1 /* Copyright (c) Mark Harmstone 2016-17
2  *
3  * This file is part of WinBtrfs.
4  *
5  * WinBtrfs is free software: you can redistribute it and/or modify
6  * it under the terms of the GNU Lesser General Public Licence as published by
7  * the Free Software Foundation, either version 3 of the Licence, or
8  * (at your option) any later version.
9  *
10  * WinBtrfs is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU Lesser General Public Licence for more details.
14  *
15  * You should have received a copy of the GNU Lesser General Public Licence
16  * along with WinBtrfs.  If not, see <http://www.gnu.org/licenses/>. */
17 
18 #include "btrfs_drv.h"
19 #include <ata.h>
20 #include <ntddscsi.h>
21 #include <ntddstor.h>
22 
23 #define MAX_CSUM_SIZE (4096 - sizeof(tree_header) - sizeof(leaf_node))
24 
25 // #define DEBUG_WRITE_LOOPS
26 
27 typedef struct {
28     KEVENT Event;
29     IO_STATUS_BLOCK iosb;
30 } write_context;
31 
32 typedef struct {
33     EXTENT_ITEM_TREE eit;
34     UINT8 type;
35     TREE_BLOCK_REF tbr;
36 } EXTENT_ITEM_TREE2;
37 
38 typedef struct {
39     EXTENT_ITEM ei;
40     UINT8 type;
41     TREE_BLOCK_REF tbr;
42 } EXTENT_ITEM_SKINNY_METADATA;
43 
44 static NTSTATUS create_chunk(device_extension* Vcb, chunk* c, PIRP Irp);
45 static NTSTATUS update_tree_extents(device_extension* Vcb, tree* t, PIRP Irp, LIST_ENTRY* rollback);
46 
47 #ifndef _MSC_VER // not in mingw yet
48 #define DEVICE_DSM_FLAG_TRIM_NOT_FS_ALLOCATED 0x80000000
49 #endif
50 
51 _Function_class_(IO_COMPLETION_ROUTINE)
52 #ifdef __REACTOS__
53 static NTSTATUS NTAPI write_completion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID conptr) {
54 #else
55 static NTSTATUS write_completion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID conptr) {
56 #endif
57     write_context* context = conptr;
58 
59     UNUSED(DeviceObject);
60 
61     context->iosb = Irp->IoStatus;
62     KeSetEvent(&context->Event, 0, FALSE);
63 
64     return STATUS_MORE_PROCESSING_REQUIRED;
65 }
66 
67 NTSTATUS write_data_phys(_In_ PDEVICE_OBJECT device, _In_ UINT64 address, _In_reads_bytes_(length) void* data, _In_ UINT32 length) {
68     NTSTATUS Status;
69     LARGE_INTEGER offset;
70     PIRP Irp;
71     PIO_STACK_LOCATION IrpSp;
72     write_context context;
73 
74     TRACE("(%p, %llx, %p, %x)\n", device, address, data, length);
75 
76     RtlZeroMemory(&context, sizeof(write_context));
77 
78     KeInitializeEvent(&context.Event, NotificationEvent, FALSE);
79 
80     offset.QuadPart = address;
81 
82     Irp = IoAllocateIrp(device->StackSize, FALSE);
83 
84     if (!Irp) {
85         ERR("IoAllocateIrp failed\n");
86         return STATUS_INSUFFICIENT_RESOURCES;
87     }
88 
89     IrpSp = IoGetNextIrpStackLocation(Irp);
90     IrpSp->MajorFunction = IRP_MJ_WRITE;
91 
92     if (device->Flags & DO_BUFFERED_IO) {
93         Irp->AssociatedIrp.SystemBuffer = data;
94 
95         Irp->Flags = IRP_BUFFERED_IO;
96     } else if (device->Flags & DO_DIRECT_IO) {
97         Irp->MdlAddress = IoAllocateMdl(data, length, FALSE, FALSE, NULL);
98         if (!Irp->MdlAddress) {
99             DbgPrint("IoAllocateMdl failed\n");
100             Status = STATUS_INSUFFICIENT_RESOURCES;
101             goto exit;
102         }
103 
104         Status = STATUS_SUCCESS;
105 
106         _SEH2_TRY {
107             MmProbeAndLockPages(Irp->MdlAddress, KernelMode, IoReadAccess);
108         } _SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER) {
109             Status = _SEH2_GetExceptionCode();
110         } _SEH2_END;
111 
112         if (!NT_SUCCESS(Status)) {
113             ERR("MmProbeAndLockPages threw exception %08x\n", Status);
114             IoFreeMdl(Irp->MdlAddress);
115             goto exit;
116         }
117     } else {
118         Irp->UserBuffer = data;
119     }
120 
121     IrpSp->Parameters.Write.Length = length;
122     IrpSp->Parameters.Write.ByteOffset = offset;
123 
124     Irp->UserIosb = &context.iosb;
125 
126     Irp->UserEvent = &context.Event;
127 
128     IoSetCompletionRoutine(Irp, write_completion, &context, TRUE, TRUE, TRUE);
129 
130     Status = IoCallDriver(device, Irp);
131 
132     if (Status == STATUS_PENDING) {
133         KeWaitForSingleObject(&context.Event, Executive, KernelMode, FALSE, NULL);
134         Status = context.iosb.Status;
135     }
136 
137     if (!NT_SUCCESS(Status)) {
138         ERR("IoCallDriver returned %08x\n", Status);
139     }
140 
141     if (device->Flags & DO_DIRECT_IO) {
142         MmUnlockPages(Irp->MdlAddress);
143         IoFreeMdl(Irp->MdlAddress);
144     }
145 
146 exit:
147     IoFreeIrp(Irp);
148 
149     return Status;
150 }
151 
152 static void add_trim_entry(device* dev, UINT64 address, UINT64 size) {
153     space* s = ExAllocatePoolWithTag(PagedPool, sizeof(space), ALLOC_TAG);
154     if (!s) {
155         ERR("out of memory\n");
156         return;
157     }
158 
159     s->address = address;
160     s->size = size;
161     dev->num_trim_entries++;
162 
163     InsertTailList(&dev->trim_list, &s->list_entry);
164 }
165 
166 static void clean_space_cache_chunk(device_extension* Vcb, chunk* c) {
167     ULONG type;
168 
169     if (Vcb->trim && !Vcb->options.no_trim) {
170         if (c->chunk_item->type & BLOCK_FLAG_DUPLICATE)
171             type = BLOCK_FLAG_DUPLICATE;
172         else if (c->chunk_item->type & BLOCK_FLAG_RAID0)
173             type = BLOCK_FLAG_RAID0;
174         else if (c->chunk_item->type & BLOCK_FLAG_RAID1)
175             type = BLOCK_FLAG_DUPLICATE;
176         else if (c->chunk_item->type & BLOCK_FLAG_RAID10)
177             type = BLOCK_FLAG_RAID10;
178         else if (c->chunk_item->type & BLOCK_FLAG_RAID5)
179             type = BLOCK_FLAG_RAID5;
180         else if (c->chunk_item->type & BLOCK_FLAG_RAID6)
181             type = BLOCK_FLAG_RAID6;
182         else // SINGLE
183             type = BLOCK_FLAG_DUPLICATE;
184     }
185 
186     while (!IsListEmpty(&c->deleting)) {
187         space* s = CONTAINING_RECORD(c->deleting.Flink, space, list_entry);
188 
189         if (Vcb->trim && !Vcb->options.no_trim && (!Vcb->options.no_barrier || !(c->chunk_item->type & BLOCK_FLAG_METADATA))) {
190             CHUNK_ITEM_STRIPE* cis = (CHUNK_ITEM_STRIPE*)&c->chunk_item[1];
191 
192             if (type == BLOCK_FLAG_DUPLICATE) {
193                 UINT16 i;
194 
195                 for (i = 0; i < c->chunk_item->num_stripes; i++) {
196                     if (c->devices[i] && c->devices[i]->devobj && !c->devices[i]->readonly && c->devices[i]->trim)
197                         add_trim_entry(c->devices[i], s->address - c->offset + cis[i].offset, s->size);
198                 }
199             } else if (type == BLOCK_FLAG_RAID0) {
200                 UINT64 startoff, endoff;
201                 UINT16 startoffstripe, endoffstripe, i;
202 
203                 get_raid0_offset(s->address - c->offset, c->chunk_item->stripe_length, c->chunk_item->num_stripes, &startoff, &startoffstripe);
204                 get_raid0_offset(s->address - c->offset + s->size - 1, c->chunk_item->stripe_length, c->chunk_item->num_stripes, &endoff, &endoffstripe);
205 
206                 for (i = 0; i < c->chunk_item->num_stripes; i++) {
207                     if (c->devices[i] && c->devices[i]->devobj && !c->devices[i]->readonly && c->devices[i]->trim) {
208                         UINT64 stripestart, stripeend;
209 
210                         if (startoffstripe > i)
211                             stripestart = startoff - (startoff % c->chunk_item->stripe_length) + c->chunk_item->stripe_length;
212                         else if (startoffstripe == i)
213                             stripestart = startoff;
214                         else
215                             stripestart = startoff - (startoff % c->chunk_item->stripe_length);
216 
217                         if (endoffstripe > i)
218                             stripeend = endoff - (endoff % c->chunk_item->stripe_length) + c->chunk_item->stripe_length;
219                         else if (endoffstripe == i)
220                             stripeend = endoff + 1;
221                         else
222                             stripeend = endoff - (endoff % c->chunk_item->stripe_length);
223 
224                         if (stripestart != stripeend)
225                             add_trim_entry(c->devices[i], stripestart + cis[i].offset, stripeend - stripestart);
226                     }
227                 }
228             } else if (type == BLOCK_FLAG_RAID10) {
229                 UINT64 startoff, endoff;
230                 UINT16 sub_stripes, startoffstripe, endoffstripe, i;
231 
232                 sub_stripes = max(1, c->chunk_item->sub_stripes);
233 
234                 get_raid0_offset(s->address - c->offset, c->chunk_item->stripe_length, c->chunk_item->num_stripes / sub_stripes, &startoff, &startoffstripe);
235                 get_raid0_offset(s->address - c->offset + s->size - 1, c->chunk_item->stripe_length, c->chunk_item->num_stripes / sub_stripes, &endoff, &endoffstripe);
236 
237                 startoffstripe *= sub_stripes;
238                 endoffstripe *= sub_stripes;
239 
240                 for (i = 0; i < c->chunk_item->num_stripes; i += sub_stripes) {
241                     ULONG j;
242                     UINT64 stripestart, stripeend;
243 
244                     if (startoffstripe > i)
245                         stripestart = startoff - (startoff % c->chunk_item->stripe_length) + c->chunk_item->stripe_length;
246                     else if (startoffstripe == i)
247                         stripestart = startoff;
248                     else
249                         stripestart = startoff - (startoff % c->chunk_item->stripe_length);
250 
251                     if (endoffstripe > i)
252                         stripeend = endoff - (endoff % c->chunk_item->stripe_length) + c->chunk_item->stripe_length;
253                     else if (endoffstripe == i)
254                         stripeend = endoff + 1;
255                     else
256                         stripeend = endoff - (endoff % c->chunk_item->stripe_length);
257 
258                     if (stripestart != stripeend) {
259                         for (j = 0; j < sub_stripes; j++) {
260                             if (c->devices[i+j] && c->devices[i+j]->devobj && !c->devices[i+j]->readonly && c->devices[i+j]->trim)
261                                 add_trim_entry(c->devices[i+j], stripestart + cis[i+j].offset, stripeend - stripestart);
262                         }
263                     }
264                 }
265             }
266             // FIXME - RAID5(?), RAID6(?)
267         }
268 
269         RemoveEntryList(&s->list_entry);
270         ExFreePool(s);
271     }
272 }
273 
274 typedef struct {
275     DEVICE_MANAGE_DATA_SET_ATTRIBUTES* dmdsa;
276     ATA_PASS_THROUGH_EX apte;
277     PIRP Irp;
278     IO_STATUS_BLOCK iosb;
279 } ioctl_context_stripe;
280 
281 typedef struct {
282     KEVENT Event;
283     LONG left;
284     ioctl_context_stripe* stripes;
285 } ioctl_context;
286 
287 _Function_class_(IO_COMPLETION_ROUTINE)
288 #ifdef __REACTOS__
289 static NTSTATUS NTAPI ioctl_completion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID conptr) {
290 #else
291 static NTSTATUS ioctl_completion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID conptr) {
292 #endif
293     ioctl_context* context = (ioctl_context*)conptr;
294     LONG left2 = InterlockedDecrement(&context->left);
295 
296     UNUSED(DeviceObject);
297     UNUSED(Irp);
298 
299     if (left2 == 0)
300         KeSetEvent(&context->Event, 0, FALSE);
301 
302     return STATUS_MORE_PROCESSING_REQUIRED;
303 }
304 
305 static void clean_space_cache(device_extension* Vcb) {
306     LIST_ENTRY* le;
307     chunk* c;
308     ULONG num;
309 
310     TRACE("(%p)\n", Vcb);
311 
312     ExAcquireResourceSharedLite(&Vcb->chunk_lock, TRUE);
313 
314     le = Vcb->chunks.Flink;
315     while (le != &Vcb->chunks) {
316         c = CONTAINING_RECORD(le, chunk, list_entry);
317 
318         if (c->space_changed) {
319             ExAcquireResourceExclusiveLite(&c->lock, TRUE);
320 
321             if (c->space_changed)
322                 clean_space_cache_chunk(Vcb, c);
323 
324             c->space_changed = FALSE;
325 
326             ExReleaseResourceLite(&c->lock);
327         }
328 
329         le = le->Flink;
330     }
331 
332     ExReleaseResourceLite(&Vcb->chunk_lock);
333 
334     if (Vcb->trim && !Vcb->options.no_trim) {
335         ioctl_context context;
336         ULONG total_num;
337 
338         context.left = 0;
339 
340         le = Vcb->devices.Flink;
341         while (le != &Vcb->devices) {
342             device* dev = CONTAINING_RECORD(le, device, list_entry);
343 
344             if (dev->devobj && !dev->readonly && dev->trim && dev->num_trim_entries > 0)
345                 context.left++;
346 
347             le = le->Flink;
348         }
349 
350         if (context.left == 0)
351             return;
352 
353         total_num = context.left;
354         num = 0;
355 
356         KeInitializeEvent(&context.Event, NotificationEvent, FALSE);
357 
358         context.stripes = ExAllocatePoolWithTag(NonPagedPool, sizeof(ioctl_context_stripe) * context.left, ALLOC_TAG);
359         if (!context.stripes) {
360             ERR("out of memory\n");
361             return;
362         }
363 
364         RtlZeroMemory(context.stripes, sizeof(ioctl_context_stripe) * context.left);
365 
366         le = Vcb->devices.Flink;
367         while (le != &Vcb->devices) {
368             device* dev = CONTAINING_RECORD(le, device, list_entry);
369 
370             if (dev->devobj && !dev->readonly && dev->trim && dev->num_trim_entries > 0) {
371                 LIST_ENTRY* le2;
372                 ioctl_context_stripe* stripe = &context.stripes[num];
373                 DEVICE_DATA_SET_RANGE* ranges;
374                 ULONG datalen = (ULONG)sector_align(sizeof(DEVICE_MANAGE_DATA_SET_ATTRIBUTES), sizeof(UINT64)) + (dev->num_trim_entries * sizeof(DEVICE_DATA_SET_RANGE)), i;
375                 PIO_STACK_LOCATION IrpSp;
376 
377                 stripe->dmdsa = ExAllocatePoolWithTag(PagedPool, datalen, ALLOC_TAG);
378                 if (!stripe->dmdsa) {
379                     ERR("out of memory\n");
380                     goto nextdev;
381                 }
382 
383                 stripe->dmdsa->Size = sizeof(DEVICE_MANAGE_DATA_SET_ATTRIBUTES);
384                 stripe->dmdsa->Action = DeviceDsmAction_Trim;
385                 stripe->dmdsa->Flags = DEVICE_DSM_FLAG_TRIM_NOT_FS_ALLOCATED;
386                 stripe->dmdsa->ParameterBlockOffset = 0;
387                 stripe->dmdsa->ParameterBlockLength = 0;
388                 stripe->dmdsa->DataSetRangesOffset = (ULONG)sector_align(sizeof(DEVICE_MANAGE_DATA_SET_ATTRIBUTES), sizeof(UINT64));
389                 stripe->dmdsa->DataSetRangesLength = dev->num_trim_entries * sizeof(DEVICE_DATA_SET_RANGE);
390 
391                 ranges = (DEVICE_DATA_SET_RANGE*)((UINT8*)stripe->dmdsa + stripe->dmdsa->DataSetRangesOffset);
392 
393                 i = 0;
394 
395                 le2 = dev->trim_list.Flink;
396                 while (le2 != &dev->trim_list) {
397                     space* s = CONTAINING_RECORD(le2, space, list_entry);
398 
399                     ranges[i].StartingOffset = s->address;
400                     ranges[i].LengthInBytes = s->size;
401                     i++;
402 
403                     le2 = le2->Flink;
404                 }
405 
406                 stripe->Irp = IoAllocateIrp(dev->devobj->StackSize, FALSE);
407 
408                 if (!stripe->Irp) {
409                     ERR("IoAllocateIrp failed\n");
410                     goto nextdev;
411                 }
412 
413                 IrpSp = IoGetNextIrpStackLocation(stripe->Irp);
414                 IrpSp->MajorFunction = IRP_MJ_DEVICE_CONTROL;
415 
416                 IrpSp->Parameters.DeviceIoControl.IoControlCode = IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES;
417                 IrpSp->Parameters.DeviceIoControl.InputBufferLength = datalen;
418                 IrpSp->Parameters.DeviceIoControl.OutputBufferLength = 0;
419 
420                 stripe->Irp->AssociatedIrp.SystemBuffer = stripe->dmdsa;
421                 stripe->Irp->Flags |= IRP_BUFFERED_IO;
422                 stripe->Irp->UserBuffer = NULL;
423                 stripe->Irp->UserIosb = &stripe->iosb;
424 
425                 IoSetCompletionRoutine(stripe->Irp, ioctl_completion, &context, TRUE, TRUE, TRUE);
426 
427                 IoCallDriver(dev->devobj, stripe->Irp);
428 
429 nextdev:
430                 while (!IsListEmpty(&dev->trim_list)) {
431                     space* s = CONTAINING_RECORD(RemoveHeadList(&dev->trim_list), space, list_entry);
432                     ExFreePool(s);
433                 }
434 
435                 dev->num_trim_entries = 0;
436 
437                 num++;
438             }
439 
440             le = le->Flink;
441         }
442 
443         KeWaitForSingleObject(&context.Event, Executive, KernelMode, FALSE, NULL);
444 
445         for (num = 0; num < total_num; num++) {
446             if (context.stripes[num].dmdsa)
447                 ExFreePool(context.stripes[num].dmdsa);
448         }
449 
450         ExFreePool(context.stripes);
451     }
452 }
453 
454 static BOOL trees_consistent(device_extension* Vcb) {
455     ULONG maxsize = Vcb->superblock.node_size - sizeof(tree_header);
456     LIST_ENTRY* le;
457 
458     le = Vcb->trees.Flink;
459     while (le != &Vcb->trees) {
460         tree* t = CONTAINING_RECORD(le, tree, list_entry);
461 
462         if (t->write) {
463             if (t->header.num_items == 0 && t->parent) {
464 #ifdef DEBUG_WRITE_LOOPS
465                 ERR("empty tree found, looping again\n");
466 #endif
467                 return FALSE;
468             }
469 
470             if (t->size > maxsize) {
471 #ifdef DEBUG_WRITE_LOOPS
472                 ERR("overlarge tree found (%u > %u), looping again\n", t->size, maxsize);
473 #endif
474                 return FALSE;
475             }
476 
477             if (!t->has_new_address) {
478 #ifdef DEBUG_WRITE_LOOPS
479                 ERR("tree found without new address, looping again\n");
480 #endif
481                 return FALSE;
482             }
483         }
484 
485         le = le->Flink;
486     }
487 
488     return TRUE;
489 }
490 
491 static NTSTATUS add_parents(device_extension* Vcb, PIRP Irp) {
492     ULONG level;
493     LIST_ENTRY* le;
494 
495     for (level = 0; level <= 255; level++) {
496         BOOL nothing_found = TRUE;
497 
498         TRACE("level = %u\n", level);
499 
500         le = Vcb->trees.Flink;
501         while (le != &Vcb->trees) {
502             tree* t = CONTAINING_RECORD(le, tree, list_entry);
503 
504             if (t->write && t->header.level == level) {
505                 TRACE("tree %p: root = %llx, level = %x, parent = %p\n", t, t->header.tree_id, t->header.level, t->parent);
506 
507                 nothing_found = FALSE;
508 
509                 if (t->parent) {
510                     if (!t->parent->write)
511                         TRACE("adding tree %p (level %x)\n", t->parent, t->header.level);
512 
513                     t->parent->write = TRUE;
514                 } else if (t->root != Vcb->root_root && t->root != Vcb->chunk_root) {
515                     KEY searchkey;
516                     traverse_ptr tp;
517                     NTSTATUS Status;
518 
519                     searchkey.obj_id = t->root->id;
520                     searchkey.obj_type = TYPE_ROOT_ITEM;
521                     searchkey.offset = 0xffffffffffffffff;
522 
523                     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
524                     if (!NT_SUCCESS(Status)) {
525                         ERR("error - find_item returned %08x\n", Status);
526                         return Status;
527                     }
528 
529                     if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
530                         ERR("could not find ROOT_ITEM for tree %llx\n", searchkey.obj_id);
531                         return STATUS_INTERNAL_ERROR;
532                     }
533 
534                     if (tp.item->size < sizeof(ROOT_ITEM)) { // if not full length, delete and create new entry
535                         ROOT_ITEM* ri = ExAllocatePoolWithTag(PagedPool, sizeof(ROOT_ITEM), ALLOC_TAG);
536 
537                         if (!ri) {
538                             ERR("out of memory\n");
539                             return STATUS_INSUFFICIENT_RESOURCES;
540                         }
541 
542                         RtlCopyMemory(ri, &t->root->root_item, sizeof(ROOT_ITEM));
543 
544                         Status = delete_tree_item(Vcb, &tp);
545                         if (!NT_SUCCESS(Status)) {
546                             ERR("delete_tree_item returned %08x\n", Status);
547                             ExFreePool(ri);
548                             return Status;
549                         }
550 
551                         Status = insert_tree_item(Vcb, Vcb->root_root, tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, ri, sizeof(ROOT_ITEM), NULL, Irp);
552                         if (!NT_SUCCESS(Status)) {
553                             ERR("insert_tree_item returned %08x\n", Status);
554                             ExFreePool(ri);
555                             return Status;
556                         }
557                     }
558                 }
559             }
560 
561             le = le->Flink;
562         }
563 
564         if (nothing_found)
565             break;
566     }
567 
568     return STATUS_SUCCESS;
569 }
570 
571 static void add_parents_to_cache(tree* t) {
572     while (t->parent) {
573         t = t->parent;
574         t->write = TRUE;
575     }
576 }
577 
578 static BOOL insert_tree_extent_skinny(device_extension* Vcb, UINT8 level, UINT64 root_id, chunk* c, UINT64 address, PIRP Irp, LIST_ENTRY* rollback) {
579     NTSTATUS Status;
580     EXTENT_ITEM_SKINNY_METADATA* eism;
581     traverse_ptr insert_tp;
582 
583     eism = ExAllocatePoolWithTag(PagedPool, sizeof(EXTENT_ITEM_SKINNY_METADATA), ALLOC_TAG);
584     if (!eism) {
585         ERR("out of memory\n");
586         return FALSE;
587     }
588 
589     eism->ei.refcount = 1;
590     eism->ei.generation = Vcb->superblock.generation;
591     eism->ei.flags = EXTENT_ITEM_TREE_BLOCK;
592     eism->type = TYPE_TREE_BLOCK_REF;
593     eism->tbr.offset = root_id;
594 
595     Status = insert_tree_item(Vcb, Vcb->extent_root, address, TYPE_METADATA_ITEM, level, eism, sizeof(EXTENT_ITEM_SKINNY_METADATA), &insert_tp, Irp);
596     if (!NT_SUCCESS(Status)) {
597         ERR("insert_tree_item returned %08x\n", Status);
598         ExFreePool(eism);
599         return FALSE;
600     }
601 
602     ExAcquireResourceExclusiveLite(&c->lock, TRUE);
603 
604     space_list_subtract(c, FALSE, address, Vcb->superblock.node_size, rollback);
605 
606     ExReleaseResourceLite(&c->lock);
607 
608     add_parents_to_cache(insert_tp.tree);
609 
610     return TRUE;
611 }
612 
613 BOOL find_metadata_address_in_chunk(device_extension* Vcb, chunk* c, UINT64* address) {
614     LIST_ENTRY* le;
615     space* s;
616 
617     TRACE("(%p, %llx, %p)\n", Vcb, c->offset, address);
618 
619     if (Vcb->superblock.node_size > c->chunk_item->size - c->used)
620         return FALSE;
621 
622     if (!c->cache_loaded) {
623         NTSTATUS Status = load_cache_chunk(Vcb, c, NULL);
624 
625         if (!NT_SUCCESS(Status)) {
626             ERR("load_cache_chunk returned %08x\n", Status);
627             return FALSE;
628         }
629     }
630 
631     if (IsListEmpty(&c->space_size))
632         return FALSE;
633 
634     if (!c->last_alloc_set) {
635         s = CONTAINING_RECORD(c->space.Blink, space, list_entry);
636 
637         c->last_alloc = s->address;
638         c->last_alloc_set = TRUE;
639 
640         if (s->size >= Vcb->superblock.node_size) {
641             *address = s->address;
642             c->last_alloc += Vcb->superblock.node_size;
643             return TRUE;
644         }
645     }
646 
647     le = c->space.Flink;
648     while (le != &c->space) {
649         s = CONTAINING_RECORD(le, space, list_entry);
650 
651         if (s->address <= c->last_alloc && s->address + s->size >= c->last_alloc + Vcb->superblock.node_size) {
652             *address = c->last_alloc;
653             c->last_alloc += Vcb->superblock.node_size;
654             return TRUE;
655         }
656 
657         le = le->Flink;
658     }
659 
660     le = c->space_size.Flink;
661     while (le != &c->space_size) {
662         s = CONTAINING_RECORD(le, space, list_entry_size);
663 
664         if (s->size == Vcb->superblock.node_size) {
665             *address = s->address;
666             c->last_alloc = s->address + Vcb->superblock.node_size;
667             return TRUE;
668         } else if (s->size < Vcb->superblock.node_size) {
669             if (le == c->space_size.Flink)
670                 return FALSE;
671 
672             s = CONTAINING_RECORD(le->Blink, space, list_entry_size);
673 
674             *address = s->address;
675             c->last_alloc = s->address + Vcb->superblock.node_size;
676 
677             return TRUE;
678         }
679 
680         le = le->Flink;
681     }
682 
683     s = CONTAINING_RECORD(c->space_size.Blink, space, list_entry_size);
684 
685     if (s->size > Vcb->superblock.node_size) {
686         *address = s->address;
687         c->last_alloc = s->address + Vcb->superblock.node_size;
688         return TRUE;
689     }
690 
691     return FALSE;
692 }
693 
694 static BOOL insert_tree_extent(device_extension* Vcb, UINT8 level, UINT64 root_id, chunk* c, UINT64* new_address, PIRP Irp, LIST_ENTRY* rollback) {
695     NTSTATUS Status;
696     UINT64 address;
697     EXTENT_ITEM_TREE2* eit2;
698     traverse_ptr insert_tp;
699 
700     TRACE("(%p, %x, %llx, %p, %p, %p, %p)\n", Vcb, level, root_id, c, new_address, rollback);
701 
702     if (!find_metadata_address_in_chunk(Vcb, c, &address))
703         return FALSE;
704 
705     if (Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_SKINNY_METADATA) {
706         BOOL b = insert_tree_extent_skinny(Vcb, level, root_id, c, address, Irp, rollback);
707 
708         if (b)
709             *new_address = address;
710 
711         return b;
712     }
713 
714     eit2 = ExAllocatePoolWithTag(PagedPool, sizeof(EXTENT_ITEM_TREE2), ALLOC_TAG);
715     if (!eit2) {
716         ERR("out of memory\n");
717         return FALSE;
718     }
719 
720     eit2->eit.extent_item.refcount = 1;
721     eit2->eit.extent_item.generation = Vcb->superblock.generation;
722     eit2->eit.extent_item.flags = EXTENT_ITEM_TREE_BLOCK;
723     eit2->eit.level = level;
724     eit2->type = TYPE_TREE_BLOCK_REF;
725     eit2->tbr.offset = root_id;
726 
727     Status = insert_tree_item(Vcb, Vcb->extent_root, address, TYPE_EXTENT_ITEM, Vcb->superblock.node_size, eit2, sizeof(EXTENT_ITEM_TREE2), &insert_tp, Irp);
728     if (!NT_SUCCESS(Status)) {
729         ERR("insert_tree_item returned %08x\n", Status);
730         ExFreePool(eit2);
731         return FALSE;
732     }
733 
734     ExAcquireResourceExclusiveLite(&c->lock, TRUE);
735 
736     space_list_subtract(c, FALSE, address, Vcb->superblock.node_size, rollback);
737 
738     ExReleaseResourceLite(&c->lock);
739 
740     add_parents_to_cache(insert_tp.tree);
741 
742     *new_address = address;
743 
744     return TRUE;
745 }
746 
747 NTSTATUS get_tree_new_address(device_extension* Vcb, tree* t, PIRP Irp, LIST_ENTRY* rollback) {
748     NTSTATUS Status;
749     chunk *origchunk = NULL, *c;
750     LIST_ENTRY* le;
751     UINT64 flags, addr;
752 
753     if (t->root->id == BTRFS_ROOT_CHUNK)
754         flags = Vcb->system_flags;
755     else
756         flags = Vcb->metadata_flags;
757 
758     if (t->has_address) {
759         origchunk = get_chunk_from_address(Vcb, t->header.address);
760 
761         if (origchunk && !origchunk->readonly && !origchunk->reloc && origchunk->chunk_item->type == flags &&
762             insert_tree_extent(Vcb, t->header.level, t->root->id, origchunk, &addr, Irp, rollback)) {
763             t->new_address = addr;
764             t->has_new_address = TRUE;
765             return STATUS_SUCCESS;
766         }
767     }
768 
769     ExAcquireResourceExclusiveLite(&Vcb->chunk_lock, TRUE);
770 
771     le = Vcb->chunks.Flink;
772     while (le != &Vcb->chunks) {
773         c = CONTAINING_RECORD(le, chunk, list_entry);
774 
775         if (!c->readonly && !c->reloc) {
776             ExAcquireResourceExclusiveLite(&c->lock, TRUE);
777 
778             if (c != origchunk && c->chunk_item->type == flags && (c->chunk_item->size - c->used) >= Vcb->superblock.node_size) {
779                 if (insert_tree_extent(Vcb, t->header.level, t->root->id, c, &addr, Irp, rollback)) {
780                     ExReleaseResourceLite(&c->lock);
781                     ExReleaseResourceLite(&Vcb->chunk_lock);
782                     t->new_address = addr;
783                     t->has_new_address = TRUE;
784                     return STATUS_SUCCESS;
785                 }
786             }
787 
788             ExReleaseResourceLite(&c->lock);
789         }
790 
791         le = le->Flink;
792     }
793 
794     // allocate new chunk if necessary
795 
796     Status = alloc_chunk(Vcb, flags, &c, FALSE);
797 
798     if (!NT_SUCCESS(Status)) {
799         ERR("alloc_chunk returned %08x\n", Status);
800         ExReleaseResourceLite(&Vcb->chunk_lock);
801         return Status;
802     }
803 
804     ExAcquireResourceExclusiveLite(&c->lock, TRUE);
805 
806     if ((c->chunk_item->size - c->used) >= Vcb->superblock.node_size) {
807         if (insert_tree_extent(Vcb, t->header.level, t->root->id, c, &addr, Irp, rollback)) {
808             ExReleaseResourceLite(&c->lock);
809             ExReleaseResourceLite(&Vcb->chunk_lock);
810             t->new_address = addr;
811             t->has_new_address = TRUE;
812             return STATUS_SUCCESS;
813         }
814     }
815 
816     ExReleaseResourceLite(&c->lock);
817 
818     ExReleaseResourceLite(&Vcb->chunk_lock);
819 
820     ERR("couldn't find any metadata chunks with %x bytes free\n", Vcb->superblock.node_size);
821 
822     return STATUS_DISK_FULL;
823 }
824 
825 static NTSTATUS reduce_tree_extent(device_extension* Vcb, UINT64 address, tree* t, UINT64 parent_root, UINT8 level, PIRP Irp, LIST_ENTRY* rollback) {
826     NTSTATUS Status;
827     UINT64 rc, root;
828 
829     TRACE("(%p, %llx, %p)\n", Vcb, address, t);
830 
831     rc = get_extent_refcount(Vcb, address, Vcb->superblock.node_size, Irp);
832     if (rc == 0) {
833         ERR("error - refcount for extent %llx was 0\n", address);
834         return STATUS_INTERNAL_ERROR;
835     }
836 
837     if (!t || t->parent)
838         root = parent_root;
839     else
840         root = t->header.tree_id;
841 
842     Status = decrease_extent_refcount_tree(Vcb, address, Vcb->superblock.node_size, root, level, Irp);
843     if (!NT_SUCCESS(Status)) {
844         ERR("decrease_extent_refcount_tree returned %08x\n", Status);
845         return Status;
846     }
847 
848     if (rc == 1) {
849         chunk* c = get_chunk_from_address(Vcb, address);
850 
851         if (c) {
852             ExAcquireResourceExclusiveLite(&c->lock, TRUE);
853 
854             if (!c->cache_loaded) {
855                 Status = load_cache_chunk(Vcb, c, NULL);
856 
857                 if (!NT_SUCCESS(Status)) {
858                     ERR("load_cache_chunk returned %08x\n", Status);
859                     ExReleaseResourceLite(&c->lock);
860                     return Status;
861                 }
862             }
863 
864             c->used -= Vcb->superblock.node_size;
865 
866             space_list_add(c, address, Vcb->superblock.node_size, rollback);
867 
868             ExReleaseResourceLite(&c->lock);
869         } else
870             ERR("could not find chunk for address %llx\n", address);
871     }
872 
873     return STATUS_SUCCESS;
874 }
875 
876 static NTSTATUS add_changed_extent_ref_edr(changed_extent* ce, EXTENT_DATA_REF* edr, BOOL old) {
877     LIST_ENTRY *le2, *list;
878     changed_extent_ref* cer;
879 
880     list = old ? &ce->old_refs : &ce->refs;
881 
882     le2 = list->Flink;
883     while (le2 != list) {
884         cer = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
885 
886         if (cer->type == TYPE_EXTENT_DATA_REF && cer->edr.root == edr->root && cer->edr.objid == edr->objid && cer->edr.offset == edr->offset) {
887             cer->edr.count += edr->count;
888             goto end;
889         }
890 
891         le2 = le2->Flink;
892     }
893 
894     cer = ExAllocatePoolWithTag(PagedPool, sizeof(changed_extent_ref), ALLOC_TAG);
895     if (!cer) {
896         ERR("out of memory\n");
897         return STATUS_INSUFFICIENT_RESOURCES;
898     }
899 
900     cer->type = TYPE_EXTENT_DATA_REF;
901     RtlCopyMemory(&cer->edr, edr, sizeof(EXTENT_DATA_REF));
902     InsertTailList(list, &cer->list_entry);
903 
904 end:
905     if (old)
906         ce->old_count += edr->count;
907     else
908         ce->count += edr->count;
909 
910     return STATUS_SUCCESS;
911 }
912 
913 static NTSTATUS add_changed_extent_ref_sdr(changed_extent* ce, SHARED_DATA_REF* sdr, BOOL old) {
914     LIST_ENTRY *le2, *list;
915     changed_extent_ref* cer;
916 
917     list = old ? &ce->old_refs : &ce->refs;
918 
919     le2 = list->Flink;
920     while (le2 != list) {
921         cer = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
922 
923         if (cer->type == TYPE_SHARED_DATA_REF && cer->sdr.offset == sdr->offset) {
924             cer->sdr.count += sdr->count;
925             goto end;
926         }
927 
928         le2 = le2->Flink;
929     }
930 
931     cer = ExAllocatePoolWithTag(PagedPool, sizeof(changed_extent_ref), ALLOC_TAG);
932     if (!cer) {
933         ERR("out of memory\n");
934         return STATUS_INSUFFICIENT_RESOURCES;
935     }
936 
937     cer->type = TYPE_SHARED_DATA_REF;
938     RtlCopyMemory(&cer->sdr, sdr, sizeof(SHARED_DATA_REF));
939     InsertTailList(list, &cer->list_entry);
940 
941 end:
942     if (old)
943         ce->old_count += sdr->count;
944     else
945         ce->count += sdr->count;
946 
947     return STATUS_SUCCESS;
948 }
949 
950 static BOOL shared_tree_is_unique(device_extension* Vcb, tree* t, PIRP Irp, LIST_ENTRY* rollback) {
951     KEY searchkey;
952     traverse_ptr tp;
953     NTSTATUS Status;
954 
955     if (!t->updated_extents && t->has_address) {
956         Status = update_tree_extents(Vcb, t, Irp, rollback);
957         if (!NT_SUCCESS(Status)) {
958             ERR("update_tree_extents returned %08x\n", Status);
959             return FALSE;
960         }
961     }
962 
963     searchkey.obj_id = t->header.address;
964     searchkey.obj_type = Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_SKINNY_METADATA ? TYPE_METADATA_ITEM : TYPE_EXTENT_ITEM;
965     searchkey.offset = 0xffffffffffffffff;
966 
967     Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
968     if (!NT_SUCCESS(Status)) {
969         ERR("error - find_item returned %08x\n", Status);
970         return FALSE;
971     }
972 
973     if (tp.item->key.obj_id == t->header.address && (tp.item->key.obj_type == TYPE_METADATA_ITEM || tp.item->key.obj_type == TYPE_EXTENT_ITEM))
974         return FALSE;
975     else
976         return TRUE;
977 }
978 
979 static NTSTATUS update_tree_extents(device_extension* Vcb, tree* t, PIRP Irp, LIST_ENTRY* rollback) {
980     NTSTATUS Status;
981     UINT64 rc = get_extent_refcount(Vcb, t->header.address, Vcb->superblock.node_size, Irp);
982     UINT64 flags = get_extent_flags(Vcb, t->header.address, Irp);
983 
984     if (rc == 0) {
985         ERR("refcount for extent %llx was 0\n", t->header.address);
986         return STATUS_INTERNAL_ERROR;
987     }
988 
989     if (flags & EXTENT_ITEM_SHARED_BACKREFS || t->header.flags & HEADER_FLAG_SHARED_BACKREF || !(t->header.flags & HEADER_FLAG_MIXED_BACKREF)) {
990         TREE_BLOCK_REF tbr;
991         BOOL unique = rc > 1 ? FALSE : (t->parent ? shared_tree_is_unique(Vcb, t->parent, Irp, rollback) : FALSE);
992 
993         if (t->header.level == 0) {
994             LIST_ENTRY* le;
995 
996             le = t->itemlist.Flink;
997             while (le != &t->itemlist) {
998                 tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
999 
1000                 if (!td->inserted && td->key.obj_type == TYPE_EXTENT_DATA && td->size >= sizeof(EXTENT_DATA) - 1 + sizeof(EXTENT_DATA2)) {
1001                     EXTENT_DATA* ed = (EXTENT_DATA*)td->data;
1002 
1003                     if (ed->type == EXTENT_TYPE_REGULAR || ed->type == EXTENT_TYPE_PREALLOC) {
1004                         EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ed->data;
1005 
1006                         if (ed2->size > 0) {
1007                             EXTENT_DATA_REF edr;
1008                             changed_extent* ce = NULL;
1009                             chunk* c = get_chunk_from_address(Vcb, ed2->address);
1010 
1011                             if (c) {
1012                                 LIST_ENTRY* le2;
1013 
1014                                 le2 = c->changed_extents.Flink;
1015                                 while (le2 != &c->changed_extents) {
1016                                     changed_extent* ce2 = CONTAINING_RECORD(le2, changed_extent, list_entry);
1017 
1018                                     if (ce2->address == ed2->address) {
1019                                         ce = ce2;
1020                                         break;
1021                                     }
1022 
1023                                     le2 = le2->Flink;
1024                                 }
1025                             }
1026 
1027                             edr.root = t->root->id;
1028                             edr.objid = td->key.obj_id;
1029                             edr.offset = td->key.offset - ed2->offset;
1030                             edr.count = 1;
1031 
1032                             if (ce) {
1033                                 Status = add_changed_extent_ref_edr(ce, &edr, TRUE);
1034                                 if (!NT_SUCCESS(Status)) {
1035                                     ERR("add_changed_extent_ref_edr returned %08x\n", Status);
1036                                     return Status;
1037                                 }
1038 
1039                                 Status = add_changed_extent_ref_edr(ce, &edr, FALSE);
1040                                 if (!NT_SUCCESS(Status)) {
1041                                     ERR("add_changed_extent_ref_edr returned %08x\n", Status);
1042                                     return Status;
1043                                 }
1044                             }
1045 
1046                             Status = increase_extent_refcount(Vcb, ed2->address, ed2->size, TYPE_EXTENT_DATA_REF, &edr, NULL, 0, Irp);
1047                             if (!NT_SUCCESS(Status)) {
1048                                 ERR("increase_extent_refcount returned %08x\n", Status);
1049                                 return Status;
1050                             }
1051 
1052                             if ((flags & EXTENT_ITEM_SHARED_BACKREFS && unique) || !(t->header.flags & HEADER_FLAG_MIXED_BACKREF)) {
1053                                 UINT64 sdrrc = find_extent_shared_data_refcount(Vcb, ed2->address, t->header.address, Irp);
1054 
1055                                 if (sdrrc > 0) {
1056                                     SHARED_DATA_REF sdr;
1057 
1058                                     sdr.offset = t->header.address;
1059                                     sdr.count = 1;
1060 
1061                                     Status = decrease_extent_refcount(Vcb, ed2->address, ed2->size, TYPE_SHARED_DATA_REF, &sdr, NULL, 0,
1062                                                                       t->header.address, ce ? ce->superseded : FALSE, Irp);
1063                                     if (!NT_SUCCESS(Status)) {
1064                                         ERR("decrease_extent_refcount returned %08x\n", Status);
1065                                         return Status;
1066                                     }
1067 
1068                                     if (ce) {
1069                                         LIST_ENTRY* le2;
1070 
1071                                         le2 = ce->refs.Flink;
1072                                         while (le2 != &ce->refs) {
1073                                             changed_extent_ref* cer = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
1074 
1075                                             if (cer->type == TYPE_SHARED_DATA_REF && cer->sdr.offset == sdr.offset) {
1076                                                 ce->count--;
1077                                                 cer->sdr.count--;
1078                                                 break;
1079                                             }
1080 
1081                                             le2 = le2->Flink;
1082                                         }
1083 
1084                                         le2 = ce->old_refs.Flink;
1085                                         while (le2 != &ce->old_refs) {
1086                                             changed_extent_ref* cer = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
1087 
1088                                             if (cer->type == TYPE_SHARED_DATA_REF && cer->sdr.offset == sdr.offset) {
1089                                                 ce->old_count--;
1090 
1091                                                 if (cer->sdr.count > 1)
1092                                                     cer->sdr.count--;
1093                                                 else {
1094                                                     RemoveEntryList(&cer->list_entry);
1095                                                     ExFreePool(cer);
1096                                                 }
1097 
1098                                                 break;
1099                                             }
1100 
1101                                             le2 = le2->Flink;
1102                                         }
1103                                     }
1104                                 }
1105                             }
1106 
1107                             // FIXME - clear shared flag if unique?
1108                         }
1109                     }
1110                 }
1111 
1112                 le = le->Flink;
1113             }
1114         } else {
1115             LIST_ENTRY* le;
1116 
1117             le = t->itemlist.Flink;
1118             while (le != &t->itemlist) {
1119                 tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
1120 
1121                 if (!td->inserted) {
1122                     tbr.offset = t->root->id;
1123 
1124                     Status = increase_extent_refcount(Vcb, td->treeholder.address, Vcb->superblock.node_size, TYPE_TREE_BLOCK_REF,
1125                                                       &tbr, &td->key, t->header.level - 1, Irp);
1126                     if (!NT_SUCCESS(Status)) {
1127                         ERR("increase_extent_refcount returned %08x\n", Status);
1128                         return Status;
1129                     }
1130 
1131                     if (unique || !(t->header.flags & HEADER_FLAG_MIXED_BACKREF)) {
1132                         UINT64 sbrrc = find_extent_shared_tree_refcount(Vcb, td->treeholder.address, t->header.address, Irp);
1133 
1134                         if (sbrrc > 0) {
1135                             SHARED_BLOCK_REF sbr;
1136 
1137                             sbr.offset = t->header.address;
1138 
1139                             Status = decrease_extent_refcount(Vcb, td->treeholder.address, Vcb->superblock.node_size, TYPE_SHARED_BLOCK_REF, &sbr, NULL, 0,
1140                                                               t->header.address, FALSE, Irp);
1141                             if (!NT_SUCCESS(Status)) {
1142                                 ERR("decrease_extent_refcount returned %08x\n", Status);
1143                                 return Status;
1144                             }
1145                         }
1146                     }
1147 
1148                     // FIXME - clear shared flag if unique?
1149                 }
1150 
1151                 le = le->Flink;
1152             }
1153         }
1154 
1155         if (unique) {
1156             UINT64 sbrrc = find_extent_shared_tree_refcount(Vcb, t->header.address, t->parent->header.address, Irp);
1157 
1158             if (sbrrc == 1) {
1159                 SHARED_BLOCK_REF sbr;
1160 
1161                 sbr.offset = t->parent->header.address;
1162 
1163                 Status = decrease_extent_refcount(Vcb, t->header.address, Vcb->superblock.node_size, TYPE_SHARED_BLOCK_REF, &sbr, NULL, 0,
1164                                                   t->parent->header.address, FALSE, Irp);
1165                 if (!NT_SUCCESS(Status)) {
1166                     ERR("decrease_extent_refcount returned %08x\n", Status);
1167                     return Status;
1168                 }
1169             }
1170         }
1171 
1172         if (t->parent)
1173             tbr.offset = t->parent->header.tree_id;
1174         else
1175             tbr.offset = t->header.tree_id;
1176 
1177         Status = increase_extent_refcount(Vcb, t->header.address, Vcb->superblock.node_size, TYPE_TREE_BLOCK_REF, &tbr,
1178                                           t->parent ? &t->paritem->key : NULL, t->header.level, Irp);
1179         if (!NT_SUCCESS(Status)) {
1180             ERR("increase_extent_refcount returned %08x\n", Status);
1181             return Status;
1182         }
1183 
1184         // FIXME - clear shared flag if unique?
1185 
1186         t->header.flags &= ~HEADER_FLAG_SHARED_BACKREF;
1187     }
1188 
1189     if (rc > 1 || t->header.tree_id == t->root->id) {
1190         Status = reduce_tree_extent(Vcb, t->header.address, t, t->parent ? t->parent->header.tree_id : t->header.tree_id, t->header.level, Irp, rollback);
1191 
1192         if (!NT_SUCCESS(Status)) {
1193             ERR("reduce_tree_extent returned %08x\n", Status);
1194             return Status;
1195         }
1196     }
1197 
1198     t->has_address = FALSE;
1199 
1200     if ((rc > 1 || t->header.tree_id != t->root->id) && !(flags & EXTENT_ITEM_SHARED_BACKREFS)) {
1201         if (t->header.tree_id == t->root->id) {
1202             flags |= EXTENT_ITEM_SHARED_BACKREFS;
1203             update_extent_flags(Vcb, t->header.address, flags, Irp);
1204         }
1205 
1206         if (t->header.level > 0) {
1207             LIST_ENTRY* le;
1208 
1209             le = t->itemlist.Flink;
1210             while (le != &t->itemlist) {
1211                 tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
1212 
1213                 if (!td->inserted) {
1214                     if (t->header.tree_id == t->root->id) {
1215                         SHARED_BLOCK_REF sbr;
1216 
1217                         sbr.offset = t->header.address;
1218 
1219                         Status = increase_extent_refcount(Vcb, td->treeholder.address, Vcb->superblock.node_size, TYPE_SHARED_BLOCK_REF, &sbr, &td->key, t->header.level - 1, Irp);
1220                     } else {
1221                         TREE_BLOCK_REF tbr;
1222 
1223                         tbr.offset = t->root->id;
1224 
1225                         Status = increase_extent_refcount(Vcb, td->treeholder.address, Vcb->superblock.node_size, TYPE_TREE_BLOCK_REF, &tbr, &td->key, t->header.level - 1, Irp);
1226                     }
1227 
1228                     if (!NT_SUCCESS(Status)) {
1229                         ERR("increase_extent_refcount returned %08x\n", Status);
1230                         return Status;
1231                     }
1232                 }
1233 
1234                 le = le->Flink;
1235             }
1236         } else {
1237             LIST_ENTRY* le;
1238 
1239             le = t->itemlist.Flink;
1240             while (le != &t->itemlist) {
1241                 tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
1242 
1243                 if (!td->inserted && td->key.obj_type == TYPE_EXTENT_DATA && td->size >= sizeof(EXTENT_DATA) - 1 + sizeof(EXTENT_DATA2)) {
1244                     EXTENT_DATA* ed = (EXTENT_DATA*)td->data;
1245 
1246                     if (ed->type == EXTENT_TYPE_REGULAR || ed->type == EXTENT_TYPE_PREALLOC) {
1247                         EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ed->data;
1248 
1249                         if (ed2->size > 0) {
1250                             changed_extent* ce = NULL;
1251                             chunk* c = get_chunk_from_address(Vcb, ed2->address);
1252 
1253                             if (c) {
1254                                 LIST_ENTRY* le2;
1255 
1256                                 le2 = c->changed_extents.Flink;
1257                                 while (le2 != &c->changed_extents) {
1258                                     changed_extent* ce2 = CONTAINING_RECORD(le2, changed_extent, list_entry);
1259 
1260                                     if (ce2->address == ed2->address) {
1261                                         ce = ce2;
1262                                         break;
1263                                     }
1264 
1265                                     le2 = le2->Flink;
1266                                 }
1267                             }
1268 
1269                             if (t->header.tree_id == t->root->id) {
1270                                 SHARED_DATA_REF sdr;
1271 
1272                                 sdr.offset = t->header.address;
1273                                 sdr.count = 1;
1274 
1275                                 if (ce) {
1276                                     Status = add_changed_extent_ref_sdr(ce, &sdr, TRUE);
1277                                     if (!NT_SUCCESS(Status)) {
1278                                         ERR("add_changed_extent_ref_edr returned %08x\n", Status);
1279                                         return Status;
1280                                     }
1281 
1282                                     Status = add_changed_extent_ref_sdr(ce, &sdr, FALSE);
1283                                     if (!NT_SUCCESS(Status)) {
1284                                         ERR("add_changed_extent_ref_edr returned %08x\n", Status);
1285                                         return Status;
1286                                     }
1287                                 }
1288 
1289                                 Status = increase_extent_refcount(Vcb, ed2->address, ed2->size, TYPE_SHARED_DATA_REF, &sdr, NULL, 0, Irp);
1290                             } else {
1291                                 EXTENT_DATA_REF edr;
1292 
1293                                 edr.root = t->root->id;
1294                                 edr.objid = td->key.obj_id;
1295                                 edr.offset = td->key.offset - ed2->offset;
1296                                 edr.count = 1;
1297 
1298                                 if (ce) {
1299                                     Status = add_changed_extent_ref_edr(ce, &edr, TRUE);
1300                                     if (!NT_SUCCESS(Status)) {
1301                                         ERR("add_changed_extent_ref_edr returned %08x\n", Status);
1302                                         return Status;
1303                                     }
1304 
1305                                     Status = add_changed_extent_ref_edr(ce, &edr, FALSE);
1306                                     if (!NT_SUCCESS(Status)) {
1307                                         ERR("add_changed_extent_ref_edr returned %08x\n", Status);
1308                                         return Status;
1309                                     }
1310                                 }
1311 
1312                                 Status = increase_extent_refcount(Vcb, ed2->address, ed2->size, TYPE_EXTENT_DATA_REF, &edr, NULL, 0, Irp);
1313                             }
1314 
1315                             if (!NT_SUCCESS(Status)) {
1316                                 ERR("increase_extent_refcount returned %08x\n", Status);
1317                                 return Status;
1318                             }
1319                         }
1320                     }
1321                 }
1322 
1323                 le = le->Flink;
1324             }
1325         }
1326     }
1327 
1328     t->updated_extents = TRUE;
1329     t->header.tree_id = t->root->id;
1330 
1331     return STATUS_SUCCESS;
1332 }
1333 
1334 static NTSTATUS allocate_tree_extents(device_extension* Vcb, PIRP Irp, LIST_ENTRY* rollback) {
1335     LIST_ENTRY* le;
1336     NTSTATUS Status;
1337     BOOL changed = FALSE;
1338     UINT8 max_level = 0, level;
1339 
1340     TRACE("(%p)\n", Vcb);
1341 
1342     le = Vcb->trees.Flink;
1343     while (le != &Vcb->trees) {
1344         tree* t = CONTAINING_RECORD(le, tree, list_entry);
1345 
1346         if (t->write && !t->has_new_address) {
1347             chunk* c;
1348 
1349             if (t->has_address) {
1350                 c = get_chunk_from_address(Vcb, t->header.address);
1351 
1352                 if (c) {
1353                     if (!c->cache_loaded) {
1354                         ExAcquireResourceExclusiveLite(&c->lock, TRUE);
1355 
1356                         if (!c->cache_loaded) {
1357                             Status = load_cache_chunk(Vcb, c, NULL);
1358 
1359                             if (!NT_SUCCESS(Status)) {
1360                                 ERR("load_cache_chunk returned %08x\n", Status);
1361                                 ExReleaseResourceLite(&c->lock);
1362                                 return Status;
1363                             }
1364                         }
1365 
1366                         ExReleaseResourceLite(&c->lock);
1367                     }
1368                 }
1369             }
1370 
1371             Status = get_tree_new_address(Vcb, t, Irp, rollback);
1372             if (!NT_SUCCESS(Status)) {
1373                 ERR("get_tree_new_address returned %08x\n", Status);
1374                 return Status;
1375             }
1376 
1377             TRACE("allocated extent %llx\n", t->new_address);
1378 
1379             c = get_chunk_from_address(Vcb, t->new_address);
1380 
1381             if (c)
1382                 c->used += Vcb->superblock.node_size;
1383             else {
1384                 ERR("could not find chunk for address %llx\n", t->new_address);
1385                 return STATUS_INTERNAL_ERROR;
1386             }
1387 
1388             changed = TRUE;
1389 
1390             if (t->header.level > max_level)
1391                 max_level = t->header.level;
1392         }
1393 
1394         le = le->Flink;
1395     }
1396 
1397     if (!changed)
1398         return STATUS_SUCCESS;
1399 
1400     level = max_level;
1401     do {
1402         le = Vcb->trees.Flink;
1403         while (le != &Vcb->trees) {
1404             tree* t = CONTAINING_RECORD(le, tree, list_entry);
1405 
1406             if (t->write && !t->updated_extents && t->has_address && t->header.level == level) {
1407                 Status = update_tree_extents(Vcb, t, Irp, rollback);
1408                 if (!NT_SUCCESS(Status)) {
1409                     ERR("update_tree_extents returned %08x\n", Status);
1410                     return Status;
1411                 }
1412             }
1413 
1414             le = le->Flink;
1415         }
1416 
1417         if (level == 0)
1418             break;
1419 
1420         level--;
1421     } while (TRUE);
1422 
1423     return STATUS_SUCCESS;
1424 }
1425 
1426 static NTSTATUS update_root_root(device_extension* Vcb, BOOL no_cache, PIRP Irp, LIST_ENTRY* rollback) {
1427     LIST_ENTRY* le;
1428     NTSTATUS Status;
1429 
1430     TRACE("(%p)\n", Vcb);
1431 
1432     le = Vcb->trees.Flink;
1433     while (le != &Vcb->trees) {
1434         tree* t = CONTAINING_RECORD(le, tree, list_entry);
1435 
1436         if (t->write && !t->parent) {
1437             if (t->root != Vcb->root_root && t->root != Vcb->chunk_root) {
1438                 KEY searchkey;
1439                 traverse_ptr tp;
1440 
1441                 searchkey.obj_id = t->root->id;
1442                 searchkey.obj_type = TYPE_ROOT_ITEM;
1443                 searchkey.offset = 0xffffffffffffffff;
1444 
1445                 Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
1446                 if (!NT_SUCCESS(Status)) {
1447                     ERR("error - find_item returned %08x\n", Status);
1448                     return Status;
1449                 }
1450 
1451                 if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
1452                     ERR("could not find ROOT_ITEM for tree %llx\n", searchkey.obj_id);
1453                     return STATUS_INTERNAL_ERROR;
1454                 }
1455 
1456                 TRACE("updating the address for root %llx to %llx\n", searchkey.obj_id, t->new_address);
1457 
1458                 t->root->root_item.block_number = t->new_address;
1459                 t->root->root_item.root_level = t->header.level;
1460                 t->root->root_item.generation = Vcb->superblock.generation;
1461                 t->root->root_item.generation2 = Vcb->superblock.generation;
1462 
1463                 // item is guaranteed to be at least sizeof(ROOT_ITEM), due to add_parents
1464 
1465                 RtlCopyMemory(tp.item->data, &t->root->root_item, sizeof(ROOT_ITEM));
1466             }
1467 
1468             t->root->treeholder.address = t->new_address;
1469             t->root->treeholder.generation = Vcb->superblock.generation;
1470         }
1471 
1472         le = le->Flink;
1473     }
1474 
1475     if (!no_cache && !(Vcb->superblock.compat_ro_flags & BTRFS_COMPAT_RO_FLAGS_FREE_SPACE_CACHE)) {
1476         ExAcquireResourceSharedLite(&Vcb->chunk_lock, TRUE);
1477         Status = update_chunk_caches(Vcb, Irp, rollback);
1478         ExReleaseResourceLite(&Vcb->chunk_lock);
1479 
1480         if (!NT_SUCCESS(Status)) {
1481             ERR("update_chunk_caches returned %08x\n", Status);
1482             return Status;
1483         }
1484     }
1485 
1486     return STATUS_SUCCESS;
1487 }
1488 
1489 NTSTATUS do_tree_writes(device_extension* Vcb, LIST_ENTRY* tree_writes, BOOL no_free) {
1490     chunk* c;
1491     LIST_ENTRY* le;
1492     tree_write* tw;
1493     NTSTATUS Status;
1494     ULONG i, num_bits;
1495     write_data_context* wtc;
1496     ULONG bit_num = 0;
1497     BOOL raid56 = FALSE;
1498 
1499     // merge together runs
1500     c = NULL;
1501     le = tree_writes->Flink;
1502     while (le != tree_writes) {
1503         tw = CONTAINING_RECORD(le, tree_write, list_entry);
1504 
1505         if (!c || tw->address < c->offset || tw->address >= c->offset + c->chunk_item->size)
1506             c = get_chunk_from_address(Vcb, tw->address);
1507         else {
1508             tree_write* tw2 = CONTAINING_RECORD(le->Blink, tree_write, list_entry);
1509 
1510             if (tw->address == tw2->address + tw2->length) {
1511                 UINT8* data = ExAllocatePoolWithTag(NonPagedPool, tw2->length + tw->length, ALLOC_TAG);
1512 
1513                 if (!data) {
1514                     ERR("out of memory\n");
1515                     return STATUS_INSUFFICIENT_RESOURCES;
1516                 }
1517 
1518                 RtlCopyMemory(data, tw2->data, tw2->length);
1519                 RtlCopyMemory(&data[tw2->length], tw->data, tw->length);
1520 
1521                 if (!no_free)
1522                     ExFreePool(tw2->data);
1523 
1524                 tw2->data = data;
1525                 tw2->length += tw->length;
1526 
1527                 if (!no_free) // FIXME - what if we allocated this just now?
1528                     ExFreePool(tw->data);
1529 
1530                 RemoveEntryList(&tw->list_entry);
1531                 ExFreePool(tw);
1532 
1533                 le = tw2->list_entry.Flink;
1534                 continue;
1535             }
1536         }
1537 
1538         tw->c = c;
1539 
1540         if (c->chunk_item->type & (BLOCK_FLAG_RAID5 | BLOCK_FLAG_RAID6))
1541             raid56 = TRUE;
1542 
1543         le = le->Flink;
1544     }
1545 
1546     num_bits = 0;
1547 
1548     le = tree_writes->Flink;
1549     while (le != tree_writes) {
1550         tw = CONTAINING_RECORD(le, tree_write, list_entry);
1551 
1552         num_bits++;
1553 
1554         le = le->Flink;
1555     }
1556 
1557     wtc = ExAllocatePoolWithTag(NonPagedPool, sizeof(write_data_context) * num_bits, ALLOC_TAG);
1558     if (!wtc) {
1559         ERR("out of memory\n");
1560         return STATUS_INSUFFICIENT_RESOURCES;
1561     }
1562 
1563     le = tree_writes->Flink;
1564 
1565     while (le != tree_writes) {
1566         tw = CONTAINING_RECORD(le, tree_write, list_entry);
1567 
1568         TRACE("address: %llx, size: %x\n", tw->address, tw->length);
1569 
1570         KeInitializeEvent(&wtc[bit_num].Event, NotificationEvent, FALSE);
1571         InitializeListHead(&wtc[bit_num].stripes);
1572         wtc[bit_num].need_wait = FALSE;
1573         wtc[bit_num].stripes_left = 0;
1574         wtc[bit_num].parity1 = wtc[bit_num].parity2 = wtc[bit_num].scratch = NULL;
1575         wtc[bit_num].mdl = wtc[bit_num].parity1_mdl = wtc[bit_num].parity2_mdl = NULL;
1576 
1577         Status = write_data(Vcb, tw->address, tw->data, tw->length, &wtc[bit_num], NULL, NULL, FALSE, 0, HighPagePriority);
1578         if (!NT_SUCCESS(Status)) {
1579             ERR("write_data returned %08x\n", Status);
1580 
1581             for (i = 0; i < num_bits; i++) {
1582                 free_write_data_stripes(&wtc[i]);
1583             }
1584             ExFreePool(wtc);
1585 
1586             return Status;
1587         }
1588 
1589         bit_num++;
1590 
1591         le = le->Flink;
1592     }
1593 
1594     for (i = 0; i < num_bits; i++) {
1595         if (wtc[i].stripes.Flink != &wtc[i].stripes) {
1596             // launch writes and wait
1597             le = wtc[i].stripes.Flink;
1598             while (le != &wtc[i].stripes) {
1599                 write_data_stripe* stripe = CONTAINING_RECORD(le, write_data_stripe, list_entry);
1600 
1601                 if (stripe->status != WriteDataStatus_Ignore) {
1602                     wtc[i].need_wait = TRUE;
1603                     IoCallDriver(stripe->device->devobj, stripe->Irp);
1604                 }
1605 
1606                 le = le->Flink;
1607             }
1608         }
1609     }
1610 
1611     for (i = 0; i < num_bits; i++) {
1612         if (wtc[i].need_wait)
1613             KeWaitForSingleObject(&wtc[i].Event, Executive, KernelMode, FALSE, NULL);
1614     }
1615 
1616     for (i = 0; i < num_bits; i++) {
1617         le = wtc[i].stripes.Flink;
1618         while (le != &wtc[i].stripes) {
1619             write_data_stripe* stripe = CONTAINING_RECORD(le, write_data_stripe, list_entry);
1620 
1621             if (stripe->status != WriteDataStatus_Ignore && !NT_SUCCESS(stripe->iosb.Status)) {
1622                 Status = stripe->iosb.Status;
1623                 log_device_error(Vcb, stripe->device, BTRFS_DEV_STAT_WRITE_ERRORS);
1624                 break;
1625             }
1626 
1627             le = le->Flink;
1628         }
1629 
1630         free_write_data_stripes(&wtc[i]);
1631     }
1632 
1633     ExFreePool(wtc);
1634 
1635     if (raid56) {
1636         c = NULL;
1637 
1638         le = tree_writes->Flink;
1639         while (le != tree_writes) {
1640             tw = CONTAINING_RECORD(le, tree_write, list_entry);
1641 
1642             if (tw->c != c) {
1643                 c = tw->c;
1644 
1645                 ExAcquireResourceExclusiveLite(&c->partial_stripes_lock, TRUE);
1646 
1647                 while (!IsListEmpty(&c->partial_stripes)) {
1648                     partial_stripe* ps = CONTAINING_RECORD(RemoveHeadList(&c->partial_stripes), partial_stripe, list_entry);
1649 
1650                     Status = flush_partial_stripe(Vcb, c, ps);
1651 
1652                     if (ps->bmparr)
1653                         ExFreePool(ps->bmparr);
1654 
1655                     ExFreePool(ps);
1656 
1657                     if (!NT_SUCCESS(Status)) {
1658                         ERR("flush_partial_stripe returned %08x\n", Status);
1659                         ExReleaseResourceLite(&c->partial_stripes_lock);
1660                         return Status;
1661                     }
1662                 }
1663 
1664                 ExReleaseResourceLite(&c->partial_stripes_lock);
1665             }
1666 
1667             le = le->Flink;
1668         }
1669     }
1670 
1671     return STATUS_SUCCESS;
1672 }
1673 
1674 static NTSTATUS write_trees(device_extension* Vcb, PIRP Irp) {
1675     ULONG level;
1676     UINT8 *data, *body;
1677     UINT32 crc32;
1678     NTSTATUS Status;
1679     LIST_ENTRY* le;
1680     LIST_ENTRY tree_writes;
1681     tree_write* tw;
1682 
1683     TRACE("(%p)\n", Vcb);
1684 
1685     InitializeListHead(&tree_writes);
1686 
1687     for (level = 0; level <= 255; level++) {
1688         BOOL nothing_found = TRUE;
1689 
1690         TRACE("level = %u\n", level);
1691 
1692         le = Vcb->trees.Flink;
1693         while (le != &Vcb->trees) {
1694             tree* t = CONTAINING_RECORD(le, tree, list_entry);
1695 
1696             if (t->write && t->header.level == level) {
1697                 KEY firstitem, searchkey;
1698                 LIST_ENTRY* le2;
1699                 traverse_ptr tp;
1700 
1701                 if (!t->has_new_address) {
1702                     ERR("error - tried to write tree with no new address\n");
1703                     return STATUS_INTERNAL_ERROR;
1704                 }
1705 
1706                 le2 = t->itemlist.Flink;
1707                 while (le2 != &t->itemlist) {
1708                     tree_data* td = CONTAINING_RECORD(le2, tree_data, list_entry);
1709                     if (!td->ignore) {
1710                         firstitem = td->key;
1711                         break;
1712                     }
1713                     le2 = le2->Flink;
1714                 }
1715 
1716                 if (t->parent) {
1717                     t->paritem->key = firstitem;
1718                     t->paritem->treeholder.address = t->new_address;
1719                     t->paritem->treeholder.generation = Vcb->superblock.generation;
1720                 }
1721 
1722                 if (!(Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_SKINNY_METADATA)) {
1723                     EXTENT_ITEM_TREE* eit;
1724 
1725                     searchkey.obj_id = t->new_address;
1726                     searchkey.obj_type = TYPE_EXTENT_ITEM;
1727                     searchkey.offset = Vcb->superblock.node_size;
1728 
1729                     Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
1730                     if (!NT_SUCCESS(Status)) {
1731                         ERR("error - find_item returned %08x\n", Status);
1732                         return Status;
1733                     }
1734 
1735                     if (keycmp(searchkey, tp.item->key)) {
1736                         ERR("could not find %llx,%x,%llx in extent_root (found %llx,%x,%llx instead)\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset, tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset);
1737                         return STATUS_INTERNAL_ERROR;
1738                     }
1739 
1740                     if (tp.item->size < sizeof(EXTENT_ITEM_TREE)) {
1741                         ERR("(%llx,%x,%llx) was %u bytes, expected at least %u\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, tp.item->size, sizeof(EXTENT_ITEM_TREE));
1742                         return STATUS_INTERNAL_ERROR;
1743                     }
1744 
1745                     eit = (EXTENT_ITEM_TREE*)tp.item->data;
1746                     eit->firstitem = firstitem;
1747                 }
1748 
1749                 nothing_found = FALSE;
1750             }
1751 
1752             le = le->Flink;
1753         }
1754 
1755         if (nothing_found)
1756             break;
1757     }
1758 
1759     TRACE("allocated tree extents\n");
1760 
1761     le = Vcb->trees.Flink;
1762     while (le != &Vcb->trees) {
1763         tree* t = CONTAINING_RECORD(le, tree, list_entry);
1764         LIST_ENTRY* le2;
1765 #ifdef DEBUG_PARANOID
1766         UINT32 num_items = 0, size = 0;
1767         BOOL crash = FALSE;
1768 #endif
1769 
1770         if (t->write) {
1771 #ifdef DEBUG_PARANOID
1772             BOOL first = TRUE;
1773             KEY lastkey;
1774 
1775             le2 = t->itemlist.Flink;
1776             while (le2 != &t->itemlist) {
1777                 tree_data* td = CONTAINING_RECORD(le2, tree_data, list_entry);
1778                 if (!td->ignore) {
1779                     num_items++;
1780 
1781                     if (!first) {
1782                         if (keycmp(td->key, lastkey) == 0) {
1783                             ERR("(%llx,%x,%llx): duplicate key\n", td->key.obj_id, td->key.obj_type, td->key.offset);
1784                             crash = TRUE;
1785                         } else if (keycmp(td->key, lastkey) == -1) {
1786                             ERR("(%llx,%x,%llx): key out of order\n", td->key.obj_id, td->key.obj_type, td->key.offset);
1787                             crash = TRUE;
1788                         }
1789                     } else
1790                         first = FALSE;
1791 
1792                     lastkey = td->key;
1793 
1794                     if (t->header.level == 0)
1795                         size += td->size;
1796                 }
1797                 le2 = le2->Flink;
1798             }
1799 
1800             if (t->header.level == 0)
1801                 size += num_items * sizeof(leaf_node);
1802             else
1803                 size += num_items * sizeof(internal_node);
1804 
1805             if (num_items != t->header.num_items) {
1806                 ERR("tree %llx, level %x: num_items was %x, expected %x\n", t->root->id, t->header.level, num_items, t->header.num_items);
1807                 crash = TRUE;
1808             }
1809 
1810             if (size != t->size) {
1811                 ERR("tree %llx, level %x: size was %x, expected %x\n", t->root->id, t->header.level, size, t->size);
1812                 crash = TRUE;
1813             }
1814 
1815             if (t->header.num_items == 0 && t->parent) {
1816                 ERR("tree %llx, level %x: tried to write empty tree with parent\n", t->root->id, t->header.level);
1817                 crash = TRUE;
1818             }
1819 
1820             if (t->size > Vcb->superblock.node_size - sizeof(tree_header)) {
1821                 ERR("tree %llx, level %x: tried to write overlarge tree (%x > %x)\n", t->root->id, t->header.level, t->size, Vcb->superblock.node_size - sizeof(tree_header));
1822                 crash = TRUE;
1823             }
1824 
1825             if (crash) {
1826                 ERR("tree %p\n", t);
1827                 le2 = t->itemlist.Flink;
1828                 while (le2 != &t->itemlist) {
1829                     tree_data* td = CONTAINING_RECORD(le2, tree_data, list_entry);
1830                     if (!td->ignore) {
1831                         ERR("%llx,%x,%llx inserted=%u\n", td->key.obj_id, td->key.obj_type, td->key.offset, td->inserted);
1832                     }
1833                     le2 = le2->Flink;
1834                 }
1835                 int3;
1836             }
1837 #endif
1838             t->header.address = t->new_address;
1839             t->header.generation = Vcb->superblock.generation;
1840             t->header.tree_id = t->root->id;
1841             t->header.flags |= HEADER_FLAG_MIXED_BACKREF;
1842             t->header.fs_uuid = Vcb->superblock.uuid;
1843             t->has_address = TRUE;
1844 
1845             data = ExAllocatePoolWithTag(NonPagedPool, Vcb->superblock.node_size, ALLOC_TAG);
1846             if (!data) {
1847                 ERR("out of memory\n");
1848                 Status = STATUS_INSUFFICIENT_RESOURCES;
1849                 goto end;
1850             }
1851 
1852             body = data + sizeof(tree_header);
1853 
1854             RtlCopyMemory(data, &t->header, sizeof(tree_header));
1855             RtlZeroMemory(body, Vcb->superblock.node_size - sizeof(tree_header));
1856 
1857             if (t->header.level == 0) {
1858                 leaf_node* itemptr = (leaf_node*)body;
1859                 int i = 0;
1860                 UINT8* dataptr = data + Vcb->superblock.node_size;
1861 
1862                 le2 = t->itemlist.Flink;
1863                 while (le2 != &t->itemlist) {
1864                     tree_data* td = CONTAINING_RECORD(le2, tree_data, list_entry);
1865                     if (!td->ignore) {
1866                         dataptr = dataptr - td->size;
1867 
1868                         itemptr[i].key = td->key;
1869                         itemptr[i].offset = (UINT32)((UINT8*)dataptr - (UINT8*)body);
1870                         itemptr[i].size = td->size;
1871                         i++;
1872 
1873                         if (td->size > 0)
1874                             RtlCopyMemory(dataptr, td->data, td->size);
1875                     }
1876 
1877                     le2 = le2->Flink;
1878                 }
1879             } else {
1880                 internal_node* itemptr = (internal_node*)body;
1881                 int i = 0;
1882 
1883                 le2 = t->itemlist.Flink;
1884                 while (le2 != &t->itemlist) {
1885                     tree_data* td = CONTAINING_RECORD(le2, tree_data, list_entry);
1886                     if (!td->ignore) {
1887                         itemptr[i].key = td->key;
1888                         itemptr[i].address = td->treeholder.address;
1889                         itemptr[i].generation = td->treeholder.generation;
1890                         i++;
1891                     }
1892 
1893                     le2 = le2->Flink;
1894                 }
1895             }
1896 
1897             crc32 = calc_crc32c(0xffffffff, (UINT8*)&((tree_header*)data)->fs_uuid, Vcb->superblock.node_size - sizeof(((tree_header*)data)->csum));
1898             crc32 = ~crc32;
1899             *((UINT32*)data) = crc32;
1900             TRACE("setting crc32 to %08x\n", crc32);
1901 
1902             tw = ExAllocatePoolWithTag(PagedPool, sizeof(tree_write), ALLOC_TAG);
1903             if (!tw) {
1904                 ERR("out of memory\n");
1905                 ExFreePool(data);
1906                 Status = STATUS_INSUFFICIENT_RESOURCES;
1907                 goto end;
1908             }
1909 
1910             tw->address = t->new_address;
1911             tw->length = Vcb->superblock.node_size;
1912             tw->data = data;
1913 
1914             if (IsListEmpty(&tree_writes))
1915                 InsertTailList(&tree_writes, &tw->list_entry);
1916             else {
1917                 BOOL inserted = FALSE;
1918 
1919                 le2 = tree_writes.Flink;
1920                 while (le2 != &tree_writes) {
1921                     tree_write* tw2 = CONTAINING_RECORD(le2, tree_write, list_entry);
1922 
1923                     if (tw2->address > tw->address) {
1924                         InsertHeadList(le2->Blink, &tw->list_entry);
1925                         inserted = TRUE;
1926                         break;
1927                     }
1928 
1929                     le2 = le2->Flink;
1930                 }
1931 
1932                 if (!inserted)
1933                     InsertTailList(&tree_writes, &tw->list_entry);
1934             }
1935         }
1936 
1937         le = le->Flink;
1938     }
1939 
1940     Status = do_tree_writes(Vcb, &tree_writes, FALSE);
1941     if (!NT_SUCCESS(Status)) {
1942         ERR("do_tree_writes returned %08x\n", Status);
1943         goto end;
1944     }
1945 
1946     Status = STATUS_SUCCESS;
1947 
1948 end:
1949     while (!IsListEmpty(&tree_writes)) {
1950         le = RemoveHeadList(&tree_writes);
1951         tw = CONTAINING_RECORD(le, tree_write, list_entry);
1952 
1953         if (tw->data)
1954             ExFreePool(tw->data);
1955 
1956         ExFreePool(tw);
1957     }
1958 
1959     return Status;
1960 }
1961 
1962 static void update_backup_superblock(device_extension* Vcb, superblock_backup* sb, PIRP Irp) {
1963     KEY searchkey;
1964     traverse_ptr tp;
1965 
1966     RtlZeroMemory(sb, sizeof(superblock_backup));
1967 
1968     sb->root_tree_addr = Vcb->superblock.root_tree_addr;
1969     sb->root_tree_generation = Vcb->superblock.generation;
1970     sb->root_level = Vcb->superblock.root_level;
1971 
1972     sb->chunk_tree_addr = Vcb->superblock.chunk_tree_addr;
1973     sb->chunk_tree_generation = Vcb->superblock.chunk_root_generation;
1974     sb->chunk_root_level = Vcb->superblock.chunk_root_level;
1975 
1976     searchkey.obj_id = BTRFS_ROOT_EXTENT;
1977     searchkey.obj_type = TYPE_ROOT_ITEM;
1978     searchkey.offset = 0xffffffffffffffff;
1979 
1980     if (NT_SUCCESS(find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp))) {
1981         if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type && tp.item->size >= sizeof(ROOT_ITEM)) {
1982             ROOT_ITEM* ri = (ROOT_ITEM*)tp.item->data;
1983 
1984             sb->extent_tree_addr = ri->block_number;
1985             sb->extent_tree_generation = ri->generation;
1986             sb->extent_root_level = ri->root_level;
1987         }
1988     }
1989 
1990     searchkey.obj_id = BTRFS_ROOT_FSTREE;
1991 
1992     if (NT_SUCCESS(find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp))) {
1993         if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type && tp.item->size >= sizeof(ROOT_ITEM)) {
1994             ROOT_ITEM* ri = (ROOT_ITEM*)tp.item->data;
1995 
1996             sb->fs_tree_addr = ri->block_number;
1997             sb->fs_tree_generation = ri->generation;
1998             sb->fs_root_level = ri->root_level;
1999         }
2000     }
2001 
2002     searchkey.obj_id = BTRFS_ROOT_DEVTREE;
2003 
2004     if (NT_SUCCESS(find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp))) {
2005         if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type && tp.item->size >= sizeof(ROOT_ITEM)) {
2006             ROOT_ITEM* ri = (ROOT_ITEM*)tp.item->data;
2007 
2008             sb->dev_root_addr = ri->block_number;
2009             sb->dev_root_generation = ri->generation;
2010             sb->dev_root_level = ri->root_level;
2011         }
2012     }
2013 
2014     searchkey.obj_id = BTRFS_ROOT_CHECKSUM;
2015 
2016     if (NT_SUCCESS(find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp))) {
2017         if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type && tp.item->size >= sizeof(ROOT_ITEM)) {
2018             ROOT_ITEM* ri = (ROOT_ITEM*)tp.item->data;
2019 
2020             sb->csum_root_addr = ri->block_number;
2021             sb->csum_root_generation = ri->generation;
2022             sb->csum_root_level = ri->root_level;
2023         }
2024     }
2025 
2026     sb->total_bytes = Vcb->superblock.total_bytes;
2027     sb->bytes_used = Vcb->superblock.bytes_used;
2028     sb->num_devices = Vcb->superblock.num_devices;
2029 }
2030 
2031 typedef struct {
2032     void* context;
2033     UINT8* buf;
2034     PMDL mdl;
2035     device* device;
2036     NTSTATUS Status;
2037     PIRP Irp;
2038     LIST_ENTRY list_entry;
2039 } write_superblocks_stripe;
2040 
2041 typedef struct _write_superblocks_context {
2042     KEVENT Event;
2043     LIST_ENTRY stripes;
2044     LONG left;
2045 } write_superblocks_context;
2046 
2047 _Function_class_(IO_COMPLETION_ROUTINE)
2048 #ifdef __REACTOS__
2049 static NTSTATUS NTAPI write_superblock_completion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID conptr) {
2050 #else
2051 static NTSTATUS write_superblock_completion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID conptr) {
2052 #endif
2053     write_superblocks_stripe* stripe = conptr;
2054     write_superblocks_context* context = stripe->context;
2055 
2056     UNUSED(DeviceObject);
2057 
2058     stripe->Status = Irp->IoStatus.Status;
2059 
2060     if (InterlockedDecrement(&context->left) == 0)
2061         KeSetEvent(&context->Event, 0, FALSE);
2062 
2063     return STATUS_MORE_PROCESSING_REQUIRED;
2064 }
2065 
2066 static NTSTATUS write_superblock(device_extension* Vcb, device* device, write_superblocks_context* context) {
2067     unsigned int i = 0;
2068 
2069     // All the documentation says that the Linux driver only writes one superblock
2070     // if it thinks a disk is an SSD, but this doesn't seem to be the case!
2071 
2072     while (superblock_addrs[i] > 0 && device->devitem.num_bytes >= superblock_addrs[i] + sizeof(superblock)) {
2073         ULONG sblen = (ULONG)sector_align(sizeof(superblock), Vcb->superblock.sector_size);
2074         superblock* sb;
2075         UINT32 crc32;
2076         write_superblocks_stripe* stripe;
2077         PIO_STACK_LOCATION IrpSp;
2078 
2079         sb = ExAllocatePoolWithTag(NonPagedPool, sblen, ALLOC_TAG);
2080         if (!sb) {
2081             ERR("out of memory\n");
2082             return STATUS_INSUFFICIENT_RESOURCES;
2083         }
2084 
2085         RtlCopyMemory(sb, &Vcb->superblock, sizeof(superblock));
2086 
2087         if (sblen > sizeof(superblock))
2088             RtlZeroMemory((UINT8*)sb + sizeof(superblock), sblen - sizeof(superblock));
2089 
2090         RtlCopyMemory(&sb->dev_item, &device->devitem, sizeof(DEV_ITEM));
2091         sb->sb_phys_addr = superblock_addrs[i];
2092 
2093         crc32 = ~calc_crc32c(0xffffffff, (UINT8*)&sb->uuid, (ULONG)sizeof(superblock) - sizeof(sb->checksum));
2094         RtlCopyMemory(&sb->checksum, &crc32, sizeof(UINT32));
2095 
2096         stripe = ExAllocatePoolWithTag(NonPagedPool, sizeof(write_superblocks_stripe), ALLOC_TAG);
2097         if (!stripe) {
2098             ERR("out of memory\n");
2099             ExFreePool(sb);
2100             return STATUS_INSUFFICIENT_RESOURCES;
2101         }
2102 
2103         stripe->buf = (UINT8*)sb;
2104 
2105         stripe->Irp = IoAllocateIrp(device->devobj->StackSize, FALSE);
2106         if (!stripe->Irp) {
2107             ERR("IoAllocateIrp failed\n");
2108             ExFreePool(stripe);
2109             ExFreePool(sb);
2110             return STATUS_INSUFFICIENT_RESOURCES;
2111         }
2112 
2113         IrpSp = IoGetNextIrpStackLocation(stripe->Irp);
2114         IrpSp->MajorFunction = IRP_MJ_WRITE;
2115 
2116         if (i == 0)
2117             IrpSp->Flags |= SL_WRITE_THROUGH;
2118 
2119         if (device->devobj->Flags & DO_BUFFERED_IO) {
2120             stripe->Irp->AssociatedIrp.SystemBuffer = sb;
2121             stripe->mdl = NULL;
2122 
2123             stripe->Irp->Flags = IRP_BUFFERED_IO;
2124         } else if (device->devobj->Flags & DO_DIRECT_IO) {
2125             stripe->mdl = IoAllocateMdl(sb, sblen, FALSE, FALSE, NULL);
2126             if (!stripe->mdl) {
2127                 ERR("IoAllocateMdl failed\n");
2128                 IoFreeIrp(stripe->Irp);
2129                 ExFreePool(stripe);
2130                 ExFreePool(sb);
2131                 return STATUS_INSUFFICIENT_RESOURCES;
2132             }
2133 
2134             stripe->Irp->MdlAddress = stripe->mdl;
2135 
2136             MmBuildMdlForNonPagedPool(stripe->mdl);
2137         } else {
2138             stripe->Irp->UserBuffer = sb;
2139             stripe->mdl = NULL;
2140         }
2141 
2142         IrpSp->Parameters.Write.Length = sblen;
2143         IrpSp->Parameters.Write.ByteOffset.QuadPart = superblock_addrs[i];
2144 
2145         IoSetCompletionRoutine(stripe->Irp, write_superblock_completion, stripe, TRUE, TRUE, TRUE);
2146 
2147         stripe->context = context;
2148         stripe->device = device;
2149         InsertTailList(&context->stripes, &stripe->list_entry);
2150 
2151         context->left++;
2152 
2153         i++;
2154     }
2155 
2156     if (i == 0)
2157         ERR("no superblocks written!\n");
2158 
2159     return STATUS_SUCCESS;
2160 }
2161 
2162 static NTSTATUS write_superblocks(device_extension* Vcb, PIRP Irp) {
2163     UINT64 i;
2164     NTSTATUS Status;
2165     LIST_ENTRY* le;
2166     write_superblocks_context context;
2167 
2168     TRACE("(%p)\n", Vcb);
2169 
2170     le = Vcb->trees.Flink;
2171     while (le != &Vcb->trees) {
2172         tree* t = CONTAINING_RECORD(le, tree, list_entry);
2173 
2174         if (t->write && !t->parent) {
2175             if (t->root == Vcb->root_root) {
2176                 Vcb->superblock.root_tree_addr = t->new_address;
2177                 Vcb->superblock.root_level = t->header.level;
2178             } else if (t->root == Vcb->chunk_root) {
2179                 Vcb->superblock.chunk_tree_addr = t->new_address;
2180                 Vcb->superblock.chunk_root_generation = t->header.generation;
2181                 Vcb->superblock.chunk_root_level = t->header.level;
2182             }
2183         }
2184 
2185         le = le->Flink;
2186     }
2187 
2188     for (i = 0; i < BTRFS_NUM_BACKUP_ROOTS - 1; i++) {
2189         RtlCopyMemory(&Vcb->superblock.backup[i], &Vcb->superblock.backup[i+1], sizeof(superblock_backup));
2190     }
2191 
2192     update_backup_superblock(Vcb, &Vcb->superblock.backup[BTRFS_NUM_BACKUP_ROOTS - 1], Irp);
2193 
2194     KeInitializeEvent(&context.Event, NotificationEvent, FALSE);
2195     InitializeListHead(&context.stripes);
2196     context.left = 0;
2197 
2198     le = Vcb->devices.Flink;
2199     while (le != &Vcb->devices) {
2200         device* dev = CONTAINING_RECORD(le, device, list_entry);
2201 
2202         if (dev->devobj && !dev->readonly) {
2203             Status = write_superblock(Vcb, dev, &context);
2204             if (!NT_SUCCESS(Status)) {
2205                 ERR("write_superblock returned %08x\n", Status);
2206                 goto end;
2207             }
2208         }
2209 
2210         le = le->Flink;
2211     }
2212 
2213     if (IsListEmpty(&context.stripes)) {
2214         ERR("error - not writing any superblocks\n");
2215         Status = STATUS_INTERNAL_ERROR;
2216         goto end;
2217     }
2218 
2219     le = context.stripes.Flink;
2220     while (le != &context.stripes) {
2221         write_superblocks_stripe* stripe = CONTAINING_RECORD(le, write_superblocks_stripe, list_entry);
2222 
2223         IoCallDriver(stripe->device->devobj, stripe->Irp);
2224 
2225         le = le->Flink;
2226     }
2227 
2228     KeWaitForSingleObject(&context.Event, Executive, KernelMode, FALSE, NULL);
2229 
2230     le = context.stripes.Flink;
2231     while (le != &context.stripes) {
2232         write_superblocks_stripe* stripe = CONTAINING_RECORD(le, write_superblocks_stripe, list_entry);
2233 
2234         if (!NT_SUCCESS(stripe->Status)) {
2235             ERR("device %llx returned %08x\n", stripe->device->devitem.dev_id, stripe->Status);
2236             log_device_error(Vcb, stripe->device, BTRFS_DEV_STAT_WRITE_ERRORS);
2237             Status = stripe->Status;
2238             goto end;
2239         }
2240 
2241         le = le->Flink;
2242     }
2243 
2244     Status = STATUS_SUCCESS;
2245 
2246 end:
2247     while (!IsListEmpty(&context.stripes)) {
2248         write_superblocks_stripe* stripe = CONTAINING_RECORD(RemoveHeadList(&context.stripes), write_superblocks_stripe, list_entry);
2249 
2250         if (stripe->mdl) {
2251             if (stripe->mdl->MdlFlags & MDL_PAGES_LOCKED)
2252                 MmUnlockPages(stripe->mdl);
2253 
2254             IoFreeMdl(stripe->mdl);
2255         }
2256 
2257         if (stripe->Irp)
2258             IoFreeIrp(stripe->Irp);
2259 
2260         if (stripe->buf)
2261             ExFreePool(stripe->buf);
2262 
2263         ExFreePool(stripe);
2264     }
2265 
2266     return Status;
2267 }
2268 
2269 static NTSTATUS flush_changed_extent(device_extension* Vcb, chunk* c, changed_extent* ce, PIRP Irp, LIST_ENTRY* rollback) {
2270     LIST_ENTRY *le, *le2;
2271     NTSTATUS Status;
2272     UINT64 old_size;
2273 
2274     if (ce->count == 0 && ce->old_count == 0) {
2275         while (!IsListEmpty(&ce->refs)) {
2276             changed_extent_ref* cer = CONTAINING_RECORD(RemoveHeadList(&ce->refs), changed_extent_ref, list_entry);
2277             ExFreePool(cer);
2278         }
2279 
2280         while (!IsListEmpty(&ce->old_refs)) {
2281             changed_extent_ref* cer = CONTAINING_RECORD(RemoveHeadList(&ce->old_refs), changed_extent_ref, list_entry);
2282             ExFreePool(cer);
2283         }
2284 
2285         goto end;
2286     }
2287 
2288     le = ce->refs.Flink;
2289     while (le != &ce->refs) {
2290         changed_extent_ref* cer = CONTAINING_RECORD(le, changed_extent_ref, list_entry);
2291         UINT32 old_count = 0;
2292 
2293         if (cer->type == TYPE_EXTENT_DATA_REF) {
2294             le2 = ce->old_refs.Flink;
2295             while (le2 != &ce->old_refs) {
2296                 changed_extent_ref* cer2 = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
2297 
2298                 if (cer2->type == TYPE_EXTENT_DATA_REF && cer2->edr.root == cer->edr.root && cer2->edr.objid == cer->edr.objid && cer2->edr.offset == cer->edr.offset) {
2299                     old_count = cer2->edr.count;
2300                     break;
2301                 }
2302 
2303                 le2 = le2->Flink;
2304             }
2305 
2306             old_size = ce->old_count > 0 ? ce->old_size : ce->size;
2307 
2308             if (cer->edr.count > old_count) {
2309                 Status = increase_extent_refcount_data(Vcb, ce->address, old_size, cer->edr.root, cer->edr.objid, cer->edr.offset, cer->edr.count - old_count, Irp);
2310 
2311                 if (!NT_SUCCESS(Status)) {
2312                     ERR("increase_extent_refcount_data returned %08x\n", Status);
2313                     return Status;
2314                 }
2315             }
2316         } else if (cer->type == TYPE_SHARED_DATA_REF) {
2317             le2 = ce->old_refs.Flink;
2318             while (le2 != &ce->old_refs) {
2319                 changed_extent_ref* cer2 = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
2320 
2321                 if (cer2->type == TYPE_SHARED_DATA_REF && cer2->sdr.offset == cer->sdr.offset) {
2322                     RemoveEntryList(&cer2->list_entry);
2323                     ExFreePool(cer2);
2324                     break;
2325                 }
2326 
2327                 le2 = le2->Flink;
2328             }
2329         }
2330 
2331         le = le->Flink;
2332     }
2333 
2334     le = ce->refs.Flink;
2335     while (le != &ce->refs) {
2336         changed_extent_ref* cer = CONTAINING_RECORD(le, changed_extent_ref, list_entry);
2337         LIST_ENTRY* le3 = le->Flink;
2338         UINT32 old_count = 0;
2339 
2340         if (cer->type == TYPE_EXTENT_DATA_REF) {
2341             le2 = ce->old_refs.Flink;
2342             while (le2 != &ce->old_refs) {
2343                 changed_extent_ref* cer2 = CONTAINING_RECORD(le2, changed_extent_ref, list_entry);
2344 
2345                 if (cer2->type == TYPE_EXTENT_DATA_REF && cer2->edr.root == cer->edr.root && cer2->edr.objid == cer->edr.objid && cer2->edr.offset == cer->edr.offset) {
2346                     old_count = cer2->edr.count;
2347 
2348                     RemoveEntryList(&cer2->list_entry);
2349                     ExFreePool(cer2);
2350                     break;
2351                 }
2352 
2353                 le2 = le2->Flink;
2354             }
2355 
2356             old_size = ce->old_count > 0 ? ce->old_size : ce->size;
2357 
2358             if (cer->edr.count < old_count) {
2359                 Status = decrease_extent_refcount_data(Vcb, ce->address, old_size, cer->edr.root, cer->edr.objid, cer->edr.offset,
2360                                                        old_count - cer->edr.count, ce->superseded, Irp);
2361 
2362                 if (!NT_SUCCESS(Status)) {
2363                     ERR("decrease_extent_refcount_data returned %08x\n", Status);
2364                     return Status;
2365                 }
2366             }
2367 
2368             if (ce->size != ce->old_size && ce->old_count > 0) {
2369                 KEY searchkey;
2370                 traverse_ptr tp;
2371                 void* data;
2372 
2373                 searchkey.obj_id = ce->address;
2374                 searchkey.obj_type = TYPE_EXTENT_ITEM;
2375                 searchkey.offset = ce->old_size;
2376 
2377                 Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
2378                 if (!NT_SUCCESS(Status)) {
2379                     ERR("error - find_item returned %08x\n", Status);
2380                     return Status;
2381                 }
2382 
2383                 if (keycmp(searchkey, tp.item->key)) {
2384                     ERR("could not find (%llx,%x,%llx) in extent tree\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset);
2385                     return STATUS_INTERNAL_ERROR;
2386                 }
2387 
2388                 if (tp.item->size > 0) {
2389                     data = ExAllocatePoolWithTag(PagedPool, tp.item->size, ALLOC_TAG);
2390 
2391                     if (!data) {
2392                         ERR("out of memory\n");
2393                         return STATUS_INSUFFICIENT_RESOURCES;
2394                     }
2395 
2396                     RtlCopyMemory(data, tp.item->data, tp.item->size);
2397                 } else
2398                     data = NULL;
2399 
2400                 Status = insert_tree_item(Vcb, Vcb->extent_root, ce->address, TYPE_EXTENT_ITEM, ce->size, data, tp.item->size, NULL, Irp);
2401                 if (!NT_SUCCESS(Status)) {
2402                     ERR("insert_tree_item returned %08x\n", Status);
2403                     if (data) ExFreePool(data);
2404                     return Status;
2405                 }
2406 
2407                 Status = delete_tree_item(Vcb, &tp);
2408                 if (!NT_SUCCESS(Status)) {
2409                     ERR("delete_tree_item returned %08x\n", Status);
2410                     return Status;
2411                 }
2412             }
2413         }
2414 
2415         RemoveEntryList(&cer->list_entry);
2416         ExFreePool(cer);
2417 
2418         le = le3;
2419     }
2420 
2421 #ifdef DEBUG_PARANOID
2422     if (!IsListEmpty(&ce->old_refs))
2423         WARN("old_refs not empty\n");
2424 #endif
2425 
2426 end:
2427     if (ce->count == 0 && !ce->superseded) {
2428         c->used -= ce->size;
2429         space_list_add(c, ce->address, ce->size, rollback);
2430     }
2431 
2432     RemoveEntryList(&ce->list_entry);
2433     ExFreePool(ce);
2434 
2435     return STATUS_SUCCESS;
2436 }
2437 
2438 void add_checksum_entry(device_extension* Vcb, UINT64 address, ULONG length, UINT32* csum, PIRP Irp) {
2439     KEY searchkey;
2440     traverse_ptr tp, next_tp;
2441     NTSTATUS Status;
2442     UINT64 startaddr, endaddr;
2443     ULONG len;
2444     UINT32* checksums;
2445     RTL_BITMAP bmp;
2446     ULONG* bmparr;
2447     ULONG runlength, index;
2448 
2449     searchkey.obj_id = EXTENT_CSUM_ID;
2450     searchkey.obj_type = TYPE_EXTENT_CSUM;
2451     searchkey.offset = address;
2452 
2453     // FIXME - create checksum_root if it doesn't exist at all
2454 
2455     Status = find_item(Vcb, Vcb->checksum_root, &tp, &searchkey, FALSE, Irp);
2456     if (Status == STATUS_NOT_FOUND) { // tree is completely empty
2457         if (csum) { // not deleted
2458             ULONG length2 = length;
2459             UINT64 off = address;
2460             UINT32* data = csum;
2461 
2462             do {
2463                 UINT16 il = (UINT16)min(length2, MAX_CSUM_SIZE / sizeof(UINT32));
2464 
2465                 checksums = ExAllocatePoolWithTag(PagedPool, il * sizeof(UINT32), ALLOC_TAG);
2466                 if (!checksums) {
2467                     ERR("out of memory\n");
2468                     return;
2469                 }
2470 
2471                 RtlCopyMemory(checksums, data, il * sizeof(UINT32));
2472 
2473                 Status = insert_tree_item(Vcb, Vcb->checksum_root, EXTENT_CSUM_ID, TYPE_EXTENT_CSUM, off, checksums,
2474                                           il * sizeof(UINT32), NULL, Irp);
2475                 if (!NT_SUCCESS(Status)) {
2476                     ERR("insert_tree_item returned %08x\n", Status);
2477                     ExFreePool(checksums);
2478                     return;
2479                 }
2480 
2481                 length2 -= il;
2482 
2483                 if (length2 > 0) {
2484                     off += il * Vcb->superblock.sector_size;
2485                     data += il;
2486                 }
2487             } while (length2 > 0);
2488         }
2489     } else if (!NT_SUCCESS(Status)) {
2490         ERR("find_item returned %08x\n", Status);
2491         return;
2492     } else {
2493         UINT32 tplen;
2494 
2495         // FIXME - check entry is TYPE_EXTENT_CSUM?
2496 
2497         if (tp.item->key.offset < address && tp.item->key.offset + (tp.item->size * Vcb->superblock.sector_size / sizeof(UINT32)) >= address)
2498             startaddr = tp.item->key.offset;
2499         else
2500             startaddr = address;
2501 
2502         searchkey.obj_id = EXTENT_CSUM_ID;
2503         searchkey.obj_type = TYPE_EXTENT_CSUM;
2504         searchkey.offset = address + (length * Vcb->superblock.sector_size);
2505 
2506         Status = find_item(Vcb, Vcb->checksum_root, &tp, &searchkey, FALSE, Irp);
2507         if (!NT_SUCCESS(Status)) {
2508             ERR("find_item returned %08x\n", Status);
2509             return;
2510         }
2511 
2512         tplen = tp.item->size / sizeof(UINT32);
2513 
2514         if (tp.item->key.offset + (tplen * Vcb->superblock.sector_size) >= address + (length * Vcb->superblock.sector_size))
2515             endaddr = tp.item->key.offset + (tplen * Vcb->superblock.sector_size);
2516         else
2517             endaddr = address + (length * Vcb->superblock.sector_size);
2518 
2519         TRACE("cs starts at %llx (%x sectors)\n", address, length);
2520         TRACE("startaddr = %llx\n", startaddr);
2521         TRACE("endaddr = %llx\n", endaddr);
2522 
2523         len = (ULONG)((endaddr - startaddr) / Vcb->superblock.sector_size);
2524 
2525         checksums = ExAllocatePoolWithTag(PagedPool, sizeof(UINT32) * len, ALLOC_TAG);
2526         if (!checksums) {
2527             ERR("out of memory\n");
2528             return;
2529         }
2530 
2531         bmparr = ExAllocatePoolWithTag(PagedPool, sizeof(ULONG) * ((len/8)+1), ALLOC_TAG);
2532         if (!bmparr) {
2533             ERR("out of memory\n");
2534             ExFreePool(checksums);
2535             return;
2536         }
2537 
2538         RtlInitializeBitMap(&bmp, bmparr, len);
2539         RtlSetAllBits(&bmp);
2540 
2541         searchkey.obj_id = EXTENT_CSUM_ID;
2542         searchkey.obj_type = TYPE_EXTENT_CSUM;
2543         searchkey.offset = address;
2544 
2545         Status = find_item(Vcb, Vcb->checksum_root, &tp, &searchkey, FALSE, Irp);
2546         if (!NT_SUCCESS(Status)) {
2547             ERR("find_item returned %08x\n", Status);
2548             ExFreePool(checksums);
2549             ExFreePool(bmparr);
2550             return;
2551         }
2552 
2553         // set bit = free space, cleared bit = allocated sector
2554 
2555         while (tp.item->key.offset < endaddr) {
2556             if (tp.item->key.offset >= startaddr) {
2557                 if (tp.item->size > 0) {
2558                     ULONG itemlen = (ULONG)min((len - (tp.item->key.offset - startaddr) / Vcb->superblock.sector_size) * sizeof(UINT32), tp.item->size);
2559 
2560                     RtlCopyMemory(&checksums[(tp.item->key.offset - startaddr) / Vcb->superblock.sector_size], tp.item->data, itemlen);
2561                     RtlClearBits(&bmp, (ULONG)((tp.item->key.offset - startaddr) / Vcb->superblock.sector_size), itemlen / sizeof(UINT32));
2562                 }
2563 
2564                 Status = delete_tree_item(Vcb, &tp);
2565                 if (!NT_SUCCESS(Status)) {
2566                     ERR("delete_tree_item returned %08x\n", Status);
2567                     ExFreePool(checksums);
2568                     ExFreePool(bmparr);
2569                     return;
2570                 }
2571             }
2572 
2573             if (find_next_item(Vcb, &tp, &next_tp, FALSE, Irp)) {
2574                 tp = next_tp;
2575             } else
2576                 break;
2577         }
2578 
2579         if (!csum) { // deleted
2580             RtlSetBits(&bmp, (ULONG)((address - startaddr) / Vcb->superblock.sector_size), length);
2581         } else {
2582             RtlCopyMemory(&checksums[(address - startaddr) / Vcb->superblock.sector_size], csum, length * sizeof(UINT32));
2583             RtlClearBits(&bmp, (ULONG)((address - startaddr) / Vcb->superblock.sector_size), length);
2584         }
2585 
2586         runlength = RtlFindFirstRunClear(&bmp, &index);
2587 
2588         while (runlength != 0) {
2589             do {
2590                 UINT16 rl;
2591                 UINT64 off;
2592                 UINT32* data;
2593 
2594                 if (runlength * sizeof(UINT32) > MAX_CSUM_SIZE)
2595                     rl = MAX_CSUM_SIZE / sizeof(UINT32);
2596                 else
2597                     rl = (UINT16)runlength;
2598 
2599                 data = ExAllocatePoolWithTag(PagedPool, sizeof(UINT32) * rl, ALLOC_TAG);
2600                 if (!data) {
2601                     ERR("out of memory\n");
2602                     ExFreePool(bmparr);
2603                     ExFreePool(checksums);
2604                     return;
2605                 }
2606 
2607                 RtlCopyMemory(data, &checksums[index], sizeof(UINT32) * rl);
2608 
2609                 off = startaddr + UInt32x32To64(index, Vcb->superblock.sector_size);
2610 
2611                 Status = insert_tree_item(Vcb, Vcb->checksum_root, EXTENT_CSUM_ID, TYPE_EXTENT_CSUM, off, data, sizeof(UINT32) * rl, NULL, Irp);
2612                 if (!NT_SUCCESS(Status)) {
2613                     ERR("insert_tree_item returned %08x\n", Status);
2614                     ExFreePool(data);
2615                     ExFreePool(bmparr);
2616                     ExFreePool(checksums);
2617                     return;
2618                 }
2619 
2620                 runlength -= rl;
2621                 index += rl;
2622             } while (runlength > 0);
2623 
2624             runlength = RtlFindNextForwardRunClear(&bmp, index, &index);
2625         }
2626 
2627         ExFreePool(bmparr);
2628         ExFreePool(checksums);
2629     }
2630 }
2631 
2632 static NTSTATUS update_chunk_usage(device_extension* Vcb, PIRP Irp, LIST_ENTRY* rollback) {
2633     LIST_ENTRY *le = Vcb->chunks.Flink, *le2;
2634     chunk* c;
2635     KEY searchkey;
2636     traverse_ptr tp;
2637     BLOCK_GROUP_ITEM* bgi;
2638     NTSTATUS Status;
2639 
2640     TRACE("(%p)\n", Vcb);
2641 
2642     ExAcquireResourceSharedLite(&Vcb->chunk_lock, TRUE);
2643 
2644     while (le != &Vcb->chunks) {
2645         c = CONTAINING_RECORD(le, chunk, list_entry);
2646 
2647         ExAcquireResourceExclusiveLite(&c->lock, TRUE);
2648 
2649         if (!c->cache_loaded && (!IsListEmpty(&c->changed_extents) || c->used != c->oldused)) {
2650             Status = load_cache_chunk(Vcb, c, NULL);
2651 
2652             if (!NT_SUCCESS(Status)) {
2653                 ERR("load_cache_chunk returned %08x\n", Status);
2654                 ExReleaseResourceLite(&c->lock);
2655                 goto end;
2656             }
2657         }
2658 
2659         le2 = c->changed_extents.Flink;
2660         while (le2 != &c->changed_extents) {
2661             LIST_ENTRY* le3 = le2->Flink;
2662             changed_extent* ce = CONTAINING_RECORD(le2, changed_extent, list_entry);
2663 
2664             Status = flush_changed_extent(Vcb, c, ce, Irp, rollback);
2665             if (!NT_SUCCESS(Status)) {
2666                 ERR("flush_changed_extent returned %08x\n", Status);
2667                 ExReleaseResourceLite(&c->lock);
2668                 goto end;
2669             }
2670 
2671             le2 = le3;
2672         }
2673 
2674         // This is usually done by update_chunks, but we have to check again in case any new chunks
2675         // have been allocated since.
2676         if (c->created) {
2677             Status = create_chunk(Vcb, c, Irp);
2678             if (!NT_SUCCESS(Status)) {
2679                 ERR("create_chunk returned %08x\n", Status);
2680                 ExReleaseResourceLite(&c->lock);
2681                 goto end;
2682             }
2683         }
2684 
2685         if (c->old_cache) {
2686             if (c->old_cache->dirty) {
2687                 LIST_ENTRY batchlist;
2688 
2689                 InitializeListHead(&batchlist);
2690 
2691                 Status = flush_fcb(c->old_cache, FALSE, &batchlist, Irp);
2692                 if (!NT_SUCCESS(Status)) {
2693                     ERR("flush_fcb returned %08x\n", Status);
2694                     ExReleaseResourceLite(&c->lock);
2695                     clear_batch_list(Vcb, &batchlist);
2696                     goto end;
2697                 }
2698 
2699                 Status = commit_batch_list(Vcb, &batchlist, Irp);
2700                 if (!NT_SUCCESS(Status)) {
2701                     ERR("commit_batch_list returned %08x\n", Status);
2702                     ExReleaseResourceLite(&c->lock);
2703                     goto end;
2704                 }
2705             }
2706 
2707             free_fcb(Vcb, c->old_cache);
2708             c->old_cache = NULL;
2709         }
2710 
2711         if (c->used != c->oldused) {
2712             searchkey.obj_id = c->offset;
2713             searchkey.obj_type = TYPE_BLOCK_GROUP_ITEM;
2714             searchkey.offset = c->chunk_item->size;
2715 
2716             Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
2717             if (!NT_SUCCESS(Status)) {
2718                 ERR("error - find_item returned %08x\n", Status);
2719                 ExReleaseResourceLite(&c->lock);
2720                 goto end;
2721             }
2722 
2723             if (keycmp(searchkey, tp.item->key)) {
2724                 ERR("could not find (%llx,%x,%llx) in extent_root\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset);
2725                 Status = STATUS_INTERNAL_ERROR;
2726                 ExReleaseResourceLite(&c->lock);
2727                 goto end;
2728             }
2729 
2730             if (tp.item->size < sizeof(BLOCK_GROUP_ITEM)) {
2731                 ERR("(%llx,%x,%llx) was %u bytes, expected %u\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, tp.item->size, sizeof(BLOCK_GROUP_ITEM));
2732                 Status = STATUS_INTERNAL_ERROR;
2733                 ExReleaseResourceLite(&c->lock);
2734                 goto end;
2735             }
2736 
2737             bgi = ExAllocatePoolWithTag(PagedPool, tp.item->size, ALLOC_TAG);
2738             if (!bgi) {
2739                 ERR("out of memory\n");
2740                 Status = STATUS_INSUFFICIENT_RESOURCES;
2741                 ExReleaseResourceLite(&c->lock);
2742                 goto end;
2743             }
2744 
2745             RtlCopyMemory(bgi, tp.item->data, tp.item->size);
2746             bgi->used = c->used;
2747 
2748             TRACE("adjusting usage of chunk %llx to %llx\n", c->offset, c->used);
2749 
2750             Status = delete_tree_item(Vcb, &tp);
2751             if (!NT_SUCCESS(Status)) {
2752                 ERR("delete_tree_item returned %08x\n", Status);
2753                 ExFreePool(bgi);
2754                 ExReleaseResourceLite(&c->lock);
2755                 goto end;
2756             }
2757 
2758             Status = insert_tree_item(Vcb, Vcb->extent_root, searchkey.obj_id, searchkey.obj_type, searchkey.offset, bgi, tp.item->size, NULL, Irp);
2759             if (!NT_SUCCESS(Status)) {
2760                 ERR("insert_tree_item returned %08x\n", Status);
2761                 ExFreePool(bgi);
2762                 ExReleaseResourceLite(&c->lock);
2763                 goto end;
2764             }
2765 
2766             TRACE("bytes_used = %llx\n", Vcb->superblock.bytes_used);
2767 
2768             Vcb->superblock.bytes_used += c->used - c->oldused;
2769 
2770             TRACE("bytes_used = %llx\n", Vcb->superblock.bytes_used);
2771 
2772             c->oldused = c->used;
2773         }
2774 
2775         ExReleaseResourceLite(&c->lock);
2776 
2777         le = le->Flink;
2778     }
2779 
2780     Status = STATUS_SUCCESS;
2781 
2782 end:
2783     ExReleaseResourceLite(&Vcb->chunk_lock);
2784 
2785     return Status;
2786 }
2787 
2788 static void get_first_item(tree* t, KEY* key) {
2789     LIST_ENTRY* le;
2790 
2791     le = t->itemlist.Flink;
2792     while (le != &t->itemlist) {
2793         tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
2794 
2795         *key = td->key;
2796         return;
2797     }
2798 }
2799 
2800 static NTSTATUS split_tree_at(device_extension* Vcb, tree* t, tree_data* newfirstitem, UINT32 numitems, UINT32 size) {
2801     tree *nt, *pt;
2802     tree_data* td;
2803     tree_data* oldlastitem;
2804 
2805     TRACE("splitting tree in %llx at (%llx,%x,%llx)\n", t->root->id, newfirstitem->key.obj_id, newfirstitem->key.obj_type, newfirstitem->key.offset);
2806 
2807     nt = ExAllocatePoolWithTag(PagedPool, sizeof(tree), ALLOC_TAG);
2808     if (!nt) {
2809         ERR("out of memory\n");
2810         return STATUS_INSUFFICIENT_RESOURCES;
2811     }
2812 
2813     RtlCopyMemory(&nt->header, &t->header, sizeof(tree_header));
2814     nt->header.address = 0;
2815     nt->header.generation = Vcb->superblock.generation;
2816     nt->header.num_items = t->header.num_items - numitems;
2817     nt->header.flags = HEADER_FLAG_MIXED_BACKREF | HEADER_FLAG_WRITTEN;
2818 
2819     nt->has_address = FALSE;
2820     nt->Vcb = Vcb;
2821     nt->parent = t->parent;
2822 
2823 #ifdef DEBUG_PARANOID
2824     if (nt->parent && nt->parent->header.level <= nt->header.level) int3;
2825 #endif
2826 
2827     nt->root = t->root;
2828     nt->new_address = 0;
2829     nt->has_new_address = FALSE;
2830     nt->updated_extents = FALSE;
2831     nt->uniqueness_determined = TRUE;
2832     nt->is_unique = TRUE;
2833     nt->list_entry_hash.Flink = NULL;
2834     nt->buf = NULL;
2835     InitializeListHead(&nt->itemlist);
2836 
2837     oldlastitem = CONTAINING_RECORD(newfirstitem->list_entry.Blink, tree_data, list_entry);
2838 
2839     nt->itemlist.Flink = &newfirstitem->list_entry;
2840     nt->itemlist.Blink = t->itemlist.Blink;
2841     nt->itemlist.Flink->Blink = &nt->itemlist;
2842     nt->itemlist.Blink->Flink = &nt->itemlist;
2843 
2844     t->itemlist.Blink = &oldlastitem->list_entry;
2845     t->itemlist.Blink->Flink = &t->itemlist;
2846 
2847     nt->size = t->size - size;
2848     t->size = size;
2849     t->header.num_items = numitems;
2850     nt->write = TRUE;
2851 
2852     InsertTailList(&Vcb->trees, &nt->list_entry);
2853 
2854     if (nt->header.level > 0) {
2855         LIST_ENTRY* le = nt->itemlist.Flink;
2856 
2857         while (le != &nt->itemlist) {
2858             tree_data* td2 = CONTAINING_RECORD(le, tree_data, list_entry);
2859 
2860             if (td2->treeholder.tree) {
2861                 td2->treeholder.tree->parent = nt;
2862 #ifdef DEBUG_PARANOID
2863                 if (td2->treeholder.tree->parent && td2->treeholder.tree->parent->header.level <= td2->treeholder.tree->header.level) int3;
2864 #endif
2865             }
2866 
2867             le = le->Flink;
2868         }
2869     } else {
2870         LIST_ENTRY* le = nt->itemlist.Flink;
2871 
2872         while (le != &nt->itemlist) {
2873             tree_data* td2 = CONTAINING_RECORD(le, tree_data, list_entry);
2874 
2875             if (!td2->inserted && td2->data) {
2876                 UINT8* data = ExAllocatePoolWithTag(PagedPool, td2->size, ALLOC_TAG);
2877 
2878                 if (!data) {
2879                     ERR("out of memory\n");
2880                     return STATUS_INSUFFICIENT_RESOURCES;
2881                 }
2882 
2883                 RtlCopyMemory(data, td2->data, td2->size);
2884                 td2->data = data;
2885                 td2->inserted = TRUE;
2886             }
2887 
2888             le = le->Flink;
2889         }
2890     }
2891 
2892     if (nt->parent) {
2893         td = ExAllocateFromPagedLookasideList(&Vcb->tree_data_lookaside);
2894         if (!td) {
2895             ERR("out of memory\n");
2896             return STATUS_INSUFFICIENT_RESOURCES;
2897         }
2898 
2899         td->key = newfirstitem->key;
2900 
2901         InsertHeadList(&t->paritem->list_entry, &td->list_entry);
2902 
2903         td->ignore = FALSE;
2904         td->inserted = TRUE;
2905         td->treeholder.tree = nt;
2906         nt->paritem = td;
2907 
2908         nt->parent->header.num_items++;
2909         nt->parent->size += sizeof(internal_node);
2910 
2911         goto end;
2912     }
2913 
2914     TRACE("adding new tree parent\n");
2915 
2916     if (nt->header.level == 255) {
2917         ERR("cannot add parent to tree at level 255\n");
2918         return STATUS_INTERNAL_ERROR;
2919     }
2920 
2921     pt = ExAllocatePoolWithTag(PagedPool, sizeof(tree), ALLOC_TAG);
2922     if (!pt) {
2923         ERR("out of memory\n");
2924         return STATUS_INSUFFICIENT_RESOURCES;
2925     }
2926 
2927     RtlCopyMemory(&pt->header, &nt->header, sizeof(tree_header));
2928     pt->header.address = 0;
2929     pt->header.num_items = 2;
2930     pt->header.level = nt->header.level + 1;
2931     pt->header.flags = HEADER_FLAG_MIXED_BACKREF | HEADER_FLAG_WRITTEN;
2932 
2933     pt->has_address = FALSE;
2934     pt->Vcb = Vcb;
2935     pt->parent = NULL;
2936     pt->paritem = NULL;
2937     pt->root = t->root;
2938     pt->new_address = 0;
2939     pt->has_new_address = FALSE;
2940     pt->updated_extents = FALSE;
2941     pt->size = pt->header.num_items * sizeof(internal_node);
2942     pt->uniqueness_determined = TRUE;
2943     pt->is_unique = TRUE;
2944     pt->list_entry_hash.Flink = NULL;
2945     pt->buf = NULL;
2946     InitializeListHead(&pt->itemlist);
2947 
2948     InsertTailList(&Vcb->trees, &pt->list_entry);
2949 
2950     td = ExAllocateFromPagedLookasideList(&Vcb->tree_data_lookaside);
2951     if (!td) {
2952         ERR("out of memory\n");
2953         return STATUS_INSUFFICIENT_RESOURCES;
2954     }
2955 
2956     get_first_item(t, &td->key);
2957     td->ignore = FALSE;
2958     td->inserted = FALSE;
2959     td->treeholder.address = 0;
2960     td->treeholder.generation = Vcb->superblock.generation;
2961     td->treeholder.tree = t;
2962     InsertTailList(&pt->itemlist, &td->list_entry);
2963     t->paritem = td;
2964 
2965     td = ExAllocateFromPagedLookasideList(&Vcb->tree_data_lookaside);
2966     if (!td) {
2967         ERR("out of memory\n");
2968         return STATUS_INSUFFICIENT_RESOURCES;
2969     }
2970 
2971     td->key = newfirstitem->key;
2972     td->ignore = FALSE;
2973     td->inserted = FALSE;
2974     td->treeholder.address = 0;
2975     td->treeholder.generation = Vcb->superblock.generation;
2976     td->treeholder.tree = nt;
2977     InsertTailList(&pt->itemlist, &td->list_entry);
2978     nt->paritem = td;
2979 
2980     pt->write = TRUE;
2981 
2982     t->root->treeholder.tree = pt;
2983 
2984     t->parent = pt;
2985     nt->parent = pt;
2986 
2987 #ifdef DEBUG_PARANOID
2988     if (t->parent && t->parent->header.level <= t->header.level) int3;
2989     if (nt->parent && nt->parent->header.level <= nt->header.level) int3;
2990 #endif
2991 
2992 end:
2993     t->root->root_item.bytes_used += Vcb->superblock.node_size;
2994 
2995     return STATUS_SUCCESS;
2996 }
2997 
2998 static NTSTATUS split_tree(device_extension* Vcb, tree* t) {
2999     LIST_ENTRY* le;
3000     UINT32 size, ds, numitems;
3001 
3002     size = 0;
3003     numitems = 0;
3004 
3005     // FIXME - naïve implementation: maximizes number of filled trees
3006 
3007     le = t->itemlist.Flink;
3008     while (le != &t->itemlist) {
3009         tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
3010 
3011         if (!td->ignore) {
3012             if (t->header.level == 0)
3013                 ds = sizeof(leaf_node) + td->size;
3014             else
3015                 ds = sizeof(internal_node);
3016 
3017             if (numitems == 0 && ds > Vcb->superblock.node_size - sizeof(tree_header)) {
3018                 ERR("(%llx,%x,%llx) in tree %llx is too large (%x > %x)\n",
3019                     td->key.obj_id, td->key.obj_type, td->key.offset, t->root->id,
3020                     ds, Vcb->superblock.node_size - sizeof(tree_header));
3021                 return STATUS_INTERNAL_ERROR;
3022             }
3023 
3024             // FIXME - move back if previous item was deleted item with same key
3025             if (size + ds > Vcb->superblock.node_size - sizeof(tree_header))
3026                 return split_tree_at(Vcb, t, td, numitems, size);
3027 
3028             size += ds;
3029             numitems++;
3030         }
3031 
3032         le = le->Flink;
3033     }
3034 
3035     return STATUS_SUCCESS;
3036 }
3037 
3038 BOOL is_tree_unique(device_extension* Vcb, tree* t, PIRP Irp) {
3039     KEY searchkey;
3040     traverse_ptr tp;
3041     NTSTATUS Status;
3042     BOOL ret = FALSE;
3043     EXTENT_ITEM* ei;
3044     UINT8* type;
3045 
3046     if (t->uniqueness_determined)
3047         return t->is_unique;
3048 
3049     if (t->parent && !is_tree_unique(Vcb, t->parent, Irp))
3050         goto end;
3051 
3052     if (t->has_address) {
3053         searchkey.obj_id = t->header.address;
3054         searchkey.obj_type = Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_SKINNY_METADATA ? TYPE_METADATA_ITEM : TYPE_EXTENT_ITEM;
3055         searchkey.offset = 0xffffffffffffffff;
3056 
3057         Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
3058         if (!NT_SUCCESS(Status)) {
3059             ERR("error - find_item returned %08x\n", Status);
3060             goto end;
3061         }
3062 
3063         if (tp.item->key.obj_id != t->header.address || (tp.item->key.obj_type != TYPE_METADATA_ITEM && tp.item->key.obj_type != TYPE_EXTENT_ITEM))
3064             goto end;
3065 
3066         if (tp.item->key.obj_type == TYPE_EXTENT_ITEM && tp.item->size == sizeof(EXTENT_ITEM_V0))
3067             goto end;
3068 
3069         if (tp.item->size < sizeof(EXTENT_ITEM))
3070             goto end;
3071 
3072         ei = (EXTENT_ITEM*)tp.item->data;
3073 
3074         if (ei->refcount > 1)
3075             goto end;
3076 
3077         if (tp.item->key.obj_type == TYPE_EXTENT_ITEM && ei->flags & EXTENT_ITEM_TREE_BLOCK) {
3078             EXTENT_ITEM2* ei2;
3079 
3080             if (tp.item->size < sizeof(EXTENT_ITEM) + sizeof(EXTENT_ITEM2))
3081                 goto end;
3082 
3083             ei2 = (EXTENT_ITEM2*)&ei[1];
3084             type = (UINT8*)&ei2[1];
3085         } else
3086             type = (UINT8*)&ei[1];
3087 
3088         if (type >= tp.item->data + tp.item->size || *type != TYPE_TREE_BLOCK_REF)
3089             goto end;
3090     }
3091 
3092     ret = TRUE;
3093 
3094 end:
3095     t->is_unique = ret;
3096     t->uniqueness_determined = TRUE;
3097 
3098     return ret;
3099 }
3100 
3101 static NTSTATUS try_tree_amalgamate(device_extension* Vcb, tree* t, BOOL* done, BOOL* done_deletions, PIRP Irp, LIST_ENTRY* rollback) {
3102     LIST_ENTRY* le;
3103     tree_data* nextparitem = NULL;
3104     NTSTATUS Status;
3105     tree *next_tree, *par;
3106     BOOL loaded;
3107 
3108     *done = FALSE;
3109 
3110     TRACE("trying to amalgamate tree in root %llx, level %x (size %u)\n", t->root->id, t->header.level, t->size);
3111 
3112     // FIXME - doesn't capture everything, as it doesn't ascend
3113     le = t->paritem->list_entry.Flink;
3114     while (le != &t->parent->itemlist) {
3115         tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
3116 
3117         if (!td->ignore) {
3118             nextparitem = td;
3119             break;
3120         }
3121 
3122         le = le->Flink;
3123     }
3124 
3125     if (!nextparitem)
3126         return STATUS_SUCCESS;
3127 
3128     TRACE("nextparitem: key = %llx,%x,%llx\n", nextparitem->key.obj_id, nextparitem->key.obj_type, nextparitem->key.offset);
3129 
3130     Status = do_load_tree(Vcb, &nextparitem->treeholder, t->root, t->parent, nextparitem, &loaded, NULL);
3131     if (!NT_SUCCESS(Status)) {
3132         ERR("do_load_tree returned %08x\n", Status);
3133         return Status;
3134     }
3135 
3136     if (!is_tree_unique(Vcb, nextparitem->treeholder.tree, Irp))
3137         return STATUS_SUCCESS;
3138 
3139     next_tree = nextparitem->treeholder.tree;
3140 
3141     if (!next_tree->updated_extents && next_tree->has_address) {
3142         Status = update_tree_extents(Vcb, next_tree, Irp, rollback);
3143         if (!NT_SUCCESS(Status)) {
3144             ERR("update_tree_extents returned %08x\n", Status);
3145             return Status;
3146         }
3147     }
3148 
3149     if (t->size + next_tree->size <= Vcb->superblock.node_size - sizeof(tree_header)) {
3150         // merge two trees into one
3151 
3152         t->header.num_items += next_tree->header.num_items;
3153         t->size += next_tree->size;
3154 
3155         if (next_tree->header.level > 0) {
3156             le = next_tree->itemlist.Flink;
3157 
3158             while (le != &next_tree->itemlist) {
3159                 tree_data* td2 = CONTAINING_RECORD(le, tree_data, list_entry);
3160 
3161                 if (td2->treeholder.tree) {
3162                     td2->treeholder.tree->parent = t;
3163 #ifdef DEBUG_PARANOID
3164                     if (td2->treeholder.tree->parent && td2->treeholder.tree->parent->header.level <= td2->treeholder.tree->header.level) int3;
3165 #endif
3166                 }
3167 
3168                 td2->inserted = TRUE;
3169                 le = le->Flink;
3170             }
3171         } else {
3172             le = next_tree->itemlist.Flink;
3173 
3174             while (le != &next_tree->itemlist) {
3175                 tree_data* td2 = CONTAINING_RECORD(le, tree_data, list_entry);
3176 
3177                 if (!td2->inserted && td2->data) {
3178                     UINT8* data = ExAllocatePoolWithTag(PagedPool, td2->size, ALLOC_TAG);
3179 
3180                     if (!data) {
3181                         ERR("out of memory\n");
3182                         return STATUS_INSUFFICIENT_RESOURCES;
3183                     }
3184 
3185                     RtlCopyMemory(data, td2->data, td2->size);
3186                     td2->data = data;
3187                     td2->inserted = TRUE;
3188                 }
3189 
3190                 le = le->Flink;
3191             }
3192         }
3193 
3194         t->itemlist.Blink->Flink = next_tree->itemlist.Flink;
3195         t->itemlist.Blink->Flink->Blink = t->itemlist.Blink;
3196         t->itemlist.Blink = next_tree->itemlist.Blink;
3197         t->itemlist.Blink->Flink = &t->itemlist;
3198 
3199         next_tree->itemlist.Flink = next_tree->itemlist.Blink = &next_tree->itemlist;
3200 
3201         next_tree->header.num_items = 0;
3202         next_tree->size = 0;
3203 
3204         if (next_tree->has_new_address) { // delete associated EXTENT_ITEM
3205             Status = reduce_tree_extent(Vcb, next_tree->new_address, next_tree, next_tree->parent->header.tree_id, next_tree->header.level, Irp, rollback);
3206 
3207             if (!NT_SUCCESS(Status)) {
3208                 ERR("reduce_tree_extent returned %08x\n", Status);
3209                 return Status;
3210             }
3211         } else if (next_tree->has_address) {
3212             Status = reduce_tree_extent(Vcb, next_tree->header.address, next_tree, next_tree->parent->header.tree_id, next_tree->header.level, Irp, rollback);
3213 
3214             if (!NT_SUCCESS(Status)) {
3215                 ERR("reduce_tree_extent returned %08x\n", Status);
3216                 return Status;
3217             }
3218         }
3219 
3220         if (!nextparitem->ignore) {
3221             nextparitem->ignore = TRUE;
3222             next_tree->parent->header.num_items--;
3223             next_tree->parent->size -= sizeof(internal_node);
3224 
3225             *done_deletions = TRUE;
3226         }
3227 
3228         par = next_tree->parent;
3229         while (par) {
3230             par->write = TRUE;
3231             par = par->parent;
3232         }
3233 
3234         RemoveEntryList(&nextparitem->list_entry);
3235         ExFreePool(next_tree->paritem);
3236         next_tree->paritem = NULL;
3237 
3238         next_tree->root->root_item.bytes_used -= Vcb->superblock.node_size;
3239 
3240         free_tree(next_tree);
3241 
3242         *done = TRUE;
3243     } else {
3244         // rebalance by moving items from second tree into first
3245         ULONG avg_size = (t->size + next_tree->size) / 2;
3246         KEY firstitem = {0, 0, 0};
3247         BOOL changed = FALSE;
3248 
3249         TRACE("attempting rebalance\n");
3250 
3251         le = next_tree->itemlist.Flink;
3252         while (le != &next_tree->itemlist && t->size < avg_size && next_tree->header.num_items > 1) {
3253             tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
3254             ULONG size;
3255 
3256             if (!td->ignore) {
3257                 if (next_tree->header.level == 0)
3258                     size = sizeof(leaf_node) + td->size;
3259                 else
3260                     size = sizeof(internal_node);
3261             } else
3262                 size = 0;
3263 
3264             if (t->size + size < Vcb->superblock.node_size - sizeof(tree_header)) {
3265                 RemoveEntryList(&td->list_entry);
3266                 InsertTailList(&t->itemlist, &td->list_entry);
3267 
3268                 if (next_tree->header.level > 0 && td->treeholder.tree) {
3269                     td->treeholder.tree->parent = t;
3270 #ifdef DEBUG_PARANOID
3271                     if (td->treeholder.tree->parent && td->treeholder.tree->parent->header.level <= td->treeholder.tree->header.level) int3;
3272 #endif
3273                 } else if (next_tree->header.level == 0 && !td->inserted && td->size > 0) {
3274                     UINT8* data = ExAllocatePoolWithTag(PagedPool, td->size, ALLOC_TAG);
3275 
3276                     if (!data) {
3277                         ERR("out of memory\n");
3278                         return STATUS_INSUFFICIENT_RESOURCES;
3279                     }
3280 
3281                     RtlCopyMemory(data, td->data, td->size);
3282                     td->data = data;
3283                 }
3284 
3285                 td->inserted = TRUE;
3286 
3287                 if (!td->ignore) {
3288                     next_tree->size -= size;
3289                     t->size += size;
3290                     next_tree->header.num_items--;
3291                     t->header.num_items++;
3292                 }
3293 
3294                 changed = TRUE;
3295             } else
3296                 break;
3297 
3298             le = next_tree->itemlist.Flink;
3299         }
3300 
3301         le = next_tree->itemlist.Flink;
3302         while (le != &next_tree->itemlist) {
3303             tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
3304 
3305             if (!td->ignore) {
3306                 firstitem = td->key;
3307                 break;
3308             }
3309 
3310             le = le->Flink;
3311         }
3312 
3313         // FIXME - once ascension is working, make this work with parent's parent, etc.
3314         if (next_tree->paritem)
3315             next_tree->paritem->key = firstitem;
3316 
3317         par = next_tree;
3318         while (par) {
3319             par->write = TRUE;
3320             par = par->parent;
3321         }
3322 
3323         if (changed)
3324             *done = TRUE;
3325     }
3326 
3327     return STATUS_SUCCESS;
3328 }
3329 
3330 static NTSTATUS update_extent_level(device_extension* Vcb, UINT64 address, tree* t, UINT8 level, PIRP Irp) {
3331     KEY searchkey;
3332     traverse_ptr tp;
3333     NTSTATUS Status;
3334 
3335     if (Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_SKINNY_METADATA) {
3336         searchkey.obj_id = address;
3337         searchkey.obj_type = TYPE_METADATA_ITEM;
3338         searchkey.offset = t->header.level;
3339 
3340         Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
3341         if (!NT_SUCCESS(Status)) {
3342             ERR("error - find_item returned %08x\n", Status);
3343             return Status;
3344         }
3345 
3346         if (!keycmp(tp.item->key, searchkey)) {
3347             EXTENT_ITEM_SKINNY_METADATA* eism;
3348 
3349             if (tp.item->size > 0) {
3350                 eism = ExAllocatePoolWithTag(PagedPool, tp.item->size, ALLOC_TAG);
3351 
3352                 if (!eism) {
3353                     ERR("out of memory\n");
3354                     return STATUS_INSUFFICIENT_RESOURCES;
3355                 }
3356 
3357                 RtlCopyMemory(eism, tp.item->data, tp.item->size);
3358             } else
3359                 eism = NULL;
3360 
3361             Status = delete_tree_item(Vcb, &tp);
3362             if (!NT_SUCCESS(Status)) {
3363                 ERR("delete_tree_item returned %08x\n", Status);
3364                 if (eism) ExFreePool(eism);
3365                 return Status;
3366             }
3367 
3368             Status = insert_tree_item(Vcb, Vcb->extent_root, address, TYPE_METADATA_ITEM, level, eism, tp.item->size, NULL, Irp);
3369             if (!NT_SUCCESS(Status)) {
3370                 ERR("insert_tree_item returned %08x\n", Status);
3371                 if (eism) ExFreePool(eism);
3372                 return Status;
3373             }
3374 
3375             return STATUS_SUCCESS;
3376         }
3377     }
3378 
3379     searchkey.obj_id = address;
3380     searchkey.obj_type = TYPE_EXTENT_ITEM;
3381     searchkey.offset = 0xffffffffffffffff;
3382 
3383     Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
3384     if (!NT_SUCCESS(Status)) {
3385         ERR("error - find_item returned %08x\n", Status);
3386         return Status;
3387     }
3388 
3389     if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type) {
3390         EXTENT_ITEM_TREE* eit;
3391 
3392         if (tp.item->size < sizeof(EXTENT_ITEM_TREE)) {
3393             ERR("(%llx,%x,%llx) was %u bytes, expected at least %u\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, tp.item->size, sizeof(EXTENT_ITEM_TREE));
3394             return STATUS_INTERNAL_ERROR;
3395         }
3396 
3397         eit = ExAllocatePoolWithTag(PagedPool, tp.item->size, ALLOC_TAG);
3398 
3399         if (!eit) {
3400             ERR("out of memory\n");
3401             return STATUS_INSUFFICIENT_RESOURCES;
3402         }
3403 
3404         RtlCopyMemory(eit, tp.item->data, tp.item->size);
3405 
3406         Status = delete_tree_item(Vcb, &tp);
3407         if (!NT_SUCCESS(Status)) {
3408             ERR("delete_tree_item returned %08x\n", Status);
3409             ExFreePool(eit);
3410             return Status;
3411         }
3412 
3413         eit->level = level;
3414 
3415         Status = insert_tree_item(Vcb, Vcb->extent_root, tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, eit, tp.item->size, NULL, Irp);
3416         if (!NT_SUCCESS(Status)) {
3417             ERR("insert_tree_item returned %08x\n", Status);
3418             ExFreePool(eit);
3419             return Status;
3420         }
3421 
3422         return STATUS_SUCCESS;
3423     }
3424 
3425     ERR("could not find EXTENT_ITEM for address %llx\n", address);
3426 
3427     return STATUS_INTERNAL_ERROR;
3428 }
3429 
3430 static NTSTATUS update_tree_extents_recursive(device_extension* Vcb, tree* t, PIRP Irp, LIST_ENTRY* rollback) {
3431     NTSTATUS Status;
3432 
3433     if (t->parent && !t->parent->updated_extents && t->parent->has_address) {
3434         Status = update_tree_extents_recursive(Vcb, t->parent, Irp, rollback);
3435         if (!NT_SUCCESS(Status))
3436             return Status;
3437     }
3438 
3439     Status = update_tree_extents(Vcb, t, Irp, rollback);
3440     if (!NT_SUCCESS(Status)) {
3441         ERR("update_tree_extents returned %08x\n", Status);
3442         return Status;
3443     }
3444 
3445     return STATUS_SUCCESS;
3446 }
3447 
3448 static NTSTATUS do_splits(device_extension* Vcb, PIRP Irp, LIST_ENTRY* rollback) {
3449     ULONG level, max_level;
3450     UINT32 min_size;
3451     BOOL empty, done_deletions = FALSE;
3452     NTSTATUS Status;
3453     tree* t;
3454 
3455     TRACE("(%p)\n", Vcb);
3456 
3457     max_level = 0;
3458 
3459     for (level = 0; level <= 255; level++) {
3460         LIST_ENTRY *le, *nextle;
3461 
3462         empty = TRUE;
3463 
3464         TRACE("doing level %u\n", level);
3465 
3466         le = Vcb->trees.Flink;
3467 
3468         while (le != &Vcb->trees) {
3469             t = CONTAINING_RECORD(le, tree, list_entry);
3470 
3471             nextle = le->Flink;
3472 
3473             if (t->write && t->header.level == level) {
3474                 empty = FALSE;
3475 
3476                 if (t->header.num_items == 0) {
3477                     if (t->parent) {
3478                         done_deletions = TRUE;
3479 
3480                         TRACE("deleting tree in root %llx\n", t->root->id);
3481 
3482                         t->root->root_item.bytes_used -= Vcb->superblock.node_size;
3483 
3484                         if (t->has_new_address) { // delete associated EXTENT_ITEM
3485                             Status = reduce_tree_extent(Vcb, t->new_address, t, t->parent->header.tree_id, t->header.level, Irp, rollback);
3486 
3487                             if (!NT_SUCCESS(Status)) {
3488                                 ERR("reduce_tree_extent returned %08x\n", Status);
3489                                 return Status;
3490                             }
3491 
3492                             t->has_new_address = FALSE;
3493                         } else if (t->has_address) {
3494                             Status = reduce_tree_extent(Vcb,t->header.address, t, t->parent->header.tree_id, t->header.level, Irp, rollback);
3495 
3496                             if (!NT_SUCCESS(Status)) {
3497                                 ERR("reduce_tree_extent returned %08x\n", Status);
3498                                 return Status;
3499                             }
3500 
3501                             t->has_address = FALSE;
3502                         }
3503 
3504                         if (!t->paritem->ignore) {
3505                             t->paritem->ignore = TRUE;
3506                             t->parent->header.num_items--;
3507                             t->parent->size -= sizeof(internal_node);
3508                         }
3509 
3510                         RemoveEntryList(&t->paritem->list_entry);
3511                         ExFreePool(t->paritem);
3512                         t->paritem = NULL;
3513 
3514                         free_tree(t);
3515                     } else if (t->header.level != 0) {
3516                         if (t->has_new_address) {
3517                             Status = update_extent_level(Vcb, t->new_address, t, 0, Irp);
3518 
3519                             if (!NT_SUCCESS(Status)) {
3520                                 ERR("update_extent_level returned %08x\n", Status);
3521                                 return Status;
3522                             }
3523                         }
3524 
3525                         t->header.level = 0;
3526                     }
3527                 } else if (t->size > Vcb->superblock.node_size - sizeof(tree_header)) {
3528                     TRACE("splitting overlarge tree (%x > %x)\n", t->size, Vcb->superblock.node_size - sizeof(tree_header));
3529 
3530                     if (!t->updated_extents && t->has_address) {
3531                         Status = update_tree_extents_recursive(Vcb, t, Irp, rollback);
3532                         if (!NT_SUCCESS(Status)) {
3533                             ERR("update_tree_extents_recursive returned %08x\n", Status);
3534                             return Status;
3535                         }
3536                     }
3537 
3538                     Status = split_tree(Vcb, t);
3539 
3540                     if (!NT_SUCCESS(Status)) {
3541                         ERR("split_tree returned %08x\n", Status);
3542                         return Status;
3543                     }
3544                 }
3545             }
3546 
3547             le = nextle;
3548         }
3549 
3550         if (!empty) {
3551             max_level = level;
3552         } else {
3553             TRACE("nothing found for level %u\n", level);
3554             break;
3555         }
3556     }
3557 
3558     min_size = (Vcb->superblock.node_size - sizeof(tree_header)) / 2;
3559 
3560     for (level = 0; level <= max_level; level++) {
3561         LIST_ENTRY* le;
3562 
3563         le = Vcb->trees.Flink;
3564 
3565         while (le != &Vcb->trees) {
3566             t = CONTAINING_RECORD(le, tree, list_entry);
3567 
3568             if (t->write && t->header.level == level && t->header.num_items > 0 && t->parent && t->size < min_size &&
3569                 t->root->id != BTRFS_ROOT_FREE_SPACE && is_tree_unique(Vcb, t, Irp)) {
3570                 BOOL done;
3571 
3572                 do {
3573                     Status = try_tree_amalgamate(Vcb, t, &done, &done_deletions, Irp, rollback);
3574                     if (!NT_SUCCESS(Status)) {
3575                         ERR("try_tree_amalgamate returned %08x\n", Status);
3576                         return Status;
3577                     }
3578                 } while (done && t->size < min_size);
3579             }
3580 
3581             le = le->Flink;
3582         }
3583     }
3584 
3585     // simplify trees if top tree only has one entry
3586 
3587     if (done_deletions) {
3588         for (level = max_level; level > 0; level--) {
3589             LIST_ENTRY *le, *nextle;
3590 
3591             le = Vcb->trees.Flink;
3592             while (le != &Vcb->trees) {
3593                 nextle = le->Flink;
3594                 t = CONTAINING_RECORD(le, tree, list_entry);
3595 
3596                 if (t->write && t->header.level == level) {
3597                     if (!t->parent && t->header.num_items == 1) {
3598                         LIST_ENTRY* le2 = t->itemlist.Flink;
3599                         tree_data* td = NULL;
3600                         tree* child_tree = NULL;
3601 
3602                         while (le2 != &t->itemlist) {
3603                             td = CONTAINING_RECORD(le2, tree_data, list_entry);
3604                             if (!td->ignore)
3605                                 break;
3606                             le2 = le2->Flink;
3607                         }
3608 
3609                         TRACE("deleting top-level tree in root %llx with one item\n", t->root->id);
3610 
3611                         if (t->has_new_address) { // delete associated EXTENT_ITEM
3612                             Status = reduce_tree_extent(Vcb, t->new_address, t, t->header.tree_id, t->header.level, Irp, rollback);
3613 
3614                             if (!NT_SUCCESS(Status)) {
3615                                 ERR("reduce_tree_extent returned %08x\n", Status);
3616                                 return Status;
3617                             }
3618 
3619                             t->has_new_address = FALSE;
3620                         } else if (t->has_address) {
3621                             Status = reduce_tree_extent(Vcb,t->header.address, t, t->header.tree_id, t->header.level, Irp, rollback);
3622 
3623                             if (!NT_SUCCESS(Status)) {
3624                                 ERR("reduce_tree_extent returned %08x\n", Status);
3625                                 return Status;
3626                             }
3627 
3628                             t->has_address = FALSE;
3629                         }
3630 
3631                         if (!td->treeholder.tree) { // load first item if not already loaded
3632                             KEY searchkey = {0,0,0};
3633                             traverse_ptr tp;
3634 
3635                             Status = find_item(Vcb, t->root, &tp, &searchkey, FALSE, Irp);
3636                             if (!NT_SUCCESS(Status)) {
3637                                 ERR("error - find_item returned %08x\n", Status);
3638                                 return Status;
3639                             }
3640                         }
3641 
3642                         child_tree = td->treeholder.tree;
3643 
3644                         if (child_tree) {
3645                             child_tree->parent = NULL;
3646                             child_tree->paritem = NULL;
3647                         }
3648 
3649                         t->root->root_item.bytes_used -= Vcb->superblock.node_size;
3650 
3651                         free_tree(t);
3652 
3653                         if (child_tree)
3654                             child_tree->root->treeholder.tree = child_tree;
3655                     }
3656                 }
3657 
3658                 le = nextle;
3659             }
3660         }
3661     }
3662 
3663     return STATUS_SUCCESS;
3664 }
3665 
3666 static NTSTATUS remove_root_extents(device_extension* Vcb, root* r, tree_holder* th, UINT8 level, tree* parent, PIRP Irp, LIST_ENTRY* rollback) {
3667     NTSTATUS Status;
3668 
3669     if (!th->tree) {
3670         Status = load_tree(Vcb, th->address, r, &th->tree, th->generation, NULL);
3671 
3672         if (!NT_SUCCESS(Status)) {
3673             ERR("load_tree(%llx) returned %08x\n", th->address, Status);
3674             return Status;
3675         }
3676     }
3677 
3678     if (level > 0) {
3679         LIST_ENTRY* le = th->tree->itemlist.Flink;
3680 
3681         while (le != &th->tree->itemlist) {
3682             tree_data* td = CONTAINING_RECORD(le, tree_data, list_entry);
3683 
3684             if (!td->ignore) {
3685                 Status = remove_root_extents(Vcb, r, &td->treeholder, th->tree->header.level - 1, th->tree, Irp, rollback);
3686 
3687                 if (!NT_SUCCESS(Status)) {
3688                     ERR("remove_root_extents returned %08x\n", Status);
3689                     return Status;
3690                 }
3691             }
3692 
3693             le = le->Flink;
3694         }
3695     }
3696 
3697     if (th->tree && !th->tree->updated_extents && th->tree->has_address) {
3698         Status = update_tree_extents(Vcb, th->tree, Irp, rollback);
3699         if (!NT_SUCCESS(Status)) {
3700             ERR("update_tree_extents returned %08x\n", Status);
3701             return Status;
3702         }
3703     }
3704 
3705     if (!th->tree || th->tree->has_address) {
3706         Status = reduce_tree_extent(Vcb, th->address, NULL, parent ? parent->header.tree_id : r->id, level, Irp, rollback);
3707 
3708         if (!NT_SUCCESS(Status)) {
3709             ERR("reduce_tree_extent(%llx) returned %08x\n", th->address, Status);
3710             return Status;
3711         }
3712     }
3713 
3714     return STATUS_SUCCESS;
3715 }
3716 
3717 static NTSTATUS drop_root(device_extension* Vcb, root* r, PIRP Irp, LIST_ENTRY* rollback) {
3718     NTSTATUS Status;
3719     KEY searchkey;
3720     traverse_ptr tp;
3721 
3722     Status = remove_root_extents(Vcb, r, &r->treeholder, r->root_item.root_level, NULL, Irp, rollback);
3723     if (!NT_SUCCESS(Status)) {
3724         ERR("remove_root_extents returned %08x\n", Status);
3725         return Status;
3726     }
3727 
3728     // remove entries in uuid root (tree 9)
3729     if (Vcb->uuid_root) {
3730         RtlCopyMemory(&searchkey.obj_id, &r->root_item.uuid.uuid[0], sizeof(UINT64));
3731         searchkey.obj_type = TYPE_SUBVOL_UUID;
3732         RtlCopyMemory(&searchkey.offset, &r->root_item.uuid.uuid[sizeof(UINT64)], sizeof(UINT64));
3733 
3734         if (searchkey.obj_id != 0 || searchkey.offset != 0) {
3735             Status = find_item(Vcb, Vcb->uuid_root, &tp, &searchkey, FALSE, Irp);
3736             if (!NT_SUCCESS(Status)) {
3737                 WARN("find_item returned %08x\n", Status);
3738             } else {
3739                 if (!keycmp(tp.item->key, searchkey)) {
3740                     Status = delete_tree_item(Vcb, &tp);
3741                     if (!NT_SUCCESS(Status)) {
3742                         ERR("delete_tree_item returned %08x\n", Status);
3743                         return Status;
3744                     }
3745                 } else
3746                     WARN("could not find (%llx,%x,%llx) in uuid tree\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset);
3747             }
3748         }
3749 
3750         if (r->root_item.rtransid > 0) {
3751             RtlCopyMemory(&searchkey.obj_id, &r->root_item.received_uuid.uuid[0], sizeof(UINT64));
3752             searchkey.obj_type = TYPE_SUBVOL_REC_UUID;
3753             RtlCopyMemory(&searchkey.offset, &r->root_item.received_uuid.uuid[sizeof(UINT64)], sizeof(UINT64));
3754 
3755             Status = find_item(Vcb, Vcb->uuid_root, &tp, &searchkey, FALSE, Irp);
3756             if (!NT_SUCCESS(Status))
3757                 WARN("find_item returned %08x\n", Status);
3758             else {
3759                 if (!keycmp(tp.item->key, searchkey)) {
3760                     if (tp.item->size == sizeof(UINT64)) {
3761                         UINT64* id = (UINT64*)tp.item->data;
3762 
3763                         if (*id == r->id) {
3764                             Status = delete_tree_item(Vcb, &tp);
3765                             if (!NT_SUCCESS(Status)) {
3766                                 ERR("delete_tree_item returned %08x\n", Status);
3767                                 return Status;
3768                             }
3769                         }
3770                     } else if (tp.item->size > sizeof(UINT64)) {
3771                         ULONG i;
3772                         UINT64* ids = (UINT64*)tp.item->data;
3773 
3774                         for (i = 0; i < tp.item->size / sizeof(UINT64); i++) {
3775                             if (ids[i] == r->id) {
3776                                 UINT64* ne;
3777 
3778                                 ne = ExAllocatePoolWithTag(PagedPool, tp.item->size - sizeof(UINT64), ALLOC_TAG);
3779                                 if (!ne) {
3780                                     ERR("out of memory\n");
3781                                     return STATUS_INSUFFICIENT_RESOURCES;
3782                                 }
3783 
3784                                 if (i > 0)
3785                                     RtlCopyMemory(ne, ids, sizeof(UINT64) * i);
3786 
3787                                 if ((i + 1) * sizeof(UINT64) < tp.item->size)
3788                                     RtlCopyMemory(&ne[i], &ids[i + 1], tp.item->size - ((i + 1) * sizeof(UINT64)));
3789 
3790                                 Status = delete_tree_item(Vcb, &tp);
3791                                 if (!NT_SUCCESS(Status)) {
3792                                     ERR("delete_tree_item returned %08x\n", Status);
3793                                     ExFreePool(ne);
3794                                     return Status;
3795                                 }
3796 
3797                                 Status = insert_tree_item(Vcb, Vcb->uuid_root, tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset,
3798                                                           ne, tp.item->size - sizeof(UINT64), NULL, Irp);
3799                                 if (!NT_SUCCESS(Status)) {
3800                                     ERR("insert_tree_item returned %08x\n", Status);
3801                                     ExFreePool(ne);
3802                                     return Status;
3803                                 }
3804 
3805                                 break;
3806                             }
3807                         }
3808                     }
3809                 } else
3810                     WARN("could not find (%llx,%x,%llx) in uuid tree\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset);
3811             }
3812         }
3813     }
3814 
3815     // delete ROOT_ITEM
3816 
3817     searchkey.obj_id = r->id;
3818     searchkey.obj_type = TYPE_ROOT_ITEM;
3819     searchkey.offset = 0xffffffffffffffff;
3820 
3821     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
3822     if (!NT_SUCCESS(Status)) {
3823         ERR("find_item returned %08x\n", Status);
3824         return Status;
3825     }
3826 
3827     if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type) {
3828         Status = delete_tree_item(Vcb, &tp);
3829 
3830         if (!NT_SUCCESS(Status)) {
3831             ERR("delete_tree_item returned %08x\n", Status);
3832             return Status;
3833         }
3834     } else
3835         WARN("could not find (%llx,%x,%llx) in root_root\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset);
3836 
3837     // delete items in tree cache
3838 
3839     free_trees_root(Vcb, r);
3840 
3841     return STATUS_SUCCESS;
3842 }
3843 
3844 static NTSTATUS drop_roots(device_extension* Vcb, PIRP Irp, LIST_ENTRY* rollback) {
3845     LIST_ENTRY *le = Vcb->drop_roots.Flink, *le2;
3846     NTSTATUS Status;
3847 
3848     while (le != &Vcb->drop_roots) {
3849         root* r = CONTAINING_RECORD(le, root, list_entry);
3850 
3851         le2 = le->Flink;
3852 
3853         Status = drop_root(Vcb, r, Irp, rollback);
3854         if (!NT_SUCCESS(Status)) {
3855             ERR("drop_root(%llx) returned %08x\n", r->id, Status);
3856             return Status;
3857         }
3858 
3859         le = le2;
3860     }
3861 
3862     return STATUS_SUCCESS;
3863 }
3864 
3865 NTSTATUS update_dev_item(device_extension* Vcb, device* device, PIRP Irp) {
3866     KEY searchkey;
3867     traverse_ptr tp;
3868     DEV_ITEM* di;
3869     NTSTATUS Status;
3870 
3871     searchkey.obj_id = 1;
3872     searchkey.obj_type = TYPE_DEV_ITEM;
3873     searchkey.offset = device->devitem.dev_id;
3874 
3875     Status = find_item(Vcb, Vcb->chunk_root, &tp, &searchkey, FALSE, Irp);
3876     if (!NT_SUCCESS(Status)) {
3877         ERR("error - find_item returned %08x\n", Status);
3878         return Status;
3879     }
3880 
3881     if (keycmp(tp.item->key, searchkey)) {
3882         ERR("error - could not find DEV_ITEM for device %llx\n", device->devitem.dev_id);
3883         return STATUS_INTERNAL_ERROR;
3884     }
3885 
3886     Status = delete_tree_item(Vcb, &tp);
3887     if (!NT_SUCCESS(Status)) {
3888         ERR("delete_tree_item returned %08x\n", Status);
3889         return Status;
3890     }
3891 
3892     di = ExAllocatePoolWithTag(PagedPool, sizeof(DEV_ITEM), ALLOC_TAG);
3893     if (!di) {
3894         ERR("out of memory\n");
3895         return STATUS_INSUFFICIENT_RESOURCES;
3896     }
3897 
3898     RtlCopyMemory(di, &device->devitem, sizeof(DEV_ITEM));
3899 
3900     Status = insert_tree_item(Vcb, Vcb->chunk_root, 1, TYPE_DEV_ITEM, device->devitem.dev_id, di, sizeof(DEV_ITEM), NULL, Irp);
3901     if (!NT_SUCCESS(Status)) {
3902         ERR("insert_tree_item returned %08x\n", Status);
3903         ExFreePool(di);
3904         return Status;
3905     }
3906 
3907     return STATUS_SUCCESS;
3908 }
3909 
3910 static void regen_bootstrap(device_extension* Vcb) {
3911     sys_chunk* sc2;
3912     USHORT i = 0;
3913     LIST_ENTRY* le;
3914 
3915     i = 0;
3916     le = Vcb->sys_chunks.Flink;
3917     while (le != &Vcb->sys_chunks) {
3918         sc2 = CONTAINING_RECORD(le, sys_chunk, list_entry);
3919 
3920         TRACE("%llx,%x,%llx\n", sc2->key.obj_id, sc2->key.obj_type, sc2->key.offset);
3921 
3922         RtlCopyMemory(&Vcb->superblock.sys_chunk_array[i], &sc2->key, sizeof(KEY));
3923         i += sizeof(KEY);
3924 
3925         RtlCopyMemory(&Vcb->superblock.sys_chunk_array[i], sc2->data, sc2->size);
3926         i += sc2->size;
3927 
3928         le = le->Flink;
3929     }
3930 }
3931 
3932 static NTSTATUS add_to_bootstrap(device_extension* Vcb, UINT64 obj_id, UINT8 obj_type, UINT64 offset, void* data, UINT16 size) {
3933     sys_chunk* sc;
3934     LIST_ENTRY* le;
3935 
3936     if (Vcb->superblock.n + sizeof(KEY) + size > SYS_CHUNK_ARRAY_SIZE) {
3937         ERR("error - bootstrap is full\n");
3938         return STATUS_INTERNAL_ERROR;
3939     }
3940 
3941     sc = ExAllocatePoolWithTag(PagedPool, sizeof(sys_chunk), ALLOC_TAG);
3942     if (!sc) {
3943         ERR("out of memory\n");
3944         return STATUS_INSUFFICIENT_RESOURCES;
3945     }
3946 
3947     sc->key.obj_id = obj_id;
3948     sc->key.obj_type = obj_type;
3949     sc->key.offset = offset;
3950     sc->size = size;
3951     sc->data = ExAllocatePoolWithTag(PagedPool, sc->size, ALLOC_TAG);
3952     if (!sc->data) {
3953         ERR("out of memory\n");
3954         ExFreePool(sc);
3955         return STATUS_INSUFFICIENT_RESOURCES;
3956     }
3957 
3958     RtlCopyMemory(sc->data, data, sc->size);
3959 
3960     le = Vcb->sys_chunks.Flink;
3961     while (le != &Vcb->sys_chunks) {
3962         sys_chunk* sc2 = CONTAINING_RECORD(le, sys_chunk, list_entry);
3963 
3964         if (keycmp(sc2->key, sc->key) == 1)
3965             break;
3966 
3967         le = le->Flink;
3968     }
3969     InsertTailList(le, &sc->list_entry);
3970 
3971     Vcb->superblock.n += sizeof(KEY) + size;
3972 
3973     regen_bootstrap(Vcb);
3974 
3975     return STATUS_SUCCESS;
3976 }
3977 
3978 static NTSTATUS create_chunk(device_extension* Vcb, chunk* c, PIRP Irp) {
3979     CHUNK_ITEM* ci;
3980     CHUNK_ITEM_STRIPE* cis;
3981     BLOCK_GROUP_ITEM* bgi;
3982     UINT16 i, factor;
3983     NTSTATUS Status;
3984 
3985     ci = ExAllocatePoolWithTag(PagedPool, c->size, ALLOC_TAG);
3986     if (!ci) {
3987         ERR("out of memory\n");
3988         return STATUS_INSUFFICIENT_RESOURCES;
3989     }
3990 
3991     RtlCopyMemory(ci, c->chunk_item, c->size);
3992 
3993     Status = insert_tree_item(Vcb, Vcb->chunk_root, 0x100, TYPE_CHUNK_ITEM, c->offset, ci, c->size, NULL, Irp);
3994     if (!NT_SUCCESS(Status)) {
3995         ERR("insert_tree_item failed\n");
3996         ExFreePool(ci);
3997         return Status;
3998     }
3999 
4000     if (c->chunk_item->type & BLOCK_FLAG_SYSTEM) {
4001         Status = add_to_bootstrap(Vcb, 0x100, TYPE_CHUNK_ITEM, c->offset, ci, c->size);
4002         if (!NT_SUCCESS(Status)) {
4003             ERR("add_to_bootstrap returned %08x\n", Status);
4004             return Status;
4005         }
4006     }
4007 
4008     // add BLOCK_GROUP_ITEM to tree 2
4009 
4010     bgi = ExAllocatePoolWithTag(PagedPool, sizeof(BLOCK_GROUP_ITEM), ALLOC_TAG);
4011     if (!bgi) {
4012         ERR("out of memory\n");
4013         return STATUS_INSUFFICIENT_RESOURCES;
4014     }
4015 
4016     bgi->used = c->used;
4017     bgi->chunk_tree = 0x100;
4018     bgi->flags = c->chunk_item->type;
4019 
4020     Status = insert_tree_item(Vcb, Vcb->extent_root, c->offset, TYPE_BLOCK_GROUP_ITEM, c->chunk_item->size, bgi, sizeof(BLOCK_GROUP_ITEM), NULL, Irp);
4021     if (!NT_SUCCESS(Status)) {
4022         ERR("insert_tree_item failed\n");
4023         ExFreePool(bgi);
4024         return Status;
4025     }
4026 
4027     if (c->chunk_item->type & BLOCK_FLAG_RAID0)
4028         factor = c->chunk_item->num_stripes;
4029     else if (c->chunk_item->type & BLOCK_FLAG_RAID10)
4030         factor = c->chunk_item->num_stripes / c->chunk_item->sub_stripes;
4031     else if (c->chunk_item->type & BLOCK_FLAG_RAID5)
4032         factor = c->chunk_item->num_stripes - 1;
4033     else if (c->chunk_item->type & BLOCK_FLAG_RAID6)
4034         factor = c->chunk_item->num_stripes - 2;
4035     else // SINGLE, DUPLICATE, RAID1
4036         factor = 1;
4037 
4038     // add DEV_EXTENTs to tree 4
4039 
4040     cis = (CHUNK_ITEM_STRIPE*)&c->chunk_item[1];
4041 
4042     for (i = 0; i < c->chunk_item->num_stripes; i++) {
4043         DEV_EXTENT* de;
4044 
4045         de = ExAllocatePoolWithTag(PagedPool, sizeof(DEV_EXTENT), ALLOC_TAG);
4046         if (!de) {
4047             ERR("out of memory\n");
4048             return STATUS_INSUFFICIENT_RESOURCES;
4049         }
4050 
4051         de->chunktree = Vcb->chunk_root->id;
4052         de->objid = 0x100;
4053         de->address = c->offset;
4054         de->length = c->chunk_item->size / factor;
4055         de->chunktree_uuid = Vcb->chunk_root->treeholder.tree->header.chunk_tree_uuid;
4056 
4057         Status = insert_tree_item(Vcb, Vcb->dev_root, c->devices[i]->devitem.dev_id, TYPE_DEV_EXTENT, cis[i].offset, de, sizeof(DEV_EXTENT), NULL, Irp);
4058         if (!NT_SUCCESS(Status)) {
4059             ERR("insert_tree_item returned %08x\n", Status);
4060             ExFreePool(de);
4061             return Status;
4062         }
4063 
4064         // FIXME - no point in calling this twice for the same device
4065         Status = update_dev_item(Vcb, c->devices[i], Irp);
4066         if (!NT_SUCCESS(Status)) {
4067             ERR("update_dev_item returned %08x\n", Status);
4068             return Status;
4069         }
4070     }
4071 
4072     c->created = FALSE;
4073 
4074     return STATUS_SUCCESS;
4075 }
4076 
4077 static void remove_from_bootstrap(device_extension* Vcb, UINT64 obj_id, UINT8 obj_type, UINT64 offset) {
4078     sys_chunk* sc2;
4079     LIST_ENTRY* le;
4080 
4081     le = Vcb->sys_chunks.Flink;
4082     while (le != &Vcb->sys_chunks) {
4083         sc2 = CONTAINING_RECORD(le, sys_chunk, list_entry);
4084 
4085         if (sc2->key.obj_id == obj_id && sc2->key.obj_type == obj_type && sc2->key.offset == offset) {
4086             RemoveEntryList(&sc2->list_entry);
4087 
4088             Vcb->superblock.n -= sizeof(KEY) + sc2->size;
4089 
4090             ExFreePool(sc2->data);
4091             ExFreePool(sc2);
4092             regen_bootstrap(Vcb);
4093             return;
4094         }
4095 
4096         le = le->Flink;
4097     }
4098 }
4099 
4100 static NTSTATUS set_xattr(device_extension* Vcb, LIST_ENTRY* batchlist, root* subvol, UINT64 inode, char* name, UINT16 namelen,
4101                           UINT32 crc32, UINT8* data, UINT16 datalen) {
4102     NTSTATUS Status;
4103     UINT16 xasize;
4104     DIR_ITEM* xa;
4105 
4106     TRACE("(%p, %llx, %llx, %.*s, %08x, %p, %u)\n", Vcb, subvol->id, inode, namelen, name, crc32, data, datalen);
4107 
4108     xasize = (UINT16)offsetof(DIR_ITEM, name[0]) + namelen + datalen;
4109 
4110     xa = ExAllocatePoolWithTag(PagedPool, xasize, ALLOC_TAG);
4111     if (!xa) {
4112         ERR("out of memory\n");
4113         return STATUS_INSUFFICIENT_RESOURCES;
4114     }
4115 
4116     xa->key.obj_id = 0;
4117     xa->key.obj_type = 0;
4118     xa->key.offset = 0;
4119     xa->transid = Vcb->superblock.generation;
4120     xa->m = datalen;
4121     xa->n = namelen;
4122     xa->type = BTRFS_TYPE_EA;
4123     RtlCopyMemory(xa->name, name, namelen);
4124     RtlCopyMemory(xa->name + namelen, data, datalen);
4125 
4126     Status = insert_tree_item_batch(batchlist, Vcb, subvol, inode, TYPE_XATTR_ITEM, crc32, xa, xasize, Batch_SetXattr);
4127     if (!NT_SUCCESS(Status)) {
4128         ERR("insert_tree_item_batch returned %08x\n", Status);
4129         ExFreePool(xa);
4130         return Status;
4131     }
4132 
4133     return STATUS_SUCCESS;
4134 }
4135 
4136 static NTSTATUS delete_xattr(device_extension* Vcb, LIST_ENTRY* batchlist, root* subvol, UINT64 inode, char* name,
4137                              UINT16 namelen, UINT32 crc32) {
4138     NTSTATUS Status;
4139     UINT16 xasize;
4140     DIR_ITEM* xa;
4141 
4142     TRACE("(%p, %llx, %llx, %.*s, %08x)\n", Vcb, subvol->id, inode, namelen, name, crc32);
4143 
4144     xasize = (UINT16)offsetof(DIR_ITEM, name[0]) + namelen;
4145 
4146     xa = ExAllocatePoolWithTag(PagedPool, xasize, ALLOC_TAG);
4147     if (!xa) {
4148         ERR("out of memory\n");
4149         return STATUS_INSUFFICIENT_RESOURCES;
4150     }
4151 
4152     xa->key.obj_id = 0;
4153     xa->key.obj_type = 0;
4154     xa->key.offset = 0;
4155     xa->transid = Vcb->superblock.generation;
4156     xa->m = 0;
4157     xa->n = namelen;
4158     xa->type = BTRFS_TYPE_EA;
4159     RtlCopyMemory(xa->name, name, namelen);
4160 
4161     Status = insert_tree_item_batch(batchlist, Vcb, subvol, inode, TYPE_XATTR_ITEM, crc32, xa, xasize, Batch_DeleteXattr);
4162     if (!NT_SUCCESS(Status)) {
4163         ERR("insert_tree_item_batch returned %08x\n", Status);
4164         ExFreePool(xa);
4165         return Status;
4166     }
4167 
4168     return STATUS_SUCCESS;
4169 }
4170 
4171 static NTSTATUS insert_sparse_extent(fcb* fcb, LIST_ENTRY* batchlist, UINT64 start, UINT64 length) {
4172     NTSTATUS Status;
4173     EXTENT_DATA* ed;
4174     EXTENT_DATA2* ed2;
4175 
4176     TRACE("((%llx, %llx), %llx, %llx)\n", fcb->subvol->id, fcb->inode, start, length);
4177 
4178     ed = ExAllocatePoolWithTag(PagedPool, sizeof(EXTENT_DATA) - 1 + sizeof(EXTENT_DATA2), ALLOC_TAG);
4179     if (!ed) {
4180         ERR("out of memory\n");
4181         return STATUS_INSUFFICIENT_RESOURCES;
4182     }
4183 
4184     ed->generation = fcb->Vcb->superblock.generation;
4185     ed->decoded_size = length;
4186     ed->compression = BTRFS_COMPRESSION_NONE;
4187     ed->encryption = BTRFS_ENCRYPTION_NONE;
4188     ed->encoding = BTRFS_ENCODING_NONE;
4189     ed->type = EXTENT_TYPE_REGULAR;
4190 
4191     ed2 = (EXTENT_DATA2*)ed->data;
4192     ed2->address = 0;
4193     ed2->size = 0;
4194     ed2->offset = 0;
4195     ed2->num_bytes = length;
4196 
4197     Status = insert_tree_item_batch(batchlist, fcb->Vcb, fcb->subvol, fcb->inode, TYPE_EXTENT_DATA, start, ed, sizeof(EXTENT_DATA) - 1 + sizeof(EXTENT_DATA2), Batch_Insert);
4198     if (!NT_SUCCESS(Status)) {
4199         ERR("insert_tree_item_batch returned %08x\n", Status);
4200         ExFreePool(ed);
4201         return Status;
4202     }
4203 
4204     return STATUS_SUCCESS;
4205 }
4206 
4207 #ifdef _MSC_VER
4208 #pragma warning(push)
4209 #pragma warning(suppress: 28194)
4210 #endif
4211 NTSTATUS insert_tree_item_batch(LIST_ENTRY* batchlist, device_extension* Vcb, root* r, UINT64 objid, UINT8 objtype, UINT64 offset,
4212                                 _In_opt_ _When_(return >= 0, __drv_aliasesMem) void* data, UINT16 datalen, enum batch_operation operation) {
4213     LIST_ENTRY* le;
4214     batch_root* br = NULL;
4215     batch_item* bi;
4216 
4217     le = batchlist->Flink;
4218     while (le != batchlist) {
4219         batch_root* br2 = CONTAINING_RECORD(le, batch_root, list_entry);
4220 
4221         if (br2->r == r) {
4222             br = br2;
4223             break;
4224         }
4225 
4226         le = le->Flink;
4227     }
4228 
4229     if (!br) {
4230         br = ExAllocatePoolWithTag(PagedPool, sizeof(batch_root), ALLOC_TAG);
4231         if (!br) {
4232             ERR("out of memory\n");
4233             return STATUS_INSUFFICIENT_RESOURCES;
4234         }
4235 
4236         br->r = r;
4237         InitializeListHead(&br->items);
4238         InsertTailList(batchlist, &br->list_entry);
4239     }
4240 
4241     bi = ExAllocateFromPagedLookasideList(&Vcb->batch_item_lookaside);
4242     if (!bi) {
4243         ERR("out of memory\n");
4244         return STATUS_INSUFFICIENT_RESOURCES;
4245     }
4246 
4247     bi->key.obj_id = objid;
4248     bi->key.obj_type = objtype;
4249     bi->key.offset = offset;
4250     bi->data = data;
4251     bi->datalen = datalen;
4252     bi->operation = operation;
4253 
4254     le = br->items.Blink;
4255     while (le != &br->items) {
4256         batch_item* bi2 = CONTAINING_RECORD(le, batch_item, list_entry);
4257 
4258         if (keycmp(bi2->key, bi->key) != 1) {
4259             InsertHeadList(&bi2->list_entry, &bi->list_entry);
4260             return STATUS_SUCCESS;
4261         }
4262 
4263         le = le->Blink;
4264     }
4265 
4266     InsertHeadList(&br->items, &bi->list_entry);
4267 
4268     return STATUS_SUCCESS;
4269 }
4270 #ifdef _MSC_VER
4271 #pragma warning(pop)
4272 #endif
4273 
4274 typedef struct {
4275     UINT64 address;
4276     UINT64 length;
4277     UINT64 offset;
4278     BOOL changed;
4279     chunk* chunk;
4280     UINT64 skip_start;
4281     UINT64 skip_end;
4282     LIST_ENTRY list_entry;
4283 } extent_range;
4284 
4285 static void rationalize_extents(fcb* fcb, PIRP Irp) {
4286     LIST_ENTRY* le;
4287     LIST_ENTRY extent_ranges;
4288     extent_range* er;
4289     BOOL changed = FALSE, truncating = FALSE;
4290     UINT32 num_extents = 0;
4291 
4292     InitializeListHead(&extent_ranges);
4293 
4294     le = fcb->extents.Flink;
4295     while (le != &fcb->extents) {
4296         extent* ext = CONTAINING_RECORD(le, extent, list_entry);
4297 
4298         if ((ext->extent_data.type == EXTENT_TYPE_REGULAR || ext->extent_data.type == EXTENT_TYPE_PREALLOC) && ext->extent_data.compression == BTRFS_COMPRESSION_NONE && ext->unique) {
4299             EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ext->extent_data.data;
4300 
4301             if (ed2->size != 0) {
4302                 LIST_ENTRY* le2;
4303 
4304                 le2 = extent_ranges.Flink;
4305                 while (le2 != &extent_ranges) {
4306                     extent_range* er2 = CONTAINING_RECORD(le2, extent_range, list_entry);
4307 
4308                     if (er2->address == ed2->address) {
4309                         er2->skip_start = min(er2->skip_start, ed2->offset);
4310                         er2->skip_end = min(er2->skip_end, ed2->size - ed2->offset - ed2->num_bytes);
4311                         goto cont;
4312                     } else if (er2->address > ed2->address)
4313                         break;
4314 
4315                     le2 = le2->Flink;
4316                 }
4317 
4318                 er = ExAllocatePoolWithTag(PagedPool, sizeof(extent_range), ALLOC_TAG); // FIXME - should be from lookaside?
4319                 if (!er) {
4320                     ERR("out of memory\n");
4321                     goto end;
4322                 }
4323 
4324                 er->address = ed2->address;
4325                 er->length = ed2->size;
4326                 er->offset = ext->offset - ed2->offset;
4327                 er->changed = FALSE;
4328                 er->chunk = NULL;
4329                 er->skip_start = ed2->offset;
4330                 er->skip_end = ed2->size - ed2->offset - ed2->num_bytes;
4331 
4332                 if (er->skip_start != 0 || er->skip_end != 0)
4333                     truncating = TRUE;
4334 
4335                 InsertHeadList(le2->Blink, &er->list_entry);
4336                 num_extents++;
4337             }
4338         }
4339 
4340 cont:
4341         le = le->Flink;
4342     }
4343 
4344     if (num_extents == 0 || (num_extents == 1 && !truncating))
4345         goto end;
4346 
4347     le = extent_ranges.Flink;
4348     while (le != &extent_ranges) {
4349         er = CONTAINING_RECORD(le, extent_range, list_entry);
4350 
4351         if (!er->chunk) {
4352             LIST_ENTRY* le2;
4353 
4354             er->chunk = get_chunk_from_address(fcb->Vcb, er->address);
4355 
4356             if (!er->chunk) {
4357                 ERR("get_chunk_from_address(%llx) failed\n", er->address);
4358                 goto end;
4359             }
4360 
4361             le2 = le->Flink;
4362             while (le2 != &extent_ranges) {
4363                 extent_range* er2 = CONTAINING_RECORD(le2, extent_range, list_entry);
4364 
4365                 if (!er2->chunk && er2->address >= er->chunk->offset && er2->address < er->chunk->offset + er->chunk->chunk_item->size)
4366                     er2->chunk = er->chunk;
4367 
4368                 le2 = le2->Flink;
4369             }
4370         }
4371 
4372         le = le->Flink;
4373     }
4374 
4375     if (truncating) {
4376         // truncate beginning or end of extent if unused
4377 
4378         le = extent_ranges.Flink;
4379         while (le != &extent_ranges) {
4380             er = CONTAINING_RECORD(le, extent_range, list_entry);
4381 
4382             if (er->skip_start > 0) {
4383                 LIST_ENTRY* le2 = fcb->extents.Flink;
4384                 while (le2 != &fcb->extents) {
4385                     extent* ext = CONTAINING_RECORD(le2, extent, list_entry);
4386 
4387                     if ((ext->extent_data.type == EXTENT_TYPE_REGULAR || ext->extent_data.type == EXTENT_TYPE_PREALLOC) && ext->extent_data.compression == BTRFS_COMPRESSION_NONE && ext->unique) {
4388                         EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ext->extent_data.data;
4389 
4390                         if (ed2->size != 0 && ed2->address == er->address) {
4391                             NTSTATUS Status;
4392 
4393                             Status = update_changed_extent_ref(fcb->Vcb, er->chunk, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset,
4394                                                                -1, fcb->inode_item.flags & BTRFS_INODE_NODATASUM, TRUE, Irp);
4395                             if (!NT_SUCCESS(Status)) {
4396                                 ERR("update_changed_extent_ref returned %08x\n", Status);
4397                                 goto end;
4398                             }
4399 
4400                             ext->extent_data.decoded_size -= er->skip_start;
4401                             ed2->size -= er->skip_start;
4402                             ed2->address += er->skip_start;
4403                             ed2->offset -= er->skip_start;
4404 
4405                             add_changed_extent_ref(er->chunk, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset,
4406                                                    1, fcb->inode_item.flags & BTRFS_INODE_NODATASUM);
4407                         }
4408                     }
4409 
4410                     le2 = le2->Flink;
4411                 }
4412 
4413                 if (!(fcb->inode_item.flags & BTRFS_INODE_NODATASUM))
4414                     add_checksum_entry(fcb->Vcb, er->address, (ULONG)(er->skip_start / fcb->Vcb->superblock.sector_size), NULL, NULL);
4415 
4416                 ExAcquireResourceExclusiveLite(&er->chunk->lock, TRUE);
4417 
4418                 if (!er->chunk->cache_loaded) {
4419                     NTSTATUS Status = load_cache_chunk(fcb->Vcb, er->chunk, NULL);
4420 
4421                     if (!NT_SUCCESS(Status)) {
4422                         ERR("load_cache_chunk returned %08x\n", Status);
4423                         ExReleaseResourceLite(&er->chunk->lock);
4424                         goto end;
4425                     }
4426                 }
4427 
4428                 er->chunk->used -= er->skip_start;
4429 
4430                 space_list_add(er->chunk, er->address, er->skip_start, NULL);
4431 
4432                 ExReleaseResourceLite(&er->chunk->lock);
4433 
4434                 er->address += er->skip_start;
4435                 er->length -= er->skip_start;
4436             }
4437 
4438             if (er->skip_end > 0) {
4439                 LIST_ENTRY* le2 = fcb->extents.Flink;
4440                 while (le2 != &fcb->extents) {
4441                     extent* ext = CONTAINING_RECORD(le2, extent, list_entry);
4442 
4443                     if ((ext->extent_data.type == EXTENT_TYPE_REGULAR || ext->extent_data.type == EXTENT_TYPE_PREALLOC) && ext->extent_data.compression == BTRFS_COMPRESSION_NONE && ext->unique) {
4444                         EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ext->extent_data.data;
4445 
4446                         if (ed2->size != 0 && ed2->address == er->address) {
4447                             NTSTATUS Status;
4448 
4449                             Status = update_changed_extent_ref(fcb->Vcb, er->chunk, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset,
4450                                                                -1, fcb->inode_item.flags & BTRFS_INODE_NODATASUM, TRUE, Irp);
4451                             if (!NT_SUCCESS(Status)) {
4452                                 ERR("update_changed_extent_ref returned %08x\n", Status);
4453                                 goto end;
4454                             }
4455 
4456                             ext->extent_data.decoded_size -= er->skip_end;
4457                             ed2->size -= er->skip_end;
4458 
4459                             add_changed_extent_ref(er->chunk, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset,
4460                                                    1, fcb->inode_item.flags & BTRFS_INODE_NODATASUM);
4461                         }
4462                     }
4463 
4464                     le2 = le2->Flink;
4465                 }
4466 
4467                 if (!(fcb->inode_item.flags & BTRFS_INODE_NODATASUM))
4468                     add_checksum_entry(fcb->Vcb, er->address + er->length - er->skip_end, (ULONG)(er->skip_end / fcb->Vcb->superblock.sector_size), NULL, NULL);
4469 
4470                 ExAcquireResourceExclusiveLite(&er->chunk->lock, TRUE);
4471 
4472                 if (!er->chunk->cache_loaded) {
4473                     NTSTATUS Status = load_cache_chunk(fcb->Vcb, er->chunk, NULL);
4474 
4475                     if (!NT_SUCCESS(Status)) {
4476                         ERR("load_cache_chunk returned %08x\n", Status);
4477                         ExReleaseResourceLite(&er->chunk->lock);
4478                         goto end;
4479                     }
4480                 }
4481 
4482                 er->chunk->used -= er->skip_end;
4483 
4484                 space_list_add(er->chunk, er->address + er->length - er->skip_end, er->skip_end, NULL);
4485 
4486                 ExReleaseResourceLite(&er->chunk->lock);
4487 
4488                 er->length -= er->skip_end;
4489             }
4490 
4491             le = le->Flink;
4492         }
4493     }
4494 
4495     if (num_extents < 2)
4496         goto end;
4497 
4498     // merge together adjacent extents
4499     le = extent_ranges.Flink;
4500     while (le != &extent_ranges) {
4501         er = CONTAINING_RECORD(le, extent_range, list_entry);
4502 
4503         if (le->Flink != &extent_ranges && er->length < MAX_EXTENT_SIZE) {
4504             extent_range* er2 = CONTAINING_RECORD(le->Flink, extent_range, list_entry);
4505 
4506             if (er->chunk == er2->chunk) {
4507                 if (er2->address == er->address + er->length && er2->offset >= er->offset + er->length) {
4508                     if (er->length + er2->length <= MAX_EXTENT_SIZE) {
4509                         er->length += er2->length;
4510                         er->changed = TRUE;
4511 
4512                         RemoveEntryList(&er2->list_entry);
4513                         ExFreePool(er2);
4514 
4515                         changed = TRUE;
4516                         continue;
4517                     }
4518                 }
4519             }
4520         }
4521 
4522         le = le->Flink;
4523     }
4524 
4525     if (!changed)
4526         goto end;
4527 
4528     le = fcb->extents.Flink;
4529     while (le != &fcb->extents) {
4530         extent* ext = CONTAINING_RECORD(le, extent, list_entry);
4531 
4532         if ((ext->extent_data.type == EXTENT_TYPE_REGULAR || ext->extent_data.type == EXTENT_TYPE_PREALLOC) && ext->extent_data.compression == BTRFS_COMPRESSION_NONE && ext->unique) {
4533             EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ext->extent_data.data;
4534 
4535             if (ed2->size != 0) {
4536                 LIST_ENTRY* le2;
4537 
4538                 le2 = extent_ranges.Flink;
4539                 while (le2 != &extent_ranges) {
4540                     extent_range* er2 = CONTAINING_RECORD(le2, extent_range, list_entry);
4541 
4542                     if (ed2->address >= er2->address && ed2->address + ed2->size <= er2->address + er2->length && er2->changed) {
4543                         NTSTATUS Status;
4544 
4545                         Status = update_changed_extent_ref(fcb->Vcb, er2->chunk, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset,
4546                                                            -1, fcb->inode_item.flags & BTRFS_INODE_NODATASUM, TRUE, Irp);
4547                         if (!NT_SUCCESS(Status)) {
4548                             ERR("update_changed_extent_ref returned %08x\n", Status);
4549                             goto end;
4550                         }
4551 
4552                         ed2->offset += ed2->address - er2->address;
4553                         ed2->address = er2->address;
4554                         ed2->size = er2->length;
4555                         ext->extent_data.decoded_size = ed2->size;
4556 
4557                         add_changed_extent_ref(er2->chunk, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset,
4558                                                1, fcb->inode_item.flags & BTRFS_INODE_NODATASUM);
4559 
4560                         break;
4561                     }
4562 
4563                     le2 = le2->Flink;
4564                 }
4565             }
4566         }
4567 
4568         le = le->Flink;
4569     }
4570 
4571 end:
4572     while (!IsListEmpty(&extent_ranges)) {
4573         le = RemoveHeadList(&extent_ranges);
4574         er = CONTAINING_RECORD(le, extent_range, list_entry);
4575 
4576         ExFreePool(er);
4577     }
4578 }
4579 
4580 NTSTATUS flush_fcb(fcb* fcb, BOOL cache, LIST_ENTRY* batchlist, PIRP Irp) {
4581     traverse_ptr tp;
4582     KEY searchkey;
4583     NTSTATUS Status;
4584     INODE_ITEM* ii;
4585     UINT64 ii_offset;
4586 #ifdef DEBUG_PARANOID
4587     UINT64 old_size = 0;
4588     BOOL extents_changed;
4589 #endif
4590 
4591     if (fcb->ads) {
4592         if (fcb->deleted) {
4593             Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, fcb->adsxattr.Buffer, fcb->adsxattr.Length, fcb->adshash);
4594             if (!NT_SUCCESS(Status)) {
4595                 ERR("delete_xattr returned %08x\n", Status);
4596                 goto end;
4597             }
4598         } else {
4599             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, fcb->adsxattr.Buffer, fcb->adsxattr.Length,
4600                                fcb->adshash, (UINT8*)fcb->adsdata.Buffer, fcb->adsdata.Length);
4601             if (!NT_SUCCESS(Status)) {
4602                 ERR("set_xattr returned %08x\n", Status);
4603                 goto end;
4604             }
4605         }
4606 
4607         Status = STATUS_SUCCESS;
4608         goto end;
4609     }
4610 
4611     if (fcb->deleted) {
4612         Status = insert_tree_item_batch(batchlist, fcb->Vcb, fcb->subvol, fcb->inode, TYPE_INODE_ITEM, 0xffffffffffffffff, NULL, 0, Batch_DeleteInode);
4613         if (!NT_SUCCESS(Status)) {
4614             ERR("insert_tree_item_batch returned %08x\n", Status);
4615             goto end;
4616         }
4617 
4618         Status = STATUS_SUCCESS;
4619         goto end;
4620     }
4621 
4622 #ifdef DEBUG_PARANOID
4623     extents_changed = fcb->extents_changed;
4624 #endif
4625 
4626     if (fcb->extents_changed) {
4627         LIST_ENTRY* le;
4628         BOOL prealloc = FALSE, extents_inline = FALSE;
4629         UINT64 last_end;
4630 
4631         // delete ignored extent items
4632         le = fcb->extents.Flink;
4633         while (le != &fcb->extents) {
4634             LIST_ENTRY* le2 = le->Flink;
4635             extent* ext = CONTAINING_RECORD(le, extent, list_entry);
4636 
4637             if (ext->ignore) {
4638                 RemoveEntryList(&ext->list_entry);
4639 
4640                 if (ext->csum)
4641                     ExFreePool(ext->csum);
4642 
4643                 ExFreePool(ext);
4644             }
4645 
4646             le = le2;
4647         }
4648 
4649         le = fcb->extents.Flink;
4650         while (le != &fcb->extents) {
4651             extent* ext = CONTAINING_RECORD(le, extent, list_entry);
4652 
4653             if (ext->inserted && ext->csum && ext->extent_data.type == EXTENT_TYPE_REGULAR) {
4654                 EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ext->extent_data.data;
4655 
4656                 if (ed2->size > 0) { // not sparse
4657                     if (ext->extent_data.compression == BTRFS_COMPRESSION_NONE)
4658                         add_checksum_entry(fcb->Vcb, ed2->address + ed2->offset, (ULONG)(ed2->num_bytes / fcb->Vcb->superblock.sector_size), ext->csum, Irp);
4659                     else
4660                         add_checksum_entry(fcb->Vcb, ed2->address, (ULONG)(ed2->size / fcb->Vcb->superblock.sector_size), ext->csum, Irp);
4661                 }
4662             }
4663 
4664             le = le->Flink;
4665         }
4666 
4667         if (!IsListEmpty(&fcb->extents)) {
4668             rationalize_extents(fcb, Irp);
4669 
4670             // merge together adjacent EXTENT_DATAs pointing to same extent
4671 
4672             le = fcb->extents.Flink;
4673             while (le != &fcb->extents) {
4674                 LIST_ENTRY* le2 = le->Flink;
4675                 extent* ext = CONTAINING_RECORD(le, extent, list_entry);
4676 
4677                 if ((ext->extent_data.type == EXTENT_TYPE_REGULAR || ext->extent_data.type == EXTENT_TYPE_PREALLOC) && le->Flink != &fcb->extents) {
4678                     extent* nextext = CONTAINING_RECORD(le->Flink, extent, list_entry);
4679 
4680                     if (ext->extent_data.type == nextext->extent_data.type) {
4681                         EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ext->extent_data.data;
4682                         EXTENT_DATA2* ned2 = (EXTENT_DATA2*)nextext->extent_data.data;
4683 
4684                         if (ed2->size != 0 && ed2->address == ned2->address && ed2->size == ned2->size &&
4685                             nextext->offset == ext->offset + ed2->num_bytes && ned2->offset == ed2->offset + ed2->num_bytes) {
4686                             chunk* c;
4687 
4688                             if (ext->extent_data.compression == BTRFS_COMPRESSION_NONE && ext->csum) {
4689                                 ULONG len = (ULONG)((ed2->num_bytes + ned2->num_bytes) / fcb->Vcb->superblock.sector_size);
4690                                 UINT32* csum;
4691 
4692                                 csum = ExAllocatePoolWithTag(NonPagedPool, len * sizeof(UINT32), ALLOC_TAG);
4693                                 if (!csum) {
4694                                     ERR("out of memory\n");
4695                                     Status = STATUS_INSUFFICIENT_RESOURCES;
4696                                     goto end;
4697                                 }
4698 
4699                                 RtlCopyMemory(csum, ext->csum, (ULONG)(ed2->num_bytes * sizeof(UINT32) / fcb->Vcb->superblock.sector_size));
4700                                 RtlCopyMemory(&csum[ed2->num_bytes / fcb->Vcb->superblock.sector_size], nextext->csum,
4701                                               (ULONG)(ned2->num_bytes * sizeof(UINT32) / fcb->Vcb->superblock.sector_size));
4702 
4703                                 ExFreePool(ext->csum);
4704                                 ext->csum = csum;
4705                             }
4706 
4707                             ext->extent_data.generation = fcb->Vcb->superblock.generation;
4708                             ed2->num_bytes += ned2->num_bytes;
4709 
4710                             RemoveEntryList(&nextext->list_entry);
4711 
4712                             if (nextext->csum)
4713                                 ExFreePool(nextext->csum);
4714 
4715                             ExFreePool(nextext);
4716 
4717                             c = get_chunk_from_address(fcb->Vcb, ed2->address);
4718 
4719                             if (!c) {
4720                                 ERR("get_chunk_from_address(%llx) failed\n", ed2->address);
4721                             } else {
4722                                 Status = update_changed_extent_ref(fcb->Vcb, c, ed2->address, ed2->size, fcb->subvol->id, fcb->inode, ext->offset - ed2->offset, -1,
4723                                                                 fcb->inode_item.flags & BTRFS_INODE_NODATASUM, FALSE, Irp);
4724                                 if (!NT_SUCCESS(Status)) {
4725                                     ERR("update_changed_extent_ref returned %08x\n", Status);
4726                                     goto end;
4727                                 }
4728                             }
4729 
4730                             le2 = le;
4731                         }
4732                     }
4733                 }
4734 
4735                 le = le2;
4736             }
4737         }
4738 
4739         if (!fcb->created) {
4740             // delete existing EXTENT_DATA items
4741 
4742             Status = insert_tree_item_batch(batchlist, fcb->Vcb, fcb->subvol, fcb->inode, TYPE_EXTENT_DATA, 0, NULL, 0, Batch_DeleteExtentData);
4743             if (!NT_SUCCESS(Status)) {
4744                 ERR("insert_tree_item_batch returned %08x\n", Status);
4745                 goto end;
4746             }
4747         }
4748 
4749         // add new EXTENT_DATAs
4750 
4751         last_end = 0;
4752 
4753         le = fcb->extents.Flink;
4754         while (le != &fcb->extents) {
4755             extent* ext = CONTAINING_RECORD(le, extent, list_entry);
4756             EXTENT_DATA* ed;
4757 
4758             ext->inserted = FALSE;
4759 
4760             if (!(fcb->Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_NO_HOLES) && ext->offset > last_end) {
4761                 Status = insert_sparse_extent(fcb, batchlist, last_end, ext->offset - last_end);
4762                 if (!NT_SUCCESS(Status)) {
4763                     ERR("insert_sparse_extent returned %08x\n", Status);
4764                     goto end;
4765                 }
4766             }
4767 
4768             ed = ExAllocatePoolWithTag(PagedPool, ext->datalen, ALLOC_TAG);
4769             if (!ed) {
4770                 ERR("out of memory\n");
4771                 Status = STATUS_INSUFFICIENT_RESOURCES;
4772                 goto end;
4773             }
4774 
4775             RtlCopyMemory(ed, &ext->extent_data, ext->datalen);
4776 
4777             Status = insert_tree_item_batch(batchlist, fcb->Vcb, fcb->subvol, fcb->inode, TYPE_EXTENT_DATA, ext->offset,
4778                                             ed, ext->datalen, Batch_Insert);
4779             if (!NT_SUCCESS(Status)) {
4780                 ERR("insert_tree_item_batch returned %08x\n", Status);
4781                 goto end;
4782             }
4783 
4784             if (ed->type == EXTENT_TYPE_PREALLOC)
4785                 prealloc = TRUE;
4786 
4787             if (ed->type == EXTENT_TYPE_INLINE)
4788                 extents_inline = TRUE;
4789 
4790             if (!(fcb->Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_NO_HOLES)) {
4791                 if (ed->type == EXTENT_TYPE_INLINE)
4792                     last_end = ext->offset + ed->decoded_size;
4793                 else {
4794                     EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ed->data;
4795 
4796                     last_end = ext->offset + ed2->num_bytes;
4797                 }
4798             }
4799 
4800             le = le->Flink;
4801         }
4802 
4803         if (!(fcb->Vcb->superblock.incompat_flags & BTRFS_INCOMPAT_FLAGS_NO_HOLES) && !extents_inline &&
4804             sector_align(fcb->inode_item.st_size, fcb->Vcb->superblock.sector_size) > last_end) {
4805             Status = insert_sparse_extent(fcb, batchlist, last_end, sector_align(fcb->inode_item.st_size, fcb->Vcb->superblock.sector_size) - last_end);
4806             if (!NT_SUCCESS(Status)) {
4807                 ERR("insert_sparse_extent returned %08x\n", Status);
4808                 goto end;
4809             }
4810         }
4811 
4812         // update prealloc flag in INODE_ITEM
4813 
4814         if (!prealloc)
4815             fcb->inode_item.flags &= ~BTRFS_INODE_PREALLOC;
4816         else
4817             fcb->inode_item.flags |= BTRFS_INODE_PREALLOC;
4818 
4819         fcb->inode_item_changed = TRUE;
4820 
4821         fcb->extents_changed = FALSE;
4822     }
4823 
4824     if ((!fcb->created && fcb->inode_item_changed) || cache) {
4825         searchkey.obj_id = fcb->inode;
4826         searchkey.obj_type = TYPE_INODE_ITEM;
4827         searchkey.offset = 0xffffffffffffffff;
4828 
4829         Status = find_item(fcb->Vcb, fcb->subvol, &tp, &searchkey, FALSE, Irp);
4830         if (!NT_SUCCESS(Status)) {
4831             ERR("error - find_item returned %08x\n", Status);
4832             goto end;
4833         }
4834 
4835         if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
4836             if (cache) {
4837                 ii = ExAllocatePoolWithTag(PagedPool, sizeof(INODE_ITEM), ALLOC_TAG);
4838                 if (!ii) {
4839                     ERR("out of memory\n");
4840                     Status = STATUS_INSUFFICIENT_RESOURCES;
4841                     goto end;
4842                 }
4843 
4844                 RtlCopyMemory(ii, &fcb->inode_item, sizeof(INODE_ITEM));
4845 
4846                 Status = insert_tree_item(fcb->Vcb, fcb->subvol, fcb->inode, TYPE_INODE_ITEM, 0, ii, sizeof(INODE_ITEM), NULL, Irp);
4847                 if (!NT_SUCCESS(Status)) {
4848                     ERR("insert_tree_item returned %08x\n", Status);
4849                     goto end;
4850                 }
4851 
4852                 ii_offset = 0;
4853             } else {
4854                 ERR("could not find INODE_ITEM for inode %llx in subvol %llx\n", fcb->inode, fcb->subvol->id);
4855                 Status = STATUS_INTERNAL_ERROR;
4856                 goto end;
4857             }
4858         } else {
4859 #ifdef DEBUG_PARANOID
4860             INODE_ITEM* ii2 = (INODE_ITEM*)tp.item->data;
4861 
4862             old_size = ii2->st_size;
4863 #endif
4864 
4865             ii_offset = tp.item->key.offset;
4866         }
4867 
4868         if (!cache) {
4869             Status = delete_tree_item(fcb->Vcb, &tp);
4870             if (!NT_SUCCESS(Status)) {
4871                 ERR("delete_tree_item returned %08x\n", Status);
4872                 goto end;
4873             }
4874         } else {
4875             searchkey.obj_id = fcb->inode;
4876             searchkey.obj_type = TYPE_INODE_ITEM;
4877             searchkey.offset = ii_offset;
4878 
4879             Status = find_item(fcb->Vcb, fcb->subvol, &tp, &searchkey, FALSE, Irp);
4880             if (!NT_SUCCESS(Status)) {
4881                 ERR("error - find_item returned %08x\n", Status);
4882                 goto end;
4883             }
4884 
4885             if (keycmp(tp.item->key, searchkey)) {
4886                 ERR("could not find INODE_ITEM for inode %llx in subvol %llx\n", fcb->inode, fcb->subvol->id);
4887                 Status = STATUS_INTERNAL_ERROR;
4888                 goto end;
4889             } else
4890                 RtlCopyMemory(tp.item->data, &fcb->inode_item, min(tp.item->size, sizeof(INODE_ITEM)));
4891         }
4892 
4893 #ifdef DEBUG_PARANOID
4894         if (!extents_changed && fcb->type != BTRFS_TYPE_DIRECTORY && old_size != fcb->inode_item.st_size) {
4895             ERR("error - size has changed but extents not marked as changed\n");
4896             int3;
4897         }
4898 #endif
4899     } else
4900         ii_offset = 0;
4901 
4902     fcb->created = FALSE;
4903 
4904     if (!cache && fcb->inode_item_changed) {
4905         ii = ExAllocatePoolWithTag(PagedPool, sizeof(INODE_ITEM), ALLOC_TAG);
4906         if (!ii) {
4907             ERR("out of memory\n");
4908             Status = STATUS_INSUFFICIENT_RESOURCES;
4909             goto end;
4910         }
4911 
4912         RtlCopyMemory(ii, &fcb->inode_item, sizeof(INODE_ITEM));
4913 
4914         Status = insert_tree_item_batch(batchlist, fcb->Vcb, fcb->subvol, fcb->inode, TYPE_INODE_ITEM, ii_offset, ii, sizeof(INODE_ITEM),
4915                                         Batch_Insert);
4916         if (!NT_SUCCESS(Status)) {
4917             ERR("insert_tree_item_batch returned %08x\n", Status);
4918             goto end;
4919         }
4920 
4921         fcb->inode_item_changed = FALSE;
4922     }
4923 
4924     if (fcb->sd_dirty) {
4925         if (!fcb->sd_deleted) {
4926             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_NTACL, (UINT16)strlen(EA_NTACL),
4927                                EA_NTACL_HASH, (UINT8*)fcb->sd, (UINT16)RtlLengthSecurityDescriptor(fcb->sd));
4928             if (!NT_SUCCESS(Status)) {
4929                 ERR("set_xattr returned %08x\n", Status);
4930                 goto end;
4931             }
4932         } else {
4933             Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_NTACL, (UINT16)strlen(EA_NTACL), EA_NTACL_HASH);
4934             if (!NT_SUCCESS(Status)) {
4935                 ERR("delete_xattr returned %08x\n", Status);
4936                 goto end;
4937             }
4938         }
4939 
4940         fcb->sd_deleted = FALSE;
4941         fcb->sd_dirty = FALSE;
4942     }
4943 
4944     if (fcb->atts_changed) {
4945         if (!fcb->atts_deleted) {
4946             UINT8 val[16], *val2;
4947             ULONG atts = fcb->atts;
4948 
4949             TRACE("inserting new DOSATTRIB xattr\n");
4950 
4951             if (fcb->inode == SUBVOL_ROOT_INODE)
4952                 atts &= ~FILE_ATTRIBUTE_READONLY;
4953 
4954             val2 = &val[sizeof(val) - 1];
4955 
4956             do {
4957                 UINT8 c = atts % 16;
4958                 *val2 = c <= 9 ? (c + '0') : (c - 0xa + 'a');
4959 
4960                 val2--;
4961                 atts >>= 4;
4962             } while (atts != 0);
4963 
4964             *val2 = 'x';
4965             val2--;
4966             *val2 = '0';
4967 
4968             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_DOSATTRIB, (UINT16)strlen(EA_DOSATTRIB),
4969                                EA_DOSATTRIB_HASH, val2, (UINT16)(val + sizeof(val) - val2));
4970             if (!NT_SUCCESS(Status)) {
4971                 ERR("set_xattr returned %08x\n", Status);
4972                 goto end;
4973             }
4974         } else {
4975             Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_DOSATTRIB, (UINT16)strlen(EA_DOSATTRIB), EA_DOSATTRIB_HASH);
4976             if (!NT_SUCCESS(Status)) {
4977                 ERR("delete_xattr returned %08x\n", Status);
4978                 goto end;
4979             }
4980         }
4981 
4982         fcb->atts_changed = FALSE;
4983         fcb->atts_deleted = FALSE;
4984     }
4985 
4986     if (fcb->reparse_xattr_changed) {
4987         if (fcb->reparse_xattr.Buffer && fcb->reparse_xattr.Length > 0) {
4988             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_REPARSE, (UINT16)strlen(EA_REPARSE),
4989                                EA_REPARSE_HASH, (UINT8*)fcb->reparse_xattr.Buffer, (UINT16)fcb->reparse_xattr.Length);
4990             if (!NT_SUCCESS(Status)) {
4991                 ERR("set_xattr returned %08x\n", Status);
4992                 goto end;
4993             }
4994         } else {
4995             Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_REPARSE, (UINT16)strlen(EA_REPARSE), EA_REPARSE_HASH);
4996             if (!NT_SUCCESS(Status)) {
4997                 ERR("delete_xattr returned %08x\n", Status);
4998                 goto end;
4999             }
5000         }
5001 
5002         fcb->reparse_xattr_changed = FALSE;
5003     }
5004 
5005     if (fcb->ea_changed) {
5006         if (fcb->ea_xattr.Buffer && fcb->ea_xattr.Length > 0) {
5007             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_EA, (UINT16)strlen(EA_EA),
5008                                EA_EA_HASH, (UINT8*)fcb->ea_xattr.Buffer, (UINT16)fcb->ea_xattr.Length);
5009             if (!NT_SUCCESS(Status)) {
5010                 ERR("set_xattr returned %08x\n", Status);
5011                 goto end;
5012             }
5013         } else {
5014             Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_EA, (UINT16)strlen(EA_EA), EA_EA_HASH);
5015             if (!NT_SUCCESS(Status)) {
5016                 ERR("delete_xattr returned %08x\n", Status);
5017                 goto end;
5018             }
5019         }
5020 
5021         fcb->ea_changed = FALSE;
5022     }
5023 
5024     if (fcb->prop_compression_changed) {
5025         if (fcb->prop_compression == PropCompression_None) {
5026             Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_PROP_COMPRESSION, (UINT16)strlen(EA_PROP_COMPRESSION), EA_PROP_COMPRESSION_HASH);
5027             if (!NT_SUCCESS(Status)) {
5028                 ERR("delete_xattr returned %08x\n", Status);
5029                 goto end;
5030             }
5031         } else if (fcb->prop_compression == PropCompression_Zlib) {
5032             const char zlib[] = "zlib";
5033 
5034             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_PROP_COMPRESSION, (UINT16)strlen(EA_PROP_COMPRESSION),
5035                                EA_PROP_COMPRESSION_HASH, (UINT8*)zlib, (UINT16)strlen(zlib));
5036             if (!NT_SUCCESS(Status)) {
5037                 ERR("set_xattr returned %08x\n", Status);
5038                 goto end;
5039             }
5040         } else if (fcb->prop_compression == PropCompression_LZO) {
5041             const char lzo[] = "lzo";
5042 
5043             Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, EA_PROP_COMPRESSION, (UINT16)strlen(EA_PROP_COMPRESSION),
5044                                EA_PROP_COMPRESSION_HASH, (UINT8*)lzo, (UINT16)strlen(lzo));
5045             if (!NT_SUCCESS(Status)) {
5046                 ERR("set_xattr returned %08x\n", Status);
5047                 goto end;
5048             }
5049         }
5050 
5051         fcb->prop_compression_changed = FALSE;
5052     }
5053 
5054     if (fcb->xattrs_changed) {
5055         LIST_ENTRY* le;
5056 
5057         le = fcb->xattrs.Flink;
5058         while (le != &fcb->xattrs) {
5059             xattr* xa = CONTAINING_RECORD(le, xattr, list_entry);
5060             LIST_ENTRY* le2 = le->Flink;
5061 
5062             if (xa->dirty) {
5063                 UINT32 hash = calc_crc32c(0xfffffffe, (UINT8*)xa->data, xa->namelen);
5064 
5065                 if (xa->valuelen == 0) {
5066                     Status = delete_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, xa->data, xa->namelen, hash);
5067                     if (!NT_SUCCESS(Status)) {
5068                         ERR("delete_xattr returned %08x\n", Status);
5069                         goto end;
5070                     }
5071 
5072                     RemoveEntryList(&xa->list_entry);
5073                     ExFreePool(xa);
5074                 } else {
5075                     Status = set_xattr(fcb->Vcb, batchlist, fcb->subvol, fcb->inode, xa->data, xa->namelen,
5076                                        hash, (UINT8*)&xa->data[xa->namelen], xa->valuelen);
5077                     if (!NT_SUCCESS(Status)) {
5078                         ERR("set_xattr returned %08x\n", Status);
5079                         goto end;
5080                     }
5081 
5082                     xa->dirty = FALSE;
5083                 }
5084             }
5085 
5086             le = le2;
5087         }
5088 
5089         fcb->xattrs_changed = FALSE;
5090     }
5091 
5092     Status = STATUS_SUCCESS;
5093 
5094 end:
5095     if (fcb->dirty) {
5096         BOOL lock = FALSE;
5097 
5098         fcb->dirty = FALSE;
5099 
5100         if (!ExIsResourceAcquiredExclusiveLite(&fcb->Vcb->dirty_fcbs_lock)) {
5101             ExAcquireResourceExclusiveLite(&fcb->Vcb->dirty_fcbs_lock, TRUE);
5102             lock = TRUE;
5103         }
5104 
5105         RemoveEntryList(&fcb->list_entry_dirty);
5106 
5107         if (lock)
5108             ExReleaseResourceLite(&fcb->Vcb->dirty_fcbs_lock);
5109     }
5110 
5111     return Status;
5112 }
5113 
5114 void add_trim_entry_avoid_sb(device_extension* Vcb, device* dev, UINT64 address, UINT64 size) {
5115     int i;
5116     ULONG sblen = (ULONG)sector_align(sizeof(superblock), Vcb->superblock.sector_size);
5117 
5118     i = 0;
5119     while (superblock_addrs[i] != 0) {
5120         if (superblock_addrs[i] + sblen >= address && superblock_addrs[i] < address + size) {
5121             if (superblock_addrs[i] > address)
5122                 add_trim_entry(dev, address, superblock_addrs[i] - address);
5123 
5124             if (size <= superblock_addrs[i] + sblen - address)
5125                 return;
5126 
5127             size -= superblock_addrs[i] + sblen - address;
5128             address = superblock_addrs[i] + sblen;
5129         } else if (superblock_addrs[i] > address + size)
5130             break;
5131 
5132         i++;
5133     }
5134 
5135     add_trim_entry(dev, address, size);
5136 }
5137 
5138 static NTSTATUS drop_chunk(device_extension* Vcb, chunk* c, LIST_ENTRY* batchlist, PIRP Irp, LIST_ENTRY* rollback) {
5139     NTSTATUS Status;
5140     KEY searchkey;
5141     traverse_ptr tp;
5142     UINT64 i, factor;
5143     CHUNK_ITEM_STRIPE* cis = (CHUNK_ITEM_STRIPE*)&c->chunk_item[1];;
5144 
5145     TRACE("dropping chunk %llx\n", c->offset);
5146 
5147     if (c->chunk_item->type & BLOCK_FLAG_RAID0)
5148         factor = c->chunk_item->num_stripes;
5149     else if (c->chunk_item->type & BLOCK_FLAG_RAID10)
5150         factor = c->chunk_item->num_stripes / c->chunk_item->sub_stripes;
5151     else if (c->chunk_item->type & BLOCK_FLAG_RAID5)
5152         factor = c->chunk_item->num_stripes - 1;
5153     else if (c->chunk_item->type & BLOCK_FLAG_RAID6)
5154         factor = c->chunk_item->num_stripes - 2;
5155     else // SINGLE, DUPLICATE, RAID1
5156         factor = 1;
5157 
5158     // do TRIM
5159     if (Vcb->trim && !Vcb->options.no_trim) {
5160         UINT64 len = c->chunk_item->size / factor;
5161 
5162         for (i = 0; i < c->chunk_item->num_stripes; i++) {
5163             if (c->devices[i] && c->devices[i]->devobj && !c->devices[i]->readonly && c->devices[i]->trim)
5164                 add_trim_entry_avoid_sb(Vcb, c->devices[i], cis[i].offset, len);
5165         }
5166     }
5167 
5168     if (!c->cache) {
5169         Status = load_stored_free_space_cache(Vcb, c, TRUE, Irp);
5170 
5171         if (!NT_SUCCESS(Status) && Status != STATUS_NOT_FOUND)
5172             WARN("load_stored_free_space_cache returned %08x\n", Status);
5173     }
5174 
5175     // remove free space cache
5176     if (c->cache) {
5177         c->cache->deleted = TRUE;
5178 
5179         Status = excise_extents(Vcb, c->cache, 0, c->cache->inode_item.st_size, Irp, rollback);
5180         if (!NT_SUCCESS(Status)) {
5181             ERR("excise_extents returned %08x\n", Status);
5182             return Status;
5183         }
5184 
5185         Status = flush_fcb(c->cache, TRUE, batchlist, Irp);
5186 
5187         free_fcb(Vcb, c->cache);
5188 
5189         if (!NT_SUCCESS(Status)) {
5190             ERR("flush_fcb returned %08x\n", Status);
5191             return Status;
5192         }
5193 
5194         searchkey.obj_id = FREE_SPACE_CACHE_ID;
5195         searchkey.obj_type = 0;
5196         searchkey.offset = c->offset;
5197 
5198         Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
5199         if (!NT_SUCCESS(Status)) {
5200             ERR("error - find_item returned %08x\n", Status);
5201             return Status;
5202         }
5203 
5204         if (!keycmp(tp.item->key, searchkey)) {
5205             Status = delete_tree_item(Vcb, &tp);
5206             if (!NT_SUCCESS(Status)) {
5207                 ERR("delete_tree_item returned %08x\n", Status);
5208                 return Status;
5209             }
5210         }
5211     }
5212 
5213     if (Vcb->space_root) {
5214         Status = insert_tree_item_batch(batchlist, Vcb, Vcb->space_root, c->offset, TYPE_FREE_SPACE_INFO, c->chunk_item->size,
5215                                         NULL, 0, Batch_DeleteFreeSpace);
5216         if (!NT_SUCCESS(Status)) {
5217             ERR("insert_tree_item_batch returned %08x\n", Status);
5218             return Status;
5219         }
5220     }
5221 
5222     for (i = 0; i < c->chunk_item->num_stripes; i++) {
5223         if (!c->created) {
5224             // remove DEV_EXTENTs from tree 4
5225             searchkey.obj_id = cis[i].dev_id;
5226             searchkey.obj_type = TYPE_DEV_EXTENT;
5227             searchkey.offset = cis[i].offset;
5228 
5229             Status = find_item(Vcb, Vcb->dev_root, &tp, &searchkey, FALSE, Irp);
5230             if (!NT_SUCCESS(Status)) {
5231                 ERR("error - find_item returned %08x\n", Status);
5232                 return Status;
5233             }
5234 
5235             if (!keycmp(tp.item->key, searchkey)) {
5236                 Status = delete_tree_item(Vcb, &tp);
5237                 if (!NT_SUCCESS(Status)) {
5238                     ERR("delete_tree_item returned %08x\n", Status);
5239                     return Status;
5240                 }
5241 
5242                 if (tp.item->size >= sizeof(DEV_EXTENT)) {
5243                     DEV_EXTENT* de = (DEV_EXTENT*)tp.item->data;
5244 
5245                     c->devices[i]->devitem.bytes_used -= de->length;
5246 
5247                     if (Vcb->balance.thread && Vcb->balance.shrinking && Vcb->balance.opts[0].devid == c->devices[i]->devitem.dev_id) {
5248                         if (cis[i].offset < Vcb->balance.opts[0].drange_start && cis[i].offset + de->length > Vcb->balance.opts[0].drange_start)
5249                             space_list_add2(&c->devices[i]->space, NULL, cis[i].offset, Vcb->balance.opts[0].drange_start - cis[i].offset, NULL, rollback);
5250                     } else
5251                         space_list_add2(&c->devices[i]->space, NULL, cis[i].offset, de->length, NULL, rollback);
5252                 }
5253             } else
5254                 WARN("could not find (%llx,%x,%llx) in dev tree\n", searchkey.obj_id, searchkey.obj_type, searchkey.offset);
5255         } else {
5256             UINT64 len = c->chunk_item->size / factor;
5257 
5258             c->devices[i]->devitem.bytes_used -= len;
5259 
5260             if (Vcb->balance.thread && Vcb->balance.shrinking && Vcb->balance.opts[0].devid == c->devices[i]->devitem.dev_id) {
5261                 if (cis[i].offset < Vcb->balance.opts[0].drange_start && cis[i].offset + len > Vcb->balance.opts[0].drange_start)
5262                     space_list_add2(&c->devices[i]->space, NULL, cis[i].offset, Vcb->balance.opts[0].drange_start - cis[i].offset, NULL, rollback);
5263             } else
5264                 space_list_add2(&c->devices[i]->space, NULL, cis[i].offset, len, NULL, rollback);
5265         }
5266     }
5267 
5268     // modify DEV_ITEMs in chunk tree
5269     for (i = 0; i < c->chunk_item->num_stripes; i++) {
5270         if (c->devices[i]) {
5271             UINT64 j;
5272             DEV_ITEM* di;
5273 
5274             searchkey.obj_id = 1;
5275             searchkey.obj_type = TYPE_DEV_ITEM;
5276             searchkey.offset = c->devices[i]->devitem.dev_id;
5277 
5278             Status = find_item(Vcb, Vcb->chunk_root, &tp, &searchkey, FALSE, Irp);
5279             if (!NT_SUCCESS(Status)) {
5280                 ERR("error - find_item returned %08x\n", Status);
5281                 return Status;
5282             }
5283 
5284             if (keycmp(tp.item->key, searchkey)) {
5285                 ERR("error - could not find DEV_ITEM for device %llx\n", searchkey.offset);
5286                 return STATUS_INTERNAL_ERROR;
5287             }
5288 
5289             Status = delete_tree_item(Vcb, &tp);
5290             if (!NT_SUCCESS(Status)) {
5291                 ERR("delete_tree_item returned %08x\n", Status);
5292                 return Status;
5293             }
5294 
5295             di = ExAllocatePoolWithTag(PagedPool, sizeof(DEV_ITEM), ALLOC_TAG);
5296             if (!di) {
5297                 ERR("out of memory\n");
5298                 return STATUS_INSUFFICIENT_RESOURCES;
5299             }
5300 
5301             RtlCopyMemory(di, &c->devices[i]->devitem, sizeof(DEV_ITEM));
5302 
5303             Status = insert_tree_item(Vcb, Vcb->chunk_root, 1, TYPE_DEV_ITEM, c->devices[i]->devitem.dev_id, di, sizeof(DEV_ITEM), NULL, Irp);
5304             if (!NT_SUCCESS(Status)) {
5305                 ERR("insert_tree_item returned %08x\n", Status);
5306                 return Status;
5307             }
5308 
5309             for (j = i + 1; j < c->chunk_item->num_stripes; j++) {
5310                 if (c->devices[j] == c->devices[i])
5311                     c->devices[j] = NULL;
5312             }
5313         }
5314     }
5315 
5316     if (!c->created) {
5317         // remove CHUNK_ITEM from chunk tree
5318         searchkey.obj_id = 0x100;
5319         searchkey.obj_type = TYPE_CHUNK_ITEM;
5320         searchkey.offset = c->offset;
5321 
5322         Status = find_item(Vcb, Vcb->chunk_root, &tp, &searchkey, FALSE, Irp);
5323         if (!NT_SUCCESS(Status)) {
5324             ERR("error - find_item returned %08x\n", Status);
5325             return Status;
5326         }
5327 
5328         if (!keycmp(tp.item->key, searchkey)) {
5329             Status = delete_tree_item(Vcb, &tp);
5330 
5331             if (!NT_SUCCESS(Status)) {
5332                 ERR("delete_tree_item returned %08x\n", Status);
5333                 return Status;
5334             }
5335         } else
5336             WARN("could not find CHUNK_ITEM for chunk %llx\n", c->offset);
5337 
5338         // remove BLOCK_GROUP_ITEM from extent tree
5339         searchkey.obj_id = c->offset;
5340         searchkey.obj_type = TYPE_BLOCK_GROUP_ITEM;
5341         searchkey.offset = 0xffffffffffffffff;
5342 
5343         Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
5344         if (!NT_SUCCESS(Status)) {
5345             ERR("error - find_item returned %08x\n", Status);
5346             return Status;
5347         }
5348 
5349         if (tp.item->key.obj_id == searchkey.obj_id && tp.item->key.obj_type == searchkey.obj_type) {
5350             Status = delete_tree_item(Vcb, &tp);
5351 
5352             if (!NT_SUCCESS(Status)) {
5353                 ERR("delete_tree_item returned %08x\n", Status);
5354                 return Status;
5355             }
5356         } else
5357             WARN("could not find BLOCK_GROUP_ITEM for chunk %llx\n", c->offset);
5358     }
5359 
5360     if (c->chunk_item->type & BLOCK_FLAG_SYSTEM)
5361         remove_from_bootstrap(Vcb, 0x100, TYPE_CHUNK_ITEM, c->offset);
5362 
5363     RemoveEntryList(&c->list_entry);
5364 
5365     // clear raid56 incompat flag if dropping last RAID5/6 chunk
5366 
5367     if (c->chunk_item->type & BLOCK_FLAG_RAID5 || c->chunk_item->type & BLOCK_FLAG_RAID6) {
5368         LIST_ENTRY* le;
5369         BOOL clear_flag = TRUE;
5370 
5371         le = Vcb->chunks.Flink;
5372         while (le != &Vcb->chunks) {
5373             chunk* c2 = CONTAINING_RECORD(le, chunk, list_entry);
5374 
5375             if (c2->chunk_item->type & BLOCK_FLAG_RAID5 || c2->chunk_item->type & BLOCK_FLAG_RAID6) {
5376                 clear_flag = FALSE;
5377                 break;
5378             }
5379 
5380             le = le->Flink;
5381         }
5382 
5383         if (clear_flag)
5384             Vcb->superblock.incompat_flags &= ~BTRFS_INCOMPAT_FLAGS_RAID56;
5385     }
5386 
5387     Vcb->superblock.bytes_used -= c->oldused;
5388 
5389     ExFreePool(c->chunk_item);
5390     ExFreePool(c->devices);
5391 
5392     while (!IsListEmpty(&c->space)) {
5393         space* s = CONTAINING_RECORD(c->space.Flink, space, list_entry);
5394 
5395         RemoveEntryList(&s->list_entry);
5396         ExFreePool(s);
5397     }
5398 
5399     while (!IsListEmpty(&c->deleting)) {
5400         space* s = CONTAINING_RECORD(c->deleting.Flink, space, list_entry);
5401 
5402         RemoveEntryList(&s->list_entry);
5403         ExFreePool(s);
5404     }
5405 
5406     ExDeleteResourceLite(&c->partial_stripes_lock);
5407     ExDeleteResourceLite(&c->range_locks_lock);
5408     ExDeleteResourceLite(&c->lock);
5409     ExDeleteResourceLite(&c->changed_extents_lock);
5410 
5411     ExFreePool(c);
5412 
5413     return STATUS_SUCCESS;
5414 }
5415 
5416 static NTSTATUS partial_stripe_read(device_extension* Vcb, chunk* c, partial_stripe* ps, UINT64 startoff, UINT16 parity, ULONG offset, ULONG len) {
5417     NTSTATUS Status;
5418     ULONG sl = (ULONG)(c->chunk_item->stripe_length / Vcb->superblock.sector_size);
5419     CHUNK_ITEM_STRIPE* cis = (CHUNK_ITEM_STRIPE*)&c->chunk_item[1];
5420 
5421     while (len > 0) {
5422         ULONG readlen = min(offset + len, offset + (sl - (offset % sl))) - offset;
5423         UINT16 stripe;
5424 
5425         stripe = (parity + (offset / sl) + 1) % c->chunk_item->num_stripes;
5426 
5427         if (c->devices[stripe]->devobj) {
5428             Status = sync_read_phys(c->devices[stripe]->devobj, cis[stripe].offset + startoff + ((offset % sl) * Vcb->superblock.sector_size),
5429                                     readlen * Vcb->superblock.sector_size, ps->data + (offset * Vcb->superblock.sector_size), FALSE);
5430             if (!NT_SUCCESS(Status)) {
5431                 ERR("sync_read_phys returned %08x\n", Status);
5432                 return Status;
5433             }
5434         } else if (c->chunk_item->type & BLOCK_FLAG_RAID5) {
5435             UINT16 i;
5436             UINT8* scratch;
5437 
5438             scratch = ExAllocatePoolWithTag(NonPagedPool, readlen * Vcb->superblock.sector_size, ALLOC_TAG);
5439             if (!scratch) {
5440                 ERR("out of memory\n");
5441                 return STATUS_INSUFFICIENT_RESOURCES;
5442             }
5443 
5444             for (i = 0; i < c->chunk_item->num_stripes; i++) {
5445                 if (i != stripe) {
5446                     if (!c->devices[i]->devobj) {
5447                         ExFreePool(scratch);
5448                         return STATUS_UNEXPECTED_IO_ERROR;
5449                     }
5450 
5451                     if (i == 0 || (stripe == 0 && i == 1)) {
5452                         Status = sync_read_phys(c->devices[i]->devobj, cis[i].offset + startoff + ((offset % sl) * Vcb->superblock.sector_size),
5453                                                 readlen * Vcb->superblock.sector_size, ps->data + (offset * Vcb->superblock.sector_size), FALSE);
5454                         if (!NT_SUCCESS(Status)) {
5455                             ERR("sync_read_phys returned %08x\n", Status);
5456                             ExFreePool(scratch);
5457                             return Status;
5458                         }
5459                     } else {
5460                         Status = sync_read_phys(c->devices[i]->devobj, cis[i].offset + startoff + ((offset % sl) * Vcb->superblock.sector_size),
5461                                                 readlen * Vcb->superblock.sector_size, scratch, FALSE);
5462                         if (!NT_SUCCESS(Status)) {
5463                             ERR("sync_read_phys returned %08x\n", Status);
5464                             ExFreePool(scratch);
5465                             return Status;
5466                         }
5467 
5468                         do_xor(ps->data + (offset * Vcb->superblock.sector_size), scratch, readlen * Vcb->superblock.sector_size);
5469                     }
5470                 }
5471             }
5472 
5473             ExFreePool(scratch);
5474         } else {
5475             UINT8* scratch;
5476             UINT16 k, i, logstripe, error_stripe, num_errors = 0;
5477 
5478             scratch = ExAllocatePoolWithTag(NonPagedPool, (c->chunk_item->num_stripes + 2) * readlen * Vcb->superblock.sector_size, ALLOC_TAG);
5479             if (!scratch) {
5480                 ERR("out of memory\n");
5481                 return STATUS_INSUFFICIENT_RESOURCES;
5482             }
5483 
5484             i = (parity + 1) % c->chunk_item->num_stripes;
5485             for (k = 0; k < c->chunk_item->num_stripes; k++) {
5486                 if (i != stripe) {
5487                     if (c->devices[i]->devobj) {
5488                         Status = sync_read_phys(c->devices[i]->devobj, cis[i].offset + startoff + ((offset % sl) * Vcb->superblock.sector_size),
5489                                                 readlen * Vcb->superblock.sector_size, scratch + (k * readlen * Vcb->superblock.sector_size), FALSE);
5490                         if (!NT_SUCCESS(Status)) {
5491                             ERR("sync_read_phys returned %08x\n", Status);
5492                             num_errors++;
5493                             error_stripe = k;
5494                         }
5495                     } else {
5496                         num_errors++;
5497                         error_stripe = k;
5498                     }
5499 
5500                     if (num_errors > 1) {
5501                         ExFreePool(scratch);
5502                         return STATUS_UNEXPECTED_IO_ERROR;
5503                     }
5504                 } else
5505                     logstripe = k;
5506 
5507                 i = (i + 1) % c->chunk_item->num_stripes;
5508             }
5509 
5510             if (num_errors == 0 || error_stripe == c->chunk_item->num_stripes - 1) {
5511                 for (k = 0; k < c->chunk_item->num_stripes - 1; k++) {
5512                     if (k != logstripe) {
5513                         if (k == 0 || (k == 1 && logstripe == 0)) {
5514                             RtlCopyMemory(ps->data + (offset * Vcb->superblock.sector_size), scratch + (k * readlen * Vcb->superblock.sector_size),
5515                                           readlen * Vcb->superblock.sector_size);
5516                         } else {
5517                             do_xor(ps->data + (offset * Vcb->superblock.sector_size), scratch + (k * readlen * Vcb->superblock.sector_size),
5518                                    readlen * Vcb->superblock.sector_size);
5519                         }
5520                     }
5521                 }
5522             } else {
5523                 raid6_recover2(scratch, c->chunk_item->num_stripes, readlen * Vcb->superblock.sector_size, logstripe,
5524                                error_stripe, scratch + (c->chunk_item->num_stripes * readlen * Vcb->superblock.sector_size));
5525 
5526                 RtlCopyMemory(ps->data + (offset * Vcb->superblock.sector_size), scratch + (c->chunk_item->num_stripes * readlen * Vcb->superblock.sector_size),
5527                               readlen * Vcb->superblock.sector_size);
5528             }
5529 
5530             ExFreePool(scratch);
5531         }
5532 
5533         offset += readlen;
5534         len -= readlen;
5535     }
5536 
5537     return STATUS_SUCCESS;
5538 }
5539 
5540 NTSTATUS flush_partial_stripe(device_extension* Vcb, chunk* c, partial_stripe* ps) {
5541     NTSTATUS Status;
5542     UINT16 parity2, stripe, startoffstripe;
5543     UINT8* data;
5544     UINT64 startoff;
5545     ULONG runlength, index, last1;
5546     CHUNK_ITEM_STRIPE* cis = (CHUNK_ITEM_STRIPE*)&c->chunk_item[1];
5547     LIST_ENTRY* le;
5548     UINT16 k, num_data_stripes = c->chunk_item->num_stripes - (c->chunk_item->type & BLOCK_FLAG_RAID5 ? 1 : 2);
5549     UINT64 ps_length = num_data_stripes * c->chunk_item->stripe_length;
5550     ULONG stripe_length = (ULONG)c->chunk_item->stripe_length;
5551 
5552     // FIXME - do writes asynchronously?
5553 
5554     get_raid0_offset(ps->address - c->offset, stripe_length, num_data_stripes, &startoff, &startoffstripe);
5555 
5556     parity2 = (((ps->address - c->offset) / ps_length) + c->chunk_item->num_stripes - 1) % c->chunk_item->num_stripes;
5557 
5558     // read data (or reconstruct if degraded)
5559 
5560     runlength = RtlFindFirstRunClear(&ps->bmp, &index);
5561     last1 = 0;
5562 
5563     while (runlength != 0) {
5564         if (index > last1) {
5565             Status = partial_stripe_read(Vcb, c, ps, startoff, parity2, last1, index - last1);
5566             if (!NT_SUCCESS(Status)) {
5567                 ERR("partial_stripe_read returned %08x\n", Status);
5568                 return Status;
5569             }
5570         }
5571 
5572         last1 = index + runlength;
5573 
5574         runlength = RtlFindNextForwardRunClear(&ps->bmp, index + runlength, &index);
5575     }
5576 
5577     if (last1 < ps_length / Vcb->superblock.sector_size) {
5578         Status = partial_stripe_read(Vcb, c, ps, startoff, parity2, last1, (ULONG)((ps_length / Vcb->superblock.sector_size) - last1));
5579         if (!NT_SUCCESS(Status)) {
5580             ERR("partial_stripe_read returned %08x\n", Status);
5581             return Status;
5582         }
5583     }
5584 
5585     // set unallocated data to 0
5586     le = c->space.Flink;
5587     while (le != &c->space) {
5588         space* s = CONTAINING_RECORD(le, space, list_entry);
5589 
5590         if (s->address + s->size > ps->address && s->address < ps->address + ps_length) {
5591             UINT64 start = max(ps->address, s->address);
5592             UINT64 end = min(ps->address + ps_length, s->address + s->size);
5593 
5594             RtlZeroMemory(ps->data + start - ps->address, (ULONG)(end - start));
5595         } else if (s->address >= ps->address + ps_length)
5596             break;
5597 
5598         le = le->Flink;
5599     }
5600 
5601     le = c->deleting.Flink;
5602     while (le != &c->deleting) {
5603         space* s = CONTAINING_RECORD(le, space, list_entry);
5604 
5605         if (s->address + s->size > ps->address && s->address < ps->address + ps_length) {
5606             UINT64 start = max(ps->address, s->address);
5607             UINT64 end = min(ps->address + ps_length, s->address + s->size);
5608 
5609             RtlZeroMemory(ps->data + start - ps->address, (ULONG)(end - start));
5610         } else if (s->address >= ps->address + ps_length)
5611             break;
5612 
5613         le = le->Flink;
5614     }
5615 
5616     stripe = (parity2 + 1) % c->chunk_item->num_stripes;
5617 
5618     data = ps->data;
5619     for (k = 0; k < num_data_stripes; k++) {
5620         if (c->devices[stripe]->devobj) {
5621             Status = write_data_phys(c->devices[stripe]->devobj, cis[stripe].offset + startoff, data, stripe_length);
5622             if (!NT_SUCCESS(Status)) {
5623                 ERR("write_data_phys returned %08x\n", Status);
5624                 return Status;
5625             }
5626         }
5627 
5628         data += stripe_length;
5629         stripe = (stripe + 1) % c->chunk_item->num_stripes;
5630     }
5631 
5632     // write parity
5633     if (c->chunk_item->type & BLOCK_FLAG_RAID5) {
5634         if (c->devices[parity2]->devobj) {
5635             UINT16 i;
5636 
5637             for (i = 1; i < c->chunk_item->num_stripes - 1; i++) {
5638                 do_xor(ps->data, ps->data + (i * stripe_length), stripe_length);
5639             }
5640 
5641             Status = write_data_phys(c->devices[parity2]->devobj, cis[parity2].offset + startoff, ps->data, stripe_length);
5642             if (!NT_SUCCESS(Status)) {
5643                 ERR("write_data_phys returned %08x\n", Status);
5644                 return Status;
5645             }
5646         }
5647     } else {
5648         UINT16 parity1 = (parity2 + c->chunk_item->num_stripes - 1) % c->chunk_item->num_stripes;
5649 
5650         if (c->devices[parity1]->devobj || c->devices[parity2]->devobj) {
5651             UINT8* scratch;
5652             UINT16 i;
5653 
5654             scratch = ExAllocatePoolWithTag(NonPagedPool, stripe_length * 2, ALLOC_TAG);
5655             if (!scratch) {
5656                 ERR("out of memory\n");
5657                 return STATUS_INSUFFICIENT_RESOURCES;
5658             }
5659 
5660             i = c->chunk_item->num_stripes - 3;
5661 
5662             while (TRUE) {
5663                 if (i == c->chunk_item->num_stripes - 3) {
5664                     RtlCopyMemory(scratch, ps->data + (i * stripe_length), stripe_length);
5665                     RtlCopyMemory(scratch + stripe_length, ps->data + (i * stripe_length), stripe_length);
5666                 } else {
5667                     do_xor(scratch, ps->data + (i * stripe_length), stripe_length);
5668 
5669                     galois_double(scratch + stripe_length, stripe_length);
5670                     do_xor(scratch + stripe_length, ps->data + (i * stripe_length), stripe_length);
5671                 }
5672 
5673                 if (i == 0)
5674                     break;
5675 
5676                 i--;
5677             }
5678 
5679             if (c->devices[parity1]->devobj) {
5680                 Status = write_data_phys(c->devices[parity1]->devobj, cis[parity1].offset + startoff, scratch, stripe_length);
5681                 if (!NT_SUCCESS(Status)) {
5682                     ERR("write_data_phys returned %08x\n", Status);
5683                     ExFreePool(scratch);
5684                     return Status;
5685                 }
5686             }
5687 
5688             if (c->devices[parity2]->devobj) {
5689                 Status = write_data_phys(c->devices[parity2]->devobj, cis[parity2].offset + startoff, scratch + stripe_length, stripe_length);
5690                 if (!NT_SUCCESS(Status)) {
5691                     ERR("write_data_phys returned %08x\n", Status);
5692                     ExFreePool(scratch);
5693                     return Status;
5694                 }
5695             }
5696 
5697             ExFreePool(scratch);
5698         }
5699     }
5700 
5701     return STATUS_SUCCESS;
5702 }
5703 
5704 static NTSTATUS update_chunks(device_extension* Vcb, LIST_ENTRY* batchlist, PIRP Irp, LIST_ENTRY* rollback) {
5705     LIST_ENTRY *le, *le2;
5706     NTSTATUS Status;
5707     UINT64 used_minus_cache;
5708 
5709     ExAcquireResourceExclusiveLite(&Vcb->chunk_lock, TRUE);
5710 
5711     // FIXME - do tree chunks before data chunks
5712 
5713     le = Vcb->chunks.Flink;
5714     while (le != &Vcb->chunks) {
5715         chunk* c = CONTAINING_RECORD(le, chunk, list_entry);
5716 
5717         le2 = le->Flink;
5718 
5719         if (c->changed) {
5720             ExAcquireResourceExclusiveLite(&c->lock, TRUE);
5721 
5722             // flush partial stripes
5723             if (!Vcb->readonly && (c->chunk_item->type & BLOCK_FLAG_RAID5 || c->chunk_item->type & BLOCK_FLAG_RAID6)) {
5724                 ExAcquireResourceExclusiveLite(&c->partial_stripes_lock, TRUE);
5725 
5726                 while (!IsListEmpty(&c->partial_stripes)) {
5727                     partial_stripe* ps = CONTAINING_RECORD(RemoveHeadList(&c->partial_stripes), partial_stripe, list_entry);
5728 
5729                     Status = flush_partial_stripe(Vcb, c, ps);
5730 
5731                     if (ps->bmparr)
5732                         ExFreePool(ps->bmparr);
5733 
5734                     ExFreePool(ps);
5735 
5736                     if (!NT_SUCCESS(Status)) {
5737                         ERR("flush_partial_stripe returned %08x\n", Status);
5738                         ExReleaseResourceLite(&c->partial_stripes_lock);
5739                         ExReleaseResourceLite(&c->lock);
5740                         ExReleaseResourceLite(&Vcb->chunk_lock);
5741                         return Status;
5742                     }
5743                 }
5744 
5745                 ExReleaseResourceLite(&c->partial_stripes_lock);
5746             }
5747 
5748             if (c->list_entry_balance.Flink) {
5749                 ExReleaseResourceLite(&c->lock);
5750                 le = le2;
5751                 continue;
5752             }
5753 
5754             if (c->space_changed || c->created) {
5755                 used_minus_cache = c->used;
5756 
5757                 // subtract self-hosted cache
5758                 if (used_minus_cache > 0 && c->chunk_item->type & BLOCK_FLAG_DATA && c->cache && c->cache->inode_item.st_size == c->used) {
5759                     LIST_ENTRY* le3;
5760 
5761                     le3 = c->cache->extents.Flink;
5762                     while (le3 != &c->cache->extents) {
5763                         extent* ext = CONTAINING_RECORD(le3, extent, list_entry);
5764                         EXTENT_DATA* ed = &ext->extent_data;
5765 
5766                         if (!ext->ignore) {
5767                             if (ed->type == EXTENT_TYPE_REGULAR || ed->type == EXTENT_TYPE_PREALLOC) {
5768                                 EXTENT_DATA2* ed2 = (EXTENT_DATA2*)ed->data;
5769 
5770                                 if (ed2->size != 0 && ed2->address >= c->offset && ed2->address + ed2->size <= c->offset + c->chunk_item->size)
5771                                     used_minus_cache -= ed2->size;
5772                             }
5773                         }
5774 
5775                         le3 = le3->Flink;
5776                     }
5777                 }
5778 
5779                 if (used_minus_cache == 0) {
5780                     Status = drop_chunk(Vcb, c, batchlist, Irp, rollback);
5781                     if (!NT_SUCCESS(Status)) {
5782                         ERR("drop_chunk returned %08x\n", Status);
5783                         ExReleaseResourceLite(&c->lock);
5784                         ExReleaseResourceLite(&Vcb->chunk_lock);
5785                         return Status;
5786                     }
5787                 } else if (c->created) {
5788                     Status = create_chunk(Vcb, c, Irp);
5789                     if (!NT_SUCCESS(Status)) {
5790                         ERR("create_chunk returned %08x\n", Status);
5791                         ExReleaseResourceLite(&c->lock);
5792                         ExReleaseResourceLite(&Vcb->chunk_lock);
5793                         return Status;
5794                     }
5795                 }
5796 
5797                 if (used_minus_cache > 0)
5798                     ExReleaseResourceLite(&c->lock);
5799             }
5800         }
5801 
5802         le = le2;
5803     }
5804 
5805     ExReleaseResourceLite(&Vcb->chunk_lock);
5806 
5807     return STATUS_SUCCESS;
5808 }
5809 
5810 static NTSTATUS delete_root_ref(device_extension* Vcb, UINT64 subvolid, UINT64 parsubvolid, UINT64 parinode, PANSI_STRING utf8, PIRP Irp) {
5811     KEY searchkey;
5812     traverse_ptr tp;
5813     NTSTATUS Status;
5814 
5815     searchkey.obj_id = parsubvolid;
5816     searchkey.obj_type = TYPE_ROOT_REF;
5817     searchkey.offset = subvolid;
5818 
5819     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
5820     if (!NT_SUCCESS(Status)) {
5821         ERR("error - find_item returned %08x\n", Status);
5822         return Status;
5823     }
5824 
5825     if (!keycmp(searchkey, tp.item->key)) {
5826         if (tp.item->size < sizeof(ROOT_REF)) {
5827             ERR("(%llx,%x,%llx) was %u bytes, expected at least %u\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, tp.item->size, sizeof(ROOT_REF));
5828             return STATUS_INTERNAL_ERROR;
5829         } else {
5830             ROOT_REF* rr;
5831             ULONG len;
5832 
5833             rr = (ROOT_REF*)tp.item->data;
5834             len = tp.item->size;
5835 
5836             do {
5837                 UINT16 itemlen;
5838 
5839                 if (len < sizeof(ROOT_REF) || len < offsetof(ROOT_REF, name[0]) + rr->n) {
5840                     ERR("(%llx,%x,%llx) was truncated\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset);
5841                     break;
5842                 }
5843 
5844                 itemlen = (UINT16)offsetof(ROOT_REF, name[0]) + rr->n;
5845 
5846                 if (rr->dir == parinode && rr->n == utf8->Length && RtlCompareMemory(rr->name, utf8->Buffer, rr->n) == rr->n) {
5847                     UINT16 newlen = tp.item->size - itemlen;
5848 
5849                     Status = delete_tree_item(Vcb, &tp);
5850                     if (!NT_SUCCESS(Status)) {
5851                         ERR("delete_tree_item returned %08x\n", Status);
5852                         return Status;
5853                     }
5854 
5855                     if (newlen == 0) {
5856                         TRACE("deleting (%llx,%x,%llx)\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset);
5857                     } else {
5858                         UINT8 *newrr = ExAllocatePoolWithTag(PagedPool, newlen, ALLOC_TAG), *rroff;
5859 
5860                         if (!newrr) {
5861                             ERR("out of memory\n");
5862                             return STATUS_INSUFFICIENT_RESOURCES;
5863                         }
5864 
5865                         TRACE("modifying (%llx,%x,%llx)\n", tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset);
5866 
5867                         if ((UINT8*)rr > tp.item->data) {
5868                             RtlCopyMemory(newrr, tp.item->data, (UINT8*)rr - tp.item->data);
5869                             rroff = newrr + ((UINT8*)rr - tp.item->data);
5870                         } else {
5871                             rroff = newrr;
5872                         }
5873 
5874                         if ((UINT8*)&rr->name[rr->n] < tp.item->data + tp.item->size)
5875                             RtlCopyMemory(rroff, &rr->name[rr->n], tp.item->size - ((UINT8*)&rr->name[rr->n] - tp.item->data));
5876 
5877                         Status = insert_tree_item(Vcb, Vcb->root_root, tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, newrr, newlen, NULL, Irp);
5878                         if (!NT_SUCCESS(Status)) {
5879                             ERR("insert_tree_item returned %08x\n", Status);
5880                             ExFreePool(newrr);
5881                             return Status;
5882                         }
5883                     }
5884 
5885                     break;
5886                 }
5887 
5888                 if (len > itemlen) {
5889                     len -= itemlen;
5890                     rr = (ROOT_REF*)&rr->name[rr->n];
5891                 } else
5892                     break;
5893             } while (len > 0);
5894         }
5895     } else {
5896         WARN("could not find ROOT_REF entry for subvol %llx in %llx\n", searchkey.offset, searchkey.obj_id);
5897         return STATUS_NOT_FOUND;
5898     }
5899 
5900     return STATUS_SUCCESS;
5901 }
5902 
5903 #ifdef _MSC_VER
5904 #pragma warning(push)
5905 #pragma warning(suppress: 28194)
5906 #endif
5907 static NTSTATUS add_root_ref(_In_ device_extension* Vcb, _In_ UINT64 subvolid, _In_ UINT64 parsubvolid, _In_ __drv_aliasesMem ROOT_REF* rr, _In_opt_ PIRP Irp) {
5908     KEY searchkey;
5909     traverse_ptr tp;
5910     NTSTATUS Status;
5911 
5912     searchkey.obj_id = parsubvolid;
5913     searchkey.obj_type = TYPE_ROOT_REF;
5914     searchkey.offset = subvolid;
5915 
5916     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
5917     if (!NT_SUCCESS(Status)) {
5918         ERR("error - find_item returned %08x\n", Status);
5919         return Status;
5920     }
5921 
5922     if (!keycmp(searchkey, tp.item->key)) {
5923         UINT16 rrsize = tp.item->size + (UINT16)offsetof(ROOT_REF, name[0]) + rr->n;
5924         UINT8* rr2;
5925 
5926         rr2 = ExAllocatePoolWithTag(PagedPool, rrsize, ALLOC_TAG);
5927         if (!rr2) {
5928             ERR("out of memory\n");
5929             return STATUS_INSUFFICIENT_RESOURCES;
5930         }
5931 
5932         if (tp.item->size > 0)
5933             RtlCopyMemory(rr2, tp.item->data, tp.item->size);
5934 
5935         RtlCopyMemory(rr2 + tp.item->size, rr, offsetof(ROOT_REF, name[0]) + rr->n);
5936         ExFreePool(rr);
5937 
5938         Status = delete_tree_item(Vcb, &tp);
5939         if (!NT_SUCCESS(Status)) {
5940             ERR("delete_tree_item returned %08x\n", Status);
5941             ExFreePool(rr2);
5942             return Status;
5943         }
5944 
5945         Status = insert_tree_item(Vcb, Vcb->root_root, searchkey.obj_id, searchkey.obj_type, searchkey.offset, rr2, rrsize, NULL, Irp);
5946         if (!NT_SUCCESS(Status)) {
5947             ERR("insert_tree_item returned %08x\n", Status);
5948             ExFreePool(rr2);
5949             return Status;
5950         }
5951     } else {
5952         Status = insert_tree_item(Vcb, Vcb->root_root, searchkey.obj_id, searchkey.obj_type, searchkey.offset, rr, (UINT16)offsetof(ROOT_REF, name[0]) + rr->n, NULL, Irp);
5953         if (!NT_SUCCESS(Status)) {
5954             ERR("insert_tree_item returned %08x\n", Status);
5955             ExFreePool(rr);
5956             return Status;
5957         }
5958     }
5959 
5960     return STATUS_SUCCESS;
5961 }
5962 #ifdef _MSC_VER
5963 #pragma warning(pop)
5964 #endif
5965 
5966 static NTSTATUS update_root_backref(device_extension* Vcb, UINT64 subvolid, UINT64 parsubvolid, PIRP Irp) {
5967     KEY searchkey;
5968     traverse_ptr tp;
5969     UINT8* data;
5970     UINT16 datalen;
5971     NTSTATUS Status;
5972 
5973     searchkey.obj_id = parsubvolid;
5974     searchkey.obj_type = TYPE_ROOT_REF;
5975     searchkey.offset = subvolid;
5976 
5977     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
5978     if (!NT_SUCCESS(Status)) {
5979         ERR("error - find_item returned %08x\n", Status);
5980         return Status;
5981     }
5982 
5983     if (!keycmp(tp.item->key, searchkey) && tp.item->size > 0) {
5984         datalen = tp.item->size;
5985 
5986         data = ExAllocatePoolWithTag(PagedPool, datalen, ALLOC_TAG);
5987         if (!data) {
5988             ERR("out of memory\n");
5989             return STATUS_INSUFFICIENT_RESOURCES;
5990         }
5991 
5992         RtlCopyMemory(data, tp.item->data, datalen);
5993     } else {
5994         datalen = 0;
5995         data = NULL;
5996     }
5997 
5998     searchkey.obj_id = subvolid;
5999     searchkey.obj_type = TYPE_ROOT_BACKREF;
6000     searchkey.offset = parsubvolid;
6001 
6002     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
6003     if (!NT_SUCCESS(Status)) {
6004         ERR("error - find_item returned %08x\n", Status);
6005 
6006         if (datalen > 0)
6007             ExFreePool(data);
6008 
6009         return Status;
6010     }
6011 
6012     if (!keycmp(tp.item->key, searchkey)) {
6013         Status = delete_tree_item(Vcb, &tp);
6014         if (!NT_SUCCESS(Status)) {
6015             ERR("delete_tree_item returned %08x\n", Status);
6016 
6017             if (datalen > 0)
6018                 ExFreePool(data);
6019 
6020             return Status;
6021         }
6022     }
6023 
6024     if (datalen > 0) {
6025         Status = insert_tree_item(Vcb, Vcb->root_root, subvolid, TYPE_ROOT_BACKREF, parsubvolid, data, datalen, NULL, Irp);
6026         if (!NT_SUCCESS(Status)) {
6027             ERR("insert_tree_item returned %08x\n", Status);
6028             ExFreePool(data);
6029             return Status;
6030         }
6031     }
6032 
6033     return STATUS_SUCCESS;
6034 }
6035 
6036 static NTSTATUS add_root_item_to_cache(device_extension* Vcb, UINT64 root, PIRP Irp) {
6037     KEY searchkey;
6038     traverse_ptr tp;
6039     NTSTATUS Status;
6040 
6041     searchkey.obj_id = root;
6042     searchkey.obj_type = TYPE_ROOT_ITEM;
6043     searchkey.offset = 0xffffffffffffffff;
6044 
6045     Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
6046     if (!NT_SUCCESS(Status)) {
6047         ERR("error - find_item returned %08x\n", Status);
6048         return Status;
6049     }
6050 
6051     if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
6052         ERR("could not find ROOT_ITEM for tree %llx\n", searchkey.obj_id);
6053         return STATUS_INTERNAL_ERROR;
6054     }
6055 
6056     if (tp.item->size < sizeof(ROOT_ITEM)) { // if not full length, create new entry with new bits zeroed
6057         ROOT_ITEM* ri = ExAllocatePoolWithTag(PagedPool, sizeof(ROOT_ITEM), ALLOC_TAG);
6058         if (!ri) {
6059             ERR("out of memory\n");
6060             return STATUS_INSUFFICIENT_RESOURCES;
6061         }
6062 
6063         if (tp.item->size > 0)
6064             RtlCopyMemory(ri, tp.item->data, tp.item->size);
6065 
6066         RtlZeroMemory(((UINT8*)ri) + tp.item->size, sizeof(ROOT_ITEM) - tp.item->size);
6067 
6068         Status = delete_tree_item(Vcb, &tp);
6069         if (!NT_SUCCESS(Status)) {
6070             ERR("delete_tree_item returned %08x\n", Status);
6071             ExFreePool(ri);
6072             return Status;
6073         }
6074 
6075         Status = insert_tree_item(Vcb, Vcb->root_root, searchkey.obj_id, searchkey.obj_type, tp.item->key.offset, ri, sizeof(ROOT_ITEM), NULL, Irp);
6076         if (!NT_SUCCESS(Status)) {
6077             ERR("insert_tree_item returned %08x\n", Status);
6078             ExFreePool(ri);
6079             return Status;
6080         }
6081     } else {
6082         tp.tree->write = TRUE;
6083     }
6084 
6085     return STATUS_SUCCESS;
6086 }
6087 
6088 static NTSTATUS flush_fileref(file_ref* fileref, LIST_ENTRY* batchlist, PIRP Irp) {
6089     NTSTATUS Status;
6090 
6091     // if fileref created and then immediately deleted, do nothing
6092     if (fileref->created && fileref->deleted) {
6093         fileref->dirty = FALSE;
6094         return STATUS_SUCCESS;
6095     }
6096 
6097     if (fileref->fcb->ads) {
6098         fileref->dirty = FALSE;
6099         return STATUS_SUCCESS;
6100     }
6101 
6102     if (fileref->created) {
6103         UINT16 disize;
6104         DIR_ITEM *di, *di2;
6105         UINT32 crc32;
6106 
6107         crc32 = calc_crc32c(0xfffffffe, (UINT8*)fileref->dc->utf8.Buffer, fileref->dc->utf8.Length);
6108 
6109         disize = (UINT16)(offsetof(DIR_ITEM, name[0]) + fileref->dc->utf8.Length);
6110         di = ExAllocatePoolWithTag(PagedPool, disize, ALLOC_TAG);
6111         if (!di) {
6112             ERR("out of memory\n");
6113             return STATUS_INSUFFICIENT_RESOURCES;
6114         }
6115 
6116         if (fileref->parent->fcb->subvol == fileref->fcb->subvol) {
6117             di->key.obj_id = fileref->fcb->inode;
6118             di->key.obj_type = TYPE_INODE_ITEM;
6119             di->key.offset = 0;
6120         } else { // subvolume
6121             di->key.obj_id = fileref->fcb->subvol->id;
6122             di->key.obj_type = TYPE_ROOT_ITEM;
6123             di->key.offset = 0xffffffffffffffff;
6124         }
6125 
6126         di->transid = fileref->fcb->Vcb->superblock.generation;
6127         di->m = 0;
6128         di->n = (UINT16)fileref->dc->utf8.Length;
6129         di->type = fileref->fcb->type;
6130         RtlCopyMemory(di->name, fileref->dc->utf8.Buffer, fileref->dc->utf8.Length);
6131 
6132         di2 = ExAllocatePoolWithTag(PagedPool, disize, ALLOC_TAG);
6133         if (!di2) {
6134             ERR("out of memory\n");
6135             return STATUS_INSUFFICIENT_RESOURCES;
6136         }
6137 
6138         RtlCopyMemory(di2, di, disize);
6139 
6140         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_INDEX,
6141                                         fileref->dc->index, di, disize, Batch_Insert);
6142         if (!NT_SUCCESS(Status)) {
6143             ERR("insert_tree_item_batch returned %08x\n", Status);
6144             return Status;
6145         }
6146 
6147         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_ITEM, crc32,
6148                                         di2, disize, Batch_DirItem);
6149         if (!NT_SUCCESS(Status)) {
6150             ERR("insert_tree_item_batch returned %08x\n", Status);
6151             return Status;
6152         }
6153 
6154         if (fileref->parent->fcb->subvol == fileref->fcb->subvol) {
6155             INODE_REF* ir;
6156 
6157             ir = ExAllocatePoolWithTag(PagedPool, sizeof(INODE_REF) - 1 + fileref->dc->utf8.Length, ALLOC_TAG);
6158             if (!ir) {
6159                 ERR("out of memory\n");
6160                 return STATUS_INSUFFICIENT_RESOURCES;
6161             }
6162 
6163             ir->index = fileref->dc->index;
6164             ir->n = fileref->dc->utf8.Length;
6165             RtlCopyMemory(ir->name, fileref->dc->utf8.Buffer, ir->n);
6166 
6167             Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->fcb->subvol, fileref->fcb->inode, TYPE_INODE_REF, fileref->parent->fcb->inode,
6168                                             ir, sizeof(INODE_REF) - 1 + ir->n, Batch_InodeRef);
6169             if (!NT_SUCCESS(Status)) {
6170                 ERR("insert_tree_item_batch returned %08x\n", Status);
6171                 return Status;
6172             }
6173         } else if (fileref->fcb != fileref->fcb->Vcb->dummy_fcb) {
6174             ULONG rrlen;
6175             ROOT_REF* rr;
6176 
6177             rrlen = sizeof(ROOT_REF) - 1 + fileref->dc->utf8.Length;
6178 
6179             rr = ExAllocatePoolWithTag(PagedPool, rrlen, ALLOC_TAG);
6180             if (!rr) {
6181                 ERR("out of memory\n");
6182                 return STATUS_INSUFFICIENT_RESOURCES;
6183             }
6184 
6185             rr->dir = fileref->parent->fcb->inode;
6186             rr->index = fileref->dc->index;
6187             rr->n = fileref->dc->utf8.Length;
6188             RtlCopyMemory(rr->name, fileref->dc->utf8.Buffer, fileref->dc->utf8.Length);
6189 
6190             Status = add_root_ref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, rr, Irp);
6191             if (!NT_SUCCESS(Status)) {
6192                 ERR("add_root_ref returned %08x\n", Status);
6193                 return Status;
6194             }
6195 
6196             Status = update_root_backref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, Irp);
6197             if (!NT_SUCCESS(Status)) {
6198                 ERR("update_root_backref returned %08x\n", Status);
6199                 return Status;
6200             }
6201         }
6202 
6203         fileref->created = FALSE;
6204     } else if (fileref->deleted) {
6205         UINT32 crc32;
6206         ANSI_STRING* name;
6207         DIR_ITEM* di;
6208 
6209         name = &fileref->oldutf8;
6210 
6211         crc32 = calc_crc32c(0xfffffffe, (UINT8*)name->Buffer, name->Length);
6212 
6213         TRACE("deleting %.*S\n", file_desc_fileref(fileref));
6214 
6215         di = ExAllocatePoolWithTag(PagedPool, sizeof(DIR_ITEM) - 1 + name->Length, ALLOC_TAG);
6216         if (!di) {
6217             ERR("out of memory\n");
6218             return STATUS_INSUFFICIENT_RESOURCES;
6219         }
6220 
6221         di->m = 0;
6222         di->n = name->Length;
6223         RtlCopyMemory(di->name, name->Buffer, name->Length);
6224 
6225         // delete DIR_ITEM (0x54)
6226 
6227         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_ITEM,
6228                                         crc32, di, sizeof(DIR_ITEM) - 1 + name->Length, Batch_DeleteDirItem);
6229         if (!NT_SUCCESS(Status)) {
6230             ERR("insert_tree_item_batch returned %08x\n", Status);
6231             return Status;
6232         }
6233 
6234         if (fileref->parent->fcb->subvol == fileref->fcb->subvol) {
6235             INODE_REF* ir;
6236 
6237             // delete INODE_REF (0xc)
6238 
6239             ir = ExAllocatePoolWithTag(PagedPool, sizeof(INODE_REF) - 1 + name->Length, ALLOC_TAG);
6240             if (!ir) {
6241                 ERR("out of memory\n");
6242                 return STATUS_INSUFFICIENT_RESOURCES;
6243             }
6244 
6245             ir->index = fileref->oldindex;
6246             ir->n = name->Length;
6247             RtlCopyMemory(ir->name, name->Buffer, name->Length);
6248 
6249             Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->fcb->inode, TYPE_INODE_REF,
6250                                             fileref->parent->fcb->inode, ir, sizeof(INODE_REF) - 1 + name->Length, Batch_DeleteInodeRef);
6251             if (!NT_SUCCESS(Status)) {
6252                 ERR("insert_tree_item_batch returned %08x\n", Status);
6253                 return Status;
6254             }
6255         } else if (fileref->fcb != fileref->fcb->Vcb->dummy_fcb) { // subvolume
6256             Status = delete_root_ref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, fileref->parent->fcb->inode, name, Irp);
6257             if (!NT_SUCCESS(Status)) {
6258                 ERR("delete_root_ref returned %08x\n", Status);
6259                 return Status;
6260             }
6261 
6262             Status = update_root_backref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, Irp);
6263             if (!NT_SUCCESS(Status)) {
6264                 ERR("update_root_backref returned %08x\n", Status);
6265                 return Status;
6266             }
6267         }
6268 
6269         // delete DIR_INDEX (0x60)
6270 
6271         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_INDEX,
6272                                         fileref->oldindex, NULL, 0, Batch_Delete);
6273         if (!NT_SUCCESS(Status)) {
6274             ERR("insert_tree_item_batch returned %08x\n", Status);
6275             return Status;
6276         }
6277 
6278         if (fileref->oldutf8.Buffer) {
6279             ExFreePool(fileref->oldutf8.Buffer);
6280             fileref->oldutf8.Buffer = NULL;
6281         }
6282     } else { // rename or change type
6283         PANSI_STRING oldutf8 = fileref->oldutf8.Buffer ? &fileref->oldutf8 : &fileref->dc->utf8;
6284         UINT32 crc32, oldcrc32;
6285         UINT16 disize;
6286         DIR_ITEM *olddi, *di, *di2;
6287 
6288         crc32 = calc_crc32c(0xfffffffe, (UINT8*)fileref->dc->utf8.Buffer, fileref->dc->utf8.Length);
6289 
6290         if (!fileref->oldutf8.Buffer)
6291             oldcrc32 = crc32;
6292         else
6293             oldcrc32 = calc_crc32c(0xfffffffe, (UINT8*)fileref->oldutf8.Buffer, fileref->oldutf8.Length);
6294 
6295         olddi = ExAllocatePoolWithTag(PagedPool, sizeof(DIR_ITEM) - 1 + oldutf8->Length, ALLOC_TAG);
6296         if (!olddi) {
6297             ERR("out of memory\n");
6298             return STATUS_INSUFFICIENT_RESOURCES;
6299         }
6300 
6301         olddi->m = 0;
6302         olddi->n = (UINT16)oldutf8->Length;
6303         RtlCopyMemory(olddi->name, oldutf8->Buffer, oldutf8->Length);
6304 
6305         // delete DIR_ITEM (0x54)
6306 
6307         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_ITEM,
6308                                         oldcrc32, olddi, sizeof(DIR_ITEM) - 1 + oldutf8->Length, Batch_DeleteDirItem);
6309         if (!NT_SUCCESS(Status)) {
6310             ERR("insert_tree_item_batch returned %08x\n", Status);
6311             ExFreePool(olddi);
6312             return Status;
6313         }
6314 
6315         // add DIR_ITEM (0x54)
6316 
6317         disize = (UINT16)(offsetof(DIR_ITEM, name[0]) + fileref->dc->utf8.Length);
6318         di = ExAllocatePoolWithTag(PagedPool, disize, ALLOC_TAG);
6319         if (!di) {
6320             ERR("out of memory\n");
6321             return STATUS_INSUFFICIENT_RESOURCES;
6322         }
6323 
6324         di2 = ExAllocatePoolWithTag(PagedPool, disize, ALLOC_TAG);
6325         if (!di2) {
6326             ERR("out of memory\n");
6327             ExFreePool(di);
6328             return STATUS_INSUFFICIENT_RESOURCES;
6329         }
6330 
6331         if (fileref->dc)
6332             di->key = fileref->dc->key;
6333         else if (fileref->parent->fcb->subvol == fileref->fcb->subvol) {
6334             di->key.obj_id = fileref->fcb->inode;
6335             di->key.obj_type = TYPE_INODE_ITEM;
6336             di->key.offset = 0;
6337         } else { // subvolume
6338             di->key.obj_id = fileref->fcb->subvol->id;
6339             di->key.obj_type = TYPE_ROOT_ITEM;
6340             di->key.offset = 0xffffffffffffffff;
6341         }
6342 
6343         di->transid = fileref->fcb->Vcb->superblock.generation;
6344         di->m = 0;
6345         di->n = (UINT16)fileref->dc->utf8.Length;
6346         di->type = fileref->fcb->type;
6347         RtlCopyMemory(di->name, fileref->dc->utf8.Buffer, fileref->dc->utf8.Length);
6348 
6349         RtlCopyMemory(di2, di, disize);
6350 
6351         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_ITEM, crc32,
6352                                         di, disize, Batch_DirItem);
6353         if (!NT_SUCCESS(Status)) {
6354             ERR("insert_tree_item_batch returned %08x\n", Status);
6355             ExFreePool(di2);
6356             ExFreePool(di);
6357             return Status;
6358         }
6359 
6360         if (fileref->parent->fcb->subvol == fileref->fcb->subvol) {
6361             INODE_REF *ir, *ir2;
6362 
6363             // delete INODE_REF (0xc)
6364 
6365             ir = ExAllocatePoolWithTag(PagedPool, sizeof(INODE_REF) - 1 + oldutf8->Length, ALLOC_TAG);
6366             if (!ir) {
6367                 ERR("out of memory\n");
6368                 ExFreePool(di2);
6369                 return STATUS_INSUFFICIENT_RESOURCES;
6370             }
6371 
6372             ir->index = fileref->dc->index;
6373             ir->n = oldutf8->Length;
6374             RtlCopyMemory(ir->name, oldutf8->Buffer, ir->n);
6375 
6376             Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->fcb->subvol, fileref->fcb->inode, TYPE_INODE_REF, fileref->parent->fcb->inode,
6377                                             ir, sizeof(INODE_REF) - 1 + ir->n, Batch_DeleteInodeRef);
6378             if (!NT_SUCCESS(Status)) {
6379                 ERR("insert_tree_item_batch returned %08x\n", Status);
6380                 ExFreePool(ir);
6381                 ExFreePool(di2);
6382                 return Status;
6383             }
6384 
6385             // add INODE_REF (0xc)
6386 
6387             ir2 = ExAllocatePoolWithTag(PagedPool, sizeof(INODE_REF) - 1 + fileref->dc->utf8.Length, ALLOC_TAG);
6388             if (!ir2) {
6389                 ERR("out of memory\n");
6390                 ExFreePool(di2);
6391                 return STATUS_INSUFFICIENT_RESOURCES;
6392             }
6393 
6394             ir2->index = fileref->dc->index;
6395             ir2->n = fileref->dc->utf8.Length;
6396             RtlCopyMemory(ir2->name, fileref->dc->utf8.Buffer, ir2->n);
6397 
6398             Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->fcb->subvol, fileref->fcb->inode, TYPE_INODE_REF, fileref->parent->fcb->inode,
6399                                             ir2, sizeof(INODE_REF) - 1 + ir2->n, Batch_InodeRef);
6400             if (!NT_SUCCESS(Status)) {
6401                 ERR("insert_tree_item_batch returned %08x\n", Status);
6402                 ExFreePool(ir2);
6403                 ExFreePool(di2);
6404                 return Status;
6405             }
6406         } else if (fileref->fcb != fileref->fcb->Vcb->dummy_fcb) { // subvolume
6407             ULONG rrlen;
6408             ROOT_REF* rr;
6409 
6410             Status = delete_root_ref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, fileref->parent->fcb->inode, oldutf8, Irp);
6411             if (!NT_SUCCESS(Status)) {
6412                 ERR("delete_root_ref returned %08x\n", Status);
6413                 ExFreePool(di2);
6414                 return Status;
6415             }
6416 
6417             rrlen = sizeof(ROOT_REF) - 1 + fileref->dc->utf8.Length;
6418 
6419             rr = ExAllocatePoolWithTag(PagedPool, rrlen, ALLOC_TAG);
6420             if (!rr) {
6421                 ERR("out of memory\n");
6422                 ExFreePool(di2);
6423                 return STATUS_INSUFFICIENT_RESOURCES;
6424             }
6425 
6426             rr->dir = fileref->parent->fcb->inode;
6427             rr->index = fileref->dc->index;
6428             rr->n = fileref->dc->utf8.Length;
6429             RtlCopyMemory(rr->name, fileref->dc->utf8.Buffer, fileref->dc->utf8.Length);
6430 
6431             Status = add_root_ref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, rr, Irp);
6432             if (!NT_SUCCESS(Status)) {
6433                 ERR("add_root_ref returned %08x\n", Status);
6434                 ExFreePool(di2);
6435                 return Status;
6436             }
6437 
6438             Status = update_root_backref(fileref->fcb->Vcb, fileref->fcb->subvol->id, fileref->parent->fcb->subvol->id, Irp);
6439             if (!NT_SUCCESS(Status)) {
6440                 ERR("update_root_backref returned %08x\n", Status);
6441                 ExFreePool(di2);
6442                 return Status;
6443             }
6444         }
6445 
6446         // delete DIR_INDEX (0x60)
6447 
6448         Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_INDEX,
6449                                         fileref->dc->index, NULL, 0, Batch_Delete);
6450         if (!NT_SUCCESS(Status)) {
6451             ERR("insert_tree_item_batch returned %08x\n", Status);
6452             ExFreePool(di2);
6453             return Status;
6454         }
6455 
6456         // add DIR_INDEX (0x60)
6457 
6458        Status = insert_tree_item_batch(batchlist, fileref->fcb->Vcb, fileref->parent->fcb->subvol, fileref->parent->fcb->inode, TYPE_DIR_INDEX,
6459                                        fileref->dc->index, di2, disize, Batch_Insert);
6460        if (!NT_SUCCESS(Status)) {
6461             ERR("insert_tree_item_batch returned %08x\n", Status);
6462             ExFreePool(di2);
6463             return Status;
6464         }
6465 
6466         if (fileref->oldutf8.Buffer) {
6467             ExFreePool(fileref->oldutf8.Buffer);
6468             fileref->oldutf8.Buffer = NULL;
6469         }
6470     }
6471 
6472     fileref->dirty = FALSE;
6473 
6474     return STATUS_SUCCESS;
6475 }
6476 
6477 static void flush_disk_caches(device_extension* Vcb) {
6478     LIST_ENTRY* le;
6479     ioctl_context context;
6480     ULONG num;
6481 
6482     context.left = 0;
6483 
6484     le = Vcb->devices.Flink;
6485 
6486     while (le != &Vcb->devices) {
6487         device* dev = CONTAINING_RECORD(le, device, list_entry);
6488 
6489         if (dev->devobj && !dev->readonly && dev->can_flush)
6490             context.left++;
6491 
6492         le = le->Flink;
6493     }
6494 
6495     if (context.left == 0)
6496         return;
6497 
6498     num = 0;
6499 
6500     KeInitializeEvent(&context.Event, NotificationEvent, FALSE);
6501 
6502     context.stripes = ExAllocatePoolWithTag(NonPagedPool, sizeof(ioctl_context_stripe) * context.left, ALLOC_TAG);
6503     if (!context.stripes) {
6504         ERR("out of memory\n");
6505         return;
6506     }
6507 
6508     RtlZeroMemory(context.stripes, sizeof(ioctl_context_stripe) * context.left);
6509 
6510     le = Vcb->devices.Flink;
6511 
6512     while (le != &Vcb->devices) {
6513         device* dev = CONTAINING_RECORD(le, device, list_entry);
6514 
6515         if (dev->devobj && !dev->readonly && dev->can_flush) {
6516             PIO_STACK_LOCATION IrpSp;
6517             ioctl_context_stripe* stripe = &context.stripes[num];
6518 
6519             RtlZeroMemory(&stripe->apte, sizeof(ATA_PASS_THROUGH_EX));
6520 
6521             stripe->apte.Length = sizeof(ATA_PASS_THROUGH_EX);
6522             stripe->apte.TimeOutValue = 5;
6523             stripe->apte.CurrentTaskFile[6] = IDE_COMMAND_FLUSH_CACHE;
6524 
6525             stripe->Irp = IoAllocateIrp(dev->devobj->StackSize, FALSE);
6526 
6527             if (!stripe->Irp) {
6528                 ERR("IoAllocateIrp failed\n");
6529                 goto nextdev;
6530             }
6531 
6532             IrpSp = IoGetNextIrpStackLocation(stripe->Irp);
6533             IrpSp->MajorFunction = IRP_MJ_DEVICE_CONTROL;
6534 
6535             IrpSp->Parameters.DeviceIoControl.IoControlCode = IOCTL_ATA_PASS_THROUGH;
6536             IrpSp->Parameters.DeviceIoControl.InputBufferLength = sizeof(ATA_PASS_THROUGH_EX);
6537             IrpSp->Parameters.DeviceIoControl.OutputBufferLength = sizeof(ATA_PASS_THROUGH_EX);
6538 
6539             stripe->Irp->AssociatedIrp.SystemBuffer = &stripe->apte;
6540             stripe->Irp->Flags |= IRP_BUFFERED_IO | IRP_INPUT_OPERATION;
6541             stripe->Irp->UserBuffer = &stripe->apte;
6542             stripe->Irp->UserIosb = &stripe->iosb;
6543 
6544             IoSetCompletionRoutine(stripe->Irp, ioctl_completion, &context, TRUE, TRUE, TRUE);
6545 
6546             IoCallDriver(dev->devobj, stripe->Irp);
6547 
6548 nextdev:
6549             num++;
6550         }
6551 
6552         le = le->Flink;
6553     }
6554 
6555     KeWaitForSingleObject(&context.Event, Executive, KernelMode, FALSE, NULL);
6556 
6557     ExFreePool(context.stripes);
6558 }
6559 
6560 static NTSTATUS flush_changed_dev_stats(device_extension* Vcb, device* dev, PIRP Irp) {
6561     NTSTATUS Status;
6562     KEY searchkey;
6563     traverse_ptr tp;
6564     UINT16 statslen;
6565     UINT64* stats;
6566 
6567     searchkey.obj_id = 0;
6568     searchkey.obj_type = TYPE_DEV_STATS;
6569     searchkey.offset = dev->devitem.dev_id;
6570 
6571     Status = find_item(Vcb, Vcb->dev_root, &tp, &searchkey, FALSE, Irp);
6572     if (!NT_SUCCESS(Status)) {
6573         ERR("find_item returned %08x\n", Status);
6574         return Status;
6575     }
6576 
6577     if (!keycmp(tp.item->key, searchkey)) {
6578         Status = delete_tree_item(Vcb, &tp);
6579         if (!NT_SUCCESS(Status)) {
6580             ERR("delete_tree_item returned %08x\n", Status);
6581             return Status;
6582         }
6583     }
6584 
6585     statslen = sizeof(UINT64) * 5;
6586     stats = ExAllocatePoolWithTag(PagedPool, statslen, ALLOC_TAG);
6587     if (!stats) {
6588         ERR("out of memory\n");
6589         return STATUS_INSUFFICIENT_RESOURCES;
6590     }
6591 
6592     RtlCopyMemory(stats, dev->stats, statslen);
6593 
6594     Status = insert_tree_item(Vcb, Vcb->dev_root, 0, TYPE_DEV_STATS, dev->devitem.dev_id, stats, statslen, NULL, Irp);
6595     if (!NT_SUCCESS(Status)) {
6596         ERR("insert_tree_item returned %08x\n", Status);
6597         ExFreePool(stats);
6598         return Status;
6599     }
6600 
6601     return STATUS_SUCCESS;
6602 }
6603 
6604 static NTSTATUS flush_subvol(device_extension* Vcb, root* r, PIRP Irp) {
6605     NTSTATUS Status;
6606 
6607     if (r != Vcb->root_root && r != Vcb->chunk_root) {
6608         KEY searchkey;
6609         traverse_ptr tp;
6610         ROOT_ITEM* ri;
6611 
6612         searchkey.obj_id = r->id;
6613         searchkey.obj_type = TYPE_ROOT_ITEM;
6614         searchkey.offset = 0xffffffffffffffff;
6615 
6616         Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
6617         if (!NT_SUCCESS(Status)) {
6618             ERR("error - find_item returned %08x\n", Status);
6619             return Status;
6620         }
6621 
6622         if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
6623             ERR("could not find ROOT_ITEM for tree %llx\n", searchkey.obj_id);
6624             return STATUS_INTERNAL_ERROR;
6625         }
6626 
6627         ri = ExAllocatePoolWithTag(PagedPool, sizeof(ROOT_ITEM), ALLOC_TAG);
6628         if (!ri) {
6629             ERR("out of memory\n");
6630             return STATUS_INSUFFICIENT_RESOURCES;
6631         }
6632 
6633         RtlCopyMemory(ri, &r->root_item, sizeof(ROOT_ITEM));
6634 
6635         Status = delete_tree_item(Vcb, &tp);
6636         if (!NT_SUCCESS(Status)) {
6637             ERR("delete_tree_item returned %08x\n", Status);
6638             return Status;
6639         }
6640 
6641         Status = insert_tree_item(Vcb, Vcb->root_root, tp.item->key.obj_id, tp.item->key.obj_type, tp.item->key.offset, ri, sizeof(ROOT_ITEM), NULL, Irp);
6642         if (!NT_SUCCESS(Status)) {
6643             ERR("insert_tree_item returned %08x\n", Status);
6644             return Status;
6645         }
6646     }
6647 
6648     if (r->received) {
6649         KEY searchkey;
6650         traverse_ptr tp;
6651 
6652         if (!Vcb->uuid_root) {
6653             root* uuid_root;
6654 
6655             TRACE("uuid root doesn't exist, creating it\n");
6656 
6657             Status = create_root(Vcb, BTRFS_ROOT_UUID, &uuid_root, FALSE, 0, Irp);
6658 
6659             if (!NT_SUCCESS(Status)) {
6660                 ERR("create_root returned %08x\n", Status);
6661                 return Status;
6662             }
6663 
6664             Vcb->uuid_root = uuid_root;
6665         }
6666 
6667         RtlCopyMemory(&searchkey.obj_id, &r->root_item.received_uuid, sizeof(UINT64));
6668         searchkey.obj_type = TYPE_SUBVOL_REC_UUID;
6669         RtlCopyMemory(&searchkey.offset, &r->root_item.received_uuid.uuid[sizeof(UINT64)], sizeof(UINT64));
6670 
6671         Status = find_item(Vcb, Vcb->uuid_root, &tp, &searchkey, FALSE, Irp);
6672         if (!NT_SUCCESS(Status)) {
6673             ERR("find_item returned %08x\n", Status);
6674             return Status;
6675         }
6676 
6677         if (!keycmp(tp.item->key, searchkey)) {
6678             if (tp.item->size + sizeof(UINT64) <= Vcb->superblock.node_size - sizeof(tree_header) - sizeof(leaf_node)) {
6679                 UINT64* ids;
6680 
6681                 ids = ExAllocatePoolWithTag(PagedPool, tp.item->size + sizeof(UINT64), ALLOC_TAG);
6682                 if (!ids) {
6683                     ERR("out of memory\n");
6684                     return STATUS_INSUFFICIENT_RESOURCES;
6685                 }
6686 
6687                 RtlCopyMemory(ids, tp.item->data, tp.item->size);
6688                 RtlCopyMemory((UINT8*)ids + tp.item->size, &r->id, sizeof(UINT64));
6689 
6690                 Status = delete_tree_item(Vcb, &tp);
6691                 if (!NT_SUCCESS(Status)) {
6692                     ERR("delete_tree_item returned %08x\n", Status);
6693                     ExFreePool(ids);
6694                     return Status;
6695                 }
6696 
6697                 Status = insert_tree_item(Vcb, Vcb->uuid_root, searchkey.obj_id, searchkey.obj_type, searchkey.offset, ids, tp.item->size + sizeof(UINT64), NULL, Irp);
6698                 if (!NT_SUCCESS(Status)) {
6699                     ERR("insert_tree_item returned %08x\n", Status);
6700                     ExFreePool(ids);
6701                     return Status;
6702                 }
6703             }
6704         } else {
6705             UINT64* root_num;
6706 
6707             root_num = ExAllocatePoolWithTag(PagedPool, sizeof(UINT64), ALLOC_TAG);
6708             if (!root_num) {
6709                 ERR("out of memory\n");
6710                 return STATUS_INSUFFICIENT_RESOURCES;
6711             }
6712 
6713             *root_num = r->id;
6714 
6715             Status = insert_tree_item(Vcb, Vcb->uuid_root, searchkey.obj_id, searchkey.obj_type, searchkey.offset, root_num, sizeof(UINT64), NULL, Irp);
6716             if (!NT_SUCCESS(Status)) {
6717                 ERR("insert_tree_item returned %08x\n", Status);
6718                 ExFreePool(root_num);
6719                 return Status;
6720             }
6721         }
6722 
6723         r->received = FALSE;
6724     }
6725 
6726     r->dirty = FALSE;
6727 
6728     return STATUS_SUCCESS;
6729 }
6730 
6731 static NTSTATUS test_not_full(device_extension* Vcb) {
6732     UINT64 reserve, could_alloc, free_space;
6733     LIST_ENTRY* le;
6734 
6735     // This function ensures we drop into readonly mode if we're about to leave very little
6736     // space for metadata - this is similar to the "global reserve" of the Linux driver.
6737     // Otherwise we might completely fill our space, at which point due to COW we can't
6738     // delete anything in order to fix this.
6739 
6740     reserve = Vcb->extent_root->root_item.bytes_used;
6741     reserve += Vcb->root_root->root_item.bytes_used;
6742     if (Vcb->checksum_root) reserve += Vcb->checksum_root->root_item.bytes_used;
6743 
6744     reserve = max(reserve, 0x1000000); // 16 M
6745     reserve = min(reserve, 0x20000000); // 512 M
6746 
6747     // Find out how much space would be available for new metadata chunks
6748 
6749     could_alloc = 0;
6750 
6751     if (Vcb->metadata_flags & BLOCK_FLAG_RAID5) {
6752         UINT64 s1 = 0, s2 = 0, s3 = 0;
6753 
6754         le = Vcb->devices.Flink;
6755         while (le != &Vcb->devices) {
6756             device* dev = CONTAINING_RECORD(le, device, list_entry);
6757 
6758             if (!dev->readonly) {
6759                 UINT64 space = dev->devitem.num_bytes - dev->devitem.bytes_used;
6760 
6761                 if (space >= s1) {
6762                     s3 = s2;
6763                     s2 = s1;
6764                     s1 = space;
6765                 } else if (space >= s2) {
6766                     s3 = s2;
6767                     s2 = space;
6768                 } else if (space >= s3)
6769                     s3 = space;
6770             }
6771 
6772             le = le->Flink;
6773         }
6774 
6775         could_alloc = s3 * 2;
6776     } else if (Vcb->metadata_flags & (BLOCK_FLAG_RAID10 | BLOCK_FLAG_RAID6)) {
6777         UINT64 s1 = 0, s2 = 0, s3 = 0, s4 = 0;
6778 
6779         le = Vcb->devices.Flink;
6780         while (le != &Vcb->devices) {
6781             device* dev = CONTAINING_RECORD(le, device, list_entry);
6782 
6783             if (!dev->readonly) {
6784                 UINT64 space = dev->devitem.num_bytes - dev->devitem.bytes_used;
6785 
6786                 if (space >= s1) {
6787                     s4 = s3;
6788                     s3 = s2;
6789                     s2 = s1;
6790                     s1 = space;
6791                 } else if (space >= s2) {
6792                     s4 = s3;
6793                     s3 = s2;
6794                     s2 = space;
6795                 } else if (space >= s3) {
6796                     s4 = s3;
6797                     s3 = space;
6798                 } else if (space >= s4)
6799                     s4 = space;
6800             }
6801 
6802             le = le->Flink;
6803         }
6804 
6805         could_alloc = s4 * 2;
6806     } else if (Vcb->metadata_flags & (BLOCK_FLAG_RAID0 | BLOCK_FLAG_RAID1)) {
6807         UINT64 s1 = 0, s2 = 0;
6808 
6809         le = Vcb->devices.Flink;
6810         while (le != &Vcb->devices) {
6811             device* dev = CONTAINING_RECORD(le, device, list_entry);
6812 
6813             if (!dev->readonly) {
6814                 UINT64 space = dev->devitem.num_bytes - dev->devitem.bytes_used;
6815 
6816                 if (space >= s1) {
6817                     s2 = s1;
6818                     s1 = space;
6819                 } else if (space >= s2)
6820                     s2 = space;
6821             }
6822 
6823             le = le->Flink;
6824         }
6825 
6826         if (Vcb->metadata_flags & BLOCK_FLAG_RAID1)
6827             could_alloc = s2;
6828         else // RAID0
6829             could_alloc = s2 * 2;
6830     } else if (Vcb->metadata_flags & BLOCK_FLAG_DUPLICATE) {
6831         le = Vcb->devices.Flink;
6832         while (le != &Vcb->devices) {
6833             device* dev = CONTAINING_RECORD(le, device, list_entry);
6834 
6835             if (!dev->readonly) {
6836                 UINT64 space = (dev->devitem.num_bytes - dev->devitem.bytes_used) / 2;
6837 
6838                 could_alloc = max(could_alloc, space);
6839             }
6840 
6841             le = le->Flink;
6842         }
6843     } else { // SINGLE
6844         le = Vcb->devices.Flink;
6845         while (le != &Vcb->devices) {
6846             device* dev = CONTAINING_RECORD(le, device, list_entry);
6847 
6848             if (!dev->readonly) {
6849                 UINT64 space = dev->devitem.num_bytes - dev->devitem.bytes_used;
6850 
6851                 could_alloc = max(could_alloc, space);
6852             }
6853 
6854             le = le->Flink;
6855         }
6856     }
6857 
6858     if (could_alloc >= reserve)
6859         return STATUS_SUCCESS;
6860 
6861     free_space = 0;
6862 
6863     le = Vcb->chunks.Flink;
6864     while (le != &Vcb->chunks) {
6865         chunk* c = CONTAINING_RECORD(le, chunk, list_entry);
6866 
6867         if (!c->reloc && !c->readonly && c->chunk_item->type & BLOCK_FLAG_METADATA) {
6868             free_space += c->chunk_item->size - c->used;
6869 
6870             if (free_space + could_alloc >= reserve)
6871                 return STATUS_SUCCESS;
6872         }
6873 
6874         le = le->Flink;
6875     }
6876 
6877     return STATUS_DISK_FULL;
6878 }
6879 
6880 static NTSTATUS do_write2(device_extension* Vcb, PIRP Irp, LIST_ENTRY* rollback) {
6881     NTSTATUS Status;
6882     LIST_ENTRY *le, batchlist;
6883     BOOL cache_changed = FALSE;
6884     volume_device_extension* vde;
6885     BOOL no_cache = FALSE;
6886 #ifdef DEBUG_FLUSH_TIMES
6887     UINT64 filerefs = 0, fcbs = 0;
6888     LARGE_INTEGER freq, time1, time2;
6889 #endif
6890 #ifdef DEBUG_WRITE_LOOPS
6891     UINT loops = 0;
6892 #endif
6893 
6894     TRACE("(%p)\n", Vcb);
6895 
6896     InitializeListHead(&batchlist);
6897 
6898 #ifdef DEBUG_FLUSH_TIMES
6899     time1 = KeQueryPerformanceCounter(&freq);
6900 #endif
6901 
6902     ExAcquireResourceExclusiveLite(&Vcb->dirty_filerefs_lock, TRUE);
6903 
6904     while (!IsListEmpty(&Vcb->dirty_filerefs)) {
6905         file_ref* fr = CONTAINING_RECORD(RemoveHeadList(&Vcb->dirty_filerefs), file_ref, list_entry_dirty);
6906 
6907         flush_fileref(fr, &batchlist, Irp);
6908         free_fileref(Vcb, fr);
6909 
6910 #ifdef DEBUG_FLUSH_TIMES
6911         filerefs++;
6912 #endif
6913     }
6914 
6915     ExReleaseResourceLite(&Vcb->dirty_filerefs_lock);
6916 
6917     Status = commit_batch_list(Vcb, &batchlist, Irp);
6918     if (!NT_SUCCESS(Status)) {
6919         ERR("commit_batch_list returned %08x\n", Status);
6920         return Status;
6921     }
6922 
6923 #ifdef DEBUG_FLUSH_TIMES
6924     time2 = KeQueryPerformanceCounter(NULL);
6925 
6926     ERR("flushed %llu filerefs in %llu (freq = %llu)\n", filerefs, time2.QuadPart - time1.QuadPart, freq.QuadPart);
6927 
6928     time1 = KeQueryPerformanceCounter(&freq);
6929 #endif
6930 
6931     // We process deleted streams first, so we don't run over our xattr
6932     // limit unless we absolutely have to.
6933     // We also process deleted normal files, to avoid any problems
6934     // caused by inode collisions.
6935 
6936     ExAcquireResourceExclusiveLite(&Vcb->dirty_fcbs_lock, TRUE);
6937 
6938     le = Vcb->dirty_fcbs.Flink;
6939     while (le != &Vcb->dirty_fcbs) {
6940         fcb* fcb = CONTAINING_RECORD(le, struct _fcb, list_entry_dirty);
6941         LIST_ENTRY* le2 = le->Flink;
6942 
6943         if (fcb->deleted) {
6944             ExAcquireResourceExclusiveLite(fcb->Header.Resource, TRUE);
6945             Status = flush_fcb(fcb, FALSE, &batchlist, Irp);
6946             ExReleaseResourceLite(fcb->Header.Resource);
6947 
6948             free_fcb(Vcb, fcb);
6949 
6950             if (!NT_SUCCESS(Status)) {
6951                 ERR("flush_fcb returned %08x\n", Status);
6952                 clear_batch_list(Vcb, &batchlist);
6953                 ExReleaseResourceLite(&Vcb->dirty_fcbs_lock);
6954                 return Status;
6955             }
6956 
6957 #ifdef DEBUG_FLUSH_TIMES
6958             fcbs++;
6959 #endif
6960         }
6961 
6962         le = le2;
6963     }
6964 
6965     Status = commit_batch_list(Vcb, &batchlist, Irp);
6966     if (!NT_SUCCESS(Status)) {
6967         ERR("commit_batch_list returned %08x\n", Status);
6968         ExReleaseResourceLite(&Vcb->dirty_fcbs_lock);
6969         return Status;
6970     }
6971 
6972     le = Vcb->dirty_fcbs.Flink;
6973     while (le != &Vcb->dirty_fcbs) {
6974         fcb* fcb = CONTAINING_RECORD(le, struct _fcb, list_entry_dirty);
6975         LIST_ENTRY* le2 = le->Flink;
6976 
6977         if (fcb->subvol != Vcb->root_root) {
6978             ExAcquireResourceExclusiveLite(fcb->Header.Resource, TRUE);
6979             Status = flush_fcb(fcb, FALSE, &batchlist, Irp);
6980             ExReleaseResourceLite(fcb->Header.Resource);
6981             free_fcb(Vcb, fcb);
6982 
6983             if (!NT_SUCCESS(Status)) {
6984                 ERR("flush_fcb returned %08x\n", Status);
6985                 ExReleaseResourceLite(&Vcb->dirty_fcbs_lock);
6986                 return Status;
6987             }
6988 
6989 #ifdef DEBUG_FLUSH_TIMES
6990             fcbs++;
6991 #endif
6992         }
6993 
6994         le = le2;
6995     }
6996 
6997     ExReleaseResourceLite(&Vcb->dirty_fcbs_lock);
6998 
6999     Status = commit_batch_list(Vcb, &batchlist, Irp);
7000     if (!NT_SUCCESS(Status)) {
7001         ERR("commit_batch_list returned %08x\n", Status);
7002         return Status;
7003     }
7004 
7005 #ifdef DEBUG_FLUSH_TIMES
7006     time2 = KeQueryPerformanceCounter(NULL);
7007 
7008     ERR("flushed %llu fcbs in %llu (freq = %llu)\n", filerefs, time2.QuadPart - time1.QuadPart, freq.QuadPart);
7009 #endif
7010 
7011     // no need to get dirty_subvols_lock here, as we have tree_lock exclusively
7012     while (!IsListEmpty(&Vcb->dirty_subvols)) {
7013         root* r = CONTAINING_RECORD(RemoveHeadList(&Vcb->dirty_subvols), root, list_entry_dirty);
7014 
7015         Status = flush_subvol(Vcb, r, Irp);
7016         if (!NT_SUCCESS(Status)) {
7017             ERR("flush_subvol returned %08x\n", Status);
7018             return Status;
7019         }
7020     }
7021 
7022     if (!IsListEmpty(&Vcb->drop_roots)) {
7023         Status = drop_roots(Vcb, Irp, rollback);
7024 
7025         if (!NT_SUCCESS(Status)) {
7026             ERR("drop_roots returned %08x\n", Status);
7027             return Status;
7028         }
7029     }
7030 
7031     Status = update_chunks(Vcb, &batchlist, Irp, rollback);
7032 
7033     if (!NT_SUCCESS(Status)) {
7034         ERR("update_chunks returned %08x\n", Status);
7035         return Status;
7036     }
7037 
7038     Status = commit_batch_list(Vcb, &batchlist, Irp);
7039 
7040     // If only changing superblock, e.g. changing label, we still need to rewrite
7041     // the root tree so the generations match, otherwise you won't be able to mount on Linux.
7042     if (!Vcb->root_root->treeholder.tree || !Vcb->root_root->treeholder.tree->write) {
7043         KEY searchkey;
7044 
7045         traverse_ptr tp;
7046 
7047         searchkey.obj_id = 0;
7048         searchkey.obj_type = 0;
7049         searchkey.offset = 0;
7050 
7051         Status = find_item(Vcb, Vcb->root_root, &tp, &searchkey, FALSE, Irp);
7052         if (!NT_SUCCESS(Status)) {
7053             ERR("error - find_item returned %08x\n", Status);
7054             return Status;
7055         }
7056 
7057         Vcb->root_root->treeholder.tree->write = TRUE;
7058     }
7059 
7060     // make sure we always update the extent tree
7061     Status = add_root_item_to_cache(Vcb, BTRFS_ROOT_EXTENT, Irp);
7062     if (!NT_SUCCESS(Status)) {
7063         ERR("add_root_item_to_cache returned %08x\n", Status);
7064         return Status;
7065     }
7066 
7067     if (Vcb->stats_changed) {
7068         le = Vcb->devices.Flink;
7069         while (le != &Vcb->devices) {
7070             device* dev = CONTAINING_RECORD(le, device, list_entry);
7071 
7072             if (dev->stats_changed) {
7073                 Status = flush_changed_dev_stats(Vcb, dev, Irp);
7074                 if (!NT_SUCCESS(Status)) {
7075                     ERR("flush_changed_dev_stats returned %08x\n", Status);
7076                     return Status;
7077                 }
7078                 dev->stats_changed = FALSE;
7079             }
7080 
7081             le = le->Flink;
7082         }
7083 
7084         Vcb->stats_changed = FALSE;
7085     }
7086 
7087     do {
7088         Status = add_parents(Vcb, Irp);
7089         if (!NT_SUCCESS(Status)) {
7090             ERR("add_parents returned %08x\n", Status);
7091             goto end;
7092         }
7093 
7094         Status = allocate_tree_extents(Vcb, Irp, rollback);
7095         if (!NT_SUCCESS(Status)) {
7096             ERR("allocate_tree_extents returned %08x\n", Status);
7097             goto end;
7098         }
7099 
7100         Status = do_splits(Vcb, Irp, rollback);
7101         if (!NT_SUCCESS(Status)) {
7102             ERR("do_splits returned %08x\n", Status);
7103             goto end;
7104         }
7105 
7106         Status = update_chunk_usage(Vcb, Irp, rollback);
7107         if (!NT_SUCCESS(Status)) {
7108             ERR("update_chunk_usage returned %08x\n", Status);
7109             goto end;
7110         }
7111 
7112         if (!(Vcb->superblock.compat_ro_flags & BTRFS_COMPAT_RO_FLAGS_FREE_SPACE_CACHE)) {
7113             if (!no_cache) {
7114                 Status = allocate_cache(Vcb, &cache_changed, Irp, rollback);
7115                 if (!NT_SUCCESS(Status)) {
7116                     WARN("allocate_cache returned %08x\n", Status);
7117                     no_cache = TRUE;
7118                     cache_changed = FALSE;
7119                 }
7120             }
7121         } else {
7122             Status = update_chunk_caches_tree(Vcb, Irp);
7123             if (!NT_SUCCESS(Status)) {
7124                 ERR("update_chunk_caches_tree returned %08x\n", Status);
7125                 goto end;
7126             }
7127         }
7128 
7129 #ifdef DEBUG_WRITE_LOOPS
7130         loops++;
7131 
7132         if (cache_changed)
7133             ERR("cache has changed, looping again\n");
7134 #endif
7135     } while (cache_changed || !trees_consistent(Vcb));
7136 
7137 #ifdef DEBUG_WRITE_LOOPS
7138     ERR("%u loops\n", loops);
7139 #endif
7140 
7141     TRACE("trees consistent\n");
7142 
7143     Status = update_root_root(Vcb, no_cache, Irp, rollback);
7144     if (!NT_SUCCESS(Status)) {
7145         ERR("update_root_root returned %08x\n", Status);
7146         goto end;
7147     }
7148 
7149     Status = write_trees(Vcb, Irp);
7150     if (!NT_SUCCESS(Status)) {
7151         ERR("write_trees returned %08x\n", Status);
7152         goto end;
7153     }
7154 
7155     Status = test_not_full(Vcb);
7156     if (!NT_SUCCESS(Status)) {
7157         ERR("test_not_full returned %08x\n", Status);
7158         goto end;
7159     }
7160 
7161 #ifdef DEBUG_PARANOID
7162     le = Vcb->trees.Flink;
7163     while (le != &Vcb->trees) {
7164         tree* t = CONTAINING_RECORD(le, tree, list_entry);
7165         KEY searchkey;
7166         traverse_ptr tp;
7167 
7168         searchkey.obj_id = t->header.address;
7169         searchkey.obj_type = TYPE_METADATA_ITEM;
7170         searchkey.offset = 0xffffffffffffffff;
7171 
7172         Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
7173         if (!NT_SUCCESS(Status)) {
7174             ERR("error - find_item returned %08x\n", Status);
7175             goto end;
7176         }
7177 
7178         if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
7179             searchkey.obj_id = t->header.address;
7180             searchkey.obj_type = TYPE_EXTENT_ITEM;
7181             searchkey.offset = 0xffffffffffffffff;
7182 
7183             Status = find_item(Vcb, Vcb->extent_root, &tp, &searchkey, FALSE, Irp);
7184             if (!NT_SUCCESS(Status)) {
7185                 ERR("error - find_item returned %08x\n", Status);
7186                 goto end;
7187             }
7188 
7189             if (tp.item->key.obj_id != searchkey.obj_id || tp.item->key.obj_type != searchkey.obj_type) {
7190                 ERR("error - could not find entry in extent tree for tree at %llx\n", t->header.address);
7191                 Status = STATUS_INTERNAL_ERROR;
7192                 goto end;
7193             }
7194         }
7195 
7196         le = le->Flink;
7197     }
7198 #endif
7199 
7200     Vcb->superblock.cache_generation = Vcb->superblock.generation;
7201 
7202     if (!Vcb->options.no_barrier)
7203         flush_disk_caches(Vcb);
7204 
7205     Status = write_superblocks(Vcb, Irp);
7206     if (!NT_SUCCESS(Status)) {
7207         ERR("write_superblocks returned %08x\n", Status);
7208         goto end;
7209     }
7210 
7211     vde = Vcb->vde;
7212 
7213     if (vde) {
7214         pdo_device_extension* pdode = vde->pdode;
7215 
7216         ExAcquireResourceSharedLite(&pdode->child_lock, TRUE);
7217 
7218         le = pdode->children.Flink;
7219 
7220         while (le != &pdode->children) {
7221             volume_child* vc = CONTAINING_RECORD(le, volume_child, list_entry);
7222 
7223             vc->generation = Vcb->superblock.generation;
7224             le = le->Flink;
7225         }
7226 
7227         ExReleaseResourceLite(&pdode->child_lock);
7228     }
7229 
7230     clean_space_cache(Vcb);
7231 
7232     le = Vcb->chunks.Flink;
7233     while (le != &Vcb->chunks) {
7234         chunk* c = CONTAINING_RECORD(le, chunk, list_entry);
7235 
7236         c->changed = FALSE;
7237         c->space_changed = FALSE;
7238 
7239         le = le->Flink;
7240     }
7241 
7242     Vcb->superblock.generation++;
7243 
7244     Status = STATUS_SUCCESS;
7245 
7246     le = Vcb->trees.Flink;
7247     while (le != &Vcb->trees) {
7248         tree* t = CONTAINING_RECORD(le, tree, list_entry);
7249 
7250         t->write = FALSE;
7251 
7252         le = le->Flink;
7253     }
7254 
7255     Vcb->need_write = FALSE;
7256 
7257     while (!IsListEmpty(&Vcb->drop_roots)) {
7258         root* r = CONTAINING_RECORD(RemoveHeadList(&Vcb->drop_roots), root, list_entry);
7259 
7260         ExDeleteResourceLite(&r->nonpaged->load_tree_lock);
7261         ExFreePool(r->nonpaged);
7262         ExFreePool(r);
7263     }
7264 
7265 end:
7266     TRACE("do_write returning %08x\n", Status);
7267 
7268     return Status;
7269 }
7270 
7271 NTSTATUS do_write(device_extension* Vcb, PIRP Irp) {
7272     LIST_ENTRY rollback;
7273     NTSTATUS Status;
7274 
7275     InitializeListHead(&rollback);
7276 
7277     Status = do_write2(Vcb, Irp, &rollback);
7278 
7279     if (!NT_SUCCESS(Status)) {
7280         ERR("do_write2 returned %08x, dropping into readonly mode\n", Status);
7281         Vcb->readonly = TRUE;
7282         FsRtlNotifyVolumeEvent(Vcb->root_file, FSRTL_VOLUME_FORCED_CLOSED);
7283         do_rollback(Vcb, &rollback);
7284     } else
7285         clear_rollback(&rollback);
7286 
7287     return Status;
7288 }
7289 
7290 #ifdef DEBUG_STATS
7291 static void print_stats(device_extension* Vcb) {
7292     ERR("READ STATS:\n");
7293     ERR("number of reads: %llu\n", Vcb->stats.num_reads);
7294     ERR("data read: %llu bytes\n", Vcb->stats.data_read);
7295     ERR("total time taken: %llu\n", Vcb->stats.read_total_time);
7296     ERR("csum time taken: %llu\n", Vcb->stats.read_csum_time);
7297     ERR("disk time taken: %llu\n", Vcb->stats.read_disk_time);
7298     ERR("other time taken: %llu\n", Vcb->stats.read_total_time - Vcb->stats.read_csum_time - Vcb->stats.read_disk_time);
7299 
7300     ERR("OPEN STATS:\n");
7301     ERR("number of opens: %llu\n", Vcb->stats.num_opens);
7302     ERR("total time taken: %llu\n", Vcb->stats.open_total_time);
7303     ERR("number of overwrites: %llu\n", Vcb->stats.num_overwrites);
7304     ERR("total time taken: %llu\n", Vcb->stats.overwrite_total_time);
7305     ERR("number of creates: %llu\n", Vcb->stats.num_creates);
7306     ERR("calls to open_fcb: %llu\n", Vcb->stats.open_fcb_calls);
7307     ERR("time spent in open_fcb: %llu\n", Vcb->stats.open_fcb_time);
7308     ERR("total time taken: %llu\n", Vcb->stats.create_total_time);
7309 
7310     RtlZeroMemory(&Vcb->stats, sizeof(debug_stats));
7311 }
7312 #endif
7313 
7314 static void do_flush(device_extension* Vcb) {
7315     NTSTATUS Status;
7316 
7317     ExAcquireResourceExclusiveLite(&Vcb->tree_lock, TRUE);
7318 
7319 #ifdef DEBUG_STATS
7320     print_stats(Vcb);
7321 #endif
7322 
7323     if (Vcb->need_write && !Vcb->readonly)
7324         Status = do_write(Vcb, NULL);
7325     else
7326         Status = STATUS_SUCCESS;
7327 
7328     free_trees(Vcb);
7329 
7330     if (!NT_SUCCESS(Status))
7331         ERR("do_write returned %08x\n", Status);
7332 
7333     ExReleaseResourceLite(&Vcb->tree_lock);
7334 }
7335 
7336 _Function_class_(KSTART_ROUTINE)
7337 #ifdef __REACTOS__
7338 void NTAPI flush_thread(void* context) {
7339 #else
7340 void flush_thread(void* context) {
7341 #endif
7342     DEVICE_OBJECT* devobj = context;
7343     device_extension* Vcb = devobj->DeviceExtension;
7344     LARGE_INTEGER due_time;
7345 
7346     ObReferenceObject(devobj);
7347 
7348     KeInitializeTimer(&Vcb->flush_thread_timer);
7349 
7350     due_time.QuadPart = (UINT64)Vcb->options.flush_interval * -10000000;
7351 
7352     KeSetTimer(&Vcb->flush_thread_timer, due_time, NULL);
7353 
7354     while (TRUE) {
7355         KeWaitForSingleObject(&Vcb->flush_thread_timer, Executive, KernelMode, FALSE, NULL);
7356 
7357         if (!(devobj->Vpb->Flags & VPB_MOUNTED) || Vcb->removing)
7358             break;
7359 
7360         if (!Vcb->locked)
7361             do_flush(Vcb);
7362 
7363         KeSetTimer(&Vcb->flush_thread_timer, due_time, NULL);
7364     }
7365 
7366     ObDereferenceObject(devobj);
7367     KeCancelTimer(&Vcb->flush_thread_timer);
7368 
7369     KeSetEvent(&Vcb->flush_thread_finished, 0, FALSE);
7370 
7371     PsTerminateSystemThread(STATUS_SUCCESS);
7372 }
7373