xref: /dragonfly/sys/vfs/hammer/hammer_inode.c (revision d37f73b6)
1 /*
2  * Copyright (c) 2007-2008 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Matthew Dillon <dillon@backplane.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 #include "hammer.h"
36 #include <vm/vm_extern.h>
37 
38 static int	hammer_unload_inode(struct hammer_inode *ip);
39 static void	hammer_free_inode(hammer_inode_t ip);
40 static void	hammer_flush_inode_core(hammer_inode_t ip,
41 					hammer_flush_group_t flg, int flags);
42 static int	hammer_setup_child_callback(hammer_record_t rec, void *data);
43 #if 0
44 static int	hammer_syncgrp_child_callback(hammer_record_t rec, void *data);
45 #endif
46 static int	hammer_setup_parent_inodes(hammer_inode_t ip, int depth,
47 					hammer_flush_group_t flg);
48 static int	hammer_setup_parent_inodes_helper(hammer_record_t record,
49 					int depth, hammer_flush_group_t flg);
50 static void	hammer_inode_wakereclaims(hammer_inode_t ip);
51 static struct hammer_inostats *hammer_inode_inostats(hammer_mount_t hmp,
52 					pid_t pid);
53 
54 #ifdef DEBUG_TRUNCATE
55 extern struct hammer_inode *HammerTruncIp;
56 #endif
57 
58 struct krate hammer_gen_krate = { 1 };
59 
60 /*
61  * RB-Tree support for inode structures
62  */
63 int
64 hammer_ino_rb_compare(hammer_inode_t ip1, hammer_inode_t ip2)
65 {
66 	if (ip1->obj_localization < ip2->obj_localization)
67 		return(-1);
68 	if (ip1->obj_localization > ip2->obj_localization)
69 		return(1);
70 	if (ip1->obj_id < ip2->obj_id)
71 		return(-1);
72 	if (ip1->obj_id > ip2->obj_id)
73 		return(1);
74 	if (ip1->obj_asof < ip2->obj_asof)
75 		return(-1);
76 	if (ip1->obj_asof > ip2->obj_asof)
77 		return(1);
78 	return(0);
79 }
80 
81 int
82 hammer_redo_rb_compare(hammer_inode_t ip1, hammer_inode_t ip2)
83 {
84 	if (ip1->redo_fifo_start < ip2->redo_fifo_start)
85 		return(-1);
86 	if (ip1->redo_fifo_start > ip2->redo_fifo_start)
87 		return(1);
88 	return(0);
89 }
90 
91 /*
92  * RB-Tree support for inode structures / special LOOKUP_INFO
93  */
94 static int
95 hammer_inode_info_cmp(hammer_inode_info_t info, hammer_inode_t ip)
96 {
97 	if (info->obj_localization < ip->obj_localization)
98 		return(-1);
99 	if (info->obj_localization > ip->obj_localization)
100 		return(1);
101 	if (info->obj_id < ip->obj_id)
102 		return(-1);
103 	if (info->obj_id > ip->obj_id)
104 		return(1);
105 	if (info->obj_asof < ip->obj_asof)
106 		return(-1);
107 	if (info->obj_asof > ip->obj_asof)
108 		return(1);
109 	return(0);
110 }
111 
112 /*
113  * Used by hammer_scan_inode_snapshots() to locate all of an object's
114  * snapshots.  Note that the asof field is not tested, which we can get
115  * away with because it is the lowest-priority field.
116  */
117 static int
118 hammer_inode_info_cmp_all_history(hammer_inode_t ip, void *data)
119 {
120 	hammer_inode_info_t info = data;
121 
122 	if (ip->obj_localization > info->obj_localization)
123 		return(1);
124 	if (ip->obj_localization < info->obj_localization)
125 		return(-1);
126 	if (ip->obj_id > info->obj_id)
127 		return(1);
128 	if (ip->obj_id < info->obj_id)
129 		return(-1);
130 	return(0);
131 }
132 
133 /*
134  * Used by hammer_unload_pseudofs() to locate all inodes associated with
135  * a particular PFS.
136  */
137 static int
138 hammer_inode_pfs_cmp(hammer_inode_t ip, void *data)
139 {
140 	u_int32_t localization = *(u_int32_t *)data;
141 	if (ip->obj_localization > localization)
142 		return(1);
143 	if (ip->obj_localization < localization)
144 		return(-1);
145 	return(0);
146 }
147 
148 /*
149  * RB-Tree support for pseudofs structures
150  */
151 static int
152 hammer_pfs_rb_compare(hammer_pseudofs_inmem_t p1, hammer_pseudofs_inmem_t p2)
153 {
154 	if (p1->localization < p2->localization)
155 		return(-1);
156 	if (p1->localization > p2->localization)
157 		return(1);
158 	return(0);
159 }
160 
161 
162 RB_GENERATE(hammer_ino_rb_tree, hammer_inode, rb_node, hammer_ino_rb_compare);
163 RB_GENERATE_XLOOKUP(hammer_ino_rb_tree, INFO, hammer_inode, rb_node,
164 		hammer_inode_info_cmp, hammer_inode_info_t);
165 RB_GENERATE2(hammer_pfs_rb_tree, hammer_pseudofs_inmem, rb_node,
166              hammer_pfs_rb_compare, u_int32_t, localization);
167 
168 /*
169  * The kernel is not actively referencing this vnode but is still holding
170  * it cached.
171  *
172  * This is called from the frontend.
173  *
174  * MPALMOSTSAFE
175  */
176 int
177 hammer_vop_inactive(struct vop_inactive_args *ap)
178 {
179 	struct hammer_inode *ip = VTOI(ap->a_vp);
180 	hammer_mount_t hmp;
181 
182 	/*
183 	 * Degenerate case
184 	 */
185 	if (ip == NULL) {
186 		vrecycle(ap->a_vp);
187 		return(0);
188 	}
189 
190 	/*
191 	 * If the inode no longer has visibility in the filesystem try to
192 	 * recycle it immediately, even if the inode is dirty.  Recycling
193 	 * it quickly allows the system to reclaim buffer cache and VM
194 	 * resources which can matter a lot in a heavily loaded system.
195 	 *
196 	 * This can deadlock in vfsync() if we aren't careful.
197 	 *
198 	 * Do not queue the inode to the flusher if we still have visibility,
199 	 * otherwise namespace calls such as chmod will unnecessarily generate
200 	 * multiple inode updates.
201 	 */
202 	if (ip->ino_data.nlinks == 0) {
203 		hmp = ip->hmp;
204 		lwkt_gettoken(&hmp->fs_token);
205 		hammer_inode_unloadable_check(ip, 0);
206 		if (ip->flags & HAMMER_INODE_MODMASK)
207 			hammer_flush_inode(ip, 0);
208 		lwkt_reltoken(&hmp->fs_token);
209 		vrecycle(ap->a_vp);
210 	}
211 	return(0);
212 }
213 
214 /*
215  * Release the vnode association.  This is typically (but not always)
216  * the last reference on the inode.
217  *
218  * Once the association is lost we are on our own with regards to
219  * flushing the inode.
220  *
221  * We must interlock ip->vp so hammer_get_vnode() can avoid races.
222  */
223 int
224 hammer_vop_reclaim(struct vop_reclaim_args *ap)
225 {
226 	struct hammer_inode *ip;
227 	hammer_mount_t hmp;
228 	struct vnode *vp;
229 
230 	vp = ap->a_vp;
231 
232 	if ((ip = vp->v_data) != NULL) {
233 		hmp = ip->hmp;
234 		lwkt_gettoken(&hmp->fs_token);
235 		hammer_lock_ex(&ip->lock);
236 		vp->v_data = NULL;
237 		ip->vp = NULL;
238 
239 		if ((ip->flags & HAMMER_INODE_RECLAIM) == 0) {
240 			++hammer_count_reclaims;
241 			++hmp->count_reclaims;
242 			ip->flags |= HAMMER_INODE_RECLAIM;
243 		}
244 		hammer_unlock(&ip->lock);
245 		vclrisdirty(vp);
246 		hammer_rel_inode(ip, 1);
247 		lwkt_reltoken(&hmp->fs_token);
248 	}
249 	return(0);
250 }
251 
252 /*
253  * Inform the kernel that the inode is dirty.  This will be checked
254  * by vn_unlock().
255  */
256 void
257 hammer_inode_dirty(struct hammer_inode *ip)
258 {
259 	struct vnode *vp;
260 
261 	if ((ip->flags & HAMMER_INODE_MODMASK) &&
262 	    (vp = ip->vp) != NULL) {
263 		vsetisdirty(vp);
264 	}
265 }
266 
267 /*
268  * Return a locked vnode for the specified inode.  The inode must be
269  * referenced but NOT LOCKED on entry and will remain referenced on
270  * return.
271  *
272  * Called from the frontend.
273  */
274 int
275 hammer_get_vnode(struct hammer_inode *ip, struct vnode **vpp)
276 {
277 	hammer_mount_t hmp;
278 	struct vnode *vp;
279 	int error = 0;
280 	u_int8_t obj_type;
281 
282 	hmp = ip->hmp;
283 
284 	for (;;) {
285 		if ((vp = ip->vp) == NULL) {
286 			error = getnewvnode(VT_HAMMER, hmp->mp, vpp, 0, 0);
287 			if (error)
288 				break;
289 			hammer_lock_ex(&ip->lock);
290 			if (ip->vp != NULL) {
291 				hammer_unlock(&ip->lock);
292 				vp = *vpp;
293 				vp->v_type = VBAD;
294 				vx_put(vp);
295 				continue;
296 			}
297 			hammer_ref(&ip->lock);
298 			vp = *vpp;
299 			ip->vp = vp;
300 
301 			obj_type = ip->ino_data.obj_type;
302 			vp->v_type = hammer_get_vnode_type(obj_type);
303 
304 			hammer_inode_wakereclaims(ip);
305 
306 			switch(ip->ino_data.obj_type) {
307 			case HAMMER_OBJTYPE_CDEV:
308 			case HAMMER_OBJTYPE_BDEV:
309 				vp->v_ops = &hmp->mp->mnt_vn_spec_ops;
310 				addaliasu(vp, ip->ino_data.rmajor,
311 					  ip->ino_data.rminor);
312 				break;
313 			case HAMMER_OBJTYPE_FIFO:
314 				vp->v_ops = &hmp->mp->mnt_vn_fifo_ops;
315 				break;
316 			case HAMMER_OBJTYPE_REGFILE:
317 				break;
318 			default:
319 				break;
320 			}
321 
322 			/*
323 			 * Only mark as the root vnode if the ip is not
324 			 * historical, otherwise the VFS cache will get
325 			 * confused.  The other half of the special handling
326 			 * is in hammer_vop_nlookupdotdot().
327 			 *
328 			 * Pseudo-filesystem roots can be accessed via
329 			 * non-root filesystem paths and setting VROOT may
330 			 * confuse the namecache.  Set VPFSROOT instead.
331 			 */
332 			if (ip->obj_id == HAMMER_OBJID_ROOT &&
333 			    ip->obj_asof == hmp->asof) {
334 				if (ip->obj_localization == 0)
335 					vsetflags(vp, VROOT);
336 				else
337 					vsetflags(vp, VPFSROOT);
338 			}
339 
340 			vp->v_data = (void *)ip;
341 			/* vnode locked by getnewvnode() */
342 			/* make related vnode dirty if inode dirty? */
343 			hammer_unlock(&ip->lock);
344 			if (vp->v_type == VREG) {
345 				vinitvmio(vp, ip->ino_data.size,
346 					  hammer_blocksize(ip->ino_data.size),
347 					  hammer_blockoff(ip->ino_data.size));
348 			}
349 			break;
350 		}
351 
352 		/*
353 		 * Interlock vnode clearing.  This does not prevent the
354 		 * vnode from going into a reclaimed state but it does
355 		 * prevent it from being destroyed or reused so the vget()
356 		 * will properly fail.
357 		 */
358 		hammer_lock_ex(&ip->lock);
359 		if ((vp = ip->vp) == NULL) {
360 			hammer_unlock(&ip->lock);
361 			continue;
362 		}
363 		vhold(vp);
364 		hammer_unlock(&ip->lock);
365 
366 		/*
367 		 * loop if the vget fails (aka races), or if the vp
368 		 * no longer matches ip->vp.
369 		 */
370 		if (vget(vp, LK_EXCLUSIVE) == 0) {
371 			if (vp == ip->vp) {
372 				vdrop(vp);
373 				break;
374 			}
375 			vput(vp);
376 		}
377 		vdrop(vp);
378 	}
379 	*vpp = vp;
380 	return(error);
381 }
382 
383 /*
384  * Locate all copies of the inode for obj_id compatible with the specified
385  * asof, reference, and issue the related call-back.  This routine is used
386  * for direct-io invalidation and does not create any new inodes.
387  */
388 void
389 hammer_scan_inode_snapshots(hammer_mount_t hmp, hammer_inode_info_t iinfo,
390 		            int (*callback)(hammer_inode_t ip, void *data),
391 			    void *data)
392 {
393 	hammer_ino_rb_tree_RB_SCAN(&hmp->rb_inos_root,
394 				   hammer_inode_info_cmp_all_history,
395 				   callback, iinfo);
396 }
397 
398 /*
399  * Acquire a HAMMER inode.  The returned inode is not locked.  These functions
400  * do not attach or detach the related vnode (use hammer_get_vnode() for
401  * that).
402  *
403  * The flags argument is only applied for newly created inodes, and only
404  * certain flags are inherited.
405  *
406  * Called from the frontend.
407  */
408 struct hammer_inode *
409 hammer_get_inode(hammer_transaction_t trans, hammer_inode_t dip,
410 		 int64_t obj_id, hammer_tid_t asof, u_int32_t localization,
411 		 int flags, int *errorp)
412 {
413 	hammer_mount_t hmp = trans->hmp;
414 	struct hammer_node_cache *cachep;
415 	struct hammer_inode_info iinfo;
416 	struct hammer_cursor cursor;
417 	struct hammer_inode *ip;
418 
419 
420 	/*
421 	 * Determine if we already have an inode cached.  If we do then
422 	 * we are golden.
423 	 *
424 	 * If we find an inode with no vnode we have to mark the
425 	 * transaction such that hammer_inode_waitreclaims() is
426 	 * called later on to avoid building up an infinite number
427 	 * of inodes.  Otherwise we can continue to * add new inodes
428 	 * faster then they can be disposed of, even with the tsleep
429 	 * delay.
430 	 *
431 	 * If we find a dummy inode we return a failure so dounlink
432 	 * (which does another lookup) doesn't try to mess with the
433 	 * link count.  hammer_vop_nresolve() uses hammer_get_dummy_inode()
434 	 * to ref dummy inodes.
435 	 */
436 	iinfo.obj_id = obj_id;
437 	iinfo.obj_asof = asof;
438 	iinfo.obj_localization = localization;
439 loop:
440 	ip = hammer_ino_rb_tree_RB_LOOKUP_INFO(&hmp->rb_inos_root, &iinfo);
441 	if (ip) {
442 		if (ip->flags & HAMMER_INODE_DUMMY) {
443 			*errorp = ENOENT;
444 			return(NULL);
445 		}
446 		hammer_ref(&ip->lock);
447 		*errorp = 0;
448 		return(ip);
449 	}
450 
451 	/*
452 	 * Allocate a new inode structure and deal with races later.
453 	 */
454 	ip = kmalloc(sizeof(*ip), hmp->m_inodes, M_WAITOK|M_ZERO);
455 	++hammer_count_inodes;
456 	++hmp->count_inodes;
457 	ip->obj_id = obj_id;
458 	ip->obj_asof = iinfo.obj_asof;
459 	ip->obj_localization = localization;
460 	ip->hmp = hmp;
461 	ip->flags = flags & HAMMER_INODE_RO;
462 	ip->cache[0].ip = ip;
463 	ip->cache[1].ip = ip;
464 	ip->cache[2].ip = ip;
465 	ip->cache[3].ip = ip;
466 	if (hmp->ronly)
467 		ip->flags |= HAMMER_INODE_RO;
468 	ip->sync_trunc_off = ip->trunc_off = ip->save_trunc_off =
469 		0x7FFFFFFFFFFFFFFFLL;
470 	RB_INIT(&ip->rec_tree);
471 	TAILQ_INIT(&ip->target_list);
472 	hammer_ref(&ip->lock);
473 
474 	/*
475 	 * Locate the on-disk inode.  If this is a PFS root we always
476 	 * access the current version of the root inode and (if it is not
477 	 * a master) always access information under it with a snapshot
478 	 * TID.
479 	 *
480 	 * We cache recent inode lookups in this directory in dip->cache[2].
481 	 * If we can't find it we assume the inode we are looking for is
482 	 * close to the directory inode.
483 	 */
484 retry:
485 	cachep = NULL;
486 	if (dip) {
487 		if (dip->cache[2].node)
488 			cachep = &dip->cache[2];
489 		else
490 			cachep = &dip->cache[0];
491 	}
492 	hammer_init_cursor(trans, &cursor, cachep, NULL);
493 	cursor.key_beg.localization = localization + HAMMER_LOCALIZE_INODE;
494 	cursor.key_beg.obj_id = ip->obj_id;
495 	cursor.key_beg.key = 0;
496 	cursor.key_beg.create_tid = 0;
497 	cursor.key_beg.delete_tid = 0;
498 	cursor.key_beg.rec_type = HAMMER_RECTYPE_INODE;
499 	cursor.key_beg.obj_type = 0;
500 
501 	cursor.asof = iinfo.obj_asof;
502 	cursor.flags = HAMMER_CURSOR_GET_LEAF | HAMMER_CURSOR_GET_DATA |
503 		       HAMMER_CURSOR_ASOF;
504 
505 	*errorp = hammer_btree_lookup(&cursor);
506 	if (*errorp == EDEADLK) {
507 		hammer_done_cursor(&cursor);
508 		goto retry;
509 	}
510 
511 	/*
512 	 * On success the B-Tree lookup will hold the appropriate
513 	 * buffer cache buffers and provide a pointer to the requested
514 	 * information.  Copy the information to the in-memory inode
515 	 * and cache the B-Tree node to improve future operations.
516 	 */
517 	if (*errorp == 0) {
518 		ip->ino_leaf = cursor.node->ondisk->elms[cursor.index].leaf;
519 		ip->ino_data = cursor.data->inode;
520 
521 		/*
522 		 * cache[0] tries to cache the location of the object inode.
523 		 * The assumption is that it is near the directory inode.
524 		 *
525 		 * cache[1] tries to cache the location of the object data.
526 		 * We might have something in the governing directory from
527 		 * scan optimizations (see the strategy code in
528 		 * hammer_vnops.c).
529 		 *
530 		 * We update dip->cache[2], if possible, with the location
531 		 * of the object inode for future directory shortcuts.
532 		 */
533 		hammer_cache_node(&ip->cache[0], cursor.node);
534 		if (dip) {
535 			if (dip->cache[3].node) {
536 				hammer_cache_node(&ip->cache[1],
537 						  dip->cache[3].node);
538 			}
539 			hammer_cache_node(&dip->cache[2], cursor.node);
540 		}
541 
542 		/*
543 		 * The file should not contain any data past the file size
544 		 * stored in the inode.  Setting save_trunc_off to the
545 		 * file size instead of max reduces B-Tree lookup overheads
546 		 * on append by allowing the flusher to avoid checking for
547 		 * record overwrites.
548 		 */
549 		ip->save_trunc_off = ip->ino_data.size;
550 
551 		/*
552 		 * Locate and assign the pseudofs management structure to
553 		 * the inode.
554 		 */
555 		if (dip && dip->obj_localization == ip->obj_localization) {
556 			ip->pfsm = dip->pfsm;
557 			hammer_ref(&ip->pfsm->lock);
558 		} else {
559 			ip->pfsm = hammer_load_pseudofs(trans,
560 							ip->obj_localization,
561 							errorp);
562 			*errorp = 0;	/* ignore ENOENT */
563 		}
564 	}
565 
566 	/*
567 	 * The inode is placed on the red-black tree and will be synced to
568 	 * the media when flushed or by the filesystem sync.  If this races
569 	 * another instantiation/lookup the insertion will fail.
570 	 */
571 	if (*errorp == 0) {
572 		if (RB_INSERT(hammer_ino_rb_tree, &hmp->rb_inos_root, ip)) {
573 			hammer_free_inode(ip);
574 			hammer_done_cursor(&cursor);
575 			goto loop;
576 		}
577 		ip->flags |= HAMMER_INODE_ONDISK;
578 	} else {
579 		if (ip->flags & HAMMER_INODE_RSV_INODES) {
580 			ip->flags &= ~HAMMER_INODE_RSV_INODES; /* sanity */
581 			--hmp->rsv_inodes;
582 		}
583 
584 		hammer_free_inode(ip);
585 		ip = NULL;
586 	}
587 	hammer_done_cursor(&cursor);
588 
589 	/*
590 	 * NEWINODE is only set if the inode becomes dirty later,
591 	 * setting it here just leads to unnecessary stalls.
592 	 *
593 	 * trans->flags |= HAMMER_TRANSF_NEWINODE;
594 	 */
595 	return (ip);
596 }
597 
598 /*
599  * Get a dummy inode to placemark a broken directory entry.
600  */
601 struct hammer_inode *
602 hammer_get_dummy_inode(hammer_transaction_t trans, hammer_inode_t dip,
603 		 int64_t obj_id, hammer_tid_t asof, u_int32_t localization,
604 		 int flags, int *errorp)
605 {
606 	hammer_mount_t hmp = trans->hmp;
607 	struct hammer_inode_info iinfo;
608 	struct hammer_inode *ip;
609 
610 	/*
611 	 * Determine if we already have an inode cached.  If we do then
612 	 * we are golden.
613 	 *
614 	 * If we find an inode with no vnode we have to mark the
615 	 * transaction such that hammer_inode_waitreclaims() is
616 	 * called later on to avoid building up an infinite number
617 	 * of inodes.  Otherwise we can continue to * add new inodes
618 	 * faster then they can be disposed of, even with the tsleep
619 	 * delay.
620 	 *
621 	 * If we find a non-fake inode we return an error.  Only fake
622 	 * inodes can be returned by this routine.
623 	 */
624 	iinfo.obj_id = obj_id;
625 	iinfo.obj_asof = asof;
626 	iinfo.obj_localization = localization;
627 loop:
628 	*errorp = 0;
629 	ip = hammer_ino_rb_tree_RB_LOOKUP_INFO(&hmp->rb_inos_root, &iinfo);
630 	if (ip) {
631 		if ((ip->flags & HAMMER_INODE_DUMMY) == 0) {
632 			*errorp = ENOENT;
633 			return(NULL);
634 		}
635 		hammer_ref(&ip->lock);
636 		return(ip);
637 	}
638 
639 	/*
640 	 * Allocate a new inode structure and deal with races later.
641 	 */
642 	ip = kmalloc(sizeof(*ip), hmp->m_inodes, M_WAITOK|M_ZERO);
643 	++hammer_count_inodes;
644 	++hmp->count_inodes;
645 	ip->obj_id = obj_id;
646 	ip->obj_asof = iinfo.obj_asof;
647 	ip->obj_localization = localization;
648 	ip->hmp = hmp;
649 	ip->flags = flags | HAMMER_INODE_RO | HAMMER_INODE_DUMMY;
650 	ip->cache[0].ip = ip;
651 	ip->cache[1].ip = ip;
652 	ip->cache[2].ip = ip;
653 	ip->cache[3].ip = ip;
654 	ip->sync_trunc_off = ip->trunc_off = ip->save_trunc_off =
655 		0x7FFFFFFFFFFFFFFFLL;
656 	RB_INIT(&ip->rec_tree);
657 	TAILQ_INIT(&ip->target_list);
658 	hammer_ref(&ip->lock);
659 
660 	/*
661 	 * Populate the dummy inode.  Leave everything zero'd out.
662 	 *
663 	 * (ip->ino_leaf and ip->ino_data)
664 	 *
665 	 * Make the dummy inode a FIFO object which most copy programs
666 	 * will properly ignore.
667 	 */
668 	ip->save_trunc_off = ip->ino_data.size;
669 	ip->ino_data.obj_type = HAMMER_OBJTYPE_FIFO;
670 
671 	/*
672 	 * Locate and assign the pseudofs management structure to
673 	 * the inode.
674 	 */
675 	if (dip && dip->obj_localization == ip->obj_localization) {
676 		ip->pfsm = dip->pfsm;
677 		hammer_ref(&ip->pfsm->lock);
678 	} else {
679 		ip->pfsm = hammer_load_pseudofs(trans, ip->obj_localization,
680 						errorp);
681 		*errorp = 0;	/* ignore ENOENT */
682 	}
683 
684 	/*
685 	 * The inode is placed on the red-black tree and will be synced to
686 	 * the media when flushed or by the filesystem sync.  If this races
687 	 * another instantiation/lookup the insertion will fail.
688 	 *
689 	 * NOTE: Do not set HAMMER_INODE_ONDISK.  The inode is a fake.
690 	 */
691 	if (*errorp == 0) {
692 		if (RB_INSERT(hammer_ino_rb_tree, &hmp->rb_inos_root, ip)) {
693 			hammer_free_inode(ip);
694 			goto loop;
695 		}
696 	} else {
697 		if (ip->flags & HAMMER_INODE_RSV_INODES) {
698 			ip->flags &= ~HAMMER_INODE_RSV_INODES; /* sanity */
699 			--hmp->rsv_inodes;
700 		}
701 		hammer_free_inode(ip);
702 		ip = NULL;
703 	}
704 	trans->flags |= HAMMER_TRANSF_NEWINODE;
705 	return (ip);
706 }
707 
708 /*
709  * Return a referenced inode only if it is in our inode cache.
710  *
711  * Dummy inodes do not count.
712  */
713 struct hammer_inode *
714 hammer_find_inode(hammer_transaction_t trans, int64_t obj_id,
715 		  hammer_tid_t asof, u_int32_t localization)
716 {
717 	hammer_mount_t hmp = trans->hmp;
718 	struct hammer_inode_info iinfo;
719 	struct hammer_inode *ip;
720 
721 	iinfo.obj_id = obj_id;
722 	iinfo.obj_asof = asof;
723 	iinfo.obj_localization = localization;
724 
725 	ip = hammer_ino_rb_tree_RB_LOOKUP_INFO(&hmp->rb_inos_root, &iinfo);
726 	if (ip) {
727 		if (ip->flags & HAMMER_INODE_DUMMY)
728 			ip = NULL;
729 		else
730 			hammer_ref(&ip->lock);
731 	}
732 	return(ip);
733 }
734 
735 /*
736  * Create a new filesystem object, returning the inode in *ipp.  The
737  * returned inode will be referenced.  The inode is created in-memory.
738  *
739  * If pfsm is non-NULL the caller wishes to create the root inode for
740  * a master PFS.
741  */
742 int
743 hammer_create_inode(hammer_transaction_t trans, struct vattr *vap,
744 		    struct ucred *cred,
745 		    hammer_inode_t dip, const char *name, int namelen,
746 		    hammer_pseudofs_inmem_t pfsm, struct hammer_inode **ipp)
747 {
748 	hammer_mount_t hmp;
749 	hammer_inode_t ip;
750 	uid_t xuid;
751 	int error;
752 	int64_t namekey;
753 	u_int32_t dummy;
754 
755 	hmp = trans->hmp;
756 
757 	/*
758 	 * Disallow the creation of new inodes in directories which
759 	 * have been deleted.  In HAMMER, this will cause a record
760 	 * syncing assertion later on in the flush code.
761 	 */
762 	if (dip && dip->ino_data.nlinks == 0) {
763 		*ipp = NULL;
764                 return (EINVAL);
765 	}
766 
767 	/*
768 	 * Allocate inode
769 	 */
770 	ip = kmalloc(sizeof(*ip), hmp->m_inodes, M_WAITOK|M_ZERO);
771 	++hammer_count_inodes;
772 	++hmp->count_inodes;
773 	trans->flags |= HAMMER_TRANSF_NEWINODE;
774 
775 	if (pfsm) {
776 		KKASSERT(pfsm->localization != 0);
777 		ip->obj_id = HAMMER_OBJID_ROOT;
778 		ip->obj_localization = pfsm->localization;
779 	} else {
780 		KKASSERT(dip != NULL);
781 		namekey = hammer_directory_namekey(dip, name, namelen, &dummy);
782 		ip->obj_id = hammer_alloc_objid(hmp, dip, namekey);
783 		ip->obj_localization = dip->obj_localization;
784 	}
785 
786 	KKASSERT(ip->obj_id != 0);
787 	ip->obj_asof = hmp->asof;
788 	ip->hmp = hmp;
789 	ip->flush_state = HAMMER_FST_IDLE;
790 	ip->flags = HAMMER_INODE_DDIRTY |
791 		    HAMMER_INODE_ATIME | HAMMER_INODE_MTIME;
792 	ip->cache[0].ip = ip;
793 	ip->cache[1].ip = ip;
794 	ip->cache[2].ip = ip;
795 	ip->cache[3].ip = ip;
796 
797 	ip->trunc_off = 0x7FFFFFFFFFFFFFFFLL;
798 	/* ip->save_trunc_off = 0; (already zero) */
799 	RB_INIT(&ip->rec_tree);
800 	TAILQ_INIT(&ip->target_list);
801 
802 	ip->ino_data.atime = trans->time;
803 	ip->ino_data.mtime = trans->time;
804 	ip->ino_data.size = 0;
805 	ip->ino_data.nlinks = 0;
806 
807 	/*
808 	 * A nohistory designator on the parent directory is inherited by
809 	 * the child.  We will do this even for pseudo-fs creation... the
810 	 * sysad can turn it off.
811 	 */
812 	if (dip) {
813 		ip->ino_data.uflags = dip->ino_data.uflags &
814 				      (SF_NOHISTORY|UF_NOHISTORY|UF_NODUMP);
815 	}
816 
817 	ip->ino_leaf.base.btype = HAMMER_BTREE_TYPE_RECORD;
818 	ip->ino_leaf.base.localization = ip->obj_localization +
819 					 HAMMER_LOCALIZE_INODE;
820 	ip->ino_leaf.base.obj_id = ip->obj_id;
821 	ip->ino_leaf.base.key = 0;
822 	ip->ino_leaf.base.create_tid = 0;
823 	ip->ino_leaf.base.delete_tid = 0;
824 	ip->ino_leaf.base.rec_type = HAMMER_RECTYPE_INODE;
825 	ip->ino_leaf.base.obj_type = hammer_get_obj_type(vap->va_type);
826 
827 	ip->ino_data.obj_type = ip->ino_leaf.base.obj_type;
828 	ip->ino_data.version = HAMMER_INODE_DATA_VERSION;
829 	ip->ino_data.mode = vap->va_mode;
830 	ip->ino_data.ctime = trans->time;
831 
832 	/*
833 	 * If we are running version 2 or greater directory entries are
834 	 * inode-localized instead of data-localized.
835 	 */
836 	if (trans->hmp->version >= HAMMER_VOL_VERSION_TWO) {
837 		if (ip->ino_leaf.base.obj_type == HAMMER_OBJTYPE_DIRECTORY) {
838 			ip->ino_data.cap_flags |=
839 				HAMMER_INODE_CAP_DIR_LOCAL_INO;
840 		}
841 	}
842 	if (trans->hmp->version >= HAMMER_VOL_VERSION_SIX) {
843 		if (ip->ino_leaf.base.obj_type == HAMMER_OBJTYPE_DIRECTORY) {
844 			ip->ino_data.cap_flags |=
845 				HAMMER_INODE_CAP_DIRHASH_ALG1;
846 		}
847 	}
848 
849 	/*
850 	 * Setup the ".." pointer.  This only needs to be done for directories
851 	 * but we do it for all objects as a recovery aid.
852 	 */
853 	if (dip)
854 		ip->ino_data.parent_obj_id = dip->ino_leaf.base.obj_id;
855 #if 0
856 	/*
857 	 * The parent_obj_localization field only applies to pseudo-fs roots.
858 	 * XXX this is no longer applicable, PFSs are no longer directly
859 	 * tied into the parent's directory structure.
860 	 */
861 	if (ip->ino_data.obj_type == HAMMER_OBJTYPE_DIRECTORY &&
862 	    ip->obj_id == HAMMER_OBJID_ROOT) {
863 		ip->ino_data.ext.obj.parent_obj_localization =
864 						dip->obj_localization;
865 	}
866 #endif
867 
868 	switch(ip->ino_leaf.base.obj_type) {
869 	case HAMMER_OBJTYPE_CDEV:
870 	case HAMMER_OBJTYPE_BDEV:
871 		ip->ino_data.rmajor = vap->va_rmajor;
872 		ip->ino_data.rminor = vap->va_rminor;
873 		break;
874 	default:
875 		break;
876 	}
877 
878 	/*
879 	 * Calculate default uid/gid and overwrite with information from
880 	 * the vap.
881 	 */
882 	if (dip) {
883 		xuid = hammer_to_unix_xid(&dip->ino_data.uid);
884 		xuid = vop_helper_create_uid(hmp->mp, dip->ino_data.mode,
885 					     xuid, cred, &vap->va_mode);
886 	} else {
887 		xuid = 0;
888 	}
889 	ip->ino_data.mode = vap->va_mode;
890 
891 	if (vap->va_vaflags & VA_UID_UUID_VALID)
892 		ip->ino_data.uid = vap->va_uid_uuid;
893 	else if (vap->va_uid != (uid_t)VNOVAL)
894 		hammer_guid_to_uuid(&ip->ino_data.uid, vap->va_uid);
895 	else
896 		hammer_guid_to_uuid(&ip->ino_data.uid, xuid);
897 
898 	if (vap->va_vaflags & VA_GID_UUID_VALID)
899 		ip->ino_data.gid = vap->va_gid_uuid;
900 	else if (vap->va_gid != (gid_t)VNOVAL)
901 		hammer_guid_to_uuid(&ip->ino_data.gid, vap->va_gid);
902 	else if (dip)
903 		ip->ino_data.gid = dip->ino_data.gid;
904 
905 	hammer_ref(&ip->lock);
906 
907 	if (pfsm) {
908 		ip->pfsm = pfsm;
909 		hammer_ref(&pfsm->lock);
910 		error = 0;
911 	} else if (dip->obj_localization == ip->obj_localization) {
912 		ip->pfsm = dip->pfsm;
913 		hammer_ref(&ip->pfsm->lock);
914 		error = 0;
915 	} else {
916 		ip->pfsm = hammer_load_pseudofs(trans,
917 						ip->obj_localization,
918 						&error);
919 		error = 0;	/* ignore ENOENT */
920 	}
921 
922 	if (error) {
923 		hammer_free_inode(ip);
924 		ip = NULL;
925 	} else if (RB_INSERT(hammer_ino_rb_tree, &hmp->rb_inos_root, ip)) {
926 		panic("hammer_create_inode: duplicate obj_id %llx",
927 		      (long long)ip->obj_id);
928 		/* not reached */
929 		hammer_free_inode(ip);
930 	}
931 	*ipp = ip;
932 	return(error);
933 }
934 
935 /*
936  * Final cleanup / freeing of an inode structure
937  */
938 static void
939 hammer_free_inode(hammer_inode_t ip)
940 {
941 	struct hammer_mount *hmp;
942 
943 	hmp = ip->hmp;
944 	KKASSERT(hammer_oneref(&ip->lock));
945 	hammer_uncache_node(&ip->cache[0]);
946 	hammer_uncache_node(&ip->cache[1]);
947 	hammer_uncache_node(&ip->cache[2]);
948 	hammer_uncache_node(&ip->cache[3]);
949 	hammer_inode_wakereclaims(ip);
950 	if (ip->objid_cache)
951 		hammer_clear_objid(ip);
952 	--hammer_count_inodes;
953 	--hmp->count_inodes;
954 	if (ip->pfsm) {
955 		hammer_rel_pseudofs(hmp, ip->pfsm);
956 		ip->pfsm = NULL;
957 	}
958 	kfree(ip, hmp->m_inodes);
959 	ip = NULL;
960 }
961 
962 /*
963  * Retrieve pseudo-fs data.  NULL will never be returned.
964  *
965  * If an error occurs *errorp will be set and a default template is returned,
966  * otherwise *errorp is set to 0.  Typically when an error occurs it will
967  * be ENOENT.
968  */
969 hammer_pseudofs_inmem_t
970 hammer_load_pseudofs(hammer_transaction_t trans,
971 		     u_int32_t localization, int *errorp)
972 {
973 	hammer_mount_t hmp = trans->hmp;
974 	hammer_inode_t ip;
975 	hammer_pseudofs_inmem_t pfsm;
976 	struct hammer_cursor cursor;
977 	int bytes;
978 
979 retry:
980 	pfsm = RB_LOOKUP(hammer_pfs_rb_tree, &hmp->rb_pfsm_root, localization);
981 	if (pfsm) {
982 		hammer_ref(&pfsm->lock);
983 		*errorp = 0;
984 		return(pfsm);
985 	}
986 
987 	/*
988 	 * PFS records are stored in the root inode (not the PFS root inode,
989 	 * but the real root).  Avoid an infinite recursion if loading
990 	 * the PFS for the real root.
991 	 */
992 	if (localization) {
993 		ip = hammer_get_inode(trans, NULL, HAMMER_OBJID_ROOT,
994 				      HAMMER_MAX_TID,
995 				      HAMMER_DEF_LOCALIZATION, 0, errorp);
996 	} else {
997 		ip = NULL;
998 	}
999 
1000 	pfsm = kmalloc(sizeof(*pfsm), hmp->m_misc, M_WAITOK | M_ZERO);
1001 	pfsm->localization = localization;
1002 	pfsm->pfsd.unique_uuid = trans->rootvol->ondisk->vol_fsid;
1003 	pfsm->pfsd.shared_uuid = pfsm->pfsd.unique_uuid;
1004 
1005 	hammer_init_cursor(trans, &cursor, (ip ? &ip->cache[1] : NULL), ip);
1006 	cursor.key_beg.localization = HAMMER_DEF_LOCALIZATION +
1007 				      HAMMER_LOCALIZE_MISC;
1008 	cursor.key_beg.obj_id = HAMMER_OBJID_ROOT;
1009 	cursor.key_beg.create_tid = 0;
1010 	cursor.key_beg.delete_tid = 0;
1011 	cursor.key_beg.rec_type = HAMMER_RECTYPE_PFS;
1012 	cursor.key_beg.obj_type = 0;
1013 	cursor.key_beg.key = localization;
1014 	cursor.asof = HAMMER_MAX_TID;
1015 	cursor.flags |= HAMMER_CURSOR_ASOF;
1016 
1017 	if (ip)
1018 		*errorp = hammer_ip_lookup(&cursor);
1019 	else
1020 		*errorp = hammer_btree_lookup(&cursor);
1021 	if (*errorp == 0) {
1022 		*errorp = hammer_ip_resolve_data(&cursor);
1023 		if (*errorp == 0) {
1024 			if (cursor.data->pfsd.mirror_flags &
1025 			    HAMMER_PFSD_DELETED) {
1026 				*errorp = ENOENT;
1027 			} else {
1028 				bytes = cursor.leaf->data_len;
1029 				if (bytes > sizeof(pfsm->pfsd))
1030 					bytes = sizeof(pfsm->pfsd);
1031 				bcopy(cursor.data, &pfsm->pfsd, bytes);
1032 			}
1033 		}
1034 	}
1035 	hammer_done_cursor(&cursor);
1036 
1037 	pfsm->fsid_udev = hammer_fsid_to_udev(&pfsm->pfsd.shared_uuid);
1038 	hammer_ref(&pfsm->lock);
1039 	if (ip)
1040 		hammer_rel_inode(ip, 0);
1041 	if (RB_INSERT(hammer_pfs_rb_tree, &hmp->rb_pfsm_root, pfsm)) {
1042 		kfree(pfsm, hmp->m_misc);
1043 		goto retry;
1044 	}
1045 	return(pfsm);
1046 }
1047 
1048 /*
1049  * Store pseudo-fs data.  The backend will automatically delete any prior
1050  * on-disk pseudo-fs data but we have to delete in-memory versions.
1051  */
1052 int
1053 hammer_save_pseudofs(hammer_transaction_t trans, hammer_pseudofs_inmem_t pfsm)
1054 {
1055 	struct hammer_cursor cursor;
1056 	hammer_record_t record;
1057 	hammer_inode_t ip;
1058 	int error;
1059 
1060 	ip = hammer_get_inode(trans, NULL, HAMMER_OBJID_ROOT, HAMMER_MAX_TID,
1061 			      HAMMER_DEF_LOCALIZATION, 0, &error);
1062 retry:
1063 	pfsm->fsid_udev = hammer_fsid_to_udev(&pfsm->pfsd.shared_uuid);
1064 	hammer_init_cursor(trans, &cursor, &ip->cache[1], ip);
1065 	cursor.key_beg.localization = ip->obj_localization +
1066 				      HAMMER_LOCALIZE_MISC;
1067 	cursor.key_beg.obj_id = HAMMER_OBJID_ROOT;
1068 	cursor.key_beg.create_tid = 0;
1069 	cursor.key_beg.delete_tid = 0;
1070 	cursor.key_beg.rec_type = HAMMER_RECTYPE_PFS;
1071 	cursor.key_beg.obj_type = 0;
1072 	cursor.key_beg.key = pfsm->localization;
1073 	cursor.asof = HAMMER_MAX_TID;
1074 	cursor.flags |= HAMMER_CURSOR_ASOF;
1075 
1076 	/*
1077 	 * Replace any in-memory version of the record.
1078 	 */
1079 	error = hammer_ip_lookup(&cursor);
1080 	if (error == 0 && hammer_cursor_inmem(&cursor)) {
1081 		record = cursor.iprec;
1082 		if (record->flags & HAMMER_RECF_INTERLOCK_BE) {
1083 			KKASSERT(cursor.deadlk_rec == NULL);
1084 			hammer_ref(&record->lock);
1085 			cursor.deadlk_rec = record;
1086 			error = EDEADLK;
1087 		} else {
1088 			record->flags |= HAMMER_RECF_DELETED_FE;
1089 			error = 0;
1090 		}
1091 	}
1092 
1093 	/*
1094 	 * Allocate replacement general record.  The backend flush will
1095 	 * delete any on-disk version of the record.
1096 	 */
1097 	if (error == 0 || error == ENOENT) {
1098 		record = hammer_alloc_mem_record(ip, sizeof(pfsm->pfsd));
1099 		record->type = HAMMER_MEM_RECORD_GENERAL;
1100 
1101 		record->leaf.base.localization = ip->obj_localization +
1102 						 HAMMER_LOCALIZE_MISC;
1103 		record->leaf.base.rec_type = HAMMER_RECTYPE_PFS;
1104 		record->leaf.base.key = pfsm->localization;
1105 		record->leaf.data_len = sizeof(pfsm->pfsd);
1106 		bcopy(&pfsm->pfsd, record->data, sizeof(pfsm->pfsd));
1107 		error = hammer_ip_add_record(trans, record);
1108 	}
1109 	hammer_done_cursor(&cursor);
1110 	if (error == EDEADLK)
1111 		goto retry;
1112 	hammer_rel_inode(ip, 0);
1113 	return(error);
1114 }
1115 
1116 /*
1117  * Create a root directory for a PFS if one does not alredy exist.
1118  *
1119  * The PFS root stands alone so we must also bump the nlinks count
1120  * to prevent it from being destroyed on release.
1121  */
1122 int
1123 hammer_mkroot_pseudofs(hammer_transaction_t trans, struct ucred *cred,
1124 		       hammer_pseudofs_inmem_t pfsm)
1125 {
1126 	hammer_inode_t ip;
1127 	struct vattr vap;
1128 	int error;
1129 
1130 	ip = hammer_get_inode(trans, NULL, HAMMER_OBJID_ROOT, HAMMER_MAX_TID,
1131 			      pfsm->localization, 0, &error);
1132 	if (ip == NULL) {
1133 		vattr_null(&vap);
1134 		vap.va_mode = 0755;
1135 		vap.va_type = VDIR;
1136 		error = hammer_create_inode(trans, &vap, cred,
1137 					    NULL, NULL, 0,
1138 					    pfsm, &ip);
1139 		if (error == 0) {
1140 			++ip->ino_data.nlinks;
1141 			hammer_modify_inode(trans, ip, HAMMER_INODE_DDIRTY);
1142 		}
1143 	}
1144 	if (ip)
1145 		hammer_rel_inode(ip, 0);
1146 	return(error);
1147 }
1148 
1149 /*
1150  * Unload any vnodes & inodes associated with a PFS, return ENOTEMPTY
1151  * if we are unable to disassociate all the inodes.
1152  */
1153 static
1154 int
1155 hammer_unload_pseudofs_callback(hammer_inode_t ip, void *data)
1156 {
1157 	int res;
1158 
1159 	hammer_ref(&ip->lock);
1160 	if (hammer_isactive(&ip->lock) == 2 && ip->vp)
1161 		vclean_unlocked(ip->vp);
1162 	if (hammer_isactive(&ip->lock) == 1 && ip->vp == NULL)
1163 		res = 0;
1164 	else
1165 		res = -1;	/* stop, someone is using the inode */
1166 	hammer_rel_inode(ip, 0);
1167 	return(res);
1168 }
1169 
1170 int
1171 hammer_unload_pseudofs(hammer_transaction_t trans, u_int32_t localization)
1172 {
1173 	int res;
1174 	int try;
1175 
1176 	for (try = res = 0; try < 4; ++try) {
1177 		res = hammer_ino_rb_tree_RB_SCAN(&trans->hmp->rb_inos_root,
1178 					   hammer_inode_pfs_cmp,
1179 					   hammer_unload_pseudofs_callback,
1180 					   &localization);
1181 		if (res == 0 && try > 1)
1182 			break;
1183 		hammer_flusher_sync(trans->hmp);
1184 	}
1185 	if (res != 0)
1186 		res = ENOTEMPTY;
1187 	return(res);
1188 }
1189 
1190 
1191 /*
1192  * Release a reference on a PFS
1193  */
1194 void
1195 hammer_rel_pseudofs(hammer_mount_t hmp, hammer_pseudofs_inmem_t pfsm)
1196 {
1197 	hammer_rel(&pfsm->lock);
1198 	if (hammer_norefs(&pfsm->lock)) {
1199 		RB_REMOVE(hammer_pfs_rb_tree, &hmp->rb_pfsm_root, pfsm);
1200 		kfree(pfsm, hmp->m_misc);
1201 	}
1202 }
1203 
1204 /*
1205  * Called by hammer_sync_inode().
1206  */
1207 static int
1208 hammer_update_inode(hammer_cursor_t cursor, hammer_inode_t ip)
1209 {
1210 	hammer_transaction_t trans = cursor->trans;
1211 	hammer_record_t record;
1212 	int error;
1213 	int redirty;
1214 
1215 retry:
1216 	error = 0;
1217 
1218 	/*
1219 	 * If the inode has a presence on-disk then locate it and mark
1220 	 * it deleted, setting DELONDISK.
1221 	 *
1222 	 * The record may or may not be physically deleted, depending on
1223 	 * the retention policy.
1224 	 */
1225 	if ((ip->flags & (HAMMER_INODE_ONDISK|HAMMER_INODE_DELONDISK)) ==
1226 	    HAMMER_INODE_ONDISK) {
1227 		hammer_normalize_cursor(cursor);
1228 		cursor->key_beg.localization = ip->obj_localization +
1229 					       HAMMER_LOCALIZE_INODE;
1230 		cursor->key_beg.obj_id = ip->obj_id;
1231 		cursor->key_beg.key = 0;
1232 		cursor->key_beg.create_tid = 0;
1233 		cursor->key_beg.delete_tid = 0;
1234 		cursor->key_beg.rec_type = HAMMER_RECTYPE_INODE;
1235 		cursor->key_beg.obj_type = 0;
1236 		cursor->asof = ip->obj_asof;
1237 		cursor->flags &= ~HAMMER_CURSOR_INITMASK;
1238 		cursor->flags |= HAMMER_CURSOR_GET_LEAF | HAMMER_CURSOR_ASOF;
1239 		cursor->flags |= HAMMER_CURSOR_BACKEND;
1240 
1241 		error = hammer_btree_lookup(cursor);
1242 		if (hammer_debug_inode)
1243 			kprintf("IPDEL %p %08x %d", ip, ip->flags, error);
1244 
1245 		if (error == 0) {
1246 			error = hammer_ip_delete_record(cursor, ip, trans->tid);
1247 			if (hammer_debug_inode)
1248 				kprintf(" error %d\n", error);
1249 			if (error == 0) {
1250 				ip->flags |= HAMMER_INODE_DELONDISK;
1251 			}
1252 			if (cursor->node)
1253 				hammer_cache_node(&ip->cache[0], cursor->node);
1254 		}
1255 		if (error == EDEADLK) {
1256 			hammer_done_cursor(cursor);
1257 			error = hammer_init_cursor(trans, cursor,
1258 						   &ip->cache[0], ip);
1259 			if (hammer_debug_inode)
1260 				kprintf("IPDED %p %d\n", ip, error);
1261 			if (error == 0)
1262 				goto retry;
1263 		}
1264 	}
1265 
1266 	/*
1267 	 * Ok, write out the initial record or a new record (after deleting
1268 	 * the old one), unless the DELETED flag is set.  This routine will
1269 	 * clear DELONDISK if it writes out a record.
1270 	 *
1271 	 * Update our inode statistics if this is the first application of
1272 	 * the inode on-disk.
1273 	 */
1274 	if (error == 0 && (ip->flags & HAMMER_INODE_DELETED) == 0) {
1275 		/*
1276 		 * Generate a record and write it to the media.  We clean-up
1277 		 * the state before releasing so we do not have to set-up
1278 		 * a flush_group.
1279 		 */
1280 		record = hammer_alloc_mem_record(ip, 0);
1281 		record->type = HAMMER_MEM_RECORD_INODE;
1282 		record->flush_state = HAMMER_FST_FLUSH;
1283 		record->leaf = ip->sync_ino_leaf;
1284 		record->leaf.base.create_tid = trans->tid;
1285 		record->leaf.data_len = sizeof(ip->sync_ino_data);
1286 		record->leaf.create_ts = trans->time32;
1287 		record->data = (void *)&ip->sync_ino_data;
1288 		record->flags |= HAMMER_RECF_INTERLOCK_BE;
1289 
1290 		/*
1291 		 * If this flag is set we cannot sync the new file size
1292 		 * because we haven't finished related truncations.  The
1293 		 * inode will be flushed in another flush group to finish
1294 		 * the job.
1295 		 */
1296 		if ((ip->flags & HAMMER_INODE_WOULDBLOCK) &&
1297 		    ip->sync_ino_data.size != ip->ino_data.size) {
1298 			redirty = 1;
1299 			ip->sync_ino_data.size = ip->ino_data.size;
1300 		} else {
1301 			redirty = 0;
1302 		}
1303 
1304 		for (;;) {
1305 			error = hammer_ip_sync_record_cursor(cursor, record);
1306 			if (hammer_debug_inode)
1307 				kprintf("GENREC %p rec %08x %d\n",
1308 					ip, record->flags, error);
1309 			if (error != EDEADLK)
1310 				break;
1311 			hammer_done_cursor(cursor);
1312 			error = hammer_init_cursor(trans, cursor,
1313 						   &ip->cache[0], ip);
1314 			if (hammer_debug_inode)
1315 				kprintf("GENREC reinit %d\n", error);
1316 			if (error)
1317 				break;
1318 		}
1319 
1320 		/*
1321 		 * Note:  The record was never on the inode's record tree
1322 		 * so just wave our hands importantly and destroy it.
1323 		 */
1324 		record->flags |= HAMMER_RECF_COMMITTED;
1325 		record->flags &= ~HAMMER_RECF_INTERLOCK_BE;
1326 		record->flush_state = HAMMER_FST_IDLE;
1327 		++ip->rec_generation;
1328 		hammer_rel_mem_record(record);
1329 
1330 		/*
1331 		 * Finish up.
1332 		 */
1333 		if (error == 0) {
1334 			if (hammer_debug_inode)
1335 				kprintf("CLEANDELOND %p %08x\n", ip, ip->flags);
1336 			ip->sync_flags &= ~(HAMMER_INODE_DDIRTY |
1337 					    HAMMER_INODE_SDIRTY |
1338 					    HAMMER_INODE_ATIME |
1339 					    HAMMER_INODE_MTIME);
1340 			ip->flags &= ~HAMMER_INODE_DELONDISK;
1341 			if (redirty)
1342 				ip->sync_flags |= HAMMER_INODE_DDIRTY;
1343 
1344 			/*
1345 			 * Root volume count of inodes
1346 			 */
1347 			hammer_sync_lock_sh(trans);
1348 			if ((ip->flags & HAMMER_INODE_ONDISK) == 0) {
1349 				hammer_modify_volume_field(trans,
1350 							   trans->rootvol,
1351 							   vol0_stat_inodes);
1352 				++ip->hmp->rootvol->ondisk->vol0_stat_inodes;
1353 				hammer_modify_volume_done(trans->rootvol);
1354 				ip->flags |= HAMMER_INODE_ONDISK;
1355 				if (hammer_debug_inode)
1356 					kprintf("NOWONDISK %p\n", ip);
1357 			}
1358 			hammer_sync_unlock(trans);
1359 		}
1360 	}
1361 
1362 	/*
1363 	 * If the inode has been destroyed, clean out any left-over flags
1364 	 * that may have been set by the frontend.
1365 	 */
1366 	if (error == 0 && (ip->flags & HAMMER_INODE_DELETED)) {
1367 		ip->sync_flags &= ~(HAMMER_INODE_DDIRTY |
1368 				    HAMMER_INODE_SDIRTY |
1369 				    HAMMER_INODE_ATIME |
1370 				    HAMMER_INODE_MTIME);
1371 	}
1372 	return(error);
1373 }
1374 
1375 /*
1376  * Update only the itimes fields.
1377  *
1378  * ATIME can be updated without generating any UNDO.  MTIME is updated
1379  * with UNDO so it is guaranteed to be synchronized properly in case of
1380  * a crash.
1381  *
1382  * Neither field is included in the B-Tree leaf element's CRC, which is how
1383  * we can get away with updating ATIME the way we do.
1384  */
1385 static int
1386 hammer_update_itimes(hammer_cursor_t cursor, hammer_inode_t ip)
1387 {
1388 	hammer_transaction_t trans = cursor->trans;
1389 	int error;
1390 
1391 retry:
1392 	if ((ip->flags & (HAMMER_INODE_ONDISK|HAMMER_INODE_DELONDISK)) !=
1393 	    HAMMER_INODE_ONDISK) {
1394 		return(0);
1395 	}
1396 
1397 	hammer_normalize_cursor(cursor);
1398 	cursor->key_beg.localization = ip->obj_localization +
1399 				       HAMMER_LOCALIZE_INODE;
1400 	cursor->key_beg.obj_id = ip->obj_id;
1401 	cursor->key_beg.key = 0;
1402 	cursor->key_beg.create_tid = 0;
1403 	cursor->key_beg.delete_tid = 0;
1404 	cursor->key_beg.rec_type = HAMMER_RECTYPE_INODE;
1405 	cursor->key_beg.obj_type = 0;
1406 	cursor->asof = ip->obj_asof;
1407 	cursor->flags &= ~HAMMER_CURSOR_INITMASK;
1408 	cursor->flags |= HAMMER_CURSOR_ASOF;
1409 	cursor->flags |= HAMMER_CURSOR_GET_LEAF;
1410 	cursor->flags |= HAMMER_CURSOR_GET_DATA;
1411 	cursor->flags |= HAMMER_CURSOR_BACKEND;
1412 
1413 	error = hammer_btree_lookup(cursor);
1414 	if (error == 0) {
1415 		hammer_cache_node(&ip->cache[0], cursor->node);
1416 		if (ip->sync_flags & HAMMER_INODE_MTIME) {
1417 			/*
1418 			 * Updating MTIME requires an UNDO.  Just cover
1419 			 * both atime and mtime.
1420 			 */
1421 			hammer_sync_lock_sh(trans);
1422 			hammer_modify_buffer(trans, cursor->data_buffer,
1423 				     HAMMER_ITIMES_BASE(&cursor->data->inode),
1424 				     HAMMER_ITIMES_BYTES);
1425 			cursor->data->inode.atime = ip->sync_ino_data.atime;
1426 			cursor->data->inode.mtime = ip->sync_ino_data.mtime;
1427 			hammer_modify_buffer_done(cursor->data_buffer);
1428 			hammer_sync_unlock(trans);
1429 		} else if (ip->sync_flags & HAMMER_INODE_ATIME) {
1430 			/*
1431 			 * Updating atime only can be done in-place with
1432 			 * no UNDO.
1433 			 */
1434 			hammer_sync_lock_sh(trans);
1435 			hammer_modify_buffer(trans, cursor->data_buffer,
1436 					     NULL, 0);
1437 			cursor->data->inode.atime = ip->sync_ino_data.atime;
1438 			hammer_modify_buffer_done(cursor->data_buffer);
1439 			hammer_sync_unlock(trans);
1440 		}
1441 		ip->sync_flags &= ~(HAMMER_INODE_ATIME | HAMMER_INODE_MTIME);
1442 	}
1443 	if (error == EDEADLK) {
1444 		hammer_done_cursor(cursor);
1445 		error = hammer_init_cursor(trans, cursor,
1446 					   &ip->cache[0], ip);
1447 		if (error == 0)
1448 			goto retry;
1449 	}
1450 	return(error);
1451 }
1452 
1453 /*
1454  * Release a reference on an inode, flush as requested.
1455  *
1456  * On the last reference we queue the inode to the flusher for its final
1457  * disposition.
1458  */
1459 void
1460 hammer_rel_inode(struct hammer_inode *ip, int flush)
1461 {
1462 	/*hammer_mount_t hmp = ip->hmp;*/
1463 
1464 	/*
1465 	 * Handle disposition when dropping the last ref.
1466 	 */
1467 	for (;;) {
1468 		if (hammer_oneref(&ip->lock)) {
1469 			/*
1470 			 * Determine whether on-disk action is needed for
1471 			 * the inode's final disposition.
1472 			 */
1473 			KKASSERT(ip->vp == NULL);
1474 			hammer_inode_unloadable_check(ip, 0);
1475 			if (ip->flags & HAMMER_INODE_MODMASK) {
1476 				hammer_flush_inode(ip, 0);
1477 			} else if (hammer_oneref(&ip->lock)) {
1478 				hammer_unload_inode(ip);
1479 				break;
1480 			}
1481 		} else {
1482 			if (flush)
1483 				hammer_flush_inode(ip, 0);
1484 
1485 			/*
1486 			 * The inode still has multiple refs, try to drop
1487 			 * one ref.
1488 			 */
1489 			KKASSERT(hammer_isactive(&ip->lock) >= 1);
1490 			if (hammer_isactive(&ip->lock) > 1) {
1491 				hammer_rel(&ip->lock);
1492 				break;
1493 			}
1494 		}
1495 	}
1496 }
1497 
1498 /*
1499  * Unload and destroy the specified inode.  Must be called with one remaining
1500  * reference.  The reference is disposed of.
1501  *
1502  * The inode must be completely clean.
1503  */
1504 static int
1505 hammer_unload_inode(struct hammer_inode *ip)
1506 {
1507 	hammer_mount_t hmp = ip->hmp;
1508 
1509 	KASSERT(hammer_oneref(&ip->lock),
1510 		("hammer_unload_inode: %d refs", hammer_isactive(&ip->lock)));
1511 	KKASSERT(ip->vp == NULL);
1512 	KKASSERT(ip->flush_state == HAMMER_FST_IDLE);
1513 	KKASSERT(ip->cursor_ip_refs == 0);
1514 	KKASSERT(hammer_notlocked(&ip->lock));
1515 	KKASSERT((ip->flags & HAMMER_INODE_MODMASK) == 0);
1516 
1517 	KKASSERT(RB_EMPTY(&ip->rec_tree));
1518 	KKASSERT(TAILQ_EMPTY(&ip->target_list));
1519 
1520 	if (ip->flags & HAMMER_INODE_RDIRTY) {
1521 		RB_REMOVE(hammer_redo_rb_tree, &hmp->rb_redo_root, ip);
1522 		ip->flags &= ~HAMMER_INODE_RDIRTY;
1523 	}
1524 	RB_REMOVE(hammer_ino_rb_tree, &hmp->rb_inos_root, ip);
1525 
1526 	hammer_free_inode(ip);
1527 	return(0);
1528 }
1529 
1530 /*
1531  * Called during unmounting if a critical error occured.  The in-memory
1532  * inode and all related structures are destroyed.
1533  *
1534  * If a critical error did not occur the unmount code calls the standard
1535  * release and asserts that the inode is gone.
1536  */
1537 int
1538 hammer_destroy_inode_callback(struct hammer_inode *ip, void *data __unused)
1539 {
1540 	hammer_record_t rec;
1541 
1542 	/*
1543 	 * Get rid of the inodes in-memory records, regardless of their
1544 	 * state, and clear the mod-mask.
1545 	 */
1546 	while ((rec = TAILQ_FIRST(&ip->target_list)) != NULL) {
1547 		TAILQ_REMOVE(&ip->target_list, rec, target_entry);
1548 		rec->target_ip = NULL;
1549 		if (rec->flush_state == HAMMER_FST_SETUP)
1550 			rec->flush_state = HAMMER_FST_IDLE;
1551 	}
1552 	while ((rec = RB_ROOT(&ip->rec_tree)) != NULL) {
1553 		if (rec->flush_state == HAMMER_FST_FLUSH)
1554 			--rec->flush_group->refs;
1555 		else
1556 			hammer_ref(&rec->lock);
1557 		KKASSERT(hammer_oneref(&rec->lock));
1558 		rec->flush_state = HAMMER_FST_IDLE;
1559 		rec->flush_group = NULL;
1560 		rec->flags |= HAMMER_RECF_DELETED_FE; /* wave hands */
1561 		rec->flags |= HAMMER_RECF_DELETED_BE; /* wave hands */
1562 		++ip->rec_generation;
1563 		hammer_rel_mem_record(rec);
1564 	}
1565 	ip->flags &= ~HAMMER_INODE_MODMASK;
1566 	ip->sync_flags &= ~HAMMER_INODE_MODMASK;
1567 	KKASSERT(ip->vp == NULL);
1568 
1569 	/*
1570 	 * Remove the inode from any flush group, force it idle.  FLUSH
1571 	 * and SETUP states have an inode ref.
1572 	 */
1573 	switch(ip->flush_state) {
1574 	case HAMMER_FST_FLUSH:
1575 		RB_REMOVE(hammer_fls_rb_tree, &ip->flush_group->flush_tree, ip);
1576 		--ip->flush_group->refs;
1577 		ip->flush_group = NULL;
1578 		/* fall through */
1579 	case HAMMER_FST_SETUP:
1580 		hammer_rel(&ip->lock);
1581 		ip->flush_state = HAMMER_FST_IDLE;
1582 		/* fall through */
1583 	case HAMMER_FST_IDLE:
1584 		break;
1585 	}
1586 
1587 	/*
1588 	 * There shouldn't be any associated vnode.  The unload needs at
1589 	 * least one ref, if we do have a vp steal its ip ref.
1590 	 */
1591 	if (ip->vp) {
1592 		kprintf("hammer_destroy_inode_callback: Unexpected "
1593 			"vnode association ip %p vp %p\n", ip, ip->vp);
1594 		ip->vp->v_data = NULL;
1595 		ip->vp = NULL;
1596 	} else {
1597 		hammer_ref(&ip->lock);
1598 	}
1599 	hammer_unload_inode(ip);
1600 	return(0);
1601 }
1602 
1603 /*
1604  * Called on mount -u when switching from RW to RO or vise-versa.  Adjust
1605  * the read-only flag for cached inodes.
1606  *
1607  * This routine is called from a RB_SCAN().
1608  */
1609 int
1610 hammer_reload_inode(hammer_inode_t ip, void *arg __unused)
1611 {
1612 	hammer_mount_t hmp = ip->hmp;
1613 
1614 	if (hmp->ronly || hmp->asof != HAMMER_MAX_TID)
1615 		ip->flags |= HAMMER_INODE_RO;
1616 	else
1617 		ip->flags &= ~HAMMER_INODE_RO;
1618 	return(0);
1619 }
1620 
1621 /*
1622  * A transaction has modified an inode, requiring updates as specified by
1623  * the passed flags.
1624  *
1625  * HAMMER_INODE_DDIRTY: Inode data has been updated, not incl mtime/atime,
1626  *			and not including size changes due to write-append
1627  *			(but other size changes are included).
1628  * HAMMER_INODE_SDIRTY: Inode data has been updated, size changes due to
1629  *			write-append.
1630  * HAMMER_INODE_XDIRTY: Dirty in-memory records
1631  * HAMMER_INODE_BUFS:   Dirty buffer cache buffers
1632  * HAMMER_INODE_DELETED: Inode record/data must be deleted
1633  * HAMMER_INODE_ATIME/MTIME: mtime/atime has been updated
1634  */
1635 void
1636 hammer_modify_inode(hammer_transaction_t trans, hammer_inode_t ip, int flags)
1637 {
1638 	/*
1639 	 * ronly of 0 or 2 does not trigger assertion.
1640 	 * 2 is a special error state
1641 	 */
1642 	KKASSERT(ip->hmp->ronly != 1 ||
1643 		  (flags & (HAMMER_INODE_DDIRTY | HAMMER_INODE_XDIRTY |
1644 			    HAMMER_INODE_SDIRTY |
1645 			    HAMMER_INODE_BUFS | HAMMER_INODE_DELETED |
1646 			    HAMMER_INODE_ATIME | HAMMER_INODE_MTIME)) == 0);
1647 	if ((ip->flags & HAMMER_INODE_RSV_INODES) == 0) {
1648 		ip->flags |= HAMMER_INODE_RSV_INODES;
1649 		++ip->hmp->rsv_inodes;
1650 	}
1651 
1652 	/*
1653 	 * Set the NEWINODE flag in the transaction if the inode
1654 	 * transitions to a dirty state.  This is used to track
1655 	 * the load on the inode cache.
1656 	 */
1657 	if (trans &&
1658 	    (ip->flags & HAMMER_INODE_MODMASK) == 0 &&
1659 	    (flags & HAMMER_INODE_MODMASK)) {
1660 		trans->flags |= HAMMER_TRANSF_NEWINODE;
1661 	}
1662 	if (flags & HAMMER_INODE_MODMASK)
1663 		hammer_inode_dirty(ip);
1664 	ip->flags |= flags;
1665 }
1666 
1667 /*
1668  * Attempt to quickly update the atime for a hammer inode.  Return 0 on
1669  * success, -1 on failure.
1670  *
1671  * We attempt to update the atime with only the ip lock and not the
1672  * whole filesystem lock in order to improve concurrency.  We can only
1673  * do this safely if the ATIME flag is already pending on the inode.
1674  *
1675  * This function is called via a vnops path (ip pointer is stable) without
1676  * fs_token held.
1677  */
1678 int
1679 hammer_update_atime_quick(hammer_inode_t ip)
1680 {
1681 	struct timeval tv;
1682 	int res = -1;
1683 
1684 	if ((ip->flags & HAMMER_INODE_RO) ||
1685 	    (ip->hmp->mp->mnt_flag & MNT_NOATIME)) {
1686 		/*
1687 		 * Silently indicate success on read-only mount/snap
1688 		 */
1689 		res = 0;
1690 	} else if (ip->flags & HAMMER_INODE_ATIME) {
1691 		/*
1692 		 * Double check with inode lock held against backend.  This
1693 		 * is only safe if all we need to do is update
1694 		 * ino_data.atime.
1695 		 */
1696 		getmicrotime(&tv);
1697 		hammer_lock_ex(&ip->lock);
1698 		if (ip->flags & HAMMER_INODE_ATIME) {
1699 			ip->ino_data.atime =
1700 			    (unsigned long)tv.tv_sec * 1000000ULL + tv.tv_usec;
1701 			res = 0;
1702 		}
1703 		hammer_unlock(&ip->lock);
1704 	}
1705 	return res;
1706 }
1707 
1708 /*
1709  * Request that an inode be flushed.  This whole mess cannot block and may
1710  * recurse (if not synchronous).  Once requested HAMMER will attempt to
1711  * actively flush the inode until the flush can be done.
1712  *
1713  * The inode may already be flushing, or may be in a setup state.  We can
1714  * place the inode in a flushing state if it is currently idle and flag it
1715  * to reflush if it is currently flushing.
1716  *
1717  * Upon return if the inode could not be flushed due to a setup
1718  * dependancy, then it will be automatically flushed when the dependancy
1719  * is satisfied.
1720  */
1721 void
1722 hammer_flush_inode(hammer_inode_t ip, int flags)
1723 {
1724 	hammer_mount_t hmp;
1725 	hammer_flush_group_t flg;
1726 	int good;
1727 
1728 	/*
1729 	 * fill_flush_group is the first flush group we may be able to
1730 	 * continue filling, it may be open or closed but it will always
1731 	 * be past the currently flushing (running) flg.
1732 	 *
1733 	 * next_flush_group is the next open flush group.
1734 	 */
1735 	hmp = ip->hmp;
1736 	while ((flg = hmp->fill_flush_group) != NULL) {
1737 		KKASSERT(flg->running == 0);
1738 		if (flg->total_count + flg->refs <= ip->hmp->undo_rec_limit &&
1739 		    flg->total_count <= hammer_autoflush) {
1740 			break;
1741 		}
1742 		hmp->fill_flush_group = TAILQ_NEXT(flg, flush_entry);
1743 		hammer_flusher_async(ip->hmp, flg);
1744 	}
1745 	if (flg == NULL) {
1746 		flg = kmalloc(sizeof(*flg), hmp->m_misc, M_WAITOK|M_ZERO);
1747 		flg->seq = hmp->flusher.next++;
1748 		if (hmp->next_flush_group == NULL)
1749 			hmp->next_flush_group = flg;
1750 		if (hmp->fill_flush_group == NULL)
1751 			hmp->fill_flush_group = flg;
1752 		RB_INIT(&flg->flush_tree);
1753 		TAILQ_INSERT_TAIL(&hmp->flush_group_list, flg, flush_entry);
1754 	}
1755 
1756 	/*
1757 	 * Trivial 'nothing to flush' case.  If the inode is in a SETUP
1758 	 * state we have to put it back into an IDLE state so we can
1759 	 * drop the extra ref.
1760 	 *
1761 	 * If we have a parent dependancy we must still fall through
1762 	 * so we can run it.
1763 	 */
1764 	if ((ip->flags & HAMMER_INODE_MODMASK) == 0) {
1765 		if (ip->flush_state == HAMMER_FST_SETUP &&
1766 		    TAILQ_EMPTY(&ip->target_list)) {
1767 			ip->flush_state = HAMMER_FST_IDLE;
1768 			hammer_rel_inode(ip, 0);
1769 		}
1770 		if (ip->flush_state == HAMMER_FST_IDLE)
1771 			return;
1772 	}
1773 
1774 	/*
1775 	 * Our flush action will depend on the current state.
1776 	 */
1777 	switch(ip->flush_state) {
1778 	case HAMMER_FST_IDLE:
1779 		/*
1780 		 * We have no dependancies and can flush immediately.  Some
1781 		 * our children may not be flushable so we have to re-test
1782 		 * with that additional knowledge.
1783 		 */
1784 		hammer_flush_inode_core(ip, flg, flags);
1785 		break;
1786 	case HAMMER_FST_SETUP:
1787 		/*
1788 		 * Recurse upwards through dependancies via target_list
1789 		 * and start their flusher actions going if possible.
1790 		 *
1791 		 * 'good' is our connectivity.  -1 means we have none and
1792 		 * can't flush, 0 means there weren't any dependancies, and
1793 		 * 1 means we have good connectivity.
1794 		 */
1795 		good = hammer_setup_parent_inodes(ip, 0, flg);
1796 
1797 		if (good >= 0) {
1798 			/*
1799 			 * We can continue if good >= 0.  Determine how
1800 			 * many records under our inode can be flushed (and
1801 			 * mark them).
1802 			 */
1803 			hammer_flush_inode_core(ip, flg, flags);
1804 		} else {
1805 			/*
1806 			 * Parent has no connectivity, tell it to flush
1807 			 * us as soon as it does.
1808 			 *
1809 			 * The REFLUSH flag is also needed to trigger
1810 			 * dependancy wakeups.
1811 			 */
1812 			ip->flags |= HAMMER_INODE_CONN_DOWN |
1813 				     HAMMER_INODE_REFLUSH;
1814 			if (flags & HAMMER_FLUSH_SIGNAL) {
1815 				ip->flags |= HAMMER_INODE_RESIGNAL;
1816 				hammer_flusher_async(ip->hmp, flg);
1817 			}
1818 		}
1819 		break;
1820 	case HAMMER_FST_FLUSH:
1821 		/*
1822 		 * We are already flushing, flag the inode to reflush
1823 		 * if needed after it completes its current flush.
1824 		 *
1825 		 * The REFLUSH flag is also needed to trigger
1826 		 * dependancy wakeups.
1827 		 */
1828 		if ((ip->flags & HAMMER_INODE_REFLUSH) == 0)
1829 			ip->flags |= HAMMER_INODE_REFLUSH;
1830 		if (flags & HAMMER_FLUSH_SIGNAL) {
1831 			ip->flags |= HAMMER_INODE_RESIGNAL;
1832 			hammer_flusher_async(ip->hmp, flg);
1833 		}
1834 		break;
1835 	}
1836 }
1837 
1838 /*
1839  * Scan ip->target_list, which is a list of records owned by PARENTS to our
1840  * ip which reference our ip.
1841  *
1842  * XXX This is a huge mess of recursive code, but not one bit of it blocks
1843  *     so for now do not ref/deref the structures.  Note that if we use the
1844  *     ref/rel code later, the rel CAN block.
1845  */
1846 static int
1847 hammer_setup_parent_inodes(hammer_inode_t ip, int depth,
1848 			   hammer_flush_group_t flg)
1849 {
1850 	hammer_record_t depend;
1851 	int good;
1852 	int r;
1853 
1854 	/*
1855 	 * If we hit our recursion limit and we have parent dependencies
1856 	 * We cannot continue.  Returning < 0 will cause us to be flagged
1857 	 * for reflush.  Returning -2 cuts off additional dependency checks
1858 	 * because they are likely to also hit the depth limit.
1859 	 *
1860 	 * We cannot return < 0 if there are no dependencies or there might
1861 	 * not be anything to wakeup (ip).
1862 	 */
1863 	if (depth == 20 && TAILQ_FIRST(&ip->target_list)) {
1864 		krateprintf(&hammer_gen_krate,
1865 			    "HAMMER Warning: depth limit reached on "
1866 			    "setup recursion, inode %p %016llx\n",
1867 			    ip, (long long)ip->obj_id);
1868 		return(-2);
1869 	}
1870 
1871 	/*
1872 	 * Scan dependencies
1873 	 */
1874 	good = 0;
1875 	TAILQ_FOREACH(depend, &ip->target_list, target_entry) {
1876 		r = hammer_setup_parent_inodes_helper(depend, depth, flg);
1877 		KKASSERT(depend->target_ip == ip);
1878 		if (r < 0 && good == 0)
1879 			good = -1;
1880 		if (r > 0)
1881 			good = 1;
1882 
1883 		/*
1884 		 * If we failed due to the recursion depth limit then stop
1885 		 * now.
1886 		 */
1887 		if (r == -2)
1888 			break;
1889 	}
1890 	return(good);
1891 }
1892 
1893 /*
1894  * This helper function takes a record representing the dependancy between
1895  * the parent inode and child inode.
1896  *
1897  * record->ip		= parent inode
1898  * record->target_ip	= child inode
1899  *
1900  * We are asked to recurse upwards and convert the record from SETUP
1901  * to FLUSH if possible.
1902  *
1903  * Return 1 if the record gives us connectivity
1904  *
1905  * Return 0 if the record is not relevant
1906  *
1907  * Return -1 if we can't resolve the dependancy and there is no connectivity.
1908  */
1909 static int
1910 hammer_setup_parent_inodes_helper(hammer_record_t record, int depth,
1911 				  hammer_flush_group_t flg)
1912 {
1913 	hammer_inode_t pip;
1914 	int good;
1915 
1916 	KKASSERT(record->flush_state != HAMMER_FST_IDLE);
1917 	pip = record->ip;
1918 
1919 	/*
1920 	 * If the record is already flushing, is it in our flush group?
1921 	 *
1922 	 * If it is in our flush group but it is a general record or a
1923 	 * delete-on-disk, it does not improve our connectivity (return 0),
1924 	 * and if the target inode is not trying to destroy itself we can't
1925 	 * allow the operation yet anyway (the second return -1).
1926 	 */
1927 	if (record->flush_state == HAMMER_FST_FLUSH) {
1928 		/*
1929 		 * If not in our flush group ask the parent to reflush
1930 		 * us as soon as possible.
1931 		 */
1932 		if (record->flush_group != flg) {
1933 			pip->flags |= HAMMER_INODE_REFLUSH;
1934 			record->target_ip->flags |= HAMMER_INODE_CONN_DOWN;
1935 			return(-1);
1936 		}
1937 
1938 		/*
1939 		 * If in our flush group everything is already set up,
1940 		 * just return whether the record will improve our
1941 		 * visibility or not.
1942 		 */
1943 		if (record->type == HAMMER_MEM_RECORD_ADD)
1944 			return(1);
1945 		return(0);
1946 	}
1947 
1948 	/*
1949 	 * It must be a setup record.  Try to resolve the setup dependancies
1950 	 * by recursing upwards so we can place ip on the flush list.
1951 	 *
1952 	 * Limit ourselves to 20 levels of recursion to avoid blowing out
1953 	 * the kernel stack.  If we hit the recursion limit we can't flush
1954 	 * until the parent flushes.  The parent will flush independantly
1955 	 * on its own and ultimately a deep recursion will be resolved.
1956 	 */
1957 	KKASSERT(record->flush_state == HAMMER_FST_SETUP);
1958 
1959 	good = hammer_setup_parent_inodes(pip, depth + 1, flg);
1960 
1961 	/*
1962 	 * If good < 0 the parent has no connectivity and we cannot safely
1963 	 * flush the directory entry, which also means we can't flush our
1964 	 * ip.  Flag us for downward recursion once the parent's
1965 	 * connectivity is resolved.  Flag the parent for [re]flush or it
1966 	 * may not check for downward recursions.
1967 	 */
1968 	if (good < 0) {
1969 		pip->flags |= HAMMER_INODE_REFLUSH;
1970 		record->target_ip->flags |= HAMMER_INODE_CONN_DOWN;
1971 		return(good);
1972 	}
1973 
1974 	/*
1975 	 * We are go, place the parent inode in a flushing state so we can
1976 	 * place its record in a flushing state.  Note that the parent
1977 	 * may already be flushing.  The record must be in the same flush
1978 	 * group as the parent.
1979 	 */
1980 	if (pip->flush_state != HAMMER_FST_FLUSH)
1981 		hammer_flush_inode_core(pip, flg, HAMMER_FLUSH_RECURSION);
1982 	KKASSERT(pip->flush_state == HAMMER_FST_FLUSH);
1983 
1984 	/*
1985 	 * It is possible for a rename to create a loop in the recursion
1986 	 * and revisit a record.  This will result in the record being
1987 	 * placed in a flush state unexpectedly.  This check deals with
1988 	 * the case.
1989 	 */
1990 	if (record->flush_state == HAMMER_FST_FLUSH) {
1991 		if (record->type == HAMMER_MEM_RECORD_ADD)
1992 			return(1);
1993 		return(0);
1994 	}
1995 
1996 	KKASSERT(record->flush_state == HAMMER_FST_SETUP);
1997 
1998 #if 0
1999 	if (record->type == HAMMER_MEM_RECORD_DEL &&
2000 	    (record->target_ip->flags & (HAMMER_INODE_DELETED|HAMMER_INODE_DELONDISK)) == 0) {
2001 		/*
2002 		 * Regardless of flushing state we cannot sync this path if the
2003 		 * record represents a delete-on-disk but the target inode
2004 		 * is not ready to sync its own deletion.
2005 		 *
2006 		 * XXX need to count effective nlinks to determine whether
2007 		 * the flush is ok, otherwise removing a hardlink will
2008 		 * just leave the DEL record to rot.
2009 		 */
2010 		record->target_ip->flags |= HAMMER_INODE_REFLUSH;
2011 		return(-1);
2012 	} else
2013 #endif
2014 	if (pip->flush_group == flg) {
2015 		/*
2016 		 * Because we have not calculated nlinks yet we can just
2017 		 * set records to the flush state if the parent is in
2018 		 * the same flush group as we are.
2019 		 */
2020 		record->flush_state = HAMMER_FST_FLUSH;
2021 		record->flush_group = flg;
2022 		++record->flush_group->refs;
2023 		hammer_ref(&record->lock);
2024 
2025 		/*
2026 		 * A general directory-add contributes to our visibility.
2027 		 *
2028 		 * Otherwise it is probably a directory-delete or
2029 		 * delete-on-disk record and does not contribute to our
2030 		 * visbility (but we can still flush it).
2031 		 */
2032 		if (record->type == HAMMER_MEM_RECORD_ADD)
2033 			return(1);
2034 		return(0);
2035 	} else {
2036 		/*
2037 		 * If the parent is not in our flush group we cannot
2038 		 * flush this record yet, there is no visibility.
2039 		 * We tell the parent to reflush and mark ourselves
2040 		 * so the parent knows it should flush us too.
2041 		 */
2042 		pip->flags |= HAMMER_INODE_REFLUSH;
2043 		record->target_ip->flags |= HAMMER_INODE_CONN_DOWN;
2044 		return(-1);
2045 	}
2046 }
2047 
2048 /*
2049  * This is the core routine placing an inode into the FST_FLUSH state.
2050  */
2051 static void
2052 hammer_flush_inode_core(hammer_inode_t ip, hammer_flush_group_t flg, int flags)
2053 {
2054 	hammer_mount_t hmp = ip->hmp;
2055 	int go_count;
2056 
2057 	/*
2058 	 * Set flush state and prevent the flusher from cycling into
2059 	 * the next flush group.  Do not place the ip on the list yet.
2060 	 * Inodes not in the idle state get an extra reference.
2061 	 */
2062 	KKASSERT(ip->flush_state != HAMMER_FST_FLUSH);
2063 	if (ip->flush_state == HAMMER_FST_IDLE)
2064 		hammer_ref(&ip->lock);
2065 	ip->flush_state = HAMMER_FST_FLUSH;
2066 	ip->flush_group = flg;
2067 	++hmp->flusher.group_lock;
2068 	++hmp->count_iqueued;
2069 	++hammer_count_iqueued;
2070 	++flg->total_count;
2071 	hammer_redo_fifo_start_flush(ip);
2072 
2073 #if 0
2074 	/*
2075 	 * We need to be able to vfsync/truncate from the backend.
2076 	 *
2077 	 * XXX Any truncation from the backend will acquire the vnode
2078 	 *     independently.
2079 	 */
2080 	KKASSERT((ip->flags & HAMMER_INODE_VHELD) == 0);
2081 	if (ip->vp && (ip->vp->v_flag & VINACTIVE) == 0) {
2082 		ip->flags |= HAMMER_INODE_VHELD;
2083 		vref(ip->vp);
2084 	}
2085 #endif
2086 
2087 	/*
2088 	 * Figure out how many in-memory records we can actually flush
2089 	 * (not including inode meta-data, buffers, etc).
2090 	 */
2091 	KKASSERT((ip->flags & HAMMER_INODE_WOULDBLOCK) == 0);
2092 	if (flags & HAMMER_FLUSH_RECURSION) {
2093 		/*
2094 		 * If this is a upwards recursion we do not want to
2095 		 * recurse down again!
2096 		 */
2097 		go_count = 1;
2098 #if 0
2099 	} else if (ip->flags & HAMMER_INODE_WOULDBLOCK) {
2100 		/*
2101 		 * No new records are added if we must complete a flush
2102 		 * from a previous cycle, but we do have to move the records
2103 		 * from the previous cycle to the current one.
2104 		 */
2105 #if 0
2106 		go_count = RB_SCAN(hammer_rec_rb_tree, &ip->rec_tree, NULL,
2107 				   hammer_syncgrp_child_callback, NULL);
2108 #endif
2109 		go_count = 1;
2110 #endif
2111 	} else {
2112 		/*
2113 		 * Normal flush, scan records and bring them into the flush.
2114 		 * Directory adds and deletes are usually skipped (they are
2115 		 * grouped with the related inode rather then with the
2116 		 * directory).
2117 		 *
2118 		 * go_count can be negative, which means the scan aborted
2119 		 * due to the flush group being over-full and we should
2120 		 * flush what we have.
2121 		 */
2122 		go_count = RB_SCAN(hammer_rec_rb_tree, &ip->rec_tree, NULL,
2123 				   hammer_setup_child_callback, NULL);
2124 	}
2125 
2126 	/*
2127 	 * This is a more involved test that includes go_count.  If we
2128 	 * can't flush, flag the inode and return.  If go_count is 0 we
2129 	 * were are unable to flush any records in our rec_tree and
2130 	 * must ignore the XDIRTY flag.
2131 	 */
2132 	if (go_count == 0) {
2133 		if ((ip->flags & HAMMER_INODE_MODMASK_NOXDIRTY) == 0) {
2134 			--hmp->count_iqueued;
2135 			--hammer_count_iqueued;
2136 
2137 			--flg->total_count;
2138 			ip->flush_state = HAMMER_FST_SETUP;
2139 			ip->flush_group = NULL;
2140 			if (flags & HAMMER_FLUSH_SIGNAL) {
2141 				ip->flags |= HAMMER_INODE_REFLUSH |
2142 					     HAMMER_INODE_RESIGNAL;
2143 			} else {
2144 				ip->flags |= HAMMER_INODE_REFLUSH;
2145 			}
2146 #if 0
2147 			if (ip->flags & HAMMER_INODE_VHELD) {
2148 				ip->flags &= ~HAMMER_INODE_VHELD;
2149 				vrele(ip->vp);
2150 			}
2151 #endif
2152 
2153 			/*
2154 			 * REFLUSH is needed to trigger dependancy wakeups
2155 			 * when an inode is in SETUP.
2156 			 */
2157 			ip->flags |= HAMMER_INODE_REFLUSH;
2158 			if (--hmp->flusher.group_lock == 0)
2159 				wakeup(&hmp->flusher.group_lock);
2160 			return;
2161 		}
2162 	}
2163 
2164 	/*
2165 	 * Snapshot the state of the inode for the backend flusher.
2166 	 *
2167 	 * We continue to retain save_trunc_off even when all truncations
2168 	 * have been resolved as an optimization to determine if we can
2169 	 * skip the B-Tree lookup for overwrite deletions.
2170 	 *
2171 	 * NOTE: The DELETING flag is a mod flag, but it is also sticky,
2172 	 * and stays in ip->flags.  Once set, it stays set until the
2173 	 * inode is destroyed.
2174 	 */
2175 	if (ip->flags & HAMMER_INODE_TRUNCATED) {
2176 		KKASSERT((ip->sync_flags & HAMMER_INODE_TRUNCATED) == 0);
2177 		ip->sync_trunc_off = ip->trunc_off;
2178 		ip->trunc_off = 0x7FFFFFFFFFFFFFFFLL;
2179 		ip->flags &= ~HAMMER_INODE_TRUNCATED;
2180 		ip->sync_flags |= HAMMER_INODE_TRUNCATED;
2181 
2182 		/*
2183 		 * The save_trunc_off used to cache whether the B-Tree
2184 		 * holds any records past that point is not used until
2185 		 * after the truncation has succeeded, so we can safely
2186 		 * set it now.
2187 		 */
2188 		if (ip->save_trunc_off > ip->sync_trunc_off)
2189 			ip->save_trunc_off = ip->sync_trunc_off;
2190 	}
2191 	ip->sync_flags |= (ip->flags & HAMMER_INODE_MODMASK &
2192 			   ~HAMMER_INODE_TRUNCATED);
2193 	ip->sync_ino_leaf = ip->ino_leaf;
2194 	ip->sync_ino_data = ip->ino_data;
2195 	ip->flags &= ~HAMMER_INODE_MODMASK | HAMMER_INODE_TRUNCATED;
2196 #ifdef DEBUG_TRUNCATE
2197 	if ((ip->sync_flags & HAMMER_INODE_TRUNCATED) && ip == HammerTruncIp)
2198 		kprintf("truncateS %016llx\n", ip->sync_trunc_off);
2199 #endif
2200 
2201 	/*
2202 	 * The flusher list inherits our inode and reference.
2203 	 */
2204 	KKASSERT(flg->running == 0);
2205 	RB_INSERT(hammer_fls_rb_tree, &flg->flush_tree, ip);
2206 	if (--hmp->flusher.group_lock == 0)
2207 		wakeup(&hmp->flusher.group_lock);
2208 
2209 	/*
2210 	 * Auto-flush the group if it grows too large.  Make sure the
2211 	 * inode reclaim wait pipeline continues to work.
2212 	 */
2213 	if (flg->total_count >= hammer_autoflush ||
2214 	    flg->total_count >= hammer_limit_reclaims / 4) {
2215 		if (hmp->fill_flush_group == flg)
2216 			hmp->fill_flush_group = TAILQ_NEXT(flg, flush_entry);
2217 		hammer_flusher_async(hmp, flg);
2218 	}
2219 }
2220 
2221 /*
2222  * Callback for scan of ip->rec_tree.  Try to include each record in our
2223  * flush.  ip->flush_group has been set but the inode has not yet been
2224  * moved into a flushing state.
2225  *
2226  * If we get stuck on a record we have to set HAMMER_INODE_REFLUSH on
2227  * both inodes.
2228  *
2229  * We return 1 for any record placed or found in FST_FLUSH, which prevents
2230  * the caller from shortcutting the flush.
2231  */
2232 static int
2233 hammer_setup_child_callback(hammer_record_t rec, void *data)
2234 {
2235 	hammer_flush_group_t flg;
2236 	hammer_inode_t target_ip;
2237 	hammer_inode_t ip;
2238 	int r;
2239 
2240 	/*
2241 	 * Records deleted or committed by the backend are ignored.
2242 	 * Note that the flush detects deleted frontend records at
2243 	 * multiple points to deal with races.  This is just the first
2244 	 * line of defense.  The only time HAMMER_RECF_DELETED_FE cannot
2245 	 * be set is when HAMMER_RECF_INTERLOCK_BE is set, because it
2246 	 * messes up link-count calculations.
2247 	 *
2248 	 * NOTE: Don't get confused between record deletion and, say,
2249 	 * directory entry deletion.  The deletion of a directory entry
2250 	 * which is on-media has nothing to do with the record deletion
2251 	 * flags.
2252 	 */
2253 	if (rec->flags & (HAMMER_RECF_DELETED_FE | HAMMER_RECF_DELETED_BE |
2254 			  HAMMER_RECF_COMMITTED)) {
2255 		if (rec->flush_state == HAMMER_FST_FLUSH) {
2256 			KKASSERT(rec->flush_group == rec->ip->flush_group);
2257 			r = 1;
2258 		} else {
2259 			r = 0;
2260 		}
2261 		return(r);
2262 	}
2263 
2264 	/*
2265 	 * If the record is in an idle state it has no dependancies and
2266 	 * can be flushed.
2267 	 */
2268 	ip = rec->ip;
2269 	flg = ip->flush_group;
2270 	r = 0;
2271 
2272 	switch(rec->flush_state) {
2273 	case HAMMER_FST_IDLE:
2274 		/*
2275 		 * The record has no setup dependancy, we can flush it.
2276 		 */
2277 		KKASSERT(rec->target_ip == NULL);
2278 		rec->flush_state = HAMMER_FST_FLUSH;
2279 		rec->flush_group = flg;
2280 		++flg->refs;
2281 		hammer_ref(&rec->lock);
2282 		r = 1;
2283 		break;
2284 	case HAMMER_FST_SETUP:
2285 		/*
2286 		 * The record has a setup dependancy.  These are typically
2287 		 * directory entry adds and deletes.  Such entries will be
2288 		 * flushed when their inodes are flushed so we do not
2289 		 * usually have to add them to the flush here.  However,
2290 		 * if the target_ip has set HAMMER_INODE_CONN_DOWN then
2291 		 * it is asking us to flush this record (and it).
2292 		 */
2293 		target_ip = rec->target_ip;
2294 		KKASSERT(target_ip != NULL);
2295 		KKASSERT(target_ip->flush_state != HAMMER_FST_IDLE);
2296 
2297 		/*
2298 		 * If the target IP is already flushing in our group
2299 		 * we could associate the record, but target_ip has
2300 		 * already synced ino_data to sync_ino_data and we
2301 		 * would also have to adjust nlinks.   Plus there are
2302 		 * ordering issues for adds and deletes.
2303 		 *
2304 		 * Reflush downward if this is an ADD, and upward if
2305 		 * this is a DEL.
2306 		 */
2307 		if (target_ip->flush_state == HAMMER_FST_FLUSH) {
2308 			if (rec->type == HAMMER_MEM_RECORD_ADD)
2309 				ip->flags |= HAMMER_INODE_REFLUSH;
2310 			else
2311 				target_ip->flags |= HAMMER_INODE_REFLUSH;
2312 			break;
2313 		}
2314 
2315 		/*
2316 		 * Target IP is not yet flushing.  This can get complex
2317 		 * because we have to be careful about the recursion.
2318 		 *
2319 		 * Directories create an issue for us in that if a flush
2320 		 * of a directory is requested the expectation is to flush
2321 		 * any pending directory entries, but this will cause the
2322 		 * related inodes to recursively flush as well.  We can't
2323 		 * really defer the operation so just get as many as we
2324 		 * can and
2325 		 */
2326 #if 0
2327 		if ((target_ip->flags & HAMMER_INODE_RECLAIM) == 0 &&
2328 		    (target_ip->flags & HAMMER_INODE_CONN_DOWN) == 0) {
2329 			/*
2330 			 * We aren't reclaiming and the target ip was not
2331 			 * previously prevented from flushing due to this
2332 			 * record dependancy.  Do not flush this record.
2333 			 */
2334 			/*r = 0;*/
2335 		} else
2336 #endif
2337 		if (flg->total_count + flg->refs >
2338 			   ip->hmp->undo_rec_limit) {
2339 			/*
2340 			 * Our flush group is over-full and we risk blowing
2341 			 * out the UNDO FIFO.  Stop the scan, flush what we
2342 			 * have, then reflush the directory.
2343 			 *
2344 			 * The directory may be forced through multiple
2345 			 * flush groups before it can be completely
2346 			 * flushed.
2347 			 */
2348 			ip->flags |= HAMMER_INODE_RESIGNAL |
2349 				     HAMMER_INODE_REFLUSH;
2350 			r = -1;
2351 		} else if (rec->type == HAMMER_MEM_RECORD_ADD) {
2352 			/*
2353 			 * If the target IP is not flushing we can force
2354 			 * it to flush, even if it is unable to write out
2355 			 * any of its own records we have at least one in
2356 			 * hand that we CAN deal with.
2357 			 */
2358 			rec->flush_state = HAMMER_FST_FLUSH;
2359 			rec->flush_group = flg;
2360 			++flg->refs;
2361 			hammer_ref(&rec->lock);
2362 			hammer_flush_inode_core(target_ip, flg,
2363 						HAMMER_FLUSH_RECURSION);
2364 			r = 1;
2365 		} else {
2366 			/*
2367 			 * General or delete-on-disk record.
2368 			 *
2369 			 * XXX this needs help.  If a delete-on-disk we could
2370 			 * disconnect the target.  If the target has its own
2371 			 * dependancies they really need to be flushed.
2372 			 *
2373 			 * XXX
2374 			 */
2375 			rec->flush_state = HAMMER_FST_FLUSH;
2376 			rec->flush_group = flg;
2377 			++flg->refs;
2378 			hammer_ref(&rec->lock);
2379 			hammer_flush_inode_core(target_ip, flg,
2380 						HAMMER_FLUSH_RECURSION);
2381 			r = 1;
2382 		}
2383 		break;
2384 	case HAMMER_FST_FLUSH:
2385 		/*
2386 		 * The record could be part of a previous flush group if the
2387 		 * inode is a directory (the record being a directory entry).
2388 		 * Once the flush group was closed a hammer_test_inode()
2389 		 * function can cause a new flush group to be setup, placing
2390 		 * the directory inode itself in a new flush group.
2391 		 *
2392 		 * When associated with a previous flush group we count it
2393 		 * as if it were in our current flush group, since it will
2394 		 * effectively be flushed by the time we flush our current
2395 		 * flush group.
2396 		 */
2397 		KKASSERT(
2398 		    rec->ip->ino_data.obj_type == HAMMER_OBJTYPE_DIRECTORY ||
2399 		    rec->flush_group == flg);
2400 		r = 1;
2401 		break;
2402 	}
2403 	return(r);
2404 }
2405 
2406 #if 0
2407 /*
2408  * This version just moves records already in a flush state to the new
2409  * flush group and that is it.
2410  */
2411 static int
2412 hammer_syncgrp_child_callback(hammer_record_t rec, void *data)
2413 {
2414 	hammer_inode_t ip = rec->ip;
2415 
2416 	switch(rec->flush_state) {
2417 	case HAMMER_FST_FLUSH:
2418 		KKASSERT(rec->flush_group == ip->flush_group);
2419 		break;
2420 	default:
2421 		break;
2422 	}
2423 	return(0);
2424 }
2425 #endif
2426 
2427 /*
2428  * Wait for a previously queued flush to complete.
2429  *
2430  * If a critical error occured we don't try to wait.
2431  */
2432 void
2433 hammer_wait_inode(hammer_inode_t ip)
2434 {
2435 	/*
2436 	 * The inode can be in a SETUP state in which case RESIGNAL
2437 	 * should be set.  If RESIGNAL is not set then the previous
2438 	 * flush completed and a later operation placed the inode
2439 	 * in a passive setup state again, so we're done.
2440 	 *
2441 	 * The inode can be in a FLUSH state in which case we
2442 	 * can just wait for completion.
2443 	 */
2444 	while (ip->flush_state == HAMMER_FST_FLUSH ||
2445 	    (ip->flush_state == HAMMER_FST_SETUP &&
2446 	     (ip->flags & HAMMER_INODE_RESIGNAL))) {
2447 		/*
2448 		 * Don't try to flush on a critical error
2449 		 */
2450 		if (ip->hmp->flags & HAMMER_MOUNT_CRITICAL_ERROR)
2451 			break;
2452 
2453 		/*
2454 		 * If the inode was already being flushed its flg
2455 		 * may not have been queued to the backend.  We
2456 		 * have to make sure it gets queued or we can wind
2457 		 * up blocked or deadlocked (particularly if we are
2458 		 * the vnlru thread).
2459 		 */
2460 		if (ip->flush_state == HAMMER_FST_FLUSH) {
2461 			KKASSERT(ip->flush_group);
2462 			if (ip->flush_group->closed == 0) {
2463 				if (hammer_debug_inode) {
2464 					kprintf("hammer: debug: forcing "
2465 						"async flush ip %016jx\n",
2466 						(intmax_t)ip->obj_id);
2467 				}
2468 				hammer_flusher_async(ip->hmp,
2469 						     ip->flush_group);
2470 				continue; /* retest */
2471 			}
2472 		}
2473 
2474 		/*
2475 		 * In a flush state with the flg queued to the backend
2476 		 * or in a setup state with RESIGNAL set, we can safely
2477 		 * wait.
2478 		 */
2479 		ip->flags |= HAMMER_INODE_FLUSHW;
2480 		tsleep(&ip->flags, 0, "hmrwin", 0);
2481 	}
2482 
2483 #if 0
2484 	/*
2485 	 * The inode may have been in a passive setup state,
2486 	 * call flush to make sure we get signaled.
2487 	 */
2488 	if (ip->flush_state == HAMMER_FST_SETUP)
2489 		hammer_flush_inode(ip, HAMMER_FLUSH_SIGNAL);
2490 #endif
2491 
2492 }
2493 
2494 /*
2495  * Called by the backend code when a flush has been completed.
2496  * The inode has already been removed from the flush list.
2497  *
2498  * A pipelined flush can occur, in which case we must re-enter the
2499  * inode on the list and re-copy its fields.
2500  */
2501 void
2502 hammer_flush_inode_done(hammer_inode_t ip, int error)
2503 {
2504 	hammer_mount_t hmp;
2505 	int dorel;
2506 
2507 	KKASSERT(ip->flush_state == HAMMER_FST_FLUSH);
2508 
2509 	hmp = ip->hmp;
2510 
2511 	/*
2512 	 * Auto-reflush if the backend could not completely flush
2513 	 * the inode.  This fixes a case where a deferred buffer flush
2514 	 * could cause fsync to return early.
2515 	 */
2516 	if (ip->sync_flags & HAMMER_INODE_MODMASK)
2517 		ip->flags |= HAMMER_INODE_REFLUSH;
2518 
2519 	/*
2520 	 * Merge left-over flags back into the frontend and fix the state.
2521 	 * Incomplete truncations are retained by the backend.
2522 	 */
2523 	ip->error = error;
2524 	ip->flags |= ip->sync_flags & ~HAMMER_INODE_TRUNCATED;
2525 	ip->sync_flags &= HAMMER_INODE_TRUNCATED;
2526 
2527 	/*
2528 	 * The backend may have adjusted nlinks, so if the adjusted nlinks
2529 	 * does not match the fronttend set the frontend's DDIRTY flag again.
2530 	 */
2531 	if (ip->ino_data.nlinks != ip->sync_ino_data.nlinks)
2532 		ip->flags |= HAMMER_INODE_DDIRTY;
2533 
2534 	/*
2535 	 * Fix up the dirty buffer status.
2536 	 */
2537 	if (ip->vp && RB_ROOT(&ip->vp->v_rbdirty_tree)) {
2538 		ip->flags |= HAMMER_INODE_BUFS;
2539 	}
2540 	hammer_redo_fifo_end_flush(ip);
2541 
2542 	/*
2543 	 * Re-set the XDIRTY flag if some of the inode's in-memory records
2544 	 * could not be flushed.
2545 	 */
2546 	KKASSERT((RB_EMPTY(&ip->rec_tree) &&
2547 		  (ip->flags & HAMMER_INODE_XDIRTY) == 0) ||
2548 		 (!RB_EMPTY(&ip->rec_tree) &&
2549 		  (ip->flags & HAMMER_INODE_XDIRTY) != 0));
2550 
2551 	/*
2552 	 * Do not lose track of inodes which no longer have vnode
2553 	 * assocations, otherwise they may never get flushed again.
2554 	 *
2555 	 * The reflush flag can be set superfluously, causing extra pain
2556 	 * for no reason.  If the inode is no longer modified it no longer
2557 	 * needs to be flushed.
2558 	 */
2559 	if (ip->flags & HAMMER_INODE_MODMASK) {
2560 		if (ip->vp == NULL)
2561 			ip->flags |= HAMMER_INODE_REFLUSH;
2562 	} else {
2563 		ip->flags &= ~HAMMER_INODE_REFLUSH;
2564 	}
2565 	if (ip->flags & HAMMER_INODE_MODMASK)
2566 		hammer_inode_dirty(ip);
2567 
2568 	/*
2569 	 * Adjust the flush state.
2570 	 */
2571 	if (ip->flags & HAMMER_INODE_WOULDBLOCK) {
2572 		/*
2573 		 * We were unable to flush out all our records, leave the
2574 		 * inode in a flush state and in the current flush group.
2575 		 * The flush group will be re-run.
2576 		 *
2577 		 * This occurs if the UNDO block gets too full or there is
2578 		 * too much dirty meta-data and allows the flusher to
2579 		 * finalize the UNDO block and then re-flush.
2580 		 */
2581 		ip->flags &= ~HAMMER_INODE_WOULDBLOCK;
2582 		dorel = 0;
2583 	} else {
2584 		/*
2585 		 * Remove from the flush_group
2586 		 */
2587 		RB_REMOVE(hammer_fls_rb_tree, &ip->flush_group->flush_tree, ip);
2588 		ip->flush_group = NULL;
2589 
2590 #if 0
2591 		/*
2592 		 * Clean up the vnode ref and tracking counts.
2593 		 */
2594 		if (ip->flags & HAMMER_INODE_VHELD) {
2595 			ip->flags &= ~HAMMER_INODE_VHELD;
2596 			vrele(ip->vp);
2597 		}
2598 #endif
2599 		--hmp->count_iqueued;
2600 		--hammer_count_iqueued;
2601 
2602 		/*
2603 		 * And adjust the state.
2604 		 */
2605 		if (TAILQ_EMPTY(&ip->target_list) && RB_EMPTY(&ip->rec_tree)) {
2606 			ip->flush_state = HAMMER_FST_IDLE;
2607 			dorel = 1;
2608 		} else {
2609 			ip->flush_state = HAMMER_FST_SETUP;
2610 			dorel = 0;
2611 		}
2612 
2613 		/*
2614 		 * If the frontend is waiting for a flush to complete,
2615 		 * wake it up.
2616 		 */
2617 		if (ip->flags & HAMMER_INODE_FLUSHW) {
2618 			ip->flags &= ~HAMMER_INODE_FLUSHW;
2619 			wakeup(&ip->flags);
2620 		}
2621 
2622 		/*
2623 		 * If the frontend made more changes and requested another
2624 		 * flush, then try to get it running.
2625 		 *
2626 		 * Reflushes are aborted when the inode is errored out.
2627 		 */
2628 		if (ip->flags & HAMMER_INODE_REFLUSH) {
2629 			ip->flags &= ~HAMMER_INODE_REFLUSH;
2630 			if (ip->flags & HAMMER_INODE_RESIGNAL) {
2631 				ip->flags &= ~HAMMER_INODE_RESIGNAL;
2632 				hammer_flush_inode(ip, HAMMER_FLUSH_SIGNAL);
2633 			} else {
2634 				hammer_flush_inode(ip, 0);
2635 			}
2636 		}
2637 	}
2638 
2639 	/*
2640 	 * If we have no parent dependancies we can clear CONN_DOWN
2641 	 */
2642 	if (TAILQ_EMPTY(&ip->target_list))
2643 		ip->flags &= ~HAMMER_INODE_CONN_DOWN;
2644 
2645 	/*
2646 	 * If the inode is now clean drop the space reservation.
2647 	 */
2648 	if ((ip->flags & HAMMER_INODE_MODMASK) == 0 &&
2649 	    (ip->flags & HAMMER_INODE_RSV_INODES)) {
2650 		ip->flags &= ~HAMMER_INODE_RSV_INODES;
2651 		--hmp->rsv_inodes;
2652 	}
2653 
2654 	ip->flags &= ~HAMMER_INODE_SLAVEFLUSH;
2655 
2656 	if (dorel)
2657 		hammer_rel_inode(ip, 0);
2658 }
2659 
2660 /*
2661  * Called from hammer_sync_inode() to synchronize in-memory records
2662  * to the media.
2663  */
2664 static int
2665 hammer_sync_record_callback(hammer_record_t record, void *data)
2666 {
2667 	hammer_cursor_t cursor = data;
2668 	hammer_transaction_t trans = cursor->trans;
2669 	hammer_mount_t hmp = trans->hmp;
2670 	int error;
2671 
2672 	/*
2673 	 * Skip records that do not belong to the current flush.
2674 	 */
2675 	++hammer_stats_record_iterations;
2676 	if (record->flush_state != HAMMER_FST_FLUSH)
2677 		return(0);
2678 
2679 #if 1
2680 	if (record->flush_group != record->ip->flush_group) {
2681 		kprintf("sync_record %p ip %p bad flush group %p %p\n", record, record->ip, record->flush_group ,record->ip->flush_group);
2682 		if (hammer_debug_critical)
2683 			Debugger("blah2");
2684 		return(0);
2685 	}
2686 #endif
2687 	KKASSERT(record->flush_group == record->ip->flush_group);
2688 
2689 	/*
2690 	 * Interlock the record using the BE flag.  Once BE is set the
2691 	 * frontend cannot change the state of FE.
2692 	 *
2693 	 * NOTE: If FE is set prior to us setting BE we still sync the
2694 	 * record out, but the flush completion code converts it to
2695 	 * a delete-on-disk record instead of destroying it.
2696 	 */
2697 	KKASSERT((record->flags & HAMMER_RECF_INTERLOCK_BE) == 0);
2698 	record->flags |= HAMMER_RECF_INTERLOCK_BE;
2699 
2700 	/*
2701 	 * The backend has already disposed of the record.
2702 	 */
2703 	if (record->flags & (HAMMER_RECF_DELETED_BE | HAMMER_RECF_COMMITTED)) {
2704 		error = 0;
2705 		goto done;
2706 	}
2707 
2708 	/*
2709 	 * If the whole inode is being deleted and all on-disk records will
2710 	 * be deleted very soon, we can't sync any new records to disk
2711 	 * because they will be deleted in the same transaction they were
2712 	 * created in (delete_tid == create_tid), which will assert.
2713 	 *
2714 	 * XXX There may be a case with RECORD_ADD with DELETED_FE set
2715 	 * that we currently panic on.
2716 	 */
2717 	if (record->ip->sync_flags & HAMMER_INODE_DELETING) {
2718 		switch(record->type) {
2719 		case HAMMER_MEM_RECORD_DATA:
2720 			/*
2721 			 * We don't have to do anything, if the record was
2722 			 * committed the space will have been accounted for
2723 			 * in the blockmap.
2724 			 */
2725 			/* fall through */
2726 		case HAMMER_MEM_RECORD_GENERAL:
2727 			/*
2728 			 * Set deleted-by-backend flag.  Do not set the
2729 			 * backend committed flag, because we are throwing
2730 			 * the record away.
2731 			 */
2732 			record->flags |= HAMMER_RECF_DELETED_BE;
2733 			++record->ip->rec_generation;
2734 			error = 0;
2735 			goto done;
2736 		case HAMMER_MEM_RECORD_ADD:
2737 			panic("hammer_sync_record_callback: illegal add "
2738 			      "during inode deletion record %p", record);
2739 			break; /* NOT REACHED */
2740 		case HAMMER_MEM_RECORD_INODE:
2741 			panic("hammer_sync_record_callback: attempt to "
2742 			      "sync inode record %p?", record);
2743 			break; /* NOT REACHED */
2744 		case HAMMER_MEM_RECORD_DEL:
2745 			/*
2746 			 * Follow through and issue the on-disk deletion
2747 			 */
2748 			break;
2749 		}
2750 	}
2751 
2752 	/*
2753 	 * If DELETED_FE is set special handling is needed for directory
2754 	 * entries.  Dependant pieces related to the directory entry may
2755 	 * have already been synced to disk.  If this occurs we have to
2756 	 * sync the directory entry and then change the in-memory record
2757 	 * from an ADD to a DELETE to cover the fact that it's been
2758 	 * deleted by the frontend.
2759 	 *
2760 	 * A directory delete covering record (MEM_RECORD_DEL) can never
2761 	 * be deleted by the frontend.
2762 	 *
2763 	 * Any other record type (aka DATA) can be deleted by the frontend.
2764 	 * XXX At the moment the flusher must skip it because there may
2765 	 * be another data record in the flush group for the same block,
2766 	 * meaning that some frontend data changes can leak into the backend's
2767 	 * synchronization point.
2768 	 */
2769 	if (record->flags & HAMMER_RECF_DELETED_FE) {
2770 		if (record->type == HAMMER_MEM_RECORD_ADD) {
2771 			/*
2772 			 * Convert a front-end deleted directory-add to
2773 			 * a directory-delete entry later.
2774 			 */
2775 			record->flags |= HAMMER_RECF_CONVERT_DELETE;
2776 		} else {
2777 			/*
2778 			 * Dispose of the record (race case).  Mark as
2779 			 * deleted by backend (and not committed).
2780 			 */
2781 			KKASSERT(record->type != HAMMER_MEM_RECORD_DEL);
2782 			record->flags |= HAMMER_RECF_DELETED_BE;
2783 			++record->ip->rec_generation;
2784 			error = 0;
2785 			goto done;
2786 		}
2787 	}
2788 
2789 	/*
2790 	 * Assign the create_tid for new records.  Deletions already
2791 	 * have the record's entire key properly set up.
2792 	 */
2793 	if (record->type != HAMMER_MEM_RECORD_DEL) {
2794 		record->leaf.base.create_tid = trans->tid;
2795 		record->leaf.create_ts = trans->time32;
2796 	}
2797 
2798 	/*
2799 	 * This actually moves the record to the on-media B-Tree.  We
2800 	 * must also generate REDO_TERM entries in the UNDO/REDO FIFO
2801 	 * indicating that the related REDO_WRITE(s) have been committed.
2802 	 *
2803 	 * During recovery any REDO_TERM's within the nominal recovery span
2804 	 * are ignored since the related meta-data is being undone, causing
2805 	 * any matching REDO_WRITEs to execute.  The REDO_TERMs outside
2806 	 * the nominal recovery span will match against REDO_WRITEs and
2807 	 * prevent them from being executed (because the meta-data has
2808 	 * already been synchronized).
2809 	 */
2810 	if (record->flags & HAMMER_RECF_REDO) {
2811 		KKASSERT(record->type == HAMMER_MEM_RECORD_DATA);
2812 		hammer_generate_redo(trans, record->ip,
2813 				     record->leaf.base.key -
2814 					 record->leaf.data_len,
2815 				     HAMMER_REDO_TERM_WRITE,
2816 				     NULL,
2817 				     record->leaf.data_len);
2818 	}
2819 
2820 	for (;;) {
2821 		error = hammer_ip_sync_record_cursor(cursor, record);
2822 		if (error != EDEADLK)
2823 			break;
2824 		hammer_done_cursor(cursor);
2825 		error = hammer_init_cursor(trans, cursor, &record->ip->cache[0],
2826 					   record->ip);
2827 		if (error)
2828 			break;
2829 	}
2830 	record->flags &= ~HAMMER_RECF_CONVERT_DELETE;
2831 
2832 	if (error)
2833 		error = -error;
2834 done:
2835 	hammer_flush_record_done(record, error);
2836 
2837 	/*
2838 	 * Do partial finalization if we have built up too many dirty
2839 	 * buffers.  Otherwise a buffer cache deadlock can occur when
2840 	 * doing things like creating tens of thousands of tiny files.
2841 	 *
2842 	 * We must release our cursor lock to avoid a 3-way deadlock
2843 	 * due to the exclusive sync lock the finalizer must get.
2844 	 *
2845 	 * WARNING: See warnings in hammer_unlock_cursor() function.
2846 	 */
2847         if (hammer_flusher_meta_limit(hmp) ||
2848 	    vm_page_count_severe()) {
2849 		hammer_unlock_cursor(cursor);
2850                 hammer_flusher_finalize(trans, 0);
2851 		hammer_lock_cursor(cursor);
2852 	}
2853 	return(error);
2854 }
2855 
2856 /*
2857  * Backend function called by the flusher to sync an inode to media.
2858  */
2859 int
2860 hammer_sync_inode(hammer_transaction_t trans, hammer_inode_t ip)
2861 {
2862 	struct hammer_cursor cursor;
2863 	hammer_node_t tmp_node;
2864 	hammer_record_t depend;
2865 	hammer_record_t next;
2866 	int error, tmp_error;
2867 	u_int64_t nlinks;
2868 
2869 	if ((ip->sync_flags & HAMMER_INODE_MODMASK) == 0)
2870 		return(0);
2871 
2872 	error = hammer_init_cursor(trans, &cursor, &ip->cache[1], ip);
2873 	if (error)
2874 		goto done;
2875 
2876 	/*
2877 	 * Any directory records referencing this inode which are not in
2878 	 * our current flush group must adjust our nlink count for the
2879 	 * purposes of synchronizating to disk.
2880 	 *
2881 	 * Records which are in our flush group can be unlinked from our
2882 	 * inode now, potentially allowing the inode to be physically
2883 	 * deleted.
2884 	 *
2885 	 * This cannot block.
2886 	 */
2887 	nlinks = ip->ino_data.nlinks;
2888 	next = TAILQ_FIRST(&ip->target_list);
2889 	while ((depend = next) != NULL) {
2890 		next = TAILQ_NEXT(depend, target_entry);
2891 		if (depend->flush_state == HAMMER_FST_FLUSH &&
2892 		    depend->flush_group == ip->flush_group) {
2893 			/*
2894 			 * If this is an ADD that was deleted by the frontend
2895 			 * the frontend nlinks count will have already been
2896 			 * decremented, but the backend is going to sync its
2897 			 * directory entry and must account for it.  The
2898 			 * record will be converted to a delete-on-disk when
2899 			 * it gets synced.
2900 			 *
2901 			 * If the ADD was not deleted by the frontend we
2902 			 * can remove the dependancy from our target_list.
2903 			 */
2904 			if (depend->flags & HAMMER_RECF_DELETED_FE) {
2905 				++nlinks;
2906 			} else {
2907 				TAILQ_REMOVE(&ip->target_list, depend,
2908 					     target_entry);
2909 				depend->target_ip = NULL;
2910 			}
2911 		} else if ((depend->flags & HAMMER_RECF_DELETED_FE) == 0) {
2912 			/*
2913 			 * Not part of our flush group and not deleted by
2914 			 * the front-end, adjust the link count synced to
2915 			 * the media (undo what the frontend did when it
2916 			 * queued the record).
2917 			 */
2918 			KKASSERT((depend->flags & HAMMER_RECF_DELETED_BE) == 0);
2919 			switch(depend->type) {
2920 			case HAMMER_MEM_RECORD_ADD:
2921 				--nlinks;
2922 				break;
2923 			case HAMMER_MEM_RECORD_DEL:
2924 				++nlinks;
2925 				break;
2926 			default:
2927 				break;
2928 			}
2929 		}
2930 	}
2931 
2932 	/*
2933 	 * Set dirty if we had to modify the link count.
2934 	 */
2935 	if (ip->sync_ino_data.nlinks != nlinks) {
2936 		KKASSERT((int64_t)nlinks >= 0);
2937 		ip->sync_ino_data.nlinks = nlinks;
2938 		ip->sync_flags |= HAMMER_INODE_DDIRTY;
2939 	}
2940 
2941 	/*
2942 	 * If there is a trunction queued destroy any data past the (aligned)
2943 	 * truncation point.  Userland will have dealt with the buffer
2944 	 * containing the truncation point for us.
2945 	 *
2946 	 * We don't flush pending frontend data buffers until after we've
2947 	 * dealt with the truncation.
2948 	 */
2949 	if (ip->sync_flags & HAMMER_INODE_TRUNCATED) {
2950 		/*
2951 		 * Interlock trunc_off.  The VOP front-end may continue to
2952 		 * make adjustments to it while we are blocked.
2953 		 */
2954 		off_t trunc_off;
2955 		off_t aligned_trunc_off;
2956 		int blkmask;
2957 
2958 		trunc_off = ip->sync_trunc_off;
2959 		blkmask = hammer_blocksize(trunc_off) - 1;
2960 		aligned_trunc_off = (trunc_off + blkmask) & ~(int64_t)blkmask;
2961 
2962 		/*
2963 		 * Delete any whole blocks on-media.  The front-end has
2964 		 * already cleaned out any partial block and made it
2965 		 * pending.  The front-end may have updated trunc_off
2966 		 * while we were blocked so we only use sync_trunc_off.
2967 		 *
2968 		 * This operation can blow out the buffer cache, EWOULDBLOCK
2969 		 * means we were unable to complete the deletion.  The
2970 		 * deletion will update sync_trunc_off in that case.
2971 		 */
2972 		error = hammer_ip_delete_range(&cursor, ip,
2973 						aligned_trunc_off,
2974 						0x7FFFFFFFFFFFFFFFLL, 2);
2975 		if (error == EWOULDBLOCK) {
2976 			ip->flags |= HAMMER_INODE_WOULDBLOCK;
2977 			error = 0;
2978 			goto defer_buffer_flush;
2979 		}
2980 
2981 		if (error)
2982 			goto done;
2983 
2984 		/*
2985 		 * Generate a REDO_TERM_TRUNC entry in the UNDO/REDO FIFO.
2986 		 *
2987 		 * XXX we do this even if we did not previously generate
2988 		 * a REDO_TRUNC record.  This operation may enclosed the
2989 		 * range for multiple prior truncation entries in the REDO
2990 		 * log.
2991 		 */
2992 		if (trans->hmp->version >= HAMMER_VOL_VERSION_FOUR &&
2993 		    (ip->flags & HAMMER_INODE_RDIRTY)) {
2994 			hammer_generate_redo(trans, ip, aligned_trunc_off,
2995 					     HAMMER_REDO_TERM_TRUNC,
2996 					     NULL, 0);
2997 		}
2998 
2999 		/*
3000 		 * Clear the truncation flag on the backend after we have
3001 		 * completed the deletions.  Backend data is now good again
3002 		 * (including new records we are about to sync, below).
3003 		 *
3004 		 * Leave sync_trunc_off intact.  As we write additional
3005 		 * records the backend will update sync_trunc_off.  This
3006 		 * tells the backend whether it can skip the overwrite
3007 		 * test.  This should work properly even when the backend
3008 		 * writes full blocks where the truncation point straddles
3009 		 * the block because the comparison is against the base
3010 		 * offset of the record.
3011 		 */
3012 		ip->sync_flags &= ~HAMMER_INODE_TRUNCATED;
3013 		/* ip->sync_trunc_off = 0x7FFFFFFFFFFFFFFFLL; */
3014 	} else {
3015 		error = 0;
3016 	}
3017 
3018 	/*
3019 	 * Now sync related records.  These will typically be directory
3020 	 * entries, records tracking direct-writes, or delete-on-disk records.
3021 	 */
3022 	if (error == 0) {
3023 		tmp_error = RB_SCAN(hammer_rec_rb_tree, &ip->rec_tree, NULL,
3024 				    hammer_sync_record_callback, &cursor);
3025 		if (tmp_error < 0)
3026 			tmp_error = -error;
3027 		if (tmp_error)
3028 			error = tmp_error;
3029 	}
3030 	hammer_cache_node(&ip->cache[1], cursor.node);
3031 
3032 	/*
3033 	 * Re-seek for inode update, assuming our cache hasn't been ripped
3034 	 * out from under us.
3035 	 */
3036 	if (error == 0) {
3037 		tmp_node = hammer_ref_node_safe(trans, &ip->cache[0], &error);
3038 		if (tmp_node) {
3039 			hammer_cursor_downgrade(&cursor);
3040 			hammer_lock_sh(&tmp_node->lock);
3041 			if ((tmp_node->flags & HAMMER_NODE_DELETED) == 0)
3042 				hammer_cursor_seek(&cursor, tmp_node, 0);
3043 			hammer_unlock(&tmp_node->lock);
3044 			hammer_rel_node(tmp_node);
3045 		}
3046 		error = 0;
3047 	}
3048 
3049 	/*
3050 	 * If we are deleting the inode the frontend had better not have
3051 	 * any active references on elements making up the inode.
3052 	 *
3053 	 * The call to hammer_ip_delete_clean() cleans up auxillary records
3054 	 * but not DB or DATA records.  Those must have already been deleted
3055 	 * by the normal truncation mechanic.
3056 	 */
3057 	if (error == 0 && ip->sync_ino_data.nlinks == 0 &&
3058 		RB_EMPTY(&ip->rec_tree)  &&
3059 	    (ip->sync_flags & HAMMER_INODE_DELETING) &&
3060 	    (ip->flags & HAMMER_INODE_DELETED) == 0) {
3061 		int count1 = 0;
3062 
3063 		error = hammer_ip_delete_clean(&cursor, ip, &count1);
3064 		if (error == 0) {
3065 			ip->flags |= HAMMER_INODE_DELETED;
3066 			ip->sync_flags &= ~HAMMER_INODE_DELETING;
3067 			ip->sync_flags &= ~HAMMER_INODE_TRUNCATED;
3068 			KKASSERT(RB_EMPTY(&ip->rec_tree));
3069 
3070 			/*
3071 			 * Set delete_tid in both the frontend and backend
3072 			 * copy of the inode record.  The DELETED flag handles
3073 			 * this, do not set DDIRTY.
3074 			 */
3075 			ip->ino_leaf.base.delete_tid = trans->tid;
3076 			ip->sync_ino_leaf.base.delete_tid = trans->tid;
3077 			ip->ino_leaf.delete_ts = trans->time32;
3078 			ip->sync_ino_leaf.delete_ts = trans->time32;
3079 
3080 
3081 			/*
3082 			 * Adjust the inode count in the volume header
3083 			 */
3084 			hammer_sync_lock_sh(trans);
3085 			if (ip->flags & HAMMER_INODE_ONDISK) {
3086 				hammer_modify_volume_field(trans,
3087 							   trans->rootvol,
3088 							   vol0_stat_inodes);
3089 				--ip->hmp->rootvol->ondisk->vol0_stat_inodes;
3090 				hammer_modify_volume_done(trans->rootvol);
3091 			}
3092 			hammer_sync_unlock(trans);
3093 		}
3094 	}
3095 
3096 	if (error)
3097 		goto done;
3098 	ip->sync_flags &= ~HAMMER_INODE_BUFS;
3099 
3100 defer_buffer_flush:
3101 	/*
3102 	 * Now update the inode's on-disk inode-data and/or on-disk record.
3103 	 * DELETED and ONDISK are managed only in ip->flags.
3104 	 *
3105 	 * In the case of a defered buffer flush we still update the on-disk
3106 	 * inode to satisfy visibility requirements if there happen to be
3107 	 * directory dependancies.
3108 	 */
3109 	switch(ip->flags & (HAMMER_INODE_DELETED | HAMMER_INODE_ONDISK)) {
3110 	case HAMMER_INODE_DELETED|HAMMER_INODE_ONDISK:
3111 		/*
3112 		 * If deleted and on-disk, don't set any additional flags.
3113 		 * the delete flag takes care of things.
3114 		 *
3115 		 * Clear flags which may have been set by the frontend.
3116 		 */
3117 		ip->sync_flags &= ~(HAMMER_INODE_DDIRTY | HAMMER_INODE_XDIRTY |
3118 				    HAMMER_INODE_SDIRTY |
3119 				    HAMMER_INODE_ATIME | HAMMER_INODE_MTIME |
3120 				    HAMMER_INODE_DELETING);
3121 		break;
3122 	case HAMMER_INODE_DELETED:
3123 		/*
3124 		 * Take care of the case where a deleted inode was never
3125 		 * flushed to the disk in the first place.
3126 		 *
3127 		 * Clear flags which may have been set by the frontend.
3128 		 */
3129 		ip->sync_flags &= ~(HAMMER_INODE_DDIRTY | HAMMER_INODE_XDIRTY |
3130 				    HAMMER_INODE_SDIRTY |
3131 				    HAMMER_INODE_ATIME | HAMMER_INODE_MTIME |
3132 				    HAMMER_INODE_DELETING);
3133 		while (RB_ROOT(&ip->rec_tree)) {
3134 			hammer_record_t record = RB_ROOT(&ip->rec_tree);
3135 			hammer_ref(&record->lock);
3136 			KKASSERT(hammer_oneref(&record->lock));
3137 			record->flags |= HAMMER_RECF_DELETED_BE;
3138 			++record->ip->rec_generation;
3139 			hammer_rel_mem_record(record);
3140 		}
3141 		break;
3142 	case HAMMER_INODE_ONDISK:
3143 		/*
3144 		 * If already on-disk, do not set any additional flags.
3145 		 */
3146 		break;
3147 	default:
3148 		/*
3149 		 * If not on-disk and not deleted, set DDIRTY to force
3150 		 * an initial record to be written.
3151 		 *
3152 		 * Also set the create_tid in both the frontend and backend
3153 		 * copy of the inode record.
3154 		 */
3155 		ip->ino_leaf.base.create_tid = trans->tid;
3156 		ip->ino_leaf.create_ts = trans->time32;
3157 		ip->sync_ino_leaf.base.create_tid = trans->tid;
3158 		ip->sync_ino_leaf.create_ts = trans->time32;
3159 		ip->sync_flags |= HAMMER_INODE_DDIRTY;
3160 		break;
3161 	}
3162 
3163 	/*
3164 	 * If DDIRTY or SDIRTY is set, write out a new record.
3165 	 * If the inode is already on-disk the old record is marked as
3166 	 * deleted.
3167 	 *
3168 	 * If DELETED is set hammer_update_inode() will delete the existing
3169 	 * record without writing out a new one.
3170 	 *
3171 	 * If *ONLY* the ITIMES flag is set we can update the record in-place.
3172 	 */
3173 	if (ip->flags & HAMMER_INODE_DELETED) {
3174 		error = hammer_update_inode(&cursor, ip);
3175 	} else
3176 	if (!(ip->sync_flags & (HAMMER_INODE_DDIRTY | HAMMER_INODE_SDIRTY)) &&
3177 	    (ip->sync_flags & (HAMMER_INODE_ATIME | HAMMER_INODE_MTIME))) {
3178 		error = hammer_update_itimes(&cursor, ip);
3179 	} else
3180 	if (ip->sync_flags & (HAMMER_INODE_DDIRTY | HAMMER_INODE_SDIRTY |
3181 			      HAMMER_INODE_ATIME | HAMMER_INODE_MTIME)) {
3182 		error = hammer_update_inode(&cursor, ip);
3183 	}
3184 done:
3185 	if (ip->flags & HAMMER_INODE_MODMASK)
3186 		hammer_inode_dirty(ip);
3187 	if (error) {
3188 		hammer_critical_error(ip->hmp, ip, error,
3189 				      "while syncing inode");
3190 	}
3191 	hammer_done_cursor(&cursor);
3192 	return(error);
3193 }
3194 
3195 /*
3196  * This routine is called when the OS is no longer actively referencing
3197  * the inode (but might still be keeping it cached), or when releasing
3198  * the last reference to an inode.
3199  *
3200  * At this point if the inode's nlinks count is zero we want to destroy
3201  * it, which may mean destroying it on-media too.
3202  */
3203 void
3204 hammer_inode_unloadable_check(hammer_inode_t ip, int getvp)
3205 {
3206 	struct vnode *vp;
3207 
3208 	/*
3209 	 * Set the DELETING flag when the link count drops to 0 and the
3210 	 * OS no longer has any opens on the inode.
3211 	 *
3212 	 * The backend will clear DELETING (a mod flag) and set DELETED
3213 	 * (a state flag) when it is actually able to perform the
3214 	 * operation.
3215 	 *
3216 	 * Don't reflag the deletion if the flusher is currently syncing
3217 	 * one that was already flagged.  A previously set DELETING flag
3218 	 * may bounce around flags and sync_flags until the operation is
3219 	 * completely done.
3220 	 *
3221 	 * Do not attempt to modify a snapshot inode (one set to read-only).
3222 	 */
3223 	if (ip->ino_data.nlinks == 0 &&
3224 	    ((ip->flags | ip->sync_flags) & (HAMMER_INODE_RO|HAMMER_INODE_DELETING|HAMMER_INODE_DELETED)) == 0) {
3225 		ip->flags |= HAMMER_INODE_DELETING;
3226 		ip->flags |= HAMMER_INODE_TRUNCATED;
3227 		ip->trunc_off = 0;
3228 		vp = NULL;
3229 		if (getvp) {
3230 			if (hammer_get_vnode(ip, &vp) != 0)
3231 				return;
3232 		}
3233 
3234 		/*
3235 		 * Final cleanup
3236 		 */
3237 		if (ip->vp)
3238 			nvtruncbuf(ip->vp, 0, HAMMER_BUFSIZE, 0, 0);
3239 		if (ip->flags & HAMMER_INODE_MODMASK)
3240 			hammer_inode_dirty(ip);
3241 		if (getvp)
3242 			vput(vp);
3243 	}
3244 }
3245 
3246 /*
3247  * After potentially resolving a dependancy the inode is tested
3248  * to determine whether it needs to be reflushed.
3249  */
3250 void
3251 hammer_test_inode(hammer_inode_t ip)
3252 {
3253 	if (ip->flags & HAMMER_INODE_REFLUSH) {
3254 		ip->flags &= ~HAMMER_INODE_REFLUSH;
3255 		hammer_ref(&ip->lock);
3256 		if (ip->flags & HAMMER_INODE_RESIGNAL) {
3257 			ip->flags &= ~HAMMER_INODE_RESIGNAL;
3258 			hammer_flush_inode(ip, HAMMER_FLUSH_SIGNAL);
3259 		} else {
3260 			hammer_flush_inode(ip, 0);
3261 		}
3262 		hammer_rel_inode(ip, 0);
3263 	}
3264 }
3265 
3266 /*
3267  * Clear the RECLAIM flag on an inode.  This occurs when the inode is
3268  * reassociated with a vp or just before it gets freed.
3269  *
3270  * Pipeline wakeups to threads blocked due to an excessive number of
3271  * detached inodes.  This typically occurs when atime updates accumulate
3272  * while scanning a directory tree.
3273  */
3274 static void
3275 hammer_inode_wakereclaims(hammer_inode_t ip)
3276 {
3277 	struct hammer_reclaim *reclaim;
3278 	hammer_mount_t hmp = ip->hmp;
3279 
3280 	if ((ip->flags & HAMMER_INODE_RECLAIM) == 0)
3281 		return;
3282 
3283 	--hammer_count_reclaims;
3284 	--hmp->count_reclaims;
3285 	ip->flags &= ~HAMMER_INODE_RECLAIM;
3286 
3287 	if ((reclaim = TAILQ_FIRST(&hmp->reclaim_list)) != NULL) {
3288 		KKASSERT(reclaim->count > 0);
3289 		if (--reclaim->count == 0) {
3290 			TAILQ_REMOVE(&hmp->reclaim_list, reclaim, entry);
3291 			wakeup(reclaim);
3292 		}
3293 	}
3294 }
3295 
3296 /*
3297  * Setup our reclaim pipeline.  We only let so many detached (and dirty)
3298  * inodes build up before we start blocking.  This routine is called
3299  * if a new inode is created or an inode is loaded from media.
3300  *
3301  * When we block we don't care *which* inode has finished reclaiming,
3302  * as long as one does.
3303  *
3304  * The reclaim pipeline is primarily governed by the auto-flush which is
3305  * 1/4 hammer_limit_reclaims.  We don't want to block if the count is
3306  * less than 1/2 hammer_limit_reclaims.  From 1/2 to full count is
3307  * dynamically governed.
3308  */
3309 void
3310 hammer_inode_waitreclaims(hammer_transaction_t trans)
3311 {
3312 	hammer_mount_t hmp = trans->hmp;
3313 	struct hammer_reclaim reclaim;
3314 	int lower_limit;
3315 
3316 	/*
3317 	 * Track inode load, delay if the number of reclaiming inodes is
3318 	 * between 2/4 and 4/4 hammer_limit_reclaims, depending.
3319 	 */
3320 	if (curthread->td_proc) {
3321 		struct hammer_inostats *stats;
3322 
3323 		stats = hammer_inode_inostats(hmp, curthread->td_proc->p_pid);
3324 		++stats->count;
3325 
3326 		if (stats->count > hammer_limit_reclaims / 2)
3327 			stats->count = hammer_limit_reclaims / 2;
3328 		lower_limit = hammer_limit_reclaims - stats->count;
3329 		if (hammer_debug_general & 0x10000) {
3330 			kprintf("pid %5d limit %d\n",
3331 				(int)curthread->td_proc->p_pid, lower_limit);
3332 		}
3333 	} else {
3334 		lower_limit = hammer_limit_reclaims * 3 / 4;
3335 	}
3336 	if (hmp->count_reclaims >= lower_limit) {
3337 		reclaim.count = 1;
3338 		TAILQ_INSERT_TAIL(&hmp->reclaim_list, &reclaim, entry);
3339 		tsleep(&reclaim, 0, "hmrrcm", hz);
3340 		if (reclaim.count > 0)
3341 			TAILQ_REMOVE(&hmp->reclaim_list, &reclaim, entry);
3342 	}
3343 }
3344 
3345 /*
3346  * Keep track of reclaim statistics on a per-pid basis using a loose
3347  * 4-way set associative hash table.  Collisions inherit the count of
3348  * the previous entry.
3349  *
3350  * NOTE: We want to be careful here to limit the chain size.  If the chain
3351  *	 size is too large a pid will spread its stats out over too many
3352  *	 entries under certain types of heavy filesystem activity and
3353  *	 wind up not delaying long enough.
3354  */
3355 static
3356 struct hammer_inostats *
3357 hammer_inode_inostats(hammer_mount_t hmp, pid_t pid)
3358 {
3359 	struct hammer_inostats *stats;
3360 	int delta;
3361 	int chain;
3362 	static volatile int iterator;	/* we don't care about MP races */
3363 
3364 	/*
3365 	 * Chain up to 4 times to find our entry.
3366 	 */
3367 	for (chain = 0; chain < 4; ++chain) {
3368 		stats = &hmp->inostats[(pid + chain) & HAMMER_INOSTATS_HMASK];
3369 		if (stats->pid == pid)
3370 			break;
3371 	}
3372 
3373 	/*
3374 	 * Replace one of the four chaining entries with our new entry.
3375 	 */
3376 	if (chain == 4) {
3377 		stats = &hmp->inostats[(pid + (iterator++ & 3)) &
3378 				       HAMMER_INOSTATS_HMASK];
3379 		stats->pid = pid;
3380 	}
3381 
3382 	/*
3383 	 * Decay the entry
3384 	 */
3385 	if (stats->count && stats->ltick != ticks) {
3386 		delta = ticks - stats->ltick;
3387 		stats->ltick = ticks;
3388 		if (delta <= 0 || delta > hz * 60)
3389 			stats->count = 0;
3390 		else
3391 			stats->count = stats->count * hz / (hz + delta);
3392 	}
3393 	if (hammer_debug_general & 0x10000)
3394 		kprintf("pid %5d stats %d\n", (int)pid, stats->count);
3395 	return (stats);
3396 }
3397 
3398 #if 0
3399 
3400 /*
3401  * XXX not used, doesn't work very well due to the large batching nature
3402  * of flushes.
3403  *
3404  * A larger then normal backlog of inodes is sitting in the flusher,
3405  * enforce a general slowdown to let it catch up.  This routine is only
3406  * called on completion of a non-flusher-related transaction which
3407  * performed B-Tree node I/O.
3408  *
3409  * It is possible for the flusher to stall in a continuous load.
3410  * blogbench -i1000 -o seems to do a good job generating this sort of load.
3411  * If the flusher is unable to catch up the inode count can bloat until
3412  * we run out of kvm.
3413  *
3414  * This is a bit of a hack.
3415  */
3416 void
3417 hammer_inode_waithard(hammer_mount_t hmp)
3418 {
3419 	/*
3420 	 * Hysteresis.
3421 	 */
3422 	if (hmp->flags & HAMMER_MOUNT_FLUSH_RECOVERY) {
3423 		if (hmp->count_reclaims < hammer_limit_reclaims / 2 &&
3424 		    hmp->count_iqueued < hmp->count_inodes / 20) {
3425 			hmp->flags &= ~HAMMER_MOUNT_FLUSH_RECOVERY;
3426 			return;
3427 		}
3428 	} else {
3429 		if (hmp->count_reclaims < hammer_limit_reclaims ||
3430 		    hmp->count_iqueued < hmp->count_inodes / 10) {
3431 			return;
3432 		}
3433 		hmp->flags |= HAMMER_MOUNT_FLUSH_RECOVERY;
3434 	}
3435 
3436 	/*
3437 	 * Block for one flush cycle.
3438 	 */
3439 	hammer_flusher_wait_next(hmp);
3440 }
3441 
3442 #endif
3443