */
                if (xfs_extent_busy_search(mp, pag, fbno, flen)) {
                        trace_xfs_discard_busy(mp, pag->pag_agno, fbno, flen);
                        goto next_extent;
                }

                xfs_extent_busy_insert_discard(pag, fbno, flen,
                                &extents->extent_list);
next_extent:
                if (tcur->by_bno)
                        error = xfs_btree_increment(cur, 0, &i);
                else
                        error = xfs_btree_decrement(cur, 0, &i);
                if (error)
                        break;

                /*
                 * If there's no more records in the tree, we are done. Set the
                 * cursor block count to 0 to indicate to the caller that there
                 * is no more extents to search.
                 */
                if (i == 0)
                        tcur->count = 0;
        }

        /*
         * If there was an error, release all the gathered busy extents because
         * we aren't going to issue a discard on them any more.
         */
        if (error)
                xfs_extent_busy_clear(mp, &extents->extent_list, false);
out_del_cursor:
        xfs_btree_del_cursor(cur, error);
out_trans_cancel:
        xfs_trans_cancel(tp);
        return error;
}

static bool
xfs_trim_should_stop(void)
{
        return fatal_signal_pending(current) || freezing(current);
}

/*
 * Iterate the free list gathering extents and discarding them. We need a cursor
 * for the repeated iteration of gather/discard loop, so use the longest extent
 * we found in the last batch as the key to start the next.
 */
static int
xfs_trim_perag_extents(
        struct xfs_perag        *pag,
        xfs_agblock_t                start,
        xfs_agblock_t                end,
        xfs_extlen_t                minlen)
{
        struct xfs_trim_cur        tcur = {
                .start                = start,
                .count                = pag->pagf_longest,
                .end                = end,
                .minlen                = minlen,
        };
        int                        error = 0;

        if (start != 0 || end != pag->block_count)
                tcur.by_bno = true;

        do {
                struct xfs_busy_extents        *extents;

                extents = kzalloc(sizeof(*extents), GFP_KERNEL);
                if (!extents) {
                        error = -ENOMEM;
                        break;
                }

                extents->mount = pag->pag_mount;
                extents->owner = extents;
                INIT_LIST_HEAD(&extents->extent_list);

                error = xfs_trim_gather_extents(pag, &tcur, extents);
                if (error) {
                        kfree(extents);
                        break;
                }

                /*
                 * We hand the extent list to the discard function here so the
                 * discarded extents can be removed from the busy extent list.
                 * This allows the discards to run asynchronously with gathering
                 * the next round of extents to discard.
                 *
                 * However, we must ensure that we do not reference the extent
                 * list  after this function call, as it may have been freed by
                 * the time control returns to us.
                 */
                error = xfs_discard_extents(pag->pag_mount, extents);
                if (error)
                        break;

                if (xfs_trim_should_stop())
                        break;

        } while (tcur.count != 0);

        return error;

}

static int
xfs_trim_datadev_extents(
        struct xfs_mount        *mp,
        xfs_daddr_t                start,
        xfs_daddr_t                end,
        xfs_extlen_t                minlen)
{
        xfs_agnumber_t                start_agno, end_agno;
        xfs_agblock_t                start_agbno, end_agbno;
        xfs_daddr_t                ddev_end;
        struct xfs_perag        *pag;
        int                        last_error = 0, error;

        ddev_end = min_t(xfs_daddr_t, end,
                         XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1);

        start_agno = xfs_daddr_to_agno(mp, start);
        start_agbno = xfs_daddr_to_agbno(mp, start);
        end_agno = xfs_daddr_to_agno(mp, ddev_end);
        end_agbno = xfs_daddr_to_agbno(mp, ddev_end);

        for_each_perag_range(mp, start_agno, end_agno, pag) {
                xfs_agblock_t        agend = pag->block_count;

                if (start_agno == end_agno)
                        agend = end_agbno;
                error = xfs_trim_perag_extents(pag, start_agbno, agend, minlen);
                if (error)
                        last_error = error;

                if (xfs_trim_should_stop()) {
                        xfs_perag_rele(pag);
                        break;
                }
                start_agbno = 0;
        }

        return last_error;
}

#ifdef CONFIG_XFS_RT
struct xfs_trim_rtdev {
        /* list of rt extents to free */
        struct list_head        extent_list;

        /* minimum length that caller allows us to trim */
        xfs_rtblock_t                minlen_fsb;

        /* restart point for the rtbitmap walk */
        xfs_rtxnum_t                restart_rtx;

        /* stopping point for the current rtbitmap walk */
        xfs_rtxnum_t                stop_rtx;
};

struct xfs_rtx_busy {
        struct list_head        list;
        xfs_rtblock_t                bno;
        xfs_rtblock_t                length;
};

static void
xfs_discard_free_rtdev_extents(
        struct xfs_trim_rtdev        *tr)
{
        struct xfs_rtx_busy        *busyp, *n;

        list_for_each_entry_safe(busyp, n, &tr->extent_list, list) {
                list_del_init(&busyp->list);
                kfree(busyp);
        }
}

/*
 * Walk the discard list and issue discards on all the busy extents in the
 * list. We plug and chain the bios so that we only need a single completion
 * call to clear all the busy extents once the discards are complete.
 */
static int
xfs_discard_rtdev_extents(
        struct xfs_mount        *mp,
        struct xfs_trim_rtdev        *tr)
{
        struct block_device        *bdev = mp->m_rtdev_targp->bt_bdev;
        struct xfs_rtx_busy        *busyp;
        struct bio                *bio = NULL;
        struct blk_plug                plug;
        xfs_rtblock_t                start = NULLRTBLOCK, length = 0;
        int                        error = 0;

        blk_start_plug(&plug);
        list_for_each_entry(busyp, &tr->extent_list, list) {
                if (start == NULLRTBLOCK)
                        start = busyp->bno;
                length += busyp->length;

                trace_xfs_discard_rtextent(mp, busyp->bno, busyp->length);

                error = __blkdev_issue_discard(bdev,
                                XFS_FSB_TO_BB(mp, busyp->bno),
                                XFS_FSB_TO_BB(mp, busyp->length),
                                GFP_NOFS, &bio);
                if (error)
                        break;
        }
        xfs_discard_free_rtdev_extents(tr);

        if (bio) {
                error = submit_bio_wait(bio);
                if (error == -EOPNOTSUPP)
                        error = 0;
                if (error)
                        xfs_info(mp,
         "discard failed for rtextent [0x%llx,%llu], error %d",
                                 (unsigned long long)start,
                                 (unsigned long long)length,
                                 error);
                bio_put(bio);
        }
        blk_finish_plug(&plug);

        return error;
}

static int
xfs_trim_gather_rtextent(
        struct xfs_mount                *mp,
        struct xfs_trans                *tp,
        const struct xfs_rtalloc_rec        *rec,
        void                                *priv)
{
        struct xfs_trim_rtdev                *tr = priv;
        struct xfs_rtx_busy                *busyp;
        xfs_rtblock_t                        rbno, rlen;

        if (rec->ar_startext > tr->stop_rtx) {
                /*
                 * If we've scanned a large number of rtbitmap blocks, update
                 * the cursor to point at this extent so we restart the next
                 * batch from this extent.
                 */
                tr->restart_rtx = rec->ar_startext;
                return -ECANCELED;
        }

        rbno = xfs_rtx_to_rtb(mp, rec->ar_startext);
        rlen = xfs_rtx_to_rtb(mp, rec->ar_extcount);

        /* Ignore too small. */
        if (rlen < tr->minlen_fsb) {
                trace_xfs_discard_rttoosmall(mp, rbno, rlen);
                return 0;
        }

        busyp = kzalloc(sizeof(struct xfs_rtx_busy), GFP_KERNEL);
        if (!busyp)
                return -ENOMEM;

        busyp->bno = rbno;
        busyp->length = rlen;
        INIT_LIST_HEAD(&busyp->list);
        list_add_tail(&busyp->list, &tr->extent_list);

        tr->restart_rtx = rec->ar_startext + rec->ar_extcount;
        return 0;
}

static int
xfs_trim_rtdev_extents(
        struct xfs_mount        *mp,
        xfs_daddr_t                start,
        xfs_daddr_t                end,
        xfs_daddr_t                minlen)
{
        struct xfs_trim_rtdev        tr = {
                .minlen_fsb        = XFS_BB_TO_FSB(mp, minlen),
        };
        xfs_rtxnum_t                low, high;
        struct xfs_trans        *tp;
        xfs_daddr_t                rtdev_daddr;
        int                        error;

        INIT_LIST_HEAD(&tr.extent_list);

        /* Shift the start and end downwards to match the rt device. */
        rtdev_daddr = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks);
        if (start > rtdev_daddr)
                start -= rtdev_daddr;
        else
                start = 0;

        if (end <= rtdev_daddr)
                return 0;
        end -= rtdev_daddr;

        error = xfs_trans_alloc_empty(mp, &tp);
        if (error)
                return error;

        end = min_t(xfs_daddr_t, end,
                        XFS_FSB_TO_BB(mp, mp->m_sb.sb_rblocks) - 1);

        /* Convert the rt blocks to rt extents */
        low = xfs_rtb_to_rtxup(mp, XFS_BB_TO_FSB(mp, start));
        high = xfs_rtb_to_rtx(mp, XFS_BB_TO_FSBT(mp, end));

        /*
         * Walk the free ranges between low and high.  The query_range function
         * trims the extents returned.
         */
        do {
                tr.stop_rtx = low + (mp->m_sb.sb_blocksize * NBBY);
                xfs_rtbitmap_lock_shared(mp, XFS_RBMLOCK_BITMAP);
                error = xfs_rtalloc_query_range(mp, tp, low, high,
                                xfs_trim_gather_rtextent, &tr);

                if (error == -ECANCELED)
                        error = 0;
                if (error) {
                        xfs_rtbitmap_unlock_shared(mp, XFS_RBMLOCK_BITMAP);
                        xfs_discard_free_rtdev_extents(&tr);
                        break;
                }

                if (list_empty(&tr.extent_list)) {
                        xfs_rtbitmap_unlock_shared(mp, XFS_RBMLOCK_BITMAP);
                        break;
                }

                error = xfs_discard_rtdev_extents(mp, &tr);
                xfs_rtbitmap_unlock_shared(mp, XFS_RBMLOCK_BITMAP);
                if (error)
                        break;

                low = tr.restart_rtx;
        } while (!xfs_trim_should_stop() && low <= high);

        xfs_trans_cancel(tp);
        return error;
}
#else
# define xfs_trim_rtdev_extents(...)        (-EOPNOTSUPP)
#endif /* CONFIG_XFS_RT */

/*
 * trim a range of the filesystem.
 *
 * Note: the parameters passed from userspace are byte ranges into the
 * filesystem which does not match to the format we use for filesystem block
 * addressing. FSB addressing is sparse (AGNO|AGBNO), while the incoming format
 * is a linear address range. Hence we need to use DADDR based conversions and
 * comparisons for determining the correct offset and regions to trim.
 *
 * The realtime device is mapped into the FITRIM "address space" immediately
 * after the data device.
 */
int
xfs_ioc_trim(
        struct xfs_mount                *mp,
        struct fstrim_range __user        *urange)
{
        unsigned int                granularity =
                bdev_discard_granularity(mp->m_ddev_targp->bt_bdev);
        struct block_device        *rt_bdev = NULL;
        struct fstrim_range        range;
        xfs_daddr_t                start, end;
        xfs_extlen_t                minlen;
        xfs_rfsblock_t                max_blocks;
        int                        error, last_error = 0;

        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
        if (mp->m_rtdev_targp &&
            bdev_max_discard_sectors(mp->m_rtdev_targp->bt_bdev))
                rt_bdev = mp->m_rtdev_targp->bt_bdev;
        if (!bdev_max_discard_sectors(mp->m_ddev_targp->bt_bdev) && !rt_bdev)
                return -EOPNOTSUPP;

        if (rt_bdev)
                granularity = max(granularity,
                                  bdev_discard_granularity(rt_bdev));

        /*
         * We haven't recovered the log, so we cannot use our bnobt-guided
         * storage zapping commands.
         */
        if (xfs_has_norecovery(mp))
                return -EROFS;

        if (copy_from_user(&range, urange, sizeof(range)))
                return -EFAULT;

        range.minlen = max_t(u64, granularity, range.minlen);
        minlen = XFS_B_TO_FSB(mp, range.minlen);

        /*
         * Truncating down the len isn't actually quite correct, but using
         * BBTOB would mean we trivially get overflows for values
         * of ULLONG_MAX or slightly lower.  And ULLONG_MAX is the default
         * used by the fstrim application.  In the end it really doesn't
         * matter as trimming blocks is an advisory interface.
         */
        max_blocks = mp->m_sb.sb_dblocks + mp->m_sb.sb_rblocks;
        if (range.start >= XFS_FSB_TO_B(mp, max_blocks) ||
            range.minlen > XFS_FSB_TO_B(mp, mp->m_ag_max_usable) ||
            range.len < mp->m_sb.sb_blocksize)
                return -EINVAL;

        start = BTOBB(range.start);
        end = start + BTOBBT(range.len) - 1;

        if (bdev_max_discard_sectors(mp->m_ddev_targp->bt_bdev)) {
                error = xfs_trim_datadev_extents(mp, start, end, minlen);
                if (error)
                        last_error = error;
        }

        if (rt_bdev && !xfs_trim_should_stop()) {
                error = xfs_trim_rtdev_extents(mp, start, end, minlen);
                if (error)
                        last_error = error;
        }

        if (last_error)
                return last_error;

        range.len = min_t(unsigned long long, range.len,
                          XFS_FSB_TO_B(mp, max_blocks) - range.start);
        if (copy_to_user(urange, &range, sizeof(range)))
                return -EFAULT;
        return 0;
}



















































































































































    1 
























































































































































    2 



    2 









































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    1 






    1 

















































































































    1 
    1 
































    1 






    2 



















    2 






















    2 







    1 














    2 


    2 










    2 





    1 




    1 


    1 










    1 








    1 

    1 





























































































































































































































































































































































































































































































































    2 













    2 









































































































































































































































































































































































































































































































































































































































































































































































































































    1 










































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (C) 2009 Red Hat, Inc.
 * Copyright (C) 2006 Rusty Russell IBM Corporation
 *
 * Author: Michael S. Tsirkin <mst@redhat.com>
 *
 * Inspiration, some code, and most witty comments come from
 * Documentation/virtual/lguest/lguest.c, by Rusty Russell
 *
 * Generic code for virtio server in host kernel.
 */

#include <linux/eventfd.h>
#include <linux/vhost.h>
#include <linux/uio.h>
#include <linux/mm.h>
#include <linux/miscdevice.h>
#include <linux/mutex.h>
#include <linux/poll.h>
#include <linux/file.h>
#include <linux/highmem.h>
#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/kthread.h>
#include <linux/module.h>
#include <linux/sort.h>
#include <linux/sched/mm.h>
#include <linux/sched/signal.h>
#include <linux/sched/vhost_task.h>
#include <linux/interval_tree_generic.h>
#include <linux/nospec.h>
#include <linux/kcov.h>

#include "vhost.h"

static ushort max_mem_regions = 64;
module_param(max_mem_regions, ushort, 0444);
MODULE_PARM_DESC(max_mem_regions,
        "Maximum number of memory regions in memory map. (default: 64)");
static int max_iotlb_entries = 2048;
module_param(max_iotlb_entries, int, 0444);
MODULE_PARM_DESC(max_iotlb_entries,
        "Maximum number of iotlb entries. (default: 2048)");

enum {
        VHOST_MEMORY_F_LOG = 0x1,
};

#define vhost_used_event(vq) ((__virtio16 __user *)&vq->avail->ring[vq->num])
#define vhost_avail_event(vq) ((__virtio16 __user *)&vq->used->ring[vq->num])

#ifdef CONFIG_VHOST_CROSS_ENDIAN_LEGACY
static void vhost_disable_cross_endian(struct vhost_virtqueue *vq)
{
        vq->user_be = !virtio_legacy_is_little_endian();
}

static void vhost_enable_cross_endian_big(struct vhost_virtqueue *vq)
{
        vq->user_be = true;
}

static void vhost_enable_cross_endian_little(struct vhost_virtqueue *vq)
{
        vq->user_be = false;
}

static long vhost_set_vring_endian(struct vhost_virtqueue *vq, int __user *argp)
{
        struct vhost_vring_state s;

        if (vq->private_data)
                return -EBUSY;

        if (copy_from_user(&s, argp, sizeof(s)))
                return -EFAULT;

        if (s.num != VHOST_VRING_LITTLE_ENDIAN &&
            s.num != VHOST_VRING_BIG_ENDIAN)
                return -EINVAL;

        if (s.num == VHOST_VRING_BIG_ENDIAN)
                vhost_enable_cross_endian_big(vq);
        else
                vhost_enable_cross_endian_little(vq);

        return 0;
}

static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx,
                                   int __user *argp)
{
        struct vhost_vring_state s = {
                .index = idx,
                .num = vq->user_be
        };

        if (copy_to_user(argp, &s, sizeof(s)))
                return -EFAULT;

        return 0;
}

static void vhost_init_is_le(struct vhost_virtqueue *vq)
{
        /* Note for legacy virtio: user_be is initialized at reset time
         * according to the host endianness. If userspace does not set an
         * explicit endianness, the default behavior is native endian, as
         * expected by legacy virtio.
         */
        vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1) || !vq->user_be;
}
#else
static void vhost_disable_cross_endian(struct vhost_virtqueue *vq)
{
}

static long vhost_set_vring_endian(struct vhost_virtqueue *vq, int __user *argp)
{
        return -ENOIOCTLCMD;
}

static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx,
                                   int __user *argp)
{
        return -ENOIOCTLCMD;
}

static void vhost_init_is_le(struct vhost_virtqueue *vq)
{
        vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1)
                || virtio_legacy_is_little_endian();
}
#endif /* CONFIG_VHOST_CROSS_ENDIAN_LEGACY */

static void vhost_reset_is_le(struct vhost_virtqueue *vq)
{
        vhost_init_is_le(vq);
}

struct vhost_flush_struct {
        struct vhost_work work;
        struct completion wait_event;
};

static void vhost_flush_work(struct vhost_work *work)
{
        struct vhost_flush_struct *s;

        s = container_of(work, struct vhost_flush_struct, work);
        complete(&s->wait_event);
}

static void vhost_poll_func(struct file *file, wait_queue_head_t *wqh,
                            poll_table *pt)
{
        struct vhost_poll *poll;

        poll = container_of(pt, struct vhost_poll, table);
        poll->wqh = wqh;
        add_wait_queue(wqh, &poll->wait);
}

static int vhost_poll_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync,
                             void *key)
{
        struct vhost_poll *poll = container_of(wait, struct vhost_poll, wait);
        struct vhost_work *work = &poll->work;

        if (!(key_to_poll(key) & poll->mask))
                return 0;

        if (!poll->dev->use_worker)
                work->fn(work);
        else
                vhost_poll_queue(poll);

        return 0;
}

void vhost_work_init(struct vhost_work *work, vhost_work_fn_t fn)
{
        clear_bit(VHOST_WORK_QUEUED, &work->flags);
        work->fn = fn;
}
EXPORT_SYMBOL_GPL(vhost_work_init);

/* Init poll structure */
void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
                     __poll_t mask, struct vhost_dev *dev,
                     struct vhost_virtqueue *vq)
{
        init_waitqueue_func_entry(&poll->wait, vhost_poll_wakeup);
        init_poll_funcptr(&poll->table, vhost_poll_func);
        poll->mask = mask;
        poll->dev = dev;
        poll->wqh = NULL;
        poll->vq = vq;

        vhost_work_init(&poll->work, fn);
}
EXPORT_SYMBOL_GPL(vhost_poll_init);

/* Start polling a file. We add ourselves to file's wait queue. The caller must
 * keep a reference to a file until after vhost_poll_stop is called. */
int vhost_poll_start(struct vhost_poll *poll, struct file *file)
{
        __poll_t mask;

        if (poll->wqh)
                return 0;

        mask = vfs_poll(file, &poll->table);
        if (mask)
                vhost_poll_wakeup(&poll->wait, 0, 0, poll_to_key(mask));
        if (mask & EPOLLERR) {
                vhost_poll_stop(poll);
                return -EINVAL;
        }

        return 0;
}
EXPORT_SYMBOL_GPL(vhost_poll_start);

/* Stop polling a file. After this function returns, it becomes safe to drop the
 * file reference. You must also flush afterwards. */
void vhost_poll_stop(struct vhost_poll *poll)
{
        if (poll->wqh) {
                remove_wait_queue(poll->wqh, &poll->wait);
                poll->wqh = NULL;
        }
}
EXPORT_SYMBOL_GPL(vhost_poll_stop);

static void vhost_worker_queue(struct vhost_worker *worker,
                               struct vhost_work *work)
{
        if (!test_and_set_bit(VHOST_WORK_QUEUED, &work->flags)) {
                /* We can only add the work to the list after we're
                 * sure it was not in the list.
                 * test_and_set_bit() implies a memory barrier.
                 */
                llist_add(&work->node, &worker->work_list);
                vhost_task_wake(worker->vtsk);
        }
}

bool vhost_vq_work_queue(struct vhost_virtqueue *vq, struct vhost_work *work)
{
        struct vhost_worker *worker;
        bool queued = false;

        rcu_read_lock();
        worker = rcu_dereference(vq->worker);
        if (worker) {
                queued = true;
                vhost_worker_queue(worker, work);
        }
        rcu_read_unlock();

        return queued;
}
EXPORT_SYMBOL_GPL(vhost_vq_work_queue);

/**
 * __vhost_worker_flush - flush a worker
 * @worker: worker to flush
 *
 * The worker's flush_mutex must be held.
 */
static void __vhost_worker_flush(struct vhost_worker *worker)
{
        struct vhost_flush_struct flush;

        if (!worker->attachment_cnt || worker->killed)
                return;

        init_completion(&flush.wait_event);
        vhost_work_init(&flush.work, vhost_flush_work);

        vhost_worker_queue(worker, &flush.work);
        /*
         * Drop mutex in case our worker is killed and it needs to take the
         * mutex to force cleanup.
         */
        mutex_unlock(&worker->mutex);
        wait_for_completion(&flush.wait_event);
        mutex_lock(&worker->mutex);
}

static void vhost_worker_flush(struct vhost_worker *worker)
{
        mutex_lock(&worker->mutex);
        __vhost_worker_flush(worker);
        mutex_unlock(&worker->mutex);
}

void vhost_dev_flush(struct vhost_dev *dev)
{
        struct vhost_worker *worker;
        unsigned long i;

        xa_for_each(&dev->worker_xa, i, worker)
                vhost_worker_flush(worker);
}
EXPORT_SYMBOL_GPL(vhost_dev_flush);

/* A lockless hint for busy polling code to exit the loop */
bool vhost_vq_has_work(struct vhost_virtqueue *vq)
{
        struct vhost_worker *worker;
        bool has_work = false;

        rcu_read_lock();
        worker = rcu_dereference(vq->worker);
        if (worker && !llist_empty(&worker->work_list))
                has_work = true;
        rcu_read_unlock();

        return has_work;
}
EXPORT_SYMBOL_GPL(vhost_vq_has_work);

void vhost_poll_queue(struct vhost_poll *poll)
{
        vhost_vq_work_queue(poll->vq, &poll->work);
}
EXPORT_SYMBOL_GPL(vhost_poll_queue);

static void __vhost_vq_meta_reset(struct vhost_virtqueue *vq)
{
        int j;

        for (j = 0; j < VHOST_NUM_ADDRS; j++)
                vq->meta_iotlb[j] = NULL;
}

static void vhost_vq_meta_reset(struct vhost_dev *d)
{
        int i;

        for (i = 0; i < d->nvqs; ++i)
                __vhost_vq_meta_reset(d->vqs[i]);
}

static void vhost_vring_call_reset(struct vhost_vring_call *call_ctx)
{
        call_ctx->ctx = NULL;
        memset(&call_ctx->producer, 0x0, sizeof(struct irq_bypass_producer));
}

bool vhost_vq_is_setup(struct vhost_virtqueue *vq)
{
        return vq->avail && vq->desc && vq->used && vhost_vq_access_ok(vq);
}
EXPORT_SYMBOL_GPL(vhost_vq_is_setup);

static void vhost_vq_reset(struct vhost_dev *dev,
                           struct vhost_virtqueue *vq)
{
        vq->num = 1;
        vq->desc = NULL;
        vq->avail = NULL;
        vq->used = NULL;
        vq->last_avail_idx = 0;
        vq->avail_idx = 0;
        vq->last_used_idx = 0;
        vq->signalled_used = 0;
        vq->signalled_used_valid = false;
        vq->used_flags = 0;
        vq->log_used = false;
        vq->log_addr = -1ull;
        vq->private_data = NULL;
        vq->acked_features = 0;
        vq->acked_backend_features = 0;
        vq->log_base = NULL;
        vq->error_ctx = NULL;
        vq->kick = NULL;
        vq->log_ctx = NULL;
        vhost_disable_cross_endian(vq);
        vhost_reset_is_le(vq);
        vq->busyloop_timeout = 0;
        vq->umem = NULL;
        vq->iotlb = NULL;
        rcu_assign_pointer(vq->worker, NULL);
        vhost_vring_call_reset(&vq->call_ctx);
        __vhost_vq_meta_reset(vq);
}

static bool vhost_run_work_list(void *data)
{
        struct vhost_worker *worker = data;
        struct vhost_work *work, *work_next;
        struct llist_node *node;

        node = llist_del_all(&worker->work_list);
        if (node) {
                __set_current_state(TASK_RUNNING);

                node = llist_reverse_order(node);
                /* make sure flag is seen after deletion */
                smp_wmb();
                llist_for_each_entry_safe(work, work_next, node, node) {
                        clear_bit(VHOST_WORK_QUEUED, &work->flags);
                        kcov_remote_start_common(worker->kcov_handle);
                        work->fn(work);
                        kcov_remote_stop();
                        cond_resched();
                }
        }

        return !!node;
}

static void vhost_worker_killed(void *data)
{
        struct vhost_worker *worker = data;
        struct vhost_dev *dev = worker->dev;
        struct vhost_virtqueue *vq;
        int i, attach_cnt = 0;

        mutex_lock(&worker->mutex);
        worker->killed = true;

        for (i = 0; i < dev->nvqs; i++) {
                vq = dev->vqs[i];

                mutex_lock(&vq->mutex);
                if (worker ==
                    rcu_dereference_check(vq->worker,
                                          lockdep_is_held(&vq->mutex))) {
                        rcu_assign_pointer(vq->worker, NULL);
                        attach_cnt++;
                }
                mutex_unlock(&vq->mutex);
        }

        worker->attachment_cnt -= attach_cnt;
        if (attach_cnt)
                synchronize_rcu();
        /*
         * Finish vhost_worker_flush calls and any other works that snuck in
         * before the synchronize_rcu.
         */
        vhost_run_work_list(worker);
        mutex_unlock(&worker->mutex);
}

static void vhost_vq_free_iovecs(struct vhost_virtqueue *vq)
{
        kfree(vq->indirect);
        vq->indirect = NULL;
        kfree(vq->log);
        vq->log = NULL;
        kfree(vq->heads);
        vq->heads = NULL;
}

/* Helper to allocate iovec buffers for all vqs. */
static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
{
        struct vhost_virtqueue *vq;
        int i;

        for (i = 0; i < dev->nvqs; ++i) {
                vq = dev->vqs[i];
                vq->indirect = kmalloc_array(UIO_MAXIOV,
                                             sizeof(*vq->indirect),
                                             GFP_KERNEL);
                vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
                                        GFP_KERNEL);
                vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
                                          GFP_KERNEL);
                if (!vq->indirect || !vq->log || !vq->heads)
                        goto err_nomem;
        }
        return 0;

err_nomem:
        for (; i >= 0; --i)
                vhost_vq_free_iovecs(dev->vqs[i]);
        return -ENOMEM;
}

static void vhost_dev_free_iovecs(struct vhost_dev *dev)
{
        int i;

        for (i = 0; i < dev->nvqs; ++i)
                vhost_vq_free_iovecs(dev->vqs[i]);
}

bool vhost_exceeds_weight(struct vhost_virtqueue *vq,
                          int pkts, int total_len)
{
        struct vhost_dev *dev = vq->dev;

        if ((dev->byte_weight && total_len >= dev->byte_weight) ||
            pkts >= dev->weight) {
                vhost_poll_queue(&vq->poll);
                return true;
        }

        return false;
}
EXPORT_SYMBOL_GPL(vhost_exceeds_weight);

static size_t vhost_get_avail_size(struct vhost_virtqueue *vq,
                                   unsigned int num)
{
        size_t event __maybe_unused =
               vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;

        return size_add(struct_size(vq->avail, ring, num), event);
}

static size_t vhost_get_used_size(struct vhost_virtqueue *vq,
                                  unsigned int num)
{
        size_t event __maybe_unused =
               vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;

        return size_add(struct_size(vq->used, ring, num), event);
}

static size_t vhost_get_desc_size(struct vhost_virtqueue *vq,
                                  unsigned int num)
{
        return sizeof(*vq->desc) * num;
}

void vhost_dev_init(struct vhost_dev *dev,
                    struct vhost_virtqueue **vqs, int nvqs,
                    int iov_limit, int weight, int byte_weight,
                    bool use_worker,
                    int (*msg_handler)(struct vhost_dev *dev, u32 asid,
                                       struct vhost_iotlb_msg *msg))
{
        struct vhost_virtqueue *vq;
        int i;

        dev->vqs = vqs;
        dev->nvqs = nvqs;
        mutex_init(&dev->mutex);
        dev->log_ctx = NULL;
        dev->umem = NULL;
        dev->iotlb = NULL;
        dev->mm = NULL;
        dev->iov_limit = iov_limit;
        dev->weight = weight;
        dev->byte_weight = byte_weight;
        dev->use_worker = use_worker;
        dev->msg_handler = msg_handler;
        init_waitqueue_head(&dev->wait);
        INIT_LIST_HEAD(&dev->read_list);
        INIT_LIST_HEAD(&dev->pending_list);
        spin_lock_init(&dev->iotlb_lock);
        xa_init_flags(&dev->worker_xa, XA_FLAGS_ALLOC);

        for (i = 0; i < dev->nvqs; ++i) {
                vq = dev->vqs[i];
                vq->log = NULL;
                vq->indirect = NULL;
                vq->heads = NULL;
                vq->dev = dev;
                mutex_init(&vq->mutex);
                vhost_vq_reset(dev, vq);
                if (vq->handle_kick)
                        vhost_poll_init(&vq->poll, vq->handle_kick,
                                        EPOLLIN, dev, vq);
        }
}
EXPORT_SYMBOL_GPL(vhost_dev_init);

/* Caller should have device mutex */
long vhost_dev_check_owner(struct vhost_dev *dev)
{
        /* Are you the owner? If not, I don't think you mean to do that */
        return dev->mm == current->mm ? 0 : -EPERM;
}
EXPORT_SYMBOL_GPL(vhost_dev_check_owner);

/* Caller should have device mutex */
bool vhost_dev_has_owner(struct vhost_dev *dev)
{
        return dev->mm;
}
EXPORT_SYMBOL_GPL(vhost_dev_has_owner);

static void vhost_attach_mm(struct vhost_dev *dev)
{
        /* No owner, become one */
        if (dev->use_worker) {
                dev->mm = get_task_mm(current);
        } else {
                /* vDPA device does not use worker thead, so there's
                 * no need to hold the address space for mm. This help
                 * to avoid deadlock in the case of mmap() which may
                 * held the refcnt of the file and depends on release
                 * method to remove vma.
                 */
                dev->mm = current->mm;
                mmgrab(dev->mm);
        }
}

static void vhost_detach_mm(struct vhost_dev *dev)
{
        if (!dev->mm)
                return;

        if (dev->use_worker)
                mmput(dev->mm);
        else
                mmdrop(dev->mm);

        dev->mm = NULL;
}

static void vhost_worker_destroy(struct vhost_dev *dev,
                                 struct vhost_worker *worker)
{
        if (!worker)
                return;

        WARN_ON(!llist_empty(&worker->work_list));
        xa_erase(&dev->worker_xa, worker->id);
        vhost_task_stop(worker->vtsk);
        kfree(worker);
}

static void vhost_workers_free(struct vhost_dev *dev)
{
        struct vhost_worker *worker;
        unsigned long i;

        if (!dev->use_worker)
                return;

        for (i = 0; i < dev->nvqs; i++)
                rcu_assign_pointer(dev->vqs[i]->worker, NULL);
        /*
         * Free the default worker we created and cleanup workers userspace
         * created but couldn't clean up (it forgot or crashed).
         */
        xa_for_each(&dev->worker_xa, i, worker)
                vhost_worker_destroy(dev, worker);
        xa_destroy(&dev->worker_xa);
}

static struct vhost_worker *vhost_worker_create(struct vhost_dev *dev)
{
        struct vhost_worker *worker;
        struct vhost_task *vtsk;
        char name[TASK_COMM_LEN];
        int ret;
        u32 id;

        worker = kzalloc(sizeof(*worker), GFP_KERNEL_ACCOUNT);
        if (!worker)
                return NULL;

        worker->dev = dev;
        snprintf(name, sizeof(name), "vhost-%d", current->pid);

        vtsk = vhost_task_create(vhost_run_work_list, vhost_worker_killed,
                                 worker, name);
        if (!vtsk)
                goto free_worker;

        mutex_init(&worker->mutex);
        init_llist_head(&worker->work_list);
        worker->kcov_handle = kcov_common_handle();
        worker->vtsk = vtsk;

        vhost_task_start(vtsk);

        ret = xa_alloc(&dev->worker_xa, &id, worker, xa_limit_32b, GFP_KERNEL);
        if (ret < 0)
                goto stop_worker;
        worker->id = id;

        return worker;

stop_worker:
        vhost_task_stop(vtsk);
free_worker:
        kfree(worker);
        return NULL;
}

/* Caller must have device mutex */
static void __vhost_vq_attach_worker(struct vhost_virtqueue *vq,
                                     struct vhost_worker *worker)
{
        struct vhost_worker *old_worker;

        mutex_lock(&worker->mutex);
        if (worker->killed) {
                mutex_unlock(&worker->mutex);
                return;
        }

        mutex_lock(&vq->mutex);

        old_worker = rcu_dereference_check(vq->worker,
                                           lockdep_is_held(&vq->mutex));
        rcu_assign_pointer(vq->worker, worker);
        worker->attachment_cnt++;

        if (!old_worker) {
                mutex_unlock(&vq->mutex);
                mutex_unlock(&worker->mutex);
                return;
        }
        mutex_unlock(&vq->mutex);
        mutex_unlock(&worker->mutex);

        /*
         * Take the worker mutex to make sure we see the work queued from
         * device wide flushes which doesn't use RCU for execution.
         */
        mutex_lock(&old_worker->mutex);
        if (old_worker->killed) {
                mutex_unlock(&old_worker->mutex);
                return;
        }

        /*
         * We don't want to call synchronize_rcu for every vq during setup
         * because it will slow down VM startup. If we haven't done
         * VHOST_SET_VRING_KICK and not done the driver specific
         * SET_ENDPOINT/RUNNUNG then we can skip the sync since there will
         * not be any works queued for scsi and net.
         */
        mutex_lock(&vq->mutex);
        if (!vhost_vq_get_backend(vq) && !vq->kick) {
                mutex_unlock(&vq->mutex);

                old_worker->attachment_cnt--;
                mutex_unlock(&old_worker->mutex);
                /*
                 * vsock can queue anytime after VHOST_VSOCK_SET_GUEST_CID.
                 * Warn if it adds support for multiple workers but forgets to
                 * handle the early queueing case.
                 */
                WARN_ON(!old_worker->attachment_cnt &&
                        !llist_empty(&old_worker->work_list));
                return;
        }
        mutex_unlock(&vq->mutex);

        /* Make sure new vq queue/flush/poll calls see the new worker */
        synchronize_rcu();
        /* Make sure whatever was queued gets run */
        __vhost_worker_flush(old_worker);
        old_worker->attachment_cnt--;
        mutex_unlock(&old_worker->mutex);
}

 /* Caller must have device mutex */
static int vhost_vq_attach_worker(struct vhost_virtqueue *vq,
                                  struct vhost_vring_worker *info)
{
        unsigned long index = info->worker_id;
        struct vhost_dev *dev = vq->dev;
        struct vhost_worker *worker;

        if (!dev->use_worker)
                return -EINVAL;

        worker = xa_find(&dev->worker_xa, &index, UINT_MAX, XA_PRESENT);
        if (!worker || worker->id != info->worker_id)
                return -ENODEV;

        __vhost_vq_attach_worker(vq, worker);
        return 0;
}

/* Caller must have device mutex */
static int vhost_new_worker(struct vhost_dev *dev,
                            struct vhost_worker_state *info)
{
        struct vhost_worker *worker;

        worker = vhost_worker_create(dev);
        if (!worker)
                return -ENOMEM;

        info->worker_id = worker->id;
        return 0;
}

/* Caller must have device mutex */
static int vhost_free_worker(struct vhost_dev *dev,
                             struct vhost_worker_state *info)
{
        unsigned long index = info->worker_id;
        struct vhost_worker *worker;

        worker = xa_find(&dev->worker_xa, &index, UINT_MAX, XA_PRESENT);
        if (!worker || worker->id != info->worker_id)
                return -ENODEV;

        mutex_lock(&worker->mutex);
        if (worker->attachment_cnt || worker->killed) {
                mutex_unlock(&worker->mutex);
                return -EBUSY;
        }
        /*
         * A flush might have raced and snuck in before attachment_cnt was set
         * to zero. Make sure flushes are flushed from the queue before
         * freeing.
         */
        __vhost_worker_flush(worker);
        mutex_unlock(&worker->mutex);

        vhost_worker_destroy(dev, worker);
        return 0;
}

static int vhost_get_vq_from_user(struct vhost_dev *dev, void __user *argp,
                                  struct vhost_virtqueue **vq, u32 *id)
{
        u32 __user *idxp = argp;
        u32 idx;
        long r;

        r = get_user(idx, idxp);
        if (r < 0)
                return r;

        if (idx >= dev->nvqs)
                return -ENOBUFS;

        idx = array_index_nospec(idx, dev->nvqs);

        *vq = dev->vqs[idx];
        *id = idx;
        return 0;
}

/* Caller must have device mutex */
long vhost_worker_ioctl(struct vhost_dev *dev, unsigned int ioctl,
                        void __user *argp)
{
        struct vhost_vring_worker ring_worker;
        struct vhost_worker_state state;
        struct vhost_worker *worker;
        struct vhost_virtqueue *vq;
        long ret;
        u32 idx;

        if (!dev->use_worker)
                return -EINVAL;

        if (!vhost_dev_has_owner(dev))
                return -EINVAL;

        ret = vhost_dev_check_owner(dev);
        if (ret)
                return ret;

        switch (ioctl) {
        /* dev worker ioctls */
        case VHOST_NEW_WORKER:
                ret = vhost_new_worker(dev, &state);
                if (!ret && copy_to_user(argp, &state, sizeof(state)))
                        ret = -EFAULT;
                return ret;
        case VHOST_FREE_WORKER:
                if (copy_from_user(&state, argp, sizeof(state)))
                        return -EFAULT;
                return vhost_free_worker(dev, &state);
        /* vring worker ioctls */
        case VHOST_ATTACH_VRING_WORKER:
        case VHOST_GET_VRING_WORKER:
                break;
        default:
                return -ENOIOCTLCMD;
        }

        ret = vhost_get_vq_from_user(dev, argp, &vq, &idx);
        if (ret)
                return ret;

        switch (ioctl) {
        case VHOST_ATTACH_VRING_WORKER:
                if (copy_from_user(&ring_worker, argp, sizeof(ring_worker))) {
                        ret = -EFAULT;
                        break;
                }

                ret = vhost_vq_attach_worker(vq, &ring_worker);
                break;
        case VHOST_GET_VRING_WORKER:
                worker = rcu_dereference_check(vq->worker,
                                               lockdep_is_held(&dev->mutex));
                if (!worker) {
                        ret = -EINVAL;
                        break;
                }

                ring_worker.index = idx;
                ring_worker.worker_id = worker->id;

                if (copy_to_user(argp, &ring_worker, sizeof(ring_worker)))
                        ret = -EFAULT;
                break;
        default:
                ret = -ENOIOCTLCMD;
                break;
        }

        return ret;
}
EXPORT_SYMBOL_GPL(vhost_worker_ioctl);

/* Caller should have device mutex */
long vhost_dev_set_owner(struct vhost_dev *dev)
{
        struct vhost_worker *worker;
        int err, i;

        /* Is there an owner already? */
        if (vhost_dev_has_owner(dev)) {
                err = -EBUSY;
                goto err_mm;
        }

        vhost_attach_mm(dev);

        err = vhost_dev_alloc_iovecs(dev);
        if (err)
                goto err_iovecs;

        if (dev->use_worker) {
                /*
                 * This should be done last, because vsock can queue work
                 * before VHOST_SET_OWNER so it simplifies the failure path
                 * below since we don't have to worry about vsock queueing
                 * while we free the worker.
                 */
                worker = vhost_worker_create(dev);
                if (!worker) {
                        err = -ENOMEM;
                        goto err_worker;
                }

                for (i = 0; i < dev->nvqs; i++)
                        __vhost_vq_attach_worker(dev->vqs[i], worker);
        }

        return 0;

err_worker:
        vhost_dev_free_iovecs(dev);
err_iovecs:
        vhost_detach_mm(dev);
err_mm:
        return err;
}
EXPORT_SYMBOL_GPL(vhost_dev_set_owner);

static struct vhost_iotlb *iotlb_alloc(void)
{
        return vhost_iotlb_alloc(max_iotlb_entries,
                                 VHOST_IOTLB_FLAG_RETIRE);
}

struct vhost_iotlb *vhost_dev_reset_owner_prepare(void)
{
        return iotlb_alloc();
}
EXPORT_SYMBOL_GPL(vhost_dev_reset_owner_prepare);

/* Caller should have device mutex */
void vhost_dev_reset_owner(struct vhost_dev *dev, struct vhost_iotlb *umem)
{
        int i;

        vhost_dev_cleanup(dev);

        dev->umem = umem;
        /* We don't need VQ locks below since vhost_dev_cleanup makes sure
         * VQs aren't running.
         */
        for (i = 0; i < dev->nvqs; ++i)
                dev->vqs[i]->umem = umem;
}
EXPORT_SYMBOL_GPL(vhost_dev_reset_owner);

void vhost_dev_stop(struct vhost_dev *dev)
{
        int i;

        for (i = 0; i < dev->nvqs; ++i) {
                if (dev->vqs[i]->kick && dev->vqs[i]->handle_kick)
                        vhost_poll_stop(&dev->vqs[i]->poll);
        }

        vhost_dev_flush(dev);
}
EXPORT_SYMBOL_GPL(vhost_dev_stop);

void vhost_clear_msg(struct vhost_dev *dev)
{
        struct vhost_msg_node *node, *n;

        spin_lock(&dev->iotlb_lock);

        list_for_each_entry_safe(node, n, &dev->read_list, node) {
                list_del(&node->node);
                kfree(node);
        }

        list_for_each_entry_safe(node, n, &dev->pending_list, node) {
                list_del(&node->node);
                kfree(node);
        }

        spin_unlock(&dev->iotlb_lock);
}
EXPORT_SYMBOL_GPL(vhost_clear_msg);

void vhost_dev_cleanup(struct vhost_dev *dev)
{
        int i;

        for (i = 0; i < dev->nvqs; ++i) {
                if (dev->vqs[i]->error_ctx)
                        eventfd_ctx_put(dev->vqs[i]->error_ctx);
                if (dev->vqs[i]->kick)
                        fput(dev->vqs[i]->kick);
                if (dev->vqs[i]->call_ctx.ctx)
                        eventfd_ctx_put(dev->vqs[i]->call_ctx.ctx);
                vhost_vq_reset(dev, dev->vqs[i]);
        }
        vhost_dev_free_iovecs(dev);
        if (dev->log_ctx)
                eventfd_ctx_put(dev->log_ctx);
        dev->log_ctx = NULL;
        /* No one will access memory at this point */
        vhost_iotlb_free(dev->umem);
        dev->umem = NULL;
        vhost_iotlb_free(dev->iotlb);
        dev->iotlb = NULL;
        vhost_clear_msg(dev);
        wake_up_interruptible_poll(&dev->wait, EPOLLIN | EPOLLRDNORM);
        vhost_workers_free(dev);
        vhost_detach_mm(dev);
}
EXPORT_SYMBOL_GPL(vhost_dev_cleanup);

static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
{
        u64 a = addr / VHOST_PAGE_SIZE / 8;

        /* Make sure 64 bit math will not overflow. */
        if (a > ULONG_MAX - (unsigned long)log_base ||
            a + (unsigned long)log_base > ULONG_MAX)
                return false;

        return access_ok(log_base + a,
                         (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);
}

/* Make sure 64 bit math will not overflow. */
static bool vhost_overflow(u64 uaddr, u64 size)
{
        if (uaddr > ULONG_MAX || size > ULONG_MAX)
                return true;

        if (!size)
                return false;

        return uaddr > ULONG_MAX - size + 1;
}

/* Caller should have vq mutex and device mutex. */
static bool vq_memory_access_ok(void __user *log_base, struct vhost_iotlb *umem,
                                int log_all)
{
        struct vhost_iotlb_map *map;

        if (!umem)
                return false;

        list_for_each_entry(map, &umem->list, link) {
                unsigned long a = map->addr;

                if (vhost_overflow(map->addr, map->size))
                        return false;


                if (!access_ok((void __user *)a, map->size))
                        return false;
                else if (log_all && !log_access_ok(log_base,
                                                   map->start,
                                                   map->size))
                        return false;
        }
        return true;
}

static inline void __user *vhost_vq_meta_fetch(struct vhost_virtqueue *vq,
                                               u64 addr, unsigned int size,
                                               int type)
{
        const struct vhost_iotlb_map *map = vq->meta_iotlb[type];

        if (!map)
                return NULL;

        return (void __user *)(uintptr_t)(map->addr + addr - map->start);
}

/* Can we switch to this memory table? */
/* Caller should have device mutex but not vq mutex */
static bool memory_access_ok(struct vhost_dev *d, struct vhost_iotlb *umem,
                             int log_all)
{
        int i;

        for (i = 0; i < d->nvqs; ++i) {
                bool ok;
                bool log;

                mutex_lock(&d->vqs[i]->mutex);
                log = log_all || vhost_has_feature(d->vqs[i], VHOST_F_LOG_ALL);
                /* If ring is inactive, will check when it's enabled. */
                if (d->vqs[i]->private_data)
                        ok = vq_memory_access_ok(d->vqs[i]->log_base,
                                                 umem, log);
                else
                        ok = true;
                mutex_unlock(&d->vqs[i]->mutex);
                if (!ok)
                        return false;
        }
        return true;
}

static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
                          struct iovec iov[], int iov_size, int access);

static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to,
                              const void *from, unsigned size)
{
        int ret;

        if (!vq->iotlb)
                return __copy_to_user(to, from, size);
        else {
                /* This function should be called after iotlb
                 * prefetch, which means we're sure that all vq
                 * could be access through iotlb. So -EAGAIN should
                 * not happen in this case.
                 */
                struct iov_iter t;
                void __user *uaddr = vhost_vq_meta_fetch(vq,
                                     (u64)(uintptr_t)to, size,
                                     VHOST_ADDR_USED);

                if (uaddr)
                        return __copy_to_user(uaddr, from, size);

                ret = translate_desc(vq, (u64)(uintptr_t)to, size, vq->iotlb_iov,
                                     ARRAY_SIZE(vq->iotlb_iov),
                                     VHOST_ACCESS_WO);
                if (ret < 0)
                        goto out;
                iov_iter_init(&t, ITER_DEST, vq->iotlb_iov, ret, size);
                ret = copy_to_iter(from, size, &t);
                if (ret == size)
                        ret = 0;
        }
out:
        return ret;
}

static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to,
                                void __user *from, unsigned size)
{
        int ret;

        if (!vq->iotlb)
                return __copy_from_user(to, from, size);
        else {
                /* This function should be called after iotlb
                 * prefetch, which means we're sure that vq
                 * could be access through iotlb. So -EAGAIN should
                 * not happen in this case.
                 */
                void __user *uaddr = vhost_vq_meta_fetch(vq,
                                     (u64)(uintptr_t)from, size,
                                     VHOST_ADDR_DESC);
                struct iov_iter f;

                if (uaddr)
                        return __copy_from_user(to, uaddr, size);

                ret = translate_desc(vq, (u64)(uintptr_t)from, size, vq->iotlb_iov,
                                     ARRAY_SIZE(vq->iotlb_iov),
                                     VHOST_ACCESS_RO);
                if (ret < 0) {
                        vq_err(vq, "IOTLB translation failure: uaddr "
                               "%p size 0x%llx\n", from,
                               (unsigned long long) size);
                        goto out;
                }
                iov_iter_init(&f, ITER_SOURCE, vq->iotlb_iov, ret, size);
                ret = copy_from_iter(to, size, &f);
                if (ret == size)
                        ret = 0;
        }

out:
        return ret;
}

static void __user *__vhost_get_user_slow(struct vhost_virtqueue *vq,
                                          void __user *addr, unsigned int size,
                                          int type)
{
        int ret;

        ret = translate_desc(vq, (u64)(uintptr_t)addr, size, vq->iotlb_iov,
                             ARRAY_SIZE(vq->iotlb_iov),
                             VHOST_ACCESS_RO);
        if (ret < 0) {
                vq_err(vq, "IOTLB translation failure: uaddr "
                        "%p size 0x%llx\n", addr,
                        (unsigned long long) size);
                return NULL;
        }

        if (ret != 1 || vq->iotlb_iov[0].iov_len != size) {
                vq_err(vq, "Non atomic userspace memory access: uaddr "
                        "%p size 0x%llx\n", addr,
                        (unsigned long long) size);
                return NULL;
        }

        return vq->iotlb_iov[0].iov_base;
}

/* This function should be called after iotlb
 * prefetch, which means we're sure that vq
 * could be access through iotlb. So -EAGAIN should
 * not happen in this case.
 */
static inline void __user *__vhost_get_user(struct vhost_virtqueue *vq,
                                            void __user *addr, unsigned int size,
                                            int type)
{
        void __user *uaddr = vhost_vq_meta_fetch(vq,
                             (u64)(uintptr_t)addr, size, type);
        if (uaddr)
                return uaddr;

        return __vhost_get_user_slow(vq, addr, size, type);
}

#define vhost_put_user(vq, x, ptr)                \
({ \
        int ret; \
        if (!vq->iotlb) { \
                ret = __put_user(x, ptr); \
        } else { \
                __typeof__(ptr) to = \
                        (__typeof__(ptr)) __vhost_get_user(vq, ptr,        \
                                          sizeof(*ptr), VHOST_ADDR_USED); \
                if (to != NULL) \
                        ret = __put_user(x, to); \
                else \
                        ret = -EFAULT;        \
        } \
        ret; \
})

static inline int vhost_put_avail_event(struct vhost_virtqueue *vq)
{
        return vhost_put_user(vq, cpu_to_vhost16(vq, vq->avail_idx),
                              vhost_avail_event(vq));
}

static inline int vhost_put_used(struct vhost_virtqueue *vq,
                                 struct vring_used_elem *head, int idx,
                                 int count)
{
        return vhost_copy_to_user(vq, vq->used->ring + idx, head,
                                  count * sizeof(*head));
}

static inline int vhost_put_used_flags(struct vhost_virtqueue *vq)

{
        return vhost_put_user(vq, cpu_to_vhost16(vq, vq->used_flags),
                              &vq->used->flags);
}

static inline int vhost_put_used_idx(struct vhost_virtqueue *vq)

{
        return vhost_put_user(vq, cpu_to_vhost16(vq, vq->last_used_idx),
                              &vq->used->idx);
}

#define vhost_get_user(vq, x, ptr, type)                \
({ \
        int ret; \
        if (!vq->iotlb) { \
                ret = __get_user(x, ptr); \
        } else { \
                __typeof__(ptr) from = \
                        (__typeof__(ptr)) __vhost_get_user(vq, ptr, \
                                                           sizeof(*ptr), \
                                                           type); \
                if (from != NULL) \
                        ret = __get_user(x, from); \
                else \
                        ret = -EFAULT; \
        } \
        ret; \
})

#define vhost_get_avail(vq, x, ptr) \
        vhost_get_user(vq, x, ptr, VHOST_ADDR_AVAIL)

#define vhost_get_used(vq, x, ptr) \
        vhost_get_user(vq, x, ptr, VHOST_ADDR_USED)

static void vhost_dev_lock_vqs(struct vhost_dev *d)
{
        int i = 0;
        for (i = 0; i < d->nvqs; ++i)
                mutex_lock_nested(&d->vqs[i]->mutex, i);
}

static void vhost_dev_unlock_vqs(struct vhost_dev *d)
{
        int i = 0;
        for (i = 0; i < d->nvqs; ++i)
                mutex_unlock(&d->vqs[i]->mutex);
}

static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq)
{
        __virtio16 idx;
        int r;

        r = vhost_get_avail(vq, idx, &vq->avail->idx);
        if (unlikely(r < 0)) {
                vq_err(vq, "Failed to access available index at %p (%d)\n",
                       &vq->avail->idx, r);
                return r;
        }

        /* Check it isn't doing very strange thing with available indexes */
        vq->avail_idx = vhost16_to_cpu(vq, idx);
        if (unlikely((u16)(vq->avail_idx - vq->last_avail_idx) > vq->num)) {
                vq_err(vq, "Invalid available index change from %u to %u",
                       vq->last_avail_idx, vq->avail_idx);
                return -EINVAL;
        }

        /* We're done if there is nothing new */
        if (vq->avail_idx == vq->last_avail_idx)
                return 0;

        /*
         * We updated vq->avail_idx so we need a memory barrier between
         * the index read above and the caller reading avail ring entries.
         */
        smp_rmb();
        return 1;
}

static inline int vhost_get_avail_head(struct vhost_virtqueue *vq,
                                       __virtio16 *head, int idx)
{
        return vhost_get_avail(vq, *head,
                               &vq->avail->ring[idx & (vq->num - 1)]);
}

static inline int vhost_get_avail_flags(struct vhost_virtqueue *vq,
                                        __virtio16 *flags)
{
        return vhost_get_avail(vq, *flags, &vq->avail->flags);
}

static inline int vhost_get_used_event(struct vhost_virtqueue *vq,
                                       __virtio16 *event)
{
        return vhost_get_avail(vq, *event, vhost_used_event(vq));
}

static inline int vhost_get_used_idx(struct vhost_virtqueue *vq,
                                     __virtio16 *idx)
{
        return vhost_get_used(vq, *idx, &vq->used->idx);
}

static inline int vhost_get_desc(struct vhost_virtqueue *vq,
                                 struct vring_desc *desc, int idx)
{
        return vhost_copy_from_user(vq, desc, vq->desc + idx, sizeof(*desc));
}

static void vhost_iotlb_notify_vq(struct vhost_dev *d,
                                  struct vhost_iotlb_msg *msg)
{
        struct vhost_msg_node *node, *n;

        spin_lock(&d->iotlb_lock);

        list_for_each_entry_safe(node, n, &d->pending_list, node) {
                struct vhost_iotlb_msg *vq_msg = &node->msg.iotlb;
                if (msg->iova <= vq_msg->iova &&
                    msg->iova + msg->size - 1 >= vq_msg->iova &&
                    vq_msg->type == VHOST_IOTLB_MISS) {
                        vhost_poll_queue(&node->vq->poll);
                        list_del(&node->node);
                        kfree(node);
                }
        }

        spin_unlock(&d->iotlb_lock);
}

static bool umem_access_ok(u64 uaddr, u64 size, int access)
{
        unsigned long a = uaddr;

        /* Make sure 64 bit math will not overflow. */
        if (vhost_overflow(uaddr, size))
                return false;

        if ((access & VHOST_ACCESS_RO) &&
            !access_ok((void __user *)a, size))
                return false;
        if ((access & VHOST_ACCESS_WO) &&
            !access_ok((void __user *)a, size))
                return false;
        return true;
}

static int vhost_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
                                   struct vhost_iotlb_msg *msg)
{
        int ret = 0;

        if (asid != 0)
                return -EINVAL;

        mutex_lock(&dev->mutex);
        vhost_dev_lock_vqs(dev);
        switch (msg->type) {
        case VHOST_IOTLB_UPDATE:
                if (!dev->iotlb) {
                        ret = -EFAULT;
                        break;
                }
                if (!umem_access_ok(msg->uaddr, msg->size, msg->perm)) {
                        ret = -EFAULT;
                        break;
                }
                vhost_vq_meta_reset(dev);
                if (vhost_iotlb_add_range(dev->iotlb, msg->iova,
                                          msg->iova + msg->size - 1,
                                          msg->uaddr, msg->perm)) {
                        ret = -ENOMEM;
                        break;
                }
                vhost_iotlb_notify_vq(dev, msg);
                break;
        case VHOST_IOTLB_INVALIDATE:
                if (!dev->iotlb) {
                        ret = -EFAULT;
                        break;
                }
                vhost_vq_meta_reset(dev);
                vhost_iotlb_del_range(dev->iotlb, msg->iova,
                                      msg->iova + msg->size - 1);
                break;
        default:
                ret = -EINVAL;
                break;
        }

        vhost_dev_unlock_vqs(dev);
        mutex_unlock(&dev->mutex);

        return ret;
}
ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
                             struct iov_iter *from)
{
        struct vhost_iotlb_msg msg;
        size_t offset;
        int type, ret;
        u32 asid = 0;

        ret = copy_from_iter(&type, sizeof(type), from);
        if (ret != sizeof(type)) {
                ret = -EINVAL;
                goto done;
        }

        switch (type) {
        case VHOST_IOTLB_MSG:
                /* There maybe a hole after type for V1 message type,
                 * so skip it here.
                 */
                offset = offsetof(struct vhost_msg, iotlb) - sizeof(int);
                break;
        case VHOST_IOTLB_MSG_V2:
                if (vhost_backend_has_feature(dev->vqs[0],
                                              VHOST_BACKEND_F_IOTLB_ASID)) {
                        ret = copy_from_iter(&asid, sizeof(asid), from);
                        if (ret != sizeof(asid)) {
                                ret = -EINVAL;
                                goto done;
                        }
                        offset = 0;
                } else
                        offset = sizeof(__u32);
                break;
        default:
                ret = -EINVAL;
                goto done;
        }

        iov_iter_advance(from, offset);
        ret = copy_from_iter(&msg, sizeof(msg), from);
        if (ret != sizeof(msg)) {
                ret = -EINVAL;
                goto done;
        }

        if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) {
                ret = -EINVAL;
                goto done;
        }

        if (dev->msg_handler)
                ret = dev->msg_handler(dev, asid, &msg);
        else
                ret = vhost_process_iotlb_msg(dev, asid, &msg);
        if (ret) {
                ret = -EFAULT;
                goto done;
        }

        ret = (type == VHOST_IOTLB_MSG) ? sizeof(struct vhost_msg) :
              sizeof(struct vhost_msg_v2);
done:
        return ret;
}
EXPORT_SYMBOL(vhost_chr_write_iter);

__poll_t vhost_chr_poll(struct file *file, struct vhost_dev *dev,
                            poll_table *wait)
{
        __poll_t mask = 0;

        poll_wait(file, &dev->wait, wait);

        if (!list_empty(&dev->read_list))
                mask |= EPOLLIN | EPOLLRDNORM;

        return mask;
}
EXPORT_SYMBOL(vhost_chr_poll);

ssize_t vhost_chr_read_iter(struct vhost_dev *dev, struct iov_iter *to,
                            int noblock)
{
        DEFINE_WAIT(wait);
        struct vhost_msg_node *node;
        ssize_t ret = 0;
        unsigned size = sizeof(struct vhost_msg);

        if (iov_iter_count(to) < size)
                return 0;

        while (1) {
                if (!noblock)
                        prepare_to_wait(&dev->wait, &wait,
                                        TASK_INTERRUPTIBLE);

                node = vhost_dequeue_msg(dev, &dev->read_list);
                if (node)
                        break;
                if (noblock) {
                        ret = -EAGAIN;
                        break;
                }
                if (signal_pending(current)) {
                        ret = -ERESTARTSYS;
                        break;
                }
                if (!dev->iotlb) {
                        ret = -EBADFD;
                        break;
                }

                schedule();
        }

        if (!noblock)
                finish_wait(&dev->wait, &wait);

        if (node) {
                struct vhost_iotlb_msg *msg;
                void *start = &node->msg;

                switch (node->msg.type) {
                case VHOST_IOTLB_MSG:
                        size = sizeof(node->msg);
                        msg = &node->msg.iotlb;
                        break;
                case VHOST_IOTLB_MSG_V2:
                        size = sizeof(node->msg_v2);
                        msg = &node->msg_v2.iotlb;
                        break;
                default:
                        BUG();
                        break;
                }

                ret = copy_to_iter(start, size, to);
                if (ret != size || msg->type != VHOST_IOTLB_MISS) {
                        kfree(node);
                        return ret;
                }
                vhost_enqueue_msg(dev, &dev->pending_list, node);
        }

        return ret;
}
EXPORT_SYMBOL_GPL(vhost_chr_read_iter);

static int vhost_iotlb_miss(struct vhost_virtqueue *vq, u64 iova, int access)
{
        struct vhost_dev *dev = vq->dev;
        struct vhost_msg_node *node;
        struct vhost_iotlb_msg *msg;
        bool v2 = vhost_backend_has_feature(vq, VHOST_BACKEND_F_IOTLB_MSG_V2);

        node = vhost_new_msg(vq, v2 ? VHOST_IOTLB_MSG_V2 : VHOST_IOTLB_MSG);
        if (!node)
                return -ENOMEM;

        if (v2) {
                node->msg_v2.type = VHOST_IOTLB_MSG_V2;
                msg = &node->msg_v2.iotlb;
        } else {
                msg = &node->msg.iotlb;
        }

        msg->type = VHOST_IOTLB_MISS;
        msg->iova = iova;
        msg->perm = access;

        vhost_enqueue_msg(dev, &dev->read_list, node);

        return 0;
}

static bool vq_access_ok(struct vhost_virtqueue *vq, unsigned int num,
                         vring_desc_t __user *desc,
                         vring_avail_t __user *avail,
                         vring_used_t __user *used)

{
        /* If an IOTLB device is present, the vring addresses are
         * GIOVAs. Access validation occurs at prefetch time. */
        if (vq->iotlb)
                return true;

        return access_ok(desc, vhost_get_desc_size(vq, num)) &&
               access_ok(avail, vhost_get_avail_size(vq, num)) &&
               access_ok(used, vhost_get_used_size(vq, num));
}

static void vhost_vq_meta_update(struct vhost_virtqueue *vq,
                                 const struct vhost_iotlb_map *map,
                                 int type)
{
        int access = (type == VHOST_ADDR_USED) ?
                     VHOST_ACCESS_WO : VHOST_ACCESS_RO;

        if (likely(map->perm & access))
                vq->meta_iotlb[type] = map;
}

static bool iotlb_access_ok(struct vhost_virtqueue *vq,
                            int access, u64 addr, u64 len, int type)
{
        const struct vhost_iotlb_map *map;
        struct vhost_iotlb *umem = vq->iotlb;
        u64 s = 0, size, orig_addr = addr, last = addr + len - 1;

        if (vhost_vq_meta_fetch(vq, addr, len, type))
                return true;

        while (len > s) {
                map = vhost_iotlb_itree_first(umem, addr, last);
                if (map == NULL || map->start > addr) {
                        vhost_iotlb_miss(vq, addr, access);
                        return false;
                } else if (!(map->perm & access)) {
                        /* Report the possible access violation by
                         * request another translation from userspace.
                         */
                        return false;
                }

                size = map->size - addr + map->start;

                if (orig_addr == addr && size >= len)
                        vhost_vq_meta_update(vq, map, type);

                s += size;
                addr += size;
        }

        return true;
}

int vq_meta_prefetch(struct vhost_virtqueue *vq)
{
        unsigned int num = vq->num;

        if (!vq->iotlb)
                return 1;

        return iotlb_access_ok(vq, VHOST_MAP_RO, (u64)(uintptr_t)vq->desc,
                               vhost_get_desc_size(vq, num), VHOST_ADDR_DESC) &&
               iotlb_access_ok(vq, VHOST_MAP_RO, (u64)(uintptr_t)vq->avail,
                               vhost_get_avail_size(vq, num),
                               VHOST_ADDR_AVAIL) &&
               iotlb_access_ok(vq, VHOST_MAP_WO, (u64)(uintptr_t)vq->used,
                               vhost_get_used_size(vq, num), VHOST_ADDR_USED);
}
EXPORT_SYMBOL_GPL(vq_meta_prefetch);

/* Can we log writes? */
/* Caller should have device mutex but not vq mutex */
bool vhost_log_access_ok(struct vhost_dev *dev)
{
        return memory_access_ok(dev, dev->umem, 1);
}
EXPORT_SYMBOL_GPL(vhost_log_access_ok);

static bool vq_log_used_access_ok(struct vhost_virtqueue *vq,
                                  void __user *log_base,
                                  bool log_used,
                                  u64 log_addr)
{
        /* If an IOTLB device is present, log_addr is a GIOVA that
         * will never be logged by log_used(). */
        if (vq->iotlb)
                return true;

        return !log_used || log_access_ok(log_base, log_addr,
                                          vhost_get_used_size(vq, vq->num));
}

/* Verify access for write logging. */
/* Caller should have vq mutex and device mutex */
static bool vq_log_access_ok(struct vhost_virtqueue *vq,
                             void __user *log_base)
{
        return vq_memory_access_ok(log_base, vq->umem,
                                   vhost_has_feature(vq, VHOST_F_LOG_ALL)) &&
                vq_log_used_access_ok(vq, log_base, vq->log_used, vq->log_addr);
}

/* Can we start vq? */
/* Caller should have vq mutex and device mutex */
bool vhost_vq_access_ok(struct vhost_virtqueue *vq)
{
        if (!vq_log_access_ok(vq, vq->log_base))
                return false;

        return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used);
}
EXPORT_SYMBOL_GPL(vhost_vq_access_ok);

static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
{
        struct vhost_memory mem, *newmem;
        struct vhost_memory_region *region;
        struct vhost_iotlb *newumem, *oldumem;
        unsigned long size = offsetof(struct vhost_memory, regions);
        int i;

        if (copy_from_user(&mem, m, size))
                return -EFAULT;
        if (mem.padding)
                return -EOPNOTSUPP;
        if (mem.nregions > max_mem_regions)
                return -E2BIG;
        newmem = kvzalloc(struct_size(newmem, regions, mem.nregions),
                        GFP_KERNEL);
        if (!newmem)
                return -ENOMEM;

        memcpy(newmem, &mem, size);
        if (copy_from_user(newmem->regions, m->regions,
                           flex_array_size(newmem, regions, mem.nregions))) {
                kvfree(newmem);
                return -EFAULT;
        }

        newumem = iotlb_alloc();
        if (!newumem) {
                kvfree(newmem);
                return -ENOMEM;
        }

        for (region = newmem->regions;
             region < newmem->regions + mem.nregions;
             region++) {
                if (vhost_iotlb_add_range(newumem,
                                          region->guest_phys_addr,
                                          region->guest_phys_addr +
                                          region->memory_size - 1,
                                          region->userspace_addr,
                                          VHOST_MAP_RW))
                        goto err;
        }

        if (!memory_access_ok(d, newumem, 0))
                goto err;

        oldumem = d->umem;
        d->umem = newumem;

        /* All memory accesses are done under some VQ mutex. */
        for (i = 0; i < d->nvqs; ++i) {
                mutex_lock(&d->vqs[i]->mutex);
                d->vqs[i]->umem = newumem;
                mutex_unlock(&d->vqs[i]->mutex);
        }

        kvfree(newmem);
        vhost_iotlb_free(oldumem);
        return 0;

err:
        vhost_iotlb_free(newumem);
        kvfree(newmem);
        return -EFAULT;
}

static long vhost_vring_set_num(struct vhost_dev *d,
                                struct vhost_virtqueue *vq,
                                void __user *argp)
{
        struct vhost_vring_state s;

        /* Resizing ring with an active backend?
         * You don't want to do that. */
        if (vq->private_data)
                return -EBUSY;

        if (copy_from_user(&s, argp, sizeof s))
                return -EFAULT;

        if (!s.num || s.num > 0xffff || (s.num & (s.num - 1)))
                return -EINVAL;
        vq->num = s.num;

        return 0;
}

static long vhost_vring_set_addr(struct vhost_dev *d,
                                 struct vhost_virtqueue *vq,
                                 void __user *argp)
{
        struct vhost_vring_addr a;

        if (copy_from_user(&a, argp, sizeof a))
                return -EFAULT;
        if (a.flags & ~(0x1 << VHOST_VRING_F_LOG))
                return -EOPNOTSUPP;

        /* For 32bit, verify that the top 32bits of the user
           data are set to zero. */
        if ((u64)(unsigned long)a.desc_user_addr != a.desc_user_addr ||
            (u64)(unsigned long)a.used_user_addr != a.used_user_addr ||
            (u64)(unsigned long)a.avail_user_addr != a.avail_user_addr)
                return -EFAULT;

        /* Make sure it's safe to cast pointers to vring types. */
        BUILD_BUG_ON(__alignof__ *vq->avail > VRING_AVAIL_ALIGN_SIZE);
        BUILD_BUG_ON(__alignof__ *vq->used > VRING_USED_ALIGN_SIZE);
        if ((a.avail_user_addr & (VRING_AVAIL_ALIGN_SIZE - 1)) ||
            (a.used_user_addr & (VRING_USED_ALIGN_SIZE - 1)) ||
            (a.log_guest_addr & (VRING_USED_ALIGN_SIZE - 1)))
                return -EINVAL;

        /* We only verify access here if backend is configured.
         * If it is not, we don't as size might not have been setup.
         * We will verify when backend is configured. */
        if (vq->private_data) {
                if (!vq_access_ok(vq, vq->num,
                        (void __user *)(unsigned long)a.desc_user_addr,
                        (void __user *)(unsigned long)a.avail_user_addr,
                        (void __user *)(unsigned long)a.used_user_addr))
                        return -EINVAL;

                /* Also validate log access for used ring if enabled. */
                if (!vq_log_used_access_ok(vq, vq->log_base,
                                a.flags & (0x1 << VHOST_VRING_F_LOG),
                                a.log_guest_addr))
                        return -EINVAL;
        }

        vq->log_used = !!(a.flags & (0x1 << VHOST_VRING_F_LOG));
        vq->desc = (void __user *)(unsigned long)a.desc_user_addr;
        vq->avail = (void __user *)(unsigned long)a.avail_user_addr;
        vq->log_addr = a.log_guest_addr;
        vq->used = (void __user *)(unsigned long)a.used_user_addr;

        return 0;
}

static long vhost_vring_set_num_addr(struct vhost_dev *d,
                                     struct vhost_virtqueue *vq,
                                     unsigned int ioctl,
                                     void __user *argp)
{
        long r;

        mutex_lock(&vq->mutex);

        switch (ioctl) {
        case VHOST_SET_VRING_NUM:
                r = vhost_vring_set_num(d, vq, argp);
                break;
        case VHOST_SET_VRING_ADDR:
                r = vhost_vring_set_addr(d, vq, argp);
                break;
        default:
                BUG();
        }

        mutex_unlock(&vq->mutex);

        return r;
}
long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
{
        struct file *eventfp, *filep = NULL;
        bool pollstart = false, pollstop = false;
        struct eventfd_ctx *ctx = NULL;
        struct vhost_virtqueue *vq;
        struct vhost_vring_state s;
        struct vhost_vring_file f;
        u32 idx;
        long r;

        r = vhost_get_vq_from_user(d, argp, &vq, &idx);
        if (r < 0)
                return r;

        if (ioctl == VHOST_SET_VRING_NUM ||
            ioctl == VHOST_SET_VRING_ADDR) {
                return vhost_vring_set_num_addr(d, vq, ioctl, argp);
        }

        mutex_lock(&vq->mutex);

        switch (ioctl) {
        case VHOST_SET_VRING_BASE:
                /* Moving base with an active backend?
                 * You don't want to do that. */
                if (vq->private_data) {
                        r = -EBUSY;
                        break;
                }
                if (copy_from_user(&s, argp, sizeof s)) {
                        r = -EFAULT;
                        break;
                }
                if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) {
                        vq->last_avail_idx = s.num & 0xffff;
                        vq->last_used_idx = (s.num >> 16) & 0xffff;
                } else {
                        if (s.num > 0xffff) {
                                r = -EINVAL;
                                break;
                        }
                        vq->last_avail_idx = s.num;
                }
                /* Forget the cached index value. */
                vq->avail_idx = vq->last_avail_idx;
                break;
        case VHOST_GET_VRING_BASE:
                s.index = idx;
                if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED))
                        s.num = (u32)vq->last_avail_idx | ((u32)vq->last_used_idx << 16);
                else
                        s.num = vq->last_avail_idx;
                if (copy_to_user(argp, &s, sizeof s))
                        r = -EFAULT;
                break;
        case VHOST_SET_VRING_KICK:
                if (copy_from_user(&f, argp, sizeof f)) {
                        r = -EFAULT;
                        break;
                }
                eventfp = f.fd == VHOST_FILE_UNBIND ? NULL : eventfd_fget(f.fd);
                if (IS_ERR(eventfp)) {
                        r = PTR_ERR(eventfp);
                        break;
                }
                if (eventfp != vq->kick) {
                        pollstop = (filep = vq->kick) != NULL;
                        pollstart = (vq->kick = eventfp) != NULL;
                } else
                        filep = eventfp;
                break;
        case VHOST_SET_VRING_CALL:
                if (copy_from_user(&f, argp, sizeof f)) {
                        r = -EFAULT;
                        break;
                }
                ctx = f.fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(f.fd);
                if (IS_ERR(ctx)) {
                        r = PTR_ERR(ctx);
                        break;
                }

                swap(ctx, vq->call_ctx.ctx);
                break;
        case VHOST_SET_VRING_ERR:
                if (copy_from_user(&f, argp, sizeof f)) {
                        r = -EFAULT;
                        break;
                }
                ctx = f.fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(f.fd);
                if (IS_ERR(ctx)) {
                        r = PTR_ERR(ctx);
                        break;
                }
                swap(ctx, vq->error_ctx);
                break;
        case VHOST_SET_VRING_ENDIAN:
                r = vhost_set_vring_endian(vq, argp);
                break;
        case VHOST_GET_VRING_ENDIAN:
                r = vhost_get_vring_endian(vq, idx, argp);
                break;
        case VHOST_SET_VRING_BUSYLOOP_TIMEOUT:
                if (copy_from_user(&s, argp, sizeof(s))) {
                        r = -EFAULT;
                        break;
                }
                vq->busyloop_timeout = s.num;
                break;
        case VHOST_GET_VRING_BUSYLOOP_TIMEOUT:
                s.index = idx;
                s.num = vq->busyloop_timeout;
                if (copy_to_user(argp, &s, sizeof(s)))
                        r = -EFAULT;
                break;
        default:
                r = -ENOIOCTLCMD;
        }

        if (pollstop && vq->handle_kick)
                vhost_poll_stop(&vq->poll);

        if (!IS_ERR_OR_NULL(ctx))
                eventfd_ctx_put(ctx);
        if (filep)
                fput(filep);

        if (pollstart && vq->handle_kick)
                r = vhost_poll_start(&vq->poll, vq->kick);

        mutex_unlock(&vq->mutex);

        if (pollstop && vq->handle_kick)
                vhost_dev_flush(vq->poll.dev);
        return r;
}
EXPORT_SYMBOL_GPL(vhost_vring_ioctl);

int vhost_init_device_iotlb(struct vhost_dev *d)
{
        struct vhost_iotlb *niotlb, *oiotlb;
        int i;

        niotlb = iotlb_alloc();
        if (!niotlb)
                return -ENOMEM;

        oiotlb = d->iotlb;
        d->iotlb = niotlb;

        for (i = 0; i < d->nvqs; ++i) {
                struct vhost_virtqueue *vq = d->vqs[i];

                mutex_lock(&vq->mutex);
                vq->iotlb = niotlb;
                __vhost_vq_meta_reset(vq);
                mutex_unlock(&vq->mutex);
        }

        vhost_iotlb_free(oiotlb);

        return 0;
}
EXPORT_SYMBOL_GPL(vhost_init_device_iotlb);

/* Caller must have device mutex */
long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
{
        struct eventfd_ctx *ctx;
        u64 p;
        long r;
        int i, fd;

        /* If you are not the owner, you can become one */
        if (ioctl == VHOST_SET_OWNER) {
                r = vhost_dev_set_owner(d);
                goto done;
        }

        /* You must be the owner to do anything else */
        r = vhost_dev_check_owner(d);
        if (r)
                goto done;

        switch (ioctl) {
        case VHOST_SET_MEM_TABLE:
                r = vhost_set_memory(d, argp);
                break;
        case VHOST_SET_LOG_BASE:
                if (copy_from_user(&p, argp, sizeof p)) {
                        r = -EFAULT;
                        break;
                }
                if ((u64)(unsigned long)p != p) {
                        r = -EFAULT;
                        break;
                }
                for (i = 0; i < d->nvqs; ++i) {
                        struct vhost_virtqueue *vq;
                        void __user *base = (void __user *)(unsigned long)p;
                        vq = d->vqs[i];
                        mutex_lock(&vq->mutex);
                        /* If ring is inactive, will check when it's enabled. */
                        if (vq->private_data && !vq_log_access_ok(vq, base))
                                r = -EFAULT;
                        else
                                vq->log_base = base;
                        mutex_unlock(&vq->mutex);
                }
                break;
        case VHOST_SET_LOG_FD:
                r = get_user(fd, (int __user *)argp);
                if (r < 0)
                        break;
                ctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd);
                if (IS_ERR(ctx)) {
                        r = PTR_ERR(ctx);
                        break;
                }
                swap(ctx, d->log_ctx);
                for (i = 0; i < d->nvqs; ++i) {
                        mutex_lock(&d->vqs[i]->mutex);
                        d->vqs[i]->log_ctx = d->log_ctx;
                        mutex_unlock(&d->vqs[i]->mutex);
                }
                if (ctx)
                        eventfd_ctx_put(ctx);
                break;
        default:
                r = -ENOIOCTLCMD;
                break;
        }
done:
        return r;
}
EXPORT_SYMBOL_GPL(vhost_dev_ioctl);

/* TODO: This is really inefficient.  We need something like get_user()
 * (instruction directly accesses the data, with an exception table entry
 * returning -EFAULT). See Documentation/arch/x86/exception-tables.rst.
 */
static int set_bit_to_user(int nr, void __user *addr)
{
        unsigned long log = (unsigned long)addr;
        struct page *page;
        void *base;
        int bit = nr + (log % PAGE_SIZE) * 8;
        int r;

        r = pin_user_pages_fast(log, 1, FOLL_WRITE, &page);
        if (r < 0)
                return r;
        BUG_ON(r != 1);
        base = kmap_atomic(page);
        set_bit(bit, base);
        kunmap_atomic(base);
        unpin_user_pages_dirty_lock(&page, 1, true);
        return 0;
}

static int log_write(void __user *log_base,
                     u64 write_address, u64 write_length)
{
        u64 write_page = write_address / VHOST_PAGE_SIZE;
        int r;

        if (!write_length)
                return 0;
        write_length += write_address % VHOST_PAGE_SIZE;
        for (;;) {
                u64 base = (u64)(unsigned long)log_base;
                u64 log = base + write_page / 8;
                int bit = write_page % 8;
                if ((u64)(unsigned long)log != log)
                        return -EFAULT;
                r = set_bit_to_user(bit, (void __user *)(unsigned long)log);
                if (r < 0)
                        return r;
                if (write_length <= VHOST_PAGE_SIZE)
                        break;
                write_length -= VHOST_PAGE_SIZE;
                write_page += 1;
        }
        return r;
}

static int log_write_hva(struct vhost_virtqueue *vq, u64 hva, u64 len)
{
        struct vhost_iotlb *umem = vq->umem;
        struct vhost_iotlb_map *u;
        u64 start, end, l, min;
        int r;
        bool hit = false;

        while (len) {
                min = len;
                /* More than one GPAs can be mapped into a single HVA. So
                 * iterate all possible umems here to be safe.
                 */
                list_for_each_entry(u, &umem->list, link) {
                        if (u->addr > hva - 1 + len ||
                            u->addr - 1 + u->size < hva)
                                continue;
                        start = max(u->addr, hva);
                        end = min(u->addr - 1 + u->size, hva - 1 + len);
                        l = end - start + 1;
                        r = log_write(vq->log_base,
                                      u->start + start - u->addr,
                                      l);
                        if (r < 0)
                                return r;
                        hit = true;
                        min = min(l, min);
                }

                if (!hit)
                        return -EFAULT;

                len -= min;
                hva += min;
        }

        return 0;
}

static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len)
{
        struct iovec *iov = vq->log_iov;
        int i, ret;

        if (!vq->iotlb)
                return log_write(vq->log_base, vq->log_addr + used_offset, len);

        ret = translate_desc(vq, (uintptr_t)vq->used + used_offset,
                             len, iov, 64, VHOST_ACCESS_WO);
        if (ret < 0)
                return ret;

        for (i = 0; i < ret; i++) {
                ret = log_write_hva(vq,        (uintptr_t)iov[i].iov_base,
                                    iov[i].iov_len);
                if (ret)
                        return ret;
        }

        return 0;
}

int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
                    unsigned int log_num, u64 len, struct iovec *iov, int count)
{
        int i, r;

        /* Make sure data written is seen before log. */
        smp_wmb();

        if (vq->iotlb) {
                for (i = 0; i < count; i++) {
                        r = log_write_hva(vq, (uintptr_t)iov[i].iov_base,
                                          iov[i].iov_len);
                        if (r < 0)
                                return r;
                }
                return 0;
        }

        for (i = 0; i < log_num; ++i) {
                u64 l = min(log[i].len, len);
                r = log_write(vq->log_base, log[i].addr, l);
                if (r < 0)
                        return r;
                len -= l;
                if (!len) {
                        if (vq->log_ctx)
                                eventfd_signal(vq->log_ctx);
                        return 0;
                }
        }
        /* Length written exceeds what we have stored. This is a bug. */
        BUG();
        return 0;
}
EXPORT_SYMBOL_GPL(vhost_log_write);

static int vhost_update_used_flags(struct vhost_virtqueue *vq)
{
        void __user *used;
        if (vhost_put_used_flags(vq))
                return -EFAULT;
        if (unlikely(vq->log_used)) {
                /* Make sure the flag is seen before log. */
                smp_wmb();
                /* Log used flag write. */
                used = &vq->used->flags;
                log_used(vq, (used - (void __user *)vq->used),
                         sizeof vq->used->flags);
                if (vq->log_ctx)
                        eventfd_signal(vq->log_ctx);
        }
        return 0;
}

static int vhost_update_avail_event(struct vhost_virtqueue *vq)
{
        if (vhost_put_avail_event(vq))
                return -EFAULT;
        if (unlikely(vq->log_used)) {
                void __user *used;
                /* Make sure the event is seen before log. */
                smp_wmb();
                /* Log avail event write */
                used = vhost_avail_event(vq);
                log_used(vq, (used - (void __user *)vq->used),
                         sizeof *vhost_avail_event(vq));
                if (vq->log_ctx)
                        eventfd_signal(vq->log_ctx);
        }
        return 0;
}

int vhost_vq_init_access(struct vhost_virtqueue *vq)
{
        __virtio16 last_used_idx;
        int r;
        bool is_le = vq->is_le;

        if (!vq->private_data)
                return 0;

        vhost_init_is_le(vq);

        r = vhost_update_used_flags(vq);
        if (r)
                goto err;
        vq->signalled_used_valid = false;
        if (!vq->iotlb &&
            !access_ok(&vq->used->idx, sizeof vq->used->idx)) {
                r = -EFAULT;
                goto err;
        }
        r = vhost_get_used_idx(vq, &last_used_idx);
        if (r) {
                vq_err(vq, "Can't access used idx at %p\n",
                       &vq->used->idx);
                goto err;
        }
        vq->last_used_idx = vhost16_to_cpu(vq, last_used_idx);
        return 0;

err:
        vq->is_le = is_le;
        return r;
}
EXPORT_SYMBOL_GPL(vhost_vq_init_access);

static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len,
                          struct iovec iov[], int iov_size, int access)
{
        const struct vhost_iotlb_map *map;
        struct vhost_dev *dev = vq->dev;
        struct vhost_iotlb *umem = dev->iotlb ? dev->iotlb : dev->umem;
        struct iovec *_iov;
        u64 s = 0, last = addr + len - 1;
        int ret = 0;

        while ((u64)len > s) {
                u64 size;
                if (unlikely(ret >= iov_size)) {
                        ret = -ENOBUFS;
                        break;
                }

                map = vhost_iotlb_itree_first(umem, addr, last);
                if (map == NULL || map->start > addr) {
                        if (umem != dev->iotlb) {
                                ret = -EFAULT;
                                break;
                        }
                        ret = -EAGAIN;
                        break;
                } else if (!(map->perm & access)) {
                        ret = -EPERM;
                        break;
                }

                _iov = iov + ret;
                size = map->size - addr + map->start;
                _iov->iov_len = min((u64)len - s, size);
                _iov->iov_base = (void __user *)(unsigned long)
                                 (map->addr + addr - map->start);
                s += size;
                addr += size;
                ++ret;
        }

        if (ret == -EAGAIN)
                vhost_iotlb_miss(vq, addr, access);
        return ret;
}

/* Each buffer in the virtqueues is actually a chain of descriptors.  This
 * function returns the next descriptor in the chain,
 * or -1U if we're at the end. */
static unsigned next_desc(struct vhost_virtqueue *vq, struct vring_desc *desc)
{
        unsigned int next;

        /* If this descriptor says it doesn't chain, we're done. */
        if (!(desc->flags & cpu_to_vhost16(vq, VRING_DESC_F_NEXT)))
                return -1U;

        /* Check they're not leading us off end of descriptors. */
        next = vhost16_to_cpu(vq, READ_ONCE(desc->next));
        return next;
}

static int get_indirect(struct vhost_virtqueue *vq,
                        struct iovec iov[], unsigned int iov_size,
                        unsigned int *out_num, unsigned int *in_num,
                        struct vhost_log *log, unsigned int *log_num,
                        struct vring_desc *indirect)
{
        struct vring_desc desc;
        unsigned int i = 0, count, found = 0;
        u32 len = vhost32_to_cpu(vq, indirect->len);
        struct iov_iter from;
        int ret, access;

        /* Sanity check */
        if (unlikely(len % sizeof desc)) {
                vq_err(vq, "Invalid length in indirect descriptor: "
                       "len 0x%llx not multiple of 0x%zx\n",
                       (unsigned long long)len,
                       sizeof desc);
                return -EINVAL;
        }

        ret = translate_desc(vq, vhost64_to_cpu(vq, indirect->addr), len, vq->indirect,
                             UIO_MAXIOV, VHOST_ACCESS_RO);
        if (unlikely(ret < 0)) {
                if (ret != -EAGAIN)
                        vq_err(vq, "Translation failure %d in indirect.\n", ret);
                return ret;
        }
        iov_iter_init(&from, ITER_SOURCE, vq->indirect, ret, len);
        count = len / sizeof desc;
        /* Buffers are chained via a 16 bit next field, so
         * we can have at most 2^16 of these. */
        if (unlikely(count > USHRT_MAX + 1)) {
                vq_err(vq, "Indirect buffer length too big: %d\n",
                       indirect->len);
                return -E2BIG;
        }

        do {
                unsigned iov_count = *in_num + *out_num;
                if (unlikely(++found > count)) {
                        vq_err(vq, "Loop detected: last one at %u "
                               "indirect size %u\n",
                               i, count);
                        return -EINVAL;
                }
                if (unlikely(!copy_from_iter_full(&desc, sizeof(desc), &from))) {
                        vq_err(vq, "Failed indirect descriptor: idx %d, %zx\n",
                               i, (size_t)vhost64_to_cpu(vq, indirect->addr) + i * sizeof desc);
                        return -EINVAL;
                }
                if (unlikely(desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_INDIRECT))) {
                        vq_err(vq, "Nested indirect descriptor: idx %d, %zx\n",
                               i, (size_t)vhost64_to_cpu(vq, indirect->addr) + i * sizeof desc);
                        return -EINVAL;
                }

                if (desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_WRITE))
                        access = VHOST_ACCESS_WO;
                else
                        access = VHOST_ACCESS_RO;

                ret = translate_desc(vq, vhost64_to_cpu(vq, desc.addr),
                                     vhost32_to_cpu(vq, desc.len), iov + iov_count,
                                     iov_size - iov_count, access);
                if (unlikely(ret < 0)) {
                        if (ret != -EAGAIN)
                                vq_err(vq, "Translation failure %d indirect idx %d\n",
                                        ret, i);
                        return ret;
                }
                /* If this is an input descriptor, increment that count. */
                if (access == VHOST_ACCESS_WO) {
                        *in_num += ret;
                        if (unlikely(log && ret)) {
                                log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
                                log[*log_num].len = vhost32_to_cpu(vq, desc.len);
                                ++*log_num;
                        }
                } else {
                        /* If it's an output descriptor, they're all supposed
                         * to come before any input descriptors. */
                        if (unlikely(*in_num)) {
                                vq_err(vq, "Indirect descriptor "
                                       "has out after in: idx %d\n", i);
                                return -EINVAL;
                        }
                        *out_num += ret;
                }
        } while ((i = next_desc(vq, &desc)) != -1);
        return 0;
}

/* This looks in the virtqueue and for the first available buffer, and converts
 * it to an iovec for convenient access.  Since descriptors consist of some
 * number of output then some number of input descriptors, it's actually two
 * iovecs, but we pack them into one and note how many of each there were.
 *
 * This function returns the descriptor number found, or vq->num (which is
 * never a valid descriptor number) if none was found.  A negative code is
 * returned on error. */
int vhost_get_vq_desc(struct vhost_virtqueue *vq,
                      struct iovec iov[], unsigned int iov_size,
                      unsigned int *out_num, unsigned int *in_num,
                      struct vhost_log *log, unsigned int *log_num)
{
        struct vring_desc desc;
        unsigned int i, head, found = 0;
        u16 last_avail_idx = vq->last_avail_idx;
        __virtio16 ring_head;
        int ret, access;

        if (vq->avail_idx == vq->last_avail_idx) {
                ret = vhost_get_avail_idx(vq);
                if (unlikely(ret < 0))
                        return ret;

                if (!ret)
                        return vq->num;
        }

        /* Grab the next descriptor number they're advertising, and increment
         * the index we've seen. */
        if (unlikely(vhost_get_avail_head(vq, &ring_head, last_avail_idx))) {
                vq_err(vq, "Failed to read head: idx %d address %p\n",
                       last_avail_idx,
                       &vq->avail->ring[last_avail_idx % vq->num]);
                return -EFAULT;
        }

        head = vhost16_to_cpu(vq, ring_head);

        /* If their number is silly, that's an error. */
        if (unlikely(head >= vq->num)) {
                vq_err(vq, "Guest says index %u > %u is available",
                       head, vq->num);
                return -EINVAL;
        }

        /* When we start there are none of either input nor output. */
        *out_num = *in_num = 0;
        if (unlikely(log))
                *log_num = 0;

        i = head;
        do {
                unsigned iov_count = *in_num + *out_num;
                if (unlikely(i >= vq->num)) {
                        vq_err(vq, "Desc index is %u > %u, head = %u",
                               i, vq->num, head);
                        return -EINVAL;
                }
                if (unlikely(++found > vq->num)) {
                        vq_err(vq, "Loop detected: last one at %u "
                               "vq size %u head %u\n",
                               i, vq->num, head);
                        return -EINVAL;
                }
                ret = vhost_get_desc(vq, &desc, i);
                if (unlikely(ret)) {
                        vq_err(vq, "Failed to get descriptor: idx %d addr %p\n",
                               i, vq->desc + i);
                        return -EFAULT;
                }
                if (desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_INDIRECT)) {
                        ret = get_indirect(vq, iov, iov_size,
                                           out_num, in_num,
                                           log, log_num, &desc);
                        if (unlikely(ret < 0)) {
                                if (ret != -EAGAIN)
                                        vq_err(vq, "Failure detected "
                                                "in indirect descriptor at idx %d\n", i);
                                return ret;
                        }
                        continue;
                }

                if (desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_WRITE))
                        access = VHOST_ACCESS_WO;
                else
                        access = VHOST_ACCESS_RO;
                ret = translate_desc(vq, vhost64_to_cpu(vq, desc.addr),
                                     vhost32_to_cpu(vq, desc.len), iov + iov_count,
                                     iov_size - iov_count, access);
                if (unlikely(ret < 0)) {
                        if (ret != -EAGAIN)
                                vq_err(vq, "Translation failure %d descriptor idx %d\n",
                                        ret, i);
                        return ret;
                }
                if (access == VHOST_ACCESS_WO) {
                        /* If this is an input descriptor,
                         * increment that count. */
                        *in_num += ret;
                        if (unlikely(log && ret)) {
                                log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
                                log[*log_num].len = vhost32_to_cpu(vq, desc.len);
                                ++*log_num;
                        }
                } else {
                        /* If it's an output descriptor, they're all supposed
                         * to come before any input descriptors. */
                        if (unlikely(*in_num)) {
                                vq_err(vq, "Descriptor has out after in: "
                                       "idx %d\n", i);
                                return -EINVAL;
                        }
                        *out_num += ret;
                }
        } while ((i = next_desc(vq, &desc)) != -1);

        /* On success, increment avail index. */
        vq->last_avail_idx++;

        /* Assume notifications from guest are disabled at this point,
         * if they aren't we would need to update avail_event index. */
        BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
        return head;
}
EXPORT_SYMBOL_GPL(vhost_get_vq_desc);

/* Reverse the effect of vhost_get_vq_desc. Useful for error handling. */
void vhost_discard_vq_desc(struct vhost_virtqueue *vq, int n)
{
        vq->last_avail_idx -= n;
}
EXPORT_SYMBOL_GPL(vhost_discard_vq_desc);

/* After we've used one of their buffers, we tell them about it.  We'll then
 * want to notify the guest, using eventfd. */
int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
{
        struct vring_used_elem heads = {
                cpu_to_vhost32(vq, head),
                cpu_to_vhost32(vq, len)
        };

        return vhost_add_used_n(vq, &heads, 1);
}
EXPORT_SYMBOL_GPL(vhost_add_used);

static int __vhost_add_used_n(struct vhost_virtqueue *vq,
                            struct vring_used_elem *heads,
                            unsigned count)
{
        vring_used_elem_t __user *used;
        u16 old, new;
        int start;

        start = vq->last_used_idx & (vq->num - 1);
        used = vq->used->ring + start;
        if (vhost_put_used(vq, heads, start, count)) {
                vq_err(vq, "Failed to write used");
                return -EFAULT;
        }
        if (unlikely(vq->log_used)) {
                /* Make sure data is seen before log. */
                smp_wmb();
                /* Log used ring entry write. */
                log_used(vq, ((void __user *)used - (void __user *)vq->used),
                         count * sizeof *used);
        }
        old = vq->last_used_idx;
        new = (vq->last_used_idx += count);
        /* If the driver never bothers to signal in a very long while,
         * used index might wrap around. If that happens, invalidate
         * signalled_used index we stored. TODO: make sure driver
         * signals at least once in 2^16 and remove this. */
        if (unlikely((u16)(new - vq->signalled_used) < (u16)(new - old)))
                vq->signalled_used_valid = false;
        return 0;
}

/* After we've used one of their buffers, we tell them about it.  We'll then
 * want to notify the guest, using eventfd. */
int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
                     unsigned count)
{
        int start, n, r;

        start = vq->last_used_idx & (vq->num - 1);
        n = vq->num - start;
        if (n < count) {
                r = __vhost_add_used_n(vq, heads, n);
                if (r < 0)
                        return r;
                heads += n;
                count -= n;
        }
        r = __vhost_add_used_n(vq, heads, count);

        /* Make sure buffer is written before we update index. */
        smp_wmb();
        if (vhost_put_used_idx(vq)) {
                vq_err(vq, "Failed to increment used idx");
                return -EFAULT;
        }
        if (unlikely(vq->log_used)) {
                /* Make sure used idx is seen before log. */
                smp_wmb();
                /* Log used index update. */
                log_used(vq, offsetof(struct vring_used, idx),
                         sizeof vq->used->idx);
                if (vq->log_ctx)
                        eventfd_signal(vq->log_ctx);
        }
        return r;
}
EXPORT_SYMBOL_GPL(vhost_add_used_n);

static bool vhost_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
{
        __u16 old, new;
        __virtio16 event;
        bool v;
        /* Flush out used index updates. This is paired
         * with the barrier that the Guest executes when enabling
         * interrupts. */
        smp_mb();

        if (vhost_has_feature(vq, VIRTIO_F_NOTIFY_ON_EMPTY) &&
            unlikely(vq->avail_idx == vq->last_avail_idx))
                return true;

        if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
                __virtio16 flags;
                if (vhost_get_avail_flags(vq, &flags)) {
                        vq_err(vq, "Failed to get flags");
                        return true;
                }
                return !(flags & cpu_to_vhost16(vq, VRING_AVAIL_F_NO_INTERRUPT));
        }
        old = vq->signalled_used;
        v = vq->signalled_used_valid;
        new = vq->signalled_used = vq->last_used_idx;
        vq->signalled_used_valid = true;

        if (unlikely(!v))
                return true;

        if (vhost_get_used_event(vq, &event)) {
                vq_err(vq, "Failed to get used event idx");
                return true;
        }
        return vring_need_event(vhost16_to_cpu(vq, event), new, old);
}

/* This actually signals the guest, using eventfd. */
void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
{
        /* Signal the Guest tell them we used something up. */
        if (vq->call_ctx.ctx && vhost_notify(dev, vq))
                eventfd_signal(vq->call_ctx.ctx);
}
EXPORT_SYMBOL_GPL(vhost_signal);

/* And here's the combo meal deal.  Supersize me! */
void vhost_add_used_and_signal(struct vhost_dev *dev,
                               struct vhost_virtqueue *vq,
                               unsigned int head, int len)
{
        vhost_add_used(vq, head, len);
        vhost_signal(dev, vq);
}
EXPORT_SYMBOL_GPL(vhost_add_used_and_signal);

/* multi-buffer version of vhost_add_used_and_signal */
void vhost_add_used_and_signal_n(struct vhost_dev *dev,
                                 struct vhost_virtqueue *vq,
                                 struct vring_used_elem *heads, unsigned count)
{
        vhost_add_used_n(vq, heads, count);
        vhost_signal(dev, vq);
}
EXPORT_SYMBOL_GPL(vhost_add_used_and_signal_n);

/* return true if we're sure that avaiable ring is empty */
bool vhost_vq_avail_empty(struct vhost_dev *dev, struct vhost_virtqueue *vq)
{
        int r;

        if (vq->avail_idx != vq->last_avail_idx)
                return false;

        r = vhost_get_avail_idx(vq);

        /* Note: we treat error as non-empty here */
        return r == 0;
}
EXPORT_SYMBOL_GPL(vhost_vq_avail_empty);

/* OK, now we need to know about added descriptors. */
bool vhost_enable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
{
        int r;

        if (!(vq->used_flags & VRING_USED_F_NO_NOTIFY))
                return false;
        vq->used_flags &= ~VRING_USED_F_NO_NOTIFY;
        if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
                r = vhost_update_used_flags(vq);
                if (r) {
                        vq_err(vq, "Failed to enable notification at %p: %d\n",
                               &vq->used->flags, r);
                        return false;
                }
        } else {
                r = vhost_update_avail_event(vq);
                if (r) {
                        vq_err(vq, "Failed to update avail event index at %p: %d\n",
                               vhost_avail_event(vq), r);
                        return false;
                }
        }
        /* They could have slipped one in as we were doing that: make
         * sure it's written, then check again. */
        smp_mb();

        r = vhost_get_avail_idx(vq);
        /* Note: we treat error as empty here */
        if (unlikely(r < 0))
                return false;

        return r;
}
EXPORT_SYMBOL_GPL(vhost_enable_notify);

/* We don't need to be notified again. */
void vhost_disable_notify(struct vhost_dev *dev, struct vhost_virtqueue *vq)
{
        int r;

        if (vq->used_flags & VRING_USED_F_NO_NOTIFY)
                return;
        vq->used_flags |= VRING_USED_F_NO_NOTIFY;
        if (!vhost_has_feature(vq, VIRTIO_RING_F_EVENT_IDX)) {
                r = vhost_update_used_flags(vq);
                if (r)
                        vq_err(vq, "Failed to disable notification at %p: %d\n",
                               &vq->used->flags, r);
        }
}
EXPORT_SYMBOL_GPL(vhost_disable_notify);

/* Create a new message. */
struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type)
{
        /* Make sure all padding within the structure is initialized. */
        struct vhost_msg_node *node = kzalloc(sizeof(*node), GFP_KERNEL);
        if (!node)
                return NULL;

        node->vq = vq;
        node->msg.type = type;
        return node;
}
EXPORT_SYMBOL_GPL(vhost_new_msg);

void vhost_enqueue_msg(struct vhost_dev *dev, struct list_head *head,
                       struct vhost_msg_node *node)
{
        spin_lock(&dev->iotlb_lock);
        list_add_tail(&node->node, head);
        spin_unlock(&dev->iotlb_lock);

        wake_up_interruptible_poll(&dev->wait, EPOLLIN | EPOLLRDNORM);
}
EXPORT_SYMBOL_GPL(vhost_enqueue_msg);

struct vhost_msg_node *vhost_dequeue_msg(struct vhost_dev *dev,
                                         struct list_head *head)
{
        struct vhost_msg_node *node = NULL;

        spin_lock(&dev->iotlb_lock);
        if (!list_empty(head)) {
                node = list_first_entry(head, struct vhost_msg_node,
                                        node);
                list_del(&node->node);
        }
        spin_unlock(&dev->iotlb_lock);

        return node;
}
EXPORT_SYMBOL_GPL(vhost_dequeue_msg);

void vhost_set_backend_features(struct vhost_dev *dev, u64 features)
{
        struct vhost_virtqueue *vq;
        int i;

        mutex_lock(&dev->mutex);
        for (i = 0; i < dev->nvqs; ++i) {
                vq = dev->vqs[i];
                mutex_lock(&vq->mutex);
                vq->acked_backend_features = features;
                mutex_unlock(&vq->mutex);
        }
        mutex_unlock(&dev->mutex);
}
EXPORT_SYMBOL_GPL(vhost_set_backend_features);

static int __init vhost_init(void)
{
        return 0;
}

static void __exit vhost_exit(void)
{
}

module_init(vhost_init);
module_exit(vhost_exit);

MODULE_VERSION("0.0.1");
MODULE_LICENSE("GPL v2");
MODULE_AUTHOR("Michael S. Tsirkin");
MODULE_DESCRIPTION("Host kernel accelerator for virtio");













































































































































































































































































































































































































































    1 






















    1 










































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007        Jiri Benc <jbenc@suse.cz>
 * Copyright 2013-2014  Intel Mobile Communications GmbH
 * Copyright (C) 2017     Intel Deutschland GmbH
 * Copyright (C) 2018-2023 Intel Corporation
 */

#include <net/mac80211.h>
#include <linux/module.h>
#include <linux/fips.h>
#include <linux/init.h>
#include <linux/netdevice.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/skbuff.h>
#include <linux/etherdevice.h>
#include <linux/if_arp.h>
#include <linux/rtnetlink.h>
#include <linux/bitmap.h>
#include <linux/inetdevice.h>
#include <net/net_namespace.h>
#include <net/dropreason.h>
#include <net/cfg80211.h>
#include <net/addrconf.h>

#include "ieee80211_i.h"
#include "driver-ops.h"
#include "rate.h"
#include "mesh.h"
#include "wep.h"
#include "led.h"
#include "debugfs.h"

void ieee80211_configure_filter(struct ieee80211_local *local)
{
        u64 mc;
        unsigned int changed_flags;
        unsigned int new_flags = 0;

        if (atomic_read(&local->iff_allmultis))
                new_flags |= FIF_ALLMULTI;

        if (local->monitors || test_bit(SCAN_SW_SCANNING, &local->scanning) ||
            test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning))
                new_flags |= FIF_BCN_PRBRESP_PROMISC;

        if (local->fif_probe_req || local->probe_req_reg)
                new_flags |= FIF_PROBE_REQ;

        if (local->fif_fcsfail)
                new_flags |= FIF_FCSFAIL;

        if (local->fif_plcpfail)
                new_flags |= FIF_PLCPFAIL;

        if (local->fif_control)
                new_flags |= FIF_CONTROL;

        if (local->fif_other_bss)
                new_flags |= FIF_OTHER_BSS;

        if (local->fif_pspoll)
                new_flags |= FIF_PSPOLL;

        if (local->rx_mcast_action_reg)
                new_flags |= FIF_MCAST_ACTION;

        spin_lock_bh(&local->filter_lock);
        changed_flags = local->filter_flags ^ new_flags;

        mc = drv_prepare_multicast(local, &local->mc_list);
        spin_unlock_bh(&local->filter_lock);

        /* be a bit nasty */
        new_flags |= (1<<31);

        drv_configure_filter(local, changed_flags, &new_flags, mc);

        WARN_ON(new_flags & (1<<31));

        local->filter_flags = new_flags & ~(1<<31);
}

static void ieee80211_reconfig_filter(struct wiphy *wiphy,
                                      struct wiphy_work *work)
{
        struct ieee80211_local *local =
                container_of(work, struct ieee80211_local, reconfig_filter);

        ieee80211_configure_filter(local);
}

static u32 ieee80211_calc_hw_conf_chan(struct ieee80211_local *local,
                                       struct ieee80211_chanctx_conf *ctx)
{
        struct ieee80211_sub_if_data *sdata;
        struct cfg80211_chan_def chandef = {};
        struct cfg80211_chan_def *oper = NULL;
        enum ieee80211_smps_mode smps_mode = IEEE80211_SMPS_STATIC;
        u32 changed = 0;
        int power;
        u32 offchannel_flag;

        if (!local->emulate_chanctx)
                return 0;

        offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;

        if (ctx && !WARN_ON(!ctx->def.chan)) {
                oper = &ctx->def;
                if (ctx->rx_chains_static > 1)
                        smps_mode = IEEE80211_SMPS_OFF;
                else if (ctx->rx_chains_dynamic > 1)
                        smps_mode = IEEE80211_SMPS_DYNAMIC;
                else
                        smps_mode = IEEE80211_SMPS_STATIC;
        }

        if (local->scan_chandef.chan) {
                chandef = local->scan_chandef;
        } else if (local->tmp_channel) {
                chandef.chan = local->tmp_channel;
                chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
                chandef.center_freq1 = chandef.chan->center_freq;
                chandef.freq1_offset = chandef.chan->freq_offset;
        } else if (oper) {
                chandef = *oper;
        } else {
                chandef = local->dflt_chandef;
        }

        if (WARN(!cfg80211_chandef_valid(&chandef),
                 "control:%d.%03d MHz width:%d center: %d.%03d/%d MHz",
                 chandef.chan ? chandef.chan->center_freq : -1,
                 chandef.chan ? chandef.chan->freq_offset : 0,
                 chandef.width, chandef.center_freq1, chandef.freq1_offset,
                 chandef.center_freq2))
                return 0;

        if (!oper || !cfg80211_chandef_identical(&chandef, oper))
                local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
        else
                local->hw.conf.flags &= ~IEEE80211_CONF_OFFCHANNEL;

        offchannel_flag ^= local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;

        /* force it also for scanning, since drivers might config differently */
        if (offchannel_flag || local->scanning || local->in_reconfig ||
            !cfg80211_chandef_identical(&local->hw.conf.chandef, &chandef)) {
                local->hw.conf.chandef = chandef;
                changed |= IEEE80211_CONF_CHANGE_CHANNEL;
        }

        if (!conf_is_ht(&local->hw.conf)) {
                /*
                 * mac80211.h documents that this is only valid
                 * when the channel is set to an HT type, and
                 * that otherwise STATIC is used.
                 */
                local->hw.conf.smps_mode = IEEE80211_SMPS_STATIC;
        } else if (local->hw.conf.smps_mode != smps_mode) {
                local->hw.conf.smps_mode = smps_mode;
                changed |= IEEE80211_CONF_CHANGE_SMPS;
        }

        power = ieee80211_chandef_max_power(&chandef);

        rcu_read_lock();
        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                if (!rcu_access_pointer(sdata->vif.bss_conf.chanctx_conf))
                        continue;
                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                        continue;
                if (sdata->vif.bss_conf.txpower == INT_MIN)
                        continue;
                power = min(power, sdata->vif.bss_conf.txpower);
        }
        rcu_read_unlock();

        if (local->hw.conf.power_level != power) {
                changed |= IEEE80211_CONF_CHANGE_POWER;
                local->hw.conf.power_level = power;
        }

        return changed;
}

int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
{
        int ret = 0;

        might_sleep();

        WARN_ON(changed & (IEEE80211_CONF_CHANGE_CHANNEL |
                           IEEE80211_CONF_CHANGE_POWER |
                           IEEE80211_CONF_CHANGE_SMPS));

        if (changed && local->open_count) {
                ret = drv_config(local, changed);
                /*
                 * Goal:
                 * HW reconfiguration should never fail, the driver has told
                 * us what it can support so it should live up to that promise.
                 *
                 * Current status:
                 * rfkill is not integrated with mac80211 and a
                 * configuration command can thus fail if hardware rfkill
                 * is enabled
                 *
                 * FIXME: integrate rfkill with mac80211 and then add this
                 * WARN_ON() back
                 *
                 */
                /* WARN_ON(ret); */
        }

        return ret;
}

/* for scanning, offchannel and chanctx emulation only */
static int _ieee80211_hw_conf_chan(struct ieee80211_local *local,
                                   struct ieee80211_chanctx_conf *ctx)
{
        u32 changed;

        if (!local->open_count)
                return 0;

        changed = ieee80211_calc_hw_conf_chan(local, ctx);
        if (!changed)
                return 0;

        return drv_config(local, changed);
}

int ieee80211_hw_conf_chan(struct ieee80211_local *local)
{
        struct ieee80211_chanctx *ctx;

        ctx = list_first_entry_or_null(&local->chanctx_list,
                                       struct ieee80211_chanctx,
                                       list);

        return _ieee80211_hw_conf_chan(local, ctx ? &ctx->conf : NULL);
}

void ieee80211_hw_conf_init(struct ieee80211_local *local)
{
        u32 changed = ~(IEEE80211_CONF_CHANGE_CHANNEL |
                        IEEE80211_CONF_CHANGE_POWER |
                        IEEE80211_CONF_CHANGE_SMPS);

        if (WARN_ON(!local->open_count))
                return;

        if (local->emulate_chanctx) {
                struct ieee80211_chanctx *ctx;

                ctx = list_first_entry_or_null(&local->chanctx_list,
                                               struct ieee80211_chanctx,
                                               list);

                changed |= ieee80211_calc_hw_conf_chan(local,
                                                       ctx ? &ctx->conf : NULL);
        }

        WARN_ON(drv_config(local, changed));
}

int ieee80211_emulate_add_chanctx(struct ieee80211_hw *hw,
                                  struct ieee80211_chanctx_conf *ctx)
{
        struct ieee80211_local *local = hw_to_local(hw);

        local->hw.conf.radar_enabled = ctx->radar_enabled;

        return _ieee80211_hw_conf_chan(local, ctx);
}
EXPORT_SYMBOL(ieee80211_emulate_add_chanctx);

void ieee80211_emulate_remove_chanctx(struct ieee80211_hw *hw,
                                      struct ieee80211_chanctx_conf *ctx)
{
        struct ieee80211_local *local = hw_to_local(hw);

        local->hw.conf.radar_enabled = false;

        _ieee80211_hw_conf_chan(local, NULL);
}
EXPORT_SYMBOL(ieee80211_emulate_remove_chanctx);

void ieee80211_emulate_change_chanctx(struct ieee80211_hw *hw,
                                      struct ieee80211_chanctx_conf *ctx,
                                      u32 changed)
{
        struct ieee80211_local *local = hw_to_local(hw);

        local->hw.conf.radar_enabled = ctx->radar_enabled;

        _ieee80211_hw_conf_chan(local, ctx);
}
EXPORT_SYMBOL(ieee80211_emulate_change_chanctx);

int ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
                                         struct ieee80211_vif_chanctx_switch *vifs,
                                         int n_vifs,
                                         enum ieee80211_chanctx_switch_mode mode)
{
        struct ieee80211_local *local = hw_to_local(hw);

        if (n_vifs <= 0)
                return -EINVAL;

        local->hw.conf.radar_enabled = vifs[0].new_ctx->radar_enabled;
        _ieee80211_hw_conf_chan(local, vifs[0].new_ctx);

        return 0;
}
EXPORT_SYMBOL(ieee80211_emulate_switch_vif_chanctx);

#define BSS_CHANGED_VIF_CFG_FLAGS (BSS_CHANGED_ASSOC |\
                                   BSS_CHANGED_IDLE |\
                                   BSS_CHANGED_PS |\
                                   BSS_CHANGED_IBSS |\
                                   BSS_CHANGED_ARP_FILTER |\
                                   BSS_CHANGED_SSID |\
                                   BSS_CHANGED_MLD_VALID_LINKS |\
                                   BSS_CHANGED_MLD_TTLM)

void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                      u64 changed)
{
        struct ieee80211_local *local = sdata->local;

        might_sleep();

        WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif));

        if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                return;

        if (WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
                                    BSS_CHANGED_BEACON_ENABLED) &&
                         sdata->vif.type != NL80211_IFTYPE_AP &&
                         sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
                         sdata->vif.type != NL80211_IFTYPE_OCB))
                return;

        if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
                         sdata->vif.type == NL80211_IFTYPE_NAN ||
                         (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
                          !sdata->vif.bss_conf.mu_mimo_owner &&
                          !(changed & BSS_CHANGED_TXPOWER))))
                return;

        if (!check_sdata_in_driver(sdata))
                return;

        if (changed & BSS_CHANGED_VIF_CFG_FLAGS) {
                u64 ch = changed & BSS_CHANGED_VIF_CFG_FLAGS;

                trace_drv_vif_cfg_changed(local, sdata, changed);
                if (local->ops->vif_cfg_changed)
                        local->ops->vif_cfg_changed(&local->hw, &sdata->vif, ch);
        }

        if (changed & ~BSS_CHANGED_VIF_CFG_FLAGS) {
                u64 ch = changed & ~BSS_CHANGED_VIF_CFG_FLAGS;

                trace_drv_link_info_changed(local, sdata, &sdata->vif.bss_conf,
                                            changed);
                if (local->ops->link_info_changed)
                        local->ops->link_info_changed(&local->hw, &sdata->vif,
                                                      &sdata->vif.bss_conf, ch);
        }

        if (local->ops->bss_info_changed)
                local->ops->bss_info_changed(&local->hw, &sdata->vif,
                                             &sdata->vif.bss_conf, changed);
        trace_drv_return_void(local);
}

void ieee80211_vif_cfg_change_notify(struct ieee80211_sub_if_data *sdata,
                                     u64 changed)
{
        struct ieee80211_local *local = sdata->local;

        WARN_ON_ONCE(changed & ~BSS_CHANGED_VIF_CFG_FLAGS);

        if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                return;

        drv_vif_cfg_changed(local, sdata, changed);
}

void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       struct ieee80211_link_data *link,
                                       u64 changed)
{
        struct ieee80211_local *local = sdata->local;

        WARN_ON_ONCE(changed & BSS_CHANGED_VIF_CFG_FLAGS);

        if (!changed || sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                return;

        if (!check_sdata_in_driver(sdata))
                return;

        drv_link_info_changed(local, sdata, link->conf, link->link_id, changed);
}

u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
{
        sdata->vif.bss_conf.use_cts_prot = false;
        sdata->vif.bss_conf.use_short_preamble = false;
        sdata->vif.bss_conf.use_short_slot = false;
        return BSS_CHANGED_ERP_CTS_PROT |
               BSS_CHANGED_ERP_PREAMBLE |
               BSS_CHANGED_ERP_SLOT;
}

/* context: requires softirqs disabled */
void ieee80211_handle_queued_frames(struct ieee80211_local *local)
{
        struct sk_buff *skb;

        while ((skb = skb_dequeue(&local->skb_queue)) ||
               (skb = skb_dequeue(&local->skb_queue_unreliable))) {
                switch (skb->pkt_type) {
                case IEEE80211_RX_MSG:
                        /* Clear skb->pkt_type in order to not confuse kernel
                         * netstack. */
                        skb->pkt_type = 0;
                        ieee80211_rx(&local->hw, skb);
                        break;
                case IEEE80211_TX_STATUS_MSG:
                        skb->pkt_type = 0;
                        ieee80211_tx_status_skb(&local->hw, skb);
                        break;
                default:
                        WARN(1, "mac80211: Packet is of unknown type %d\n",
                             skb->pkt_type);
                        dev_kfree_skb(skb);
                        break;
                }
        }
}

static void ieee80211_tasklet_handler(struct tasklet_struct *t)
{
        struct ieee80211_local *local = from_tasklet(local, t, tasklet);

        ieee80211_handle_queued_frames(local);
}

static void ieee80211_restart_work(struct work_struct *work)
{
        struct ieee80211_local *local =
                container_of(work, struct ieee80211_local, restart_work);
        struct ieee80211_sub_if_data *sdata;
        int ret;

        flush_workqueue(local->workqueue);

        rtnl_lock();
        /* we might do interface manipulations, so need both */
        wiphy_lock(local->hw.wiphy);
        wiphy_work_flush(local->hw.wiphy, NULL);

        WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
             "%s called with hardware scan in progress\n", __func__);

        list_for_each_entry(sdata, &local->interfaces, list) {
                /*
                 * XXX: there may be more work for other vif types and even
                 * for station mode: a good thing would be to run most of
                 * the iface type's dependent _stop (ieee80211_mg_stop,
                 * ieee80211_ibss_stop) etc...
                 * For now, fix only the specific bug that was seen: race
                 * between csa_connection_drop_work and us.
                 */
                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                        /*
                         * This worker is scheduled from the iface worker that
                         * runs on mac80211's workqueue, so we can't be
                         * scheduling this worker after the cancel right here.
                         * The exception is ieee80211_chswitch_done.
                         * Then we can have a race...
                         */
                        wiphy_work_cancel(local->hw.wiphy,
                                          &sdata->u.mgd.csa_connection_drop_work);
                        if (sdata->vif.bss_conf.csa_active)
                                ieee80211_sta_connection_lost(sdata,
                                                              WLAN_REASON_UNSPECIFIED,
                                                              false);
                }
                wiphy_delayed_work_flush(local->hw.wiphy,
                                         &sdata->dec_tailroom_needed_wk);
        }
        ieee80211_scan_cancel(local);

        /* make sure any new ROC will consider local->in_reconfig */
        wiphy_delayed_work_flush(local->hw.wiphy, &local->roc_work);
        wiphy_work_flush(local->hw.wiphy, &local->hw_roc_done);

        /* wait for all packet processing to be done */
        synchronize_net();

        ret = ieee80211_reconfig(local);
        wiphy_unlock(local->hw.wiphy);

        if (ret)
                cfg80211_shutdown_all_interfaces(local->hw.wiphy);

        rtnl_unlock();
}

void ieee80211_restart_hw(struct ieee80211_hw *hw)
{
        struct ieee80211_local *local = hw_to_local(hw);

        trace_api_restart_hw(local);

        wiphy_info(hw->wiphy,
                   "Hardware restart was requested\n");

        /* use this reason, ieee80211_reconfig will unblock it */
        ieee80211_stop_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
                                        IEEE80211_QUEUE_STOP_REASON_SUSPEND,
                                        false);

        /*
         * Stop all Rx during the reconfig. We don't want state changes
         * or driver callbacks while this is in progress.
         */
        local->in_reconfig = true;
        barrier();

        queue_work(system_freezable_wq, &local->restart_work);
}
EXPORT_SYMBOL(ieee80211_restart_hw);

#ifdef CONFIG_INET
static int ieee80211_ifa_changed(struct notifier_block *nb,
                                 unsigned long data, void *arg)
{
        struct in_ifaddr *ifa = arg;
        struct ieee80211_local *local =
                container_of(nb, struct ieee80211_local,
                             ifa_notifier);
        struct net_device *ndev = ifa->ifa_dev->dev;
        struct wireless_dev *wdev = ndev->ieee80211_ptr;
        struct in_device *idev;
        struct ieee80211_sub_if_data *sdata;
        struct ieee80211_vif_cfg *vif_cfg;
        struct ieee80211_if_managed *ifmgd;
        int c = 0;

        /* Make sure it's our interface that got changed */
        if (!wdev)
                return NOTIFY_DONE;

        if (wdev->wiphy != local->hw.wiphy || !wdev->registered)
                return NOTIFY_DONE;

        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
        vif_cfg = &sdata->vif.cfg;

        /* ARP filtering is only supported in managed mode */
        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                return NOTIFY_DONE;

        idev = __in_dev_get_rtnl(sdata->dev);
        if (!idev)
                return NOTIFY_DONE;

        ifmgd = &sdata->u.mgd;

        /*
         * The nested here is needed to convince lockdep that this is
         * all OK. Yes, we lock the wiphy mutex here while we already
         * hold the notifier rwsem, that's the normal case. And yes,
         * we also acquire the notifier rwsem again when unregistering
         * a netdev while we already hold the wiphy mutex, so it does
         * look like a typical ABBA deadlock.
         *
         * However, both of these things happen with the RTNL held
         * already. Therefore, they can't actually happen, since the
         * lock orders really are ABC and ACB, which is fine due to
         * the RTNL (A).
         *
         * We still need to prevent recursion, which is accomplished
         * by the !wdev->registered check above.
         */
        mutex_lock_nested(&local->hw.wiphy->mtx, 1);
        __acquire(&local->hw.wiphy->mtx);

        /* Copy the addresses to the vif config list */
        ifa = rtnl_dereference(idev->ifa_list);
        while (ifa) {
                if (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN)
                        vif_cfg->arp_addr_list[c] = ifa->ifa_address;
                ifa = rtnl_dereference(ifa->ifa_next);
                c++;
        }

        vif_cfg->arp_addr_cnt = c;

        /* Configure driver only if associated (which also implies it is up) */
        if (ifmgd->associated)
                ieee80211_vif_cfg_change_notify(sdata, BSS_CHANGED_ARP_FILTER);

        wiphy_unlock(local->hw.wiphy);

        return NOTIFY_OK;
}
#endif

#if IS_ENABLED(CONFIG_IPV6)
static int ieee80211_ifa6_changed(struct notifier_block *nb,
                                  unsigned long data, void *arg)
{
        struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)arg;
        struct inet6_dev *idev = ifa->idev;
        struct net_device *ndev = ifa->idev->dev;
        struct ieee80211_local *local =
                container_of(nb, struct ieee80211_local, ifa6_notifier);
        struct wireless_dev *wdev = ndev->ieee80211_ptr;
        struct ieee80211_sub_if_data *sdata;

        /* Make sure it's our interface that got changed */
        if (!wdev || wdev->wiphy != local->hw.wiphy)
                return NOTIFY_DONE;

        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);

        /*
         * For now only support station mode. This is mostly because
         * doing AP would have to handle AP_VLAN in some way ...
         */
        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                return NOTIFY_DONE;

        drv_ipv6_addr_change(local, sdata, idev);

        return NOTIFY_OK;
}
#endif

/* There isn't a lot of sense in it, but you can transmit anything you like */
static const struct ieee80211_txrx_stypes
ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
        [NL80211_IFTYPE_ADHOC] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
        },
        [NL80211_IFTYPE_STATION] = {
                .tx = 0xffff,
                /*
                 * To support Pre Association Security Negotiation (PASN) while
                 * already associated to one AP, allow user space to register to
                 * Rx authentication frames, so that the user space logic would
                 * be able to receive/handle authentication frames from a
                 * different AP as part of PASN.
                 * It is expected that user space would intelligently register
                 * for Rx authentication frames, i.e., only when PASN is used
                 * and configure a match filter only for PASN authentication
                 * algorithm, as otherwise the MLME functionality of mac80211
                 * would be broken.
                 */
                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
        },
        [NL80211_IFTYPE_AP] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
                        BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
                        BIT(IEEE80211_STYPE_DISASSOC >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
                        BIT(IEEE80211_STYPE_ACTION >> 4),
        },
        [NL80211_IFTYPE_AP_VLAN] = {
                /* copy AP */
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
                        BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
                        BIT(IEEE80211_STYPE_DISASSOC >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
                        BIT(IEEE80211_STYPE_ACTION >> 4),
        },
        [NL80211_IFTYPE_P2P_CLIENT] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
        },
        [NL80211_IFTYPE_P2P_GO] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
                        BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
                        BIT(IEEE80211_STYPE_DISASSOC >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
                        BIT(IEEE80211_STYPE_ACTION >> 4),
        },
        [NL80211_IFTYPE_MESH_POINT] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
                        BIT(IEEE80211_STYPE_DEAUTH >> 4),
        },
        [NL80211_IFTYPE_P2P_DEVICE] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
        },
};

static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
        .ampdu_params_info = IEEE80211_HT_AMPDU_PARM_FACTOR |
                             IEEE80211_HT_AMPDU_PARM_DENSITY,

        .cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                IEEE80211_HT_CAP_MAX_AMSDU |
                                IEEE80211_HT_CAP_SGI_20 |
                                IEEE80211_HT_CAP_SGI_40 |
                                IEEE80211_HT_CAP_TX_STBC |
                                IEEE80211_HT_CAP_RX_STBC |
                                IEEE80211_HT_CAP_LDPC_CODING |
                                IEEE80211_HT_CAP_40MHZ_INTOLERANT),
        .mcs = {
                .rx_mask = { 0xff, 0xff, 0xff, 0xff, 0xff,
                             0xff, 0xff, 0xff, 0xff, 0xff, },
        },
};

static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
        .vht_cap_info =
                cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
                            IEEE80211_VHT_CAP_SHORT_GI_80 |
                            IEEE80211_VHT_CAP_SHORT_GI_160 |
                            IEEE80211_VHT_CAP_RXSTBC_MASK |
                            IEEE80211_VHT_CAP_TXSTBC |
                            IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
                            IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
                            IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN |
                            IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
                            IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK),
        .supp_mcs = {
                .rx_mcs_map = cpu_to_le16(~0),
                .tx_mcs_map = cpu_to_le16(~0),
        },
};

struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
                                           const struct ieee80211_ops *ops,
                                           const char *requested_name)
{
        struct ieee80211_local *local;
        int priv_size, i;
        struct wiphy *wiphy;
        bool emulate_chanctx;

        if (WARN_ON(!ops->tx || !ops->start || !ops->stop || !ops->config ||
                    !ops->add_interface || !ops->remove_interface ||
                    !ops->configure_filter || !ops->wake_tx_queue))
                return NULL;

        if (WARN_ON(ops->sta_state && (ops->sta_add || ops->sta_remove)))
                return NULL;

        if (WARN_ON(!!ops->link_info_changed != !!ops->vif_cfg_changed ||
                    (ops->link_info_changed && ops->bss_info_changed)))
                return NULL;

        /* check all or no channel context operations exist */
        if (ops->add_chanctx == ieee80211_emulate_add_chanctx &&
            ops->remove_chanctx == ieee80211_emulate_remove_chanctx &&
            ops->change_chanctx == ieee80211_emulate_change_chanctx) {
                if (WARN_ON(ops->assign_vif_chanctx ||
                            ops->unassign_vif_chanctx))
                        return NULL;
                emulate_chanctx = true;
        } else {
                if (WARN_ON(ops->add_chanctx == ieee80211_emulate_add_chanctx ||
                            ops->remove_chanctx == ieee80211_emulate_remove_chanctx ||
                            ops->change_chanctx == ieee80211_emulate_change_chanctx))
                        return NULL;
                if (WARN_ON(!ops->add_chanctx ||
                            !ops->remove_chanctx ||
                            !ops->change_chanctx ||
                            !ops->assign_vif_chanctx ||
                            !ops->unassign_vif_chanctx))
                        return NULL;
                emulate_chanctx = false;
        }

        /* Ensure 32-byte alignment of our private data and hw private data.
         * We use the wiphy priv data for both our ieee80211_local and for
         * the driver's private data
         *
         * In memory it'll be like this:
         *
         * +-------------------------+
         * | struct wiphy            |
         * +-------------------------+
         * | struct ieee80211_local  |
         * +-------------------------+
         * | driver's private data   |
         * +-------------------------+
         *
         */
        priv_size = ALIGN(sizeof(*local), NETDEV_ALIGN) + priv_data_len;

        wiphy = wiphy_new_nm(&mac80211_config_ops, priv_size, requested_name);

        if (!wiphy)
                return NULL;

        wiphy->mgmt_stypes = ieee80211_default_mgmt_stypes;

        wiphy->privid = mac80211_wiphy_privid;

        wiphy->flags |= WIPHY_FLAG_NETNS_OK |
                        WIPHY_FLAG_4ADDR_AP |
                        WIPHY_FLAG_4ADDR_STATION |
                        WIPHY_FLAG_REPORTS_OBSS |
                        WIPHY_FLAG_OFFCHAN_TX;

        if (emulate_chanctx || ops->remain_on_channel)
                wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;

        wiphy->features |= NL80211_FEATURE_SK_TX_STATUS |
                           NL80211_FEATURE_SAE |
                           NL80211_FEATURE_HT_IBSS |
                           NL80211_FEATURE_VIF_TXPOWER |
                           NL80211_FEATURE_MAC_ON_CREATE |
                           NL80211_FEATURE_USERSPACE_MPM |
                           NL80211_FEATURE_FULL_AP_CLIENT_STATE;
        wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_FILS_STA);
        wiphy_ext_feature_set(wiphy,
                              NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211);
        wiphy_ext_feature_set(wiphy,
                              NL80211_EXT_FEATURE_CONTROL_PORT_NO_PREAUTH);
        wiphy_ext_feature_set(wiphy,
                              NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS);
        wiphy_ext_feature_set(wiphy,
                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ);
        wiphy_ext_feature_set(wiphy,
                              NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE);

        if (!ops->hw_scan) {
                wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
                                   NL80211_FEATURE_AP_SCAN;
                /*
                 * if the driver behaves correctly using the probe request
                 * (template) from mac80211, then both of these should be
                 * supported even with hw scan - but let drivers opt in.
                 */
                wiphy_ext_feature_set(wiphy,
                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN);
                wiphy_ext_feature_set(wiphy,
                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
        }

        if (!ops->set_key) {
                wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
                wiphy_ext_feature_set(wiphy,
                                      NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT);
        }

        wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_TXQS);
        wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_RRM);

        wiphy->bss_priv_size = sizeof(struct ieee80211_bss);

        local = wiphy_priv(wiphy);

        if (sta_info_init(local))
                goto err_free;

        local->hw.wiphy = wiphy;

        local->hw.priv = (char *)local + ALIGN(sizeof(*local), NETDEV_ALIGN);

        local->ops = ops;
        local->emulate_chanctx = emulate_chanctx;

        if (emulate_chanctx)
                ieee80211_hw_set(&local->hw, CHANCTX_STA_CSA);

        /*
         * We need a bit of data queued to build aggregates properly, so
         * instruct the TCP stack to allow more than a single ms of data
         * to be queued in the stack. The value is a bit-shift of 1
         * second, so 7 is ~8ms of queued data. Only affects local TCP
         * sockets.
         * This is the default, anyhow - drivers may need to override it
         * for local reasons (longer buffers, longer completion time, or
         * similar).
         */
        local->hw.tx_sk_pacing_shift = 7;

        /* set up some defaults */
        local->hw.queues = 1;
        local->hw.max_rates = 1;
        local->hw.max_report_rates = 0;
        local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF_HT;
        local->hw.max_tx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF_HT;
        local->hw.offchannel_tx_hw_queue = IEEE80211_INVAL_HW_QUEUE;
        local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
        local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
        local->hw.radiotap_mcs_details = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
                                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
                                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
        local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
                                         IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
        local->hw.uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
        local->hw.uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
        local->hw.max_mtu = IEEE80211_MAX_DATA_LEN;
        local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
        wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
        wiphy->vht_capa_mod_mask = &mac80211_vht_capa_mod_mask;

        local->ext_capa[7] = WLAN_EXT_CAPA8_OPMODE_NOTIF;

        wiphy->extended_capabilities = local->ext_capa;
        wiphy->extended_capabilities_mask = local->ext_capa;
        wiphy->extended_capabilities_len =
                ARRAY_SIZE(local->ext_capa);

        INIT_LIST_HEAD(&local->interfaces);
        INIT_LIST_HEAD(&local->mon_list);

        __hw_addr_init(&local->mc_list);

        mutex_init(&local->iflist_mtx);
        spin_lock_init(&local->filter_lock);
        spin_lock_init(&local->rx_path_lock);
        spin_lock_init(&local->queue_stop_reason_lock);

        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                INIT_LIST_HEAD(&local->active_txqs[i]);
                spin_lock_init(&local->active_txq_lock[i]);
                local->aql_txq_limit_low[i] = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
                local->aql_txq_limit_high[i] =
                        IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H;
                atomic_set(&local->aql_ac_pending_airtime[i], 0);
        }

        local->airtime_flags = AIRTIME_USE_TX | AIRTIME_USE_RX;
        local->aql_threshold = IEEE80211_AQL_THRESHOLD;
        atomic_set(&local->aql_total_pending_airtime, 0);

        spin_lock_init(&local->handle_wake_tx_queue_lock);

        INIT_LIST_HEAD(&local->chanctx_list);

        wiphy_delayed_work_init(&local->scan_work, ieee80211_scan_work);

        INIT_WORK(&local->restart_work, ieee80211_restart_work);

        wiphy_work_init(&local->radar_detected_work,
                        ieee80211_dfs_radar_detected_work);

        wiphy_work_init(&local->reconfig_filter, ieee80211_reconfig_filter);

        wiphy_work_init(&local->dynamic_ps_enable_work,
                        ieee80211_dynamic_ps_enable_work);
        wiphy_work_init(&local->dynamic_ps_disable_work,
                        ieee80211_dynamic_ps_disable_work);
        timer_setup(&local->dynamic_ps_timer, ieee80211_dynamic_ps_timer, 0);

        wiphy_work_init(&local->sched_scan_stopped_work,
                        ieee80211_sched_scan_stopped_work);

        spin_lock_init(&local->ack_status_lock);
        idr_init(&local->ack_status_frames);

        for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
                skb_queue_head_init(&local->pending[i]);
                atomic_set(&local->agg_queue_stop[i], 0);
        }
        tasklet_setup(&local->tx_pending_tasklet, ieee80211_tx_pending);
        tasklet_setup(&local->wake_txqs_tasklet, ieee80211_wake_txqs);
        tasklet_setup(&local->tasklet, ieee80211_tasklet_handler);

        skb_queue_head_init(&local->skb_queue);
        skb_queue_head_init(&local->skb_queue_unreliable);

        ieee80211_alloc_led_names(local);

        ieee80211_roc_setup(local);

        local->hw.radiotap_timestamp.units_pos = -1;
        local->hw.radiotap_timestamp.accuracy = -1;

        return &local->hw;
 err_free:
        wiphy_free(wiphy);
        return NULL;
}
EXPORT_SYMBOL(ieee80211_alloc_hw_nm);

static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
{
        bool have_wep = !fips_enabled; /* FIPS does not permit the use of RC4 */
        bool have_mfp = ieee80211_hw_check(&local->hw, MFP_CAPABLE);
        int r = 0, w = 0;
        u32 *suites;
        static const u32 cipher_suites[] = {
                /* keep WEP first, it may be removed below */
                WLAN_CIPHER_SUITE_WEP40,
                WLAN_CIPHER_SUITE_WEP104,
                WLAN_CIPHER_SUITE_TKIP,
                WLAN_CIPHER_SUITE_CCMP,
                WLAN_CIPHER_SUITE_CCMP_256,
                WLAN_CIPHER_SUITE_GCMP,
                WLAN_CIPHER_SUITE_GCMP_256,

                /* keep last -- depends on hw flags! */
                WLAN_CIPHER_SUITE_AES_CMAC,
                WLAN_CIPHER_SUITE_BIP_CMAC_256,
                WLAN_CIPHER_SUITE_BIP_GMAC_128,
                WLAN_CIPHER_SUITE_BIP_GMAC_256,
        };

        if (ieee80211_hw_check(&local->hw, SW_CRYPTO_CONTROL) ||
            local->hw.wiphy->cipher_suites) {
                /* If the driver advertises, or doesn't support SW crypto,
                 * we only need to remove WEP if necessary.
                 */
                if (have_wep)
                        return 0;

                /* well if it has _no_ ciphers ... fine */
                if (!local->hw.wiphy->n_cipher_suites)
                        return 0;

                /* Driver provides cipher suites, but we need to exclude WEP */
                suites = kmemdup_array(local->hw.wiphy->cipher_suites,
                                       local->hw.wiphy->n_cipher_suites,
                                       sizeof(u32), GFP_KERNEL);
                if (!suites)
                        return -ENOMEM;

                for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
                        u32 suite = local->hw.wiphy->cipher_suites[r];

                        if (suite == WLAN_CIPHER_SUITE_WEP40 ||
                            suite == WLAN_CIPHER_SUITE_WEP104)
                                continue;
                        suites[w++] = suite;
                }
        } else {
                /* assign the (software supported and perhaps offloaded)
                 * cipher suites
                 */
                local->hw.wiphy->cipher_suites = cipher_suites;
                local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);

                if (!have_mfp)
                        local->hw.wiphy->n_cipher_suites -= 4;

                if (!have_wep) {
                        local->hw.wiphy->cipher_suites += 2;
                        local->hw.wiphy->n_cipher_suites -= 2;
                }

                /* not dynamically allocated, so just return */
                return 0;
        }

        local->hw.wiphy->cipher_suites = suites;
        local->hw.wiphy->n_cipher_suites = w;
        local->wiphy_ciphers_allocated = true;

        return 0;
}

static bool
ieee80211_ifcomb_check(const struct ieee80211_iface_combination *c, int n_comb)
{
        int i, j;

        for (i = 0; i < n_comb; i++, c++) {
                /* DFS is not supported with multi-channel combinations yet */
                if (c->radar_detect_widths &&
                    c->num_different_channels > 1)
                        return false;

                /* mac80211 doesn't support more than one IBSS interface */
                for (j = 0; j < c->n_limits; j++)
                        if ((c->limits[j].types & BIT(NL80211_IFTYPE_ADHOC)) &&
                            c->limits[j].max > 1)
                                return false;
        }

        return true;
}

int ieee80211_register_hw(struct ieee80211_hw *hw)
{
        struct ieee80211_local *local = hw_to_local(hw);
        int result, i;
        enum nl80211_band band;
        int channels, max_bitrates;
        bool supp_ht, supp_vht, supp_he, supp_eht;
        struct cfg80211_chan_def dflt_chandef = {};

        if (ieee80211_hw_check(hw, QUEUE_CONTROL) &&
            (local->hw.offchannel_tx_hw_queue == IEEE80211_INVAL_HW_QUEUE ||
             local->hw.offchannel_tx_hw_queue >= local->hw.queues))
                return -EINVAL;

        if ((hw->wiphy->features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH) &&
            (!local->ops->tdls_channel_switch ||
             !local->ops->tdls_cancel_channel_switch ||
             !local->ops->tdls_recv_channel_switch))
                return -EOPNOTSUPP;

        if (WARN_ON(ieee80211_hw_check(hw, SUPPORTS_TX_FRAG) &&
                    !local->ops->set_frag_threshold))
                return -EINVAL;

        if (WARN_ON(local->hw.wiphy->interface_modes &
                        BIT(NL80211_IFTYPE_NAN) &&
                    (!local->ops->start_nan || !local->ops->stop_nan)))
                return -EINVAL;

        if (hw->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO) {
                /*
                 * For drivers capable of doing MLO, assume modern driver
                 * or firmware facilities, so software doesn't have to do
                 * as much, e.g. monitoring beacons would be hard if we
                 * might not even know which link is active at which time.
                 */
                if (WARN_ON(local->emulate_chanctx))
                        return -EINVAL;

                if (WARN_ON(!local->ops->link_info_changed))
                        return -EINVAL;

                if (WARN_ON(!ieee80211_hw_check(hw, HAS_RATE_CONTROL)))
                        return -EINVAL;

                if (WARN_ON(!ieee80211_hw_check(hw, AMPDU_AGGREGATION)))
                        return -EINVAL;

                if (WARN_ON(ieee80211_hw_check(hw, HOST_BROADCAST_PS_BUFFERING)))
                        return -EINVAL;

                if (WARN_ON(ieee80211_hw_check(hw, SUPPORTS_PS) &&
                            (!ieee80211_hw_check(hw, SUPPORTS_DYNAMIC_PS) ||
                             ieee80211_hw_check(hw, PS_NULLFUNC_STACK))))
                        return -EINVAL;

                if (WARN_ON(!ieee80211_hw_check(hw, MFP_CAPABLE)))
                        return -EINVAL;

                if (WARN_ON(!ieee80211_hw_check(hw, CONNECTION_MONITOR)))
                        return -EINVAL;

                if (WARN_ON(ieee80211_hw_check(hw, NEED_DTIM_BEFORE_ASSOC)))
                        return -EINVAL;

                if (WARN_ON(ieee80211_hw_check(hw, TIMING_BEACON_ONLY)))
                        return -EINVAL;

                if (WARN_ON(!ieee80211_hw_check(hw, AP_LINK_PS)))
                        return -EINVAL;
        }

#ifdef CONFIG_PM
        if (hw->wiphy->wowlan && (!local->ops->suspend || !local->ops->resume))
                return -EINVAL;
#endif

        if (local->emulate_chanctx) {
                for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
                        const struct ieee80211_iface_combination *comb;

                        comb = &local->hw.wiphy->iface_combinations[i];

                        if (comb->num_different_channels > 1)
                                return -EINVAL;
                }
        }

        if (hw->wiphy->n_radio) {
                for (i = 0; i < hw->wiphy->n_radio; i++) {
                        const struct wiphy_radio *radio = &hw->wiphy->radio[i];

                        if (!ieee80211_ifcomb_check(radio->iface_combinations,
                                                    radio->n_iface_combinations))
                                return -EINVAL;
                }
        } else {
                if (!ieee80211_ifcomb_check(hw->wiphy->iface_combinations,
                                            hw->wiphy->n_iface_combinations))
                        return -EINVAL;
        }

        /* Only HW csum features are currently compatible with mac80211 */
        if (WARN_ON(hw->netdev_features & ~MAC80211_SUPPORTED_FEATURES))
                return -EINVAL;

        if (hw->max_report_rates == 0)
                hw->max_report_rates = hw->max_rates;

        local->rx_chains = 1;

        /*
         * generic code guarantees at least one band,
         * set this very early because much code assumes
         * that hw.conf.channel is assigned
         */
        channels = 0;
        max_bitrates = 0;
        supp_ht = false;
        supp_vht = false;
        supp_he = false;
        supp_eht = false;
        for (band = 0; band < NUM_NL80211_BANDS; band++) {
                const struct ieee80211_sband_iftype_data *iftd;
                struct ieee80211_supported_band *sband;

                sband = local->hw.wiphy->bands[band];
                if (!sband)
                        continue;

                if (!dflt_chandef.chan) {
                        /*
                         * Assign the first enabled channel to dflt_chandef
                         * from the list of channels
                         */
                        for (i = 0; i < sband->n_channels; i++)
                                if (!(sband->channels[i].flags &
                                                IEEE80211_CHAN_DISABLED))
                                        break;
                        /* if none found then use the first anyway */
                        if (i == sband->n_channels)
                                i = 0;
                        cfg80211_chandef_create(&dflt_chandef,
                                                &sband->channels[i],
                                                NL80211_CHAN_NO_HT);
                        /* init channel we're on */
                        local->monitor_chanreq.oper = dflt_chandef;
                        if (local->emulate_chanctx) {
                                local->dflt_chandef = dflt_chandef;
                                local->hw.conf.chandef = dflt_chandef;
                        }
                }

                channels += sband->n_channels;

                /*
                 * Due to the way the aggregation code handles this and it
                 * being an HT capability, we can't really support delayed
                 * BA in MLO (yet).
                 */
                if (WARN_ON(sband->ht_cap.ht_supported &&
                            (sband->ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA) &&
                            hw->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
                        return -EINVAL;

                if (max_bitrates < sband->n_bitrates)
                        max_bitrates = sband->n_bitrates;
                supp_ht = supp_ht || sband->ht_cap.ht_supported;
                supp_vht = supp_vht || sband->vht_cap.vht_supported;

                for_each_sband_iftype_data(sband, i, iftd) {
                        u8 he_40_mhz_cap;

                        supp_he = supp_he || iftd->he_cap.has_he;
                        supp_eht = supp_eht || iftd->eht_cap.has_eht;

                        if (band == NL80211_BAND_2GHZ)
                                he_40_mhz_cap =
                                        IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G;
                        else
                                he_40_mhz_cap =
                                        IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G;

                        /* currently no support for HE client where HT has 40 MHz but not HT */
                        if (iftd->he_cap.has_he &&
                            iftd->types_mask & (BIT(NL80211_IFTYPE_STATION) |
                                                BIT(NL80211_IFTYPE_P2P_CLIENT)) &&
                            sband->ht_cap.ht_supported &&
                            sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
                            !(iftd->he_cap.he_cap_elem.phy_cap_info[0] & he_40_mhz_cap))
                                return -EINVAL;
                }

                /* HT, VHT, HE require QoS, thus >= 4 queues */
                if (WARN_ON(local->hw.queues < IEEE80211_NUM_ACS &&
                            (supp_ht || supp_vht || supp_he)))
                        return -EINVAL;

                /* EHT requires HE support */
                if (WARN_ON(supp_eht && !supp_he))
                        return -EINVAL;

                if (!sband->ht_cap.ht_supported)
                        continue;

                /* TODO: consider VHT for RX chains, hopefully it's the same */
                local->rx_chains =
                        max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs),
                            local->rx_chains);

                /* no need to mask, SM_PS_DISABLED has all bits set */
                sband->ht_cap.cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
                                     IEEE80211_HT_CAP_SM_PS_SHIFT;
        }

        /* if low-level driver supports AP, we also support VLAN.
         * drivers advertising SW_CRYPTO_CONTROL should enable AP_VLAN
         * based on their support to transmit SW encrypted packets.
         */
        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP) &&
            !ieee80211_hw_check(&local->hw, SW_CRYPTO_CONTROL)) {
                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
                hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_AP_VLAN);
        }

        /* mac80211 always supports monitor */
        hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
        hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);


        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
                                      sizeof(void *) * channels, GFP_KERNEL);
        if (!local->int_scan_req)
                return -ENOMEM;

        eth_broadcast_addr(local->int_scan_req->bssid);

        for (band = 0; band < NUM_NL80211_BANDS; band++) {
                if (!local->hw.wiphy->bands[band])
                        continue;
                local->int_scan_req->rates[band] = (u32) -1;
        }

#ifndef CONFIG_MAC80211_MESH
        /* mesh depends on Kconfig, but drivers should set it if they want */
        local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
#endif

        /* if the underlying driver supports mesh, mac80211 will (at least)
         * provide routing of mesh authentication frames to userspace */
        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_MESH_POINT))
                local->hw.wiphy->flags |= WIPHY_FLAG_MESH_AUTH;

        /* mac80211 supports control port protocol changing */
        local->hw.wiphy->flags |= WIPHY_FLAG_CONTROL_PORT_PROTOCOL;

        if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) {
                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
        } else if (ieee80211_hw_check(&local->hw, SIGNAL_UNSPEC)) {
                local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
                if (hw->max_signal <= 0) {
                        result = -EINVAL;
                        goto fail_workqueue;
                }
        }

        /* Mac80211 and therefore all drivers using SW crypto only
         * are able to handle PTK rekeys and Extended Key ID.
         */
        if (!local->ops->set_key) {
                wiphy_ext_feature_set(local->hw.wiphy,
                                      NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
                wiphy_ext_feature_set(local->hw.wiphy,
                                      NL80211_EXT_FEATURE_EXT_KEY_ID);
        }

        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_ADHOC))
                wiphy_ext_feature_set(local->hw.wiphy,
                                      NL80211_EXT_FEATURE_DEL_IBSS_STA);

        /*
         * Calculate scan IE length -- we need this to alloc
         * memory and to subtract from the driver limit. It
         * includes the DS Params, (extended) supported rates, and HT
         * information -- SSID is the driver's responsibility.
         */
        local->scan_ies_len = 4 + max_bitrates /* (ext) supp rates */ +
                3 /* DS Params */;
        if (supp_ht)
                local->scan_ies_len += 2 + sizeof(struct ieee80211_ht_cap);

        if (supp_vht)
                local->scan_ies_len +=
                        2 + sizeof(struct ieee80211_vht_cap);

        /*
         * HE cap element is variable in size - set len to allow max size */
        if (supp_he) {
                local->scan_ies_len +=
                        3 + sizeof(struct ieee80211_he_cap_elem) +
                        sizeof(struct ieee80211_he_mcs_nss_supp) +
                        IEEE80211_HE_PPE_THRES_MAX_LEN;

                if (supp_eht)
                        local->scan_ies_len +=
                                3 + sizeof(struct ieee80211_eht_cap_elem) +
                                sizeof(struct ieee80211_eht_mcs_nss_supp) +
                                IEEE80211_EHT_PPE_THRES_MAX_LEN;
        }

        if (!local->ops->hw_scan) {
                /* For hw_scan, driver needs to set these up. */
                local->hw.wiphy->max_scan_ssids = 4;
                local->hw.wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
        }

        /*
         * If the driver supports any scan IEs, then assume the
         * limit includes the IEs mac80211 will add, otherwise
         * leave it at zero and let the driver sort it out; we
         * still pass our IEs to the driver but userspace will
         * not be allowed to in that case.
         */
        if (local->hw.wiphy->max_scan_ie_len)
                local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;

        result = ieee80211_init_cipher_suites(local);
        if (result < 0)
                goto fail_workqueue;

        if (!local->ops->remain_on_channel)
                local->hw.wiphy->max_remain_on_channel_duration = 5000;

        /* mac80211 based drivers don't support internal TDLS setup */
        if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;

        /* mac80211 supports eCSA, if the driver supports STA CSA at all */
        if (ieee80211_hw_check(&local->hw, CHANCTX_STA_CSA))
                local->ext_capa[0] |= WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING;

        /* mac80211 supports multi BSSID, if the driver supports it */
        if (ieee80211_hw_check(&local->hw, SUPPORTS_MULTI_BSSID)) {
                local->hw.wiphy->support_mbssid = true;
                if (ieee80211_hw_check(&local->hw,
                                       SUPPORTS_ONLY_HE_MULTI_BSSID))
                        local->hw.wiphy->support_only_he_mbssid = true;
                else
                        local->ext_capa[2] |=
                                WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT;
        }

        local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CNTDWN_COUNTERS_NUM;

        /*
         * We use the number of queues for feature tests (QoS, HT) internally
         * so restrict them appropriately.
         */
        if (hw->queues > IEEE80211_MAX_QUEUES)
                hw->queues = IEEE80211_MAX_QUEUES;

        local->workqueue =
                alloc_ordered_workqueue("%s", 0, wiphy_name(local->hw.wiphy));
        if (!local->workqueue) {
                result = -ENOMEM;
                goto fail_workqueue;
        }

        /*
         * The hardware needs headroom for sending the frame,
         * and we need some headroom for passing the frame to monitor
         * interfaces, but never both at the same time.
         */
        local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
                                   IEEE80211_TX_STATUS_HEADROOM);

        /*
         * if the driver doesn't specify a max listen interval we
         * use 5 which should be a safe default
         */
        if (local->hw.max_listen_interval == 0)
                local->hw.max_listen_interval = 5;

        local->hw.conf.listen_interval = local->hw.max_listen_interval;

        local->dynamic_ps_forced_timeout = -1;

        if (!local->hw.max_nan_de_entries)
                local->hw.max_nan_de_entries = IEEE80211_MAX_NAN_INSTANCE_ID;

        if (!local->hw.weight_multiplier)
                local->hw.weight_multiplier = 1;

        ieee80211_wep_init(local);

        local->hw.conf.flags = IEEE80211_CONF_IDLE;

        ieee80211_led_init(local);

        result = ieee80211_txq_setup_flows(local);
        if (result)
                goto fail_flows;

        rtnl_lock();
        result = ieee80211_init_rate_ctrl_alg(local,
                                              hw->rate_control_algorithm);
        rtnl_unlock();
        if (result < 0) {
                wiphy_debug(local->hw.wiphy,
                            "Failed to initialize rate control algorithm\n");
                goto fail_rate;
        }

        if (local->rate_ctrl) {
                clear_bit(IEEE80211_HW_SUPPORTS_VHT_EXT_NSS_BW, hw->flags);
                if (local->rate_ctrl->ops->capa & RATE_CTRL_CAPA_VHT_EXT_NSS_BW)
                        ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
        }

        /*
         * If the VHT capabilities don't have IEEE80211_VHT_EXT_NSS_BW_CAPABLE,
         * or have it when we don't, copy the sband structure and set/clear it.
         * This is necessary because rate scaling algorithms could be switched
         * and have different support values.
         * Print a message so that in the common case the reallocation can be
         * avoided.
         */
        BUILD_BUG_ON(NUM_NL80211_BANDS > 8 * sizeof(local->sband_allocated));
        for (band = 0; band < NUM_NL80211_BANDS; band++) {
                struct ieee80211_supported_band *sband;
                bool local_cap, ie_cap;

                local_cap = ieee80211_hw_check(hw, SUPPORTS_VHT_EXT_NSS_BW);

                sband = local->hw.wiphy->bands[band];
                if (!sband || !sband->vht_cap.vht_supported)
                        continue;

                ie_cap = !!(sband->vht_cap.vht_mcs.tx_highest &
                            cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE));

                if (local_cap == ie_cap)
                        continue;

                sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL);
                if (!sband) {
                        result = -ENOMEM;
                        goto fail_rate;
                }

                wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n",
                          band);

                sband->vht_cap.vht_mcs.tx_highest ^=
                        cpu_to_le16(IEEE80211_VHT_EXT_NSS_BW_CAPABLE);

                local->hw.wiphy->bands[band] = sband;
                local->sband_allocated |= BIT(band);
        }

        result = wiphy_register(local->hw.wiphy);
        if (result < 0)
                goto fail_wiphy_register;

        debugfs_hw_add(local);
        rate_control_add_debugfs(local);

        ieee80211_check_wbrf_support(local);

        rtnl_lock();
        wiphy_lock(hw->wiphy);

        /* add one default STA interface if supported */
        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION) &&
            !ieee80211_hw_check(hw, NO_AUTO_VIF)) {
                struct vif_params params = {0};

                result = ieee80211_if_add(local, "wlan%d", NET_NAME_ENUM, NULL,
                                          NL80211_IFTYPE_STATION, &params);
                if (result)
                        wiphy_warn(local->hw.wiphy,
                                   "Failed to add default virtual iface\n");
        }

        wiphy_unlock(hw->wiphy);
        rtnl_unlock();

#ifdef CONFIG_INET
        local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
        result = register_inetaddr_notifier(&local->ifa_notifier);
        if (result)
                goto fail_ifa;
#endif

#if IS_ENABLED(CONFIG_IPV6)
        local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
        result = register_inet6addr_notifier(&local->ifa6_notifier);
        if (result)
                goto fail_ifa6;
#endif

        return 0;

#if IS_ENABLED(CONFIG_IPV6)
 fail_ifa6:
#ifdef CONFIG_INET
        unregister_inetaddr_notifier(&local->ifa_notifier);
#endif
#endif
#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
 fail_ifa:
#endif
        wiphy_unregister(local->hw.wiphy);
 fail_wiphy_register:
        rtnl_lock();
        rate_control_deinitialize(local);
        ieee80211_remove_interfaces(local);
        rtnl_unlock();
 fail_rate:
        ieee80211_txq_teardown_flows(local);
 fail_flows:
        ieee80211_led_exit(local);
        destroy_workqueue(local->workqueue);
 fail_workqueue:
        if (local->wiphy_ciphers_allocated) {
                kfree(local->hw.wiphy->cipher_suites);
                local->wiphy_ciphers_allocated = false;
        }
        kfree(local->int_scan_req);
        return result;
}
EXPORT_SYMBOL(ieee80211_register_hw);

void ieee80211_unregister_hw(struct ieee80211_hw *hw)
{
        struct ieee80211_local *local = hw_to_local(hw);

        tasklet_kill(&local->tx_pending_tasklet);
        tasklet_kill(&local->tasklet);

#ifdef CONFIG_INET
        unregister_inetaddr_notifier(&local->ifa_notifier);
#endif
#if IS_ENABLED(CONFIG_IPV6)
        unregister_inet6addr_notifier(&local->ifa6_notifier);
#endif

        rtnl_lock();

        /*
         * At this point, interface list manipulations are fine
         * because the driver cannot be handing us frames any
         * more and the tasklet is killed.
         */
        ieee80211_remove_interfaces(local);

        ieee80211_txq_teardown_flows(local);

        wiphy_lock(local->hw.wiphy);
        wiphy_delayed_work_cancel(local->hw.wiphy, &local->roc_work);
        wiphy_work_cancel(local->hw.wiphy, &local->reconfig_filter);
        wiphy_work_cancel(local->hw.wiphy, &local->sched_scan_stopped_work);
        wiphy_work_cancel(local->hw.wiphy, &local->radar_detected_work);
        wiphy_unlock(local->hw.wiphy);
        rtnl_unlock();

        cancel_work_sync(&local->restart_work);

        ieee80211_clear_tx_pending(local);
        rate_control_deinitialize(local);

        if (skb_queue_len(&local->skb_queue) ||
            skb_queue_len(&local->skb_queue_unreliable))
                wiphy_warn(local->hw.wiphy, "skb_queue not empty\n");
        skb_queue_purge(&local->skb_queue);
        skb_queue_purge(&local->skb_queue_unreliable);

        wiphy_unregister(local->hw.wiphy);
        destroy_workqueue(local->workqueue);
        ieee80211_led_exit(local);
        kfree(local->int_scan_req);
}
EXPORT_SYMBOL(ieee80211_unregister_hw);

static int ieee80211_free_ack_frame(int id, void *p, void *data)
{
        WARN_ONCE(1, "Have pending ack frames!\n");
        kfree_skb(p);
        return 0;
}

void ieee80211_free_hw(struct ieee80211_hw *hw)
{
        struct ieee80211_local *local = hw_to_local(hw);
        enum nl80211_band band;

        mutex_destroy(&local->iflist_mtx);

        if (local->wiphy_ciphers_allocated) {
                kfree(local->hw.wiphy->cipher_suites);
                local->wiphy_ciphers_allocated = false;
        }

        idr_for_each(&local->ack_status_frames,
                     ieee80211_free_ack_frame, NULL);
        idr_destroy(&local->ack_status_frames);

        sta_info_stop(local);

        ieee80211_free_led_names(local);

        for (band = 0; band < NUM_NL80211_BANDS; band++) {
                if (!(local->sband_allocated & BIT(band)))
                        continue;
                kfree(local->hw.wiphy->bands[band]);
        }

        wiphy_free(local->hw.wiphy);
}
EXPORT_SYMBOL(ieee80211_free_hw);

static const char * const drop_reasons_monitor[] = {
#define V(x)        #x,
        [0] = "RX_DROP_MONITOR",
        MAC80211_DROP_REASONS_MONITOR(V)
};

static struct drop_reason_list drop_reason_list_monitor = {
        .reasons = drop_reasons_monitor,
        .n_reasons = ARRAY_SIZE(drop_reasons_monitor),
};

static const char * const drop_reasons_unusable[] = {
        [0] = "RX_DROP_UNUSABLE",
        MAC80211_DROP_REASONS_UNUSABLE(V)
#undef V
};

static struct drop_reason_list drop_reason_list_unusable = {
        .reasons = drop_reasons_unusable,
        .n_reasons = ARRAY_SIZE(drop_reasons_unusable),
};

static int __init ieee80211_init(void)
{
        struct sk_buff *skb;
        int ret;

        BUILD_BUG_ON(sizeof(struct ieee80211_tx_info) > sizeof(skb->cb));
        BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, driver_data) +
                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE > sizeof(skb->cb));

        ret = rc80211_minstrel_init();
        if (ret)
                return ret;

        ret = ieee80211_iface_init();
        if (ret)
                goto err_netdev;

        drop_reasons_register_subsys(SKB_DROP_REASON_SUBSYS_MAC80211_MONITOR,
                                     &drop_reason_list_monitor);
        drop_reasons_register_subsys(SKB_DROP_REASON_SUBSYS_MAC80211_UNUSABLE,
                                     &drop_reason_list_unusable);

        return 0;
 err_netdev:
        rc80211_minstrel_exit();

        return ret;
}

static void __exit ieee80211_exit(void)
{
        rc80211_minstrel_exit();

        ieee80211s_stop();

        ieee80211_iface_exit();

        drop_reasons_unregister_subsys(SKB_DROP_REASON_SUBSYS_MAC80211_MONITOR);
        drop_reasons_unregister_subsys(SKB_DROP_REASON_SUBSYS_MAC80211_UNUSABLE);

        rcu_barrier();
}


subsys_initcall(ieee80211_init);
module_exit(ieee80211_exit);

MODULE_DESCRIPTION("IEEE 802.11 subsystem");
MODULE_LICENSE("GPL");




































































































    3 
















































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef __LINUX_RTNETLINK_H
#define __LINUX_RTNETLINK_H


#include <linux/mutex.h>
#include <linux/netdevice.h>
#include <linux/wait.h>
#include <linux/refcount.h>
#include <linux/cleanup.h>
#include <uapi/linux/rtnetlink.h>

extern int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, u32 group, int echo);

static inline int rtnetlink_maybe_send(struct sk_buff *skb, struct net *net,
                                       u32 pid, u32 group, int echo)
{
        return !skb ? 0 : rtnetlink_send(skb, net, pid, group, echo);
}

extern int rtnl_unicast(struct sk_buff *skb, struct net *net, u32 pid);
extern void rtnl_notify(struct sk_buff *skb, struct net *net, u32 pid,
                        u32 group, const struct nlmsghdr *nlh, gfp_t flags);
extern void rtnl_set_sk_err(struct net *net, u32 group, int error);
extern int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics);
extern int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst,
                              u32 id, long expires, u32 error);

void rtmsg_ifinfo(int type, struct net_device *dev, unsigned int change, gfp_t flags,
                  u32 portid, const struct nlmsghdr *nlh);
void rtmsg_ifinfo_newnet(int type, struct net_device *dev, unsigned int change,
                         gfp_t flags, int *new_nsid, int new_ifindex);
struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
                                       unsigned change, u32 event,
                                       gfp_t flags, int *new_nsid,
                                       int new_ifindex, u32 portid,
                                       const struct nlmsghdr *nlh);
void rtmsg_ifinfo_send(struct sk_buff *skb, struct net_device *dev,
                       gfp_t flags, u32 portid, const struct nlmsghdr *nlh);


/* RTNL is used as a global lock for all changes to network configuration  */
extern void rtnl_lock(void);
extern void rtnl_unlock(void);
extern int rtnl_trylock(void);
extern int rtnl_is_locked(void);
extern int rtnl_lock_killable(void);
extern bool refcount_dec_and_rtnl_lock(refcount_t *r);

DEFINE_LOCK_GUARD_0(rtnl, rtnl_lock(), rtnl_unlock())

extern wait_queue_head_t netdev_unregistering_wq;
extern atomic_t dev_unreg_count;
extern struct rw_semaphore pernet_ops_rwsem;
extern struct rw_semaphore net_rwsem;

#ifdef CONFIG_PROVE_LOCKING
extern bool lockdep_rtnl_is_held(void);
#else
static inline bool lockdep_rtnl_is_held(void)
{
        return true;
}
#endif /* #ifdef CONFIG_PROVE_LOCKING */

/**
 * rcu_dereference_rtnl - rcu_dereference with debug checking
 * @p: The pointer to read, prior to dereferencing
 *
 * Do an rcu_dereference(p), but check caller either holds rcu_read_lock()
 * or RTNL. Note : Please prefer rtnl_dereference() or rcu_dereference()
 */
#define rcu_dereference_rtnl(p)                                        \
        rcu_dereference_check(p, lockdep_rtnl_is_held())

/**
 * rtnl_dereference - fetch RCU pointer when updates are prevented by RTNL
 * @p: The pointer to read, prior to dereferencing
 *
 * Return the value of the specified RCU-protected pointer, but omit
 * the READ_ONCE(), because caller holds RTNL.
 */
#define rtnl_dereference(p)                                        \
        rcu_dereference_protected(p, lockdep_rtnl_is_held())

/**
 * rcu_replace_pointer_rtnl - replace an RCU pointer under rtnl_lock, returning
 * its old value
 * @rp: RCU pointer, whose value is returned
 * @p: regular pointer
 *
 * Perform a replacement under rtnl_lock, where @rp is an RCU-annotated
 * pointer. The old value of @rp is returned, and @rp is set to @p
 */
#define rcu_replace_pointer_rtnl(rp, p)                        \
        rcu_replace_pointer(rp, p, lockdep_rtnl_is_held())

static inline struct netdev_queue *dev_ingress_queue(struct net_device *dev)
{
        return rtnl_dereference(dev->ingress_queue);
}

static inline struct netdev_queue *dev_ingress_queue_rcu(struct net_device *dev)
{
        return rcu_dereference(dev->ingress_queue);
}

struct netdev_queue *dev_ingress_queue_create(struct net_device *dev);

#ifdef CONFIG_NET_INGRESS
void net_inc_ingress_queue(void);
void net_dec_ingress_queue(void);
#endif

#ifdef CONFIG_NET_EGRESS
void net_inc_egress_queue(void);
void net_dec_egress_queue(void);
void netdev_xmit_skip_txqueue(bool skip);
#endif

void rtnetlink_init(void);
void __rtnl_unlock(void);
void rtnl_kfree_skbs(struct sk_buff *head, struct sk_buff *tail);

#define ASSERT_RTNL() \
        WARN_ONCE(!rtnl_is_locked(), \
                  "RTNL: assertion failed at %s (%d)\n", __FILE__,  __LINE__)

extern int ndo_dflt_fdb_dump(struct sk_buff *skb,
                             struct netlink_callback *cb,
                             struct net_device *dev,
                             struct net_device *filter_dev,
                             int *idx);
extern int ndo_dflt_fdb_add(struct ndmsg *ndm,
                            struct nlattr *tb[],
                            struct net_device *dev,
                            const unsigned char *addr,
                            u16 vid,
                            u16 flags);
extern int ndo_dflt_fdb_del(struct ndmsg *ndm,
                            struct nlattr *tb[],
                            struct net_device *dev,
                            const unsigned char *addr,
                            u16 vid);

extern int ndo_dflt_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
                                   struct net_device *dev, u16 mode,
                                   u32 flags, u32 mask, int nlflags,
                                   u32 filter_mask,
                                   int (*vlan_fill)(struct sk_buff *skb,
                                                    struct net_device *dev,
                                                    u32 filter_mask));

extern void rtnl_offload_xstats_notify(struct net_device *dev);

static inline int rtnl_has_listeners(const struct net *net, u32 group)
{
        struct sock *rtnl = net->rtnl;

        return netlink_has_listeners(rtnl, group);
}

/**
 * rtnl_notify_needed - check if notification is needed
 * @net: Pointer to the net namespace
 * @nlflags: netlink ingress message flags
 * @group: rtnl group
 *
 * Based on the ingress message flags and rtnl group, returns true
 * if a notification is needed, false otherwise.
 */
static inline bool
rtnl_notify_needed(const struct net *net, u16 nlflags, u32 group)
{
        return (nlflags & NLM_F_ECHO) || rtnl_has_listeners(net, group);
}

void netdev_set_operstate(struct net_device *dev, int newstate);

#endif        /* __LINUX_RTNETLINK_H */
























































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
/* SPDX-License-Identifier: GPL-2.0 */

#ifndef BTRFS_INODE_ITEM_H
#define BTRFS_INODE_ITEM_H

#include <linux/types.h>
#include <linux/crc32c.h>

struct fscrypt_str;
struct extent_buffer;
struct btrfs_trans_handle;
struct btrfs_root;
struct btrfs_path;
struct btrfs_key;
struct btrfs_inode_extref;
struct btrfs_inode;
struct btrfs_truncate_control;

/*
 * Return this if we need to call truncate_block for the last bit of the
 * truncate.
 */
#define BTRFS_NEED_TRUNCATE_BLOCK                1

struct btrfs_truncate_control {
        /*
         * IN: the inode we're operating on, this can be NULL if
         * ->clear_extent_range is false.
         */
        struct btrfs_inode *inode;

        /* IN: the size we're truncating to. */
        u64 new_size;

        /* OUT: the number of extents truncated. */
        u64 extents_found;

        /* OUT: the last size we truncated this inode to. */
        u64 last_size;

        /* OUT: the number of bytes to sub from this inode. */
        u64 sub_bytes;

        /* IN: the ino we are truncating. */
        u64 ino;

        /*
         * IN: minimum key type to remove.  All key types with this type are
         * removed only if their offset >= new_size.
         */
        u32 min_type;

        /*
         * IN: true if we don't want to do extent reference updates for any file
         * extents we drop.
         */
        bool skip_ref_updates;

        /*
         * IN: true if we need to clear the file extent range for the inode as
         * we drop the file extent items.
         */
        bool clear_extent_range;
};

/*
 * btrfs_inode_item stores flags in a u64, btrfs_inode stores them in two
 * separate u32s. These two functions convert between the two representations.
 */
static inline u64 btrfs_inode_combine_flags(u32 flags, u32 ro_flags)
{
        return (flags | ((u64)ro_flags << 32));
}

static inline void btrfs_inode_split_flags(u64 inode_item_flags,
                                           u32 *flags, u32 *ro_flags)
{
        *flags = (u32)inode_item_flags;
        *ro_flags = (u32)(inode_item_flags >> 32);
}

/* Figure the key offset of an extended inode ref. */
static inline u64 btrfs_extref_hash(u64 parent_objectid, const char *name, int len)
{
       return (u64)crc32c(parent_objectid, name, len);
}

int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               struct btrfs_truncate_control *control);
int btrfs_insert_inode_ref(struct btrfs_trans_handle *trans,
                           struct btrfs_root *root, const struct fscrypt_str *name,
                           u64 inode_objectid, u64 ref_objectid, u64 index);
int btrfs_del_inode_ref(struct btrfs_trans_handle *trans,
                        struct btrfs_root *root, const struct fscrypt_str *name,
                        u64 inode_objectid, u64 ref_objectid, u64 *index);
int btrfs_insert_empty_inode(struct btrfs_trans_handle *trans,
                             struct btrfs_root *root,
                             struct btrfs_path *path, u64 objectid);
int btrfs_lookup_inode(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root, struct btrfs_path *path,
                       struct btrfs_key *location, int mod);

struct btrfs_inode_extref *btrfs_lookup_inode_extref(
                          struct btrfs_trans_handle *trans,
                          struct btrfs_root *root,
                          struct btrfs_path *path,
                          const struct fscrypt_str *name,
                          u64 inode_objectid, u64 ref_objectid, int ins_len,
                          int cow);

struct btrfs_inode_ref *btrfs_find_name_in_backref(const struct extent_buffer *leaf,
                                                   int slot,
                                                   const struct fscrypt_str *name);
struct btrfs_inode_extref *btrfs_find_name_in_ext_backref(
                const struct extent_buffer *leaf, int slot, u64 ref_objectid,
                const struct fscrypt_str *name);

#endif






















































































































































































































































































































































































































































































































































































































































































































































































































































































































































    2 
    2 















































































































































    2 



    2 




























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    2 























    2 

    2 


    2 


















































































































































































































































































































    2 














































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































    3 
















































    3 





































    2 















    2 




































































































































































































    2 
    2 



    2 

    2 








    2 














    2 

    2 


















































    2 



    2 






    2 








    2 







    2 

    2 
    2 
















    2 






    2 



    2 













    2 
    2 





    2 











    2 









    2 






































    2 











    2 



    2 














    2 

    2 







    2 





    2 



























































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
3414
3415
3416
3417
3418
3419
3420
3421
3422
3423
3424
3425
3426
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444
3445
3446
3447
3448
3449
3450
3451
3452
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462
3463
3464
3465
3466
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
3748
3749
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
3785
3786
3787
3788
3789
3790
3791
3792
3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
3841
3842
3843
3844
3845
3846
3847
3848
3849
3850
3851
3852
3853
3854
3855
3856
3857
3858
3859
3860
3861
3862
3863
3864
3865
3866
3867
3868
3869
3870
3871
3872
3873
3874
3875
3876
3877
3878
3879
3880
3881
3882
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
3898
3899
3900
3901
3902
3903
3904
3905
3906
3907
3908
3909
3910
3911
3912
3913
3914
3915
3916
3917
3918
3919
3920
3921
3922
3923
3924
3925
3926
3927
3928
3929
3930
3931
3932
3933
3934
3935
3936
3937
3938
3939
3940
3941
3942
3943
3944
3945
3946
3947
3948
3949
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960
3961
3962
3963
3964
3965
3966
3967
3968
3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995
3996
3997
3998
3999
4000
4001
4002
4003
4004
4005
4006
4007
4008
4009
4010
4011
4012
4013
4014
4015
4016
4017
4018
4019
4020
4021
4022
4023
4024
4025
4026
4027
4028
4029
4030
4031
4032
4033
4034
4035
4036
4037
4038
4039
4040
4041
4042
4043
4044
4045
4046
4047
4048
4049
4050
4051
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061
4062
4063
4064
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
4097
4098
4099
4100
4101
4102
4103
4104
4105
4106
4107
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
4123
4124
4125
4126
4127
4128
4129
4130
4131
4132
4133
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
4172
4173
4174
4175
4176
4177
4178
4179
4180
4181
4182
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214
4215
4216
4217
4218
4219
4220
4221
4222
4223
4224
4225
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
4249
4250
4251
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287
4288
4289
4290
4291
4292
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303
4304
4305
4306
4307
4308
4309
4310
4311
4312
4313
4314
4315
4316
4317
4318
4319
4320
4321
4322
4323
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
4367
4368
4369
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379
4380
4381
4382
4383
4384
4385
4386
4387
4388
4389
4390
4391
4392
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404
4405
4406
4407
4408
4409
4410
4411
4412
4413
4414
4415
4416
4417
4418
4419
4420
4421
4422
4423
4424
4425
4426
4427
4428
4429
4430
4431
4432
4433
4434
4435
4436
4437
4438
4439
4440
4441
4442
4443
4444
4445
4446
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457
4458
4459
4460
4461
4462
4463
4464
4465
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475
4476
4477
4478
4479
4480
4481
4482
4483
4484
4485
4486
4487
4488
4489
4490
4491
4492
4493
4494
4495
4496
4497
4498
4499
4500
4501
4502
4503
4504
4505
4506
4507
4508
4509
4510
4511
4512
4513
4514
4515
4516
4517
4518
4519
4520
4521
4522
4523
4524
4525
4526
4527
4528
4529
4530
4531
4532
4533
4534
4535
4536
4537
4538
4539
4540
4541
4542
4543
4544
4545
4546
4547
4548
4549
4550
4551
4552
4553
4554
4555
4556
4557
4558
4559
4560
4561
4562
4563
4564
4565
4566
4567
4568
4569
4570
4571
4572
4573
4574
4575
4576
4577
4578
4579
4580
4581
4582
4583
4584
4585
4586
4587
4588
4589
4590
4591
4592
4593
4594
4595
4596
4597
4598
4599
4600
4601
4602
4603
4604
4605
4606
4607
4608
4609
4610
4611
4612
4613
4614
4615
4616
4617
4618
4619
4620
4621
4622
4623
4624
4625
4626
4627
4628
4629
4630
4631
4632
4633
4634
4635
4636
4637
4638
4639
4640
4641
4642
4643
4644
4645
4646
4647
4648
4649
4650
4651
4652
4653
4654
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
4670
4671
4672
4673
4674
4675
4676
4677
4678
4679
4680
4681
4682
4683
4684
4685
4686
4687
4688
4689
4690
4691
4692
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
4709
4710
4711
4712
4713
4714
4715
4716
4717
4718
4719
4720
4721
4722
4723
4724
4725
4726
4727
4728
4729
4730
4731
4732
4733
4734
4735
4736
4737
4738
4739
4740
4741
4742
4743
4744
4745
4746
4747
4748
4749
4750
4751
4752
4753
4754
4755
4756
4757
4758
4759
4760
4761
4762
4763
4764
4765
4766
4767
4768
4769
4770
4771
4772
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
4788
4789
4790
4791
4792
4793
4794
4795
4796
4797
4798
4799
4800
4801
4802
4803
4804
4805
4806
4807
4808
4809
4810
4811
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826
4827
4828
4829
4830
4831
4832
4833
4834
4835
4836
4837
4838
4839
4840
4841
4842
4843
4844
4845
4846
4847
4848
4849
4850
4851
4852
4853
4854
4855
4856
4857
4858
4859
4860
4861
4862
4863
4864
4865
4866
4867
4868
4869
4870
4871
4872
4873
4874
4875
4876
4877
4878
4879
4880
4881
4882
4883
4884
4885
4886
4887
4888
4889
4890
4891
4892
4893
4894
4895
4896
4897
4898
4899
4900
4901
4902
4903
4904
4905
4906
4907
4908
4909
4910
4911
4912
4913
4914
4915
4916
4917
4918
4919
4920
4921
4922
4923
4924
4925
4926
4927
4928
4929
4930
4931
4932
4933
4934
4935
4936
4937
4938
4939
4940
4941
4942
4943
4944
4945
4946
4947
4948
4949
4950
4951
4952
4953
4954
4955
4956
4957
4958
4959
4960
4961
4962
4963
4964
4965
4966
4967
4968
4969
4970
4971
4972
4973
4974
4975
4976
4977
4978
4979
4980
4981
4982
4983
4984
4985
4986
4987
4988
4989
4990
4991
4992
4993
4994
4995
4996
4997
4998
4999
5000
5001
5002
5003
5004
5005
5006
5007
5008
5009
5010
5011
5012
5013
5014
5015
5016
5017
5018
5019
5020
5021
5022
5023
5024
5025
5026
5027
5028
5029
5030
5031
5032
5033
5034
5035
5036
5037
5038
5039
5040
5041
5042
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
5080
5081
5082
5083
5084
5085
5086
5087
5088
5089
5090
5091
5092
5093
5094
5095
5096
5097
5098
5099
5100
5101
5102
5103
5104
5105
5106
5107
5108
5109
5110
5111
5112
5113
5114
5115
5116
5117
5118
5119
5120
5121
5122
5123
5124
5125
5126
5127
5128
5129
5130
5131
5132
5133
5134
5135
5136
5137
5138
5139
5140
5141
5142
5143
5144
5145
5146
5147
5148
5149
5150
5151
5152
5153
5154
5155
5156
5157
5158
5159
5160
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170
5171
5172
5173
5174
5175
5176
5177
5178
5179
5180
5181
5182
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
5198
5199
5200
5201
5202
5203
5204
5205
5206
5207
5208
5209
5210
5211
5212
5213
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224
5225
5226
5227
5228
5229
5230
5231
5232
5233
5234
5235
5236
5237
5238
5239
5240
5241
5242
5243
5244
5245
5246
5247
5248
5249
5250
5251
5252
5253
5254
5255
5256
5257
5258
5259
5260
5261
5262
5263
5264
5265
5266
5267
5268
5269
5270
5271
5272
5273
5274
5275
5276
5277
5278
5279
5280
5281
5282
5283
5284
5285
5286
5287
5288
5289
5290
5291
5292
5293
5294
5295
5296
5297
5298
5299
5300
5301
5302
5303
5304
5305
5306
5307
5308
5309
5310
5311
5312
5313
5314
5315
5316
5317
5318
5319
5320
5321
5322
5323
5324
5325
5326
5327
5328
5329
5330
5331
5332
5333
5334
5335
5336
5337
5338
5339
5340
5341
5342
5343
5344
5345
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
5357
5358
5359
5360
5361
5362
5363
5364
5365
5366
5367
5368
5369
5370
5371
5372
5373
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
5389
5390
5391
5392
5393
5394
5395
5396
5397
5398
5399
5400
5401
5402
5403
5404
5405
5406
5407
5408
5409
5410
5411
5412
5413
5414
5415
5416
5417
5418
5419
5420
5421
5422
5423
5424
5425
5426
5427
5428
5429
5430
5431
5432
5433
5434
5435
5436
5437
5438
5439
5440
5441
5442
5443
5444
5445
5446
5447
5448
5449
5450
5451
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
5475
5476
5477
5478
5479
5480
5481
5482
5483
5484
5485
5486
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
5507
5508
5509
5510
5511
5512
5513
5514
5515
5516
5517
5518
5519
5520
5521
5522
5523
5524
5525
5526
5527
5528
5529
5530
5531
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
5545
5546
5547
5548
5549
5550
5551
5552
5553
5554
5555
5556
5557
5558
5559
5560
5561
5562
5563
5564
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
5585
5586
5587
5588
5589
5590
5591
5592
5593
5594
5595
5596
5597
5598
5599
5600
5601
5602
5603
5604
5605
5606
5607
5608
5609
5610
5611
5612
5613
5614
5615
5616
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629
5630
5631
5632
5633
5634
5635
5636
5637
5638
5639
5640
5641
5642
5643
5644
5645
5646
5647
5648
5649
5650
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662
5663
5664
5665
5666
5667
5668
5669
5670
5671
5672
5673
5674
5675
5676
5677
5678
5679
5680
5681
5682
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699
5700
5701
5702
5703
5704
5705
5706
5707
5708
5709
5710
5711
5712
5713
5714
5715
5716
5717
5718
5719
5720
5721
5722
5723
5724
5725
5726
5727
5728
5729
5730
5731
5732
5733
5734
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751
5752
5753
5754
5755
5756
5757
5758
5759
5760
5761
5762
5763
5764
5765
5766
5767
5768
5769
5770
5771
5772
5773
5774
5775
5776
5777
5778
5779
5780
5781
5782
5783
5784
5785
5786
5787
5788
5789
5790
5791
5792
5793
5794
5795
5796
5797
5798
5799
5800
5801
5802
5803
5804
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
5815
5816
5817
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827
5828
5829
5830
5831
5832
5833
5834
5835
5836
5837
5838
5839
5840
5841
5842
5843
5844
5845
5846
5847
5848
5849
5850
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865
5866
5867
5868
5869
5870
5871
5872
5873
5874
5875
5876
5877
5878
5879
5880
5881
5882
5883
5884
5885
5886
5887
5888
5889
5890
5891
5892
5893
5894
5895
5896
5897
5898
5899
5900
5901
5902
5903
5904
5905
5906
5907
5908
5909
5910
5911
5912
5913
5914
5915
5916
5917
5918
5919
5920
5921
5922
5923
5924
5925
5926
5927
5928
5929
5930
5931
5932
5933
5934
5935
5936
5937
5938
5939
5940
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
5959
5960
5961
5962
5963
5964
5965
5966
5967
5968
5969
5970
5971
5972
5973
5974
5975
5976
5977
5978
5979
5980
5981
5982
5983
5984
5985
5986
5987
5988
5989
5990
5991
5992
5993
5994
5995
5996
5997
5998
5999
6000
6001
6002
6003
6004
6005
6006
6007
6008
6009
6010
6011
6012
6013
6014
6015
6016
6017
6018
6019
6020
6021
6022
6023
6024
6025
6026
6027
6028
6029
6030
6031
6032
6033
6034
6035
6036
6037
6038
6039
6040
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074
6075
6076
6077
6078
6079
6080
6081
6082
6083
6084
6085
6086
6087
6088
6089
6090
6091
6092
6093
6094
6095
6096
6097
6098
6099
6100
6101
6102
6103
6104
6105
6106
6107
6108
6109
6110
6111
6112
6113
6114
6115
6116
6117
6118
6119
6120
6121
6122
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
6135
6136
6137
6138
6139
6140
6141
6142
6143
6144
6145
6146
6147
6148
6149
6150
6151
6152
6153
6154
6155
6156
6157
6158
6159
6160
6161
6162
6163
6164
6165
6166
6167
6168
6169
6170
6171
6172
6173
6174
6175
6176
6177
6178
6179
6180
6181
6182
6183
6184
6185
6186
6187
6188
6189
6190
6191
6192
6193
6194
6195
6196
6197
6198
6199
6200
6201
6202
6203
6204
6205
6206
6207
6208
6209
6210
6211
6212
6213
6214
6215
6216
6217
6218
6219
6220
6221
6222
6223
6224
6225
6226
6227
6228
6229
6230
6231
6232
6233
6234
6235
6236
6237
6238
6239
6240
6241
6242
6243
6244
6245
6246
6247
6248
6249
6250
6251
6252
6253
6254
6255
6256
6257
6258
6259
6260
6261
6262
6263
6264
6265
6266
6267
6268
6269
6270
6271
6272
6273
6274
6275
6276
6277
6278
6279
6280
6281
6282
6283
6284
6285
6286
6287
6288
6289
6290
6291
6292
6293
6294
6295
6296
6297
6298
6299
6300
6301
6302
6303
6304
6305
6306
6307
6308
6309
6310
6311
6312
6313
6314
6315
6316
6317
6318
6319
6320
6321
6322
6323
6324
6325
6326
6327
6328
6329
6330
6331
6332
6333
6334
6335
6336
6337
6338
6339
6340
6341
6342
6343
6344
6345
6346
6347
6348
6349
6350
6351
6352
6353
6354
6355
6356
6357
6358
6359
6360
6361
6362
6363
6364
6365
6366
6367
6368
6369
6370
6371
6372
6373
6374
6375
6376
6377
6378
6379
6380
6381
6382
6383
6384
6385
6386
6387
6388
6389
6390
6391
6392
6393
6394
6395
6396
6397
6398
6399
6400
6401
6402
6403
6404
6405
6406
6407
6408
6409
6410
6411
6412
6413
6414
6415
6416
6417
6418
6419
6420
6421
6422
6423
6424
6425
6426
6427
6428
6429
6430
6431
6432
6433
6434
6435
6436
6437
6438
6439
6440
6441
6442
6443
6444
6445
6446
6447
6448
6449
6450
6451
6452
6453
6454
6455
6456
6457
6458
6459
6460
6461
6462
// SPDX-License-Identifier: GPL-2.0
#include <linux/ceph/ceph_debug.h>

#include <linux/fs.h>
#include <linux/wait.h>
#include <linux/slab.h>
#include <linux/gfp.h>
#include <linux/sched.h>
#include <linux/debugfs.h>
#include <linux/seq_file.h>
#include <linux/ratelimit.h>
#include <linux/bits.h>
#include <linux/ktime.h>
#include <linux/bitmap.h>
#include <linux/mnt_idmapping.h>

#include "super.h"
#include "mds_client.h"
#include "crypto.h"

#include <linux/ceph/ceph_features.h>
#include <linux/ceph/messenger.h>
#include <linux/ceph/decode.h>
#include <linux/ceph/pagelist.h>
#include <linux/ceph/auth.h>
#include <linux/ceph/debugfs.h>

#define RECONNECT_MAX_SIZE (INT_MAX - PAGE_SIZE)

/*
 * A cluster of MDS (metadata server) daemons is responsible for
 * managing the file system namespace (the directory hierarchy and
 * inodes) and for coordinating shared access to storage.  Metadata is
 * partitioning hierarchically across a number of servers, and that
 * partition varies over time as the cluster adjusts the distribution
 * in order to balance load.
 *
 * The MDS client is primarily responsible to managing synchronous
 * metadata requests for operations like open, unlink, and so forth.
 * If there is a MDS failure, we find out about it when we (possibly
 * request and) receive a new MDS map, and can resubmit affected
 * requests.
 *
 * For the most part, though, we take advantage of a lossless
 * communications channel to the MDS, and do not need to worry about
 * timing out or resubmitting requests.
 *
 * We maintain a stateful "session" with each MDS we interact with.
 * Within each session, we sent periodic heartbeat messages to ensure
 * any capabilities or leases we have been issues remain valid.  If
 * the session times out and goes stale, our leases and capabilities
 * are no longer valid.
 */

struct ceph_reconnect_state {
        struct ceph_mds_session *session;
        int nr_caps, nr_realms;
        struct ceph_pagelist *pagelist;
        unsigned msg_version;
        bool allow_multi;
};

static void __wake_requests(struct ceph_mds_client *mdsc,
                            struct list_head *head);
static void ceph_cap_release_work(struct work_struct *work);
static void ceph_cap_reclaim_work(struct work_struct *work);

static const struct ceph_connection_operations mds_con_ops;


/*
 * mds reply parsing
 */

static int parse_reply_info_quota(void **p, void *end,
                                  struct ceph_mds_reply_info_in *info)
{
        u8 struct_v, struct_compat;
        u32 struct_len;

        ceph_decode_8_safe(p, end, struct_v, bad);
        ceph_decode_8_safe(p, end, struct_compat, bad);
        /* struct_v is expected to be >= 1. we only
         * understand encoding with struct_compat == 1. */
        if (!struct_v || struct_compat != 1)
                goto bad;
        ceph_decode_32_safe(p, end, struct_len, bad);
        ceph_decode_need(p, end, struct_len, bad);
        end = *p + struct_len;
        ceph_decode_64_safe(p, end, info->max_bytes, bad);
        ceph_decode_64_safe(p, end, info->max_files, bad);
        *p = end;
        return 0;
bad:
        return -EIO;
}

/*
 * parse individual inode info
 */
static int parse_reply_info_in(void **p, void *end,
                               struct ceph_mds_reply_info_in *info,
                               u64 features)
{
        int err = 0;
        u8 struct_v = 0;

        if (features == (u64)-1) {
                u32 struct_len;
                u8 struct_compat;
                ceph_decode_8_safe(p, end, struct_v, bad);
                ceph_decode_8_safe(p, end, struct_compat, bad);
                /* struct_v is expected to be >= 1. we only understand
                 * encoding with struct_compat == 1. */
                if (!struct_v || struct_compat != 1)
                        goto bad;
                ceph_decode_32_safe(p, end, struct_len, bad);
                ceph_decode_need(p, end, struct_len, bad);
                end = *p + struct_len;
        }

        ceph_decode_need(p, end, sizeof(struct ceph_mds_reply_inode), bad);
        info->in = *p;
        *p += sizeof(struct ceph_mds_reply_inode) +
                sizeof(*info->in->fragtree.splits) *
                le32_to_cpu(info->in->fragtree.nsplits);

        ceph_decode_32_safe(p, end, info->symlink_len, bad);
        ceph_decode_need(p, end, info->symlink_len, bad);
        info->symlink = *p;
        *p += info->symlink_len;

        ceph_decode_copy_safe(p, end, &info->dir_layout,
                              sizeof(info->dir_layout), bad);
        ceph_decode_32_safe(p, end, info->xattr_len, bad);
        ceph_decode_need(p, end, info->xattr_len, bad);
        info->xattr_data = *p;
        *p += info->xattr_len;

        if (features == (u64)-1) {
                /* inline data */
                ceph_decode_64_safe(p, end, info->inline_version, bad);
                ceph_decode_32_safe(p, end, info->inline_len, bad);
                ceph_decode_need(p, end, info->inline_len, bad);
                info->inline_data = *p;
                *p += info->inline_len;
                /* quota */
                err = parse_reply_info_quota(p, end, info);
                if (err < 0)
                        goto out_bad;
                /* pool namespace */
                ceph_decode_32_safe(p, end, info->pool_ns_len, bad);
                if (info->pool_ns_len > 0) {
                        ceph_decode_need(p, end, info->pool_ns_len, bad);
                        info->pool_ns_data = *p;
                        *p += info->pool_ns_len;
                }

                /* btime */
                ceph_decode_need(p, end, sizeof(info->btime), bad);
                ceph_decode_copy(p, &info->btime, sizeof(info->btime));

                /* change attribute */
                ceph_decode_64_safe(p, end, info->change_attr, bad);

                /* dir pin */
                if (struct_v >= 2) {
                        ceph_decode_32_safe(p, end, info->dir_pin, bad);
                } else {
                        info->dir_pin = -ENODATA;
                }

                /* snapshot birth time, remains zero for v<=2 */
                if (struct_v >= 3) {
                        ceph_decode_need(p, end, sizeof(info->snap_btime), bad);
                        ceph_decode_copy(p, &info->snap_btime,
                                         sizeof(info->snap_btime));
                } else {
                        memset(&info->snap_btime, 0, sizeof(info->snap_btime));
                }

                /* snapshot count, remains zero for v<=3 */
                if (struct_v >= 4) {
                        ceph_decode_64_safe(p, end, info->rsnaps, bad);
                } else {
                        info->rsnaps = 0;
                }

                if (struct_v >= 5) {
                        u32 alen;

                        ceph_decode_32_safe(p, end, alen, bad);

                        while (alen--) {
                                u32 len;

                                /* key */
                                ceph_decode_32_safe(p, end, len, bad);
                                ceph_decode_skip_n(p, end, len, bad);
                                /* value */
                                ceph_decode_32_safe(p, end, len, bad);
                                ceph_decode_skip_n(p, end, len, bad);
                        }
                }

                /* fscrypt flag -- ignore */
                if (struct_v >= 6)
                        ceph_decode_skip_8(p, end, bad);

                info->fscrypt_auth = NULL;
                info->fscrypt_auth_len = 0;
                info->fscrypt_file = NULL;
                info->fscrypt_file_len = 0;
                if (struct_v >= 7) {
                        ceph_decode_32_safe(p, end, info->fscrypt_auth_len, bad);
                        if (info->fscrypt_auth_len) {
                                info->fscrypt_auth = kmalloc(info->fscrypt_auth_len,
                                                             GFP_KERNEL);
                                if (!info->fscrypt_auth)
                                        return -ENOMEM;
                                ceph_decode_copy_safe(p, end, info->fscrypt_auth,
                                                      info->fscrypt_auth_len, bad);
                        }
                        ceph_decode_32_safe(p, end, info->fscrypt_file_len, bad);
                        if (info->fscrypt_file_len) {
                                info->fscrypt_file = kmalloc(info->fscrypt_file_len,
                                                             GFP_KERNEL);
                                if (!info->fscrypt_file)
                                        return -ENOMEM;
                                ceph_decode_copy_safe(p, end, info->fscrypt_file,
                                                      info->fscrypt_file_len, bad);
                        }
                }
                *p = end;
        } else {
                /* legacy (unversioned) struct */
                if (features & CEPH_FEATURE_MDS_INLINE_DATA) {
                        ceph_decode_64_safe(p, end, info->inline_version, bad);
                        ceph_decode_32_safe(p, end, info->inline_len, bad);
                        ceph_decode_need(p, end, info->inline_len, bad);
                        info->inline_data = *p;
                        *p += info->inline_len;
                } else
                        info->inline_version = CEPH_INLINE_NONE;

                if (features & CEPH_FEATURE_MDS_QUOTA) {
                        err = parse_reply_info_quota(p, end, info);
                        if (err < 0)
                                goto out_bad;
                } else {
                        info->max_bytes = 0;
                        info->max_files = 0;
                }

                info->pool_ns_len = 0;
                info->pool_ns_data = NULL;
                if (features & CEPH_FEATURE_FS_FILE_LAYOUT_V2) {
                        ceph_decode_32_safe(p, end, info->pool_ns_len, bad);
                        if (info->pool_ns_len > 0) {
                                ceph_decode_need(p, end, info->pool_ns_len, bad);
                                info->pool_ns_data = *p;
                                *p += info->pool_ns_len;
                        }
                }

                if (features & CEPH_FEATURE_FS_BTIME) {
                        ceph_decode_need(p, end, sizeof(info->btime), bad);
                        ceph_decode_copy(p, &info->btime, sizeof(info->btime));
                        ceph_decode_64_safe(p, end, info->change_attr, bad);
                }

                info->dir_pin = -ENODATA;
                /* info->snap_btime and info->rsnaps remain zero */
        }
        return 0;
bad:
        err = -EIO;
out_bad:
        return err;
}

static int parse_reply_info_dir(void **p, void *end,
                                struct ceph_mds_reply_dirfrag **dirfrag,
                                u64 features)
{
        if (features == (u64)-1) {
                u8 struct_v, struct_compat;
                u32 struct_len;
                ceph_decode_8_safe(p, end, struct_v, bad);
                ceph_decode_8_safe(p, end, struct_compat, bad);
                /* struct_v is expected to be >= 1. we only understand
                 * encoding whose struct_compat == 1. */
                if (!struct_v || struct_compat != 1)
                        goto bad;
                ceph_decode_32_safe(p, end, struct_len, bad);
                ceph_decode_need(p, end, struct_len, bad);
                end = *p + struct_len;
        }

        ceph_decode_need(p, end, sizeof(**dirfrag), bad);
        *dirfrag = *p;
        *p += sizeof(**dirfrag) + sizeof(u32) * le32_to_cpu((*dirfrag)->ndist);
        if (unlikely(*p > end))
                goto bad;
        if (features == (u64)-1)
                *p = end;
        return 0;
bad:
        return -EIO;
}

static int parse_reply_info_lease(void **p, void *end,
                                  struct ceph_mds_reply_lease **lease,
                                  u64 features, u32 *altname_len, u8 **altname)
{
        u8 struct_v;
        u32 struct_len;
        void *lend;

        if (features == (u64)-1) {
                u8 struct_compat;

                ceph_decode_8_safe(p, end, struct_v, bad);
                ceph_decode_8_safe(p, end, struct_compat, bad);

                /* struct_v is expected to be >= 1. we only understand
                 * encoding whose struct_compat == 1. */
                if (!struct_v || struct_compat != 1)
                        goto bad;

                ceph_decode_32_safe(p, end, struct_len, bad);
        } else {
                struct_len = sizeof(**lease);
                *altname_len = 0;
                *altname = NULL;
        }

        lend = *p + struct_len;
        ceph_decode_need(p, end, struct_len, bad);
        *lease = *p;
        *p += sizeof(**lease);

        if (features == (u64)-1) {
                if (struct_v >= 2) {
                        ceph_decode_32_safe(p, end, *altname_len, bad);
                        ceph_decode_need(p, end, *altname_len, bad);
                        *altname = *p;
                        *p += *altname_len;
                } else {
                        *altname = NULL;
                        *altname_len = 0;
                }
        }
        *p = lend;
        return 0;
bad:
        return -EIO;
}

/*
 * parse a normal reply, which may contain a (dir+)dentry and/or a
 * target inode.
 */
static int parse_reply_info_trace(void **p, void *end,
                                  struct ceph_mds_reply_info_parsed *info,
                                  u64 features)
{
        int err;

        if (info->head->is_dentry) {
                err = parse_reply_info_in(p, end, &info->diri, features);
                if (err < 0)
                        goto out_bad;

                err = parse_reply_info_dir(p, end, &info->dirfrag, features);
                if (err < 0)
                        goto out_bad;

                ceph_decode_32_safe(p, end, info->dname_len, bad);
                ceph_decode_need(p, end, info->dname_len, bad);
                info->dname = *p;
                *p += info->dname_len;

                err = parse_reply_info_lease(p, end, &info->dlease, features,
                                             &info->altname_len, &info->altname);
                if (err < 0)
                        goto out_bad;
        }

        if (info->head->is_target) {
                err = parse_reply_info_in(p, end, &info->targeti, features);
                if (err < 0)
                        goto out_bad;
        }

        if (unlikely(*p != end))
                goto bad;
        return 0;

bad:
        err = -EIO;
out_bad:
        pr_err("problem parsing mds trace %d\n", err);
        return err;
}

/*
 * parse readdir results
 */
static int parse_reply_info_readdir(void **p, void *end,
                                    struct ceph_mds_request *req,
                                    u64 features)
{
        struct ceph_mds_reply_info_parsed *info = &req->r_reply_info;
        struct ceph_client *cl = req->r_mdsc->fsc->client;
        u32 num, i = 0;
        int err;

        err = parse_reply_info_dir(p, end, &info->dir_dir, features);
        if (err < 0)
                goto out_bad;

        ceph_decode_need(p, end, sizeof(num) + 2, bad);
        num = ceph_decode_32(p);
        {
                u16 flags = ceph_decode_16(p);
                info->dir_end = !!(flags & CEPH_READDIR_FRAG_END);
                info->dir_complete = !!(flags & CEPH_READDIR_FRAG_COMPLETE);
                info->hash_order = !!(flags & CEPH_READDIR_HASH_ORDER);
                info->offset_hash = !!(flags & CEPH_READDIR_OFFSET_HASH);
        }
        if (num == 0)
                goto done;

        BUG_ON(!info->dir_entries);
        if ((unsigned long)(info->dir_entries + num) >
            (unsigned long)info->dir_entries + info->dir_buf_size) {
                pr_err_client(cl, "dir contents are larger than expected\n");
                WARN_ON(1);
                goto bad;
        }

        info->dir_nr = num;
        while (num) {
                struct inode *inode = d_inode(req->r_dentry);
                struct ceph_inode_info *ci = ceph_inode(inode);
                struct ceph_mds_reply_dir_entry *rde = info->dir_entries + i;
                struct fscrypt_str tname = FSTR_INIT(NULL, 0);
                struct fscrypt_str oname = FSTR_INIT(NULL, 0);
                struct ceph_fname fname;
                u32 altname_len, _name_len;
                u8 *altname, *_name;

                /* dentry */
                ceph_decode_32_safe(p, end, _name_len, bad);
                ceph_decode_need(p, end, _name_len, bad);
                _name = *p;
                *p += _name_len;
                doutc(cl, "parsed dir dname '%.*s'\n", _name_len, _name);

                if (info->hash_order)
                        rde->raw_hash = ceph_str_hash(ci->i_dir_layout.dl_dir_hash,
                                                      _name, _name_len);

                /* dentry lease */
                err = parse_reply_info_lease(p, end, &rde->lease, features,
                                             &altname_len, &altname);
                if (err)
                        goto out_bad;

                /*
                 * Try to dencrypt the dentry names and update them
                 * in the ceph_mds_reply_dir_entry struct.
                 */
                fname.dir = inode;
                fname.name = _name;
                fname.name_len = _name_len;
                fname.ctext = altname;
                fname.ctext_len = altname_len;
                /*
                 * The _name_len maybe larger than altname_len, such as
                 * when the human readable name length is in range of
                 * (CEPH_NOHASH_NAME_MAX, CEPH_NOHASH_NAME_MAX + SHA256_DIGEST_SIZE),
                 * then the copy in ceph_fname_to_usr will corrupt the
                 * data if there has no encryption key.
                 *
                 * Just set the no_copy flag and then if there has no
                 * encryption key the oname.name will be assigned to
                 * _name always.
                 */
                fname.no_copy = true;
                if (altname_len == 0) {
                        /*
                         * Set tname to _name, and this will be used
                         * to do the base64_decode in-place. It's
                         * safe because the decoded string should
                         * always be shorter, which is 3/4 of origin
                         * string.
                         */
                        tname.name = _name;

                        /*
                         * Set oname to _name too, and this will be
                         * used to do the dencryption in-place.
                         */
                        oname.name = _name;
                        oname.len = _name_len;
                } else {
                        /*
                         * This will do the decryption only in-place
                         * from altname cryptext directly.
                         */
                        oname.name = altname;
                        oname.len = altname_len;
                }
                rde->is_nokey = false;
                err = ceph_fname_to_usr(&fname, &tname, &oname, &rde->is_nokey);
                if (err) {
                        pr_err_client(cl, "unable to decode %.*s, got %d\n",
                                      _name_len, _name, err);
                        goto out_bad;
                }
                rde->name = oname.name;
                rde->name_len = oname.len;

                /* inode */
                err = parse_reply_info_in(p, end, &rde->inode, features);
                if (err < 0)
                        goto out_bad;
                /* ceph_readdir_prepopulate() will update it */
                rde->offset = 0;
                i++;
                num--;
        }

done:
        /* Skip over any unrecognized fields */
        *p = end;
        return 0;

bad:
        err = -EIO;
out_bad:
        pr_err_client(cl, "problem parsing dir contents %d\n", err);
        return err;
}

/*
 * parse fcntl F_GETLK results
 */
static int parse_reply_info_filelock(void **p, void *end,
                                     struct ceph_mds_reply_info_parsed *info,
                                     u64 features)
{
        if (*p + sizeof(*info->filelock_reply) > end)
                goto bad;

        info->filelock_reply = *p;

        /* Skip over any unrecognized fields */
        *p = end;
        return 0;
bad:
        return -EIO;
}


#if BITS_PER_LONG == 64

#define DELEGATED_INO_AVAILABLE                xa_mk_value(1)

static int ceph_parse_deleg_inos(void **p, void *end,
                                 struct ceph_mds_session *s)
{
        struct ceph_client *cl = s->s_mdsc->fsc->client;
        u32 sets;

        ceph_decode_32_safe(p, end, sets, bad);
        doutc(cl, "got %u sets of delegated inodes\n", sets);
        while (sets--) {
                u64 start, len;

                ceph_decode_64_safe(p, end, start, bad);
                ceph_decode_64_safe(p, end, len, bad);

                /* Don't accept a delegation of system inodes */
                if (start < CEPH_INO_SYSTEM_BASE) {
                        pr_warn_ratelimited_client(cl,
                                "ignoring reserved inode range delegation (start=0x%llx len=0x%llx)\n",
                                start, len);
                        continue;
                }
                while (len--) {
                        int err = xa_insert(&s->s_delegated_inos, start++,
                                            DELEGATED_INO_AVAILABLE,
                                            GFP_KERNEL);
                        if (!err) {
                                doutc(cl, "added delegated inode 0x%llx\n", start - 1);
                        } else if (err == -EBUSY) {
                                pr_warn_client(cl,
                                        "MDS delegated inode 0x%llx more than once.\n",
                                        start - 1);
                        } else {
                                return err;
                        }
                }
        }
        return 0;
bad:
        return -EIO;
}

u64 ceph_get_deleg_ino(struct ceph_mds_session *s)
{
        unsigned long ino;
        void *val;

        xa_for_each(&s->s_delegated_inos, ino, val) {
                val = xa_erase(&s->s_delegated_inos, ino);
                if (val == DELEGATED_INO_AVAILABLE)
                        return ino;
        }
        return 0;
}

int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino)
{
        return xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE,
                         GFP_KERNEL);
}
#else /* BITS_PER_LONG == 64 */
/*
 * FIXME: xarrays can't handle 64-bit indexes on a 32-bit arch. For now, just
 * ignore delegated_inos on 32 bit arch. Maybe eventually add xarrays for top
 * and bottom words?
 */
static int ceph_parse_deleg_inos(void **p, void *end,
                                 struct ceph_mds_session *s)
{
        u32 sets;

        ceph_decode_32_safe(p, end, sets, bad);
        if (sets)
                ceph_decode_skip_n(p, end, sets * 2 * sizeof(__le64), bad);
        return 0;
bad:
        return -EIO;
}

u64 ceph_get_deleg_ino(struct ceph_mds_session *s)
{
        return 0;
}

int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino)
{
        return 0;
}
#endif /* BITS_PER_LONG == 64 */

/*
 * parse create results
 */
static int parse_reply_info_create(void **p, void *end,
                                  struct ceph_mds_reply_info_parsed *info,
                                  u64 features, struct ceph_mds_session *s)
{
        int ret;

        if (features == (u64)-1 ||
            (features & CEPH_FEATURE_REPLY_CREATE_INODE)) {
                if (*p == end) {
                        /* Malformed reply? */
                        info->has_create_ino = false;
                } else if (test_bit(CEPHFS_FEATURE_DELEG_INO, &s->s_features)) {
                        info->has_create_ino = true;
                        /* struct_v, struct_compat, and len */
                        ceph_decode_skip_n(p, end, 2 + sizeof(u32), bad);
                        ceph_decode_64_safe(p, end, info->ino, bad);
                        ret = ceph_parse_deleg_inos(p, end, s);
                        if (ret)
                                return ret;
                } else {
                        /* legacy */
                        ceph_decode_64_safe(p, end, info->ino, bad);
                        info->has_create_ino = true;
                }
        } else {
                if (*p != end)
                        goto bad;
        }

        /* Skip over any unrecognized fields */
        *p = end;
        return 0;
bad:
        return -EIO;
}

static int parse_reply_info_getvxattr(void **p, void *end,
                                      struct ceph_mds_reply_info_parsed *info,
                                      u64 features)
{
        u32 value_len;

        ceph_decode_skip_8(p, end, bad); /* skip current version: 1 */
        ceph_decode_skip_8(p, end, bad); /* skip first version: 1 */
        ceph_decode_skip_32(p, end, bad); /* skip payload length */

        ceph_decode_32_safe(p, end, value_len, bad);

        if (value_len == end - *p) {
          info->xattr_info.xattr_value = *p;
          info->xattr_info.xattr_value_len = value_len;
          *p = end;
          return value_len;
        }
bad:
        return -EIO;
}

/*
 * parse extra results
 */
static int parse_reply_info_extra(void **p, void *end,
                                  struct ceph_mds_request *req,
                                  u64 features, struct ceph_mds_session *s)
{
        struct ceph_mds_reply_info_parsed *info = &req->r_reply_info;
        u32 op = le32_to_cpu(info->head->op);

        if (op == CEPH_MDS_OP_GETFILELOCK)
                return parse_reply_info_filelock(p, end, info, features);
        else if (op == CEPH_MDS_OP_READDIR || op == CEPH_MDS_OP_LSSNAP)
                return parse_reply_info_readdir(p, end, req, features);
        else if (op == CEPH_MDS_OP_CREATE)
                return parse_reply_info_create(p, end, info, features, s);
        else if (op == CEPH_MDS_OP_GETVXATTR)
                return parse_reply_info_getvxattr(p, end, info, features);
        else
                return -EIO;
}

/*
 * parse entire mds reply
 */
static int parse_reply_info(struct ceph_mds_session *s, struct ceph_msg *msg,
                            struct ceph_mds_request *req, u64 features)
{
        struct ceph_mds_reply_info_parsed *info = &req->r_reply_info;
        struct ceph_client *cl = s->s_mdsc->fsc->client;
        void *p, *end;
        u32 len;
        int err;

        info->head = msg->front.iov_base;
        p = msg->front.iov_base + sizeof(struct ceph_mds_reply_head);
        end = p + msg->front.iov_len - sizeof(struct ceph_mds_reply_head);

        /* trace */
        ceph_decode_32_safe(&p, end, len, bad);
        if (len > 0) {
                ceph_decode_need(&p, end, len, bad);
                err = parse_reply_info_trace(&p, p+len, info, features);
                if (err < 0)
                        goto out_bad;
        }

        /* extra */
        ceph_decode_32_safe(&p, end, len, bad);
        if (len > 0) {
                ceph_decode_need(&p, end, len, bad);
                err = parse_reply_info_extra(&p, p+len, req, features, s);
                if (err < 0)
                        goto out_bad;
        }

        /* snap blob */
        ceph_decode_32_safe(&p, end, len, bad);
        info->snapblob_len = len;
        info->snapblob = p;
        p += len;

        if (p != end)
                goto bad;
        return 0;

bad:
        err = -EIO;
out_bad:
        pr_err_client(cl, "mds parse_reply err %d\n", err);
        ceph_msg_dump(msg);
        return err;
}

static void destroy_reply_info(struct ceph_mds_reply_info_parsed *info)
{
        int i;

        kfree(info->diri.fscrypt_auth);
        kfree(info->diri.fscrypt_file);
        kfree(info->targeti.fscrypt_auth);
        kfree(info->targeti.fscrypt_file);
        if (!info->dir_entries)
                return;

        for (i = 0; i < info->dir_nr; i++) {
                struct ceph_mds_reply_dir_entry *rde = info->dir_entries + i;

                kfree(rde->inode.fscrypt_auth);
                kfree(rde->inode.fscrypt_file);
        }
        free_pages((unsigned long)info->dir_entries, get_order(info->dir_buf_size));
}

/*
 * In async unlink case the kclient won't wait for the first reply
 * from MDS and just drop all the links and unhash the dentry and then
 * succeeds immediately.
 *
 * For any new create/link/rename,etc requests followed by using the
 * same file names we must wait for the first reply of the inflight
 * unlink request, or the MDS possibly will fail these following
 * requests with -EEXIST if the inflight async unlink request was
 * delayed for some reasons.
 *
 * And the worst case is that for the none async openc request it will
 * successfully open the file if the CDentry hasn't been unlinked yet,
 * but later the previous delayed async unlink request will remove the
 * CDenty. That means the just created file is possiblly deleted later
 * by accident.
 *
 * We need to wait for the inflight async unlink requests to finish
 * when creating new files/directories by using the same file names.
 */
int ceph_wait_on_conflict_unlink(struct dentry *dentry)
{
        struct ceph_fs_client *fsc = ceph_sb_to_fs_client(dentry->d_sb);
        struct ceph_client *cl = fsc->client;
        struct dentry *pdentry = dentry->d_parent;
        struct dentry *udentry, *found = NULL;
        struct ceph_dentry_info *di;
        struct qstr dname;
        u32 hash = dentry->d_name.hash;
        int err;

        dname.name = dentry->d_name.name;
        dname.len = dentry->d_name.len;

        rcu_read_lock();
        hash_for_each_possible_rcu(fsc->async_unlink_conflict, di,
                                   hnode, hash) {
                udentry = di->dentry;

                spin_lock(&udentry->d_lock);
                if (udentry->d_name.hash != hash)
                        goto next;
                if (unlikely(udentry->d_parent != pdentry))
                        goto next;
                if (!hash_hashed(&di->hnode))
                        goto next;

                if (!test_bit(CEPH_DENTRY_ASYNC_UNLINK_BIT, &di->flags))
                        pr_warn_client(cl, "dentry %p:%pd async unlink bit is not set\n",
                                       dentry, dentry);

                if (!d_same_name(udentry, pdentry, &dname))
                        goto next;

                found = dget_dlock(udentry);
                spin_unlock(&udentry->d_lock);
                break;
next:
                spin_unlock(&udentry->d_lock);
        }
        rcu_read_unlock();

        if (likely(!found))
                return 0;

        doutc(cl, "dentry %p:%pd conflict with old %p:%pd\n", dentry, dentry,
              found, found);

        err = wait_on_bit(&di->flags, CEPH_DENTRY_ASYNC_UNLINK_BIT,
                          TASK_KILLABLE);
        dput(found);
        return err;
}


/*
 * sessions
 */
const char *ceph_session_state_name(int s)
{
        switch (s) {
        case CEPH_MDS_SESSION_NEW: return "new";
        case CEPH_MDS_SESSION_OPENING: return "opening";
        case CEPH_MDS_SESSION_OPEN: return "open";
        case CEPH_MDS_SESSION_HUNG: return "hung";
        case CEPH_MDS_SESSION_CLOSING: return "closing";
        case CEPH_MDS_SESSION_CLOSED: return "closed";
        case CEPH_MDS_SESSION_RESTARTING: return "restarting";
        case CEPH_MDS_SESSION_RECONNECTING: return "reconnecting";
        case CEPH_MDS_SESSION_REJECTED: return "rejected";
        default: return "???";
        }
}

struct ceph_mds_session *ceph_get_mds_session(struct ceph_mds_session *s)
{
        if (refcount_inc_not_zero(&s->s_ref))
                return s;
        return NULL;
}

void ceph_put_mds_session(struct ceph_mds_session *s)
{
        if (IS_ERR_OR_NULL(s))
                return;

        if (refcount_dec_and_test(&s->s_ref)) {
                if (s->s_auth.authorizer)
                        ceph_auth_destroy_authorizer(s->s_auth.authorizer);
                WARN_ON(mutex_is_locked(&s->s_mutex));
                xa_destroy(&s->s_delegated_inos);
                kfree(s);
        }
}

/*
 * called under mdsc->mutex
 */
struct ceph_mds_session *__ceph_lookup_mds_session(struct ceph_mds_client *mdsc,
                                                   int mds)
{
        if (mds >= mdsc->max_sessions || !mdsc->sessions[mds])
                return NULL;
        return ceph_get_mds_session(mdsc->sessions[mds]);
}

static bool __have_session(struct ceph_mds_client *mdsc, int mds)
{
        if (mds >= mdsc->max_sessions || !mdsc->sessions[mds])
                return false;
        else
                return true;
}

static int __verify_registered_session(struct ceph_mds_client *mdsc,
                                       struct ceph_mds_session *s)
{
        if (s->s_mds >= mdsc->max_sessions ||
            mdsc->sessions[s->s_mds] != s)
                return -ENOENT;
        return 0;
}

/*
 * create+register a new session for given mds.
 * called under mdsc->mutex.
 */
static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
                                                 int mds)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_session *s;

        if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_FENCE_IO)
                return ERR_PTR(-EIO);

        if (mds >= mdsc->mdsmap->possible_max_rank)
                return ERR_PTR(-EINVAL);

        s = kzalloc(sizeof(*s), GFP_NOFS);
        if (!s)
                return ERR_PTR(-ENOMEM);

        if (mds >= mdsc->max_sessions) {
                int newmax = 1 << get_count_order(mds + 1);
                struct ceph_mds_session **sa;

                doutc(cl, "realloc to %d\n", newmax);
                sa = kcalloc(newmax, sizeof(void *), GFP_NOFS);
                if (!sa)
                        goto fail_realloc;
                if (mdsc->sessions) {
                        memcpy(sa, mdsc->sessions,
                               mdsc->max_sessions * sizeof(void *));
                        kfree(mdsc->sessions);
                }
                mdsc->sessions = sa;
                mdsc->max_sessions = newmax;
        }

        doutc(cl, "mds%d\n", mds);
        s->s_mdsc = mdsc;
        s->s_mds = mds;
        s->s_state = CEPH_MDS_SESSION_NEW;
        mutex_init(&s->s_mutex);

        ceph_con_init(&s->s_con, s, &mds_con_ops, &mdsc->fsc->client->msgr);

        atomic_set(&s->s_cap_gen, 1);
        s->s_cap_ttl = jiffies - 1;

        spin_lock_init(&s->s_cap_lock);
        INIT_LIST_HEAD(&s->s_caps);
        refcount_set(&s->s_ref, 1);
        INIT_LIST_HEAD(&s->s_waiting);
        INIT_LIST_HEAD(&s->s_unsafe);
        xa_init(&s->s_delegated_inos);
        INIT_LIST_HEAD(&s->s_cap_releases);
        INIT_WORK(&s->s_cap_release_work, ceph_cap_release_work);

        INIT_LIST_HEAD(&s->s_cap_dirty);
        INIT_LIST_HEAD(&s->s_cap_flushing);

        mdsc->sessions[mds] = s;
        atomic_inc(&mdsc->num_sessions);
        refcount_inc(&s->s_ref);  /* one ref to sessions[], one to caller */

        ceph_con_open(&s->s_con, CEPH_ENTITY_TYPE_MDS, mds,
                      ceph_mdsmap_get_addr(mdsc->mdsmap, mds));

        return s;

fail_realloc:
        kfree(s);
        return ERR_PTR(-ENOMEM);
}

/*
 * called under mdsc->mutex
 */
static void __unregister_session(struct ceph_mds_client *mdsc,
                               struct ceph_mds_session *s)
{
        doutc(mdsc->fsc->client, "mds%d %p\n", s->s_mds, s);
        BUG_ON(mdsc->sessions[s->s_mds] != s);
        mdsc->sessions[s->s_mds] = NULL;
        ceph_con_close(&s->s_con);
        ceph_put_mds_session(s);
        atomic_dec(&mdsc->num_sessions);
}

/*
 * drop session refs in request.
 *
 * should be last request ref, or hold mdsc->mutex
 */
static void put_request_session(struct ceph_mds_request *req)
{
        if (req->r_session) {
                ceph_put_mds_session(req->r_session);
                req->r_session = NULL;
        }
}

void ceph_mdsc_iterate_sessions(struct ceph_mds_client *mdsc,
                                void (*cb)(struct ceph_mds_session *),
                                bool check_state)
{
        int mds;

        mutex_lock(&mdsc->mutex);
        for (mds = 0; mds < mdsc->max_sessions; ++mds) {
                struct ceph_mds_session *s;

                s = __ceph_lookup_mds_session(mdsc, mds);
                if (!s)
                        continue;

                if (check_state && !check_session_state(s)) {
                        ceph_put_mds_session(s);
                        continue;
                }

                mutex_unlock(&mdsc->mutex);
                cb(s);
                ceph_put_mds_session(s);
                mutex_lock(&mdsc->mutex);
        }
        mutex_unlock(&mdsc->mutex);
}

void ceph_mdsc_release_request(struct kref *kref)
{
        struct ceph_mds_request *req = container_of(kref,
                                                    struct ceph_mds_request,
                                                    r_kref);
        ceph_mdsc_release_dir_caps_async(req);
        destroy_reply_info(&req->r_reply_info);
        if (req->r_request)
                ceph_msg_put(req->r_request);
        if (req->r_reply)
                ceph_msg_put(req->r_reply);
        if (req->r_inode) {
                ceph_put_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);
                iput(req->r_inode);
        }
        if (req->r_parent) {
                ceph_put_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);
                iput(req->r_parent);
        }
        iput(req->r_target_inode);
        iput(req->r_new_inode);
        if (req->r_dentry)
                dput(req->r_dentry);
        if (req->r_old_dentry)
                dput(req->r_old_dentry);
        if (req->r_old_dentry_dir) {
                /*
                 * track (and drop pins for) r_old_dentry_dir
                 * separately, since r_old_dentry's d_parent may have
                 * changed between the dir mutex being dropped and
                 * this request being freed.
                 */
                ceph_put_cap_refs(ceph_inode(req->r_old_dentry_dir),
                                  CEPH_CAP_PIN);
                iput(req->r_old_dentry_dir);
        }
        kfree(req->r_path1);
        kfree(req->r_path2);
        put_cred(req->r_cred);
        if (req->r_mnt_idmap)
                mnt_idmap_put(req->r_mnt_idmap);
        if (req->r_pagelist)
                ceph_pagelist_release(req->r_pagelist);
        kfree(req->r_fscrypt_auth);
        kfree(req->r_altname);
        put_request_session(req);
        ceph_unreserve_caps(req->r_mdsc, &req->r_caps_reservation);
        WARN_ON_ONCE(!list_empty(&req->r_wait));
        kmem_cache_free(ceph_mds_request_cachep, req);
}

DEFINE_RB_FUNCS(request, struct ceph_mds_request, r_tid, r_node)

/*
 * lookup session, bump ref if found.
 *
 * called under mdsc->mutex.
 */
static struct ceph_mds_request *
lookup_get_request(struct ceph_mds_client *mdsc, u64 tid)
{
        struct ceph_mds_request *req;

        req = lookup_request(&mdsc->request_tree, tid);
        if (req)
                ceph_mdsc_get_request(req);

        return req;
}

/*
 * Register an in-flight request, and assign a tid.  Link to directory
 * are modifying (if any).
 *
 * Called under mdsc->mutex.
 */
static void __register_request(struct ceph_mds_client *mdsc,
                               struct ceph_mds_request *req,
                               struct inode *dir)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int ret = 0;

        req->r_tid = ++mdsc->last_tid;
        if (req->r_num_caps) {
                ret = ceph_reserve_caps(mdsc, &req->r_caps_reservation,
                                        req->r_num_caps);
                if (ret < 0) {
                        pr_err_client(cl, "%p failed to reserve caps: %d\n",
                                      req, ret);
                        /* set req->r_err to fail early from __do_request */
                        req->r_err = ret;
                        return;
                }
        }
        doutc(cl, "%p tid %lld\n", req, req->r_tid);
        ceph_mdsc_get_request(req);
        insert_request(&mdsc->request_tree, req);

        req->r_cred = get_current_cred();
        if (!req->r_mnt_idmap)
                req->r_mnt_idmap = &nop_mnt_idmap;

        if (mdsc->oldest_tid == 0 && req->r_op != CEPH_MDS_OP_SETFILELOCK)
                mdsc->oldest_tid = req->r_tid;

        if (dir) {
                struct ceph_inode_info *ci = ceph_inode(dir);

                ihold(dir);
                req->r_unsafe_dir = dir;
                spin_lock(&ci->i_unsafe_lock);
                list_add_tail(&req->r_unsafe_dir_item, &ci->i_unsafe_dirops);
                spin_unlock(&ci->i_unsafe_lock);
        }
}

static void __unregister_request(struct ceph_mds_client *mdsc,
                                 struct ceph_mds_request *req)
{
        doutc(mdsc->fsc->client, "%p tid %lld\n", req, req->r_tid);

        /* Never leave an unregistered request on an unsafe list! */
        list_del_init(&req->r_unsafe_item);

        if (req->r_tid == mdsc->oldest_tid) {
                struct rb_node *p = rb_next(&req->r_node);
                mdsc->oldest_tid = 0;
                while (p) {
                        struct ceph_mds_request *next_req =
                                rb_entry(p, struct ceph_mds_request, r_node);
                        if (next_req->r_op != CEPH_MDS_OP_SETFILELOCK) {
                                mdsc->oldest_tid = next_req->r_tid;
                                break;
                        }
                        p = rb_next(p);
                }
        }

        erase_request(&mdsc->request_tree, req);

        if (req->r_unsafe_dir) {
                struct ceph_inode_info *ci = ceph_inode(req->r_unsafe_dir);
                spin_lock(&ci->i_unsafe_lock);
                list_del_init(&req->r_unsafe_dir_item);
                spin_unlock(&ci->i_unsafe_lock);
        }
        if (req->r_target_inode &&
            test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags)) {
                struct ceph_inode_info *ci = ceph_inode(req->r_target_inode);
                spin_lock(&ci->i_unsafe_lock);
                list_del_init(&req->r_unsafe_target_item);
                spin_unlock(&ci->i_unsafe_lock);
        }

        if (req->r_unsafe_dir) {
                iput(req->r_unsafe_dir);
                req->r_unsafe_dir = NULL;
        }

        complete_all(&req->r_safe_completion);

        ceph_mdsc_put_request(req);
}

/*
 * Walk back up the dentry tree until we hit a dentry representing a
 * non-snapshot inode. We do this using the rcu_read_lock (which must be held
 * when calling this) to ensure that the objects won't disappear while we're
 * working with them. Once we hit a candidate dentry, we attempt to take a
 * reference to it, and return that as the result.
 */
static struct inode *get_nonsnap_parent(struct dentry *dentry)
{
        struct inode *inode = NULL;

        while (dentry && !IS_ROOT(dentry)) {
                inode = d_inode_rcu(dentry);
                if (!inode || ceph_snap(inode) == CEPH_NOSNAP)
                        break;
                dentry = dentry->d_parent;
        }
        if (inode)
                inode = igrab(inode);
        return inode;
}

/*
 * Choose mds to send request to next.  If there is a hint set in the
 * request (e.g., due to a prior forward hint from the mds), use that.
 * Otherwise, consult frag tree and/or caps to identify the
 * appropriate mds.  If all else fails, choose randomly.
 *
 * Called under mdsc->mutex.
 */
static int __choose_mds(struct ceph_mds_client *mdsc,
                        struct ceph_mds_request *req,
                        bool *random)
{
        struct inode *inode;
        struct ceph_inode_info *ci;
        struct ceph_cap *cap;
        int mode = req->r_direct_mode;
        int mds = -1;
        u32 hash = req->r_direct_hash;
        bool is_hash = test_bit(CEPH_MDS_R_DIRECT_IS_HASH, &req->r_req_flags);
        struct ceph_client *cl = mdsc->fsc->client;

        if (random)
                *random = false;

        /*
         * is there a specific mds we should try?  ignore hint if we have
         * no session and the mds is not up (active or recovering).
         */
        if (req->r_resend_mds >= 0 &&
            (__have_session(mdsc, req->r_resend_mds) ||
             ceph_mdsmap_get_state(mdsc->mdsmap, req->r_resend_mds) > 0)) {
                doutc(cl, "using resend_mds mds%d\n", req->r_resend_mds);
                return req->r_resend_mds;
        }

        if (mode == USE_RANDOM_MDS)
                goto random;

        inode = NULL;
        if (req->r_inode) {
                if (ceph_snap(req->r_inode) != CEPH_SNAPDIR) {
                        inode = req->r_inode;
                        ihold(inode);
                } else {
                        /* req->r_dentry is non-null for LSSNAP request */
                        rcu_read_lock();
                        inode = get_nonsnap_parent(req->r_dentry);
                        rcu_read_unlock();
                        doutc(cl, "using snapdir's parent %p %llx.%llx\n",
                              inode, ceph_vinop(inode));
                }
        } else if (req->r_dentry) {
                /* ignore race with rename; old or new d_parent is okay */
                struct dentry *parent;
                struct inode *dir;

                rcu_read_lock();
                parent = READ_ONCE(req->r_dentry->d_parent);
                dir = req->r_parent ? : d_inode_rcu(parent);

                if (!dir || dir->i_sb != mdsc->fsc->sb) {
                        /*  not this fs or parent went negative */
                        inode = d_inode(req->r_dentry);
                        if (inode)
                                ihold(inode);
                } else if (ceph_snap(dir) != CEPH_NOSNAP) {
                        /* direct snapped/virtual snapdir requests
                         * based on parent dir inode */
                        inode = get_nonsnap_parent(parent);
                        doutc(cl, "using nonsnap parent %p %llx.%llx\n",
                              inode, ceph_vinop(inode));
                } else {
                        /* dentry target */
                        inode = d_inode(req->r_dentry);
                        if (!inode || mode == USE_AUTH_MDS) {
                                /* dir + name */
                                inode = igrab(dir);
                                hash = ceph_dentry_hash(dir, req->r_dentry);
                                is_hash = true;
                        } else {
                                ihold(inode);
                        }
                }
                rcu_read_unlock();
        }

        if (!inode)
                goto random;

        doutc(cl, "%p %llx.%llx is_hash=%d (0x%x) mode %d\n", inode,
              ceph_vinop(inode), (int)is_hash, hash, mode);
        ci = ceph_inode(inode);

        if (is_hash && S_ISDIR(inode->i_mode)) {
                struct ceph_inode_frag frag;
                int found;

                ceph_choose_frag(ci, hash, &frag, &found);
                if (found) {
                        if (mode == USE_ANY_MDS && frag.ndist > 0) {
                                u8 r;

                                /* choose a random replica */
                                get_random_bytes(&r, 1);
                                r %= frag.ndist;
                                mds = frag.dist[r];
                                doutc(cl, "%p %llx.%llx frag %u mds%d (%d/%d)\n",
                                      inode, ceph_vinop(inode), frag.frag,
                                      mds, (int)r, frag.ndist);
                                if (ceph_mdsmap_get_state(mdsc->mdsmap, mds) >=
                                    CEPH_MDS_STATE_ACTIVE &&
                                    !ceph_mdsmap_is_laggy(mdsc->mdsmap, mds))
                                        goto out;
                        }

                        /* since this file/dir wasn't known to be
                         * replicated, then we want to look for the
                         * authoritative mds. */
                        if (frag.mds >= 0) {
                                /* choose auth mds */
                                mds = frag.mds;
                                doutc(cl, "%p %llx.%llx frag %u mds%d (auth)\n",
                                      inode, ceph_vinop(inode), frag.frag, mds);
                                if (ceph_mdsmap_get_state(mdsc->mdsmap, mds) >=
                                    CEPH_MDS_STATE_ACTIVE) {
                                        if (!ceph_mdsmap_is_laggy(mdsc->mdsmap,
                                                                  mds))
                                                goto out;
                                }
                        }
                        mode = USE_AUTH_MDS;
                }
        }

        spin_lock(&ci->i_ceph_lock);
        cap = NULL;
        if (mode == USE_AUTH_MDS)
                cap = ci->i_auth_cap;
        if (!cap && !RB_EMPTY_ROOT(&ci->i_caps))
                cap = rb_entry(rb_first(&ci->i_caps), struct ceph_cap, ci_node);
        if (!cap) {
                spin_unlock(&ci->i_ceph_lock);
                iput(inode);
                goto random;
        }
        mds = cap->session->s_mds;
        doutc(cl, "%p %llx.%llx mds%d (%scap %p)\n", inode,
              ceph_vinop(inode), mds,
              cap == ci->i_auth_cap ? "auth " : "", cap);
        spin_unlock(&ci->i_ceph_lock);
out:
        iput(inode);
        return mds;

random:
        if (random)
                *random = true;

        mds = ceph_mdsmap_get_random_mds(mdsc->mdsmap);
        doutc(cl, "chose random mds%d\n", mds);
        return mds;
}


/*
 * session messages
 */
struct ceph_msg *ceph_create_session_msg(u32 op, u64 seq)
{
        struct ceph_msg *msg;
        struct ceph_mds_session_head *h;

        msg = ceph_msg_new(CEPH_MSG_CLIENT_SESSION, sizeof(*h), GFP_NOFS,
                           false);
        if (!msg) {
                pr_err("ENOMEM creating session %s msg\n",
                       ceph_session_op_name(op));
                return NULL;
        }
        h = msg->front.iov_base;
        h->op = cpu_to_le32(op);
        h->seq = cpu_to_le64(seq);

        return msg;
}

static const unsigned char feature_bits[] = CEPHFS_FEATURES_CLIENT_SUPPORTED;
#define FEATURE_BYTES(c) (DIV_ROUND_UP((size_t)feature_bits[c - 1] + 1, 64) * 8)
static int encode_supported_features(void **p, void *end)
{
        static const size_t count = ARRAY_SIZE(feature_bits);

        if (count > 0) {
                size_t i;
                size_t size = FEATURE_BYTES(count);
                unsigned long bit;

                if (WARN_ON_ONCE(*p + 4 + size > end))
                        return -ERANGE;

                ceph_encode_32(p, size);
                memset(*p, 0, size);
                for (i = 0; i < count; i++) {
                        bit = feature_bits[i];
                        ((unsigned char *)(*p))[bit / 8] |= BIT(bit % 8);
                }
                *p += size;
        } else {
                if (WARN_ON_ONCE(*p + 4 > end))
                        return -ERANGE;

                ceph_encode_32(p, 0);
        }

        return 0;
}

static const unsigned char metric_bits[] = CEPHFS_METRIC_SPEC_CLIENT_SUPPORTED;
#define METRIC_BYTES(cnt) (DIV_ROUND_UP((size_t)metric_bits[cnt - 1] + 1, 64) * 8)
static int encode_metric_spec(void **p, void *end)
{
        static const size_t count = ARRAY_SIZE(metric_bits);

        /* header */
        if (WARN_ON_ONCE(*p + 2 > end))
                return -ERANGE;

        ceph_encode_8(p, 1); /* version */
        ceph_encode_8(p, 1); /* compat */

        if (count > 0) {
                size_t i;
                size_t size = METRIC_BYTES(count);

                if (WARN_ON_ONCE(*p + 4 + 4 + size > end))
                        return -ERANGE;

                /* metric spec info length */
                ceph_encode_32(p, 4 + size);

                /* metric spec */
                ceph_encode_32(p, size);
                memset(*p, 0, size);
                for (i = 0; i < count; i++)
                        ((unsigned char *)(*p))[i / 8] |= BIT(metric_bits[i] % 8);
                *p += size;
        } else {
                if (WARN_ON_ONCE(*p + 4 + 4 > end))
                        return -ERANGE;

                /* metric spec info length */
                ceph_encode_32(p, 4);
                /* metric spec */
                ceph_encode_32(p, 0);
        }

        return 0;
}

/*
 * session message, specialization for CEPH_SESSION_REQUEST_OPEN
 * to include additional client metadata fields.
 */
static struct ceph_msg *
create_session_full_msg(struct ceph_mds_client *mdsc, int op, u64 seq)
{
        struct ceph_msg *msg;
        struct ceph_mds_session_head *h;
        int i;
        int extra_bytes = 0;
        int metadata_key_count = 0;
        struct ceph_options *opt = mdsc->fsc->client->options;
        struct ceph_mount_options *fsopt = mdsc->fsc->mount_options;
        struct ceph_client *cl = mdsc->fsc->client;
        size_t size, count;
        void *p, *end;
        int ret;

        const char* metadata[][2] = {
                {"hostname", mdsc->nodename},
                {"kernel_version", init_utsname()->release},
                {"entity_id", opt->name ? : ""},
                {"root", fsopt->server_path ? : "/"},
                {NULL, NULL}
        };

        /* Calculate serialized length of metadata */
        extra_bytes = 4;  /* map length */
        for (i = 0; metadata[i][0]; ++i) {
                extra_bytes += 8 + strlen(metadata[i][0]) +
                        strlen(metadata[i][1]);
                metadata_key_count++;
        }

        /* supported feature */
        size = 0;
        count = ARRAY_SIZE(feature_bits);
        if (count > 0)
                size = FEATURE_BYTES(count);
        extra_bytes += 4 + size;

        /* metric spec */
        size = 0;
        count = ARRAY_SIZE(metric_bits);
        if (count > 0)
                size = METRIC_BYTES(count);
        extra_bytes += 2 + 4 + 4 + size;

        /* flags, mds auth caps and oldest_client_tid */
        extra_bytes += 4 + 4 + 8;

        /* Allocate the message */
        msg = ceph_msg_new(CEPH_MSG_CLIENT_SESSION, sizeof(*h) + extra_bytes,
                           GFP_NOFS, false);
        if (!msg) {
                pr_err_client(cl, "ENOMEM creating session open msg\n");
                return ERR_PTR(-ENOMEM);
        }
        p = msg->front.iov_base;
        end = p + msg->front.iov_len;

        h = p;
        h->op = cpu_to_le32(op);
        h->seq = cpu_to_le64(seq);

        /*
         * Serialize client metadata into waiting buffer space, using
         * the format that userspace expects for map<string, string>
         *
         * ClientSession messages with metadata are v7
         */
        msg->hdr.version = cpu_to_le16(7);
        msg->hdr.compat_version = cpu_to_le16(1);

        /* The write pointer, following the session_head structure */
        p += sizeof(*h);

        /* Number of entries in the map */
        ceph_encode_32(&p, metadata_key_count);

        /* Two length-prefixed strings for each entry in the map */
        for (i = 0; metadata[i][0]; ++i) {
                size_t const key_len = strlen(metadata[i][0]);
                size_t const val_len = strlen(metadata[i][1]);

                ceph_encode_32(&p, key_len);
                memcpy(p, metadata[i][0], key_len);
                p += key_len;
                ceph_encode_32(&p, val_len);
                memcpy(p, metadata[i][1], val_len);
                p += val_len;
        }

        ret = encode_supported_features(&p, end);
        if (ret) {
                pr_err_client(cl, "encode_supported_features failed!\n");
                ceph_msg_put(msg);
                return ERR_PTR(ret);
        }

        ret = encode_metric_spec(&p, end);
        if (ret) {
                pr_err_client(cl, "encode_metric_spec failed!\n");
                ceph_msg_put(msg);
                return ERR_PTR(ret);
        }

        /* version == 5, flags */
        ceph_encode_32(&p, 0);

        /* version == 6, mds auth caps */
        ceph_encode_32(&p, 0);

        /* version == 7, oldest_client_tid */
        ceph_encode_64(&p, mdsc->oldest_tid);

        msg->front.iov_len = p - msg->front.iov_base;
        msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);

        return msg;
}

/*
 * send session open request.
 *
 * called under mdsc->mutex
 */
static int __open_session(struct ceph_mds_client *mdsc,
                          struct ceph_mds_session *session)
{
        struct ceph_msg *msg;
        int mstate;
        int mds = session->s_mds;

        if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_FENCE_IO)
                return -EIO;

        /* wait for mds to go active? */
        mstate = ceph_mdsmap_get_state(mdsc->mdsmap, mds);
        doutc(mdsc->fsc->client, "open_session to mds%d (%s)\n", mds,
              ceph_mds_state_name(mstate));
        session->s_state = CEPH_MDS_SESSION_OPENING;
        session->s_renew_requested = jiffies;

        /* send connect message */
        msg = create_session_full_msg(mdsc, CEPH_SESSION_REQUEST_OPEN,
                                      session->s_seq);
        if (IS_ERR(msg))
                return PTR_ERR(msg);
        ceph_con_send(&session->s_con, msg);
        return 0;
}

/*
 * open sessions for any export targets for the given mds
 *
 * called under mdsc->mutex
 */
static struct ceph_mds_session *
__open_export_target_session(struct ceph_mds_client *mdsc, int target)
{
        struct ceph_mds_session *session;
        int ret;

        session = __ceph_lookup_mds_session(mdsc, target);
        if (!session) {
                session = register_session(mdsc, target);
                if (IS_ERR(session))
                        return session;
        }
        if (session->s_state == CEPH_MDS_SESSION_NEW ||
            session->s_state == CEPH_MDS_SESSION_CLOSING) {
                ret = __open_session(mdsc, session);
                if (ret)
                        return ERR_PTR(ret);
        }

        return session;
}

struct ceph_mds_session *
ceph_mdsc_open_export_target_session(struct ceph_mds_client *mdsc, int target)
{
        struct ceph_mds_session *session;
        struct ceph_client *cl = mdsc->fsc->client;

        doutc(cl, "to mds%d\n", target);

        mutex_lock(&mdsc->mutex);
        session = __open_export_target_session(mdsc, target);
        mutex_unlock(&mdsc->mutex);

        return session;
}

static void __open_export_target_sessions(struct ceph_mds_client *mdsc,
                                          struct ceph_mds_session *session)
{
        struct ceph_mds_info *mi;
        struct ceph_mds_session *ts;
        int i, mds = session->s_mds;
        struct ceph_client *cl = mdsc->fsc->client;

        if (mds >= mdsc->mdsmap->possible_max_rank)
                return;

        mi = &mdsc->mdsmap->m_info[mds];
        doutc(cl, "for mds%d (%d targets)\n", session->s_mds,
              mi->num_export_targets);

        for (i = 0; i < mi->num_export_targets; i++) {
                ts = __open_export_target_session(mdsc, mi->export_targets[i]);
                ceph_put_mds_session(ts);
        }
}

void ceph_mdsc_open_export_target_sessions(struct ceph_mds_client *mdsc,
                                           struct ceph_mds_session *session)
{
        mutex_lock(&mdsc->mutex);
        __open_export_target_sessions(mdsc, session);
        mutex_unlock(&mdsc->mutex);
}

/*
 * session caps
 */

static void detach_cap_releases(struct ceph_mds_session *session,
                                struct list_head *target)
{
        struct ceph_client *cl = session->s_mdsc->fsc->client;

        lockdep_assert_held(&session->s_cap_lock);

        list_splice_init(&session->s_cap_releases, target);
        session->s_num_cap_releases = 0;
        doutc(cl, "mds%d\n", session->s_mds);
}

static void dispose_cap_releases(struct ceph_mds_client *mdsc,
                                 struct list_head *dispose)
{
        while (!list_empty(dispose)) {
                struct ceph_cap *cap;
                /* zero out the in-progress message */
                cap = list_first_entry(dispose, struct ceph_cap, session_caps);
                list_del(&cap->session_caps);
                ceph_put_cap(mdsc, cap);
        }
}

static void cleanup_session_requests(struct ceph_mds_client *mdsc,
                                     struct ceph_mds_session *session)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request *req;
        struct rb_node *p;

        doutc(cl, "mds%d\n", session->s_mds);
        mutex_lock(&mdsc->mutex);
        while (!list_empty(&session->s_unsafe)) {
                req = list_first_entry(&session->s_unsafe,
                                       struct ceph_mds_request, r_unsafe_item);
                pr_warn_ratelimited_client(cl, " dropping unsafe request %llu\n",
                                           req->r_tid);
                if (req->r_target_inode)
                        mapping_set_error(req->r_target_inode->i_mapping, -EIO);
                if (req->r_unsafe_dir)
                        mapping_set_error(req->r_unsafe_dir->i_mapping, -EIO);
                __unregister_request(mdsc, req);
        }
        /* zero r_attempts, so kick_requests() will re-send requests */
        p = rb_first(&mdsc->request_tree);
        while (p) {
                req = rb_entry(p, struct ceph_mds_request, r_node);
                p = rb_next(p);
                if (req->r_session &&
                    req->r_session->s_mds == session->s_mds)
                        req->r_attempts = 0;
        }
        mutex_unlock(&mdsc->mutex);
}

/*
 * Helper to safely iterate over all caps associated with a session, with
 * special care taken to handle a racing __ceph_remove_cap().
 *
 * Caller must hold session s_mutex.
 */
int ceph_iterate_session_caps(struct ceph_mds_session *session,
                              int (*cb)(struct inode *, int mds, void *),
                              void *arg)
{
        struct ceph_client *cl = session->s_mdsc->fsc->client;
        struct list_head *p;
        struct ceph_cap *cap;
        struct inode *inode, *last_inode = NULL;
        struct ceph_cap *old_cap = NULL;
        int ret;

        doutc(cl, "%p mds%d\n", session, session->s_mds);
        spin_lock(&session->s_cap_lock);
        p = session->s_caps.next;
        while (p != &session->s_caps) {
                int mds;

                cap = list_entry(p, struct ceph_cap, session_caps);
                inode = igrab(&cap->ci->netfs.inode);
                if (!inode) {
                        p = p->next;
                        continue;
                }
                session->s_cap_iterator = cap;
                mds = cap->mds;
                spin_unlock(&session->s_cap_lock);

                if (last_inode) {
                        iput(last_inode);
                        last_inode = NULL;
                }
                if (old_cap) {
                        ceph_put_cap(session->s_mdsc, old_cap);
                        old_cap = NULL;
                }

                ret = cb(inode, mds, arg);
                last_inode = inode;

                spin_lock(&session->s_cap_lock);
                p = p->next;
                if (!cap->ci) {
                        doutc(cl, "finishing cap %p removal\n", cap);
                        BUG_ON(cap->session != session);
                        cap->session = NULL;
                        list_del_init(&cap->session_caps);
                        session->s_nr_caps--;
                        atomic64_dec(&session->s_mdsc->metric.total_caps);
                        if (cap->queue_release)
                                __ceph_queue_cap_release(session, cap);
                        else
                                old_cap = cap;  /* put_cap it w/o locks held */
                }
                if (ret < 0)
                        goto out;
        }
        ret = 0;
out:
        session->s_cap_iterator = NULL;
        spin_unlock(&session->s_cap_lock);

        iput(last_inode);
        if (old_cap)
                ceph_put_cap(session->s_mdsc, old_cap);

        return ret;
}

static int remove_session_caps_cb(struct inode *inode, int mds, void *arg)
{
        struct ceph_inode_info *ci = ceph_inode(inode);
        struct ceph_client *cl = ceph_inode_to_client(inode);
        bool invalidate = false;
        struct ceph_cap *cap;
        int iputs = 0;

        spin_lock(&ci->i_ceph_lock);
        cap = __get_cap_for_mds(ci, mds);
        if (cap) {
                doutc(cl, " removing cap %p, ci is %p, inode is %p\n",
                      cap, ci, &ci->netfs.inode);

                iputs = ceph_purge_inode_cap(inode, cap, &invalidate);
        }
        spin_unlock(&ci->i_ceph_lock);

        if (cap)
                wake_up_all(&ci->i_cap_wq);
        if (invalidate)
                ceph_queue_invalidate(inode);
        while (iputs--)
                iput(inode);
        return 0;
}

/*
 * caller must hold session s_mutex
 */
static void remove_session_caps(struct ceph_mds_session *session)
{
        struct ceph_fs_client *fsc = session->s_mdsc->fsc;
        struct super_block *sb = fsc->sb;
        LIST_HEAD(dispose);

        doutc(fsc->client, "on %p\n", session);
        ceph_iterate_session_caps(session, remove_session_caps_cb, fsc);

        wake_up_all(&fsc->mdsc->cap_flushing_wq);

        spin_lock(&session->s_cap_lock);
        if (session->s_nr_caps > 0) {
                struct inode *inode;
                struct ceph_cap *cap, *prev = NULL;
                struct ceph_vino vino;
                /*
                 * iterate_session_caps() skips inodes that are being
                 * deleted, we need to wait until deletions are complete.
                 * __wait_on_freeing_inode() is designed for the job,
                 * but it is not exported, so use lookup inode function
                 * to access it.
                 */
                while (!list_empty(&session->s_caps)) {
                        cap = list_entry(session->s_caps.next,
                                         struct ceph_cap, session_caps);
                        if (cap == prev)
                                break;
                        prev = cap;
                        vino = cap->ci->i_vino;
                        spin_unlock(&session->s_cap_lock);

                        inode = ceph_find_inode(sb, vino);
                        iput(inode);

                        spin_lock(&session->s_cap_lock);
                }
        }

        // drop cap expires and unlock s_cap_lock
        detach_cap_releases(session, &dispose);

        BUG_ON(session->s_nr_caps > 0);
        BUG_ON(!list_empty(&session->s_cap_flushing));
        spin_unlock(&session->s_cap_lock);
        dispose_cap_releases(session->s_mdsc, &dispose);
}

enum {
        RECONNECT,
        RENEWCAPS,
        FORCE_RO,
};

/*
 * wake up any threads waiting on this session's caps.  if the cap is
 * old (didn't get renewed on the client reconnect), remove it now.
 *
 * caller must hold s_mutex.
 */
static int wake_up_session_cb(struct inode *inode, int mds, void *arg)
{
        struct ceph_inode_info *ci = ceph_inode(inode);
        unsigned long ev = (unsigned long)arg;

        if (ev == RECONNECT) {
                spin_lock(&ci->i_ceph_lock);
                ci->i_wanted_max_size = 0;
                ci->i_requested_max_size = 0;
                spin_unlock(&ci->i_ceph_lock);
        } else if (ev == RENEWCAPS) {
                struct ceph_cap *cap;

                spin_lock(&ci->i_ceph_lock);
                cap = __get_cap_for_mds(ci, mds);
                /* mds did not re-issue stale cap */
                if (cap && cap->cap_gen < atomic_read(&cap->session->s_cap_gen))
                        cap->issued = cap->implemented = CEPH_CAP_PIN;
                spin_unlock(&ci->i_ceph_lock);
        } else if (ev == FORCE_RO) {
        }
        wake_up_all(&ci->i_cap_wq);
        return 0;
}

static void wake_up_session_caps(struct ceph_mds_session *session, int ev)
{
        struct ceph_client *cl = session->s_mdsc->fsc->client;

        doutc(cl, "session %p mds%d\n", session, session->s_mds);
        ceph_iterate_session_caps(session, wake_up_session_cb,
                                  (void *)(unsigned long)ev);
}

/*
 * Send periodic message to MDS renewing all currently held caps.  The
 * ack will reset the expiration for all caps from this session.
 *
 * caller holds s_mutex
 */
static int send_renew_caps(struct ceph_mds_client *mdsc,
                           struct ceph_mds_session *session)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_msg *msg;
        int state;

        if (time_after_eq(jiffies, session->s_cap_ttl) &&
            time_after_eq(session->s_cap_ttl, session->s_renew_requested))
                pr_info_client(cl, "mds%d caps stale\n", session->s_mds);
        session->s_renew_requested = jiffies;

        /* do not try to renew caps until a recovering mds has reconnected
         * with its clients. */
        state = ceph_mdsmap_get_state(mdsc->mdsmap, session->s_mds);
        if (state < CEPH_MDS_STATE_RECONNECT) {
                doutc(cl, "ignoring mds%d (%s)\n", session->s_mds,
                      ceph_mds_state_name(state));
                return 0;
        }

        doutc(cl, "to mds%d (%s)\n", session->s_mds,
              ceph_mds_state_name(state));
        msg = create_session_full_msg(mdsc, CEPH_SESSION_REQUEST_RENEWCAPS,
                                      ++session->s_renew_seq);
        if (IS_ERR(msg))
                return PTR_ERR(msg);
        ceph_con_send(&session->s_con, msg);
        return 0;
}

static int send_flushmsg_ack(struct ceph_mds_client *mdsc,
                             struct ceph_mds_session *session, u64 seq)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_msg *msg;

        doutc(cl, "to mds%d (%s)s seq %lld\n", session->s_mds,
              ceph_session_state_name(session->s_state), seq);
        msg = ceph_create_session_msg(CEPH_SESSION_FLUSHMSG_ACK, seq);
        if (!msg)
                return -ENOMEM;
        ceph_con_send(&session->s_con, msg);
        return 0;
}


/*
 * Note new cap ttl, and any transition from stale -> not stale (fresh?).
 *
 * Called under session->s_mutex
 */
static void renewed_caps(struct ceph_mds_client *mdsc,
                         struct ceph_mds_session *session, int is_renew)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int was_stale;
        int wake = 0;

        spin_lock(&session->s_cap_lock);
        was_stale = is_renew && time_after_eq(jiffies, session->s_cap_ttl);

        session->s_cap_ttl = session->s_renew_requested +
                mdsc->mdsmap->m_session_timeout*HZ;

        if (was_stale) {
                if (time_before(jiffies, session->s_cap_ttl)) {
                        pr_info_client(cl, "mds%d caps renewed\n",
                                       session->s_mds);
                        wake = 1;
                } else {
                        pr_info_client(cl, "mds%d caps still stale\n",
                                       session->s_mds);
                }
        }
        doutc(cl, "mds%d ttl now %lu, was %s, now %s\n", session->s_mds,
              session->s_cap_ttl, was_stale ? "stale" : "fresh",
              time_before(jiffies, session->s_cap_ttl) ? "stale" : "fresh");
        spin_unlock(&session->s_cap_lock);

        if (wake)
                wake_up_session_caps(session, RENEWCAPS);
}

/*
 * send a session close request
 */
static int request_close_session(struct ceph_mds_session *session)
{
        struct ceph_client *cl = session->s_mdsc->fsc->client;
        struct ceph_msg *msg;

        doutc(cl, "mds%d state %s seq %lld\n", session->s_mds,
              ceph_session_state_name(session->s_state), session->s_seq);
        msg = ceph_create_session_msg(CEPH_SESSION_REQUEST_CLOSE,
                                      session->s_seq);
        if (!msg)
                return -ENOMEM;
        ceph_con_send(&session->s_con, msg);
        return 1;
}

/*
 * Called with s_mutex held.
 */
static int __close_session(struct ceph_mds_client *mdsc,
                         struct ceph_mds_session *session)
{
        if (session->s_state >= CEPH_MDS_SESSION_CLOSING)
                return 0;
        session->s_state = CEPH_MDS_SESSION_CLOSING;
        return request_close_session(session);
}

static bool drop_negative_children(struct dentry *dentry)
{
        struct dentry *child;
        bool all_negative = true;

        if (!d_is_dir(dentry))
                goto out;

        spin_lock(&dentry->d_lock);
        hlist_for_each_entry(child, &dentry->d_children, d_sib) {
                if (d_really_is_positive(child)) {
                        all_negative = false;
                        break;
                }
        }
        spin_unlock(&dentry->d_lock);

        if (all_negative)
                shrink_dcache_parent(dentry);
out:
        return all_negative;
}

/*
 * Trim old(er) caps.
 *
 * Because we can't cache an inode without one or more caps, we do
 * this indirectly: if a cap is unused, we prune its aliases, at which
 * point the inode will hopefully get dropped to.
 *
 * Yes, this is a bit sloppy.  Our only real goal here is to respond to
 * memory pressure from the MDS, though, so it needn't be perfect.
 */
static int trim_caps_cb(struct inode *inode, int mds, void *arg)
{
        struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
        struct ceph_client *cl = mdsc->fsc->client;
        int *remaining = arg;
        struct ceph_inode_info *ci = ceph_inode(inode);
        int used, wanted, oissued, mine;
        struct ceph_cap *cap;

        if (*remaining <= 0)
                return -1;

        spin_lock(&ci->i_ceph_lock);
        cap = __get_cap_for_mds(ci, mds);
        if (!cap) {
                spin_unlock(&ci->i_ceph_lock);
                return 0;
        }
        mine = cap->issued | cap->implemented;
        used = __ceph_caps_used(ci);
        wanted = __ceph_caps_file_wanted(ci);
        oissued = __ceph_caps_issued_other(ci, cap);

        doutc(cl, "%p %llx.%llx cap %p mine %s oissued %s used %s wanted %s\n",
              inode, ceph_vinop(inode), cap, ceph_cap_string(mine),
              ceph_cap_string(oissued), ceph_cap_string(used),
              ceph_cap_string(wanted));
        if (cap == ci->i_auth_cap) {
                if (ci->i_dirty_caps || ci->i_flushing_caps ||
                    !list_empty(&ci->i_cap_snaps))
                        goto out;
                if ((used | wanted) & CEPH_CAP_ANY_WR)
                        goto out;
                /* Note: it's possible that i_filelock_ref becomes non-zero
                 * after dropping auth caps. It doesn't hurt because reply
                 * of lock mds request will re-add auth caps. */
                if (atomic_read(&ci->i_filelock_ref) > 0)
                        goto out;
        }
        /* The inode has cached pages, but it's no longer used.
         * we can safely drop it */
        if (S_ISREG(inode->i_mode) &&
            wanted == 0 && used == CEPH_CAP_FILE_CACHE &&
            !(oissued & CEPH_CAP_FILE_CACHE)) {
          used = 0;
          oissued = 0;
        }
        if ((used | wanted) & ~oissued & mine)
                goto out;   /* we need these caps */

        if (oissued) {
                /* we aren't the only cap.. just remove us */
                ceph_remove_cap(mdsc, cap, true);
                (*remaining)--;
        } else {
                struct dentry *dentry;
                /* try dropping referring dentries */
                spin_unlock(&ci->i_ceph_lock);
                dentry = d_find_any_alias(inode);
                if (dentry && drop_negative_children(dentry)) {
                        int count;
                        dput(dentry);
                        d_prune_aliases(inode);
                        count = atomic_read(&inode->i_count);
                        if (count == 1)
                                (*remaining)--;
                        doutc(cl, "%p %llx.%llx cap %p pruned, count now %d\n",
                              inode, ceph_vinop(inode), cap, count);
                } else {
                        dput(dentry);
                }
                return 0;
        }

out:
        spin_unlock(&ci->i_ceph_lock);
        return 0;
}

/*
 * Trim session cap count down to some max number.
 */
int ceph_trim_caps(struct ceph_mds_client *mdsc,
                   struct ceph_mds_session *session,
                   int max_caps)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int trim_caps = session->s_nr_caps - max_caps;

        doutc(cl, "mds%d start: %d / %d, trim %d\n", session->s_mds,
              session->s_nr_caps, max_caps, trim_caps);
        if (trim_caps > 0) {
                int remaining = trim_caps;

                ceph_iterate_session_caps(session, trim_caps_cb, &remaining);
                doutc(cl, "mds%d done: %d / %d, trimmed %d\n",
                      session->s_mds, session->s_nr_caps, max_caps,
                      trim_caps - remaining);
        }

        ceph_flush_session_cap_releases(mdsc, session);
        return 0;
}

static int check_caps_flush(struct ceph_mds_client *mdsc,
                            u64 want_flush_tid)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int ret = 1;

        spin_lock(&mdsc->cap_dirty_lock);
        if (!list_empty(&mdsc->cap_flush_list)) {
                struct ceph_cap_flush *cf =
                        list_first_entry(&mdsc->cap_flush_list,
                                         struct ceph_cap_flush, g_list);
                if (cf->tid <= want_flush_tid) {
                        doutc(cl, "still flushing tid %llu <= %llu\n",
                              cf->tid, want_flush_tid);
                        ret = 0;
                }
        }
        spin_unlock(&mdsc->cap_dirty_lock);
        return ret;
}

/*
 * flush all dirty inode data to disk.
 *
 * returns true if we've flushed through want_flush_tid
 */
static void wait_caps_flush(struct ceph_mds_client *mdsc,
                            u64 want_flush_tid)
{
        struct ceph_client *cl = mdsc->fsc->client;

        doutc(cl, "want %llu\n", want_flush_tid);

        wait_event(mdsc->cap_flushing_wq,
                   check_caps_flush(mdsc, want_flush_tid));

        doutc(cl, "ok, flushed thru %llu\n", want_flush_tid);
}

/*
 * called under s_mutex
 */
static void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
                                   struct ceph_mds_session *session)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_msg *msg = NULL;
        struct ceph_mds_cap_release *head;
        struct ceph_mds_cap_item *item;
        struct ceph_osd_client *osdc = &mdsc->fsc->client->osdc;
        struct ceph_cap *cap;
        LIST_HEAD(tmp_list);
        int num_cap_releases;
        __le32        barrier, *cap_barrier;

        down_read(&osdc->lock);
        barrier = cpu_to_le32(osdc->epoch_barrier);
        up_read(&osdc->lock);

        spin_lock(&session->s_cap_lock);
again:
        list_splice_init(&session->s_cap_releases, &tmp_list);
        num_cap_releases = session->s_num_cap_releases;
        session->s_num_cap_releases = 0;
        spin_unlock(&session->s_cap_lock);

        while (!list_empty(&tmp_list)) {
                if (!msg) {
                        msg = ceph_msg_new(CEPH_MSG_CLIENT_CAPRELEASE,
                                        PAGE_SIZE, GFP_NOFS, false);
                        if (!msg)
                                goto out_err;
                        head = msg->front.iov_base;
                        head->num = cpu_to_le32(0);
                        msg->front.iov_len = sizeof(*head);

                        msg->hdr.version = cpu_to_le16(2);
                        msg->hdr.compat_version = cpu_to_le16(1);
                }

                cap = list_first_entry(&tmp_list, struct ceph_cap,
                                        session_caps);
                list_del(&cap->session_caps);
                num_cap_releases--;

                head = msg->front.iov_base;
                put_unaligned_le32(get_unaligned_le32(&head->num) + 1,
                                   &head->num);
                item = msg->front.iov_base + msg->front.iov_len;
                item->ino = cpu_to_le64(cap->cap_ino);
                item->cap_id = cpu_to_le64(cap->cap_id);
                item->migrate_seq = cpu_to_le32(cap->mseq);
                item->seq = cpu_to_le32(cap->issue_seq);
                msg->front.iov_len += sizeof(*item);

                ceph_put_cap(mdsc, cap);

                if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
                        // Append cap_barrier field
                        cap_barrier = msg->front.iov_base + msg->front.iov_len;
                        *cap_barrier = barrier;
                        msg->front.iov_len += sizeof(*cap_barrier);

                        msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
                        doutc(cl, "mds%d %p\n", session->s_mds, msg);
                        ceph_con_send(&session->s_con, msg);
                        msg = NULL;
                }
        }

        BUG_ON(num_cap_releases != 0);

        spin_lock(&session->s_cap_lock);
        if (!list_empty(&session->s_cap_releases))
                goto again;
        spin_unlock(&session->s_cap_lock);

        if (msg) {
                // Append cap_barrier field
                cap_barrier = msg->front.iov_base + msg->front.iov_len;
                *cap_barrier = barrier;
                msg->front.iov_len += sizeof(*cap_barrier);

                msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
                doutc(cl, "mds%d %p\n", session->s_mds, msg);
                ceph_con_send(&session->s_con, msg);
        }
        return;
out_err:
        pr_err_client(cl, "mds%d, failed to allocate message\n",
                      session->s_mds);
        spin_lock(&session->s_cap_lock);
        list_splice(&tmp_list, &session->s_cap_releases);
        session->s_num_cap_releases += num_cap_releases;
        spin_unlock(&session->s_cap_lock);
}

static void ceph_cap_release_work(struct work_struct *work)
{
        struct ceph_mds_session *session =
                container_of(work, struct ceph_mds_session, s_cap_release_work);

        mutex_lock(&session->s_mutex);
        if (session->s_state == CEPH_MDS_SESSION_OPEN ||
            session->s_state == CEPH_MDS_SESSION_HUNG)
                ceph_send_cap_releases(session->s_mdsc, session);
        mutex_unlock(&session->s_mutex);
        ceph_put_mds_session(session);
}

void ceph_flush_session_cap_releases(struct ceph_mds_client *mdsc,
                             struct ceph_mds_session *session)
{
        struct ceph_client *cl = mdsc->fsc->client;
        if (mdsc->stopping)
                return;

        ceph_get_mds_session(session);
        if (queue_work(mdsc->fsc->cap_wq,
                       &session->s_cap_release_work)) {
                doutc(cl, "cap release work queued\n");
        } else {
                ceph_put_mds_session(session);
                doutc(cl, "failed to queue cap release work\n");
        }
}

/*
 * caller holds session->s_cap_lock
 */
void __ceph_queue_cap_release(struct ceph_mds_session *session,
                              struct ceph_cap *cap)
{
        list_add_tail(&cap->session_caps, &session->s_cap_releases);
        session->s_num_cap_releases++;

        if (!(session->s_num_cap_releases % CEPH_CAPS_PER_RELEASE))
                ceph_flush_session_cap_releases(session->s_mdsc, session);
}

static void ceph_cap_reclaim_work(struct work_struct *work)
{
        struct ceph_mds_client *mdsc =
                container_of(work, struct ceph_mds_client, cap_reclaim_work);
        int ret = ceph_trim_dentries(mdsc);
        if (ret == -EAGAIN)
                ceph_queue_cap_reclaim_work(mdsc);
}

void ceph_queue_cap_reclaim_work(struct ceph_mds_client *mdsc)
{
        struct ceph_client *cl = mdsc->fsc->client;
        if (mdsc->stopping)
                return;

        if (queue_work(mdsc->fsc->cap_wq, &mdsc->cap_reclaim_work)) {
                doutc(cl, "caps reclaim work queued\n");
        } else {
                doutc(cl, "failed to queue caps release work\n");
        }
}

void ceph_reclaim_caps_nr(struct ceph_mds_client *mdsc, int nr)
{
        int val;
        if (!nr)
                return;
        val = atomic_add_return(nr, &mdsc->cap_reclaim_pending);
        if ((val % CEPH_CAPS_PER_RELEASE) < nr) {
                atomic_set(&mdsc->cap_reclaim_pending, 0);
                ceph_queue_cap_reclaim_work(mdsc);
        }
}

void ceph_queue_cap_unlink_work(struct ceph_mds_client *mdsc)
{
        struct ceph_client *cl = mdsc->fsc->client;
        if (mdsc->stopping)
                return;

        if (queue_work(mdsc->fsc->cap_wq, &mdsc->cap_unlink_work)) {
                doutc(cl, "caps unlink work queued\n");
        } else {
                doutc(cl, "failed to queue caps unlink work\n");
        }
}

static void ceph_cap_unlink_work(struct work_struct *work)
{
        struct ceph_mds_client *mdsc =
                container_of(work, struct ceph_mds_client, cap_unlink_work);
        struct ceph_client *cl = mdsc->fsc->client;

        doutc(cl, "begin\n");
        spin_lock(&mdsc->cap_delay_lock);
        while (!list_empty(&mdsc->cap_unlink_delay_list)) {
                struct ceph_inode_info *ci;
                struct inode *inode;

                ci = list_first_entry(&mdsc->cap_unlink_delay_list,
                                      struct ceph_inode_info,
                                      i_cap_delay_list);
                list_del_init(&ci->i_cap_delay_list);

                inode = igrab(&ci->netfs.inode);
                if (inode) {
                        spin_unlock(&mdsc->cap_delay_lock);
                        doutc(cl, "on %p %llx.%llx\n", inode,
                              ceph_vinop(inode));
                        ceph_check_caps(ci, CHECK_CAPS_FLUSH);
                        iput(inode);
                        spin_lock(&mdsc->cap_delay_lock);
                }
        }
        spin_unlock(&mdsc->cap_delay_lock);
        doutc(cl, "done\n");
}

/*
 * requests
 */

int ceph_alloc_readdir_reply_buffer(struct ceph_mds_request *req,
                                    struct inode *dir)
{
        struct ceph_inode_info *ci = ceph_inode(dir);
        struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info;
        struct ceph_mount_options *opt = req->r_mdsc->fsc->mount_options;
        size_t size = sizeof(struct ceph_mds_reply_dir_entry);
        unsigned int num_entries;
        int order;

        spin_lock(&ci->i_ceph_lock);
        num_entries = ci->i_files + ci->i_subdirs;
        spin_unlock(&ci->i_ceph_lock);
        num_entries = max(num_entries, 1U);
        num_entries = min(num_entries, opt->max_readdir);

        order = get_order(size * num_entries);
        while (order >= 0) {
                rinfo->dir_entries = (void*)__get_free_pages(GFP_KERNEL |
                                                             __GFP_NOWARN |
                                                             __GFP_ZERO,
                                                             order);
                if (rinfo->dir_entries)
                        break;
                order--;
        }
        if (!rinfo->dir_entries)
                return -ENOMEM;

        num_entries = (PAGE_SIZE << order) / size;
        num_entries = min(num_entries, opt->max_readdir);

        rinfo->dir_buf_size = PAGE_SIZE << order;
        req->r_num_caps = num_entries + 1;
        req->r_args.readdir.max_entries = cpu_to_le32(num_entries);
        req->r_args.readdir.max_bytes = cpu_to_le32(opt->max_readdir_bytes);
        return 0;
}

/*
 * Create an mds request.
 */
struct ceph_mds_request *
ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode)
{
        struct ceph_mds_request *req;

        req = kmem_cache_zalloc(ceph_mds_request_cachep, GFP_NOFS);
        if (!req)
                return ERR_PTR(-ENOMEM);

        mutex_init(&req->r_fill_mutex);
        req->r_mdsc = mdsc;
        req->r_started = jiffies;
        req->r_start_latency = ktime_get();
        req->r_resend_mds = -1;
        INIT_LIST_HEAD(&req->r_unsafe_dir_item);
        INIT_LIST_HEAD(&req->r_unsafe_target_item);
        req->r_fmode = -1;
        req->r_feature_needed = -1;
        kref_init(&req->r_kref);
        RB_CLEAR_NODE(&req->r_node);
        INIT_LIST_HEAD(&req->r_wait);
        init_completion(&req->r_completion);
        init_completion(&req->r_safe_completion);
        INIT_LIST_HEAD(&req->r_unsafe_item);

        ktime_get_coarse_real_ts64(&req->r_stamp);

        req->r_op = op;
        req->r_direct_mode = mode;
        return req;
}

/*
 * return oldest (lowest) request, tid in request tree, 0 if none.
 *
 * called under mdsc->mutex.
 */
static struct ceph_mds_request *__get_oldest_req(struct ceph_mds_client *mdsc)
{
        if (RB_EMPTY_ROOT(&mdsc->request_tree))
                return NULL;
        return rb_entry(rb_first(&mdsc->request_tree),
                        struct ceph_mds_request, r_node);
}

static inline  u64 __get_oldest_tid(struct ceph_mds_client *mdsc)
{
        return mdsc->oldest_tid;
}

#if IS_ENABLED(CONFIG_FS_ENCRYPTION)
static u8 *get_fscrypt_altname(const struct ceph_mds_request *req, u32 *plen)
{
        struct inode *dir = req->r_parent;
        struct dentry *dentry = req->r_dentry;
        u8 *cryptbuf = NULL;
        u32 len = 0;
        int ret = 0;

        /* only encode if we have parent and dentry */
        if (!dir || !dentry)
                goto success;

        /* No-op unless this is encrypted */
        if (!IS_ENCRYPTED(dir))
                goto success;

        ret = ceph_fscrypt_prepare_readdir(dir);
        if (ret < 0)
                return ERR_PTR(ret);

        /* No key? Just ignore it. */
        if (!fscrypt_has_encryption_key(dir))
                goto success;

        if (!fscrypt_fname_encrypted_size(dir, dentry->d_name.len, NAME_MAX,
                                          &len)) {
                WARN_ON_ONCE(1);
                return ERR_PTR(-ENAMETOOLONG);
        }

        /* No need to append altname if name is short enough */
        if (len <= CEPH_NOHASH_NAME_MAX) {
                len = 0;
                goto success;
        }

        cryptbuf = kmalloc(len, GFP_KERNEL);
        if (!cryptbuf)
                return ERR_PTR(-ENOMEM);

        ret = fscrypt_fname_encrypt(dir, &dentry->d_name, cryptbuf, len);
        if (ret) {
                kfree(cryptbuf);
                return ERR_PTR(ret);
        }
success:
        *plen = len;
        return cryptbuf;
}
#else
static u8 *get_fscrypt_altname(const struct ceph_mds_request *req, u32 *plen)
{
        *plen = 0;
        return NULL;
}
#endif

/**
 * ceph_mdsc_build_path - build a path string to a given dentry
 * @mdsc: mds client
 * @dentry: dentry to which path should be built
 * @plen: returned length of string
 * @pbase: returned base inode number
 * @for_wire: is this path going to be sent to the MDS?
 *
 * Build a string that represents the path to the dentry. This is mostly called
 * for two different purposes:
 *
 * 1) we need to build a path string to send to the MDS (for_wire == true)
 * 2) we need a path string for local presentation (e.g. debugfs)
 *    (for_wire == false)
 *
 * The path is built in reverse, starting with the dentry. Walk back up toward
 * the root, building the path until the first non-snapped inode is reached
 * (for_wire) or the root inode is reached (!for_wire).
 *
 * Encode hidden .snap dirs as a double /, i.e.
 *   foo/.snap/bar -> foo//bar
 */
char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry,
                           int *plen, u64 *pbase, int for_wire)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct dentry *cur;
        struct inode *inode;
        char *path;
        int pos;
        unsigned seq;
        u64 base;

        if (!dentry)
                return ERR_PTR(-EINVAL);

        path = __getname();
        if (!path)
                return ERR_PTR(-ENOMEM);
retry:
        pos = PATH_MAX - 1;
        path[pos] = '\0';

        seq = read_seqbegin(&rename_lock);
        cur = dget(dentry);
        for (;;) {
                struct dentry *parent;

                spin_lock(&cur->d_lock);
                inode = d_inode(cur);
                if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
                        doutc(cl, "path+%d: %p SNAPDIR\n", pos, cur);
                        spin_unlock(&cur->d_lock);
                        parent = dget_parent(cur);
                } else if (for_wire && inode && dentry != cur &&
                           ceph_snap(inode) == CEPH_NOSNAP) {
                        spin_unlock(&cur->d_lock);
                        pos++; /* get rid of any prepended '/' */
                        break;
                } else if (!for_wire || !IS_ENCRYPTED(d_inode(cur->d_parent))) {
                        pos -= cur->d_name.len;
                        if (pos < 0) {
                                spin_unlock(&cur->d_lock);
                                break;
                        }
                        memcpy(path + pos, cur->d_name.name, cur->d_name.len);
                        spin_unlock(&cur->d_lock);
                        parent = dget_parent(cur);
                } else {
                        int len, ret;
                        char buf[NAME_MAX];

                        /*
                         * Proactively copy name into buf, in case we need to
                         * present it as-is.
                         */
                        memcpy(buf, cur->d_name.name, cur->d_name.len);
                        len = cur->d_name.len;
                        spin_unlock(&cur->d_lock);
                        parent = dget_parent(cur);

                        ret = ceph_fscrypt_prepare_readdir(d_inode(parent));
                        if (ret < 0) {
                                dput(parent);
                                dput(cur);
                                return ERR_PTR(ret);
                        }

                        if (fscrypt_has_encryption_key(d_inode(parent))) {
                                len = ceph_encode_encrypted_fname(d_inode(parent),
                                                                  cur, buf);
                                if (len < 0) {
                                        dput(parent);
                                        dput(cur);
                                        return ERR_PTR(len);
                                }
                        }
                        pos -= len;
                        if (pos < 0) {
                                dput(parent);
                                break;
                        }
                        memcpy(path + pos, buf, len);
                }
                dput(cur);
                cur = parent;

                /* Are we at the root? */
                if (IS_ROOT(cur))
                        break;

                /* Are we out of buffer? */
                if (--pos < 0)
                        break;

                path[pos] = '/';
        }
        inode = d_inode(cur);
        base = inode ? ceph_ino(inode) : 0;
        dput(cur);

        if (read_seqretry(&rename_lock, seq))
                goto retry;

        if (pos < 0) {
                /*
                 * A rename didn't occur, but somehow we didn't end up where
                 * we thought we would. Throw a warning and try again.
                 */
                pr_warn_client(cl, "did not end path lookup where expected (pos = %d)\n",
                               pos);
                goto retry;
        }

        *pbase = base;
        *plen = PATH_MAX - 1 - pos;
        doutc(cl, "on %p %d built %llx '%.*s'\n", dentry, d_count(dentry),
              base, *plen, path + pos);
        return path + pos;
}

static int build_dentry_path(struct ceph_mds_client *mdsc, struct dentry *dentry,
                             struct inode *dir, const char **ppath, int *ppathlen,
                             u64 *pino, bool *pfreepath, bool parent_locked)
{
        char *path;

        rcu_read_lock();
        if (!dir)
                dir = d_inode_rcu(dentry->d_parent);
        if (dir && parent_locked && ceph_snap(dir) == CEPH_NOSNAP &&
            !IS_ENCRYPTED(dir)) {
                *pino = ceph_ino(dir);
                rcu_read_unlock();
                *ppath = dentry->d_name.name;
                *ppathlen = dentry->d_name.len;
                return 0;
        }
        rcu_read_unlock();
        path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1);
        if (IS_ERR(path))
                return PTR_ERR(path);
        *ppath = path;
        *pfreepath = true;
        return 0;
}

static int build_inode_path(struct inode *inode,
                            const char **ppath, int *ppathlen, u64 *pino,
                            bool *pfreepath)
{
        struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
        struct dentry *dentry;
        char *path;

        if (ceph_snap(inode) == CEPH_NOSNAP) {
                *pino = ceph_ino(inode);
                *ppathlen = 0;
                return 0;
        }
        dentry = d_find_alias(inode);
        path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1);
        dput(dentry);
        if (IS_ERR(path))
                return PTR_ERR(path);
        *ppath = path;
        *pfreepath = true;
        return 0;
}

/*
 * request arguments may be specified via an inode *, a dentry *, or
 * an explicit ino+path.
 */
static int set_request_path_attr(struct ceph_mds_client *mdsc, struct inode *rinode,
                                 struct dentry *rdentry, struct inode *rdiri,
                                 const char *rpath, u64 rino, const char **ppath,
                                 int *pathlen, u64 *ino, bool *freepath,
                                 bool parent_locked)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int r = 0;

        if (rinode) {
                r = build_inode_path(rinode, ppath, pathlen, ino, freepath);
                doutc(cl, " inode %p %llx.%llx\n", rinode, ceph_ino(rinode),
                      ceph_snap(rinode));
        } else if (rdentry) {
                r = build_dentry_path(mdsc, rdentry, rdiri, ppath, pathlen, ino,
                                        freepath, parent_locked);
                doutc(cl, " dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen, *ppath);
        } else if (rpath || rino) {
                *ino = rino;
                *ppath = rpath;
                *pathlen = rpath ? strlen(rpath) : 0;
                doutc(cl, " path %.*s\n", *pathlen, rpath);
        }

        return r;
}

static void encode_mclientrequest_tail(void **p,
                                       const struct ceph_mds_request *req)
{
        struct ceph_timespec ts;
        int i;

        ceph_encode_timespec64(&ts, &req->r_stamp);
        ceph_encode_copy(p, &ts, sizeof(ts));

        /* v4: gid_list */
        ceph_encode_32(p, req->r_cred->group_info->ngroups);
        for (i = 0; i < req->r_cred->group_info->ngroups; i++)
                ceph_encode_64(p, from_kgid(&init_user_ns,
                                            req->r_cred->group_info->gid[i]));

        /* v5: altname */
        ceph_encode_32(p, req->r_altname_len);
        ceph_encode_copy(p, req->r_altname, req->r_altname_len);

        /* v6: fscrypt_auth and fscrypt_file */
        if (req->r_fscrypt_auth) {
                u32 authlen = ceph_fscrypt_auth_len(req->r_fscrypt_auth);

                ceph_encode_32(p, authlen);
                ceph_encode_copy(p, req->r_fscrypt_auth, authlen);
        } else {
                ceph_encode_32(p, 0);
        }
        if (test_bit(CEPH_MDS_R_FSCRYPT_FILE, &req->r_req_flags)) {
                ceph_encode_32(p, sizeof(__le64));
                ceph_encode_64(p, req->r_fscrypt_file);
        } else {
                ceph_encode_32(p, 0);
        }
}

static inline u16 mds_supported_head_version(struct ceph_mds_session *session)
{
        if (!test_bit(CEPHFS_FEATURE_32BITS_RETRY_FWD, &session->s_features))
                return 1;

        if (!test_bit(CEPHFS_FEATURE_HAS_OWNER_UIDGID, &session->s_features))
                return 2;

        return CEPH_MDS_REQUEST_HEAD_VERSION;
}

static struct ceph_mds_request_head_legacy *
find_legacy_request_head(void *p, u64 features)
{
        bool legacy = !(features & CEPH_FEATURE_FS_BTIME);
        struct ceph_mds_request_head_old *ohead;

        if (legacy)
                return (struct ceph_mds_request_head_legacy *)p;
        ohead = (struct ceph_mds_request_head_old *)p;
        return (struct ceph_mds_request_head_legacy *)&ohead->oldest_client_tid;
}

/*
 * called under mdsc->mutex
 */
static struct ceph_msg *create_request_message(struct ceph_mds_session *session,
                                               struct ceph_mds_request *req,
                                               bool drop_cap_releases)
{
        int mds = session->s_mds;
        struct ceph_mds_client *mdsc = session->s_mdsc;
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_msg *msg;
        struct ceph_mds_request_head_legacy *lhead;
        const char *path1 = NULL;
        const char *path2 = NULL;
        u64 ino1 = 0, ino2 = 0;
        int pathlen1 = 0, pathlen2 = 0;
        bool freepath1 = false, freepath2 = false;
        struct dentry *old_dentry = NULL;
        int len;
        u16 releases;
        void *p, *end;
        int ret;
        bool legacy = !(session->s_con.peer_features & CEPH_FEATURE_FS_BTIME);
        u16 request_head_version = mds_supported_head_version(session);
        kuid_t caller_fsuid = req->r_cred->fsuid;
        kgid_t caller_fsgid = req->r_cred->fsgid;

        ret = set_request_path_attr(mdsc, req->r_inode, req->r_dentry,
                              req->r_parent, req->r_path1, req->r_ino1.ino,
                              &path1, &pathlen1, &ino1, &freepath1,
                              test_bit(CEPH_MDS_R_PARENT_LOCKED,
                                        &req->r_req_flags));
        if (ret < 0) {
                msg = ERR_PTR(ret);
                goto out;
        }

        /* If r_old_dentry is set, then assume that its parent is locked */
        if (req->r_old_dentry &&
            !(req->r_old_dentry->d_flags & DCACHE_DISCONNECTED))
                old_dentry = req->r_old_dentry;
        ret = set_request_path_attr(mdsc, NULL, old_dentry,
                              req->r_old_dentry_dir,
                              req->r_path2, req->r_ino2.ino,
                              &path2, &pathlen2, &ino2, &freepath2, true);
        if (ret < 0) {
                msg = ERR_PTR(ret);
                goto out_free1;
        }

        req->r_altname = get_fscrypt_altname(req, &req->r_altname_len);
        if (IS_ERR(req->r_altname)) {
                msg = ERR_CAST(req->r_altname);
                req->r_altname = NULL;
                goto out_free2;
        }

        /*
         * For old cephs without supporting the 32bit retry/fwd feature
         * it will copy the raw memories directly when decoding the
         * requests. While new cephs will decode the head depending the
         * version member, so we need to make sure it will be compatible
         * with them both.
         */
        if (legacy)
                len = sizeof(struct ceph_mds_request_head_legacy);
        else if (request_head_version == 1)
                len = sizeof(struct ceph_mds_request_head_old);
        else if (request_head_version == 2)
                len = offsetofend(struct ceph_mds_request_head, ext_num_fwd);
        else
                len = sizeof(struct ceph_mds_request_head);

        /* filepaths */
        len += 2 * (1 + sizeof(u32) + sizeof(u64));
        len += pathlen1 + pathlen2;

        /* cap releases */
        len += sizeof(struct ceph_mds_request_release) *
                (!!req->r_inode_drop + !!req->r_dentry_drop +
                 !!req->r_old_inode_drop + !!req->r_old_dentry_drop);

        if (req->r_dentry_drop)
                len += pathlen1;
        if (req->r_old_dentry_drop)
                len += pathlen2;

        /* MClientRequest tail */

        /* req->r_stamp */
        len += sizeof(struct ceph_timespec);

        /* gid list */
        len += sizeof(u32) + (sizeof(u64) * req->r_cred->group_info->ngroups);

        /* alternate name */
        len += sizeof(u32) + req->r_altname_len;

        /* fscrypt_auth */
        len += sizeof(u32); // fscrypt_auth
        if (req->r_fscrypt_auth)
                len += ceph_fscrypt_auth_len(req->r_fscrypt_auth);

        /* fscrypt_file */
        len += sizeof(u32);
        if (test_bit(CEPH_MDS_R_FSCRYPT_FILE, &req->r_req_flags))
                len += sizeof(__le64);

        msg = ceph_msg_new2(CEPH_MSG_CLIENT_REQUEST, len, 1, GFP_NOFS, false);
        if (!msg) {
                msg = ERR_PTR(-ENOMEM);
                goto out_free2;
        }

        msg->hdr.tid = cpu_to_le64(req->r_tid);

        lhead = find_legacy_request_head(msg->front.iov_base,
                                         session->s_con.peer_features);

        if ((req->r_mnt_idmap != &nop_mnt_idmap) &&
            !test_bit(CEPHFS_FEATURE_HAS_OWNER_UIDGID, &session->s_features)) {
                WARN_ON_ONCE(!IS_CEPH_MDS_OP_NEWINODE(req->r_op));

                if (enable_unsafe_idmap) {
                        pr_warn_once_client(cl,
                                "idmapped mount is used and CEPHFS_FEATURE_HAS_OWNER_UIDGID"
                                " is not supported by MDS. UID/GID-based restrictions may"
                                " not work properly.\n");

                        caller_fsuid = from_vfsuid(req->r_mnt_idmap, &init_user_ns,
                                                   VFSUIDT_INIT(req->r_cred->fsuid));
                        caller_fsgid = from_vfsgid(req->r_mnt_idmap, &init_user_ns,
                                                   VFSGIDT_INIT(req->r_cred->fsgid));
                } else {
                        pr_err_ratelimited_client(cl,
                                "idmapped mount is used and CEPHFS_FEATURE_HAS_OWNER_UIDGID"
                                " is not supported by MDS. Fail request with -EIO.\n");

                        ret = -EIO;
                        goto out_err;
                }
        }

        /*
         * The ceph_mds_request_head_legacy didn't contain a version field, and
         * one was added when we moved the message version from 3->4.
         */
        if (legacy) {
                msg->hdr.version = cpu_to_le16(3);
                p = msg->front.iov_base + sizeof(*lhead);
        } else if (request_head_version == 1) {
                struct ceph_mds_request_head_old *ohead = msg->front.iov_base;

                msg->hdr.version = cpu_to_le16(4);
                ohead->version = cpu_to_le16(1);
                p = msg->front.iov_base + sizeof(*ohead);
        } else if (request_head_version == 2) {
                struct ceph_mds_request_head *nhead = msg->front.iov_base;

                msg->hdr.version = cpu_to_le16(6);
                nhead->version = cpu_to_le16(2);

                p = msg->front.iov_base + offsetofend(struct ceph_mds_request_head, ext_num_fwd);
        } else {
                struct ceph_mds_request_head *nhead = msg->front.iov_base;
                kuid_t owner_fsuid;
                kgid_t owner_fsgid;

                msg->hdr.version = cpu_to_le16(6);
                nhead->version = cpu_to_le16(CEPH_MDS_REQUEST_HEAD_VERSION);
                nhead->struct_len = cpu_to_le32(sizeof(struct ceph_mds_request_head));

                if (IS_CEPH_MDS_OP_NEWINODE(req->r_op)) {
                        owner_fsuid = from_vfsuid(req->r_mnt_idmap, &init_user_ns,
                                                VFSUIDT_INIT(req->r_cred->fsuid));
                        owner_fsgid = from_vfsgid(req->r_mnt_idmap, &init_user_ns,
                                                VFSGIDT_INIT(req->r_cred->fsgid));
                        nhead->owner_uid = cpu_to_le32(from_kuid(&init_user_ns, owner_fsuid));
                        nhead->owner_gid = cpu_to_le32(from_kgid(&init_user_ns, owner_fsgid));
                } else {
                        nhead->owner_uid = cpu_to_le32(-1);
                        nhead->owner_gid = cpu_to_le32(-1);
                }

                p = msg->front.iov_base + sizeof(*nhead);
        }

        end = msg->front.iov_base + msg->front.iov_len;

        lhead->mdsmap_epoch = cpu_to_le32(mdsc->mdsmap->m_epoch);
        lhead->op = cpu_to_le32(req->r_op);
        lhead->caller_uid = cpu_to_le32(from_kuid(&init_user_ns,
                                                  caller_fsuid));
        lhead->caller_gid = cpu_to_le32(from_kgid(&init_user_ns,
                                                  caller_fsgid));
        lhead->ino = cpu_to_le64(req->r_deleg_ino);
        lhead->args = req->r_args;

        ceph_encode_filepath(&p, end, ino1, path1);
        ceph_encode_filepath(&p, end, ino2, path2);

        /* make note of release offset, in case we need to replay */
        req->r_request_release_offset = p - msg->front.iov_base;

        /* cap releases */
        releases = 0;
        if (req->r_inode_drop)
                releases += ceph_encode_inode_release(&p,
                      req->r_inode ? req->r_inode : d_inode(req->r_dentry),
                      mds, req->r_inode_drop, req->r_inode_unless,
                      req->r_op == CEPH_MDS_OP_READDIR);
        if (req->r_dentry_drop) {
                ret = ceph_encode_dentry_release(&p, req->r_dentry,
                                req->r_parent, mds, req->r_dentry_drop,
                                req->r_dentry_unless);
                if (ret < 0)
                        goto out_err;
                releases += ret;
        }
        if (req->r_old_dentry_drop) {
                ret = ceph_encode_dentry_release(&p, req->r_old_dentry,
                                req->r_old_dentry_dir, mds,
                                req->r_old_dentry_drop,
                                req->r_old_dentry_unless);
                if (ret < 0)
                        goto out_err;
                releases += ret;
        }
        if (req->r_old_inode_drop)
                releases += ceph_encode_inode_release(&p,
                      d_inode(req->r_old_dentry),
                      mds, req->r_old_inode_drop, req->r_old_inode_unless, 0);

        if (drop_cap_releases) {
                releases = 0;
                p = msg->front.iov_base + req->r_request_release_offset;
        }

        lhead->num_releases = cpu_to_le16(releases);

        encode_mclientrequest_tail(&p, req);

        if (WARN_ON_ONCE(p > end)) {
                ceph_msg_put(msg);
                msg = ERR_PTR(-ERANGE);
                goto out_free2;
        }

        msg->front.iov_len = p - msg->front.iov_base;
        msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);

        if (req->r_pagelist) {
                struct ceph_pagelist *pagelist = req->r_pagelist;
                ceph_msg_data_add_pagelist(msg, pagelist);
                msg->hdr.data_len = cpu_to_le32(pagelist->length);
        } else {
                msg->hdr.data_len = 0;
        }

        msg->hdr.data_off = cpu_to_le16(0);

out_free2:
        if (freepath2)
                ceph_mdsc_free_path((char *)path2, pathlen2);
out_free1:
        if (freepath1)
                ceph_mdsc_free_path((char *)path1, pathlen1);
out:
        return msg;
out_err:
        ceph_msg_put(msg);
        msg = ERR_PTR(ret);
        goto out_free2;
}

/*
 * called under mdsc->mutex if error, under no mutex if
 * success.
 */
static void complete_request(struct ceph_mds_client *mdsc,
                             struct ceph_mds_request *req)
{
        req->r_end_latency = ktime_get();

        if (req->r_callback)
                req->r_callback(mdsc, req);
        complete_all(&req->r_completion);
}

/*
 * called under mdsc->mutex
 */
static int __prepare_send_request(struct ceph_mds_session *session,
                                  struct ceph_mds_request *req,
                                  bool drop_cap_releases)
{
        int mds = session->s_mds;
        struct ceph_mds_client *mdsc = session->s_mdsc;
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request_head_legacy *lhead;
        struct ceph_mds_request_head *nhead;
        struct ceph_msg *msg;
        int flags = 0, old_max_retry;
        bool old_version = !test_bit(CEPHFS_FEATURE_32BITS_RETRY_FWD,
                                     &session->s_features);

        /*
         * Avoid inifinite retrying after overflow. The client will
         * increase the retry count and if the MDS is old version,
         * so we limit to retry at most 256 times.
         */
        if (req->r_attempts) {
               old_max_retry = sizeof_field(struct ceph_mds_request_head_old,
                                            num_retry);
               old_max_retry = 1 << (old_max_retry * BITS_PER_BYTE);
               if ((old_version && req->r_attempts >= old_max_retry) ||
                   ((uint32_t)req->r_attempts >= U32_MAX)) {
                        pr_warn_ratelimited_client(cl, "request tid %llu seq overflow\n",
                                                   req->r_tid);
                        return -EMULTIHOP;
               }
        }

        req->r_attempts++;
        if (req->r_inode) {
                struct ceph_cap *cap =
                        ceph_get_cap_for_mds(ceph_inode(req->r_inode), mds);

                if (cap)
                        req->r_sent_on_mseq = cap->mseq;
                else
                        req->r_sent_on_mseq = -1;
        }
        doutc(cl, "%p tid %lld %s (attempt %d)\n", req, req->r_tid,
              ceph_mds_op_name(req->r_op), req->r_attempts);

        if (test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags)) {
                void *p;

                /*
                 * Replay.  Do not regenerate message (and rebuild
                 * paths, etc.); just use the original message.
                 * Rebuilding paths will break for renames because
                 * d_move mangles the src name.
                 */
                msg = req->r_request;
                lhead = find_legacy_request_head(msg->front.iov_base,
                                                 session->s_con.peer_features);

                flags = le32_to_cpu(lhead->flags);
                flags |= CEPH_MDS_FLAG_REPLAY;
                lhead->flags = cpu_to_le32(flags);

                if (req->r_target_inode)
                        lhead->ino = cpu_to_le64(ceph_ino(req->r_target_inode));

                lhead->num_retry = req->r_attempts - 1;
                if (!old_version) {
                        nhead = (struct ceph_mds_request_head*)msg->front.iov_base;
                        nhead->ext_num_retry = cpu_to_le32(req->r_attempts - 1);
                }

                /* remove cap/dentry releases from message */
                lhead->num_releases = 0;

                p = msg->front.iov_base + req->r_request_release_offset;
                encode_mclientrequest_tail(&p, req);

                msg->front.iov_len = p - msg->front.iov_base;
                msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
                return 0;
        }

        if (req->r_request) {
                ceph_msg_put(req->r_request);
                req->r_request = NULL;
        }
        msg = create_request_message(session, req, drop_cap_releases);
        if (IS_ERR(msg)) {
                req->r_err = PTR_ERR(msg);
                return PTR_ERR(msg);
        }
        req->r_request = msg;

        lhead = find_legacy_request_head(msg->front.iov_base,
                                         session->s_con.peer_features);
        lhead->oldest_client_tid = cpu_to_le64(__get_oldest_tid(mdsc));
        if (test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags))
                flags |= CEPH_MDS_FLAG_REPLAY;
        if (test_bit(CEPH_MDS_R_ASYNC, &req->r_req_flags))
                flags |= CEPH_MDS_FLAG_ASYNC;
        if (req->r_parent)
                flags |= CEPH_MDS_FLAG_WANT_DENTRY;
        lhead->flags = cpu_to_le32(flags);
        lhead->num_fwd = req->r_num_fwd;
        lhead->num_retry = req->r_attempts - 1;
        if (!old_version) {
                nhead = (struct ceph_mds_request_head*)msg->front.iov_base;
                nhead->ext_num_fwd = cpu_to_le32(req->r_num_fwd);
                nhead->ext_num_retry = cpu_to_le32(req->r_attempts - 1);
        }

        doutc(cl, " r_parent = %p\n", req->r_parent);
        return 0;
}

/*
 * called under mdsc->mutex
 */
static int __send_request(struct ceph_mds_session *session,
                          struct ceph_mds_request *req,
                          bool drop_cap_releases)
{
        int err;

        err = __prepare_send_request(session, req, drop_cap_releases);
        if (!err) {
                ceph_msg_get(req->r_request);
                ceph_con_send(&session->s_con, req->r_request);
        }

        return err;
}

/*
 * send request, or put it on the appropriate wait list.
 */
static void __do_request(struct ceph_mds_client *mdsc,
                        struct ceph_mds_request *req)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_session *session = NULL;
        int mds = -1;
        int err = 0;
        bool random;

        if (req->r_err || test_bit(CEPH_MDS_R_GOT_RESULT, &req->r_req_flags)) {
                if (test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags))
                        __unregister_request(mdsc, req);
                return;
        }

        if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_FENCE_IO) {
                doutc(cl, "metadata corrupted\n");
                err = -EIO;
                goto finish;
        }
        if (req->r_timeout &&
            time_after_eq(jiffies, req->r_started + req->r_timeout)) {
                doutc(cl, "timed out\n");
                err = -ETIMEDOUT;
                goto finish;
        }
        if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN) {
                doutc(cl, "forced umount\n");
                err = -EIO;
                goto finish;
        }
        if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_MOUNTING) {
                if (mdsc->mdsmap_err) {
                        err = mdsc->mdsmap_err;
                        doutc(cl, "mdsmap err %d\n", err);
                        goto finish;
                }
                if (mdsc->mdsmap->m_epoch == 0) {
                        doutc(cl, "no mdsmap, waiting for map\n");
                        list_add(&req->r_wait, &mdsc->waiting_for_map);
                        return;
                }
                if (!(mdsc->fsc->mount_options->flags &
                      CEPH_MOUNT_OPT_MOUNTWAIT) &&
                    !ceph_mdsmap_is_cluster_available(mdsc->mdsmap)) {
                        err = -EHOSTUNREACH;
                        goto finish;
                }
        }

        put_request_session(req);

        mds = __choose_mds(mdsc, req, &random);
        if (mds < 0 ||
            ceph_mdsmap_get_state(mdsc->mdsmap, mds) < CEPH_MDS_STATE_ACTIVE) {
                if (test_bit(CEPH_MDS_R_ASYNC, &req->r_req_flags)) {
                        err = -EJUKEBOX;
                        goto finish;
                }
                doutc(cl, "no mds or not active, waiting for map\n");
                list_add(&req->r_wait, &mdsc->waiting_for_map);
                return;
        }

        /* get, open session */
        session = __ceph_lookup_mds_session(mdsc, mds);
        if (!session) {
                session = register_session(mdsc, mds);
                if (IS_ERR(session)) {
                        err = PTR_ERR(session);
                        goto finish;
                }
        }
        req->r_session = ceph_get_mds_session(session);

        doutc(cl, "mds%d session %p state %s\n", mds, session,
              ceph_session_state_name(session->s_state));

        /*
         * The old ceph will crash the MDSs when see unknown OPs
         */
        if (req->r_feature_needed > 0 &&
            !test_bit(req->r_feature_needed, &session->s_features)) {
                err = -EOPNOTSUPP;
                goto out_session;
        }

        if (session->s_state != CEPH_MDS_SESSION_OPEN &&
            session->s_state != CEPH_MDS_SESSION_HUNG) {
                /*
                 * We cannot queue async requests since the caps and delegated
                 * inodes are bound to the session. Just return -EJUKEBOX and
                 * let the caller retry a sync request in that case.
                 */
                if (test_bit(CEPH_MDS_R_ASYNC, &req->r_req_flags)) {
                        err = -EJUKEBOX;
                        goto out_session;
                }

                /*
                 * If the session has been REJECTED, then return a hard error,
                 * unless it's a CLEANRECOVER mount, in which case we'll queue
                 * it to the mdsc queue.
                 */
                if (session->s_state == CEPH_MDS_SESSION_REJECTED) {
                        if (ceph_test_mount_opt(mdsc->fsc, CLEANRECOVER))
                                list_add(&req->r_wait, &mdsc->waiting_for_map);
                        else
                                err = -EACCES;
                        goto out_session;
                }

                if (session->s_state == CEPH_MDS_SESSION_NEW ||
                    session->s_state == CEPH_MDS_SESSION_CLOSING) {
                        err = __open_session(mdsc, session);
                        if (err)
                                goto out_session;
                        /* retry the same mds later */
                        if (random)
                                req->r_resend_mds = mds;
                }
                list_add(&req->r_wait, &session->s_waiting);
                goto out_session;
        }

        /* send request */
        req->r_resend_mds = -1;   /* forget any previous mds hint */

        if (req->r_request_started == 0)   /* note request start time */
                req->r_request_started = jiffies;

        /*
         * For async create we will choose the auth MDS of frag in parent
         * directory to send the request and ususally this works fine, but
         * if the migrated the dirtory to another MDS before it could handle
         * it the request will be forwarded.
         *
         * And then the auth cap will be changed.
         */
        if (test_bit(CEPH_MDS_R_ASYNC, &req->r_req_flags) && req->r_num_fwd) {
                struct ceph_dentry_info *di = ceph_dentry(req->r_dentry);
                struct ceph_inode_info *ci;
                struct ceph_cap *cap;

                /*
                 * The request maybe handled very fast and the new inode
                 * hasn't been linked to the dentry yet. We need to wait
                 * for the ceph_finish_async_create(), which shouldn't be
                 * stuck too long or fail in thoery, to finish when forwarding
                 * the request.
                 */
                if (!d_inode(req->r_dentry)) {
                        err = wait_on_bit(&di->flags, CEPH_DENTRY_ASYNC_CREATE_BIT,
                                          TASK_KILLABLE);
                        if (err) {
                                mutex_lock(&req->r_fill_mutex);
                                set_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags);
                                mutex_unlock(&req->r_fill_mutex);
                                goto out_session;
                        }
                }

                ci = ceph_inode(d_inode(req->r_dentry));

                spin_lock(&ci->i_ceph_lock);
                cap = ci->i_auth_cap;
                if (ci->i_ceph_flags & CEPH_I_ASYNC_CREATE && mds != cap->mds) {
                        doutc(cl, "session changed for auth cap %d -> %d\n",
                              cap->session->s_mds, session->s_mds);

                        /* Remove the auth cap from old session */
                        spin_lock(&cap->session->s_cap_lock);
                        cap->session->s_nr_caps--;
                        list_del_init(&cap->session_caps);
                        spin_unlock(&cap->session->s_cap_lock);

                        /* Add the auth cap to the new session */
                        cap->mds = mds;
                        cap->session = session;
                        spin_lock(&session->s_cap_lock);
                        session->s_nr_caps++;
                        list_add_tail(&cap->session_caps, &session->s_caps);
                        spin_unlock(&session->s_cap_lock);

                        change_auth_cap_ses(ci, session);
                }
                spin_unlock(&ci->i_ceph_lock);
        }

        err = __send_request(session, req, false);

out_session:
        ceph_put_mds_session(session);
finish:
        if (err) {
                doutc(cl, "early error %d\n", err);
                req->r_err = err;
                complete_request(mdsc, req);
                __unregister_request(mdsc, req);
        }
        return;
}

/*
 * called under mdsc->mutex
 */
static void __wake_requests(struct ceph_mds_client *mdsc,
                            struct list_head *head)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request *req;
        LIST_HEAD(tmp_list);

        list_splice_init(head, &tmp_list);

        while (!list_empty(&tmp_list)) {
                req = list_entry(tmp_list.next,
                                 struct ceph_mds_request, r_wait);
                list_del_init(&req->r_wait);
                doutc(cl, " wake request %p tid %llu\n", req,
                      req->r_tid);
                __do_request(mdsc, req);
        }
}

/*
 * Wake up threads with requests pending for @mds, so that they can
 * resubmit their requests to a possibly different mds.
 */
static void kick_requests(struct ceph_mds_client *mdsc, int mds)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request *req;
        struct rb_node *p = rb_first(&mdsc->request_tree);

        doutc(cl, "kick_requests mds%d\n", mds);
        while (p) {
                req = rb_entry(p, struct ceph_mds_request, r_node);
                p = rb_next(p);
                if (test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags))
                        continue;
                if (req->r_attempts > 0)
                        continue; /* only new requests */
                if (req->r_session &&
                    req->r_session->s_mds == mds) {
                        doutc(cl, " kicking tid %llu\n", req->r_tid);
                        list_del_init(&req->r_wait);
                        __do_request(mdsc, req);
                }
        }
}

int ceph_mdsc_submit_request(struct ceph_mds_client *mdsc, struct inode *dir,
                              struct ceph_mds_request *req)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int err = 0;

        /* take CAP_PIN refs for r_inode, r_parent, r_old_dentry */
        if (req->r_inode)
                ceph_get_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);
        if (req->r_parent) {
                struct ceph_inode_info *ci = ceph_inode(req->r_parent);
                int fmode = (req->r_op & CEPH_MDS_OP_WRITE) ?
                            CEPH_FILE_MODE_WR : CEPH_FILE_MODE_RD;
                spin_lock(&ci->i_ceph_lock);
                ceph_take_cap_refs(ci, CEPH_CAP_PIN, false);
                __ceph_touch_fmode(ci, mdsc, fmode);
                spin_unlock(&ci->i_ceph_lock);
        }
        if (req->r_old_dentry_dir)
                ceph_get_cap_refs(ceph_inode(req->r_old_dentry_dir),
                                  CEPH_CAP_PIN);

        if (req->r_inode) {
                err = ceph_wait_on_async_create(req->r_inode);
                if (err) {
                        doutc(cl, "wait for async create returned: %d\n", err);
                        return err;
                }
        }

        if (!err && req->r_old_inode) {
                err = ceph_wait_on_async_create(req->r_old_inode);
                if (err) {
                        doutc(cl, "wait for async create returned: %d\n", err);
                        return err;
                }
        }

        doutc(cl, "submit_request on %p for inode %p\n", req, dir);
        mutex_lock(&mdsc->mutex);
        __register_request(mdsc, req, dir);
        __do_request(mdsc, req);
        err = req->r_err;
        mutex_unlock(&mdsc->mutex);
        return err;
}

int ceph_mdsc_wait_request(struct ceph_mds_client *mdsc,
                           struct ceph_mds_request *req,
                           ceph_mds_request_wait_callback_t wait_func)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int err;

        /* wait */
        doutc(cl, "do_request waiting\n");
        if (wait_func) {
                err = wait_func(mdsc, req);
        } else {
                long timeleft = wait_for_completion_killable_timeout(
                                        &req->r_completion,
                                        ceph_timeout_jiffies(req->r_timeout));
                if (timeleft > 0)
                        err = 0;
                else if (!timeleft)
                        err = -ETIMEDOUT;  /* timed out */
                else
                        err = timeleft;  /* killed */
        }
        doutc(cl, "do_request waited, got %d\n", err);
        mutex_lock(&mdsc->mutex);

        /* only abort if we didn't race with a real reply */
        if (test_bit(CEPH_MDS_R_GOT_RESULT, &req->r_req_flags)) {
                err = le32_to_cpu(req->r_reply_info.head->result);
        } else if (err < 0) {
                doutc(cl, "aborted request %lld with %d\n", req->r_tid, err);

                /*
                 * ensure we aren't running concurrently with
                 * ceph_fill_trace or ceph_readdir_prepopulate, which
                 * rely on locks (dir mutex) held by our caller.
                 */
                mutex_lock(&req->r_fill_mutex);
                req->r_err = err;
                set_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags);
                mutex_unlock(&req->r_fill_mutex);

                if (req->r_parent &&
                    (req->r_op & CEPH_MDS_OP_WRITE))
                        ceph_invalidate_dir_request(req);
        } else {
                err = req->r_err;
        }

        mutex_unlock(&mdsc->mutex);
        return err;
}

/*
 * Synchrously perform an mds request.  Take care of all of the
 * session setup, forwarding, retry details.
 */
int ceph_mdsc_do_request(struct ceph_mds_client *mdsc,
                         struct inode *dir,
                         struct ceph_mds_request *req)
{
        struct ceph_client *cl = mdsc->fsc->client;
        int err;

        doutc(cl, "do_request on %p\n", req);

        /* issue */
        err = ceph_mdsc_submit_request(mdsc, dir, req);
        if (!err)
                err = ceph_mdsc_wait_request(mdsc, req, NULL);
        doutc(cl, "do_request %p done, result %d\n", req, err);
        return err;
}

/*
 * Invalidate dir's completeness, dentry lease state on an aborted MDS
 * namespace request.
 */
void ceph_invalidate_dir_request(struct ceph_mds_request *req)
{
        struct inode *dir = req->r_parent;
        struct inode *old_dir = req->r_old_dentry_dir;
        struct ceph_client *cl = req->r_mdsc->fsc->client;

        doutc(cl, "invalidate_dir_request %p %p (complete, lease(s))\n",
              dir, old_dir);

        ceph_dir_clear_complete(dir);
        if (old_dir)
                ceph_dir_clear_complete(old_dir);
        if (req->r_dentry)
                ceph_invalidate_dentry_lease(req->r_dentry);
        if (req->r_old_dentry)
                ceph_invalidate_dentry_lease(req->r_old_dentry);
}

/*
 * Handle mds reply.
 *
 * We take the session mutex and parse and process the reply immediately.
 * This preserves the logical ordering of replies, capabilities, etc., sent
 * by the MDS as they are applied to our local cache.
 */
static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
{
        struct ceph_mds_client *mdsc = session->s_mdsc;
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request *req;
        struct ceph_mds_reply_head *head = msg->front.iov_base;
        struct ceph_mds_reply_info_parsed *rinfo;  /* parsed reply info */
        struct ceph_snap_realm *realm;
        u64 tid;
        int err, result;
        int mds = session->s_mds;
        bool close_sessions = false;

        if (msg->front.iov_len < sizeof(*head)) {
                pr_err_client(cl, "got corrupt (short) reply\n");
                ceph_msg_dump(msg);
                return;
        }

        /* get request, session */
        tid = le64_to_cpu(msg->hdr.tid);
        mutex_lock(&mdsc->mutex);
        req = lookup_get_request(mdsc, tid);
        if (!req) {
                doutc(cl, "on unknown tid %llu\n", tid);
                mutex_unlock(&mdsc->mutex);
                return;
        }
        doutc(cl, "handle_reply %p\n", req);

        /* correct session? */
        if (req->r_session != session) {
                pr_err_client(cl, "got %llu on session mds%d not mds%d\n",
                              tid, session->s_mds,
                              req->r_session ? req->r_session->s_mds : -1);
                mutex_unlock(&mdsc->mutex);
                goto out;
        }

        /* dup? */
        if ((test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags) && !head->safe) ||
            (test_bit(CEPH_MDS_R_GOT_SAFE, &req->r_req_flags) && head->safe)) {
                pr_warn_client(cl, "got a dup %s reply on %llu from mds%d\n",
                               head->safe ? "safe" : "unsafe", tid, mds);
                mutex_unlock(&mdsc->mutex);
                goto out;
        }
        if (test_bit(CEPH_MDS_R_GOT_SAFE, &req->r_req_flags)) {
                pr_warn_client(cl, "got unsafe after safe on %llu from mds%d\n",
                               tid, mds);
                mutex_unlock(&mdsc->mutex);
                goto out;
        }

        result = le32_to_cpu(head->result);

        if (head->safe) {
                set_bit(CEPH_MDS_R_GOT_SAFE, &req->r_req_flags);
                __unregister_request(mdsc, req);

                /* last request during umount? */
                if (mdsc->stopping && !__get_oldest_req(mdsc))
                        complete_all(&mdsc->safe_umount_waiters);

                if (test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags)) {
                        /*
                         * We already handled the unsafe response, now do the
                         * cleanup.  No need to examine the response; the MDS
                         * doesn't include any result info in the safe
                         * response.  And even if it did, there is nothing
                         * useful we could do with a revised return value.
                         */
                        doutc(cl, "got safe reply %llu, mds%d\n", tid, mds);

                        mutex_unlock(&mdsc->mutex);
                        goto out;
                }
        } else {
                set_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags);
                list_add_tail(&req->r_unsafe_item, &req->r_session->s_unsafe);
        }

        doutc(cl, "tid %lld result %d\n", tid, result);
        if (test_bit(CEPHFS_FEATURE_REPLY_ENCODING, &session->s_features))
                err = parse_reply_info(session, msg, req, (u64)-1);
        else
                err = parse_reply_info(session, msg, req,
                                       session->s_con.peer_features);
        mutex_unlock(&mdsc->mutex);

        /* Must find target inode outside of mutexes to avoid deadlocks */
        rinfo = &req->r_reply_info;
        if ((err >= 0) && rinfo->head->is_target) {
                struct inode *in = xchg(&req->r_new_inode, NULL);
                struct ceph_vino tvino = {
                        .ino  = le64_to_cpu(rinfo->targeti.in->ino),
                        .snap = le64_to_cpu(rinfo->targeti.in->snapid)
                };

                /*
                 * If we ended up opening an existing inode, discard
                 * r_new_inode
                 */
                if (req->r_op == CEPH_MDS_OP_CREATE &&
                    !req->r_reply_info.has_create_ino) {
                        /* This should never happen on an async create */
                        WARN_ON_ONCE(req->r_deleg_ino);
                        iput(in);
                        in = NULL;
                }

                in = ceph_get_inode(mdsc->fsc->sb, tvino, in);
                if (IS_ERR(in)) {
                        err = PTR_ERR(in);
                        mutex_lock(&session->s_mutex);
                        goto out_err;
                }
                req->r_target_inode = in;
        }

        mutex_lock(&session->s_mutex);
        if (err < 0) {
                pr_err_client(cl, "got corrupt reply mds%d(tid:%lld)\n",
                              mds, tid);
                ceph_msg_dump(msg);
                goto out_err;
        }

        /* snap trace */
        realm = NULL;
        if (rinfo->snapblob_len) {
                down_write(&mdsc->snap_rwsem);
                err = ceph_update_snap_trace(mdsc, rinfo->snapblob,
                                rinfo->snapblob + rinfo->snapblob_len,
                                le32_to_cpu(head->op) == CEPH_MDS_OP_RMSNAP,
                                &realm);
                if (err) {
                        up_write(&mdsc->snap_rwsem);
                        close_sessions = true;
                        if (err == -EIO)
                                ceph_msg_dump(msg);
                        goto out_err;
                }
                downgrade_write(&mdsc->snap_rwsem);
        } else {
                down_read(&mdsc->snap_rwsem);
        }

        /* insert trace into our cache */
        mutex_lock(&req->r_fill_mutex);
        current->journal_info = req;
        err = ceph_fill_trace(mdsc->fsc->sb, req);
        if (err == 0) {
                if (result == 0 && (req->r_op == CEPH_MDS_OP_READDIR ||
                                    req->r_op == CEPH_MDS_OP_LSSNAP))
                        err = ceph_readdir_prepopulate(req, req->r_session);
        }
        current->journal_info = NULL;
        mutex_unlock(&req->r_fill_mutex);

        up_read(&mdsc->snap_rwsem);
        if (realm)
                ceph_put_snap_realm(mdsc, realm);

        if (err == 0) {
                if (req->r_target_inode &&
                    test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags)) {
                        struct ceph_inode_info *ci =
                                ceph_inode(req->r_target_inode);
                        spin_lock(&ci->i_unsafe_lock);
                        list_add_tail(&req->r_unsafe_target_item,
                                      &ci->i_unsafe_iops);
                        spin_unlock(&ci->i_unsafe_lock);
                }

                ceph_unreserve_caps(mdsc, &req->r_caps_reservation);
        }
out_err:
        mutex_lock(&mdsc->mutex);
        if (!test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {
                if (err) {
                        req->r_err = err;
                } else {
                        req->r_reply =  ceph_msg_get(msg);
                        set_bit(CEPH_MDS_R_GOT_RESULT, &req->r_req_flags);
                }
        } else {
                doutc(cl, "reply arrived after request %lld was aborted\n", tid);
        }
        mutex_unlock(&mdsc->mutex);

        mutex_unlock(&session->s_mutex);

        /* kick calling process */
        complete_request(mdsc, req);

        ceph_update_metadata_metrics(&mdsc->metric, req->r_start_latency,
                                     req->r_end_latency, err);
out:
        ceph_mdsc_put_request(req);

        /* Defer closing the sessions after s_mutex lock being released */
        if (close_sessions)
                ceph_mdsc_close_sessions(mdsc);
        return;
}



/*
 * handle mds notification that our request has been forwarded.
 */
static void handle_forward(struct ceph_mds_client *mdsc,
                           struct ceph_mds_session *session,
                           struct ceph_msg *msg)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request *req;
        u64 tid = le64_to_cpu(msg->hdr.tid);
        u32 next_mds;
        u32 fwd_seq;
        int err = -EINVAL;
        void *p = msg->front.iov_base;
        void *end = p + msg->front.iov_len;
        bool aborted = false;

        ceph_decode_need(&p, end, 2*sizeof(u32), bad);
        next_mds = ceph_decode_32(&p);
        fwd_seq = ceph_decode_32(&p);

        mutex_lock(&mdsc->mutex);
        req = lookup_get_request(mdsc, tid);
        if (!req) {
                mutex_unlock(&mdsc->mutex);
                doutc(cl, "forward tid %llu to mds%d - req dne\n", tid, next_mds);
                return;  /* dup reply? */
        }

        if (test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {
                doutc(cl, "forward tid %llu aborted, unregistering\n", tid);
                __unregister_request(mdsc, req);
        } else if (fwd_seq <= req->r_num_fwd || (uint32_t)fwd_seq >= U32_MAX) {
                /*
                 * Avoid inifinite retrying after overflow.
                 *
                 * The MDS will increase the fwd count and in client side
                 * if the num_fwd is less than the one saved in request
                 * that means the MDS is an old version and overflowed of
                 * 8 bits.
                 */
                mutex_lock(&req->r_fill_mutex);
                req->r_err = -EMULTIHOP;
                set_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags);
                mutex_unlock(&req->r_fill_mutex);
                aborted = true;
                pr_warn_ratelimited_client(cl, "forward tid %llu seq overflow\n",
                                           tid);
        } else {
                /* resend. forward race not possible; mds would drop */
                doutc(cl, "forward tid %llu to mds%d (we resend)\n", tid, next_mds);
                BUG_ON(req->r_err);
                BUG_ON(test_bit(CEPH_MDS_R_GOT_RESULT, &req->r_req_flags));
                req->r_attempts = 0;
                req->r_num_fwd = fwd_seq;
                req->r_resend_mds = next_mds;
                put_request_session(req);
                __do_request(mdsc, req);
        }
        mutex_unlock(&mdsc->mutex);

        /* kick calling process */
        if (aborted)
                complete_request(mdsc, req);
        ceph_mdsc_put_request(req);
        return;

bad:
        pr_err_client(cl, "decode error err=%d\n", err);
        ceph_msg_dump(msg);
}

static int __decode_session_metadata(void **p, void *end,
                                     bool *blocklisted)
{
        /* map<string,string> */
        u32 n;
        bool err_str;
        ceph_decode_32_safe(p, end, n, bad);
        while (n-- > 0) {
                u32 len;
                ceph_decode_32_safe(p, end, len, bad);
                ceph_decode_need(p, end, len, bad);
                err_str = !strncmp(*p, "error_string", len);
                *p += len;
                ceph_decode_32_safe(p, end, len, bad);
                ceph_decode_need(p, end, len, bad);
                /*
                 * Match "blocklisted (blacklisted)" from newer MDSes,
                 * or "blacklisted" from older MDSes.
                 */
                if (err_str && strnstr(*p, "blacklisted", len))
                        *blocklisted = true;
                *p += len;
        }
        return 0;
bad:
        return -1;
}

/*
 * handle a mds session control message
 */
static void handle_session(struct ceph_mds_session *session,
                           struct ceph_msg *msg)
{
        struct ceph_mds_client *mdsc = session->s_mdsc;
        struct ceph_client *cl = mdsc->fsc->client;
        int mds = session->s_mds;
        int msg_version = le16_to_cpu(msg->hdr.version);
        void *p = msg->front.iov_base;
        void *end = p + msg->front.iov_len;
        struct ceph_mds_session_head *h;
        struct ceph_mds_cap_auth *cap_auths = NULL;
        u32 op, cap_auths_num = 0;
        u64 seq, features = 0;
        int wake = 0;
        bool blocklisted = false;
        u32 i;


        /* decode */
        ceph_decode_need(&p, end, sizeof(*h), bad);
        h = p;
        p += sizeof(*h);

        op = le32_to_cpu(h->op);
        seq = le64_to_cpu(h->seq);

        if (msg_version >= 3) {
                u32 len;
                /* version >= 2 and < 5, decode metadata, skip otherwise
                 * as it's handled via flags.
                 */
                if (msg_version >= 5)
                        ceph_decode_skip_map(&p, end, string, string, bad);
                else if (__decode_session_metadata(&p, end, &blocklisted) < 0)
                        goto bad;

                /* version >= 3, feature bits */
                ceph_decode_32_safe(&p, end, len, bad);
                if (len) {
                        ceph_decode_64_safe(&p, end, features, bad);
                        p += len - sizeof(features);
                }
        }

        if (msg_version >= 5) {
                u32 flags, len;

                /* version >= 4 */
                ceph_decode_skip_16(&p, end, bad); /* struct_v, struct_cv */
                ceph_decode_32_safe(&p, end, len, bad); /* len */
                ceph_decode_skip_n(&p, end, len, bad); /* metric_spec */

                /* version >= 5, flags   */
                ceph_decode_32_safe(&p, end, flags, bad);
                if (flags & CEPH_SESSION_BLOCKLISTED) {
                        pr_warn_client(cl, "mds%d session blocklisted\n",
                                       session->s_mds);
                        blocklisted = true;
                }
        }

        if (msg_version >= 6) {
                ceph_decode_32_safe(&p, end, cap_auths_num, bad);
                doutc(cl, "cap_auths_num %d\n", cap_auths_num);

                if (cap_auths_num && op != CEPH_SESSION_OPEN) {
                        WARN_ON_ONCE(op != CEPH_SESSION_OPEN);
                        goto skip_cap_auths;
                }

                cap_auths = kcalloc(cap_auths_num,
                                    sizeof(struct ceph_mds_cap_auth),
                                    GFP_KERNEL);
                if (!cap_auths) {
                        pr_err_client(cl, "No memory for cap_auths\n");
                        return;
                }

                for (i = 0; i < cap_auths_num; i++) {
                        u32 _len, j;

                        /* struct_v, struct_compat, and struct_len in MDSCapAuth */
                        ceph_decode_skip_n(&p, end, 2 + sizeof(u32), bad);

                        /* struct_v, struct_compat, and struct_len in MDSCapMatch */
                        ceph_decode_skip_n(&p, end, 2 + sizeof(u32), bad);
                        ceph_decode_64_safe(&p, end, cap_auths[i].match.uid, bad);
                        ceph_decode_32_safe(&p, end, _len, bad);
                        if (_len) {
                                cap_auths[i].match.gids = kcalloc(_len, sizeof(u32),
                                                                  GFP_KERNEL);
                                if (!cap_auths[i].match.gids) {
                                        pr_err_client(cl, "No memory for gids\n");
                                        goto fail;
                                }

                                cap_auths[i].match.num_gids = _len;
                                for (j = 0; j < _len; j++)
                                        ceph_decode_32_safe(&p, end,
                                                            cap_auths[i].match.gids[j],
                                                            bad);
                        }

                        ceph_decode_32_safe(&p, end, _len, bad);
                        if (_len) {
                                cap_auths[i].match.path = kcalloc(_len + 1, sizeof(char),
                                                                  GFP_KERNEL);
                                if (!cap_auths[i].match.path) {
                                        pr_err_client(cl, "No memory for path\n");
                                        goto fail;
                                }
                                ceph_decode_copy(&p, cap_auths[i].match.path, _len);

                                /* Remove the tailing '/' */
                                while (_len && cap_auths[i].match.path[_len - 1] == '/') {
                                        cap_auths[i].match.path[_len - 1] = '\0';
                                        _len -= 1;
                                }
                        }

                        ceph_decode_32_safe(&p, end, _len, bad);
                        if (_len) {
                                cap_auths[i].match.fs_name = kcalloc(_len + 1, sizeof(char),
                                                                     GFP_KERNEL);
                                if (!cap_auths[i].match.fs_name) {
                                        pr_err_client(cl, "No memory for fs_name\n");
                                        goto fail;
                                }
                                ceph_decode_copy(&p, cap_auths[i].match.fs_name, _len);
                        }

                        ceph_decode_8_safe(&p, end, cap_auths[i].match.root_squash, bad);
                        ceph_decode_8_safe(&p, end, cap_auths[i].readable, bad);
                        ceph_decode_8_safe(&p, end, cap_auths[i].writeable, bad);
                        doutc(cl, "uid %lld, num_gids %u, path %s, fs_name %s, root_squash %d, readable %d, writeable %d\n",
                              cap_auths[i].match.uid, cap_auths[i].match.num_gids,
                              cap_auths[i].match.path, cap_auths[i].match.fs_name,
                              cap_auths[i].match.root_squash,
                              cap_auths[i].readable, cap_auths[i].writeable);
                }
        }

skip_cap_auths:
        mutex_lock(&mdsc->mutex);
        if (op == CEPH_SESSION_OPEN) {
                if (mdsc->s_cap_auths) {
                        for (i = 0; i < mdsc->s_cap_auths_num; i++) {
                                kfree(mdsc->s_cap_auths[i].match.gids);
                                kfree(mdsc->s_cap_auths[i].match.path);
                                kfree(mdsc->s_cap_auths[i].match.fs_name);
                        }
                        kfree(mdsc->s_cap_auths);
                }
                mdsc->s_cap_auths_num = cap_auths_num;
                mdsc->s_cap_auths = cap_auths;
        }
        if (op == CEPH_SESSION_CLOSE) {
                ceph_get_mds_session(session);
                __unregister_session(mdsc, session);
        }
        /* FIXME: this ttl calculation is generous */
        session->s_ttl = jiffies + HZ*mdsc->mdsmap->m_session_autoclose;
        mutex_unlock(&mdsc->mutex);

        mutex_lock(&session->s_mutex);

        doutc(cl, "mds%d %s %p state %s seq %llu\n", mds,
              ceph_session_op_name(op), session,
              ceph_session_state_name(session->s_state), seq);

        if (session->s_state == CEPH_MDS_SESSION_HUNG) {
                session->s_state = CEPH_MDS_SESSION_OPEN;
                pr_info_client(cl, "mds%d came back\n", session->s_mds);
        }

        switch (op) {
        case CEPH_SESSION_OPEN:
                if (session->s_state == CEPH_MDS_SESSION_RECONNECTING)
                        pr_info_client(cl, "mds%d reconnect success\n",
                                       session->s_mds);

                session->s_features = features;
                if (session->s_state == CEPH_MDS_SESSION_OPEN) {
                        pr_notice_client(cl, "mds%d is already opened\n",
                                         session->s_mds);
                } else {
                        session->s_state = CEPH_MDS_SESSION_OPEN;
                        renewed_caps(mdsc, session, 0);
                        if (test_bit(CEPHFS_FEATURE_METRIC_COLLECT,
                                     &session->s_features))
                                metric_schedule_delayed(&mdsc->metric);
                }

                /*
                 * The connection maybe broken and the session in client
                 * side has been reinitialized, need to update the seq
                 * anyway.
                 */
                if (!session->s_seq && seq)
                        session->s_seq = seq;

                wake = 1;
                if (mdsc->stopping)
                        __close_session(mdsc, session);
                break;

        case CEPH_SESSION_RENEWCAPS:
                if (session->s_renew_seq == seq)
                        renewed_caps(mdsc, session, 1);
                break;

        case CEPH_SESSION_CLOSE:
                if (session->s_state == CEPH_MDS_SESSION_RECONNECTING)
                        pr_info_client(cl, "mds%d reconnect denied\n",
                                       session->s_mds);
                session->s_state = CEPH_MDS_SESSION_CLOSED;
                cleanup_session_requests(mdsc, session);
                remove_session_caps(session);
                wake = 2; /* for good measure */
                wake_up_all(&mdsc->session_close_wq);
                break;

        case CEPH_SESSION_STALE:
                pr_info_client(cl, "mds%d caps went stale, renewing\n",
                               session->s_mds);
                atomic_inc(&session->s_cap_gen);
                session->s_cap_ttl = jiffies - 1;
                send_renew_caps(mdsc, session);
                break;

        case CEPH_SESSION_RECALL_STATE:
                ceph_trim_caps(mdsc, session, le32_to_cpu(h->max_caps));
                break;

        case CEPH_SESSION_FLUSHMSG:
                /* flush cap releases */
                spin_lock(&session->s_cap_lock);
                if (session->s_num_cap_releases)
                        ceph_flush_session_cap_releases(mdsc, session);
                spin_unlock(&session->s_cap_lock);

                send_flushmsg_ack(mdsc, session, seq);
                break;

        case CEPH_SESSION_FORCE_RO:
                doutc(cl, "force_session_readonly %p\n", session);
                spin_lock(&session->s_cap_lock);
                session->s_readonly = true;
                spin_unlock(&session->s_cap_lock);
                wake_up_session_caps(session, FORCE_RO);
                break;

        case CEPH_SESSION_REJECT:
                WARN_ON(session->s_state != CEPH_MDS_SESSION_OPENING);
                pr_info_client(cl, "mds%d rejected session\n",
                               session->s_mds);
                session->s_state = CEPH_MDS_SESSION_REJECTED;
                cleanup_session_requests(mdsc, session);
                remove_session_caps(session);
                if (blocklisted)
                        mdsc->fsc->blocklisted = true;
                wake = 2; /* for good measure */
                break;

        default:
                pr_err_client(cl, "bad op %d mds%d\n", op, mds);
                WARN_ON(1);
        }

        mutex_unlock(&session->s_mutex);
        if (wake) {
                mutex_lock(&mdsc->mutex);
                __wake_requests(mdsc, &session->s_waiting);
                if (wake == 2)
                        kick_requests(mdsc, mds);
                mutex_unlock(&mdsc->mutex);
        }
        if (op == CEPH_SESSION_CLOSE)
                ceph_put_mds_session(session);
        return;

bad:
        pr_err_client(cl, "corrupt message mds%d len %d\n", mds,
                      (int)msg->front.iov_len);
        ceph_msg_dump(msg);
fail:
        for (i = 0; i < cap_auths_num; i++) {
                kfree(cap_auths[i].match.gids);
                kfree(cap_auths[i].match.path);
                kfree(cap_auths[i].match.fs_name);
        }
        kfree(cap_auths);
        return;
}

void ceph_mdsc_release_dir_caps(struct ceph_mds_request *req)
{
        struct ceph_client *cl = req->r_mdsc->fsc->client;
        int dcaps;

        dcaps = xchg(&req->r_dir_caps, 0);
        if (dcaps) {
                doutc(cl, "releasing r_dir_caps=%s\n", ceph_cap_string(dcaps));
                ceph_put_cap_refs(ceph_inode(req->r_parent), dcaps);
        }
}

void ceph_mdsc_release_dir_caps_async(struct ceph_mds_request *req)
{
        struct ceph_client *cl = req->r_mdsc->fsc->client;
        int dcaps;

        dcaps = xchg(&req->r_dir_caps, 0);
        if (dcaps) {
                doutc(cl, "releasing r_dir_caps=%s\n", ceph_cap_string(dcaps));
                ceph_put_cap_refs_async(ceph_inode(req->r_parent), dcaps);
        }
}

/*
 * called under session->mutex.
 */
static void replay_unsafe_requests(struct ceph_mds_client *mdsc,
                                   struct ceph_mds_session *session)
{
        struct ceph_mds_request *req, *nreq;
        struct rb_node *p;

        doutc(mdsc->fsc->client, "mds%d\n", session->s_mds);

        mutex_lock(&mdsc->mutex);
        list_for_each_entry_safe(req, nreq, &session->s_unsafe, r_unsafe_item)
                __send_request(session, req, true);

        /*
         * also re-send old requests when MDS enters reconnect stage. So that MDS
         * can process completed request in clientreplay stage.
         */
        p = rb_first(&mdsc->request_tree);
        while (p) {
                req = rb_entry(p, struct ceph_mds_request, r_node);
                p = rb_next(p);
                if (test_bit(CEPH_MDS_R_GOT_UNSAFE, &req->r_req_flags))
                        continue;
                if (req->r_attempts == 0)
                        continue; /* only old requests */
                if (!req->r_session)
                        continue;
                if (req->r_session->s_mds != session->s_mds)
                        continue;

                ceph_mdsc_release_dir_caps_async(req);

                __send_request(session, req, true);
        }
        mutex_unlock(&mdsc->mutex);
}

static int send_reconnect_partial(struct ceph_reconnect_state *recon_state)
{
        struct ceph_msg *reply;
        struct ceph_pagelist *_pagelist;
        struct page *page;
        __le32 *addr;
        int err = -ENOMEM;

        if (!recon_state->allow_multi)
                return -ENOSPC;

        /* can't handle message that contains both caps and realm */
        BUG_ON(!recon_state->nr_caps == !recon_state->nr_realms);

        /* pre-allocate new pagelist */
        _pagelist = ceph_pagelist_alloc(GFP_NOFS);
        if (!_pagelist)
                return -ENOMEM;

        reply = ceph_msg_new2(CEPH_MSG_CLIENT_RECONNECT, 0, 1, GFP_NOFS, false);
        if (!reply)
                goto fail_msg;

        /* placeholder for nr_caps */
        err = ceph_pagelist_encode_32(_pagelist, 0);
        if (err < 0)
                goto fail;

        if (recon_state->nr_caps) {
                /* currently encoding caps */
                err = ceph_pagelist_encode_32(recon_state->pagelist, 0);
                if (err)
                        goto fail;
        } else {
                /* placeholder for nr_realms (currently encoding relams) */
                err = ceph_pagelist_encode_32(_pagelist, 0);
                if (err < 0)
                        goto fail;
        }

        err = ceph_pagelist_encode_8(recon_state->pagelist, 1);
        if (err)
                goto fail;

        page = list_first_entry(&recon_state->pagelist->head, struct page, lru);
        addr = kmap_atomic(page);
        if (recon_state->nr_caps) {
                /* currently encoding caps */
                *addr = cpu_to_le32(recon_state->nr_caps);
        } else {
                /* currently encoding relams */
                *(addr + 1) = cpu_to_le32(recon_state->nr_realms);
        }
        kunmap_atomic(addr);

        reply->hdr.version = cpu_to_le16(5);
        reply->hdr.compat_version = cpu_to_le16(4);

        reply->hdr.data_len = cpu_to_le32(recon_state->pagelist->length);
        ceph_msg_data_add_pagelist(reply, recon_state->pagelist);

        ceph_con_send(&recon_state->session->s_con, reply);
        ceph_pagelist_release(recon_state->pagelist);

        recon_state->pagelist = _pagelist;
        recon_state->nr_caps = 0;
        recon_state->nr_realms = 0;
        recon_state->msg_version = 5;
        return 0;
fail:
        ceph_msg_put(reply);
fail_msg:
        ceph_pagelist_release(_pagelist);
        return err;
}

static struct dentry* d_find_primary(struct inode *inode)
{
        struct dentry *alias, *dn = NULL;

        if (hlist_empty(&inode->i_dentry))
                return NULL;

        spin_lock(&inode->i_lock);
        if (hlist_empty(&inode->i_dentry))
                goto out_unlock;

        if (S_ISDIR(inode->i_mode)) {
                alias = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
                if (!IS_ROOT(alias))
                        dn = dget(alias);
                goto out_unlock;
        }

        hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
                spin_lock(&alias->d_lock);
                if (!d_unhashed(alias) &&
                    (ceph_dentry(alias)->flags & CEPH_DENTRY_PRIMARY_LINK)) {
                        dn = dget_dlock(alias);
                }
                spin_unlock(&alias->d_lock);
                if (dn)
                        break;
        }
out_unlock:
        spin_unlock(&inode->i_lock);
        return dn;
}

/*
 * Encode information about a cap for a reconnect with the MDS.
 */
static int reconnect_caps_cb(struct inode *inode, int mds, void *arg)
{
        struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
        struct ceph_client *cl = ceph_inode_to_client(inode);
        union {
                struct ceph_mds_cap_reconnect v2;
                struct ceph_mds_cap_reconnect_v1 v1;
        } rec;
        struct ceph_inode_info *ci = ceph_inode(inode);
        struct ceph_reconnect_state *recon_state = arg;
        struct ceph_pagelist *pagelist = recon_state->pagelist;
        struct dentry *dentry;
        struct ceph_cap *cap;
        char *path;
        int pathlen = 0, err;
        u64 pathbase;
        u64 snap_follows;

        dentry = d_find_primary(inode);
        if (dentry) {
                /* set pathbase to parent dir when msg_version >= 2 */
                path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase,
                                            recon_state->msg_version >= 2);
                dput(dentry);
                if (IS_ERR(path)) {
                        err = PTR_ERR(path);
                        goto out_err;
                }
        } else {
                path = NULL;
                pathbase = 0;
        }

        spin_lock(&ci->i_ceph_lock);
        cap = __get_cap_for_mds(ci, mds);
        if (!cap) {
                spin_unlock(&ci->i_ceph_lock);
                err = 0;
                goto out_err;
        }
        doutc(cl, " adding %p ino %llx.%llx cap %p %lld %s\n", inode,
              ceph_vinop(inode), cap, cap->cap_id,
              ceph_cap_string(cap->issued));

        cap->seq = 0;        /* reset cap seq */
        cap->issue_seq = 0;  /* and issue_seq */
        cap->mseq = 0;       /* and migrate_seq */
        cap->cap_gen = atomic_read(&cap->session->s_cap_gen);

        /* These are lost when the session goes away */
        if (S_ISDIR(inode->i_mode)) {
                if (cap->issued & CEPH_CAP_DIR_CREATE) {
                        ceph_put_string(rcu_dereference_raw(ci->i_cached_layout.pool_ns));
                        memset(&ci->i_cached_layout, 0, sizeof(ci->i_cached_layout));
                }
                cap->issued &= ~CEPH_CAP_ANY_DIR_OPS;
        }

        if (recon_state->msg_version >= 2) {
                rec.v2.cap_id = cpu_to_le64(cap->cap_id);
                rec.v2.wanted = cpu_to_le32(__ceph_caps_wanted(ci));
                rec.v2.issued = cpu_to_le32(cap->issued);
                rec.v2.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);
                rec.v2.pathbase = cpu_to_le64(pathbase);
                rec.v2.flock_len = (__force __le32)
                        ((ci->i_ceph_flags & CEPH_I_ERROR_FILELOCK) ? 0 : 1);
        } else {
                struct timespec64 ts;

                rec.v1.cap_id = cpu_to_le64(cap->cap_id);
                rec.v1.wanted = cpu_to_le32(__ceph_caps_wanted(ci));
                rec.v1.issued = cpu_to_le32(cap->issued);
                rec.v1.size = cpu_to_le64(i_size_read(inode));
                ts = inode_get_mtime(inode);
                ceph_encode_timespec64(&rec.v1.mtime, &ts);
                ts = inode_get_atime(inode);
                ceph_encode_timespec64(&rec.v1.atime, &ts);
                rec.v1.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);
                rec.v1.pathbase = cpu_to_le64(pathbase);
        }

        if (list_empty(&ci->i_cap_snaps)) {
                snap_follows = ci->i_head_snapc ? ci->i_head_snapc->seq : 0;
        } else {
                struct ceph_cap_snap *capsnap =
                        list_first_entry(&ci->i_cap_snaps,
                                         struct ceph_cap_snap, ci_item);
                snap_follows = capsnap->follows;
        }
        spin_unlock(&ci->i_ceph_lock);

        if (recon_state->msg_version >= 2) {
                int num_fcntl_locks, num_flock_locks;
                struct ceph_filelock *flocks = NULL;
                size_t struct_len, total_len = sizeof(u64);
                u8 struct_v = 0;

encode_again:
                if (rec.v2.flock_len) {
                        ceph_count_locks(inode, &num_fcntl_locks, &num_flock_locks);
                } else {
                        num_fcntl_locks = 0;
                        num_flock_locks = 0;
                }
                if (num_fcntl_locks + num_flock_locks > 0) {
                        flocks = kmalloc_array(num_fcntl_locks + num_flock_locks,
                                               sizeof(struct ceph_filelock),
                                               GFP_NOFS);
                        if (!flocks) {
                                err = -ENOMEM;
                                goto out_err;
                        }
                        err = ceph_encode_locks_to_buffer(inode, flocks,
                                                          num_fcntl_locks,
                                                          num_flock_locks);
                        if (err) {
                                kfree(flocks);
                                flocks = NULL;
                                if (err == -ENOSPC)
                                        goto encode_again;
                                goto out_err;
                        }
                } else {
                        kfree(flocks);
                        flocks = NULL;
                }

                if (recon_state->msg_version >= 3) {
                        /* version, compat_version and struct_len */
                        total_len += 2 * sizeof(u8) + sizeof(u32);
                        struct_v = 2;
                }
                /*
                 * number of encoded locks is stable, so copy to pagelist
                 */
                struct_len = 2 * sizeof(u32) +
                            (num_fcntl_locks + num_flock_locks) *
                            sizeof(struct ceph_filelock);
                rec.v2.flock_len = cpu_to_le32(struct_len);

                struct_len += sizeof(u32) + pathlen + sizeof(rec.v2);

                if (struct_v >= 2)
                        struct_len += sizeof(u64); /* snap_follows */

                total_len += struct_len;

                if (pagelist->length + total_len > RECONNECT_MAX_SIZE) {
                        err = send_reconnect_partial(recon_state);
                        if (err)
                                goto out_freeflocks;
                        pagelist = recon_state->pagelist;
                }

                err = ceph_pagelist_reserve(pagelist, total_len);
                if (err)
                        goto out_freeflocks;

                ceph_pagelist_encode_64(pagelist, ceph_ino(inode));
                if (recon_state->msg_version >= 3) {
                        ceph_pagelist_encode_8(pagelist, struct_v);
                        ceph_pagelist_encode_8(pagelist, 1);
                        ceph_pagelist_encode_32(pagelist, struct_len);
                }
                ceph_pagelist_encode_string(pagelist, path, pathlen);
                ceph_pagelist_append(pagelist, &rec, sizeof(rec.v2));
                ceph_locks_to_pagelist(flocks, pagelist,
                                       num_fcntl_locks, num_flock_locks);
                if (struct_v >= 2)
                        ceph_pagelist_encode_64(pagelist, snap_follows);
out_freeflocks:
                kfree(flocks);
        } else {
                err = ceph_pagelist_reserve(pagelist,
                                            sizeof(u64) + sizeof(u32) +
                                            pathlen + sizeof(rec.v1));
                if (err)
                        goto out_err;

                ceph_pagelist_encode_64(pagelist, ceph_ino(inode));
                ceph_pagelist_encode_string(pagelist, path, pathlen);
                ceph_pagelist_append(pagelist, &rec, sizeof(rec.v1));
        }

out_err:
        ceph_mdsc_free_path(path, pathlen);
        if (!err)
                recon_state->nr_caps++;
        return err;
}

static int encode_snap_realms(struct ceph_mds_client *mdsc,
                              struct ceph_reconnect_state *recon_state)
{
        struct rb_node *p;
        struct ceph_pagelist *pagelist = recon_state->pagelist;
        struct ceph_client *cl = mdsc->fsc->client;
        int err = 0;

        if (recon_state->msg_version >= 4) {
                err = ceph_pagelist_encode_32(pagelist, mdsc->num_snap_realms);
                if (err < 0)
                        goto fail;
        }

        /*
         * snaprealms.  we provide mds with the ino, seq (version), and
         * parent for all of our realms.  If the mds has any newer info,
         * it will tell us.
         */
        for (p = rb_first(&mdsc->snap_realms); p; p = rb_next(p)) {
                struct ceph_snap_realm *realm =
                       rb_entry(p, struct ceph_snap_realm, node);
                struct ceph_mds_snaprealm_reconnect sr_rec;

                if (recon_state->msg_version >= 4) {
                        size_t need = sizeof(u8) * 2 + sizeof(u32) +
                                      sizeof(sr_rec);

                        if (pagelist->length + need > RECONNECT_MAX_SIZE) {
                                err = send_reconnect_partial(recon_state);
                                if (err)
                                        goto fail;
                                pagelist = recon_state->pagelist;
                        }

                        err = ceph_pagelist_reserve(pagelist, need);
                        if (err)
                                goto fail;

                        ceph_pagelist_encode_8(pagelist, 1);
                        ceph_pagelist_encode_8(pagelist, 1);
                        ceph_pagelist_encode_32(pagelist, sizeof(sr_rec));
                }

                doutc(cl, " adding snap realm %llx seq %lld parent %llx\n",
                      realm->ino, realm->seq, realm->parent_ino);
                sr_rec.ino = cpu_to_le64(realm->ino);
                sr_rec.seq = cpu_to_le64(realm->seq);
                sr_rec.parent = cpu_to_le64(realm->parent_ino);

                err = ceph_pagelist_append(pagelist, &sr_rec, sizeof(sr_rec));
                if (err)
                        goto fail;

                recon_state->nr_realms++;
        }
fail:
        return err;
}


/*
 * If an MDS fails and recovers, clients need to reconnect in order to
 * reestablish shared state.  This includes all caps issued through
 * this session _and_ the snap_realm hierarchy.  Because it's not
 * clear which snap realms the mds cares about, we send everything we
 * know about.. that ensures we'll then get any new info the
 * recovering MDS might have.
 *
 * This is a relatively heavyweight operation, but it's rare.
 */
static void send_mds_reconnect(struct ceph_mds_client *mdsc,
                               struct ceph_mds_session *session)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_msg *reply;
        int mds = session->s_mds;
        int err = -ENOMEM;
        struct ceph_reconnect_state recon_state = {
                .session = session,
        };
        LIST_HEAD(dispose);

        pr_info_client(cl, "mds%d reconnect start\n", mds);

        recon_state.pagelist = ceph_pagelist_alloc(GFP_NOFS);
        if (!recon_state.pagelist)
                goto fail_nopagelist;

        reply = ceph_msg_new2(CEPH_MSG_CLIENT_RECONNECT, 0, 1, GFP_NOFS, false);
        if (!reply)
                goto fail_nomsg;

        xa_destroy(&session->s_delegated_inos);

        mutex_lock(&session->s_mutex);
        session->s_state = CEPH_MDS_SESSION_RECONNECTING;
        session->s_seq = 0;

        doutc(cl, "session %p state %s\n", session,
              ceph_session_state_name(session->s_state));

        atomic_inc(&session->s_cap_gen);

        spin_lock(&session->s_cap_lock);
        /* don't know if session is readonly */
        session->s_readonly = 0;
        /*
         * notify __ceph_remove_cap() that we are composing cap reconnect.
         * If a cap get released before being added to the cap reconnect,
         * __ceph_remove_cap() should skip queuing cap release.
         */
        session->s_cap_reconnect = 1;
        /* drop old cap expires; we're about to reestablish that state */
        detach_cap_releases(session, &dispose);
        spin_unlock(&session->s_cap_lock);
        dispose_cap_releases(mdsc, &dispose);

        /* trim unused caps to reduce MDS's cache rejoin time */
        if (mdsc->fsc->sb->s_root)
                shrink_dcache_parent(mdsc->fsc->sb->s_root);

        ceph_con_close(&session->s_con);
        ceph_con_open(&session->s_con,
                      CEPH_ENTITY_TYPE_MDS, mds,
                      ceph_mdsmap_get_addr(mdsc->mdsmap, mds));

        /* replay unsafe requests */
        replay_unsafe_requests(mdsc, session);

        ceph_early_kick_flushing_caps(mdsc, session);

        down_read(&mdsc->snap_rwsem);

        /* placeholder for nr_caps */
        err = ceph_pagelist_encode_32(recon_state.pagelist, 0);
        if (err)
                goto fail;

        if (test_bit(CEPHFS_FEATURE_MULTI_RECONNECT, &session->s_features)) {
                recon_state.msg_version = 3;
                recon_state.allow_multi = true;
        } else if (session->s_con.peer_features & CEPH_FEATURE_MDSENC) {
                recon_state.msg_version = 3;
        } else {
                recon_state.msg_version = 2;
        }
        /* traverse this session's caps */
        err = ceph_iterate_session_caps(session, reconnect_caps_cb, &recon_state);

        spin_lock(&session->s_cap_lock);
        session->s_cap_reconnect = 0;
        spin_unlock(&session->s_cap_lock);

        if (err < 0)
                goto fail;

        /* check if all realms can be encoded into current message */
        if (mdsc->num_snap_realms) {
                size_t total_len =
                        recon_state.pagelist->length +
                        mdsc->num_snap_realms *
                        sizeof(struct ceph_mds_snaprealm_reconnect);
                if (recon_state.msg_version >= 4) {
                        /* number of realms */
                        total_len += sizeof(u32);
                        /* version, compat_version and struct_len */
                        total_len += mdsc->num_snap_realms *
                                     (2 * sizeof(u8) + sizeof(u32));
                }
                if (total_len > RECONNECT_MAX_SIZE) {
                        if (!recon_state.allow_multi) {
                                err = -ENOSPC;
                                goto fail;
                        }
                        if (recon_state.nr_caps) {
                                err = send_reconnect_partial(&recon_state);
                                if (err)
                                        goto fail;
                        }
                        recon_state.msg_version = 5;
                }
        }

        err = encode_snap_realms(mdsc, &recon_state);
        if (err < 0)
                goto fail;

        if (recon_state.msg_version >= 5) {
                err = ceph_pagelist_encode_8(recon_state.pagelist, 0);
                if (err < 0)
                        goto fail;
        }

        if (recon_state.nr_caps || recon_state.nr_realms) {
                struct page *page =
                        list_first_entry(&recon_state.pagelist->head,
                                        struct page, lru);
                __le32 *addr = kmap_atomic(page);
                if (recon_state.nr_caps) {
                        WARN_ON(recon_state.nr_realms != mdsc->num_snap_realms);
                        *addr = cpu_to_le32(recon_state.nr_caps);
                } else if (recon_state.msg_version >= 4) {
                        *(addr + 1) = cpu_to_le32(recon_state.nr_realms);
                }
                kunmap_atomic(addr);
        }

        reply->hdr.version = cpu_to_le16(recon_state.msg_version);
        if (recon_state.msg_version >= 4)
                reply->hdr.compat_version = cpu_to_le16(4);

        reply->hdr.data_len = cpu_to_le32(recon_state.pagelist->length);
        ceph_msg_data_add_pagelist(reply, recon_state.pagelist);

        ceph_con_send(&session->s_con, reply);

        mutex_unlock(&session->s_mutex);

        mutex_lock(&mdsc->mutex);
        __wake_requests(mdsc, &session->s_waiting);
        mutex_unlock(&mdsc->mutex);

        up_read(&mdsc->snap_rwsem);
        ceph_pagelist_release(recon_state.pagelist);
        return;

fail:
        ceph_msg_put(reply);
        up_read(&mdsc->snap_rwsem);
        mutex_unlock(&session->s_mutex);
fail_nomsg:
        ceph_pagelist_release(recon_state.pagelist);
fail_nopagelist:
        pr_err_client(cl, "error %d preparing reconnect for mds%d\n",
                      err, mds);
        return;
}


/*
 * compare old and new mdsmaps, kicking requests
 * and closing out old connections as necessary
 *
 * called under mdsc->mutex.
 */
static void check_new_map(struct ceph_mds_client *mdsc,
                          struct ceph_mdsmap *newmap,
                          struct ceph_mdsmap *oldmap)
{
        int i, j, err;
        int oldstate, newstate;
        struct ceph_mds_session *s;
        unsigned long targets[DIV_ROUND_UP(CEPH_MAX_MDS, sizeof(unsigned long))] = {0};
        struct ceph_client *cl = mdsc->fsc->client;

        doutc(cl, "new %u old %u\n", newmap->m_epoch, oldmap->m_epoch);

        if (newmap->m_info) {
                for (i = 0; i < newmap->possible_max_rank; i++) {
                        for (j = 0; j < newmap->m_info[i].num_export_targets; j++)
                                set_bit(newmap->m_info[i].export_targets[j], targets);
                }
        }

        for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                if (!mdsc->sessions[i])
                        continue;
                s = mdsc->sessions[i];
                oldstate = ceph_mdsmap_get_state(oldmap, i);
                newstate = ceph_mdsmap_get_state(newmap, i);

                doutc(cl, "mds%d state %s%s -> %s%s (session %s)\n",
                      i, ceph_mds_state_name(oldstate),
                      ceph_mdsmap_is_laggy(oldmap, i) ? " (laggy)" : "",
                      ceph_mds_state_name(newstate),
                      ceph_mdsmap_is_laggy(newmap, i) ? " (laggy)" : "",
                      ceph_session_state_name(s->s_state));

                if (i >= newmap->possible_max_rank) {
                        /* force close session for stopped mds */
                        ceph_get_mds_session(s);
                        __unregister_session(mdsc, s);
                        __wake_requests(mdsc, &s->s_waiting);
                        mutex_unlock(&mdsc->mutex);

                        mutex_lock(&s->s_mutex);
                        cleanup_session_requests(mdsc, s);
                        remove_session_caps(s);
                        mutex_unlock(&s->s_mutex);

                        ceph_put_mds_session(s);

                        mutex_lock(&mdsc->mutex);
                        kick_requests(mdsc, i);
                        continue;
                }

                if (memcmp(ceph_mdsmap_get_addr(oldmap, i),
                           ceph_mdsmap_get_addr(newmap, i),
                           sizeof(struct ceph_entity_addr))) {
                        /* just close it */
                        mutex_unlock(&mdsc->mutex);
                        mutex_lock(&s->s_mutex);
                        mutex_lock(&mdsc->mutex);
                        ceph_con_close(&s->s_con);
                        mutex_unlock(&s->s_mutex);
                        s->s_state = CEPH_MDS_SESSION_RESTARTING;
                } else if (oldstate == newstate) {
                        continue;  /* nothing new with this mds */
                }

                /*
                 * send reconnect?
                 */
                if (s->s_state == CEPH_MDS_SESSION_RESTARTING &&
                    newstate >= CEPH_MDS_STATE_RECONNECT) {
                        mutex_unlock(&mdsc->mutex);
                        clear_bit(i, targets);
                        send_mds_reconnect(mdsc, s);
                        mutex_lock(&mdsc->mutex);
                }

                /*
                 * kick request on any mds that has gone active.
                 */
                if (oldstate < CEPH_MDS_STATE_ACTIVE &&
                    newstate >= CEPH_MDS_STATE_ACTIVE) {
                        if (oldstate != CEPH_MDS_STATE_CREATING &&
                            oldstate != CEPH_MDS_STATE_STARTING)
                                pr_info_client(cl, "mds%d recovery completed\n",
                                               s->s_mds);
                        kick_requests(mdsc, i);
                        mutex_unlock(&mdsc->mutex);
                        mutex_lock(&s->s_mutex);
                        mutex_lock(&mdsc->mutex);
                        ceph_kick_flushing_caps(mdsc, s);
                        mutex_unlock(&s->s_mutex);
                        wake_up_session_caps(s, RECONNECT);
                }
        }

        /*
         * Only open and reconnect sessions that don't exist yet.
         */
        for (i = 0; i < newmap->possible_max_rank; i++) {
                /*
                 * In case the import MDS is crashed just after
                 * the EImportStart journal is flushed, so when
                 * a standby MDS takes over it and is replaying
                 * the EImportStart journal the new MDS daemon
                 * will wait the client to reconnect it, but the
                 * client may never register/open the session yet.
                 *
                 * Will try to reconnect that MDS daemon if the
                 * rank number is in the export targets array and
                 * is the up:reconnect state.
                 */
                newstate = ceph_mdsmap_get_state(newmap, i);
                if (!test_bit(i, targets) || newstate != CEPH_MDS_STATE_RECONNECT)
                        continue;

                /*
                 * The session maybe registered and opened by some
                 * requests which were choosing random MDSes during
                 * the mdsc->mutex's unlock/lock gap below in rare
                 * case. But the related MDS daemon will just queue
                 * that requests and be still waiting for the client's
                 * reconnection request in up:reconnect state.
                 */
                s = __ceph_lookup_mds_session(mdsc, i);
                if (likely(!s)) {
                        s = __open_export_target_session(mdsc, i);
                        if (IS_ERR(s)) {
                                err = PTR_ERR(s);
                                pr_err_client(cl,
                                              "failed to open export target session, err %d\n",
                                              err);
                                continue;
                        }
                }
                doutc(cl, "send reconnect to export target mds.%d\n", i);
                mutex_unlock(&mdsc->mutex);
                send_mds_reconnect(mdsc, s);
                ceph_put_mds_session(s);
                mutex_lock(&mdsc->mutex);
        }

        for (i = 0; i < newmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                s = mdsc->sessions[i];
                if (!s)
                        continue;
                if (!ceph_mdsmap_is_laggy(newmap, i))
                        continue;
                if (s->s_state == CEPH_MDS_SESSION_OPEN ||
                    s->s_state == CEPH_MDS_SESSION_HUNG ||
                    s->s_state == CEPH_MDS_SESSION_CLOSING) {
                        doutc(cl, " connecting to export targets of laggy mds%d\n", i);
                        __open_export_target_sessions(mdsc, s);
                }
        }
}



/*
 * leases
 */

/*
 * caller must hold session s_mutex, dentry->d_lock
 */
void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry)
{
        struct ceph_dentry_info *di = ceph_dentry(dentry);

        ceph_put_mds_session(di->lease_session);
        di->lease_session = NULL;
}

static void handle_lease(struct ceph_mds_client *mdsc,
                         struct ceph_mds_session *session,
                         struct ceph_msg *msg)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct super_block *sb = mdsc->fsc->sb;
        struct inode *inode;
        struct dentry *parent, *dentry;
        struct ceph_dentry_info *di;
        int mds = session->s_mds;
        struct ceph_mds_lease *h = msg->front.iov_base;
        u32 seq;
        struct ceph_vino vino;
        struct qstr dname;
        int release = 0;

        doutc(cl, "from mds%d\n", mds);

        if (!ceph_inc_mds_stopping_blocker(mdsc, session))
                return;

        /* decode */
        if (msg->front.iov_len < sizeof(*h) + sizeof(u32))
                goto bad;
        vino.ino = le64_to_cpu(h->ino);
        vino.snap = CEPH_NOSNAP;
        seq = le32_to_cpu(h->seq);
        dname.len = get_unaligned_le32(h + 1);
        if (msg->front.iov_len < sizeof(*h) + sizeof(u32) + dname.len)
                goto bad;
        dname.name = (void *)(h + 1) + sizeof(u32);

        /* lookup inode */
        inode = ceph_find_inode(sb, vino);
        doutc(cl, "%s, ino %llx %p %.*s\n", ceph_lease_op_name(h->action),
              vino.ino, inode, dname.len, dname.name);

        mutex_lock(&session->s_mutex);
        if (!inode) {
                doutc(cl, "no inode %llx\n", vino.ino);
                goto release;
        }

        /* dentry */
        parent = d_find_alias(inode);
        if (!parent) {
                doutc(cl, "no parent dentry on inode %p\n", inode);
                WARN_ON(1);
                goto release;  /* hrm... */
        }
        dname.hash = full_name_hash(parent, dname.name, dname.len);
        dentry = d_lookup(parent, &dname);
        dput(parent);
        if (!dentry)
                goto release;

        spin_lock(&dentry->d_lock);
        di = ceph_dentry(dentry);
        switch (h->action) {
        case CEPH_MDS_LEASE_REVOKE:
                if (di->lease_session == session) {
                        if (ceph_seq_cmp(di->lease_seq, seq) > 0)
                                h->seq = cpu_to_le32(di->lease_seq);
                        __ceph_mdsc_drop_dentry_lease(dentry);
                }
                release = 1;
                break;

        case CEPH_MDS_LEASE_RENEW:
                if (di->lease_session == session &&
                    di->lease_gen == atomic_read(&session->s_cap_gen) &&
                    di->lease_renew_from &&
                    di->lease_renew_after == 0) {
                        unsigned long duration =
                                msecs_to_jiffies(le32_to_cpu(h->duration_ms));

                        di->lease_seq = seq;
                        di->time = di->lease_renew_from + duration;
                        di->lease_renew_after = di->lease_renew_from +
                                (duration >> 1);
                        di->lease_renew_from = 0;
                }
                break;
        }
        spin_unlock(&dentry->d_lock);
        dput(dentry);

        if (!release)
                goto out;

release:
        /* let's just reuse the same message */
        h->action = CEPH_MDS_LEASE_REVOKE_ACK;
        ceph_msg_get(msg);
        ceph_con_send(&session->s_con, msg);

out:
        mutex_unlock(&session->s_mutex);
        iput(inode);

        ceph_dec_mds_stopping_blocker(mdsc);
        return;

bad:
        ceph_dec_mds_stopping_blocker(mdsc);

        pr_err_client(cl, "corrupt lease message\n");
        ceph_msg_dump(msg);
}

void ceph_mdsc_lease_send_msg(struct ceph_mds_session *session,
                              struct dentry *dentry, char action,
                              u32 seq)
{
        struct ceph_client *cl = session->s_mdsc->fsc->client;
        struct ceph_msg *msg;
        struct ceph_mds_lease *lease;
        struct inode *dir;
        int len = sizeof(*lease) + sizeof(u32) + NAME_MAX;

        doutc(cl, "identry %p %s to mds%d\n", dentry, ceph_lease_op_name(action),
              session->s_mds);

        msg = ceph_msg_new(CEPH_MSG_CLIENT_LEASE, len, GFP_NOFS, false);
        if (!msg)
                return;
        lease = msg->front.iov_base;
        lease->action = action;
        lease->seq = cpu_to_le32(seq);

        spin_lock(&dentry->d_lock);
        dir = d_inode(dentry->d_parent);
        lease->ino = cpu_to_le64(ceph_ino(dir));
        lease->first = lease->last = cpu_to_le64(ceph_snap(dir));

        put_unaligned_le32(dentry->d_name.len, lease + 1);
        memcpy((void *)(lease + 1) + 4,
               dentry->d_name.name, dentry->d_name.len);
        spin_unlock(&dentry->d_lock);

        ceph_con_send(&session->s_con, msg);
}

/*
 * lock unlock the session, to wait ongoing session activities
 */
static void lock_unlock_session(struct ceph_mds_session *s)
{
        mutex_lock(&s->s_mutex);
        mutex_unlock(&s->s_mutex);
}

static void maybe_recover_session(struct ceph_mds_client *mdsc)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_fs_client *fsc = mdsc->fsc;

        if (!ceph_test_mount_opt(fsc, CLEANRECOVER))
                return;

        if (READ_ONCE(fsc->mount_state) != CEPH_MOUNT_MOUNTED)
                return;

        if (!READ_ONCE(fsc->blocklisted))
                return;

        pr_info_client(cl, "auto reconnect after blocklisted\n");
        ceph_force_reconnect(fsc->sb);
}

bool check_session_state(struct ceph_mds_session *s)
{
        struct ceph_client *cl = s->s_mdsc->fsc->client;

        switch (s->s_state) {
        case CEPH_MDS_SESSION_OPEN:
                if (s->s_ttl && time_after(jiffies, s->s_ttl)) {
                        s->s_state = CEPH_MDS_SESSION_HUNG;
                        pr_info_client(cl, "mds%d hung\n", s->s_mds);
                }
                break;
        case CEPH_MDS_SESSION_CLOSING:
        case CEPH_MDS_SESSION_NEW:
        case CEPH_MDS_SESSION_RESTARTING:
        case CEPH_MDS_SESSION_CLOSED:
        case CEPH_MDS_SESSION_REJECTED:
                return false;
        }

        return true;
}

/*
 * If the sequence is incremented while we're waiting on a REQUEST_CLOSE reply,
 * then we need to retransmit that request.
 */
void inc_session_sequence(struct ceph_mds_session *s)
{
        struct ceph_client *cl = s->s_mdsc->fsc->client;

        lockdep_assert_held(&s->s_mutex);

        s->s_seq++;

        if (s->s_state == CEPH_MDS_SESSION_CLOSING) {
                int ret;

                doutc(cl, "resending session close request for mds%d\n", s->s_mds);
                ret = request_close_session(s);
                if (ret < 0)
                        pr_err_client(cl, "unable to close session to mds%d: %d\n",
                                      s->s_mds, ret);
        }
}

/*
 * delayed work -- periodically trim expired leases, renew caps with mds.  If
 * the @delay parameter is set to 0 or if it's more than 5 secs, the default
 * workqueue delay value of 5 secs will be used.
 */
static void schedule_delayed(struct ceph_mds_client *mdsc, unsigned long delay)
{
        unsigned long max_delay = HZ * 5;

        /* 5 secs default delay */
        if (!delay || (delay > max_delay))
                delay = max_delay;
        schedule_delayed_work(&mdsc->delayed_work,
                              round_jiffies_relative(delay));
}

static void delayed_work(struct work_struct *work)
{
        struct ceph_mds_client *mdsc =
                container_of(work, struct ceph_mds_client, delayed_work.work);
        unsigned long delay;
        int renew_interval;
        int renew_caps;
        int i;

        doutc(mdsc->fsc->client, "mdsc delayed_work\n");

        if (mdsc->stopping >= CEPH_MDSC_STOPPING_FLUSHED)
                return;

        mutex_lock(&mdsc->mutex);
        renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
        renew_caps = time_after_eq(jiffies, HZ*renew_interval +
                                   mdsc->last_renew_caps);
        if (renew_caps)
                mdsc->last_renew_caps = jiffies;

        for (i = 0; i < mdsc->max_sessions; i++) {
                struct ceph_mds_session *s = __ceph_lookup_mds_session(mdsc, i);
                if (!s)
                        continue;

                if (!check_session_state(s)) {
                        ceph_put_mds_session(s);
                        continue;
                }
                mutex_unlock(&mdsc->mutex);

                ceph_flush_session_cap_releases(mdsc, s);

                mutex_lock(&s->s_mutex);
                if (renew_caps)
                        send_renew_caps(mdsc, s);
                else
                        ceph_con_keepalive(&s->s_con);
                if (s->s_state == CEPH_MDS_SESSION_OPEN ||
                    s->s_state == CEPH_MDS_SESSION_HUNG)
                        ceph_send_cap_releases(mdsc, s);
                mutex_unlock(&s->s_mutex);
                ceph_put_mds_session(s);

                mutex_lock(&mdsc->mutex);
        }
        mutex_unlock(&mdsc->mutex);

        delay = ceph_check_delayed_caps(mdsc);

        ceph_queue_cap_reclaim_work(mdsc);

        ceph_trim_snapid_map(mdsc);

        maybe_recover_session(mdsc);

        schedule_delayed(mdsc, delay);
}

int ceph_mdsc_init(struct ceph_fs_client *fsc)

{
        struct ceph_mds_client *mdsc;
        int err;

        mdsc = kzalloc(sizeof(struct ceph_mds_client), GFP_NOFS);
        if (!mdsc)
                return -ENOMEM;
        mdsc->fsc = fsc;
        mutex_init(&mdsc->mutex);
        mdsc->mdsmap = kzalloc(sizeof(*mdsc->mdsmap), GFP_NOFS);
        if (!mdsc->mdsmap) {
                err = -ENOMEM;
                goto err_mdsc;
        }

        init_completion(&mdsc->safe_umount_waiters);
        spin_lock_init(&mdsc->stopping_lock);
        atomic_set(&mdsc->stopping_blockers, 0);
        init_completion(&mdsc->stopping_waiter);
        init_waitqueue_head(&mdsc->session_close_wq);
        INIT_LIST_HEAD(&mdsc->waiting_for_map);
        mdsc->quotarealms_inodes = RB_ROOT;
        mutex_init(&mdsc->quotarealms_inodes_mutex);
        init_rwsem(&mdsc->snap_rwsem);
        mdsc->snap_realms = RB_ROOT;
        INIT_LIST_HEAD(&mdsc->snap_empty);
        spin_lock_init(&mdsc->snap_empty_lock);
        mdsc->request_tree = RB_ROOT;
        INIT_DELAYED_WORK(&mdsc->delayed_work, delayed_work);
        mdsc->last_renew_caps = jiffies;
        INIT_LIST_HEAD(&mdsc->cap_delay_list);
#ifdef CONFIG_DEBUG_FS
        INIT_LIST_HEAD(&mdsc->cap_wait_list);
#endif
        spin_lock_init(&mdsc->cap_delay_lock);
        INIT_LIST_HEAD(&mdsc->cap_unlink_delay_list);
        INIT_LIST_HEAD(&mdsc->snap_flush_list);
        spin_lock_init(&mdsc->snap_flush_lock);
        mdsc->last_cap_flush_tid = 1;
        INIT_LIST_HEAD(&mdsc->cap_flush_list);
        INIT_LIST_HEAD(&mdsc->cap_dirty_migrating);
        spin_lock_init(&mdsc->cap_dirty_lock);
        init_waitqueue_head(&mdsc->cap_flushing_wq);
        INIT_WORK(&mdsc->cap_reclaim_work, ceph_cap_reclaim_work);
        INIT_WORK(&mdsc->cap_unlink_work, ceph_cap_unlink_work);
        err = ceph_metric_init(&mdsc->metric);
        if (err)
                goto err_mdsmap;

        spin_lock_init(&mdsc->dentry_list_lock);
        INIT_LIST_HEAD(&mdsc->dentry_leases);
        INIT_LIST_HEAD(&mdsc->dentry_dir_leases);

        ceph_caps_init(mdsc);
        ceph_adjust_caps_max_min(mdsc, fsc->mount_options);

        spin_lock_init(&mdsc->snapid_map_lock);
        mdsc->snapid_map_tree = RB_ROOT;
        INIT_LIST_HEAD(&mdsc->snapid_map_lru);

        init_rwsem(&mdsc->pool_perm_rwsem);
        mdsc->pool_perm_tree = RB_ROOT;

        strscpy(mdsc->nodename, utsname()->nodename,
                sizeof(mdsc->nodename));

        fsc->mdsc = mdsc;
        return 0;

err_mdsmap:
        kfree(mdsc->mdsmap);
err_mdsc:
        kfree(mdsc);
        return err;
}

/*
 * Wait for safe replies on open mds requests.  If we time out, drop
 * all requests from the tree to avoid dangling dentry refs.
 */
static void wait_requests(struct ceph_mds_client *mdsc)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_options *opts = mdsc->fsc->client->options;
        struct ceph_mds_request *req;

        mutex_lock(&mdsc->mutex);
        if (__get_oldest_req(mdsc)) {
                mutex_unlock(&mdsc->mutex);

                doutc(cl, "waiting for requests\n");
                wait_for_completion_timeout(&mdsc->safe_umount_waiters,
                                    ceph_timeout_jiffies(opts->mount_timeout));

                /* tear down remaining requests */
                mutex_lock(&mdsc->mutex);
                while ((req = __get_oldest_req(mdsc))) {
                        doutc(cl, "timed out on tid %llu\n", req->r_tid);
                        list_del_init(&req->r_wait);
                        __unregister_request(mdsc, req);
                }
        }
        mutex_unlock(&mdsc->mutex);
        doutc(cl, "done\n");
}

void send_flush_mdlog(struct ceph_mds_session *s)
{
        struct ceph_client *cl = s->s_mdsc->fsc->client;
        struct ceph_msg *msg;

        /*
         * Pre-luminous MDS crashes when it sees an unknown session request
         */
        if (!CEPH_HAVE_FEATURE(s->s_con.peer_features, SERVER_LUMINOUS))
                return;

        mutex_lock(&s->s_mutex);
        doutc(cl, "request mdlog flush to mds%d (%s)s seq %lld\n",
              s->s_mds, ceph_session_state_name(s->s_state), s->s_seq);
        msg = ceph_create_session_msg(CEPH_SESSION_REQUEST_FLUSH_MDLOG,
                                      s->s_seq);
        if (!msg) {
                pr_err_client(cl, "failed to request mdlog flush to mds%d (%s) seq %lld\n",
                              s->s_mds, ceph_session_state_name(s->s_state), s->s_seq);
        } else {
                ceph_con_send(&s->s_con, msg);
        }
        mutex_unlock(&s->s_mutex);
}

static int ceph_mds_auth_match(struct ceph_mds_client *mdsc,
                               struct ceph_mds_cap_auth *auth,
                               char *tpath)
{
        const struct cred *cred = get_current_cred();
        u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid);
        u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid);
        struct ceph_client *cl = mdsc->fsc->client;
        const char *spath = mdsc->fsc->mount_options->server_path;
        bool gid_matched = false;
        u32 gid, tlen, len;
        int i, j;

        doutc(cl, "match.uid %lld\n", auth->match.uid);
        if (auth->match.uid != MDS_AUTH_UID_ANY) {
                if (auth->match.uid != caller_uid)
                        return 0;
                if (auth->match.num_gids) {
                        for (i = 0; i < auth->match.num_gids; i++) {
                                if (caller_gid == auth->match.gids[i])
                                        gid_matched = true;
                        }
                        if (!gid_matched && cred->group_info->ngroups) {
                                for (i = 0; i < cred->group_info->ngroups; i++) {
                                        gid = from_kgid(&init_user_ns,
                                                        cred->group_info->gid[i]);
                                        for (j = 0; j < auth->match.num_gids; j++) {
                                                if (gid == auth->match.gids[j]) {
                                                        gid_matched = true;
                                                        break;
                                                }
                                        }
                                        if (gid_matched)
                                                break;
                                }
                        }
                        if (!gid_matched)
                                return 0;
                }
        }

        /* path match */
        if (auth->match.path) {
                if (!tpath)
                        return 0;

                tlen = strlen(tpath);
                len = strlen(auth->match.path);
                if (len) {
                        char *_tpath = tpath;
                        bool free_tpath = false;
                        int m, n;

                        doutc(cl, "server path %s, tpath %s, match.path %s\n",
                              spath, tpath, auth->match.path);
                        if (spath && (m = strlen(spath)) != 1) {
                                /* mount path + '/' + tpath + an extra space */
                                n = m + 1 + tlen + 1;
                                _tpath = kmalloc(n, GFP_NOFS);
                                if (!_tpath)
                                        return -ENOMEM;
                                /* remove the leading '/' */
                                snprintf(_tpath, n, "%s/%s", spath + 1, tpath);
                                free_tpath = true;
                                tlen = strlen(_tpath);
                        }

                        /*
                         * Please note the tailing '/' for match.path has already
                         * been removed when parsing.
                         *
                         * Remove the tailing '/' for the target path.
                         */
                        while (tlen && _tpath[tlen - 1] == '/') {
                                _tpath[tlen - 1] = '\0';
                                tlen -= 1;
                        }
                        doutc(cl, "_tpath %s\n", _tpath);

                        /*
                         * In case first == _tpath && tlen == len:
                         *  match.path=/foo  --> /foo _path=/foo     --> match
                         *  match.path=/foo/ --> /foo _path=/foo     --> match
                         *
                         * In case first == _tmatch.path && tlen > len:
                         *  match.path=/foo/ --> /foo _path=/foo/    --> match
                         *  match.path=/foo  --> /foo _path=/foo/    --> match
                         *  match.path=/foo/ --> /foo _path=/foo/d   --> match
                         *  match.path=/foo  --> /foo _path=/food    --> mismatch
                         *
                         * All the other cases                       --> mismatch
                         */
                        char *first = strstr(_tpath, auth->match.path);
                        if (first != _tpath) {
                                if (free_tpath)
                                        kfree(_tpath);
                                return 0;
                        }

                        if (tlen > len && _tpath[len] != '/') {
                                if (free_tpath)
                                        kfree(_tpath);
                                return 0;
                        }
                }
        }

        doutc(cl, "matched\n");
        return 1;
}

int ceph_mds_check_access(struct ceph_mds_client *mdsc, char *tpath, int mask)
{
        const struct cred *cred = get_current_cred();
        u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid);
        u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid);
        struct ceph_mds_cap_auth *rw_perms_s = NULL;
        struct ceph_client *cl = mdsc->fsc->client;
        bool root_squash_perms = true;
        int i, err;

        doutc(cl, "tpath '%s', mask %d, caller_uid %d, caller_gid %d\n",
              tpath, mask, caller_uid, caller_gid);

        for (i = 0; i < mdsc->s_cap_auths_num; i++) {
                struct ceph_mds_cap_auth *s = &mdsc->s_cap_auths[i];

                err = ceph_mds_auth_match(mdsc, s, tpath);
                if (err < 0) {
                        return err;
                } else if (err > 0) {
                        /* always follow the last auth caps' permision */
                        root_squash_perms = true;
                        rw_perms_s = NULL;
                        if ((mask & MAY_WRITE) && s->writeable &&
                            s->match.root_squash && (!caller_uid || !caller_gid))
                                root_squash_perms = false;

                        if (((mask & MAY_WRITE) && !s->writeable) ||
                            ((mask & MAY_READ) && !s->readable))
                                rw_perms_s = s;
                }
        }

        doutc(cl, "root_squash_perms %d, rw_perms_s %p\n", root_squash_perms,
              rw_perms_s);
        if (root_squash_perms && rw_perms_s == NULL) {
                doutc(cl, "access allowed\n");
                return 0;
        }

        if (!root_squash_perms) {
                doutc(cl, "root_squash is enabled and user(%d %d) isn't allowed to write",
                      caller_uid, caller_gid);
        }
        if (rw_perms_s) {
                doutc(cl, "mds auth caps readable/writeable %d/%d while request r/w %d/%d",
                      rw_perms_s->readable, rw_perms_s->writeable,
                      !!(mask & MAY_READ), !!(mask & MAY_WRITE));
        }
        doutc(cl, "access denied\n");
        return -EACCES;
}

/*
 * called before mount is ro, and before dentries are torn down.
 * (hmm, does this still race with new lookups?)
 */
void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
{
        doutc(mdsc->fsc->client, "begin\n");
        mdsc->stopping = CEPH_MDSC_STOPPING_BEGIN;

        ceph_mdsc_iterate_sessions(mdsc, send_flush_mdlog, true);
        ceph_mdsc_iterate_sessions(mdsc, lock_unlock_session, false);
        ceph_flush_dirty_caps(mdsc);
        wait_requests(mdsc);

        /*
         * wait for reply handlers to drop their request refs and
         * their inode/dcache refs
         */
        ceph_msgr_flush();

        ceph_cleanup_quotarealms_inodes(mdsc);
        doutc(mdsc->fsc->client, "done\n");
}

/*
 * flush the mdlog and wait for all write mds requests to flush.
 */
static void flush_mdlog_and_wait_mdsc_unsafe_requests(struct ceph_mds_client *mdsc,
                                                 u64 want_tid)
{
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_request *req = NULL, *nextreq;
        struct ceph_mds_session *last_session = NULL;
        struct rb_node *n;

        mutex_lock(&mdsc->mutex);
        doutc(cl, "want %lld\n", want_tid);
restart:
        req = __get_oldest_req(mdsc);
        while (req && req->r_tid <= want_tid) {
                /* find next request */
                n = rb_next(&req->r_node);
                if (n)
                        nextreq = rb_entry(n, struct ceph_mds_request, r_node);
                else
                        nextreq = NULL;
                if (req->r_op != CEPH_MDS_OP_SETFILELOCK &&
                    (req->r_op & CEPH_MDS_OP_WRITE)) {
                        struct ceph_mds_session *s = req->r_session;

                        if (!s) {
                                req = nextreq;
                                continue;
                        }

                        /* write op */
                        ceph_mdsc_get_request(req);
                        if (nextreq)
                                ceph_mdsc_get_request(nextreq);
                        s = ceph_get_mds_session(s);
                        mutex_unlock(&mdsc->mutex);

                        /* send flush mdlog request to MDS */
                        if (last_session != s) {
                                send_flush_mdlog(s);
                                ceph_put_mds_session(last_session);
                                last_session = s;
                        } else {
                                ceph_put_mds_session(s);
                        }
                        doutc(cl, "wait on %llu (want %llu)\n",
                              req->r_tid, want_tid);
                        wait_for_completion(&req->r_safe_completion);

                        mutex_lock(&mdsc->mutex);
                        ceph_mdsc_put_request(req);
                        if (!nextreq)
                                break;  /* next dne before, so we're done! */
                        if (RB_EMPTY_NODE(&nextreq->r_node)) {
                                /* next request was removed from tree */
                                ceph_mdsc_put_request(nextreq);
                                goto restart;
                        }
                        ceph_mdsc_put_request(nextreq);  /* won't go away */
                }
                req = nextreq;
        }
        mutex_unlock(&mdsc->mutex);
        ceph_put_mds_session(last_session);
        doutc(cl, "done\n");
}

void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
{
        struct ceph_client *cl = mdsc->fsc->client;
        u64 want_tid, want_flush;

        if (READ_ONCE(mdsc->fsc->mount_state) >= CEPH_MOUNT_SHUTDOWN)
                return;

        doutc(cl, "sync\n");
        mutex_lock(&mdsc->mutex);
        want_tid = mdsc->last_tid;
        mutex_unlock(&mdsc->mutex);

        ceph_flush_dirty_caps(mdsc);
        ceph_flush_cap_releases(mdsc);
        spin_lock(&mdsc->cap_dirty_lock);
        want_flush = mdsc->last_cap_flush_tid;
        if (!list_empty(&mdsc->cap_flush_list)) {
                struct ceph_cap_flush *cf =
                        list_last_entry(&mdsc->cap_flush_list,
                                        struct ceph_cap_flush, g_list);
                cf->wake = true;
        }
        spin_unlock(&mdsc->cap_dirty_lock);

        doutc(cl, "sync want tid %lld flush_seq %lld\n", want_tid, want_flush);

        flush_mdlog_and_wait_mdsc_unsafe_requests(mdsc, want_tid);
        wait_caps_flush(mdsc, want_flush);
}

/*
 * true if all sessions are closed, or we force unmount
 */
static bool done_closing_sessions(struct ceph_mds_client *mdsc, int skipped)
{
        if (READ_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN)
                return true;
        return atomic_read(&mdsc->num_sessions) <= skipped;
}

/*
 * called after sb is ro or when metadata corrupted.
 */
void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc)
{
        struct ceph_options *opts = mdsc->fsc->client->options;
        struct ceph_client *cl = mdsc->fsc->client;
        struct ceph_mds_session *session;
        int i;
        int skipped = 0;

        doutc(cl, "begin\n");

        /* close sessions */
        mutex_lock(&mdsc->mutex);
        for (i = 0; i < mdsc->max_sessions; i++) {
                session = __ceph_lookup_mds_session(mdsc, i);
                if (!session)
                        continue;
                mutex_unlock(&mdsc->mutex);
                mutex_lock(&session->s_mutex);
                if (__close_session(mdsc, session) <= 0)
                        skipped++;
                mutex_unlock(&session->s_mutex);
                ceph_put_mds_session(session);
                mutex_lock(&mdsc->mutex);
        }
        mutex_unlock(&mdsc->mutex);

        doutc(cl, "waiting for sessions to close\n");
        wait_event_timeout(mdsc->session_close_wq,
                           done_closing_sessions(mdsc, skipped),
                           ceph_timeout_jiffies(opts->mount_timeout));

        /* tear down remaining sessions */
        mutex_lock(&mdsc->mutex);
        for (i = 0; i < mdsc->max_sessions; i++) {
                if (mdsc->sessions[i]) {
                        session = ceph_get_mds_session(mdsc->sessions[i]);
                        __unregister_session(mdsc, session);
                        mutex_unlock(&mdsc->mutex);
                        mutex_lock(&session->s_mutex);
                        remove_session_caps(session);
                        mutex_unlock(&session->s_mutex);
                        ceph_put_mds_session(session);
                        mutex_lock(&mdsc->mutex);
                }
        }
        WARN_ON(!list_empty(&mdsc->cap_delay_list));
        mutex_unlock(&mdsc->mutex);

        ceph_cleanup_snapid_map(mdsc);
        ceph_cleanup_global_and_empty_realms(mdsc);

        cancel_work_sync(&mdsc->cap_reclaim_work);
        cancel_work_sync(&mdsc->cap_unlink_work);
        cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */

        doutc(cl, "done\n");
}

void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
{
        struct ceph_mds_session *session;
        int mds;

        doutc(mdsc->fsc->client, "force umount\n");

        mutex_lock(&mdsc->mutex);
        for (mds = 0; mds < mdsc->max_sessions; mds++) {
                session = __ceph_lookup_mds_session(mdsc, mds);
                if (!session)
                        continue;

                if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                        __unregister_session(mdsc, session);
                __wake_requests(mdsc, &session->s_waiting);
                mutex_unlock(&mdsc->mutex);

                mutex_lock(&session->s_mutex);
                __close_session(mdsc, session);
                if (session->s_state == CEPH_MDS_SESSION_CLOSING) {
                        cleanup_session_requests(mdsc, session);
                        remove_session_caps(session);
                }
                mutex_unlock(&session->s_mutex);
                ceph_put_mds_session(session);

                mutex_lock(&mdsc->mutex);
                kick_requests(mdsc, mds);
        }
        __wake_requests(mdsc, &mdsc->waiting_for_map);
        mutex_unlock(&mdsc->mutex);
}

static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
{
        doutc(mdsc->fsc->client, "stop\n");
        /*
         * Make sure the delayed work stopped before releasing
         * the resources.
         *
         * Because the cancel_delayed_work_sync() will only
         * guarantee that the work finishes executing. But the
         * delayed work will re-arm itself again after that.
         */
        flush_delayed_work(&mdsc->delayed_work);

        if (mdsc->mdsmap)
                ceph_mdsmap_destroy(mdsc->mdsmap);
        kfree(mdsc->sessions);
        ceph_caps_finalize(mdsc);

        if (mdsc->s_cap_auths) {
                int i;

                for (i = 0; i < mdsc->s_cap_auths_num; i++) {
                        kfree(mdsc->s_cap_auths[i].match.gids);
                        kfree(mdsc->s_cap_auths[i].match.path);
                        kfree(mdsc->s_cap_auths[i].match.fs_name);
                }
                kfree(mdsc->s_cap_auths);
        }

        ceph_pool_perm_destroy(mdsc);
}

void ceph_mdsc_destroy(struct ceph_fs_client *fsc)
{
        struct ceph_mds_client *mdsc = fsc->mdsc;
        doutc(fsc->client, "%p\n", mdsc);

        if (!mdsc)
                return;

        /* flush out any connection work with references to us */
        ceph_msgr_flush();

        ceph_mdsc_stop(mdsc);

        ceph_metric_destroy(&mdsc->metric);

        fsc->mdsc = NULL;
        kfree(mdsc);
        doutc(fsc->client, "%p done\n", mdsc);
}

void ceph_mdsc_handle_fsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
{
        struct ceph_fs_client *fsc = mdsc->fsc;
        struct ceph_client *cl = fsc->client;
        const char *mds_namespace = fsc->mount_options->mds_namespace;
        void *p = msg->front.iov_base;
        void *end = p + msg->front.iov_len;
        u32 epoch;
        u32 num_fs;
        u32 mount_fscid = (u32)-1;
        int err = -EINVAL;

        ceph_decode_need(&p, end, sizeof(u32), bad);
        epoch = ceph_decode_32(&p);

        doutc(cl, "epoch %u\n", epoch);

        /* struct_v, struct_cv, map_len, epoch, legacy_client_fscid */
        ceph_decode_skip_n(&p, end, 2 + sizeof(u32) * 3, bad);

        ceph_decode_32_safe(&p, end, num_fs, bad);
        while (num_fs-- > 0) {
                void *info_p, *info_end;
                u32 info_len;
                u32 fscid, namelen;

                ceph_decode_need(&p, end, 2 + sizeof(u32), bad);
                p += 2;                // info_v, info_cv
                info_len = ceph_decode_32(&p);
                ceph_decode_need(&p, end, info_len, bad);
                info_p = p;
                info_end = p + info_len;
                p = info_end;

                ceph_decode_need(&info_p, info_end, sizeof(u32) * 2, bad);
                fscid = ceph_decode_32(&info_p);
                namelen = ceph_decode_32(&info_p);
                ceph_decode_need(&info_p, info_end, namelen, bad);

                if (mds_namespace &&
                    strlen(mds_namespace) == namelen &&
                    !strncmp(mds_namespace, (char *)info_p, namelen)) {
                        mount_fscid = fscid;
                        break;
                }
        }

        ceph_monc_got_map(&fsc->client->monc, CEPH_SUB_FSMAP, epoch);
        if (mount_fscid != (u32)-1) {
                fsc->client->monc.fs_cluster_id = mount_fscid;
                ceph_monc_want_map(&fsc->client->monc, CEPH_SUB_MDSMAP,
                                   0, true);
                ceph_monc_renew_subs(&fsc->client->monc);
        } else {
                err = -ENOENT;
                goto err_out;
        }
        return;

bad:
        pr_err_client(cl, "error decoding fsmap %d. Shutting down mount.\n",
                      err);
        ceph_umount_begin(mdsc->fsc->sb);
        ceph_msg_dump(msg);
err_out:
        mutex_lock(&mdsc->mutex);
        mdsc->mdsmap_err = err;
        __wake_requests(mdsc, &mdsc->waiting_for_map);
        mutex_unlock(&mdsc->mutex);
}

/*
 * handle mds map update.
 */
void ceph_mdsc_handle_mdsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
{
        struct ceph_client *cl = mdsc->fsc->client;
        u32 epoch;
        u32 maplen;
        void *p = msg->front.iov_base;
        void *end = p + msg->front.iov_len;
        struct ceph_mdsmap *newmap, *oldmap;
        struct ceph_fsid fsid;
        int err = -EINVAL;

        ceph_decode_need(&p, end, sizeof(fsid)+2*sizeof(u32), bad);
        ceph_decode_copy(&p, &fsid, sizeof(fsid));
        if (ceph_check_fsid(mdsc->fsc->client, &fsid) < 0)
                return;
        epoch = ceph_decode_32(&p);
        maplen = ceph_decode_32(&p);
        doutc(cl, "epoch %u len %d\n", epoch, (int)maplen);

        /* do we need it? */
        mutex_lock(&mdsc->mutex);
        if (mdsc->mdsmap && epoch <= mdsc->mdsmap->m_epoch) {
                doutc(cl, "epoch %u <= our %u\n", epoch, mdsc->mdsmap->m_epoch);
                mutex_unlock(&mdsc->mutex);
                return;
        }

        newmap = ceph_mdsmap_decode(mdsc, &p, end, ceph_msgr2(mdsc->fsc->client));
        if (IS_ERR(newmap)) {
                err = PTR_ERR(newmap);
                goto bad_unlock;
        }

        /* swap into place */
        if (mdsc->mdsmap) {
                oldmap = mdsc->mdsmap;
                mdsc->mdsmap = newmap;
                check_new_map(mdsc, newmap, oldmap);
                ceph_mdsmap_destroy(oldmap);
        } else {
                mdsc->mdsmap = newmap;  /* first mds map */
        }
        mdsc->fsc->max_file_size = min((loff_t)mdsc->mdsmap->m_max_file_size,
                                        MAX_LFS_FILESIZE);

        __wake_requests(mdsc, &mdsc->waiting_for_map);
        ceph_monc_got_map(&mdsc->fsc->client->monc, CEPH_SUB_MDSMAP,
                          mdsc->mdsmap->m_epoch);

        mutex_unlock(&mdsc->mutex);
        schedule_delayed(mdsc, 0);
        return;

bad_unlock:
        mutex_unlock(&mdsc->mutex);
bad:
        pr_err_client(cl, "error decoding mdsmap %d. Shutting down mount.\n",
                      err);
        ceph_umount_begin(mdsc->fsc->sb);
        ceph_msg_dump(msg);
        return;
}

static struct ceph_connection *mds_get_con(struct ceph_connection *con)
{
        struct ceph_mds_session *s = con->private;

        if (ceph_get_mds_session(s))
                return con;
        return NULL;
}

static void mds_put_con(struct ceph_connection *con)
{
        struct ceph_mds_session *s = con->private;

        ceph_put_mds_session(s);
}

/*
 * if the client is unresponsive for long enough, the mds will kill
 * the session entirely.
 */
static void mds_peer_reset(struct ceph_connection *con)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mds_client *mdsc = s->s_mdsc;

        pr_warn_client(mdsc->fsc->client, "mds%d closed our session\n",
                       s->s_mds);
        if (READ_ONCE(mdsc->fsc->mount_state) != CEPH_MOUNT_FENCE_IO &&
            ceph_mdsmap_get_state(mdsc->mdsmap, s->s_mds) >= CEPH_MDS_STATE_RECONNECT)
                send_mds_reconnect(mdsc, s);
}

static void mds_dispatch(struct ceph_connection *con, struct ceph_msg *msg)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mds_client *mdsc = s->s_mdsc;
        struct ceph_client *cl = mdsc->fsc->client;
        int type = le16_to_cpu(msg->hdr.type);

        mutex_lock(&mdsc->mutex);
        if (__verify_registered_session(mdsc, s) < 0) {
                mutex_unlock(&mdsc->mutex);
                goto out;
        }
        mutex_unlock(&mdsc->mutex);

        switch (type) {
        case CEPH_MSG_MDS_MAP:
                ceph_mdsc_handle_mdsmap(mdsc, msg);
                break;
        case CEPH_MSG_FS_MAP_USER:
                ceph_mdsc_handle_fsmap(mdsc, msg);
                break;
        case CEPH_MSG_CLIENT_SESSION:
                handle_session(s, msg);
                break;
        case CEPH_MSG_CLIENT_REPLY:
                handle_reply(s, msg);
                break;
        case CEPH_MSG_CLIENT_REQUEST_FORWARD:
                handle_forward(mdsc, s, msg);
                break;
        case CEPH_MSG_CLIENT_CAPS:
                ceph_handle_caps(s, msg);
                break;
        case CEPH_MSG_CLIENT_SNAP:
                ceph_handle_snap(mdsc, s, msg);
                break;
        case CEPH_MSG_CLIENT_LEASE:
                handle_lease(mdsc, s, msg);
                break;
        case CEPH_MSG_CLIENT_QUOTA:
                ceph_handle_quota(mdsc, s, msg);
                break;

        default:
                pr_err_client(cl, "received unknown message type %d %s\n",
                              type, ceph_msg_type_name(type));
        }
out:
        ceph_msg_put(msg);
}

/*
 * authentication
 */

/*
 * Note: returned pointer is the address of a structure that's
 * managed separately.  Caller must *not* attempt to free it.
 */
static struct ceph_auth_handshake *
mds_get_authorizer(struct ceph_connection *con, int *proto, int force_new)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mds_client *mdsc = s->s_mdsc;
        struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth;
        struct ceph_auth_handshake *auth = &s->s_auth;
        int ret;

        ret = __ceph_auth_get_authorizer(ac, auth, CEPH_ENTITY_TYPE_MDS,
                                         force_new, proto, NULL, NULL);
        if (ret)
                return ERR_PTR(ret);

        return auth;
}

static int mds_add_authorizer_challenge(struct ceph_connection *con,
                                    void *challenge_buf, int challenge_buf_len)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mds_client *mdsc = s->s_mdsc;
        struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth;

        return ceph_auth_add_authorizer_challenge(ac, s->s_auth.authorizer,
                                            challenge_buf, challenge_buf_len);
}

static int mds_verify_authorizer_reply(struct ceph_connection *con)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mds_client *mdsc = s->s_mdsc;
        struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth;
        struct ceph_auth_handshake *auth = &s->s_auth;

        return ceph_auth_verify_authorizer_reply(ac, auth->authorizer,
                auth->authorizer_reply_buf, auth->authorizer_reply_buf_len,
                NULL, NULL, NULL, NULL);
}

static int mds_invalidate_authorizer(struct ceph_connection *con)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mds_client *mdsc = s->s_mdsc;
        struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth;

        ceph_auth_invalidate_authorizer(ac, CEPH_ENTITY_TYPE_MDS);

        return ceph_monc_validate_auth(&mdsc->fsc->client->monc);
}

static int mds_get_auth_request(struct ceph_connection *con,
                                void *buf, int *buf_len,
                                void **authorizer, int *authorizer_len)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_auth_client *ac = s->s_mdsc->fsc->client->monc.auth;
        struct ceph_auth_handshake *auth = &s->s_auth;
        int ret;

        ret = ceph_auth_get_authorizer(ac, auth, CEPH_ENTITY_TYPE_MDS,
                                       buf, buf_len);
        if (ret)
                return ret;

        *authorizer = auth->authorizer_buf;
        *authorizer_len = auth->authorizer_buf_len;
        return 0;
}

static int mds_handle_auth_reply_more(struct ceph_connection *con,
                                      void *reply, int reply_len,
                                      void *buf, int *buf_len,
                                      void **authorizer, int *authorizer_len)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_auth_client *ac = s->s_mdsc->fsc->client->monc.auth;
        struct ceph_auth_handshake *auth = &s->s_auth;
        int ret;

        ret = ceph_auth_handle_svc_reply_more(ac, auth, reply, reply_len,
                                              buf, buf_len);
        if (ret)
                return ret;

        *authorizer = auth->authorizer_buf;
        *authorizer_len = auth->authorizer_buf_len;
        return 0;
}

static int mds_handle_auth_done(struct ceph_connection *con,
                                u64 global_id, void *reply, int reply_len,
                                u8 *session_key, int *session_key_len,
                                u8 *con_secret, int *con_secret_len)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_auth_client *ac = s->s_mdsc->fsc->client->monc.auth;
        struct ceph_auth_handshake *auth = &s->s_auth;

        return ceph_auth_handle_svc_reply_done(ac, auth, reply, reply_len,
                                               session_key, session_key_len,
                                               con_secret, con_secret_len);
}

static int mds_handle_auth_bad_method(struct ceph_connection *con,
                                      int used_proto, int result,
                                      const int *allowed_protos, int proto_cnt,
                                      const int *allowed_modes, int mode_cnt)
{
        struct ceph_mds_session *s = con->private;
        struct ceph_mon_client *monc = &s->s_mdsc->fsc->client->monc;
        int ret;

        if (ceph_auth_handle_bad_authorizer(monc->auth, CEPH_ENTITY_TYPE_MDS,
                                            used_proto, result,
                                            allowed_protos, proto_cnt,
                                            allowed_modes, mode_cnt)) {
                ret = ceph_monc_validate_auth(monc);
                if (ret)
                        return ret;
        }

        return -EACCES;
}

static struct ceph_msg *mds_alloc_msg(struct ceph_connection *con,
                                struct ceph_msg_header *hdr, int *skip)
{
        struct ceph_msg *msg;
        int type = (int) le16_to_cpu(hdr->type);
        int front_len = (int) le32_to_cpu(hdr->front_len);

        if (con->in_msg)
                return con->in_msg;

        *skip = 0;
        msg = ceph_msg_new(type, front_len, GFP_NOFS, false);
        if (!msg) {
                pr_err("unable to allocate msg type %d len %d\n",
                       type, front_len);
                return NULL;
        }

        return msg;
}

static int mds_sign_message(struct ceph_msg *msg)
{
       struct ceph_mds_session *s = msg->con->private;
       struct ceph_auth_handshake *auth = &s->s_auth;

       return ceph_auth_sign_message(auth, msg);
}

static int mds_check_message_signature(struct ceph_msg *msg)
{
       struct ceph_mds_session *s = msg->con->private;
       struct ceph_auth_handshake *auth = &s->s_auth;

       return ceph_auth_check_message_signature(auth, msg);
}

static const struct ceph_connection_operations mds_con_ops = {
        .get = mds_get_con,
        .put = mds_put_con,
        .alloc_msg = mds_alloc_msg,
        .dispatch = mds_dispatch,
        .peer_reset = mds_peer_reset,
        .get_authorizer = mds_get_authorizer,
        .add_authorizer_challenge = mds_add_authorizer_challenge,
        .verify_authorizer_reply = mds_verify_authorizer_reply,
        .invalidate_authorizer = mds_invalidate_authorizer,
        .sign_message = mds_sign_message,
        .check_message_signature = mds_check_message_signature,
        .get_auth_request = mds_get_auth_request,
        .handle_auth_reply_more = mds_handle_auth_reply_more,
        .handle_auth_done = mds_handle_auth_done,
        .handle_auth_bad_method = mds_handle_auth_bad_method,
};

/* eof */






































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































 3731 
























 3733 





 3740 



















































































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
// SPDX-License-Identifier: GPL-2.0-only
// Copyright (C) 2022 Linutronix GmbH, John Ogness
// Copyright (C) 2022 Intel, Thomas Gleixner

#include <linux/atomic.h>
#include <linux/bug.h>
#include <linux/console.h>
#include <linux/delay.h>
#include <linux/errno.h>
#include <linux/export.h>
#include <linux/init.h>
#include <linux/irqflags.h>
#include <linux/kthread.h>
#include <linux/minmax.h>
#include <linux/percpu.h>
#include <linux/preempt.h>
#include <linux/slab.h>
#include <linux/smp.h>
#include <linux/stddef.h>
#include <linux/string.h>
#include <linux/types.h>
#include "internal.h"
#include "printk_ringbuffer.h"
/*
 * Printk console printing implementation for consoles which does not depend
 * on the legacy style console_lock mechanism.
 *
 * The state of the console is maintained in the "nbcon_state" atomic
 * variable.
 *
 * The console is locked when:
 *
 *   - The 'prio' field contains the priority of the context that owns the
 *     console. Only higher priority contexts are allowed to take over the
 *     lock. A value of 0 (NBCON_PRIO_NONE) means the console is not locked.
 *
 *   - The 'cpu' field denotes on which CPU the console is locked. It is used
 *     to prevent busy waiting on the same CPU. Also it informs the lock owner
 *     that it has lost the lock in a more complex scenario when the lock was
 *     taken over by a higher priority context, released, and taken on another
 *     CPU with the same priority as the interrupted owner.
 *
 * The acquire mechanism uses a few more fields:
 *
 *   - The 'req_prio' field is used by the handover approach to make the
 *     current owner aware that there is a context with a higher priority
 *     waiting for the friendly handover.
 *
 *   - The 'unsafe' field allows to take over the console in a safe way in the
 *     middle of emitting a message. The field is set only when accessing some
 *     shared resources or when the console device is manipulated. It can be
 *     cleared, for example, after emitting one character when the console
 *     device is in a consistent state.
 *
 *   - The 'unsafe_takeover' field is set when a hostile takeover took the
 *     console in an unsafe state. The console will stay in the unsafe state
 *     until re-initialized.
 *
 * The acquire mechanism uses three approaches:
 *
 *   1) Direct acquire when the console is not owned or is owned by a lower
 *      priority context and is in a safe state.
 *
 *   2) Friendly handover mechanism uses a request/grant handshake. It is used
 *      when the current owner has lower priority and the console is in an
 *      unsafe state.
 *
 *      The requesting context:
 *
 *        a) Sets its priority into the 'req_prio' field.
 *
 *        b) Waits (with a timeout) for the owning context to unlock the
 *           console.
 *
 *        c) Takes the lock and clears the 'req_prio' field.
 *
 *      The owning context:
 *
 *        a) Observes the 'req_prio' field set on exit from the unsafe
 *           console state.
 *
 *        b) Gives up console ownership by clearing the 'prio' field.
 *
 *   3) Unsafe hostile takeover allows to take over the lock even when the
 *      console is an unsafe state. It is used only in panic() by the final
 *      attempt to flush consoles in a try and hope mode.
 *
 *      Note that separate record buffers are used in panic(). As a result,
 *      the messages can be read and formatted without any risk even after
 *      using the hostile takeover in unsafe state.
 *
 * The release function simply clears the 'prio' field.
 *
 * All operations on @console::nbcon_state are atomic cmpxchg based to
 * handle concurrency.
 *
 * The acquire/release functions implement only minimal policies:
 *
 *   - Preference for higher priority contexts.
 *   - Protection of the panic CPU.
 *
 * All other policy decisions must be made at the call sites:
 *
 *   - What is marked as an unsafe section.
 *   - Whether to spin-wait if there is already an owner and the console is
 *     in an unsafe state.
 *   - Whether to attempt an unsafe hostile takeover.
 *
 * The design allows to implement the well known:
 *
 *     acquire()
 *     output_one_printk_record()
 *     release()
 *
 * The output of one printk record might be interrupted with a higher priority
 * context. The new owner is supposed to reprint the entire interrupted record
 * from scratch.
 */

/**
 * nbcon_state_set - Helper function to set the console state
 * @con:        Console to update
 * @new:        The new state to write
 *
 * Only to be used when the console is not yet or no longer visible in the
 * system. Otherwise use nbcon_state_try_cmpxchg().
 */
static inline void nbcon_state_set(struct console *con, struct nbcon_state *new)
{
        atomic_set(&ACCESS_PRIVATE(con, nbcon_state), new->atom);
}

/**
 * nbcon_state_read - Helper function to read the console state
 * @con:        Console to read
 * @state:        The state to store the result
 */
static inline void nbcon_state_read(struct console *con, struct nbcon_state *state)
{
        state->atom = atomic_read(&ACCESS_PRIVATE(con, nbcon_state));
}

/**
 * nbcon_state_try_cmpxchg() - Helper function for atomic_try_cmpxchg() on console state
 * @con:        Console to update
 * @cur:        Old/expected state
 * @new:        New state
 *
 * Return: True on success. False on fail and @cur is updated.
 */
static inline bool nbcon_state_try_cmpxchg(struct console *con, struct nbcon_state *cur,
                                           struct nbcon_state *new)
{
        return atomic_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_state), &cur->atom, new->atom);
}

/**
 * nbcon_seq_read - Read the current console sequence
 * @con:        Console to read the sequence of
 *
 * Return:        Sequence number of the next record to print on @con.
 */
u64 nbcon_seq_read(struct console *con)
{
        unsigned long nbcon_seq = atomic_long_read(&ACCESS_PRIVATE(con, nbcon_seq));

        return __ulseq_to_u64seq(prb, nbcon_seq);
}

/**
 * nbcon_seq_force - Force console sequence to a specific value
 * @con:        Console to work on
 * @seq:        Sequence number value to set
 *
 * Only to be used during init (before registration) or in extreme situations
 * (such as panic with CONSOLE_REPLAY_ALL).
 */
void nbcon_seq_force(struct console *con, u64 seq)
{
        /*
         * If the specified record no longer exists, the oldest available record
         * is chosen. This is especially important on 32bit systems because only
         * the lower 32 bits of the sequence number are stored. The upper 32 bits
         * are derived from the sequence numbers available in the ringbuffer.
         */
        u64 valid_seq = max_t(u64, seq, prb_first_valid_seq(prb));

        atomic_long_set(&ACCESS_PRIVATE(con, nbcon_seq), __u64seq_to_ulseq(valid_seq));
}

/**
 * nbcon_seq_try_update - Try to update the console sequence number
 * @ctxt:        Pointer to an acquire context that contains
 *                all information about the acquire mode
 * @new_seq:        The new sequence number to set
 *
 * @ctxt->seq is updated to the new value of @con::nbcon_seq (expanded to
 * the 64bit value). This could be a different value than @new_seq if
 * nbcon_seq_force() was used or the current context no longer owns the
 * console. In the later case, it will stop printing anyway.
 */
static void nbcon_seq_try_update(struct nbcon_context *ctxt, u64 new_seq)
{
        unsigned long nbcon_seq = __u64seq_to_ulseq(ctxt->seq);
        struct console *con = ctxt->console;

        if (atomic_long_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_seq), &nbcon_seq,
                                    __u64seq_to_ulseq(new_seq))) {
                ctxt->seq = new_seq;
        } else {
                ctxt->seq = nbcon_seq_read(con);
        }
}

/**
 * nbcon_context_try_acquire_direct - Try to acquire directly
 * @ctxt:        The context of the caller
 * @cur:        The current console state
 *
 * Acquire the console when it is released. Also acquire the console when
 * the current owner has a lower priority and the console is in a safe state.
 *
 * Return:        0 on success. Otherwise, an error code on failure. Also @cur
 *                is updated to the latest state when failed to modify it.
 *
 * Errors:
 *
 *        -EPERM:                A panic is in progress and this is not the panic CPU.
 *                        Or the current owner or waiter has the same or higher
 *                        priority. No acquire method can be successful in
 *                        this case.
 *
 *        -EBUSY:                The current owner has a lower priority but the console
 *                        in an unsafe state. The caller should try using
 *                        the handover acquire method.
 */
static int nbcon_context_try_acquire_direct(struct nbcon_context *ctxt,
                                            struct nbcon_state *cur)
{
        unsigned int cpu = smp_processor_id();
        struct console *con = ctxt->console;
        struct nbcon_state new;

        do {
                /*
                 * Panic does not imply that the console is owned. However, it
                 * is critical that non-panic CPUs during panic are unable to
                 * acquire ownership in order to satisfy the assumptions of
                 * nbcon_waiter_matches(). In particular, the assumption that
                 * lower priorities are ignored during panic.
                 */
                if (other_cpu_in_panic())
                        return -EPERM;

                if (ctxt->prio <= cur->prio || ctxt->prio <= cur->req_prio)
                        return -EPERM;

                if (cur->unsafe)
                        return -EBUSY;

                /*
                 * The console should never be safe for a direct acquire
                 * if an unsafe hostile takeover has ever happened.
                 */
                WARN_ON_ONCE(cur->unsafe_takeover);

                new.atom = cur->atom;
                new.prio        = ctxt->prio;
                new.req_prio        = NBCON_PRIO_NONE;
                new.unsafe        = cur->unsafe_takeover;
                new.cpu                = cpu;

        } while (!nbcon_state_try_cmpxchg(con, cur, &new));

        return 0;
}

static bool nbcon_waiter_matches(struct nbcon_state *cur, int expected_prio)
{
        /*
         * The request context is well defined by the @req_prio because:
         *
         * - Only a context with a priority higher than the owner can become
         *   a waiter.
         * - Only a context with a priority higher than the waiter can
         *   directly take over the request.
         * - There are only three priorities.
         * - Only one CPU is allowed to request PANIC priority.
         * - Lower priorities are ignored during panic() until reboot.
         *
         * As a result, the following scenario is *not* possible:
         *
         * 1. This context is currently a waiter.
         * 2. Another context with a higher priority than this context
         *    directly takes ownership.
         * 3. The higher priority context releases the ownership.
         * 4. Another lower priority context takes the ownership.
         * 5. Another context with the same priority as this context
         *    creates a request and starts waiting.
         *
         * Event #1 implies this context is EMERGENCY.
         * Event #2 implies the new context is PANIC.
         * Event #3 occurs when panic() has flushed the console.
         * Events #4 and #5 are not possible due to the other_cpu_in_panic()
         * check in nbcon_context_try_acquire_direct().
         */

        return (cur->req_prio == expected_prio);
}

/**
 * nbcon_context_try_acquire_requested - Try to acquire after having
 *                                         requested a handover
 * @ctxt:        The context of the caller
 * @cur:        The current console state
 *
 * This is a helper function for nbcon_context_try_acquire_handover().
 * It is called when the console is in an unsafe state. The current
 * owner will release the console on exit from the unsafe region.
 *
 * Return:        0 on success and @cur is updated to the new console state.
 *                Otherwise an error code on failure.
 *
 * Errors:
 *
 *        -EPERM:                A panic is in progress and this is not the panic CPU
 *                        or this context is no longer the waiter.
 *
 *        -EBUSY:                The console is still locked. The caller should
 *                        continue waiting.
 *
 * Note: The caller must still remove the request when an error has occurred
 *       except when this context is no longer the waiter.
 */
static int nbcon_context_try_acquire_requested(struct nbcon_context *ctxt,
                                               struct nbcon_state *cur)
{
        unsigned int cpu = smp_processor_id();
        struct console *con = ctxt->console;
        struct nbcon_state new;

        /* Note that the caller must still remove the request! */
        if (other_cpu_in_panic())
                return -EPERM;

        /*
         * Note that the waiter will also change if there was an unsafe
         * hostile takeover.
         */
        if (!nbcon_waiter_matches(cur, ctxt->prio))
                return -EPERM;

        /* If still locked, caller should continue waiting. */
        if (cur->prio != NBCON_PRIO_NONE)
                return -EBUSY;

        /*
         * The previous owner should have never released ownership
         * in an unsafe region.
         */
        WARN_ON_ONCE(cur->unsafe);

        new.atom = cur->atom;
        new.prio        = ctxt->prio;
        new.req_prio        = NBCON_PRIO_NONE;
        new.unsafe        = cur->unsafe_takeover;
        new.cpu                = cpu;

        if (!nbcon_state_try_cmpxchg(con, cur, &new)) {
                /*
                 * The acquire could fail only when it has been taken
                 * over by a higher priority context.
                 */
                WARN_ON_ONCE(nbcon_waiter_matches(cur, ctxt->prio));
                return -EPERM;
        }

        /* Handover success. This context now owns the console. */
        return 0;
}

/**
 * nbcon_context_try_acquire_handover - Try to acquire via handover
 * @ctxt:        The context of the caller
 * @cur:        The current console state
 *
 * The function must be called only when the context has higher priority
 * than the current owner and the console is in an unsafe state.
 * It is the case when nbcon_context_try_acquire_direct() returns -EBUSY.
 *
 * The function sets "req_prio" field to make the current owner aware of
 * the request. Then it waits until the current owner releases the console,
 * or an even higher context takes over the request, or timeout expires.
 *
 * The current owner checks the "req_prio" field on exit from the unsafe
 * region and releases the console. It does not touch the "req_prio" field
 * so that the console stays reserved for the waiter.
 *
 * Return:        0 on success. Otherwise, an error code on failure. Also @cur
 *                is updated to the latest state when failed to modify it.
 *
 * Errors:
 *
 *        -EPERM:                A panic is in progress and this is not the panic CPU.
 *                        Or a higher priority context has taken over the
 *                        console or the handover request.
 *
 *        -EBUSY:                The current owner is on the same CPU so that the hand
 *                        shake could not work. Or the current owner is not
 *                        willing to wait (zero timeout). Or the console does
 *                        not enter the safe state before timeout passed. The
 *                        caller might still use the unsafe hostile takeover
 *                        when allowed.
 *
 *        -EAGAIN:        @cur has changed when creating the handover request.
 *                        The caller should retry with direct acquire.
 */
static int nbcon_context_try_acquire_handover(struct nbcon_context *ctxt,
                                              struct nbcon_state *cur)
{
        unsigned int cpu = smp_processor_id();
        struct console *con = ctxt->console;
        struct nbcon_state new;
        int timeout;
        int request_err = -EBUSY;

        /*
         * Check that the handover is called when the direct acquire failed
         * with -EBUSY.
         */
        WARN_ON_ONCE(ctxt->prio <= cur->prio || ctxt->prio <= cur->req_prio);
        WARN_ON_ONCE(!cur->unsafe);

        /* Handover is not possible on the same CPU. */
        if (cur->cpu == cpu)
                return -EBUSY;

        /*
         * Console stays unsafe after an unsafe takeover until re-initialized.
         * Waiting is not going to help in this case.
         */
        if (cur->unsafe_takeover)
                return -EBUSY;

        /* Is the caller willing to wait? */
        if (ctxt->spinwait_max_us == 0)
                return -EBUSY;

        /*
         * Setup a request for the handover. The caller should try to acquire
         * the console directly when the current state has been modified.
         */
        new.atom = cur->atom;
        new.req_prio = ctxt->prio;
        if (!nbcon_state_try_cmpxchg(con, cur, &new))
                return -EAGAIN;

        cur->atom = new.atom;

        /* Wait until there is no owner and then acquire the console. */
        for (timeout = ctxt->spinwait_max_us; timeout >= 0; timeout--) {
                /* On successful acquire, this request is cleared. */
                request_err = nbcon_context_try_acquire_requested(ctxt, cur);
                if (!request_err)
                        return 0;

                /*
                 * If the acquire should be aborted, it must be ensured
                 * that the request is removed before returning to caller.
                 */
                if (request_err == -EPERM)
                        break;

                udelay(1);

                /* Re-read the state because some time has passed. */
                nbcon_state_read(con, cur);
        }

        /* Timed out or aborted. Carefully remove handover request. */
        do {
                /*
                 * No need to remove request if there is a new waiter. This
                 * can only happen if a higher priority context has taken over
                 * the console or the handover request.
                 */
                if (!nbcon_waiter_matches(cur, ctxt->prio))
                        return -EPERM;

                /* Unset request for handover. */
                new.atom = cur->atom;
                new.req_prio = NBCON_PRIO_NONE;
                if (nbcon_state_try_cmpxchg(con, cur, &new)) {
                        /*
                         * Request successfully unset. Report failure of
                         * acquiring via handover.
                         */
                        cur->atom = new.atom;
                        return request_err;
                }

                /*
                 * Unable to remove request. Try to acquire in case
                 * the owner has released the lock.
                 */
        } while (nbcon_context_try_acquire_requested(ctxt, cur));

        /* Lucky timing. The acquire succeeded while removing the request. */
        return 0;
}

/**
 * nbcon_context_try_acquire_hostile - Acquire via unsafe hostile takeover
 * @ctxt:        The context of the caller
 * @cur:        The current console state
 *
 * Acquire the console even in the unsafe state.
 *
 * It can be permitted by setting the 'allow_unsafe_takeover' field only
 * by the final attempt to flush messages in panic().
 *
 * Return:        0 on success. -EPERM when not allowed by the context.
 */
static int nbcon_context_try_acquire_hostile(struct nbcon_context *ctxt,
                                             struct nbcon_state *cur)
{
        unsigned int cpu = smp_processor_id();
        struct console *con = ctxt->console;
        struct nbcon_state new;

        if (!ctxt->allow_unsafe_takeover)
                return -EPERM;

        /* Ensure caller is allowed to perform unsafe hostile takeovers. */
        if (WARN_ON_ONCE(ctxt->prio != NBCON_PRIO_PANIC))
                return -EPERM;

        /*
         * Check that try_acquire_direct() and try_acquire_handover() returned
         * -EBUSY in the right situation.
         */
        WARN_ON_ONCE(ctxt->prio <= cur->prio || ctxt->prio <= cur->req_prio);
        WARN_ON_ONCE(cur->unsafe != true);

        do {
                new.atom = cur->atom;
                new.cpu                        = cpu;
                new.prio                = ctxt->prio;
                new.unsafe                |= cur->unsafe_takeover;
                new.unsafe_takeover        |= cur->unsafe;

        } while (!nbcon_state_try_cmpxchg(con, cur, &new));

        return 0;
}

static struct printk_buffers panic_nbcon_pbufs;

/**
 * nbcon_context_try_acquire - Try to acquire nbcon console
 * @ctxt:        The context of the caller
 *
 * Context:        Under @ctxt->con->device_lock() or local_irq_save().
 * Return:        True if the console was acquired. False otherwise.
 *
 * If the caller allowed an unsafe hostile takeover, on success the
 * caller should check the current console state to see if it is
 * in an unsafe state. Otherwise, on success the caller may assume
 * the console is not in an unsafe state.
 */
static bool nbcon_context_try_acquire(struct nbcon_context *ctxt)
{
        unsigned int cpu = smp_processor_id();
        struct console *con = ctxt->console;
        struct nbcon_state cur;
        int err;

        nbcon_state_read(con, &cur);
try_again:
        err = nbcon_context_try_acquire_direct(ctxt, &cur);
        if (err != -EBUSY)
                goto out;

        err = nbcon_context_try_acquire_handover(ctxt, &cur);
        if (err == -EAGAIN)
                goto try_again;
        if (err != -EBUSY)
                goto out;

        err = nbcon_context_try_acquire_hostile(ctxt, &cur);
out:
        if (err)
                return false;

        /* Acquire succeeded. */

        /* Assign the appropriate buffer for this context. */
        if (atomic_read(&panic_cpu) == cpu)
                ctxt->pbufs = &panic_nbcon_pbufs;
        else
                ctxt->pbufs = con->pbufs;

        /* Set the record sequence for this context to print. */
        ctxt->seq = nbcon_seq_read(ctxt->console);

        return true;
}

static bool nbcon_owner_matches(struct nbcon_state *cur, int expected_cpu,
                                int expected_prio)
{
        /*
         * A similar function, nbcon_waiter_matches(), only deals with
         * EMERGENCY and PANIC priorities. However, this function must also
         * deal with the NORMAL priority, which requires additional checks
         * and constraints.
         *
         * For the case where preemption and interrupts are disabled, it is
         * enough to also verify that the owning CPU has not changed.
         *
         * For the case where preemption or interrupts are enabled, an
         * external synchronization method *must* be used. In particular,
         * the driver-specific locking mechanism used in device_lock()
         * (including disabling migration) should be used. It prevents
         * scenarios such as:
         *
         * 1. [Task A] owns a context with NBCON_PRIO_NORMAL on [CPU X] and
         *    is scheduled out.
         * 2. Another context takes over the lock with NBCON_PRIO_EMERGENCY
         *    and releases it.
         * 3. [Task B] acquires a context with NBCON_PRIO_NORMAL on [CPU X]
         *    and is scheduled out.
         * 4. [Task A] gets running on [CPU X] and sees that the console is
         *    still owned by a task on [CPU X] with NBON_PRIO_NORMAL. Thus
         *    [Task A] thinks it is the owner when it is not.
         */

        if (cur->prio != expected_prio)
                return false;

        if (cur->cpu != expected_cpu)
                return false;

        return true;
}

/**
 * nbcon_context_release - Release the console
 * @ctxt:        The nbcon context from nbcon_context_try_acquire()
 */
static void nbcon_context_release(struct nbcon_context *ctxt)
{
        unsigned int cpu = smp_processor_id();
        struct console *con = ctxt->console;
        struct nbcon_state cur;
        struct nbcon_state new;

        nbcon_state_read(con, &cur);

        do {
                if (!nbcon_owner_matches(&cur, cpu, ctxt->prio))
                        break;

                new.atom = cur.atom;
                new.prio = NBCON_PRIO_NONE;

                /*
                 * If @unsafe_takeover is set, it is kept set so that
                 * the state remains permanently unsafe.
                 */
                new.unsafe |= cur.unsafe_takeover;

        } while (!nbcon_state_try_cmpxchg(con, &cur, &new));

        ctxt->pbufs = NULL;
}

/**
 * nbcon_context_can_proceed - Check whether ownership can proceed
 * @ctxt:        The nbcon context from nbcon_context_try_acquire()
 * @cur:        The current console state
 *
 * Return:        True if this context still owns the console. False if
 *                ownership was handed over or taken.
 *
 * Must be invoked when entering the unsafe state to make sure that it still
 * owns the lock. Also must be invoked when exiting the unsafe context
 * to eventually free the lock for a higher priority context which asked
 * for the friendly handover.
 *
 * It can be called inside an unsafe section when the console is just
 * temporary in safe state instead of exiting and entering the unsafe
 * state.
 *
 * Also it can be called in the safe context before doing an expensive
 * safe operation. It does not make sense to do the operation when
 * a higher priority context took the lock.
 *
 * When this function returns false then the calling context no longer owns
 * the console and is no longer allowed to go forward. In this case it must
 * back out immediately and carefully. The buffer content is also no longer
 * trusted since it no longer belongs to the calling context.
 */
static bool nbcon_context_can_proceed(struct nbcon_context *ctxt, struct nbcon_state *cur)
{
        unsigned int cpu = smp_processor_id();

        /* Make sure this context still owns the console. */
        if (!nbcon_owner_matches(cur, cpu, ctxt->prio))
                return false;

        /* The console owner can proceed if there is no waiter. */
        if (cur->req_prio == NBCON_PRIO_NONE)
                return true;

        /*
         * A console owner within an unsafe region is always allowed to
         * proceed, even if there are waiters. It can perform a handover
         * when exiting the unsafe region. Otherwise the waiter will
         * need to perform an unsafe hostile takeover.
         */
        if (cur->unsafe)
                return true;

        /* Waiters always have higher priorities than owners. */
        WARN_ON_ONCE(cur->req_prio <= cur->prio);

        /*
         * Having a safe point for take over and eventually a few
         * duplicated characters or a full line is way better than a
         * hostile takeover. Post processing can take care of the garbage.
         * Release and hand over.
         */
        nbcon_context_release(ctxt);

        /*
         * It is not clear whether the waiter really took over ownership. The
         * outermost callsite must make the final decision whether console
         * ownership is needed for it to proceed. If yes, it must reacquire
         * ownership (possibly hostile) before carefully proceeding.
         *
         * The calling context no longer owns the console so go back all the
         * way instead of trying to implement reacquire heuristics in tons of
         * places.
         */
        return false;
}

/**
 * nbcon_can_proceed - Check whether ownership can proceed
 * @wctxt:        The write context that was handed to the write function
 *
 * Return:        True if this context still owns the console. False if
 *                ownership was handed over or taken.
 *
 * It is used in nbcon_enter_unsafe() to make sure that it still owns the
 * lock. Also it is used in nbcon_exit_unsafe() to eventually free the lock
 * for a higher priority context which asked for the friendly handover.
 *
 * It can be called inside an unsafe section when the console is just
 * temporary in safe state instead of exiting and entering the unsafe state.
 *
 * Also it can be called in the safe context before doing an expensive safe
 * operation. It does not make sense to do the operation when a higher
 * priority context took the lock.
 *
 * When this function returns false then the calling context no longer owns
 * the console and is no longer allowed to go forward. In this case it must
 * back out immediately and carefully. The buffer content is also no longer
 * trusted since it no longer belongs to the calling context.
 */
bool nbcon_can_proceed(struct nbcon_write_context *wctxt)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
        struct console *con = ctxt->console;
        struct nbcon_state cur;

        nbcon_state_read(con, &cur);

        return nbcon_context_can_proceed(ctxt, &cur);
}
EXPORT_SYMBOL_GPL(nbcon_can_proceed);

#define nbcon_context_enter_unsafe(c)        __nbcon_context_update_unsafe(c, true)
#define nbcon_context_exit_unsafe(c)        __nbcon_context_update_unsafe(c, false)

/**
 * __nbcon_context_update_unsafe - Update the unsafe bit in @con->nbcon_state
 * @ctxt:        The nbcon context from nbcon_context_try_acquire()
 * @unsafe:        The new value for the unsafe bit
 *
 * Return:        True if the unsafe state was updated and this context still
 *                owns the console. Otherwise false if ownership was handed
 *                over or taken.
 *
 * This function allows console owners to modify the unsafe status of the
 * console.
 *
 * When this function returns false then the calling context no longer owns
 * the console and is no longer allowed to go forward. In this case it must
 * back out immediately and carefully. The buffer content is also no longer
 * trusted since it no longer belongs to the calling context.
 *
 * Internal helper to avoid duplicated code.
 */
static bool __nbcon_context_update_unsafe(struct nbcon_context *ctxt, bool unsafe)
{
        struct console *con = ctxt->console;
        struct nbcon_state cur;
        struct nbcon_state new;

        nbcon_state_read(con, &cur);

        do {
                /*
                 * The unsafe bit must not be cleared if an
                 * unsafe hostile takeover has occurred.
                 */
                if (!unsafe && cur.unsafe_takeover)
                        goto out;

                if (!nbcon_context_can_proceed(ctxt, &cur))
                        return false;

                new.atom = cur.atom;
                new.unsafe = unsafe;
        } while (!nbcon_state_try_cmpxchg(con, &cur, &new));

        cur.atom = new.atom;
out:
        return nbcon_context_can_proceed(ctxt, &cur);
}

static void nbcon_write_context_set_buf(struct nbcon_write_context *wctxt,
                                        char *buf, unsigned int len)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
        struct console *con = ctxt->console;
        struct nbcon_state cur;

        wctxt->outbuf = buf;
        wctxt->len = len;
        nbcon_state_read(con, &cur);
        wctxt->unsafe_takeover = cur.unsafe_takeover;
}

/**
 * nbcon_enter_unsafe - Enter an unsafe region in the driver
 * @wctxt:        The write context that was handed to the write function
 *
 * Return:        True if this context still owns the console. False if
 *                ownership was handed over or taken.
 *
 * When this function returns false then the calling context no longer owns
 * the console and is no longer allowed to go forward. In this case it must
 * back out immediately and carefully. The buffer content is also no longer
 * trusted since it no longer belongs to the calling context.
 */
bool nbcon_enter_unsafe(struct nbcon_write_context *wctxt)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
        bool is_owner;

        is_owner = nbcon_context_enter_unsafe(ctxt);
        if (!is_owner)
                nbcon_write_context_set_buf(wctxt, NULL, 0);
        return is_owner;
}
EXPORT_SYMBOL_GPL(nbcon_enter_unsafe);

/**
 * nbcon_exit_unsafe - Exit an unsafe region in the driver
 * @wctxt:        The write context that was handed to the write function
 *
 * Return:        True if this context still owns the console. False if
 *                ownership was handed over or taken.
 *
 * When this function returns false then the calling context no longer owns
 * the console and is no longer allowed to go forward. In this case it must
 * back out immediately and carefully. The buffer content is also no longer
 * trusted since it no longer belongs to the calling context.
 */
bool nbcon_exit_unsafe(struct nbcon_write_context *wctxt)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
        bool ret;

        ret = nbcon_context_exit_unsafe(ctxt);
        if (!ret)
                nbcon_write_context_set_buf(wctxt, NULL, 0);
        return ret;
}
EXPORT_SYMBOL_GPL(nbcon_exit_unsafe);

/**
 * nbcon_reacquire_nobuf - Reacquire a console after losing ownership
 *                                while printing
 * @wctxt:        The write context that was handed to the write callback
 *
 * Since ownership can be lost at any time due to handover or takeover, a
 * printing context _must_ be prepared to back out immediately and
 * carefully. However, there are scenarios where the printing context must
 * reacquire ownership in order to finalize or revert hardware changes.
 *
 * This function allows a printing context to reacquire ownership using the
 * same priority as its previous ownership.
 *
 * Note that after a successful reacquire the printing context will have no
 * output buffer because that has been lost. This function cannot be used to
 * resume printing.
 */
void nbcon_reacquire_nobuf(struct nbcon_write_context *wctxt)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);

        while (!nbcon_context_try_acquire(ctxt))
                cpu_relax();

        nbcon_write_context_set_buf(wctxt, NULL, 0);
}
EXPORT_SYMBOL_GPL(nbcon_reacquire_nobuf);

/**
 * nbcon_emit_next_record - Emit a record in the acquired context
 * @wctxt:        The write context that will be handed to the write function
 * @use_atomic:        True if the write_atomic() callback is to be used
 *
 * Return:        True if this context still owns the console. False if
 *                ownership was handed over or taken.
 *
 * When this function returns false then the calling context no longer owns
 * the console and is no longer allowed to go forward. In this case it must
 * back out immediately and carefully. The buffer content is also no longer
 * trusted since it no longer belongs to the calling context. If the caller
 * wants to do more it must reacquire the console first.
 *
 * When true is returned, @wctxt->ctxt.backlog indicates whether there are
 * still records pending in the ringbuffer,
 */
static bool nbcon_emit_next_record(struct nbcon_write_context *wctxt, bool use_atomic)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
        struct console *con = ctxt->console;
        bool is_extended = console_srcu_read_flags(con) & CON_EXTENDED;
        struct printk_message pmsg = {
                .pbufs = ctxt->pbufs,
        };
        unsigned long con_dropped;
        struct nbcon_state cur;
        unsigned long dropped;
        unsigned long ulseq;

        /*
         * This function should never be called for consoles that have not
         * implemented the necessary callback for writing: i.e. legacy
         * consoles and, when atomic, nbcon consoles with no write_atomic().
         * Handle it as if ownership was lost and try to continue.
         *
         * Note that for nbcon consoles the write_thread() callback is
         * mandatory and was already checked in nbcon_alloc().
         */
        if (WARN_ON_ONCE((use_atomic && !con->write_atomic) ||
                         !(console_srcu_read_flags(con) & CON_NBCON))) {
                nbcon_context_release(ctxt);
                return false;
        }

        /*
         * The printk buffers are filled within an unsafe section. This
         * prevents NBCON_PRIO_NORMAL and NBCON_PRIO_EMERGENCY from
         * clobbering each other.
         */

        if (!nbcon_context_enter_unsafe(ctxt))
                return false;

        ctxt->backlog = printk_get_next_message(&pmsg, ctxt->seq, is_extended, true);
        if (!ctxt->backlog)
                return nbcon_context_exit_unsafe(ctxt);

        /*
         * @con->dropped is not protected in case of an unsafe hostile
         * takeover. In that situation the update can be racy so
         * annotate it accordingly.
         */
        con_dropped = data_race(READ_ONCE(con->dropped));

        dropped = con_dropped + pmsg.dropped;
        if (dropped && !is_extended)
                console_prepend_dropped(&pmsg, dropped);

        /*
         * If the previous owner was assigned the same record, this context
         * has taken over ownership and is replaying the record. Prepend a
         * message to let the user know the record is replayed.
         */
        ulseq = atomic_long_read(&ACCESS_PRIVATE(con, nbcon_prev_seq));
        if (__ulseq_to_u64seq(prb, ulseq) == pmsg.seq) {
                console_prepend_replay(&pmsg);
        } else {
                /*
                 * Ensure this context is still the owner before trying to
                 * update @nbcon_prev_seq. Otherwise the value in @ulseq may
                 * not be from the previous owner and instead be some later
                 * value from the context that took over ownership.
                 */
                nbcon_state_read(con, &cur);
                if (!nbcon_context_can_proceed(ctxt, &cur))
                        return false;

                atomic_long_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_prev_seq), &ulseq,
                                        __u64seq_to_ulseq(pmsg.seq));
        }

        if (!nbcon_context_exit_unsafe(ctxt))
                return false;

        /* For skipped records just update seq/dropped in @con. */
        if (pmsg.outbuf_len == 0)
                goto update_con;

        /* Initialize the write context for driver callbacks. */
        nbcon_write_context_set_buf(wctxt, &pmsg.pbufs->outbuf[0], pmsg.outbuf_len);

        if (use_atomic)
                con->write_atomic(con, wctxt);
        else
                con->write_thread(con, wctxt);

        if (!wctxt->outbuf) {
                /*
                 * Ownership was lost and reacquired by the driver. Handle it
                 * as if ownership was lost.
                 */
                nbcon_context_release(ctxt);
                return false;
        }

        /*
         * Ownership may have been lost but _not_ reacquired by the driver.
         * This case is detected and handled when entering unsafe to update
         * dropped/seq values.
         */

        /*
         * Since any dropped message was successfully output, reset the
         * dropped count for the console.
         */
        dropped = 0;
update_con:
        /*
         * The dropped count and the sequence number are updated within an
         * unsafe section. This limits update races to the panic context and
         * allows the panic context to win.
         */

        if (!nbcon_context_enter_unsafe(ctxt))
                return false;

        if (dropped != con_dropped) {
                /* Counterpart to the READ_ONCE() above. */
                WRITE_ONCE(con->dropped, dropped);
        }

        nbcon_seq_try_update(ctxt, pmsg.seq + 1);

        return nbcon_context_exit_unsafe(ctxt);
}

/*
 * nbcon_emit_one - Print one record for an nbcon console using the
 *                        specified callback
 * @wctxt:        An initialized write context struct to use for this context
 * @use_atomic:        True if the write_atomic() callback is to be used
 *
 * Return:        True, when a record has been printed and there are still
 *                pending records. The caller might want to continue flushing.
 *
 *                False, when there is no pending record, or when the console
 *                context cannot be acquired, or the ownership has been lost.
 *                The caller should give up. Either the job is done, cannot be
 *                done, or will be handled by the owning context.
 *
 * This is an internal helper to handle the locking of the console before
 * calling nbcon_emit_next_record().
 */
static bool nbcon_emit_one(struct nbcon_write_context *wctxt, bool use_atomic)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
        struct console *con = ctxt->console;
        unsigned long flags;
        bool ret = false;

        if (!use_atomic) {
                con->device_lock(con, &flags);

                /*
                 * Ensure this stays on the CPU to make handover and
                 * takeover possible.
                 */
                cant_migrate();
        }

        if (!nbcon_context_try_acquire(ctxt))
                goto out;

        /*
         * nbcon_emit_next_record() returns false when the console was
         * handed over or taken over. In both cases the context is no
         * longer valid.
         *
         * The higher priority printing context takes over responsibility
         * to print the pending records.
         */
        if (!nbcon_emit_next_record(wctxt, use_atomic))
                goto out;

        nbcon_context_release(ctxt);

        ret = ctxt->backlog;
out:
        if (!use_atomic)
                con->device_unlock(con, flags);
        return ret;
}

/**
 * nbcon_kthread_should_wakeup - Check whether a printer thread should wakeup
 * @con:        Console to operate on
 * @ctxt:        The nbcon context from nbcon_context_try_acquire()
 *
 * Return:        True if the thread should shutdown or if the console is
 *                allowed to print and a record is available. False otherwise.
 *
 * After the thread wakes up, it must first check if it should shutdown before
 * attempting any printing.
 */
static bool nbcon_kthread_should_wakeup(struct console *con, struct nbcon_context *ctxt)
{
        bool ret = false;
        short flags;
        int cookie;

        if (kthread_should_stop())
                return true;

        cookie = console_srcu_read_lock();

        flags = console_srcu_read_flags(con);
        if (console_is_usable(con, flags, false)) {
                /* Bring the sequence in @ctxt up to date */
                ctxt->seq = nbcon_seq_read(con);

                ret = prb_read_valid(prb, ctxt->seq, NULL);
        }

        console_srcu_read_unlock(cookie);
        return ret;
}

/**
 * nbcon_kthread_func - The printer thread function
 * @__console:        Console to operate on
 *
 * Return:        0
 */
static int nbcon_kthread_func(void *__console)
{
        struct console *con = __console;
        struct nbcon_write_context wctxt = {
                .ctxt.console        = con,
                .ctxt.prio        = NBCON_PRIO_NORMAL,
        };
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(&wctxt, ctxt);
        short con_flags;
        bool backlog;
        int cookie;

wait_for_event:
        /*
         * Guarantee this task is visible on the rcuwait before
         * checking the wake condition.
         *
         * The full memory barrier within set_current_state() of
         * ___rcuwait_wait_event() pairs with the full memory
         * barrier within rcuwait_has_sleeper().
         *
         * This pairs with rcuwait_has_sleeper:A and nbcon_kthread_wake:A.
         */
        rcuwait_wait_event(&con->rcuwait,
                           nbcon_kthread_should_wakeup(con, ctxt),
                           TASK_INTERRUPTIBLE); /* LMM(nbcon_kthread_func:A) */

        do {
                if (kthread_should_stop())
                        return 0;

                backlog = false;

                /*
                 * Keep the srcu read lock around the entire operation so that
                 * synchronize_srcu() can guarantee that the kthread stopped
                 * or suspended printing.
                 */
                cookie = console_srcu_read_lock();

                con_flags = console_srcu_read_flags(con);

                if (console_is_usable(con, con_flags, false))
                        backlog = nbcon_emit_one(&wctxt, false);

                console_srcu_read_unlock(cookie);

                cond_resched();

        } while (backlog);

        goto wait_for_event;
}

/**
 * nbcon_irq_work - irq work to wake console printer thread
 * @irq_work:        The irq work to operate on
 */
static void nbcon_irq_work(struct irq_work *irq_work)
{
        struct console *con = container_of(irq_work, struct console, irq_work);

        nbcon_kthread_wake(con);
}

static inline bool rcuwait_has_sleeper(struct rcuwait *w)
{
        /*
         * Guarantee any new records can be seen by tasks preparing to wait
         * before this context checks if the rcuwait is empty.
         *
         * This full memory barrier pairs with the full memory barrier within
         * set_current_state() of ___rcuwait_wait_event(), which is called
         * after prepare_to_rcuwait() adds the waiter but before it has
         * checked the wait condition.
         *
         * This pairs with nbcon_kthread_func:A.
         */
        smp_mb(); /* LMM(rcuwait_has_sleeper:A) */
        return rcuwait_active(w);
}

/**
 * nbcon_kthreads_wake - Wake up printing threads using irq_work
 */
void nbcon_kthreads_wake(void)
{
        struct console *con;
        int cookie;

        if (!printk_kthreads_running)
                return;

        cookie = console_srcu_read_lock();
        for_each_console_srcu(con) {
                if (!(console_srcu_read_flags(con) & CON_NBCON))
                        continue;

                /*
                 * Only schedule irq_work if the printing thread is
                 * actively waiting. If not waiting, the thread will
                 * notice by itself that it has work to do.
                 */
                if (rcuwait_has_sleeper(&con->rcuwait))
                        irq_work_queue(&con->irq_work);
        }
        console_srcu_read_unlock(cookie);
}

/*
 * nbcon_kthread_stop - Stop a console printer thread
 * @con:        Console to operate on
 */
void nbcon_kthread_stop(struct console *con)
{
        lockdep_assert_console_list_lock_held();

        if (!con->kthread)
                return;

        kthread_stop(con->kthread);
        con->kthread = NULL;
}

/**
 * nbcon_kthread_create - Create a console printer thread
 * @con:        Console to operate on
 *
 * Return:        True if the kthread was started or already exists.
 *                Otherwise false and @con must not be registered.
 *
 * This function is called when it will be expected that nbcon consoles are
 * flushed using the kthread. The messages printed with NBCON_PRIO_NORMAL
 * will be no longer flushed by the legacy loop. This is why failure must
 * be fatal for console registration.
 *
 * If @con was already registered and this function fails, @con must be
 * unregistered before the global state variable @printk_kthreads_running
 * can be set.
 */
bool nbcon_kthread_create(struct console *con)
{
        struct task_struct *kt;

        lockdep_assert_console_list_lock_held();

        if (con->kthread)
                return true;

        kt = kthread_run(nbcon_kthread_func, con, "pr/%s%d", con->name, con->index);
        if (WARN_ON(IS_ERR(kt))) {
                con_printk(KERN_ERR, con, "failed to start printing thread\n");
                return false;
        }

        con->kthread = kt;

        /*
         * It is important that console printing threads are scheduled
         * shortly after a printk call and with generous runtime budgets.
         */
        sched_set_normal(con->kthread, -20);

        return true;
}

/* Track the nbcon emergency nesting per CPU. */
static DEFINE_PER_CPU(unsigned int, nbcon_pcpu_emergency_nesting);
static unsigned int early_nbcon_pcpu_emergency_nesting __initdata;

/**
 * nbcon_get_cpu_emergency_nesting - Get the per CPU emergency nesting pointer
 *
 * Context:        For reading, any context. For writing, any context which could
 *                not be migrated to another CPU.
 * Return:        Either a pointer to the per CPU emergency nesting counter of
 *                the current CPU or to the init data during early boot.
 *
 * The function is safe for reading per-CPU variables in any context because
 * preemption is disabled if the current CPU is in the emergency state. See
 * also nbcon_cpu_emergency_enter().
 */
static __ref unsigned int *nbcon_get_cpu_emergency_nesting(void)
{
        /*
         * The value of __printk_percpu_data_ready gets set in normal
         * context and before SMP initialization. As a result it could
         * never change while inside an nbcon emergency section.
         */
        if (!printk_percpu_data_ready())
                return &early_nbcon_pcpu_emergency_nesting;

        return raw_cpu_ptr(&nbcon_pcpu_emergency_nesting);
}

/**
 * nbcon_get_default_prio - The appropriate nbcon priority to use for nbcon
 *                                printing on the current CPU
 *
 * Context:        Any context.
 * Return:        The nbcon_prio to use for acquiring an nbcon console in this
 *                context for printing.
 *
 * The function is safe for reading per-CPU data in any context because
 * preemption is disabled if the current CPU is in the emergency or panic
 * state.
 */
enum nbcon_prio nbcon_get_default_prio(void)
{
        unsigned int *cpu_emergency_nesting;

        if (this_cpu_in_panic())
                return NBCON_PRIO_PANIC;

        cpu_emergency_nesting = nbcon_get_cpu_emergency_nesting();
        if (*cpu_emergency_nesting)
                return NBCON_PRIO_EMERGENCY;

        return NBCON_PRIO_NORMAL;
}

/**
 * nbcon_legacy_emit_next_record - Print one record for an nbcon console
 *                                        in legacy contexts
 * @con:        The console to print on
 * @handover:        Will be set to true if a printk waiter has taken over the
 *                console_lock, in which case the caller is no longer holding
 *                both the console_lock and the SRCU read lock. Otherwise it
 *                is set to false.
 * @cookie:        The cookie from the SRCU read lock.
 * @use_atomic: Set true when called in an atomic or unknown context.
 *                It affects which nbcon callback will be used: write_atomic()
 *                or write_thread().
 *
 *                When false, the write_thread() callback is used and would be
 *                called in a preemtible context unless disabled by the
 *                device_lock. The legacy handover is not allowed in this mode.
 *
 * Context:        Any context except NMI.
 * Return:        True, when a record has been printed and there are still
 *                pending records. The caller might want to continue flushing.
 *
 *                False, when there is no pending record, or when the console
 *                context cannot be acquired, or the ownership has been lost.
 *                The caller should give up. Either the job is done, cannot be
 *                done, or will be handled by the owning context.
 *
 * This function is meant to be called by console_flush_all() to print records
 * on nbcon consoles from legacy context (printing via console unlocking).
 * Essentially it is the nbcon version of console_emit_next_record().
 */
bool nbcon_legacy_emit_next_record(struct console *con, bool *handover,
                                   int cookie, bool use_atomic)
{
        struct nbcon_write_context wctxt = { };
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(&wctxt, ctxt);
        unsigned long flags;
        bool progress;

        ctxt->console        = con;
        ctxt->prio        = nbcon_get_default_prio();

        if (use_atomic) {
                /*
                 * In an atomic or unknown context, use the same procedure as
                 * in console_emit_next_record(). It allows to handover.
                 */
                printk_safe_enter_irqsave(flags);
                console_lock_spinning_enable();
                stop_critical_timings();
        }

        progress = nbcon_emit_one(&wctxt, use_atomic);

        if (use_atomic) {
                start_critical_timings();
                *handover = console_lock_spinning_disable_and_check(cookie);
                printk_safe_exit_irqrestore(flags);
        } else {
                /* Non-atomic does not perform legacy spinning handovers. */
                *handover = false;
        }

        return progress;
}

/**
 * __nbcon_atomic_flush_pending_con - Flush specified nbcon console using its
 *                                        write_atomic() callback
 * @con:                        The nbcon console to flush
 * @stop_seq:                        Flush up until this record
 * @allow_unsafe_takeover:        True, to allow unsafe hostile takeovers
 *
 * Return:        0 if @con was flushed up to @stop_seq Otherwise, error code on
 *                failure.
 *
 * Errors:
 *
 *        -EPERM:                Unable to acquire console ownership.
 *
 *        -EAGAIN:        Another context took over ownership while printing.
 *
 *        -ENOENT:        A record before @stop_seq is not available.
 *
 * If flushing up to @stop_seq was not successful, it only makes sense for the
 * caller to try again when -EAGAIN was returned. When -EPERM is returned,
 * this context is not allowed to acquire the console. When -ENOENT is
 * returned, it cannot be expected that the unfinalized record will become
 * available.
 */
static int __nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq,
                                            bool allow_unsafe_takeover)
{
        struct nbcon_write_context wctxt = { };
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(&wctxt, ctxt);
        int err = 0;

        ctxt->console                        = con;
        ctxt->spinwait_max_us                = 2000;
        ctxt->prio                        = nbcon_get_default_prio();
        ctxt->allow_unsafe_takeover        = allow_unsafe_takeover;

        if (!nbcon_context_try_acquire(ctxt))
                return -EPERM;

        while (nbcon_seq_read(con) < stop_seq) {
                /*
                 * nbcon_emit_next_record() returns false when the console was
                 * handed over or taken over. In both cases the context is no
                 * longer valid.
                 */
                if (!nbcon_emit_next_record(&wctxt, true))
                        return -EAGAIN;

                if (!ctxt->backlog) {
                        /* Are there reserved but not yet finalized records? */
                        if (nbcon_seq_read(con) < stop_seq)
                                err = -ENOENT;
                        break;
                }
        }

        nbcon_context_release(ctxt);
        return err;
}

/**
 * nbcon_atomic_flush_pending_con - Flush specified nbcon console using its
 *                                        write_atomic() callback
 * @con:                        The nbcon console to flush
 * @stop_seq:                        Flush up until this record
 * @allow_unsafe_takeover:        True, to allow unsafe hostile takeovers
 *
 * This will stop flushing before @stop_seq if another context has ownership.
 * That context is then responsible for the flushing. Likewise, if new records
 * are added while this context was flushing and there is no other context
 * to handle the printing, this context must also flush those records.
 */
static void nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq,
                                           bool allow_unsafe_takeover)
{
        struct console_flush_type ft;
        unsigned long flags;
        int err;

again:
        /*
         * Atomic flushing does not use console driver synchronization (i.e.
         * it does not hold the port lock for uart consoles). Therefore IRQs
         * must be disabled to avoid being interrupted and then calling into
         * a driver that will deadlock trying to acquire console ownership.
         */
        local_irq_save(flags);

        err = __nbcon_atomic_flush_pending_con(con, stop_seq, allow_unsafe_takeover);

        local_irq_restore(flags);

        /*
         * If there was a new owner (-EPERM, -EAGAIN), that context is
         * responsible for completing.
         *
         * Do not wait for records not yet finalized (-ENOENT) to avoid a
         * possible deadlock. They will either get flushed by the writer or
         * eventually skipped on panic CPU.
         */
        if (err)
                return;

        /*
         * If flushing was successful but more records are available, this
         * context must flush those remaining records if the printer thread
         * is not available do it.
         */
        printk_get_console_flush_type(&ft);
        if (!ft.nbcon_offload &&
            prb_read_valid(prb, nbcon_seq_read(con), NULL)) {
                stop_seq = prb_next_reserve_seq(prb);
                goto again;
        }
}

/**
 * __nbcon_atomic_flush_pending - Flush all nbcon consoles using their
 *                                        write_atomic() callback
 * @stop_seq:                        Flush up until this record
 * @allow_unsafe_takeover:        True, to allow unsafe hostile takeovers
 */
static void __nbcon_atomic_flush_pending(u64 stop_seq, bool allow_unsafe_takeover)
{
        struct console *con;
        int cookie;

        cookie = console_srcu_read_lock();
        for_each_console_srcu(con) {
                short flags = console_srcu_read_flags(con);

                if (!(flags & CON_NBCON))
                        continue;

                if (!console_is_usable(con, flags, true))
                        continue;

                if (nbcon_seq_read(con) >= stop_seq)
                        continue;

                nbcon_atomic_flush_pending_con(con, stop_seq, allow_unsafe_takeover);
        }
        console_srcu_read_unlock(cookie);
}

/**
 * nbcon_atomic_flush_pending - Flush all nbcon consoles using their
 *                                write_atomic() callback
 *
 * Flush the backlog up through the currently newest record. Any new
 * records added while flushing will not be flushed if there is another
 * context available to handle the flushing. This is to avoid one CPU
 * printing unbounded because other CPUs continue to add records.
 */
void nbcon_atomic_flush_pending(void)
{
        __nbcon_atomic_flush_pending(prb_next_reserve_seq(prb), false);
}

/**
 * nbcon_atomic_flush_unsafe - Flush all nbcon consoles using their
 *        write_atomic() callback and allowing unsafe hostile takeovers
 *
 * Flush the backlog up through the currently newest record. Unsafe hostile
 * takeovers will be performed, if necessary.
 */
void nbcon_atomic_flush_unsafe(void)
{
        __nbcon_atomic_flush_pending(prb_next_reserve_seq(prb), true);
}

/**
 * nbcon_cpu_emergency_enter - Enter an emergency section where printk()
 *                                messages for that CPU are flushed directly
 *
 * Context:        Any context. Disables preemption.
 *
 * When within an emergency section, printk() calls will attempt to flush any
 * pending messages in the ringbuffer.
 */
void nbcon_cpu_emergency_enter(void)
{
        unsigned int *cpu_emergency_nesting;

        preempt_disable();

        cpu_emergency_nesting = nbcon_get_cpu_emergency_nesting();
        (*cpu_emergency_nesting)++;
}

/**
 * nbcon_cpu_emergency_exit - Exit an emergency section
 *
 * Context:        Within an emergency section. Enables preemption.
 */
void nbcon_cpu_emergency_exit(void)
{
        unsigned int *cpu_emergency_nesting;

        cpu_emergency_nesting = nbcon_get_cpu_emergency_nesting();

        if (!WARN_ON_ONCE(*cpu_emergency_nesting == 0))
                (*cpu_emergency_nesting)--;

        preempt_enable();
}

/**
 * nbcon_alloc - Allocate and init the nbcon console specific data
 * @con:        Console to initialize
 *
 * Return:        True if the console was fully allocated and initialized.
 *                Otherwise @con must not be registered.
 *
 * When allocation and init was successful, the console must be properly
 * freed using nbcon_free() once it is no longer needed.
 */
bool nbcon_alloc(struct console *con)
{
        struct nbcon_state state = { };

        /* The write_thread() callback is mandatory. */
        if (WARN_ON(!con->write_thread))
                return false;

        rcuwait_init(&con->rcuwait);
        init_irq_work(&con->irq_work, nbcon_irq_work);
        atomic_long_set(&ACCESS_PRIVATE(con, nbcon_prev_seq), -1UL);
        nbcon_state_set(con, &state);

        /*
         * Initialize @nbcon_seq to the highest possible sequence number so
         * that practically speaking it will have nothing to print until a
         * desired initial sequence number has been set via nbcon_seq_force().
         */
        atomic_long_set(&ACCESS_PRIVATE(con, nbcon_seq), ULSEQ_MAX(prb));

        if (con->flags & CON_BOOT) {
                /*
                 * Boot console printing is synchronized with legacy console
                 * printing, so boot consoles can share the same global printk
                 * buffers.
                 */
                con->pbufs = &printk_shared_pbufs;
        } else {
                con->pbufs = kmalloc(sizeof(*con->pbufs), GFP_KERNEL);
                if (!con->pbufs) {
                        con_printk(KERN_ERR, con, "failed to allocate printing buffer\n");
                        return false;
                }

                if (printk_kthreads_running) {
                        if (!nbcon_kthread_create(con)) {
                                kfree(con->pbufs);
                                con->pbufs = NULL;
                                return false;
                        }
                }
        }

        return true;
}

/**
 * nbcon_free - Free and cleanup the nbcon console specific data
 * @con:        Console to free/cleanup nbcon data
 */
void nbcon_free(struct console *con)
{
        struct nbcon_state state = { };

        if (printk_kthreads_running)
                nbcon_kthread_stop(con);

        nbcon_state_set(con, &state);

        /* Boot consoles share global printk buffers. */
        if (!(con->flags & CON_BOOT))
                kfree(con->pbufs);

        con->pbufs = NULL;
}

/**
 * nbcon_device_try_acquire - Try to acquire nbcon console and enter unsafe
 *                                section
 * @con:        The nbcon console to acquire
 *
 * Context:        Under the locking mechanism implemented in
 *                @con->device_lock() including disabling migration.
 * Return:        True if the console was acquired. False otherwise.
 *
 * Console drivers will usually use their own internal synchronization
 * mechasism to synchronize between console printing and non-printing
 * activities (such as setting baud rates). However, nbcon console drivers
 * supporting atomic consoles may also want to mark unsafe sections when
 * performing non-printing activities in order to synchronize against their
 * atomic_write() callback.
 *
 * This function acquires the nbcon console using priority NBCON_PRIO_NORMAL
 * and marks it unsafe for handover/takeover.
 */
bool nbcon_device_try_acquire(struct console *con)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(con, nbcon_device_ctxt);

        cant_migrate();

        memset(ctxt, 0, sizeof(*ctxt));
        ctxt->console        = con;
        ctxt->prio        = NBCON_PRIO_NORMAL;

        if (!nbcon_context_try_acquire(ctxt))
                return false;

        if (!nbcon_context_enter_unsafe(ctxt))
                return false;

        return true;
}
EXPORT_SYMBOL_GPL(nbcon_device_try_acquire);

/**
 * nbcon_device_release - Exit unsafe section and release the nbcon console
 * @con:        The nbcon console acquired in nbcon_device_try_acquire()
 */
void nbcon_device_release(struct console *con)
{
        struct nbcon_context *ctxt = &ACCESS_PRIVATE(con, nbcon_device_ctxt);
        struct console_flush_type ft;
        int cookie;

        if (!nbcon_context_exit_unsafe(ctxt))
                return;

        nbcon_context_release(ctxt);

        /*
         * This context must flush any new records added while the console
         * was locked if the printer thread is not available to do it. The
         * console_srcu_read_lock must be taken to ensure the console is
         * usable throughout flushing.
         */
        cookie = console_srcu_read_lock();
        printk_get_console_flush_type(&ft);
        if (console_is_usable(con, console_srcu_read_flags(con), true) &&
            !ft.nbcon_offload &&
            prb_read_valid(prb, nbcon_seq_read(con), NULL)) {
                /*
                 * If nbcon_atomic flushing is not available, fallback to
                 * using the legacy loop.
                 */
                if (ft.nbcon_atomic) {
                        __nbcon_atomic_flush_pending_con(con, prb_next_reserve_seq(prb), false);
                } else if (ft.legacy_direct) {
                        if (console_trylock())
                                console_unlock();
                } else if (ft.legacy_offload) {
                        printk_trigger_flush();
                }
        }
        console_srcu_read_unlock(cookie);
}
EXPORT_SYMBOL_GPL(nbcon_device_release);







































    4 



    4 








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _TRACE_SYSCALL_H
#define _TRACE_SYSCALL_H

#include <linux/tracepoint.h>
#include <linux/unistd.h>
#include <linux/trace_events.h>
#include <linux/thread_info.h>

#include <asm/ptrace.h>


/*
 * A syscall entry in the ftrace syscalls array.
 *
 * @name: name of the syscall
 * @syscall_nr: number of the syscall
 * @nb_args: number of parameters it takes
 * @types: list of types as strings
 * @args: list of args as strings (args[i] matches types[i])
 * @enter_fields: list of fields for syscall_enter trace event
 * @enter_event: associated syscall_enter trace event
 * @exit_event: associated syscall_exit trace event
 */
struct syscall_metadata {
        const char        *name;
        int                syscall_nr;
        int                nb_args;
        const char        **types;
        const char        **args;
        struct list_head enter_fields;

        struct trace_event_call *enter_event;
        struct trace_event_call *exit_event;
};

#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS)
static inline void syscall_tracepoint_update(struct task_struct *p)
{
        if (test_syscall_work(SYSCALL_TRACEPOINT))
                set_task_syscall_work(p, SYSCALL_TRACEPOINT);
        else
                clear_task_syscall_work(p, SYSCALL_TRACEPOINT);
}
#else
static inline void syscall_tracepoint_update(struct task_struct *p)
{
}
#endif

#endif /* _TRACE_SYSCALL_H */











































































































































































































































































































































































































































































































   10 






















































































































































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
// SPDX-License-Identifier: GPL-2.0-only
/*
 * linux/net/sunrpc/auth.c
 *
 * Generic RPC client authentication API.
 *
 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
 */

#include <linux/types.h>
#include <linux/sched.h>
#include <linux/cred.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/hash.h>
#include <linux/sunrpc/clnt.h>
#include <linux/sunrpc/gss_api.h>
#include <linux/spinlock.h>

#include <trace/events/sunrpc.h>

#define RPC_CREDCACHE_DEFAULT_HASHBITS        (4)
struct rpc_cred_cache {
        struct hlist_head        *hashtable;
        unsigned int                hashbits;
        spinlock_t                lock;
};

static unsigned int auth_hashbits = RPC_CREDCACHE_DEFAULT_HASHBITS;

static const struct rpc_authops __rcu *auth_flavors[RPC_AUTH_MAXFLAVOR] = {
        [RPC_AUTH_NULL] = (const struct rpc_authops __force __rcu *)&authnull_ops,
        [RPC_AUTH_UNIX] = (const struct rpc_authops __force __rcu *)&authunix_ops,
        [RPC_AUTH_TLS]  = (const struct rpc_authops __force __rcu *)&authtls_ops,
};

static LIST_HEAD(cred_unused);
static unsigned long number_cred_unused;

static struct cred machine_cred = {
        .usage = ATOMIC_INIT(1),
};

/*
 * Return the machine_cred pointer to be used whenever
 * the a generic machine credential is needed.
 */
const struct cred *rpc_machine_cred(void)
{
        return &machine_cred;
}
EXPORT_SYMBOL_GPL(rpc_machine_cred);

#define MAX_HASHTABLE_BITS (14)
static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp)
{
        unsigned long num;
        unsigned int nbits;
        int ret;

        if (!val)
                goto out_inval;
        ret = kstrtoul(val, 0, &num);
        if (ret)
                goto out_inval;
        nbits = fls(num - 1);
        if (nbits > MAX_HASHTABLE_BITS || nbits < 2)
                goto out_inval;
        *(unsigned int *)kp->arg = nbits;
        return 0;
out_inval:
        return -EINVAL;
}

static int param_get_hashtbl_sz(char *buffer, const struct kernel_param *kp)
{
        unsigned int nbits;

        nbits = *(unsigned int *)kp->arg;
        return sprintf(buffer, "%u\n", 1U << nbits);
}

#define param_check_hashtbl_sz(name, p) __param_check(name, p, unsigned int);

static const struct kernel_param_ops param_ops_hashtbl_sz = {
        .set = param_set_hashtbl_sz,
        .get = param_get_hashtbl_sz,
};

module_param_named(auth_hashtable_size, auth_hashbits, hashtbl_sz, 0644);
MODULE_PARM_DESC(auth_hashtable_size, "RPC credential cache hashtable size");

static unsigned long auth_max_cred_cachesize = ULONG_MAX;
module_param(auth_max_cred_cachesize, ulong, 0644);
MODULE_PARM_DESC(auth_max_cred_cachesize, "RPC credential maximum total cache size");

static u32
pseudoflavor_to_flavor(u32 flavor) {
        if (flavor > RPC_AUTH_MAXFLAVOR)
                return RPC_AUTH_GSS;
        return flavor;
}

int
rpcauth_register(const struct rpc_authops *ops)
{
        const struct rpc_authops *old;
        rpc_authflavor_t flavor;

        if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
                return -EINVAL;
        old = cmpxchg((const struct rpc_authops ** __force)&auth_flavors[flavor], NULL, ops);
        if (old == NULL || old == ops)
                return 0;
        return -EPERM;
}
EXPORT_SYMBOL_GPL(rpcauth_register);

int
rpcauth_unregister(const struct rpc_authops *ops)
{
        const struct rpc_authops *old;
        rpc_authflavor_t flavor;

        if ((flavor = ops->au_flavor) >= RPC_AUTH_MAXFLAVOR)
                return -EINVAL;

        old = cmpxchg((const struct rpc_authops ** __force)&auth_flavors[flavor], ops, NULL);
        if (old == ops || old == NULL)
                return 0;
        return -EPERM;
}
EXPORT_SYMBOL_GPL(rpcauth_unregister);

static const struct rpc_authops *
rpcauth_get_authops(rpc_authflavor_t flavor)
{
        const struct rpc_authops *ops;

        if (flavor >= RPC_AUTH_MAXFLAVOR)
                return NULL;

        rcu_read_lock();
        ops = rcu_dereference(auth_flavors[flavor]);
        if (ops == NULL) {
                rcu_read_unlock();
                request_module("rpc-auth-%u", flavor);
                rcu_read_lock();
                ops = rcu_dereference(auth_flavors[flavor]);
                if (ops == NULL)
                        goto out;
        }
        if (!try_module_get(ops->owner))
                ops = NULL;
out:
        rcu_read_unlock();
        return ops;
}

static void
rpcauth_put_authops(const struct rpc_authops *ops)
{
        module_put(ops->owner);
}

/**
 * rpcauth_get_pseudoflavor - check if security flavor is supported
 * @flavor: a security flavor
 * @info: a GSS mech OID, quality of protection, and service value
 *
 * Verifies that an appropriate kernel module is available or already loaded.
 * Returns an equivalent pseudoflavor, or RPC_AUTH_MAXFLAVOR if "flavor" is
 * not supported locally.
 */
rpc_authflavor_t
rpcauth_get_pseudoflavor(rpc_authflavor_t flavor, struct rpcsec_gss_info *info)
{
        const struct rpc_authops *ops = rpcauth_get_authops(flavor);
        rpc_authflavor_t pseudoflavor;

        if (!ops)
                return RPC_AUTH_MAXFLAVOR;
        pseudoflavor = flavor;
        if (ops->info2flavor != NULL)
                pseudoflavor = ops->info2flavor(info);

        rpcauth_put_authops(ops);
        return pseudoflavor;
}
EXPORT_SYMBOL_GPL(rpcauth_get_pseudoflavor);

/**
 * rpcauth_get_gssinfo - find GSS tuple matching a GSS pseudoflavor
 * @pseudoflavor: GSS pseudoflavor to match
 * @info: rpcsec_gss_info structure to fill in
 *
 * Returns zero and fills in "info" if pseudoflavor matches a
 * supported mechanism.
 */
int
rpcauth_get_gssinfo(rpc_authflavor_t pseudoflavor, struct rpcsec_gss_info *info)
{
        rpc_authflavor_t flavor = pseudoflavor_to_flavor(pseudoflavor);
        const struct rpc_authops *ops;
        int result;

        ops = rpcauth_get_authops(flavor);
        if (ops == NULL)
                return -ENOENT;

        result = -ENOENT;
        if (ops->flavor2info != NULL)
                result = ops->flavor2info(pseudoflavor, info);

        rpcauth_put_authops(ops);
        return result;
}
EXPORT_SYMBOL_GPL(rpcauth_get_gssinfo);

struct rpc_auth *
rpcauth_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
{
        struct rpc_auth        *auth = ERR_PTR(-EINVAL);
        const struct rpc_authops *ops;
        u32 flavor = pseudoflavor_to_flavor(args->pseudoflavor);

        ops = rpcauth_get_authops(flavor);
        if (ops == NULL)
                goto out;

        auth = ops->create(args, clnt);

        rpcauth_put_authops(ops);
        if (IS_ERR(auth))
                return auth;
        if (clnt->cl_auth)
                rpcauth_release(clnt->cl_auth);
        clnt->cl_auth = auth;

out:
        return auth;
}
EXPORT_SYMBOL_GPL(rpcauth_create);

void
rpcauth_release(struct rpc_auth *auth)
{
        if (!refcount_dec_and_test(&auth->au_count))
                return;
        auth->au_ops->destroy(auth);
}

static DEFINE_SPINLOCK(rpc_credcache_lock);

/*
 * On success, the caller is responsible for freeing the reference
 * held by the hashtable
 */
static bool
rpcauth_unhash_cred_locked(struct rpc_cred *cred)
{
        if (!test_and_clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags))
                return false;
        hlist_del_rcu(&cred->cr_hash);
        return true;
}

static bool
rpcauth_unhash_cred(struct rpc_cred *cred)
{
        spinlock_t *cache_lock;
        bool ret;

        if (!test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags))
                return false;
        cache_lock = &cred->cr_auth->au_credcache->lock;
        spin_lock(cache_lock);
        ret = rpcauth_unhash_cred_locked(cred);
        spin_unlock(cache_lock);
        return ret;
}

/*
 * Initialize RPC credential cache
 */
int
rpcauth_init_credcache(struct rpc_auth *auth)
{
        struct rpc_cred_cache *new;
        unsigned int hashsize;

        new = kmalloc(sizeof(*new), GFP_KERNEL);
        if (!new)
                goto out_nocache;
        new->hashbits = auth_hashbits;
        hashsize = 1U << new->hashbits;
        new->hashtable = kcalloc(hashsize, sizeof(new->hashtable[0]), GFP_KERNEL);
        if (!new->hashtable)
                goto out_nohashtbl;
        spin_lock_init(&new->lock);
        auth->au_credcache = new;
        return 0;
out_nohashtbl:
        kfree(new);
out_nocache:
        return -ENOMEM;
}
EXPORT_SYMBOL_GPL(rpcauth_init_credcache);

char *
rpcauth_stringify_acceptor(struct rpc_cred *cred)
{
        if (!cred->cr_ops->crstringify_acceptor)
                return NULL;
        return cred->cr_ops->crstringify_acceptor(cred);
}
EXPORT_SYMBOL_GPL(rpcauth_stringify_acceptor);

/*
 * Destroy a list of credentials
 */
static inline
void rpcauth_destroy_credlist(struct list_head *head)
{
        struct rpc_cred *cred;

        while (!list_empty(head)) {
                cred = list_entry(head->next, struct rpc_cred, cr_lru);
                list_del_init(&cred->cr_lru);
                put_rpccred(cred);
        }
}

static void
rpcauth_lru_add_locked(struct rpc_cred *cred)
{
        if (!list_empty(&cred->cr_lru))
                return;
        number_cred_unused++;
        list_add_tail(&cred->cr_lru, &cred_unused);
}

static void
rpcauth_lru_add(struct rpc_cred *cred)
{
        if (!list_empty(&cred->cr_lru))
                return;
        spin_lock(&rpc_credcache_lock);
        rpcauth_lru_add_locked(cred);
        spin_unlock(&rpc_credcache_lock);
}

static void
rpcauth_lru_remove_locked(struct rpc_cred *cred)
{
        if (list_empty(&cred->cr_lru))
                return;
        number_cred_unused--;
        list_del_init(&cred->cr_lru);
}

static void
rpcauth_lru_remove(struct rpc_cred *cred)
{
        if (list_empty(&cred->cr_lru))
                return;
        spin_lock(&rpc_credcache_lock);
        rpcauth_lru_remove_locked(cred);
        spin_unlock(&rpc_credcache_lock);
}

/*
 * Clear the RPC credential cache, and delete those credentials
 * that are not referenced.
 */
void
rpcauth_clear_credcache(struct rpc_cred_cache *cache)
{
        LIST_HEAD(free);
        struct hlist_head *head;
        struct rpc_cred        *cred;
        unsigned int hashsize = 1U << cache->hashbits;
        int                i;

        spin_lock(&rpc_credcache_lock);
        spin_lock(&cache->lock);
        for (i = 0; i < hashsize; i++) {
                head = &cache->hashtable[i];
                while (!hlist_empty(head)) {
                        cred = hlist_entry(head->first, struct rpc_cred, cr_hash);
                        rpcauth_unhash_cred_locked(cred);
                        /* Note: We now hold a reference to cred */
                        rpcauth_lru_remove_locked(cred);
                        list_add_tail(&cred->cr_lru, &free);
                }
        }
        spin_unlock(&cache->lock);
        spin_unlock(&rpc_credcache_lock);
        rpcauth_destroy_credlist(&free);
}

/*
 * Destroy the RPC credential cache
 */
void
rpcauth_destroy_credcache(struct rpc_auth *auth)
{
        struct rpc_cred_cache *cache = auth->au_credcache;

        if (cache) {
                auth->au_credcache = NULL;
                rpcauth_clear_credcache(cache);
                kfree(cache->hashtable);
                kfree(cache);
        }
}
EXPORT_SYMBOL_GPL(rpcauth_destroy_credcache);


#define RPC_AUTH_EXPIRY_MORATORIUM (60 * HZ)

/*
 * Remove stale credentials. Avoid sleeping inside the loop.
 */
static long
rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
{
        struct rpc_cred *cred, *next;
        unsigned long expired = jiffies - RPC_AUTH_EXPIRY_MORATORIUM;
        long freed = 0;

        list_for_each_entry_safe(cred, next, &cred_unused, cr_lru) {

                if (nr_to_scan-- == 0)
                        break;
                if (refcount_read(&cred->cr_count) > 1) {
                        rpcauth_lru_remove_locked(cred);
                        continue;
                }
                /*
                 * Enforce a 60 second garbage collection moratorium
                 * Note that the cred_unused list must be time-ordered.
                 */
                if (time_in_range(cred->cr_expire, expired, jiffies))
                        continue;
                if (!rpcauth_unhash_cred(cred))
                        continue;

                rpcauth_lru_remove_locked(cred);
                freed++;
                list_add_tail(&cred->cr_lru, free);
        }
        return freed ? freed : SHRINK_STOP;
}

static unsigned long
rpcauth_cache_do_shrink(int nr_to_scan)
{
        LIST_HEAD(free);
        unsigned long freed;

        spin_lock(&rpc_credcache_lock);
        freed = rpcauth_prune_expired(&free, nr_to_scan);
        spin_unlock(&rpc_credcache_lock);
        rpcauth_destroy_credlist(&free);

        return freed;
}

/*
 * Run memory cache shrinker.
 */
static unsigned long
rpcauth_cache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)

{
        if ((sc->gfp_mask & GFP_KERNEL) != GFP_KERNEL)
                return SHRINK_STOP;

        /* nothing left, don't come back */
        if (list_empty(&cred_unused))
                return SHRINK_STOP;

        return rpcauth_cache_do_shrink(sc->nr_to_scan);
}

static unsigned long
rpcauth_cache_shrink_count(struct shrinker *shrink, struct shrink_control *sc)

{
        return number_cred_unused * sysctl_vfs_cache_pressure / 100;
}

static void
rpcauth_cache_enforce_limit(void)
{
        unsigned long diff;
        unsigned int nr_to_scan;

        if (number_cred_unused <= auth_max_cred_cachesize)
                return;
        diff = number_cred_unused - auth_max_cred_cachesize;
        nr_to_scan = 100;
        if (diff < nr_to_scan)
                nr_to_scan = diff;
        rpcauth_cache_do_shrink(nr_to_scan);
}

/*
 * Look up a process' credentials in the authentication cache
 */
struct rpc_cred *
rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
                int flags, gfp_t gfp)
{
        LIST_HEAD(free);
        struct rpc_cred_cache *cache = auth->au_credcache;
        struct rpc_cred        *cred = NULL,
                        *entry, *new;
        unsigned int nr;

        nr = auth->au_ops->hash_cred(acred, cache->hashbits);

        rcu_read_lock();
        hlist_for_each_entry_rcu(entry, &cache->hashtable[nr], cr_hash) {
                if (!entry->cr_ops->crmatch(acred, entry, flags))
                        continue;
                cred = get_rpccred(entry);
                if (cred)
                        break;
        }
        rcu_read_unlock();

        if (cred != NULL)
                goto found;

        new = auth->au_ops->crcreate(auth, acred, flags, gfp);
        if (IS_ERR(new)) {
                cred = new;
                goto out;
        }

        spin_lock(&cache->lock);
        hlist_for_each_entry(entry, &cache->hashtable[nr], cr_hash) {
                if (!entry->cr_ops->crmatch(acred, entry, flags))
                        continue;
                cred = get_rpccred(entry);
                if (cred)
                        break;
        }
        if (cred == NULL) {
                cred = new;
                set_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags);
                refcount_inc(&cred->cr_count);
                hlist_add_head_rcu(&cred->cr_hash, &cache->hashtable[nr]);
        } else
                list_add_tail(&new->cr_lru, &free);
        spin_unlock(&cache->lock);
        rpcauth_cache_enforce_limit();
found:
        if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
            cred->cr_ops->cr_init != NULL &&
            !(flags & RPCAUTH_LOOKUP_NEW)) {
                int res = cred->cr_ops->cr_init(auth, cred);
                if (res < 0) {
                        put_rpccred(cred);
                        cred = ERR_PTR(res);
                }
        }
        rpcauth_destroy_credlist(&free);
out:
        return cred;
}
EXPORT_SYMBOL_GPL(rpcauth_lookup_credcache);

struct rpc_cred *
rpcauth_lookupcred(struct rpc_auth *auth, int flags)
{
        struct auth_cred acred;
        struct rpc_cred *ret;
        const struct cred *cred = current_cred();

        memset(&acred, 0, sizeof(acred));
        acred.cred = cred;
        ret = auth->au_ops->lookup_cred(auth, &acred, flags);
        return ret;
}
EXPORT_SYMBOL_GPL(rpcauth_lookupcred);

void
rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
                  struct rpc_auth *auth, const struct rpc_credops *ops)
{
        INIT_HLIST_NODE(&cred->cr_hash);
        INIT_LIST_HEAD(&cred->cr_lru);
        refcount_set(&cred->cr_count, 1);
        cred->cr_auth = auth;
        cred->cr_flags = 0;
        cred->cr_ops = ops;
        cred->cr_expire = jiffies;
        cred->cr_cred = get_cred(acred->cred);
}
EXPORT_SYMBOL_GPL(rpcauth_init_cred);

static struct rpc_cred *
rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags)
{
        struct rpc_auth *auth = task->tk_client->cl_auth;
        struct auth_cred acred = {
                .cred = get_task_cred(&init_task),
        };
        struct rpc_cred *ret;

        if (RPC_IS_ASYNC(task))
                lookupflags |= RPCAUTH_LOOKUP_ASYNC;
        ret = auth->au_ops->lookup_cred(auth, &acred, lookupflags);
        put_cred(acred.cred);
        return ret;
}

static struct rpc_cred *
rpcauth_bind_machine_cred(struct rpc_task *task, int lookupflags)
{
        struct rpc_auth *auth = task->tk_client->cl_auth;
        struct auth_cred acred = {
                .principal = task->tk_client->cl_principal,
                .cred = init_task.cred,
        };

        if (!acred.principal)
                return NULL;
        if (RPC_IS_ASYNC(task))
                lookupflags |= RPCAUTH_LOOKUP_ASYNC;
        return auth->au_ops->lookup_cred(auth, &acred, lookupflags);
}

static struct rpc_cred *
rpcauth_bind_new_cred(struct rpc_task *task, int lookupflags)
{
        struct rpc_auth *auth = task->tk_client->cl_auth;

        return rpcauth_lookupcred(auth, lookupflags);
}

static int
rpcauth_bindcred(struct rpc_task *task, const struct cred *cred, int flags)
{
        struct rpc_rqst *req = task->tk_rqstp;
        struct rpc_cred *new = NULL;
        int lookupflags = 0;
        struct rpc_auth *auth = task->tk_client->cl_auth;
        struct auth_cred acred = {
                .cred = cred,
        };

        if (flags & RPC_TASK_ASYNC)
                lookupflags |= RPCAUTH_LOOKUP_NEW | RPCAUTH_LOOKUP_ASYNC;
        if (task->tk_op_cred)
                /* Task must use exactly this rpc_cred */
                new = get_rpccred(task->tk_op_cred);
        else if (cred != NULL && cred != &machine_cred)
                new = auth->au_ops->lookup_cred(auth, &acred, lookupflags);
        else if (cred == &machine_cred)
                new = rpcauth_bind_machine_cred(task, lookupflags);

        /* If machine cred couldn't be bound, try a root cred */
        if (new)
                ;
        else if (cred == &machine_cred)
                new = rpcauth_bind_root_cred(task, lookupflags);
        else if (flags & RPC_TASK_NULLCREDS)
                new = authnull_ops.lookup_cred(NULL, NULL, 0);
        else
                new = rpcauth_bind_new_cred(task, lookupflags);
        if (IS_ERR(new))
                return PTR_ERR(new);
        put_rpccred(req->rq_cred);
        req->rq_cred = new;
        return 0;
}

void
put_rpccred(struct rpc_cred *cred)
{
        if (cred == NULL)
                return;
        rcu_read_lock();
        if (refcount_dec_and_test(&cred->cr_count))
                goto destroy;
        if (refcount_read(&cred->cr_count) != 1 ||
            !test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags))
                goto out;
        if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) {
                cred->cr_expire = jiffies;
                rpcauth_lru_add(cred);
                /* Race breaker */
                if (unlikely(!test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags)))
                        rpcauth_lru_remove(cred);
        } else if (rpcauth_unhash_cred(cred)) {
                rpcauth_lru_remove(cred);
                if (refcount_dec_and_test(&cred->cr_count))
                        goto destroy;
        }
out:
        rcu_read_unlock();
        return;
destroy:
        rcu_read_unlock();
        cred->cr_ops->crdestroy(cred);
}
EXPORT_SYMBOL_GPL(put_rpccred);

/**
 * rpcauth_marshcred - Append RPC credential to end of @xdr
 * @task: controlling RPC task
 * @xdr: xdr_stream containing initial portion of RPC Call header
 *
 * On success, an appropriate verifier is added to @xdr, @xdr is
 * updated to point past the verifier, and zero is returned.
 * Otherwise, @xdr is in an undefined state and a negative errno
 * is returned.
 */
int rpcauth_marshcred(struct rpc_task *task, struct xdr_stream *xdr)
{
        const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops;

        return ops->crmarshal(task, xdr);
}

/**
 * rpcauth_wrap_req_encode - XDR encode the RPC procedure
 * @task: controlling RPC task
 * @xdr: stream where on-the-wire bytes are to be marshalled
 *
 * On success, @xdr contains the encoded and wrapped message.
 * Otherwise, @xdr is in an undefined state.
 */
int rpcauth_wrap_req_encode(struct rpc_task *task, struct xdr_stream *xdr)
{
        kxdreproc_t encode = task->tk_msg.rpc_proc->p_encode;

        encode(task->tk_rqstp, xdr, task->tk_msg.rpc_argp);
        return 0;
}
EXPORT_SYMBOL_GPL(rpcauth_wrap_req_encode);

/**
 * rpcauth_wrap_req - XDR encode and wrap the RPC procedure
 * @task: controlling RPC task
 * @xdr: stream where on-the-wire bytes are to be marshalled
 *
 * On success, @xdr contains the encoded and wrapped message,
 * and zero is returned. Otherwise, @xdr is in an undefined
 * state and a negative errno is returned.
 */
int rpcauth_wrap_req(struct rpc_task *task, struct xdr_stream *xdr)
{
        const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops;

        return ops->crwrap_req(task, xdr);
}

/**
 * rpcauth_checkverf - Validate verifier in RPC Reply header
 * @task: controlling RPC task
 * @xdr: xdr_stream containing RPC Reply header
 *
 * Return values:
 *   %0: Verifier is valid. @xdr now points past the verifier.
 *   %-EIO: Verifier is corrupted or message ended early.
 *   %-EACCES: Verifier is intact but not valid.
 *   %-EPROTONOSUPPORT: Server does not support the requested auth type.
 *
 * When a negative errno is returned, @xdr is left in an undefined
 * state.
 */
int
rpcauth_checkverf(struct rpc_task *task, struct xdr_stream *xdr)
{
        const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops;

        return ops->crvalidate(task, xdr);
}

/**
 * rpcauth_unwrap_resp_decode - Invoke XDR decode function
 * @task: controlling RPC task
 * @xdr: stream where the Reply message resides
 *
 * Returns zero on success; otherwise a negative errno is returned.
 */
int
rpcauth_unwrap_resp_decode(struct rpc_task *task, struct xdr_stream *xdr)
{
        kxdrdproc_t decode = task->tk_msg.rpc_proc->p_decode;

        return decode(task->tk_rqstp, xdr, task->tk_msg.rpc_resp);
}
EXPORT_SYMBOL_GPL(rpcauth_unwrap_resp_decode);

/**
 * rpcauth_unwrap_resp - Invoke unwrap and decode function for the cred
 * @task: controlling RPC task
 * @xdr: stream where the Reply message resides
 *
 * Returns zero on success; otherwise a negative errno is returned.
 */
int
rpcauth_unwrap_resp(struct rpc_task *task, struct xdr_stream *xdr)
{
        const struct rpc_credops *ops = task->tk_rqstp->rq_cred->cr_ops;

        return ops->crunwrap_resp(task, xdr);
}

bool
rpcauth_xmit_need_reencode(struct rpc_task *task)
{
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

        if (!cred || !cred->cr_ops->crneed_reencode)
                return false;
        return cred->cr_ops->crneed_reencode(task);
}

int
rpcauth_refreshcred(struct rpc_task *task)
{
        struct rpc_cred        *cred;
        int err;

        cred = task->tk_rqstp->rq_cred;
        if (cred == NULL) {
                err = rpcauth_bindcred(task, task->tk_msg.rpc_cred, task->tk_flags);
                if (err < 0)
                        goto out;
                cred = task->tk_rqstp->rq_cred;
        }

        err = cred->cr_ops->crrefresh(task);
out:
        if (err < 0)
                task->tk_status = err;
        return err;
}

void
rpcauth_invalcred(struct rpc_task *task)
{
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

        if (cred)
                clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
}

int
rpcauth_uptodatecred(struct rpc_task *task)
{
        struct rpc_cred *cred = task->tk_rqstp->rq_cred;

        return cred == NULL ||
                test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0;
}

static struct shrinker *rpc_cred_shrinker;

int __init rpcauth_init_module(void)
{
        int err;

        err = rpc_init_authunix();
        if (err < 0)
                goto out1;
        rpc_cred_shrinker = shrinker_alloc(0, "sunrpc_cred");
        if (!rpc_cred_shrinker) {
                err = -ENOMEM;
                goto out2;
        }

        rpc_cred_shrinker->count_objects = rpcauth_cache_shrink_count;
        rpc_cred_shrinker->scan_objects = rpcauth_cache_shrink_scan;

        shrinker_register(rpc_cred_shrinker);

        return 0;
out2:
        rpc_destroy_authunix();
out1:
        return err;
}

void rpcauth_remove_module(void)
{
        rpc_destroy_authunix();
        shrinker_free(rpc_cred_shrinker);
}














































































































































































    1 







    1 


    1 










    1 

    1 




























































































































































    1 












    1 


    1 








    1 

    1 
    1 















































    2 


    2 


































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *   ALSA sequencer Timer
 *   Copyright (c) 1998-1999 by Frank van de Pol <fvdpol@coil.demon.nl>
 *                              Jaroslav Kysela <perex@perex.cz>
 */

#include <sound/core.h>
#include <linux/slab.h>
#include "seq_timer.h"
#include "seq_queue.h"
#include "seq_info.h"

/* allowed sequencer timer frequencies, in Hz */
#define MIN_FREQUENCY                10
#define MAX_FREQUENCY                6250
#define DEFAULT_FREQUENCY        1000

#define SKEW_BASE        0x10000        /* 16bit shift */

static void snd_seq_timer_set_tick_resolution(struct snd_seq_timer *tmr)
{
        unsigned int threshold =
                tmr->tempo_base == 1000 ? 1000000 : 10000;

        if (tmr->tempo < threshold)
                tmr->tick.resolution = (tmr->tempo * tmr->tempo_base) / tmr->ppq;
        else {
                /* might overflow.. */
                unsigned int s;
                s = tmr->tempo % tmr->ppq;
                s = (s * tmr->tempo_base) / tmr->ppq;
                tmr->tick.resolution = (tmr->tempo / tmr->ppq) * tmr->tempo_base;
                tmr->tick.resolution += s;
        }
        if (tmr->tick.resolution <= 0)
                tmr->tick.resolution = 1;
        snd_seq_timer_update_tick(&tmr->tick, 0);
}

/* create new timer (constructor) */
struct snd_seq_timer *snd_seq_timer_new(void)
{
        struct snd_seq_timer *tmr;
        
        tmr = kzalloc(sizeof(*tmr), GFP_KERNEL);
        if (!tmr)
                return NULL;
        spin_lock_init(&tmr->lock);

        /* reset setup to defaults */
        snd_seq_timer_defaults(tmr);
        
        /* reset time */
        snd_seq_timer_reset(tmr);
        
        return tmr;
}

/* delete timer (destructor) */
void snd_seq_timer_delete(struct snd_seq_timer **tmr)
{
        struct snd_seq_timer *t = *tmr;
        *tmr = NULL;

        if (t == NULL) {
                pr_debug("ALSA: seq: snd_seq_timer_delete() called with NULL timer\n");
                return;
        }
        t->running = 0;

        /* reset time */
        snd_seq_timer_stop(t);
        snd_seq_timer_reset(t);

        kfree(t);
}

void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
{
        guard(spinlock_irqsave)(&tmr->lock);
        /* setup defaults */
        tmr->ppq = 96;                /* 96 PPQ */
        tmr->tempo = 500000;        /* 120 BPM */
        tmr->tempo_base = 1000;        /* 1us */
        snd_seq_timer_set_tick_resolution(tmr);
        tmr->running = 0;

        tmr->type = SNDRV_SEQ_TIMER_ALSA;
        tmr->alsa_id.dev_class = seq_default_timer_class;
        tmr->alsa_id.dev_sclass = seq_default_timer_sclass;
        tmr->alsa_id.card = seq_default_timer_card;
        tmr->alsa_id.device = seq_default_timer_device;
        tmr->alsa_id.subdevice = seq_default_timer_subdevice;
        tmr->preferred_resolution = seq_default_timer_resolution;

        tmr->skew = tmr->skew_base = SKEW_BASE;
}

static void seq_timer_reset(struct snd_seq_timer *tmr)
{
        /* reset time & songposition */
        tmr->cur_time.tv_sec = 0;
        tmr->cur_time.tv_nsec = 0;

        tmr->tick.cur_tick = 0;
        tmr->tick.fraction = 0;
}

void snd_seq_timer_reset(struct snd_seq_timer *tmr)
{
        guard(spinlock_irqsave)(&tmr->lock);
        seq_timer_reset(tmr);
}


/* called by timer interrupt routine. the period time since previous invocation is passed */
static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
                                    unsigned long resolution,
                                    unsigned long ticks)
{
        struct snd_seq_queue *q = timeri->callback_data;
        struct snd_seq_timer *tmr;

        if (q == NULL)
                return;
        tmr = q->timer;
        if (tmr == NULL)
                return;

        scoped_guard(spinlock_irqsave, &tmr->lock) {
                if (!tmr->running)
                        return;

                resolution *= ticks;
                if (tmr->skew != tmr->skew_base) {
                        /* FIXME: assuming skew_base = 0x10000 */
                        resolution = (resolution >> 16) * tmr->skew +
                                (((resolution & 0xffff) * tmr->skew) >> 16);
                }

                /* update timer */
                snd_seq_inc_time_nsec(&tmr->cur_time, resolution);

                /* calculate current tick */
                snd_seq_timer_update_tick(&tmr->tick, resolution);

                /* register actual time of this timer update */
                ktime_get_ts64(&tmr->last_update);
        }

        /* check queues and dispatch events */
        snd_seq_check_queue(q, 1, 0);
}

/* set current tempo */
int snd_seq_timer_set_tempo(struct snd_seq_timer * tmr, int tempo)
{
        if (snd_BUG_ON(!tmr))
                return -EINVAL;
        if (tempo <= 0)
                return -EINVAL;
        guard(spinlock_irqsave)(&tmr->lock);
        if ((unsigned int)tempo != tmr->tempo) {
                tmr->tempo = tempo;
                snd_seq_timer_set_tick_resolution(tmr);
        }
        return 0;
}

/* set current tempo, ppq and base in a shot */
int snd_seq_timer_set_tempo_ppq(struct snd_seq_timer *tmr, int tempo, int ppq,
                                unsigned int tempo_base)
{
        int changed;

        if (snd_BUG_ON(!tmr))
                return -EINVAL;
        if (tempo <= 0 || ppq <= 0)
                return -EINVAL;
        /* allow only 10ns or 1us tempo base for now */
        if (tempo_base && tempo_base != 10 && tempo_base != 1000)
                return -EINVAL;
        guard(spinlock_irqsave)(&tmr->lock);
        if (tmr->running && (ppq != tmr->ppq)) {
                /* refuse to change ppq on running timers */
                /* because it will upset the song position (ticks) */
                pr_debug("ALSA: seq: cannot change ppq of a running timer\n");
                return -EBUSY;
        }
        changed = (tempo != tmr->tempo) || (ppq != tmr->ppq);
        tmr->tempo = tempo;
        tmr->ppq = ppq;
        tmr->tempo_base = tempo_base ? tempo_base : 1000;
        if (changed)
                snd_seq_timer_set_tick_resolution(tmr);
        return 0;
}

/* set current tick position */
int snd_seq_timer_set_position_tick(struct snd_seq_timer *tmr,
                                    snd_seq_tick_time_t position)
{
        if (snd_BUG_ON(!tmr))
                return -EINVAL;

        guard(spinlock_irqsave)(&tmr->lock);
        tmr->tick.cur_tick = position;
        tmr->tick.fraction = 0;
        return 0;
}

/* set current real-time position */
int snd_seq_timer_set_position_time(struct snd_seq_timer *tmr,
                                    snd_seq_real_time_t position)
{
        if (snd_BUG_ON(!tmr))
                return -EINVAL;

        snd_seq_sanity_real_time(&position);
        guard(spinlock_irqsave)(&tmr->lock);
        tmr->cur_time = position;
        return 0;
}

/* set timer skew */
int snd_seq_timer_set_skew(struct snd_seq_timer *tmr, unsigned int skew,
                           unsigned int base)
{
        if (snd_BUG_ON(!tmr))
                return -EINVAL;

        /* FIXME */
        if (base != SKEW_BASE) {
                pr_debug("ALSA: seq: invalid skew base 0x%x\n", base);
                return -EINVAL;
        }
        guard(spinlock_irqsave)(&tmr->lock);
        tmr->skew = skew;
        return 0;
}

int snd_seq_timer_open(struct snd_seq_queue *q)
{
        struct snd_timer_instance *t;
        struct snd_seq_timer *tmr;
        char str[32];
        int err;

        tmr = q->timer;
        if (snd_BUG_ON(!tmr))
                return -EINVAL;
        if (tmr->timeri)
                return -EBUSY;
        sprintf(str, "sequencer queue %i", q->queue);
        if (tmr->type != SNDRV_SEQ_TIMER_ALSA)        /* standard ALSA timer */
                return -EINVAL;
        if (tmr->alsa_id.dev_class != SNDRV_TIMER_CLASS_SLAVE)
                tmr->alsa_id.dev_sclass = SNDRV_TIMER_SCLASS_SEQUENCER;
        t = snd_timer_instance_new(str);
        if (!t)
                return -ENOMEM;
        t->callback = snd_seq_timer_interrupt;
        t->callback_data = q;
        t->flags |= SNDRV_TIMER_IFLG_AUTO;
        err = snd_timer_open(t, &tmr->alsa_id, q->queue);
        if (err < 0 && tmr->alsa_id.dev_class != SNDRV_TIMER_CLASS_SLAVE) {
                if (tmr->alsa_id.dev_class != SNDRV_TIMER_CLASS_GLOBAL ||
                    tmr->alsa_id.device != SNDRV_TIMER_GLOBAL_SYSTEM) {
                        struct snd_timer_id tid;
                        memset(&tid, 0, sizeof(tid));
                        tid.dev_class = SNDRV_TIMER_CLASS_GLOBAL;
                        tid.dev_sclass = SNDRV_TIMER_SCLASS_SEQUENCER;
                        tid.card = -1;
                        tid.device = SNDRV_TIMER_GLOBAL_SYSTEM;
                        err = snd_timer_open(t, &tid, q->queue);
                }
        }
        if (err < 0) {
                pr_err("ALSA: seq fatal error: cannot create timer (%i)\n", err);
                snd_timer_instance_free(t);
                return err;
        }
        scoped_guard(spinlock_irq, &tmr->lock) {
                if (tmr->timeri)
                        err = -EBUSY;
                else
                        tmr->timeri = t;
        }
        if (err < 0) {
                snd_timer_close(t);
                snd_timer_instance_free(t);
                return err;
        }
        return 0;
}

int snd_seq_timer_close(struct snd_seq_queue *q)
{
        struct snd_seq_timer *tmr;
        struct snd_timer_instance *t;
        
        tmr = q->timer;
        if (snd_BUG_ON(!tmr))
                return -EINVAL;
        scoped_guard(spinlock_irq, &tmr->lock) {
                t = tmr->timeri;
                tmr->timeri = NULL;
        }
        if (t) {
                snd_timer_close(t);
                snd_timer_instance_free(t);
        }
        return 0;
}

static int seq_timer_stop(struct snd_seq_timer *tmr)
{
        if (! tmr->timeri)
                return -EINVAL;
        if (!tmr->running)
                return 0;
        tmr->running = 0;
        snd_timer_pause(tmr->timeri);
        return 0;
}

int snd_seq_timer_stop(struct snd_seq_timer *tmr)
{
        guard(spinlock_irqsave)(&tmr->lock);
        return seq_timer_stop(tmr);
}

static int initialize_timer(struct snd_seq_timer *tmr)
{
        struct snd_timer *t;
        unsigned long freq;

        t = tmr->timeri->timer;
        if (!t)
                return -EINVAL;

        freq = tmr->preferred_resolution;
        if (!freq)
                freq = DEFAULT_FREQUENCY;
        else if (freq < MIN_FREQUENCY)
                freq = MIN_FREQUENCY;
        else if (freq > MAX_FREQUENCY)
                freq = MAX_FREQUENCY;

        tmr->ticks = 1;
        if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
                unsigned long r = snd_timer_resolution(tmr->timeri);
                if (r) {
                        tmr->ticks = (unsigned int)(1000000000uL / (r * freq));
                        if (! tmr->ticks)
                                tmr->ticks = 1;
                }
        }
        tmr->initialized = 1;
        return 0;
}

static int seq_timer_start(struct snd_seq_timer *tmr)
{
        if (! tmr->timeri)
                return -EINVAL;
        if (tmr->running)
                seq_timer_stop(tmr);
        seq_timer_reset(tmr);
        if (initialize_timer(tmr) < 0)
                return -EINVAL;
        snd_timer_start(tmr->timeri, tmr->ticks);
        tmr->running = 1;
        ktime_get_ts64(&tmr->last_update);
        return 0;
}

int snd_seq_timer_start(struct snd_seq_timer *tmr)
{
        guard(spinlock_irqsave)(&tmr->lock);
        return seq_timer_start(tmr);
}

static int seq_timer_continue(struct snd_seq_timer *tmr)
{
        if (! tmr->timeri)
                return -EINVAL;
        if (tmr->running)
                return -EBUSY;
        if (! tmr->initialized) {
                seq_timer_reset(tmr);
                if (initialize_timer(tmr) < 0)
                        return -EINVAL;
        }
        snd_timer_start(tmr->timeri, tmr->ticks);
        tmr->running = 1;
        ktime_get_ts64(&tmr->last_update);
        return 0;
}

int snd_seq_timer_continue(struct snd_seq_timer *tmr)
{
        guard(spinlock_irqsave)(&tmr->lock);
        return seq_timer_continue(tmr);
}

/* return current 'real' time. use timeofday() to get better granularity. */
snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr,
                                               bool adjust_ktime)
{
        snd_seq_real_time_t cur_time;

        guard(spinlock_irqsave)(&tmr->lock);
        cur_time = tmr->cur_time;
        if (adjust_ktime && tmr->running) {
                struct timespec64 tm;

                ktime_get_ts64(&tm);
                tm = timespec64_sub(tm, tmr->last_update);
                cur_time.tv_nsec += tm.tv_nsec;
                cur_time.tv_sec += tm.tv_sec;
                snd_seq_sanity_real_time(&cur_time);
        }
        return cur_time;        
}

/* TODO: use interpolation on tick queue (will only be useful for very
 high PPQ values) */
snd_seq_tick_time_t snd_seq_timer_get_cur_tick(struct snd_seq_timer *tmr)
{
        guard(spinlock_irqsave)(&tmr->lock);
        return tmr->tick.cur_tick;
}


#ifdef CONFIG_SND_PROC_FS
/* exported to seq_info.c */
void snd_seq_info_timer_read(struct snd_info_entry *entry,
                             struct snd_info_buffer *buffer)
{
        int idx;
        struct snd_seq_queue *q;
        struct snd_seq_timer *tmr;
        struct snd_timer_instance *ti;
        unsigned long resolution;
        
        for (idx = 0; idx < SNDRV_SEQ_MAX_QUEUES; idx++) {
                q = queueptr(idx);
                if (q == NULL)
                        continue;
                scoped_guard(mutex, &q->timer_mutex) {
                        tmr = q->timer;
                        if (!tmr)
                                break;
                        ti = tmr->timeri;
                        if (!ti)
                                break;
                        snd_iprintf(buffer, "Timer for queue %i : %s\n", q->queue, ti->timer->name);
                        resolution = snd_timer_resolution(ti) * tmr->ticks;
                        snd_iprintf(buffer, "  Period time : %lu.%09lu\n", resolution / 1000000000, resolution % 1000000000);
                        snd_iprintf(buffer, "  Skew : %u / %u\n", tmr->skew, tmr->skew_base);
                }
                queuefree(q);
         }
}
#endif /* CONFIG_SND_PROC_FS */













































































































































































































































































































































































































































































































































































   22 








   16 
   22 






   20 





























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
/*
 * linux/fs/nls/mac-turkish.c
 *
 * Charset macturkish translation tables.
 * Generated automatically from the Unicode and charset
 * tables from the Unicode Organization (www.unicode.org).
 * The Unicode to charset table has only exact mappings.
 */

/*
 * COPYRIGHT AND PERMISSION NOTICE
 *
 * Copyright 1991-2012 Unicode, Inc.  All rights reserved.  Distributed under
 * the Terms of Use in http://www.unicode.org/copyright.html.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of the Unicode data files and any associated documentation (the "Data
 * Files") or Unicode software and any associated documentation (the
 * "Software") to deal in the Data Files or Software without restriction,
 * including without limitation the rights to use, copy, modify, merge,
 * publish, distribute, and/or sell copies of the Data Files or Software, and
 * to permit persons to whom the Data Files or Software are furnished to do
 * so, provided that (a) the above copyright notice(s) and this permission
 * notice appear with all copies of the Data Files or Software, (b) both the
 * above copyright notice(s) and this permission notice appear in associated
 * documentation, and (c) there is clear notice in each modified Data File or
 * in the Software as well as in the documentation associated with the Data
 * File(s) or Software that the data or software has been modified.
 *
 * THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
 * KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
 * THIRD PARTY RIGHTS.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS
 * INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT
 * OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THE DATA FILES OR SOFTWARE.
 *
 * Except as contained in this notice, the name of a copyright holder shall
 * not be used in advertising or otherwise to promote the sale, use or other
 * dealings in these Data Files or Software without prior written
 * authorization of the copyright holder.
 */

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/nls.h>
#include <linux/errno.h>

static const wchar_t charset2uni[256] = {
        /* 0x00 */
        0x0000, 0x0001, 0x0002, 0x0003,
        0x0004, 0x0005, 0x0006, 0x0007,
        0x0008, 0x0009, 0x000a, 0x000b,
        0x000c, 0x000d, 0x000e, 0x000f,
        /* 0x10 */
        0x0010, 0x0011, 0x0012, 0x0013,
        0x0014, 0x0015, 0x0016, 0x0017,
        0x0018, 0x0019, 0x001a, 0x001b,
        0x001c, 0x001d, 0x001e, 0x001f,
        /* 0x20 */
        0x0020, 0x0021, 0x0022, 0x0023,
        0x0024, 0x0025, 0x0026, 0x0027,
        0x0028, 0x0029, 0x002a, 0x002b,
        0x002c, 0x002d, 0x002e, 0x002f,
        /* 0x30 */
        0x0030, 0x0031, 0x0032, 0x0033,
        0x0034, 0x0035, 0x0036, 0x0037,
        0x0038, 0x0039, 0x003a, 0x003b,
        0x003c, 0x003d, 0x003e, 0x003f,
        /* 0x40 */
        0x0040, 0x0041, 0x0042, 0x0043,
        0x0044, 0x0045, 0x0046, 0x0047,
        0x0048, 0x0049, 0x004a, 0x004b,
        0x004c, 0x004d, 0x004e, 0x004f,
        /* 0x50 */
        0x0050, 0x0051, 0x0052, 0x0053,
        0x0054, 0x0055, 0x0056, 0x0057,
        0x0058, 0x0059, 0x005a, 0x005b,
        0x005c, 0x005d, 0x005e, 0x005f,
        /* 0x60 */
        0x0060, 0x0061, 0x0062, 0x0063,
        0x0064, 0x0065, 0x0066, 0x0067,
        0x0068, 0x0069, 0x006a, 0x006b,
        0x006c, 0x006d, 0x006e, 0x006f,
        /* 0x70 */
        0x0070, 0x0071, 0x0072, 0x0073,
        0x0074, 0x0075, 0x0076, 0x0077,
        0x0078, 0x0079, 0x007a, 0x007b,
        0x007c, 0x007d, 0x007e, 0x007f,
        /* 0x80 */
        0x00c4, 0x00c5, 0x00c7, 0x00c9,
        0x00d1, 0x00d6, 0x00dc, 0x00e1,
        0x00e0, 0x00e2, 0x00e4, 0x00e3,
        0x00e5, 0x00e7, 0x00e9, 0x00e8,
        /* 0x90 */
        0x00ea, 0x00eb, 0x00ed, 0x00ec,
        0x00ee, 0x00ef, 0x00f1, 0x00f3,
        0x00f2, 0x00f4, 0x00f6, 0x00f5,
        0x00fa, 0x00f9, 0x00fb, 0x00fc,
        /* 0xa0 */
        0x2020, 0x00b0, 0x00a2, 0x00a3,
        0x00a7, 0x2022, 0x00b6, 0x00df,
        0x00ae, 0x00a9, 0x2122, 0x00b4,
        0x00a8, 0x2260, 0x00c6, 0x00d8,
        /* 0xb0 */
        0x221e, 0x00b1, 0x2264, 0x2265,
        0x00a5, 0x00b5, 0x2202, 0x2211,
        0x220f, 0x03c0, 0x222b, 0x00aa,
        0x00ba, 0x03a9, 0x00e6, 0x00f8,
        /* 0xc0 */
        0x00bf, 0x00a1, 0x00ac, 0x221a,
        0x0192, 0x2248, 0x2206, 0x00ab,
        0x00bb, 0x2026, 0x00a0, 0x00c0,
        0x00c3, 0x00d5, 0x0152, 0x0153,
        /* 0xd0 */
        0x2013, 0x2014, 0x201c, 0x201d,
        0x2018, 0x2019, 0x00f7, 0x25ca,
        0x00ff, 0x0178, 0x011e, 0x011f,
        0x0130, 0x0131, 0x015e, 0x015f,
        /* 0xe0 */
        0x2021, 0x00b7, 0x201a, 0x201e,
        0x2030, 0x00c2, 0x00ca, 0x00c1,
        0x00cb, 0x00c8, 0x00cd, 0x00ce,
        0x00cf, 0x00cc, 0x00d3, 0x00d4,
        /* 0xf0 */
        0xf8ff, 0x00d2, 0x00da, 0x00db,
        0x00d9, 0xf8a0, 0x02c6, 0x02dc,
        0x00af, 0x02d8, 0x02d9, 0x02da,
        0x00b8, 0x02dd, 0x02db, 0x02c7,
};

static const unsigned char page00[256] = {
        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */
        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */
        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */
        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */
        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */
        0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */
        0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */
        0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */
        0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */
        0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, /* 0x60-0x67 */
        0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, /* 0x68-0x6f */
        0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, /* 0x70-0x77 */
        0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0xca, 0xc1, 0xa2, 0xa3, 0x00, 0xb4, 0x00, 0xa4, /* 0xa0-0xa7 */
        0xac, 0xa9, 0xbb, 0xc7, 0xc2, 0x00, 0xa8, 0xf8, /* 0xa8-0xaf */
        0xa1, 0xb1, 0x00, 0x00, 0xab, 0xb5, 0xa6, 0xe1, /* 0xb0-0xb7 */
        0xfc, 0x00, 0xbc, 0xc8, 0x00, 0x00, 0x00, 0xc0, /* 0xb8-0xbf */
        0xcb, 0xe7, 0xe5, 0xcc, 0x80, 0x81, 0xae, 0x82, /* 0xc0-0xc7 */
        0xe9, 0x83, 0xe6, 0xe8, 0xed, 0xea, 0xeb, 0xec, /* 0xc8-0xcf */
        0x00, 0x84, 0xf1, 0xee, 0xef, 0xcd, 0x85, 0x00, /* 0xd0-0xd7 */
        0xaf, 0xf4, 0xf2, 0xf3, 0x86, 0x00, 0x00, 0xa7, /* 0xd8-0xdf */
        0x88, 0x87, 0x89, 0x8b, 0x8a, 0x8c, 0xbe, 0x8d, /* 0xe0-0xe7 */
        0x8f, 0x8e, 0x90, 0x91, 0x93, 0x92, 0x94, 0x95, /* 0xe8-0xef */
        0x00, 0x96, 0x98, 0x97, 0x99, 0x9b, 0x9a, 0xd6, /* 0xf0-0xf7 */
        0xbf, 0x9d, 0x9c, 0x9e, 0x9f, 0x00, 0x00, 0xd8, /* 0xf8-0xff */
};

static const unsigned char page01[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xda, 0xdb, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0xdc, 0xdd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0xce, 0xcf, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xde, 0xdf, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0xd9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page02[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0xff, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0xf9, 0xfa, 0xfb, 0xfe, 0xf7, 0xfd, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page03[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0xbd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page20[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0xd0, 0xd1, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0xd4, 0xd5, 0xe2, 0x00, 0xd2, 0xd3, 0xe3, 0x00, /* 0x18-0x1f */
        0xa0, 0xe0, 0xa5, 0x00, 0x00, 0x00, 0xc9, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0xe4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page21[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0xaa, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page22[256] = {
        0x00, 0x00, 0xb6, 0x00, 0x00, 0x00, 0xc6, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, /* 0x08-0x0f */
        0x00, 0xb7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0xc3, 0x00, 0x00, 0x00, 0xb0, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0xba, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0xc5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0xad, 0x00, 0x00, 0x00, 0xb2, 0xb3, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page25[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0xd7, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char pagef8[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x50-0x57 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0xf5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa8-0xaf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb0-0xb7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc0-0xc7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd0-0xd7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe0-0xe7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xf0-0xf7 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, /* 0xf8-0xff */
};

static const unsigned char *const page_uni2charset[256] = {
        page00, page01, page02, page03, NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        page20, page21, page22, NULL,   NULL,   page25, NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
        pagef8, NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,
};

static const unsigned char charset2lower[256] = {
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x00-0x07 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x08-0x0f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x10-0x17 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x18-0x1f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x20-0x27 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x28-0x2f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x30-0x37 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x38-0x3f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x40-0x47 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x48-0x4f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x50-0x57 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x58-0x5f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x60-0x67 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x68-0x6f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x70-0x77 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x78-0x7f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x80-0x87 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x88-0x8f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x90-0x97 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x98-0x9f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xa0-0xa7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xa8-0xaf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xb0-0xb7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xb8-0xbf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xc0-0xc7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xc8-0xcf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xd0-0xd7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xd8-0xdf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xe0-0xe7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xe8-0xef */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xf0-0xf7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xf8-0xff */
};

static const unsigned char charset2upper[256] = {
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x00-0x07 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x08-0x0f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x10-0x17 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x18-0x1f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x20-0x27 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x28-0x2f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x30-0x37 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x38-0x3f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x40-0x47 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x48-0x4f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x50-0x57 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x58-0x5f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x60-0x67 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x68-0x6f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x70-0x77 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x78-0x7f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x80-0x87 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x88-0x8f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x90-0x97 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0x98-0x9f */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xa0-0xa7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xa8-0xaf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xb0-0xb7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xb8-0xbf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xc0-0xc7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xc8-0xcf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xd0-0xd7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xd8-0xdf */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xe0-0xe7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xe8-0xef */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xf0-0xf7 */
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, /* 0xf8-0xff */
};

static int uni2char(wchar_t uni, unsigned char *out, int boundlen)
{
        const unsigned char *uni2charset;
        unsigned char cl = uni & 0x00ff;
        unsigned char ch = (uni & 0xff00) >> 8;

        if (boundlen <= 0)
                return -ENAMETOOLONG;

        uni2charset = page_uni2charset[ch];
        if (uni2charset && uni2charset[cl])
                out[0] = uni2charset[cl];
        else
                return -EINVAL;
        return 1;
}

static int char2uni(const unsigned char *rawstring, int boundlen, wchar_t *uni)
{
        *uni = charset2uni[*rawstring];
        if (*uni == 0x0000)
                return -EINVAL;
        return 1;
}

static struct nls_table table = {
        .charset        = "macturkish",
        .uni2char        = uni2char,
        .char2uni        = char2uni,
        .charset2lower        = charset2lower,
        .charset2upper        = charset2upper,
};

static int __init init_nls_macturkish(void)
{
        return register_nls(&table);
}

static void __exit exit_nls_macturkish(void)
{
        unregister_nls(&table);
}

module_init(init_nls_macturkish)
module_exit(exit_nls_macturkish)

MODULE_DESCRIPTION("NLS Codepage macturkish");
MODULE_LICENSE("Dual BSD/GPL");














































































































































































































































    3 




    1 


    2 


    1 



    1 












  250 
  251 





    3 









































































































































































    3 












































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
// SPDX-License-Identifier: GPL-2.0-only
/*
 * Persistent Storage - ramfs parts.
 *
 * Copyright (C) 2010 Intel Corporation <tony.luck@intel.com>
 */

#include <linux/module.h>
#include <linux/fs.h>
#include <linux/fsnotify.h>
#include <linux/pagemap.h>
#include <linux/highmem.h>
#include <linux/time.h>
#include <linux/init.h>
#include <linux/list.h>
#include <linux/string.h>
#include <linux/mount.h>
#include <linux/seq_file.h>
#include <linux/ramfs.h>
#include <linux/parser.h>
#include <linux/sched.h>
#include <linux/magic.h>
#include <linux/pstore.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/cleanup.h>

#include "internal.h"

#define        PSTORE_NAMELEN        64

static DEFINE_MUTEX(records_list_lock);
static LIST_HEAD(records_list);

static DEFINE_MUTEX(pstore_sb_lock);
static struct super_block *pstore_sb;

DEFINE_FREE(pstore_iput, struct inode *, if (_T) iput(_T))

struct pstore_private {
        struct list_head list;
        struct dentry *dentry;
        struct pstore_record *record;
        size_t total_size;
};

struct pstore_ftrace_seq_data {
        const void *ptr;
        size_t off;
        size_t size;
};

#define REC_SIZE sizeof(struct pstore_ftrace_record)

static void free_pstore_private(struct pstore_private *private)
{
        if (!private)
                return;
        if (private->record) {
                kvfree(private->record->buf);
                kfree(private->record->priv);
                kfree(private->record);
        }
        kfree(private);
}
DEFINE_FREE(pstore_private, struct pstore_private *, free_pstore_private(_T));

static void *pstore_ftrace_seq_start(struct seq_file *s, loff_t *pos)
{
        struct pstore_private *ps = s->private;
        struct pstore_ftrace_seq_data *data __free(kfree) = NULL;

        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
                return NULL;

        data->off = ps->total_size % REC_SIZE;
        data->off += *pos * REC_SIZE;
        if (data->off + REC_SIZE > ps->total_size)
                return NULL;

        return_ptr(data);
}

static void pstore_ftrace_seq_stop(struct seq_file *s, void *v)
{
        kfree(v);
}

static void *pstore_ftrace_seq_next(struct seq_file *s, void *v, loff_t *pos)
{
        struct pstore_private *ps = s->private;
        struct pstore_ftrace_seq_data *data = v;

        (*pos)++;
        data->off += REC_SIZE;
        if (data->off + REC_SIZE > ps->total_size)
                return NULL;

        return data;
}

static int pstore_ftrace_seq_show(struct seq_file *s, void *v)
{
        struct pstore_private *ps = s->private;
        struct pstore_ftrace_seq_data *data = v;
        struct pstore_ftrace_record *rec;

        if (!data)
                return 0;

        rec = (struct pstore_ftrace_record *)(ps->record->buf + data->off);

        seq_printf(s, "CPU:%d ts:%llu %08lx  %08lx  %ps <- %pS\n",
                   pstore_ftrace_decode_cpu(rec),
                   pstore_ftrace_read_timestamp(rec),
                   rec->ip, rec->parent_ip, (void *)rec->ip,
                   (void *)rec->parent_ip);

        return 0;
}

static const struct seq_operations pstore_ftrace_seq_ops = {
        .start        = pstore_ftrace_seq_start,
        .next        = pstore_ftrace_seq_next,
        .stop        = pstore_ftrace_seq_stop,
        .show        = pstore_ftrace_seq_show,
};

static ssize_t pstore_file_read(struct file *file, char __user *userbuf,
                                                size_t count, loff_t *ppos)
{
        struct seq_file *sf = file->private_data;
        struct pstore_private *ps = sf->private;

        if (ps->record->type == PSTORE_TYPE_FTRACE)
                return seq_read(file, userbuf, count, ppos);
        return simple_read_from_buffer(userbuf, count, ppos,
                                       ps->record->buf, ps->total_size);
}

static int pstore_file_open(struct inode *inode, struct file *file)
{
        struct pstore_private *ps = inode->i_private;
        struct seq_file *sf;
        int err;
        const struct seq_operations *sops = NULL;

        if (ps->record->type == PSTORE_TYPE_FTRACE)
                sops = &pstore_ftrace_seq_ops;

        err = seq_open(file, sops);
        if (err < 0)
                return err;

        sf = file->private_data;
        sf->private = ps;

        return 0;
}

static loff_t pstore_file_llseek(struct file *file, loff_t off, int whence)
{
        struct seq_file *sf = file->private_data;

        if (sf->op)
                return seq_lseek(file, off, whence);
        return default_llseek(file, off, whence);
}

static const struct file_operations pstore_file_operations = {
        .open                = pstore_file_open,
        .read                = pstore_file_read,
        .llseek                = pstore_file_llseek,
        .release        = seq_release,
};

/*
 * When a file is unlinked from our file system we call the
 * platform driver to erase the record from persistent store.
 */
static int pstore_unlink(struct inode *dir, struct dentry *dentry)
{
        struct pstore_private *p = d_inode(dentry)->i_private;
        struct pstore_record *record = p->record;

        if (!record->psi->erase)
                return -EPERM;

        /* Make sure we can't race while removing this file. */
        scoped_guard(mutex, &records_list_lock) {
                if (!list_empty(&p->list))
                        list_del_init(&p->list);
                else
                        return -ENOENT;
                p->dentry = NULL;
        }

        scoped_guard(mutex, &record->psi->read_mutex)
                record->psi->erase(record);

        return simple_unlink(dir, dentry);
}

static void pstore_evict_inode(struct inode *inode)
{
        struct pstore_private        *p = inode->i_private;

        clear_inode(inode);
        free_pstore_private(p);
}

static const struct inode_operations pstore_dir_inode_operations = {
        .lookup                = simple_lookup,
        .unlink                = pstore_unlink,
};

static struct inode *pstore_get_inode(struct super_block *sb)
{
        struct inode *inode = new_inode(sb);
        if (inode) {
                inode->i_ino = get_next_ino();
                simple_inode_init_ts(inode);
        }
        return inode;
}

enum {
        Opt_kmsg_bytes, Opt_err
};

static const match_table_t tokens = {
        {Opt_kmsg_bytes, "kmsg_bytes=%u"},
        {Opt_err, NULL}
};

static void parse_options(char *options)
{
        char                *p;
        substring_t        args[MAX_OPT_ARGS];
        int                option;

        if (!options)
                return;

        while ((p = strsep(&options, ",")) != NULL) {
                int token;

                if (!*p)
                        continue;

                token = match_token(p, tokens, args);
                switch (token) {
                case Opt_kmsg_bytes:
                        if (!match_int(&args[0], &option))
                                pstore_set_kmsg_bytes(option);
                        break;
                }
        }
}

/*
 * Display the mount options in /proc/mounts.
 */
static int pstore_show_options(struct seq_file *m, struct dentry *root)
{
        if (kmsg_bytes != CONFIG_PSTORE_DEFAULT_KMSG_BYTES)
                seq_printf(m, ",kmsg_bytes=%lu", kmsg_bytes);
        return 0;
}

static int pstore_remount(struct super_block *sb, int *flags, char *data)
{
        sync_filesystem(sb);
        parse_options(data);

        return 0;
}

static const struct super_operations pstore_ops = {
        .statfs                = simple_statfs,
        .drop_inode        = generic_delete_inode,
        .evict_inode        = pstore_evict_inode,
        .remount_fs        = pstore_remount,
        .show_options        = pstore_show_options,
};

static struct dentry *psinfo_lock_root(void)
{
        struct dentry *root;

        guard(mutex)(&pstore_sb_lock);
        /*
         * Having no backend is fine -- no records appear.
         * Not being mounted is fine -- nothing to do.
         */
        if (!psinfo || !pstore_sb)
                return NULL;

        root = pstore_sb->s_root;
        inode_lock(d_inode(root));

        return root;
}

int pstore_put_backend_records(struct pstore_info *psi)
{
        struct pstore_private *pos, *tmp;
        struct dentry *root;

        root = psinfo_lock_root();
        if (!root)
                return 0;

        scoped_guard(mutex, &records_list_lock) {
                list_for_each_entry_safe(pos, tmp, &records_list, list) {
                        if (pos->record->psi == psi) {
                                list_del_init(&pos->list);
                                d_invalidate(pos->dentry);
                                simple_unlink(d_inode(root), pos->dentry);
                                pos->dentry = NULL;
                        }
                }
        }

        inode_unlock(d_inode(root));

        return 0;
}

/*
 * Make a regular file in the root directory of our file system.
 * Load it up with "size" bytes of data from "buf".
 * Set the mtime & ctime to the date that this record was originally stored.
 */
int pstore_mkfile(struct dentry *root, struct pstore_record *record)
{
        struct dentry                *dentry;
        struct inode                *inode __free(pstore_iput) = NULL;
        char                        name[PSTORE_NAMELEN];
        struct pstore_private        *private __free(pstore_private) = NULL, *pos;
        size_t                        size = record->size + record->ecc_notice_size;

        if (WARN_ON(!inode_is_locked(d_inode(root))))
                return -EINVAL;

        guard(mutex)(&records_list_lock);

        /* Skip records that are already present in the filesystem. */
        list_for_each_entry(pos, &records_list, list) {
                if (pos->record->type == record->type &&
                    pos->record->id == record->id &&
                    pos->record->psi == record->psi)
                        return -EEXIST;
        }

        inode = pstore_get_inode(root->d_sb);
        if (!inode)
                return -ENOMEM;
        inode->i_mode = S_IFREG | 0444;
        inode->i_fop = &pstore_file_operations;
        scnprintf(name, sizeof(name), "%s-%s-%llu%s",
                        pstore_type_to_name(record->type),
                        record->psi->name, record->id,
                        record->compressed ? ".enc.z" : "");

        private = kzalloc(sizeof(*private), GFP_KERNEL);
        if (!private)
                return -ENOMEM;

        dentry = d_alloc_name(root, name);
        if (!dentry)
                return -ENOMEM;

        private->dentry = dentry;
        private->record = record;
        inode->i_size = private->total_size = size;
        inode->i_private = private;

        if (record->time.tv_sec)
                inode_set_mtime_to_ts(inode,
                                      inode_set_ctime_to_ts(inode, record->time));

        d_add(dentry, no_free_ptr(inode));

        list_add(&(no_free_ptr(private))->list, &records_list);

        return 0;
}

/*
 * Read all the records from the persistent store. Create
 * files in our filesystem.  Don't warn about -EEXIST errors
 * when we are re-scanning the backing store looking to add new
 * error records.
 */
void pstore_get_records(int quiet)
{
        struct dentry *root;

        root = psinfo_lock_root();
        if (!root)
                return;

        pstore_get_backend_records(psinfo, root, quiet);
        inode_unlock(d_inode(root));
}

static int pstore_fill_super(struct super_block *sb, void *data, int silent)
{
        struct inode *inode;

        sb->s_maxbytes                = MAX_LFS_FILESIZE;
        sb->s_blocksize                = PAGE_SIZE;
        sb->s_blocksize_bits        = PAGE_SHIFT;
        sb->s_magic                = PSTOREFS_MAGIC;
        sb->s_op                = &pstore_ops;
        sb->s_time_gran                = 1;

        parse_options(data);

        inode = pstore_get_inode(sb);
        if (inode) {
                inode->i_mode = S_IFDIR | 0750;
                inode->i_op = &pstore_dir_inode_operations;
                inode->i_fop = &simple_dir_operations;
                inc_nlink(inode);
        }
        sb->s_root = d_make_root(inode);
        if (!sb->s_root)
                return -ENOMEM;

        scoped_guard(mutex, &pstore_sb_lock)
                pstore_sb = sb;

        pstore_get_records(0);

        return 0;
}

static struct dentry *pstore_mount(struct file_system_type *fs_type,
        int flags, const char *dev_name, void *data)
{
        return mount_single(fs_type, flags, data, pstore_fill_super);
}

static void pstore_kill_sb(struct super_block *sb)
{
        guard(mutex)(&pstore_sb_lock);
        WARN_ON(pstore_sb && pstore_sb != sb);

        kill_litter_super(sb);
        pstore_sb = NULL;

        guard(mutex)(&records_list_lock);
        INIT_LIST_HEAD(&records_list);
}

static struct file_system_type pstore_fs_type = {
        .owner          = THIS_MODULE,
        .name                = "pstore",
        .mount                = pstore_mount,
        .kill_sb        = pstore_kill_sb,
};

int __init pstore_init_fs(void)
{
        int err;

        /* Create a convenient mount point for people to access pstore */
        err = sysfs_create_mount_point(fs_kobj, "pstore");
        if (err)
                goto out;

        err = register_filesystem(&pstore_fs_type);
        if (err < 0)
                sysfs_remove_mount_point(fs_kobj, "pstore");

out:
        return err;
}

void __exit pstore_exit_fs(void)
{
        unregister_filesystem(&pstore_fs_type);
        sysfs_remove_mount_point(fs_kobj, "pstore");
}




































































































    5 




















































    5 













   88 
























   88 




    5 






    5 

















































































































































































































































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
// SPDX-License-Identifier: GPL-2.0-only
/*
 * filecheck.c
 *
 * Code which implements online file check.
 *
 * Copyright (C) 2016 SuSE.  All rights reserved.
 */

#include <linux/list.h>
#include <linux/spinlock.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/kmod.h>
#include <linux/fs.h>
#include <linux/kobject.h>
#include <linux/sysfs.h>
#include <linux/sysctl.h>
#include <cluster/masklog.h>

#include "ocfs2.h"
#include "ocfs2_fs.h"
#include "stackglue.h"
#include "inode.h"

#include "filecheck.h"


/* File check error strings,
 * must correspond with error number in header file.
 */
static const char * const ocfs2_filecheck_errs[] = {
        "SUCCESS",
        "FAILED",
        "INPROGRESS",
        "READONLY",
        "INJBD",
        "INVALIDINO",
        "BLOCKECC",
        "BLOCKNO",
        "VALIDFLAG",
        "GENERATION",
        "UNSUPPORTED"
};

struct ocfs2_filecheck_entry {
        struct list_head fe_list;
        unsigned long fe_ino;
        unsigned int fe_type;
        unsigned int fe_done:1;
        unsigned int fe_status:31;
};

struct ocfs2_filecheck_args {
        unsigned int fa_type;
        union {
                unsigned long fa_ino;
                unsigned int fa_len;
        };
};

static const char *
ocfs2_filecheck_error(int errno)
{
        if (!errno)
                return ocfs2_filecheck_errs[errno];

        BUG_ON(errno < OCFS2_FILECHECK_ERR_START ||
               errno > OCFS2_FILECHECK_ERR_END);
        return ocfs2_filecheck_errs[errno - OCFS2_FILECHECK_ERR_START + 1];
}

static ssize_t ocfs2_filecheck_attr_show(struct kobject *kobj,
                                        struct kobj_attribute *attr,
                                        char *buf);
static ssize_t ocfs2_filecheck_attr_store(struct kobject *kobj,
                                        struct kobj_attribute *attr,
                                        const char *buf, size_t count);
static struct kobj_attribute ocfs2_filecheck_attr_chk =
                                        __ATTR(check, S_IRUSR | S_IWUSR,
                                        ocfs2_filecheck_attr_show,
                                        ocfs2_filecheck_attr_store);
static struct kobj_attribute ocfs2_filecheck_attr_fix =
                                        __ATTR(fix, S_IRUSR | S_IWUSR,
                                        ocfs2_filecheck_attr_show,
                                        ocfs2_filecheck_attr_store);
static struct kobj_attribute ocfs2_filecheck_attr_set =
                                        __ATTR(set, S_IRUSR | S_IWUSR,
                                        ocfs2_filecheck_attr_show,
                                        ocfs2_filecheck_attr_store);
static struct attribute *ocfs2_filecheck_attrs[] = {
        &ocfs2_filecheck_attr_chk.attr,
        &ocfs2_filecheck_attr_fix.attr,
        &ocfs2_filecheck_attr_set.attr,
        NULL
};
ATTRIBUTE_GROUPS(ocfs2_filecheck);

static void ocfs2_filecheck_release(struct kobject *kobj)
{
        struct ocfs2_filecheck_sysfs_entry *entry = container_of(kobj,
                                struct ocfs2_filecheck_sysfs_entry, fs_kobj);

        complete(&entry->fs_kobj_unregister);
}

static ssize_t
ocfs2_filecheck_show(struct kobject *kobj, struct attribute *attr, char *buf)
{
        ssize_t ret = -EIO;
        struct kobj_attribute *kattr = container_of(attr,
                                        struct kobj_attribute, attr);

        kobject_get(kobj);
        if (kattr->show)
                ret = kattr->show(kobj, kattr, buf);
        kobject_put(kobj);
        return ret;
}

static ssize_t
ocfs2_filecheck_store(struct kobject *kobj, struct attribute *attr,
                        const char *buf, size_t count)
{
        ssize_t ret = -EIO;
        struct kobj_attribute *kattr = container_of(attr,
                                        struct kobj_attribute, attr);

        kobject_get(kobj);
        if (kattr->store)
                ret = kattr->store(kobj, kattr, buf, count);
        kobject_put(kobj);
        return ret;
}

static const struct sysfs_ops ocfs2_filecheck_ops = {
        .show = ocfs2_filecheck_show,
        .store = ocfs2_filecheck_store,
};

static struct kobj_type ocfs2_ktype_filecheck = {
        .default_groups = ocfs2_filecheck_groups,
        .sysfs_ops = &ocfs2_filecheck_ops,
        .release = ocfs2_filecheck_release,
};

static void
ocfs2_filecheck_sysfs_free(struct ocfs2_filecheck_sysfs_entry *entry)
{
        struct ocfs2_filecheck_entry *p;

        spin_lock(&entry->fs_fcheck->fc_lock);
        while (!list_empty(&entry->fs_fcheck->fc_head)) {
                p = list_first_entry(&entry->fs_fcheck->fc_head,
                                     struct ocfs2_filecheck_entry, fe_list);
                list_del(&p->fe_list);
                BUG_ON(!p->fe_done); /* To free a undone file check entry */
                kfree(p);
        }
        spin_unlock(&entry->fs_fcheck->fc_lock);

        kfree(entry->fs_fcheck);
        entry->fs_fcheck = NULL;
}

int ocfs2_filecheck_create_sysfs(struct ocfs2_super *osb)
{
        int ret;
        struct ocfs2_filecheck *fcheck;
        struct ocfs2_filecheck_sysfs_entry *entry = &osb->osb_fc_ent;

        fcheck = kmalloc(sizeof(struct ocfs2_filecheck), GFP_NOFS);
        if (!fcheck)
                return -ENOMEM;

        INIT_LIST_HEAD(&fcheck->fc_head);
        spin_lock_init(&fcheck->fc_lock);
        fcheck->fc_max = OCFS2_FILECHECK_MINSIZE;
        fcheck->fc_size = 0;
        fcheck->fc_done = 0;

        entry->fs_kobj.kset = osb->osb_dev_kset;
        init_completion(&entry->fs_kobj_unregister);
        ret = kobject_init_and_add(&entry->fs_kobj, &ocfs2_ktype_filecheck,
                                        NULL, "filecheck");
        if (ret) {
                kobject_put(&entry->fs_kobj);
                kfree(fcheck);
                return ret;
        }

        entry->fs_fcheck = fcheck;
        return 0;
}

void ocfs2_filecheck_remove_sysfs(struct ocfs2_super *osb)
{
        if (!osb->osb_fc_ent.fs_fcheck)
                return;

        kobject_del(&osb->osb_fc_ent.fs_kobj);
        kobject_put(&osb->osb_fc_ent.fs_kobj);
        wait_for_completion(&osb->osb_fc_ent.fs_kobj_unregister);
        ocfs2_filecheck_sysfs_free(&osb->osb_fc_ent);
}

static int
ocfs2_filecheck_erase_entries(struct ocfs2_filecheck_sysfs_entry *ent,
                              unsigned int count);
static int
ocfs2_filecheck_adjust_max(struct ocfs2_filecheck_sysfs_entry *ent,
                           unsigned int len)
{
        int ret;

        if ((len < OCFS2_FILECHECK_MINSIZE) || (len > OCFS2_FILECHECK_MAXSIZE))
                return -EINVAL;

        spin_lock(&ent->fs_fcheck->fc_lock);
        if (len < (ent->fs_fcheck->fc_size - ent->fs_fcheck->fc_done)) {
                mlog(ML_NOTICE,
                "Cannot set online file check maximum entry number "
                "to %u due to too many pending entries(%u)\n",
                len, ent->fs_fcheck->fc_size - ent->fs_fcheck->fc_done);
                ret = -EBUSY;
        } else {
                if (len < ent->fs_fcheck->fc_size)
                        BUG_ON(!ocfs2_filecheck_erase_entries(ent,
                                ent->fs_fcheck->fc_size - len));

                ent->fs_fcheck->fc_max = len;
                ret = 0;
        }
        spin_unlock(&ent->fs_fcheck->fc_lock);

        return ret;
}

#define OCFS2_FILECHECK_ARGS_LEN        24
static int
ocfs2_filecheck_args_get_long(const char *buf, size_t count,
                              unsigned long *val)
{
        char buffer[OCFS2_FILECHECK_ARGS_LEN];

        memcpy(buffer, buf, count);
        buffer[count] = '\0';

        if (kstrtoul(buffer, 0, val))
                return 1;

        return 0;
}

static int
ocfs2_filecheck_type_parse(const char *name, unsigned int *type)
{
        if (!strncmp(name, "fix", 4))
                *type = OCFS2_FILECHECK_TYPE_FIX;
        else if (!strncmp(name, "check", 6))
                *type = OCFS2_FILECHECK_TYPE_CHK;
        else if (!strncmp(name, "set", 4))
                *type = OCFS2_FILECHECK_TYPE_SET;
        else
                return 1;

        return 0;
}

static int
ocfs2_filecheck_args_parse(const char *name, const char *buf, size_t count,
                           struct ocfs2_filecheck_args *args)
{
        unsigned long val = 0;
        unsigned int type;

        /* too short/long args length */
        if ((count < 1) || (count >= OCFS2_FILECHECK_ARGS_LEN))
                return 1;

        if (ocfs2_filecheck_type_parse(name, &type))
                return 1;
        if (ocfs2_filecheck_args_get_long(buf, count, &val))
                return 1;

        if (val <= 0)
                return 1;

        args->fa_type = type;
        if (type == OCFS2_FILECHECK_TYPE_SET)
                args->fa_len = (unsigned int)val;
        else
                args->fa_ino = val;

        return 0;
}

static ssize_t ocfs2_filecheck_attr_show(struct kobject *kobj,
                                    struct kobj_attribute *attr,
                                    char *buf)
{

        ssize_t ret = 0, total = 0, remain = PAGE_SIZE;
        unsigned int type;
        struct ocfs2_filecheck_entry *p;
        struct ocfs2_filecheck_sysfs_entry *ent = container_of(kobj,
                                struct ocfs2_filecheck_sysfs_entry, fs_kobj);

        if (ocfs2_filecheck_type_parse(attr->attr.name, &type))
                return -EINVAL;

        if (type == OCFS2_FILECHECK_TYPE_SET) {
                spin_lock(&ent->fs_fcheck->fc_lock);
                total = snprintf(buf, remain, "%u\n", ent->fs_fcheck->fc_max);
                spin_unlock(&ent->fs_fcheck->fc_lock);
                goto exit;
        }

        ret = snprintf(buf, remain, "INO\t\tDONE\tERROR\n");
        total += ret;
        remain -= ret;
        spin_lock(&ent->fs_fcheck->fc_lock);
        list_for_each_entry(p, &ent->fs_fcheck->fc_head, fe_list) {
                if (p->fe_type != type)
                        continue;

                ret = snprintf(buf + total, remain, "%lu\t\t%u\t%s\n",
                               p->fe_ino, p->fe_done,
                               ocfs2_filecheck_error(p->fe_status));
                if (ret >= remain) {
                        /* snprintf() didn't fit */
                        total = -E2BIG;
                        break;
                }
                total += ret;
                remain -= ret;
        }
        spin_unlock(&ent->fs_fcheck->fc_lock);

exit:
        return total;
}

static inline int
ocfs2_filecheck_is_dup_entry(struct ocfs2_filecheck_sysfs_entry *ent,
                                unsigned long ino)
{
        struct ocfs2_filecheck_entry *p;

        list_for_each_entry(p, &ent->fs_fcheck->fc_head, fe_list) {
                if (!p->fe_done) {
                        if (p->fe_ino == ino)
                                return 1;
                }
        }

        return 0;
}

static inline int
ocfs2_filecheck_erase_entry(struct ocfs2_filecheck_sysfs_entry *ent)
{
        struct ocfs2_filecheck_entry *p;

        list_for_each_entry(p, &ent->fs_fcheck->fc_head, fe_list) {
                if (p->fe_done) {
                        list_del(&p->fe_list);
                        kfree(p);
                        ent->fs_fcheck->fc_size--;
                        ent->fs_fcheck->fc_done--;
                        return 1;
                }
        }

        return 0;
}

static int
ocfs2_filecheck_erase_entries(struct ocfs2_filecheck_sysfs_entry *ent,
                              unsigned int count)
{
        unsigned int i = 0;
        unsigned int ret = 0;

        while (i++ < count) {
                if (ocfs2_filecheck_erase_entry(ent))
                        ret++;
                else
                        break;
        }

        return (ret == count ? 1 : 0);
}

static void
ocfs2_filecheck_done_entry(struct ocfs2_filecheck_sysfs_entry *ent,
                           struct ocfs2_filecheck_entry *entry)
{
        spin_lock(&ent->fs_fcheck->fc_lock);
        entry->fe_done = 1;
        ent->fs_fcheck->fc_done++;
        spin_unlock(&ent->fs_fcheck->fc_lock);
}

static unsigned int
ocfs2_filecheck_handle(struct ocfs2_super *osb,
                       unsigned long ino, unsigned int flags)
{
        unsigned int ret = OCFS2_FILECHECK_ERR_SUCCESS;
        struct inode *inode = NULL;
        int rc;

        inode = ocfs2_iget(osb, ino, flags, 0);
        if (IS_ERR(inode)) {
                rc = (int)(-(long)inode);
                if (rc >= OCFS2_FILECHECK_ERR_START &&
                    rc < OCFS2_FILECHECK_ERR_END)
                        ret = rc;
                else
                        ret = OCFS2_FILECHECK_ERR_FAILED;
        } else
                iput(inode);

        return ret;
}

static void
ocfs2_filecheck_handle_entry(struct ocfs2_filecheck_sysfs_entry *ent,
                             struct ocfs2_filecheck_entry *entry)
{
        struct ocfs2_super *osb = container_of(ent, struct ocfs2_super,
                                                osb_fc_ent);

        if (entry->fe_type == OCFS2_FILECHECK_TYPE_CHK)
                entry->fe_status = ocfs2_filecheck_handle(osb,
                                entry->fe_ino, OCFS2_FI_FLAG_FILECHECK_CHK);
        else if (entry->fe_type == OCFS2_FILECHECK_TYPE_FIX)
                entry->fe_status = ocfs2_filecheck_handle(osb,
                                entry->fe_ino, OCFS2_FI_FLAG_FILECHECK_FIX);
        else
                entry->fe_status = OCFS2_FILECHECK_ERR_UNSUPPORTED;

        ocfs2_filecheck_done_entry(ent, entry);
}

static ssize_t ocfs2_filecheck_attr_store(struct kobject *kobj,
                                     struct kobj_attribute *attr,
                                     const char *buf, size_t count)
{
        ssize_t ret = 0;
        struct ocfs2_filecheck_args args;
        struct ocfs2_filecheck_entry *entry;
        struct ocfs2_filecheck_sysfs_entry *ent = container_of(kobj,
                                struct ocfs2_filecheck_sysfs_entry, fs_kobj);

        if (count == 0)
                return count;

        if (ocfs2_filecheck_args_parse(attr->attr.name, buf, count, &args))
                return -EINVAL;

        if (args.fa_type == OCFS2_FILECHECK_TYPE_SET) {
                ret = ocfs2_filecheck_adjust_max(ent, args.fa_len);
                goto exit;
        }

        entry = kmalloc(sizeof(struct ocfs2_filecheck_entry), GFP_NOFS);
        if (!entry) {
                ret = -ENOMEM;
                goto exit;
        }

        spin_lock(&ent->fs_fcheck->fc_lock);
        if (ocfs2_filecheck_is_dup_entry(ent, args.fa_ino)) {
                ret = -EEXIST;
                kfree(entry);
        } else if ((ent->fs_fcheck->fc_size >= ent->fs_fcheck->fc_max) &&
                (ent->fs_fcheck->fc_done == 0)) {
                mlog(ML_NOTICE,
                "Cannot do more file check "
                "since file check queue(%u) is full now\n",
                ent->fs_fcheck->fc_max);
                ret = -EAGAIN;
                kfree(entry);
        } else {
                if ((ent->fs_fcheck->fc_size >= ent->fs_fcheck->fc_max) &&
                    (ent->fs_fcheck->fc_done > 0)) {
                        /* Delete the oldest entry which was done,
                         * make sure the entry size in list does
                         * not exceed maximum value
                         */
                        BUG_ON(!ocfs2_filecheck_erase_entry(ent));
                }

                entry->fe_ino = args.fa_ino;
                entry->fe_type = args.fa_type;
                entry->fe_done = 0;
                entry->fe_status = OCFS2_FILECHECK_ERR_INPROGRESS;
                list_add_tail(&entry->fe_list, &ent->fs_fcheck->fc_head);
                ent->fs_fcheck->fc_size++;
        }
        spin_unlock(&ent->fs_fcheck->fc_lock);

        if (!ret)
                ocfs2_filecheck_handle_entry(ent, entry);

exit:
        return (!ret ? count : ret);
}












































 5452 












































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _LINUX_BIO_INTEGRITY_H
#define _LINUX_BIO_INTEGRITY_H

#include <linux/bio.h>

enum bip_flags {
        BIP_BLOCK_INTEGRITY        = 1 << 0, /* block layer owns integrity data */
        BIP_MAPPED_INTEGRITY        = 1 << 1, /* ref tag has been remapped */
        BIP_CTRL_NOCHECK        = 1 << 2, /* disable HBA integrity checking */
        BIP_DISK_NOCHECK        = 1 << 3, /* disable disk integrity checking */
        BIP_IP_CHECKSUM                = 1 << 4, /* IP checksum */
        BIP_COPY_USER                = 1 << 5, /* Kernel bounce buffer in use */
};

struct bio_integrity_payload {
        struct bio                *bip_bio;        /* parent bio */

        struct bvec_iter        bip_iter;

        unsigned short                bip_vcnt;        /* # of integrity bio_vecs */
        unsigned short                bip_max_vcnt;        /* integrity bio_vec slots */
        unsigned short                bip_flags;        /* control flags */

        struct bvec_iter        bio_iter;        /* for rewinding parent bio */

        struct work_struct        bip_work;        /* I/O completion */

        struct bio_vec                *bip_vec;
        struct bio_vec                bip_inline_vecs[];/* embedded bvec array */
};

#ifdef CONFIG_BLK_DEV_INTEGRITY

#define bip_for_each_vec(bvl, bip, iter)                                \
        for_each_bvec(bvl, (bip)->bip_vec, iter, (bip)->bip_iter)

#define bio_for_each_integrity_vec(_bvl, _bio, _iter)                        \
        for_each_bio(_bio)                                                \
                bip_for_each_vec(_bvl, _bio->bi_integrity, _iter)

static inline struct bio_integrity_payload *bio_integrity(struct bio *bio)
{
        if (bio->bi_opf & REQ_INTEGRITY)
                return bio->bi_integrity;

        return NULL;
}

static inline bool bio_integrity_flagged(struct bio *bio, enum bip_flags flag)
{
        struct bio_integrity_payload *bip = bio_integrity(bio);

        if (bip)
                return bip->bip_flags & flag;

        return false;
}

static inline sector_t bip_get_seed(struct bio_integrity_payload *bip)
{
        return bip->bip_iter.bi_sector;
}

static inline void bip_set_seed(struct bio_integrity_payload *bip,
                                sector_t seed)
{
        bip->bip_iter.bi_sector = seed;
}

struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio, gfp_t gfp,
                unsigned int nr);
int bio_integrity_add_page(struct bio *bio, struct page *page, unsigned int len,
                unsigned int offset);
int bio_integrity_map_user(struct bio *bio, void __user *ubuf, ssize_t len, u32 seed);
void bio_integrity_unmap_user(struct bio *bio);
bool bio_integrity_prep(struct bio *bio);
void bio_integrity_advance(struct bio *bio, unsigned int bytes_done);
void bio_integrity_trim(struct bio *bio);
int bio_integrity_clone(struct bio *bio, struct bio *bio_src, gfp_t gfp_mask);
int bioset_integrity_create(struct bio_set *bs, int pool_size);
void bioset_integrity_free(struct bio_set *bs);
void bio_integrity_init(void);

#else /* CONFIG_BLK_DEV_INTEGRITY */

static inline struct bio_integrity_payload *bio_integrity(struct bio *bio)
{
        return NULL;
}

static inline int bioset_integrity_create(struct bio_set *bs, int pool_size)
{
        return 0;
}

static inline void bioset_integrity_free(struct bio_set *bs)
{
}

static inline int bio_integrity_map_user(struct bio *bio, void __user *ubuf,
                                         ssize_t len, u32 seed)
{
        return -EINVAL;
}

static inline void bio_integrity_unmap_user(struct bio *bio)
{
}

static inline bool bio_integrity_prep(struct bio *bio)
{
        return true;
}

static inline int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
                gfp_t gfp_mask)
{
        return 0;
}

static inline void bio_integrity_advance(struct bio *bio,
                unsigned int bytes_done)
{
}

static inline void bio_integrity_trim(struct bio *bio)
{
}

static inline void bio_integrity_init(void)
{
}

static inline bool bio_integrity_flagged(struct bio *bio, enum bip_flags flag)
{
        return false;
}

static inline struct bio_integrity_payload *
bio_integrity_alloc(struct bio *bio, gfp_t gfp, unsigned int nr)
{
        return ERR_PTR(-EINVAL);
}

static inline int bio_integrity_add_page(struct bio *bio, struct page *page,
                                        unsigned int len, unsigned int offset)
{
        return 0;
}
#endif /* CONFIG_BLK_DEV_INTEGRITY */
#endif /* _LINUX_BIO_INTEGRITY_H */





















































  227 






















  202 





  203 


  203 


















    5 
  198 
  203 


    2 
  156 




  139 
  139 

  139 


  138 






   53 


   53 

   53 
   52 




















  126 




  126 

  126 



  110 
   23 

    1 







  126 
  126 
    1 














  125 
















    1 












   55 




   55 

   55 
    6 





   55 

















   55 



   11 











   51 















   21 






   11 








    1 




    1 









    1 














    1 





















  239 

  238 
















  239 









  239 






















   27 








   27 
    1 
    1 
    1 

























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
// SPDX-License-Identifier: GPL-2.0-only
#include <linux/spinlock.h>
#include <linux/slab.h>
#include <linux/list.h>
#include <linux/list_bl.h>
#include <linux/module.h>
#include <linux/sched.h>
#include <linux/workqueue.h>
#include <linux/mbcache.h>

/*
 * Mbcache is a simple key-value store. Keys need not be unique, however
 * key-value pairs are expected to be unique (we use this fact in
 * mb_cache_entry_delete_or_get()).
 *
 * Ext2 and ext4 use this cache for deduplication of extended attribute blocks.
 * Ext4 also uses it for deduplication of xattr values stored in inodes.
 * They use hash of data as a key and provide a value that may represent a
 * block or inode number. That's why keys need not be unique (hash of different
 * data may be the same). However user provided value always uniquely
 * identifies a cache entry.
 *
 * We provide functions for creation and removal of entries, search by key,
 * and a special "delete entry with given key-value pair" operation. Fixed
 * size hash table is used for fast key lookups.
 */

struct mb_cache {
        /* Hash table of entries */
        struct hlist_bl_head        *c_hash;
        /* log2 of hash table size */
        int                        c_bucket_bits;
        /* Maximum entries in cache to avoid degrading hash too much */
        unsigned long                c_max_entries;
        /* Protects c_list, c_entry_count */
        spinlock_t                c_list_lock;
        struct list_head        c_list;
        /* Number of entries in cache */
        unsigned long                c_entry_count;
        struct shrinker                *c_shrink;
        /* Work for shrinking when the cache has too many entries */
        struct work_struct        c_shrink_work;
};

static struct kmem_cache *mb_entry_cache;

static unsigned long mb_cache_shrink(struct mb_cache *cache,
                                     unsigned long nr_to_scan);

static inline struct hlist_bl_head *mb_cache_entry_head(struct mb_cache *cache,
                                                        u32 key)
{
        return &cache->c_hash[hash_32(key, cache->c_bucket_bits)];
}

/*
 * Number of entries to reclaim synchronously when there are too many entries
 * in cache
 */
#define SYNC_SHRINK_BATCH 64

/*
 * mb_cache_entry_create - create entry in cache
 * @cache - cache where the entry should be created
 * @mask - gfp mask with which the entry should be allocated
 * @key - key of the entry
 * @value - value of the entry
 * @reusable - is the entry reusable by others?
 *
 * Creates entry in @cache with key @key and value @value. The function returns
 * -EBUSY if entry with the same key and value already exists in cache.
 * Otherwise 0 is returned.
 */
int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
                          u64 value, bool reusable)
{
        struct mb_cache_entry *entry, *dup;
        struct hlist_bl_node *dup_node;
        struct hlist_bl_head *head;

        /* Schedule background reclaim if there are too many entries */
        if (cache->c_entry_count >= cache->c_max_entries)
                schedule_work(&cache->c_shrink_work);
        /* Do some sync reclaim if background reclaim cannot keep up */
        if (cache->c_entry_count >= 2*cache->c_max_entries)
                mb_cache_shrink(cache, SYNC_SHRINK_BATCH);

        entry = kmem_cache_alloc(mb_entry_cache, mask);
        if (!entry)
                return -ENOMEM;

        INIT_LIST_HEAD(&entry->e_list);
        /*
         * We create entry with two references. One reference is kept by the
         * hash table, the other reference is used to protect us from
         * mb_cache_entry_delete_or_get() until the entry is fully setup. This
         * avoids nesting of cache->c_list_lock into hash table bit locks which
         * is problematic for RT.
         */
        atomic_set(&entry->e_refcnt, 2);
        entry->e_key = key;
        entry->e_value = value;
        entry->e_flags = 0;
        if (reusable)
                set_bit(MBE_REUSABLE_B, &entry->e_flags);
        head = mb_cache_entry_head(cache, key);
        hlist_bl_lock(head);
        hlist_bl_for_each_entry(dup, dup_node, head, e_hash_list) {
                if (dup->e_key == key && dup->e_value == value) {
                        hlist_bl_unlock(head);
                        kmem_cache_free(mb_entry_cache, entry);
                        return -EBUSY;
                }
        }
        hlist_bl_add_head(&entry->e_hash_list, head);
        hlist_bl_unlock(head);
        spin_lock(&cache->c_list_lock);
        list_add_tail(&entry->e_list, &cache->c_list);
        cache->c_entry_count++;
        spin_unlock(&cache->c_list_lock);
        mb_cache_entry_put(cache, entry);

        return 0;
}
EXPORT_SYMBOL(mb_cache_entry_create);

void __mb_cache_entry_free(struct mb_cache *cache, struct mb_cache_entry *entry)
{
        struct hlist_bl_head *head;

        head = mb_cache_entry_head(cache, entry->e_key);
        hlist_bl_lock(head);
        hlist_bl_del(&entry->e_hash_list);
        hlist_bl_unlock(head);
        kmem_cache_free(mb_entry_cache, entry);
}
EXPORT_SYMBOL(__mb_cache_entry_free);

/*
 * mb_cache_entry_wait_unused - wait to be the last user of the entry
 *
 * @entry - entry to work on
 *
 * Wait to be the last user of the entry.
 */
void mb_cache_entry_wait_unused(struct mb_cache_entry *entry)
{
        wait_var_event(&entry->e_refcnt, atomic_read(&entry->e_refcnt) <= 2);
}
EXPORT_SYMBOL(mb_cache_entry_wait_unused);

static struct mb_cache_entry *__entry_find(struct mb_cache *cache,
                                           struct mb_cache_entry *entry,
                                           u32 key)
{
        struct mb_cache_entry *old_entry = entry;
        struct hlist_bl_node *node;
        struct hlist_bl_head *head;

        head = mb_cache_entry_head(cache, key);
        hlist_bl_lock(head);
        if (entry && !hlist_bl_unhashed(&entry->e_hash_list))
                node = entry->e_hash_list.next;
        else
                node = hlist_bl_first(head);
        while (node) {
                entry = hlist_bl_entry(node, struct mb_cache_entry,
                                       e_hash_list);
                if (entry->e_key == key &&
                    test_bit(MBE_REUSABLE_B, &entry->e_flags) &&
                    atomic_inc_not_zero(&entry->e_refcnt))
                        goto out;
                node = node->next;
        }
        entry = NULL;
out:
        hlist_bl_unlock(head);
        if (old_entry)
                mb_cache_entry_put(cache, old_entry);

        return entry;
}

/*
 * mb_cache_entry_find_first - find the first reusable entry with the given key
 * @cache: cache where we should search
 * @key: key to look for
 *
 * Search in @cache for a reusable entry with key @key. Grabs reference to the
 * first reusable entry found and returns the entry.
 */
struct mb_cache_entry *mb_cache_entry_find_first(struct mb_cache *cache,
                                                 u32 key)
{
        return __entry_find(cache, NULL, key);
}
EXPORT_SYMBOL(mb_cache_entry_find_first);

/*
 * mb_cache_entry_find_next - find next reusable entry with the same key
 * @cache: cache where we should search
 * @entry: entry to start search from
 *
 * Finds next reusable entry in the hash chain which has the same key as @entry.
 * If @entry is unhashed (which can happen when deletion of entry races with the
 * search), finds the first reusable entry in the hash chain. The function drops
 * reference to @entry and returns with a reference to the found entry.
 */
struct mb_cache_entry *mb_cache_entry_find_next(struct mb_cache *cache,
                                                struct mb_cache_entry *entry)
{
        return __entry_find(cache, entry, entry->e_key);
}
EXPORT_SYMBOL(mb_cache_entry_find_next);

/*
 * mb_cache_entry_get - get a cache entry by value (and key)
 * @cache - cache we work with
 * @key - key
 * @value - value
 */
struct mb_cache_entry *mb_cache_entry_get(struct mb_cache *cache, u32 key,
                                          u64 value)
{
        struct hlist_bl_node *node;
        struct hlist_bl_head *head;
        struct mb_cache_entry *entry;

        head = mb_cache_entry_head(cache, key);
        hlist_bl_lock(head);
        hlist_bl_for_each_entry(entry, node, head, e_hash_list) {
                if (entry->e_key == key && entry->e_value == value &&
                    atomic_inc_not_zero(&entry->e_refcnt))
                        goto out;
        }
        entry = NULL;
out:
        hlist_bl_unlock(head);
        return entry;
}
EXPORT_SYMBOL(mb_cache_entry_get);

/* mb_cache_entry_delete_or_get - remove a cache entry if it has no users
 * @cache - cache we work with
 * @key - key
 * @value - value
 *
 * Remove entry from cache @cache with key @key and value @value. The removal
 * happens only if the entry is unused. The function returns NULL in case the
 * entry was successfully removed or there's no entry in cache. Otherwise the
 * function grabs reference of the entry that we failed to delete because it
 * still has users and return it.
 */
struct mb_cache_entry *mb_cache_entry_delete_or_get(struct mb_cache *cache,
                                                    u32 key, u64 value)
{
        struct mb_cache_entry *entry;

        entry = mb_cache_entry_get(cache, key, value);
        if (!entry)
                return NULL;

        /*
         * Drop the ref we got from mb_cache_entry_get() and the initial hash
         * ref if we are the last user
         */
        if (atomic_cmpxchg(&entry->e_refcnt, 2, 0) != 2)
                return entry;

        spin_lock(&cache->c_list_lock);
        if (!list_empty(&entry->e_list))
                list_del_init(&entry->e_list);
        cache->c_entry_count--;
        spin_unlock(&cache->c_list_lock);
        __mb_cache_entry_free(cache, entry);
        return NULL;
}
EXPORT_SYMBOL(mb_cache_entry_delete_or_get);

/* mb_cache_entry_touch - cache entry got used
 * @cache - cache the entry belongs to
 * @entry - entry that got used
 *
 * Marks entry as used to give hit higher chances of surviving in cache.
 */
void mb_cache_entry_touch(struct mb_cache *cache,
                          struct mb_cache_entry *entry)
{
        set_bit(MBE_REFERENCED_B, &entry->e_flags);
}
EXPORT_SYMBOL(mb_cache_entry_touch);

static unsigned long mb_cache_count(struct shrinker *shrink,
                                    struct shrink_control *sc)
{
        struct mb_cache *cache = shrink->private_data;

        return cache->c_entry_count;
}

/* Shrink number of entries in cache */
static unsigned long mb_cache_shrink(struct mb_cache *cache,
                                     unsigned long nr_to_scan)
{
        struct mb_cache_entry *entry;
        unsigned long shrunk = 0;

        spin_lock(&cache->c_list_lock);
        while (nr_to_scan-- && !list_empty(&cache->c_list)) {
                entry = list_first_entry(&cache->c_list,
                                         struct mb_cache_entry, e_list);
                /* Drop initial hash reference if there is no user */
                if (test_bit(MBE_REFERENCED_B, &entry->e_flags) ||
                    atomic_cmpxchg(&entry->e_refcnt, 1, 0) != 1) {
                        clear_bit(MBE_REFERENCED_B, &entry->e_flags);
                        list_move_tail(&entry->e_list, &cache->c_list);
                        continue;
                }
                list_del_init(&entry->e_list);
                cache->c_entry_count--;
                spin_unlock(&cache->c_list_lock);
                __mb_cache_entry_free(cache, entry);
                shrunk++;
                cond_resched();
                spin_lock(&cache->c_list_lock);
        }
        spin_unlock(&cache->c_list_lock);

        return shrunk;
}

static unsigned long mb_cache_scan(struct shrinker *shrink,
                                   struct shrink_control *sc)
{
        struct mb_cache *cache = shrink->private_data;
        return mb_cache_shrink(cache, sc->nr_to_scan);
}

/* We shrink 1/X of the cache when we have too many entries in it */
#define SHRINK_DIVISOR 16

static void mb_cache_shrink_worker(struct work_struct *work)
{
        struct mb_cache *cache = container_of(work, struct mb_cache,
                                              c_shrink_work);
        mb_cache_shrink(cache, cache->c_max_entries / SHRINK_DIVISOR);
}

/*
 * mb_cache_create - create cache
 * @bucket_bits: log2 of the hash table size
 *
 * Create cache for keys with 2^bucket_bits hash entries.
 */
struct mb_cache *mb_cache_create(int bucket_bits)
{
        struct mb_cache *cache;
        unsigned long bucket_count = 1UL << bucket_bits;
        unsigned long i;

        cache = kzalloc(sizeof(struct mb_cache), GFP_KERNEL);
        if (!cache)
                goto err_out;
        cache->c_bucket_bits = bucket_bits;
        cache->c_max_entries = bucket_count << 4;
        INIT_LIST_HEAD(&cache->c_list);
        spin_lock_init(&cache->c_list_lock);
        cache->c_hash = kmalloc_array(bucket_count,
                                      sizeof(struct hlist_bl_head),
                                      GFP_KERNEL);
        if (!cache->c_hash) {
                kfree(cache);
                goto err_out;
        }
        for (i = 0; i < bucket_count; i++)
                INIT_HLIST_BL_HEAD(&cache->c_hash[i]);

        cache->c_shrink = shrinker_alloc(0, "mbcache-shrinker");
        if (!cache->c_shrink) {
                kfree(cache->c_hash);
                kfree(cache);
                goto err_out;
        }

        cache->c_shrink->count_objects = mb_cache_count;
        cache->c_shrink->scan_objects = mb_cache_scan;
        cache->c_shrink->private_data = cache;

        shrinker_register(cache->c_shrink);

        INIT_WORK(&cache->c_shrink_work, mb_cache_shrink_worker);

        return cache;

err_out:
        return NULL;
}
EXPORT_SYMBOL(mb_cache_create);

/*
 * mb_cache_destroy - destroy cache
 * @cache: the cache to destroy
 *
 * Free all entries in cache and cache itself. Caller must make sure nobody
 * (except shrinker) can reach @cache when calling this.
 */
void mb_cache_destroy(struct mb_cache *cache)
{
        struct mb_cache_entry *entry, *next;

        shrinker_free(cache->c_shrink);

        /*
         * We don't bother with any locking. Cache must not be used at this
         * point.
         */
        list_for_each_entry_safe(entry, next, &cache->c_list, e_list) {
                list_del(&entry->e_list);
                WARN_ON(atomic_read(&entry->e_refcnt) != 1);
                mb_cache_entry_put(cache, entry);
        }
        kfree(cache->c_hash);
        kfree(cache);
}
EXPORT_SYMBOL(mb_cache_destroy);

static int __init mbcache_init(void)
{
        mb_entry_cache = KMEM_CACHE(mb_cache_entry, SLAB_RECLAIM_ACCOUNT);
        if (!mb_entry_cache)
                return -ENOMEM;
        return 0;
}

static void __exit mbcache_exit(void)
{
        kmem_cache_destroy(mb_entry_cache);
}

module_init(mbcache_init)
module_exit(mbcache_exit)

MODULE_AUTHOR("Jan Kara <jack@suse.cz>");
MODULE_DESCRIPTION("Meta block cache (for extended attributes)");
MODULE_LICENSE("GPL");
























































































































































































































































































































































































































































































































































































































































































































































































































































































































  177 



















1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Copyright (c) 2000-2001,2005 Silicon Graphics, Inc.
 * Copyright (c) 2013 Red Hat, Inc.
 * All Rights Reserved.
 */
#ifndef __XFS_DA_FORMAT_H__
#define __XFS_DA_FORMAT_H__

/*
 * This structure is common to both leaf nodes and non-leaf nodes in the Btree.
 *
 * It is used to manage a doubly linked list of all blocks at the same
 * level in the Btree, and to identify which type of block this is.
 */
#define XFS_DA_NODE_MAGIC        0xfebe        /* magic number: non-leaf blocks */
#define XFS_ATTR_LEAF_MAGIC        0xfbee        /* magic number: attribute leaf blks */
#define XFS_DIR2_LEAF1_MAGIC        0xd2f1        /* magic number: v2 dirlf single blks */
#define XFS_DIR2_LEAFN_MAGIC        0xd2ff        /* magic number: v2 dirlf multi blks */

typedef struct xfs_da_blkinfo {
        __be32                forw;                        /* previous block in list */
        __be32                back;                        /* following block in list */
        __be16                magic;                        /* validity check on block */
        __be16                pad;                        /* unused */
} xfs_da_blkinfo_t;

/*
 * CRC enabled directory structure types
 *
 * The headers change size for the additional verification information, but
 * otherwise the tree layouts and contents are unchanged. Hence the da btree
 * code can use the struct xfs_da_blkinfo for manipulating the tree links and
 * magic numbers without modification for both v2 and v3 nodes.
 */
#define XFS_DA3_NODE_MAGIC        0x3ebe        /* magic number: non-leaf blocks */
#define XFS_ATTR3_LEAF_MAGIC        0x3bee        /* magic number: attribute leaf blks */
#define XFS_DIR3_LEAF1_MAGIC        0x3df1        /* magic number: v3 dirlf single blks */
#define XFS_DIR3_LEAFN_MAGIC        0x3dff        /* magic number: v3 dirlf multi blks */

struct xfs_da3_blkinfo {
        /*
         * the node link manipulation code relies on the fact that the first
         * element of this structure is the struct xfs_da_blkinfo so it can
         * ignore the differences in the rest of the structures.
         */
        struct xfs_da_blkinfo        hdr;
        __be32                        crc;        /* CRC of block */
        __be64                        blkno;        /* first block of the buffer */
        __be64                        lsn;        /* sequence number of last write */
        uuid_t                        uuid;        /* filesystem we belong to */
        __be64                        owner;        /* inode that owns the block */
};

/*
 * This is the structure of the root and intermediate nodes in the Btree.
 * The leaf nodes are defined above.
 *
 * Entries are not packed.
 *
 * Since we have duplicate keys, use a binary search but always follow
 * all match in the block, not just the first match found.
 */
#define XFS_DA_NODE_MAXDEPTH        5        /* max depth of Btree */

typedef struct xfs_da_node_hdr {
        struct xfs_da_blkinfo        info;        /* block type, links, etc. */
        __be16                        __count; /* count of active entries */
        __be16                        __level; /* level above leaves (leaf == 0) */
} xfs_da_node_hdr_t;

struct xfs_da3_node_hdr {
        struct xfs_da3_blkinfo        info;        /* block type, links, etc. */
        __be16                        __count; /* count of active entries */
        __be16                        __level; /* level above leaves (leaf == 0) */
        __be32                        __pad32;
};

#define XFS_DA3_NODE_CRC_OFF        (offsetof(struct xfs_da3_node_hdr, info.crc))

typedef struct xfs_da_node_entry {
        __be32        hashval;        /* hash value for this descendant */
        __be32        before;                /* Btree block before this key */
} xfs_da_node_entry_t;

typedef struct xfs_da_intnode {
        struct xfs_da_node_hdr        hdr;
        struct xfs_da_node_entry __btree[];
} xfs_da_intnode_t;

struct xfs_da3_intnode {
        struct xfs_da3_node_hdr        hdr;
        struct xfs_da_node_entry __btree[];
};

/*
 * Directory version 2.
 *
 * There are 4 possible formats:
 *  - shortform - embedded into the inode
 *  - single block - data with embedded leaf at the end
 *  - multiple data blocks, single leaf+freeindex block
 *  - data blocks, node and leaf blocks (btree), freeindex blocks
 *
 * Note: many node blocks structures and constants are shared with the attr
 * code and defined in xfs_da_btree.h.
 */

#define        XFS_DIR2_BLOCK_MAGIC        0x58443242        /* XD2B: single block dirs */
#define        XFS_DIR2_DATA_MAGIC        0x58443244        /* XD2D: multiblock dirs */
#define        XFS_DIR2_FREE_MAGIC        0x58443246        /* XD2F: free index blocks */

/*
 * Directory Version 3 With CRCs.
 *
 * The tree formats are the same as for version 2 directories.  The difference
 * is in the block header and dirent formats. In many cases the v3 structures
 * use v2 definitions as they are no different and this makes code sharing much
 * easier.
 *
 * Also, the xfs_dir3_*() functions handle both v2 and v3 formats - if the
 * format is v2 then they switch to the existing v2 code, or the format is v3
 * they implement the v3 functionality. This means the existing dir2 is a mix of
 * xfs_dir2/xfs_dir3 calls and functions. The xfs_dir3 functions are called
 * where there is a difference in the formats, otherwise the code is unchanged.
 *
 * Where it is possible, the code decides what to do based on the magic numbers
 * in the blocks rather than feature bits in the superblock. This means the code
 * is as independent of the external XFS code as possible as doesn't require
 * passing struct xfs_mount pointers into places where it isn't really
 * necessary.
 *
 * Version 3 includes:
 *
 *        - a larger block header for CRC and identification purposes and so the
 *        offsets of all the structures inside the blocks are different.
 *
 *        - new magic numbers to be able to detect the v2/v3 types on the fly.
 */

#define        XFS_DIR3_BLOCK_MAGIC        0x58444233        /* XDB3: single block dirs */
#define        XFS_DIR3_DATA_MAGIC        0x58444433        /* XDD3: multiblock dirs */
#define        XFS_DIR3_FREE_MAGIC        0x58444633        /* XDF3: free index blocks */

/*
 * Dirents in version 3 directories have a file type field. Additions to this
 * list are an on-disk format change, requiring feature bits. Valid values
 * are as follows:
 */
#define XFS_DIR3_FT_UNKNOWN                0
#define XFS_DIR3_FT_REG_FILE                1
#define XFS_DIR3_FT_DIR                        2
#define XFS_DIR3_FT_CHRDEV                3
#define XFS_DIR3_FT_BLKDEV                4
#define XFS_DIR3_FT_FIFO                5
#define XFS_DIR3_FT_SOCK                6
#define XFS_DIR3_FT_SYMLINK                7
#define XFS_DIR3_FT_WHT                        8

#define XFS_DIR3_FT_MAX                        9

#define XFS_DIR3_FTYPE_STR \
        { XFS_DIR3_FT_UNKNOWN,        "unknown" }, \
        { XFS_DIR3_FT_REG_FILE,        "file" }, \
        { XFS_DIR3_FT_DIR,        "directory" }, \
        { XFS_DIR3_FT_CHRDEV,        "char" }, \
        { XFS_DIR3_FT_BLKDEV,        "block" }, \
        { XFS_DIR3_FT_FIFO,        "fifo" }, \
        { XFS_DIR3_FT_SOCK,        "sock" }, \
        { XFS_DIR3_FT_SYMLINK,        "symlink" }, \
        { XFS_DIR3_FT_WHT,        "whiteout" }

/*
 * Byte offset in data block and shortform entry.
 */
typedef uint16_t        xfs_dir2_data_off_t;
#define        NULLDATAOFF        0xffffU
typedef uint                xfs_dir2_data_aoff_t;        /* argument form */

/*
 * Offset in data space of a data entry.
 */
typedef uint32_t        xfs_dir2_dataptr_t;
#define        XFS_DIR2_MAX_DATAPTR        ((xfs_dir2_dataptr_t)0xffffffff)
#define        XFS_DIR2_NULL_DATAPTR        ((xfs_dir2_dataptr_t)0)

/*
 * Byte offset in a directory.
 */
typedef        xfs_off_t        xfs_dir2_off_t;

/*
 * Directory block number (logical dirblk in file)
 */
typedef uint32_t        xfs_dir2_db_t;

#define XFS_INO32_SIZE        4
#define XFS_INO64_SIZE        8
#define XFS_INO64_DIFF        (XFS_INO64_SIZE - XFS_INO32_SIZE)

#define        XFS_DIR2_MAX_SHORT_INUM        ((xfs_ino_t)0xffffffffULL)

/*
 * Directory layout when stored internal to an inode.
 *
 * Small directories are packed as tightly as possible so as to fit into the
 * literal area of the inode.  These "shortform" directories consist of a
 * single xfs_dir2_sf_hdr header followed by zero or more xfs_dir2_sf_entry
 * structures.  Due the different inode number storage size and the variable
 * length name field in the xfs_dir2_sf_entry all these structure are
 * variable length, and the accessors in this file should be used to iterate
 * over them.
 */
typedef struct xfs_dir2_sf_hdr {
        uint8_t                        count;                /* count of entries */
        uint8_t                        i8count;        /* count of 8-byte inode #s */
        uint8_t                        parent[8];        /* parent dir inode number */
} __packed xfs_dir2_sf_hdr_t;

typedef struct xfs_dir2_sf_entry {
        __u8                        namelen;        /* actual name length */
        __u8                        offset[2];        /* saved offset */
        __u8                        name[];                /* name, variable size */
        /*
         * A single byte containing the file type field follows the inode
         * number for version 3 directory entries.
         *
         * A 64-bit or 32-bit inode number follows here, at a variable offset
         * after the name.
         */
} __packed xfs_dir2_sf_entry_t;

static inline int xfs_dir2_sf_hdr_size(int i8count)
{
        return sizeof(struct xfs_dir2_sf_hdr) -
                (i8count == 0) * XFS_INO64_DIFF;
}

static inline xfs_dir2_data_aoff_t
xfs_dir2_sf_get_offset(xfs_dir2_sf_entry_t *sfep)
{
        return get_unaligned_be16(sfep->offset);
}

static inline void
xfs_dir2_sf_put_offset(xfs_dir2_sf_entry_t *sfep, xfs_dir2_data_aoff_t off)
{
        put_unaligned_be16(off, sfep->offset);
}

static inline struct xfs_dir2_sf_entry *
xfs_dir2_sf_firstentry(struct xfs_dir2_sf_hdr *hdr)
{
        return (struct xfs_dir2_sf_entry *)
                ((char *)hdr + xfs_dir2_sf_hdr_size(hdr->i8count));
}

/*
 * Data block structures.
 *
 * A pure data block looks like the following drawing on disk:
 *
 *    +-------------------------------------------------+
 *    | xfs_dir2_data_hdr_t                             |
 *    +-------------------------------------------------+
 *    | xfs_dir2_data_entry_t OR xfs_dir2_data_unused_t |
 *    | xfs_dir2_data_entry_t OR xfs_dir2_data_unused_t |
 *    | xfs_dir2_data_entry_t OR xfs_dir2_data_unused_t |
 *    | ...                                             |
 *    +-------------------------------------------------+
 *    | unused space                                    |
 *    +-------------------------------------------------+
 *
 * As all the entries are variable size structures the accessors below should
 * be used to iterate over them.
 *
 * In addition to the pure data blocks for the data and node formats,
 * most structures are also used for the combined data/freespace "block"
 * format below.
 */

#define        XFS_DIR2_DATA_ALIGN_LOG        3                /* i.e., 8 bytes */
#define        XFS_DIR2_DATA_ALIGN        (1 << XFS_DIR2_DATA_ALIGN_LOG)
#define        XFS_DIR2_DATA_FREE_TAG        0xffff
#define        XFS_DIR2_DATA_FD_COUNT        3

/*
 * Directory address space divided into sections,
 * spaces separated by 32GB.
 */
#define        XFS_DIR2_MAX_SPACES        3
#define        XFS_DIR2_SPACE_SIZE        (1ULL << (32 + XFS_DIR2_DATA_ALIGN_LOG))
#define        XFS_DIR2_DATA_SPACE        0
#define        XFS_DIR2_DATA_OFFSET        (XFS_DIR2_DATA_SPACE * XFS_DIR2_SPACE_SIZE)

/*
 * Describe a free area in the data block.
 *
 * The freespace will be formatted as a xfs_dir2_data_unused_t.
 */
typedef struct xfs_dir2_data_free {
        __be16                        offset;                /* start of freespace */
        __be16                        length;                /* length of freespace */
} xfs_dir2_data_free_t;

/*
 * Header for the data blocks.
 *
 * The code knows that XFS_DIR2_DATA_FD_COUNT is 3.
 */
typedef struct xfs_dir2_data_hdr {
        __be32                        magic;                /* XFS_DIR2_DATA_MAGIC or */
                                                /* XFS_DIR2_BLOCK_MAGIC */
        xfs_dir2_data_free_t        bestfree[XFS_DIR2_DATA_FD_COUNT];
} xfs_dir2_data_hdr_t;

/*
 * define a structure for all the verification fields we are adding to the
 * directory block structures. This will be used in several structures.
 * The magic number must be the first entry to align with all the dir2
 * structures so we determine how to decode them just by the magic number.
 */
struct xfs_dir3_blk_hdr {
        __be32                        magic;        /* magic number */
        __be32                        crc;        /* CRC of block */
        __be64                        blkno;        /* first block of the buffer */
        __be64                        lsn;        /* sequence number of last write */
        uuid_t                        uuid;        /* filesystem we belong to */
        __be64                        owner;        /* inode that owns the block */
};

struct xfs_dir3_data_hdr {
        struct xfs_dir3_blk_hdr        hdr;
        xfs_dir2_data_free_t        best_free[XFS_DIR2_DATA_FD_COUNT];
        __be32                        pad;        /* 64 bit alignment */
};

#define XFS_DIR3_DATA_CRC_OFF  offsetof(struct xfs_dir3_data_hdr, hdr.crc)

/*
 * Active entry in a data block.
 *
 * Aligned to 8 bytes.  After the variable length name field there is a
 * 2 byte tag field, which can be accessed using xfs_dir3_data_entry_tag_p.
 *
 * For dir3 structures, there is file type field between the name and the tag.
 * This can only be manipulated by helper functions. It is packed hard against
 * the end of the name so any padding for rounding is between the file type and
 * the tag.
 */
typedef struct xfs_dir2_data_entry {
        __be64                        inumber;        /* inode number */
        __u8                        namelen;        /* name length */
        __u8                        name[];                /* name bytes, no null */
     /* __u8                        filetype; */        /* type of inode we point to */
     /*        __be16                  tag; */                /* starting offset of us */
} xfs_dir2_data_entry_t;

/*
 * Unused entry in a data block.
 *
 * Aligned to 8 bytes.  Tag appears as the last 2 bytes and must be accessed
 * using xfs_dir2_data_unused_tag_p.
 */
typedef struct xfs_dir2_data_unused {
        __be16                        freetag;        /* XFS_DIR2_DATA_FREE_TAG */
        __be16                        length;                /* total free length */
                                                /* variable offset */
        __be16                        tag;                /* starting offset of us */
} xfs_dir2_data_unused_t;

/*
 * Pointer to a freespace's tag word.
 */
static inline __be16 *
xfs_dir2_data_unused_tag_p(struct xfs_dir2_data_unused *dup)
{
        return (__be16 *)((char *)dup +
                        be16_to_cpu(dup->length) - sizeof(__be16));
}

/*
 * Leaf block structures.
 *
 * A pure leaf block looks like the following drawing on disk:
 *
 *    +---------------------------+
 *    | xfs_dir2_leaf_hdr_t       |
 *    +---------------------------+
 *    | xfs_dir2_leaf_entry_t     |
 *    | xfs_dir2_leaf_entry_t     |
 *    | xfs_dir2_leaf_entry_t     |
 *    | xfs_dir2_leaf_entry_t     |
 *    | ...                       |
 *    +---------------------------+
 *    | xfs_dir2_data_off_t       |
 *    | xfs_dir2_data_off_t       |
 *    | xfs_dir2_data_off_t       |
 *    | ...                       |
 *    +---------------------------+
 *    | xfs_dir2_leaf_tail_t      |
 *    +---------------------------+
 *
 * The xfs_dir2_data_off_t members (bests) and tail are at the end of the block
 * for single-leaf (magic = XFS_DIR2_LEAF1_MAGIC) blocks only, but not present
 * for directories with separate leaf nodes and free space blocks
 * (magic = XFS_DIR2_LEAFN_MAGIC).
 *
 * As all the entries are variable size structures the accessors below should
 * be used to iterate over them.
 */

/*
 * Offset of the leaf/node space.  First block in this space
 * is the btree root.
 */
#define        XFS_DIR2_LEAF_SPACE        1
#define        XFS_DIR2_LEAF_OFFSET        (XFS_DIR2_LEAF_SPACE * XFS_DIR2_SPACE_SIZE)

/*
 * Leaf block header.
 */
typedef struct xfs_dir2_leaf_hdr {
        xfs_da_blkinfo_t        info;                /* header for da routines */
        __be16                        count;                /* count of entries */
        __be16                        stale;                /* count of stale entries */
} xfs_dir2_leaf_hdr_t;

struct xfs_dir3_leaf_hdr {
        struct xfs_da3_blkinfo        info;                /* header for da routines */
        __be16                        count;                /* count of entries */
        __be16                        stale;                /* count of stale entries */
        __be32                        pad;                /* 64 bit alignment */
};

/*
 * Leaf block entry.
 */
typedef struct xfs_dir2_leaf_entry {
        __be32                        hashval;        /* hash value of name */
        __be32                        address;        /* address of data entry */
} xfs_dir2_leaf_entry_t;

/*
 * Leaf block tail.
 */
typedef struct xfs_dir2_leaf_tail {
        __be32                        bestcount;
} xfs_dir2_leaf_tail_t;

/*
 * Leaf block.
 */
typedef struct xfs_dir2_leaf {
        xfs_dir2_leaf_hdr_t        hdr;                        /* leaf header */
        xfs_dir2_leaf_entry_t        __ents[];                /* entries */
} xfs_dir2_leaf_t;

struct xfs_dir3_leaf {
        struct xfs_dir3_leaf_hdr        hdr;                /* leaf header */
        struct xfs_dir2_leaf_entry        __ents[];        /* entries */
};

#define XFS_DIR3_LEAF_CRC_OFF  offsetof(struct xfs_dir3_leaf_hdr, info.crc)

/*
 * Get address of the bests array in the single-leaf block.
 */
static inline __be16 *
xfs_dir2_leaf_bests_p(struct xfs_dir2_leaf_tail *ltp)
{
        return (__be16 *)ltp - be32_to_cpu(ltp->bestcount);
}

/*
 * Free space block definitions for the node format.
 */

/*
 * Offset of the freespace index.
 */
#define        XFS_DIR2_FREE_SPACE        2
#define        XFS_DIR2_FREE_OFFSET        (XFS_DIR2_FREE_SPACE * XFS_DIR2_SPACE_SIZE)

typedef        struct xfs_dir2_free_hdr {
        __be32                        magic;                /* XFS_DIR2_FREE_MAGIC */
        __be32                        firstdb;        /* db of first entry */
        __be32                        nvalid;                /* count of valid entries */
        __be32                        nused;                /* count of used entries */
} xfs_dir2_free_hdr_t;

typedef struct xfs_dir2_free {
        xfs_dir2_free_hdr_t        hdr;                /* block header */
        __be16                        bests[];        /* best free counts */
                                                /* unused entries are -1 */
} xfs_dir2_free_t;

struct xfs_dir3_free_hdr {
        struct xfs_dir3_blk_hdr        hdr;
        __be32                        firstdb;        /* db of first entry */
        __be32                        nvalid;                /* count of valid entries */
        __be32                        nused;                /* count of used entries */
        __be32                        pad;                /* 64 bit alignment */
};

struct xfs_dir3_free {
        struct xfs_dir3_free_hdr hdr;
        __be16                        bests[];        /* best free counts */
                                                /* unused entries are -1 */
};

#define XFS_DIR3_FREE_CRC_OFF  offsetof(struct xfs_dir3_free, hdr.hdr.crc)

/*
 * Single block format.
 *
 * The single block format looks like the following drawing on disk:
 *
 *    +-------------------------------------------------+
 *    | xfs_dir2_data_hdr_t                             |
 *    +-------------------------------------------------+
 *    | xfs_dir2_data_entry_t OR xfs_dir2_data_unused_t |
 *    | xfs_dir2_data_entry_t OR xfs_dir2_data_unused_t |
 *    | xfs_dir2_data_entry_t OR xfs_dir2_data_unused_t :
 *    | ...                                             |
 *    +-------------------------------------------------+
 *    | unused space                                    |
 *    +-------------------------------------------------+
 *    | ...                                             |
 *    | xfs_dir2_leaf_entry_t                           |
 *    | xfs_dir2_leaf_entry_t                           |
 *    +-------------------------------------------------+
 *    | xfs_dir2_block_tail_t                           |
 *    +-------------------------------------------------+
 *
 * As all the entries are variable size structures the accessors below should
 * be used to iterate over them.
 */

typedef struct xfs_dir2_block_tail {
        __be32                count;                        /* count of leaf entries */
        __be32                stale;                        /* count of stale lf entries */
} xfs_dir2_block_tail_t;

/*
 * Pointer to the leaf entries embedded in a data block (1-block format)
 */
static inline struct xfs_dir2_leaf_entry *
xfs_dir2_block_leaf_p(struct xfs_dir2_block_tail *btp)
{
        return ((struct xfs_dir2_leaf_entry *)btp) - be32_to_cpu(btp->count);
}


/*
 * Attribute storage layout
 *
 * Attribute lists are structured around Btrees where all the data
 * elements are in the leaf nodes.  Attribute names are hashed into an int,
 * then that int is used as the index into the Btree.  Since the hashval
 * of an attribute name may not be unique, we may have duplicate keys.  The
 * internal links in the Btree are logical block offsets into the file.
 *
 * Struct leaf_entry's are packed from the top.  Name/values grow from the
 * bottom but are not packed.  The freemap contains run-length-encoded entries
 * for the free bytes after the leaf_entry's, but only the N largest such,
 * smaller runs are dropped.  When the freemap doesn't show enough space
 * for an allocation, we compact the name/value area and try again.  If we
 * still don't have enough space, then we have to split the block.  The
 * name/value structs (both local and remote versions) must be 32bit aligned.
 *
 * Since we have duplicate hash keys, for each key that matches, compare
 * the actual name string.  The root and intermediate node search always
 * takes the first-in-the-block key match found, so we should only have
 * to work "forw"ard.  If none matches, continue with the "forw"ard leaf
 * nodes until the hash key changes or the attribute name is found.
 *
 * We store the fact that an attribute is a ROOT/USER/SECURE attribute in
 * the leaf_entry.  The namespaces are independent only because we also look
 * at the namespace bit when we are looking for a matching attribute name.
 *
 * We also store an "incomplete" bit in the leaf_entry.  It shows that an
 * attribute is in the middle of being created and should not be shown to
 * the user if we crash during the time that the bit is set.  We clear the
 * bit when we have finished setting up the attribute.  We do this because
 * we cannot create some large attributes inside a single transaction, and we
 * need some indication that we weren't finished if we crash in the middle.
 */
#define XFS_ATTR_LEAF_MAPSIZE        3        /* how many freespace slots */

/*
 * Attribute storage when stored inside the inode.
 *
 * Small attribute lists are packed as tightly as possible so as to fit into the
 * literal area of the inode.
 *
 * These "shortform" attribute forks consist of a single xfs_attr_sf_hdr header
 * followed by zero or more xfs_attr_sf_entry structures.
 */
struct xfs_attr_sf_hdr {        /* constant-structure header block */
        __be16        totsize;        /* total bytes in shortform list */
        __u8        count;                /* count of active entries */
        __u8        padding;
};

struct xfs_attr_sf_entry {
        __u8        namelen;        /* actual length of name (no NULL) */
        __u8        valuelen;        /* actual length of value (no NULL) */
        __u8        flags;                /* flags bits (XFS_ATTR_*) */
        __u8        nameval[];        /* name & value bytes concatenated */
};

typedef struct xfs_attr_leaf_map {        /* RLE map of free bytes */
        __be16        base;                          /* base of free region */
        __be16        size;                          /* length of free region */
} xfs_attr_leaf_map_t;

typedef struct xfs_attr_leaf_hdr {        /* constant-structure header block */
        xfs_da_blkinfo_t info;                /* block type, links, etc. */
        __be16        count;                        /* count of active leaf_entry's */
        __be16        usedbytes;                /* num bytes of names/values stored */
        __be16        firstused;                /* first used byte in name area */
        __u8        holes;                        /* != 0 if blk needs compaction */
        __u8        pad1;
        xfs_attr_leaf_map_t freemap[XFS_ATTR_LEAF_MAPSIZE];
                                        /* N largest free regions */
} xfs_attr_leaf_hdr_t;

typedef struct xfs_attr_leaf_entry {        /* sorted on key, not name */
        __be32        hashval;                /* hash value of name */
        __be16        nameidx;                /* index into buffer of name/value */
        __u8        flags;                        /* LOCAL/ROOT/SECURE/INCOMPLETE flag */
        __u8        pad2;                        /* unused pad byte */
} xfs_attr_leaf_entry_t;

typedef struct xfs_attr_leaf_name_local {
        __be16        valuelen;                /* number of bytes in value */
        __u8        namelen;                /* length of name bytes */
        /*
         * In Linux 6.5 this flex array was converted from nameval[1] to
         * nameval[].  Be very careful here about extra padding at the end;
         * see xfs_attr_leaf_entsize_local() for details.
         */
        __u8        nameval[];                /* name/value bytes */
} xfs_attr_leaf_name_local_t;

typedef struct xfs_attr_leaf_name_remote {
        __be32        valueblk;                /* block number of value bytes */
        __be32        valuelen;                /* number of bytes in value */
        __u8        namelen;                /* length of name bytes */
        /*
         * In Linux 6.5 this flex array was converted from name[1] to name[].
         * Be very careful here about extra padding at the end; see
         * xfs_attr_leaf_entsize_remote() for details.
         */
        __u8        name[];                        /* name bytes */
} xfs_attr_leaf_name_remote_t;

typedef struct xfs_attr_leafblock {
        xfs_attr_leaf_hdr_t        hdr;        /* constant-structure header block */
        xfs_attr_leaf_entry_t        entries[];        /* sorted on key, not name */
        /*
         * The rest of the block contains the following structures after the
         * leaf entries, growing from the bottom up. The variables are never
         * referenced and definining them can actually make gcc optimize away
         * accesses to the 'entries' array above index 0 so don't do that.
         *
         * xfs_attr_leaf_name_local_t namelist;
         * xfs_attr_leaf_name_remote_t valuelist;
         */
} xfs_attr_leafblock_t;

/*
 * CRC enabled leaf structures. Called "version 3" structures to match the
 * version number of the directory and dablk structures for this feature, and
 * attr2 is already taken by the variable inode attribute fork size feature.
 */
struct xfs_attr3_leaf_hdr {
        struct xfs_da3_blkinfo        info;
        __be16                        count;
        __be16                        usedbytes;
        __be16                        firstused;
        __u8                        holes;
        __u8                        pad1;
        struct xfs_attr_leaf_map freemap[XFS_ATTR_LEAF_MAPSIZE];
        __be32                        pad2;                /* 64 bit alignment */
};

#define XFS_ATTR3_LEAF_CRC_OFF        (offsetof(struct xfs_attr3_leaf_hdr, info.crc))

struct xfs_attr3_leafblock {
        struct xfs_attr3_leaf_hdr        hdr;
        struct xfs_attr_leaf_entry        entries[];

        /*
         * The rest of the block contains the following structures after the
         * leaf entries, growing from the bottom up. The variables are never
         * referenced, the locations accessed purely from helper functions.
         *
         * struct xfs_attr_leaf_name_local
         * struct xfs_attr_leaf_name_remote
         */
};

/*
 * Special value to represent fs block size in the leaf header firstused field.
 * Only used when block size overflows the 2-bytes available on disk.
 */
#define XFS_ATTR3_LEAF_NULLOFF        0

/*
 * Flags used in the leaf_entry[i].flags field.
 */
#define        XFS_ATTR_LOCAL_BIT        0        /* attr is stored locally */
#define        XFS_ATTR_ROOT_BIT        1        /* limit access to trusted attrs */
#define        XFS_ATTR_SECURE_BIT        2        /* limit access to secure attrs */
#define        XFS_ATTR_PARENT_BIT        3        /* parent pointer attrs */
#define        XFS_ATTR_INCOMPLETE_BIT        7        /* attr in middle of create/delete */
#define XFS_ATTR_LOCAL                (1u << XFS_ATTR_LOCAL_BIT)
#define XFS_ATTR_ROOT                (1u << XFS_ATTR_ROOT_BIT)
#define XFS_ATTR_SECURE                (1u << XFS_ATTR_SECURE_BIT)
#define XFS_ATTR_PARENT                (1u << XFS_ATTR_PARENT_BIT)
#define XFS_ATTR_INCOMPLETE        (1u << XFS_ATTR_INCOMPLETE_BIT)

#define XFS_ATTR_NSP_ONDISK_MASK        (XFS_ATTR_ROOT | \
                                         XFS_ATTR_SECURE | \
                                         XFS_ATTR_PARENT)

/* Private attr namespaces not exposed to userspace */
#define XFS_ATTR_PRIVATE_NSP_MASK        (XFS_ATTR_PARENT)

#define XFS_ATTR_ONDISK_MASK        (XFS_ATTR_NSP_ONDISK_MASK | \
                                 XFS_ATTR_LOCAL | \
                                 XFS_ATTR_INCOMPLETE)

#define XFS_ATTR_NAMESPACE_STR \
        { XFS_ATTR_LOCAL,        "local" }, \
        { XFS_ATTR_ROOT,        "root" }, \
        { XFS_ATTR_SECURE,        "secure" }, \
        { XFS_ATTR_PARENT,        "parent" }

/*
 * Alignment for namelist and valuelist entries (since they are mixed
 * there can be only one alignment value)
 */
#define        XFS_ATTR_LEAF_NAME_ALIGN        ((uint)sizeof(xfs_dablk_t))

static inline int
xfs_attr3_leaf_hdr_size(struct xfs_attr_leafblock *leafp)
{
        if (leafp->hdr.info.magic == cpu_to_be16(XFS_ATTR3_LEAF_MAGIC))
                return sizeof(struct xfs_attr3_leaf_hdr);
        return sizeof(struct xfs_attr_leaf_hdr);
}

static inline struct xfs_attr_leaf_entry *
xfs_attr3_leaf_entryp(xfs_attr_leafblock_t *leafp)
{
        if (leafp->hdr.info.magic == cpu_to_be16(XFS_ATTR3_LEAF_MAGIC))
                return &((struct xfs_attr3_leafblock *)leafp)->entries[0];
        return &leafp->entries[0];
}

/*
 * Cast typed pointers for "local" and "remote" name/value structs.
 */
static inline char *
xfs_attr3_leaf_name(xfs_attr_leafblock_t *leafp, int idx)
{
        struct xfs_attr_leaf_entry *entries = xfs_attr3_leaf_entryp(leafp);

        return &((char *)leafp)[be16_to_cpu(entries[idx].nameidx)];
}

static inline xfs_attr_leaf_name_remote_t *
xfs_attr3_leaf_name_remote(xfs_attr_leafblock_t *leafp, int idx)
{
        return (xfs_attr_leaf_name_remote_t *)xfs_attr3_leaf_name(leafp, idx);
}

static inline xfs_attr_leaf_name_local_t *
xfs_attr3_leaf_name_local(xfs_attr_leafblock_t *leafp, int idx)
{
        return (xfs_attr_leaf_name_local_t *)xfs_attr3_leaf_name(leafp, idx);
}

/*
 * Calculate total bytes used (including trailing pad for alignment) for
 * a "local" name/value structure, a "remote" name/value structure, and
 * a pointer which might be either.
 */
static inline int xfs_attr_leaf_entsize_remote(int nlen)
{
        /*
         * Prior to Linux 6.5, struct xfs_attr_leaf_name_remote ended with
         * name[1], which was used as a flexarray.  The layout of this struct
         * is 9 bytes of fixed-length fields followed by a __u8 flex array at
         * offset 9.
         *
         * On most architectures, struct xfs_attr_leaf_name_remote had two
         * bytes of implicit padding at the end of the struct to make the
         * struct length 12.  After converting name[1] to name[], there are
         * three implicit padding bytes and the struct size remains 12.
         * However, there are compiler configurations that do not add implicit
         * padding at all (m68k) and have been broken for years.
         *
         * This entsize computation historically added (the xattr name length)
         * to (the padded struct length - 1) and rounded that sum up to the
         * nearest multiple of 4 (NAME_ALIGN).  IOWs, round_up(11 + nlen, 4).
         * This is encoded in the ondisk format, so we cannot change this.
         *
         * Compute the entsize from offsetof of the flexarray and manually
         * adding bytes for the implicit padding.
         */
        const size_t remotesize =
                        offsetof(struct xfs_attr_leaf_name_remote, name) + 2;

        return round_up(remotesize + nlen, XFS_ATTR_LEAF_NAME_ALIGN);
}

static inline int xfs_attr_leaf_entsize_local(int nlen, int vlen)
{
        /*
         * Prior to Linux 6.5, struct xfs_attr_leaf_name_local ended with
         * nameval[1], which was used as a flexarray.  The layout of this
         * struct is 3 bytes of fixed-length fields followed by a __u8 flex
         * array at offset 3.
         *
         * struct xfs_attr_leaf_name_local had zero bytes of implicit padding
         * at the end of the struct to make the struct length 4.  On most
         * architectures, after converting nameval[1] to nameval[], there is
         * one implicit padding byte and the struct size remains 4.  However,
         * there are compiler configurations that do not add implicit padding
         * at all (m68k) and would break.
         *
         * This entsize computation historically added (the xattr name and
         * value length) to (the padded struct length - 1) and rounded that sum
         * up to the nearest multiple of 4 (NAME_ALIGN).  IOWs, the formula is
         * round_up(3 + nlen + vlen, 4).  This is encoded in the ondisk format,
         * so we cannot change this.
         *
         * Compute the entsize from offsetof of the flexarray and manually
         * adding bytes for the implicit padding.
         */
        const size_t localsize =
                        offsetof(struct xfs_attr_leaf_name_local, nameval);

        return round_up(localsize + nlen + vlen, XFS_ATTR_LEAF_NAME_ALIGN);
}

static inline int xfs_attr_leaf_entsize_local_max(int bsize)
{
        return (((bsize) >> 1) + ((bsize) >> 2));
}



/*
 * Remote attribute block format definition
 *
 * There is one of these headers per filesystem block in a remote attribute.
 * This is done to ensure there is a 1:1 mapping between the attribute value
 * length and the number of blocks needed to store the attribute. This makes the
 * verification of a buffer a little more complex, but greatly simplifies the
 * allocation, reading and writing of these attributes as we don't have to guess
 * the number of blocks needed to store the attribute data.
 */
#define XFS_ATTR3_RMT_MAGIC        0x5841524d        /* XARM */

struct xfs_attr3_rmt_hdr {
        __be32        rm_magic;
        __be32        rm_offset;
        __be32        rm_bytes;
        __be32        rm_crc;
        uuid_t        rm_uuid;
        __be64        rm_owner;
        __be64        rm_blkno;
        __be64        rm_lsn;
};

#define XFS_ATTR3_RMT_CRC_OFF        offsetof(struct xfs_attr3_rmt_hdr, rm_crc)

unsigned int xfs_attr3_rmt_buf_space(struct xfs_mount *mp);

/* Number of bytes in a directory block. */
static inline unsigned int xfs_dir2_dirblock_bytes(struct xfs_sb *sbp)
{
        return 1 << (sbp->sb_blocklog + sbp->sb_dirblklog);
}

xfs_failaddr_t xfs_da3_blkinfo_verify(struct xfs_buf *bp,
                                      struct xfs_da3_blkinfo *hdr3);

/*
 * Parent pointer attribute format definition
 *
 * The xattr name contains the dirent name.
 * The xattr value encodes the parent inode number and generation to ease
 * opening parents by handle.
 * The xattr hashval is xfs_dir2_namehash() ^ p_ino
 */
struct xfs_parent_rec {
        __be64        p_ino;
        __be32        p_gen;
} __packed;

#endif /* __XFS_DA_FORMAT_H__ */








































































































  347 








































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * fs/kernfs/kernfs-internal.h - kernfs internal header file
 *
 * Copyright (c) 2001-3 Patrick Mochel
 * Copyright (c) 2007 SUSE Linux Products GmbH
 * Copyright (c) 2007, 2013 Tejun Heo <teheo@suse.de>
 */

#ifndef __KERNFS_INTERNAL_H
#define __KERNFS_INTERNAL_H

#include <linux/lockdep.h>
#include <linux/fs.h>
#include <linux/mutex.h>
#include <linux/rwsem.h>
#include <linux/xattr.h>

#include <linux/kernfs.h>
#include <linux/fs_context.h>

struct kernfs_iattrs {
        kuid_t                        ia_uid;
        kgid_t                        ia_gid;
        struct timespec64        ia_atime;
        struct timespec64        ia_mtime;
        struct timespec64        ia_ctime;

        struct simple_xattrs        xattrs;
        atomic_t                nr_user_xattrs;
        atomic_t                user_xattr_size;
};

struct kernfs_root {
        /* published fields */
        struct kernfs_node        *kn;
        unsigned int                flags;        /* KERNFS_ROOT_* flags */

        /* private fields, do not use outside kernfs proper */
        struct idr                ino_idr;
        u32                        last_id_lowbits;
        u32                        id_highbits;
        struct kernfs_syscall_ops *syscall_ops;

        /* list of kernfs_super_info of this root, protected by kernfs_rwsem */
        struct list_head        supers;

        wait_queue_head_t        deactivate_waitq;
        struct rw_semaphore        kernfs_rwsem;
        struct rw_semaphore        kernfs_iattr_rwsem;
        struct rw_semaphore        kernfs_supers_rwsem;

        struct rcu_head                rcu;
};

/* +1 to avoid triggering overflow warning when negating it */
#define KN_DEACTIVATED_BIAS                (INT_MIN + 1)

/* KERNFS_TYPE_MASK and types are defined in include/linux/kernfs.h */

/**
 * kernfs_root - find out the kernfs_root a kernfs_node belongs to
 * @kn: kernfs_node of interest
 *
 * Return: the kernfs_root @kn belongs to.
 */
static inline struct kernfs_root *kernfs_root(struct kernfs_node *kn)
{
        /* if parent exists, it's always a dir; otherwise, @sd is a dir */
        if (kn->parent)
                kn = kn->parent;
        return kn->dir.root;
}

/*
 * mount.c
 */
struct kernfs_super_info {
        struct super_block        *sb;

        /*
         * The root associated with this super_block.  Each super_block is
         * identified by the root and ns it's associated with.
         */
        struct kernfs_root        *root;

        /*
         * Each sb is associated with one namespace tag, currently the
         * network namespace of the task which mounted this kernfs
         * instance.  If multiple tags become necessary, make the following
         * an array and compare kernfs_node tag against every entry.
         */
        const void                *ns;

        /* anchored at kernfs_root->supers, protected by kernfs_rwsem */
        struct list_head        node;
};
#define kernfs_info(SB) ((struct kernfs_super_info *)(SB->s_fs_info))

static inline struct kernfs_node *kernfs_dentry_node(struct dentry *dentry)
{
        if (d_really_is_negative(dentry))
                return NULL;
        return d_inode(dentry)->i_private;
}

static inline void kernfs_set_rev(struct kernfs_node *parent,
                                  struct dentry *dentry)
{
        dentry->d_time = parent->dir.rev;
}

static inline void kernfs_inc_rev(struct kernfs_node *parent)
{
        parent->dir.rev++;
}

static inline bool kernfs_dir_changed(struct kernfs_node *parent,
                                      struct dentry *dentry)
{
        if (parent->dir.rev != dentry->d_time)
                return true;
        return false;
}

extern const struct super_operations kernfs_sops;
extern struct kmem_cache *kernfs_node_cache, *kernfs_iattrs_cache;

/*
 * inode.c
 */
extern const struct xattr_handler * const kernfs_xattr_handlers[];
void kernfs_evict_inode(struct inode *inode);
int kernfs_iop_permission(struct mnt_idmap *idmap,
                          struct inode *inode, int mask);
int kernfs_iop_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
                       struct iattr *iattr);
int kernfs_iop_getattr(struct mnt_idmap *idmap,
                       const struct path *path, struct kstat *stat,
                       u32 request_mask, unsigned int query_flags);
ssize_t kernfs_iop_listxattr(struct dentry *dentry, char *buf, size_t size);
int __kernfs_setattr(struct kernfs_node *kn, const struct iattr *iattr);

/*
 * dir.c
 */
extern const struct dentry_operations kernfs_dops;
extern const struct file_operations kernfs_dir_fops;
extern const struct inode_operations kernfs_dir_iops;

struct kernfs_node *kernfs_get_active(struct kernfs_node *kn);
void kernfs_put_active(struct kernfs_node *kn);
int kernfs_add_one(struct kernfs_node *kn);
struct kernfs_node *kernfs_new_node(struct kernfs_node *parent,
                                    const char *name, umode_t mode,
                                    kuid_t uid, kgid_t gid,
                                    unsigned flags);

/*
 * file.c
 */
extern const struct file_operations kernfs_file_fops;

bool kernfs_should_drain_open_files(struct kernfs_node *kn);
void kernfs_drain_open_files(struct kernfs_node *kn);

/*
 * symlink.c
 */
extern const struct inode_operations kernfs_symlink_iops;

/*
 * kernfs locks
 */
extern struct kernfs_global_locks *kernfs_locks;
#endif        /* __KERNFS_INTERNAL_H */




























































































































































































































 1251 





 1248 





























































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
// SPDX-License-Identifier: GPL-2.0
#include <linux/kernel.h>
#include <linux/of.h>
#include <linux/of_device.h>
#include <linux/of_address.h>
#include <linux/of_iommu.h>
#include <linux/of_reserved_mem.h>
#include <linux/dma-direct.h> /* for bus_dma_region */
#include <linux/dma-map-ops.h>
#include <linux/init.h>
#include <linux/mod_devicetable.h>
#include <linux/slab.h>
#include <linux/platform_device.h>

#include <asm/errno.h>
#include "of_private.h"

/**
 * of_match_device - Tell if a struct device matches an of_device_id list
 * @matches: array of of device match structures to search in
 * @dev: the of device structure to match against
 *
 * Used by a driver to check whether an platform_device present in the
 * system is in its list of supported devices.
 */
const struct of_device_id *of_match_device(const struct of_device_id *matches,
                                           const struct device *dev)
{
        if (!matches || !dev->of_node || dev->of_node_reused)
                return NULL;
        return of_match_node(matches, dev->of_node);
}
EXPORT_SYMBOL(of_match_device);

static void
of_dma_set_restricted_buffer(struct device *dev, struct device_node *np)
{
        struct device_node *node, *of_node = dev->of_node;
        int count, i;

        if (!IS_ENABLED(CONFIG_DMA_RESTRICTED_POOL))
                return;

        count = of_property_count_elems_of_size(of_node, "memory-region",
                                                sizeof(u32));
        /*
         * If dev->of_node doesn't exist or doesn't contain memory-region, try
         * the OF node having DMA configuration.
         */
        if (count <= 0) {
                of_node = np;
                count = of_property_count_elems_of_size(
                        of_node, "memory-region", sizeof(u32));
        }

        for (i = 0; i < count; i++) {
                node = of_parse_phandle(of_node, "memory-region", i);
                /*
                 * There might be multiple memory regions, but only one
                 * restricted-dma-pool region is allowed.
                 */
                if (of_device_is_compatible(node, "restricted-dma-pool") &&
                    of_device_is_available(node)) {
                        of_node_put(node);
                        break;
                }
                of_node_put(node);
        }

        /*
         * Attempt to initialize a restricted-dma-pool region if one was found.
         * Note that count can hold a negative error code.
         */
        if (i < count && of_reserved_mem_device_init_by_idx(dev, of_node, i))
                dev_warn(dev, "failed to initialise \"restricted-dma-pool\" memory node\n");
}

/**
 * of_dma_configure_id - Setup DMA configuration
 * @dev:        Device to apply DMA configuration
 * @np:                Pointer to OF node having DMA configuration
 * @force_dma:  Whether device is to be set up by of_dma_configure() even if
 *                DMA capability is not explicitly described by firmware.
 * @id:                Optional const pointer value input id
 *
 * Try to get devices's DMA configuration from DT and update it
 * accordingly.
 *
 * If platform code needs to use its own special DMA configuration, it
 * can use a platform bus notifier and handle BUS_NOTIFY_ADD_DEVICE events
 * to fix up DMA configuration.
 */
int of_dma_configure_id(struct device *dev, struct device_node *np,
                        bool force_dma, const u32 *id)
{
        const struct bus_dma_region *map = NULL;
        struct device_node *bus_np;
        u64 mask, end = 0;
        bool coherent, set_map = false;
        int ret;

        if (np == dev->of_node)
                bus_np = __of_get_dma_parent(np);
        else
                bus_np = of_node_get(np);

        ret = of_dma_get_range(bus_np, &map);
        of_node_put(bus_np);
        if (ret < 0) {
                /*
                 * For legacy reasons, we have to assume some devices need
                 * DMA configuration regardless of whether "dma-ranges" is
                 * correctly specified or not.
                 */
                if (!force_dma)
                        return ret == -ENODEV ? 0 : ret;
        } else {
                /* Determine the overall bounds of all DMA regions */
                end = dma_range_map_max(map);
                set_map = true;
        }

        /*
         * If @dev is expected to be DMA-capable then the bus code that created
         * it should have initialised its dma_mask pointer by this point. For
         * now, we'll continue the legacy behaviour of coercing it to the
         * coherent mask if not, but we'll no longer do so quietly.
         */
        if (!dev->dma_mask) {
                dev_warn(dev, "DMA mask not set\n");
                dev->dma_mask = &dev->coherent_dma_mask;
        }

        if (!end && dev->coherent_dma_mask)
                end = dev->coherent_dma_mask;
        else if (!end)
                end = (1ULL << 32) - 1;

        /*
         * Limit coherent and dma mask based on size and default mask
         * set by the driver.
         */
        mask = DMA_BIT_MASK(ilog2(end) + 1);
        dev->coherent_dma_mask &= mask;
        *dev->dma_mask &= mask;
        /* ...but only set bus limit and range map if we found valid dma-ranges earlier */
        if (set_map) {
                dev->bus_dma_limit = end;
                dev->dma_range_map = map;
        }

        coherent = of_dma_is_coherent(np);
        dev_dbg(dev, "device is%sdma coherent\n",
                coherent ? " " : " not ");

        ret = of_iommu_configure(dev, np, id);
        if (ret == -EPROBE_DEFER) {
                /* Don't touch range map if it wasn't set from a valid dma-ranges */
                if (set_map)
                        dev->dma_range_map = NULL;
                kfree(map);
                return -EPROBE_DEFER;
        }
        /* Take all other IOMMU errors to mean we'll just carry on without it */
        dev_dbg(dev, "device is%sbehind an iommu\n",
                !ret ? " " : " not ");

        arch_setup_dma_ops(dev, coherent);

        if (ret)
                of_dma_set_restricted_buffer(dev, np);

        return 0;
}
EXPORT_SYMBOL_GPL(of_dma_configure_id);

const void *of_device_get_match_data(const struct device *dev)
{
        const struct of_device_id *match;

        match = of_match_device(dev->driver->of_match_table, dev);
        if (!match)
                return NULL;

        return match->data;
}
EXPORT_SYMBOL(of_device_get_match_data);

/**
 * of_device_modalias - Fill buffer with newline terminated modalias string
 * @dev:        Calling device
 * @str:        Modalias string
 * @len:        Size of @str
 */
ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len)
{
        ssize_t sl;

        if (!dev || !dev->of_node || dev->of_node_reused)
                return -ENODEV;

        sl = of_modalias(dev->of_node, str, len - 2);
        if (sl < 0)
                return sl;
        if (sl > len - 2)
                return -ENOMEM;

        str[sl++] = '\n';
        str[sl] = 0;
        return sl;
}
EXPORT_SYMBOL_GPL(of_device_modalias);

/**
 * of_device_uevent - Display OF related uevent information
 * @dev:        Device to display the uevent information for
 * @env:        Kernel object's userspace event reference to fill up
 */
void of_device_uevent(const struct device *dev, struct kobj_uevent_env *env)
{
        const char *compat, *type;
        struct alias_prop *app;
        struct property *p;
        int seen = 0;

        if ((!dev) || (!dev->of_node))
                return;

        add_uevent_var(env, "OF_NAME=%pOFn", dev->of_node);
        add_uevent_var(env, "OF_FULLNAME=%pOF", dev->of_node);
        type = of_node_get_device_type(dev->of_node);
        if (type)
                add_uevent_var(env, "OF_TYPE=%s", type);

        /* Since the compatible field can contain pretty much anything
         * it's not really legal to split it out with commas. We split it
         * up using a number of environment variables instead. */
        of_property_for_each_string(dev->of_node, "compatible", p, compat) {
                add_uevent_var(env, "OF_COMPATIBLE_%d=%s", seen, compat);
                seen++;
        }
        add_uevent_var(env, "OF_COMPATIBLE_N=%d", seen);

        seen = 0;
        mutex_lock(&of_mutex);
        list_for_each_entry(app, &aliases_lookup, link) {
                if (dev->of_node == app->np) {
                        add_uevent_var(env, "OF_ALIAS_%d=%s", seen,
                                       app->alias);
                        seen++;
                }
        }
        mutex_unlock(&of_mutex);
}
EXPORT_SYMBOL_GPL(of_device_uevent);

int of_device_uevent_modalias(const struct device *dev, struct kobj_uevent_env *env)
{
        int sl;

        if ((!dev) || (!dev->of_node) || dev->of_node_reused)
                return -ENODEV;

        /* Devicetree modalias is tricky, we add it in 2 steps */
        if (add_uevent_var(env, "MODALIAS="))
                return -ENOMEM;

        sl = of_modalias(dev->of_node, &env->buf[env->buflen-1],
                         sizeof(env->buf) - env->buflen);
        if (sl < 0)
                return sl;
        if (sl >= (sizeof(env->buf) - env->buflen))
                return -ENOMEM;
        env->buflen += sl;

        return 0;
}
EXPORT_SYMBOL_GPL(of_device_uevent_modalias);

/**
 * of_device_make_bus_id - Use the device node data to assign a unique name
 * @dev: pointer to device structure that is linked to a device tree node
 *
 * This routine will first try using the translated bus address to
 * derive a unique name. If it cannot, then it will prepend names from
 * parent nodes until a unique name can be derived.
 */
void of_device_make_bus_id(struct device *dev)
{
        struct device_node *node = dev->of_node;
        const __be32 *reg;
        u64 addr;
        u32 mask;

        /* Construct the name, using parent nodes if necessary to ensure uniqueness */
        while (node->parent) {
                /*
                 * If the address can be translated, then that is as much
                 * uniqueness as we need. Make it the first component and return
                 */
                reg = of_get_property(node, "reg", NULL);
                if (reg && (addr = of_translate_address(node, reg)) != OF_BAD_ADDR) {
                        if (!of_property_read_u32(node, "mask", &mask))
                                dev_set_name(dev, dev_name(dev) ? "%llx.%x.%pOFn:%s" : "%llx.%x.%pOFn",
                                             addr, ffs(mask) - 1, node, dev_name(dev));

                        else
                                dev_set_name(dev, dev_name(dev) ? "%llx.%pOFn:%s" : "%llx.%pOFn",
                                             addr, node, dev_name(dev));
                        return;
                }

                /* format arguments only used if dev_name() resolves to NULL */
                dev_set_name(dev, dev_name(dev) ? "%s:%s" : "%s",
                             kbasename(node->full_name), dev_name(dev));
                node = node->parent;
        }
}
EXPORT_SYMBOL_GPL(of_device_make_bus_id);



















 3731 





 3739 




 9486 





 9483 





 3732 






 3729 



 3718 














 3724 


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * printk_safe.c - Safe printk for printk-deadlock-prone contexts
 */

#include <linux/preempt.h>
#include <linux/kdb.h>
#include <linux/smp.h>
#include <linux/cpumask.h>
#include <linux/printk.h>
#include <linux/kprobes.h>

#include "internal.h"

static DEFINE_PER_CPU(int, printk_context);

/* Can be preempted by NMI. */
void __printk_safe_enter(void)
{
        this_cpu_inc(printk_context);
}

/* Can be preempted by NMI. */
void __printk_safe_exit(void)
{
        this_cpu_dec(printk_context);
}

void __printk_deferred_enter(void)
{
        cant_migrate();
        __printk_safe_enter();
}

void __printk_deferred_exit(void)
{
        cant_migrate();
        __printk_safe_exit();
}

bool is_printk_legacy_deferred(void)
{
        /*
         * The per-CPU variable @printk_context can be read safely in any
         * context. CPU migration is always disabled when set.
         */
        return (force_legacy_kthread() ||
                this_cpu_read(printk_context) ||
                in_nmi());
}

asmlinkage int vprintk(const char *fmt, va_list args)
{
#ifdef CONFIG_KGDB_KDB
        /* Allow to pass printk() to kdb but avoid a recursion. */
        if (unlikely(kdb_trap_printk && kdb_printf_cpu < 0))
                return vkdb_printf(KDB_MSGSRC_PRINTK, fmt, args);
#endif

        /*
         * Use the main logbuf even in NMI. But avoid calling console
         * drivers that might have their own locks.
         */
        if (is_printk_legacy_deferred())
                return vprintk_deferred(fmt, args);

        /* No obstacles. */
        return vprintk_default(fmt, args);
}
EXPORT_SYMBOL(vprintk);


















































































































































































































































































   23 








   17 
   23 






   22 





























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
/*
 * linux/fs/nls/nls_cp775.c
 *
 * Charset cp775 translation tables.
 * Generated automatically from the Unicode and charset
 * tables from the Unicode Organization (www.unicode.org).
 * The Unicode to charset table has only exact mappings.
 */

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/nls.h>
#include <linux/errno.h>

static const wchar_t charset2uni[256] = {
        /* 0x00*/
        0x0000, 0x0001, 0x0002, 0x0003,
        0x0004, 0x0005, 0x0006, 0x0007,
        0x0008, 0x0009, 0x000a, 0x000b,
        0x000c, 0x000d, 0x000e, 0x000f,
        /* 0x10*/
        0x0010, 0x0011, 0x0012, 0x0013,
        0x0014, 0x0015, 0x0016, 0x0017,
        0x0018, 0x0019, 0x001a, 0x001b,
        0x001c, 0x001d, 0x001e, 0x001f,
        /* 0x20*/
        0x0020, 0x0021, 0x0022, 0x0023,
        0x0024, 0x0025, 0x0026, 0x0027,
        0x0028, 0x0029, 0x002a, 0x002b,
        0x002c, 0x002d, 0x002e, 0x002f,
        /* 0x30*/
        0x0030, 0x0031, 0x0032, 0x0033,
        0x0034, 0x0035, 0x0036, 0x0037,
        0x0038, 0x0039, 0x003a, 0x003b,
        0x003c, 0x003d, 0x003e, 0x003f,
        /* 0x40*/
        0x0040, 0x0041, 0x0042, 0x0043,
        0x0044, 0x0045, 0x0046, 0x0047,
        0x0048, 0x0049, 0x004a, 0x004b,
        0x004c, 0x004d, 0x004e, 0x004f,
        /* 0x50*/
        0x0050, 0x0051, 0x0052, 0x0053,
        0x0054, 0x0055, 0x0056, 0x0057,
        0x0058, 0x0059, 0x005a, 0x005b,
        0x005c, 0x005d, 0x005e, 0x005f,
        /* 0x60*/
        0x0060, 0x0061, 0x0062, 0x0063,
        0x0064, 0x0065, 0x0066, 0x0067,
        0x0068, 0x0069, 0x006a, 0x006b,
        0x006c, 0x006d, 0x006e, 0x006f,
        /* 0x70*/
        0x0070, 0x0071, 0x0072, 0x0073,
        0x0074, 0x0075, 0x0076, 0x0077,
        0x0078, 0x0079, 0x007a, 0x007b,
        0x007c, 0x007d, 0x007e, 0x007f,
        /* 0x80*/
        0x0106, 0x00fc, 0x00e9, 0x0101,
        0x00e4, 0x0123, 0x00e5, 0x0107,
        0x0142, 0x0113, 0x0156, 0x0157,
        0x012b, 0x0179, 0x00c4, 0x00c5,
        /* 0x90*/
        0x00c9, 0x00e6, 0x00c6, 0x014d,
        0x00f6, 0x0122, 0x00a2, 0x015a,
        0x015b, 0x00d6, 0x00dc, 0x00f8,
        0x00a3, 0x00d8, 0x00d7, 0x00a4,
        /* 0xa0*/
        0x0100, 0x012a, 0x00f3, 0x017b,
        0x017c, 0x017a, 0x201d, 0x00a6,
        0x00a9, 0x00ae, 0x00ac, 0x00bd,
        0x00bc, 0x0141, 0x00ab, 0x00bb,
        /* 0xb0*/
        0x2591, 0x2592, 0x2593, 0x2502,
        0x2524, 0x0104, 0x010c, 0x0118,
        0x0116, 0x2563, 0x2551, 0x2557,
        0x255d, 0x012e, 0x0160, 0x2510,
        /* 0xc0*/
        0x2514, 0x2534, 0x252c, 0x251c,
        0x2500, 0x253c, 0x0172, 0x016a,
        0x255a, 0x2554, 0x2569, 0x2566,
        0x2560, 0x2550, 0x256c, 0x017d,
        /* 0xd0*/
        0x0105, 0x010d, 0x0119, 0x0117,
        0x012f, 0x0161, 0x0173, 0x016b,
        0x017e, 0x2518, 0x250c, 0x2588,
        0x2584, 0x258c, 0x2590, 0x2580,
        /* 0xe0*/
        0x00d3, 0x00df, 0x014c, 0x0143,
        0x00f5, 0x00d5, 0x00b5, 0x0144,
        0x0136, 0x0137, 0x013b, 0x013c,
        0x0146, 0x0112, 0x0145, 0x2019,
        /* 0xf0*/
        0x00ad, 0x00b1, 0x201c, 0x00be,
        0x00b6, 0x00a7, 0x00f7, 0x201e,
        0x00b0, 0x2219, 0x00b7, 0x00b9,
        0x00b3, 0x00b2, 0x25a0, 0x00a0,
};

static const unsigned char page00[256] = {
        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */
        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */
        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */
        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */
        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */
        0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */
        0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */
        0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */
        0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */
        0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, /* 0x60-0x67 */
        0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, /* 0x68-0x6f */
        0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, /* 0x70-0x77 */
        0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */

        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0xff, 0x00, 0x96, 0x9c, 0x9f, 0x00, 0xa7, 0xf5, /* 0xa0-0xa7 */
        0x00, 0xa8, 0x00, 0xae, 0xaa, 0xf0, 0xa9, 0x00, /* 0xa8-0xaf */
        0xf8, 0xf1, 0xfd, 0xfc, 0x00, 0xe6, 0xf4, 0xfa, /* 0xb0-0xb7 */
        0x00, 0xfb, 0x00, 0xaf, 0xac, 0xab, 0xf3, 0x00, /* 0xb8-0xbf */
        0x00, 0x00, 0x00, 0x00, 0x8e, 0x8f, 0x92, 0x00, /* 0xc0-0xc7 */
        0x00, 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xc8-0xcf */
        0x00, 0x00, 0x00, 0xe0, 0x00, 0xe5, 0x99, 0x9e, /* 0xd0-0xd7 */
        0x9d, 0x00, 0x00, 0x00, 0x9a, 0x00, 0x00, 0xe1, /* 0xd8-0xdf */
        0x00, 0x00, 0x00, 0x00, 0x84, 0x86, 0x91, 0x00, /* 0xe0-0xe7 */
        0x00, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xe8-0xef */
        0x00, 0x00, 0x00, 0xa2, 0x00, 0xe4, 0x94, 0xf6, /* 0xf0-0xf7 */
        0x9b, 0x00, 0x00, 0x00, 0x81, 0x00, 0x00, 0x00, /* 0xf8-0xff */
};

static const unsigned char page01[256] = {
        0xa0, 0x83, 0x00, 0x00, 0xb5, 0xd0, 0x80, 0x87, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0xb6, 0xd1, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0xed, 0x89, 0x00, 0x00, 0xb8, 0xd3, /* 0x10-0x17 */
        0xb7, 0xd2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x95, 0x85, 0x00, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0xa1, 0x8c, 0x00, 0x00, 0xbd, 0xd4, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0xe9, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0xea, 0xeb, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0xad, 0x88, 0xe3, 0xe7, 0xee, 0xec, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0xe2, 0x93, 0x00, 0x00, /* 0x48-0x4f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8a, 0x8b, /* 0x50-0x57 */
        0x00, 0x00, 0x97, 0x98, 0x00, 0x00, 0x00, 0x00, /* 0x58-0x5f */
        0xbe, 0xd5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x60-0x67 */
        0x00, 0x00, 0xc7, 0xd7, 0x00, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0xc6, 0xd6, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x8d, 0xa5, 0xa3, 0xa4, 0xcf, 0xd8, 0x00, /* 0x78-0x7f */
};

static const unsigned char page20[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0xef, 0x00, 0x00, 0xf2, 0xa6, 0xf7, 0x00, /* 0x18-0x1f */
};

static const unsigned char page22[256] = {
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0x00, 0xf9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x18-0x1f */
};

static const unsigned char page25[256] = {
        0xc4, 0x00, 0xb3, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x00-0x07 */
        0x00, 0x00, 0x00, 0x00, 0xda, 0x00, 0x00, 0x00, /* 0x08-0x0f */
        0xbf, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, /* 0x10-0x17 */
        0xd9, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x00, 0x00, /* 0x18-0x1f */
        0x00, 0x00, 0x00, 0x00, 0xb4, 0x00, 0x00, 0x00, /* 0x20-0x27 */
        0x00, 0x00, 0x00, 0x00, 0xc2, 0x00, 0x00, 0x00, /* 0x28-0x2f */
        0x00, 0x00, 0x00, 0x00, 0xc1, 0x00, 0x00, 0x00, /* 0x30-0x37 */
        0x00, 0x00, 0x00, 0x00, 0xc5, 0x00, 0x00, 0x00, /* 0x38-0x3f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x40-0x47 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x48-0x4f */
        0xcd, 0xba, 0x00, 0x00, 0xc9, 0x00, 0x00, 0xbb, /* 0x50-0x57 */
        0x00, 0x00, 0xc8, 0x00, 0x00, 0xbc, 0x00, 0x00, /* 0x58-0x5f */
        0xcc, 0x00, 0x00, 0xb9, 0x00, 0x00, 0xcb, 0x00, /* 0x60-0x67 */
        0x00, 0xca, 0x00, 0x00, 0xce, 0x00, 0x00, 0x00, /* 0x68-0x6f */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x70-0x77 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x78-0x7f */

        0xdf, 0x00, 0x00, 0x00, 0xdc, 0x00, 0x00, 0x00, /* 0x80-0x87 */
        0xdb, 0x00, 0x00, 0x00, 0xdd, 0x00, 0x00, 0x00, /* 0x88-0x8f */
        0xde, 0xb0, 0xb1, 0xb2, 0x00, 0x00, 0x00, 0x00, /* 0x90-0x97 */
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x98-0x9f */
        0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xa0-0xa7 */
};

static const unsigned char *const page_uni2charset[256] = {
        page00, page01, NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   
        NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   NULL,   
        page20, NULL,   page22, NULL,   NULL,   page25, NULL,   NULL,   
};

static const unsigned char charset2lower[256] = {
        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */
        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */
        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */
        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */
        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */
        0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, /* 0x40-0x47 */
        0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, /* 0x48-0x4f */
        0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, /* 0x50-0x57 */
        0x78, 0x79, 0x7a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */
        0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, /* 0x60-0x67 */
        0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, /* 0x68-0x6f */
        0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, /* 0x70-0x77 */
        0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */

        0x87, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 0x80-0x87 */
        0x88, 0x89, 0x8b, 0x8b, 0x8c, 0xa5, 0x84, 0x86, /* 0x88-0x8f */
        0x82, 0x91, 0x91, 0x93, 0x94, 0x85, 0x96, 0x98, /* 0x90-0x97 */
        0x98, 0x94, 0x81, 0x9b, 0x9c, 0x9b, 0x9e, 0x9f, /* 0x98-0x9f */
        0x83, 0x8c, 0xa2, 0xa4, 0xa4, 0xa5, 0xa6, 0xa7, /* 0xa0-0xa7 */
        0xa8, 0xa9, 0xaa, 0xab, 0xac, 0x88, 0xae, 0xaf, /* 0xa8-0xaf */
        0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xd0, 0xd1, 0xd2, /* 0xb0-0xb7 */
        0xd3, 0xb9, 0xba, 0xbb, 0xbc, 0xd4, 0xd5, 0xbf, /* 0xb8-0xbf */
        0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xd6, 0xd7, /* 0xc0-0xc7 */
        0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xd8, /* 0xc8-0xcf */
        0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, /* 0xd0-0xd7 */
        0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, /* 0xd8-0xdf */
        0xa2, 0xe1, 0x93, 0xe7, 0xe4, 0xe4, 0xe6, 0xe7, /* 0xe0-0xe7 */
        0xe9, 0xe9, 0xeb, 0xeb, 0xec, 0x89, 0xec, 0xef, /* 0xe8-0xef */
        0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, /* 0xf0-0xf7 */
        0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff, /* 0xf8-0xff */
};

static const unsigned char charset2upper[256] = {
        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */
        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */
        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */
        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */
        0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */
        0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */
        0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */
        0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */
        0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */
        0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */
        0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */
        0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */
        0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x60-0x67 */
        0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x68-0x6f */
        0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x70-0x77 */
        0x58, 0x59, 0x5a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */

        0x80, 0x9a, 0x90, 0xa0, 0x8e, 0x95, 0x8f, 0x80, /* 0x80-0x87 */
        0xad, 0xed, 0x8a, 0x8a, 0xa1, 0x8d, 0x8e, 0x8f, /* 0x88-0x8f */
        0x90, 0x92, 0x92, 0xe2, 0x99, 0x95, 0x96, 0x97, /* 0x90-0x97 */
        0x97, 0x99, 0x9a, 0x9d, 0x9c, 0x9d, 0x9e, 0x9f, /* 0x98-0x9f */
        0xa0, 0xa1, 0xe0, 0xa3, 0xa3, 0x8d, 0xa6, 0xa7, /* 0xa0-0xa7 */
        0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, /* 0xa8-0xaf */
        0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, /* 0xb0-0xb7 */
        0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, /* 0xb8-0xbf */
        0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xc0-0xc7 */
        0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xc8-0xcf */
        0xb5, 0xb6, 0xb7, 0xb8, 0xbd, 0xbe, 0xc6, 0xc7, /* 0xd0-0xd7 */
        0xcf, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, /* 0xd8-0xdf */
        0xe0, 0xe1, 0xe2, 0xe3, 0xe5, 0xe5, 0x00, 0xe3, /* 0xe0-0xe7 */
        0xe8, 0xe8, 0xea, 0xea, 0xee, 0xed, 0xee, 0xef, /* 0xe8-0xef */
        0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, /* 0xf0-0xf7 */
        0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff, /* 0xf8-0xff */
};

static int uni2char(wchar_t uni, unsigned char *out, int boundlen)
{
        const unsigned char *uni2charset;
        unsigned char cl = uni & 0x00ff;
        unsigned char ch = (uni & 0xff00) >> 8;

        if (boundlen <= 0)
                return -ENAMETOOLONG;

        uni2charset = page_uni2charset[ch];
        if (uni2charset && uni2charset[cl])
                out[0] = uni2charset[cl];
        else
                return -EINVAL;
        return 1;
}

static int char2uni(const unsigned char *rawstring, int boundlen, wchar_t *uni)
{
        *uni = charset2uni[*rawstring];
        if (*uni == 0x0000)
                return -EINVAL;
        return 1;
}

static struct nls_table table = {
        .charset        = "cp775",
        .uni2char        = uni2char,
        .char2uni        = char2uni,
        .charset2lower        = charset2lower,
        .charset2upper        = charset2upper,
};

static int __init init_nls_cp775(void)
{
        return register_nls(&table);
}

static void __exit exit_nls_cp775(void)
{
        unregister_nls(&table);
}

module_init(init_nls_cp775)
module_exit(exit_nls_cp775)

MODULE_DESCRIPTION("NLS Codepage 775 (Baltic Rim)");
MODULE_LICENSE("Dual BSD/GPL");










 3735 



























1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
/* SPDX-License-Identifier: GPL-2.0 */
#undef TRACE_SYSTEM
#define TRACE_SYSTEM printk

#if !defined(_TRACE_PRINTK_H) || defined(TRACE_HEADER_MULTI_READ)
#define _TRACE_PRINTK_H

#include <linux/tracepoint.h>

TRACE_EVENT(console,
        TP_PROTO(const char *text, size_t len),

        TP_ARGS(text, len),

        TP_STRUCT__entry(
                __dynamic_array(char, msg, len + 1)
        ),

        TP_fast_assign(
                /*
                 * Each trace entry is printed in a new line.
                 * If the msg finishes with '\n', cut it off
                 * to avoid blank lines in the trace.
                 */
                if ((len > 0) && (text[len-1] == '\n'))
                        len -= 1;

                memcpy(__get_str(msg), text, len);
                __get_str(msg)[len] = 0;
        ),

        TP_printk("%s", __get_str(msg))
);
#endif /* _TRACE_PRINTK_H */

/* This part must be outside protection */
#include <trace/define_trace.h>





































































  213 














1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
/* SPDX-License-Identifier: GPL-2.0 */
/*
 * kernel/workqueue_internal.h
 *
 * Workqueue internal header file.  Only to be included by workqueue and
 * core kernel subsystems.
 */
#ifndef _KERNEL_WORKQUEUE_INTERNAL_H
#define _KERNEL_WORKQUEUE_INTERNAL_H

#include <linux/workqueue.h>
#include <linux/kthread.h>
#include <linux/preempt.h>

struct worker_pool;

/*
 * The poor guys doing the actual heavy lifting.  All on-duty workers are
 * either serving the manager role, on idle list or on busy hash.  For
 * details on the locking annotation (L, I, X...), refer to workqueue.c.
 *
 * Only to be used in workqueue and async.
 */
struct worker {
        /* on idle list while idle, on busy hash table while busy */
        union {
                struct list_head        entry;        /* L: while idle */
                struct hlist_node        hentry;        /* L: while busy */
        };

        struct work_struct        *current_work;        /* K: work being processed and its */
        work_func_t                current_func;        /* K: function */
        struct pool_workqueue        *current_pwq;        /* K: pwq */
        u64                        current_at;        /* K: runtime at start or last wakeup */
        unsigned int                current_color;        /* K: color */

        int                        sleeping;        /* S: is worker sleeping? */

        /* used by the scheduler to determine a worker's last known identity */
        work_func_t                last_func;        /* K: last work's fn */

        struct list_head        scheduled;        /* L: scheduled works */

        struct task_struct        *task;                /* I: worker task */
        struct worker_pool        *pool;                /* A: the associated pool */
                                                /* L: for rescuers */
        struct list_head        node;                /* A: anchored at pool->workers */
                                                /* A: runs through worker->node */

        unsigned long                last_active;        /* K: last active timestamp */
        unsigned int                flags;                /* L: flags */
        int                        id;                /* I: worker id */

        /*
         * Opaque string set with work_set_desc().  Printed out with task
         * dump for debugging - WARN, BUG, panic or sysrq.
         */
        char                        desc[WORKER_DESC_LEN];

        /* used only by rescuers to point to the target workqueue */
        struct workqueue_struct        *rescue_wq;        /* I: the workqueue to rescue */
};

/**
 * current_wq_worker - return struct worker if %current is a workqueue worker
 */
static inline struct worker *current_wq_worker(void)
{
        if (in_task() && (current->flags & PF_WQ_WORKER))
                return kthread_data(current);
        return NULL;
}

/*
 * Scheduler hooks for concurrency managed workqueue.  Only to be used from
 * sched/ and workqueue.c.
 */
void wq_worker_running(struct task_struct *task);
void wq_worker_sleeping(struct task_struct *task);
void wq_worker_tick(struct task_struct *task);
work_func_t wq_worker_last_func(struct task_struct *task);

#endif /* _KERNEL_WORKQUEUE_INTERNAL_H */






























































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































   14 


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
// SPDX-License-Identifier: GPL-2.0
#include "bcachefs.h"
#include "alloc_background.h"
#include "alloc_foreground.h"
#include "backpointers.h"
#include "bkey_buf.h"
#include "btree_cache.h"
#include "btree_io.h"
#include "btree_key_cache.h"
#include "btree_update.h"
#include "btree_update_interior.h"
#include "btree_gc.h"
#include "btree_write_buffer.h"
#include "buckets.h"
#include "buckets_waiting_for_journal.h"
#include "clock.h"
#include "debug.h"
#include "disk_accounting.h"
#include "ec.h"
#include "error.h"
#include "lru.h"
#include "recovery.h"
#include "trace.h"
#include "varint.h"

#include <linux/kthread.h>
#include <linux/math64.h>
#include <linux/random.h>
#include <linux/rculist.h>
#include <linux/rcupdate.h>
#include <linux/sched/task.h>
#include <linux/sort.h>
#include <linux/jiffies.h>

static void bch2_discard_one_bucket_fast(struct bch_dev *, u64);

/* Persistent alloc info: */

static const unsigned BCH_ALLOC_V1_FIELD_BYTES[] = {
#define x(name, bits) [BCH_ALLOC_FIELD_V1_##name] = bits / 8,
        BCH_ALLOC_FIELDS_V1()
#undef x
};

struct bkey_alloc_unpacked {
        u64                journal_seq;
        u8                gen;
        u8                oldest_gen;
        u8                data_type;
        bool                need_discard:1;
        bool                need_inc_gen:1;
#define x(_name, _bits)        u##_bits _name;
        BCH_ALLOC_FIELDS_V2()
#undef  x
};

static inline u64 alloc_field_v1_get(const struct bch_alloc *a,
                                     const void **p, unsigned field)
{
        unsigned bytes = BCH_ALLOC_V1_FIELD_BYTES[field];
        u64 v;

        if (!(a->fields & (1 << field)))
                return 0;

        switch (bytes) {
        case 1:
                v = *((const u8 *) *p);
                break;
        case 2:
                v = le16_to_cpup(*p);
                break;
        case 4:
                v = le32_to_cpup(*p);
                break;
        case 8:
                v = le64_to_cpup(*p);
                break;
        default:
                BUG();
        }

        *p += bytes;
        return v;
}

static void bch2_alloc_unpack_v1(struct bkey_alloc_unpacked *out,
                                 struct bkey_s_c k)
{
        const struct bch_alloc *in = bkey_s_c_to_alloc(k).v;
        const void *d = in->data;
        unsigned idx = 0;

        out->gen = in->gen;

#define x(_name, _bits) out->_name = alloc_field_v1_get(in, &d, idx++);
        BCH_ALLOC_FIELDS_V1()
#undef  x
}

static int bch2_alloc_unpack_v2(struct bkey_alloc_unpacked *out,
                                struct bkey_s_c k)
{
        struct bkey_s_c_alloc_v2 a = bkey_s_c_to_alloc_v2(k);
        const u8 *in = a.v->data;
        const u8 *end = bkey_val_end(a);
        unsigned fieldnr = 0;
        int ret;
        u64 v;

        out->gen        = a.v->gen;
        out->oldest_gen        = a.v->oldest_gen;
        out->data_type        = a.v->data_type;

#define x(_name, _bits)                                                        \
        if (fieldnr < a.v->nr_fields) {                                        \
                ret = bch2_varint_decode_fast(in, end, &v);                \
                if (ret < 0)                                                \
                        return ret;                                        \
                in += ret;                                                \
        } else {                                                        \
                v = 0;                                                        \
        }                                                                \
        out->_name = v;                                                        \
        if (v != out->_name)                                                \
                return -1;                                                \
        fieldnr++;

        BCH_ALLOC_FIELDS_V2()
#undef  x
        return 0;
}

static int bch2_alloc_unpack_v3(struct bkey_alloc_unpacked *out,
                                struct bkey_s_c k)
{
        struct bkey_s_c_alloc_v3 a = bkey_s_c_to_alloc_v3(k);
        const u8 *in = a.v->data;
        const u8 *end = bkey_val_end(a);
        unsigned fieldnr = 0;
        int ret;
        u64 v;

        out->gen        = a.v->gen;
        out->oldest_gen        = a.v->oldest_gen;
        out->data_type        = a.v->data_type;
        out->need_discard = BCH_ALLOC_V3_NEED_DISCARD(a.v);
        out->need_inc_gen = BCH_ALLOC_V3_NEED_INC_GEN(a.v);
        out->journal_seq = le64_to_cpu(a.v->journal_seq);

#define x(_name, _bits)                                                        \
        if (fieldnr < a.v->nr_fields) {                                        \
                ret = bch2_varint_decode_fast(in, end, &v);                \
                if (ret < 0)                                                \
                        return ret;                                        \
                in += ret;                                                \
        } else {                                                        \
                v = 0;                                                        \
        }                                                                \
        out->_name = v;                                                        \
        if (v != out->_name)                                                \
                return -1;                                                \
        fieldnr++;

        BCH_ALLOC_FIELDS_V2()
#undef  x
        return 0;
}

static struct bkey_alloc_unpacked bch2_alloc_unpack(struct bkey_s_c k)
{
        struct bkey_alloc_unpacked ret = { .gen        = 0 };

        switch (k.k->type) {
        case KEY_TYPE_alloc:
                bch2_alloc_unpack_v1(&ret, k);
                break;
        case KEY_TYPE_alloc_v2:
                bch2_alloc_unpack_v2(&ret, k);
                break;
        case KEY_TYPE_alloc_v3:
                bch2_alloc_unpack_v3(&ret, k);
                break;
        }

        return ret;
}

static unsigned bch_alloc_v1_val_u64s(const struct bch_alloc *a)
{
        unsigned i, bytes = offsetof(struct bch_alloc, data);

        for (i = 0; i < ARRAY_SIZE(BCH_ALLOC_V1_FIELD_BYTES); i++)
                if (a->fields & (1 << i))
                        bytes += BCH_ALLOC_V1_FIELD_BYTES[i];

        return DIV_ROUND_UP(bytes, sizeof(u64));
}

int bch2_alloc_v1_validate(struct bch_fs *c, struct bkey_s_c k,
                           enum bch_validate_flags flags)
{
        struct bkey_s_c_alloc a = bkey_s_c_to_alloc(k);
        int ret = 0;

        /* allow for unknown fields */
        bkey_fsck_err_on(bkey_val_u64s(a.k) < bch_alloc_v1_val_u64s(a.v),
                         c, alloc_v1_val_size_bad,
                         "incorrect value size (%zu < %u)",
                         bkey_val_u64s(a.k), bch_alloc_v1_val_u64s(a.v));
fsck_err:
        return ret;
}

int bch2_alloc_v2_validate(struct bch_fs *c, struct bkey_s_c k,
                           enum bch_validate_flags flags)
{
        struct bkey_alloc_unpacked u;
        int ret = 0;

        bkey_fsck_err_on(bch2_alloc_unpack_v2(&u, k),
                         c, alloc_v2_unpack_error,
                         "unpack error");
fsck_err:
        return ret;
}

int bch2_alloc_v3_validate(struct bch_fs *c, struct bkey_s_c k,
                           enum bch_validate_flags flags)
{
        struct bkey_alloc_unpacked u;
        int ret = 0;

        bkey_fsck_err_on(bch2_alloc_unpack_v3(&u, k),
                         c, alloc_v2_unpack_error,
                         "unpack error");
fsck_err:
        return ret;
}

int bch2_alloc_v4_validate(struct bch_fs *c, struct bkey_s_c k,
                           enum bch_validate_flags flags)
{
        struct bch_alloc_v4 a;
        int ret = 0;

        bkey_val_copy(&a, bkey_s_c_to_alloc_v4(k));

        bkey_fsck_err_on(alloc_v4_u64s_noerror(&a) > bkey_val_u64s(k.k),
                         c, alloc_v4_val_size_bad,
                         "bad val size (%u > %zu)",
                         alloc_v4_u64s_noerror(&a), bkey_val_u64s(k.k));

        bkey_fsck_err_on(!BCH_ALLOC_V4_BACKPOINTERS_START(&a) &&
                         BCH_ALLOC_V4_NR_BACKPOINTERS(&a),
                         c, alloc_v4_backpointers_start_bad,
                         "invalid backpointers_start");

        bkey_fsck_err_on(alloc_data_type(a, a.data_type) != a.data_type,
                         c, alloc_key_data_type_bad,
                         "invalid data type (got %u should be %u)",
                         a.data_type, alloc_data_type(a, a.data_type));

        for (unsigned i = 0; i < 2; i++)
                bkey_fsck_err_on(a.io_time[i] > LRU_TIME_MAX,
                                 c, alloc_key_io_time_bad,
                                 "invalid io_time[%s]: %llu, max %llu",
                                 i == READ ? "read" : "write",
                                 a.io_time[i], LRU_TIME_MAX);

        unsigned stripe_sectors = BCH_ALLOC_V4_BACKPOINTERS_START(&a) * sizeof(u64) >
                offsetof(struct bch_alloc_v4, stripe_sectors)
                ? a.stripe_sectors
                : 0;

        switch (a.data_type) {
        case BCH_DATA_free:
        case BCH_DATA_need_gc_gens:
        case BCH_DATA_need_discard:
                bkey_fsck_err_on(stripe_sectors ||
                                 a.dirty_sectors ||
                                 a.cached_sectors ||
                                 a.stripe,
                                 c, alloc_key_empty_but_have_data,
                                 "empty data type free but have data %u.%u.%u %u",
                                 stripe_sectors,
                                 a.dirty_sectors,
                                 a.cached_sectors,
                                 a.stripe);
                break;
        case BCH_DATA_sb:
        case BCH_DATA_journal:
        case BCH_DATA_btree:
        case BCH_DATA_user:
        case BCH_DATA_parity:
                bkey_fsck_err_on(!a.dirty_sectors &&
                                 !stripe_sectors,
                                 c, alloc_key_dirty_sectors_0,
                                 "data_type %s but dirty_sectors==0",
                                 bch2_data_type_str(a.data_type));
                break;
        case BCH_DATA_cached:
                bkey_fsck_err_on(!a.cached_sectors ||
                                 a.dirty_sectors ||
                                 stripe_sectors ||
                                 a.stripe,
                                 c, alloc_key_cached_inconsistency,
                                 "data type inconsistency");

                bkey_fsck_err_on(!a.io_time[READ] &&
                                 c->curr_recovery_pass > BCH_RECOVERY_PASS_check_alloc_to_lru_refs,
                                 c, alloc_key_cached_but_read_time_zero,
                                 "cached bucket with read_time == 0");
                break;
        case BCH_DATA_stripe:
                break;
        }
fsck_err:
        return ret;
}

void bch2_alloc_v4_swab(struct bkey_s k)
{
        struct bch_alloc_v4 *a = bkey_s_to_alloc_v4(k).v;
        struct bch_backpointer *bp, *bps;

        a->journal_seq                = swab64(a->journal_seq);
        a->flags                = swab32(a->flags);
        a->dirty_sectors        = swab32(a->dirty_sectors);
        a->cached_sectors        = swab32(a->cached_sectors);
        a->io_time[0]                = swab64(a->io_time[0]);
        a->io_time[1]                = swab64(a->io_time[1]);
        a->stripe                = swab32(a->stripe);
        a->nr_external_backpointers = swab32(a->nr_external_backpointers);
        a->fragmentation_lru        = swab64(a->fragmentation_lru);
        a->stripe_sectors        = swab32(a->stripe_sectors);

        bps = alloc_v4_backpointers(a);
        for (bp = bps; bp < bps + BCH_ALLOC_V4_NR_BACKPOINTERS(a); bp++) {
                bp->bucket_offset        = swab40(bp->bucket_offset);
                bp->bucket_len                = swab32(bp->bucket_len);
                bch2_bpos_swab(&bp->pos);
        }
}

void bch2_alloc_to_text(struct printbuf *out, struct bch_fs *c, struct bkey_s_c k)
{
        struct bch_alloc_v4 _a;
        const struct bch_alloc_v4 *a = bch2_alloc_to_v4(k, &_a);

        prt_newline(out);
        printbuf_indent_add(out, 2);

        prt_printf(out, "gen %u oldest_gen %u data_type ", a->gen, a->oldest_gen);
        bch2_prt_data_type(out, a->data_type);
        prt_newline(out);
        prt_printf(out, "journal_seq       %llu\n",        a->journal_seq);
        prt_printf(out, "need_discard      %llu\n",        BCH_ALLOC_V4_NEED_DISCARD(a));
        prt_printf(out, "need_inc_gen      %llu\n",        BCH_ALLOC_V4_NEED_INC_GEN(a));
        prt_printf(out, "dirty_sectors     %u\n",        a->dirty_sectors);
        prt_printf(out, "stripe_sectors    %u\n",        a->stripe_sectors);
        prt_printf(out, "cached_sectors    %u\n",        a->cached_sectors);
        prt_printf(out, "stripe            %u\n",        a->stripe);
        prt_printf(out, "stripe_redundancy %u\n",        a->stripe_redundancy);
        prt_printf(out, "io_time[READ]     %llu\n",        a->io_time[READ]);
        prt_printf(out, "io_time[WRITE]    %llu\n",        a->io_time[WRITE]);
        prt_printf(out, "fragmentation     %llu\n",        a->fragmentation_lru);
        prt_printf(out, "bp_start          %llu\n", BCH_ALLOC_V4_BACKPOINTERS_START(a));
        printbuf_indent_sub(out, 2);
}

void __bch2_alloc_to_v4(struct bkey_s_c k, struct bch_alloc_v4 *out)
{
        if (k.k->type == KEY_TYPE_alloc_v4) {
                void *src, *dst;

                *out = *bkey_s_c_to_alloc_v4(k).v;

                src = alloc_v4_backpointers(out);
                SET_BCH_ALLOC_V4_BACKPOINTERS_START(out, BCH_ALLOC_V4_U64s);
                dst = alloc_v4_backpointers(out);

                if (src < dst)
                        memset(src, 0, dst - src);

                SET_BCH_ALLOC_V4_NR_BACKPOINTERS(out, 0);
        } else {
                struct bkey_alloc_unpacked u = bch2_alloc_unpack(k);

                *out = (struct bch_alloc_v4) {
                        .journal_seq                = u.journal_seq,
                        .flags                        = u.need_discard,
                        .gen                        = u.gen,
                        .oldest_gen                = u.oldest_gen,
                        .data_type                = u.data_type,
                        .stripe_redundancy        = u.stripe_redundancy,
                        .dirty_sectors                = u.dirty_sectors,
                        .cached_sectors                = u.cached_sectors,
                        .io_time[READ]                = u.read_time,
                        .io_time[WRITE]                = u.write_time,
                        .stripe                        = u.stripe,
                };

                SET_BCH_ALLOC_V4_BACKPOINTERS_START(out, BCH_ALLOC_V4_U64s);
        }
}

static noinline struct bkey_i_alloc_v4 *
__bch2_alloc_to_v4_mut(struct btree_trans *trans, struct bkey_s_c k)
{
        struct bkey_i_alloc_v4 *ret;

        ret = bch2_trans_kmalloc(trans, max(bkey_bytes(k.k), sizeof(struct bkey_i_alloc_v4)));
        if (IS_ERR(ret))
                return ret;

        if (k.k->type == KEY_TYPE_alloc_v4) {
                void *src, *dst;

                bkey_reassemble(&ret->k_i, k);

                src = alloc_v4_backpointers(&ret->v);
                SET_BCH_ALLOC_V4_BACKPOINTERS_START(&ret->v, BCH_ALLOC_V4_U64s);
                dst = alloc_v4_backpointers(&ret->v);

                if (src < dst)
                        memset(src, 0, dst - src);

                SET_BCH_ALLOC_V4_NR_BACKPOINTERS(&ret->v, 0);
                set_alloc_v4_u64s(ret);
        } else {
                bkey_alloc_v4_init(&ret->k_i);
                ret->k.p = k.k->p;
                bch2_alloc_to_v4(k, &ret->v);
        }
        return ret;
}

static inline struct bkey_i_alloc_v4 *bch2_alloc_to_v4_mut_inlined(struct btree_trans *trans, struct bkey_s_c k)
{
        struct bkey_s_c_alloc_v4 a;

        if (likely(k.k->type == KEY_TYPE_alloc_v4) &&
            ((a = bkey_s_c_to_alloc_v4(k), true) &&
             BCH_ALLOC_V4_NR_BACKPOINTERS(a.v) == 0))
                return bch2_bkey_make_mut_noupdate_typed(trans, k, alloc_v4);

        return __bch2_alloc_to_v4_mut(trans, k);
}

struct bkey_i_alloc_v4 *bch2_alloc_to_v4_mut(struct btree_trans *trans, struct bkey_s_c k)
{
        return bch2_alloc_to_v4_mut_inlined(trans, k);
}

struct bkey_i_alloc_v4 *
bch2_trans_start_alloc_update_noupdate(struct btree_trans *trans, struct btree_iter *iter,
                                       struct bpos pos)
{
        struct bkey_s_c k = bch2_bkey_get_iter(trans, iter, BTREE_ID_alloc, pos,
                                               BTREE_ITER_with_updates|
                                               BTREE_ITER_cached|
                                               BTREE_ITER_intent);
        int ret = bkey_err(k);
        if (unlikely(ret))
                return ERR_PTR(ret);

        struct bkey_i_alloc_v4 *a = bch2_alloc_to_v4_mut_inlined(trans, k);
        ret = PTR_ERR_OR_ZERO(a);
        if (unlikely(ret))
                goto err;
        return a;
err:
        bch2_trans_iter_exit(trans, iter);
        return ERR_PTR(ret);
}

__flatten
struct bkey_i_alloc_v4 *bch2_trans_start_alloc_update(struct btree_trans *trans, struct bpos pos,
                                                      enum btree_iter_update_trigger_flags flags)
{
        struct btree_iter iter;
        struct bkey_i_alloc_v4 *a = bch2_trans_start_alloc_update_noupdate(trans, &iter, pos);
        int ret = PTR_ERR_OR_ZERO(a);
        if (ret)
                return ERR_PTR(ret);

        ret = bch2_trans_update(trans, &iter, &a->k_i, flags);
        bch2_trans_iter_exit(trans, &iter);
        return unlikely(ret) ? ERR_PTR(ret) : a;
}

static struct bpos alloc_gens_pos(struct bpos pos, unsigned *offset)
{
        *offset = pos.offset & KEY_TYPE_BUCKET_GENS_MASK;

        pos.offset >>= KEY_TYPE_BUCKET_GENS_BITS;
        return pos;
}

static struct bpos bucket_gens_pos_to_alloc(struct bpos pos, unsigned offset)
{
        pos.offset <<= KEY_TYPE_BUCKET_GENS_BITS;
        pos.offset += offset;
        return pos;
}

static unsigned alloc_gen(struct bkey_s_c k, unsigned offset)
{
        return k.k->type == KEY_TYPE_bucket_gens
                ? bkey_s_c_to_bucket_gens(k).v->gens[offset]
                : 0;
}

int bch2_bucket_gens_validate(struct bch_fs *c, struct bkey_s_c k,
                             enum bch_validate_flags flags)
{
        int ret = 0;

        bkey_fsck_err_on(bkey_val_bytes(k.k) != sizeof(struct bch_bucket_gens),
                         c, bucket_gens_val_size_bad,
                         "bad val size (%zu != %zu)",
                         bkey_val_bytes(k.k), sizeof(struct bch_bucket_gens));
fsck_err:
        return ret;
}

void bch2_bucket_gens_to_text(struct printbuf *out, struct bch_fs *c, struct bkey_s_c k)
{
        struct bkey_s_c_bucket_gens g = bkey_s_c_to_bucket_gens(k);
        unsigned i;

        for (i = 0; i < ARRAY_SIZE(g.v->gens); i++) {
                if (i)
                        prt_char(out, ' ');
                prt_printf(out, "%u", g.v->gens[i]);
        }
}

int bch2_bucket_gens_init(struct bch_fs *c)
{
        struct btree_trans *trans = bch2_trans_get(c);
        struct bkey_i_bucket_gens g;
        bool have_bucket_gens_key = false;
        int ret;

        ret = for_each_btree_key(trans, iter, BTREE_ID_alloc, POS_MIN,
                                 BTREE_ITER_prefetch, k, ({
                /*
                 * Not a fsck error because this is checked/repaired by
                 * bch2_check_alloc_key() which runs later:
                 */
                if (!bch2_dev_bucket_exists(c, k.k->p))
                        continue;

                struct bch_alloc_v4 a;
                u8 gen = bch2_alloc_to_v4(k, &a)->gen;
                unsigned offset;
                struct bpos pos = alloc_gens_pos(iter.pos, &offset);
                int ret2 = 0;

                if (have_bucket_gens_key && !bkey_eq(g.k.p, pos)) {
                        ret2 =  bch2_btree_insert_trans(trans, BTREE_ID_bucket_gens, &g.k_i, 0) ?:
                                bch2_trans_commit(trans, NULL, NULL, BCH_TRANS_COMMIT_no_enospc);
                        if (ret2)
                                goto iter_err;
                        have_bucket_gens_key = false;
                }

                if (!have_bucket_gens_key) {
                        bkey_bucket_gens_init(&g.k_i);
                        g.k.p = pos;
                        have_bucket_gens_key = true;
                }

                g.v.gens[offset] = gen;
iter_err:
                ret2;
        }));

        if (have_bucket_gens_key && !ret)
                ret = commit_do(trans, NULL, NULL,
                                BCH_TRANS_COMMIT_no_enospc,
                        bch2_btree_insert_trans(trans, BTREE_ID_bucket_gens, &g.k_i, 0));

        bch2_trans_put(trans);

        bch_err_fn(c, ret);
        return ret;
}

int bch2_alloc_read(struct bch_fs *c)
{
        struct btree_trans *trans = bch2_trans_get(c);
        struct bch_dev *ca = NULL;
        int ret;

        if (c->sb.version_upgrade_complete >= bcachefs_metadata_version_bucket_gens) {
                ret = for_each_btree_key(trans, iter, BTREE_ID_bucket_gens, POS_MIN,
                                         BTREE_ITER_prefetch, k, ({
                        u64 start = bucket_gens_pos_to_alloc(k.k->p, 0).offset;
                        u64 end = bucket_gens_pos_to_alloc(bpos_nosnap_successor(k.k->p), 0).offset;

                        if (k.k->type != KEY_TYPE_bucket_gens)
                                continue;

                        ca = bch2_dev_iterate(c, ca, k.k->p.inode);
                        /*
                         * Not a fsck error because this is checked/repaired by
                         * bch2_check_alloc_key() which runs later:
                         */
                        if (!ca) {
                                bch2_btree_iter_set_pos(&iter, POS(k.k->p.inode + 1, 0));
                                continue;
                        }

                        const struct bch_bucket_gens *g = bkey_s_c_to_bucket_gens(k).v;

                        for (u64 b = max_t(u64, ca->mi.first_bucket, start);
                             b < min_t(u64, ca->mi.nbuckets, end);
                             b++)
                                *bucket_gen(ca, b) = g->gens[b & KEY_TYPE_BUCKET_GENS_MASK];
                        0;
                }));
        } else {
                ret = for_each_btree_key(trans, iter, BTREE_ID_alloc, POS_MIN,
                                         BTREE_ITER_prefetch, k, ({
                        ca = bch2_dev_iterate(c, ca, k.k->p.inode);
                        /*
                         * Not a fsck error because this is checked/repaired by
                         * bch2_check_alloc_key() which runs later:
                         */
                        if (!ca) {
                                bch2_btree_iter_set_pos(&iter, POS(k.k->p.inode + 1, 0));
                                continue;
                        }

                        struct bch_alloc_v4 a;
                        *bucket_gen(ca, k.k->p.offset) = bch2_alloc_to_v4(k, &a)->gen;
                        0;
                }));
        }

        bch2_dev_put(ca);
        bch2_trans_put(trans);

        bch_err_fn(c, ret);
        return ret;
}

/* Free space/discard btree: */

static int bch2_bucket_do_index(struct btree_trans *trans,
                                struct bch_dev *ca,
                                struct bkey_s_c alloc_k,
                                const struct bch_alloc_v4 *a,
                                bool set)
{
        struct bch_fs *c = trans->c;
        struct btree_iter iter;
        struct bkey_s_c old;
        struct bkey_i *k;
        enum btree_id btree;
        enum bch_bkey_type old_type = !set ? KEY_TYPE_set : KEY_TYPE_deleted;
        enum bch_bkey_type new_type =  set ? KEY_TYPE_set : KEY_TYPE_deleted;
        struct printbuf buf = PRINTBUF;
        int ret;

        if (a->data_type != BCH_DATA_free &&
            a->data_type != BCH_DATA_need_discard)
                return 0;

        k = bch2_trans_kmalloc_nomemzero(trans, sizeof(*k));
        if (IS_ERR(k))
                return PTR_ERR(k);

        bkey_init(&k->k);
        k->k.type = new_type;

        switch (a->data_type) {
        case BCH_DATA_free:
                btree = BTREE_ID_freespace;
                k->k.p = alloc_freespace_pos(alloc_k.k->p, *a);
                bch2_key_resize(&k->k, 1);
                break;
        case BCH_DATA_need_discard:
                btree = BTREE_ID_need_discard;
                k->k.p = alloc_k.k->p;
                break;
        default:
                return 0;
        }

        old = bch2_bkey_get_iter(trans, &iter, btree,
                             bkey_start_pos(&k->k),
                             BTREE_ITER_intent);
        ret = bkey_err(old);
        if (ret)
                return ret;

        if (ca->mi.freespace_initialized &&
            c->curr_recovery_pass > BCH_RECOVERY_PASS_check_alloc_info &&
            bch2_trans_inconsistent_on(old.k->type != old_type, trans,
                        "incorrect key when %s %s:%llu:%llu:0 (got %s should be %s)\n"
                        "  for %s",
                        set ? "setting" : "clearing",
                        bch2_btree_id_str(btree),
                        iter.pos.inode,
                        iter.pos.offset,
                        bch2_bkey_types[old.k->type],
                        bch2_bkey_types[old_type],
                        (bch2_bkey_val_to_text(&buf, c, alloc_k), buf.buf))) {
                ret = -EIO;
                goto err;
        }

        ret = bch2_trans_update(trans, &iter, k, 0);
err:
        bch2_trans_iter_exit(trans, &iter);
        printbuf_exit(&buf);
        return ret;
}

static noinline int bch2_bucket_gen_update(struct btree_trans *trans,
                                           struct bpos bucket, u8 gen)
{
        struct btree_iter iter;
        unsigned offset;
        struct bpos pos = alloc_gens_pos(bucket, &offset);
        struct bkey_i_bucket_gens *g;
        struct bkey_s_c k;
        int ret;

        g = bch2_trans_kmalloc(trans, sizeof(*g));
        ret = PTR_ERR_OR_ZERO(g);
        if (ret)
                return ret;

        k = bch2_bkey_get_iter(trans, &iter, BTREE_ID_bucket_gens, pos,
                               BTREE_ITER_intent|
                               BTREE_ITER_with_updates);
        ret = bkey_err(k);
        if (ret)
                return ret;

        if (k.k->type != KEY_TYPE_bucket_gens) {
                bkey_bucket_gens_init(&g->k_i);
                g->k.p = iter.pos;
        } else {
                bkey_reassemble(&g->k_i, k);
        }

        g->v.gens[offset] = gen;

        ret = bch2_trans_update(trans, &iter, &g->k_i, 0);
        bch2_trans_iter_exit(trans, &iter);
        return ret;
}

static inline int bch2_dev_data_type_accounting_mod(struct btree_trans *trans, struct bch_dev *ca,
                                                    enum bch_data_type data_type,
                                                    s64 delta_buckets,
                                                    s64 delta_sectors,
                                                    s64 delta_fragmented, unsigned flags)
{
        struct disk_accounting_pos acc = {
                .type = BCH_DISK_ACCOUNTING_dev_data_type,
                .dev_data_type.dev                = ca->dev_idx,
                .dev_data_type.data_type        = data_type,
        };
        s64 d[3] = { delta_buckets, delta_sectors, delta_fragmented };

        return bch2_disk_accounting_mod(trans, &acc, d, 3, flags & BTREE_TRIGGER_gc);
}

int bch2_alloc_key_to_dev_counters(struct btree_trans *trans, struct bch_dev *ca,
                                   const struct bch_alloc_v4 *old,
                                   const struct bch_alloc_v4 *new,
                                   unsigned flags)
{
        s64 old_sectors = bch2_bucket_sectors(*old);
        s64 new_sectors = bch2_bucket_sectors(*new);
        if (old->data_type != new->data_type) {
                int ret = bch2_dev_data_type_accounting_mod(trans, ca, new->data_type,
                                 1,  new_sectors,  bch2_bucket_sectors_fragmented(ca, *new), flags) ?:
                          bch2_dev_data_type_accounting_mod(trans, ca, old->data_type,
                                -1, -old_sectors, -bch2_bucket_sectors_fragmented(ca, *old), flags);
                if (ret)
                        return ret;
        } else if (old_sectors != new_sectors) {
                int ret = bch2_dev_data_type_accounting_mod(trans, ca, new->data_type,
                                         0,
                                         new_sectors - old_sectors,
                                         bch2_bucket_sectors_fragmented(ca, *new) -
                                         bch2_bucket_sectors_fragmented(ca, *old), flags);
                if (ret)
                        return ret;
        }

        s64 old_unstriped = bch2_bucket_sectors_unstriped(*old);
        s64 new_unstriped = bch2_bucket_sectors_unstriped(*new);
        if (old_unstriped != new_unstriped) {
                int ret = bch2_dev_data_type_accounting_mod(trans, ca, BCH_DATA_unstriped,
                                         !!new_unstriped - !!old_unstriped,
                                         new_unstriped - old_unstriped,
                                         0,
                                         flags);
                if (ret)
                        return ret;
        }

        return 0;
}

int bch2_trigger_alloc(struct btree_trans *trans,
                       enum btree_id btree, unsigned level,
                       struct bkey_s_c old, struct bkey_s new,
                       enum btree_iter_update_trigger_flags flags)
{
        struct bch_fs *c = trans->c;
        struct printbuf buf = PRINTBUF;
        int ret = 0;

        struct bch_dev *ca = bch2_dev_bucket_tryget(c, new.k->p);
        if (!ca)
                return -EIO;

        struct bch_alloc_v4 old_a_convert;
        const struct bch_alloc_v4 *old_a = bch2_alloc_to_v4(old, &old_a_convert);

        struct bch_alloc_v4 *new_a;
        if (likely(new.k->type == KEY_TYPE_alloc_v4)) {
                new_a = bkey_s_to_alloc_v4(new).v;
        } else {
                BUG_ON(!(flags & (BTREE_TRIGGER_gc|BTREE_TRIGGER_check_repair)));

                struct bkey_i_alloc_v4 *new_ka = bch2_alloc_to_v4_mut_inlined(trans, new.s_c);
                ret = PTR_ERR_OR_ZERO(new_ka);
                if (unlikely(ret))
                        goto err;
                new_a = &new_ka->v;
        }

        if (flags & BTREE_TRIGGER_transactional) {
                alloc_data_type_set(new_a, new_a->data_type);

                if (bch2_bucket_sectors_total(*new_a) > bch2_bucket_sectors_total(*old_a)) {
                        new_a->io_time[READ] = bch2_current_io_time(c, READ);
                        new_a->io_time[WRITE]= bch2_current_io_time(c, WRITE);
                        SET_BCH_ALLOC_V4_NEED_INC_GEN(new_a, true);
                        SET_BCH_ALLOC_V4_NEED_DISCARD(new_a, true);
                }

                if (data_type_is_empty(new_a->data_type) &&
                    BCH_ALLOC_V4_NEED_INC_GEN(new_a) &&
                    !bch2_bucket_is_open_safe(c, new.k->p.inode, new.k->p.offset)) {
                        new_a->gen++;
                        SET_BCH_ALLOC_V4_NEED_INC_GEN(new_a, false);
                        alloc_data_type_set(new_a, new_a->data_type);
                }

                if (old_a->data_type != new_a->data_type ||
                    (new_a->data_type == BCH_DATA_free &&
                     alloc_freespace_genbits(*old_a) != alloc_freespace_genbits(*new_a))) {
                        ret =   bch2_bucket_do_index(trans, ca, old, old_a, false) ?:
                                bch2_bucket_do_index(trans, ca, new.s_c, new_a, true);
                        if (ret)
                                goto err;
                }

                if (new_a->data_type == BCH_DATA_cached &&
                    !new_a->io_time[READ])
                        new_a->io_time[READ] = bch2_current_io_time(c, READ);

                u64 old_lru = alloc_lru_idx_read(*old_a);
                u64 new_lru = alloc_lru_idx_read(*new_a);
                if (old_lru != new_lru) {
                        ret = bch2_lru_change(trans, new.k->p.inode,
                                              bucket_to_u64(new.k->p),
                                              old_lru, new_lru);
                        if (ret)
                                goto err;
                }

                new_a->fragmentation_lru = alloc_lru_idx_fragmentation(*new_a, ca);
                if (old_a->fragmentation_lru != new_a->fragmentation_lru) {
                        ret = bch2_lru_change(trans,
                                        BCH_LRU_FRAGMENTATION_START,
                                        bucket_to_u64(new.k->p),
                                        old_a->fragmentation_lru, new_a->fragmentation_lru);
                        if (ret)
                                goto err;
                }

                if (old_a->gen != new_a->gen) {
                        ret = bch2_bucket_gen_update(trans, new.k->p, new_a->gen);
                        if (ret)
                                goto err;
                }

                if ((flags & BTREE_TRIGGER_bucket_invalidate) &&
                    old_a->cached_sectors) {
                        ret = bch2_mod_dev_cached_sectors(trans, ca->dev_idx,
                                         -((s64) old_a->cached_sectors),
                                         flags & BTREE_TRIGGER_gc);
                        if (ret)
                                goto err;
                }

                ret = bch2_alloc_key_to_dev_counters(trans, ca, old_a, new_a, flags);
                if (ret)
                        goto err;
        }

        if ((flags & BTREE_TRIGGER_atomic) && (flags & BTREE_TRIGGER_insert)) {
                u64 journal_seq = trans->journal_res.seq;
                u64 bucket_journal_seq = new_a->journal_seq;

                if ((flags & BTREE_TRIGGER_insert) &&
                    data_type_is_empty(old_a->data_type) !=
                    data_type_is_empty(new_a->data_type) &&
                    new.k->type == KEY_TYPE_alloc_v4) {
                        struct bch_alloc_v4 *v = bkey_s_to_alloc_v4(new).v;

                        /*
                         * If the btree updates referring to a bucket weren't flushed
                         * before the bucket became empty again, then the we don't have
                         * to wait on a journal flush before we can reuse the bucket:
                         */
                        v->journal_seq = bucket_journal_seq =
                                data_type_is_empty(new_a->data_type) &&
                                (journal_seq == v->journal_seq ||
                                 bch2_journal_noflush_seq(&c->journal, v->journal_seq))
                                ? 0 : journal_seq;
                }

                if (!data_type_is_empty(old_a->data_type) &&am