1	// SPDX-License-Identifier: GPL-2.0+
2	/*
3	* Copyright (C) 2016 Oracle. All Rights Reserved.
4	* Author: Darrick J. Wong <darrick.wong@oracle.com>
5	*/
6	#include "xfs.h"
7	#include "xfs_fs.h"
8	#include "xfs_shared.h"
9	#include "xfs_format.h"
10	#include "xfs_log_format.h"
11	#include "xfs_trans_resv.h"
12	#include "xfs_mount.h"
13	#include "xfs_defer.h"
14	#include "xfs_inode.h"
15	#include "xfs_trans.h"
16	#include "xfs_bmap.h"
17	#include "xfs_bmap_util.h"
18	#include "xfs_trace.h"
19	#include "xfs_icache.h"
20	#include "xfs_btree.h"
21	#include "xfs_refcount_btree.h"
22	#include "xfs_refcount.h"
23	#include "xfs_bmap_btree.h"
24	#include "xfs_trans_space.h"
25	#include "xfs_bit.h"
26	#include "xfs_alloc.h"
27	#include "xfs_quota.h"
28	#include "xfs_reflink.h"
29	#include "xfs_iomap.h"
30	#include "xfs_ag.h"
31	#include "xfs_ag_resv.h"
32
33	/*
34	* Copy on Write of Shared Blocks
35	*
36	* XFS must preserve "the usual" file semantics even when two files share
37	* the same physical blocks. This means that a write to one file must not
38	* alter the blocks in a different file; the way that we'll do that is
39	* through the use of a copy-on-write mechanism. At a high level, that
40	* means that when we want to write to a shared block, we allocate a new
41	* block, write the data to the new block, and if that succeeds we map the
42	* new block into the file.
43	*
44	* XFS provides a "delayed allocation" mechanism that defers the allocation
45	* of disk blocks to dirty-but-not-yet-mapped file blocks as long as
46	* possible. This reduces fragmentation by enabling the filesystem to ask
47	* for bigger chunks less often, which is exactly what we want for CoW.
48	*
49	* The delalloc mechanism begins when the kernel wants to make a block
50	* writable (write_begin or page_mkwrite). If the offset is not mapped, we
51	* create a delalloc mapping, which is a regular in-core extent, but without
52	* a real startblock. (For delalloc mappings, the startblock encodes both
53	* a flag that this is a delalloc mapping, and a worst-case estimate of how
54	* many blocks might be required to put the mapping into the BMBT.) delalloc
55	* mappings are a reservation against the free space in the filesystem;
56	* adjacent mappings can also be combined into fewer larger mappings.
57	*
58	* As an optimization, the CoW extent size hint (cowextsz) creates
59	* outsized aligned delalloc reservations in the hope of landing out of
60	* order nearby CoW writes in a single extent on disk, thereby reducing
61	* fragmentation and improving future performance.
62	*
63	* D: --RRRRRRSSSRRRRRRRR--- (data fork)
64	* C: ------DDDDDDD--------- (CoW fork)
65	*
66	* When dirty pages are being written out (typically in writepage), the
67	* delalloc reservations are converted into unwritten mappings by
68	* allocating blocks and replacing the delalloc mapping with real ones.
69	* A delalloc mapping can be replaced by several unwritten ones if the
70	* free space is fragmented.
71	*
72	* D: --RRRRRRSSSRRRRRRRR---
73	* C: ------UUUUUUU---------
74	*
75	* We want to adapt the delalloc mechanism for copy-on-write, since the
76	* write paths are similar. The first two steps (creating the reservation
77	* and allocating the blocks) are exactly the same as delalloc except that
78	* the mappings must be stored in a separate CoW fork because we do not want
79	* to disturb the mapping in the data fork until we're sure that the write
80	* succeeded. IO completion in this case is the process of removing the old
81	* mapping from the data fork and moving the new mapping from the CoW fork to
82	* the data fork. This will be discussed shortly.
83	*
84	* For now, unaligned directio writes will be bounced back to the page cache.
85	* Block-aligned directio writes will use the same mechanism as buffered
86	* writes.
87	*
88	* Just prior to submitting the actual disk write requests, we convert
89	* the extents representing the range of the file actually being written
90	* (as opposed to extra pieces created for the cowextsize hint) to real
91	* extents. This will become important in the next step:
92	*
93	* D: --RRRRRRSSSRRRRRRRR---
94	* C: ------UUrrUUU---------
95	*
96	* CoW remapping must be done after the data block write completes,
97	* because we don't want to destroy the old data fork map until we're sure
98	* the new block has been written. Since the new mappings are kept in a
99	* separate fork, we can simply iterate these mappings to find the ones
100	* that cover the file blocks that we just CoW'd. For each extent, simply
101	* unmap the corresponding range in the data fork, map the new range into
102	* the data fork, and remove the extent from the CoW fork. Because of
103	* the presence of the cowextsize hint, however, we must be careful
104	* only to remap the blocks that we've actually written out -- we must
105	* never remap delalloc reservations nor CoW staging blocks that have
106	* yet to be written. This corresponds exactly to the real extents in
107	* the CoW fork:
108	*
109	* D: --RRRRRRrrSRRRRRRRR---
110	* C: ------UU--UUU---------
111	*
112	* Since the remapping operation can be applied to an arbitrary file
113	* range, we record the need for the remap step as a flag in the ioend
114	* instead of declaring a new IO type. This is required for direct io
115	* because we only have ioend for the whole dio, and we have to be able to
116	* remember the presence of unwritten blocks and CoW blocks with a single
117	* ioend structure. Better yet, the more ground we can cover with one
118	* ioend, the better.
119	*/
120
121	/*
122	* Given an AG extent, find the lowest-numbered run of shared blocks
123	* within that range and return the range in fbno/flen. If
124	* find_end_of_shared is true, return the longest contiguous extent of
125	* shared blocks. If there are no shared extents, fbno and flen will
126	* be set to NULLAGBLOCK and 0, respectively.
127	*/
128	static int
129	xfs_reflink_find_shared(
130	struct xfs_perag *pag,
131	struct xfs_trans *tp,
132	xfs_agblock_t agbno,
133	xfs_extlen_t aglen,
134	xfs_agblock_t *fbno,
135	xfs_extlen_t *flen,
136	bool find_end_of_shared)
137	{
138	struct xfs_buf *agbp;
139	struct xfs_btree_cur *cur;
140	int error;
141
142	error = xfs_alloc_read_agf(pag, tp, 0, &agbp);
143	if (error)
144	return error;
145
146	cur = xfs_refcountbt_init_cursor(pag->pag_mount, tp, agbp, pag);
147
148	error = xfs_refcount_find_shared(cur, agbno, aglen, fbno, flen,
149	find_end_of_shared);
150
151	xfs_btree_del_cursor(cur, error);
152
153	xfs_trans_brelse(tp, agbp);
154	return error;
155	}
156
157	/*
158	* Trim the mapping to the next block where there's a change in the
159	* shared/unshared status. More specifically, this means that we
160	* find the lowest-numbered extent of shared blocks that coincides with
161	* the given block mapping. If the shared extent overlaps the start of
162	* the mapping, trim the mapping to the end of the shared extent. If
163	* the shared region intersects the mapping, trim the mapping to the
164	* start of the shared extent. If there are no shared regions that
165	* overlap, just return the original extent.
166	*/
167	int
168	xfs_reflink_trim_around_shared(
169	struct xfs_inode *ip,
170	struct xfs_bmbt_irec *irec,
171	bool *shared)
172	{
173	struct xfs_mount *mp = ip->i_mount;
174	struct xfs_perag *pag;
175	xfs_agblock_t agbno;
176	xfs_extlen_t aglen;
177	xfs_agblock_t fbno;
178	xfs_extlen_t flen;
179	int error = 0;
180
181	/* Holes, unwritten, and delalloc extents cannot be shared */
182	if (!xfs_is_cow_inode(ip) || !xfs_bmap_is_written_extent(irec)) {
183	*shared = false;
184	return 0;
185	}
186
187	trace_xfs_reflink_trim_around_shared(ip, irec);
188
189	pag = xfs_perag_get(mp, XFS_FSB_TO_AGNO(mp, irec->br_startblock));
190	agbno = XFS_FSB_TO_AGBNO(mp, irec->br_startblock);
191	aglen = irec->br_blockcount;
192
193	error = xfs_reflink_find_shared(pag, NULL, agbno, aglen, &fbno, &flen,
194	true);
195	xfs_perag_put(pag);
196	if (error)
197	return error;
198
199	*shared = false;
200	if (fbno == NULLAGBLOCK) {
201	/* No shared blocks at all. */
202	return 0;
203	}
204
205	if (fbno == agbno) {
206	/*
207	* The start of this extent is shared. Truncate the
208	* mapping at the end of the shared region so that a
209	* subsequent iteration starts at the start of the
210	* unshared region.
211	*/
212	irec->br_blockcount = flen;
213	*shared = true;
214	return 0;
215	}
216
217	/*
218	* There's a shared extent midway through this extent.
219	* Truncate the mapping at the start of the shared
220	* extent so that a subsequent iteration starts at the
221	* start of the shared region.
222	*/
223	irec->br_blockcount = fbno - agbno;
224	return 0;
225	}
226
227	int
228	xfs_bmap_trim_cow(
229	struct xfs_inode *ip,
230	struct xfs_bmbt_irec *imap,
231	bool *shared)
232	{
233	/* We can't update any real extents in always COW mode. */
234	if (xfs_is_always_cow_inode(ip) &&
235	!isnullstartblock(imap->br_startblock)) {
236	*shared = true;
237	return 0;
238	}
239
240	/* Trim the mapping to the nearest shared extent boundary. */
241	return xfs_reflink_trim_around_shared(ip, irec: imap, shared);
242	}
243
244	static int
245	xfs_reflink_convert_cow_locked(
246	struct xfs_inode *ip,
247	xfs_fileoff_t offset_fsb,
248	xfs_filblks_t count_fsb)
249	{
250	struct xfs_iext_cursor icur;
251	struct xfs_bmbt_irec got;
252	struct xfs_btree_cur *dummy_cur = NULL;
253	int dummy_logflags;
254	int error = 0;
255
256	if (!xfs_iext_lookup_extent(ip, ip->i_cowfp, offset_fsb, &icur, &got))
257	return 0;
258
259	do {
260	if (got.br_startoff >= offset_fsb + count_fsb)
261	break;
262	if (got.br_state == XFS_EXT_NORM)
263	continue;
264	if (WARN_ON_ONCE(isnullstartblock(got.br_startblock)))
265	return -EIO;
266
267	xfs_trim_extent(&got, offset_fsb, count_fsb);
268	if (!got.br_blockcount)
269	continue;
270
271	got.br_state = XFS_EXT_NORM;
272	error = xfs_bmap_add_extent_unwritten_real(NULL, ip,
273	XFS_COW_FORK, &icur, &dummy_cur, &got,
274	&dummy_logflags);
275	if (error)
276	return error;
277	} while (xfs_iext_next_extent(ip->i_cowfp, &icur, &got));
278
279	return error;
280	}
281
282	/* Convert all of the unwritten CoW extents in a file's range to real ones. */
283	int
284	xfs_reflink_convert_cow(
285	struct xfs_inode *ip,
286	xfs_off_t offset,
287	xfs_off_t count)
288	{
289	struct xfs_mount *mp = ip->i_mount;
290	xfs_fileoff_t offset_fsb = XFS_B_TO_FSBT(mp, offset);
291	xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, offset + count);
292	xfs_filblks_t count_fsb = end_fsb - offset_fsb;
293	int error;
294
295	ASSERT(count != 0);
296
297	xfs_ilock(ip, XFS_ILOCK_EXCL);
298	error = xfs_reflink_convert_cow_locked(ip, offset_fsb, count_fsb);
299	xfs_iunlock(ip, XFS_ILOCK_EXCL);
300	return error;
301	}
302
303	/*
304	* Find the extent that maps the given range in the COW fork. Even if the extent
305	* is not shared we might have a preallocation for it in the COW fork. If so we
306	* use it that rather than trigger a new allocation.
307	*/
308	static int
309	xfs_find_trim_cow_extent(
310	struct xfs_inode *ip,
311	struct xfs_bmbt_irec *imap,
312	struct xfs_bmbt_irec *cmap,
313	bool *shared,
314	bool *found)
315	{
316	xfs_fileoff_t offset_fsb = imap->br_startoff;
317	xfs_filblks_t count_fsb = imap->br_blockcount;
318	struct xfs_iext_cursor icur;
319
320	*found = false;
321
322	/*
323	* If we don't find an overlapping extent, trim the range we need to
324	* allocate to fit the hole we found.
325	*/
326	if (!xfs_iext_lookup_extent(ip, ip->i_cowfp, offset_fsb, &icur, cmap))
327	cmap->br_startoff = offset_fsb + count_fsb;
328	if (cmap->br_startoff > offset_fsb) {
329	xfs_trim_extent(imap, imap->br_startoff,
330	cmap->br_startoff - imap->br_startoff);
331	return xfs_bmap_trim_cow(ip, imap, shared);
332	}
333
334	*shared = true;
335	if (isnullstartblock(cmap->br_startblock)) {
336	xfs_trim_extent(imap, cmap->br_startoff, cmap->br_blockcount);
337	return 0;
338	}
339
340	/* real extent found - no need to allocate */
341	xfs_trim_extent(cmap, offset_fsb, count_fsb);
342	*found = true;
343	return 0;
344	}
345
346	static int
347	xfs_reflink_convert_unwritten(
348	struct xfs_inode *ip,
349	struct xfs_bmbt_irec *imap,
350	struct xfs_bmbt_irec *cmap,
351	bool convert_now)
352	{
353	xfs_fileoff_t offset_fsb = imap->br_startoff;
354	xfs_filblks_t count_fsb = imap->br_blockcount;
355	int error;
356
357	/*
358	* cmap might larger than imap due to cowextsize hint.
359	*/
360	xfs_trim_extent(cmap, offset_fsb, count_fsb);
361
362	/*
363	* COW fork extents are supposed to remain unwritten until we're ready
364	* to initiate a disk write. For direct I/O we are going to write the
365	* data and need the conversion, but for buffered writes we're done.
366	*/
367	if (!convert_now || cmap->br_state == XFS_EXT_NORM)
368	return 0;
369
370	trace_xfs_reflink_convert_cow(ip, irec: cmap);
371
372	error = xfs_reflink_convert_cow_locked(ip, offset_fsb, count_fsb);
373	if (!error)
374	cmap->br_state = XFS_EXT_NORM;
375
376	return error;
377	}
378
379	static int
380	xfs_reflink_fill_cow_hole(
381	struct xfs_inode *ip,
382	struct xfs_bmbt_irec *imap,
383	struct xfs_bmbt_irec *cmap,
384	bool *shared,
385	uint *lockmode,
386	bool convert_now)
387	{
388	struct xfs_mount *mp = ip->i_mount;
389	struct xfs_trans *tp;
390	xfs_filblks_t resaligned;
391	xfs_extlen_t resblks;
392	int nimaps;
393	int error;
394	bool found;
395
396	resaligned = xfs_aligned_fsb_count(imap->br_startoff,
397	imap->br_blockcount, xfs_get_cowextsz_hint(ip));
398	resblks = XFS_DIOSTRAT_SPACE_RES(mp, resaligned);
399
400	xfs_iunlock(ip, *lockmode);
401	*lockmode = 0;
402
403	error = xfs_trans_alloc_inode(ip, &M_RES(mp)->tr_write, resblks, 0,
404	false, &tp);
405	if (error)
406	return error;
407
408	*lockmode = XFS_ILOCK_EXCL;
409
410	error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, found: &found);
411	if (error || !*shared)
412	goto out_trans_cancel;
413
414	if (found) {
415	xfs_trans_cancel(tp);
416	goto convert;
417	}
418
419	/* Allocate the entire reservation as unwritten blocks. */
420	nimaps = 1;
421	error = xfs_bmapi_write(tp, ip, imap->br_startoff, imap->br_blockcount,
422	XFS_BMAPI_COWFORK | XFS_BMAPI_PREALLOC, 0, cmap,
423	&nimaps);
424	if (error)
425	goto out_trans_cancel;
426
427	xfs_inode_set_cowblocks_tag(ip);
428	error = xfs_trans_commit(tp);
429	if (error)
430	return error;
431
432	/*
433	* Allocation succeeded but the requested range was not even partially
434	* satisfied? Bail out!
435	*/
436	if (nimaps == 0)
437	return -ENOSPC;
438
439	convert:
440	return xfs_reflink_convert_unwritten(ip, imap, cmap, convert_now);
441
442	out_trans_cancel:
443	xfs_trans_cancel(tp);
444	return error;
445	}
446
447	static int
448	xfs_reflink_fill_delalloc(
449	struct xfs_inode *ip,
450	struct xfs_bmbt_irec *imap,
451	struct xfs_bmbt_irec *cmap,
452	bool *shared,
453	uint *lockmode,
454	bool convert_now)
455	{
456	struct xfs_mount *mp = ip->i_mount;
457	struct xfs_trans *tp;
458	int nimaps;
459	int error;
460	bool found;
461
462	do {
463	xfs_iunlock(ip, *lockmode);
464	*lockmode = 0;
465
466	error = xfs_trans_alloc_inode(ip, resv: &M_RES(mp)->tr_write, dblocks: 0, rblocks: 0,
467	force: false, tpp: &tp);
468	if (error)
469	return error;
470
471	*lockmode = XFS_ILOCK_EXCL;
472
473	error = xfs_find_trim_cow_extent(ip, imap, cmap, shared,
474	found: &found);
475	if (error || !*shared)
476	goto out_trans_cancel;
477
478	if (found) {
479	xfs_trans_cancel(tp);
480	break;
481	}
482
483	ASSERT(isnullstartblock(cmap->br_startblock) ||
484	cmap->br_startblock == DELAYSTARTBLOCK);
485
486	/*
487	* Replace delalloc reservation with an unwritten extent.
488	*/
489	nimaps = 1;
490	error = xfs_bmapi_write(tp, ip, cmap->br_startoff,
491	cmap->br_blockcount,
492	XFS_BMAPI_COWFORK | XFS_BMAPI_PREALLOC, 0,
493	cmap, &nimaps);
494	if (error)
495	goto out_trans_cancel;
496
497	xfs_inode_set_cowblocks_tag(ip);
498	error = xfs_trans_commit(tp);
499	if (error)
500	return error;
501
502	/*
503	* Allocation succeeded but the requested range was not even
504	* partially satisfied? Bail out!
505	*/
506	if (nimaps == 0)
507	return -ENOSPC;
508	} while (cmap->br_startoff + cmap->br_blockcount <= imap->br_startoff);
509
510	return xfs_reflink_convert_unwritten(ip, imap, cmap, convert_now);
511
512	out_trans_cancel:
513	xfs_trans_cancel(tp);
514	return error;
515	}
516
517	/* Allocate all CoW reservations covering a range of blocks in a file. */
518	int
519	xfs_reflink_allocate_cow(
520	struct xfs_inode *ip,
521	struct xfs_bmbt_irec *imap,
522	struct xfs_bmbt_irec *cmap,
523	bool *shared,
524	uint *lockmode,
525	bool convert_now)
526	{
527	int error;
528	bool found;
529
530	ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
531	if (!ip->i_cowfp) {
532	ASSERT(!xfs_is_reflink_inode(ip));
533	xfs_ifork_init_cow(ip);
534	}
535
536	error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, found: &found);
537	if (error || !*shared)
538	return error;
539
540	/* CoW fork has a real extent */
541	if (found)
542	return xfs_reflink_convert_unwritten(ip, imap, cmap,
543	convert_now);
544
545	/*
546	* CoW fork does not have an extent and data extent is shared.
547	* Allocate a real extent in the CoW fork.
548	*/
549	if (cmap->br_startoff > imap->br_startoff)
550	return xfs_reflink_fill_cow_hole(ip, imap, cmap, shared,
551	lockmode, convert_now);
552
553	/*
554	* CoW fork has a delalloc reservation. Replace it with a real extent.
555	* There may or may not be a data fork mapping.
556	*/
557	if (isnullstartblock(cmap->br_startblock) ||
558	cmap->br_startblock == DELAYSTARTBLOCK)
559	return xfs_reflink_fill_delalloc(ip, imap, cmap, shared,
560	lockmode, convert_now);
561
562	/* Shouldn't get here. */
563	ASSERT(0);
564	return -EFSCORRUPTED;
565	}
566
567	/*
568	* Cancel CoW reservations for some block range of an inode.
569	*
570	* If cancel_real is true this function cancels all COW fork extents for the
571	* inode; if cancel_real is false, real extents are not cleared.
572	*
573	* Caller must have already joined the inode to the current transaction. The
574	* inode will be joined to the transaction returned to the caller.
575	*/
576	int
577	xfs_reflink_cancel_cow_blocks(
578	struct xfs_inode *ip,
579	struct xfs_trans **tpp,
580	xfs_fileoff_t offset_fsb,
581	xfs_fileoff_t end_fsb,
582	bool cancel_real)
583	{
584	struct xfs_ifork *ifp = xfs_ifork_ptr(ip, XFS_COW_FORK);
585	struct xfs_bmbt_irec got, del;
586	struct xfs_iext_cursor icur;
587	int error = 0;
588
589	if (!xfs_inode_has_cow_data(ip))
590	return 0;
591	if (!xfs_iext_lookup_extent_before(ip, ifp, &end_fsb, &icur, &got))
592	return 0;
593
594	/* Walk backwards until we're out of the I/O range... */
595	while (got.br_startoff + got.br_blockcount > offset_fsb) {
596	del = got;
597	xfs_trim_extent(&del, offset_fsb, end_fsb - offset_fsb);
598
599	/* Extent delete may have bumped ext forward */
600	if (!del.br_blockcount) {
601	xfs_iext_prev(ifp, &icur);
602	goto next_extent;
603	}
604
605	trace_xfs_reflink_cancel_cow(ip, irec: &del);
606
607	if (isnullstartblock(del.br_startblock)) {
608	error = xfs_bmap_del_extent_delay(ip, XFS_COW_FORK,
609	&icur, &got, &del);
610	if (error)
611	break;
612	} else if (del.br_state == XFS_EXT_UNWRITTEN || cancel_real) {
613	ASSERT((*tpp)->t_highest_agno == NULLAGNUMBER);
614
615	/* Free the CoW orphan record. */
616	xfs_refcount_free_cow_extent(*tpp, del.br_startblock,
617	del.br_blockcount);
618
619	error = xfs_free_extent_later(*tpp, del.br_startblock,
620	del.br_blockcount, NULL,
621	XFS_AG_RESV_NONE);
622	if (error)
623	break;
624
625	/* Roll the transaction */
626	error = xfs_defer_finish(tpp);
627	if (error)
628	break;
629
630	/* Remove the mapping from the CoW fork. */
631	xfs_bmap_del_extent_cow(ip, &icur, &got, &del);
632
633	/* Remove the quota reservation */
634	error = xfs_quota_unreserve_blkres(ip,
635	blocks: del.br_blockcount);
636	if (error)
637	break;
638	} else {
639	/* Didn't do anything, push cursor back. */
640	xfs_iext_prev(ifp, &icur);
641	}
642	next_extent:
643	if (!xfs_iext_get_extent(ifp, &icur, &got))
644	break;
645	}
646
647	/* clear tag if cow fork is emptied */
648	if (!ifp->if_bytes)
649	xfs_inode_clear_cowblocks_tag(ip);
650	return error;
651	}
652
653	/*
654	* Cancel CoW reservations for some byte range of an inode.
655	*
656	* If cancel_real is true this function cancels all COW fork extents for the
657	* inode; if cancel_real is false, real extents are not cleared.
658	*/
659	int
660	xfs_reflink_cancel_cow_range(
661	struct xfs_inode *ip,
662	xfs_off_t offset,
663	xfs_off_t count,
664	bool cancel_real)
665	{
666	struct xfs_trans *tp;
667	xfs_fileoff_t offset_fsb;
668	xfs_fileoff_t end_fsb;
669	int error;
670
671	trace_xfs_reflink_cancel_cow_range(ip, offset, count);
672	ASSERT(ip->i_cowfp);
673
674	offset_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
675	if (count == NULLFILEOFF)
676	end_fsb = NULLFILEOFF;
677	else
678	end_fsb = XFS_B_TO_FSB(ip->i_mount, offset + count);
679
680	/* Start a rolling transaction to remove the mappings */
681	error = xfs_trans_alloc(mp: ip->i_mount, resp: &M_RES(ip->i_mount)->tr_write,
682	blocks: 0, rtextents: 0, flags: 0, tpp: &tp);
683	if (error)
684	goto out;
685
686	xfs_ilock(ip, XFS_ILOCK_EXCL);
687	xfs_trans_ijoin(tp, ip, 0);
688
689	/* Scrape out the old CoW reservations */
690	error = xfs_reflink_cancel_cow_blocks(ip, &tp, offset_fsb, end_fsb,
691	cancel_real);
692	if (error)
693	goto out_cancel;
694
695	error = xfs_trans_commit(tp);
696
697	xfs_iunlock(ip, XFS_ILOCK_EXCL);
698	return error;
699
700	out_cancel:
701	xfs_trans_cancel(tp);
702	xfs_iunlock(ip, XFS_ILOCK_EXCL);
703	out:
704	trace_xfs_reflink_cancel_cow_range_error(ip, error, _RET_IP_);
705	return error;
706	}
707
708	/*
709	* Remap part of the CoW fork into the data fork.
710	*
711	* We aim to remap the range starting at @offset_fsb and ending at @end_fsb
712	* into the data fork; this function will remap what it can (at the end of the
713	* range) and update @end_fsb appropriately. Each remap gets its own
714	* transaction because we can end up merging and splitting bmbt blocks for
715	* every remap operation and we'd like to keep the block reservation
716	* requirements as low as possible.
717	*/
718	STATIC int
719	xfs_reflink_end_cow_extent(
720	struct xfs_inode *ip,
721	xfs_fileoff_t *offset_fsb,
722	xfs_fileoff_t end_fsb)
723	{
724	struct xfs_iext_cursor icur;
725	struct xfs_bmbt_irec got, del, data;
726	struct xfs_mount *mp = ip->i_mount;
727	struct xfs_trans *tp;
728	struct xfs_ifork *ifp = xfs_ifork_ptr(ip, XFS_COW_FORK);
729	unsigned int resblks;
730	int nmaps;
731	int error;
732
733	/* No COW extents? That's easy! */
734	if (ifp->if_bytes == 0) {
735	*offset_fsb = end_fsb;
736	return 0;
737	}
738
739	resblks = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
740	error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, resblks, 0,
741	XFS_TRANS_RESERVE, &tp);
742	if (error)
743	return error;
744
745	/*
746	* Lock the inode. We have to ijoin without automatic unlock because
747	* the lead transaction is the refcountbt record deletion; the data
748	* fork update follows as a deferred log item.
749	*/
750	xfs_ilock(ip, XFS_ILOCK_EXCL);
751	xfs_trans_ijoin(tp, ip, 0);
752
753	error = xfs_iext_count_may_overflow(ip, XFS_DATA_FORK,
754	XFS_IEXT_REFLINK_END_COW_CNT);
755	if (error == -EFBIG)
756	error = xfs_iext_count_upgrade(tp, ip,
757	XFS_IEXT_REFLINK_END_COW_CNT);
758	if (error)
759	goto out_cancel;
760
761	/*
762	* In case of racing, overlapping AIO writes no COW extents might be
763	* left by the time I/O completes for the loser of the race. In that
764	* case we are done.
765	*/
766	if (!xfs_iext_lookup_extent(ip, ifp, *offset_fsb, &icur, &got) ||
767	got.br_startoff >= end_fsb) {
768	*offset_fsb = end_fsb;
769	goto out_cancel;
770	}
771
772	/*
773	* Only remap real extents that contain data. With AIO, speculative
774	* preallocations can leak into the range we are called upon, and we
775	* need to skip them. Preserve @got for the eventual CoW fork
776	* deletion; from now on @del represents the mapping that we're
777	* actually remapping.
778	*/
779	while (!xfs_bmap_is_written_extent(&got)) {
780	if (!xfs_iext_next_extent(ifp, &icur, &got) ||
781	got.br_startoff >= end_fsb) {
782	*offset_fsb = end_fsb;
783	goto out_cancel;
784	}
785	}
786	del = got;
787
788	/* Grab the corresponding mapping in the data fork. */
789	nmaps = 1;
790	error = xfs_bmapi_read(ip, del.br_startoff, del.br_blockcount, &data,
791	&nmaps, 0);
792	if (error)
793	goto out_cancel;
794
795	/* We can only remap the smaller of the two extent sizes. */
796	data.br_blockcount = min(data.br_blockcount, del.br_blockcount);
797	del.br_blockcount = data.br_blockcount;
798
799	trace_xfs_reflink_cow_remap_from(ip, irec: &del);
800	trace_xfs_reflink_cow_remap_to(ip, irec: &data);
801
802	if (xfs_bmap_is_real_extent(&data)) {
803	/*
804	* If the extent we're remapping is backed by storage (written
805	* or not), unmap the extent and drop its refcount.
806	*/
807	xfs_bmap_unmap_extent(tp, ip, &data);
808	xfs_refcount_decrease_extent(tp, &data);
809	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT,
810	-data.br_blockcount);
811	} else if (data.br_startblock == DELAYSTARTBLOCK) {
812	int done;
813
814	/*
815	* If the extent we're remapping is a delalloc reservation,
816	* we can use the regular bunmapi function to release the
817	* incore state. Dropping the delalloc reservation takes care
818	* of the quota reservation for us.
819	*/
820	error = xfs_bunmapi(NULL, ip, data.br_startoff,
821	data.br_blockcount, 0, 1, &done);
822	if (error)
823	goto out_cancel;
824	ASSERT(done);
825	}
826
827	/* Free the CoW orphan record. */
828	xfs_refcount_free_cow_extent(tp, del.br_startblock, del.br_blockcount);
829
830	/* Map the new blocks into the data fork. */
831	xfs_bmap_map_extent(tp, ip, &del);
832
833	/* Charge this new data fork mapping to the on-disk quota. */
834	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_DELBCOUNT,
835	(long)del.br_blockcount);
836
837	/* Remove the mapping from the CoW fork. */
838	xfs_bmap_del_extent_cow(ip, &icur, &got, &del);
839
840	error = xfs_trans_commit(tp);
841	xfs_iunlock(ip, XFS_ILOCK_EXCL);
842	if (error)
843	return error;
844
845	/* Update the caller about how much progress we made. */
846	*offset_fsb = del.br_startoff + del.br_blockcount;
847	return 0;
848
849	out_cancel:
850	xfs_trans_cancel(tp);
851	xfs_iunlock(ip, XFS_ILOCK_EXCL);
852	return error;
853	}
854
855	/*
856	* Remap parts of a file's data fork after a successful CoW.
857	*/
858	int
859	xfs_reflink_end_cow(
860	struct xfs_inode *ip,
861	xfs_off_t offset,
862	xfs_off_t count)
863	{
864	xfs_fileoff_t offset_fsb;
865	xfs_fileoff_t end_fsb;
866	int error = 0;
867
868	trace_xfs_reflink_end_cow(ip, offset, count);
869
870	offset_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
871	end_fsb = XFS_B_TO_FSB(ip->i_mount, offset + count);
872
873	/*
874	* Walk forwards until we've remapped the I/O range. The loop function
875	* repeatedly cycles the ILOCK to allocate one transaction per remapped
876	* extent.
877	*
878	* If we're being called by writeback then the pages will still
879	* have PageWriteback set, which prevents races with reflink remapping
880	* and truncate. Reflink remapping prevents races with writeback by
881	* taking the iolock and mmaplock before flushing the pages and
882	* remapping, which means there won't be any further writeback or page
883	* cache dirtying until the reflink completes.
884	*
885	* We should never have two threads issuing writeback for the same file
886	* region. There are also have post-eof checks in the writeback
887	* preparation code so that we don't bother writing out pages that are
888	* about to be truncated.
889	*
890	* If we're being called as part of directio write completion, the dio
891	* count is still elevated, which reflink and truncate will wait for.
892	* Reflink remapping takes the iolock and mmaplock and waits for
893	* pending dio to finish, which should prevent any directio until the
894	* remap completes. Multiple concurrent directio writes to the same
895	* region are handled by end_cow processing only occurring for the
896	* threads which succeed; the outcome of multiple overlapping direct
897	* writes is not well defined anyway.
898	*
899	* It's possible that a buffered write and a direct write could collide
900	* here (the buffered write stumbles in after the dio flushes and
901	* invalidates the page cache and immediately queues writeback), but we
902	* have never supported this 100%. If either disk write succeeds the
903	* blocks will be remapped.
904	*/
905	while (end_fsb > offset_fsb && !error)
906	error = xfs_reflink_end_cow_extent(ip, &offset_fsb, end_fsb);
907
908	if (error)
909	trace_xfs_reflink_end_cow_error(ip, error, _RET_IP_);
910	return error;
911	}
912
913	/*
914	* Free all CoW staging blocks that are still referenced by the ondisk refcount
915	* metadata. The ondisk metadata does not track which inode created the
916	* staging extent, so callers must ensure that there are no cached inodes with
917	* live CoW staging extents.
918	*/
919	int
920	xfs_reflink_recover_cow(
921	struct xfs_mount *mp)
922	{
923	struct xfs_perag *pag;
924	xfs_agnumber_t agno;
925	int error = 0;
926
927	if (!xfs_has_reflink(mp))
928	return 0;
929
930	for_each_perag(mp, agno, pag) {
931	error = xfs_refcount_recover_cow_leftovers(mp, pag);
932	if (error) {
933	xfs_perag_rele(pag);
934	break;
935	}
936	}
937
938	return error;
939	}
940
941	/*
942	* Reflinking (Block) Ranges of Two Files Together
943	*
944	* First, ensure that the reflink flag is set on both inodes. The flag is an
945	* optimization to avoid unnecessary refcount btree lookups in the write path.
946	*
947	* Now we can iteratively remap the range of extents (and holes) in src to the
948	* corresponding ranges in dest. Let drange and srange denote the ranges of
949	* logical blocks in dest and src touched by the reflink operation.
950	*
951	* While the length of drange is greater than zero,
952	* - Read src's bmbt at the start of srange ("imap")
953	* - If imap doesn't exist, make imap appear to start at the end of srange
954	* with zero length.
955	* - If imap starts before srange, advance imap to start at srange.
956	* - If imap goes beyond srange, truncate imap to end at the end of srange.
957	* - Punch (imap start - srange start + imap len) blocks from dest at
958	* offset (drange start).
959	* - If imap points to a real range of pblks,
960	* > Increase the refcount of the imap's pblks
961	* > Map imap's pblks into dest at the offset
962	* (drange start + imap start - srange start)
963	* - Advance drange and srange by (imap start - srange start + imap len)
964	*
965	* Finally, if the reflink made dest longer, update both the in-core and
966	* on-disk file sizes.
967	*
968	* ASCII Art Demonstration:
969	*
970	* Let's say we want to reflink this source file:
971	*
972	* ----SSSSSSS-SSSSS----SSSSSS (src file)
973	* <-------------------->
974	*
975	* into this destination file:
976	*
977	* --DDDDDDDDDDDDDDDDDDD--DDD (dest file)
978	* <-------------------->
979	* '-' means a hole, and 'S' and 'D' are written blocks in the src and dest.
980	* Observe that the range has different logical offsets in either file.
981	*
982	* Consider that the first extent in the source file doesn't line up with our
983	* reflink range. Unmapping and remapping are separate operations, so we can
984	* unmap more blocks from the destination file than we remap.
985	*
986	* ----SSSSSSS-SSSSS----SSSSSS
987	* <------->
988	* --DDDDD---------DDDDD--DDD
989	* <------->
990	*
991	* Now remap the source extent into the destination file:
992	*
993	* ----SSSSSSS-SSSSS----SSSSSS
994	* <------->
995	* --DDDDD--SSSSSSSDDDDD--DDD
996	* <------->
997	*
998	* Do likewise with the second hole and extent in our range. Holes in the
999	* unmap range don't affect our operation.
1000	*
1001	* ----SSSSSSS-SSSSS----SSSSSS
1002	* <---->
1003	* --DDDDD--SSSSSSS-SSSSS-DDD
1004	* <---->
1005	*
1006	* Finally, unmap and remap part of the third extent. This will increase the
1007	* size of the destination file.
1008	*
1009	* ----SSSSSSS-SSSSS----SSSSSS
1010	* <----->
1011	* --DDDDD--SSSSSSS-SSSSS----SSS
1012	* <----->
1013	*
1014	* Once we update the destination file's i_size, we're done.
1015	*/
1016
1017	/*
1018	* Ensure the reflink bit is set in both inodes.
1019	*/
1020	STATIC int
1021	xfs_reflink_set_inode_flag(
1022	struct xfs_inode *src,
1023	struct xfs_inode *dest)
1024	{
1025	struct xfs_mount *mp = src->i_mount;
1026	int error;
1027	struct xfs_trans *tp;
1028
1029	if (xfs_is_reflink_inode(ip: src) && xfs_is_reflink_inode(ip: dest))
1030	return 0;
1031
1032	error = xfs_trans_alloc(mp, resp: &M_RES(mp)->tr_ichange, blocks: 0, rtextents: 0, flags: 0, tpp: &tp);
1033	if (error)
1034	goto out_error;
1035
1036	/* Lock both files against IO */
1037	if (src->i_ino == dest->i_ino)
1038	xfs_ilock(src, XFS_ILOCK_EXCL);
1039	else
1040	xfs_lock_two_inodes(ip0: src, XFS_ILOCK_EXCL, ip1: dest, XFS_ILOCK_EXCL);
1041
1042	if (!xfs_is_reflink_inode(ip: src)) {
1043	trace_xfs_reflink_set_inode_flag(ip: src);
1044	xfs_trans_ijoin(tp, src, XFS_ILOCK_EXCL);
1045	src->i_diflags2 |= XFS_DIFLAG2_REFLINK;
1046	xfs_trans_log_inode(tp, src, XFS_ILOG_CORE);
1047	xfs_ifork_init_cow(src);
1048	} else
1049	xfs_iunlock(src, XFS_ILOCK_EXCL);
1050
1051	if (src->i_ino == dest->i_ino)
1052	goto commit_flags;
1053
1054	if (!xfs_is_reflink_inode(ip: dest)) {
1055	trace_xfs_reflink_set_inode_flag(ip: dest);
1056	xfs_trans_ijoin(tp, dest, XFS_ILOCK_EXCL);
1057	dest->i_diflags2 |= XFS_DIFLAG2_REFLINK;
1058	xfs_trans_log_inode(tp, dest, XFS_ILOG_CORE);
1059	xfs_ifork_init_cow(dest);
1060	} else
1061	xfs_iunlock(dest, XFS_ILOCK_EXCL);
1062
1063	commit_flags:
1064	error = xfs_trans_commit(tp);
1065	if (error)
1066	goto out_error;
1067	return error;
1068
1069	out_error:
1070	trace_xfs_reflink_set_inode_flag_error(ip: dest, error, _RET_IP_);
1071	return error;
1072	}
1073
1074	/*
1075	* Update destination inode size & cowextsize hint, if necessary.
1076	*/
1077	int
1078	xfs_reflink_update_dest(
1079	struct xfs_inode *dest,
1080	xfs_off_t newlen,
1081	xfs_extlen_t cowextsize,
1082	unsigned int remap_flags)
1083	{
1084	struct xfs_mount *mp = dest->i_mount;
1085	struct xfs_trans *tp;
1086	int error;
1087
1088	if (newlen <= i_size_read(inode: VFS_I(ip: dest)) && cowextsize == 0)
1089	return 0;
1090
1091	error = xfs_trans_alloc(mp, resp: &M_RES(mp)->tr_ichange, blocks: 0, rtextents: 0, flags: 0, tpp: &tp);
1092	if (error)
1093	goto out_error;
1094
1095	xfs_ilock(dest, XFS_ILOCK_EXCL);
1096	xfs_trans_ijoin(tp, dest, XFS_ILOCK_EXCL);
1097
1098	if (newlen > i_size_read(inode: VFS_I(ip: dest))) {
1099	trace_xfs_reflink_update_inode_size(dest, newlen);
1100	i_size_write(inode: VFS_I(ip: dest), i_size: newlen);
1101	dest->i_disk_size = newlen;
1102	}
1103
1104	if (cowextsize) {
1105	dest->i_cowextsize = cowextsize;
1106	dest->i_diflags2 |= XFS_DIFLAG2_COWEXTSIZE;
1107	}
1108
1109	xfs_trans_log_inode(tp, dest, XFS_ILOG_CORE);
1110
1111	error = xfs_trans_commit(tp);
1112	if (error)
1113	goto out_error;
1114	return error;
1115
1116	out_error:
1117	trace_xfs_reflink_update_inode_size_error(ip: dest, error, _RET_IP_);
1118	return error;
1119	}
1120
1121	/*
1122	* Do we have enough reserve in this AG to handle a reflink? The refcount
1123	* btree already reserved all the space it needs, but the rmap btree can grow
1124	* infinitely, so we won't allow more reflinks when the AG is down to the
1125	* btree reserves.
1126	*/
1127	static int
1128	xfs_reflink_ag_has_free_space(
1129	struct xfs_mount *mp,
1130	xfs_agnumber_t agno)
1131	{
1132	struct xfs_perag *pag;
1133	int error = 0;
1134
1135	if (!xfs_has_rmapbt(mp))
1136	return 0;
1137
1138	pag = xfs_perag_get(mp, agno);
1139	if (xfs_ag_resv_critical(pag, XFS_AG_RESV_RMAPBT) ||
1140	xfs_ag_resv_critical(pag, XFS_AG_RESV_METADATA))
1141	error = -ENOSPC;
1142	xfs_perag_put(pag);
1143	return error;
1144	}
1145
1146	/*
1147	* Remap the given extent into the file. The dmap blockcount will be set to
1148	* the number of blocks that were actually remapped.
1149	*/
1150	STATIC int
1151	xfs_reflink_remap_extent(
1152	struct xfs_inode *ip,
1153	struct xfs_bmbt_irec *dmap,
1154	xfs_off_t new_isize)
1155	{
1156	struct xfs_bmbt_irec smap;
1157	struct xfs_mount *mp = ip->i_mount;
1158	struct xfs_trans *tp;
1159	xfs_off_t newlen;
1160	int64_t qdelta = 0;
1161	unsigned int resblks;
1162	bool quota_reserved = true;
1163	bool smap_real;
1164	bool dmap_written = xfs_bmap_is_written_extent(dmap);
1165	int iext_delta = 0;
1166	int nimaps;
1167	int error;
1168
1169	/*
1170	* Start a rolling transaction to switch the mappings.
1171	*
1172	* Adding a written extent to the extent map can cause a bmbt split,
1173	* and removing a mapped extent from the extent can cause a bmbt split.
1174	* The two operations cannot both cause a split since they operate on
1175	* the same index in the bmap btree, so we only need a reservation for
1176	* one bmbt split if either thing is happening. However, we haven't
1177	* locked the inode yet, so we reserve assuming this is the case.
1178	*
1179	* The first allocation call tries to reserve enough space to handle
1180	* mapping dmap into a sparse part of the file plus the bmbt split. We
1181	* haven't locked the inode or read the existing mapping yet, so we do
1182	* not know for sure that we need the space. This should succeed most
1183	* of the time.
1184	*
1185	* If the first attempt fails, try again but reserving only enough
1186	* space to handle a bmbt split. This is the hard minimum requirement,
1187	* and we revisit quota reservations later when we know more about what
1188	* we're remapping.
1189	*/
1190	resblks = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
1191	error = xfs_trans_alloc_inode(ip, resv: &M_RES(mp)->tr_write,
1192	dblocks: resblks + dmap->br_blockcount, rblocks: 0, force: false, tpp: &tp);
1193	if (error == -EDQUOT || error == -ENOSPC) {
1194	quota_reserved = false;
1195	error = xfs_trans_alloc_inode(ip, resv: &M_RES(mp)->tr_write,
1196	dblocks: resblks, rblocks: 0, force: false, tpp: &tp);
1197	}
1198	if (error)
1199	goto out;
1200
1201	/*
1202	* Read what's currently mapped in the destination file into smap.
1203	* If smap isn't a hole, we will have to remove it before we can add
1204	* dmap to the destination file.
1205	*/
1206	nimaps = 1;
1207	error = xfs_bmapi_read(ip, dmap->br_startoff, dmap->br_blockcount,
1208	&smap, &nimaps, 0);
1209	if (error)
1210	goto out_cancel;
1211	ASSERT(nimaps == 1 && smap.br_startoff == dmap->br_startoff);
1212	smap_real = xfs_bmap_is_real_extent(&smap);
1213
1214	/*
1215	* We can only remap as many blocks as the smaller of the two extent
1216	* maps, because we can only remap one extent at a time.
1217	*/
1218	dmap->br_blockcount = min(dmap->br_blockcount, smap.br_blockcount);
1219	ASSERT(dmap->br_blockcount == smap.br_blockcount);
1220
1221	trace_xfs_reflink_remap_extent_dest(ip, irec: &smap);
1222
1223	/*
1224	* Two extents mapped to the same physical block must not have
1225	* different states; that's filesystem corruption. Move on to the next
1226	* extent if they're both holes or both the same physical extent.
1227	*/
1228	if (dmap->br_startblock == smap.br_startblock) {
1229	if (dmap->br_state != smap.br_state)
1230	error = -EFSCORRUPTED;
1231	goto out_cancel;
1232	}
1233
1234	/* If both extents are unwritten, leave them alone. */
1235	if (dmap->br_state == XFS_EXT_UNWRITTEN &&
1236	smap.br_state == XFS_EXT_UNWRITTEN)
1237	goto out_cancel;
1238
1239	/* No reflinking if the AG of the dest mapping is low on space. */
1240	if (dmap_written) {
1241	error = xfs_reflink_ag_has_free_space(mp,
1242	XFS_FSB_TO_AGNO(mp, dmap->br_startblock));
1243	if (error)
1244	goto out_cancel;
1245	}
1246
1247	/*
1248	* Increase quota reservation if we think the quota block counter for
1249	* this file could increase.
1250	*
1251	* If we are mapping a written extent into the file, we need to have
1252	* enough quota block count reservation to handle the blocks in that
1253	* extent. We log only the delta to the quota block counts, so if the
1254	* extent we're unmapping also has blocks allocated to it, we don't
1255	* need a quota reservation for the extent itself.
1256	*
1257	* Note that if we're replacing a delalloc reservation with a written
1258	* extent, we have to take the full quota reservation because removing
1259	* the delalloc reservation gives the block count back to the quota
1260	* count. This is suboptimal, but the VFS flushed the dest range
1261	* before we started. That should have removed all the delalloc
1262	* reservations, but we code defensively.
1263	*
1264	* xfs_trans_alloc_inode above already tried to grab an even larger
1265	* quota reservation, and kicked off a blockgc scan if it couldn't.
1266	* If we can't get a potentially smaller quota reservation now, we're
1267	* done.
1268	*/
1269	if (!quota_reserved && !smap_real && dmap_written) {
1270	error = xfs_trans_reserve_quota_nblks(tp, ip,
1271	dblocks: dmap->br_blockcount, rblocks: 0, force: false);
1272	if (error)
1273	goto out_cancel;
1274	}
1275
1276	if (smap_real)
1277	++iext_delta;
1278
1279	if (dmap_written)
1280	++iext_delta;
1281
1282	error = xfs_iext_count_may_overflow(ip, XFS_DATA_FORK, iext_delta);
1283	if (error == -EFBIG)
1284	error = xfs_iext_count_upgrade(tp, ip, iext_delta);
1285	if (error)
1286	goto out_cancel;
1287
1288	if (smap_real) {
1289	/*
1290	* If the extent we're unmapping is backed by storage (written
1291	* or not), unmap the extent and drop its refcount.
1292	*/
1293	xfs_bmap_unmap_extent(tp, ip, &smap);
1294	xfs_refcount_decrease_extent(tp, &smap);
1295	qdelta -= smap.br_blockcount;
1296	} else if (smap.br_startblock == DELAYSTARTBLOCK) {
1297	int done;
1298
1299	/*
1300	* If the extent we're unmapping is a delalloc reservation,
1301	* we can use the regular bunmapi function to release the
1302	* incore state. Dropping the delalloc reservation takes care
1303	* of the quota reservation for us.
1304	*/
1305	error = xfs_bunmapi(NULL, ip, smap.br_startoff,
1306	smap.br_blockcount, 0, 1, &done);
1307	if (error)
1308	goto out_cancel;
1309	ASSERT(done);
1310	}
1311
1312	/*
1313	* If the extent we're sharing is backed by written storage, increase
1314	* its refcount and map it into the file.
1315	*/
1316	if (dmap_written) {
1317	xfs_refcount_increase_extent(tp, dmap);
1318	xfs_bmap_map_extent(tp, ip, dmap);
1319	qdelta += dmap->br_blockcount;
1320	}
1321
1322	xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, qdelta);
1323
1324	/* Update dest isize if needed. */
1325	newlen = XFS_FSB_TO_B(mp, dmap->br_startoff + dmap->br_blockcount);
1326	newlen = min_t(xfs_off_t, newlen, new_isize);
1327	if (newlen > i_size_read(inode: VFS_I(ip))) {
1328	trace_xfs_reflink_update_inode_size(ip, newlen);
1329	i_size_write(inode: VFS_I(ip), i_size: newlen);
1330	ip->i_disk_size = newlen;
1331	xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
1332	}
1333
1334	/* Commit everything and unlock. */
1335	error = xfs_trans_commit(tp);
1336	goto out_unlock;
1337
1338	out_cancel:
1339	xfs_trans_cancel(tp);
1340	out_unlock:
1341	xfs_iunlock(ip, XFS_ILOCK_EXCL);
1342	out:
1343	if (error)
1344	trace_xfs_reflink_remap_extent_error(ip, error, _RET_IP_);
1345	return error;
1346	}
1347
1348	/* Remap a range of one file to the other. */
1349	int
1350	xfs_reflink_remap_blocks(
1351	struct xfs_inode *src,
1352	loff_t pos_in,
1353	struct xfs_inode *dest,
1354	loff_t pos_out,
1355	loff_t remap_len,
1356	loff_t *remapped)
1357	{
1358	struct xfs_bmbt_irec imap;
1359	struct xfs_mount *mp = src->i_mount;
1360	xfs_fileoff_t srcoff = XFS_B_TO_FSBT(mp, pos_in);
1361	xfs_fileoff_t destoff = XFS_B_TO_FSBT(mp, pos_out);
1362	xfs_filblks_t len;
1363	xfs_filblks_t remapped_len = 0;
1364	xfs_off_t new_isize = pos_out + remap_len;
1365	int nimaps;
1366	int error = 0;
1367
1368	len = min_t(xfs_filblks_t, XFS_B_TO_FSB(mp, remap_len),
1369	XFS_MAX_FILEOFF);
1370
1371	trace_xfs_reflink_remap_blocks(src, srcoff, len, dest, destoff);
1372
1373	while (len > 0) {
1374	unsigned int lock_mode;
1375
1376	/* Read extent from the source file */
1377	nimaps = 1;
1378	lock_mode = xfs_ilock_data_map_shared(src);
1379	error = xfs_bmapi_read(src, srcoff, len, &imap, &nimaps, 0);
1380	xfs_iunlock(src, lock_mode);
1381	if (error)
1382	break;
1383	/*
1384	* The caller supposedly flushed all dirty pages in the source
1385	* file range, which means that writeback should have allocated
1386	* or deleted all delalloc reservations in that range. If we
1387	* find one, that's a good sign that something is seriously
1388	* wrong here.
1389	*/
1390	ASSERT(nimaps == 1 && imap.br_startoff == srcoff);
1391	if (imap.br_startblock == DELAYSTARTBLOCK) {
1392	ASSERT(imap.br_startblock != DELAYSTARTBLOCK);
1393	error = -EFSCORRUPTED;
1394	break;
1395	}
1396
1397	trace_xfs_reflink_remap_extent_src(ip: src, irec: &imap);
1398
1399	/* Remap into the destination file at the given offset. */
1400	imap.br_startoff = destoff;
1401	error = xfs_reflink_remap_extent(ip: dest, dmap: &imap, new_isize);
1402	if (error)
1403	break;
1404
1405	if (fatal_signal_pending(current)) {
1406	error = -EINTR;
1407	break;
1408	}
1409
1410	/* Advance drange/srange */
1411	srcoff += imap.br_blockcount;
1412	destoff += imap.br_blockcount;
1413	len -= imap.br_blockcount;
1414	remapped_len += imap.br_blockcount;
1415	}
1416
1417	if (error)
1418	trace_xfs_reflink_remap_blocks_error(ip: dest, error, _RET_IP_);
1419	*remapped = min_t(loff_t, remap_len,
1420	XFS_FSB_TO_B(src->i_mount, remapped_len));
1421	return error;
1422	}
1423
1424	/*
1425	* If we're reflinking to a point past the destination file's EOF, we must
1426	* zero any speculative post-EOF preallocations that sit between the old EOF
1427	* and the destination file offset.
1428	*/
1429	static int
1430	xfs_reflink_zero_posteof(
1431	struct xfs_inode *ip,
1432	loff_t pos)
1433	{
1434	loff_t isize = i_size_read(inode: VFS_I(ip));
1435
1436	if (pos <= isize)
1437	return 0;
1438
1439	trace_xfs_zero_eof(ip, offset: isize, count: pos - isize);
1440	return xfs_zero_range(ip, pos: isize, len: pos - isize, NULL);
1441	}
1442
1443	/*
1444	* Prepare two files for range cloning. Upon a successful return both inodes
1445	* will have the iolock and mmaplock held, the page cache of the out file will
1446	* be truncated, and any leases on the out file will have been broken. This
1447	* function borrows heavily from xfs_file_aio_write_checks.
1448	*
1449	* The VFS allows partial EOF blocks to "match" for dedupe even though it hasn't
1450	* checked that the bytes beyond EOF physically match. Hence we cannot use the
1451	* EOF block in the source dedupe range because it's not a complete block match,
1452	* hence can introduce a corruption into the file that has it's block replaced.
1453	*
1454	* In similar fashion, the VFS file cloning also allows partial EOF blocks to be
1455	* "block aligned" for the purposes of cloning entire files. However, if the
1456	* source file range includes the EOF block and it lands within the existing EOF
1457	* of the destination file, then we can expose stale data from beyond the source
1458	* file EOF in the destination file.
1459	*
1460	* XFS doesn't support partial block sharing, so in both cases we have check
1461	* these cases ourselves. For dedupe, we can simply round the length to dedupe
1462	* down to the previous whole block and ignore the partial EOF block. While this
1463	* means we can't dedupe the last block of a file, this is an acceptible
1464	* tradeoff for simplicity on implementation.
1465	*
1466	* For cloning, we want to share the partial EOF block if it is also the new EOF
1467	* block of the destination file. If the partial EOF block lies inside the
1468	* existing destination EOF, then we have to abort the clone to avoid exposing
1469	* stale data in the destination file. Hence we reject these clone attempts with
1470	* -EINVAL in this case.
1471	*/
1472	int
1473	xfs_reflink_remap_prep(
1474	struct file *file_in,
1475	loff_t pos_in,
1476	struct file *file_out,
1477	loff_t pos_out,
1478	loff_t *len,
1479	unsigned int remap_flags)
1480	{
1481	struct inode *inode_in = file_inode(f: file_in);
1482	struct xfs_inode *src = XFS_I(inode: inode_in);
1483	struct inode *inode_out = file_inode(f: file_out);
1484	struct xfs_inode *dest = XFS_I(inode: inode_out);
1485	int ret;
1486
1487	/* Lock both files against IO */
1488	ret = xfs_ilock2_io_mmap(ip1: src, ip2: dest);
1489	if (ret)
1490	return ret;
1491
1492	/* Check file eligibility and prepare for block sharing. */
1493	ret = -EINVAL;
1494	/* Don't reflink realtime inodes */
1495	if (XFS_IS_REALTIME_INODE(src) || XFS_IS_REALTIME_INODE(dest))
1496	goto out_unlock;
1497
1498	/* Don't share DAX file data with non-DAX file. */
1499	if (IS_DAX(inode_in) != IS_DAX(inode_out))
1500	goto out_unlock;
1501
1502	if (!IS_DAX(inode_in))
1503	ret = generic_remap_file_range_prep(file_in, pos_in, file_out,
1504	pos_out, count: len, remap_flags);
1505	else
1506	ret = dax_remap_file_range_prep(file_in, pos_in, file_out,
1507	pos_out, len, remap_flags, ops: &xfs_read_iomap_ops);
1508	if (ret || *len == 0)
1509	goto out_unlock;
1510
1511	/* Attach dquots to dest inode before changing block map */
1512	ret = xfs_qm_dqattach(dest);
1513	if (ret)
1514	goto out_unlock;
1515
1516	/*
1517	* Zero existing post-eof speculative preallocations in the destination
1518	* file.
1519	*/
1520	ret = xfs_reflink_zero_posteof(ip: dest, pos: pos_out);
1521	if (ret)
1522	goto out_unlock;
1523
1524	/* Set flags and remap blocks. */
1525	ret = xfs_reflink_set_inode_flag(src, dest);
1526	if (ret)
1527	goto out_unlock;
1528
1529	/*
1530	* If pos_out > EOF, we may have dirtied blocks between EOF and
1531	* pos_out. In that case, we need to extend the flush and unmap to cover
1532	* from EOF to the end of the copy length.
1533	*/
1534	if (pos_out > XFS_ISIZE(dest)) {
1535	loff_t flen = *len + (pos_out - XFS_ISIZE(dest));
1536	ret = xfs_flush_unmap_range(ip: dest, offset: XFS_ISIZE(dest), len: flen);
1537	} else {
1538	ret = xfs_flush_unmap_range(ip: dest, offset: pos_out, len: *len);
1539	}
1540	if (ret)
1541	goto out_unlock;
1542
1543	xfs_iflags_set(ip: src, XFS_IREMAPPING);
1544	if (inode_in != inode_out)
1545	xfs_ilock_demote(src, XFS_IOLOCK_EXCL | XFS_MMAPLOCK_EXCL);
1546
1547	return 0;
1548	out_unlock:
1549	xfs_iunlock2_io_mmap(ip1: src, ip2: dest);
1550	return ret;
1551	}
1552
1553	/* Does this inode need the reflink flag? */
1554	int
1555	xfs_reflink_inode_has_shared_extents(
1556	struct xfs_trans *tp,
1557	struct xfs_inode *ip,
1558	bool *has_shared)
1559	{
1560	struct xfs_bmbt_irec got;
1561	struct xfs_mount *mp = ip->i_mount;
1562	struct xfs_ifork *ifp;
1563	struct xfs_iext_cursor icur;
1564	bool found;
1565	int error;
1566
1567	ifp = xfs_ifork_ptr(ip, XFS_DATA_FORK);
1568	error = xfs_iread_extents(tp, ip, XFS_DATA_FORK);
1569	if (error)
1570	return error;
1571
1572	*has_shared = false;
1573	found = xfs_iext_lookup_extent(ip, ifp, 0, &icur, &got);
1574	while (found) {
1575	struct xfs_perag *pag;
1576	xfs_agblock_t agbno;
1577	xfs_extlen_t aglen;
1578	xfs_agblock_t rbno;
1579	xfs_extlen_t rlen;
1580
1581	if (isnullstartblock(got.br_startblock) ||
1582	got.br_state != XFS_EXT_NORM)
1583	goto next;
1584
1585	pag = xfs_perag_get(mp, XFS_FSB_TO_AGNO(mp, got.br_startblock));
1586	agbno = XFS_FSB_TO_AGBNO(mp, got.br_startblock);
1587	aglen = got.br_blockcount;
1588	error = xfs_reflink_find_shared(pag, tp, agbno, aglen,
1589	&rbno, &rlen, false);
1590	xfs_perag_put(pag);
1591	if (error)
1592	return error;
1593
1594	/* Is there still a shared block here? */
1595	if (rbno != NULLAGBLOCK) {
1596	*has_shared = true;
1597	return 0;
1598	}
1599	next:
1600	found = xfs_iext_next_extent(ifp, &icur, &got);
1601	}
1602
1603	return 0;
1604	}
1605
1606	/*
1607	* Clear the inode reflink flag if there are no shared extents.
1608	*
1609	* The caller is responsible for joining the inode to the transaction passed in.
1610	* The inode will be joined to the transaction that is returned to the caller.
1611	*/
1612	int
1613	xfs_reflink_clear_inode_flag(
1614	struct xfs_inode *ip,
1615	struct xfs_trans **tpp)
1616	{
1617	bool needs_flag;
1618	int error = 0;
1619
1620	ASSERT(xfs_is_reflink_inode(ip));
1621
1622	error = xfs_reflink_inode_has_shared_extents(tp: *tpp, ip, has_shared: &needs_flag);
1623	if (error || needs_flag)
1624	return error;
1625
1626	/*
1627	* We didn't find any shared blocks so turn off the reflink flag.
1628	* First, get rid of any leftover CoW mappings.
1629	*/
1630	error = xfs_reflink_cancel_cow_blocks(ip, tpp, 0, XFS_MAX_FILEOFF,
1631	true);
1632	if (error)
1633	return error;
1634
1635	/* Clear the inode flag. */
1636	trace_xfs_reflink_unset_inode_flag(ip);
1637	ip->i_diflags2 &= ~XFS_DIFLAG2_REFLINK;
1638	xfs_inode_clear_cowblocks_tag(ip);
1639	xfs_trans_log_inode(*tpp, ip, XFS_ILOG_CORE);
1640
1641	return error;
1642	}
1643
1644	/*
1645	* Clear the inode reflink flag if there are no shared extents and the size
1646	* hasn't changed.
1647	*/
1648	STATIC int
1649	xfs_reflink_try_clear_inode_flag(
1650	struct xfs_inode *ip)
1651	{
1652	struct xfs_mount *mp = ip->i_mount;
1653	struct xfs_trans *tp;
1654	int error = 0;
1655
1656	/* Start a rolling transaction to remove the mappings */
1657	error = xfs_trans_alloc(mp, resp: &M_RES(mp)->tr_write, blocks: 0, rtextents: 0, flags: 0, tpp: &tp);
1658	if (error)
1659	return error;
1660
1661	xfs_ilock(ip, XFS_ILOCK_EXCL);
1662	xfs_trans_ijoin(tp, ip, 0);
1663
1664	error = xfs_reflink_clear_inode_flag(ip, tpp: &tp);
1665	if (error)
1666	goto cancel;
1667
1668	error = xfs_trans_commit(tp);
1669	if (error)
1670	goto out;
1671
1672	xfs_iunlock(ip, XFS_ILOCK_EXCL);
1673	return 0;
1674	cancel:
1675	xfs_trans_cancel(tp);
1676	out:
1677	xfs_iunlock(ip, XFS_ILOCK_EXCL);
1678	return error;
1679	}
1680
1681	/*
1682	* Pre-COW all shared blocks within a given byte range of a file and turn off
1683	* the reflink flag if we unshare all of the file's blocks.
1684	*/
1685	int
1686	xfs_reflink_unshare(
1687	struct xfs_inode *ip,
1688	xfs_off_t offset,
1689	xfs_off_t len)
1690	{
1691	struct inode *inode = VFS_I(ip);
1692	int error;
1693
1694	if (!xfs_is_reflink_inode(ip))
1695	return 0;
1696
1697	trace_xfs_reflink_unshare(ip, offset, count: len);
1698
1699	inode_dio_wait(inode);
1700
1701	if (IS_DAX(inode))
1702	error = dax_file_unshare(inode, pos: offset, len,
1703	ops: &xfs_dax_write_iomap_ops);
1704	else
1705	error = iomap_file_unshare(inode, pos: offset, len,
1706	ops: &xfs_buffered_write_iomap_ops);
1707	if (error)
1708	goto out;
1709
1710	error = filemap_write_and_wait_range(mapping: inode->i_mapping, lstart: offset,
1711	lend: offset + len - 1);
1712	if (error)
1713	goto out;
1714
1715	/* Turn off the reflink flag if possible. */
1716	error = xfs_reflink_try_clear_inode_flag(ip);
1717	if (error)
1718	goto out;
1719	return 0;
1720
1721	out:
1722	trace_xfs_reflink_unshare_error(ip, error, _RET_IP_);
1723	return error;
1724	}
1725