xref: /dragonfly/sys/vfs/hammer2/hammer2_vfsops.c (revision 6e316fcd)
1 /*
2  * Copyright (c) 2011-2018 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Matthew Dillon <dillon@backplane.com>
6  * by Daniel Flores (GSOC 2013 - mentored by Matthew Dillon, compression)
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the
17  *    distribution.
18  * 3. Neither the name of The DragonFly Project nor the names of its
19  *    contributors may be used to endorse or promote products derived
20  *    from this software without specific, prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
25  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
26  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
28  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
29  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
30  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
31  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
32  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/kernel.h>
38 #include <sys/nlookup.h>
39 #include <sys/vnode.h>
40 #include <sys/mount.h>
41 #include <sys/fcntl.h>
42 #include <sys/buf.h>
43 #include <sys/uuid.h>
44 #include <sys/vfsops.h>
45 #include <sys/sysctl.h>
46 #include <sys/socket.h>
47 #include <sys/objcache.h>
48 
49 #include <sys/proc.h>
50 #include <sys/namei.h>
51 #include <sys/mountctl.h>
52 #include <sys/dirent.h>
53 #include <sys/uio.h>
54 
55 #include <sys/mutex.h>
56 #include <sys/mutex2.h>
57 
58 #include "hammer2.h"
59 #include "hammer2_disk.h"
60 #include "hammer2_mount.h"
61 #include "hammer2_lz4.h"
62 
63 #include "zlib/hammer2_zlib.h"
64 
65 #define REPORT_REFS_ERRORS 1	/* XXX remove me */
66 
67 MALLOC_DEFINE(M_OBJCACHE, "objcache", "Object Cache");
68 
69 struct hammer2_sync_info {
70 	int error;
71 	int waitfor;
72 	int pass;
73 };
74 
75 TAILQ_HEAD(hammer2_mntlist, hammer2_dev);
76 static struct hammer2_mntlist hammer2_mntlist;
77 
78 struct hammer2_pfslist hammer2_pfslist;
79 struct hammer2_pfslist hammer2_spmplist;
80 struct lock hammer2_mntlk;
81 
82 int hammer2_supported_version = HAMMER2_VOL_VERSION_DEFAULT;
83 int hammer2_debug;
84 long hammer2_debug_inode;
85 int hammer2_cluster_meta_read = 1;	/* physical read-ahead */
86 int hammer2_cluster_data_read = 4;	/* physical read-ahead */
87 int hammer2_cluster_write = 0;		/* physical write clustering */
88 int hammer2_dedup_enable = 1;
89 int hammer2_always_compress = 0;	/* always try to compress */
90 int hammer2_inval_enable = 0;
91 int hammer2_flush_pipe = 100;
92 int hammer2_dio_count;
93 int hammer2_dio_limit = 256;
94 int hammer2_bulkfree_tps = 5000;
95 int hammer2_worker_rmask = 3;
96 long hammer2_chain_allocs;
97 long hammer2_chain_frees;
98 long hammer2_limit_dirty_chains;
99 long hammer2_limit_dirty_inodes;
100 long hammer2_count_modified_chains;
101 long hammer2_iod_invals;
102 long hammer2_iod_file_read;
103 long hammer2_iod_meta_read;
104 long hammer2_iod_indr_read;
105 long hammer2_iod_fmap_read;
106 long hammer2_iod_volu_read;
107 long hammer2_iod_file_write;
108 long hammer2_iod_file_wembed;
109 long hammer2_iod_file_wzero;
110 long hammer2_iod_file_wdedup;
111 long hammer2_iod_meta_write;
112 long hammer2_iod_indr_write;
113 long hammer2_iod_fmap_write;
114 long hammer2_iod_volu_write;
115 long hammer2_iod_inode_creates;
116 long hammer2_iod_inode_deletes;
117 
118 MALLOC_DECLARE(M_HAMMER2_CBUFFER);
119 MALLOC_DEFINE(M_HAMMER2_CBUFFER, "HAMMER2-compbuffer",
120 		"Buffer used for compression.");
121 
122 MALLOC_DECLARE(M_HAMMER2_DEBUFFER);
123 MALLOC_DEFINE(M_HAMMER2_DEBUFFER, "HAMMER2-decompbuffer",
124 		"Buffer used for decompression.");
125 
126 SYSCTL_NODE(_vfs, OID_AUTO, hammer2, CTLFLAG_RW, 0, "HAMMER2 filesystem");
127 
128 SYSCTL_INT(_vfs_hammer2, OID_AUTO, supported_version, CTLFLAG_RD,
129 	   &hammer2_supported_version, 0, "");
130 SYSCTL_INT(_vfs_hammer2, OID_AUTO, debug, CTLFLAG_RW,
131 	   &hammer2_debug, 0, "");
132 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, debug_inode, CTLFLAG_RW,
133 	   &hammer2_debug_inode, 0, "");
134 SYSCTL_INT(_vfs_hammer2, OID_AUTO, cluster_meta_read, CTLFLAG_RW,
135 	   &hammer2_cluster_meta_read, 0, "");
136 SYSCTL_INT(_vfs_hammer2, OID_AUTO, cluster_data_read, CTLFLAG_RW,
137 	   &hammer2_cluster_data_read, 0, "");
138 SYSCTL_INT(_vfs_hammer2, OID_AUTO, cluster_write, CTLFLAG_RW,
139 	   &hammer2_cluster_write, 0, "");
140 SYSCTL_INT(_vfs_hammer2, OID_AUTO, dedup_enable, CTLFLAG_RW,
141 	   &hammer2_dedup_enable, 0, "");
142 SYSCTL_INT(_vfs_hammer2, OID_AUTO, always_compress, CTLFLAG_RW,
143 	   &hammer2_always_compress, 0, "");
144 SYSCTL_INT(_vfs_hammer2, OID_AUTO, inval_enable, CTLFLAG_RW,
145 	   &hammer2_inval_enable, 0, "");
146 SYSCTL_INT(_vfs_hammer2, OID_AUTO, flush_pipe, CTLFLAG_RW,
147 	   &hammer2_flush_pipe, 0, "");
148 SYSCTL_INT(_vfs_hammer2, OID_AUTO, worker_rmask, CTLFLAG_RW,
149 	   &hammer2_worker_rmask, 0, "");
150 SYSCTL_INT(_vfs_hammer2, OID_AUTO, bulkfree_tps, CTLFLAG_RW,
151 	   &hammer2_bulkfree_tps, 0, "");
152 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, chain_allocs, CTLFLAG_RW,
153 	   &hammer2_chain_allocs, 0, "");
154 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, chain_frees, CTLFLAG_RW,
155 	   &hammer2_chain_frees, 0, "");
156 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, limit_dirty_chains, CTLFLAG_RW,
157 	   &hammer2_limit_dirty_chains, 0, "");
158 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, limit_dirty_inodes, CTLFLAG_RW,
159 	   &hammer2_limit_dirty_inodes, 0, "");
160 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, count_modified_chains, CTLFLAG_RW,
161 	   &hammer2_count_modified_chains, 0, "");
162 SYSCTL_INT(_vfs_hammer2, OID_AUTO, dio_count, CTLFLAG_RD,
163 	   &hammer2_dio_count, 0, "");
164 SYSCTL_INT(_vfs_hammer2, OID_AUTO, dio_limit, CTLFLAG_RW,
165 	   &hammer2_dio_limit, 0, "");
166 
167 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_invals, CTLFLAG_RW,
168 	   &hammer2_iod_invals, 0, "");
169 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_file_read, CTLFLAG_RW,
170 	   &hammer2_iod_file_read, 0, "");
171 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_meta_read, CTLFLAG_RW,
172 	   &hammer2_iod_meta_read, 0, "");
173 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_indr_read, CTLFLAG_RW,
174 	   &hammer2_iod_indr_read, 0, "");
175 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_fmap_read, CTLFLAG_RW,
176 	   &hammer2_iod_fmap_read, 0, "");
177 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_volu_read, CTLFLAG_RW,
178 	   &hammer2_iod_volu_read, 0, "");
179 
180 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_file_write, CTLFLAG_RW,
181 	   &hammer2_iod_file_write, 0, "");
182 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_file_wembed, CTLFLAG_RW,
183 	   &hammer2_iod_file_wembed, 0, "");
184 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_file_wzero, CTLFLAG_RW,
185 	   &hammer2_iod_file_wzero, 0, "");
186 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_file_wdedup, CTLFLAG_RW,
187 	   &hammer2_iod_file_wdedup, 0, "");
188 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_meta_write, CTLFLAG_RW,
189 	   &hammer2_iod_meta_write, 0, "");
190 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_indr_write, CTLFLAG_RW,
191 	   &hammer2_iod_indr_write, 0, "");
192 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_fmap_write, CTLFLAG_RW,
193 	   &hammer2_iod_fmap_write, 0, "");
194 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_volu_write, CTLFLAG_RW,
195 	   &hammer2_iod_volu_write, 0, "");
196 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_inode_creates, CTLFLAG_RW,
197 	   &hammer2_iod_inode_creates, 0, "");
198 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, iod_inode_deletes, CTLFLAG_RW,
199 	   &hammer2_iod_inode_deletes, 0, "");
200 
201 long hammer2_process_icrc32;
202 long hammer2_process_xxhash64;
203 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, process_icrc32, CTLFLAG_RW,
204 	   &hammer2_process_icrc32, 0, "");
205 SYSCTL_LONG(_vfs_hammer2, OID_AUTO, process_xxhash64, CTLFLAG_RW,
206 	   &hammer2_process_xxhash64, 0, "");
207 
208 static int hammer2_vfs_init(struct vfsconf *conf);
209 static int hammer2_vfs_uninit(struct vfsconf *vfsp);
210 static int hammer2_vfs_mount(struct mount *mp, char *path, caddr_t data,
211 				struct ucred *cred);
212 static int hammer2_remount(hammer2_dev_t *, struct mount *, char *,
213 				struct vnode *, struct ucred *);
214 static int hammer2_recovery(hammer2_dev_t *hmp);
215 static int hammer2_vfs_unmount(struct mount *mp, int mntflags);
216 static int hammer2_vfs_root(struct mount *mp, struct vnode **vpp);
217 static int hammer2_vfs_statfs(struct mount *mp, struct statfs *sbp,
218 				struct ucred *cred);
219 static int hammer2_vfs_statvfs(struct mount *mp, struct statvfs *sbp,
220 				struct ucred *cred);
221 static int hammer2_vfs_fhtovp(struct mount *mp, struct vnode *rootvp,
222 				struct fid *fhp, struct vnode **vpp);
223 static int hammer2_vfs_vptofh(struct vnode *vp, struct fid *fhp);
224 static int hammer2_vfs_checkexp(struct mount *mp, struct sockaddr *nam,
225 				int *exflagsp, struct ucred **credanonp);
226 static void hammer2_vfs_modifying(struct mount *mp);
227 
228 static int hammer2_install_volume_header(hammer2_dev_t *hmp);
229 #if 0
230 static int hammer2_sync_scan2(struct mount *mp, struct vnode *vp, void *data);
231 #endif
232 
233 static void hammer2_update_pmps(hammer2_dev_t *hmp);
234 
235 static void hammer2_mount_helper(struct mount *mp, hammer2_pfs_t *pmp);
236 static void hammer2_unmount_helper(struct mount *mp, hammer2_pfs_t *pmp,
237 				hammer2_dev_t *hmp);
238 static int hammer2_fixup_pfses(hammer2_dev_t *hmp);
239 
240 /*
241  * HAMMER2 vfs operations.
242  */
243 static struct vfsops hammer2_vfsops = {
244 	.vfs_init	= hammer2_vfs_init,
245 	.vfs_uninit	= hammer2_vfs_uninit,
246 	.vfs_sync	= hammer2_vfs_sync,
247 	.vfs_mount	= hammer2_vfs_mount,
248 	.vfs_unmount	= hammer2_vfs_unmount,
249 	.vfs_root 	= hammer2_vfs_root,
250 	.vfs_statfs	= hammer2_vfs_statfs,
251 	.vfs_statvfs	= hammer2_vfs_statvfs,
252 	.vfs_vget	= hammer2_vfs_vget,
253 	.vfs_vptofh	= hammer2_vfs_vptofh,
254 	.vfs_fhtovp	= hammer2_vfs_fhtovp,
255 	.vfs_checkexp	= hammer2_vfs_checkexp,
256 	.vfs_modifying	= hammer2_vfs_modifying
257 };
258 
259 MALLOC_DEFINE(M_HAMMER2, "HAMMER2-mount", "");
260 
261 VFS_SET(hammer2_vfsops, hammer2, VFCF_MPSAFE);
262 MODULE_VERSION(hammer2, 1);
263 
264 static
265 int
266 hammer2_vfs_init(struct vfsconf *conf)
267 {
268 	static struct objcache_malloc_args margs_read;
269 	static struct objcache_malloc_args margs_write;
270 	static struct objcache_malloc_args margs_vop;
271 
272 	int error;
273 
274 	error = 0;
275 	kmalloc_raise_limit(M_HAMMER2, 0);	/* unlimited */
276 
277 	/*
278 	 * A large DIO cache is needed to retain dedup enablement masks.
279 	 * The bulkfree code clears related masks as part of the disk block
280 	 * recycling algorithm, preventing it from being used for a later
281 	 * dedup.
282 	 *
283 	 * NOTE: A large buffer cache can actually interfere with dedup
284 	 *	 operation because we dedup based on media physical buffers
285 	 *	 and not logical buffers.  Try to make the DIO case large
286 	 *	 enough to avoid this problem, but also cap it.
287 	 */
288 	hammer2_dio_limit = nbuf * 2;
289 	if (hammer2_dio_limit > 100000)
290 		hammer2_dio_limit = 100000;
291 
292 	if (HAMMER2_BLOCKREF_BYTES != sizeof(struct hammer2_blockref))
293 		error = EINVAL;
294 	if (HAMMER2_INODE_BYTES != sizeof(struct hammer2_inode_data))
295 		error = EINVAL;
296 	if (HAMMER2_VOLUME_BYTES != sizeof(struct hammer2_volume_data))
297 		error = EINVAL;
298 
299 	if (error)
300 		kprintf("HAMMER2 structure size mismatch; cannot continue.\n");
301 
302 	margs_read.objsize = 65536;
303 	margs_read.mtype = M_HAMMER2_DEBUFFER;
304 
305 	margs_write.objsize = 32768;
306 	margs_write.mtype = M_HAMMER2_CBUFFER;
307 
308 	margs_vop.objsize = sizeof(hammer2_xop_t);
309 	margs_vop.mtype = M_HAMMER2;
310 
311 	/*
312 	 * Note thaht for the XOPS cache we want backing store allocations
313 	 * to use M_ZERO.  This is not allowed in objcache_get() (to avoid
314 	 * confusion), so use the backing store function that does it.  This
315 	 * means that initial XOPS objects are zerod but REUSED objects are
316 	 * not.  So we are responsible for cleaning the object up sufficiently
317 	 * for our needs before objcache_put()ing it back (typically just the
318 	 * FIFO indices).
319 	 */
320 	cache_buffer_read = objcache_create(margs_read.mtype->ks_shortdesc,
321 				0, 1, NULL, NULL, NULL,
322 				objcache_malloc_alloc,
323 				objcache_malloc_free,
324 				&margs_read);
325 	cache_buffer_write = objcache_create(margs_write.mtype->ks_shortdesc,
326 				0, 1, NULL, NULL, NULL,
327 				objcache_malloc_alloc,
328 				objcache_malloc_free,
329 				&margs_write);
330 	cache_xops = objcache_create(margs_vop.mtype->ks_shortdesc,
331 				0, 1, NULL, NULL, NULL,
332 				objcache_malloc_alloc_zero,
333 				objcache_malloc_free,
334 				&margs_vop);
335 
336 
337 	lockinit(&hammer2_mntlk, "mntlk", 0, 0);
338 	TAILQ_INIT(&hammer2_mntlist);
339 	TAILQ_INIT(&hammer2_pfslist);
340 	TAILQ_INIT(&hammer2_spmplist);
341 
342 	hammer2_limit_dirty_chains = maxvnodes / 10;
343 	if (hammer2_limit_dirty_chains > HAMMER2_LIMIT_DIRTY_CHAINS)
344 		hammer2_limit_dirty_chains = HAMMER2_LIMIT_DIRTY_CHAINS;
345 	if (hammer2_limit_dirty_chains < 1000)
346 		hammer2_limit_dirty_chains = 1000;
347 
348 	hammer2_limit_dirty_inodes = maxvnodes / 25;
349 	if (hammer2_limit_dirty_inodes < 100)
350 		hammer2_limit_dirty_inodes = 100;
351 	if (hammer2_limit_dirty_inodes > HAMMER2_LIMIT_DIRTY_INODES)
352 		hammer2_limit_dirty_inodes = HAMMER2_LIMIT_DIRTY_INODES;
353 
354 	return (error);
355 }
356 
357 static
358 int
359 hammer2_vfs_uninit(struct vfsconf *vfsp __unused)
360 {
361 	objcache_destroy(cache_buffer_read);
362 	objcache_destroy(cache_buffer_write);
363 	objcache_destroy(cache_xops);
364 	return 0;
365 }
366 
367 /*
368  * Core PFS allocator.  Used to allocate or reference the pmp structure
369  * for PFS cluster mounts and the spmp structure for media (hmp) structures.
370  * The pmp can be passed in or loaded by this function using the chain and
371  * inode data.
372  *
373  * pmp->modify_tid tracks new modify_tid transaction ids for front-end
374  * transactions.  Note that synchronization does not use this field.
375  * (typically frontend operations and synchronization cannot run on the
376  * same PFS node at the same time).
377  *
378  * XXX check locking
379  */
380 hammer2_pfs_t *
381 hammer2_pfsalloc(hammer2_chain_t *chain,
382 		 const hammer2_inode_data_t *ripdata,
383 		 hammer2_tid_t modify_tid, hammer2_dev_t *force_local)
384 {
385 	hammer2_pfs_t *pmp;
386 	hammer2_inode_t *iroot;
387 	int count;
388 	int i;
389 	int j;
390 
391 	pmp = NULL;
392 
393 	/*
394 	 * Locate or create the PFS based on the cluster id.  If ripdata
395 	 * is NULL this is a spmp which is unique and is always allocated.
396 	 *
397 	 * If the device is mounted in local mode all PFSs are considered
398 	 * independent and not part of any cluster (for debugging only).
399 	 */
400 	if (ripdata) {
401 		TAILQ_FOREACH(pmp, &hammer2_pfslist, mntentry) {
402 			if (force_local != pmp->force_local)
403 				continue;
404 			if (force_local == NULL &&
405 			    bcmp(&pmp->pfs_clid, &ripdata->meta.pfs_clid,
406 				 sizeof(pmp->pfs_clid)) == 0) {
407 					break;
408 			} else if (force_local && pmp->pfs_names[0] &&
409 			    strcmp(pmp->pfs_names[0], ripdata->filename) == 0) {
410 					break;
411 			}
412 		}
413 	}
414 
415 	if (pmp == NULL) {
416 		pmp = kmalloc(sizeof(*pmp), M_HAMMER2, M_WAITOK | M_ZERO);
417 		pmp->force_local = force_local;
418 		hammer2_trans_manage_init(pmp);
419 		kmalloc_create(&pmp->minode, "HAMMER2-inodes");
420 		kmalloc_create(&pmp->mmsg, "HAMMER2-pfsmsg");
421 		lockinit(&pmp->lock, "pfslk", 0, 0);
422 		lockinit(&pmp->lock_nlink, "h2nlink", 0, 0);
423 		spin_init(&pmp->inum_spin, "hm2pfsalloc_inum");
424 		spin_init(&pmp->xop_spin, "h2xop");
425 		spin_init(&pmp->lru_spin, "h2lru");
426 		RB_INIT(&pmp->inum_tree);
427 		TAILQ_INIT(&pmp->syncq);
428 		TAILQ_INIT(&pmp->depq);
429 		TAILQ_INIT(&pmp->lru_list);
430 		spin_init(&pmp->list_spin, "h2pfsalloc_list");
431 
432 		/*
433 		 * Distribute backend operations to threads
434 		 */
435 		for (i = 0; i < HAMMER2_XOPGROUPS; ++i)
436 			hammer2_xop_group_init(pmp, &pmp->xop_groups[i]);
437 
438 		/*
439 		 * Save the last media transaction id for the flusher.  Set
440 		 * initial
441 		 */
442 		if (ripdata) {
443 			pmp->pfs_clid = ripdata->meta.pfs_clid;
444 			TAILQ_INSERT_TAIL(&hammer2_pfslist, pmp, mntentry);
445 		} else {
446 			pmp->flags |= HAMMER2_PMPF_SPMP;
447 			TAILQ_INSERT_TAIL(&hammer2_spmplist, pmp, mntentry);
448 		}
449 
450 		/*
451 		 * The synchronization thread may start too early, make
452 		 * sure it stays frozen until we are ready to let it go.
453 		 * XXX
454 		 */
455 		/*
456 		pmp->primary_thr.flags = HAMMER2_THREAD_FROZEN |
457 					 HAMMER2_THREAD_REMASTER;
458 		*/
459 	}
460 
461 	/*
462 	 * Create the PFS's root inode and any missing XOP helper threads.
463 	 */
464 	if ((iroot = pmp->iroot) == NULL) {
465 		iroot = hammer2_inode_get(pmp, NULL, 1, -1);
466 		if (ripdata)
467 			iroot->meta = ripdata->meta;
468 		pmp->iroot = iroot;
469 		hammer2_inode_ref(iroot);
470 		hammer2_inode_unlock(iroot);
471 	}
472 
473 	/*
474 	 * Stop here if no chain is passed in.
475 	 */
476 	if (chain == NULL)
477 		goto done;
478 
479 	/*
480 	 * When a chain is passed in we must add it to the PFS's root
481 	 * inode, update pmp->pfs_types[], and update the syncronization
482 	 * threads.
483 	 *
484 	 * When forcing local mode, mark the PFS as a MASTER regardless.
485 	 *
486 	 * At the moment empty spots can develop due to removals or failures.
487 	 * Ultimately we want to re-fill these spots but doing so might
488 	 * confused running code. XXX
489 	 */
490 	hammer2_inode_ref(iroot);
491 	hammer2_mtx_ex(&iroot->lock);
492 	j = iroot->cluster.nchains;
493 
494 	if (j == HAMMER2_MAXCLUSTER) {
495 		kprintf("hammer2_mount: cluster full!\n");
496 		/* XXX fatal error? */
497 	} else {
498 		KKASSERT(chain->pmp == NULL);
499 		chain->pmp = pmp;
500 		hammer2_chain_ref(chain);
501 		iroot->cluster.array[j].chain = chain;
502 		if (force_local)
503 			pmp->pfs_types[j] = HAMMER2_PFSTYPE_MASTER;
504 		else
505 			pmp->pfs_types[j] = ripdata->meta.pfs_type;
506 		pmp->pfs_names[j] = kstrdup(ripdata->filename, M_HAMMER2);
507 		pmp->pfs_hmps[j] = chain->hmp;
508 		hammer2_spin_ex(&pmp->inum_spin);
509 		pmp->pfs_iroot_blocksets[j] = chain->data->ipdata.u.blockset;
510 		hammer2_spin_unex(&pmp->inum_spin);
511 
512 		/*
513 		 * If the PFS is already mounted we must account
514 		 * for the mount_count here.
515 		 */
516 		if (pmp->mp)
517 			++chain->hmp->mount_count;
518 
519 		/*
520 		 * May have to fixup dirty chain tracking.  Previous
521 		 * pmp was NULL so nothing to undo.
522 		 */
523 		if (chain->flags & HAMMER2_CHAIN_MODIFIED)
524 			hammer2_pfs_memory_inc(pmp);
525 		++j;
526 	}
527 	iroot->cluster.nchains = j;
528 
529 	/*
530 	 * Update nmasters from any PFS inode which is part of the cluster.
531 	 * It is possible that this will result in a value which is too
532 	 * high.  MASTER PFSs are authoritative for pfs_nmasters and will
533 	 * override this value later on.
534 	 *
535 	 * (This informs us of masters that might not currently be
536 	 *  discoverable by this mount).
537 	 */
538 	if (ripdata && pmp->pfs_nmasters < ripdata->meta.pfs_nmasters) {
539 		pmp->pfs_nmasters = ripdata->meta.pfs_nmasters;
540 	}
541 
542 	/*
543 	 * Count visible masters.  Masters are usually added with
544 	 * ripdata->meta.pfs_nmasters set to 1.  This detects when there
545 	 * are more (XXX and must update the master inodes).
546 	 */
547 	count = 0;
548 	for (i = 0; i < iroot->cluster.nchains; ++i) {
549 		if (pmp->pfs_types[i] == HAMMER2_PFSTYPE_MASTER)
550 			++count;
551 	}
552 	if (pmp->pfs_nmasters < count)
553 		pmp->pfs_nmasters = count;
554 
555 	/*
556 	 * Create missing synchronization and support threads.
557 	 *
558 	 * Single-node masters (including snapshots) have nothing to
559 	 * synchronize and do not require this thread.
560 	 *
561 	 * Multi-node masters or any number of soft masters, slaves, copy,
562 	 * or other PFS types need the thread.
563 	 *
564 	 * Each thread is responsible for its particular cluster index.
565 	 * We use independent threads so stalls or mismatches related to
566 	 * any given target do not affect other targets.
567 	 */
568 	for (i = 0; i < iroot->cluster.nchains; ++i) {
569 		/*
570 		 * Single-node masters (including snapshots) have nothing
571 		 * to synchronize and will make direct xops support calls,
572 		 * thus they do not require this thread.
573 		 *
574 		 * Note that there can be thousands of snapshots.  We do not
575 		 * want to create thousands of threads.
576 		 */
577 		if (pmp->pfs_nmasters <= 1 &&
578 		    pmp->pfs_types[i] == HAMMER2_PFSTYPE_MASTER) {
579 			continue;
580 		}
581 
582 		/*
583 		 * Sync support thread
584 		 */
585 		if (pmp->sync_thrs[i].td == NULL) {
586 			hammer2_thr_create(&pmp->sync_thrs[i], pmp, NULL,
587 					   "h2nod", i, -1,
588 					   hammer2_primary_sync_thread);
589 		}
590 	}
591 
592 	/*
593 	 * Create missing Xop threads
594 	 *
595 	 * NOTE: We create helper threads for all mounted PFSs or any
596 	 *	 PFSs with 2+ nodes (so the sync thread can update them,
597 	 *	 even if not mounted).
598 	 */
599 	if (pmp->mp || iroot->cluster.nchains >= 2)
600 		hammer2_xop_helper_create(pmp);
601 
602 	hammer2_mtx_unlock(&iroot->lock);
603 	hammer2_inode_drop(iroot);
604 done:
605 	return pmp;
606 }
607 
608 /*
609  * Deallocate an element of a probed PFS.  If destroying and this is a
610  * MASTER, adjust nmasters.
611  *
612  * This function does not physically destroy the PFS element in its device
613  * under the super-root  (see hammer2_ioctl_pfs_delete()).
614  */
615 void
616 hammer2_pfsdealloc(hammer2_pfs_t *pmp, int clindex, int destroying)
617 {
618 	hammer2_inode_t *iroot;
619 	hammer2_chain_t *chain;
620 	int j;
621 
622 	/*
623 	 * Cleanup our reference on iroot.  iroot is (should) not be needed
624 	 * by the flush code.
625 	 */
626 	iroot = pmp->iroot;
627 	if (iroot) {
628 		/*
629 		 * Stop synchronizing
630 		 *
631 		 * XXX flush after acquiring the iroot lock.
632 		 * XXX clean out the cluster index from all inode structures.
633 		 */
634 		hammer2_thr_delete(&pmp->sync_thrs[clindex]);
635 
636 		/*
637 		 * Remove the cluster index from the group.  If destroying
638 		 * the PFS and this is a master, adjust pfs_nmasters.
639 		 */
640 		hammer2_mtx_ex(&iroot->lock);
641 		chain = iroot->cluster.array[clindex].chain;
642 		iroot->cluster.array[clindex].chain = NULL;
643 
644 		switch(pmp->pfs_types[clindex]) {
645 		case HAMMER2_PFSTYPE_MASTER:
646 			if (destroying && pmp->pfs_nmasters > 0)
647 				--pmp->pfs_nmasters;
648 			/* XXX adjust ripdata->meta.pfs_nmasters */
649 			break;
650 		default:
651 			break;
652 		}
653 		pmp->pfs_types[clindex] = HAMMER2_PFSTYPE_NONE;
654 
655 		hammer2_mtx_unlock(&iroot->lock);
656 
657 		/*
658 		 * Release the chain.
659 		 */
660 		if (chain) {
661 			atomic_set_int(&chain->flags, HAMMER2_CHAIN_RELEASE);
662 			hammer2_chain_drop(chain);
663 		}
664 
665 		/*
666 		 * Terminate all XOP threads for the cluster index.
667 		 */
668 		for (j = 0; j < HAMMER2_XOPGROUPS; ++j)
669 			hammer2_thr_delete(&pmp->xop_groups[j].thrs[clindex]);
670 	}
671 }
672 
673 /*
674  * Destroy a PFS, typically only occurs after the last mount on a device
675  * has gone away.
676  */
677 static void
678 hammer2_pfsfree(hammer2_pfs_t *pmp)
679 {
680 	hammer2_inode_t *iroot;
681 	hammer2_chain_t *chain;
682 	int chains_still_present = 0;
683 	int i;
684 	int j;
685 
686 	/*
687 	 * Cleanup our reference on iroot.  iroot is (should) not be needed
688 	 * by the flush code.
689 	 */
690 	if (pmp->flags & HAMMER2_PMPF_SPMP)
691 		TAILQ_REMOVE(&hammer2_spmplist, pmp, mntentry);
692 	else
693 		TAILQ_REMOVE(&hammer2_pfslist, pmp, mntentry);
694 
695 	/*
696 	 * Cleanup chains remaining on LRU list.
697 	 */
698 	hammer2_spin_ex(&pmp->lru_spin);
699 	while ((chain = TAILQ_FIRST(&pmp->lru_list)) != NULL) {
700 		KKASSERT(chain->flags & HAMMER2_CHAIN_ONLRU);
701 		atomic_add_int(&pmp->lru_count, -1);
702 		atomic_clear_int(&chain->flags, HAMMER2_CHAIN_ONLRU);
703 		TAILQ_REMOVE(&pmp->lru_list, chain, lru_node);
704 		hammer2_chain_ref(chain);
705 		hammer2_spin_unex(&pmp->lru_spin);
706 		atomic_set_int(&chain->flags, HAMMER2_CHAIN_RELEASE);
707 		hammer2_chain_drop(chain);
708 		hammer2_spin_ex(&pmp->lru_spin);
709 	}
710 	hammer2_spin_unex(&pmp->lru_spin);
711 
712 	/*
713 	 * Clean up iroot
714 	 */
715 	iroot = pmp->iroot;
716 	if (iroot) {
717 		for (i = 0; i < iroot->cluster.nchains; ++i) {
718 			hammer2_thr_delete(&pmp->sync_thrs[i]);
719 			for (j = 0; j < HAMMER2_XOPGROUPS; ++j)
720 				hammer2_thr_delete(&pmp->xop_groups[j].thrs[i]);
721 			chain = iroot->cluster.array[i].chain;
722 			if (chain && !RB_EMPTY(&chain->core.rbtree)) {
723 				kprintf("hammer2: Warning pmp %p still "
724 					"has active chains\n", pmp);
725 				chains_still_present = 1;
726 			}
727 		}
728 #if REPORT_REFS_ERRORS
729 		if (iroot->refs != 1)
730 			kprintf("PMP->IROOT %p REFS WRONG %d\n",
731 				iroot, iroot->refs);
732 #else
733 		KKASSERT(iroot->refs == 1);
734 #endif
735 		/* ref for iroot */
736 		hammer2_inode_drop(iroot);
737 		pmp->iroot = NULL;
738 	}
739 
740 	/*
741 	 * Free remaining pmp resources
742 	 */
743 	if (chains_still_present) {
744 		kprintf("hammer2: cannot free pmp %p, still in use\n", pmp);
745 	} else {
746 		kmalloc_destroy(&pmp->mmsg);
747 		kmalloc_destroy(&pmp->minode);
748 		kfree(pmp, M_HAMMER2);
749 	}
750 }
751 
752 /*
753  * Remove all references to hmp from the pfs list.  Any PFS which becomes
754  * empty is terminated and freed.
755  *
756  * XXX inefficient.
757  */
758 static void
759 hammer2_pfsfree_scan(hammer2_dev_t *hmp, int which)
760 {
761 	hammer2_pfs_t *pmp;
762 	hammer2_inode_t *iroot;
763 	hammer2_chain_t *rchain;
764 	int i;
765 	int j;
766 	struct hammer2_pfslist *wlist;
767 
768 	if (which == 0)
769 		wlist = &hammer2_pfslist;
770 	else
771 		wlist = &hammer2_spmplist;
772 again:
773 	TAILQ_FOREACH(pmp, wlist, mntentry) {
774 		if ((iroot = pmp->iroot) == NULL)
775 			continue;
776 
777 		/*
778 		 * Determine if this PFS is affected.  If it is we must
779 		 * freeze all management threads and lock its iroot.
780 		 *
781 		 * Freezing a management thread forces it idle, operations
782 		 * in-progress will be aborted and it will have to start
783 		 * over again when unfrozen, or exit if told to exit.
784 		 */
785 		for (i = 0; i < HAMMER2_MAXCLUSTER; ++i) {
786 			if (pmp->pfs_hmps[i] == hmp)
787 				break;
788 		}
789 		if (i == HAMMER2_MAXCLUSTER)
790 			continue;
791 
792 		hammer2_vfs_sync_pmp(pmp, MNT_WAIT);
793 
794 		/*
795 		 * Make sure all synchronization threads are locked
796 		 * down.
797 		 */
798 		for (i = 0; i < HAMMER2_MAXCLUSTER; ++i) {
799 			if (pmp->pfs_hmps[i] == NULL)
800 				continue;
801 			hammer2_thr_freeze_async(&pmp->sync_thrs[i]);
802 			for (j = 0; j < HAMMER2_XOPGROUPS; ++j) {
803 				hammer2_thr_freeze_async(
804 					&pmp->xop_groups[j].thrs[i]);
805 			}
806 		}
807 		for (i = 0; i < HAMMER2_MAXCLUSTER; ++i) {
808 			if (pmp->pfs_hmps[i] == NULL)
809 				continue;
810 			hammer2_thr_freeze(&pmp->sync_thrs[i]);
811 			for (j = 0; j < HAMMER2_XOPGROUPS; ++j) {
812 				hammer2_thr_freeze(
813 					&pmp->xop_groups[j].thrs[i]);
814 			}
815 		}
816 
817 		/*
818 		 * Lock the inode and clean out matching chains.
819 		 * Note that we cannot use hammer2_inode_lock_*()
820 		 * here because that would attempt to validate the
821 		 * cluster that we are in the middle of ripping
822 		 * apart.
823 		 *
824 		 * WARNING! We are working directly on the inodes
825 		 *	    embedded cluster.
826 		 */
827 		hammer2_mtx_ex(&iroot->lock);
828 
829 		/*
830 		 * Remove the chain from matching elements of the PFS.
831 		 */
832 		for (i = 0; i < HAMMER2_MAXCLUSTER; ++i) {
833 			if (pmp->pfs_hmps[i] != hmp)
834 				continue;
835 			hammer2_thr_delete(&pmp->sync_thrs[i]);
836 			for (j = 0; j < HAMMER2_XOPGROUPS; ++j) {
837 				hammer2_thr_delete(
838 					&pmp->xop_groups[j].thrs[i]);
839 			}
840 			rchain = iroot->cluster.array[i].chain;
841 			iroot->cluster.array[i].chain = NULL;
842 			pmp->pfs_types[i] = 0;
843 			if (pmp->pfs_names[i]) {
844 				kfree(pmp->pfs_names[i], M_HAMMER2);
845 				pmp->pfs_names[i] = NULL;
846 			}
847 			if (rchain) {
848 				hammer2_chain_drop(rchain);
849 				/* focus hint */
850 				if (iroot->cluster.focus == rchain)
851 					iroot->cluster.focus = NULL;
852 			}
853 			pmp->pfs_hmps[i] = NULL;
854 		}
855 		hammer2_mtx_unlock(&iroot->lock);
856 
857 		/*
858 		 * Cleanup trailing chains.  Gaps may remain.
859 		 */
860 		for (i = HAMMER2_MAXCLUSTER - 1; i >= 0; --i) {
861 			if (pmp->pfs_hmps[i])
862 				break;
863 		}
864 		iroot->cluster.nchains = i + 1;
865 
866 		/*
867 		 * If the PMP has no elements remaining we can destroy it.
868 		 * (this will transition management threads from frozen->exit).
869 		 */
870 		if (iroot->cluster.nchains == 0) {
871 			/*
872 			 * If this was the hmp's spmp, we need to clean
873 			 * a little more stuff out.
874 			 */
875 			if (hmp->spmp == pmp) {
876 				hmp->spmp = NULL;
877 				hmp->vchain.pmp = NULL;
878 				hmp->fchain.pmp = NULL;
879 			}
880 
881 			/*
882 			 * Free the pmp and restart the loop
883 			 */
884 			KKASSERT(TAILQ_EMPTY(&pmp->syncq));
885 			KKASSERT(TAILQ_EMPTY(&pmp->depq));
886 			hammer2_pfsfree(pmp);
887 			goto again;
888 		}
889 
890 		/*
891 		 * If elements still remain we need to set the REMASTER
892 		 * flag and unfreeze it.
893 		 */
894 		for (i = 0; i < HAMMER2_MAXCLUSTER; ++i) {
895 			if (pmp->pfs_hmps[i] == NULL)
896 				continue;
897 			hammer2_thr_remaster(&pmp->sync_thrs[i]);
898 			hammer2_thr_unfreeze(&pmp->sync_thrs[i]);
899 			for (j = 0; j < HAMMER2_XOPGROUPS; ++j) {
900 				hammer2_thr_remaster(
901 					&pmp->xop_groups[j].thrs[i]);
902 				hammer2_thr_unfreeze(
903 					&pmp->xop_groups[j].thrs[i]);
904 			}
905 		}
906 	}
907 }
908 
909 /*
910  * Mount or remount HAMMER2 fileystem from physical media
911  *
912  *	mountroot
913  *		mp		mount point structure
914  *		path		NULL
915  *		data		<unused>
916  *		cred		<unused>
917  *
918  *	mount
919  *		mp		mount point structure
920  *		path		path to mount point
921  *		data		pointer to argument structure in user space
922  *			volume	volume path (device@LABEL form)
923  *			hflags	user mount flags
924  *		cred		user credentials
925  *
926  * RETURNS:	0	Success
927  *		!0	error number
928  */
929 static
930 int
931 hammer2_vfs_mount(struct mount *mp, char *path, caddr_t data,
932 		  struct ucred *cred)
933 {
934 	struct hammer2_mount_info info;
935 	hammer2_pfs_t *pmp;
936 	hammer2_pfs_t *spmp;
937 	hammer2_dev_t *hmp;
938 	hammer2_dev_t *force_local;
939 	hammer2_key_t key_next;
940 	hammer2_key_t key_dummy;
941 	hammer2_key_t lhc;
942 	struct vnode *devvp;
943 	struct nlookupdata nd;
944 	hammer2_chain_t *parent;
945 	hammer2_chain_t *chain;
946 	const hammer2_inode_data_t *ripdata;
947 	hammer2_blockref_t bref;
948 	struct file *fp;
949 	char devstr[MNAMELEN];
950 	size_t size;
951 	size_t done;
952 	char *dev;
953 	char *label;
954 	int ronly = 1;
955 	int error;
956 	int i;
957 
958 	hmp = NULL;
959 	pmp = NULL;
960 	dev = NULL;
961 	label = NULL;
962 	devvp = NULL;
963 
964 	if (path == NULL) {
965 		/*
966 		 * Root mount
967 		 */
968 		bzero(&info, sizeof(info));
969 		info.cluster_fd = -1;
970 		ksnprintf(devstr, sizeof(devstr), "%s",
971 			  mp->mnt_stat.f_mntfromname);
972 		kprintf("hammer2_mount: root '%s'\n", devstr);
973 		done = strlen(devstr) + 1;
974 	} else {
975 		/*
976 		 * Non-root mount or updating a mount
977 		 */
978 		error = copyin(data, &info, sizeof(info));
979 		if (error)
980 			return (error);
981 
982 		error = copyinstr(info.volume, devstr, MNAMELEN - 1, &done);
983 		if (error)
984 			return (error);
985 		kprintf("hammer2_mount: '%s'\n", devstr);
986 	}
987 
988 	/*
989 	 * Extract device and label, automatically mount @BOOT, @ROOT, or @DATA
990 	 * if no label specified, based on the partition id.  Error out if no
991 	 * label or device (with partition id) is specified.  This is strictly
992 	 * a convenience to match the default label created by newfs_hammer2,
993 	 * our preference is that a label always be specified.
994 	 *
995 	 * NOTE: We allow 'mount @LABEL <blah>'... that is, a mount command
996 	 *	 that does not specify a device, as long as some H2 label
997 	 *	 has already been mounted from that device.  This makes
998 	 *	 mounting snapshots a lot easier.
999 	 */
1000 	dev = devstr;
1001 	label = strchr(devstr, '@');
1002 	if (label && ((label + 1) - dev) > done) {
1003 		kprintf("hammer2: mount: bad label %s/%zd\n",
1004 			devstr, done);
1005 		return (EINVAL);
1006 	}
1007 	if (label == NULL || label[1] == 0) {
1008 		char slice;
1009 
1010 		if (label == NULL)
1011 			label = devstr + strlen(devstr);
1012 		else
1013 			*label = '\0';		/* clean up trailing @ */
1014 
1015 		slice = label[-1];
1016 		switch(slice) {
1017 		case 'a':
1018 			label = "BOOT";
1019 			break;
1020 		case 'd':
1021 			label = "ROOT";
1022 			break;
1023 		default:
1024 			label = "DATA";
1025 			break;
1026 		}
1027 	} else {
1028 		*label = '\0';
1029 		label++;
1030 	}
1031 
1032 	kprintf("hammer2_mount: dev=\"%s\" label=\"%s\" rdonly=%d\n",
1033 		dev, label, (mp->mnt_flag & MNT_RDONLY));
1034 
1035 	if (mp->mnt_flag & MNT_UPDATE) {
1036 		/*
1037 		 * Update mount.  Note that pmp->iroot->cluster is
1038 		 * an inode-embedded cluster and thus cannot be
1039 		 * directly locked.
1040 		 *
1041 		 * XXX HAMMER2 needs to implement NFS export via
1042 		 *     mountctl.
1043 		 */
1044 		hammer2_cluster_t *cluster;
1045 
1046 		pmp = MPTOPMP(mp);
1047 		pmp->hflags = info.hflags;
1048 		cluster = &pmp->iroot->cluster;
1049 		for (i = 0; i < cluster->nchains; ++i) {
1050 			if (cluster->array[i].chain == NULL)
1051 				continue;
1052 			hmp = cluster->array[i].chain->hmp;
1053 			devvp = hmp->devvp;
1054 			error = hammer2_remount(hmp, mp, path,
1055 						devvp, cred);
1056 			if (error)
1057 				break;
1058 		}
1059 
1060 		return error;
1061 	}
1062 
1063 	/*
1064 	 * HMP device mount
1065 	 *
1066 	 * If a path is specified and dev is not an empty string, lookup the
1067 	 * name and verify that it referes to a block device.
1068 	 *
1069 	 * If a path is specified and dev is an empty string we fall through
1070 	 * and locate the label in the hmp search.
1071 	 */
1072 	if (path && *dev != 0) {
1073 		error = nlookup_init(&nd, dev, UIO_SYSSPACE, NLC_FOLLOW);
1074 		if (error == 0)
1075 			error = nlookup(&nd);
1076 		if (error == 0)
1077 			error = cache_vref(&nd.nl_nch, nd.nl_cred, &devvp);
1078 		nlookup_done(&nd);
1079 	} else if (path == NULL) {
1080 		/* root mount */
1081 		cdev_t cdev = kgetdiskbyname(dev);
1082 		error = bdevvp(cdev, &devvp);
1083 		if (error)
1084 			kprintf("hammer2: cannot find '%s'\n", dev);
1085 	} else {
1086 		/*
1087 		 * We will locate the hmp using the label in the hmp loop.
1088 		 */
1089 		error = 0;
1090 	}
1091 
1092 	/*
1093 	 * Make sure its a block device.  Do not check to see if it is
1094 	 * already mounted until we determine that its a fresh H2 device.
1095 	 */
1096 	if (error == 0 && devvp) {
1097 		vn_isdisk(devvp, &error);
1098 	}
1099 
1100 	/*
1101 	 * Determine if the device has already been mounted.  After this
1102 	 * check hmp will be non-NULL if we are doing the second or more
1103 	 * hammer2 mounts from the same device.
1104 	 */
1105 	lockmgr(&hammer2_mntlk, LK_EXCLUSIVE);
1106 	if (devvp) {
1107 		/*
1108 		 * Match the device.  Due to the way devfs works,
1109 		 * we may not be able to directly match the vnode pointer,
1110 		 * so also check to see if the underlying device matches.
1111 		 */
1112 		TAILQ_FOREACH(hmp, &hammer2_mntlist, mntentry) {
1113 			if (hmp->devvp == devvp)
1114 				break;
1115 			if (devvp->v_rdev &&
1116 			    hmp->devvp->v_rdev == devvp->v_rdev) {
1117 				break;
1118 			}
1119 		}
1120 
1121 		/*
1122 		 * If no match this may be a fresh H2 mount, make sure
1123 		 * the device is not mounted on anything else.
1124 		 */
1125 		if (hmp == NULL)
1126 			error = vfs_mountedon(devvp);
1127 	} else if (error == 0) {
1128 		/*
1129 		 * Match the label to a pmp already probed.
1130 		 */
1131 		TAILQ_FOREACH(pmp, &hammer2_pfslist, mntentry) {
1132 			for (i = 0; i < HAMMER2_MAXCLUSTER; ++i) {
1133 				if (pmp->pfs_names[i] &&
1134 				    strcmp(pmp->pfs_names[i], label) == 0) {
1135 					hmp = pmp->pfs_hmps[i];
1136 					break;
1137 				}
1138 			}
1139 			if (hmp)
1140 				break;
1141 		}
1142 		if (hmp == NULL)
1143 			error = ENOENT;
1144 	}
1145 
1146 	/*
1147 	 * Open the device if this isn't a secondary mount and construct
1148 	 * the H2 device mount (hmp).
1149 	 */
1150 	if (hmp == NULL) {
1151 		hammer2_chain_t *schain;
1152 		hammer2_xid_t xid;
1153 		hammer2_xop_head_t xop;
1154 
1155 		if (error == 0 && vcount(devvp) > 0) {
1156 			kprintf("Primary device already has references\n");
1157 			error = EBUSY;
1158 		}
1159 
1160 		/*
1161 		 * Now open the device
1162 		 */
1163 		if (error == 0) {
1164 			ronly = ((mp->mnt_flag & MNT_RDONLY) != 0);
1165 			vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);
1166 			error = vinvalbuf(devvp, V_SAVE, 0, 0);
1167 			if (error == 0) {
1168 				error = VOP_OPEN(devvp,
1169 					     (ronly ? FREAD : FREAD | FWRITE),
1170 					     FSCRED, NULL);
1171 			}
1172 			vn_unlock(devvp);
1173 		}
1174 		if (error && devvp) {
1175 			vrele(devvp);
1176 			devvp = NULL;
1177 		}
1178 		if (error) {
1179 			lockmgr(&hammer2_mntlk, LK_RELEASE);
1180 			return error;
1181 		}
1182 		hmp = kmalloc(sizeof(*hmp), M_HAMMER2, M_WAITOK | M_ZERO);
1183 		ksnprintf(hmp->devrepname, sizeof(hmp->devrepname), "%s", dev);
1184 		hmp->ronly = ronly;
1185 		hmp->devvp = devvp;
1186 		hmp->hflags = info.hflags & HMNT2_DEVFLAGS;
1187 		kmalloc_create(&hmp->mchain, "HAMMER2-chains");
1188 		TAILQ_INSERT_TAIL(&hammer2_mntlist, hmp, mntentry);
1189 		RB_INIT(&hmp->iotree);
1190 		spin_init(&hmp->io_spin, "h2mount_io");
1191 		spin_init(&hmp->list_spin, "h2mount_list");
1192 
1193 		lockinit(&hmp->vollk, "h2vol", 0, 0);
1194 		lockinit(&hmp->bulklk, "h2bulk", 0, 0);
1195 		lockinit(&hmp->bflock, "h2bflk", 0, 0);
1196 
1197 		/*
1198 		 * vchain setup. vchain.data is embedded.
1199 		 * vchain.refs is initialized and will never drop to 0.
1200 		 *
1201 		 * NOTE! voldata is not yet loaded.
1202 		 */
1203 		hmp->vchain.hmp = hmp;
1204 		hmp->vchain.refs = 1;
1205 		hmp->vchain.data = (void *)&hmp->voldata;
1206 		hmp->vchain.bref.type = HAMMER2_BREF_TYPE_VOLUME;
1207 		hmp->vchain.bref.data_off = 0 | HAMMER2_PBUFRADIX;
1208 		hmp->vchain.bref.mirror_tid = hmp->voldata.mirror_tid;
1209 
1210 		hammer2_chain_core_init(&hmp->vchain);
1211 		/* hmp->vchain.u.xxx is left NULL */
1212 
1213 		/*
1214 		 * fchain setup.  fchain.data is embedded.
1215 		 * fchain.refs is initialized and will never drop to 0.
1216 		 *
1217 		 * The data is not used but needs to be initialized to
1218 		 * pass assertion muster.  We use this chain primarily
1219 		 * as a placeholder for the freemap's top-level RBTREE
1220 		 * so it does not interfere with the volume's topology
1221 		 * RBTREE.
1222 		 */
1223 		hmp->fchain.hmp = hmp;
1224 		hmp->fchain.refs = 1;
1225 		hmp->fchain.data = (void *)&hmp->voldata.freemap_blockset;
1226 		hmp->fchain.bref.type = HAMMER2_BREF_TYPE_FREEMAP;
1227 		hmp->fchain.bref.data_off = 0 | HAMMER2_PBUFRADIX;
1228 		hmp->fchain.bref.mirror_tid = hmp->voldata.freemap_tid;
1229 		hmp->fchain.bref.methods =
1230 			HAMMER2_ENC_CHECK(HAMMER2_CHECK_FREEMAP) |
1231 			HAMMER2_ENC_COMP(HAMMER2_COMP_NONE);
1232 
1233 		hammer2_chain_core_init(&hmp->fchain);
1234 		/* hmp->fchain.u.xxx is left NULL */
1235 
1236 		/*
1237 		 * Install the volume header and initialize fields from
1238 		 * voldata.
1239 		 */
1240 		error = hammer2_install_volume_header(hmp);
1241 		if (error) {
1242 			hammer2_unmount_helper(mp, NULL, hmp);
1243 			lockmgr(&hammer2_mntlk, LK_RELEASE);
1244 			hammer2_vfs_unmount(mp, MNT_FORCE);
1245 			return error;
1246 		}
1247 
1248 		/*
1249 		 * Really important to get these right or the flush and
1250 		 * teardown code will get confused.
1251 		 */
1252 		hmp->spmp = hammer2_pfsalloc(NULL, NULL, 0, NULL);
1253 		spmp = hmp->spmp;
1254 		spmp->pfs_hmps[0] = hmp;
1255 
1256 		/*
1257 		 * Dummy-up vchain and fchain's modify_tid.  mirror_tid
1258 		 * is inherited from the volume header.
1259 		 */
1260 		xid = 0;
1261 		hmp->vchain.bref.mirror_tid = hmp->voldata.mirror_tid;
1262 		hmp->vchain.bref.modify_tid = hmp->vchain.bref.mirror_tid;
1263 		hmp->vchain.pmp = spmp;
1264 		hmp->fchain.bref.mirror_tid = hmp->voldata.freemap_tid;
1265 		hmp->fchain.bref.modify_tid = hmp->fchain.bref.mirror_tid;
1266 		hmp->fchain.pmp = spmp;
1267 
1268 		/*
1269 		 * First locate the super-root inode, which is key 0
1270 		 * relative to the volume header's blockset.
1271 		 *
1272 		 * Then locate the root inode by scanning the directory keyspace
1273 		 * represented by the label.
1274 		 */
1275 		parent = hammer2_chain_lookup_init(&hmp->vchain, 0);
1276 		schain = hammer2_chain_lookup(&parent, &key_dummy,
1277 				      HAMMER2_SROOT_KEY, HAMMER2_SROOT_KEY,
1278 				      &error, 0);
1279 		hammer2_chain_lookup_done(parent);
1280 		if (schain == NULL) {
1281 			kprintf("hammer2_mount: invalid super-root\n");
1282 			hammer2_unmount_helper(mp, NULL, hmp);
1283 			lockmgr(&hammer2_mntlk, LK_RELEASE);
1284 			hammer2_vfs_unmount(mp, MNT_FORCE);
1285 			return EINVAL;
1286 		}
1287 		if (schain->error) {
1288 			kprintf("hammer2_mount: error %s reading super-root\n",
1289 				hammer2_error_str(schain->error));
1290 			hammer2_chain_unlock(schain);
1291 			hammer2_chain_drop(schain);
1292 			schain = NULL;
1293 			hammer2_unmount_helper(mp, NULL, hmp);
1294 			lockmgr(&hammer2_mntlk, LK_RELEASE);
1295 			hammer2_vfs_unmount(mp, MNT_FORCE);
1296 			return EINVAL;
1297 		}
1298 
1299 		/*
1300 		 * The super-root always uses an inode_tid of 1 when
1301 		 * creating PFSs.
1302 		 */
1303 		spmp->inode_tid = 1;
1304 		spmp->modify_tid = schain->bref.modify_tid + 1;
1305 
1306 		/*
1307 		 * Sanity-check schain's pmp and finish initialization.
1308 		 * Any chain belonging to the super-root topology should
1309 		 * have a NULL pmp (not even set to spmp).
1310 		 */
1311 		ripdata = &hammer2_chain_rdata(schain)->ipdata;
1312 		KKASSERT(schain->pmp == NULL);
1313 		spmp->pfs_clid = ripdata->meta.pfs_clid;
1314 
1315 		/*
1316 		 * Replace the dummy spmp->iroot with a real one.  It's
1317 		 * easier to just do a wholesale replacement than to try
1318 		 * to update the chain and fixup the iroot fields.
1319 		 *
1320 		 * The returned inode is locked with the supplied cluster.
1321 		 */
1322 		hammer2_dummy_xop_from_chain(&xop, schain);
1323 		hammer2_inode_drop(spmp->iroot);
1324 		spmp->iroot = NULL;
1325 		spmp->iroot = hammer2_inode_get(spmp, &xop, -1, -1);
1326 		spmp->spmp_hmp = hmp;
1327 		spmp->pfs_types[0] = ripdata->meta.pfs_type;
1328 		spmp->pfs_hmps[0] = hmp;
1329 		hammer2_inode_ref(spmp->iroot);
1330 		hammer2_inode_unlock(spmp->iroot);
1331 		hammer2_cluster_unlock(&xop.cluster);
1332 		hammer2_chain_drop(schain);
1333 		/* do not call hammer2_cluster_drop() on an embedded cluster */
1334 		schain = NULL;	/* now invalid */
1335 		/* leave spmp->iroot with one ref */
1336 
1337 		if ((mp->mnt_flag & MNT_RDONLY) == 0) {
1338 			error = hammer2_recovery(hmp);
1339 			if (error == 0)
1340 				error |= hammer2_fixup_pfses(hmp);
1341 			/* XXX do something with error */
1342 		}
1343 		hammer2_update_pmps(hmp);
1344 		hammer2_iocom_init(hmp);
1345 		hammer2_bulkfree_init(hmp);
1346 
1347 		/*
1348 		 * Ref the cluster management messaging descriptor.  The mount
1349 		 * program deals with the other end of the communications pipe.
1350 		 *
1351 		 * Root mounts typically do not supply one.
1352 		 */
1353 		if (info.cluster_fd >= 0) {
1354 			fp = holdfp(curthread, info.cluster_fd, -1);
1355 			if (fp) {
1356 				hammer2_cluster_reconnect(hmp, fp);
1357 			} else {
1358 				kprintf("hammer2_mount: bad cluster_fd!\n");
1359 			}
1360 		}
1361 	} else {
1362 		spmp = hmp->spmp;
1363 		if (info.hflags & HMNT2_DEVFLAGS) {
1364 			kprintf("hammer2: Warning: mount flags pertaining "
1365 				"to the whole device may only be specified "
1366 				"on the first mount of the device: %08x\n",
1367 				info.hflags & HMNT2_DEVFLAGS);
1368 		}
1369 	}
1370 
1371 	/*
1372 	 * Force local mount (disassociate all PFSs from their clusters).
1373 	 * Used primarily for debugging.
1374 	 */
1375 	force_local = (hmp->hflags & HMNT2_LOCAL) ? hmp : NULL;
1376 
1377 	/*
1378 	 * Lookup the mount point under the media-localized super-root.
1379 	 * Scanning hammer2_pfslist doesn't help us because it represents
1380 	 * PFS cluster ids which can aggregate several named PFSs together.
1381 	 *
1382 	 * cluster->pmp will incorrectly point to spmp and must be fixed
1383 	 * up later on.
1384 	 */
1385 	hammer2_inode_lock(spmp->iroot, 0);
1386 	parent = hammer2_inode_chain(spmp->iroot, 0, HAMMER2_RESOLVE_ALWAYS);
1387 	lhc = hammer2_dirhash(label, strlen(label));
1388 	chain = hammer2_chain_lookup(&parent, &key_next,
1389 				     lhc, lhc + HAMMER2_DIRHASH_LOMASK,
1390 				     &error, 0);
1391 	while (chain) {
1392 		if (chain->bref.type == HAMMER2_BREF_TYPE_INODE &&
1393 		    strcmp(label, chain->data->ipdata.filename) == 0) {
1394 			break;
1395 		}
1396 		chain = hammer2_chain_next(&parent, chain, &key_next,
1397 					    key_next,
1398 					    lhc + HAMMER2_DIRHASH_LOMASK,
1399 					    &error, 0);
1400 	}
1401 	if (parent) {
1402 		hammer2_chain_unlock(parent);
1403 		hammer2_chain_drop(parent);
1404 	}
1405 	hammer2_inode_unlock(spmp->iroot);
1406 
1407 	/*
1408 	 * PFS could not be found?
1409 	 */
1410 	if (chain == NULL) {
1411 		if (error)
1412 			kprintf("hammer2_mount: PFS label I/O error\n");
1413 		else
1414 			kprintf("hammer2_mount: PFS label not found\n");
1415 		hammer2_unmount_helper(mp, NULL, hmp);
1416 		lockmgr(&hammer2_mntlk, LK_RELEASE);
1417 		hammer2_vfs_unmount(mp, MNT_FORCE);
1418 
1419 		return EINVAL;
1420 	}
1421 
1422 	/*
1423 	 * Acquire the pmp structure (it should have already been allocated
1424 	 * via hammer2_update_pmps() so do not pass cluster in to add to
1425 	 * available chains).
1426 	 *
1427 	 * Check if the cluster has already been mounted.  A cluster can
1428 	 * only be mounted once, use null mounts to mount additional copies.
1429 	 */
1430 	if (chain->error) {
1431 		kprintf("hammer2_mount: PFS label I/O error\n");
1432 	} else {
1433 		ripdata = &chain->data->ipdata;
1434 		bref = chain->bref;
1435 		pmp = hammer2_pfsalloc(NULL, ripdata,
1436 				       bref.modify_tid, force_local);
1437 	}
1438 	hammer2_chain_unlock(chain);
1439 	hammer2_chain_drop(chain);
1440 
1441 	/*
1442 	 * Finish the mount
1443 	 */
1444         kprintf("hammer2_mount hmp=%p pmp=%p\n", hmp, pmp);
1445 
1446 	if (pmp->mp) {
1447 		kprintf("hammer2_mount: PFS already mounted!\n");
1448 		hammer2_unmount_helper(mp, NULL, hmp);
1449 		lockmgr(&hammer2_mntlk, LK_RELEASE);
1450 		hammer2_vfs_unmount(mp, MNT_FORCE);
1451 
1452 		return EBUSY;
1453 	}
1454 
1455 	pmp->hflags = info.hflags;
1456         mp->mnt_flag |= MNT_LOCAL;
1457         mp->mnt_kern_flag |= MNTK_ALL_MPSAFE;   /* all entry pts are SMP */
1458         mp->mnt_kern_flag |= MNTK_THR_SYNC;     /* new vsyncscan semantics */
1459 
1460         /*
1461          * required mount structure initializations
1462          */
1463         mp->mnt_stat.f_iosize = HAMMER2_PBUFSIZE;
1464         mp->mnt_stat.f_bsize = HAMMER2_PBUFSIZE;
1465 
1466         mp->mnt_vstat.f_frsize = HAMMER2_PBUFSIZE;
1467         mp->mnt_vstat.f_bsize = HAMMER2_PBUFSIZE;
1468 
1469         /*
1470          * Optional fields
1471          */
1472         mp->mnt_iosize_max = MAXPHYS;
1473 
1474 	/*
1475 	 * Connect up mount pointers.
1476 	 */
1477 	hammer2_mount_helper(mp, pmp);
1478 
1479         lockmgr(&hammer2_mntlk, LK_RELEASE);
1480 
1481 	/*
1482 	 * Finish setup
1483 	 */
1484 	vfs_getnewfsid(mp);
1485 	vfs_add_vnodeops(mp, &hammer2_vnode_vops, &mp->mnt_vn_norm_ops);
1486 	vfs_add_vnodeops(mp, &hammer2_spec_vops, &mp->mnt_vn_spec_ops);
1487 	vfs_add_vnodeops(mp, &hammer2_fifo_vops, &mp->mnt_vn_fifo_ops);
1488 
1489 	if (path) {
1490 		copyinstr(info.volume, mp->mnt_stat.f_mntfromname,
1491 			  MNAMELEN - 1, &size);
1492 		bzero(mp->mnt_stat.f_mntfromname + size, MNAMELEN - size);
1493 	} /* else root mount, already in there */
1494 
1495 	bzero(mp->mnt_stat.f_mntonname, sizeof(mp->mnt_stat.f_mntonname));
1496 	if (path) {
1497 		copyinstr(path, mp->mnt_stat.f_mntonname,
1498 			  sizeof(mp->mnt_stat.f_mntonname) - 1,
1499 			  &size);
1500 	} else {
1501 		/* root mount */
1502 		mp->mnt_stat.f_mntonname[0] = '/';
1503 	}
1504 
1505 	/*
1506 	 * Initial statfs to prime mnt_stat.
1507 	 */
1508 	hammer2_vfs_statfs(mp, &mp->mnt_stat, cred);
1509 
1510 	return 0;
1511 }
1512 
1513 /*
1514  * Scan PFSs under the super-root and create hammer2_pfs structures.
1515  */
1516 static
1517 void
1518 hammer2_update_pmps(hammer2_dev_t *hmp)
1519 {
1520 	const hammer2_inode_data_t *ripdata;
1521 	hammer2_chain_t *parent;
1522 	hammer2_chain_t *chain;
1523 	hammer2_blockref_t bref;
1524 	hammer2_dev_t *force_local;
1525 	hammer2_pfs_t *spmp;
1526 	hammer2_pfs_t *pmp;
1527 	hammer2_key_t key_next;
1528 	int error;
1529 
1530 	/*
1531 	 * Force local mount (disassociate all PFSs from their clusters).
1532 	 * Used primarily for debugging.
1533 	 */
1534 	force_local = (hmp->hflags & HMNT2_LOCAL) ? hmp : NULL;
1535 
1536 	/*
1537 	 * Lookup mount point under the media-localized super-root.
1538 	 *
1539 	 * cluster->pmp will incorrectly point to spmp and must be fixed
1540 	 * up later on.
1541 	 */
1542 	spmp = hmp->spmp;
1543 	hammer2_inode_lock(spmp->iroot, 0);
1544 	parent = hammer2_inode_chain(spmp->iroot, 0, HAMMER2_RESOLVE_ALWAYS);
1545 	chain = hammer2_chain_lookup(&parent, &key_next,
1546 					 HAMMER2_KEY_MIN, HAMMER2_KEY_MAX,
1547 					 &error, 0);
1548 	while (chain) {
1549 		if (chain->bref.type != HAMMER2_BREF_TYPE_INODE)
1550 			continue;
1551 		if (chain->error) {
1552 			kprintf("I/O error scanning PFS labels\n");
1553 		} else {
1554 			ripdata = &chain->data->ipdata;
1555 			bref = chain->bref;
1556 
1557 			pmp = hammer2_pfsalloc(chain, ripdata,
1558 					       bref.modify_tid, force_local);
1559 		}
1560 		chain = hammer2_chain_next(&parent, chain, &key_next,
1561 					   key_next, HAMMER2_KEY_MAX,
1562 					   &error, 0);
1563 	}
1564 	if (parent) {
1565 		hammer2_chain_unlock(parent);
1566 		hammer2_chain_drop(parent);
1567 	}
1568 	hammer2_inode_unlock(spmp->iroot);
1569 }
1570 
1571 static
1572 int
1573 hammer2_remount(hammer2_dev_t *hmp, struct mount *mp, char *path __unused,
1574 		struct vnode *devvp, struct ucred *cred)
1575 {
1576 	int error;
1577 
1578 	if (hmp->ronly && (mp->mnt_kern_flag & MNTK_WANTRDWR)) {
1579 		vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);
1580 		VOP_OPEN(devvp, FREAD | FWRITE, FSCRED, NULL);
1581 		vn_unlock(devvp);
1582 		error = hammer2_recovery(hmp);
1583 		if (error == 0)
1584 			error |= hammer2_fixup_pfses(hmp);
1585 		vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);
1586 		if (error == 0) {
1587 			VOP_CLOSE(devvp, FREAD, NULL);
1588 			hmp->ronly = 0;
1589 		} else {
1590 			VOP_CLOSE(devvp, FREAD | FWRITE, NULL);
1591 		}
1592 		vn_unlock(devvp);
1593 	} else {
1594 		error = 0;
1595 	}
1596 	return error;
1597 }
1598 
1599 static
1600 int
1601 hammer2_vfs_unmount(struct mount *mp, int mntflags)
1602 {
1603 	hammer2_pfs_t *pmp;
1604 	int flags;
1605 	int error = 0;
1606 
1607 	pmp = MPTOPMP(mp);
1608 
1609 	if (pmp == NULL)
1610 		return(0);
1611 
1612 	lockmgr(&hammer2_mntlk, LK_EXCLUSIVE);
1613 
1614 	/*
1615 	 * If mount initialization proceeded far enough we must flush
1616 	 * its vnodes and sync the underlying mount points.  Three syncs
1617 	 * are required to fully flush the filesystem (freemap updates lag
1618 	 * by one flush, and one extra for safety).
1619 	 */
1620 	if (mntflags & MNT_FORCE)
1621 		flags = FORCECLOSE;
1622 	else
1623 		flags = 0;
1624 	if (pmp->iroot) {
1625 		error = vflush(mp, 0, flags);
1626 		if (error)
1627 			goto failed;
1628 		hammer2_vfs_sync(mp, MNT_WAIT);
1629 		hammer2_vfs_sync(mp, MNT_WAIT);
1630 		hammer2_vfs_sync(mp, MNT_WAIT);
1631 	}
1632 
1633 	/*
1634 	 * Cleanup the frontend support XOPS threads
1635 	 */
1636 	hammer2_xop_helper_cleanup(pmp);
1637 
1638 	if (pmp->mp)
1639 		hammer2_unmount_helper(mp, pmp, NULL);
1640 
1641 	error = 0;
1642 failed:
1643 	lockmgr(&hammer2_mntlk, LK_RELEASE);
1644 
1645 	return (error);
1646 }
1647 
1648 /*
1649  * Mount helper, hook the system mount into our PFS.
1650  * The mount lock is held.
1651  *
1652  * We must bump the mount_count on related devices for any
1653  * mounted PFSs.
1654  */
1655 static
1656 void
1657 hammer2_mount_helper(struct mount *mp, hammer2_pfs_t *pmp)
1658 {
1659 	hammer2_cluster_t *cluster;
1660 	hammer2_chain_t *rchain;
1661 	int i;
1662 
1663         mp->mnt_data = (qaddr_t)pmp;
1664 	pmp->mp = mp;
1665 
1666 	/*
1667 	 * After pmp->mp is set we have to adjust hmp->mount_count.
1668 	 */
1669 	cluster = &pmp->iroot->cluster;
1670 	for (i = 0; i < cluster->nchains; ++i) {
1671 		rchain = cluster->array[i].chain;
1672 		if (rchain == NULL)
1673 			continue;
1674 		++rchain->hmp->mount_count;
1675 	}
1676 
1677 	/*
1678 	 * Create missing Xop threads
1679 	 */
1680 	hammer2_xop_helper_create(pmp);
1681 }
1682 
1683 /*
1684  * Mount helper, unhook the system mount from our PFS.
1685  * The mount lock is held.
1686  *
1687  * If hmp is supplied a mount responsible for being the first to open
1688  * the block device failed and the block device and all PFSs using the
1689  * block device must be cleaned up.
1690  *
1691  * If pmp is supplied multiple devices might be backing the PFS and each
1692  * must be disconnected.  This might not be the last PFS using some of the
1693  * underlying devices.  Also, we have to adjust our hmp->mount_count
1694  * accounting for the devices backing the pmp which is now undergoing an
1695  * unmount.
1696  */
1697 static
1698 void
1699 hammer2_unmount_helper(struct mount *mp, hammer2_pfs_t *pmp, hammer2_dev_t *hmp)
1700 {
1701 	hammer2_cluster_t *cluster;
1702 	hammer2_chain_t *rchain;
1703 	struct vnode *devvp;
1704 	int dumpcnt;
1705 	int ronly;
1706 	int i;
1707 
1708 	/*
1709 	 * If no device supplied this is a high-level unmount and we have to
1710 	 * to disconnect the mount, adjust mount_count, and locate devices
1711 	 * that might now have no mounts.
1712 	 */
1713 	if (pmp) {
1714 		KKASSERT(hmp == NULL);
1715 		KKASSERT((void *)(intptr_t)mp->mnt_data == pmp);
1716 		pmp->mp = NULL;
1717 		mp->mnt_data = NULL;
1718 
1719 		/*
1720 		 * After pmp->mp is cleared we have to account for
1721 		 * mount_count.
1722 		 */
1723 		cluster = &pmp->iroot->cluster;
1724 		for (i = 0; i < cluster->nchains; ++i) {
1725 			rchain = cluster->array[i].chain;
1726 			if (rchain == NULL)
1727 				continue;
1728 			--rchain->hmp->mount_count;
1729 			/* scrapping hmp now may invalidate the pmp */
1730 		}
1731 again:
1732 		TAILQ_FOREACH(hmp, &hammer2_mntlist, mntentry) {
1733 			if (hmp->mount_count == 0) {
1734 				hammer2_unmount_helper(NULL, NULL, hmp);
1735 				goto again;
1736 			}
1737 		}
1738 		return;
1739 	}
1740 
1741 	/*
1742 	 * Try to terminate the block device.  We can't terminate it if
1743 	 * there are still PFSs referencing it.
1744 	 */
1745 	if (hmp->mount_count)
1746 		return;
1747 
1748 	/*
1749 	 * Decomission the network before we start messing with the
1750 	 * device and PFS.
1751 	 */
1752 	hammer2_iocom_uninit(hmp);
1753 
1754 	hammer2_bulkfree_uninit(hmp);
1755 	hammer2_pfsfree_scan(hmp, 0);
1756 #if 0
1757 	hammer2_dev_exlock(hmp);	/* XXX order */
1758 #endif
1759 
1760 	/*
1761 	 * Cycle the volume data lock as a safety (probably not needed any
1762 	 * more).  To ensure everything is out we need to flush at least
1763 	 * three times.  (1) The running of the sideq can dirty the
1764 	 * filesystem, (2) A normal flush can dirty the freemap, and
1765 	 * (3) ensure that the freemap is fully synchronized.
1766 	 *
1767 	 * The next mount's recovery scan can clean everything up but we want
1768 	 * to leave the filesystem in a 100% clean state on a normal unmount.
1769 	 */
1770 #if 0
1771 	hammer2_voldata_lock(hmp);
1772 	hammer2_voldata_unlock(hmp);
1773 #endif
1774 
1775 	/*
1776 	 * Flush whatever is left.  Unmounted but modified PFS's might still
1777 	 * have some dirty chains on them.
1778 	 */
1779 	hammer2_chain_lock(&hmp->vchain, HAMMER2_RESOLVE_ALWAYS);
1780 	hammer2_chain_lock(&hmp->fchain, HAMMER2_RESOLVE_ALWAYS);
1781 
1782 	if (hmp->fchain.flags & HAMMER2_CHAIN_FLUSH_MASK) {
1783 		hammer2_voldata_modify(hmp);
1784 		hammer2_flush(&hmp->fchain, HAMMER2_FLUSH_TOP |
1785 					    HAMMER2_FLUSH_ALL);
1786 	}
1787 	hammer2_chain_unlock(&hmp->fchain);
1788 
1789 	if (hmp->vchain.flags & HAMMER2_CHAIN_FLUSH_MASK) {
1790 		hammer2_flush(&hmp->vchain, HAMMER2_FLUSH_TOP |
1791 					    HAMMER2_FLUSH_ALL);
1792 	}
1793 	hammer2_chain_unlock(&hmp->vchain);
1794 
1795 	if ((hmp->vchain.flags | hmp->fchain.flags) &
1796 	    HAMMER2_CHAIN_FLUSH_MASK) {
1797 		kprintf("hammer2_unmount: chains left over "
1798 			"after final sync\n");
1799 		kprintf("    vchain %08x\n", hmp->vchain.flags);
1800 		kprintf("    fchain %08x\n", hmp->fchain.flags);
1801 
1802 		if (hammer2_debug & 0x0010)
1803 			Debugger("entered debugger");
1804 	}
1805 
1806 	hammer2_pfsfree_scan(hmp, 1);
1807 
1808 	KKASSERT(hmp->spmp == NULL);
1809 
1810 	/*
1811 	 * Finish up with the device vnode
1812 	 */
1813 	if ((devvp = hmp->devvp) != NULL) {
1814 		ronly = hmp->ronly;
1815 		vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);
1816 		kprintf("hammer2_unmount(A): devvp %s rbdirty %p ronly=%d\n",
1817 			hmp->devrepname, RB_ROOT(&devvp->v_rbdirty_tree),
1818 			ronly);
1819 		vinvalbuf(devvp, (ronly ? 0 : V_SAVE), 0, 0);
1820 		kprintf("hammer2_unmount(B): devvp %s rbdirty %p\n",
1821 			hmp->devrepname, RB_ROOT(&devvp->v_rbdirty_tree));
1822 		hmp->devvp = NULL;
1823 		VOP_CLOSE(devvp, (ronly ? FREAD : FREAD|FWRITE), NULL);
1824 		vn_unlock(devvp);
1825 		vrele(devvp);
1826 		devvp = NULL;
1827 	}
1828 
1829 	/*
1830 	 * Clear vchain/fchain flags that might prevent final cleanup
1831 	 * of these chains.
1832 	 */
1833 	if (hmp->vchain.flags & HAMMER2_CHAIN_MODIFIED) {
1834 		atomic_add_long(&hammer2_count_modified_chains, -1);
1835 		atomic_clear_int(&hmp->vchain.flags, HAMMER2_CHAIN_MODIFIED);
1836 		hammer2_pfs_memory_wakeup(hmp->vchain.pmp);
1837 	}
1838 	if (hmp->vchain.flags & HAMMER2_CHAIN_UPDATE) {
1839 		atomic_clear_int(&hmp->vchain.flags, HAMMER2_CHAIN_UPDATE);
1840 	}
1841 
1842 	if (hmp->fchain.flags & HAMMER2_CHAIN_MODIFIED) {
1843 		atomic_add_long(&hammer2_count_modified_chains, -1);
1844 		atomic_clear_int(&hmp->fchain.flags, HAMMER2_CHAIN_MODIFIED);
1845 		hammer2_pfs_memory_wakeup(hmp->fchain.pmp);
1846 	}
1847 	if (hmp->fchain.flags & HAMMER2_CHAIN_UPDATE) {
1848 		atomic_clear_int(&hmp->fchain.flags, HAMMER2_CHAIN_UPDATE);
1849 	}
1850 
1851 	/*
1852 	 * Final drop of embedded freemap root chain to
1853 	 * clean up fchain.core (fchain structure is not
1854 	 * flagged ALLOCATED so it is cleaned out and then
1855 	 * left to rot).
1856 	 */
1857 	hammer2_chain_drop(&hmp->fchain);
1858 
1859 	/*
1860 	 * Final drop of embedded volume root chain to clean
1861 	 * up vchain.core (vchain structure is not flagged
1862 	 * ALLOCATED so it is cleaned out and then left to
1863 	 * rot).
1864 	 */
1865 	dumpcnt = 50;
1866 	hammer2_dump_chain(&hmp->vchain, 0, &dumpcnt, 'v', (u_int)-1);
1867 	dumpcnt = 50;
1868 	hammer2_dump_chain(&hmp->fchain, 0, &dumpcnt, 'f', (u_int)-1);
1869 #if 0
1870 	hammer2_dev_unlock(hmp);
1871 #endif
1872 	hammer2_chain_drop(&hmp->vchain);
1873 
1874 	hammer2_io_cleanup(hmp, &hmp->iotree);
1875 	if (hmp->iofree_count) {
1876 		kprintf("io_cleanup: %d I/O's left hanging\n",
1877 			hmp->iofree_count);
1878 	}
1879 
1880 	TAILQ_REMOVE(&hammer2_mntlist, hmp, mntentry);
1881 	kmalloc_destroy(&hmp->mchain);
1882 	kfree(hmp, M_HAMMER2);
1883 }
1884 
1885 int
1886 hammer2_vfs_vget(struct mount *mp, struct vnode *dvp,
1887 		 ino_t ino, struct vnode **vpp)
1888 {
1889 	hammer2_xop_lookup_t *xop;
1890 	hammer2_pfs_t *pmp;
1891 	hammer2_inode_t *ip;
1892 	hammer2_tid_t inum;
1893 	int error;
1894 
1895 	inum = (hammer2_tid_t)ino & HAMMER2_DIRHASH_USERMSK;
1896 
1897 	error = 0;
1898 	pmp = MPTOPMP(mp);
1899 
1900 	/*
1901 	 * Easy if we already have it cached
1902 	 */
1903 	ip = hammer2_inode_lookup(pmp, inum);
1904 	if (ip) {
1905 		hammer2_inode_lock(ip, HAMMER2_RESOLVE_SHARED);
1906 		*vpp = hammer2_igetv(ip, &error);
1907 		hammer2_inode_unlock(ip);
1908 		hammer2_inode_drop(ip);		/* from lookup */
1909 
1910 		return error;
1911 	}
1912 
1913 	/*
1914 	 * Otherwise we have to find the inode
1915 	 */
1916 	xop = hammer2_xop_alloc(pmp->iroot, 0);
1917 	xop->lhc = inum;
1918 	hammer2_xop_start(&xop->head, &hammer2_lookup_desc);
1919 	error = hammer2_xop_collect(&xop->head, 0);
1920 
1921 	if (error == 0)
1922 		ip = hammer2_inode_get(pmp, &xop->head, -1, -1);
1923 	hammer2_xop_retire(&xop->head, HAMMER2_XOPMASK_VOP);
1924 
1925 	if (ip) {
1926 		*vpp = hammer2_igetv(ip, &error);
1927 		hammer2_inode_unlock(ip);
1928 	} else {
1929 		*vpp = NULL;
1930 		error = ENOENT;
1931 	}
1932 	return (error);
1933 }
1934 
1935 static
1936 int
1937 hammer2_vfs_root(struct mount *mp, struct vnode **vpp)
1938 {
1939 	hammer2_pfs_t *pmp;
1940 	struct vnode *vp;
1941 	int error;
1942 
1943 	pmp = MPTOPMP(mp);
1944 	if (pmp->iroot == NULL) {
1945 		kprintf("hammer2 (%s): no root inode\n",
1946 			mp->mnt_stat.f_mntfromname);
1947 		*vpp = NULL;
1948 		return EINVAL;
1949 	}
1950 
1951 	error = 0;
1952 	hammer2_inode_lock(pmp->iroot, HAMMER2_RESOLVE_SHARED);
1953 
1954 	while (pmp->inode_tid == 0) {
1955 		hammer2_xop_ipcluster_t *xop;
1956 		const hammer2_inode_meta_t *meta;
1957 
1958 		xop = hammer2_xop_alloc(pmp->iroot, HAMMER2_XOP_MODIFYING);
1959 		hammer2_xop_start(&xop->head, &hammer2_ipcluster_desc);
1960 		error = hammer2_xop_collect(&xop->head, 0);
1961 
1962 		if (error == 0) {
1963 			meta = &hammer2_xop_gdata(&xop->head)->ipdata.meta;
1964 			pmp->iroot->meta = *meta;
1965 			pmp->inode_tid = meta->pfs_inum + 1;
1966 			hammer2_xop_pdata(&xop->head);
1967 			/* meta invalid */
1968 
1969 			if (pmp->inode_tid < HAMMER2_INODE_START)
1970 				pmp->inode_tid = HAMMER2_INODE_START;
1971 			pmp->modify_tid =
1972 				xop->head.cluster.focus->bref.modify_tid + 1;
1973 #if 0
1974 			kprintf("PFS: Starting inode %jd\n",
1975 				(intmax_t)pmp->inode_tid);
1976 			kprintf("PMP focus good set nextino=%ld mod=%016jx\n",
1977 				pmp->inode_tid, pmp->modify_tid);
1978 #endif
1979 			wakeup(&pmp->iroot);
1980 
1981 			hammer2_xop_retire(&xop->head, HAMMER2_XOPMASK_VOP);
1982 
1983 			/*
1984 			 * Prime the mount info.
1985 			 */
1986 			hammer2_vfs_statfs(mp, &mp->mnt_stat, NULL);
1987 			break;
1988 		}
1989 
1990 		/*
1991 		 * Loop, try again
1992 		 */
1993 		hammer2_xop_retire(&xop->head, HAMMER2_XOPMASK_VOP);
1994 		hammer2_inode_unlock(pmp->iroot);
1995 		error = tsleep(&pmp->iroot, PCATCH, "h2root", hz);
1996 		hammer2_inode_lock(pmp->iroot, HAMMER2_RESOLVE_SHARED);
1997 		if (error == EINTR)
1998 			break;
1999 	}
2000 
2001 	if (error) {
2002 		hammer2_inode_unlock(pmp->iroot);
2003 		*vpp = NULL;
2004 	} else {
2005 		vp = hammer2_igetv(pmp->iroot, &error);
2006 		hammer2_inode_unlock(pmp->iroot);
2007 		*vpp = vp;
2008 	}
2009 
2010 	return (error);
2011 }
2012 
2013 /*
2014  * Filesystem status
2015  *
2016  * XXX incorporate ipdata->meta.inode_quota and data_quota
2017  */
2018 static
2019 int
2020 hammer2_vfs_statfs(struct mount *mp, struct statfs *sbp, struct ucred *cred)
2021 {
2022 	hammer2_pfs_t *pmp;
2023 	hammer2_dev_t *hmp;
2024 	hammer2_blockref_t bref;
2025 	struct statfs tmp;
2026 	int i;
2027 
2028 	/*
2029 	 * NOTE: iroot might not have validated the cluster yet.
2030 	 */
2031 	pmp = MPTOPMP(mp);
2032 
2033 	bzero(&tmp, sizeof(tmp));
2034 
2035 	for (i = 0; i < pmp->iroot->cluster.nchains; ++i) {
2036 		hmp = pmp->pfs_hmps[i];
2037 		if (hmp == NULL)
2038 			continue;
2039 		if (pmp->iroot->cluster.array[i].chain)
2040 			bref = pmp->iroot->cluster.array[i].chain->bref;
2041 		else
2042 			bzero(&bref, sizeof(bref));
2043 
2044 		tmp.f_files = bref.embed.stats.inode_count;
2045 		tmp.f_ffree = 0;
2046 		tmp.f_blocks = hmp->voldata.allocator_size /
2047 			       mp->mnt_vstat.f_bsize;
2048 		tmp.f_bfree = hmp->voldata.allocator_free /
2049 			      mp->mnt_vstat.f_bsize;
2050 		tmp.f_bavail = tmp.f_bfree;
2051 
2052 		if (cred && cred->cr_uid != 0) {
2053 			uint64_t adj;
2054 
2055 			/* 5% */
2056 			adj = hmp->free_reserved / mp->mnt_vstat.f_bsize;
2057 			tmp.f_blocks -= adj;
2058 			tmp.f_bfree -= adj;
2059 			tmp.f_bavail -= adj;
2060 		}
2061 
2062 		mp->mnt_stat.f_blocks = tmp.f_blocks;
2063 		mp->mnt_stat.f_bfree = tmp.f_bfree;
2064 		mp->mnt_stat.f_bavail = tmp.f_bavail;
2065 		mp->mnt_stat.f_files = tmp.f_files;
2066 		mp->mnt_stat.f_ffree = tmp.f_ffree;
2067 
2068 		*sbp = mp->mnt_stat;
2069 	}
2070 	return (0);
2071 }
2072 
2073 static
2074 int
2075 hammer2_vfs_statvfs(struct mount *mp, struct statvfs *sbp, struct ucred *cred)
2076 {
2077 	hammer2_pfs_t *pmp;
2078 	hammer2_dev_t *hmp;
2079 	hammer2_blockref_t bref;
2080 	struct statvfs tmp;
2081 	int i;
2082 
2083 	/*
2084 	 * NOTE: iroot might not have validated the cluster yet.
2085 	 */
2086 	pmp = MPTOPMP(mp);
2087 	bzero(&tmp, sizeof(tmp));
2088 
2089 	for (i = 0; i < pmp->iroot->cluster.nchains; ++i) {
2090 		hmp = pmp->pfs_hmps[i];
2091 		if (hmp == NULL)
2092 			continue;
2093 		if (pmp->iroot->cluster.array[i].chain)
2094 			bref = pmp->iroot->cluster.array[i].chain->bref;
2095 		else
2096 			bzero(&bref, sizeof(bref));
2097 
2098 		tmp.f_files = bref.embed.stats.inode_count;
2099 		tmp.f_ffree = 0;
2100 		tmp.f_blocks = hmp->voldata.allocator_size /
2101 			       mp->mnt_vstat.f_bsize;
2102 		tmp.f_bfree = hmp->voldata.allocator_free /
2103 			      mp->mnt_vstat.f_bsize;
2104 		tmp.f_bavail = tmp.f_bfree;
2105 
2106 		if (cred && cred->cr_uid != 0) {
2107 			uint64_t adj;
2108 
2109 			/* 5% */
2110 			adj = hmp->free_reserved / mp->mnt_vstat.f_bsize;
2111 			tmp.f_blocks -= adj;
2112 			tmp.f_bfree -= adj;
2113 			tmp.f_bavail -= adj;
2114 		}
2115 
2116 		mp->mnt_vstat.f_blocks = tmp.f_blocks;
2117 		mp->mnt_vstat.f_bfree = tmp.f_bfree;
2118 		mp->mnt_vstat.f_bavail = tmp.f_bavail;
2119 		mp->mnt_vstat.f_files = tmp.f_files;
2120 		mp->mnt_vstat.f_ffree = tmp.f_ffree;
2121 
2122 		*sbp = mp->mnt_vstat;
2123 	}
2124 	return (0);
2125 }
2126 
2127 /*
2128  * Mount-time recovery (RW mounts)
2129  *
2130  * Updates to the free block table are allowed to lag flushes by one
2131  * transaction.  In case of a crash, then on a fresh mount we must do an
2132  * incremental scan of the last committed transaction id and make sure that
2133  * all related blocks have been marked allocated.
2134  *
2135  * The super-root topology and each PFS has its own transaction id domain,
2136  * so we must track PFS boundary transitions.
2137  */
2138 struct hammer2_recovery_elm {
2139 	TAILQ_ENTRY(hammer2_recovery_elm) entry;
2140 	hammer2_chain_t *chain;
2141 	hammer2_tid_t sync_tid;
2142 };
2143 
2144 TAILQ_HEAD(hammer2_recovery_list, hammer2_recovery_elm);
2145 
2146 struct hammer2_recovery_info {
2147 	struct hammer2_recovery_list list;
2148 	hammer2_tid_t	mtid;
2149 	int	depth;
2150 };
2151 
2152 static int hammer2_recovery_scan(hammer2_dev_t *hmp,
2153 			hammer2_chain_t *parent,
2154 			struct hammer2_recovery_info *info,
2155 			hammer2_tid_t sync_tid);
2156 
2157 #define HAMMER2_RECOVERY_MAXDEPTH	10
2158 
2159 static
2160 int
2161 hammer2_recovery(hammer2_dev_t *hmp)
2162 {
2163 	struct hammer2_recovery_info info;
2164 	struct hammer2_recovery_elm *elm;
2165 	hammer2_chain_t *parent;
2166 	hammer2_tid_t sync_tid;
2167 	hammer2_tid_t mirror_tid;
2168 	int error;
2169 
2170 	hammer2_trans_init(hmp->spmp, 0);
2171 
2172 	sync_tid = hmp->voldata.freemap_tid;
2173 	mirror_tid = hmp->voldata.mirror_tid;
2174 
2175 	kprintf("hammer2 mount \"%s\": ", hmp->devrepname);
2176 	if (sync_tid >= mirror_tid) {
2177 		kprintf(" no recovery needed\n");
2178 	} else {
2179 		kprintf(" freemap recovery %016jx-%016jx\n",
2180 			sync_tid + 1, mirror_tid);
2181 	}
2182 
2183 	TAILQ_INIT(&info.list);
2184 	info.depth = 0;
2185 	parent = hammer2_chain_lookup_init(&hmp->vchain, 0);
2186 	error = hammer2_recovery_scan(hmp, parent, &info, sync_tid);
2187 	hammer2_chain_lookup_done(parent);
2188 
2189 	while ((elm = TAILQ_FIRST(&info.list)) != NULL) {
2190 		TAILQ_REMOVE(&info.list, elm, entry);
2191 		parent = elm->chain;
2192 		sync_tid = elm->sync_tid;
2193 		kfree(elm, M_HAMMER2);
2194 
2195 		hammer2_chain_lock(parent, HAMMER2_RESOLVE_ALWAYS);
2196 		error |= hammer2_recovery_scan(hmp, parent, &info,
2197 					      hmp->voldata.freemap_tid);
2198 		hammer2_chain_unlock(parent);
2199 		hammer2_chain_drop(parent);	/* drop elm->chain ref */
2200 	}
2201 
2202 	hammer2_trans_done(hmp->spmp, 0);
2203 
2204 	return error;
2205 }
2206 
2207 static
2208 int
2209 hammer2_recovery_scan(hammer2_dev_t *hmp, hammer2_chain_t *parent,
2210 		      struct hammer2_recovery_info *info,
2211 		      hammer2_tid_t sync_tid)
2212 {
2213 	const hammer2_inode_data_t *ripdata;
2214 	hammer2_chain_t *chain;
2215 	hammer2_blockref_t bref;
2216 	int tmp_error;
2217 	int rup_error;
2218 	int error;
2219 	int first;
2220 
2221 	/*
2222 	 * Adjust freemap to ensure that the block(s) are marked allocated.
2223 	 */
2224 	if (parent->bref.type != HAMMER2_BREF_TYPE_VOLUME) {
2225 		hammer2_freemap_adjust(hmp, &parent->bref,
2226 				       HAMMER2_FREEMAP_DORECOVER);
2227 	}
2228 
2229 	/*
2230 	 * Check type for recursive scan
2231 	 */
2232 	switch(parent->bref.type) {
2233 	case HAMMER2_BREF_TYPE_VOLUME:
2234 		/* data already instantiated */
2235 		break;
2236 	case HAMMER2_BREF_TYPE_INODE:
2237 		/*
2238 		 * Must instantiate data for DIRECTDATA test and also
2239 		 * for recursion.
2240 		 */
2241 		hammer2_chain_lock(parent, HAMMER2_RESOLVE_ALWAYS);
2242 		ripdata = &hammer2_chain_rdata(parent)->ipdata;
2243 		if (ripdata->meta.op_flags & HAMMER2_OPFLAG_DIRECTDATA) {
2244 			/* not applicable to recovery scan */
2245 			hammer2_chain_unlock(parent);
2246 			return 0;
2247 		}
2248 		hammer2_chain_unlock(parent);
2249 		break;
2250 	case HAMMER2_BREF_TYPE_INDIRECT:
2251 		/*
2252 		 * Must instantiate data for recursion
2253 		 */
2254 		hammer2_chain_lock(parent, HAMMER2_RESOLVE_ALWAYS);
2255 		hammer2_chain_unlock(parent);
2256 		break;
2257 	case HAMMER2_BREF_TYPE_DIRENT:
2258 	case HAMMER2_BREF_TYPE_DATA:
2259 	case HAMMER2_BREF_TYPE_FREEMAP:
2260 	case HAMMER2_BREF_TYPE_FREEMAP_NODE:
2261 	case HAMMER2_BREF_TYPE_FREEMAP_LEAF:
2262 		/* not applicable to recovery scan */
2263 		return 0;
2264 		break;
2265 	default:
2266 		return HAMMER2_ERROR_BADBREF;
2267 	}
2268 
2269 	/*
2270 	 * Defer operation if depth limit reached or if we are crossing a
2271 	 * PFS boundary.
2272 	 */
2273 	if (info->depth >= HAMMER2_RECOVERY_MAXDEPTH) {
2274 		struct hammer2_recovery_elm *elm;
2275 
2276 		elm = kmalloc(sizeof(*elm), M_HAMMER2, M_ZERO | M_WAITOK);
2277 		elm->chain = parent;
2278 		elm->sync_tid = sync_tid;
2279 		hammer2_chain_ref(parent);
2280 		TAILQ_INSERT_TAIL(&info->list, elm, entry);
2281 		/* unlocked by caller */
2282 
2283 		return(0);
2284 	}
2285 
2286 
2287 	/*
2288 	 * Recursive scan of the last flushed transaction only.  We are
2289 	 * doing this without pmp assignments so don't leave the chains
2290 	 * hanging around after we are done with them.
2291 	 *
2292 	 * error	Cumulative error this level only
2293 	 * rup_error	Cumulative error for recursion
2294 	 * tmp_error	Specific non-cumulative recursion error
2295 	 */
2296 	chain = NULL;
2297 	first = 1;
2298 	rup_error = 0;
2299 	error = 0;
2300 
2301 	for (;;) {
2302 		error |= hammer2_chain_scan(parent, &chain, &bref,
2303 					    &first,
2304 					    HAMMER2_LOOKUP_NODATA);
2305 
2306 		/*
2307 		 * Problem during scan or EOF
2308 		 */
2309 		if (error)
2310 			break;
2311 
2312 		/*
2313 		 * If this is a leaf
2314 		 */
2315 		if (chain == NULL) {
2316 			if (bref.mirror_tid > sync_tid) {
2317 				hammer2_freemap_adjust(hmp, &bref,
2318 						     HAMMER2_FREEMAP_DORECOVER);
2319 			}
2320 			continue;
2321 		}
2322 
2323 		/*
2324 		 * This may or may not be a recursive node.
2325 		 */
2326 		atomic_set_int(&chain->flags, HAMMER2_CHAIN_RELEASE);
2327 		if (bref.mirror_tid > sync_tid) {
2328 			++info->depth;
2329 			tmp_error = hammer2_recovery_scan(hmp, chain,
2330 							   info, sync_tid);
2331 			--info->depth;
2332 		} else {
2333 			tmp_error = 0;
2334 		}
2335 
2336 		/*
2337 		 * Flush the recovery at the PFS boundary to stage it for
2338 		 * the final flush of the super-root topology.
2339 		 */
2340 		if (tmp_error == 0 &&
2341 		    (bref.flags & HAMMER2_BREF_FLAG_PFSROOT) &&
2342 		    (chain->flags & HAMMER2_CHAIN_ONFLUSH)) {
2343 			hammer2_flush(chain, HAMMER2_FLUSH_TOP |
2344 					     HAMMER2_FLUSH_ALL);
2345 		}
2346 		rup_error |= tmp_error;
2347 	}
2348 	return ((error | rup_error) & ~HAMMER2_ERROR_EOF);
2349 }
2350 
2351 /*
2352  * This fixes up an error introduced in earlier H2 implementations where
2353  * moving a PFS inode into an indirect block wound up causing the
2354  * HAMMER2_BREF_FLAG_PFSROOT flag in the bref to get cleared.
2355  */
2356 static
2357 int
2358 hammer2_fixup_pfses(hammer2_dev_t *hmp)
2359 {
2360 	const hammer2_inode_data_t *ripdata;
2361 	hammer2_chain_t *parent;
2362 	hammer2_chain_t *chain;
2363 	hammer2_key_t key_next;
2364 	hammer2_pfs_t *spmp;
2365 	int error;
2366 
2367 	error = 0;
2368 
2369 	/*
2370 	 * Lookup mount point under the media-localized super-root.
2371 	 *
2372 	 * cluster->pmp will incorrectly point to spmp and must be fixed
2373 	 * up later on.
2374 	 */
2375 	spmp = hmp->spmp;
2376 	hammer2_inode_lock(spmp->iroot, 0);
2377 	parent = hammer2_inode_chain(spmp->iroot, 0, HAMMER2_RESOLVE_ALWAYS);
2378 	chain = hammer2_chain_lookup(&parent, &key_next,
2379 					 HAMMER2_KEY_MIN, HAMMER2_KEY_MAX,
2380 					 &error, 0);
2381 	while (chain) {
2382 		if (chain->bref.type != HAMMER2_BREF_TYPE_INODE)
2383 			continue;
2384 		if (chain->error) {
2385 			kprintf("I/O error scanning PFS labels\n");
2386 			error |= chain->error;
2387 		} else if ((chain->bref.flags &
2388 			    HAMMER2_BREF_FLAG_PFSROOT) == 0) {
2389 			int error2;
2390 
2391 			ripdata = &chain->data->ipdata;
2392 			hammer2_trans_init(hmp->spmp, 0);
2393 			error2 = hammer2_chain_modify(chain,
2394 						      chain->bref.modify_tid,
2395 						      0, 0);
2396 			if (error2 == 0) {
2397 				kprintf("hammer2: Correct mis-flagged PFS %s\n",
2398 					ripdata->filename);
2399 				chain->bref.flags |= HAMMER2_BREF_FLAG_PFSROOT;
2400 			} else {
2401 				error |= error2;
2402 			}
2403 			hammer2_flush(chain, HAMMER2_FLUSH_TOP |
2404 					     HAMMER2_FLUSH_ALL);
2405 			hammer2_trans_done(hmp->spmp, 0);
2406 		}
2407 		chain = hammer2_chain_next(&parent, chain, &key_next,
2408 					   key_next, HAMMER2_KEY_MAX,
2409 					   &error, 0);
2410 	}
2411 	if (parent) {
2412 		hammer2_chain_unlock(parent);
2413 		hammer2_chain_drop(parent);
2414 	}
2415 	hammer2_inode_unlock(spmp->iroot);
2416 
2417 	return error;
2418 }
2419 
2420 /*
2421  * Sync a mount point; this is called periodically on a per-mount basis from
2422  * the filesystem syncer, and whenever a user issues a sync.
2423  */
2424 int
2425 hammer2_vfs_sync(struct mount *mp, int waitfor)
2426 {
2427 	int error;
2428 
2429 	error = hammer2_vfs_sync_pmp(MPTOPMP(mp), waitfor);
2430 
2431 	return error;
2432 }
2433 
2434 /*
2435  * Because frontend operations lock vnodes before we get a chance to
2436  * lock the related inode, we can't just acquire a vnode lock without
2437  * risking a deadlock.  The frontend may be holding a vnode lock while
2438  * also blocked on our SYNCQ flag while trying to get the inode lock.
2439  *
2440  * To deal with this situation we can check the vnode lock situation
2441  * after locking the inode and perform a work-around.
2442  */
2443 int
2444 hammer2_vfs_sync_pmp(hammer2_pfs_t *pmp, int waitfor)
2445 {
2446 	struct mount *mp;
2447 	/*hammer2_xop_flush_t *xop;*/
2448 	/*struct hammer2_sync_info info;*/
2449 	hammer2_inode_t *ip;
2450 	hammer2_depend_t *depend;
2451 	hammer2_depend_t *depend_next;
2452 	struct vnode *vp;
2453 	uint32_t pass2;
2454 	int error;
2455 	int dorestart;
2456 
2457 	mp = pmp->mp;
2458 
2459 	/*
2460 	 * Move all inodes on sideq to syncq.  This will clear sideq.
2461 	 * This should represent all flushable inodes.  These inodes
2462 	 * will already have refs due to being on syncq or sideq.  We
2463 	 * must do this all at once with the spinlock held to ensure that
2464 	 * all inode dependencies are part of the same flush.
2465 	 *
2466 	 * We should be able to do this asynchronously from frontend
2467 	 * operations because we will be locking the inodes later on
2468 	 * to actually flush them, and that will partition any frontend
2469 	 * op using the same inode.  Either it has already locked the
2470 	 * inode and we will block, or it has not yet locked the inode
2471 	 * and it will block until we are finished flushing that inode.
2472 	 *
2473 	 * When restarting, only move the inodes flagged as PASS2 from
2474 	 * SIDEQ to SYNCQ.  PASS2 propagation by inode_lock4() and
2475 	 * inode_depend() are atomic with the spin-lock.
2476 	 */
2477 	hammer2_trans_init(pmp, HAMMER2_TRANS_ISFLUSH);
2478 #ifdef HAMMER2_DEBUG_SYNC
2479 	kprintf("FILESYSTEM SYNC BOUNDARY\n");
2480 #endif
2481 	dorestart = 0;
2482 
2483 	/*
2484 	 * Move inodes from depq to syncq, releasing the related
2485 	 * depend structures.
2486 	 */
2487 restart:
2488 #ifdef HAMMER2_DEBUG_SYNC
2489 	kprintf("FILESYSTEM SYNC RESTART (%d)\n", dorestart);
2490 #endif
2491 	hammer2_trans_setflags(pmp, 0/*HAMMER2_TRANS_COPYQ*/);
2492 	hammer2_trans_clearflags(pmp, HAMMER2_TRANS_RESCAN);
2493 
2494 	/*
2495 	 * Move inodes from depq to syncq.  When restarting, only depq's
2496 	 * marked pass2 are moved.
2497 	 */
2498 	hammer2_spin_ex(&pmp->list_spin);
2499 	depend_next = TAILQ_FIRST(&pmp->depq);
2500 
2501 	while ((depend = depend_next) != NULL) {
2502 		depend_next = TAILQ_NEXT(depend, entry);
2503 		if (dorestart && depend->pass2 == 0)
2504 			continue;
2505 		TAILQ_FOREACH(ip, &depend->sideq, entry) {
2506 			KKASSERT(ip->flags & HAMMER2_INODE_SIDEQ);
2507 			atomic_set_int(&ip->flags, HAMMER2_INODE_SYNCQ);
2508 			atomic_clear_int(&ip->flags, HAMMER2_INODE_SIDEQ);
2509 			ip->depend = NULL;
2510 		}
2511 		TAILQ_CONCAT(&pmp->syncq, &depend->sideq, entry);
2512 		pmp->sideq_count -= depend->count;
2513 		depend->count = 0;
2514 		depend->pass2 = 0;
2515 		TAILQ_REMOVE(&pmp->depq, depend, entry);
2516 	}
2517 
2518 	hammer2_spin_unex(&pmp->list_spin);
2519 	hammer2_trans_clearflags(pmp, /*HAMMER2_TRANS_COPYQ |*/
2520 				      HAMMER2_TRANS_WAITING);
2521 	dorestart = 0;
2522 
2523 	/*
2524 	 * sideq_count may have dropped enough to allow us to unstall
2525 	 * the frontend.
2526 	 */
2527 	hammer2_pfs_memory_inc(pmp);
2528 	hammer2_pfs_memory_wakeup(pmp);
2529 
2530 	/*
2531 	 * Now run through all inodes on syncq.
2532 	 *
2533 	 * Flush transactions only interlock with other flush transactions.
2534 	 * Any conflicting frontend operations will block on the inode, but
2535 	 * may hold a vnode lock while doing so.
2536 	 */
2537 	hammer2_spin_ex(&pmp->list_spin);
2538 	while ((ip = TAILQ_FIRST(&pmp->syncq)) != NULL) {
2539 		/*
2540 		 * Remove the inode from the SYNCQ, transfer the syncq ref
2541 		 * to us.  We must clear SYNCQ to allow any potential
2542 		 * front-end deadlock to proceed.  We must set PASS2 so
2543 		 * the dependency code knows what to do.
2544 		 */
2545 		pass2 = ip->flags;
2546 		cpu_ccfence();
2547 		if (atomic_cmpset_int(&ip->flags,
2548 			      pass2,
2549 			      (pass2 & ~(HAMMER2_INODE_SYNCQ |
2550 					 HAMMER2_INODE_SYNCQ_WAKEUP)) |
2551 			      HAMMER2_INODE_SYNCQ_PASS2) == 0) {
2552 			continue;
2553 		}
2554 		TAILQ_REMOVE(&pmp->syncq, ip, entry);
2555 		hammer2_spin_unex(&pmp->list_spin);
2556 		if (pass2 & HAMMER2_INODE_SYNCQ_WAKEUP)
2557 			wakeup(&ip->flags);
2558 
2559 		/*
2560 		 * Relock the inode, and we inherit a ref from the above.
2561 		 * We will check for a race after we acquire the vnode.
2562 		 */
2563 		hammer2_mtx_ex(&ip->lock);
2564 
2565 		/*
2566 		 * We need the vp in order to vfsync() dirty buffers, so if
2567 		 * one isn't attached we can skip it.
2568 		 *
2569 		 * Ordering the inode lock and then the vnode lock has the
2570 		 * potential to deadlock.  If we had left SYNCQ set that could
2571 		 * also deadlock us against the frontend even if we don't hold
2572 		 * any locks, but the latter is not a problem now since we
2573 		 * cleared it.  igetv will temporarily release the inode lock
2574 		 * in a safe manner to work-around the deadlock.
2575 		 *
2576 		 * Unfortunately it is still possible to deadlock when the
2577 		 * frontend obtains multiple inode locks, because all the
2578 		 * related vnodes are already locked (nor can the vnode locks
2579 		 * be released and reacquired without messing up RECLAIM and
2580 		 * INACTIVE sequencing).
2581 		 *
2582 		 * The solution for now is to move the vp back onto SIDEQ
2583 		 * and set dorestart, which will restart the flush after we
2584 		 * exhaust the current SYNCQ.  Note that additional
2585 		 * dependencies may build up, so we definitely need to move
2586 		 * the whole SIDEQ back to SYNCQ when we restart.
2587 		 */
2588 		vp = ip->vp;
2589 		if (vp) {
2590 			if (vget(vp, LK_EXCLUSIVE|LK_NOWAIT)) {
2591 				/*
2592 				 * Failed to get the vnode, requeue the inode
2593 				 * (PASS2 is already set so it will be found
2594 				 * again on the restart).
2595 				 *
2596 				 * Then unlock, possibly sleep, and retry
2597 				 * later.  We sleep if PASS2 was *previously*
2598 				 * set, before we set it again above.
2599 				 */
2600 				vp = NULL;
2601 				dorestart = 1;
2602 #ifdef HAMMER2_DEBUG_SYNC
2603 				kprintf("inum %ld (sync delayed by vnode)\n",
2604 					(long)ip->meta.inum);
2605 #endif
2606 				hammer2_inode_delayed_sideq(ip);
2607 
2608 				hammer2_mtx_unlock(&ip->lock);
2609 				hammer2_inode_drop(ip);
2610 
2611 				if (pass2 & HAMMER2_INODE_SYNCQ_PASS2) {
2612 					tsleep(&dorestart, 0, "h2syndel", 2);
2613 				}
2614 				hammer2_spin_ex(&pmp->list_spin);
2615 				continue;
2616 			}
2617 		} else {
2618 			vp = NULL;
2619 		}
2620 
2621 		/*
2622 		 * If the inode wound up on a SIDEQ again it will already be
2623 		 * prepped for another PASS2.  In this situation if we flush
2624 		 * it now we will just wind up flushing it again in the same
2625 		 * syncer run, so we might as well not flush it now.
2626 		 */
2627 		if (ip->flags & HAMMER2_INODE_SIDEQ) {
2628 			hammer2_mtx_unlock(&ip->lock);
2629 			hammer2_inode_drop(ip);
2630 			if (vp)
2631 				vput(vp);
2632 			dorestart = 1;
2633 			hammer2_spin_ex(&pmp->list_spin);
2634 			continue;
2635 		}
2636 
2637 		/*
2638 		 * Ok we have the inode exclusively locked and if vp is
2639 		 * not NULL that will also be exclusively locked.  Do the
2640 		 * meat of the flush.
2641 		 *
2642 		 * vp token needed for v_rbdirty_tree check / vclrisdirty
2643 		 * sequencing.  Though we hold the vnode exclusively so
2644 		 * we shouldn't need to hold the token also in this case.
2645 		 */
2646 		if (vp) {
2647 			vfsync(vp, MNT_WAIT, 1, NULL, NULL);
2648 			bio_track_wait(&vp->v_track_write, 0, 0); /* XXX */
2649 		}
2650 
2651 		/*
2652 		 * If the inode has not yet been inserted into the tree
2653 		 * we must do so.  Then sync and flush it.  The flush should
2654 		 * update the parent.
2655 		 */
2656 		if (ip->flags & HAMMER2_INODE_DELETING) {
2657 #ifdef HAMMER2_DEBUG_SYNC
2658 			kprintf("inum %ld destroy\n", (long)ip->meta.inum);
2659 #endif
2660 			hammer2_inode_chain_des(ip);
2661 			atomic_add_long(&hammer2_iod_inode_deletes, 1);
2662 		} else if (ip->flags & HAMMER2_INODE_CREATING) {
2663 #ifdef HAMMER2_DEBUG_SYNC
2664 			kprintf("inum %ld insert\n", (long)ip->meta.inum);
2665 #endif
2666 			hammer2_inode_chain_ins(ip);
2667 			atomic_add_long(&hammer2_iod_inode_creates, 1);
2668 		}
2669 #ifdef HAMMER2_DEBUG_SYNC
2670 		kprintf("inum %ld chain-sync\n", (long)ip->meta.inum);
2671 #endif
2672 
2673 		/*
2674 		 * Because I kinda messed up the design and index the inodes
2675 		 * under the root inode, along side the directory entries,
2676 		 * we can't flush the inode index under the iroot until the
2677 		 * end.  If we do it now we might miss effects created by
2678 		 * other inodes on the SYNCQ.
2679 		 *
2680 		 * Do a normal (non-FSSYNC) flush instead, which allows the
2681 		 * vnode code to work the same.  We don't want to force iroot
2682 		 * back onto the SIDEQ, and we also don't want the flush code
2683 		 * to update pfs_iroot_blocksets until the final flush later.
2684 		 *
2685 		 * XXX at the moment this will likely result in a double-flush
2686 		 * of the iroot chain.
2687 		 */
2688 		hammer2_inode_chain_sync(ip);
2689 		if (ip == pmp->iroot) {
2690 			hammer2_inode_chain_flush(ip, HAMMER2_XOP_INODE_STOP);
2691 		} else {
2692 			hammer2_inode_chain_flush(ip, HAMMER2_XOP_INODE_STOP |
2693 						      HAMMER2_XOP_FSSYNC);
2694 		}
2695 		if (vp) {
2696 			lwkt_gettoken(&vp->v_token);
2697 			if ((ip->flags & (HAMMER2_INODE_MODIFIED |
2698 					  HAMMER2_INODE_RESIZED |
2699 					  HAMMER2_INODE_DIRTYDATA)) == 0 &&
2700 			    RB_EMPTY(&vp->v_rbdirty_tree) &&
2701 			    !bio_track_active(&vp->v_track_write)) {
2702 				vclrisdirty(vp);
2703 			} else {
2704 				hammer2_inode_delayed_sideq(ip);
2705 			}
2706 			lwkt_reltoken(&vp->v_token);
2707 			vput(vp);
2708 			vp = NULL;	/* safety */
2709 		}
2710 		atomic_clear_int(&ip->flags, HAMMER2_INODE_SYNCQ_PASS2);
2711 		hammer2_inode_unlock(ip);	/* unlock+drop */
2712 		/* ip pointer invalid */
2713 
2714 		/*
2715 		 * If the inode got dirted after we dropped our locks,
2716 		 * it will have already been moved back to the SIDEQ.
2717 		 */
2718 		hammer2_spin_ex(&pmp->list_spin);
2719 	}
2720 	hammer2_spin_unex(&pmp->list_spin);
2721 	if (dorestart || (pmp->trans.flags & HAMMER2_TRANS_RESCAN)) {
2722 #ifdef HAMMER2_DEBUG_SYNC
2723 		kprintf("FILESYSTEM SYNC STAGE 1 RESTART\n");
2724 		/*tsleep(&dorestart, 0, "h2STG1-R", hz*20);*/
2725 #endif
2726 		dorestart = 1;
2727 		goto restart;
2728 	}
2729 #ifdef HAMMER2_DEBUG_SYNC
2730 	kprintf("FILESYSTEM SYNC STAGE 2 BEGIN\n");
2731 	/*tsleep(&dorestart, 0, "h2STG2", hz*20);*/
2732 #endif
2733 
2734 	/*
2735 	 * We have to flush the PFS root last, even if it does not appear to
2736 	 * be dirty, because all the inodes in the PFS are indexed under it.
2737 	 * The normal flushing of iroot above would only occur if directory
2738 	 * entries under the root were changed.
2739 	 *
2740 	 * Specifying VOLHDR will cause an additionl flush of hmp->spmp
2741 	 * for the media making up the cluster.
2742 	 */
2743 	if ((ip = pmp->iroot) != NULL) {
2744 		hammer2_inode_ref(ip);
2745 		hammer2_mtx_ex(&ip->lock);
2746 		hammer2_inode_chain_sync(ip);
2747 		hammer2_inode_chain_flush(ip, HAMMER2_XOP_INODE_STOP |
2748 					      HAMMER2_XOP_FSSYNC |
2749 					      HAMMER2_XOP_VOLHDR);
2750 		hammer2_inode_unlock(ip);	/* unlock+drop */
2751 	}
2752 #ifdef HAMMER2_DEBUG_SYNC
2753 	kprintf("FILESYSTEM SYNC STAGE 2 DONE\n");
2754 #endif
2755 
2756 	/*
2757 	 * device bioq sync
2758 	 */
2759 	hammer2_bioq_sync(pmp);
2760 
2761 #if 0
2762 	info.pass = 1;
2763 	info.waitfor = MNT_WAIT;
2764 	vsyncscan(mp, flags, hammer2_sync_scan2, &info);
2765 
2766 	info.pass = 2;
2767 	info.waitfor = MNT_WAIT;
2768 	vsyncscan(mp, flags, hammer2_sync_scan2, &info);
2769 #endif
2770 #if 0
2771 	/*
2772 	 * Generally speaking we now want to flush the media topology from
2773 	 * the iroot through to the inodes.  The flush stops at any inode
2774 	 * boundary, which allows the frontend to continue running concurrent
2775 	 * modifying operations on inodes (including kernel flushes of
2776 	 * buffers) without interfering with the main sync.
2777 	 *
2778 	 * Use the XOP interface to concurrently flush all nodes to
2779 	 * synchronize the PFSROOT subtopology to the media.  A standard
2780 	 * end-of-scan ENOENT error indicates cluster sufficiency.
2781 	 *
2782 	 * Note that this flush will not be visible on crash recovery until
2783 	 * we flush the super-root topology in the next loop.
2784 	 *
2785 	 * XXX For now wait for all flushes to complete.
2786 	 */
2787 	if (mp && (ip = pmp->iroot) != NULL) {
2788 		/*
2789 		 * If unmounting try to flush everything including any
2790 		 * sub-trees under inodes, just in case there is dangling
2791 		 * modified data, as a safety.  Otherwise just flush up to
2792 		 * the inodes in this stage.
2793 		 */
2794 		kprintf("MP & IROOT\n");
2795 #ifdef HAMMER2_DEBUG_SYNC
2796 		kprintf("FILESYSTEM SYNC STAGE 3 IROOT BEGIN\n");
2797 #endif
2798 		if (mp->mnt_kern_flag & MNTK_UNMOUNT) {
2799 			xop = hammer2_xop_alloc(ip, HAMMER2_XOP_MODIFYING |
2800 						    HAMMER2_XOP_VOLHDR |
2801 						    HAMMER2_XOP_FSSYNC |
2802 						    HAMMER2_XOP_INODE_STOP);
2803 		} else {
2804 			xop = hammer2_xop_alloc(ip, HAMMER2_XOP_MODIFYING |
2805 						    HAMMER2_XOP_INODE_STOP |
2806 						    HAMMER2_XOP_VOLHDR |
2807 						    HAMMER2_XOP_FSSYNC |
2808 						    HAMMER2_XOP_INODE_STOP);
2809 		}
2810 		hammer2_xop_start(&xop->head, &hammer2_inode_flush_desc);
2811 		error = hammer2_xop_collect(&xop->head,
2812 					    HAMMER2_XOP_COLLECT_WAITALL);
2813 		hammer2_xop_retire(&xop->head, HAMMER2_XOPMASK_VOP);
2814 #ifdef HAMMER2_DEBUG_SYNC
2815 		kprintf("FILESYSTEM SYNC STAGE 3 IROOT END\n");
2816 #endif
2817 		if (error == HAMMER2_ERROR_ENOENT)
2818 			error = 0;
2819 		else
2820 			error = hammer2_error_to_errno(error);
2821 	} else {
2822 		error = 0;
2823 	}
2824 #endif
2825 	error = 0;	/* XXX */
2826 	hammer2_trans_done(pmp, HAMMER2_TRANS_ISFLUSH);
2827 
2828 	return (error);
2829 }
2830 
2831 static
2832 int
2833 hammer2_vfs_vptofh(struct vnode *vp, struct fid *fhp)
2834 {
2835 	hammer2_inode_t *ip;
2836 
2837 	KKASSERT(MAXFIDSZ >= 16);
2838 	ip = VTOI(vp);
2839 	fhp->fid_len = offsetof(struct fid, fid_data[16]);
2840 	fhp->fid_ext = 0;
2841 	((hammer2_tid_t *)fhp->fid_data)[0] = ip->meta.inum;
2842 	((hammer2_tid_t *)fhp->fid_data)[1] = 0;
2843 
2844 	return 0;
2845 }
2846 
2847 static
2848 int
2849 hammer2_vfs_fhtovp(struct mount *mp, struct vnode *rootvp,
2850 	       struct fid *fhp, struct vnode **vpp)
2851 {
2852 	hammer2_pfs_t *pmp;
2853 	hammer2_tid_t inum;
2854 	int error;
2855 
2856 	pmp = MPTOPMP(mp);
2857 	inum = ((hammer2_tid_t *)fhp->fid_data)[0] & HAMMER2_DIRHASH_USERMSK;
2858 	if (vpp) {
2859 		if (inum == 1)
2860 			error = hammer2_vfs_root(mp, vpp);
2861 		else
2862 			error = hammer2_vfs_vget(mp, NULL, inum, vpp);
2863 	} else {
2864 		error = 0;
2865 	}
2866 	if (error)
2867 		kprintf("fhtovp: %016jx -> %p, %d\n", inum, *vpp, error);
2868 	return error;
2869 }
2870 
2871 static
2872 int
2873 hammer2_vfs_checkexp(struct mount *mp, struct sockaddr *nam,
2874 		 int *exflagsp, struct ucred **credanonp)
2875 {
2876 	hammer2_pfs_t *pmp;
2877 	struct netcred *np;
2878 	int error;
2879 
2880 	pmp = MPTOPMP(mp);
2881 	np = vfs_export_lookup(mp, &pmp->export, nam);
2882 	if (np) {
2883 		*exflagsp = np->netc_exflags;
2884 		*credanonp = &np->netc_anon;
2885 		error = 0;
2886 	} else {
2887 		error = EACCES;
2888 	}
2889 	return error;
2890 }
2891 
2892 /*
2893  * Support code for hammer2_vfs_mount().  Read, verify, and install the volume
2894  * header into the HMP
2895  *
2896  * XXX read four volhdrs and use the one with the highest TID whos CRC
2897  *     matches.
2898  *
2899  * XXX check iCRCs.
2900  *
2901  * XXX For filesystems w/ less than 4 volhdrs, make sure to not write to
2902  *     nonexistant locations.
2903  *
2904  * XXX Record selected volhdr and ring updates to each of 4 volhdrs
2905  */
2906 static
2907 int
2908 hammer2_install_volume_header(hammer2_dev_t *hmp)
2909 {
2910 	hammer2_volume_data_t *vd;
2911 	struct buf *bp;
2912 	hammer2_crc32_t crc0, crc, bcrc0, bcrc;
2913 	int error_reported;
2914 	int error;
2915 	int valid;
2916 	int i;
2917 
2918 	error_reported = 0;
2919 	error = 0;
2920 	valid = 0;
2921 	bp = NULL;
2922 
2923 	/*
2924 	 * There are up to 4 copies of the volume header (syncs iterate
2925 	 * between them so there is no single master).  We don't trust the
2926 	 * volu_size field so we don't know precisely how large the filesystem
2927 	 * is, so depend on the OS to return an error if we go beyond the
2928 	 * block device's EOF.
2929 	 */
2930 	for (i = 0; i < HAMMER2_NUM_VOLHDRS; i++) {
2931 		error = bread(hmp->devvp, i * HAMMER2_ZONE_BYTES64,
2932 			      HAMMER2_VOLUME_BYTES, &bp);
2933 		if (error) {
2934 			brelse(bp);
2935 			bp = NULL;
2936 			continue;
2937 		}
2938 
2939 		vd = (struct hammer2_volume_data *) bp->b_data;
2940 		if ((vd->magic != HAMMER2_VOLUME_ID_HBO) &&
2941 		    (vd->magic != HAMMER2_VOLUME_ID_ABO)) {
2942 			brelse(bp);
2943 			bp = NULL;
2944 			continue;
2945 		}
2946 
2947 		if (vd->magic == HAMMER2_VOLUME_ID_ABO) {
2948 			/* XXX: Reversed-endianness filesystem */
2949 			kprintf("hammer2: reverse-endian filesystem detected");
2950 			brelse(bp);
2951 			bp = NULL;
2952 			continue;
2953 		}
2954 
2955 		crc = vd->icrc_sects[HAMMER2_VOL_ICRC_SECT0];
2956 		crc0 = hammer2_icrc32(bp->b_data + HAMMER2_VOLUME_ICRC0_OFF,
2957 				      HAMMER2_VOLUME_ICRC0_SIZE);
2958 		bcrc = vd->icrc_sects[HAMMER2_VOL_ICRC_SECT1];
2959 		bcrc0 = hammer2_icrc32(bp->b_data + HAMMER2_VOLUME_ICRC1_OFF,
2960 				       HAMMER2_VOLUME_ICRC1_SIZE);
2961 		if ((crc0 != crc) || (bcrc0 != bcrc)) {
2962 			kprintf("hammer2 volume header crc "
2963 				"mismatch copy #%d %08x/%08x\n",
2964 				i, crc0, crc);
2965 			error_reported = 1;
2966 			brelse(bp);
2967 			bp = NULL;
2968 			continue;
2969 		}
2970 		if (valid == 0 || hmp->voldata.mirror_tid < vd->mirror_tid) {
2971 			valid = 1;
2972 			hmp->voldata = *vd;
2973 			hmp->volhdrno = i;
2974 		}
2975 		brelse(bp);
2976 		bp = NULL;
2977 	}
2978 	if (valid) {
2979 		hmp->volsync = hmp->voldata;
2980 		hmp->free_reserved = hmp->voldata.allocator_size / 20;
2981 		error = 0;
2982 		if (error_reported || bootverbose || 1) { /* 1/DEBUG */
2983 			kprintf("hammer2: using volume header #%d\n",
2984 				hmp->volhdrno);
2985 		}
2986 	} else {
2987 		error = EINVAL;
2988 		kprintf("hammer2: no valid volume headers found!\n");
2989 	}
2990 	return (error);
2991 }
2992 
2993 /*
2994  * This handles hysteresis on regular file flushes.  Because the BIOs are
2995  * routed to a thread it is possible for an excessive number to build up
2996  * and cause long front-end stalls long before the runningbuffspace limit
2997  * is hit, so we implement hammer2_flush_pipe to control the
2998  * hysteresis.
2999  *
3000  * This is a particular problem when compression is used.
3001  */
3002 void
3003 hammer2_lwinprog_ref(hammer2_pfs_t *pmp)
3004 {
3005 	atomic_add_int(&pmp->count_lwinprog, 1);
3006 }
3007 
3008 void
3009 hammer2_lwinprog_drop(hammer2_pfs_t *pmp)
3010 {
3011 	int lwinprog;
3012 
3013 	lwinprog = atomic_fetchadd_int(&pmp->count_lwinprog, -1);
3014 	if ((lwinprog & HAMMER2_LWINPROG_WAITING) &&
3015 	    (lwinprog & HAMMER2_LWINPROG_MASK) <= hammer2_flush_pipe * 2 / 3) {
3016 		atomic_clear_int(&pmp->count_lwinprog,
3017 				 HAMMER2_LWINPROG_WAITING);
3018 		wakeup(&pmp->count_lwinprog);
3019 	}
3020 	if ((lwinprog & HAMMER2_LWINPROG_WAITING0) &&
3021 	    (lwinprog & HAMMER2_LWINPROG_MASK) <= 0) {
3022 		atomic_clear_int(&pmp->count_lwinprog,
3023 				 HAMMER2_LWINPROG_WAITING0);
3024 		wakeup(&pmp->count_lwinprog);
3025 	}
3026 }
3027 
3028 void
3029 hammer2_lwinprog_wait(hammer2_pfs_t *pmp, int flush_pipe)
3030 {
3031 	int lwinprog;
3032 	int lwflag = (flush_pipe) ? HAMMER2_LWINPROG_WAITING :
3033 				    HAMMER2_LWINPROG_WAITING0;
3034 
3035 	for (;;) {
3036 		lwinprog = pmp->count_lwinprog;
3037 		cpu_ccfence();
3038 		if ((lwinprog & HAMMER2_LWINPROG_MASK) <= flush_pipe)
3039 			break;
3040 		tsleep_interlock(&pmp->count_lwinprog, 0);
3041 		atomic_set_int(&pmp->count_lwinprog, lwflag);
3042 		lwinprog = pmp->count_lwinprog;
3043 		if ((lwinprog & HAMMER2_LWINPROG_MASK) <= flush_pipe)
3044 			break;
3045 		tsleep(&pmp->count_lwinprog, PINTERLOCKED, "h2wpipe", hz);
3046 	}
3047 }
3048 
3049 /*
3050  * It is possible for an excessive number of dirty chains or dirty inodes
3051  * to build up.  When this occurs we start an asynchronous filesystem sync.
3052  * If the level continues to build up, we stall, waiting for it to drop,
3053  * with some hysteresis.
3054  *
3055  * We limit the stall to two seconds per call.
3056  *
3057  * This relies on the kernel calling hammer2_vfs_modifying() prior to
3058  * obtaining any vnode locks before making a modifying VOP call.
3059  */
3060 static void
3061 hammer2_vfs_modifying(struct mount *mp)
3062 {
3063 	hammer2_pfs_memory_wait(MPTOPMP(mp));
3064 }
3065 
3066 /*
3067  * Initiate an asynchronous filesystem sync and, with hysteresis,
3068  * stall if the internal data structure count becomes too bloated.
3069  */
3070 void
3071 hammer2_pfs_memory_wait(hammer2_pfs_t *pmp)
3072 {
3073 	uint32_t waiting;
3074 	int loops;
3075 
3076 	if (pmp == NULL || pmp->mp == NULL)
3077 		return;
3078 
3079 	for (loops = 0; loops < 2; ++loops) {
3080 		waiting = pmp->inmem_dirty_chains & HAMMER2_DIRTYCHAIN_MASK;
3081 		cpu_ccfence();
3082 
3083 		/*
3084 		 * Start the syncer running at 1/2 the limit
3085 		 */
3086 		if (waiting > hammer2_limit_dirty_chains / 2 ||
3087 		    pmp->sideq_count > hammer2_limit_dirty_inodes / 2) {
3088 			trigger_syncer(pmp->mp);
3089 		}
3090 
3091 		/*
3092 		 * Stall at the limit waiting for the counts to drop.
3093 		 * This code will typically be woken up once the count
3094 		 * drops below 3/4 the limit, or in one second.
3095 		 */
3096 		if (waiting < hammer2_limit_dirty_chains &&
3097 		    pmp->sideq_count < hammer2_limit_dirty_inodes) {
3098 			break;
3099 		}
3100 		tsleep_interlock(&pmp->inmem_dirty_chains, 0);
3101 		atomic_set_int(&pmp->inmem_dirty_chains,
3102 			       HAMMER2_DIRTYCHAIN_WAITING);
3103 		if (waiting < hammer2_limit_dirty_chains &&
3104 		    pmp->sideq_count < hammer2_limit_dirty_inodes) {
3105 			break;
3106 		}
3107 		trigger_syncer(pmp->mp);
3108 		tsleep(&pmp->inmem_dirty_chains, PINTERLOCKED, "h2memw", hz);
3109 #if 0
3110 		limit = pmp->mp->mnt_nvnodelistsize / 10;
3111 		if (limit < hammer2_limit_dirty_chains)
3112 			limit = hammer2_limit_dirty_chains;
3113 		if (limit < 1000)
3114 			limit = 1000;
3115 #endif
3116 	}
3117 }
3118 
3119 void
3120 hammer2_pfs_memory_inc(hammer2_pfs_t *pmp)
3121 {
3122 	if (pmp) {
3123 		atomic_add_int(&pmp->inmem_dirty_chains, 1);
3124 	}
3125 }
3126 
3127 void
3128 hammer2_pfs_memory_wakeup(hammer2_pfs_t *pmp)
3129 {
3130 	uint32_t waiting;
3131 
3132 	if (pmp) {
3133 		waiting = atomic_fetchadd_int(&pmp->inmem_dirty_chains, -1);
3134 		/* don't need --waiting to test flag */
3135 
3136 		if ((waiting & HAMMER2_DIRTYCHAIN_WAITING) &&
3137 		    (pmp->inmem_dirty_chains & HAMMER2_DIRTYCHAIN_MASK) <=
3138 		    hammer2_limit_dirty_chains * 2 / 3 &&
3139 		    pmp->sideq_count <= hammer2_limit_dirty_inodes * 2 / 3) {
3140 			atomic_clear_int(&pmp->inmem_dirty_chains,
3141 					 HAMMER2_DIRTYCHAIN_WAITING);
3142 			wakeup(&pmp->inmem_dirty_chains);
3143 		}
3144 	}
3145 }
3146 
3147 /*
3148  * Returns 0 if the filesystem has tons of free space
3149  * Returns 1 if the filesystem has less than 10% remaining
3150  * Returns 2 if the filesystem has less than 2%/5% (user/root) remaining.
3151  */
3152 int
3153 hammer2_vfs_enospace(hammer2_inode_t *ip, off_t bytes, struct ucred *cred)
3154 {
3155 	hammer2_pfs_t *pmp;
3156 	hammer2_dev_t *hmp;
3157 	hammer2_off_t free_reserved;
3158 	hammer2_off_t free_nominal;
3159 	int i;
3160 
3161 	pmp = ip->pmp;
3162 
3163 	if (pmp->free_ticks == 0 || pmp->free_ticks != ticks) {
3164 		free_reserved = HAMMER2_SEGSIZE;
3165 		free_nominal = 0x7FFFFFFFFFFFFFFFLLU;
3166 		for (i = 0; i < pmp->iroot->cluster.nchains; ++i) {
3167 			hmp = pmp->pfs_hmps[i];
3168 			if (hmp == NULL)
3169 				continue;
3170 			if (pmp->pfs_types[i] != HAMMER2_PFSTYPE_MASTER &&
3171 			    pmp->pfs_types[i] != HAMMER2_PFSTYPE_SOFT_MASTER)
3172 				continue;
3173 
3174 			if (free_nominal > hmp->voldata.allocator_free)
3175 				free_nominal = hmp->voldata.allocator_free;
3176 			if (free_reserved < hmp->free_reserved)
3177 				free_reserved = hmp->free_reserved;
3178 		}
3179 
3180 		/*
3181 		 * SMP races ok
3182 		 */
3183 		pmp->free_reserved = free_reserved;
3184 		pmp->free_nominal = free_nominal;
3185 		pmp->free_ticks = ticks;
3186 	} else {
3187 		free_reserved = pmp->free_reserved;
3188 		free_nominal = pmp->free_nominal;
3189 	}
3190 	if (cred && cred->cr_uid != 0) {
3191 		if ((int64_t)(free_nominal - bytes) <
3192 		    (int64_t)free_reserved) {
3193 			return 2;
3194 		}
3195 	} else {
3196 		if ((int64_t)(free_nominal - bytes) <
3197 		    (int64_t)free_reserved / 2) {
3198 			return 2;
3199 		}
3200 	}
3201 	if ((int64_t)(free_nominal - bytes) < (int64_t)free_reserved * 2)
3202 		return 1;
3203 	return 0;
3204 }
3205 
3206 /*
3207  * Debugging
3208  */
3209 void
3210 hammer2_dump_chain(hammer2_chain_t *chain, int tab, int *countp, char pfx,
3211 		   u_int flags)
3212 {
3213 	hammer2_chain_t *scan;
3214 	hammer2_chain_t *parent;
3215 
3216 	--*countp;
3217 	if (*countp == 0) {
3218 		kprintf("%*.*s...\n", tab, tab, "");
3219 		return;
3220 	}
3221 	if (*countp < 0)
3222 		return;
3223 	kprintf("%*.*s%c-chain %p.%d %016jx/%d mir=%016jx\n",
3224 		tab, tab, "", pfx,
3225 		chain, chain->bref.type,
3226 		chain->bref.key, chain->bref.keybits,
3227 		chain->bref.mirror_tid);
3228 
3229 	kprintf("%*.*s      [%08x] (%s) refs=%d",
3230 		tab, tab, "",
3231 		chain->flags,
3232 		((chain->bref.type == HAMMER2_BREF_TYPE_INODE &&
3233 		chain->data) ?  (char *)chain->data->ipdata.filename : "?"),
3234 		chain->refs);
3235 
3236 	parent = chain->parent;
3237 	if (parent)
3238 		kprintf("\n%*.*s      p=%p [pflags %08x prefs %d",
3239 			tab, tab, "",
3240 			parent, parent->flags, parent->refs);
3241 	if (RB_EMPTY(&chain->core.rbtree)) {
3242 		kprintf("\n");
3243 	} else {
3244 		kprintf(" {\n");
3245 		RB_FOREACH(scan, hammer2_chain_tree, &chain->core.rbtree) {
3246 			if ((scan->flags & flags) || flags == (u_int)-1) {
3247 				hammer2_dump_chain(scan, tab + 4, countp, 'a',
3248 						   flags);
3249 			}
3250 		}
3251 		if (chain->bref.type == HAMMER2_BREF_TYPE_INODE && chain->data)
3252 			kprintf("%*.*s}(%s)\n", tab, tab, "",
3253 				chain->data->ipdata.filename);
3254 		else
3255 			kprintf("%*.*s}\n", tab, tab, "");
3256 	}
3257 }
3258