syzbot

map[DenialOfService:false Explanation:Based on the analysis of the bug report and the kernel source code, here is the
assessment of the security impact:

**Root Cause Analysis:**
The bug is a race condition between `__f2fs_remount` (specifically when
remounting with the `nodiscard` option) and a concurrent checkpoint operation
(e.g., from the background checkpoint thread or a `sync` call).
When `__f2fs_remount` processes the `nodiscard` option, it stops the discard
thread and calls `f2fs_issue_discard_timeout()`. This function attempts to drop
or wait for all pending discard commands and then asserts that `discard_cmd_cnt`
is zero using `f2fs_bug_on()`.
However, `__f2fs_remount` does not hold the checkpoint lock
(`sbi->cp_global_sem`) during this process. A concurrent checkpoint can run and
call `f2fs_clear_prefree_segments()`, which adds new discard commands to the
pending list and increments `discard_cmd_cnt`. If this happens after
`f2fs_issue_discard_timeout()` has dropped the existing commands but before it
checks the count, `discard_cmd_cnt` will be non-zero, triggering the
`f2fs_bug_on()`.

**Security Impact:**
* **Exploitable / Denial of Service:** In production kernels,
`CONFIG_F2FS_CHECK_FS` is typically disabled. In this configuration,
`f2fs_bug_on()` is defined to merely emit a `WARN_ON` and set the
`SBI_NEED_FSCK` flag, which does not crash the system or cause memory
corruption. Even if `CONFIG_F2FS_CHECK_FS` is enabled (as in the syzkaller
reproducer), it results in a `BUG_ON` (a kernel panic), but it does not lead to
an exploitable memory corruption (like a use-after-free or out-of-bounds
access).
* **Privilege Requirements:** Triggering this bug requires executing `mount -o
remount,nodiscard`. The `f2fs` filesystem does not have the `FS_USERNS_MOUNT`
flag, meaning it cannot be mounted or remounted within an unprivileged user
namespace. The VFS `reconfigure_super()` function enforces that remounting an
`f2fs` filesystem requires `CAP_SYS_ADMIN` in the initial user namespace (i.e.,
root privileges).

Since the bug can only be triggered by a fully privileged user (root), it does
not cross any security boundaries and is not considered a security
vulnerability. It cannot be triggered by unprivileged users, via user
namespaces, or by auto-mounting a malicious filesystem image (as auto-mounting
does not concurrently remount with `nodiscard`). Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

map[SimplifiedCRepro:]

map[KernelSrc:/app/workdir/cache/src/467e55f613aaf753738bad9aa4d4d66a1b3a23eb]

map[KernelObj:/app/workdir/cache/build/4a129ff7d019a758cba7a99b851d569783a95c15]

map[Index:codesearch-index]

gemini-3.1-pro-preview

map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.

Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).

Don't make assumptions; verify them with source code access. Try different strategies when analyzing the bug:
 - think of ways in which the vulnerable code is unreachable
 - or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.

Analysis dimensions:

* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.

Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.

* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.

* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).

* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.

* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.

* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).

* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.

* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).

* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.

* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The kernel bug report is:

------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:1900!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 7532 Comm: syz.1.186 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:f2fs_issue_discard_timeout+0x59b/0x5a0 fs/f2fs/segment.c:1900
Code: d9 80 e1 07 80 c1 03 38 c1 0f 8c d6 fe ff ff 48 89 df e8 a8 b6 f9 fd e9 c9 fe ff ff e8 ae 94 93 fd 90 0f 0b e8 a6 94 93 fd 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
RSP: 0018:ffffc90004547940 EFLAGS: 00010283
RAX: ffffffff8430ebca RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000fe31000 RSI: 0000000000001e90 RDI: 0000000000001e91
RBP: ffff8880285ac001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10050b5c31 R12: 1ffff110050b5c30
R13: 1ffff1100672282c R14: dffffc0000000000 R15: ffff8880285ae160
FS:  00007f387f0456c0(0000) GS:ffff888126436000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe8abe556b8 CR3: 0000000059e2c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __f2fs_remount fs/f2fs/super.c:2960 [inline]
 f2fs_reconfigure+0x108a/0x1710 fs/f2fs/super.c:5443
 reconfigure_super+0x227/0x8a0 fs/super.c:1080
 do_remount fs/namespace.c:3391 [inline]
 path_mount+0xdc5/0x10e0 fs/namespace.c:4151
 do_mount fs/namespace.c:4172 [inline]
 __do_sys_mount fs/namespace.c:4361 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4338
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3880e0da8a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f387f044e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f387f044ee0 RCX: 00007f3880e0da8a
RDX: 0000200000000180 RSI: 0000200000000000 RDI: 0000000000000000
RBP: 0000200000000180 R08: 00007f387f044ee0 R09: 00000000018424bc
R10: 00000000018424bc R11: 0000000000000246 R12: 0000200000000000
R13: 00007f387f044ea0 R14: 0000000000000000 R15: 00002000000003c0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f2fs_issue_discard_timeout+0x59b/0x5a0 fs/f2fs/segment.c:1900
Code: d9 80 e1 07 80 c1 03 38 c1 0f 8c d6 fe ff ff 48 89 df e8 a8 b6 f9 fd e9 c9 fe ff ff e8 ae 94 93 fd 90 0f 0b e8 a6 94 93 fd 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3
RSP: 0018:ffffc90004547940 EFLAGS: 00010283
RAX: ffffffff8430ebca RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000fe31000 RSI: 0000000000001e90 RDI: 0000000000001e91
RBP: ffff8880285ac001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10050b5c31 R12: 1ffff110050b5c30
R13: 1ffff1100672282c R14: dffffc0000000000 R15: ffff8880285ae160
FS:  00007f387f0456c0(0000) GS:ffff888126436000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe8abe556b8 CR3: 0000000059e2c000 CR4: 00000000003526f0

Based on the analysis of the bug report and the kernel source code, here is the assessment of the security impact:

**Root Cause Analysis:**
The bug is a race condition between `__f2fs_remount` (specifically when remounting with the `nodiscard` option) and a concurrent checkpoint operation (e.g., from the background checkpoint thread or a `sync` call). 
When `__f2fs_remount` processes the `nodiscard` option, it stops the discard thread and calls `f2fs_issue_discard_timeout()`. This function attempts to drop or wait for all pending discard commands and then asserts that `discard_cmd_cnt` is zero using `f2fs_bug_on()`.
However, `__f2fs_remount` does not hold the checkpoint lock (`sbi->cp_global_sem`) during this process. A concurrent checkpoint can run and call `f2fs_clear_prefree_segments()`, which adds new discard commands to the pending list and increments `discard_cmd_cnt`. If this happens after `f2fs_issue_discard_timeout()` has dropped the existing commands but before it checks the count, `discard_cmd_cnt` will be non-zero, triggering the `f2fs_bug_on()`.

**Security Impact:**
* **Exploitable / Denial of Service:** In production kernels, `CONFIG_F2FS_CHECK_FS` is typically disabled. In this configuration, `f2fs_bug_on()` is defined to merely emit a `WARN_ON` and set the `SBI_NEED_FSCK` flag, which does not crash the system or cause memory corruption. Even if `CONFIG_F2FS_CHECK_FS` is enabled (as in the syzkaller reproducer), it results in a `BUG_ON` (a kernel panic), but it does not lead to an exploitable memory corruption (like a use-after-free or out-of-bounds access).
* **Privilege Requirements:** Triggering this bug requires executing `mount -o remount,nodiscard`. The `f2fs` filesystem does not have the `FS_USERNS_MOUNT` flag, meaning it cannot be mounted or remounted within an unprivileged user namespace. The VFS `reconfigure_super()` function enforces that remounting an `f2fs` filesystem requires `CAP_SYS_ADMIN` in the initial user namespace (i.e., root privileges). 

Since the bug can only be triggered by a fully privileged user (root), it does not cross any security boundaries and is not considered a security vulnerability. It cannot be triggered by unprivileged users, via user namespaces, or by auto-mounting a malicious filesystem image (as auto-mounting does not concurrently remount with `nodiscard`).

gemini-3.1-pro-preview

							input: 6705
							output: 47
							thoughts: 138
						

Okay, here's my understanding, tailored for an expert audience, as if it were my own thought process:

**F2FS Discard Timeout Bug Investigation**

Right, a kernel bug has been reported, specifically a BUG at `fs/f2fs/segment.c:1900` within the `f2fs_issue_discard_timeout` function. The call trace provides a clear path through the remount process: it goes from `__f2fs_remount` down to `f2fs_reconfigure`, then `reconfigure_super`, all the way to the system call level with `do_syscall_x64` through the mount system call. The critical path is: `__f2fs_remount` -> `f2fs_reconfigure` -> `reconfigure_super` -> `do_remount` -> `path_mount` -> `do_mount` -> `__do_sys_mount` -> `__se_sys_mount` -> `do_syscall_x64`.

The issue is originating when discarding blocks in the F2FS file system, and apparently it is a timeout issue. Now, I need to zoom in on `fs/f2fs/segment.c` around line 1900, the entry point of `f2fs_issue_discard_timeout`. This should give me the core logic involved in the discard operation and hopefully reveal the source of the timeout or any related race conditions, or incorrect assumptions made about discard operations. I'll need to assess the surrounding code for potential deadlocks, incorrect use of locks, or perhaps even a faulty timeout mechanism. Hopefully, a quick glance will reveal what the problem is.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:f2fs_issue_discard_timeout]

map[SourceCode:1875:	/**
1876:	 * f2fs_issue_discard_timeout() - Issue all discard cmd within UMOUNT_DISCARD_TIMEOUT
1877:	 * @sbi: the f2fs_sb_info data for discard cmd to issue
1878:	 *
1879:	 * When UMOUNT_DISCARD_TIMEOUT is exceeded, all remaining discard commands will be dropped
1880:	 *
1881:	 * Return true if issued all discard cmd or no discard cmd need issue, otherwise return false.
1882:	 */
1883:	bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi)
1884:	{
1885:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1886:		struct discard_policy dpolicy;
1887:		bool dropped;
1888:	
1889:		if (!atomic_read(&dcc->discard_cmd_cnt))
1890:			return true;
1891:	
1892:		__init_discard_policy(sbi, &dpolicy, DPOLICY_UMOUNT,
1893:						dcc->discard_granularity);
1894:		__issue_discard_cmd(sbi, &dpolicy);
1895:		dropped = __drop_discard_cmd(sbi);
1896:	
1897:		/* just to make sure there is no pending discard commands */
1898:		__wait_all_discard_cmd(sbi, NULL);
1899:	
1900:		f2fs_bug_on(sbi, atomic_read(&dcc->discard_cmd_cnt));
1901:		return !dropped;
1902:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 7751
							output: 47
							thoughts: 116
						

Okay, let's break this down.

**Diving into This F2FS Bug**

Right, so the trace indicates a `f2fs_bug_on` trigger, specifically at line 1900. It's the `f2fs_bug_on(sbi, atomic_read(&dcc->discard_cmd_cnt));` call that's causing the problem.  The critical clue is that the value of `atomic_read(&dcc->discard_cmd_cnt)` is *not* zero after a call to `__wait_all_discard_cmd(sbi, NULL)`. That's the core anomaly – we expect this counter to be cleared after that wait function.  I need to confirm the definition of `f2fs_bug_on` now; I need to understand exactly what kind of failure this macro represents. Is this just a `BUG_ON` or something more involved, depending on how F2FS is configured? Time to trace that macro and see what it is actually doing.

requested entity does not exist

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_bug_on]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 8157
							output: 23
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**Investigating a Potential F2FS Issue**

Okay, so I've got this feeling something isn't quite right with F2FS. My gut tells me there might be a bug lurking in the code. My immediate thought is to zero in on potential error conditions. Given my experience, a common debugging starting point is to look for explicit assertions or error checks within the file system code. Therefore, I want to start by searching the code base for instances of the macro `f2fs_bug_on`. It usually signifies a developer's explicit detection of an unexpected situation that warrants halting execution, which helps me to rapidly identify and zero in on potentially unstable areas of the file system. Let's see what pops up.

map[Expression:#define f2fs_bug_on]

map[Output:fs/f2fs/f2fs.h=31=struct pagevec;
--
fs/f2fs/f2fs.h-33-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:34:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-35-#else
fs/f2fs/f2fs.h:36:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-37-	do {								\
]

gemini-3.1-pro-preview

							input: 8536
							output: 23
							thoughts: 192
						

**Analyzing the f2fs_bug_on Macro and its Implications**

Okay, so `f2fs_bug_on` presents a conditional behavior depending on `CONFIG_F2FS_CHECK_FS`. If that config is enabled, it's a `BUG_ON`, a hard kernel panic. Otherwise, it's merely a warning and sets an error flag. Interesting. The bug report I'm looking at specifies a `kernel BUG at fs/f2fs/segment.c:1900!`. This immediately suggests that `CONFIG_F2FS_CHECK_FS` *is* enabled in the syzkaller kernel that generated this, or that whatever is triggering the bug is equivalent to a `BUG_ON`.

The critical takeaway is that, if we're dealing with a production build – and this is key to understanding the impact – where `CONFIG_F2FS_CHECK_FS` is typically disabled, the same condition would only result in a warning and the `F2FS_ERR_INCONSISTENT` error flag being set. This implies a potentially silent corruption that would go unnoticed unless we specifically check for this error.

Therefore, my immediate next step is to verify whether `CONFIG_F2FS_CHECK_FS` is enabled in production kernels. It’s usually a debug option, but it's crucial to confirm. I should probably check `fs/f2fs/Kconfig` for the definitive answer. This will dictate how aggressively we need to treat this bug, as it could be a catastrophic data corruption scenario or something more easily contained.

map[File:fs/f2fs/Kconfig]

map[Contents:# SPDX-License-Identifier: GPL-2.0-only
config F2FS_FS
	tristate "F2FS filesystem support"
	depends on BLOCK
	select BUFFER_HEAD
	select NLS
	select CRC32
	select F2FS_FS_XATTR if FS_ENCRYPTION
	select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
	select FS_IOMAP
	select LZ4_COMPRESS if F2FS_FS_LZ4
	select LZ4_DECOMPRESS if F2FS_FS_LZ4
	select LZ4HC_COMPRESS if F2FS_FS_LZ4HC
	select LZO_COMPRESS if F2FS_FS_LZO
	select LZO_DECOMPRESS if F2FS_FS_LZO
	select ZSTD_COMPRESS if F2FS_FS_ZSTD
	select ZSTD_DECOMPRESS if F2FS_FS_ZSTD
	help
	  F2FS is based on Log-structured File System (LFS), which supports
	  versatile "flash-friendly" features. The design has been focused on
	  addressing the fundamental issues in LFS, which are snowball effect
	  of wandering tree and high cleaning overhead.

	  Since flash-based storages show different characteristics according to
	  the internal geometry or flash memory management schemes aka FTL, F2FS
	  and tools support various parameters not only for configuring on-disk
	  layout, but also for selecting allocation and cleaning algorithms.

	  If unsure, say N.

config F2FS_STAT_FS
	bool "F2FS Status Information"
	depends on F2FS_FS
	default y
	help
	  /sys/kernel/debug/f2fs/ contains information about all the partitions
	  mounted as f2fs. Each file shows the whole f2fs information.

	  /sys/kernel/debug/f2fs/status includes:
	    - major filesystem information managed by f2fs currently
	    - average SIT information about whole segments
	    - current memory footprint consumed by f2fs.

config F2FS_FS_XATTR
	bool "F2FS extended attributes"
	depends on F2FS_FS
	default y
	help
	  Extended attributes are name:value pairs associated with inodes by
	  the kernel or by users (see the attr(5) manual page for details).

	  If unsure, say N.

config F2FS_FS_POSIX_ACL
	bool "F2FS Access Control Lists"
	depends on F2FS_FS_XATTR
	select FS_POSIX_ACL
	default y
	help
	  Posix Access Control Lists (ACLs) support permissions for users and
	  groups beyond the owner/group/world scheme.

	  If you don't know what Access Control Lists are, say N

config F2FS_FS_SECURITY
	bool "F2FS Security Labels"
	depends on F2FS_FS_XATTR
	help
	  Security labels provide an access control facility to support Linux
	  Security Models (LSMs) accepted by AppArmor, SELinux, Smack and TOMOYO
	  Linux. This option enables an extended attribute handler for file
	  security labels in the f2fs filesystem, so that it requires enabling
	  the extended attribute support in advance. In particular you need this
	  option if you use the setcap command to assign initial process capabi-
	  lities to executables (the security.* extended attributes).

	  If you are not using a security module, say N.

config F2FS_CHECK_FS
	bool "F2FS consistency checking feature"
	depends on F2FS_FS
	help
	  Enables BUG_ONs which check the filesystem consistency in runtime.

	  If you want to improve the performance, say N.

config F2FS_FAULT_INJECTION
	bool "F2FS fault injection facility"
	depends on F2FS_FS
	help
	  Test F2FS to inject faults such as ENOMEM, ENOSPC, and so on.

	  If unsure, say N.

config F2FS_FS_COMPRESSION
	bool "F2FS compression feature"
	depends on F2FS_FS
	help
	  Enable filesystem-level compression on f2fs regular files,
	  multiple back-end compression algorithms are supported.

config F2FS_FS_LZO
	bool "LZO compression support"
	depends on F2FS_FS_COMPRESSION
	default y
	help
	  Support LZO compress algorithm, if unsure, say Y.

config F2FS_FS_LZORLE
	bool "LZO-RLE compression support"
	depends on F2FS_FS_LZO
	default y
	help
	  Support LZO-RLE compress algorithm, if unsure, say Y.

config F2FS_FS_LZ4
	bool "LZ4 compression support"
	depends on F2FS_FS_COMPRESSION
	default y
	help
	  Support LZ4 compress algorithm, if unsure, say Y.

config F2FS_FS_LZ4HC
	bool "LZ4HC compression support"
	depends on F2FS_FS_LZ4
	default y
	help
	  Support LZ4HC compress algorithm, LZ4HC has compatible on-disk
	  layout with LZ4, if unsure, say Y.

config F2FS_FS_ZSTD
	bool "ZSTD compression support"
	depends on F2FS_FS_COMPRESSION
	default y
	help
	  Support ZSTD compress algorithm, if unsure, say Y.

config F2FS_IOSTAT
	bool "F2FS IO statistics information"
	depends on F2FS_FS
	default y
	help
	  Support getting IO statistics through sysfs and printing out periodic
	  IO statistics tracepoint events. You have to turn on "iostat_enable"
	  sysfs node to enable this feature.

config F2FS_UNFAIR_RWSEM
	bool "F2FS unfair rw_semaphore"
	depends on F2FS_FS && BLK_CGROUP
	help
	  Use unfair rw_semaphore, if system configured IO priority by block
	  cgroup.
]

gemini-3.1-pro-preview

							input: 10550
							output: 23
							thoughts: 52
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing F2FS_CHECK_FS and Its Implications**

Alright, so `F2FS_CHECK_FS` is throwing up a flag. The comment is pretty direct: "If you want to improve performance, say N." That's usually a strong indicator that this option is disabled by default in production, and I'd bet money that's the case. It screams "resource intensive" or "performance-impacting."

The immediate question that springs to mind is *why*? What's the trade-off? What does `F2FS_CHECK_FS` actually *do* that warrants this performance hit? And, more critically, what are the implications of running without it? I need to understand the potential risks and the expected benefits if it's left disabled. What failure modes does this enable? What data corruption vulnerabilities does this create?

My next step is clearly to dive deeper. I need to get a handle on the behavior of the filesystem with and without this check. If it's disabled, I'll need to figure out the behavior and risk profile to fully understand the impact. Time to dig into the documentation, the source code, and potentially even some targeted testing to fully map it out. I need to be able to assess the real-world implications, not just the code-level behavior. This requires a much more robust understanding of the inner workings of F2FS.

map[Expression:#define f2fs_bug_on]

map[Output:fs/f2fs/f2fs.h=31=struct pagevec;
--
fs/f2fs/f2fs.h-33-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:34:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-35-#else
fs/f2fs/f2fs.h:36:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-37-	do {								\
]

gemini-3.1-pro-preview

							input: 11102
							output: 47
							thoughts: 10
						

Okay, I'm ready. Here's a summary as if it's my own thought process, assuming I'm an expert in my field:

**Assessing the Broader Context**

Alright, I need to see the rest of this macro. I can't make a proper assessment without understanding the surrounding code. My initial impression is, whatever the current snippet does, it's just a small piece of a larger system. I need to understand its relationship to the other elements. What's the overall architecture? What are the inputs and outputs? Where does it fit into the control flow? It's essential to not just understand what this specific fragment does, but what it's *supposed* to do, in the grand scheme of things. Is it a data transformation? A validation step? An interaction with an external resource? This isolated snippet, on its own, means next to nothing without the framework to support it. I must look at what triggered this code block to gain a holistic view.

requested entity does not exist

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_bug_on]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 11390
							output: 29
							thoughts: 23
						

Here's a summary of my thought process, as requested:

**Diving into F2FS's Header**

Okay, time to dig in. I need to understand some core aspects of the F2FS file system, and the best place to start is often the header file. Specifically, I'm going to jump into `fs/f2fs/f2fs.h`. Let's zero in around line 36. That's usually where crucial defines or data structures start to appear, and where the foundational concepts are laid out. I'm expecting to find some of the basic building blocks and maybe some key parameters of the file system architecture defined there. This should provide a solid grounding for understanding the code that follows.

map[Expression:#define f2fs_bug_on\(sbi, condition\)]

map[Output:fs/f2fs/f2fs.h=31=struct pagevec;
--
fs/f2fs/f2fs.h-33-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:34:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-35-#else
fs/f2fs/f2fs.h:36:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-37-	do {								\
]

gemini-3.1-pro-preview

							input: 11764
							output: 21
							thoughts: 25
						

Here's my take on the thought process, as requested:

**Diving into F2FS's Core Definitions**

Okay, time to get my hands dirty. I need to refresh my memory on the fundamental data structures and constants within the F2FS file system. Let's start with `fs/f2fs/f2fs.h`, specifically lines 33 to 45. I know this header is a cornerstone of the F2FS implementation, and that section likely contains some crucial definitions. I'm hoping to quickly identify the key macros and typedefs that govern the block layout or perhaps some core file system flags. I'm expecting to see things like block size definitions, maybe some inode-related structs, or even constants for different allocation strategies. I am expecting this to be the definition of a basic data structure which is at the heart of the file system's block addressing and allocation mechanism. Getting a clear picture of these core structures is essential before diving deeper into any specific feature or bug fix. Alright, let's see what we've got.

map[Expression:f2fs_bug_on]

map[Output:
Full output is too long, showing 500 out of 770 lines.
Use more precise expression if possible.

[fs/f2fs/checkpoint.c=93=static bool need_uplift_priority(struct f2fs_rwsem *sem, bool is_write)
 --
 fs/f2fs/checkpoint.c-111-	default:
 fs/f2fs/checkpoint.c:112:		f2fs_bug_on(sem->sbi, 1);
 fs/f2fs/checkpoint.c-113-	}
 --
 fs/f2fs/checkpoint.c=709=static void __add_ino_entry(struct f2fs_sb_info *sbi, nid_t ino,
 --
 fs/f2fs/checkpoint.c-727-	ret = radix_tree_preload(GFP_NOFS | __GFP_NOFAIL);
 fs/f2fs/checkpoint.c:728:	f2fs_bug_on(sbi, ret);
 fs/f2fs/checkpoint.c-729-
 --
 fs/f2fs/checkpoint.c-739-		if (unlikely(radix_tree_insert(&im->ino_root, ino, e)))
 fs/f2fs/checkpoint.c:740:			f2fs_bug_on(sbi, 1);
 fs/f2fs/checkpoint.c-741-
 --
 fs/f2fs/checkpoint.c=863=void f2fs_release_orphan_inode(struct f2fs_sb_info *sbi)
 --
 fs/f2fs/checkpoint.c-867-	spin_lock(&im->ino_lock);
 fs/f2fs/checkpoint.c:868:	f2fs_bug_on(sbi, im->ino_num == 0);
 fs/f2fs/checkpoint.c-869-	im->ino_num--;
 --
 fs/f2fs/checkpoint.c=886=static int recover_orphan_inode(struct f2fs_sb_info *sbi, nid_t ino)
 --
 fs/f2fs/checkpoint.c-897-		 */
 fs/f2fs/checkpoint.c:898:		f2fs_bug_on(sbi, PTR_ERR(inode) == -ENOENT);
 fs/f2fs/checkpoint.c-899-		return PTR_ERR(inode);
 --
 fs/f2fs/checkpoint.c=1598=static void commit_checkpoint(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/checkpoint.c-1613-	if (unlikely(!folio_clear_dirty_for_io(folio)))
 fs/f2fs/checkpoint.c:1614:		f2fs_bug_on(sbi, 1);
 fs/f2fs/checkpoint.c-1615-
 --
 fs/f2fs/checkpoint.c-1621-		}
 fs/f2fs/checkpoint.c:1622:		f2fs_bug_on(sbi, true);
 fs/f2fs/checkpoint.c-1623-	}
 --
 fs/f2fs/checkpoint.c=1679=static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
 --
 fs/f2fs/checkpoint.c-1820-		f2fs_sb_has_compression(sbi))
 fs/f2fs/checkpoint.c:1821:		f2fs_bug_on(sbi,
 fs/f2fs/checkpoint.c-1822-			invalidate_inode_pages2_range(META_MAPPING(sbi),
 --
 fs/f2fs/checkpoint.c-1846-
 fs/f2fs/checkpoint.c:1847:	f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_DENTS));
 fs/f2fs/checkpoint.c-1848-
 --
 fs/f2fs/checkpoint.c=1852=int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
 --
 fs/f2fs/checkpoint.c-1924-		f2fs_err(sbi, "f2fs_flush_nat_entries failed err:%d, stop checkpoint", err);
 fs/f2fs/checkpoint.c:1925:		f2fs_bug_on(sbi, !f2fs_cp_error(sbi));
 fs/f2fs/checkpoint.c-1926-		goto stop;
 --
 fs/f2fs/checkpoint.c-1939-		f2fs_err(sbi, "do_checkpoint failed err:%d, stop checkpoint", err);
 fs/f2fs/checkpoint.c:1940:		f2fs_bug_on(sbi, !f2fs_cp_error(sbi));
 fs/f2fs/checkpoint.c-1941-		f2fs_release_discard_addrs(sbi);
 --
 fs/f2fs/compress.c=74=bool f2fs_is_compressed_page(struct folio *folio)
 --
 fs/f2fs/compress.c-80-
 fs/f2fs/compress.c:81:	f2fs_bug_on(F2FS_F_SB(folio),
 fs/f2fs/compress.c-82-		*((u32 *)folio->private) != F2FS_COMPRESSED_PAGE_MAGIC);
 --
 fs/f2fs/compress.c=163=void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct folio *folio)
 --
 fs/f2fs/compress.c-167-	if (!f2fs_cluster_can_merge_page(cc, folio->index))
 fs/f2fs/compress.c:168:		f2fs_bug_on(F2FS_I_SB(cc->inode), 1);
 fs/f2fs/compress.c-169-
 --
 fs/f2fs/compress.c=872=static bool cluster_has_invalid_data(struct compress_ctx *cc)
 --
 fs/f2fs/compress.c-880-
 fs/f2fs/compress.c:881:		f2fs_bug_on(F2FS_I_SB(cc->inode), !page);
 fs/f2fs/compress.c-882-
 --
 fs/f2fs/compress.c=890=bool f2fs_sanity_check_cluster(struct dnode_of_data *dn)
 --
 fs/f2fs/compress.c-929-
 fs/f2fs/compress.c:930:	f2fs_bug_on(F2FS_I_SB(dn->inode), count != cluster_size &&
 fs/f2fs/compress.c-931-		!is_inode_flag_set(dn->inode, FI_COMPRESS_RELEASED));
 --
 fs/f2fs/compress.c=1086=static int prepare_compress_overwrite(struct compress_ctx *cc,
 --
 fs/f2fs/compress.c-1138-	for (i = 0; i < cc->cluster_size; i++) {
 fs/f2fs/compress.c:1139:		f2fs_bug_on(sbi, cc->rpages[i]);
 fs/f2fs/compress.c-1140-
 --
 fs/f2fs/compress.c=1212=int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
 --
 fs/f2fs/compress.c-1235-	/* should not be a normal cluster */
 fs/f2fs/compress.c:1236:	f2fs_bug_on(F2FS_I_SB(inode), err == 0);
 fs/f2fs/compress.c-1237-
 --
 fs/f2fs/compress.c=1267=static int f2fs_write_compressed_pages(struct compress_ctx *cc,
 --
 fs/f2fs/compress.c-1404-
 fs/f2fs/compress.c:1405:		f2fs_bug_on(fio.sbi, blkaddr == NULL_ADDR);
 fs/f2fs/compress.c-1406-
 --
 fs/f2fs/compress.c=1597=int f2fs_write_multi_pages(struct compress_ctx *cc,
 --
 fs/f2fs/compress.c-1618-			return 0;
 fs/f2fs/compress.c:1619:		f2fs_bug_on(F2FS_I_SB(cc->inode), err != -EAGAIN);
 fs/f2fs/compress.c-1620-	}
 fs/f2fs/compress.c-1621-write:
 fs/f2fs/compress.c:1622:	f2fs_bug_on(F2FS_I_SB(cc->inode), *submitted);
 fs/f2fs/compress.c-1623-
 --
 fs/f2fs/data.c=346=static void f2fs_write_end_io(struct bio *bio)
 --
 fs/f2fs/data.c-386-				folio->index, NODE_TYPE_REGULAR, true);
 fs/f2fs/data.c:387:			f2fs_bug_on(sbi, folio->index != nid_of_node(folio));
 fs/f2fs/data.c-388-		}
 --
 fs/f2fs/data.c=836=static int add_ipu_page(struct f2fs_io_info *fio, struct bio **bio,
 --
 fs/f2fs/data.c-856-
 fs/f2fs/data.c:857:			f2fs_bug_on(sbi, !page_is_mergeable(sbi, *bio,
 fs/f2fs/data.c-858-							    *fio->last_block,
 --
 fs/f2fs/data.c=884=void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/data.c-890-
 fs/f2fs/data.c:891:	f2fs_bug_on(sbi, !target && !folio);
 fs/f2fs/data.c-892-
 --
 fs/f2fs/data.c=1003=void f2fs_submit_page_write(struct f2fs_io_info *fio)
 --
 fs/f2fs/data.c-1011-
 fs/f2fs/data.c:1012:	f2fs_bug_on(sbi, is_read_io(fio->op));
 fs/f2fs/data.c-1013-
 --
 fs/f2fs/data.c=1148=static void f2fs_submit_page_read(struct inode *inode, struct fsverity_info *vi,
 --
 fs/f2fs/data.c-1161-	if (!bio_add_folio(bio, folio, PAGE_SIZE, 0))
 fs/f2fs/data.c:1162:		f2fs_bug_on(sbi, 1);
 fs/f2fs/data.c-1163-
 --
 fs/f2fs/data.c=1412=struct folio *f2fs_get_new_data_folio(struct inode *inode,
 --
 fs/f2fs/data.c-1449-		/* if ifolio exists, blkaddr should be NEW_ADDR */
 fs/f2fs/data.c:1450:		f2fs_bug_on(F2FS_I_SB(inode), ifolio);
 fs/f2fs/data.c-1451-		folio = f2fs_get_lock_data_folio(inode, index, true);
 --
 fs/f2fs/data.c=1615=int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
 --
 fs/f2fs/data.c-1851-
 fs/f2fs/data.c:1852:			f2fs_bug_on(sbi, blk_addr + map->m_len >
 fs/f2fs/data.c-1853-						FDEV(bidx).end_blk + 1);
 --
 fs/f2fs/data.c=2262=int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
 --
 fs/f2fs/data.c-2284-
 fs/f2fs/data.c:2285:	f2fs_bug_on(sbi, f2fs_cluster_is_empty(cc));
 fs/f2fs/data.c-2286-
 --
 fs/f2fs/data.c-2327-
 fs/f2fs/data.c:2328:	f2fs_bug_on(sbi, dn.data_blkaddr != COMPRESS_ADDR);
 fs/f2fs/data.c-2329-
 --
 fs/f2fs/data.c=3053=int f2fs_write_single_data_page(struct folio *folio, int *submitted,
 --
 fs/f2fs/data.c-3158-		if (err == -EAGAIN) {
 fs/f2fs/data.c:3159:			f2fs_bug_on(sbi, compr_blocks);
 fs/f2fs/data.c-3160-			fio.need_lock = LOCK_REQ;
 --
 fs/f2fs/data.c=4501=static int f2fs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
 --
 fs/f2fs/data.c-4570-		} else {
 fs/f2fs/data.c:4571:			f2fs_bug_on(F2FS_I_SB(inode), 1);
 fs/f2fs/data.c-4572-		}
 --
 fs/f2fs/extent_cache.c=333=static void __release_extent_node(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/extent_cache.c-338-	spin_lock(&eti->extent_lock);
 fs/f2fs/extent_cache.c:339:	f2fs_bug_on(sbi, list_empty(&en->list));
 fs/f2fs/extent_cache.c-340-	list_del_init(&en->list);
 --
 fs/f2fs/extent_cache.c=577=static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/extent_cache.c-611-				en->ei.last_blocks, ei->fofs, ei->blk, ei->len, ei->age, ei->last_blocks);
 fs/f2fs/extent_cache.c:612:			f2fs_bug_on(sbi, 1);
 fs/f2fs/extent_cache.c-613-			return NULL;
 --
 fs/f2fs/extent_cache.c=632=static unsigned int __destroy_extent_node(struct inode *inode,
 --
 fs/f2fs/extent_cache.c-650-
 fs/f2fs/extent_cache.c:651:	f2fs_bug_on(sbi, atomic_read(&et->node_cnt));
 fs/f2fs/extent_cache.c-652-
 --
 fs/f2fs/extent_cache.c=656=static void __update_extent_tree_range(struct inode *inode,
 --
 fs/f2fs/extent_cache.c-677-			tei->age, tei->last_blocks);
 fs/f2fs/extent_cache.c:678:		f2fs_bug_on(sbi, 1);
 fs/f2fs/extent_cache.c-679-		return;
 --
 fs/f2fs/extent_cache.c-724-		org_end = dei.fofs + dei.len;
 fs/f2fs/extent_cache.c:725:		f2fs_bug_on(sbi, fofs >= org_end);
 fs/f2fs/extent_cache.c-726-
 --
 fs/f2fs/extent_cache.c=890=static int __get_new_block_age(struct inode *inode, struct extent_info *ei,
 --
 fs/f2fs/extent_cache.c-925-
 fs/f2fs/extent_cache.c:926:	f2fs_bug_on(sbi, blkaddr == NULL_ADDR);
 fs/f2fs/extent_cache.c-927-
 --
 fs/f2fs/extent_cache.c=1170=static void __destroy_extent_tree(struct inode *inode, enum extent_type type)
 --
 fs/f2fs/extent_cache.c-1193-	mutex_lock(&eti->extent_tree_lock);
 fs/f2fs/extent_cache.c:1194:	f2fs_bug_on(sbi, atomic_read(&et->node_cnt));
 fs/f2fs/extent_cache.c-1195-	radix_tree_delete(&eti->extent_tree_root, inode->i_ino);
 --
 fs/f2fs/f2fs.h=31=struct pagevec;
 --
 fs/f2fs/f2fs.h-33-#ifdef CONFIG_F2FS_CHECK_FS
 fs/f2fs/f2fs.h:34:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
 fs/f2fs/f2fs.h-35-#else
 fs/f2fs/f2fs.h:36:#define f2fs_bug_on(sbi, condition)					\
 fs/f2fs/f2fs.h-37-	do {								\
 --
 fs/f2fs/f2fs.h=3068=static inline void f2fs_folio_put(struct folio *folio, bool unlock)
 --
 fs/f2fs/f2fs.h-3073-	if (unlock) {
 fs/f2fs/f2fs.h:3074:		f2fs_bug_on(F2FS_F_SB(folio), !folio_test_locked(folio));
 fs/f2fs/f2fs.h-3075-		folio_unlock(folio);
 --
 fs/f2fs/file.c=75=static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 --
 fs/f2fs/file.c-124-
 fs/f2fs/file.c:125:	f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
 fs/f2fs/file.c-126-
 --
 fs/f2fs/file.c=739=static int truncate_partial_data_page(struct inode *inode, u64 from,
 --
 fs/f2fs/file.c-767-	/* An encrypted inode should have a key and truncate the last page. */
 fs/f2fs/file.c:768:	f2fs_bug_on(F2FS_I_SB(inode), cache_only && IS_ENCRYPTED(inode));
 fs/f2fs/file.c-769-	if (!cache_only)
 --
 fs/f2fs/file.c=775=int f2fs_do_truncate_blocks(struct inode *inode, u64 from, bool lock)
 --
 fs/f2fs/file.c-836-	count -= dn.ofs_in_node;
 fs/f2fs/file.c:837:	f2fs_bug_on(sbi, count < 0);
 fs/f2fs/file.c-838-
 --
 fs/f2fs/file.c=1241=int f2fs_truncate_hole(struct inode *inode, pgoff_t pg_start, pgoff_t pg_end)
 --
 fs/f2fs/file.c-1262-
 fs/f2fs/file.c:1263:		f2fs_bug_on(F2FS_I_SB(inode), count == 0 || count > end_offset);
 fs/f2fs/file.c-1264-
 --
 fs/f2fs/file.c=2104=static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
 --
 fs/f2fs/file.c-2156-	fi->i_flags = iflags | (fi->i_flags & ~mask);
 fs/f2fs/file.c:2157:	f2fs_bug_on(F2FS_I_SB(inode), (fi->i_flags & F2FS_COMPR_FL) &&
 fs/f2fs/file.c-2158-					(fi->i_flags & F2FS_NOCOMP_FL));
 --
 fs/f2fs/file.c=2262=static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
 --
 fs/f2fs/file.c-2332-		/* Reuse the already created COW inode */
 fs/f2fs/file.c:2333:		f2fs_bug_on(sbi, get_dirty_pages(fi->cow_inode));
 fs/f2fs/file.c-2334-
 --
 fs/f2fs/file.c=4433=static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)
 --
 fs/f2fs/file.c-4458-		/* It will never fail, when folio has pinned above */
 fs/f2fs/file.c:4459:		f2fs_bug_on(F2FS_I_SB(inode), IS_ERR(folio));
 fs/f2fs/file.c-4460-
 --
 fs/f2fs/gc.c=367=static unsigned int get_cb_cost(struct f2fs_sb_info *sbi, unsigned int segno)
 --
 fs/f2fs/gc.c-376-	mtime = f2fs_get_section_mtime(sbi, segno);
 fs/f2fs/gc.c:377:	f2fs_bug_on(sbi, mtime == INVALID_MTIME);
 fs/f2fs/gc.c-378-	vblocks = get_valid_blocks(sbi, segno, true);
 --
 fs/f2fs/gc.c=395=static inline unsigned int get_gc_cost(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-412-
 fs/f2fs/gc.c:413:	f2fs_bug_on(sbi, 1);
 fs/f2fs/gc.c-414-	return 0;
 --
 fs/f2fs/gc.c=520=static void add_victim_entry(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-532-	mtime = f2fs_get_section_mtime(sbi, segno);
 fs/f2fs/gc.c:533:	f2fs_bug_on(sbi, mtime == INVALID_MTIME);
 fs/f2fs/gc.c-534-
 --
 fs/f2fs/gc.c=552=static void atgc_lookup_victim(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-596-	vblocks = get_valid_blocks(sbi, ve->segno, true);
 fs/f2fs/gc.c:597:	f2fs_bug_on(sbi, !vblocks || vblocks == sec_blocks);
 fs/f2fs/gc.c-598-
 --
 fs/f2fs/gc.c-602-
 fs/f2fs/gc.c:603:	f2fs_bug_on(sbi, age + u >= UINT_MAX);
 fs/f2fs/gc.c-604-
 --
 fs/f2fs/gc.c=625=static void atssr_lookup_victim(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-659-	vblocks = get_seg_entry(sbi, ve->segno)->ckpt_valid_blocks;
 fs/f2fs/gc.c:660:	f2fs_bug_on(sbi, !vblocks);
 fs/f2fs/gc.c-661-
 --
 fs/f2fs/gc.c=689=static void lookup_victim_by_age(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-691-{
 fs/f2fs/gc.c:692:	f2fs_bug_on(sbi, !f2fs_check_victim_tree(sbi, &sbi->am.root));
 fs/f2fs/gc.c-693-
 --
 fs/f2fs/gc.c-698-	else
 fs/f2fs/gc.c:699:		f2fs_bug_on(sbi, 1);
 fs/f2fs/gc.c-700-}
 --
 fs/f2fs/gc.c=702=static void release_victim_entry(struct f2fs_sb_info *sbi)
 --
 fs/f2fs/gc.c-714-
 fs/f2fs/gc.c:715:	f2fs_bug_on(sbi, am->victim_count);
 fs/f2fs/gc.c:716:	f2fs_bug_on(sbi, !list_empty(&am->victim_list));
 fs/f2fs/gc.c-717-}
 --
 fs/f2fs/gc.c=1740=static int do_garbage_collect(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-1832-							__func__, segno);
 fs/f2fs/gc.c:1833:			f2fs_bug_on(sbi, 1);
 fs/f2fs/gc.c-1834-			goto next_block;
 --
 fs/f2fs/gc.c=2148=static int free_segment_range(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/gc.c-2192-			 next_inuse);
 fs/f2fs/gc.c:2193:		f2fs_bug_on(sbi, 1);
 fs/f2fs/gc.c-2194-	}
 --
 fs/f2fs/inline.c=82=void f2fs_do_read_inline_data(struct folio *folio, struct folio *ifolio)
 --
 fs/f2fs/inline.c-88-
 fs/f2fs/inline.c:89:	f2fs_bug_on(F2FS_I_SB(inode), folio->index);
 fs/f2fs/inline.c-90-
 --
 fs/f2fs/inline.c=145=int f2fs_convert_inline_folio(struct dnode_of_data *dn, struct folio *folio)
 --
 fs/f2fs/inline.c-184-
 fs/f2fs/inline.c:185:	f2fs_bug_on(F2FS_F_SB(folio), folio_test_writeback(folio));
 fs/f2fs/inline.c-186-
 --
 fs/f2fs/inline.c=264=int f2fs_write_inline_data(struct inode *inode, struct folio *folio)
 --
 fs/f2fs/inline.c-277-
 fs/f2fs/inline.c:278:	f2fs_bug_on(F2FS_I_SB(inode), folio->index);
 fs/f2fs/inline.c-279-
 --
 fs/f2fs/inode.c=850=void f2fs_evict_inode(struct inode *inode)
 --
 fs/f2fs/inode.c-878-
 fs/f2fs/inode.c:879:	f2fs_bug_on(sbi, get_dirty_pages(inode));
 fs/f2fs/inode.c-880-	f2fs_remove_dirty_inode(inode);
 --
 fs/f2fs/inode.c-952-		 * due to fuzzed corrupted inode, call f2fs_inode_synced() to
 fs/f2fs/inode.c:953:		 * avoid triggering later f2fs_bug_on().
 fs/f2fs/inode.c-954-		 */
 --
 fs/f2fs/inode.c-976-				!is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
 fs/f2fs/inode.c:977:		f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE));
 fs/f2fs/inode.c-978-
 --
 fs/f2fs/namei.c=219=static struct inode *f2fs_new_inode(struct mnt_idmap *idmap,
 --
 fs/f2fs/namei.c-292-	if (f2fs_sb_has_flexible_inline_xattr(sbi)) {
 fs/f2fs/namei.c:293:		f2fs_bug_on(sbi, !f2fs_has_extra_attr(inode));
 fs/f2fs/namei.c-294-		if (f2fs_has_inline_xattr(inode))
 --
 fs/f2fs/node.c=143=static struct folio *get_next_nat_folio(struct f2fs_sb_info *sbi, nid_t nid)
 --
 fs/f2fs/node.c-158-	dst_folio = f2fs_grab_meta_folio(sbi, dst_off);
 fs/f2fs/node.c:159:	f2fs_bug_on(sbi, folio_test_dirty(src_folio));
 fs/f2fs/node.c-160-
 --
 fs/f2fs/node.c=365=void f2fs_del_fsync_node_entry(struct f2fs_sb_info *sbi, struct folio *folio)
 --
 fs/f2fs/node.c-381-	spin_unlock_irqrestore(&sbi->fsync_node_lock, flags);
 fs/f2fs/node.c:382:	f2fs_bug_on(sbi, 1);
 fs/f2fs/node.c-383-}
 --
 fs/f2fs/node.c=442=static void cache_nat_entry(struct f2fs_sb_info *sbi, nid_t nid,
 --
 fs/f2fs/node.c-460-	else
 fs/f2fs/node.c:461:		f2fs_bug_on(sbi, nat_get_ino(e) != le32_to_cpu(ne->ino) ||
 fs/f2fs/node.c-462-				nat_get_blkaddr(e) !=
 --
 fs/f2fs/node.c=470=static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
 --
 fs/f2fs/node.c-483-		copy_node_info(&e->ni, ni);
 fs/f2fs/node.c:484:		f2fs_bug_on(sbi, ni->blk_addr == NEW_ADDR);
 fs/f2fs/node.c-485-	} else if (new_blkaddr == NEW_ADDR) {
 --
 fs/f2fs/node.c-491-		copy_node_info(&e->ni, ni);
 fs/f2fs/node.c:492:		f2fs_bug_on(sbi, ni->blk_addr != NULL_ADDR);
 fs/f2fs/node.c-493-	}
 --
 fs/f2fs/node.c-498-	/* sanity check */
 fs/f2fs/node.c:499:	f2fs_bug_on(sbi, nat_get_blkaddr(e) != ni->blk_addr);
 fs/f2fs/node.c:500:	f2fs_bug_on(sbi, nat_get_blkaddr(e) == NULL_ADDR &&
 fs/f2fs/node.c-501-			new_blkaddr == NULL_ADDR);
 fs/f2fs/node.c:502:	f2fs_bug_on(sbi, nat_get_blkaddr(e) == NEW_ADDR &&
 fs/f2fs/node.c-503-			new_blkaddr == NEW_ADDR);
 fs/f2fs/node.c:504:	f2fs_bug_on(sbi, __is_valid_data_blkaddr(nat_get_blkaddr(e)) &&
 fs/f2fs/node.c-505-			new_blkaddr == NEW_ADDR);
 --
 fs/f2fs/node.c=686=pgoff_t f2fs_get_next_page_offset(struct dnode_of_data *dn, pgoff_t pgofs)
 --
 fs/f2fs/node.c-712-	default:
 fs/f2fs/node.c:713:		f2fs_bug_on(F2FS_I_SB(dn->inode), 1);
 fs/f2fs/node.c-714-	}
 --
 fs/f2fs/node.c=2336=static void __remove_free_nid(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/node.c-2340-
 fs/f2fs/node.c:2341:	f2fs_bug_on(sbi, state != i->state);
 fs/f2fs/node.c-2342-	nm_i->nid_cnt[state]--;
 --
 fs/f2fs/node.c=2348=static void __move_free_nid(struct f2fs_sb_info *sbi, struct free_nid *i,
 --
 fs/f2fs/node.c-2352-
 fs/f2fs/node.c:2353:	f2fs_bug_on(sbi, org_state != i->state);
 fs/f2fs/node.c-2354-	i->state = dst_state;
 --
 fs/f2fs/node.c=2395=static bool add_free_nid(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/node.c-2415-	err = radix_tree_preload(GFP_NOFS | __GFP_NOFAIL);
 fs/f2fs/node.c:2416:	f2fs_bug_on(sbi, err);
 fs/f2fs/node.c-2417-
 --
 fs/f2fs/node.c=2675=bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid)
 --
 fs/f2fs/node.c-2691-	if (nm_i->nid_cnt[FREE_NID] && !on_f2fs_build_free_nids(nm_i)) {
 fs/f2fs/node.c:2692:		f2fs_bug_on(sbi, list_empty(&nm_i->free_nid_list));
 fs/f2fs/node.c-2693-		i = list_first_entry(&nm_i->free_nid_list,
 --
 fs/f2fs/node.c=2726=void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid)
 --
 fs/f2fs/node.c-2732-	i = __lookup_free_nid_list(nm_i, nid);
 fs/f2fs/node.c:2733:	f2fs_bug_on(sbi, !i);
 fs/f2fs/node.c-2734-	__remove_free_nid(sbi, i, PREALLOC_NID);
 --
 fs/f2fs/node.c=2743=void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid)
 --
 fs/f2fs/node.c-2753-	i = __lookup_free_nid_list(nm_i, nid);
 fs/f2fs/node.c:2754:	f2fs_bug_on(sbi, !i);
 fs/f2fs/node.c-2755-
 --
 fs/f2fs/node.c=3097=static int __flush_nat_entry_set(struct f2fs_sb_info *sbi,
 --
 fs/f2fs/node.c-3124-		nat_blk = folio_address(folio);
 fs/f2fs/node.c:3125:		f2fs_bug_on(sbi, !nat_blk);
 fs/f2fs/node.c-3126-	}
 --
 fs/f2fs/node.c-3133-
 fs/f2fs/node.c:3134:		f2fs_bug_on(sbi, nat_get_blkaddr(ne) == NEW_ADDR);
 fs/f2fs/node.c-3135-
 --
 fs/f2fs/node.c-3138-							NAT_JOURNAL, nid, 1);
 fs/f2fs/node.c:3139:			f2fs_bug_on(sbi, offset < 0);
 fs/f2fs/node.c-3140-			raw_ne = &nat_in_journal(journal, offset);
 --
 fs/f2fs/node.c=3443=void f2fs_destroy_node_manager(struct f2fs_sb_info *sbi)
 --
 fs/f2fs/node.c-3463-	}
 fs/f2fs/node.c:3464:	f2fs_bug_on(sbi, nm_i->nid_cnt[FREE_NID]);
 fs/f2fs/node.c:3465:	f2fs_bug_on(sbi, nm_i->nid_cnt[PREALLOC_NID]);
 fs/f2fs/node.c:3466:	f2fs_bug_on(sbi, !list_empty(&nm_i->free_nid_list));
 fs/f2fs/node.c-3467-	spin_unlock(&nm_i->nid_list_lock);
 --
 fs/f2fs/node.c-3483-	}
 fs/f2fs/node.c:3484:	f2fs_bug_on(sbi, nm_i->nat_cnt[TOTAL_NAT]);
 fs/f2fs/node.c-3485-
 --
 fs/f2fs/node.c-3495-			/* entry_cnt is not zero, when cp_error was occurred */
 fs/f2fs/node.c:3496:			f2fs_bug_on(sbi, !list_empty(&setvec[idx]->entry_list));
 fs/f2fs/node.c-3497-			radix_tree_delete(&nm_i->nat_set_root, setvec[idx]->set);
 --
 fs/f2fs/node.h=184=static inline void get_nat_bitmap(struct f2fs_sb_info *sbi, void *addr)
 --
 fs/f2fs/node.h-190-						nm_i->bitmap_size))
 fs/f2fs/node.h:191:		f2fs_bug_on(sbi, 1);
 fs/f2fs/node.h-192-#endif
 --
 fs/f2fs/recovery.c=625=static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
 --
 fs/f2fs/recovery.c-673-
 fs/f2fs/recovery.c:674:	f2fs_bug_on(sbi, ni.ino != ino_of_node(folio));
 fs/f2fs/recovery.c-675-
 --
 fs/f2fs/recovery.c=873=int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only)
 --
 fs/f2fs/recovery.c-908-	if (!err)
 fs/f2fs/recovery.c:909:		f2fs_bug_on(sbi, !list_empty(&inode_list));
 fs/f2fs/recovery.c-910-	else
 fs/f2fs/recovery.c:911:		f2fs_bug_on(sbi, sbi->sb->s_flags & SB_ACTIVE);
 fs/f2fs/recovery.c-912-skip:
 --
 fs/f2fs/segment.c=771=static void __locate_dirty_segment(struct f2fs_sb_info *sbi, unsigned int segno,
]
]

gemini-3.1-pro-preview

							input: 22773
							output: 23
							thoughts: 259
						

**Analyzing the f2fs_bug_on Macro**

Okay, let's break this down. My initial observation is that `f2fs_bug_on` has a conditional definition. If `CONFIG_F2FS_CHECK_FS` is enabled, it boils down to a straightforward `BUG_ON`, a kernel panic if the condition is met. However, if that configuration option is *disabled*, then `f2fs_bug_on` becomes a `WARN_ON_ONCE` along with setting the `SBI_NEED_FSCK` flag. The implication here is a warning once to the kernel console and an indicator that a file system check is necessary.

Now the interesting part. The bug report is pointing to a kernel BUG at `fs/f2fs/segment.c:1900`. That means the condition within `f2fs_bug_on` is being triggered, causing either a kernel panic or a warning, depending on the configuration. My immediate thought is, if there's a BUG, that implies either `CONFIG_F2FS_CHECK_FS` *is* enabled in this syzkaller kernel, or there's some other definition of `f2fs_bug_on` that's in play. Let's confirm how the macro is defined and check `fs/f2fs/f2fs.h` around lines 33-45. I need to understand which branch of the macro's definition is being taken to properly interpret the bug report.

map[Expression:#define f2fs_bug_on]

map[Output:fs/f2fs/f2fs.h=31=struct pagevec;
--
fs/f2fs/f2fs.h-33-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:34:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-35-#else
fs/f2fs/f2fs.h:36:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-37-	do {								\
]

gemini-3.1-pro-preview

							input: 23545
							output: 26
							thoughts: 25
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Leveraging the F2FS Header for Quick Understanding**

Okay, hold on a second. Instead of diving into the full source tree, I'm going to take a more direct route. My instinct tells me that the key definitions, especially for core data structures or major constants, will be readily accessible in the primary header file. I bet `fs/f2fs/f2fs.h` is where I need to start. Specifically, I'll zero in around line 36. That's usually where the basic layout or initial declarations are located. A quick scan of that section should give me the foundation I need to understand the subsequent code better. This should streamline my understanding, and hopefully, give me enough context to infer the relevant details from the surrounding code.

map[File:fs/f2fs/f2fs.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 */
/*
 * fs/f2fs/f2fs.h
 *
 * Copyright (c) 2012 Samsung Electronics Co., Ltd.
 *             http://www.samsung.com/
 */
#ifndef _LINUX_F2FS_H
#define _LINUX_F2FS_H

#include <linux/uio.h>
#include <linux/types.h>
#include <linux/page-flags.h>
#include <linux/slab.h>
#include <linux/crc32.h>
#include <linux/magic.h>
#include <linux/kobject.h>
#include <linux/sched.h>
#include <linux/cred.h>
#include <linux/sched/mm.h>
#include <linux/vmalloc.h>
#include <linux/bio.h>
#include <linux/blkdev.h>
#include <linux/quotaops.h>
#include <linux/part_stat.h>
#include <linux/rw_hint.h>

#include <linux/fscrypt.h>
#include <linux/fsverity.h>

struct pagevec;

#ifdef CONFIG_F2FS_CHECK_FS
#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
#else
#define f2fs_bug_on(sbi, condition)					\
	do {								\
		if (WARN_ON(condition))					\
			set_sbi_flag(sbi, SBI_NEED_FSCK);		\
	} while (0)
#endif

enum {
	FAULT_KMALLOC,
	FAULT_KVMALLOC,
	FAULT_PAGE_ALLOC,
	FAULT_PAGE_GET,
	FAULT_ALLOC_BIO,	/* it's obsolete due to bio_alloc() will never fail */
	FAULT_ALLOC_NID,
	FAULT_ORPHAN,
	FAULT_BLOCK,
	FAULT_DIR_DEPTH,
	FAULT_EVICT_INODE,
	FAULT_TRUNCATE,
	FAULT_READ_IO,
	FAULT_CHECKPOINT,
	FAULT_DISCARD,		/* it's obsolete due to __blkdev_issue_discard() will never fail */
	FAULT_WRITE_IO,
	FAULT_SLAB_ALLOC,
	FAULT_DQUOT_INIT,
	FAULT_LOCK_OP,
	FAULT_BLKADDR_VALIDITY,
	FAULT_BLKADDR_CONSISTENCE,
	FAULT_NO_SEGMENT,
	FAULT_INCONSISTENT_FOOTER,
	FAULT_ATOMIC_TIMEOUT,
	FAULT_VMALLOC,
	FAULT_LOCK_TIMEOUT,
	FAULT_SKIP_WRITE,
	FAULT_MAX,
};

/* indicate which option to update */
enum fault_option {
	FAULT_RATE	= 1,	/* only update fault rate */
	FAULT_TYPE	= 2,	/* only update fault type */
	FAULT_TIMEOUT	= 4,	/* only update fault timeout type */
	FAULT_ALL	= 8,	/* reset all fault injection options/stats */
};

#ifdef CONFIG_F2FS_FAULT_INJECTION
struct f2fs_fault_info {
	atomic_t inject_ops;
	int inject_rate;
	unsigned int inject_type;
	/* Used to account total count of injection for each type */
	unsigned int inject_count[FAULT_MAX];
	unsigned int inject_lock_timeout;	/* inject lock timeout */
};

extern const char *f2fs_fault_name[FAULT_MAX];
#define IS_FAULT_SET(fi, type) ((fi)->inject_type & BIT(type))

/* maximum retry count for injected failure */
#define DEFAULT_FAILURE_RETRY_COUNT		8
#else
#define DEFAULT_FAILURE_RETRY_COUNT		1
#endif

/*
 * For mount options
 */
enum f2fs_mount_opt {
	F2FS_MOUNT_DISABLE_ROLL_FORWARD,
	F2FS_MOUNT_DISCARD,
	F2FS_MOUNT_NOHEAP,
	F2FS_MOUNT_XATTR_USER,
	F2FS_MOUNT_POSIX_ACL,
	F2FS_MOUNT_DISABLE_EXT_IDENTIFY,
	F2FS_MOUNT_INLINE_XATTR,
	F2FS_MOUNT_INLINE_DATA,
	F2FS_MOUNT_INLINE_DENTRY,
	F2FS_MOUNT_FLUSH_MERGE,
	F2FS_MOUNT_NOBARRIER,
	F2FS_MOUNT_FASTBOOT,
	F2FS_MOUNT_READ_EXTENT_CACHE,
	F2FS_MOUNT_DATA_FLUSH,
	F2FS_MOUNT_FAULT_INJECTION,
	F2FS_MOUNT_USRQUOTA,
	F2FS_MOUNT_GRPQUOTA,
	F2FS_MOUNT_PRJQUOTA,
	F2FS_MOUNT_QUOTA,
	F2FS_MOUNT_INLINE_XATTR_SIZE,
	F2FS_MOUNT_RESERVE_ROOT,
	F2FS_MOUNT_DISABLE_CHECKPOINT,
	F2FS_MOUNT_NORECOVERY,
	F2FS_MOUNT_ATGC,
	F2FS_MOUNT_MERGE_CHECKPOINT,
	F2FS_MOUNT_GC_MERGE,
	F2FS_MOUNT_COMPRESS_CACHE,
	F2FS_MOUNT_AGE_EXTENT_CACHE,
	F2FS_MOUNT_NAT_BITS,
	F2FS_MOUNT_INLINECRYPT,
	/*
	 * Some f2fs environments expect to be able to pass the "lazytime" option
	 * string rather than using the MS_LAZYTIME flag, so this must remain.
	 */
	F2FS_MOUNT_LAZYTIME,
	F2FS_MOUNT_RESERVE_NODE,
};

#define F2FS_OPTION(sbi)	((sbi)->mount_opt)
#define clear_opt(sbi, option)		\
	(F2FS_OPTION(sbi).opt &= ~BIT(F2FS_MOUNT_##option))
#define set_opt(sbi, option)		\
	(F2FS_OPTION(sbi).opt |= BIT(F2FS_MOUNT_##option))
#define test_opt(sbi, option)		\
	(F2FS_OPTION(sbi).opt & BIT(F2FS_MOUNT_##option))

#define ver_after(a, b)	(typecheck(unsigned long long, a) &&		\
		typecheck(unsigned long long, b) &&			\
		((long long)((a) - (b)) > 0))

typedef u32 block_t;	/*
			 * should not change u32, since it is the on-disk block
			 * address format, __le32.
			 */
typedef u32 nid_t;

#define COMPRESS_EXT_NUM		16

enum blkzone_allocation_policy {
	BLKZONE_ALLOC_PRIOR_SEQ,	/* Prioritize writing to sequential zones */
	BLKZONE_ALLOC_ONLY_SEQ,		/* Only allow writing to sequential zones */
	BLKZONE_ALLOC_PRIOR_CONV,	/* Prioritize writing to conventional zones */
};

enum bggc_io_aware_policy {
	AWARE_ALL_IO,		/* skip background GC if there is any kind of pending IO */
	AWARE_READ_IO,		/* skip background GC if there is pending read IO */
	AWARE_NONE,			/* don't aware IO for background GC */
};

enum device_allocation_policy {
	ALLOCATE_FORWARD_NOHINT,
	ALLOCATE_FORWARD_WITHIN_HINT,
	ALLOCATE_FORWARD_FROM_HINT,
};

enum f2fs_lock_name {
	LOCK_NAME_NONE,
	LOCK_NAME_CP_RWSEM,
	LOCK_NAME_NODE_CHANGE,
	LOCK_NAME_NODE_WRITE,
	LOCK_NAME_GC_LOCK,
	LOCK_NAME_CP_GLOBAL,
	LOCK_NAME_IO_RWSEM,
	LOCK_NAME_MAX,
};

enum f2fs_timeout_type {
	TIMEOUT_TYPE_NONE,
	TIMEOUT_TYPE_RUNNING,
	TIMEOUT_TYPE_IO_SLEEP,
	TIMEOUT_TYPE_NONIO_SLEEP,
	TIMEOUT_TYPE_RUNNABLE,
	TIMEOUT_TYPE_MAX,
};

/*
 * An implementation of an rwsem that is explicitly unfair to readers. This
 * prevents priority inversion when a low-priority reader acquires the read lock
 * while sleeping on the write lock but the write lock is needed by
 * higher-priority clients.
 */

struct f2fs_rwsem {
	struct f2fs_sb_info *sbi;
	enum f2fs_lock_name name;
        struct rw_semaphore internal_rwsem;
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
        wait_queue_head_t read_waiters;
#endif
};

struct f2fs_mount_info {
	unsigned long long opt;
	block_t root_reserved_blocks;	/* root reserved blocks */
	block_t root_reserved_nodes;	/* root reserved nodes */
	kuid_t s_resuid;		/* reserved blocks for uid */
	kgid_t s_resgid;		/* reserved blocks for gid */
	int active_logs;		/* # of active logs */
	int inline_xattr_size;		/* inline xattr size */
#ifdef CONFIG_F2FS_FAULT_INJECTION
	struct f2fs_fault_info fault_info;	/* For fault injection */
#endif
#ifdef CONFIG_QUOTA
	/* Names of quota files with journalled quota */
	char *s_qf_names[MAXQUOTAS];
	int s_jquota_fmt;			/* Format of quota to use */
#endif
	/* For which write hints are passed down to block layer */
	int alloc_mode;			/* segment allocation policy */
	int fsync_mode;			/* fsync policy */
	int fs_mode;			/* fs mode: LFS or ADAPTIVE */
	int bggc_mode;			/* bggc mode: off, on or sync */
	int memory_mode;		/* memory mode */
	int errors;			/* errors parameter */
	int discard_unit;		/*
					 * discard command's offset/size should
					 * be aligned to this unit: block,
					 * segment or section
					 */
	struct fscrypt_dummy_policy dummy_enc_policy; /* test dummy encryption */
	block_t unusable_cap_perc;	/* percentage for cap */
	block_t unusable_cap;		/* Amount of space allowed to be
					 * unusable when disabling checkpoint
					 */

	/* For compression */
	unsigned char compress_algorithm;	/* algorithm type */
	unsigned char compress_log_size;	/* cluster log size */
	unsigned char compress_level;		/* compress level */
	bool compress_chksum;			/* compressed data chksum */
	unsigned char compress_ext_cnt;		/* extension count */
	unsigned char nocompress_ext_cnt;		/* nocompress extension count */
	int compress_mode;			/* compression mode */
	unsigned char extensions[COMPRESS_EXT_NUM][F2FS_EXTENSION_LEN];	/* extensions */
	unsigned char noextensions[COMPRESS_EXT_NUM][F2FS_EXTENSION_LEN]; /* extensions */
	unsigned int lookup_mode;
};

#define F2FS_FEATURE_ENCRYPT			0x00000001
#define F2FS_FEATURE_BLKZONED			0x00000002
#define F2FS_FEATURE_ATOMIC_WRITE		0x00000004
#define F2FS_FEATURE_EXTRA_ATTR			0x00000008
#define F2FS_FEATURE_PRJQUOTA			0x00000010
#define F2FS_FEATURE_INODE_CHKSUM		0x00000020
#define F2FS_FEATURE_FLEXIBLE_INLINE_XATTR	0x00000040
#define F2FS_FEATURE_QUOTA_INO			0x00000080
#define F2FS_FEATURE_INODE_CRTIME		0x00000100
#define F2FS_FEATURE_LOST_FOUND			0x00000200
#define F2FS_FEATURE_VERITY			0x00000400
#define F2FS_FEATURE_SB_CHKSUM			0x00000800
#define F2FS_FEATURE_CASEFOLD			0x00001000
#define F2FS_FEATURE_COMPRESSION		0x00002000
#define F2FS_FEATURE_RO				0x00004000
#define F2FS_FEATURE_DEVICE_ALIAS		0x00008000
#define F2FS_FEATURE_PACKED_SSA			0x00010000

#define __F2FS_HAS_FEATURE(raw_super, mask)				\
	((raw_super->feature & cpu_to_le32(mask)) != 0)
#define F2FS_HAS_FEATURE(sbi, mask)	__F2FS_HAS_FEATURE(sbi->raw_super, mask)

/*
 * Default values for user and/or group using reserved blocks
 */
#define	F2FS_DEF_RESUID		0
#define	F2FS_DEF_RESGID		0

/*
 * For checkpoint manager
 */
enum {
	NAT_BITMAP,
	SIT_BITMAP
};

#define	CP_UMOUNT	0x00000001
#define	CP_FASTBOOT	0x00000002
#define	CP_SYNC		0x00000004
#define	CP_RECOVERY	0x00000008
#define	CP_DISCARD	0x00000010
#define CP_TRIMMED	0x00000020
#define CP_PAUSE	0x00000040
#define CP_RESIZE 	0x00000080

#define DEF_MAX_DISCARD_REQUEST		8	/* issue 8 discards per round */
#define DEF_MIN_DISCARD_ISSUE_TIME	50	/* 50 ms, if exists */
#define DEF_MID_DISCARD_ISSUE_TIME	500	/* 500 ms, if device busy */
#define DEF_MAX_DISCARD_ISSUE_TIME	60000	/* 60 s, if no candidates */
#define DEF_DISCARD_URGENT_UTIL		80	/* do more discard over 80% */
#define DEF_CP_INTERVAL			60	/* 60 secs */
#define DEF_IDLE_INTERVAL		5	/* 5 secs */
#define DEF_DISABLE_INTERVAL		5	/* 5 secs */
#define DEF_DISABLE_QUICK_INTERVAL	1	/* 1 secs */
#define DEF_UMOUNT_DISCARD_TIMEOUT	5	/* 5 secs */

enum cp_time {
	CP_TIME_START,		/* begin */
	CP_TIME_LOCK,		/* after cp_global_sem */
	CP_TIME_OP_LOCK,	/* after block_operation */
	CP_TIME_MERGE_WRITE,	/* after flush DATA/NODE/META */
	CP_TIME_FLUSH_NAT,	/* after flush nat */
	CP_TIME_FLUSH_SIT,	/* after flush sit */
	CP_TIME_SYNC_META,	/* after sync_meta_pages */
	CP_TIME_SYNC_CP_META,	/* after sync cp meta pages */
	CP_TIME_WAIT_DIRTY_META,/* after wait on dirty meta */
	CP_TIME_WAIT_CP_DATA,	/* after wait on cp data */
	CP_TIME_FLUSH_DEVICE,	/* after flush device cache */
	CP_TIME_WAIT_LAST_CP,	/* after wait on last cp pack */
	CP_TIME_END,		/* after unblock_operation */
	CP_TIME_MAX,
};

/* time cost stats of checkpoint */
struct cp_stats {
	ktime_t times[CP_TIME_MAX];
};

struct cp_control {
	int reason;
	__u64 trim_start;
	__u64 trim_end;
	__u64 trim_minlen;
	struct cp_stats stats;
};

enum f2fs_cp_phase {
	CP_PHASE_START_BLOCK_OPS,
	CP_PHASE_FINISH_BLOCK_OPS,
	CP_PHASE_FINISH_CHECKPOINT,
};

/*
 * indicate meta/data type
 */
enum {
	META_CP,
	META_NAT,
	META_SIT,
	META_SSA,
	META_MAX,
	META_POR,
	DATA_GENERIC,		/* check range only */
	DATA_GENERIC_ENHANCE,	/* strong check on range and segment bitmap */
	DATA_GENERIC_ENHANCE_READ,	/*
					 * strong check on range and segment
					 * bitmap but no warning due to race
					 * condition of read on truncated area
					 * by extent_cache
					 */
	DATA_GENERIC_ENHANCE_UPDATE,	/*
					 * strong check on range and segment
					 * bitmap for update case
					 */
	META_GENERIC,
};

/* for the list of ino */
enum {
	ORPHAN_INO,		/* for orphan ino list */
	APPEND_INO,		/* for append ino list */
	UPDATE_INO,		/* for update ino list */
	TRANS_DIR_INO,		/* for transactions dir ino list */
	XATTR_DIR_INO,		/* for xattr updated dir ino list */
	FLUSH_INO,		/* for multiple device flushing */
	MAX_INO_ENTRY,		/* max. list */
};

struct ino_entry {
	struct list_head list;		/* list head */
	nid_t ino;			/* inode number */
	unsigned int dirty_device;	/* dirty device bitmap */
};

/* for the list of inodes to be GCed */
struct inode_entry {
	struct list_head list;	/* list head */
	struct inode *inode;	/* vfs inode pointer */
};

struct fsync_node_entry {
	struct list_head list;	/* list head */
	struct folio *folio;	/* warm node folio pointer */
	unsigned int seq_id;	/* sequence id */
};

struct ckpt_req {
	struct completion wait;		/* completion for checkpoint done */
	struct llist_node llnode;	/* llist_node to be linked in wait queue */
	int ret;			/* return code of checkpoint */
	union {
		ktime_t queue_time;	/* request queued time */
		ktime_t delta_time;	/* time in queue */
	};
};

struct ckpt_req_control {
	struct task_struct *f2fs_issue_ckpt;	/* checkpoint task */
	int ckpt_thread_ioprio;			/* checkpoint merge thread ioprio */
	wait_queue_head_t ckpt_wait_queue;	/* waiting queue for wake-up */
	atomic_t issued_ckpt;		/* # of actually issued ckpts */
	atomic_t total_ckpt;		/* # of total ckpts */
	atomic_t queued_ckpt;		/* # of queued ckpts */
	struct llist_head issue_list;	/* list for command issue */
	spinlock_t stat_lock;		/* lock for below checkpoint time stats */
	unsigned int cur_time;		/* cur wait time in msec for currently issued checkpoint */
	unsigned int peak_time;		/* peak wait time in msec until now */
};

/* a time threshold that checkpoint was blocked for, unit: ms */
#define CP_LONG_LATENCY_THRESHOLD	5000

/* for the bitmap indicate blocks to be discarded */
struct discard_entry {
	struct list_head list;	/* list head */
	block_t start_blkaddr;	/* start blockaddr of current segment */
	unsigned char discard_map[SIT_VBLOCK_MAP_SIZE];	/* segment discard bitmap */
};

/* minimum discard granularity, unit: block count */
#define MIN_DISCARD_GRANULARITY		1
/* default discard granularity of inner discard thread, unit: block count */
#define DEFAULT_DISCARD_GRANULARITY		16
/* default maximum discard granularity of ordered discard, unit: block count */
#define DEFAULT_MAX_ORDERED_DISCARD_GRANULARITY	16
/* default interval of periodical discard submission */
#define DEFAULT_DISCARD_INTERVAL	(msecs_to_jiffies(20))

/* max discard pend list number */
#define MAX_PLIST_NUM		512
#define plist_idx(blk_num)	((blk_num) >= MAX_PLIST_NUM ?		\
					(MAX_PLIST_NUM - 1) : ((blk_num) - 1))

enum {
	D_PREP,			/* initial */
	D_PARTIAL,		/* partially submitted */
	D_SUBMIT,		/* all submitted */
	D_DONE,			/* finished */
};

struct discard_info {
	block_t lstart;			/* logical start address */
	block_t len;			/* length */
	block_t start;			/* actual start address in dev */
};

struct discard_cmd {
	struct rb_node rb_node;		/* rb node located in rb-tree */
	struct discard_info di;		/* discard info */
	struct list_head list;		/* command list */
	struct completion wait;		/* completion */
	struct block_device *bdev;	/* bdev */
	unsigned short ref;		/* reference count */
	unsigned char state;		/* state */
	unsigned char queued;		/* queued discard */
	int error;			/* bio error */
	spinlock_t lock;		/* for state/bio_ref updating */
	unsigned short bio_ref;		/* bio reference count */
};

enum {
	DPOLICY_BG,
	DPOLICY_FORCE,
	DPOLICY_FSTRIM,
	DPOLICY_UMOUNT,
	MAX_DPOLICY,
};

enum {
	DPOLICY_IO_AWARE_DISABLE,	/* force to not be aware of IO */
	DPOLICY_IO_AWARE_ENABLE,	/* force to be aware of IO */
	DPOLICY_IO_AWARE_MAX,
};

struct discard_policy {
	int type;			/* type of discard */
	unsigned int min_interval;	/* used for candidates exist */
	unsigned int mid_interval;	/* used for device busy */
	unsigned int max_interval;	/* used for candidates not exist */
	unsigned int max_requests;	/* # of discards issued per round */
	unsigned int io_aware_gran;	/* minimum granularity discard not be aware of I/O */
	bool io_aware;			/* issue discard in idle time */
	bool sync;			/* submit discard with REQ_SYNC flag */
	bool ordered;			/* issue discard by lba order */
	bool timeout;			/* discard timeout for put_super */
	unsigned int granularity;	/* discard granularity */
};

struct discard_cmd_control {
	struct task_struct *f2fs_issue_discard;	/* discard thread */
	struct list_head entry_list;		/* 4KB discard entry list */
	struct list_head pend_list[MAX_PLIST_NUM];/* store pending entries */
	struct list_head wait_list;		/* store on-flushing entries */
	struct list_head fstrim_list;		/* in-flight discard from fstrim */
	wait_queue_head_t discard_wait_queue;	/* waiting queue for wake-up */
	struct mutex cmd_lock;
	unsigned int nr_discards;		/* # of discards in the list */
	unsigned int max_discards;		/* max. discards to be issued */
	unsigned int max_discard_request;	/* max. discard request per round */
	unsigned int min_discard_issue_time;	/* min. interval between discard issue */
	unsigned int mid_discard_issue_time;	/* mid. interval between discard issue */
	unsigned int max_discard_issue_time;	/* max. interval between discard issue */
	unsigned int discard_io_aware_gran; /* minimum discard granularity not be aware of I/O */
	unsigned int discard_urgent_util;	/* utilization which issue discard proactively */
	unsigned int discard_granularity;	/* discard granularity */
	unsigned int max_ordered_discard;	/* maximum discard granularity issued by lba order */
	unsigned int discard_io_aware;		/* io_aware policy */
	unsigned int undiscard_blks;		/* # of undiscard blocks */
	unsigned int next_pos;			/* next discard position */
	atomic_t issued_discard;		/* # of issued discard */
	atomic_t queued_discard;		/* # of queued discard */
	atomic_t discard_cmd_cnt;		/* # of cached cmd count */
	struct rb_root_cached root;		/* root of discard rb-tree */
	bool rbtree_check;			/* config for consistence check */
	bool discard_wake;			/* to wake up discard thread */
};

/* for the list of fsync inodes, used only during recovery */
struct fsync_inode_entry {
	struct list_head list;	/* list head */
	struct inode *inode;	/* vfs inode pointer */
	block_t blkaddr;	/* block address locating the last fsync */
	block_t last_dentry;	/* block address locating the last dentry */
};

#define nats_in_cursum(jnl)		(le16_to_cpu((jnl)->n_nats))
#define sits_in_cursum(jnl)		(le16_to_cpu((jnl)->n_sits))

#define nat_in_journal(jnl, i) \
	(((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].ne)
#define nid_in_journal(jnl, i) \
	(((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].nid)
#define sit_in_journal(jnl, i) \
	(((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].se)
#define segno_in_journal(jnl, i) \
	(((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].segno)

#define sum_entries(sum)	((struct f2fs_summary *)(sum))
#define sum_journal(sbi, sum) \
	((struct f2fs_journal *)((char *)(sum) + \
	((sbi)->entries_in_sum * sizeof(struct f2fs_summary))))
#define sum_footer(sbi, sum) \
	((struct summary_footer *)((char *)(sum) + (sbi)->sum_blocksize - \
	sizeof(struct summary_footer)))

#define MAX_NAT_JENTRIES(sbi, jnl)	((sbi)->nat_journal_entries - nats_in_cursum(jnl))
#define MAX_SIT_JENTRIES(sbi, jnl)	((sbi)->sit_journal_entries - sits_in_cursum(jnl))

static inline int update_nats_in_cursum(struct f2fs_journal *journal, int i)
{
	int before = nats_in_cursum(journal);

	journal->n_nats = cpu_to_le16(before + i);
	return before;
}

static inline int update_sits_in_cursum(struct f2fs_journal *journal, int i)
{
	int before = sits_in_cursum(journal);

	journal->n_sits = cpu_to_le16(before + i);
	return before;
}

/* for inline stuff */
#define DEF_INLINE_RESERVED_SIZE	1
static inline int get_extra_isize(struct inode *inode);
static inline int get_inline_xattr_addrs(struct inode *inode);
#define MAX_INLINE_DATA(inode)	(sizeof(__le32) *			\
				(CUR_ADDRS_PER_INODE(inode) -		\
				get_inline_xattr_addrs(inode) -	\
				DEF_INLINE_RESERVED_SIZE))

/* for inline dir */
#define NR_INLINE_DENTRY(inode)	(MAX_INLINE_DATA(inode) * BITS_PER_BYTE / \
				((SIZE_OF_DIR_ENTRY + F2FS_SLOT_LEN) * \
				BITS_PER_BYTE + 1))
#define INLINE_DENTRY_BITMAP_SIZE(inode) \
	DIV_ROUND_UP(NR_INLINE_DENTRY(inode), BITS_PER_BYTE)
#define INLINE_RESERVED_SIZE(inode)	(MAX_INLINE_DATA(inode) - \
				((SIZE_OF_DIR_ENTRY + F2FS_SLOT_LEN) * \
				NR_INLINE_DENTRY(inode) + \
				INLINE_DENTRY_BITMAP_SIZE(inode)))

/*
 * For INODE and NODE manager
 */
/* for directory operations */

struct f2fs_filename {
	/*
	 * The filename the user specified.  This is NULL for some
	 * filesystem-internal operations, e.g. converting an inline directory
	 * to a non-inline one, or roll-forward recovering an encrypted dentry.
	 */
	const struct qstr *usr_fname;

	/*
	 * The on-disk filename.  For encrypted directories, this is encrypted.
	 * This may be NULL for lookups in an encrypted dir without the key.
	 */
	struct fscrypt_str disk_name;

	/* The dirhash of this filename */
	f2fs_hash_t hash;

#ifdef CONFIG_FS_ENCRYPTION
	/*
	 * For lookups in encrypted directories: either the buffer backing
	 * disk_name, or a buffer that holds the decoded no-key name.
	 */
	struct fscrypt_str crypto_buf;
#endif
#if IS_ENABLED(CONFIG_UNICODE)
	/*
	 * For casefolded directories: the casefolded name, but it's left NULL
	 * if the original name is not valid Unicode, if the original name is
	 * "." or "..", if the directory is both casefolded and encrypted and
	 * its encryption key is unavailable, or if the filesystem is doing an
	 * internal operation where usr_fname is also NULL.  In all these cases
	 * we fall back to treating the name as an opaque byte sequence.
	 */
	struct qstr cf_name;
#endif
};

struct f2fs_dentry_ptr {
	struct inode *inode;
	void *bitmap;
	struct f2fs_dir_entry *dentry;
	__u8 (*filename)[F2FS_SLOT_LEN];
	int max;
	int nr_bitmap;
};

static inline void make_dentry_ptr_block(struct inode *inode,
		struct f2fs_dentry_ptr *d, struct f2fs_dentry_block *t)
{
	d->inode = inode;
	d->max = NR_DENTRY_IN_BLOCK;
	d->nr_bitmap = SIZE_OF_DENTRY_BITMAP;
	d->bitmap = t->dentry_bitmap;
	d->dentry = t->dentry;
	d->filename = t->filename;
}

static inline void make_dentry_ptr_inline(struct inode *inode,
					struct f2fs_dentry_ptr *d, void *t)
{
	int entry_cnt = NR_INLINE_DENTRY(inode);
	int bitmap_size = INLINE_DENTRY_BITMAP_SIZE(inode);
	int reserved_size = INLINE_RESERVED_SIZE(inode);

	d->inode = inode;
	d->max = entry_cnt;
	d->nr_bitmap = bitmap_size;
	d->bitmap = t;
	d->dentry = t + bitmap_size + reserved_size;
	d->filename = t + bitmap_size + reserved_size +
					SIZE_OF_DIR_ENTRY * entry_cnt;
}

/*
 * XATTR_NODE_OFFSET stores xattrs to one node block per file keeping -1
 * as its node offset to distinguish from index node blocks.
 * But some bits are used to mark the node block.
 */
#define XATTR_NODE_OFFSET	((((unsigned int)-1) << OFFSET_BIT_SHIFT) \
				>> OFFSET_BIT_SHIFT)
enum {
	ALLOC_NODE,			/* allocate a new node page if needed */
	LOOKUP_NODE,			/* look up a node without readahead */
	LOOKUP_NODE_RA,			/*
					 * look up a node with readahead called
					 * by get_data_block.
					 */
};

#define DEFAULT_RETRY_IO_COUNT	8	/* maximum retry read IO or flush count */

#define MAX_FLUSH_RETRY_COUNT	3	/* maximum flush retry count in f2fs_enable_checkpoint() */

/* IO/non-IO congestion wait timeout value, default: 1 jiffies */
#define	DEFAULT_SCHEDULE_TIMEOUT	1

/* timeout value injected, default: 1000ms */
#define DEFAULT_FAULT_TIMEOUT	(msecs_to_jiffies(1000))

/* maximum retry quota flush count */
#define DEFAULT_RETRY_QUOTA_FLUSH_COUNT		8

/* maximum retry of EIO'ed page */
#define MAX_RETRY_PAGE_EIO			100

#define F2FS_LINK_MAX	0xffffffff	/* maximum link count per file */

#define MAX_DIR_RA_PAGES	4	/* maximum ra pages of dir */

/* dirty segments threshold for triggering CP */
#define DEFAULT_DIRTY_THRESHOLD		4

#define RECOVERY_MAX_RA_BLOCKS		BIO_MAX_VECS
#define RECOVERY_MIN_RA_BLOCKS		1

#define F2FS_ONSTACK_PAGES	16	/* nr of onstack pages */

/* for in-memory extent cache entry */
#define F2FS_MIN_EXTENT_LEN	64	/* minimum extent length */

/* number of extent info in extent cache we try to shrink */
#define READ_EXTENT_CACHE_SHRINK_NUMBER	128

/* number of age extent info in extent cache we try to shrink */
#define AGE_EXTENT_CACHE_SHRINK_NUMBER	128
#define LAST_AGE_WEIGHT			30
#define SAME_AGE_REGION			1024

/*
 * Define data block with age less than 1GB as hot data
 * define data block with age less than 10GB but more than 1GB as warm data
 */
#define DEF_HOT_DATA_AGE_THRESHOLD	262144
#define DEF_WARM_DATA_AGE_THRESHOLD	2621440

/* default max read extent count per inode */
#define DEF_MAX_READ_EXTENT_COUNT	10240

/* extent cache type */
enum extent_type {
	EX_READ,
	EX_BLOCK_AGE,
	NR_EXTENT_CACHES,
};

/*
 * Reserved value to mark invalid age extents, hence valid block range
 * from 0 to ULLONG_MAX-1
 */
#define F2FS_EXTENT_AGE_INVALID	ULLONG_MAX

struct extent_info {
	unsigned int fofs;		/* start offset in a file */
	unsigned int len;		/* length of the extent */
	union {
		/* read extent_cache */
		struct {
			/* start block address of the extent */
			block_t blk;
#ifdef CONFIG_F2FS_FS_COMPRESSION
			/* physical extent length of compressed blocks */
			unsigned int c_len;
#endif
		};
		/* block age extent_cache */
		struct {
			/* block age of the extent */
			unsigned long long age;
			/* last total blocks allocated */
			unsigned long long last_blocks;
		};
	};
};

struct extent_node {
	struct rb_node rb_node;		/* rb node located in rb-tree */
	struct extent_info ei;		/* extent info */
	struct list_head list;		/* node in global extent list of sbi */
	struct extent_tree *et;		/* extent tree pointer */
};

struct extent_tree {
	nid_t ino;			/* inode number */
	enum extent_type type;		/* keep the extent tree type */
	struct rb_root_cached root;	/* root of extent info rb-tree */
	struct extent_node *cached_en;	/* recently accessed extent node */
	struct list_head list;		/* to be used by sbi->zombie_list */
	rwlock_t lock;			/* protect extent info rb-tree */
	atomic_t node_cnt;		/* # of extent node in rb-tree*/
	bool largest_updated;		/* largest extent updated */
	struct extent_info largest;	/* largest cached extent for EX_READ */
};

struct extent_tree_info {
	struct radix_tree_root extent_tree_root;/* cache extent cache entries */
	struct mutex extent_tree_lock;	/* locking extent radix tree */
	struct list_head extent_list;		/* lru list for shrinker */
	spinlock_t extent_lock;			/* locking extent lru list */
	atomic_t total_ext_tree;		/* extent tree count */
	struct list_head zombie_list;		/* extent zombie tree list */
	atomic_t total_zombie_tree;		/* extent zombie tree count */
	atomic_t total_ext_node;		/* extent info count */
};

/*
 * State of block returned by f2fs_map_blocks.
 */
#define F2FS_MAP_NEW		(1U << 0)
#define F2FS_MAP_MAPPED		(1U << 1)
#define F2FS_MAP_DELALLOC	(1U << 2)
#define F2FS_MAP_FLAGS		(F2FS_MAP_NEW | F2FS_MAP_MAPPED |\
				F2FS_MAP_DELALLOC)

struct f2fs_map_blocks {
	struct block_device *m_bdev;	/* for multi-device dio */
	block_t m_pblk;
	block_t m_lblk;
	unsigned int m_len;
	unsigned int m_flags;
	unsigned long m_last_pblk;	/* last allocated block, only used for DIO in LFS mode */
	pgoff_t *m_next_pgofs;		/* point next possible non-hole pgofs */
	pgoff_t *m_next_extent;		/* point to next possible extent */
	int m_seg_type;
	bool m_may_create;		/* indicate it is from write path */
	bool m_multidev_dio;		/* indicate it allows multi-device dio */
};

/* for flag in get_data_block */
enum {
	F2FS_GET_BLOCK_DEFAULT,
	F2FS_GET_BLOCK_FIEMAP,
	F2FS_GET_BLOCK_BMAP,
	F2FS_GET_BLOCK_DIO,
	F2FS_GET_BLOCK_PRE_DIO,
	F2FS_GET_BLOCK_PRE_AIO,
	F2FS_GET_BLOCK_PRECACHE,
};

/*
 * i_advise uses FADVISE_XXX_BIT. We can add additional hints later.
 */
#define FADVISE_COLD_BIT	0x01
#define FADVISE_LOST_PINO_BIT	0x02
#define FADVISE_ENCRYPT_BIT	0x04
#define FADVISE_ENC_NAME_BIT	0x08
#define FADVISE_KEEP_SIZE_BIT	0x10
#define FADVISE_HOT_BIT		0x20
#define FADVISE_VERITY_BIT	0x40
#define FADVISE_TRUNC_BIT	0x80

#define FADVISE_MODIFIABLE_BITS	(FADVISE_COLD_BIT | FADVISE_HOT_BIT)

#define file_is_cold(inode)	is_file(inode, FADVISE_COLD_BIT)
#define file_set_cold(inode)	set_file(inode, FADVISE_COLD_BIT)
#define file_clear_cold(inode)	clear_file(inode, FADVISE_COLD_BIT)

#define file_wrong_pino(inode)	is_file(inode, FADVISE_LOST_PINO_BIT)
#define file_lost_pino(inode)	set_file(inode, FADVISE_LOST_PINO_BIT)
#define file_got_pino(inode)	clear_file(inode, FADVISE_LOST_PINO_BIT)

#define file_is_encrypt(inode)	is_file(inode, FADVISE_ENCRYPT_BIT)
#define file_set_encrypt(inode)	set_file(inode, FADVISE_ENCRYPT_BIT)

#define file_enc_name(inode)	is_file(inode, FADVISE_ENC_NAME_BIT)
#define file_set_enc_name(inode) set_file(inode, FADVISE_ENC_NAME_BIT)

#define file_keep_isize(inode)	is_file(inode, FADVISE_KEEP_SIZE_BIT)
#define file_set_keep_isize(inode) set_file(inode, FADVISE_KEEP_SIZE_BIT)

#define file_is_hot(inode)	is_file(inode, FADVISE_HOT_BIT)
#define file_set_hot(inode)	set_file(inode, FADVISE_HOT_BIT)
#define file_clear_hot(inode)	clear_file(inode, FADVISE_HOT_BIT)

#define file_is_verity(inode)	is_file(inode, FADVISE_VERITY_BIT)
#define file_set_verity(inode)	set_file(inode, FADVISE_VERITY_BIT)

#define file_should_truncate(inode)	is_file(inode, FADVISE_TRUNC_BIT)
#define file_need_truncate(inode)	set_file(inode, FADVISE_TRUNC_BIT)
#define file_dont_truncate(inode)	clear_file(inode, FADVISE_TRUNC_BIT)

#define DEF_DIR_LEVEL		0

/* used for f2fs_inode_info->flags */
enum {
	FI_NEW_INODE,		/* indicate newly allocated inode */
	FI_DIRTY_INODE,		/* indicate inode is dirty or not */
	FI_AUTO_RECOVER,	/* indicate inode is recoverable */
	FI_DIRTY_DIR,		/* indicate directory has dirty pages */
	FI_INC_LINK,		/* need to increment i_nlink */
	FI_ACL_MODE,		/* indicate acl mode */
	FI_NO_ALLOC,		/* should not allocate any blocks */
	FI_FREE_NID,		/* free allocated nide */
	FI_NO_EXTENT,		/* not to use the extent cache */
	FI_INLINE_XATTR,	/* used for inline xattr */
	FI_INLINE_DATA,		/* used for inline data*/
	FI_INLINE_DENTRY,	/* used for inline dentry */
	FI_APPEND_WRITE,	/* inode has appended data */
	FI_UPDATE_WRITE,	/* inode has in-place-update data */
	FI_NEED_IPU,		/* used for ipu per file */
	FI_ATOMIC_FILE,		/* indicate atomic file */
	FI_DATA_EXIST,		/* indicate data exists */
	FI_SKIP_WRITES,		/* should skip data page writeback */
	FI_OPU_WRITE,		/* used for opu per file */
	FI_DIRTY_FILE,		/* indicate regular/symlink has dirty pages */
	FI_PREALLOCATED_ALL,	/* all blocks for write were preallocated */
	FI_HOT_DATA,		/* indicate file is hot */
	FI_EXTRA_ATTR,		/* indicate file has extra attribute */
	FI_PROJ_INHERIT,	/* indicate file inherits projectid */
	FI_PIN_FILE,		/* indicate file should not be gced */
	FI_VERITY_IN_PROGRESS,	/* building fs-verity Merkle tree */
	FI_COMPRESSED_FILE,	/* indicate file's data can be compressed */
	FI_COMPRESS_CORRUPT,	/* indicate compressed cluster is corrupted */
	FI_MMAP_FILE,		/* indicate file was mmapped */
	FI_ENABLE_COMPRESS,	/* enable compression in "user" compression mode */
	FI_COMPRESS_RELEASED,	/* compressed blocks were released */
	FI_ALIGNED_WRITE,	/* enable aligned write */
	FI_COW_FILE,		/* indicate COW file */
	FI_ATOMIC_COMMITTED,	/* indicate atomic commit completed except disk sync */
	FI_ATOMIC_DIRTIED,	/* indicate atomic file is dirtied */
	FI_ATOMIC_REPLACE,	/* indicate atomic replace */
	FI_OPENED_FILE,		/* indicate file has been opened */
	FI_DONATE_FINISHED,	/* indicate page donation of file has been finished */
	FI_MAX,			/* max flag, never be used */
};

struct f2fs_inode_info {
	struct inode vfs_inode;		/* serve a vfs inode */
	unsigned long i_flags;		/* keep an inode flags for ioctl */
	unsigned char i_advise;		/* use to give file attribute hints */
	unsigned char i_dir_level;	/* use for dentry level for large dir */
	union {
		unsigned int i_current_depth;	/* only for directory depth */
		unsigned short i_gc_failures;	/* for gc failure statistic */
	};
	unsigned int i_pino;		/* parent inode number */
	umode_t i_acl_mode;		/* keep file acl mode temporarily */

	/* Use below internally in f2fs*/
	unsigned long flags[BITS_TO_LONGS(FI_MAX)];	/* use to pass per-file flags */
	unsigned int ioprio_hint;	/* hint for IO priority */
	struct f2fs_rwsem i_sem;	/* protect fi info */
	atomic_t dirty_pages;		/* # of dirty pages */
	f2fs_hash_t chash;		/* hash value of given file name */
	unsigned int clevel;		/* maximum level of given file name */
	struct task_struct *task;	/* lookup and create consistency */
	struct task_struct *cp_task;	/* separate cp/wb IO stats*/
	struct task_struct *wb_task;	/* indicate inode is in context of writeback */
	nid_t i_xattr_nid;		/* node id that contains xattrs */
	loff_t	last_disk_size;		/* lastly written file size */
	spinlock_t i_size_lock;		/* protect last_disk_size */

#ifdef CONFIG_QUOTA
	struct dquot __rcu *i_dquot[MAXQUOTAS];

	/* quota space reservation, managed internally by quota code */
	qsize_t i_reserved_quota;
#endif
	struct list_head dirty_list;	/* dirty list for dirs and files */
	struct list_head gdirty_list;	/* linked in global dirty list */

	/* linked in global inode list for cache donation */
	struct list_head gdonate_list;
	pgoff_t donate_start, donate_end; /* inclusive */
	atomic_t open_count;		/* # of open files */

	struct task_struct *atomic_write_task;	/* store atomic write task */
	struct extent_tree *extent_tree[NR_EXTENT_CACHES];
					/* cached extent_tree entry */
	union {
		struct inode *cow_inode;	/* copy-on-write inode for atomic write */
		struct inode *atomic_inode;
					/* point to atomic_inode, available only for cow_inode */
	};

	/* avoid racing between foreground op and gc */
	struct f2fs_rwsem i_gc_rwsem[2];
	struct f2fs_rwsem i_xattr_sem; /* avoid racing between reading and changing EAs */

	int i_extra_isize;		/* size of extra space located in i_addr */
	kprojid_t i_projid;		/* id for project quota */
	int i_inline_xattr_size;	/* inline xattr size */
	struct timespec64 i_crtime;	/* inode creation time */
	struct timespec64 i_disk_time[3];/* inode disk times */

	/* for file compress */
	atomic_t i_compr_blocks;		/* # of compressed blocks */
	unsigned char i_compress_algorithm;	/* algorithm type */
	unsigned char i_log_cluster_size;	/* log of cluster size */
	unsigned char i_compress_level;		/* compress level (lz4hc,zstd) */
	unsigned char i_compress_flag;		/* compress flag */
	unsigned int i_cluster_size;		/* cluster size */
	atomic_t writeback;			/* count # of writeback thread */

	unsigned int atomic_write_cnt;
	loff_t original_i_size;		/* original i_size before atomic write */
#ifdef CONFIG_FS_ENCRYPTION
	struct fscrypt_inode_info *i_crypt_info; /* filesystem encryption info */
#endif
};

static inline void get_read_extent_info(struct extent_info *ext,
					struct f2fs_extent *i_ext)
{
	ext->fofs = le32_to_cpu(i_ext->fofs);
	ext->blk = le32_to_cpu(i_ext->blk);
	ext->len = le32_to_cpu(i_ext->len);
}

static inline void set_raw_read_extent(struct extent_info *ext,
					struct f2fs_extent *i_ext)
{
	i_ext->fofs = cpu_to_le32(ext->fofs);
	i_ext->blk = cpu_to_le32(ext->blk);
	i_ext->len = cpu_to_le32(ext->len);
}

static inline bool __is_discard_mergeable(struct discard_info *back,
			struct discard_info *front, unsigned int max_len)
{
	return (back->lstart + back->len == front->lstart) &&
		(back->len + front->len <= max_len);
}

static inline bool __is_discard_back_mergeable(struct discard_info *cur,
			struct discard_info *back, unsigned int max_len)
{
	return __is_discard_mergeable(back, cur, max_len);
}

static inline bool __is_discard_front_mergeable(struct discard_info *cur,
			struct discard_info *front, unsigned int max_len)
{
	return __is_discard_mergeable(cur, front, max_len);
}

/*
 * For free nid management
 */
enum nid_state {
	FREE_NID,		/* newly added to free nid list */
	PREALLOC_NID,		/* it is preallocated */
	MAX_NID_STATE,
};

enum nat_state {
	TOTAL_NAT,
	DIRTY_NAT,
	RECLAIMABLE_NAT,
	MAX_NAT_STATE,
};

struct f2fs_nm_info {
	block_t nat_blkaddr;		/* base disk address of NAT */
	nid_t max_nid;			/* maximum possible node ids */
	nid_t available_nids;		/* # of available node ids */
	nid_t next_scan_nid;		/* the next nid to be scanned */
	nid_t max_rf_node_blocks;	/* max # of nodes for recovery */
	unsigned int ram_thresh;	/* control the memory footprint */
	unsigned int ra_nid_pages;	/* # of nid pages to be readaheaded */
	unsigned int dirty_nats_ratio;	/* control dirty nats ratio threshold */

	/* NAT cache management */
	struct radix_tree_root nat_root;/* root of the nat entry cache */
	struct radix_tree_root nat_set_root;/* root of the nat set cache */
	struct f2fs_rwsem nat_tree_lock;	/* protect nat entry tree */
	struct list_head nat_entries;	/* cached nat entry list (clean) */
	spinlock_t nat_list_lock;	/* protect clean nat entry list */
	unsigned int nat_cnt[MAX_NAT_STATE]; /* the # of cached nat entries */
	unsigned int nat_blocks;	/* # of nat blocks */

	/* free node ids management */
	struct radix_tree_root free_nid_root;/* root of the free_nid cache */
	struct list_head free_nid_list;		/* list for free nids excluding preallocated nids */
	unsigned int nid_cnt[MAX_NID_STATE];	/* the number of free node id */
	spinlock_t nid_list_lock;	/* protect nid lists ops */
	struct mutex build_lock;	/* lock for build free nids */
	unsigned char **free_nid_bitmap;
	unsigned char *nat_block_bitmap;
	unsigned short *free_nid_count;	/* free nid count of NAT block */

	/* for checkpoint */
	char *nat_bitmap;		/* NAT bitmap pointer */

	unsigned int nat_bits_blocks;	/* # of nat bits blocks */
	unsigned char *nat_bits;	/* NAT bits blocks */
	unsigned char *full_nat_bits;	/* full NAT pages */
	unsigned char *empty_nat_bits;	/* empty NAT pages */
#ifdef CONFIG_F2FS_CHECK_FS
	char *nat_bitmap_mir;		/* NAT bitmap mirror */
#endif
	int bitmap_size;		/* bitmap size */
};

/*
 * this structure is used as one of function parameters.
 * all the information are dedicated to a given direct node block determined
 * by the data offset in a file.
 */
struct dnode_of_data {
	struct inode *inode;		/* vfs inode pointer */
	struct folio *inode_folio;	/* its inode folio, NULL is possible */
	struct folio *node_folio;	/* cached direct node folio */
	nid_t nid;			/* node id of the direct node block */
	unsigned int ofs_in_node;	/* data offset in the node page */
	bool inode_folio_locked;	/* inode folio is locked or not */
	bool node_changed;		/* is node block changed */
	char cur_level;			/* level of hole node page */
	char max_level;			/* level of current page located */
	block_t	data_blkaddr;		/* block address of the node block */
};

static inline void set_new_dnode(struct dnode_of_data *dn, struct inode *inode,
		struct folio *ifolio, struct folio *nfolio, nid_t nid)
{
	memset(dn, 0, sizeof(*dn));
	dn->inode = inode;
	dn->inode_folio = ifolio;
	dn->node_folio = nfolio;
	dn->nid = nid;
}

/*
 * For SIT manager
 *
 * By default, there are 6 active log areas across the whole main area.
 * When considering hot and cold data separation to reduce cleaning overhead,
 * we split 3 for data logs and 3 for node logs as hot, warm, and cold types,
 * respectively.
 * In the current design, you should not change the numbers intentionally.
 * Instead, as a mount option such as active_logs=x, you can use 2, 4, and 6
 * logs individually according to the underlying devices. (default: 6)
 * Just in case, on-disk layout covers maximum 16 logs that consist of 8 for
 * data and 8 for node logs.
 */
#define	NR_CURSEG_DATA_TYPE	(3)
#define NR_CURSEG_NODE_TYPE	(3)
#define NR_CURSEG_INMEM_TYPE	(2)
#define NR_CURSEG_RO_TYPE	(2)
#define NR_CURSEG_PERSIST_TYPE	(NR_CURSEG_DATA_TYPE + NR_CURSEG_NODE_TYPE)
#define NR_CURSEG_TYPE		(NR_CURSEG_INMEM_TYPE + NR_CURSEG_PERSIST_TYPE)

enum log_type {
	CURSEG_HOT_DATA	= 0,	/* directory entry blocks */
	CURSEG_WARM_DATA,	/* data blocks */
	CURSEG_COLD_DATA,	/* multimedia or GCed data blocks */
	CURSEG_HOT_NODE,	/* direct node blocks of directory files */
	CURSEG_WARM_NODE,	/* direct node blocks of normal files */
	CURSEG_COLD_NODE,	/* indirect node blocks */
	NR_PERSISTENT_LOG,	/* number of persistent log */
	CURSEG_COLD_DATA_PINNED = NR_PERSISTENT_LOG,
				/* pinned file that needs consecutive block address */
	CURSEG_ALL_DATA_ATGC,	/* SSR alloctor in hot/warm/cold data area */
	NO_CHECK_TYPE,		/* number of persistent & inmem log */
};

struct flush_cmd {
	struct completion wait;
	struct llist_node llnode;
	nid_t ino;
	int ret;
};

struct flush_cmd_control {
	struct task_struct *f2fs_issue_flush;	/* flush thread */
	wait_queue_head_t flush_wait_queue;	/* waiting queue for wake-up */
	atomic_t issued_flush;			/* # of issued flushes */
	atomic_t queued_flush;			/* # of queued flushes */
	struct llist_head issue_list;		/* list for command issue */
	struct llist_node *dispatch_list;	/* list for command dispatch */
};

struct f2fs_sm_info {
	struct sit_info *sit_info;		/* whole segment information */
	struct free_segmap_info *free_info;	/* free segment information */
	struct dirty_seglist_info *dirty_info;	/* dirty segment information */
	struct curseg_info *curseg_array;	/* active segment information */

	struct f2fs_rwsem curseg_lock;	/* for preventing curseg change */

	block_t seg0_blkaddr;		/* block address of 0'th segment */
	block_t main_blkaddr;		/* start block address of main area */
	block_t ssa_blkaddr;		/* start block address of SSA area */

	unsigned int segment_count;	/* total # of segments */
	unsigned int main_segments;	/* # of segments in main area */
	unsigned int reserved_segments;	/* # of reserved segments */
	unsigned int ovp_segments;	/* # of overprovision segments */

	/* a threshold to reclaim prefree segments */
	unsigned int rec_prefree_segments;

	struct list_head sit_entry_set;	/* sit entry set list */

	unsigned int ipu_policy;	/* in-place-update policy */
	unsigned int min_ipu_util;	/* in-place-update threshold */
	unsigned int min_fsync_blocks;	/* threshold for fsync */
	unsigned int min_seq_blocks;	/* threshold for sequential blocks */
	unsigned int min_hot_blocks;	/* threshold for hot block allocation */
	unsigned int min_ssr_sections;	/* threshold to trigger SSR allocation */

	/* for flush command control */
	struct flush_cmd_control *fcc_info;

	/* for discard command control */
	struct discard_cmd_control *dcc_info;
};

/*
 * For superblock
 */
/*
 * COUNT_TYPE for monitoring
 *
 * f2fs monitors the number of several block types such as on-writeback,
 * dirty dentry blocks, dirty node blocks, and dirty meta blocks.
 */
#define WB_DATA_TYPE(folio, f)			\
	(f || f2fs_is_cp_guaranteed(folio) ? F2FS_WB_CP_DATA : F2FS_WB_DATA)
enum count_type {
	F2FS_DIRTY_DENTS,
	F2FS_DIRTY_DATA,
	F2FS_DIRTY_QDATA,
	F2FS_DIRTY_NODES,
	F2FS_DIRTY_META,
	F2FS_DIRTY_IMETA,
	F2FS_WB_CP_DATA,
	F2FS_WB_DATA,
	F2FS_RD_DATA,
	F2FS_RD_NODE,
	F2FS_RD_META,
	F2FS_DIO_WRITE,
	F2FS_DIO_READ,
	F2FS_SKIPPED_WRITE,	/* skip or fail during f2fs_enable_checkpoint() */
	NR_COUNT_TYPE,
};

/*
 * The below are the page types of bios used in submit_bio().
 * The available types are:
 * DATA			User data pages. It operates as async mode.
 * NODE			Node pages. It operates as async mode.
 * META			FS metadata pages such as SIT, NAT, CP.
 * NR_PAGE_TYPE		The number of page types.
 * META_FLUSH		Make sure the previous pages are written
 *			with waiting the bio's completion
 * ...			Only can be used with META.
 */
#define PAGE_TYPE_OF_BIO(type)	((type) > META ? META : (type))
#define PAGE_TYPE_ON_MAIN(type)	((type) == DATA || (type) == NODE)
enum page_type {
	DATA = 0,
	NODE = 1,	/* should not change this */
	META,
	NR_PAGE_TYPE,
	META_FLUSH,
	IPU,		/* the below types are used by tracepoints only. */
	OPU,
};

enum temp_type {
	HOT = 0,	/* must be zero for meta bio */
	WARM,
	COLD,
	NR_TEMP_TYPE,
};

enum need_lock_type {
	LOCK_REQ = 0,
	LOCK_DONE,
	LOCK_RETRY,
};

enum cp_reason_type {
	CP_NO_NEEDED,
	CP_NON_REGULAR,
	CP_COMPRESSED,
	CP_HARDLINK,
	CP_SB_NEED_CP,
	CP_WRONG_PINO,
	CP_NO_SPC_ROLL,
	CP_NODE_NEED_CP,
	CP_FASTBOOT_MODE,
	CP_SPEC_LOG_NUM,
	CP_RECOVER_DIR,
	CP_XATTR_DIR,
};

enum iostat_type {
	/* WRITE IO */
	APP_DIRECT_IO,			/* app direct write IOs */
	APP_BUFFERED_IO,		/* app buffered write IOs */
	APP_WRITE_IO,			/* app write IOs */
	APP_MAPPED_IO,			/* app mapped IOs */
	APP_BUFFERED_CDATA_IO,		/* app buffered write IOs on compressed file */
	APP_MAPPED_CDATA_IO,		/* app mapped write IOs on compressed file */
	FS_DATA_IO,			/* data IOs from kworker/fsync/reclaimer */
	FS_CDATA_IO,			/* data IOs from kworker/fsync/reclaimer on compressed file */
	FS_NODE_IO,			/* node IOs from kworker/fsync/reclaimer */
	FS_META_IO,			/* meta IOs from kworker/reclaimer */
	FS_GC_DATA_IO,			/* data IOs from forground gc */
	FS_GC_NODE_IO,			/* node IOs from forground gc */
	FS_CP_DATA_IO,			/* data IOs from checkpoint */
	FS_CP_NODE_IO,			/* node IOs from checkpoint */
	FS_CP_META_IO,			/* meta IOs from checkpoint */

	/* READ IO */
	APP_DIRECT_READ_IO,		/* app direct read IOs */
	APP_BUFFERED_READ_IO,		/* app buffered read IOs */
	APP_READ_IO,			/* app read IOs */
	APP_MAPPED_READ_IO,		/* app mapped read IOs */
	APP_BUFFERED_CDATA_READ_IO,	/* app buffered read IOs on compressed file  */
	APP_MAPPED_CDATA_READ_IO,	/* app mapped read IOs on compressed file  */
	FS_DATA_READ_IO,		/* data read IOs */
	FS_GDATA_READ_IO,		/* data read IOs from background gc */
	FS_CDATA_READ_IO,		/* compressed data read IOs */
	FS_NODE_READ_IO,		/* node read IOs */
	FS_META_READ_IO,		/* meta read IOs */

	/* other */
	FS_DISCARD_IO,			/* discard */
	FS_FLUSH_IO,			/* flush */
	FS_ZONE_RESET_IO,		/* zone reset */
	NR_IO_TYPE,
};

struct f2fs_io_info {
	struct f2fs_sb_info *sbi;	/* f2fs_sb_info pointer */
	nid_t ino;		/* inode number */
	enum page_type type;	/* contains DATA/NODE/META/META_FLUSH */
	enum temp_type temp;	/* contains HOT/WARM/COLD */
	enum req_op op;		/* contains REQ_OP_ */
	blk_opf_t op_flags;	/* req_flag_bits */
	block_t new_blkaddr;	/* new block address to be written */
	block_t old_blkaddr;	/* old block address before Cow */
	union {
		struct page *page;	/* page to be written */
		struct folio *folio;
	};
	struct page *encrypted_page;	/* encrypted page */
	struct page *compressed_page;	/* compressed page */
	struct list_head list;		/* serialize IOs */
	unsigned int compr_blocks;	/* # of compressed block addresses */
	unsigned int need_lock:8;	/* indicate we need to lock cp_rwsem */
	unsigned int version:8;		/* version of the node */
	unsigned int submitted:1;	/* indicate IO submission */
	unsigned int in_list:1;		/* indicate fio is in io_list */
	unsigned int is_por:1;		/* indicate IO is from recovery or not */
	unsigned int encrypted:1;	/* indicate file is encrypted */
	unsigned int meta_gc:1;		/* require meta inode GC */
	enum iostat_type io_type;	/* io type */
	struct writeback_control *io_wbc; /* writeback control */
	struct bio **bio;		/* bio for ipu */
	sector_t *last_block;		/* last block number in bio */
};

struct bio_entry {
	struct bio *bio;
	struct list_head list;
};

#define is_read_io(rw) ((rw) == READ)
struct f2fs_bio_info {
	struct f2fs_sb_info *sbi;	/* f2fs superblock */
	struct bio *bio;		/* bios to merge */
	sector_t last_block_in_bio;	/* last block number */
	struct f2fs_io_info fio;	/* store buffered io info. */
#ifdef CONFIG_BLK_DEV_ZONED
	struct completion zone_wait;	/* condition value for the previous open zone to close */
	struct bio *zone_pending_bio;	/* pending bio for the previous zone */
	void *bi_private;		/* previous bi_private for pending bio */
#endif
	struct f2fs_rwsem io_rwsem;	/* blocking op for bio */
	spinlock_t io_lock;		/* serialize DATA/NODE IOs */
	struct list_head io_list;	/* track fios */
	struct list_head bio_list;	/* bio entry list head */
	struct f2fs_rwsem bio_list_lock;	/* lock to protect bio entry list */
};

#define FDEV(i)				(sbi->devs[i])
#define RDEV(i)				(raw_super->devs[i])
struct f2fs_dev_info {
	struct file *bdev_file;
	struct block_device *bdev;
	char path[MAX_PATH_LEN + 1];
	unsigned int total_segments;
	block_t start_blk;
	block_t end_blk;
#ifdef CONFIG_BLK_DEV_ZONED
	unsigned int nr_blkz;		/* Total number of zones */
	unsigned long *blkz_seq;	/* Bitmap indicating sequential zones */
#endif
};

enum inode_type {
	DIR_INODE,			/* for dirty dir inode */
	FILE_INODE,			/* for dirty regular/symlink inode */
	DIRTY_META,			/* for all dirtied inode metadata */
	DONATE_INODE,			/* for all inode to donate pages */
	NR_INODE_TYPE,
};

/* for inner inode cache management */
struct inode_management {
	struct radix_tree_root ino_root;	/* ino entry array */
	spinlock_t ino_lock;			/* for ino entry lock */
	struct list_head ino_list;		/* inode list head */
	unsigned long ino_num;			/* number of entries */
};

/* for GC_AT */
struct atgc_management {
	bool atgc_enabled;			/* ATGC is enabled or not */
	struct rb_root_cached root;		/* root of victim rb-tree */
	struct list_head victim_list;		/* linked with all victim entries */
	unsigned int victim_count;		/* victim count in rb-tree */
	unsigned int candidate_ratio;		/* candidate ratio */
	unsigned int max_candidate_count;	/* max candidate count */
	unsigned int age_weight;		/* age weight, vblock_weight = 100 - age_weight */
	unsigned long long age_threshold;	/* age threshold */
};

struct f2fs_time_stat {
	unsigned long long total_time;		/* total wall clock time */
#ifdef CONFIG_64BIT
	unsigned long long running_time;	/* running time */
#endif
#if defined(CONFIG_SCHED_INFO) && defined(CONFIG_SCHEDSTATS)
	unsigned long long runnable_time;	/* runnable(including preempted) time */
#endif
#ifdef CONFIG_TASK_DELAY_ACCT
	unsigned long long io_sleep_time;	/* IO sleep time */
#endif
};

struct f2fs_lock_context {
	struct f2fs_time_stat ts;
	int orig_nice;
	int new_nice;
	bool lock_trace;
	bool need_restore;
};

struct f2fs_gc_control {
	unsigned int victim_segno;	/* target victim segment number */
	int init_gc_type;		/* FG_GC or BG_GC */
	bool no_bg_gc;			/* check the space and stop bg_gc */
	bool should_migrate_blocks;	/* should migrate blocks */
	bool err_gc_skipped;		/* return EAGAIN if GC skipped */
	bool one_time;			/* require one time GC in one migration unit */
	unsigned int nr_free_secs;	/* # of free sections to do GC */
	struct f2fs_lock_context lc;	/* lock context for gc_lock */
};

/*
 * For s_flag in struct f2fs_sb_info
 * Modification on enum should be synchronized with s_flag array
 */
enum {
	SBI_IS_DIRTY,				/* dirty flag for checkpoint */
	SBI_IS_CLOSE,				/* specify unmounting */
	SBI_NEED_FSCK,				/* need fsck.f2fs to fix */
	SBI_POR_DOING,				/* recovery is doing or not */
	SBI_NEED_SB_WRITE,			/* need to recover superblock */
	SBI_NEED_CP,				/* need to checkpoint */
	SBI_IS_SHUTDOWN,			/* shutdown by ioctl */
	SBI_IS_RECOVERED,			/* recovered orphan/data */
	SBI_CP_DISABLED,			/* CP was disabled last mount */
	SBI_CP_DISABLED_QUICK,			/* CP was disabled quickly */
	SBI_QUOTA_NEED_FLUSH,			/* need to flush quota info in CP */
	SBI_QUOTA_SKIP_FLUSH,			/* skip flushing quota in current CP */
	SBI_QUOTA_NEED_REPAIR,			/* quota file may be corrupted */
	SBI_IS_RESIZEFS,			/* resizefs is in process */
	SBI_IS_FREEZING,			/* freezefs is in process */
	SBI_IS_WRITABLE,			/* remove ro mountoption transiently */
	SBI_ENABLE_CHECKPOINT,			/* indicate it's during f2fs_enable_checkpoint() */
	MAX_SBI_FLAG,
};

enum {
	CP_TIME,
	REQ_TIME,
	DISCARD_TIME,
	GC_TIME,
	DISABLE_TIME,
	UMOUNT_DISCARD_TIMEOUT,
	MAX_TIME,
};

/* Note that you need to keep synchronization with this gc_mode_names array */
enum {
	GC_NORMAL,
	GC_IDLE_CB,
	GC_IDLE_GREEDY,
	GC_IDLE_AT,
	GC_URGENT_HIGH,
	GC_URGENT_LOW,
	GC_URGENT_MID,
	MAX_GC_MODE,
};

enum {
	BGGC_MODE_ON,		/* background gc is on */
	BGGC_MODE_OFF,		/* background gc is off */
	BGGC_MODE_SYNC,		/*
				 * background gc is on, migrating blocks
				 * like foreground gc
				 */
};

enum {
	FS_MODE_ADAPTIVE,		/* use both lfs/ssr allocation */
	FS_MODE_LFS,			/* use lfs allocation only */
	FS_MODE_FRAGMENT_SEG,		/* segment fragmentation mode */
	FS_MODE_FRAGMENT_BLK,		/* block fragmentation mode */
};

enum {
	ALLOC_MODE_DEFAULT,	/* stay default */
	ALLOC_MODE_REUSE,	/* reuse segments as much as possible */
};

enum fsync_mode {
	FSYNC_MODE_POSIX,	/* fsync follows posix semantics */
	FSYNC_MODE_STRICT,	/* fsync behaves in line with ext4 */
	FSYNC_MODE_NOBARRIER,	/* fsync behaves nobarrier based on posix */
};

enum {
	COMPR_MODE_FS,		/*
				 * automatically compress compression
				 * enabled files
				 */
	COMPR_MODE_USER,	/*
				 * automatical compression is disabled.
				 * user can control the file compression
				 * using ioctls
				 */
};

enum {
	DISCARD_UNIT_BLOCK,	/* basic discard unit is block */
	DISCARD_UNIT_SEGMENT,	/* basic discard unit is segment */
	DISCARD_UNIT_SECTION,	/* basic discard unit is section */
};

enum {
	MEMORY_MODE_NORMAL,	/* memory mode for normal devices */
	MEMORY_MODE_LOW,	/* memory mode for low memory devices */
};

enum errors_option {
	MOUNT_ERRORS_READONLY,	/* remount fs ro on errors */
	MOUNT_ERRORS_CONTINUE,	/* continue on errors */
	MOUNT_ERRORS_PANIC,	/* panic on errors */
};

enum {
	BACKGROUND,
	FOREGROUND,
	MAX_CALL_TYPE,
	TOTAL_CALL = FOREGROUND,
};

enum f2fs_lookup_mode {
	LOOKUP_PERF,
	LOOKUP_COMPAT,
	LOOKUP_AUTO,
};

/* For node type in __get_node_folio() */
enum node_type {
	NODE_TYPE_REGULAR,
	NODE_TYPE_INODE,
	NODE_TYPE_XATTR,
	NODE_TYPE_NON_INODE,
};

/* a threshold of maximum elapsed time in critical region to print tracepoint */
#define MAX_LOCK_ELAPSED_TIME		500

#define F2FS_DEFAULT_TASK_PRIORITY		(DEFAULT_PRIO)
#define F2FS_CRITICAL_TASK_PRIORITY		NICE_TO_PRIO(0)

static inline int f2fs_test_bit(unsigned int nr, char *addr);
static inline void f2fs_set_bit(unsigned int nr, char *addr);
static inline void f2fs_clear_bit(unsigned int nr, char *addr);

/*
 * Layout of f2fs page.private:
 *
 * Layout A: lowest bit should be 1
 * | bit0 = 1 | bit1 | bit2 | ... | bit MAX | private data .... |
 * bit 0	PAGE_PRIVATE_NOT_POINTER
 * bit 1	PAGE_PRIVATE_ONGOING_MIGRATION
 * bit 2	PAGE_PRIVATE_INLINE_INODE
 * bit 3	PAGE_PRIVATE_REF_RESOURCE
 * bit 4	PAGE_PRIVATE_ATOMIC_WRITE
 * bit 5-	f2fs private data
 *
 * Layout B: lowest bit should be 0
 * page.private is a wrapped pointer.
 */
enum {
	PAGE_PRIVATE_NOT_POINTER,		/* private contains non-pointer data */
	PAGE_PRIVATE_ONGOING_MIGRATION,		/* data page which is on-going migrating */
	PAGE_PRIVATE_INLINE_INODE,		/* inode page contains inline data */
	PAGE_PRIVATE_REF_RESOURCE,		/* dirty page has referenced resources */
	PAGE_PRIVATE_ATOMIC_WRITE,		/* data page from atomic write path */
	PAGE_PRIVATE_MAX
};

/* For compression */
enum compress_algorithm_type {
	COMPRESS_LZO,
	COMPRESS_LZ4,
	COMPRESS_ZSTD,
	COMPRESS_LZORLE,
	COMPRESS_MAX,
};

enum compress_flag {
	COMPRESS_CHKSUM,
	COMPRESS_MAX_FLAG,
};

#define	COMPRESS_WATERMARK			20
#define	COMPRESS_PERCENT			20

#define COMPRESS_DATA_RESERVED_SIZE		4
struct compress_data {
	__le32 clen;			/* compressed data size */
	__le32 chksum;			/* compressed data checksum */
	__le32 reserved[COMPRESS_DATA_RESERVED_SIZE];	/* reserved */
	u8 cdata[];			/* compressed data */
};

#define COMPRESS_HEADER_SIZE	(sizeof(struct compress_data))

#define F2FS_COMPRESSED_PAGE_MAGIC	0xF5F2C000

#define F2FS_ZSTD_DEFAULT_CLEVEL	1

#define	COMPRESS_LEVEL_OFFSET	8

/* compress context */
struct compress_ctx {
	struct inode *inode;		/* inode the context belong to */
	pgoff_t cluster_idx;		/* cluster index number */
	unsigned int cluster_size;	/* page count in cluster */
	unsigned int log_cluster_size;	/* log of cluster size */
	struct page **rpages;		/* pages store raw data in cluster */
	unsigned int nr_rpages;		/* total page number in rpages */
	struct page **cpages;		/* pages store compressed data in cluster */
	unsigned int nr_cpages;		/* total page number in cpages */
	unsigned int valid_nr_cpages;	/* valid page number in cpages */
	void *rbuf;			/* virtual mapped address on rpages */
	struct compress_data *cbuf;	/* virtual mapped address on cpages */
	size_t rlen;			/* valid data length in rbuf */
	size_t clen;			/* valid data length in cbuf */
	void *private;			/* payload buffer for specified compression algorithm */
	void *private2;			/* extra payload buffer */
	struct fsverity_info *vi;	/* verity info if needed */
};

/* compress context for write IO path */
struct compress_io_ctx {
	u32 magic;			/* magic number to indicate page is compressed */
	struct inode *inode;		/* inode the context belong to */
	struct page **rpages;		/* pages store raw data in cluster */
	unsigned int nr_rpages;		/* total page number in rpages */
	atomic_t pending_pages;		/* in-flight compressed page count */
};

/* Context for decompressing one cluster on the read IO path */
struct decompress_io_ctx {
	u32 magic;			/* magic number to indicate page is compressed */
	struct inode *inode;		/* inode the context belong to */
	struct f2fs_sb_info *sbi;	/* f2fs_sb_info pointer */
	pgoff_t cluster_idx;		/* cluster index number */
	unsigned int cluster_size;	/* page count in cluster */
	unsigned int log_cluster_size;	/* log of cluster size */
	struct page **rpages;		/* pages store raw data in cluster */
	unsigned int nr_rpages;		/* total page number in rpages */
	struct page **cpages;		/* pages store compressed data in cluster */
	unsigned int nr_cpages;		/* total page number in cpages */
	struct page **tpages;		/* temp pages to pad holes in cluster */
	void *rbuf;			/* virtual mapped address on rpages */
	struct compress_data *cbuf;	/* virtual mapped address on cpages */
	size_t rlen;			/* valid data length in rbuf */
	size_t clen;			/* valid data length in cbuf */

	/*
	 * The number of compressed pages remaining to be read in this cluster.
	 * This is initially nr_cpages.  It is decremented by 1 each time a page
	 * has been read (or failed to be read).  When it reaches 0, the cluster
	 * is decompressed (or an error is reported).
	 *
	 * If an error occurs before all the pages have been submitted for I/O,
	 * then this will never reach 0.  In this case the I/O submitter is
	 * responsible for calling f2fs_decompress_end_io() instead.
	 */
	atomic_t remaining_pages;

	/*
	 * Number of references to this decompress_io_ctx.
	 *
	 * One reference is held for I/O completion.  This reference is dropped
	 * after the pagecache pages are updated and unlocked -- either after
	 * decompression (and verity if enabled), or after an error.
	 *
	 * In addition, each compressed page holds a reference while it is in a
	 * bio.  These references are necessary prevent compressed pages from
	 * being freed while they are still in a bio.
	 */
	refcount_t refcnt;

	bool failed;			/* IO error occurred before decompression? */
	struct fsverity_info *vi;	/* fs-verity context if needed */
	unsigned char compress_algorithm;	/* backup algorithm type */
	void *private;			/* payload buffer for specified decompression algorithm */
	void *private2;			/* extra payload buffer */
	struct work_struct verity_work;	/* work to verify the decompressed pages */
	struct work_struct free_work;	/* work for late free this structure itself */
};

#define NULL_CLUSTER			((unsigned int)(~0))
#define MIN_COMPRESS_LOG_SIZE		2
#define MAX_COMPRESS_LOG_SIZE		8
#define MAX_COMPRESS_WINDOW_SIZE(log_size)	((PAGE_SIZE) << (log_size))

struct f2fs_sb_info {
	struct super_block *sb;			/* pointer to VFS super block */
	struct proc_dir_entry *s_proc;		/* proc entry */
	struct f2fs_super_block *raw_super;	/* raw super block pointer */
	struct f2fs_rwsem sb_lock;		/* lock for raw super block */
	int valid_super_block;			/* valid super block no */
	unsigned long s_flag;				/* flags for sbi */
	struct mutex writepages;		/* mutex for writepages() */

#ifdef CONFIG_BLK_DEV_ZONED
	unsigned int blocks_per_blkz;		/* F2FS blocks per zone */
	unsigned int unusable_blocks_per_sec;   /* unusable blocks per section */
	unsigned int max_open_zones;		/* max open zone resources of the zoned device */
	/* For adjust the priority writing position of data in zone UFS */
	unsigned int blkzone_alloc_policy;
#endif

	/* for node-related operations */
	struct f2fs_nm_info *nm_info;		/* node manager */
	struct inode *node_inode;		/* cache node blocks */

	/* for segment-related operations */
	struct f2fs_sm_info *sm_info;		/* segment manager */

	/* for bio operations */
	struct f2fs_bio_info *write_io[NR_PAGE_TYPE];	/* for write bios */
	/* keep migration IO order for LFS mode */
	struct f2fs_rwsem io_order_lock;
	pgoff_t page_eio_ofs[NR_PAGE_TYPE];	/* EIO page offset */
	int page_eio_cnt[NR_PAGE_TYPE];		/* EIO count */

	/* for checkpoint */
	struct f2fs_checkpoint *ckpt;		/* raw checkpoint pointer */
	int cur_cp_pack;			/* remain current cp pack */
	spinlock_t cp_lock;			/* for flag in ckpt */
	struct inode *meta_inode;		/* cache meta blocks */
	struct f2fs_rwsem cp_global_sem;	/* checkpoint procedure lock */
	struct f2fs_rwsem cp_rwsem;		/* blocking FS operations */
	struct f2fs_rwsem node_write;		/* locking node writes */
	struct f2fs_rwsem node_change;	/* locking node change */
	wait_queue_head_t cp_wait;
	unsigned long last_time[MAX_TIME];	/* to store time in jiffies */
	long interval_time[MAX_TIME];		/* to store thresholds */
	struct ckpt_req_control cprc_info;	/* for checkpoint request control */
	struct cp_stats cp_stats;		/* for time stat of checkpoint */

	struct inode_management im[MAX_INO_ENTRY];	/* manage inode cache */

	spinlock_t fsync_node_lock;		/* for node entry lock */
	struct list_head fsync_node_list;	/* node list head */
	unsigned int fsync_seg_id;		/* sequence id */
	unsigned int fsync_node_num;		/* number of node entries */

	/* for orphan inode, use 0'th array */
	unsigned int max_orphans;		/* max orphan inodes */

	/* for inode management */
	struct list_head inode_list[NR_INODE_TYPE];	/* dirty inode list */
	spinlock_t inode_lock[NR_INODE_TYPE];	/* for dirty inode list lock */
	struct mutex flush_lock;		/* for flush exclusion */

	/* for extent tree cache */
	struct extent_tree_info extent_tree[NR_EXTENT_CACHES];
	atomic64_t allocated_data_blocks;	/* for block age extent_cache */
	unsigned int max_read_extent_count;	/* max read extent count per inode */

	/* The threshold used for hot and warm data seperation*/
	unsigned int hot_data_age_threshold;
	unsigned int warm_data_age_threshold;
	unsigned int last_age_weight;

	/* control donate caches */
	unsigned int donate_files;

	/* basic filesystem units */
	unsigned int log_sectors_per_block;	/* log2 sectors per block */
	unsigned int log_blocksize;		/* log2 block size */
	unsigned int blocksize;			/* block size */
	unsigned int root_ino_num;		/* root inode number*/
	unsigned int node_ino_num;		/* node inode number*/
	unsigned int meta_ino_num;		/* meta inode number*/
	unsigned int log_blocks_per_seg;	/* log2 blocks per segment */
	unsigned int blocks_per_seg;		/* blocks per segment */
	unsigned int segs_per_sec;		/* segments per section */
	unsigned int secs_per_zone;		/* sections per zone */
	unsigned int total_sections;		/* total section count */
	unsigned int total_node_count;		/* total node block count */
	unsigned int total_valid_node_count;	/* valid node block count */
	int dir_level;				/* directory level */
	bool readdir_ra;			/* readahead inode in readdir */
	unsigned int max_io_bytes;		/* max io bytes to merge IOs */

	/* variable summary block units */
	unsigned int sum_blocksize;		/* sum block size */
	unsigned int sums_per_block;		/* sum block count per block */
	unsigned int entries_in_sum;		/* entry count in sum block */
	unsigned int sum_entry_size;		/* total entry size in sum block */
	unsigned int sum_journal_size;		/* journal size in sum block */
	unsigned int nat_journal_entries;	/* nat journal entry count in the journal */
	unsigned int sit_journal_entries;	/* sit journal entry count in the journal */

	block_t user_block_count;		/* # of user blocks */
	block_t total_valid_block_count;	/* # of valid blocks */
	block_t discard_blks;			/* discard command candidats */
	block_t last_valid_block_count;		/* for recovery */
	block_t reserved_blocks;		/* configurable reserved blocks */
	block_t current_reserved_blocks;	/* current reserved blocks */

	/* Additional tracking for no checkpoint mode */
	block_t unusable_block_count;		/* # of blocks saved by last cp */

	unsigned int nquota_files;		/* # of quota sysfile */
	struct f2fs_rwsem quota_sem;		/* blocking cp for flags */
	struct task_struct *umount_lock_holder;	/* s_umount lock holder */

	/* # of pages, see count_type */
	atomic_t nr_pages[NR_COUNT_TYPE];
	/* # of allocated blocks */
	struct percpu_counter alloc_valid_block_count;
	/* # of node block writes as roll forward recovery */
	struct percpu_counter rf_node_block_count;

	/* writeback control */
	atomic_t wb_sync_req[META];	/* count # of WB_SYNC threads */

	/* valid inode count */
	struct percpu_counter total_valid_inode_count;

	struct f2fs_mount_info mount_opt;	/* mount options */

	/* for cleaning operations */
	struct f2fs_rwsem gc_lock;		/*
						 * semaphore for GC, avoid
						 * race between GC and GC or CP
						 */
	struct f2fs_gc_kthread	*gc_thread;	/* GC thread */
	struct atgc_management am;		/* atgc management */
	unsigned int cur_victim_sec;		/* current victim section num */
	unsigned int gc_mode;			/* current GC state */
	unsigned int next_victim_seg[2];	/* next segment in victim section */
	spinlock_t gc_remaining_trials_lock;
	/* remaining trial count for GC_URGENT_* and GC_IDLE_* */
	unsigned int gc_remaining_trials;

	/* for skip statistic */
	unsigned long long skipped_gc_rwsem;		/* FG_GC only */

	/* free sections reserved for pinned file */
	unsigned int reserved_pin_section;

	/* threshold for gc trials on pinned files */
	unsigned short gc_pin_file_threshold;
	struct f2fs_rwsem pin_sem;

	/* maximum # of trials to find a victim segment for SSR and GC */
	unsigned int max_victim_search;
	/* migration granularity of garbage collection, unit: segment */
	unsigned int migration_granularity;
	/* migration window granularity of garbage collection, unit: segment */
	unsigned int migration_window_granularity;

	/*
	 * for stat information.
	 * one is for the LFS mode, and the other is for the SSR mode.
	 */
#ifdef CONFIG_F2FS_STAT_FS
	struct f2fs_stat_info *stat_info;	/* FS status information */
	atomic_t meta_count[META_MAX];		/* # of meta blocks */
	unsigned int segment_count[2];		/* # of allocated segments */
	unsigned int block_count[2];		/* # of allocated blocks */
	atomic_t inplace_count;		/* # of inplace update */
	/* # of lookup extent cache */
	atomic64_t total_hit_ext[NR_EXTENT_CACHES];
	/* # of hit rbtree extent node */
	atomic64_t read_hit_rbtree[NR_EXTENT_CACHES];
	/* # of hit cached extent node */
	atomic64_t read_hit_cached[NR_EXTENT_CACHES];
	/* # of hit largest extent node in read extent cache */
	atomic64_t read_hit_largest;
	atomic_t inline_xattr;			/* # of inline_xattr inodes */
	atomic_t inline_inode;			/* # of inline_data inodes */
	atomic_t inline_dir;			/* # of inline_dentry inodes */
	atomic_t compr_inode;			/* # of compressed inodes */
	atomic64_t compr_blocks;		/* # of compressed blocks */
	atomic_t swapfile_inode;		/* # of swapfile inodes */
	atomic_t atomic_files;			/* # of opened atomic file */
	atomic_t max_aw_cnt;			/* max # of atomic writes */
	unsigned int io_skip_bggc;		/* skip background gc for in-flight IO */
	unsigned int other_skip_bggc;		/* skip background gc for other reasons */
	unsigned int ndirty_inode[NR_INODE_TYPE];	/* # of dirty inodes */
	atomic_t cp_call_count[MAX_CALL_TYPE];	/* # of cp call */
#endif
	spinlock_t stat_lock;			/* lock for stat operations */

	/* to attach REQ_META|REQ_FUA flags */
	unsigned int data_io_flag;
	unsigned int node_io_flag;

	/* For sysfs support */
	struct kobject s_kobj;			/* /sys/fs/f2fs/<devname> */
	struct completion s_kobj_unregister;

	struct kobject s_stat_kobj;		/* /sys/fs/f2fs/<devname>/stat */
	struct completion s_stat_kobj_unregister;

	struct kobject s_feature_list_kobj;		/* /sys/fs/f2fs/<devname>/feature_list */
	struct completion s_feature_list_kobj_unregister;

	/* For shrinker support */
	struct list_head s_list;
	struct mutex umount_mutex;
	unsigned int shrinker_run_no;

	/* For multi devices */
	int s_ndevs;				/* number of devices */
	struct f2fs_dev_info *devs;		/* for device list */
	unsigned int dirty_device;		/* for checkpoint data flush */
	spinlock_t dev_lock;			/* protect dirty_device */
	bool aligned_blksize;			/* all devices has the same logical blksize */
	unsigned int first_seq_zone_segno;	/* first segno in sequential zone */
	unsigned int bggc_io_aware;		/* For adjust the BG_GC priority when pending IO */
	unsigned int allocate_section_hint;	/* the boundary position between devices */
	unsigned int allocate_section_policy;	/* determine the section writing priority */

	/* For write statistics */
	u64 sectors_written_start;
	u64 kbytes_written;

	/* Precomputed FS UUID checksum for seeding other checksums */
	__u32 s_chksum_seed;

	struct workqueue_struct *post_read_wq;	/* post read workqueue */

	/*
	 * If we are in irq context, let's update error information into
	 * on-disk superblock in the work.
	 */
	struct work_struct s_error_work;
	unsigned char errors[MAX_F2FS_ERRORS];		/* error flags */
	unsigned char stop_reason[MAX_STOP_REASON];	/* stop reason */
	spinlock_t error_lock;			/* protect errors/stop_reason array */
	bool error_dirty;			/* errors of sb is dirty */

	/* For reclaimed segs statistics per each GC mode */
	unsigned int gc_segment_mode;		/* GC state for reclaimed segments */
	unsigned int gc_reclaimed_segs[MAX_GC_MODE];	/* Reclaimed segs for each mode */

	unsigned int seq_file_ra_mul;		/* multiplier for ra_pages of seq. files in fadvise */

	int max_fragment_chunk;			/* max chunk size for block fragmentation mode */
	int max_fragment_hole;			/* max hole size for block fragmentation mode */

	/* For atomic write statistics */
	atomic64_t current_atomic_write;
	s64 peak_atomic_write;
	u64 committed_atomic_block;
	u64 revoked_atomic_block;

	/* carve out reserved_blocks from total blocks */
	bool carve_out;

	/* max elapsed time threshold in critical region that lock covered */
	unsigned long long max_lock_elapsed_time;

	/* enable/disable to adjust task priority in critical region covered by lock */
	unsigned int adjust_lock_priority;

	/* adjust priority for task which is in critical region covered by lock */
	unsigned int lock_duration_priority;

	/* priority for critical task, e.g. f2fs_ckpt, f2fs_gc threads */
	long critical_task_priority;

#ifdef CONFIG_F2FS_FS_COMPRESSION
	struct kmem_cache *page_array_slab;	/* page array entry */
	unsigned int page_array_slab_size;	/* default page array slab size */

	/* For runtime compression statistics */
	u64 compr_written_block;
	u64 compr_saved_block;
	u32 compr_new_inode;

	/* For compressed block cache */
	struct inode *compress_inode;		/* cache compressed blocks */
	unsigned int compress_percent;		/* cache page percentage */
	unsigned int compress_watermark;	/* cache page watermark */
	atomic_t compress_page_hit;		/* cache hit count */
#endif

#ifdef CONFIG_F2FS_IOSTAT
	/* For app/fs IO statistics */
	spinlock_t iostat_lock;
	unsigned long long iostat_count[NR_IO_TYPE];
	unsigned long long iostat_bytes[NR_IO_TYPE];
	unsigned long long prev_iostat_bytes[NR_IO_TYPE];
	bool iostat_enable;
	unsigned long iostat_next_period;
	unsigned int iostat_period_ms;

	/* For io latency related statistics info in one iostat period */
	spinlock_t iostat_lat_lock;
	struct iostat_lat_info *iostat_io_lat;
#endif
};

/* Definitions to access f2fs_sb_info */
#define SEGS_TO_BLKS(sbi, segs)					\
		((segs) << (sbi)->log_blocks_per_seg)
#define BLKS_TO_SEGS(sbi, blks)					\
		((blks) >> (sbi)->log_blocks_per_seg)

#define BLKS_PER_SEG(sbi)	((sbi)->blocks_per_seg)
#define BLKS_PER_SEC(sbi)	(SEGS_TO_BLKS(sbi, (sbi)->segs_per_sec))
#define SEGS_PER_SEC(sbi)	((sbi)->segs_per_sec)

__printf(3, 4)
void f2fs_printk(struct f2fs_sb_info *sbi, bool limit_rate, const char *fmt, ...);

#define f2fs_err(sbi, fmt, ...)						\
	f2fs_printk(sbi, false, KERN_ERR fmt, ##__VA_ARGS__)
#define f2fs_warn(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_WARNING fmt, ##__VA_ARGS__)
#define f2fs_notice(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_NOTICE fmt, ##__VA_ARGS__)
#define f2fs_info(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_INFO fmt, ##__VA_ARGS__)
#define f2fs_debug(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_DEBUG fmt, ##__VA_ARGS__)

#define f2fs_err_ratelimited(sbi, fmt, ...)				\
	f2fs_printk(sbi, true, KERN_ERR fmt, ##__VA_ARGS__)
#define f2fs_warn_ratelimited(sbi, fmt, ...)				\
	f2fs_printk(sbi, true, KERN_WARNING fmt, ##__VA_ARGS__)
#define f2fs_info_ratelimited(sbi, fmt, ...)				\
	f2fs_printk(sbi, true, KERN_INFO fmt, ##__VA_ARGS__)

#ifdef CONFIG_F2FS_FAULT_INJECTION
#define time_to_inject(sbi, type) __time_to_inject(sbi, type, __func__,	\
									__builtin_return_address(0))
static inline bool __time_to_inject(struct f2fs_sb_info *sbi, int type,
				const char *func, const char *parent_func)
{
	struct f2fs_fault_info *ffi = &F2FS_OPTION(sbi).fault_info;

	if (!ffi->inject_rate)
		return false;

	if (!IS_FAULT_SET(ffi, type))
		return false;

	atomic_inc(&ffi->inject_ops);
	if (atomic_read(&ffi->inject_ops) >= ffi->inject_rate) {
		atomic_set(&ffi->inject_ops, 0);
		ffi->inject_count[type]++;
		f2fs_info_ratelimited(sbi, "inject %s in %s of %pS",
				f2fs_fault_name[type], func, parent_func);
		return true;
	}
	return false;
}
#else
static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type)
{
	return false;
}
#endif

/*
 * Test if the mounted volume is a multi-device volume.
 *   - For a single regular disk volume, sbi->s_ndevs is 0.
 *   - For a single zoned disk volume, sbi->s_ndevs is 1.
 *   - For a multi-device volume, sbi->s_ndevs is always 2 or more.
 */
static inline bool f2fs_is_multi_device(struct f2fs_sb_info *sbi)
{
	return sbi->s_ndevs > 1;
}

static inline void f2fs_update_time(struct f2fs_sb_info *sbi, int type)
{
	unsigned long now = jiffies;

	sbi->last_time[type] = now;

	/* DISCARD_TIME and GC_TIME are based on REQ_TIME */
	if (type == REQ_TIME) {
		sbi->last_time[DISCARD_TIME] = now;
		sbi->last_time[GC_TIME] = now;
	}
}

static inline bool f2fs_time_over(struct f2fs_sb_info *sbi, int type)
{
	unsigned long interval = sbi->interval_time[type] * HZ;

	return time_after(jiffies, sbi->last_time[type] + interval);
}

static inline unsigned int f2fs_time_to_wait(struct f2fs_sb_info *sbi,
						int type)
{
	unsigned long interval = sbi->interval_time[type] * HZ;
	unsigned int wait_ms = 0;
	long delta;

	delta = (sbi->last_time[type] + interval) - jiffies;
	if (delta > 0)
		wait_ms = jiffies_to_msecs(delta);

	return wait_ms;
}

/*
 * Inline functions
 */
static inline u32 __f2fs_crc32(u32 crc, const void *address,
			       unsigned int length)
{
	return crc32(crc, address, length);
}

static inline u32 f2fs_crc32(const void *address, unsigned int length)
{
	return __f2fs_crc32(F2FS_SUPER_MAGIC, address, length);
}

static inline u32 f2fs_chksum(u32 crc, const void *address, unsigned int length)
{
	return __f2fs_crc32(crc, address, length);
}

static inline struct f2fs_inode_info *F2FS_I(struct inode *inode)
{
	return container_of(inode, struct f2fs_inode_info, vfs_inode);
}

static inline struct f2fs_sb_info *F2FS_SB(struct super_block *sb)
{
	return sb->s_fs_info;
}

static inline struct f2fs_sb_info *F2FS_I_SB(struct inode *inode)
{
	return F2FS_SB(inode->i_sb);
}

static inline struct f2fs_sb_info *F2FS_M_SB(struct address_space *mapping)
{
	return F2FS_I_SB(mapping->host);
}

static inline struct f2fs_sb_info *F2FS_F_SB(const struct folio *folio)
{
	return F2FS_M_SB(folio->mapping);
}

static inline struct f2fs_super_block *F2FS_RAW_SUPER(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_super_block *)(sbi->raw_super);
}

static inline struct f2fs_super_block *F2FS_SUPER_BLOCK(struct folio *folio,
								pgoff_t index)
{
	pgoff_t idx_in_folio = index % folio_nr_pages(folio);

	return (struct f2fs_super_block *)
		(page_address(folio_page(folio, idx_in_folio)) +
						F2FS_SUPER_OFFSET);
}

static inline struct f2fs_checkpoint *F2FS_CKPT(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_checkpoint *)(sbi->ckpt);
}

static inline struct f2fs_node *F2FS_NODE(const struct folio *folio)
{
	return (struct f2fs_node *)folio_address(folio);
}

static inline struct f2fs_inode *F2FS_INODE(const struct folio *folio)
{
	return &((struct f2fs_node *)folio_address(folio))->i;
}

static inline struct f2fs_nm_info *NM_I(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_nm_info *)(sbi->nm_info);
}

static inline struct f2fs_sm_info *SM_I(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_sm_info *)(sbi->sm_info);
}

static inline struct sit_info *SIT_I(struct f2fs_sb_info *sbi)
{
	return (struct sit_info *)(SM_I(sbi)->sit_info);
}

static inline struct free_segmap_info *FREE_I(struct f2fs_sb_info *sbi)
{
	return (struct free_segmap_info *)(SM_I(sbi)->free_info);
}

static inline struct dirty_seglist_info *DIRTY_I(struct f2fs_sb_info *sbi)
{
	return (struct dirty_seglist_info *)(SM_I(sbi)->dirty_info);
}

static inline struct address_space *META_MAPPING(struct f2fs_sb_info *sbi)
{
	return sbi->meta_inode->i_mapping;
}

static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
{
	return sbi->node_inode->i_mapping;
}

static inline bool is_meta_folio(struct folio *folio)
{
	return folio->mapping == META_MAPPING(F2FS_F_SB(folio));
}

static inline bool is_node_folio(struct folio *folio)
{
	return folio->mapping == NODE_MAPPING(F2FS_F_SB(folio));
}

static inline bool is_sbi_flag_set(struct f2fs_sb_info *sbi, unsigned int type)
{
	return test_bit(type, &sbi->s_flag);
}

static inline void set_sbi_flag(struct f2fs_sb_info *sbi, unsigned int type)
{
	set_bit(type, &sbi->s_flag);
}

static inline void clear_sbi_flag(struct f2fs_sb_info *sbi, unsigned int type)
{
	clear_bit(type, &sbi->s_flag);
}

static inline unsigned long long cur_cp_version(struct f2fs_checkpoint *cp)
{
	return le64_to_cpu(cp->checkpoint_ver);
}

static inline unsigned long f2fs_qf_ino(struct super_block *sb, int type)
{
	if (type < F2FS_MAX_QUOTAS)
		return le32_to_cpu(F2FS_SB(sb)->raw_super->qf_ino[type]);
	return 0;
}

static inline __u64 cur_cp_crc(struct f2fs_checkpoint *cp)
{
	size_t crc_offset = le32_to_cpu(cp->checksum_offset);
	return le32_to_cpu(*((__le32 *)((unsigned char *)cp + crc_offset)));
}

static inline bool __is_set_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
{
	unsigned int ckpt_flags = le32_to_cpu(cp->ckpt_flags);

	return ckpt_flags & f;
}

static inline bool is_set_ckpt_flags(struct f2fs_sb_info *sbi, unsigned int f)
{
	return __is_set_ckpt_flags(F2FS_CKPT(sbi), f);
}

static inline void __set_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
{
	unsigned int ckpt_flags;

	ckpt_flags = le32_to_cpu(cp->ckpt_flags);
	ckpt_flags |= f;
	cp->ckpt_flags = cpu_to_le32(ckpt_flags);
}

static inline void set_ckpt_flags(struct f2fs_sb_info *sbi, unsigned int f)
{
	unsigned long flags;

	spin_lock_irqsave(&sbi->cp_lock, flags);
	__set_ckpt_flags(F2FS_CKPT(sbi), f);
	spin_unlock_irqrestore(&sbi->cp_lock, flags);
}

static inline void __clear_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
{
	unsigned int ckpt_flags;

	ckpt_flags = le32_to_cpu(cp->ckpt_flags);
	ckpt_flags &= (~f);
	cp->ckpt_flags = cpu_to_le32(ckpt_flags);
}

static inline void clear_ckpt_flags(struct f2fs_sb_info *sbi, unsigned int f)
{
	unsigned long flags;

	spin_lock_irqsave(&sbi->cp_lock, flags);
	__clear_ckpt_flags(F2FS_CKPT(sbi), f);
	spin_unlock_irqrestore(&sbi->cp_lock, flags);
}

#define init_f2fs_rwsem(sem)	__init_f2fs_rwsem(sem, NULL, LOCK_NAME_NONE)
#define init_f2fs_rwsem_trace	__init_f2fs_rwsem

#define __init_f2fs_rwsem(sem, sbi, name)			\
do {								\
	static struct lock_class_key __key;			\
								\
	do_init_f2fs_rwsem((sem), #sem, &__key, sbi, name);	\
} while (0)

static inline void do_init_f2fs_rwsem(struct f2fs_rwsem *sem,
		const char *sem_name, struct lock_class_key *key,
		struct f2fs_sb_info *sbi, enum f2fs_lock_name name)
{
	sem->sbi = sbi;
	sem->name = name;
	__init_rwsem(&sem->internal_rwsem, sem_name, key);
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
	init_waitqueue_head(&sem->read_waiters);
#endif
}

static inline int f2fs_rwsem_is_locked(struct f2fs_rwsem *sem)
{
	return rwsem_is_locked(&sem->internal_rwsem);
}

static inline int f2fs_rwsem_is_contended(struct f2fs_rwsem *sem)
{
	return rwsem_is_contended(&sem->internal_rwsem);
}

static inline void f2fs_down_read(struct f2fs_rwsem *sem)
{
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
	wait_event(sem->read_waiters, down_read_trylock(&sem->internal_rwsem));
#else
	down_read(&sem->internal_rwsem);
#endif
}

static inline int f2fs_down_read_trylock(struct f2fs_rwsem *sem)
{
	return down_read_trylock(&sem->internal_rwsem);
}

static inline void f2fs_up_read(struct f2fs_rwsem *sem)
{
	up_read(&sem->internal_rwsem);
}

static inline void f2fs_down_write(struct f2fs_rwsem *sem)
{
	down_write(&sem->internal_rwsem);
}

#ifdef CONFIG_DEBUG_LOCK_ALLOC
static inline void f2fs_down_read_nested(struct f2fs_rwsem *sem, int subclass)
{
	down_read_nested(&sem->internal_rwsem, subclass);
}

static inline void f2fs_down_write_nested(struct f2fs_rwsem *sem, int subclass)
{
	down_write_nested(&sem->internal_rwsem, subclass);
}
#else
#define f2fs_down_read_nested(sem, subclass) f2fs_down_read(sem)
#define f2fs_down_write_nested(sem, subclass) f2fs_down_write(sem)
#endif

static inline int f2fs_down_write_trylock(struct f2fs_rwsem *sem)
{
	return down_write_trylock(&sem->internal_rwsem);
}

static inline void f2fs_up_write(struct f2fs_rwsem *sem)
{
	up_write(&sem->internal_rwsem);
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
	wake_up_all(&sem->read_waiters);
#endif
}

void f2fs_down_read_trace(struct f2fs_rwsem *sem, struct f2fs_lock_context *lc);
int f2fs_down_read_trylock_trace(struct f2fs_rwsem *sem,
						struct f2fs_lock_context *lc);
void f2fs_up_read_trace(struct f2fs_rwsem *sem, struct f2fs_lock_context *lc);
void f2fs_down_write_trace(struct f2fs_rwsem *sem,
						struct f2fs_lock_context *lc);
int f2fs_down_write_trylock_trace(struct f2fs_rwsem *sem,
						struct f2fs_lock_context *lc);
void f2fs_up_write_trace(struct f2fs_rwsem *sem, struct f2fs_lock_context *lc);

static inline void disable_nat_bits(struct f2fs_sb_info *sbi, bool lock)
{
	unsigned long flags;
	unsigned char *nat_bits;

	/*
	 * In order to re-enable nat_bits we need to call fsck.f2fs by
	 * set_sbi_flag(sbi, SBI_NEED_FSCK). But it may give huge cost,
	 * so let's rely on regular fsck or unclean shutdown.
	 */

	if (lock)
		spin_lock_irqsave(&sbi->cp_lock, flags);
	__clear_ckpt_flags(F2FS_CKPT(sbi), CP_NAT_BITS_FLAG);
	nat_bits = NM_I(sbi)->nat_bits;
	NM_I(sbi)->nat_bits = NULL;
	if (lock)
		spin_unlock_irqrestore(&sbi->cp_lock, flags);

	kvfree(nat_bits);
}

static inline bool enabled_nat_bits(struct f2fs_sb_info *sbi,
					struct cp_control *cpc)
{
	bool set = is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG);

	return (cpc) ? (cpc->reason & CP_UMOUNT) && set : set;
}

static inline int __get_cp_reason(struct f2fs_sb_info *sbi)
{
	int reason = CP_SYNC;

	if (test_opt(sbi, FASTBOOT))
		reason = CP_FASTBOOT;
	if (is_sbi_flag_set(sbi, SBI_IS_CLOSE))
		reason = CP_UMOUNT;
	return reason;
}

static inline bool __remain_node_summaries(int reason)
{
	return (reason & (CP_UMOUNT | CP_FASTBOOT));
}

static inline bool __exist_node_summaries(struct f2fs_sb_info *sbi)
{
	return (is_set_ckpt_flags(sbi, CP_UMOUNT_FLAG) ||
			is_set_ckpt_flags(sbi, CP_FASTBOOT_FLAG));
}

/*
 * Check whether the inode has blocks or not
 */
static inline int F2FS_HAS_BLOCKS(struct inode *inode)
{
	block_t xattr_block = F2FS_I(inode)->i_xattr_nid ? 1 : 0;

	return (inode->i_blocks >> F2FS_LOG_SECTORS_PER_BLOCK) > xattr_block;
}

static inline bool f2fs_has_xattr_block(unsigned int ofs)
{
	return ofs == XATTR_NODE_OFFSET;
}

static inline bool __allow_reserved_root(struct f2fs_sb_info *sbi,
					struct inode *inode, bool cap)
{
	if (!inode)
		return true;
	if (IS_NOQUOTA(inode))
		return true;
	if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
		return true;
	if (!gid_eq(F2FS_OPTION(sbi).s_resgid, GLOBAL_ROOT_GID) &&
					in_group_p(F2FS_OPTION(sbi).s_resgid))
		return true;
	if (cap && capable(CAP_SYS_RESOURCE))
		return true;
	return false;
}

static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
						struct inode *inode, bool cap)
{
	block_t avail_user_block_count;

	avail_user_block_count = sbi->user_block_count -
					sbi->current_reserved_blocks;

	if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_root(sbi, inode, cap))
		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;

	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
		if (avail_user_block_count > sbi->unusable_block_count)
			avail_user_block_count -= sbi->unusable_block_count;
		else
			avail_user_block_count = 0;
	}

	return avail_user_block_count;
}

static inline void f2fs_i_blocks_write(struct inode *, block_t, bool, bool);
static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
				 struct inode *inode, blkcnt_t *count, bool partial)
{
	long long diff = 0, release = 0;
	block_t avail_user_block_count;
	int ret;

	ret = dquot_reserve_block(inode, *count);
	if (ret)
		return ret;

	if (time_to_inject(sbi, FAULT_BLOCK)) {
		release = *count;
		goto release_quota;
	}

	/*
	 * let's increase this in prior to actual block count change in order
	 * for f2fs_sync_file to avoid data races when deciding checkpoint.
	 */
	percpu_counter_add(&sbi->alloc_valid_block_count, (*count));

	spin_lock(&sbi->stat_lock);

	avail_user_block_count = get_available_block_count(sbi, inode, true);
	diff = (long long)sbi->total_valid_block_count + *count -
						avail_user_block_count;
	if (unlikely(diff > 0)) {
		if (!partial) {
			spin_unlock(&sbi->stat_lock);
			release = *count;
			goto enospc;
		}
		if (diff > *count)
			diff = *count;
		*count -= diff;
		release = diff;
		if (!*count) {
			spin_unlock(&sbi->stat_lock);
			goto enospc;
		}
	}
	sbi->total_valid_block_count += (block_t)(*count);

	spin_unlock(&sbi->stat_lock);

	if (unlikely(release)) {
		percpu_counter_sub(&sbi->alloc_valid_block_count, release);
		dquot_release_reservation_block(inode, release);
	}
	f2fs_i_blocks_write(inode, *count, true, true);
	return 0;

enospc:
	percpu_counter_sub(&sbi->alloc_valid_block_count, release);
release_quota:
	dquot_release_reservation_block(inode, release);
	return -ENOSPC;
}

#define PAGE_PRIVATE_GET_FUNC(name, flagname) \
static inline bool folio_test_f2fs_##name(const struct folio *folio)	\
{									\
	unsigned long priv = (unsigned long)folio->private;		\
	unsigned long v = (1UL << PAGE_PRIVATE_NOT_POINTER) |		\
			     (1UL << PAGE_PRIVATE_##flagname);		\
	return (priv & v) == v;						\
}									\
static inline bool page_private_##name(struct page *page) \
{ \
	return PagePrivate(page) && \
		test_bit(PAGE_PRIVATE_NOT_POINTER, &page_private(page)) && \
		test_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \
}

#define PAGE_PRIVATE_SET_FUNC(name, flagname) \
static inline void folio_set_f2fs_##name(struct folio *folio)		\
{									\
	unsigned long v = (1UL << PAGE_PRIVATE_NOT_POINTER) |		\
			     (1UL << PAGE_PRIVATE_##flagname);		\
	if (!folio->private)						\
		folio_attach_private(folio, (void *)v);			\
	else {								\
		v |= (unsigned long)folio->private;			\
		folio->private = (void *)v;				\
	}								\
}									\
static inline void set_page_private_##name(struct page *page) \
{ \
	if (!PagePrivate(page)) \
		attach_page_private(page, (void *)0); \
	set_bit(PAGE_PRIVATE_NOT_POINTER, &page_private(page)); \
	set_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \
}

#define PAGE_PRIVATE_CLEAR_FUNC(name, flagname) \
static inline void folio_clear_f2fs_##name(struct folio *folio)		\
{									\
	unsigned long v = (unsigned long)folio->private;		\
									\
	v &= ~(1UL << PAGE_PRIVATE_##flagname);				\
	if (v == (1UL << PAGE_PRIVATE_NOT_POINTER))			\
		folio_detach_private(folio);				\
	else								\
		folio->private = (void *)v;				\
}									\
static inline void clear_page_private_##name(struct page *page) \
{ \
	clear_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \
	if (page_private(page) == BIT(PAGE_PRIVATE_NOT_POINTER)) \
		detach_page_private(page); \
}

PAGE_PRIVATE_GET_FUNC(nonpointer, NOT_POINTER);
PAGE_PRIVATE_GET_FUNC(inline, INLINE_INODE);
PAGE_PRIVATE_GET_FUNC(gcing, ONGOING_MIGRATION);
PAGE_PRIVATE_GET_FUNC(atomic, ATOMIC_WRITE);

PAGE_PRIVATE_SET_FUNC(reference, REF_RESOURCE);
PAGE_PRIVATE_SET_FUNC(inline, INLINE_INODE);
PAGE_PRIVATE_SET_FUNC(gcing, ONGOING_MIGRATION);
PAGE_PRIVATE_SET_FUNC(atomic, ATOMIC_WRITE);

PAGE_PRIVATE_CLEAR_FUNC(reference, REF_RESOURCE);
PAGE_PRIVATE_CLEAR_FUNC(inline, INLINE_INODE);
PAGE_PRIVATE_CLEAR_FUNC(gcing, ONGOING_MIGRATION);
PAGE_PRIVATE_CLEAR_FUNC(atomic, ATOMIC_WRITE);

static inline unsigned long folio_get_f2fs_data(struct folio *folio)
{
	unsigned long data = (unsigned long)folio->private;

	if (!test_bit(PAGE_PRIVATE_NOT_POINTER, &data))
		return 0;
	return data >> PAGE_PRIVATE_MAX;
}

static inline void folio_set_f2fs_data(struct folio *folio, unsigned long data)
{
	data = (1UL << PAGE_PRIVATE_NOT_POINTER) | (data << PAGE_PRIVATE_MAX);

	if (!folio_test_private(folio))
		folio_attach_private(folio, (void *)data);
	else
		folio->private = (void *)((unsigned long)folio->private | data);
}

static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,
						struct inode *inode,
						block_t count)
{
	blkcnt_t sectors = count << F2FS_LOG_SECTORS_PER_BLOCK;

	spin_lock(&sbi->stat_lock);
	if (unlikely(sbi->total_valid_block_count < count)) {
		f2fs_warn(sbi, "Inconsistent total_valid_block_count:%u, ino:%lu, count:%u",
			  sbi->total_valid_block_count, inode->i_ino, count);
		sbi->total_valid_block_count = 0;
		set_sbi_flag(sbi, SBI_NEED_FSCK);
	} else {
		sbi->total_valid_block_count -= count;
	}
	if (sbi->reserved_blocks &&
		sbi->current_reserved_blocks < sbi->reserved_blocks)
		sbi->current_reserved_blocks = min(sbi->reserved_blocks,
					sbi->current_reserved_blocks + count);
	spin_unlock(&sbi->stat_lock);
	if (unlikely(inode->i_blocks < sectors)) {
		f2fs_warn(sbi, "Inconsistent i_blocks, ino:%lu, iblocks:%llu, sectors:%llu",
			  inode->i_ino,
			  (unsigned long long)inode->i_blocks,
			  (unsigned long long)sectors);
		set_sbi_flag(sbi, SBI_NEED_FSCK);
		return;
	}
	f2fs_i_blocks_write(inode, count, false, true);
}

static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type)
{
	atomic_inc(&sbi->nr_pages[count_type]);

	if (count_type == F2FS_DIRTY_DENTS ||
			count_type == F2FS_DIRTY_NODES ||
			count_type == F2FS_DIRTY_META ||
			count_type == F2FS_DIRTY_QDATA ||
			count_type == F2FS_DIRTY_IMETA)
		set_sbi_flag(sbi, SBI_IS_DIRTY);
}

static inline void inode_inc_dirty_pages(struct inode *inode)
{
	atomic_inc(&F2FS_I(inode)->dirty_pages);
	inc_page_count(F2FS_I_SB(inode), S_ISDIR(inode->i_mode) ?
				F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA);
	if (IS_NOQUOTA(inode))
		inc_page_count(F2FS_I_SB(inode), F2FS_DIRTY_QDATA);
}

static inline void dec_page_count(struct f2fs_sb_info *sbi, int count_type)
{
	atomic_dec(&sbi->nr_pages[count_type]);
}

static inline void inode_dec_dirty_pages(struct inode *inode)
{
	if (!S_ISDIR(inode->i_mode) && !S_ISREG(inode->i_mode) &&
			!S_ISLNK(inode->i_mode))
		return;

	atomic_dec(&F2FS_I(inode)->dirty_pages);
	dec_page_count(F2FS_I_SB(inode), S_ISDIR(inode->i_mode) ?
				F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA);
	if (IS_NOQUOTA(inode))
		dec_page_count(F2FS_I_SB(inode), F2FS_DIRTY_QDATA);
}

static inline void inc_atomic_write_cnt(struct inode *inode)
{
	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
	struct f2fs_inode_info *fi = F2FS_I(inode);
	u64 current_write;

	fi->atomic_write_cnt++;
	atomic64_inc(&sbi->current_atomic_write);
	current_write = atomic64_read(&sbi->current_atomic_write);
	if (current_write > sbi->peak_atomic_write)
		sbi->peak_atomic_write = current_write;
}

static inline void release_atomic_write_cnt(struct inode *inode)
{
	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
	struct f2fs_inode_info *fi = F2FS_I(inode);

	atomic64_sub(fi->atomic_write_cnt, &sbi->current_atomic_write);
	fi->atomic_write_cnt = 0;
}

static inline s64 get_pages(struct f2fs_sb_info *sbi, int count_type)
{
	return atomic_read(&sbi->nr_pages[count_type]);
}

static inline int get_dirty_pages(struct inode *inode)
{
	return atomic_read(&F2FS_I(inode)->dirty_pages);
}

static inline int get_blocktype_secs(struct f2fs_sb_info *sbi, int block_type)
{
	return div_u64(get_pages(sbi, block_type) + BLKS_PER_SEC(sbi) - 1,
							BLKS_PER_SEC(sbi));
}

static inline block_t valid_user_blocks(struct f2fs_sb_info *sbi)
{
	return sbi->total_valid_block_count;
}

static inline block_t discard_blocks(struct f2fs_sb_info *sbi)
{
	return sbi->discard_blks;
}

static inline unsigned long __bitmap_size(struct f2fs_sb_info *sbi, int flag)
{
	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);

	/* return NAT or SIT bitmap */
	if (flag == NAT_BITMAP)
		return le32_to_cpu(ckpt->nat_ver_bitmap_bytesize);
	else if (flag == SIT_BITMAP)
		return le32_to_cpu(ckpt->sit_ver_bitmap_bytesize);

	return 0;
}

static inline block_t __cp_payload(struct f2fs_sb_info *sbi)
{
	return le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_payload);
}

static inline void *__bitmap_ptr(struct f2fs_sb_info *sbi, int flag)
{
	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
	void *tmp_ptr = &ckpt->sit_nat_version_bitmap;
	int offset;

	if (is_set_ckpt_flags(sbi, CP_LARGE_NAT_BITMAP_FLAG)) {
		offset = (flag == SIT_BITMAP) ?
			le32_to_cpu(ckpt->nat_ver_bitmap_bytesize) : 0;
		/*
		 * if large_nat_bitmap feature is enabled, leave checksum
		 * protection for all nat/sit bitmaps.
		 */
		return tmp_ptr + offset + sizeof(__le32);
	}

	if (__cp_payload(sbi) > 0) {
		if (flag == NAT_BITMAP)
			return tmp_ptr;
		else
			return (unsigned char *)ckpt + F2FS_BLKSIZE;
	} else {
		offset = (flag == NAT_BITMAP) ?
			le32_to_cpu(ckpt->sit_ver_bitmap_bytesize) : 0;
		return tmp_ptr + offset;
	}
}

static inline block_t __start_cp_addr(struct f2fs_sb_info *sbi)
{
	block_t start_addr = le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_blkaddr);

	if (sbi->cur_cp_pack == 2)
		start_addr += BLKS_PER_SEG(sbi);
	return start_addr;
}

static inline block_t __start_cp_next_addr(struct f2fs_sb_info *sbi)
{
	block_t start_addr = le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_blkaddr);

	if (sbi->cur_cp_pack == 1)
		start_addr += BLKS_PER_SEG(sbi);
	return start_addr;
}

static inline void __set_cp_next_pack(struct f2fs_sb_info *sbi)
{
	sbi->cur_cp_pack = (sbi->cur_cp_pack == 1) ? 2 : 1;
}

static inline block_t __start_sum_addr(struct f2fs_sb_info *sbi)
{
	return le32_to_cpu(F2FS_CKPT(sbi)->cp_pack_start_sum);
}

static inline bool __has_cursum_space(struct f2fs_sb_info *sbi,
		struct f2fs_journal *journal, unsigned int size, int type)
{
	if (type == NAT_JOURNAL)
		return size <= MAX_NAT_JENTRIES(sbi, journal);
	return size <= MAX_SIT_JENTRIES(sbi, journal);
}

extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
static inline int inc_valid_node_count(struct f2fs_sb_info *sbi,
					struct inode *inode, bool is_inode)
{
	block_t	valid_block_count;
	unsigned int valid_node_count, avail_user_node_count;
	unsigned int avail_user_block_count;
	int err;

	if (is_inode) {
		if (inode) {
			err = dquot_alloc_inode(inode);
			if (err)
				return err;
		}
	} else {
		err = dquot_reserve_block(inode, 1);
		if (err)
			return err;
	}

	if (time_to_inject(sbi, FAULT_BLOCK))
		goto enospc;

	spin_lock(&sbi->stat_lock);

	valid_block_count = sbi->total_valid_block_count + 1;
	avail_user_block_count = get_available_block_count(sbi, inode,
			test_opt(sbi, RESERVE_NODE));

	if (unlikely(valid_block_count > avail_user_block_count)) {
		spin_unlock(&sbi->stat_lock);
		goto enospc;
	}

	avail_user_node_count = sbi->total_node_count - F2FS_RESERVED_NODE_NUM;
	if (test_opt(sbi, RESERVE_NODE) &&
			!__allow_reserved_root(sbi, inode, true))
		avail_user_node_count -= F2FS_OPTION(sbi).root_reserved_nodes;
	valid_node_count = sbi->total_valid_node_count + 1;
	if (unlikely(valid_node_count > avail_user_node_count)) {
		spin_unlock(&sbi->stat_lock);
		goto enospc;
	}

	sbi->total_valid_node_count++;
	sbi->total_valid_block_count++;
	spin_unlock(&sbi->stat_lock);

	if (inode) {
		if (is_inode)
			f2fs_mark_inode_dirty_sync(inode, true);
		else
			f2fs_i_blocks_write(inode, 1, true, true);
	}

	percpu_counter_inc(&sbi->alloc_valid_block_count);
	return 0;

enospc:
	if (is_inode) {
		if (inode)
			dquot_free_inode(inode);
	} else {
		dquot_release_reservation_block(inode, 1);
	}
	return -ENOSPC;
}

static inline void dec_valid_node_count(struct f2fs_sb_info *sbi,
					struct inode *inode, bool is_inode)
{
	spin_lock(&sbi->stat_lock);

	if (unlikely(!sbi->total_valid_block_count ||
			!sbi->total_valid_node_count)) {
		f2fs_warn(sbi, "dec_valid_node_count: inconsistent block counts, total_valid_block:%u, total_valid_node:%u",
			  sbi->total_valid_block_count,
			  sbi->total_valid_node_count);
		set_sbi_flag(sbi, SBI_NEED_FSCK);
	} else {
		sbi->total_valid_block_count--;
		sbi->total_valid_node_count--;
	}

	if (sbi->reserved_blocks &&
		sbi->current_reserved_blocks < sbi->reserved_blocks)
		sbi->current_reserved_blocks++;

	spin_unlock(&sbi->stat_lock);

	if (is_inode) {
		dquot_free_inode(inode);
	} else {
		if (unlikely(inode->i_blocks == 0)) {
			f2fs_warn(sbi, "dec_valid_node_count: inconsistent i_blocks, ino:%lu, iblocks:%llu",
				  inode->i_ino,
				  (unsigned long long)inode->i_blocks);
			set_sbi_flag(sbi, SBI_NEED_FSCK);
			return;
		}
		f2fs_i_blocks_write(inode, 1, false, true);
	}
}

static inline unsigned int valid_node_count(struct f2fs_sb_info *sbi)
{
	return sbi->total_valid_node_count;
}

static inline void inc_valid_inode_count(struct f2fs_sb_info *sbi)
{
	percpu_counter_inc(&sbi->total_valid_inode_count);
}

static inline void dec_valid_inode_count(struct f2fs_sb_info *sbi)
{
	percpu_counter_dec(&sbi->total_valid_inode_count);
}

static inline s64 valid_inode_count(struct f2fs_sb_info *sbi)
{
	return percpu_counter_sum_positive(&sbi->total_valid_inode_count);
}

static inline struct folio *f2fs_grab_cache_folio(struct address_space *mapping,
		pgoff_t index, bool for_write)
{
	struct folio *folio;
	unsigned int flags;

	if (IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION)) {
		fgf_t fgf_flags;

		if (!for_write)
			fgf_flags = FGP_LOCK | FGP_ACCESSED;
		else
			fgf_flags = FGP_LOCK;
		folio = __filemap_get_folio(mapping, index, fgf_flags, 0);
		if (!IS_ERR(folio))
			return folio;

		if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_ALLOC))
			return ERR_PTR(-ENOMEM);
	}

	if (!for_write)
		return filemap_grab_folio(mapping, index);

	flags = memalloc_nofs_save();
	folio = __filemap_get_folio(mapping, index, FGP_WRITEBEGIN,
			mapping_gfp_mask(mapping));
	memalloc_nofs_restore(flags);

	return folio;
}

static inline struct folio *f2fs_filemap_get_folio(
				struct address_space *mapping, pgoff_t index,
				fgf_t fgp_flags, gfp_t gfp_mask)
{
	if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_GET))
		return ERR_PTR(-ENOMEM);

	return __filemap_get_folio(mapping, index, fgp_flags, gfp_mask);
}

static inline void f2fs_folio_put(struct folio *folio, bool unlock)
{
	if (IS_ERR_OR_NULL(folio))
		return;

	if (unlock) {
		f2fs_bug_on(F2FS_F_SB(folio), !folio_test_locked(folio));
		folio_unlock(folio);
	}
	folio_put(folio);
}

static inline void f2fs_put_page(struct page *page, bool unlock)
{
	if (!page)
		return;
	f2fs_folio_put(page_folio(page), unlock);
}

static inline void f2fs_put_dnode(struct dnode_of_data *dn)
{
	if (dn->node_folio)
		f2fs_folio_put(dn->node_folio, true);
	if (dn->inode_folio && dn->node_folio != dn->inode_folio)
		f2fs_folio_put(dn->inode_folio, false);
	dn->node_folio = NULL;
	dn->inode_folio = NULL;
}

static inline struct kmem_cache *f2fs_kmem_cache_create(const char *name,
					size_t size)
{
	return kmem_cache_create(name, size, 0, SLAB_RECLAIM_ACCOUNT, NULL);
}

static inline void *f2fs_kmem_cache_alloc_nofail(struct kmem_cache *cachep,
						gfp_t flags)
{
	void *entry;

	entry = kmem_cache_alloc(cachep, flags);
	if (!entry)
		entry = kmem_cache_alloc(cachep, flags | __GFP_NOFAIL);
	return entry;
}

static inline void *f2fs_kmem_cache_alloc(struct kmem_cache *cachep,
			gfp_t flags, bool nofail, struct f2fs_sb_info *sbi)
{
	if (nofail)
		return f2fs_kmem_cache_alloc_nofail(cachep, flags);

	if (time_to_inject(sbi, FAULT_SLAB_ALLOC))
		return NULL;

	return kmem_cache_alloc(cachep, flags);
}

static inline bool is_inflight_io(struct f2fs_sb_info *sbi, int type)
{
	if (get_pages(sbi, F2FS_RD_DATA) || get_pages(sbi, F2FS_RD_NODE) ||
		get_pages(sbi, F2FS_RD_META) || get_pages(sbi, F2FS_WB_DATA) ||
		get_pages(sbi, F2FS_WB_CP_DATA) ||
		get_pages(sbi, F2FS_DIO_READ) ||
		get_pages(sbi, F2FS_DIO_WRITE))
		return true;

	if (type != DISCARD_TIME && SM_I(sbi) && SM_I(sbi)->dcc_info &&
			atomic_read(&SM_I(sbi)->dcc_info->queued_discard))
		return true;

	if (SM_I(sbi) && SM_I(sbi)->fcc_info &&
			atomic_read(&SM_I(sbi)->fcc_info->queued_flush))
		return true;
	return false;
}

static inline bool is_inflight_read_io(struct f2fs_sb_info *sbi)
{
	return get_pages(sbi, F2FS_RD_DATA) || get_pages(sbi, F2FS_DIO_READ);
}

static inline bool is_idle(struct f2fs_sb_info *sbi, int type)
{
	bool zoned_gc = (type == GC_TIME &&
			F2FS_HAS_FEATURE(sbi, F2FS_FEATURE_BLKZONED));

	if (sbi->gc_mode == GC_URGENT_HIGH)
		return true;

	if (sbi->bggc_io_aware == AWARE_READ_IO && is_inflight_read_io(sbi))
		return false;
	if (sbi->bggc_io_aware == AWARE_ALL_IO && is_inflight_io(sbi, type))
		return false;

	if (sbi->gc_mode == GC_URGENT_MID)
		return true;

	if (sbi->gc_mode == GC_URGENT_LOW &&
			(type == DISCARD_TIME || type == GC_TIME))
		return true;

	if (zoned_gc)
		return true;

	return f2fs_time_over(sbi, type);
}

static inline void f2fs_radix_tree_insert(struct radix_tree_root *root,
				unsigned long index, void *item)
{
	while (radix_tree_insert(root, index, item))
		cond_resched();
}

#define RAW_IS_INODE(p)	((p)->footer.nid == (p)->footer.ino)

static inline bool IS_INODE(const struct folio *folio)
{
	struct f2fs_node *p = F2FS_NODE(folio);

	return RAW_IS_INODE(p);
}

static inline int offset_in_addr(struct f2fs_inode *i)
{
	return (i->i_inline & F2FS_EXTRA_ATTR) ?
			(le16_to_cpu(i->i_extra_isize) / sizeof(__le32)) : 0;
}

static inline __le32 *blkaddr_in_node(struct f2fs_node *node)
{
	return RAW_IS_INODE(node) ? node->i.i_addr : node->dn.addr;
}

static inline int f2fs_has_extra_attr(struct inode *inode);
static inline unsigned int get_dnode_base(struct inode *inode,
					struct folio *node_folio)
{
	if (!IS_INODE(node_folio))
		return 0;

	return inode ? get_extra_isize(inode) :
			offset_in_addr(&F2FS_NODE(node_folio)->i);
}

static inline __le32 *get_dnode_addr(struct inode *inode,
					struct folio *node_folio)
{
	return blkaddr_in_node(F2FS_NODE(node_folio)) +
			get_dnode_base(inode, node_folio);
}

static inline block_t data_blkaddr(struct inode *inode,
			struct folio *node_folio, unsigned int offset)
{
	return le32_to_cpu(*(get_dnode_addr(inode, node_folio) + offset));
}

static inline block_t f2fs_data_blkaddr(struct dnode_of_data *dn)
{
	return data_blkaddr(dn->inode, dn->node_folio, dn->ofs_in_node);
}

static inline int f2fs_test_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	return mask & *addr;
}

static inline void f2fs_set_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	*addr |= mask;
}

static inline void f2fs_clear_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	*addr &= ~mask;
}

static inline int f2fs_test_and_set_bit(unsigned int nr, char *addr)
{
	int mask;
	int ret;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	ret = mask & *addr;
	*addr |= mask;
	return ret;
}

static inline int f2fs_test_and_clear_bit(unsigned int nr, char *addr)
{
	int mask;
	int ret;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	ret = mask & *addr;
	*addr &= ~mask;
	return ret;
}

static inline void f2fs_change_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	*addr ^= mask;
}

/*
 * On-disk inode flags (f2fs_inode::i_flags)
 */
#define F2FS_COMPR_FL			0x00000004 /* Compress file */
#define F2FS_SYNC_FL			0x00000008 /* Synchronous updates */
#define F2FS_IMMUTABLE_FL		0x00000010 /* Immutable file */
#define F2FS_APPEND_FL			0x00000020 /* writes to file may only append */
#define F2FS_NODUMP_FL			0x00000040 /* do not dump file */
#define F2FS_NOATIME_FL			0x00000080 /* do not update atime */
#define F2FS_NOCOMP_FL			0x00000400 /* Don't compress */
#define F2FS_INDEX_FL			0x00001000 /* hash-indexed directory */
#define F2FS_DIRSYNC_FL			0x00010000 /* dirsync behaviour (directories only) */
#define F2FS_PROJINHERIT_FL		0x20000000 /* Create with parents projid */
#define F2FS_CASEFOLD_FL		0x40000000 /* Casefolded file */
#define F2FS_DEVICE_ALIAS_FL		0x80000000 /* File for aliasing a device */

#define F2FS_QUOTA_DEFAULT_FL		(F2FS_NOATIME_FL | F2FS_IMMUTABLE_FL)

/* Flags that should be inherited by new inodes from their parent. */
#define F2FS_FL_INHERITED (F2FS_SYNC_FL | F2FS_NODUMP_FL | F2FS_NOATIME_FL | \
			   F2FS_DIRSYNC_FL | F2FS_PROJINHERIT_FL | \
			   F2FS_CASEFOLD_FL)

/* Flags that are appropriate for regular files (all but dir-specific ones). */
#define F2FS_REG_FLMASK		(~(F2FS_DIRSYNC_FL | F2FS_PROJINHERIT_FL | \
				F2FS_CASEFOLD_FL))

/* Flags that are appropriate for non-directories/regular files. */
#define F2FS_OTHER_FLMASK	(F2FS_NODUMP_FL | F2FS_NOATIME_FL)

#define IS_DEVICE_ALIASING(inode)	(F2FS_I(inode)->i_flags & F2FS_DEVICE_ALIAS_FL)

static inline __u32 f2fs_mask_flags(umode_t mode, __u32 flags)
{
	if (S_ISDIR(mode))
		return flags;
	else if (S_ISREG(mode))
		return flags & F2FS_REG_FLMASK;
	else
		return flags & F2FS_OTHER_FLMASK;
}

static inline void __mark_inode_dirty_flag(struct inode *inode,
						int flag, bool set)
{
	switch (flag) {
	case FI_INLINE_XATTR:
	case FI_INLINE_DATA:
	case FI_INLINE_DENTRY:
	case FI_NEW_INODE:
		if (set)
			return;
		fallthrough;
	case FI_DATA_EXIST:
	case FI_PIN_FILE:
	case FI_COMPRESS_RELEASED:
		f2fs_mark_inode_dirty_sync(inode, true);
	}
}

static inline void set_inode_flag(struct inode *inode, int flag)
{
	set_bit(flag, F2FS_I(inode)->flags);
	__mark_inode_dirty_flag(inode, flag, true);
}

static inline int is_inode_flag_set(struct inode *inode, int flag)
{
	return test_bit(flag, F2FS_I(inode)->flags);
}

static inline void clear_inode_flag(struct inode *inode, int flag)
{
	clear_bit(flag, F2FS_I(inode)->flags);
	__mark_inode_dirty_flag(inode, flag, false);
}

static inline bool f2fs_verity_in_progress(struct inode *inode)
{
	return IS_ENABLED(CONFIG_FS_VERITY) &&
	       is_inode_flag_set(inode, FI_VERITY_IN_PROGRESS);
}

static inline void set_acl_inode(struct inode *inode, umode_t mode)
{
	F2FS_I(inode)->i_acl_mode = mode;
	set_inode_flag(inode, FI_ACL_MODE);
	f2fs_mark_inode_dirty_sync(inode, false);
}

static inline void f2fs_i_links_write(struct inode *inode, bool inc)
{
	if (inc)
		inc_nlink(inode);
	else
		drop_nlink(inode);
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_blocks_write(struct inode *inode,
					block_t diff, bool add, bool claim)
{
	bool clean = !is_inode_flag_set(inode, FI_DIRTY_INODE);
	bool recover = is_inode_flag_set(inode, FI_AUTO_RECOVER);

	/* add = 1, claim = 1 should be dquot_reserve_block in pair */
	if (add) {
		if (claim)
			dquot_claim_block(inode, diff);
		else
			dquot_alloc_block_nofail(inode, diff);
	} else {
		dquot_free_block(inode, diff);
	}

	f2fs_mark_inode_dirty_sync(inode, true);
	if (clean || recover)
		set_inode_flag(inode, FI_AUTO_RECOVER);
}

static inline bool f2fs_is_atomic_file(struct inode *inode);

static inline void f2fs_i_size_write(struct inode *inode, loff_t i_size)
{
	bool clean = !is_inode_flag_set(inode, FI_DIRTY_INODE);
	bool recover = is_inode_flag_set(inode, FI_AUTO_RECOVER);

	if (i_size_read(inode) == i_size)
		return;

	i_size_write(inode, i_size);

	if (f2fs_is_atomic_file(inode))
		return;

	f2fs_mark_inode_dirty_sync(inode, true);
	if (clean || recover)
		set_inode_flag(inode, FI_AUTO_RECOVER);
}

static inline void f2fs_i_depth_write(struct inode *inode, unsigned int depth)
{
	F2FS_I(inode)->i_current_depth = depth;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_gc_failures_write(struct inode *inode,
					unsigned int count)
{
	F2FS_I(inode)->i_gc_failures = count;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_xnid_write(struct inode *inode, nid_t xnid)
{
	F2FS_I(inode)->i_xattr_nid = xnid;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_pino_write(struct inode *inode, nid_t pino)
{
	F2FS_I(inode)->i_pino = pino;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri)
{
	struct f2fs_inode_info *fi = F2FS_I(inode);

	if (ri->i_inline & F2FS_INLINE_XATTR)
		set_bit(FI_INLINE_XATTR, fi->flags);
	if (ri->i_inline & F2FS_INLINE_DATA)
		set_bit(FI_INLINE_DATA, fi->flags);
	if (ri->i_inline & F2FS_INLINE_DENTRY)
		set_bit(FI_INLINE_DENTRY, fi->flags);
	if (ri->i_inline & F2FS_DATA_EXIST)
		set_bit(FI_DATA_EXIST, fi->flags);
	if (ri->i_inline & F2FS_EXTRA_ATTR)
		set_bit(FI_EXTRA_ATTR, fi->flags);
	if (ri->i_inline & F2FS_PIN_FILE)
		set_bit(FI_PIN_FILE, fi->flags);
	if (ri->i_inline & F2FS_COMPRESS_RELEASED)
		set_bit(FI_COMPRESS_RELEASED, fi->flags);
}

static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri)
{
	ri->i_inline = 0;

	if (is_inode_flag_set(inode, FI_INLINE_XATTR))
		ri->i_inline |= F2FS_INLINE_XATTR;
	if (is_inode_flag_set(inode, FI_INLINE_DATA))
		ri->i_inline |= F2FS_INLINE_DATA;
	if (is_inode_flag_set(inode, FI_INLINE_DENTRY))
		ri->i_inline |= F2FS_INLINE_DENTRY;
	if (is_inode_flag_set(inode, FI_DATA_EXIST))
		ri->i_inline |= F2FS_DATA_EXIST;
	if (is_inode_flag_set(inode, FI_EXTRA_ATTR))
		ri->i_inline |= F2FS_EXTRA_ATTR;
	if (is_inode_flag_set(inode, FI_PIN_FILE))
		ri->i_inline |= F2FS_PIN_FILE;
	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED))
		ri->i_inline |= F2FS_COMPRESS_RELEASED;
}

static inline int f2fs_has_extra_attr(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_EXTRA_ATTR);
}

static inline int f2fs_has_inline_xattr(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_INLINE_XATTR);
}

static inline int f2fs_compressed_file(struct inode *inode)
{
	return S_ISREG(inode->i_mode) &&
		is_inode_flag_set(inode, FI_COMPRESSED_FILE);
}

static inline bool f2fs_need_compress_data(struct inode *inode)
{
	int compress_mode = F2FS_OPTION(F2FS_I_SB(inode)).compress_mode;

	if (!f2fs_compressed_file(inode))
		return false;

	if (compress_mode == COMPR_MODE_FS)
		return true;
	else if (compress_mode == COMPR_MODE_USER &&
			is_inode_flag_set(inode, FI_ENABLE_COMPRESS))
		return true;

	return false;
}

static inline unsigned int addrs_per_page(struct inode *inode,
							bool is_inode)
{
	unsigned int addrs = is_inode ? (CUR_ADDRS_PER_INODE(inode) -
			get_inline_xattr_addrs(inode)) : DEF_ADDRS_PER_BLOCK;

	if (f2fs_compressed_file(inode))
		return ALIGN_DOWN(addrs, F2FS_I(inode)->i_cluster_size);
	return addrs;
}

static inline
void *inline_xattr_addr(struct inode *inode, const struct folio *folio)
{
	struct f2fs_inode *ri = F2FS_INODE(folio);

	return (void *)&(ri->i_addr[DEF_ADDRS_PER_INODE -
					get_inline_xattr_addrs(inode)]);
}

static inline int inline_xattr_size(struct inode *inode)
{
	if (f2fs_has_inline_xattr(inode))
		return get_inline_xattr_addrs(inode) * sizeof(__le32);
	return 0;
}

/*
 * Notice: check inline_data flag without inode page lock is unsafe.
 * It could change at any time by f2fs_convert_inline_folio().
 */
static inline int f2fs_has_inline_data(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_INLINE_DATA);
}

static inline int f2fs_exist_data(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_DATA_EXIST);
}

static inline int f2fs_is_mmap_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_MMAP_FILE);
}

static inline bool f2fs_is_pinned_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_PIN_FILE);
}

static inline bool f2fs_is_atomic_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_ATOMIC_FILE);
}

static inline bool f2fs_is_cow_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_COW_FILE);
}

static inline void *inline_data_addr(struct inode *inode, struct folio *folio)
{
	__le32 *addr = get_dnode_addr(inode, folio);

	return (void *)(addr + DEF_INLINE_RESERVED_SIZE);
}

static inline int f2fs_has_inline_dentry(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_INLINE_DENTRY);
}

static inline int is_file(struct inode *inode, int type)
{
	return F2FS_I(inode)->i_advise & type;
}

static inline void set_file(struct inode *inode, int type)
{
	if (is_file(inode, type))
		return;
	F2FS_I(inode)->i_advise |= type;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void clear_file(struct inode *inode, int type)
{
	if (!is_file(inode, type))
		return;
	F2FS_I(inode)->i_advise &= ~type;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline bool f2fs_is_time_consistent(struct inode *inode)
{
	struct timespec64 ts = inode_get_atime(inode);

	if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &ts))
		return false;
	ts = inode_get_ctime(inode);
	if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &ts))
		return false;
	ts = inode_get_mtime(inode);
	if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &ts))
		return false;
	return true;
}

static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync)
{
	bool ret;

	if (dsync) {
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);

		spin_lock(&sbi->inode_lock[DIRTY_META]);
		ret = list_empty(&F2FS_I(inode)->gdirty_list);
		spin_unlock(&sbi->inode_lock[DIRTY_META]);
		return ret;
	}
	if (!is_inode_flag_set(inode, FI_AUTO_RECOVER) ||
			file_keep_isize(inode) ||
			i_size_read(inode) & ~PAGE_MASK)
		return false;

	if (!f2fs_is_time_consistent(inode))
		return false;

	spin_lock(&F2FS_I(inode)->i_size_lock);
	ret = F2FS_I(inode)->last_disk_size == i_size_read(inode);
	spin_unlock(&F2FS_I(inode)->i_size_lock);

	return ret;
}

static inline bool f2fs_readonly(struct super_block *sb)
{
	return sb_rdonly(sb);
}

static inline bool f2fs_cp_error(struct f2fs_sb_info *sbi)
{
	return is_set_ckpt_flags(sbi, CP_ERROR_FLAG);
}

static inline void *f2fs_kmalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	if (time_to_inject(sbi, FAULT_KMALLOC))
		return NULL;

	return kmalloc(size, flags);
}

static inline void *f2fs_getname(struct f2fs_sb_info *sbi)
{
	if (time_to_inject(sbi, FAULT_KMALLOC))
		return NULL;

	return __getname();
}

static inline void f2fs_putname(char *buf)
{
	__putname(buf);
}

static inline void *f2fs_kzalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	return f2fs_kmalloc(sbi, size, flags | __GFP_ZERO);
}

static inline void *f2fs_kvmalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	if (time_to_inject(sbi, FAULT_KVMALLOC))
		return NULL;

	return kvmalloc(size, flags);
}

static inline void *f2fs_kvzalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	return f2fs_kvmalloc(sbi, size, flags | __GFP_ZERO);
}

static inline void *f2fs_vmalloc(struct f2fs_sb_info *sbi, size_t size)
{
	if (time_to_inject(sbi, FAULT_VMALLOC))
		return NULL;

	return vmalloc(size);
}

static inline int get_extra_isize(struct inode *inode)
{
	return F2FS_I(inode)->i_extra_isize / sizeof(__le32);
}

static inline int get_inline_xattr_addrs(struct inode *inode)
{
	return F2FS_I(inode)->i_inline_xattr_size;
}

#define f2fs_get_inode_mode(i) \
	((is_inode_flag_set(i, FI_ACL_MODE)) ? \
	 (F2FS_I(i)->i_acl_mode) : ((i)->i_mode))

#define F2FS_MIN_EXTRA_ATTR_SIZE		(sizeof(__le32))

#define F2FS_TOTAL_EXTRA_ATTR_SIZE			\
	(offsetof(struct f2fs_inode, i_extra_end) -	\
	offsetof(struct f2fs_inode, i_extra_isize))	\

#define F2FS_OLD_ATTRIBUTE_SIZE	(offsetof(struct f2fs_inode, i_addr))
#define F2FS_FITS_IN_INODE(f2fs_inode, extra_isize, field)		\
		((offsetof(typeof(*(f2fs_inode)), field) +	\
		sizeof((f2fs_inode)->field))			\
		<= (F2FS_OLD_ATTRIBUTE_SIZE + (extra_isize)))	\

#define __is_large_section(sbi)		(SEGS_PER_SEC(sbi) > 1)

#define __is_meta_io(fio) (PAGE_TYPE_OF_BIO((fio)->type) == META)

bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type);
static inline void verify_blkaddr(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type)
{
	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type))
		f2fs_err(sbi, "invalid blkaddr: %u, type: %d, run fsck to fix.",
			 blkaddr, type);
}

static inline bool __is_valid_data_blkaddr(block_t blkaddr)
{
	if (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR ||
			blkaddr == COMPRESS_ADDR)
		return false;
	return true;
}

/*
 * file.c
 */
int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync);
int f2fs_do_truncate_blocks(struct inode *inode, u64 from, bool lock);
int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock);
int f2fs_truncate(struct inode *inode);
int f2fs_getattr(struct mnt_idmap *idmap, const struct path *path,
		 struct kstat *stat, u32 request_mask, unsigned int flags);
int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
		 struct iattr *attr);
int f2fs_truncate_hole(struct inode *inode, pgoff_t pg_start, pgoff_t pg_end);
void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count);
int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
						bool readonly, bool need_lock);
int f2fs_precache_extents(struct inode *inode);
int f2fs_fileattr_get(struct dentry *dentry, struct file_kattr *fa);
int f2fs_fileattr_set(struct mnt_idmap *idmap,
		      struct dentry *dentry, struct file_kattr *fa);
long f2fs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
long f2fs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid);
int f2fs_pin_file_control(struct inode *inode, bool inc);

/*
 * inode.c
 */
void f2fs_set_inode_flags(struct inode *inode);
bool f2fs_inode_chksum_verify(struct f2fs_sb_info *sbi, struct folio *folio);
void f2fs_inode_chksum_set(struct f2fs_sb_info *sbi, struct folio *folio);
struct inode *f2fs_iget(struct super_block *sb, unsigned long ino);
struct inode *f2fs_iget_retry(struct super_block *sb, unsigned long ino);
int f2fs_try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink);
void f2fs_update_inode(struct inode *inode, struct folio *node_folio);
void f2fs_update_inode_page(struct inode *inode);
int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc);
void f2fs_remove_donate_inode(struct inode *inode);
void f2fs_evict_inode(struct inode *inode);
void f2fs_handle_failed_inode(struct inode *inode, struct f2fs_lock_context *lc);

/*
 * namei.c
 */
int f2fs_update_extension_list(struct f2fs_sb_info *sbi, const char *name,
							bool hot, bool set);
struct dentry *f2fs_get_parent(struct dentry *child);
int f2fs_get_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
		     struct inode **new_inode);

/*
 * dir.c
 */
#if IS_ENABLED(CONFIG_UNICODE)
int f2fs_init_casefolded_name(const struct inode *dir,
			      struct f2fs_filename *fname);
void f2fs_free_casefolded_name(struct f2fs_filename *fname);
#else
static inline int f2fs_init_casefolded_name(const struct inode *dir,
					    struct f2fs_filename *fname)
{
	return 0;
}

static inline void f2fs_free_casefolded_name(struct f2fs_filename *fname)
{
}
#endif /* CONFIG_UNICODE */

int f2fs_setup_filename(struct inode *dir, const struct qstr *iname,
			int lookup, struct f2fs_filename *fname);
int f2fs_prepare_lookup(struct inode *dir, struct dentry *dentry,
			struct f2fs_filename *fname);
void f2fs_free_filename(struct f2fs_filename *fname);
struct f2fs_dir_entry *f2fs_find_target_dentry(const struct f2fs_dentry_ptr *d,
			const struct f2fs_filename *fname, int *max_slots,
			bool use_hash);
int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
			unsigned int start_pos, struct fscrypt_str *fstr);
void f2fs_do_make_empty_dir(struct inode *inode, struct inode *parent,
			struct f2fs_dentry_ptr *d);
struct folio *f2fs_init_inode_metadata(struct inode *inode, struct inode *dir,
		const struct f2fs_filename *fname, struct folio *dfolio);
void f2fs_update_parent_metadata(struct inode *dir, struct inode *inode,
			unsigned int current_depth);
int f2fs_room_for_filename(const void *bitmap, int slots, int max_slots);
void f2fs_drop_nlink(struct inode *dir, struct inode *inode);
struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir,
		const struct f2fs_filename *fname, struct folio **res_folio);
struct f2fs_dir_entry *f2fs_find_entry(struct inode *dir,
			const struct qstr *child, struct folio **res_folio);
struct f2fs_dir_entry *f2fs_parent_dir(struct inode *dir, struct folio **f);
ino_t f2fs_inode_by_name(struct inode *dir, const struct qstr *qstr,
			struct folio **folio);
void f2fs_set_link(struct inode *dir, struct f2fs_dir_entry *de,
			struct folio *folio, struct inode *inode);
bool f2fs_has_enough_room(struct inode *dir, struct folio *ifolio,
			  const struct f2fs_filename *fname);
void f2fs_update_dentry(nid_t ino, umode_t mode, struct f2fs_dentry_ptr *d,
			const struct fscrypt_str *name, f2fs_hash_t name_hash,
			unsigned int bit_pos);
int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
			struct inode *inode, nid_t ino, umode_t mode);
int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
			struct inode *inode, nid_t ino, umode_t mode);
int f2fs_do_add_link(struct inode *dir, const struct qstr *name,
			struct inode *inode, nid_t ino, umode_t mode);
void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct folio *folio,
			struct inode *dir, struct inode *inode);
int f2fs_do_tmpfile(struct inode *inode, struct inode *dir,
					struct f2fs_filename *fname);
bool f2fs_empty_dir(struct inode *dir);

static inline int f2fs_add_link(struct dentry *dentry, struct inode *inode)
{
	if (fscrypt_is_nokey_name(dentry))
		return -ENOKEY;
	return f2fs_do_add_link(d_inode(dentry->d_parent), &dentry->d_name,
				inode, inode->i_ino, inode->i_mode);
}

/*
 * super.c
 */
int f2fs_inode_dirtied(struct inode *inode, bool sync);
void f2fs_inode_synced(struct inode *inode);
int f2fs_dquot_initialize(struct inode *inode);
int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly);
int f2fs_do_quota_sync(struct super_block *sb, int type);
loff_t max_file_blocks(struct inode *inode);
void f2fs_quota_off_umount(struct super_block *sb);
void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason);
void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
int f2fs_sync_fs(struct super_block *sb, int sync);
int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi);

/*
 * hash.c
 */
void f2fs_hash_filename(const struct inode *dir, struct f2fs_filename *fname);

/*
 * node.c
 */
struct node_info;
enum node_type;

int f2fs_check_nid_range(struct f2fs_sb_info *sbi, nid_t nid);
bool f2fs_available_free_memory(struct f2fs_sb_info *sbi, int type);
bool f2fs_in_warm_node_list(struct f2fs_sb_info *sbi, struct folio *folio);
void f2fs_init_fsync_node_info(struct f2fs_sb_info *sbi);
void f2fs_del_fsync_node_entry(struct f2fs_sb_info *sbi, struct folio *folio);
void f2fs_reset_fsync_node_info(struct f2fs_sb_info *sbi);
int f2fs_need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid);
bool f2fs_is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid);
bool f2fs_need_inode_block_update(struct f2fs_sb_info *sbi, nid_t ino);
int f2fs_get_node_info(struct f2fs_sb_info *sbi, nid_t nid,
				struct node_info *ni, bool checkpoint_context);
pgoff_t f2fs_get_next_page_offset(struct dnode_of_data *dn, pgoff_t pgofs);
int f2fs_get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode);
int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from);
int f2fs_truncate_xattr_node(struct inode *inode);
int f2fs_wait_on_node_pages_writeback(struct f2fs_sb_info *sbi,
					unsigned int seq_id);
int f2fs_remove_inode_page(struct inode *inode);
struct folio *f2fs_new_inode_folio(struct inode *inode);
struct folio *f2fs_new_node_folio(struct dnode_of_data *dn, unsigned int ofs);
void f2fs_ra_node_page(struct f2fs_sb_info *sbi, nid_t nid);
struct folio *f2fs_get_node_folio(struct f2fs_sb_info *sbi, pgoff_t nid,
						enum node_type node_type);
int f2fs_sanity_check_node_footer(struct f2fs_sb_info *sbi,
					struct folio *folio, pgoff_t nid,
					enum node_type ntype, bool in_irq);
struct folio *f2fs_get_inode_folio(struct f2fs_sb_info *sbi, pgoff_t ino);
struct folio *f2fs_get_xnode_folio(struct f2fs_sb_info *sbi, pgoff_t xnid);
int f2fs_move_node_folio(struct folio *node_folio, int gc_type);
void f2fs_flush_inline_data(struct f2fs_sb_info *sbi);
int f2fs_fsync_node_pages(struct f2fs_sb_info *sbi, struct inode *inode,
			struct writeback_control *wbc, bool atomic,
			unsigned int *seq_id);
int f2fs_sync_node_pages(struct f2fs_sb_info *sbi,
			struct writeback_control *wbc,
			bool do_balance, enum iostat_type io_type);
int f2fs_build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount);
bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);
void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid);
void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid);
int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink);
int f2fs_recover_inline_xattr(struct inode *inode, struct folio *folio);
int f2fs_recover_xattr_data(struct inode *inode, struct folio *folio);
int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct folio *folio);
int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
			unsigned int segno, struct f2fs_summary_block *sum);
int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc);
int f2fs_build_node_manager(struct f2fs_sb_info *sbi);
void f2fs_destroy_node_manager(struct f2fs_sb_info *sbi);
int __init f2fs_create_node_manager_caches(void);
void f2fs_destroy_node_manager_caches(void);

/*
 * segment.c
 */
bool f2fs_need_SSR(struct f2fs_sb_info *sbi);
int f2fs_commit_atomic_write(struct inode *inode);
void f2fs_abort_atomic_write(struct inode *inode, bool clean);
void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need);
void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi, bool from_bg);
int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino);
int f2fs_create_flush_cmd_control(struct f2fs_sb_info *sbi);
int f2fs_flush_device_cache(struct f2fs_sb_info *sbi);
void f2fs_destroy_flush_cmd_control(struct f2fs_sb_info *sbi, bool free);
void f2fs_invalidate_blocks(struct f2fs_sb_info *sbi, block_t addr,
						unsigned int len);
bool f2fs_is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
int f2fs_start_discard_thread(struct f2fs_sb_info *sbi);
void f2fs_drop_discard_cmd(struct f2fs_sb_info *sbi);
void f2fs_stop_discard_thread(struct f2fs_sb_info *sbi);
bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi);
void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi,
					struct cp_control *cpc);
void f2fs_dirty_to_prefree(struct f2fs_sb_info *sbi);
block_t f2fs_get_unusable_blocks(struct f2fs_sb_info *sbi);
int f2fs_disable_cp_again(struct f2fs_sb_info *sbi, block_t unusable);
void f2fs_release_discard_addrs(struct f2fs_sb_info *sbi);
int f2fs_npages_for_summary_flush(struct f2fs_sb_info *sbi, bool for_ra);
bool f2fs_segment_has_free_slot(struct f2fs_sb_info *sbi, int segno);
int f2fs_init_inmem_curseg(struct f2fs_sb_info *sbi);
int f2fs_reinit_atgc_curseg(struct f2fs_sb_info *sbi);
void f2fs_save_inmem_curseg(struct f2fs_sb_info *sbi);
void f2fs_restore_inmem_curseg(struct f2fs_sb_info *sbi);
int f2fs_allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type,
					unsigned int start, unsigned int end);
int f2fs_allocate_new_section(struct f2fs_sb_info *sbi, int type, bool force);
int f2fs_allocate_pinning_section(struct f2fs_sb_info *sbi);
int f2fs_allocate_new_segments(struct f2fs_sb_info *sbi);
int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range);
bool f2fs_exist_trim_candidates(struct f2fs_sb_info *sbi,
					struct cp_control *cpc);
struct folio *f2fs_get_sum_folio(struct f2fs_sb_info *sbi, unsigned int segno);
void f2fs_update_meta_page(struct f2fs_sb_info *sbi, void *src,
					block_t blk_addr);
void f2fs_do_write_meta_page(struct f2fs_sb_info *sbi, struct folio *folio,
						enum iostat_type io_type);
void f2fs_do_write_node_page(unsigned int nid, struct f2fs_io_info *fio);
void f2fs_outplace_write_data(struct dnode_of_data *dn,
			struct f2fs_io_info *fio);
int f2fs_inplace_write_data(struct f2fs_io_info *fio);
void f2fs_do_replace_block(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
			block_t old_blkaddr, block_t new_blkaddr,
			bool recover_curseg, bool recover_newaddr,
			bool from_gc);
void f2fs_replace_block(struct f2fs_sb_info *sbi, struct dnode_of_data *dn,
			block_t old_addr, block_t new_addr,
			unsigned char version, bool recover_curseg,
			bool recover_newaddr);
enum temp_type f2fs_get_segment_temp(struct f2fs_sb_info *sbi,
						enum log_type seg_type);
int f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct folio *folio,
			block_t old_blkaddr, block_t *new_blkaddr,
			struct f2fs_summary *sum, int type,
			struct f2fs_io_info *fio);
void f2fs_update_device_state(struct f2fs_sb_info *sbi, nid_t ino,
					block_t blkaddr, unsigned int blkcnt);
void f2fs_folio_wait_writeback(struct folio *folio, enum page_type type,
		bool ordered, bool locked);
#define f2fs_wait_on_page_writeback(page, type, ordered, locked)	\
		f2fs_folio_wait_writeback(page_folio(page), type, ordered, locked)
void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr);
void f2fs_wait_on_block_writeback_range(struct inode *inode, block_t blkaddr,
								block_t len);
void f2fs_write_data_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
void f2fs_write_node_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
int f2fs_lookup_journal_in_cursum(struct f2fs_sb_info *sbi,
			struct f2fs_journal *journal, int type,
			unsigned int val, int alloc);
void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc);
int f2fs_check_and_fix_write_pointer(struct f2fs_sb_info *sbi);
int f2fs_build_segment_manager(struct f2fs_sb_info *sbi);
void f2fs_destroy_segment_manager(struct f2fs_sb_info *sbi);
int __init f2fs_create_segment_manager_caches(void);
void f2fs_destroy_segment_manager_caches(void);
int f2fs_rw_hint_to_seg_type(struct f2fs_sb_info *sbi, enum rw_hint hint);
enum rw_hint f2fs_io_type_to_rw_hint(struct f2fs_sb_info *sbi,
			enum page_type type, enum temp_type temp);
unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi);
unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi,
			unsigned int segno);
unsigned long long f2fs_get_section_mtime(struct f2fs_sb_info *sbi,
			unsigned int segno);

static inline struct inode *fio_inode(struct f2fs_io_info *fio)
{
	return fio->folio->mapping->host;
}

#define DEF_FRAGMENT_SIZE	4
#define MIN_FRAGMENT_SIZE	1
#define MAX_FRAGMENT_SIZE	512

static inline bool f2fs_need_rand_seg(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).fs_mode == FS_MODE_FRAGMENT_SEG ||
		F2FS_OPTION(sbi).fs_mode == FS_MODE_FRAGMENT_BLK;
}

/*
 * checkpoint.c
 */
void f2fs_lock_op(struct f2fs_sb_info *sbi, struct f2fs_lock_context *lc);
int f2fs_trylock_op(struct f2fs_sb_info *sbi, struct f2fs_lock_context *lc);
void f2fs_unlock_op(struct f2fs_sb_info *sbi, struct f2fs_lock_context *lc);
void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io,
							unsigned char reason);
void f2fs_flush_ckpt_thread(struct f2fs_sb_info *sbi);
struct folio *f2fs_grab_meta_folio(struct f2fs_sb_info *sbi, pgoff_t index);
struct folio *f2fs_get_meta_folio(struct f2fs_sb_info *sbi, pgoff_t index);
struct folio *f2fs_get_meta_folio_retry(struct f2fs_sb_info *sbi, pgoff_t index);
struct folio *f2fs_get_tmp_folio(struct f2fs_sb_info *sbi, pgoff_t index);
bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type);
bool f2fs_is_valid_blkaddr_raw(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type);
int f2fs_ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
			int type, bool sync);
void f2fs_ra_meta_pages_cond(struct f2fs_sb_info *sbi, pgoff_t index,
							unsigned int ra_blocks);
long f2fs_sync_meta_pages(struct f2fs_sb_info *sbi, long nr_to_write,
			enum iostat_type io_type);
void f2fs_add_ino_entry(struct f2fs_sb_info *sbi, nid_t ino, int type);
void f2fs_remove_ino_entry(struct f2fs_sb_info *sbi, nid_t ino, int type);
void f2fs_release_ino_entry(struct f2fs_sb_info *sbi, bool all);
bool f2fs_exist_written_data(struct f2fs_sb_info *sbi, nid_t ino, int mode);
void f2fs_set_dirty_device(struct f2fs_sb_info *sbi, nid_t ino,
					unsigned int devidx, int type);
bool f2fs_is_dirty_device(struct f2fs_sb_info *sbi, nid_t ino,
					unsigned int devidx, int type);
int f2fs_acquire_orphan_inode(struct f2fs_sb_info *sbi);
void f2fs_release_orphan_inode(struct f2fs_sb_info *sbi);
void f2fs_add_orphan_inode(struct inode *inode);
void f2fs_remove_orphan_inode(struct f2fs_sb_info *sbi, nid_t ino);
int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi);
int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi);
void f2fs_update_dirty_folio(struct inode *inode, struct folio *folio);
void f2fs_remove_dirty_inode(struct inode *inode);
int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type,
								bool from_cp);
void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type);
u64 f2fs_get_sectors_written(struct f2fs_sb_info *sbi);
int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc);
void f2fs_init_ino_entry_info(struct f2fs_sb_info *sbi);
int __init f2fs_create_checkpoint_caches(void);
void f2fs_destroy_checkpoint_caches(void);
int f2fs_issue_checkpoint(struct f2fs_sb_info *sbi);
int f2fs_start_ckpt_thread(struct f2fs_sb_info *sbi);
void f2fs_stop_ckpt_thread(struct f2fs_sb_info *sbi);
void f2fs_init_ckpt_req_control(struct f2fs_sb_info *sbi);

/*
 * data.c
 */
int __init f2fs_init_bioset(void);
void f2fs_destroy_bioset(void);
bool f2fs_is_cp_guaranteed(const struct folio *folio);
int f2fs_init_bio_entry_cache(void);
void f2fs_destroy_bio_entry_cache(void);
void f2fs_submit_read_bio(struct f2fs_sb_info *sbi, struct bio *bio,
			  enum page_type type);
int f2fs_init_write_merge_io(struct f2fs_sb_info *sbi);
void f2fs_submit_merged_write(struct f2fs_sb_info *sbi, enum page_type type);
void f2fs_submit_merged_write_cond(struct f2fs_sb_info *sbi,
				struct inode *inode, struct folio *folio,
				nid_t ino, enum page_type type);
void f2fs_submit_merged_write_folio(struct f2fs_sb_info *sbi,
				struct folio *folio, enum page_type type);
void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
					struct bio **bio, struct folio *folio);
void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
int f2fs_submit_page_bio(struct f2fs_io_info *fio);
int f2fs_merge_page_bio(struct f2fs_io_info *fio);
void f2fs_submit_page_write(struct f2fs_io_info *fio);
struct block_device *f2fs_target_device(struct f2fs_sb_info *sbi,
		block_t blk_addr, sector_t *sector);
int f2fs_target_device_index(struct f2fs_sb_info *sbi, block_t blkaddr);
void f2fs_set_data_blkaddr(struct dnode_of_data *dn, block_t blkaddr);
void f2fs_update_data_blkaddr(struct dnode_of_data *dn, block_t blkaddr);
int f2fs_reserve_new_blocks(struct dnode_of_data *dn, blkcnt_t count);
int f2fs_reserve_new_block(struct dnode_of_data *dn);
int f2fs_get_block_locked(struct dnode_of_data *dn, pgoff_t index);
int f2fs_reserve_block(struct dnode_of_data *dn, pgoff_t index);
struct folio *f2fs_get_read_data_folio(struct inode *inode, pgoff_t index,
		blk_opf_t op_flags, bool for_write, pgoff_t *next_pgofs);
struct folio *f2fs_find_data_folio(struct inode *inode, pgoff_t index,
		pgoff_t *next_pgofs);
struct folio *f2fs_get_lock_data_folio(struct inode *inode, pgoff_t index,
			bool for_write);
struct folio *f2fs_get_new_data_folio(struct inode *inode,
			struct folio *ifolio, pgoff_t index, bool new_i_size);
int f2fs_do_write_data_page(struct f2fs_io_info *fio);
int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag);
int f2fs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
			u64 start, u64 len);
int f2fs_encrypt_one_page(struct f2fs_io_info *fio);
bool f2fs_should_update_inplace(struct inode *inode, struct f2fs_io_info *fio);
bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio);
int f2fs_write_single_data_page(struct folio *folio, int *submitted,
				struct bio **bio, sector_t *last_block,
				struct writeback_control *wbc,
				enum iostat_type io_type,
				int compr_blocks, bool allow_balance);
void f2fs_write_failed(struct inode *inode, loff_t to);
void f2fs_invalidate_folio(struct folio *folio, size_t offset, size_t length);
bool f2fs_release_folio(struct folio *folio, gfp_t wait);
bool f2fs_overwrite_io(struct inode *inode, loff_t pos, size_t len);
void f2fs_clear_page_cache_dirty_tag(struct folio *folio);
int f2fs_init_post_read_processing(void);
void f2fs_destroy_post_read_processing(void);
int f2fs_init_post_read_wq(struct f2fs_sb_info *sbi);
void f2fs_destroy_post_read_wq(struct f2fs_sb_info *sbi);
extern const struct iomap_ops f2fs_iomap_ops;

/*
 * gc.c
 */
int f2fs_start_gc_thread(struct f2fs_sb_info *sbi);
void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi);
block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode);
int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);
void f2fs_build_gc_manager(struct f2fs_sb_info *sbi);
int f2fs_gc_range(struct f2fs_sb_info *sbi,
		unsigned int start_seg, unsigned int end_seg,
		bool dry_run, unsigned int dry_run_sections);
int f2fs_resize_fs(struct file *filp, __u64 block_count);
int __init f2fs_create_garbage_collection_cache(void);
void f2fs_destroy_garbage_collection_cache(void);
/* victim selection function for cleaning and SSR */
int f2fs_get_victim(struct f2fs_sb_info *sbi, unsigned int *result,
			int gc_type, int type, char alloc_mode,
			unsigned long long age, bool one_time);

/*
 * recovery.c
 */
int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only);
bool f2fs_space_for_roll_forward(struct f2fs_sb_info *sbi);
int __init f2fs_create_recovery_cache(void);
void f2fs_destroy_recovery_cache(void);

/*
 * debug.c
 */
#ifdef CONFIG_F2FS_STAT_FS
enum {
	DEVSTAT_INUSE,
	DEVSTAT_DIRTY,
	DEVSTAT_FULL,
	DEVSTAT_FREE,
	DEVSTAT_PREFREE,
	DEVSTAT_MAX,
};

struct f2fs_dev_stats {
	unsigned int devstats[2][DEVSTAT_MAX];		/* 0: segs, 1: secs */
};

struct f2fs_stat_info {
	struct list_head stat_list;
	struct f2fs_sb_info *sbi;
	int all_area_segs, sit_area_segs, nat_area_segs, ssa_area_segs;
	int main_area_segs, main_area_sections, main_area_zones;
	unsigned long long hit_cached[NR_EXTENT_CACHES];
	unsigned long long hit_rbtree[NR_EXTENT_CACHES];
	unsigned long long total_ext[NR_EXTENT_CACHES];
	unsigned long long hit_total[NR_EXTENT_CACHES];
	int ext_tree[NR_EXTENT_CACHES];
	int zombie_tree[NR_EXTENT_CACHES];
	int ext_node[NR_EXTENT_CACHES];
	/* to count memory footprint */
	unsigned long long ext_mem[NR_EXTENT_CACHES];
	/* for read extent cache */
	unsigned long long hit_largest;
	/* for block age extent cache */
	unsigned long long allocated_data_blocks;
	int ndirty_node, ndirty_dent, ndirty_meta, ndirty_imeta;
	int ndirty_data, ndirty_qdata;
	unsigned int ndirty_dirs, ndirty_files, ndirty_all;
	unsigned int nquota_files, ndonate_files;
	int nats, dirty_nats, sits, dirty_sits;
	int free_nids, avail_nids, alloc_nids;
	int total_count, utilization;
	int nr_wb_cp_data, nr_wb_data;
	int nr_rd_data, nr_rd_node, nr_rd_meta;
	int nr_dio_read, nr_dio_write;
	unsigned int io_skip_bggc, other_skip_bggc;
	int nr_flushing, nr_flushed, flush_list_empty;
	int nr_discarding, nr_discarded;
	int nr_discard_cmd;
	unsigned int undiscard_blks;
	int nr_issued_ckpt, nr_total_ckpt, nr_queued_ckpt;
	unsigned int cur_ckpt_time, peak_ckpt_time;
	int inline_xattr, inline_inode, inline_dir, append, update, orphans;
	int compr_inode, swapfile_inode;
	unsigned long long compr_blocks;
	int aw_cnt, max_aw_cnt;
	unsigned int valid_count, valid_node_count, valid_inode_count, discard_blks;
	unsigned int bimodal, avg_vblocks;
	int util_free, util_valid, util_invalid;
	int rsvd_segs, overp_segs;
	int dirty_count, node_pages, meta_pages, compress_pages;
	int compress_page_hit;
	int prefree_count, free_segs, free_secs;
	int cp_call_count[MAX_CALL_TYPE], cp_count;
	int gc_call_count[MAX_CALL_TYPE];
	int gc_segs[2][2];
	int gc_secs[2][2];
	int tot_blks, data_blks, node_blks;
	int bg_data_blks, bg_node_blks;
	int blkoff[NR_CURSEG_TYPE];
	int curseg[NR_CURSEG_TYPE];
	int cursec[NR_CURSEG_TYPE];
	int curzone[NR_CURSEG_TYPE];
	unsigned int dirty_seg[NR_CURSEG_TYPE];
	unsigned int full_seg[NR_CURSEG_TYPE];
	unsigned int valid_blks[NR_CURSEG_TYPE];

	unsigned int meta_count[META_MAX];
	unsigned int segment_count[2];
	unsigned int block_count[2];
	unsigned int inplace_count;
	unsigned long long base_mem, cache_mem, page_mem;
	struct f2fs_dev_stats *dev_stats;
};

static inline struct f2fs_stat_info *F2FS_STAT(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_stat_info *)sbi->stat_info;
}

#define stat_inc_cp_call_count(sbi, foreground)				\
		atomic_inc(&sbi->cp_call_count[(foreground)])
#define stat_inc_cp_count(sbi)		(F2FS_STAT(sbi)->cp_count++)
#define stat_io_skip_bggc_count(sbi)	((sbi)->io_skip_bggc++)
#define stat_other_skip_bggc_count(sbi)	((sbi)->other_skip_bggc++)
#define stat_inc_dirty_inode(sbi, type)	((sbi)->ndirty_inode[type]++)
#define stat_dec_dirty_inode(sbi, type)	((sbi)->ndirty_inode[type]--)
#define stat_inc_total_hit(sbi, type)		(atomic64_inc(&(sbi)->total_hit_ext[type]))
#define stat_inc_rbtree_node_hit(sbi, type)	(atomic64_inc(&(sbi)->read_hit_rbtree[type]))
#define stat_inc_largest_node_hit(sbi)	(atomic64_inc(&(sbi)->read_hit_largest))
#define stat_inc_cached_node_hit(sbi, type)	(atomic64_inc(&(sbi)->read_hit_cached[type]))
#define stat_inc_inline_xattr(inode)					\
	do {								\
		if (f2fs_has_inline_xattr(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->inline_xattr));	\
	} while (0)
#define stat_dec_inline_xattr(inode)					\
	do {								\
		if (f2fs_has_inline_xattr(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->inline_xattr));	\
	} while (0)
#define stat_inc_inline_inode(inode)					\
	do {								\
		if (f2fs_has_inline_data(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->inline_inode));	\
	} while (0)
#define stat_dec_inline_inode(inode)					\
	do {								\
		if (f2fs_has_inline_data(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->inline_inode));	\
	} while (0)
#define stat_inc_inline_dir(inode)					\
	do {								\
		if (f2fs_has_inline_dentry(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->inline_dir));	\
	} while (0)
#define stat_dec_inline_dir(inode)					\
	do {								\
		if (f2fs_has_inline_dentry(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->inline_dir));	\
	} while (0)
#define stat_inc_compr_inode(inode)					\
	do {								\
		if (f2fs_compressed_file(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->compr_inode));	\
	} while (0)
#define stat_dec_compr_inode(inode)					\
	do {								\
		if (f2fs_compressed_file(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->compr_inode));	\
	} while (0)
#define stat_add_compr_blocks(inode, blocks)				\
		(atomic64_add(blocks, &F2FS_I_SB(inode)->compr_blocks))
#define stat_sub_compr_blocks(inode, blocks)				\
		(atomic64_sub(blocks, &F2FS_I_SB(inode)->compr_blocks))
#define stat_inc_swapfile_inode(inode)					\
		(atomic_inc(&F2FS_I_SB(inode)->swapfile_inode))
#define stat_dec_swapfile_inode(inode)					\
		(atomic_dec(&F2FS_I_SB(inode)->swapfile_inode))
#define stat_inc_atomic_inode(inode)					\
			(atomic_inc(&F2FS_I_SB(inode)->atomic_files))
#define stat_dec_atomic_inode(inode)					\
			(atomic_dec(&F2FS_I_SB(inode)->atomic_files))
#define stat_inc_meta_count(sbi, blkaddr)				\
	do {								\
		if (blkaddr < SIT_I(sbi)->sit_base_addr)		\
			atomic_inc(&(sbi)->meta_count[META_CP]);	\
		else if (blkaddr < NM_I(sbi)->nat_blkaddr)		\
			atomic_inc(&(sbi)->meta_count[META_SIT]);	\
		else if (blkaddr < SM_I(sbi)->ssa_blkaddr)		\
			atomic_inc(&(sbi)->meta_count[META_NAT]);	\
		else if (blkaddr < SM_I(sbi)->main_blkaddr)		\
			atomic_inc(&(sbi)->meta_count[META_SSA]);	\
	} while (0)
#define stat_inc_seg_type(sbi, curseg)					\
		((sbi)->segment_count[(curseg)->alloc_type]++)
#define stat_inc_block_count(sbi, curseg)				\
		((sbi)->block_count[(curseg)->alloc_type]++)
#define stat_inc_inplace_blocks(sbi)					\
		(atomic_inc(&(sbi)->inplace_count))
#define stat_update_max_atomic_write(inode)				\
	do {								\
		int cur = atomic_read(&F2FS_I_SB(inode)->atomic_files);	\
		int max = atomic_read(&F2FS_I_SB(inode)->max_aw_cnt);	\
		if (cur > max)						\
			atomic_set(&F2FS_I_SB(inode)->max_aw_cnt, cur);	\
	} while (0)
#define stat_inc_gc_call_count(sbi, foreground)				\
		(F2FS_STAT(sbi)->gc_call_count[(foreground)]++)
#define stat_inc_gc_sec_count(sbi, type, gc_type)			\
		(F2FS_STAT(sbi)->gc_secs[(type)][(gc_type)]++)
#define stat_inc_gc_seg_count(sbi, type, gc_type)			\
		(F2FS_STAT(sbi)->gc_segs[(type)][(gc_type)]++)

#define stat_inc_tot_blk_count(si, blks)				\
	((si)->tot_blks += (blks))

#define stat_inc_data_blk_count(sbi, blks, gc_type)			\
	do {								\
		struct f2fs_stat_info *si = F2FS_STAT(sbi);		\
		stat_inc_tot_blk_count(si, blks);			\
		si->data_blks += (blks);				\
		si->bg_data_blks += ((gc_type) == BG_GC) ? (blks) : 0;	\
	} while (0)

#define stat_inc_node_blk_count(sbi, blks, gc_type)			\
	do {								\
		struct f2fs_stat_info *si = F2FS_STAT(sbi);		\
		stat_inc_tot_blk_count(si, blks);			\
		si->node_blks += (blks);				\
		si->bg_node_blks += ((gc_type) == BG_GC) ? (blks) : 0;	\
	} while (0)

int f2fs_build_stats(struct f2fs_sb_info *sbi);
void f2fs_destroy_stats(struct f2fs_sb_info *sbi);
void __init f2fs_create_root_stats(void);
void f2fs_destroy_root_stats(void);
void f2fs_update_sit_info(struct f2fs_sb_info *sbi);
#else
#define stat_inc_cp_call_count(sbi, foreground)		do { } while (0)
#define stat_inc_cp_count(sbi)				do { } while (0)
#define stat_io_skip_bggc_count(sbi)			do { } while (0)
#define stat_other_skip_bggc_count(sbi)			do { } while (0)
#define stat_inc_dirty_inode(sbi, type)			do { } while (0)
#define stat_dec_dirty_inode(sbi, type)			do { } while (0)
#define stat_inc_total_hit(sbi, type)			do { } while (0)
#define stat_inc_rbtree_node_hit(sbi, type)		do { } while (0)
#define stat_inc_largest_node_hit(sbi)			do { } while (0)
#define stat_inc_cached_node_hit(sbi, type)		do { } while (0)
#define stat_inc_inline_xattr(inode)			do { } while (0)
#define stat_dec_inline_xattr(inode)			do { } while (0)
#define stat_inc_inline_inode(inode)			do { } while (0)
#define stat_dec_inline_inode(inode)			do { } while (0)
#define stat_inc_inline_dir(inode)			do { } while (0)
#define stat_dec_inline_dir(inode)			do { } while (0)
#define stat_inc_compr_inode(inode)			do { } while (0)
#define stat_dec_compr_inode(inode)			do { } while (0)
#define stat_add_compr_blocks(inode, blocks)		do { } while (0)
#define stat_sub_compr_blocks(inode, blocks)		do { } while (0)
#define stat_inc_swapfile_inode(inode)			do { } while (0)
#define stat_dec_swapfile_inode(inode)			do { } while (0)
#define stat_inc_atomic_inode(inode)			do { } while (0)
#define stat_dec_atomic_inode(inode)			do { } while (0)
#define stat_update_max_atomic_write(inode)		do { } while (0)
#define stat_inc_meta_count(sbi, blkaddr)		do { } while (0)
#define stat_inc_seg_type(sbi, curseg)			do { } while (0)
#define stat_inc_block_count(sbi, curseg)		do { } while (0)
#define stat_inc_inplace_blocks(sbi)			do { } while (0)
#define stat_inc_gc_call_count(sbi, foreground)		do { } while (0)
#define stat_inc_gc_sec_count(sbi, type, gc_type)	do { } while (0)
#define stat_inc_gc_seg_count(sbi, type, gc_type)	do { } while (0)
#define stat_inc_tot_blk_count(si, blks)		do { } while (0)
#define stat_inc_data_blk_count(sbi, blks, gc_type)	do { } while (0)
#define stat_inc_node_blk_count(sbi, blks, gc_type)	do { } while (0)

static inline int f2fs_build_stats(struct f2fs_sb_info *sbi) { return 0; }
static inline void f2fs_destroy_stats(struct f2fs_sb_info *sbi) { }
static inline void __init f2fs_create_root_stats(void) { }
static inline void f2fs_destroy_root_stats(void) { }
static inline void f2fs_update_sit_info(struct f2fs_sb_info *sbi) {}
#endif

extern const struct file_operations f2fs_dir_operations;
extern const struct file_operations f2fs_file_operations;
extern const struct inode_operations f2fs_file_inode_operations;
extern const struct address_space_operations f2fs_dblock_aops;
extern const struct address_space_operations f2fs_node_aops;
extern const struct address_space_operations f2fs_meta_aops;
extern const struct inode_operations f2fs_dir_inode_operations;
extern const struct inode_operations f2fs_symlink_inode_operations;
extern const struct inode_operations f2fs_encrypted_symlink_inode_operations;
extern const struct inode_operations f2fs_special_inode_operations;
extern struct kmem_cache *f2fs_inode_entry_slab;

/*
 * inline.c
 */
bool f2fs_may_inline_data(struct inode *inode);
bool f2fs_sanity_check_inline_data(struct inode *inode, struct folio *ifolio);
bool f2fs_may_inline_dentry(struct inode *inode);
void f2fs_do_read_inline_data(struct folio *folio, struct folio *ifolio);
void f2fs_truncate_inline_inode(struct inode *inode, struct folio *ifolio,
		u64 from);
int f2fs_read_inline_data(struct inode *inode, struct folio *folio);
int f2fs_convert_inline_folio(struct dnode_of_data *dn, struct folio *folio);
int f2fs_convert_inline_inode(struct inode *inode);
int f2fs_try_convert_inline_dir(struct inode *dir, struct dentry *dentry);
int f2fs_write_inline_data(struct inode *inode, struct folio *folio);
int f2fs_recover_inline_data(struct inode *inode, struct folio *nfolio);
struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
		const struct f2fs_filename *fname, struct folio **res_folio,
		bool use_hash);
int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent,
			struct folio *ifolio);
int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
			struct inode *inode, nid_t ino, umode_t mode);
void f2fs_delete_inline_entry(struct f2fs_dir_entry *dentry,
		struct folio *folio, struct inode *dir, struct inode *inode);
bool f2fs_empty_inline_dir(struct inode *dir);
int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
			struct fscrypt_str *fstr);
int f2fs_inline_data_fiemap(struct inode *inode,
			struct fiemap_extent_info *fieinfo,
			__u64 start, __u64 len);

/*
 * shrinker.c
 */
unsigned long f2fs_shrink_count(struct shrinker *shrink,
			struct shrink_control *sc);
unsigned long f2fs_shrink_scan(struct shrinker *shrink,
			struct shrink_control *sc);
unsigned int f2fs_donate_files(void);
void f2fs_reclaim_caches(unsigned int reclaim_caches_kb);
void f2fs_join_shrinker(struct f2fs_sb_info *sbi);
void f2fs_leave_shrinker(struct f2fs_sb_info *sbi);

/*
 * extent_cache.c
 */
bool sanity_check_extent_cache(struct inode *inode, struct folio *ifolio);
void f2fs_init_extent_tree(struct inode *inode);
void f2fs_drop_extent_tree(struct inode *inode);
void f2fs_destroy_extent_node(struct inode *inode);
void f2fs_destroy_extent_tree(struct inode *inode);
void f2fs_init_extent_cache_info(struct f2fs_sb_info *sbi);
int __init f2fs_create_extent_cache(void);
void f2fs_destroy_extent_cache(void);

/* read extent cache ops */
void f2fs_init_read_extent_tree(struct inode *inode, struct folio *ifolio);
bool f2fs_lookup_read_extent_cache(struct inode *inode, pgoff_t pgofs,
			struct extent_info *ei);
bool f2fs_lookup_read_extent_cache_block(struct inode *inode, pgoff_t index,
			block_t *blkaddr);
void f2fs_update_read_extent_cache(struct dnode_of_data *dn);
void f2fs_update_read_extent_cache_range(struct dnode_of_data *dn,
			pgoff_t fofs, block_t blkaddr, unsigned int len);
unsigned int f2fs_shrink_read_extent_tree(struct f2fs_sb_info *sbi,
			int nr_shrink);

/* block age extent cache ops */
void f2fs_init_age_extent_tree(struct inode *inode);
bool f2fs_lookup_age_extent_cache(struct inode *inode, pgoff_t pgofs,
			struct extent_info *ei);
void f2fs_update_age_extent_cache(struct dnode_of_data *dn);
void f2fs_update_age_extent_cache_range(struct dnode_of_data *dn,
			pgoff_t fofs, unsigned int len);
unsigned int f2fs_shrink_age_extent_tree(struct f2fs_sb_info *sbi,
			int nr_shrink);

/*
 * sysfs.c
 */
#define MIN_RA_MUL	2
#define MAX_RA_MUL	256

int __init f2fs_init_sysfs(void);
void f2fs_exit_sysfs(void);
int f2fs_register_sysfs(struct f2fs_sb_info *sbi);
void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi);

/* verity.c */
extern const struct fsverity_operations f2fs_verityops;

/*
 * crypto support
 */
static inline bool f2fs_encrypted_file(struct inode *inode)
{
	return IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode);
}

static inline void f2fs_set_encrypted_inode(struct inode *inode)
{
#ifdef CONFIG_FS_ENCRYPTION
	file_set_encrypt(inode);
	f2fs_set_inode_flags(inode);
#endif
}

/*
 * Returns true if the reads of the inode's data need to undergo some
 * postprocessing step, like decryption or authenticity verification.
 */
static inline bool f2fs_post_read_required(struct inode *inode)
{
	return f2fs_encrypted_file(inode) || fsverity_active(inode) ||
		f2fs_compressed_file(inode);
}

static inline bool f2fs_used_in_atomic_write(struct inode *inode)
{
	return f2fs_is_atomic_file(inode) || f2fs_is_cow_file(inode);
}

static inline bool f2fs_meta_inode_gc_required(struct inode *inode)
{
	return f2fs_post_read_required(inode) || f2fs_used_in_atomic_write(inode);
}

/*
 * compress.c
 */
#ifdef CONFIG_F2FS_FS_COMPRESSION
enum cluster_check_type {
	CLUSTER_IS_COMPR,   /* check only if compressed cluster */
	CLUSTER_COMPR_BLKS, /* return # of compressed blocks in a cluster */
	CLUSTER_RAW_BLKS    /* return # of raw blocks in a cluster */
};
bool f2fs_is_compressed_page(struct folio *folio);
struct folio *f2fs_compress_control_folio(struct folio *folio);
int f2fs_prepare_compress_overwrite(struct inode *inode,
			struct page **pagep, pgoff_t index, void **fsdata);
bool f2fs_compress_write_end(struct inode *inode, void *fsdata,
					pgoff_t index, unsigned copied);
int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock);
void f2fs_compress_write_end_io(struct bio *bio, struct folio *folio);
bool f2fs_is_compress_backend_ready(struct inode *inode);
bool f2fs_is_compress_level_valid(int alg, int lvl);
int __init f2fs_init_compress_mempool(void);
void f2fs_destroy_compress_mempool(void);
void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task);
void f2fs_end_read_compressed_page(struct folio *folio, bool failed,
				block_t blkaddr, bool in_task);
bool f2fs_cluster_is_empty(struct compress_ctx *cc);
bool f2fs_cluster_can_merge_page(struct compress_ctx *cc, pgoff_t index);
bool f2fs_all_cluster_page_ready(struct compress_ctx *cc, struct page **pages,
				int index, int nr_pages, bool uptodate);
bool f2fs_sanity_check_cluster(struct dnode_of_data *dn);
void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct folio *folio);
int f2fs_write_multi_pages(struct compress_ctx *cc,
						int *submitted,
						struct writeback_control *wbc,
						enum iostat_type io_type);
int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index);
bool f2fs_is_sparse_cluster(struct inode *inode, pgoff_t index);
void f2fs_update_read_extent_tree_range_compressed(struct inode *inode,
				pgoff_t fofs, block_t blkaddr,
				unsigned int llen, unsigned int c_len);
int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
				unsigned nr_pages, sector_t *last_block_in_bio,
				struct readahead_control *rac, bool for_write);
struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc);
void f2fs_decompress_end_io(struct decompress_io_ctx *dic, bool failed,
				bool in_task);
void f2fs_put_folio_dic(struct folio *folio, bool in_task);
unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn,
						unsigned int ofs_in_node);
int f2fs_init_compress_ctx(struct compress_ctx *cc);
void f2fs_destroy_compress_ctx(struct compress_ctx *cc, bool reuse);
void f2fs_init_compress_info(struct f2fs_sb_info *sbi);
int f2fs_init_compress_inode(struct f2fs_sb_info *sbi);
void f2fs_destroy_compress_inode(struct f2fs_sb_info *sbi);
int f2fs_init_page_array_cache(struct f2fs_sb_info *sbi);
void f2fs_destroy_page_array_cache(struct f2fs_sb_info *sbi);
int __init f2fs_init_compress_cache(void);
void f2fs_destroy_compress_cache(void);
struct address_space *COMPRESS_MAPPING(struct f2fs_sb_info *sbi);
void f2fs_invalidate_compress_pages_range(struct f2fs_sb_info *sbi,
					block_t blkaddr, unsigned int len);
bool f2fs_load_compressed_folio(struct f2fs_sb_info *sbi, struct folio *folio,
								block_t blkaddr);
void f2fs_invalidate_compress_pages(struct f2fs_sb_info *sbi, nid_t ino);
#define inc_compr_inode_stat(inode)					\
	do {								\
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);		\
		sbi->compr_new_inode++;					\
	} while (0)
#define add_compr_block_stat(inode, blocks)				\
	do {								\
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);		\
		int diff = F2FS_I(inode)->i_cluster_size - blocks;	\
		sbi->compr_written_block += blocks;			\
		sbi->compr_saved_block += diff;				\
	} while (0)
#else
static inline bool f2fs_is_compressed_page(struct folio *folio) { return false; }
static inline bool f2fs_is_compress_backend_ready(struct inode *inode)
{
	if (!f2fs_compressed_file(inode))
		return true;
	/* not support compression */
	return false;
}
static inline bool f2fs_is_compress_level_valid(int alg, int lvl) { return false; }
static inline struct folio *f2fs_compress_control_folio(struct folio *folio)
{
	WARN_ON_ONCE(1);
	return ERR_PTR(-EINVAL);
}
static inline int __init f2fs_init_compress_mempool(void) { return 0; }
static inline void f2fs_destroy_compress_mempool(void) { }
static inline void f2fs_decompress_cluster(struct decompress_io_ctx *dic,
				bool in_task) { }
static inline void f2fs_end_read_compressed_page(struct folio *folio,
				bool failed, block_t blkaddr, bool in_task)
{
	WARN_ON_ONCE(1);
}
static inline void f2fs_put_folio_dic(struct folio *folio, bool in_task)
{
	WARN_ON_ONCE(1);
}
static inline unsigned int f2fs_cluster_blocks_are_contiguous(
			struct dnode_of_data *dn, unsigned int ofs_in_node) { return 0; }
static inline bool f2fs_sanity_check_cluster(struct dnode_of_data *dn) { return false; }
static inline int f2fs_init_compress_inode(struct f2fs_sb_info *sbi) { return 0; }
static inline void f2fs_destroy_compress_inode(struct f2fs_sb_info *sbi) { }
static inline int f2fs_init_page_array_cache(struct f2fs_sb_info *sbi) { return 0; }
static inline void f2fs_destroy_page_array_cache(struct f2fs_sb_info *sbi) { }
static inline int __init f2fs_init_compress_cache(void) { return 0; }
static inline void f2fs_destroy_compress_cache(void) { }
static inline void f2fs_invalidate_compress_pages_range(struct f2fs_sb_info *sbi,
				block_t blkaddr, unsigned int len) { }
static inline bool f2fs_load_compressed_folio(struct f2fs_sb_info *sbi,
		struct folio *folio, block_t blkaddr) { return false; }
static inline void f2fs_invalidate_compress_pages(struct f2fs_sb_info *sbi,
							nid_t ino) { }
#define inc_compr_inode_stat(inode)		do { } while (0)
static inline int f2fs_is_compressed_cluster(
				struct inode *inode,
				pgoff_t index) { return 0; }
static inline bool f2fs_is_sparse_cluster(
				struct inode *inode,
				pgoff_t index) { return true; }
static inline void f2fs_update_read_extent_tree_range_compressed(
				struct inode *inode,
				pgoff_t fofs, block_t blkaddr,
				unsigned int llen, unsigned int c_len) { }
#endif

static inline int set_compress_context(struct inode *inode)
{
#ifdef CONFIG_F2FS_FS_COMPRESSION
	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
	struct f2fs_inode_info *fi = F2FS_I(inode);

	fi->i_compress_algorithm = F2FS_OPTION(sbi).compress_algorithm;
	fi->i_log_cluster_size = F2FS_OPTION(sbi).compress_log_size;
	fi->i_compress_flag = F2FS_OPTION(sbi).compress_chksum ?
					BIT(COMPRESS_CHKSUM) : 0;
	fi->i_cluster_size = BIT(fi->i_log_cluster_size);
	if ((fi->i_compress_algorithm == COMPRESS_LZ4 ||
		fi->i_compress_algorithm == COMPRESS_ZSTD) &&
			F2FS_OPTION(sbi).compress_level)
		fi->i_compress_level = F2FS_OPTION(sbi).compress_level;
	fi->i_flags |= F2FS_COMPR_FL;
	set_inode_flag(inode, FI_COMPRESSED_FILE);
	stat_inc_compr_inode(inode);
	inc_compr_inode_stat(inode);
	f2fs_mark_inode_dirty_sync(inode, true);
	return 0;
#else
	return -EOPNOTSUPP;
#endif
}

static inline bool f2fs_disable_compressed_file(struct inode *inode)
{
	struct f2fs_inode_info *fi = F2FS_I(inode);

	f2fs_down_write(&fi->i_sem);

	if (!f2fs_compressed_file(inode)) {
		f2fs_up_write(&fi->i_sem);
		return true;
	}
	if (f2fs_is_mmap_file(inode) || atomic_read(&fi->writeback) ||
		(S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode))) {
		f2fs_up_write(&fi->i_sem);
		return false;
	}

	fi->i_flags &= ~F2FS_COMPR_FL;
	stat_dec_compr_inode(inode);
	clear_inode_flag(inode, FI_COMPRESSED_FILE);
	f2fs_mark_inode_dirty_sync(inode, true);

	f2fs_up_write(&fi->i_sem);
	return true;
}

#define F2FS_FEATURE_FUNCS(name, flagname) \
static inline bool f2fs_sb_has_##name(struct f2fs_sb_info *sbi) \
{ \
	return F2FS_HAS_FEATURE(sbi, F2FS_FEATURE_##flagname); \
}

F2FS_FEATURE_FUNCS(encrypt, ENCRYPT);
F2FS_FEATURE_FUNCS(blkzoned, BLKZONED);
F2FS_FEATURE_FUNCS(extra_attr, EXTRA_ATTR);
F2FS_FEATURE_FUNCS(project_quota, PRJQUOTA);
F2FS_FEATURE_FUNCS(inode_chksum, INODE_CHKSUM);
F2FS_FEATURE_FUNCS(flexible_inline_xattr, FLEXIBLE_INLINE_XATTR);
F2FS_FEATURE_FUNCS(quota_ino, QUOTA_INO);
F2FS_FEATURE_FUNCS(inode_crtime, INODE_CRTIME);
F2FS_FEATURE_FUNCS(lost_found, LOST_FOUND);
F2FS_FEATURE_FUNCS(verity, VERITY);
F2FS_FEATURE_FUNCS(sb_chksum, SB_CHKSUM);
F2FS_FEATURE_FUNCS(casefold, CASEFOLD);
F2FS_FEATURE_FUNCS(compression, COMPRESSION);
F2FS_FEATURE_FUNCS(readonly, RO);
F2FS_FEATURE_FUNCS(device_alias, DEVICE_ALIAS);
F2FS_FEATURE_FUNCS(packed_ssa, PACKED_SSA);

#ifdef CONFIG_BLK_DEV_ZONED
static inline bool f2fs_zone_is_seq(struct f2fs_sb_info *sbi, int devi,
							unsigned int zone)
{
	return test_bit(zone, FDEV(devi).blkz_seq);
}

static inline bool f2fs_blkz_is_seq(struct f2fs_sb_info *sbi, int devi,
								block_t blkaddr)
{
	return f2fs_zone_is_seq(sbi, devi, blkaddr / sbi->blocks_per_blkz);
}
#endif

static inline int f2fs_bdev_index(struct f2fs_sb_info *sbi,
				  struct block_device *bdev)
{
	int i;

	if (!f2fs_is_multi_device(sbi))
		return 0;

	for (i = 0; i < sbi->s_ndevs; i++)
		if (FDEV(i).bdev == bdev)
			return i;

	WARN_ON(1);
	return -1;
}

static inline bool f2fs_hw_should_discard(struct f2fs_sb_info *sbi)
{
	return f2fs_sb_has_blkzoned(sbi);
}

static inline bool f2fs_bdev_support_discard(struct block_device *bdev)
{
	return bdev_max_discard_sectors(bdev) || bdev_is_zoned(bdev);
}

static inline bool f2fs_hw_support_discard(struct f2fs_sb_info *sbi)
{
	int i;

	if (!f2fs_is_multi_device(sbi))
		return f2fs_bdev_support_discard(sbi->sb->s_bdev);

	for (i = 0; i < sbi->s_ndevs; i++)
		if (f2fs_bdev_support_discard(FDEV(i).bdev))
			return true;
	return false;
}

static inline unsigned int f2fs_hw_discard_granularity(struct f2fs_sb_info *sbi)
{
	int i = 1;
	unsigned int discard_granularity = bdev_discard_granularity(sbi->sb->s_bdev);

	if (f2fs_is_multi_device(sbi))
		for (; i < sbi->s_ndevs && !bdev_is_zoned(FDEV(i).bdev); i++)
			discard_granularity = max_t(unsigned int, discard_granularity,
						bdev_discard_granularity(FDEV(i).bdev));
	return discard_granularity;
}

static inline bool f2fs_realtime_discard_enable(struct f2fs_sb_info *sbi)
{
	return (test_opt(sbi, DISCARD) && f2fs_hw_support_discard(sbi)) ||
					f2fs_hw_should_discard(sbi);
}

static inline bool f2fs_hw_is_readonly(struct f2fs_sb_info *sbi)
{
	int i;

	if (!f2fs_is_multi_device(sbi))
		return bdev_read_only(sbi->sb->s_bdev);

	for (i = 0; i < sbi->s_ndevs; i++)
		if (bdev_read_only(FDEV(i).bdev))
			return true;
	return false;
}

static inline bool f2fs_dev_is_readonly(struct f2fs_sb_info *sbi)
{
	return f2fs_sb_has_readonly(sbi) || f2fs_hw_is_readonly(sbi);
}

static inline bool f2fs_lfs_mode(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).fs_mode == FS_MODE_LFS;
}

static inline bool f2fs_is_sequential_zone_area(struct f2fs_sb_info *sbi,
					  block_t blkaddr)
{
	if (f2fs_sb_has_blkzoned(sbi)) {
#ifdef CONFIG_BLK_DEV_ZONED
		int devi = f2fs_target_device_index(sbi, blkaddr);

		if (!bdev_is_zoned(FDEV(devi).bdev))
			return false;

		if (f2fs_is_multi_device(sbi)) {
			if (blkaddr < FDEV(devi).start_blk ||
				blkaddr > FDEV(devi).end_blk) {
				f2fs_err(sbi, "Invalid block %x", blkaddr);
				return false;
			}
			blkaddr -= FDEV(devi).start_blk;
		}

		return f2fs_blkz_is_seq(sbi, devi, blkaddr);
#else
		return false;
#endif
	}
	return false;
}

static inline bool f2fs_low_mem_mode(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).memory_mode == MEMORY_MODE_LOW;
}

static inline bool f2fs_may_compress(struct inode *inode)
{
	if (IS_SWAPFILE(inode) || f2fs_is_pinned_file(inode) ||
		f2fs_is_atomic_file(inode) || f2fs_has_inline_data(inode) ||
		f2fs_is_mmap_file(inode))
		return false;
	return S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode);
}

static inline void f2fs_i_compr_blocks_update(struct inode *inode,
						u64 blocks, bool add)
{
	struct f2fs_inode_info *fi = F2FS_I(inode);
	int diff = fi->i_cluster_size - blocks;

	/* don't update i_compr_blocks if saved blocks were released */
	if (!add && !atomic_read(&fi->i_compr_blocks))
		return;

	if (add) {
		atomic_add(diff, &fi->i_compr_blocks);
		stat_add_compr_blocks(inode, diff);
	} else {
		atomic_sub(diff, &fi->i_compr_blocks);
		stat_sub_compr_blocks(inode, diff);
	}
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline bool f2fs_allow_multi_device_dio(struct f2fs_sb_info *sbi,
								int flag)
{
	if (!f2fs_is_multi_device(sbi))
		return false;
	if (flag != F2FS_GET_BLOCK_DIO)
		return false;
	return sbi->aligned_blksize;
}

#ifdef CONFIG_F2FS_FAULT_INJECTION
extern int f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned long rate,
					unsigned long type, enum fault_option fo);
extern void f2fs_simulate_lock_timeout(struct f2fs_sb_info *sbi);
#else
static inline int f2fs_build_fault_attr(struct f2fs_sb_info *sbi,
					unsigned long rate, unsigned long type,
					enum fault_option fo)
{
	return 0;
}
static inline void f2fs_simulate_lock_timeout(struct f2fs_sb_info *sbi)
{
	return;
}
#endif

static inline bool is_journalled_quota(struct f2fs_sb_info *sbi)
{
#ifdef CONFIG_QUOTA
	if (f2fs_sb_has_quota_ino(sbi))
		return true;
	if (F2FS_OPTION(sbi).s_qf_names[USRQUOTA] ||
		F2FS_OPTION(sbi).s_qf_names[GRPQUOTA] ||
		F2FS_OPTION(sbi).s_qf_names[PRJQUOTA])
		return true;
#endif
	return false;
}

static inline bool f2fs_quota_file(struct f2fs_sb_info *sbi, nid_t ino)
{
#ifdef CONFIG_QUOTA
	int i;

	if (!f2fs_sb_has_quota_ino(sbi))
		return false;

	for (i = 0; i < MAXQUOTAS; i++) {
		if (f2fs_qf_ino(sbi->sb, i) == ino)
			return true;
	}
#endif
	return false;
}

static inline bool f2fs_block_unit_discard(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).discard_unit == DISCARD_UNIT_BLOCK;
}

static inline void __f2fs_schedule_timeout(long timeout, bool io)
{
	set_current_state(TASK_UNINTERRUPTIBLE);
	if (io)
		io_schedule_timeout(timeout);
	else
		schedule_timeout(timeout);
}

#define f2fs_io_schedule_timeout(timeout)		\
			__f2fs_schedule_timeout(timeout, true)
#define f2fs_schedule_timeout(timeout)			\
			__f2fs_schedule_timeout(timeout, false)

static inline void f2fs_schedule_timeout_killable(long timeout, bool io)
{
	unsigned long last_time = jiffies + timeout;

	while (jiffies < last_time) {
		if (fatal_signal_pending(current))
			return;
		__f2fs_schedule_timeout(DEFAULT_SCHEDULE_TIMEOUT, io);
	}
}

static inline void f2fs_handle_page_eio(struct f2fs_sb_info *sbi,
				struct folio *folio, enum page_type type)
{
	pgoff_t ofs = folio->index;

	if (unlikely(f2fs_cp_error(sbi)))
		return;

	if (ofs == sbi->page_eio_ofs[type]) {
		if (sbi->page_eio_cnt[type]++ == MAX_RETRY_PAGE_EIO)
			set_ckpt_flags(sbi, CP_ERROR_FLAG);
	} else {
		sbi->page_eio_ofs[type] = ofs;
		sbi->page_eio_cnt[type] = 0;
	}
}

static inline bool f2fs_is_readonly(struct f2fs_sb_info *sbi)
{
	return f2fs_sb_has_readonly(sbi) || f2fs_readonly(sbi->sb);
}

static inline void f2fs_truncate_meta_inode_pages(struct f2fs_sb_info *sbi,
					block_t blkaddr, unsigned int cnt)
{
	bool need_submit = false;
	int i = 0;

	do {
		struct folio *folio;

		folio = filemap_get_folio(META_MAPPING(sbi), blkaddr + i);
		if (!IS_ERR(folio)) {
			if (folio_test_writeback(folio))
				need_submit = true;
			f2fs_folio_put(folio, false);
		}
	} while (++i < cnt && !need_submit);

	if (need_submit)
		f2fs_submit_merged_write_cond(sbi, sbi->meta_inode,
							NULL, 0, DATA);

	truncate_inode_pages_range(META_MAPPING(sbi),
			F2FS_BLK_TO_BYTES((loff_t)blkaddr),
			F2FS_BLK_END_BYTES((loff_t)(blkaddr + cnt - 1)));
}

static inline void f2fs_invalidate_internal_cache(struct f2fs_sb_info *sbi,
						block_t blkaddr, unsigned int len)
{
	f2fs_truncate_meta_inode_pages(sbi, blkaddr, len);
	f2fs_invalidate_compress_pages_range(sbi, blkaddr, len);
}

#endif /* _LINUX_F2FS_H */
]

gemini-3.1-pro-preview

							input: 87033
							output: 47
							thoughts: 308
						

**Analyzing the f2fs_bug_on Macro**

Okay, let's break down this `f2fs_bug_on` macro. I see the definition: it's either `BUG_ON` if `CONFIG_F2FS_CHECK_FS` is enabled, or a `WARN_ON` with an added `set_sbi_flag` call if it's disabled. That's pretty standard for these kinds of checks. So, in a production environment, where we usually don't want to halt the kernel, it defaults to a `WARN_ON`. This means it just prints a warning and sets the `SBI_NEED_FSCK` flag, suggesting a file system check is required.

The bug report mentions a `kernel BUG` at `fs/f2fs/segment.c:1900`. That confirms `CONFIG_F2FS_CHECK_FS` *was* enabled in the kernel that generated this report, likely the syzkaller kernel. Consequently, in a production environment, the same condition would have simply triggered a warning. Now, I need to understand the implications, specifically in the context of `f2fs_issue_discard_timeout`. My next step is to examine what happens immediately after the `f2fs_bug_on(sbi, atomic_read(&dcc->discard_cmd_cnt));` call within that function.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:f2fs_issue_discard_timeout]

map[SourceCode:1875:	/**
1876:	 * f2fs_issue_discard_timeout() - Issue all discard cmd within UMOUNT_DISCARD_TIMEOUT
1877:	 * @sbi: the f2fs_sb_info data for discard cmd to issue
1878:	 *
1879:	 * When UMOUNT_DISCARD_TIMEOUT is exceeded, all remaining discard commands will be dropped
1880:	 *
1881:	 * Return true if issued all discard cmd or no discard cmd need issue, otherwise return false.
1882:	 */
1883:	bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi)
1884:	{
1885:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1886:		struct discard_policy dpolicy;
1887:		bool dropped;
1888:	
1889:		if (!atomic_read(&dcc->discard_cmd_cnt))
1890:			return true;
1891:	
1892:		__init_discard_policy(sbi, &dpolicy, DPOLICY_UMOUNT,
1893:						dcc->discard_granularity);
1894:		__issue_discard_cmd(sbi, &dpolicy);
1895:		dropped = __drop_discard_cmd(sbi);
1896:	
1897:		/* just to make sure there is no pending discard commands */
1898:		__wait_all_discard_cmd(sbi, NULL);
1899:	
1900:		f2fs_bug_on(sbi, atomic_read(&dcc->discard_cmd_cnt));
1901:		return !dropped;
1902:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 88185
							output: 55
							thoughts: 53
						

**Analyzing the Potential Impact of a Warning in F2FS**

Okay, so I'm looking at this `f2fs_bug_on` function, and it seems like it's behaving more like a warning than a hard stop. It's returning `!dropped` if it's just a warning. The immediate question that pops into my head is, what does that mean in the grand scheme of things? What are the implications of this `!dropped` return value? Where does this lead?

The core issue I'm concerned with revolves around its effect on the timeout. I need to understand the impact of this "warning" behavior on the `f2fs_issue_discard_timeout` call. So I need to trace where `f2fs_issue_discard_timeout` is called. That's the next logical step. I need to find the call sites. From there, I can analyze the upstream impacts.

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:f2fs_issue_discard_timeout SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__f2fs_remount SourceFile:fs/f2fs/super.c SourceLine:2960] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:destroy_discard_cmd_control SourceFile:fs/f2fs/segment.c SourceLine:2370] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_put_super SourceFile:fs/f2fs/super.c SourceLine:2012] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_unfreeze SourceFile:fs/f2fs/super.c SourceLine:2155]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 88725
							output: 45
							thoughts: 25
						

Here's my take on those thoughts, tailored for an expert audience:

**Diving into the F2FS Remount Logic**

Okay, time to get my hands dirty. I'm thinking I need to understand the remount process within the F2FS filesystem, specifically the function `__f2fs_remount`. Let's navigate straight to `fs/f2fs/super.c`. This is where the core superblock operations are, so it's the logical place to start digging into how the filesystem handles remounting. I'm expecting to find the nitty-gritty details of how flags are manipulated, what checks are performed on the mount options, and how the on-disk structures are updated during a remount operation. I anticipate it will involve updating superblock flags, potentially syncing critical metadata, and maybe some checks regarding dirty blocks or pending transactions. I also wouldn't be surprised to find some interaction with the journal, if F2FS uses one. Let's see what the code reveals.

map[ContextFile:fs/f2fs/super.c IncludeLines:true Name:__f2fs_remount]

map[SourceCode:2762:	static int __f2fs_remount(struct fs_context *fc, struct super_block *sb)
2763:	{
2764:		struct f2fs_sb_info *sbi = F2FS_SB(sb);
2765:		struct f2fs_mount_info org_mount_opt;
2766:		unsigned long old_sb_flags;
2767:		unsigned int flags = fc->sb_flags;
2768:		int err;
2769:		bool need_restart_gc = false, need_stop_gc = false;
2770:		bool need_restart_flush = false, need_stop_flush = false;
2771:		bool need_restart_discard = false, need_stop_discard = false;
2772:		bool need_enable_checkpoint = false, need_disable_checkpoint = false;
2773:		bool no_read_extent_cache = !test_opt(sbi, READ_EXTENT_CACHE);
2774:		bool no_age_extent_cache = !test_opt(sbi, AGE_EXTENT_CACHE);
2775:		bool enable_checkpoint = !test_opt(sbi, DISABLE_CHECKPOINT);
2776:		bool no_atgc = !test_opt(sbi, ATGC);
2777:		bool no_discard = !test_opt(sbi, DISCARD);
2778:		bool no_compress_cache = !test_opt(sbi, COMPRESS_CACHE);
2779:		bool block_unit_discard = f2fs_block_unit_discard(sbi);
2780:		bool no_nat_bits = !test_opt(sbi, NAT_BITS);
2781:	#ifdef CONFIG_QUOTA
2782:		int i, j;
2783:	#endif
2784:	
2785:		/*
2786:		 * Save the old mount options in case we
2787:		 * need to restore them.
2788:		 */
2789:		org_mount_opt = sbi->mount_opt;
2790:		old_sb_flags = sb->s_flags;
2791:	
2792:		sbi->umount_lock_holder = current;
2793:	
2794:	#ifdef CONFIG_QUOTA
2795:		org_mount_opt.s_jquota_fmt = F2FS_OPTION(sbi).s_jquota_fmt;
2796:		for (i = 0; i < MAXQUOTAS; i++) {
2797:			if (F2FS_OPTION(sbi).s_qf_names[i]) {
2798:				org_mount_opt.s_qf_names[i] =
2799:					kstrdup(F2FS_OPTION(sbi).s_qf_names[i],
2800:					GFP_KERNEL);
2801:				if (!org_mount_opt.s_qf_names[i]) {
2802:					for (j = 0; j < i; j++)
2803:						kfree(org_mount_opt.s_qf_names[j]);
2804:					return -ENOMEM;
2805:				}
2806:			} else {
2807:				org_mount_opt.s_qf_names[i] = NULL;
2808:			}
2809:		}
2810:	#endif
2811:	
2812:		/* recover superblocks we couldn't write due to previous RO mount */
2813:		if (!(flags & SB_RDONLY) && is_sbi_flag_set(sbi, SBI_NEED_SB_WRITE)) {
2814:			err = f2fs_commit_super(sbi, false);
2815:			f2fs_info(sbi, "Try to recover all the superblocks, ret: %d",
2816:				  err);
2817:			if (!err)
2818:				clear_sbi_flag(sbi, SBI_NEED_SB_WRITE);
2819:		}
2820:	
2821:		default_options(sbi, true);
2822:	
2823:		err = f2fs_check_opt_consistency(fc, sb);
2824:		if (err)
2825:			goto restore_opts;
2826:	
2827:		f2fs_apply_options(fc, sb);
2828:	
2829:		err = f2fs_sanity_check_options(sbi, true);
2830:		if (err)
2831:			goto restore_opts;
2832:	
2833:		/* flush outstanding errors before changing fs state */
2834:		flush_work(&sbi->s_error_work);
2835:	
2836:		/*
2837:		 * Previous and new state of filesystem is RO,
2838:		 * so skip checking GC and FLUSH_MERGE conditions.
2839:		 */
2840:		if (f2fs_readonly(sb) && (flags & SB_RDONLY))
2841:			goto skip;
2842:	
2843:		if (f2fs_dev_is_readonly(sbi) && !(flags & SB_RDONLY)) {
2844:			err = -EROFS;
2845:			goto restore_opts;
2846:		}
2847:	
2848:	#ifdef CONFIG_QUOTA
2849:		if (!f2fs_readonly(sb) && (flags & SB_RDONLY)) {
2850:			err = dquot_suspend(sb, -1);
2851:			if (err < 0)
2852:				goto restore_opts;
2853:		} else if (f2fs_readonly(sb) && !(flags & SB_RDONLY)) {
2854:			/* dquot_resume needs RW */
2855:			sb->s_flags &= ~SB_RDONLY;
2856:			if (sb_any_quota_suspended(sb)) {
2857:				dquot_resume(sb, -1);
2858:			} else if (f2fs_sb_has_quota_ino(sbi)) {
2859:				err = f2fs_enable_quotas(sb);
2860:				if (err)
2861:					goto restore_opts;
2862:			}
2863:		}
2864:	#endif
2865:		/* disallow enable atgc dynamically */
2866:		if (no_atgc == !!test_opt(sbi, ATGC)) {
2867:			err = -EINVAL;
2868:			f2fs_warn(sbi, "switch atgc option is not allowed");
2869:			goto restore_opts;
2870:		}
2871:	
2872:		/* disallow enable/disable extent_cache dynamically */
2873:		if (no_read_extent_cache == !!test_opt(sbi, READ_EXTENT_CACHE)) {
2874:			err = -EINVAL;
2875:			f2fs_warn(sbi, "switch extent_cache option is not allowed");
2876:			goto restore_opts;
2877:		}
2878:		/* disallow enable/disable age extent_cache dynamically */
2879:		if (no_age_extent_cache == !!test_opt(sbi, AGE_EXTENT_CACHE)) {
2880:			err = -EINVAL;
2881:			f2fs_warn(sbi, "switch age_extent_cache option is not allowed");
2882:			goto restore_opts;
2883:		}
2884:	
2885:		if (no_compress_cache == !!test_opt(sbi, COMPRESS_CACHE)) {
2886:			err = -EINVAL;
2887:			f2fs_warn(sbi, "switch compress_cache option is not allowed");
2888:			goto restore_opts;
2889:		}
2890:	
2891:		if (block_unit_discard != f2fs_block_unit_discard(sbi)) {
2892:			err = -EINVAL;
2893:			f2fs_warn(sbi, "switch discard_unit option is not allowed");
2894:			goto restore_opts;
2895:		}
2896:	
2897:		if (no_nat_bits == !!test_opt(sbi, NAT_BITS)) {
2898:			err = -EINVAL;
2899:			f2fs_warn(sbi, "switch nat_bits option is not allowed");
2900:			goto restore_opts;
2901:		}
2902:	
2903:		if ((flags & SB_RDONLY) && test_opt(sbi, DISABLE_CHECKPOINT)) {
2904:			err = -EINVAL;
2905:			f2fs_warn(sbi, "disabling checkpoint not compatible with read-only");
2906:			goto restore_opts;
2907:		}
2908:	
2909:		/*
2910:		 * We stop the GC thread if FS is mounted as RO
2911:		 * or if background_gc = off is passed in mount
2912:		 * option. Also sync the filesystem.
2913:		 */
2914:		if ((flags & SB_RDONLY) ||
2915:				(F2FS_OPTION(sbi).bggc_mode == BGGC_MODE_OFF &&
2916:				!test_opt(sbi, GC_MERGE))) {
2917:			if (sbi->gc_thread) {
2918:				f2fs_stop_gc_thread(sbi);
2919:				need_restart_gc = true;
2920:			}
2921:		} else if (!sbi->gc_thread) {
2922:			err = f2fs_start_gc_thread(sbi);
2923:			if (err)
2924:				goto restore_opts;
2925:			need_stop_gc = true;
2926:		}
2927:	
2928:		if (flags & SB_RDONLY) {
2929:			sync_inodes_sb(sb);
2930:	
2931:			set_sbi_flag(sbi, SBI_IS_DIRTY);
2932:			set_sbi_flag(sbi, SBI_IS_CLOSE);
2933:			f2fs_sync_fs(sb, 1);
2934:			clear_sbi_flag(sbi, SBI_IS_CLOSE);
2935:		}
2936:	
2937:		/*
2938:		 * We stop issue flush thread if FS is mounted as RO
2939:		 * or if flush_merge is not passed in mount option.
2940:		 */
2941:		if ((flags & SB_RDONLY) || !test_opt(sbi, FLUSH_MERGE)) {
2942:			clear_opt(sbi, FLUSH_MERGE);
2943:			f2fs_destroy_flush_cmd_control(sbi, false);
2944:			need_restart_flush = true;
2945:		} else {
2946:			err = f2fs_create_flush_cmd_control(sbi);
2947:			if (err)
2948:				goto restore_gc;
2949:			need_stop_flush = true;
2950:		}
2951:	
2952:		if (no_discard == !!test_opt(sbi, DISCARD)) {
2953:			if (test_opt(sbi, DISCARD)) {
2954:				err = f2fs_start_discard_thread(sbi);
2955:				if (err)
2956:					goto restore_flush;
2957:				need_stop_discard = true;
2958:			} else {
2959:				f2fs_stop_discard_thread(sbi);
2960:				f2fs_issue_discard_timeout(sbi);
2961:				need_restart_discard = true;
2962:			}
2963:		}
2964:	
2965:		adjust_unusable_cap_perc(sbi);
2966:		if (enable_checkpoint == !!test_opt(sbi, DISABLE_CHECKPOINT)) {
2967:			if (test_opt(sbi, DISABLE_CHECKPOINT)) {
2968:				err = f2fs_disable_checkpoint(sbi);
2969:				if (err)
2970:					goto restore_discard;
2971:				need_enable_checkpoint = true;
2972:			} else {
2973:				err = f2fs_enable_checkpoint(sbi);
2974:				if (err)
2975:					goto restore_discard;
2976:				need_disable_checkpoint = true;
2977:			}
2978:		}
2979:	
2980:		/*
2981:		 * Place this routine at the end, since a new checkpoint would be
2982:		 * triggered while remount and we need to take care of it before
2983:		 * returning from remount.
2984:		 */
2985:		if ((flags & SB_RDONLY) || test_opt(sbi, DISABLE_CHECKPOINT) ||
2986:				!test_opt(sbi, MERGE_CHECKPOINT)) {
2987:			f2fs_stop_ckpt_thread(sbi);
2988:		} else {
2989:			/* Flush if the previous checkpoint, if exists. */
2990:			f2fs_flush_ckpt_thread(sbi);
2991:	
2992:			err = f2fs_start_ckpt_thread(sbi);
2993:			if (err) {
2994:				f2fs_err(sbi,
2995:				    "Failed to start F2FS issue_checkpoint_thread (%d)",
2996:				    err);
2997:				goto restore_checkpoint;
2998:			}
2999:		}
3000:	
3001:	skip:
3002:	#ifdef CONFIG_QUOTA
3003:		/* Release old quota file names */
3004:		for (i = 0; i < MAXQUOTAS; i++)
3005:			kfree(org_mount_opt.s_qf_names[i]);
3006:	#endif
3007:		/* Update the POSIXACL Flag */
3008:		sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
3009:			(test_opt(sbi, POSIX_ACL) ? SB_POSIXACL : 0);
3010:	
3011:		limit_reserve_root(sbi);
3012:		fc->sb_flags = (flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME);
3013:	
3014:		sbi->umount_lock_holder = NULL;
3015:		return 0;
3016:	restore_checkpoint:
3017:		if (need_enable_checkpoint) {
3018:			if (f2fs_enable_checkpoint(sbi))
3019:				f2fs_warn(sbi, "checkpoint has not been enabled");
3020:		} else if (need_disable_checkpoint) {
3021:			if (f2fs_disable_checkpoint(sbi))
3022:				f2fs_warn(sbi, "checkpoint has not been disabled");
3023:		}
3024:	restore_discard:
3025:		if (need_restart_discard) {
3026:			if (f2fs_start_discard_thread(sbi))
3027:				f2fs_warn(sbi, "discard has been stopped");
3028:		} else if (need_stop_discard) {
3029:			f2fs_stop_discard_thread(sbi);
3030:		}
3031:	restore_flush:
3032:		if (need_restart_flush) {
3033:			if (f2fs_create_flush_cmd_control(sbi))
3034:				f2fs_warn(sbi, "background flush thread has stopped");
3035:		} else if (need_stop_flush) {
3036:			clear_opt(sbi, FLUSH_MERGE);
3037:			f2fs_destroy_flush_cmd_control(sbi, false);
3038:		}
3039:	restore_gc:
3040:		if (need_restart_gc) {
3041:			if (f2fs_start_gc_thread(sbi))
3042:				f2fs_warn(sbi, "background gc thread has stopped");
3043:		} else if (need_stop_gc) {
3044:			f2fs_stop_gc_thread(sbi);
3045:		}
3046:	restore_opts:
3047:	#ifdef CONFIG_QUOTA
3048:		F2FS_OPTION(sbi).s_jquota_fmt = org_mount_opt.s_jquota_fmt;
3049:		for (i = 0; i < MAXQUOTAS; i++) {
3050:			kfree(F2FS_OPTION(sbi).s_qf_names[i]);
3051:			F2FS_OPTION(sbi).s_qf_names[i] = org_mount_opt.s_qf_names[i];
3052:		}
3053:	#endif
3054:		sbi->mount_opt = org_mount_opt;
3055:		sb->s_flags = old_sb_flags;
3056:	
3057:		sbi->umount_lock_holder = NULL;
3058:		return err;
3059:	}
 SourceFile:fs/f2fs/super.c]

gemini-3.1-pro-preview

							input: 93923
							output: 47
							thoughts: 305
						

**Analyzing the F2FS Remount Logic**

Okay, so I'm digging into this `__f2fs_remount` function. It seems like the condition that triggers a call to `f2fs_issue_discard_timeout` is a bit... peculiar. It's when `no_discard` is equivalent to the logical NOT of the `DISCARD` option. That is, it is called specifically when remounting with the `nodiscard` option. This is where things get interesting.

```c
	if (no_discard == !!test_opt(sbi, DISCARD)) {
		if (test_opt(sbi, DISCARD)) {
			err = f2fs_start_discard_thread(sbi);
			if (err)
				goto restore_flush;
			need_stop_discard = true;
		} else {
			f2fs_stop_discard_thread(sbi);
			f2fs_issue_discard_timeout(sbi);
			need_restart_discard = true;
		}
	}
```

My concern is what happens when `f2fs_issue_discard_timeout` returns `false`. This indicates that it was unable to issue all discard commands.  The code simply *ignores* the return value. Is this really safe? It seems like a potential loss of discard operation.

And here's another thing: if `f2fs_bug_on` is a `WARN_ON` and it sets `SBI_NEED_FSCK`, the filesystem gets marked as needing a check. But is that just a warning, or does this potentially create instability? Could we be talking about a crash or memory corruption scenario here? I need to re-examine the `f2fs_issue_discard_timeout` function to get a clear picture. I want to understand the implications of this potential discard command dropping.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:f2fs_issue_discard_timeout]

map[SourceCode:1875:	/**
1876:	 * f2fs_issue_discard_timeout() - Issue all discard cmd within UMOUNT_DISCARD_TIMEOUT
1877:	 * @sbi: the f2fs_sb_info data for discard cmd to issue
1878:	 *
1879:	 * When UMOUNT_DISCARD_TIMEOUT is exceeded, all remaining discard commands will be dropped
1880:	 *
1881:	 * Return true if issued all discard cmd or no discard cmd need issue, otherwise return false.
1882:	 */
1883:	bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi)
1884:	{
1885:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1886:		struct discard_policy dpolicy;
1887:		bool dropped;
1888:	
1889:		if (!atomic_read(&dcc->discard_cmd_cnt))
1890:			return true;
1891:	
1892:		__init_discard_policy(sbi, &dpolicy, DPOLICY_UMOUNT,
1893:						dcc->discard_granularity);
1894:		__issue_discard_cmd(sbi, &dpolicy);
1895:		dropped = __drop_discard_cmd(sbi);
1896:	
1897:		/* just to make sure there is no pending discard commands */
1898:		__wait_all_discard_cmd(sbi, NULL);
1899:	
1900:		f2fs_bug_on(sbi, atomic_read(&dcc->discard_cmd_cnt));
1901:		return !dropped;
1902:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 95185
							output: 44
							thoughts: 50
						

Okay, let's break this down.

**Investigating a Non-Zero Discard Command Count**

Alright, so the code is telling me that `atomic_read(&dcc->discard_cmd_cnt)` isn't zero. That means we have discard commands lingering in the cache, and the system isn't clearing them as expected. Why is that? I need to figure out the root cause here. This isn't normal behavior. My gut says there's a problem with how those commands are being processed or flushed.

Let's quickly check the implementation of `__drop_discard_cmd`. That's where the decrement should be happening. Knowing how that function works is key to understanding why that counter wouldn't go to zero. I'll need to look carefully at the logic there – are there any error paths skipping the decrement? Are there race conditions? I'll probably need to understand where and how that function is called. This whole situation requires a deeper dive.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__drop_discard_cmd]

map[SourceCode:1712:	static bool __drop_discard_cmd(struct f2fs_sb_info *sbi)
1713:	{
1714:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1715:		struct list_head *pend_list;
1716:		struct discard_cmd *dc, *tmp;
1717:		int i;
1718:		bool dropped = false;
1719:	
1720:		mutex_lock(&dcc->cmd_lock);
1721:		for (i = MAX_PLIST_NUM - 1; i >= 0; i--) {
1722:			pend_list = &dcc->pend_list[i];
1723:			list_for_each_entry_safe(dc, tmp, pend_list, list) {
1724:				f2fs_bug_on(sbi, dc->state != D_PREP);
1725:				__remove_discard_cmd(sbi, dc);
1726:				dropped = true;
1727:			}
1728:		}
1729:		mutex_unlock(&dcc->cmd_lock);
1730:	
1731:		return dropped;
1732:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 95858
							output: 46
							thoughts: 60
						

Okay, let's break this down.

**My Analysis of Discard Command Management**

Right, so `__drop_discard_cmd` is responsible for cleaning up discard commands. Specifically, it targets commands currently sitting in `pend_list` and, importantly, only those in the `D_PREP` state. That makes sense, a prepped discard should be able to be dropped.

Now, I need to consider a potential edge case. What happens to discard commands waiting in `wait_list`? Are those taken care of here? I need to check. To make sure I understand the full picture, I need to see what `__wait_all_discard_cmd` does. That should cover the remaining discard commands.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__wait_all_discard_cmd]

map[SourceCode:1800:	static unsigned int __wait_all_discard_cmd(struct f2fs_sb_info *sbi,
1801:							struct discard_policy *dpolicy)
1802:	{
1803:		struct discard_policy dp;
1804:		unsigned int discard_blks;
1805:	
1806:		if (dpolicy)
1807:			return __wait_discard_cmd_range(sbi, dpolicy, 0, UINT_MAX);
1808:	
1809:		/* wait all */
1810:		__init_discard_policy(sbi, &dp, DPOLICY_FSTRIM, MIN_DISCARD_GRANULARITY);
1811:		discard_blks = __wait_discard_cmd_range(sbi, &dp, 0, UINT_MAX);
1812:		__init_discard_policy(sbi, &dp, DPOLICY_UMOUNT, MIN_DISCARD_GRANULARITY);
1813:		discard_blks += __wait_discard_cmd_range(sbi, &dp, 0, UINT_MAX);
1814:	
1815:		return discard_blks;
1816:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 96470
							output: 46
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience, presented in the first person:

**Analyzing the `__wait_discard_cmd_range` Function**

Alright, let's dive into this `__wait_discard_cmd_range` function. Immediately, my mind jumps to the core of what this likely handles: managing command submission and completion, particularly in the context of discarding data. The double underscore prefix usually indicates a "private" or internal function, so it's probably deeply ingrained within the driver or storage stack. I'm immediately thinking about race conditions. We're talking about waiting, which implies synchronization. Discarding implies some kind of write operation or invalidation. What exactly is the range? Is it for flash memory blocks, sectors, logical blocks, what? Understanding the granularity is crucial. Is this an atomic operation, or is this function coordinating a series of operations? The command range probably dictates the scope of this wait and discard mechanism. I’m also wondering about potential interactions with other operations; does this have to deal with prefetch requests, write-back caching, or garbage collection? I need to look at this function to see how it is working, and how the internal logic of the function is implemented.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__wait_discard_cmd_range]

map[SourceCode:1759:	static unsigned int __wait_discard_cmd_range(struct f2fs_sb_info *sbi,
1760:							struct discard_policy *dpolicy,
1761:							block_t start, block_t end)
1762:	{
1763:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1764:		struct list_head *wait_list = (dpolicy->type == DPOLICY_FSTRIM) ?
1765:						&(dcc->fstrim_list) : &(dcc->wait_list);
1766:		struct discard_cmd *dc = NULL, *iter, *tmp;
1767:		unsigned int trimmed = 0;
1768:	
1769:	next:
1770:		dc = NULL;
1771:	
1772:		mutex_lock(&dcc->cmd_lock);
1773:		list_for_each_entry_safe(iter, tmp, wait_list, list) {
1774:			if (iter->di.lstart + iter->di.len <= start ||
1775:						end <= iter->di.lstart)
1776:				continue;
1777:			if (iter->di.len < dpolicy->granularity)
1778:				continue;
1779:			if (iter->state == D_DONE && !iter->ref) {
1780:				wait_for_completion_io(&iter->wait);
1781:				if (!iter->error)
1782:					trimmed += iter->di.len;
1783:				__remove_discard_cmd(sbi, iter);
1784:			} else {
1785:				iter->ref++;
1786:				dc = iter;
1787:				break;
1788:			}
1789:		}
1790:		mutex_unlock(&dcc->cmd_lock);
1791:	
1792:		if (dc) {
1793:			trimmed += __wait_one_discard_bio(sbi, dc);
1794:			goto next;
1795:		}
1796:	
1797:		return trimmed;
1798:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 97425
							output: 52
							thoughts: 776
						

**Analyzing F2FS Discard Command Management**

Okay, so I'm diving into this F2FS discard command logic. My initial thought process is centered around how the `__wait_discard_cmd_range` function works, specifically its role in waiting for and matching discard commands based on their range and granularity within either the `wait_list` or `fstrim_list`. I see that `__wait_all_discard_cmd` calls this with both `DPOLICY_FSTRIM` and `DPOLICY_UMOUNT`, utilizing `MIN_DISCARD_GRANULARITY`.

A potential concern pops into my head: what happens if discard commands exist in `wait_list` with lengths smaller than `MIN_DISCARD_GRANULARITY`? But then I quickly remember that `MIN_DISCARD_GRANULARITY` is 1, making any length less than that impossible. That's a sanity check out of the way.

Next, I wondered about discard commands in the `pend_list` that aren't in the `D_PREP` state. The code snippet in `__drop_discard_cmd` includes a `f2fs_bug_on` check for that very scenario. It seems that commands in the `pend_list` *should* always be in the `D_PREP` state, or the bug will trigger. So, I see the intention.

The lingering question is about `atomic_read(&dcc->discard_cmd_cnt)` not being zero after `__wait_all_discard_cmd`. This *should* be zero because all commands from `pend_list`, `wait_list`, and `fstrim_list` are cleaned. However, what if some commands are not in any of these lists? I immediately think that is unlikely.

But, I need to check: Could it be that `__issue_discard_cmd` isn't issuing all commands? I look again, and I see that it issues commands from `pend_list` to `wait_list`. The key here is `__drop_discard_cmd`, which *removes ALL* commands from `pend_list`, so `pend_list` should be empty. Then `__wait_all_discard_cmd` waits for and removes all commands from `wait_list` and `fstrim_list`. Thus, all lists *should* be empty, and I *should* see `discard_cmd_cnt` is zero.

So, why isn't it? Is there a leak in `discard_cmd_cnt`, or are discard commands possibly added concurrently? I start to explore the possibilities.

My focus shifts to `f2fs_issue_discard_timeout`, looking for clues. I find it in `__f2fs_remount`. Critically, `f2fs_stop_discard_thread(sbi)` stops the discard thread. This is important: the discard thread isn't running. This eliminates concurrent additions from the dedicated discard thread.

Finally, I need to understand if other threads can add commands. I will now track down where `__add_discard_cmd`, `f2fs_add_discard_cmd`, or `f2fs_issue_discard` are called to understand exactly which code paths could potentially add discard commands.

requested entity does not exist

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:__add_discard_cmd SourceTreePrefix:]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 98981
							output: 51
							thoughts: 11
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to an expert:

**Checking `discard_cmd_cnt`**

Alright, let's take a look at `discard_cmd_cnt`. I need to assess its current state and significance. I'm thinking, this counter likely plays a key role in tracking the number of discarded commands, which could provide critical insight into potential issues with command processing – perhaps bottlenecks, errors, or resource limitations. Depending on the system, a high or rapidly increasing value could be indicative of a significant problem, warranting immediate attention. Conversely, a stable and low count might suggest things are operating normally. I should consider what triggers command discarding within this system. Does it relate to specific errors, resource exhaustion, or maybe even configuration settings? Understanding the context around why a command might be discarded is crucial for proper troubleshooting and optimization. I'll need to correlate this data with other metrics, of course.

requested entity does not exist

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:discard_cmd_cnt SourceTreePrefix:]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 99266
							output: 57
							thoughts: 16
						

Okay, let's see...

**Deconstructing the `discard_cmd_control` Structure**

Hmm, so I'm focusing on the `discard_cmd_control` structure right now. It's clearly a field within that structure that's got my attention. It's a key element, obviously. What precisely it *does* within that `discard_cmd_control` context is the critical question. Now, I need to understand what that field represents in order to proceed effectively. Let me see where that takes me.

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:discard_cmd_control::discard_cmd_cnt SourceTreePrefix:]

map[References:[map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__create_discard_cmd SourceFile:fs/f2fs/segment.c SourceLine:992] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__detach_discard_cmd SourceFile:fs/f2fs/segment.c SourceLine:1115] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__init_discard_policy SourceFile:fs/f2fs/segment.c SourceLine:1216] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:create_discard_cmd_control SourceFile:fs/f2fs/segment.c SourceLine:2332] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:f2fs_available_free_memory SourceFile:fs/f2fs/node.c SourceLine:104] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:f2fs_issue_discard_timeout SourceFile:fs/f2fs/segment.c SourceLine:1889] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:f2fs_issue_discard_timeout SourceFile:fs/f2fs/segment.c SourceLine:1900] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:issue_discard_thread SourceFile:fs/f2fs/segment.c SourceLine:1940] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:issue_discard_thread SourceFile:fs/f2fs/segment.c SourceLine:1958] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:pending_discard_show SourceFile:fs/f2fs/sysfs.c SourceLine:152] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:update_general_status SourceFile:fs/f2fs/debug.c SourceLine:193] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:update_mem_info SourceFile:fs/f2fs/debug.c SourceLine:365]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 100157
							output: 44
							thoughts: 44
						

Here's my analysis of the provided code snippet:

**Analyzing Discard Command Management**

Okay, so I see that the `discard_cmd_cnt` variable is the key to tracking the discard commands. From the snippet, it's pretty clear that it's incremented during command creation (`__create_discard_cmd`) and decremented during detachment (`__detach_discard_cmd`). That's a standard pattern for managing resources with a counter. 

Given this, I should focus my attention on `__detach_discard_cmd` to see the logic behind decrementing the counter. Understanding the detachment process will tell me how these discard commands are properly cleaned up. Let's delve into that function and see what's happening.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__detach_discard_cmd]

map[SourceCode:1103:	static void __detach_discard_cmd(struct discard_cmd_control *dcc,
1104:								struct discard_cmd *dc)
1105:	{
1106:		if (dc->state == D_DONE)
1107:			atomic_sub(dc->queued, &dcc->queued_discard);
1108:	
1109:		list_del(&dc->list);
1110:		rb_erase_cached(&dc->rb_node, &dcc->root);
1111:		dcc->undiscard_blks -= dc->di.len;
1112:	
1113:		kmem_cache_free(discard_cmd_slab, dc);
1114:	
1115:		atomic_dec(&dcc->discard_cmd_cnt);
1116:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 100655
							output: 44
							thoughts: 18
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Delving into the Command Execution Flow**

Right, so I'm looking at this execution chain, and it's clear: `__remove_discard_cmd` has to call `__detach_discard_cmd`. That relationship is fundamental to the proper operation of the system. I see that `__remove_discard_cmd` probably orchestrates the removal logic, but the actual detachment of resources, the critical step of severing the link to the item being discarded, is handled by `__detach_discard_cmd`. My guess is the former preps the item for removal and the latter actually does it, ensuring that state is consistent throughout the process. I'll need to drill down and see how that is handled.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__remove_discard_cmd]

map[SourceCode:1118:	static void __remove_discard_cmd(struct f2fs_sb_info *sbi,
1119:								struct discard_cmd *dc)
1120:	{
1121:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1122:		unsigned long flags;
1123:	
1124:		trace_f2fs_remove_discard(dc->bdev, dc->di.start, dc->di.len);
1125:	
1126:		spin_lock_irqsave(&dc->lock, flags);
1127:		if (dc->bio_ref) {
1128:			spin_unlock_irqrestore(&dc->lock, flags);
1129:			return;
1130:		}
1131:		spin_unlock_irqrestore(&dc->lock, flags);
1132:	
1133:		f2fs_bug_on(sbi, dc->ref);
1134:	
1135:		if (dc->error == -EOPNOTSUPP)
1136:			dc->error = 0;
1137:	
1138:		if (dc->error)
1139:			f2fs_info_ratelimited(sbi,
1140:				"Issue discard(%u, %u, %u) failed, ret: %d",
1141:				dc->di.lstart, dc->di.start, dc->di.len, dc->error);
1142:		__detach_discard_cmd(dcc, dc);
1143:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 101353
							output: 47
							thoughts: 279
						

**Analyzing the Discard Command Flow**

Okay, so I'm looking at this `__remove_discard_cmd` function, and there's something that feels off. Specifically, it has this critical section:

```c
	spin_lock_irqsave(&dc->lock, flags);
	if (dc->bio_ref) {
		spin_unlock_irqrestore(&dc->lock, flags);
		return;
	}
	spin_unlock_irqrestore(&dc->lock, flags);
```

Basically, if `dc->bio_ref` isn't zero, it just *returns*. It doesn't detach the discard command. This implies that the discard command is left in the list and critically, `discard_cmd_cnt` isn't decremented. 

Wait a minute, if `dc->bio_ref` isn't zero, that suggests the BIO is still active, or "in-flight" as we say. But, then I'm looking at `__wait_discard_cmd_range`, and it has this logic:

```c
		if (iter->state == D_DONE && !iter->ref) {
			wait_for_completion_io(&iter->wait);
			if (!iter->error)
				trimmed += iter->di.len;
			__remove_discard_cmd(sbi, iter);
		}
```

Here, if `iter->state == D_DONE`, the BIO should have definitely completed, right? We're waiting on a completion. So, why wouldn't the command be safe to remove?

I need to dig deeper here and trace the lifecycle of these discard commands. I should check `f2fs_submit_discard_endio` to fully understand what's happening.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:f2fs_submit_discard_endio]

map[SourceCode:1145:	static void f2fs_submit_discard_endio(struct bio *bio)
1146:	{
1147:		struct discard_cmd *dc = (struct discard_cmd *)bio->bi_private;
1148:		unsigned long flags;
1149:	
1150:		spin_lock_irqsave(&dc->lock, flags);
1151:		if (!dc->error)
1152:			dc->error = blk_status_to_errno(bio->bi_status);
1153:		dc->bio_ref--;
1154:		if (!dc->bio_ref && dc->state == D_SUBMIT) {
1155:			dc->state = D_DONE;
1156:			complete_all(&dc->wait);
1157:		}
1158:		spin_unlock_irqrestore(&dc->lock, flags);
1159:		bio_put(bio);
1160:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 102353
							output: 46
							thoughts: 579
						

**Analyzing F2FS Discard Command States and Bio References**

Okay, let's break this down. My initial thought was about the state `D_DONE`. If `dc->state` is `D_DONE`, it *should* mean `dc->bio_ref` was zero when `f2fs_submit_discard_endio` set the state. But wait... Could `bio_ref` be incremented *after* that? No, that's right, `bio_ref` is only touched during bio submission. So, the implication here is that if `dc->state == D_DONE`, the `bio_ref` *must* be 0. Which then begs the question, why would `__remove_discard_cmd` ever return early in this scenario? I need to think this through and not just make assumptions.

Ah, I see it now. The important part is, what if `dc->state` is *not* `D_DONE`? Looking at `__drop_discard_cmd`, the context changes. Here, within the nested loop, `dc->state` *is* actually `D_PREP`. This is crucial. Now, with `D_PREP`, the `dc->bio_ref` will be zero. It has not been submitted yet and this makes sense. That's why `__remove_discard_cmd` detaches it. That makes sense.

Now I am thinking about `__wait_discard_cmd_range`. Let's step through this. The loop examines commands in the `wait_list`. If the command's range doesn't intersect with the current `start` and `end`, then it continues. It also continues if the command's length is smaller than the granularity. But the interesting part is if the command is `D_DONE` *and* its `ref` is zero: it waits for completion, and then removes it, which is the expected case. If it's not `D_DONE`, or the `ref` is not zero, the loop breaks and waits for the command `dc`. This requires a check for the non `D_DONE` case.

It breaks the loop and calls `__wait_one_discard_bio` for the `dc`, and this continues processing, which makes sense. I will now examine `__wait_one_discard_bio`.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__wait_one_discard_bio]

map[SourceCode:1739:	static unsigned int __wait_one_discard_bio(struct f2fs_sb_info *sbi,
1740:								struct discard_cmd *dc)
1741:	{
1742:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1743:		unsigned int len = 0;
1744:	
1745:		wait_for_completion_io(&dc->wait);
1746:		mutex_lock(&dcc->cmd_lock);
1747:		f2fs_bug_on(sbi, dc->state != D_DONE);
1748:		dc->ref--;
1749:		if (!dc->ref) {
1750:			if (!dc->error)
1751:				len = dc->di.len;
1752:			__remove_discard_cmd(sbi, dc);
1753:		}
1754:		mutex_unlock(&dcc->cmd_lock);
1755:	
1756:		return len;
1757:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 103802
							output: 44
							thoughts: 125
						

Okay, let me break this down.

**Analyzing the Discard Command Flow**

Alright, so `__wait_one_discard_bio` is essentially the cleanup function. It's waiting for the operation to finish, decreasing the reference count (`ref`), and then, if that count hits zero, it removes the discard command entirely. Makes sense so far.

But, a nagging thought is creeping in: What if the `dc->state` is either `D_PREP` or `D_PARTIAL`? If the state is `D_PREP`, I'm pretty sure `wait_for_completion_io(&dc->wait)` will lock up the system indefinitely because the command never gets submitted to the device in that initial state!

Now, wait a second. My memory is jogged and the `wait_list` structure is only meant to contain commands that have actually been submitted, right? That means `D_PREP` or `D_PARTIAL` states are problematic. I'd better double check the logic in `__issue_discard_cmd` to see why that's even possible in the first place. This bears further investigation.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__issue_discard_cmd]

map[SourceCode:1639:	static int __issue_discard_cmd(struct f2fs_sb_info *sbi,
1640:						struct discard_policy *dpolicy)
1641:	{
1642:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1643:		struct list_head *pend_list;
1644:		struct discard_cmd *dc, *tmp;
1645:		struct blk_plug plug;
1646:		int i, issued;
1647:		bool io_interrupted = false;
1648:	
1649:		if (dpolicy->timeout)
1650:			f2fs_update_time(sbi, UMOUNT_DISCARD_TIMEOUT);
1651:	
1652:	retry:
1653:		issued = 0;
1654:		for (i = MAX_PLIST_NUM - 1; i >= 0; i--) {
1655:			if (dpolicy->timeout &&
1656:					f2fs_time_over(sbi, UMOUNT_DISCARD_TIMEOUT))
1657:				break;
1658:	
1659:			if (i + 1 < dpolicy->granularity)
1660:				break;
1661:	
1662:			if (i + 1 < dcc->max_ordered_discard && dpolicy->ordered) {
1663:				__issue_discard_cmd_orderly(sbi, dpolicy, &issued);
1664:				return issued;
1665:			}
1666:	
1667:			pend_list = &dcc->pend_list[i];
1668:	
1669:			mutex_lock(&dcc->cmd_lock);
1670:			if (list_empty(pend_list))
1671:				goto next;
1672:			if (unlikely(dcc->rbtree_check))
1673:				f2fs_bug_on(sbi, !f2fs_check_discard_tree(sbi));
1674:			blk_start_plug(&plug);
1675:			list_for_each_entry_safe(dc, tmp, pend_list, list) {
1676:				f2fs_bug_on(sbi, dc->state != D_PREP);
1677:	
1678:				if (dpolicy->timeout &&
1679:					f2fs_time_over(sbi, UMOUNT_DISCARD_TIMEOUT))
1680:					break;
1681:	
1682:				if (dpolicy->io_aware && i < dpolicy->io_aware_gran &&
1683:							!is_idle(sbi, DISCARD_TIME)) {
1684:					io_interrupted = true;
1685:					break;
1686:				}
1687:	
1688:				__submit_discard_cmd(sbi, dpolicy, dc, &issued);
1689:	
1690:				if (issued >= dpolicy->max_requests)
1691:					break;
1692:			}
1693:			blk_finish_plug(&plug);
1694:	next:
1695:			mutex_unlock(&dcc->cmd_lock);
1696:	
1697:			if (issued >= dpolicy->max_requests || io_interrupted)
1698:				break;
1699:		}
1700:	
1701:		if (dpolicy->type == DPOLICY_UMOUNT && issued) {
1702:			__wait_all_discard_cmd(sbi, dpolicy);
1703:			goto retry;
1704:		}
1705:	
1706:		if (!issued && io_interrupted)
1707:			issued = -1;
1708:	
1709:		return issued;
1710:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 105313
							output: 55
							thoughts: 224
						

**Analyzing the Discard Command Flow**

Okay, so I'm diving into this `__issue_discard_cmd` function. If the discard policy has a timeout enabled, meaning `dpolicy->timeout` is true, it checks if enough time has passed using `f2fs_time_over` with `UMOUNT_DISCARD_TIMEOUT`. If that timeout has expired, the loop breaks, and it returns the 'issued' status. The concern is, if the timeout is hit, there might still be discard commands lingering in the `pend_list`.

Essentially, if the timeout triggers, `f2fs_issue_discard_timeout` gets called, which then calls `__drop_discard_cmd(sbi)`. That function is supposed to clear out all the remaining commands from the `pend_list`. After that, `__wait_all_discard_cmd(sbi, NULL)` is invoked to ensure all outstanding commands in the `wait_list` and the `fstrim_list` are completed. At this point, I would expect the `pend_list`, `wait_list`, and `fstrim_list` to be empty. This implies the total discard command count, `discard_cmd_cnt`, should be zero.

But here's where my mind starts to wander. What about the `entry_list`? Are there scenarios where discard commands could end up there and not be properly handled by this timeout mechanism? I need to verify what happens to the entries present in the `entry_list`. I need to dig deeper into the code and see what might be going on there. I need to understand if this is an edge case or a legitimate problem. Let's start by checking the `entry_list`...

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:discard_cmd_control::entry_list SourceTreePrefix:]

map[References:[map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:add_discard_addrs SourceFile:fs/f2fs/segment.c SourceLine:2085] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:create_discard_cmd_control SourceFile:fs/f2fs/segment.c SourceLine:2324] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:f2fs_clear_prefree_segments SourceFile:fs/f2fs/segment.c SourceLine:2171] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:f2fs_release_discard_addrs SourceFile:fs/f2fs/segment.c SourceLine:2145]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 106218
							output: 48
							thoughts: 16
						

Okay, let's dive into this. Here's my thought process on tackling `f2fs_clear_prefree_segments`:

**Analyzing f2fs_clear_prefree_segments**

Alright, I'm going to take a look at `f2fs_clear_prefree_segments`. My initial thought is to figure out its purpose within the F2FS filesystem. I know the general function naming convention suggests it has something to do with clearing prefree segments, which, if my memory serves, are those segments marked for potential reuse before actual allocation. So, the question is how this function contributes to that process. What's it doing with those prefree segments? Is it about marking, unmarking, or actually erasing the data? I'll probably be looking for its interaction with the block mapping table and the overall free space management in F2FS. I'll need to understand how it fits into the garbage collection and wear-leveling strategies. I'm expecting this is a fairly low-level function, so the details might be a little gnarly, but that's what I'm here for. Let's see what's actually going on.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:f2fs_clear_prefree_segments]

map[SourceCode:2167:	void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi,
2168:							struct cp_control *cpc)
2169:	{
2170:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
2171:		struct list_head *head = &dcc->entry_list;
2172:		struct discard_entry *entry, *this;
2173:		struct dirty_seglist_info *dirty_i = DIRTY_I(sbi);
2174:		unsigned long *prefree_map = dirty_i->dirty_segmap[PRE];
2175:		unsigned int start = 0, end = -1;
2176:		unsigned int secno, start_segno;
2177:		bool force = (cpc->reason & CP_DISCARD);
2178:		bool section_alignment = F2FS_OPTION(sbi).discard_unit ==
2179:							DISCARD_UNIT_SECTION;
2180:	
2181:		if (f2fs_lfs_mode(sbi) && __is_large_section(sbi))
2182:			section_alignment = true;
2183:	
2184:		mutex_lock(&dirty_i->seglist_lock);
2185:	
2186:		while (1) {
2187:			int i;
2188:	
2189:			if (section_alignment && end != -1)
2190:				end--;
2191:			start = find_next_bit(prefree_map, MAIN_SEGS(sbi), end + 1);
2192:			if (start >= MAIN_SEGS(sbi))
2193:				break;
2194:			end = find_next_zero_bit(prefree_map, MAIN_SEGS(sbi),
2195:									start + 1);
2196:	
2197:			if (section_alignment) {
2198:				start = rounddown(start, SEGS_PER_SEC(sbi));
2199:				end = roundup(end, SEGS_PER_SEC(sbi));
2200:			}
2201:	
2202:			for (i = start; i < end; i++) {
2203:				if (test_and_clear_bit(i, prefree_map))
2204:					dirty_i->nr_dirty[PRE]--;
2205:			}
2206:	
2207:			if (!f2fs_realtime_discard_enable(sbi))
2208:				continue;
2209:	
2210:			if (force && start >= cpc->trim_start &&
2211:						(end - 1) <= cpc->trim_end)
2212:				continue;
2213:	
2214:			/* Should cover 2MB zoned device for zone-based reset */
2215:			if (!f2fs_sb_has_blkzoned(sbi) &&
2216:			    (!f2fs_lfs_mode(sbi) || !__is_large_section(sbi))) {
2217:				f2fs_issue_discard(sbi, START_BLOCK(sbi, start),
2218:					SEGS_TO_BLKS(sbi, end - start));
2219:				continue;
2220:			}
2221:	next:
2222:			secno = GET_SEC_FROM_SEG(sbi, start);
2223:			start_segno = GET_SEG_FROM_SEC(sbi, secno);
2224:			if (!is_cursec(sbi, secno) &&
2225:				!get_valid_blocks(sbi, start, true))
2226:				f2fs_issue_discard(sbi, START_BLOCK(sbi, start_segno),
2227:							BLKS_PER_SEC(sbi));
2228:	
2229:			start = start_segno + SEGS_PER_SEC(sbi);
2230:			if (start < end)
2231:				goto next;
2232:			else
2233:				end = start - 1;
2234:		}
2235:		mutex_unlock(&dirty_i->seglist_lock);
2236:	
2237:		if (!f2fs_block_unit_discard(sbi))
2238:			goto wakeup;
2239:	
2240:		/* send small discards */
2241:		list_for_each_entry_safe(entry, this, head, list) {
2242:			unsigned int cur_pos = 0, next_pos, len, total_len = 0;
2243:			bool is_valid = test_bit_le(0, entry->discard_map);
2244:	
2245:	find_next:
2246:			if (is_valid) {
2247:				next_pos = find_next_zero_bit_le(entry->discard_map,
2248:							BLKS_PER_SEG(sbi), cur_pos);
2249:				len = next_pos - cur_pos;
2250:	
2251:				if (f2fs_sb_has_blkzoned(sbi) ||
2252:				    (force && len < cpc->trim_minlen))
2253:					goto skip;
2254:	
2255:				f2fs_issue_discard(sbi, entry->start_blkaddr + cur_pos,
2256:										len);
2257:				total_len += len;
2258:			} else {
2259:				next_pos = find_next_bit_le(entry->discard_map,
2260:							BLKS_PER_SEG(sbi), cur_pos);
2261:			}
2262:	skip:
2263:			cur_pos = next_pos;
2264:			is_valid = !is_valid;
2265:	
2266:			if (cur_pos < BLKS_PER_SEG(sbi))
2267:				goto find_next;
2268:	
2269:			release_discard_addr(entry);
2270:			dcc->nr_discards -= total_len;
2271:		}
2272:	
2273:	wakeup:
2274:		wake_up_discard_thread(sbi, false);
2275:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 108329
							output: 53
							thoughts: 605
						

**My Deep Dive into F2FS Discard Operations**

Okay, so I'm digging into how F2FS handles discard commands, and it's got some interesting nuances. First, `f2fs_issue_discard` adds these commands, that makes sense. But the `f2fs_issue_discard_timeout` function is throwing me for a loop. It's supposed to wait for all the commands, but if it's called, say, during a remount, what about discard commands waiting in `entry_list`? It looks like `f2fs_issue_discard_timeout` *doesn't* actually touch `entry_list` at all. That's a critical detail.

I see that `f2fs_issue_discard_timeout` is called within `__f2fs_remount` if the `DISCARD` option isn't enabled. Specifically:

```c
		if (no_discard == !!test_opt(sbi, DISCARD)) {
			if (test_opt(sbi, DISCARD)) {
				err = f2fs_start_discard_thread(sbi);
				if (err)
					goto restore_flush;
				need_stop_discard = true;
			} else {
				f2fs_stop_discard_thread(sbi);
				f2fs_issue_discard_timeout(sbi);
				need_restart_discard = true;
			}
		}
```

So, if the discard thread is stopped (via `f2fs_stop_discard_thread`), then `f2fs_issue_discard_timeout` is invoked. But, as I understand it, any pending discards in `entry_list` are *not* processed by `f2fs_issue_discard_timeout`. 

Now, let's clarify `entry_list`. `entry_list` holds `discard_entry` structures, right? These are converted to `discard_cmd` structures by `f2fs_issue_discard`? No, wait, that's not quite right. `f2fs_issue_discard` uses `__add_discard_cmd` to create `discard_cmd` structures and put them into `pend_list`, not `entry_list`. `entry_list` contains the `discard_entry` structures, which are processed in `f2fs_clear_prefree_segments`. Got it.

Okay, so `discard_cmd_cnt` is the *number* of `discard_cmd` structures, which makes sense. There's a condition in `__remove_discard_cmd` where it returns early if `dc->bio_ref` isn't zero. If that happens, `discard_cmd_cnt` *isn't* decremented. Hmm... why wouldn't `dc->bio_ref` be zero? Ah, because the I/O for that discard command is still in flight. 

`__wait_one_discard_bio` seems to be responsible for waiting on a bio completion:

```c
	wait_for_completion_io(&dc->wait);
```

So, once the bio completes, `f2fs_submit_discard_endio` is called, which decrements `dc->bio_ref`. But... is there any other place where `dc->bio_ref` could be incremented? I need to track down all the places where `dc->bio_ref` is touched to be absolutely sure. This could be a potential race condition or bug if there's a missed decrement. Gotta check.

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:discard_cmd::bio_ref SourceTreePrefix:]

map[References:[map[ReferenceKind:writes ReferencingEntityKind:function ReferencingEntityName:__create_discard_cmd SourceFile:fs/f2fs/segment.c SourceLine:991] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:__remove_discard_cmd SourceFile:fs/f2fs/segment.c SourceLine:1127] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__submit_discard_cmd SourceFile:fs/f2fs/segment.c SourceLine:1359] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:__submit_zone_reset_cmd SourceFile:fs/f2fs/segment.c SourceLine:1254] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:f2fs_submit_discard_endio SourceFile:fs/f2fs/segment.c SourceLine:1153] map[ReferenceKind:reads ReferencingEntityKind:function ReferencingEntityName:f2fs_submit_discard_endio SourceFile:fs/f2fs/segment.c SourceLine:1154]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 110120
							output: 44
							thoughts: 12
						

Okay, here's my interpretation of that thought process, assuming I'm deeply familiar with code and likely in the middle of debugging or reviewing:

**Checking `__submit_discard_cmd`**

Alright, time to dive into this. "Let's check `__submit_discard_cmd`." That's the core of what's on my mind right now. I'm zeroing in on this specific function. It's probably a crucial piece of the puzzle, likely involved in managing some sort of data submission or discarding process. Could be anything, from a database transaction, a UI interaction, or internal state management. The double underscores usually tell me this is a private or internal method, so I need to understand its role and why it's potentially causing an issue or is relevant to the problem I'm trying to solve. What's it doing and what am I expecting to happen when it gets triggered? Is there a reason why this needs checking? Are there known issues relating to this specific functionality? I need to analyze its implementation, its call sites, and any associated logging or error handling to fully understand its behavior and why it needs my attention. Let's see what's in there...

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__submit_discard_cmd]

map[SourceCode:1277:	/* this function is copied from blkdev_issue_discard from block/blk-lib.c */
1278:	static int __submit_discard_cmd(struct f2fs_sb_info *sbi,
1279:					struct discard_policy *dpolicy,
1280:					struct discard_cmd *dc, int *issued)
1281:	{
1282:		struct block_device *bdev = dc->bdev;
1283:		unsigned int max_discard_blocks =
1284:				SECTOR_TO_BLOCK(bdev_max_discard_sectors(bdev));
1285:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1286:		struct list_head *wait_list = (dpolicy->type == DPOLICY_FSTRIM) ?
1287:						&(dcc->fstrim_list) : &(dcc->wait_list);
1288:		blk_opf_t flag = dpolicy->sync ? REQ_SYNC : 0;
1289:		block_t lstart, start, len, total_len;
1290:	
1291:		if (dc->state != D_PREP)
1292:			return 0;
1293:	
1294:		if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))
1295:			return 0;
1296:	
1297:	#ifdef CONFIG_BLK_DEV_ZONED
1298:		if (f2fs_sb_has_blkzoned(sbi) && bdev_is_zoned(bdev)) {
1299:			int devi = f2fs_bdev_index(sbi, bdev);
1300:	
1301:			if (devi < 0)
1302:				return -EINVAL;
1303:	
1304:			if (f2fs_blkz_is_seq(sbi, devi, dc->di.start)) {
1305:				__submit_zone_reset_cmd(sbi, dc, flag,
1306:							wait_list, issued);
1307:				return 0;
1308:			}
1309:		}
1310:	#endif
1311:	
1312:		/*
1313:		 * stop issuing discard for any of below cases:
1314:		 * 1. device is conventional zone, but it doesn't support discard.
1315:		 * 2. device is regulare device, after snapshot it doesn't support
1316:		 * discard.
1317:		 */
1318:		if (!bdev_max_discard_sectors(bdev))
1319:			return -EOPNOTSUPP;
1320:	
1321:		trace_f2fs_issue_discard(bdev, dc->di.start, dc->di.len);
1322:	
1323:		lstart = dc->di.lstart;
1324:		start = dc->di.start;
1325:		len = dc->di.len;
1326:		total_len = len;
1327:	
1328:		dc->di.len = 0;
1329:	
1330:		while (total_len && *issued < dpolicy->max_requests) {
1331:			struct bio *bio = NULL;
1332:			unsigned long flags;
1333:			bool last = true;
1334:	
1335:			if (len > max_discard_blocks) {
1336:				len = max_discard_blocks;
1337:				last = false;
1338:			}
1339:	
1340:			(*issued)++;
1341:			if (*issued == dpolicy->max_requests)
1342:				last = true;
1343:	
1344:			dc->di.len += len;
1345:	
1346:			__blkdev_issue_discard(bdev, SECTOR_FROM_BLOCK(start),
1347:					SECTOR_FROM_BLOCK(len), GFP_NOFS, &bio);
1348:			f2fs_bug_on(sbi, !bio);
1349:	
1350:			/*
1351:			 * should keep before submission to avoid D_DONE
1352:			 * right away
1353:			 */
1354:			spin_lock_irqsave(&dc->lock, flags);
1355:			if (last)
1356:				dc->state = D_SUBMIT;
1357:			else
1358:				dc->state = D_PARTIAL;
1359:			dc->bio_ref++;
1360:			spin_unlock_irqrestore(&dc->lock, flags);
1361:	
1362:			atomic_inc(&dcc->queued_discard);
1363:			dc->queued++;
1364:			list_move_tail(&dc->list, wait_list);
1365:	
1366:			/* sanity check on discard range */
1367:			__check_sit_bitmap(sbi, lstart, lstart + len);
1368:	
1369:			bio->bi_private = dc;
1370:			bio->bi_end_io = f2fs_submit_discard_endio;
1371:			bio->bi_opf |= flag;
1372:			submit_bio(bio);
1373:	
1374:			atomic_inc(&dcc->issued_discard);
1375:	
1376:			f2fs_update_iostat(sbi, NULL, FS_DISCARD_IO, len * F2FS_BLKSIZE);
1377:	
1378:			lstart += len;
1379:			start += len;
1380:			total_len -= len;
1381:			len = total_len;
1382:		}
1383:	
1384:		if (len) {
1385:			dcc->undiscard_blks -= len;
1386:			__update_discard_tree_range(sbi, bdev, lstart, start, len);
1387:		}
1388:		return 0;
1389:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 112165
							output: 46
							thoughts: 701
						

**Analyzing F2FS Discard Command Logic**

Okay, let me break this down. My initial observation is focused on how discard commands are handled, especially concerning edge cases and potential inconsistencies in how the counters are updated.

First, if `is_sbi_flag_set(sbi, SBI_NEED_FSCK)` returns true, the discard command is effectively skipped. It *returns 0*, meaning no discard submission is attempted. This means the command stays in the `pend_list` with a `D_PREP` state. The critical point is: because it's still in `pend_list`, the `__drop_discard_cmd` function *will* eventually remove it. That removal should decrement `discard_cmd_cnt`. Makes sense.

Similarly, if `bdev_max_discard_sectors(bdev)` returns 0, indicating the block device doesn't support discard, we get `-EOPNOTSUPP`. This command will also end up remaining in `pend_list` and will be removed by `__drop_discard_cmd`. Again, this should result in a `discard_cmd_cnt` decrement.

Now, let's consider the scenario where `__submit_discard_cmd` issues *some* of the discard requests but not all, because of a `*issued >= dpolicy->max_requests` limit within the loop. The code breaks out of the loop. Crucially, the code then updates the original command `dc`'s remaining length (which is added to `dcc->undiscard_blks` and passed to `__update_discard_tree_range`). Importantly, the original command `dc` is moved to the `wait_list`, but its length (`dc->di.len`) is updated. The remaining discard length is then added as a *new* discard command to `pend_list`.

So here's the flow: `pend_list` potentially contains partially submitted or non-submitted discard commands. `__drop_discard_cmd` should remove *all* these commands from `pend_list`. Then, `__wait_all_discard_cmd` waits for commands in the `wait_list` and `fstrim_list`, presumably completing the processing. After all this, logically, I'd expect all those lists to be empty, and the `discard_cmd_cnt` to be 0.

However, the question that is left to answer is: why is `discard_cmd_cnt` not zero? It seems like I need to dig deeper. I suspect that the decrementing of the `dcc->discard_cmd_cnt` is not happening in all the right places, or perhaps there's a race condition. Let's start by scrutinizing `__update_discard_tree_range` closely to see if there's any logic within that function that could cause an issue with the counter. That's the most likely culprit.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__update_discard_tree_range]

map[SourceCode:1465:	static void __update_discard_tree_range(struct f2fs_sb_info *sbi,
1466:					struct block_device *bdev, block_t lstart,
1467:					block_t start, block_t len)
1468:	{
1469:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1470:		struct discard_cmd *prev_dc = NULL, *next_dc = NULL;
1471:		struct discard_cmd *dc;
1472:		struct discard_info di = {0};
1473:		struct rb_node **insert_p = NULL, *insert_parent = NULL;
1474:		unsigned int max_discard_blocks =
1475:				SECTOR_TO_BLOCK(bdev_max_discard_sectors(bdev));
1476:		block_t end = lstart + len;
1477:	
1478:		dc = __lookup_discard_cmd_ret(&dcc->root, lstart,
1479:					&prev_dc, &next_dc, &insert_p, &insert_parent);
1480:		if (dc)
1481:			prev_dc = dc;
1482:	
1483:		if (!prev_dc) {
1484:			di.lstart = lstart;
1485:			di.len = next_dc ? next_dc->di.lstart - lstart : len;
1486:			di.len = min(di.len, len);
1487:			di.start = start;
1488:		}
1489:	
1490:		while (1) {
1491:			struct rb_node *node;
1492:			bool merged = false;
1493:			struct discard_cmd *tdc = NULL;
1494:	
1495:			if (prev_dc) {
1496:				di.lstart = prev_dc->di.lstart + prev_dc->di.len;
1497:				if (di.lstart < lstart)
1498:					di.lstart = lstart;
1499:				if (di.lstart >= end)
1500:					break;
1501:	
1502:				if (!next_dc || next_dc->di.lstart > end)
1503:					di.len = end - di.lstart;
1504:				else
1505:					di.len = next_dc->di.lstart - di.lstart;
1506:				di.start = start + di.lstart - lstart;
1507:			}
1508:	
1509:			if (!di.len)
1510:				goto next;
1511:	
1512:			if (prev_dc && prev_dc->state == D_PREP &&
1513:				prev_dc->bdev == bdev &&
1514:				__is_discard_back_mergeable(&di, &prev_dc->di,
1515:								max_discard_blocks)) {
1516:				prev_dc->di.len += di.len;
1517:				dcc->undiscard_blks += di.len;
1518:				__relocate_discard_cmd(dcc, prev_dc);
1519:				di = prev_dc->di;
1520:				tdc = prev_dc;
1521:				merged = true;
1522:			}
1523:	
1524:			if (next_dc && next_dc->state == D_PREP &&
1525:				next_dc->bdev == bdev &&
1526:				__is_discard_front_mergeable(&di, &next_dc->di,
1527:								max_discard_blocks)) {
1528:				next_dc->di.lstart = di.lstart;
1529:				next_dc->di.len += di.len;
1530:				next_dc->di.start = di.start;
1531:				dcc->undiscard_blks += di.len;
1532:				__relocate_discard_cmd(dcc, next_dc);
1533:				if (tdc)
1534:					__remove_discard_cmd(sbi, tdc);
1535:				merged = true;
1536:			}
1537:	
1538:			if (!merged)
1539:				__insert_discard_cmd(sbi, bdev,
1540:							di.lstart, di.start, di.len);
1541:	 next:
1542:			prev_dc = next_dc;
1543:			if (!prev_dc)
1544:				break;
1545:	
1546:			node = rb_next(&prev_dc->rb_node);
1547:			next_dc = rb_entry_safe(node, struct discard_cmd, rb_node);
1548:		}
1549:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 114925
							output: 44
							thoughts: 154
						

**Analyzing Discard Command Merging**

Okay, so I'm diving into this `__update_discard_tree_range` function. It looks like its primary role is merging discard commands, which is interesting. My initial thought is to trace the merging logic, specifically the interaction with `tdc` and `next_dc`. The code merges `tdc` and then with `next_dc`, and then `__remove_discard_cmd(sbi, tdc)` is called. I had a quick concern: What if `tdc` wasn't in the `D_PREP` state? But wait, `tdc` is actually `prev_dc`, and the merging *only* happens when `prev_dc->state == D_PREP`. So that resolves the immediate worry, ensuring `tdc->state` *is* indeed `D_PREP`. This means `__remove_discard_cmd` will correctly detach it. However, I need to consider a potential failure case: What happens if `__insert_discard_cmd` *fails*? I better go back and check the logic within `__insert_discard_cmd` to be sure I understand the potential failure points and their implications.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__insert_discard_cmd]

map[SourceCode:1391:	static void __insert_discard_cmd(struct f2fs_sb_info *sbi,
1392:					struct block_device *bdev, block_t lstart,
1393:					block_t start, block_t len)
1394:	{
1395:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1396:		struct rb_node **p = &dcc->root.rb_root.rb_node;
1397:		struct rb_node *parent = NULL;
1398:		struct discard_cmd *dc;
1399:		bool leftmost = true;
1400:	
1401:		/* look up rb tree to find parent node */
1402:		while (*p) {
1403:			parent = *p;
1404:			dc = rb_entry(parent, struct discard_cmd, rb_node);
1405:	
1406:			if (lstart < dc->di.lstart) {
1407:				p = &(*p)->rb_left;
1408:			} else if (lstart >= dc->di.lstart + dc->di.len) {
1409:				p = &(*p)->rb_right;
1410:				leftmost = false;
1411:			} else {
1412:				/* Let's skip to add, if exists */
1413:				return;
1414:			}
1415:		}
1416:	
1417:		dc = __create_discard_cmd(sbi, bdev, lstart, start, len);
1418:	
1419:		rb_link_node(&dc->rb_node, parent, p);
1420:		rb_insert_color_cached(&dc->rb_node, &dcc->root, leftmost);
1421:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 115915
							output: 44
							thoughts: 17
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Digging into the Discard Command Logic**

Alright, so I'm seeing a clear relationship here. The `__insert_discard_cmd` function, that's the one responsible for... well, inserting the discard command into the system, obviously. But the interesting bit is *how* it does that. It's not creating the command directly, at least not in this immediate context. Instead, it delegates that responsibility. The mental connection is: `__insert_discard_cmd` acts as the orchestrator, and it calls upon `__create_discard_cmd` to actually build the discard command structure. I need to investigate the implementation of `__create_discard_cmd` to understand the construction and potentially any parameters passed between them. I'd imagine `__insert_discard_cmd` would handle things like determining where to insert the command in the queue, error handling, maybe even security checks. The creation itself – the instantiation of a discard command object, populating its fields, setting its type – that’s `__create_discard_cmd`'s job. This separation of concerns suggests a modular design, which is always a good sign in this kind of system. It helps with maintainability and potential future enhancements. I'm keen to see if this pattern is consistent throughout the other commands as well.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__create_discard_cmd]

map[SourceCode: 966:	static struct discard_cmd *__create_discard_cmd(struct f2fs_sb_info *sbi,
 967:			struct block_device *bdev, block_t lstart,
 968:			block_t start, block_t len)
 969:	{
 970:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
 971:		struct list_head *pend_list;
 972:		struct discard_cmd *dc;
 973:	
 974:		f2fs_bug_on(sbi, !len);
 975:	
 976:		pend_list = &dcc->pend_list[plist_idx(len)];
 977:	
 978:		dc = f2fs_kmem_cache_alloc(discard_cmd_slab, GFP_NOFS, true, NULL);
 979:		INIT_LIST_HEAD(&dc->list);
 980:		dc->bdev = bdev;
 981:		dc->di.lstart = lstart;
 982:		dc->di.start = start;
 983:		dc->di.len = len;
 984:		dc->ref = 0;
 985:		dc->state = D_PREP;
 986:		dc->queued = 0;
 987:		dc->error = 0;
 988:		init_completion(&dc->wait);
 989:		list_add_tail(&dc->list, pend_list);
 990:		spin_lock_init(&dc->lock);
 991:		dc->bio_ref = 0;
 992:		atomic_inc(&dcc->discard_cmd_cnt);
 993:		dcc->undiscard_blks += len;
 994:	
 995:		return dc;
 996:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 116819
							output: 46
							thoughts: 1415
						

**Discard Command Processing Analysis**

Okay, let's break this down systematically. My initial thought process revolves around the lifecycle of discard commands in this F2FS implementation. I see that `__create_discard_cmd` allocates a discard command with `GFP_NOFS` and `nofail`, which implies a guaranteed allocation, and increments `discard_cmd_cnt`. However, I immediately consider a potential issue with overlapping discard ranges, and how the short-circuit in `__insert_discard_cmd` might affect that counter. It's fine; if `__insert_discard_cmd` returns early due to overlap, no new command is created, and the counter is not incremented. So that's safe.

Next, I wondered about `__wait_all_discard_cmd`. Does it truly wait for all commands, or could some be missed? Upon examining the code, it calls `__wait_discard_cmd_range`, which waits on commands linked to either the `fstrim_list` (under `DPOLICY_FSTRIM`) and `wait_list` (under `DPOLICY_UMOUNT`). My immediate concern was whether commands with small lengths (`di.len < MIN_DISCARD_GRANULARITY`) in the `wait_list` might be missed. I quickly confirmed that `MIN_DISCARD_GRANULARITY` is 1, and `di.len` is always >= 1. All commands *should* be accounted for.

My attention then shifted to commands in the `pend_list`. Could there be a race condition? `__drop_discard_cmd` removes commands from `pend_list` if they are in the `D_PREP` state. Could a command be in `pend_list` but *not* in `D_PREP`? I was concerned `__submit_discard_cmd` moves commands to the `wait_list` but *before* changing their state to `D_SUBMIT` or `D_PARTIAL`. A quick check confirmed `list_move_tail` is called after the state transition, so a race could exist. If `__drop_discard_cmd` ran concurrently, it might see a command with `state != D_PREP` while still in the `pend_list`, potentially triggering a bug. The check within `__drop_discard_cmd` would catch it.

However, I stopped to consider the locking mechanisms. Both `__drop_discard_cmd` and `__submit_discard_cmd` acquire `dcc->cmd_lock` before operating on the `pend_list`. This means they can't run concurrently. This eliminates the race condition: `__drop_discard_cmd` *will* never see a command in the `pend_list` with a state other than `D_PREP`.

Finally, I considered failure scenarios in `__submit_discard_cmd`. If `bdev_max_discard_sectors(bdev)` returns `-EOPNOTSUPP`, the command stays in `pend_list` in `D_PREP` and gets handled by `__drop_discard_cmd`. However, I considered, if the discard command is submitted to the block device, and `__blkdev_issue_discard` fails, would this cause an issue? However, upon checking, `__blkdev_issue_discard` does not fail, and always returns 0. So no problems should occur.

map[ContextFile:fs/f2fs/segment.c IncludeLines:true Name:__submit_zone_reset_cmd]

map[SourceCode:1240:	static void __submit_zone_reset_cmd(struct f2fs_sb_info *sbi,
1241:					   struct discard_cmd *dc, blk_opf_t flag,
1242:					   struct list_head *wait_list,
1243:					   unsigned int *issued)
1244:	{
1245:		struct discard_cmd_control *dcc = SM_I(sbi)->dcc_info;
1246:		struct block_device *bdev = dc->bdev;
1247:		struct bio *bio = bio_alloc(bdev, 0, REQ_OP_ZONE_RESET | flag, GFP_NOFS);
1248:		unsigned long flags;
1249:	
1250:		trace_f2fs_issue_reset_zone(bdev, dc->di.start);
1251:	
1252:		spin_lock_irqsave(&dc->lock, flags);
1253:		dc->state = D_SUBMIT;
1254:		dc->bio_ref++;
1255:		spin_unlock_irqrestore(&dc->lock, flags);
1256:	
1257:		if (issued)
1258:			(*issued)++;
1259:	
1260:		atomic_inc(&dcc->queued_discard);
1261:		dc->queued++;
1262:		list_move_tail(&dc->list, wait_list);
1263:	
1264:		/* sanity check on discard range */
1265:		__check_sit_bitmap(sbi, dc->di.lstart, dc->di.lstart + dc->di.len);
1266:	
1267:		bio->bi_iter.bi_sector = SECTOR_FROM_BLOCK(dc->di.start);
1268:		bio->bi_private = dc;
1269:		bio->bi_end_io = f2fs_submit_discard_endio;
1270:		submit_bio(bio);
1271:	
1272:		atomic_inc(&dcc->issued_discard);
1273:		f2fs_update_iostat(sbi, NULL, FS_ZONE_RESET_IO, dc->di.len * F2FS_BLKSIZE);
1274:	}
 SourceFile:fs/f2fs/segment.c]

gemini-3.1-pro-preview

							input: 119654
							output: 53
							thoughts: 6823
						

**Analysis of Potential Discard Command Count Discrepancies**

Okay, so I've been wrestling with a potential issue where the `discard_cmd_cnt` doesn't seem to reach zero as expected, and I think I've narrowed down the most likely scenario. Let's trace it carefully. The core of the issue revolves around concurrent operations, specifically the interactions between the umount/remount process, the discard thread, and the background checkpoint process.

The fundamental process is this: `f2fs_issue_discard_timeout` gets called during a umount or remount. It attempts to clean up discard commands. It calls `__issue_discard_cmd`, then `__drop_discard_cmd` to drain `pend_list`, and finally calls `__wait_all_discard_cmd` to wait for everything on `wait_list` and `fstrim_list` to complete. My initial concern was about commands getting "lost" between the lists or within the logic of `__wait_discard_cmd_range`, but the granularity checks prevent that. The logic of `__wait_all_discard_cmd` and `__wait_one_discard_bio` looks sound. The handling of `dc->bio_ref` and `dc->state` in the submit endio path seems correct.

The real problem lies in concurrency. I see the potential for a race condition. When the filesystem is being umounted and `f2fs_issue_discard_timeout` is called, a checkpoint may start concurrently. This could be due to background checkpointing or user activity. The checkpoint process can call `f2fs_clear_prefree_segments`, which calls `f2fs_issue_discard`. This adds new discard commands to the `pend_list`. However, this is happening concurrently with the process of draining all pending commands from `pend_list` in `f2fs_issue_discard_timeout`.

Here is the precise sequence of events: `f2fs_issue_discard_timeout` begins to drain. The command lists are cleaned. *Then* a concurrent checkpoint starts. The checkpoint submits new discard commands to `pend_list` *after* `__drop_discard_cmd` is called, but *before* the check in `f2fs_issue_discard_timeout` for `atomic_read(&dcc->discard_cmd_cnt)`. This results in the discrepancy where `atomic_read(&dcc->discard_cmd_cnt)` is not zero, triggering the bug. The filesystem is in an inconsistent state during a remount if this occurs.

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:f2fs_issue_discard SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_clear_prefree_segments SourceFile:fs/f2fs/segment.c SourceLine:2217] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_clear_prefree_segments SourceFile:fs/f2fs/segment.c SourceLine:2226] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_clear_prefree_segments SourceFile:fs/f2fs/segment.c SourceLine:2255]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 127273
							output: 56
							thoughts: 24
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in file systems, particularly F2FS:

**My Perspective on `f2fs_clear_prefree_segments` within Checkpoint Writing**

Alright, so I'm focusing on the checkpointing process in F2FS and I'm seeing that `f2fs_clear_prefree_segments` is being called from within `f2fs_write_checkpoint`. Immediately, my mind starts to draw connections. Checkpointing, as I know it, is about establishing a consistent state on disk, a reliable snapshot of the file system. And `f2fs_clear_prefree_segments` sounds like a cleanup function. So, the picture forming is that we're using this function *during* the checkpoint to prepare the file system for a clean state.

Thinking about it more concretely, I'd guess this function is responsible for clearing out those "prefree" segments. These likely refer to segments that were marked as candidates for freeing, but haven't actually been fully reclaimed yet. Perhaps they contain data that is no longer valid, or has been relocated elsewhere, but the metadata hasn't been fully updated yet. During checkpointing, we have to make sure that these are handled consistently. The checkpoint must represent a reliable state so whatever these segments hold (or previously held) must not be involved in the creation of that state.

So, I'm envisioning the execution flow: `f2fs_write_checkpoint` initiates the checkpointing procedure, and *within* that procedure, before the checkpoint metadata is committed, this `f2fs_clear_prefree_segments` routine is called to ensure these segments are properly dealt with, likely by zeroing them, marking them as free, or maybe even relocating the data in them. The goal is to avoid the situation where a partially freed segment causes data corruption or inconsistency upon the next mount or recovery. The checkpoint will then represent a file system where the 'prefree' segments have been correctly resolved.

It also implies that we’re dealing with a sophisticated write path, with a mechanism that is likely optimized to reduce fragmentation. I will have to investigate what happens in cases where the segments contain valid data, or what happens when a write to a prefree segment is requested.

map[ContextFile:fs/f2fs/checkpoint.c IncludeSnippetLines:0 Name:f2fs_clear_prefree_segments SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_write_checkpoint SourceFile:fs/f2fs/checkpoint.c SourceLine:1906] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_write_checkpoint SourceFile:fs/f2fs/checkpoint.c SourceLine:1943]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 127966
							output: 47
							thoughts: 1092
						

**F2FS Race Condition Analysis: Discard Commands and Remounts**

Okay, so let me break this down. It seems there's a race condition lurking in F2FS, specifically related to discard commands during remounts with the `nodiscard` option.

My thought process began by tracing the call stack.  `f2fs_write_checkpoint` does indeed call `f2fs_clear_prefree_segments`, which involves handling discard operations.  I recalled that `f2fs_write_checkpoint` is triggered not just by `f2fs_sync_fs`, but also by background processes like the garbage collector (`f2fs_gc`), balancing (`f2fs_balance_fs`), and crucially, the background checkpoint thread (`issue_checkpoint_thread`).

The core of the issue centers on how F2FS handles these processes during a remount, particularly when `nodiscard` is specified.  Looking at `__f2fs_remount`, the code flow reveals a critical timing window.  The code determines whether to stop or start the checkpoint thread.  This happens *after* `f2fs_issue_discard_timeout` has been called.

So, here's the problem: The background checkpoint thread can still be running, calling `f2fs_write_checkpoint`, which calls `f2fs_clear_prefree_segments`. Consequently, `f2fs_issue_discard` can be invoked, adding new discard commands to `pend_list` and incrementing `discard_cmd_cnt`. The race happens if this increment occurs *after* `__drop_discard_cmd` and *before* `f2fs_bug_on` checks the `discard_cmd_cnt`.

This is a clear race: a concurrent checkpoint and a remount with `nodiscard`. The `f2fs_bug_on` trigger condition is `discard_cmd_cnt` is greater than 0.

So, if `CONFIG_F2FS_CHECK_FS` is enabled, the kernel crashes immediately.  In a typical production environment, where this option is disabled, it will just trigger a `WARN_ON` and set `SBI_NEED_FSCK`, effectively marking the filesystem as corrupted, but without a kernel crash.

The key question then becomes: is there a memory corruption or use-after-free scenario here?  Let's consider that. `f2fs_issue_discard_timeout` simply returns `!dropped`. The discard commands added by the concurrent checkpoint thread simply sit in `pend_list` since `nodiscard` is set, and the discard thread will be stopped. These commands will remain until a remount with `discard` or the filesystem unmounts.

Here's the crucial point: when the filesystem unmounts, `f2fs_put_super` calls `f2fs_destroy_segment_manager`, which calls `destroy_discard_cmd_control`.  This in turn calls `f2fs_issue_discard_timeout` again!  However, a closer look at `f2fs_put_super` confirms that this call to `f2fs_destroy_segment_manager` occurs *after* `f2fs_write_checkpoint` and after all threads are stopped.  Thus, during unmount, there should not be any concurrent checkpoint operations. As such, `f2fs_issue_discard_timeout` will correctly handle all commands, `discard_cmd_cnt` will be zero, and `dcc` is freed, so there's no memory leak or use-after-free issue during unmount.

What about during `__f2fs_remount`? The commands added by the concurrent checkpoint will just sit there in `pend_list`. They are valid `discard_cmd` objects. No memory corruption will happen. The only problem is the `f2fs_bug_on` warning. Since it is only a warning in production, it will not crash the kernel. The only thing left to check is if that assumption is actually correct, in the production kernel.

requested entity does not exist

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_bug_on]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 129998
							output: 55
							thoughts: 346
						

**Analyzing the Implications of an F2FS Bug**

Okay, so I just reviewed the `f2fs_bug_on` macro definition in `fs/f2fs/f2fs.h`. I see that it's conditional based on `CONFIG_F2FS_CHECK_FS`.  I already know that `CONFIG_F2FS_CHECK_FS` is a debug option for runtime consistency checks. That means, in most production environments – Android, ChromeOS, typical Linux distributions – this option is disabled.

Therefore, in those cases, the bug condition will only trigger a `WARN_ON` and set the `SBI_NEED_FSCK` flag. It won't lead to a kernel panic or a denial-of-service situation. Unless, of course, `panic_on_warn` is enabled, which is not the default. That’s good to know.

But, wait a minute, I need to be completely thorough. Just because it doesn't cause an immediate crash doesn't mean it's benign. I need to be certain. Does setting `SBI_NEED_FSCK` itself trigger any denial-of-service scenarios? I'd better investigate what that flag actually does.

requested entity does not exist

map[ContextFile:fs/f2fs/f2fs.h IncludeSnippetLines:0 Name:SBI_NEED_FSCK SourceTreePrefix:]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 130682
							output: 21
							thoughts: 14
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating `SBI_NEED_FSCK`**

Okay, so I'm seeing `SBI_NEED_FSCK`... that's interesting. My immediate thought is, time to start digging into the superblock information. I'm going to reach for `grep` and see where this flag is actually being used in the codebase. I want to see which parts of the filesystem code are setting or checking this. Knowing the exact context of where this flag is manipulated is key to understanding the underlying issue, and its significance to the integrity of the filesystem. Let's see what that search turns up.

map[Expression:SBI_NEED_FSCK]

map[Output:Documentation/ABI/testing/sysfs-fs-f2fs=459=Description:	Show status of f2fs superblock in real time.
--
Documentation/ABI/testing/sysfs-fs-f2fs-464-		0x2    SBI_IS_CLOSE          specify unmounting
Documentation/ABI/testing/sysfs-fs-f2fs:465:		0x4    SBI_NEED_FSCK         need fsck.f2fs to fix
Documentation/ABI/testing/sysfs-fs-f2fs-466-		0x8    SBI_POR_DOING         recovery is doing or not
--
fs/f2fs/checkpoint.c=343=static bool __is_bitmap_valid(struct f2fs_sb_info *sbi, block_t blkaddr,
--
fs/f2fs/checkpoint.c-372-		 blkaddr, exist);
fs/f2fs/checkpoint.c:373:	set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/checkpoint.c-374-	dump_stack();
--
fs/f2fs/checkpoint.c=380=static bool __f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
--
fs/f2fs/checkpoint.c-417-				  blkaddr);
fs/f2fs/checkpoint.c:418:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/checkpoint.c-419-			dump_stack();
--
fs/f2fs/checkpoint.c=886=static int recover_orphan_inode(struct f2fs_sb_info *sbi, nid_t ino)
--
fs/f2fs/checkpoint.c-924-err_out:
fs/f2fs/checkpoint.c:925:	set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/checkpoint.c-926-	f2fs_warn(sbi, "%s: orphan failed (ino=%x), run fsck to fix.",
--
fs/f2fs/checkpoint.c=1532=static void update_ckpt_flags(struct f2fs_sb_info *sbi, struct cp_control *cpc)
--
fs/f2fs/checkpoint.c-1564-
fs/f2fs/checkpoint.c:1565:	if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))
fs/f2fs/checkpoint.c-1566-		__set_ckpt_flags(ckpt, CP_FSCK_FLAG);
--
fs/f2fs/compress.c=732=void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task)
--
fs/f2fs/compress.c-779-			}
fs/f2fs/compress.c:780:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/compress.c-781-		}
--
fs/f2fs/compress.c=890=bool f2fs_sanity_check_cluster(struct dnode_of_data *dn)
--
fs/f2fs/compress.c-936-			dn->inode->i_ino, dn->nid, dn->ofs_in_node, reason);
fs/f2fs/compress.c:937:	set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/compress.c-938-	return true;
--
fs/f2fs/data.c=2876=bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
--
fs/f2fs/data.c-2882-		return false;
fs/f2fs/data.c:2883:	if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK))
fs/f2fs/data.c-2884-		return true;
--
fs/f2fs/debug.c=409=static const char *s_flag[MAX_SBI_FLAG] = {
--
fs/f2fs/debug.c-411-	[SBI_IS_CLOSE]		= "closing",
fs/f2fs/debug.c:412:	[SBI_NEED_FSCK]		= "need_fsck",
fs/f2fs/debug.c-413-	[SBI_POR_DOING]		= "recovering",
--
fs/f2fs/dir.c=973=int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
--
fs/f2fs/dir.c-1001-					le32_to_cpu(de->ino));
fs/f2fs/dir.c:1002:				set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/dir.c-1003-			}
--
fs/f2fs/dir.c-1019-				  __func__, le16_to_cpu(de->name_len));
fs/f2fs/dir.c:1020:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/dir.c-1021-			err = -EFSCORRUPTED;
--
fs/f2fs/f2fs.h=31=struct pagevec;
--
fs/f2fs/f2fs.h-38-		if (WARN_ON(condition))					\
fs/f2fs/f2fs.h:39:			set_sbi_flag(sbi, SBI_NEED_FSCK);		\
fs/f2fs/f2fs.h-40-	} while (0)
--
fs/f2fs/f2fs.h=1469=enum {
--
fs/f2fs/f2fs.h-1471-	SBI_IS_CLOSE,				/* specify unmounting */
fs/f2fs/f2fs.h:1472:	SBI_NEED_FSCK,				/* need fsck.f2fs to fix */
fs/f2fs/f2fs.h-1473-	SBI_POR_DOING,				/* recovery is doing or not */
--
fs/f2fs/f2fs.h=2448=static inline void disable_nat_bits(struct f2fs_sb_info *sbi, bool lock)
--
fs/f2fs/f2fs.h-2454-	 * In order to re-enable nat_bits we need to call fsck.f2fs by
fs/f2fs/f2fs.h:2455:	 * set_sbi_flag(sbi, SBI_NEED_FSCK). But it may give huge cost,
fs/f2fs/f2fs.h-2456-	 * so let's rely on regular fsck or unclean shutdown.
--
fs/f2fs/f2fs.h=2701=static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,
--
fs/f2fs/f2fs.h-2711-		sbi->total_valid_block_count = 0;
fs/f2fs/f2fs.h:2712:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/f2fs.h-2713-	} else {
--
fs/f2fs/f2fs.h-2725-			  (unsigned long long)sectors);
fs/f2fs/f2fs.h:2726:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/f2fs.h-2727-		return;
--
fs/f2fs/f2fs.h=2970=static inline void dec_valid_node_count(struct f2fs_sb_info *sbi,
--
fs/f2fs/f2fs.h-2979-			  sbi->total_valid_node_count);
fs/f2fs/f2fs.h:2980:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/f2fs.h-2981-	} else {
--
fs/f2fs/f2fs.h-2998-				  (unsigned long long)inode->i_blocks);
fs/f2fs/f2fs.h:2999:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/f2fs.h-3000-			return;
--
fs/f2fs/file.c=2436=int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
--
fs/f2fs/file.c-2467-	case F2FS_GOING_DOWN_NEED_FSCK:
fs/f2fs/file.c:2468:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/file.c-2469-		set_sbi_flag(sbi, SBI_CP_DISABLED_QUICK);
--
fs/f2fs/file.c=3847=static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
--
fs/f2fs/file.c-3951-			atomic_read(&fi->i_compr_blocks)) {
fs/f2fs/file.c:3952:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/file.c-3953-		f2fs_warn(sbi, "%s: partial blocks were released i_ino=%lx "
--
fs/f2fs/file.c=4044=static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
--
fs/f2fs/file.c-4134-			atomic_read(&fi->i_compr_blocks)) {
fs/f2fs/file.c:4135:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/file.c-4136-		f2fs_warn(sbi, "%s: partial blocks were reserved i_ino=%lx "
--
fs/f2fs/gc.c=1148=static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
--
fs/f2fs/gc.c-1170-			  __func__);
fs/f2fs/gc.c:1171:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/gc.c-1172-	}
--
fs/f2fs/gc.c-1206-					 blkaddr, source_blkaddr, segno);
fs/f2fs/gc.c:1207:				set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/gc.c-1208-			}
--
fs/f2fs/gc.c=1548=static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
--
fs/f2fs/gc.c-1622-				iput(inode);
fs/f2fs/gc.c:1623:				set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/gc.c-1624-				f2fs_err_ratelimited(sbi,
--
fs/f2fs/gc.c=2266=int f2fs_resize_fs(struct file *filp, __u64 block_count)
--
fs/f2fs/gc.c-2298-
fs/f2fs/gc.c:2299:	if (is_sbi_flag_set(sbi, SBI_NEED_FSCK)) {
fs/f2fs/gc.c-2300-		f2fs_err(sbi, "Should run fsck to repair first.");
--
fs/f2fs/gc.c-2396-	if (err) {
fs/f2fs/gc.c:2397:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/gc.c-2398-		f2fs_err(sbi, "resize_fs failed, should run fsck to repair!");
--
fs/f2fs/inline.c=145=int f2fs_convert_inline_folio(struct dnode_of_data *dn, struct folio *folio)
--
fs/f2fs/inline.c-177-		f2fs_put_dnode(dn);
fs/f2fs/inline.c:178:		set_sbi_flag(fio.sbi, SBI_NEED_FSCK);
fs/f2fs/inline.c-179-		f2fs_warn(fio.sbi, "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, run fsck to fix.",
--
fs/f2fs/inline.c=411=static int f2fs_move_inline_dirents(struct inode *dir, struct folio *ifolio,
--
fs/f2fs/inline.c-432-		f2fs_put_dnode(&dn);
fs/f2fs/inline.c:433:		set_sbi_flag(F2FS_F_SB(folio), SBI_NEED_FSCK);
fs/f2fs/inline.c-434-		f2fs_warn(F2FS_F_SB(folio), "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, run fsck to fix.",
--
fs/f2fs/inode.c=413=static int do_read_inode(struct inode *inode)
--
fs/f2fs/inode.c-480-		f2fs_folio_put(node_folio, true);
fs/f2fs/inode.c:481:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/inode.c-482-		f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
--
fs/f2fs/inode.c=568=struct inode *f2fs_iget(struct super_block *sb, unsigned long ino)
--
fs/f2fs/inode.c-580-			f2fs_err(sbi, "inaccessible inode: %lu, run fsck to repair", ino);
fs/f2fs/inode.c:581:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/inode.c-582-			ret = -EFSCORRUPTED;
--
fs/f2fs/inode.c=850=void f2fs_evict_inode(struct inode *inode)
--
fs/f2fs/inode.c-930-				f2fs_inode_synced(inode);
fs/f2fs/inode.c:931:				set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/inode.c-932-			}
--
fs/f2fs/inode.c-959-			f2fs_inode_synced(inode);
fs/f2fs/inode.c:960:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/inode.c-961-		}
--
fs/f2fs/inode.c=1013=void f2fs_handle_failed_inode(struct inode *inode, struct f2fs_lock_context *lc)
--
fs/f2fs/inode.c-1041-	if (err) {
fs/f2fs/inode.c:1042:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/inode.c-1043-		set_inode_flag(inode, FI_FREE_NID);
--
fs/f2fs/inode.c-1050-		if (err) {
fs/f2fs/inode.c:1051:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/inode.c-1052-			f2fs_warn(sbi, "Too many orphan inodes, run fsck to fix.");
--
fs/f2fs/namei.c=463=static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
--
fs/f2fs/namei.c-510-		err = -EFSCORRUPTED;
fs/f2fs/namei.c:511:		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
fs/f2fs/namei.c-512-		goto out_iput;
--
fs/f2fs/namei.c=545=static int f2fs_unlink(struct inode *dir, struct dentry *dentry)
--
fs/f2fs/namei.c-611-	err = -EFSCORRUPTED;
fs/f2fs/namei.c:612:	set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/namei.c-613-	f2fs_folio_put(folio, false);
--
fs/f2fs/node.c=38=int f2fs_check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
--
fs/f2fs/node.c-40-	if (unlikely(is_invalid_nid(sbi, nid))) {
fs/f2fs/node.c:41:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-42-		f2fs_warn(sbi, "%s: out-of-range nid=%x, run fsck to fix.",
--
fs/f2fs/node.c=562=int f2fs_get_node_info(struct f2fs_sb_info *sbi, nid_t nid,
--
fs/f2fs/node.c-635-					DATA_GENERIC_ENHANCE)) {
fs/f2fs/node.c:636:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-637-		f2fs_err_ratelimited(sbi,
--
fs/f2fs/node.c-647-		!__is_valid_data_blkaddr(ni->blk_addr))) {
fs/f2fs/node.c:648:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-649-		f2fs_err_ratelimited(sbi,
--
fs/f2fs/node.c=804=int f2fs_get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode)
--
fs/f2fs/node.c-851-				dn->inode->i_ino, nids[i], level, offset[level]);
fs/f2fs/node.c:852:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-853-			goto release_pages;
--
fs/f2fs/node.c=952=static int truncate_node(struct dnode_of_data *dn)
--
fs/f2fs/node.c-967-			"nid:%u, blkaddr:%u", ni.ino, ni.nid, ni.blk_addr);
fs/f2fs/node.c:968:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-969-		f2fs_handle_error(sbi, ERROR_INCONSISTENT_NAT);
--
fs/f2fs/node.c=999=static int truncate_dnode(struct dnode_of_data *dn)
--
fs/f2fs/node.c-1017-				dn->inode->i_ino, dn->nid, ino_of_node(folio));
fs/f2fs/node.c:1018:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-1019-		f2fs_handle_error(sbi, ERROR_INVALID_NODE_REFERENCE);
--
fs/f2fs/node.c=1181=int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from)
--
fs/f2fs/node.c-1199-					from, ADDRS_PER_INODE(inode));
fs/f2fs/node.c:1200:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-1201-		}
--
fs/f2fs/node.c-1264-		if (err == -ENOENT) {
fs/f2fs/node.c:1265:			set_sbi_flag(F2FS_F_SB(folio), SBI_NEED_FSCK);
fs/f2fs/node.c-1266-			f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
--
fs/f2fs/node.c=1324=int f2fs_remove_inode_page(struct inode *inode)
--
fs/f2fs/node.c-1355-			inode->i_ino, (unsigned long long)inode->i_blocks);
fs/f2fs/node.c:1356:		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
fs/f2fs/node.c-1357-	}
--
fs/f2fs/node.c=1379=struct folio *f2fs_new_node_folio(struct dnode_of_data *dn, unsigned int ofs)
--
fs/f2fs/node.c-1404-		dec_valid_node_count(sbi, dn->inode, !ofs);
fs/f2fs/node.c:1405:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-1406-		f2fs_warn_ratelimited(sbi,
--
fs/f2fs/node.c=1514=int f2fs_sanity_check_node_footer(struct f2fs_sb_info *sbi,
--
fs/f2fs/node.c-1549-out_err:
fs/f2fs/node.c:1550:	set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-1551-	f2fs_warn_ratelimited(sbi, "inconsistent node block, node_type:%d, nid:%lu, "
--
fs/f2fs/node.c=2576=static int __f2fs_build_free_nids(struct f2fs_sb_info *sbi,
--
fs/f2fs/node.c-2627-					f2fs_err(sbi, "NAT is corrupt, run fsck to fix it");
fs/f2fs/node.c:2628:					set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/node.c-2629-					f2fs_handle_error(sbi,
--
fs/f2fs/segment.c=1278=static int __submit_discard_cmd(struct f2fs_sb_info *sbi,
--
fs/f2fs/segment.c-1293-
fs/f2fs/segment.c:1294:	if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))
fs/f2fs/segment.c-1295-		return 0;
--
fs/f2fs/segment.c=1904=static int issue_discard_thread(void *data)
--
fs/f2fs/segment.c-1938-			return 0;
fs/f2fs/segment.c:1939:		if (is_sbi_flag_set(sbi, SBI_NEED_FSCK) ||
fs/f2fs/segment.c-1940-			!atomic_read(&dcc->discard_cmd_cnt)) {
--
fs/f2fs/segment.c=3480=int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
--
fs/f2fs/segment.c-3498-
fs/f2fs/segment.c:3499:	if (is_sbi_flag_set(sbi, SBI_NEED_FSCK)) {
fs/f2fs/segment.c-3500-		f2fs_warn(sbi, "Found FS corruption, run fsck to fix.");
--
fs/f2fs/segment.c=4057=int f2fs_inplace_write_data(struct f2fs_io_info *fio)
--
fs/f2fs/segment.c-4069-	if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
fs/f2fs/segment.c:4070:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/segment.c-4071-		f2fs_warn(sbi, "%s: incorrect segment(%u) type, run fsck to fix.",
--
fs/f2fs/segment.h=846=static inline int check_block_count(struct f2fs_sb_info *sbi,
--
fs/f2fs/segment.h-871-			 GET_SIT_VBLOCKS(raw_sit), valid_blocks);
fs/f2fs/segment.h:872:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/segment.h-873-		f2fs_handle_error(sbi, ERROR_INCONSISTENT_SIT);
--
fs/f2fs/segment.h-886-			 GET_SIT_VBLOCKS(raw_sit), segno);
fs/f2fs/segment.h:887:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/segment.h-888-		f2fs_handle_error(sbi, ERROR_INCONSISTENT_SIT);
--
fs/f2fs/super.c=4302=static void init_sb_info(struct f2fs_sb_info *sbi)
--
fs/f2fs/super.c-4361-				DEF_UMOUNT_DISCARD_TIMEOUT;
fs/f2fs/super.c:4362:	clear_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/super.c-4363-
--
fs/f2fs/super.c=4919=static int f2fs_fill_super(struct super_block *sb, struct fs_context *fc)
--
fs/f2fs/super.c-5091-	if (__is_set_ckpt_flags(F2FS_CKPT(sbi), CP_FSCK_FLAG))
fs/f2fs/super.c:5092:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/super.c-5093-
--
fs/f2fs/super.c-5256-		if (need_fsck)
fs/f2fs/super.c:5257:			set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/super.c-5258-
--
fs/f2fs/verity.c=146=static int f2fs_end_enable_verity(struct file *filp, const void *desc,
--
fs/f2fs/verity.c-211-			 err2);
fs/f2fs/verity.c:212:		set_sbi_flag(sbi, SBI_NEED_FSCK);
fs/f2fs/verity.c-213-	}
--
fs/f2fs/xattr.c=318=static int lookup_all_xattrs(struct inode *inode, struct folio *ifolio,
--
fs/f2fs/xattr.c-369-								inode->i_ino);
fs/f2fs/xattr.c:370:		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
fs/f2fs/xattr.c-371-		err = -ENODATA;
--
fs/f2fs/xattr.c=563=ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
--
fs/f2fs/xattr.c-589-						inode->i_ino);
fs/f2fs/xattr.c:590:			set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
fs/f2fs/xattr.c-591-			f2fs_handle_error(F2FS_I_SB(inode),
--
fs/f2fs/xattr.c=629=static int __f2fs_setxattr(struct inode *inode, int index,
--
fs/f2fs/xattr.c-675-								inode->i_ino);
fs/f2fs/xattr.c:676:		set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
fs/f2fs/xattr.c-677-		error = -EFSCORRUPTED;
--
fs/f2fs/xattr.c-703-					inode->i_ino, ENTRY_SIZE(last));
fs/f2fs/xattr.c:704:			set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
fs/f2fs/xattr.c-705-			error = -EFSCORRUPTED;
]

gemini-3.1-pro-preview

							input: 138804
							output: 21
							thoughts: 620
						

**My Analysis of the `SBI_NEED_FSCK` Flag in F2FS**

Okay, so I'm looking at this `SBI_NEED_FSCK` flag in F2FS, and it seems like it's causing more trouble than it's worth, given this particular scenario. The idea is that the flag signals the filesystem needs a `fsck` run. That's fine in principle, but here's where it gets interesting. It effectively disables certain operations like discard commands, trimming, and resizing. The core issue is, in this case, the flag is being set falsely due to a race condition with `discard_cmd_cnt`. The filesystem *isn't* actually corrupted, but we're treating it as if it is.

The concerning part is the behavior when `CONFIG_F2FS_CHECK_FS` is enabled. That's a debug option, so it's a kernel crash, a `BUG_ON`, if the flag is set. Thankfully, that's not likely to be enabled in production. However, in production it's a `WARN_ON`, which isn't a crash, but it sets `SBI_NEED_FSCK`, even though there is no real need. This still seems problematic.

What's the real impact on the system? It's not a full system crash. It might prevent some file system operations. However, the bigger issue is that setting this flag causes `f2fs_write_checkpoint` to set the `CP_FSCK_FLAG` in the checkpoint. This means that *on the next mount* the system *will* demand `fsck`. So that's the vulnerability: forcing a `fsck`.

The real question is, can an unprivileged user trigger this? If they can, it's a potential denial of service, forcing `fsck` which could cause downtime or block operations. Let's think about how that works. `__f2fs_remount` is the relevant function to investigate since it has the potential to set that flag. Remounting requires `CAP_SYS_ADMIN` within the user namespace. A standard user can't do that, which is good. However, they *can* create user namespaces. Can a user namespace with a mounted f2fs system trigger this problem? Theoretically, yes. If they can mount a f2fs image via a loop device, or maybe if `fsconfig` allows it, this becomes a problem. Wait a minute, f2fs *doesn't* have `FS_USERNS_MOUNT`, so that makes things a bit harder. I need to double-check `fs/f2fs/super.c` to confirm that that bit is not set. But, on the surface, it seems difficult for an unprivileged user to remount an F2FS file system to trigger this `fsck` requirement.

map[Expression:FS_USERNS_MOUNT]

map[Output:drivers/android/binder/rust_binderfs.c=753=static struct file_system_type binder_fs_type = {
--
drivers/android/binder/rust_binderfs.c-757-	.kill_sb		= binderfs_kill_super,
drivers/android/binder/rust_binderfs.c:758:	.fs_flags		= FS_USERNS_MOUNT,
drivers/android/binder/rust_binderfs.c-759-};
--
drivers/android/binderfs.c=749=static struct file_system_type binder_fs_type = {
--
drivers/android/binderfs.c-753-	.kill_sb		= binderfs_kill_super,
drivers/android/binderfs.c:754:	.fs_flags		= FS_USERNS_MOUNT,
drivers/android/binderfs.c-755-};
--
fs/binfmt_misc.c=1021=static struct file_system_type bm_fs_type = {
--
fs/binfmt_misc.c-1024-	.init_fs_context = bm_init_fs_context,
fs/binfmt_misc.c:1025:	.fs_flags	= FS_USERNS_MOUNT,
fs/binfmt_misc.c-1026-	.kill_sb	= kill_anon_super,
--
fs/devpts/inode.c=453=static struct file_system_type devpts_fs_type = {
--
fs/devpts/inode.c-457-	.kill_sb	= devpts_kill_sb,
fs/devpts/inode.c:458:	.fs_flags	= FS_USERNS_MOUNT,
fs/devpts/inode.c-459-};
--
fs/fuse/inode.c=2131=static struct file_system_type fuse_fs_type = {
--
fs/fuse/inode.c-2133-	.name		= "fuse",
fs/fuse/inode.c:2134:	.fs_flags	= FS_HAS_SUBTYPE | FS_USERNS_MOUNT | FS_ALLOW_IDMAP,
fs/fuse/inode.c-2135-	.init_fs_context = fuse_init_fs_context,
--
fs/overlayfs/params.c=782=static const struct fs_context_operations ovl_context_ops = {
--
fs/overlayfs/params.c-791- * This is called during fsopen() and will record the user namespace of
fs/overlayfs/params.c:792: * the caller in fc->user_ns since we've raised FS_USERNS_MOUNT. We'll
fs/overlayfs/params.c-793- * need it when we actually create the superblock to verify that the
--
fs/overlayfs/super.c=1575=struct file_system_type ovl_fs_type = {
--
fs/overlayfs/super.c-1579-	.parameters		= ovl_parameter_spec,
fs/overlayfs/super.c:1580:	.fs_flags		= FS_USERNS_MOUNT,
fs/overlayfs/super.c-1581-	.kill_sb		= kill_anon_super,
--
fs/proc/root.c=357=static struct file_system_type proc_fs_type = {
--
fs/proc/root.c-361-	.kill_sb		= proc_kill_sb,
fs/proc/root.c:362:	.fs_flags		= FS_USERNS_MOUNT | FS_DISALLOW_NOTIFY_PERM,
fs/proc/root.c-363-};
--
fs/ramfs/inode.c=317=static struct file_system_type ramfs_fs_type = {
--
fs/ramfs/inode.c-321-	.kill_sb	= ramfs_kill_sb,
fs/ramfs/inode.c:322:	.fs_flags	= FS_USERNS_MOUNT,
fs/ramfs/inode.c-323-};
--
fs/super.c=694=bool mount_capable(struct fs_context *fc)
fs/super.c-695-{
fs/super.c:696:	if (!(fc->fs_type->fs_flags & FS_USERNS_MOUNT))
fs/super.c-697-		return capable(CAP_SYS_ADMIN);
--
fs/super.c=734=struct super_block *sget_fc(struct fs_context *fc,
--
fs/super.c-743-	/*
fs/super.c:744:	 * Never allow s_user_ns != &init_user_ns when FS_USERNS_MOUNT is
fs/super.c-745-	 * not set, as the filesystem is likely unprepared to handle it.
--
fs/super.c-748-	 */
fs/super.c:749:	if (user_ns != &init_user_ns && !(fc->fs_type->fs_flags & FS_USERNS_MOUNT)) {
fs/super.c-750-		errorfc(fc, "VFS: Mounting from non-initial user namespace is not allowed");
--
fs/sysfs/mount.c=90=static struct file_system_type sysfs_fs_type = {
--
fs/sysfs/mount.c-93-	.kill_sb		= sysfs_kill_sb,
fs/sysfs/mount.c:94:	.fs_flags		= FS_USERNS_MOUNT,
fs/sysfs/mount.c-95-};
--
include/linux/fs.h=2271=struct file_system_type {
--
include/linux/fs.h-2276-#define FS_HAS_SUBTYPE		4
include/linux/fs.h:2277:#define FS_USERNS_MOUNT		8	/* Can be mounted by userns root */
include/linux/fs.h-2278-#define FS_DISALLOW_NOTIFY_PERM	16	/* Disable fanotify permission events */
--
ipc/mqueue.c=1613=static struct file_system_type mqueue_fs_type = {
--
ipc/mqueue.c-1616-	.kill_sb		= kill_anon_super,
ipc/mqueue.c:1617:	.fs_flags		= FS_USERNS_MOUNT,
ipc/mqueue.c-1618-};
--
kernel/bpf/inode.c=1074=static struct file_system_type bpf_fs_type = {
--
kernel/bpf/inode.c-1079-	.kill_sb	= bpf_kill_super,
kernel/bpf/inode.c:1080:	.fs_flags	= FS_USERNS_MOUNT,
kernel/bpf/inode.c-1081-};
--
kernel/cgroup/cgroup.c=2392=struct file_system_type cgroup_fs_type = {
--
kernel/cgroup/cgroup.c-2396-	.kill_sb		= cgroup_kill_sb,
kernel/cgroup/cgroup.c:2397:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2398-};
--
kernel/cgroup/cgroup.c=2400=static struct file_system_type cgroup2_fs_type = {
--
kernel/cgroup/cgroup.c-2404-	.kill_sb		= cgroup_kill_sb,
kernel/cgroup/cgroup.c:2405:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2406-};
--
kernel/cgroup/cgroup.c=2473=static struct file_system_type cpuset_fs_type = {
--
kernel/cgroup/cgroup.c-2476-	.parameters		= cpuset_fs_parameters,
kernel/cgroup/cgroup.c:2477:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2478-};
--
mm/shmem.c=5351=static struct file_system_type shmem_fs_type = {
--
mm/shmem.c-5358-	.kill_sb	= kill_anon_super,
mm/shmem.c:5359:	.fs_flags	= FS_USERNS_MOUNT | FS_ALLOW_IDMAP | FS_MGTIME,
mm/shmem.c-5360-};
--
mm/shmem.c=5761=static struct file_system_type shmem_fs_type = {
--
mm/shmem.c-5765-	.kill_sb	= ramfs_kill_sb,
mm/shmem.c:5766:	.fs_flags	= FS_USERNS_MOUNT,
mm/shmem.c-5767-};
]

gemini-3.1-pro-preview

							input: 142377
							output: 55
							thoughts: 539
						

**Analyzing the F2FS Vulnerability**

Okay, let's break this down. My initial thought was, "Can an unprivileged user exploit this `f2fs` issue?" Since `f2fs` lacks `FS_USERNS_MOUNT`, mounting or remounting it in a user namespace is a no-go for them. Then I considered, "What if the filesystem is *initially* mounted by root, but an unprivileged user somehow triggers the bug?" The key function here is `__f2fs_remount`, which is called by `mount -o remount`. However, only a user with `CAP_SYS_ADMIN` in the mount namespace can execute that `mount` command. And because f2fs doesn't support mounting in a user namespace, that implies the user must have `CAP_SYS_ADMIN` in the initial namespace, meaning root privileges. So, no, an unprivileged user can't directly trigger it that way.

Now, could there be another entry point to the vulnerable code, `f2fs_issue_discard_timeout`? Let's trace that. It's called in `destroy_discard_cmd_control`, which is called from `f2fs_destroy_segment_manager`, which is, in turn, called from `f2fs_put_super`. And `f2fs_put_super` is invoked during an unmount operation. Unmounting *also* requires `CAP_SYS_ADMIN`. So, an unprivileged user can't trigger it via that route either.

Then I considered malicious filesystem images. What if a user plugs in a USB drive with a poisoned `f2fs` image, which is auto-mounted? I can envision that situation. But auto-mounting, in my experience, doesn't automatically remount with different options, which is the crux of the problem. However, it *does* trigger an unmount when the device is removed, leading to `f2fs_put_super` being called. Fortunately, I recall that the checkpoint thread is already stopped during `f2fs_put_super`, so the race condition I am concerned about does *not* happen during unmount. The race is ONLY happening during `__f2fs_remount`, which requires the `nodiscard` option. The question now becomes: does auto-mounting ever remount with `nodiscard`? It usually does not.

Therefore, this looks like a privileged user (root) vulnerability. The only scenario I can currently envision for exploitation is a privileged user running `mount -o remount,nodiscard`. I think that's it. Wait...let me recheck all call sites to `f2fs_issue_discard_timeout` again just to be sure.

map[ContextFile:fs/f2fs/segment.c IncludeSnippetLines:0 Name:f2fs_issue_discard_timeout SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__f2fs_remount SourceFile:fs/f2fs/super.c SourceLine:2960] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:destroy_discard_cmd_control SourceFile:fs/f2fs/segment.c SourceLine:2370] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_put_super SourceFile:fs/f2fs/super.c SourceLine:2012] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_unfreeze SourceFile:fs/f2fs/super.c SourceLine:2155]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 143793
							output: 44
							thoughts: 24
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Unfreezing the File System: A Quick Scan**

Alright, *f2fs_unfreeze*... right. Time to check out the state of play with that function. I immediately want to understand its role within the broader context of F2FS's overall state management. Is it being called as expected, under which conditions, and what potential issues could arise if its execution isn't precisely controlled? I need to quickly recall the typical usage scenarios and the associated potential corner cases to ensure there are no surprises in the code path. I want to rapidly assess whether there might be any unexpected interactions with other kernel subsystems or potential race conditions that need further scrutiny. A quick mental review of the locking primitives utilized within `f2fs_unfreeze` is definitely in order, just to keep ahead of any unforeseen issues.

map[ContextFile:fs/f2fs/super.c IncludeLines:true Name:f2fs_unfreeze]

map[SourceCode:2143:	static int f2fs_unfreeze(struct super_block *sb)
2144:	{
2145:		struct f2fs_sb_info *sbi = F2FS_SB(sb);
2146:	
2147:		/*
2148:		 * It will update discard_max_bytes of mounted lvm device to zero
2149:		 * after creating snapshot on this lvm device, let's drop all
2150:		 * remained discards.
2151:		 * We don't need to disable real-time discard because discard_max_bytes
2152:		 * will recover after removal of snapshot.
2153:		 */
2154:		if (test_opt(sbi, DISCARD) && !f2fs_hw_support_discard(sbi))
2155:			f2fs_issue_discard_timeout(sbi);
2156:	
2157:		clear_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING);
2158:		return 0;
2159:	}
 SourceFile:fs/f2fs/super.c]

gemini-3.1-pro-preview

							input: 144374
							output: 17
							thoughts: 64
						

**Unfreezing a Filesystem: A Quick Mental Check**

Okay, so `f2fs_unfreeze` gets called when the filesystem comes back to life after being frozen. Makes sense. But wait, I need to be careful here – unfrozen operations often need elevated permissions, usually `CAP_SYS_ADMIN`. That seems right, I've seen that pattern before. Now, hold on, wasn't it the `FIFREEZE` and `FITHAW` ioctls that also demand `CAP_SYS_ADMIN`? Just to be absolutely sure, I should probably double-check that. Gotta make sure I'm solid on these permission requirements. Let's verify that quickly, just to be thorough.

map[Expression:FITHAW]

map[Output:fs/ioctl.c=492=static int do_vfs_ioctl(struct file *filp, unsigned int fd,
--
fs/ioctl.c-526-
fs/ioctl.c:527:	case FITHAW:
fs/ioctl.c-528-		return ioctl_fsthaw(filp);
--
fs/xfs/libxfs/xfs_fs.h=1164=struct xfs_verify_media {
--
fs/xfs/libxfs/xfs_fs.h-1258-#define XFS_IOC_FREEZE		     _IOWR('X', 119, int)	/* aka FIFREEZE */
fs/xfs/libxfs/xfs_fs.h:1259:#define XFS_IOC_THAW		     _IOWR('X', 120, int)	/* aka FITHAW */
fs/xfs/libxfs/xfs_fs.h-1260-
--
include/uapi/linux/fs.h=226=struct file_attr {
--
include/uapi/linux/fs.h-309-#define FIFREEZE	_IOWR('X', 119, int)	/* Freeze */
include/uapi/linux/fs.h:310:#define FITHAW		_IOWR('X', 120, int)	/* Thaw */
include/uapi/linux/fs.h-311-#define FITRIM		_IOWR('X', 121, struct fstrim_range)	/* Trim */
--
include/uapi/linux/landlock.h=186=struct landlock_net_port_attr {
--
include/uapi/linux/landlock.h-242- *   * IOCTL commands targeting file descriptions (``FIONBIO``, ``FIOASYNC``),
include/uapi/linux/landlock.h:243: *   * IOCTL commands targeting file systems (``FIFREEZE``, ``FITHAW``,
include/uapi/linux/landlock.h-244- *     ``FIGETBSZ``, ``FS_IOC_GETFSUUID``, ``FS_IOC_GETFSSYSFSPATH``)
--
security/landlock/fs.c=125=static __attribute_const__ bool is_masked_device_ioctl(const unsigned int cmd)
--
security/landlock/fs.c-145-	/*
security/landlock/fs.c:146:	 * FIFREEZE and FITHAW freeze and thaw the file system which the
security/landlock/fs.c-147-	 * given file belongs to.  Requires CAP_SYS_ADMIN.
--
security/landlock/fs.c-154-	case FIFREEZE:
security/landlock/fs.c:155:	case FITHAW:
security/landlock/fs.c-156-	/*
--
tools/hv/hv_vss_daemon.c=34=static int vss_do_freeze(char *dir, unsigned int cmd)
--
tools/hv/hv_vss_daemon.c-53-		if ((cmd == FIFREEZE && errno == EBUSY) ||
tools/hv/hv_vss_daemon.c:54:		    (cmd == FITHAW && errno == EINVAL)) {
tools/hv/hv_vss_daemon.c-55-			close(fd);
--
tools/hv/hv_vss_daemon.c=113=static int vss_operate(int operation)
--
tools/hv/hv_vss_daemon.c-128-	case VSS_OP_THAW:
tools/hv/hv_vss_daemon.c:129:		cmd = FITHAW;
tools/hv/hv_vss_daemon.c-130-		break;
--
tools/include/uapi/linux/fs.h=142=struct fsxattr {
--
tools/include/uapi/linux/fs.h-223-#define FIFREEZE	_IOWR('X', 119, int)	/* Freeze */
tools/include/uapi/linux/fs.h:224:#define FITHAW		_IOWR('X', 120, int)	/* Thaw */
tools/include/uapi/linux/fs.h-225-#define FITRIM		_IOWR('X', 121, struct fstrim_range)	/* Trim */
--
tools/perf/trace/beauty/include/uapi/linux/fs.h=226=struct file_attr {
--
tools/perf/trace/beauty/include/uapi/linux/fs.h-309-#define FIFREEZE	_IOWR('X', 119, int)	/* Freeze */
tools/perf/trace/beauty/include/uapi/linux/fs.h:310:#define FITHAW		_IOWR('X', 120, int)	/* Thaw */
tools/perf/trace/beauty/include/uapi/linux/fs.h-311-#define FITRIM		_IOWR('X', 121, struct fstrim_range)	/* Trim */
--
tools/testing/selftests/landlock/fs_test.c=4260=TEST_F_FORK(layout1, blanket_permitted_ioctls)
--
tools/testing/selftests/landlock/fs_test.c-4285-	EXPECT_NE(EACCES, ioctl_error(_metadata, fd, FIFREEZE));
tools/testing/selftests/landlock/fs_test.c:4286:	EXPECT_NE(EACCES, ioctl_error(_metadata, fd, FITHAW));
tools/testing/selftests/landlock/fs_test.c-4287-	EXPECT_NE(EACCES, ioctl_error(_metadata, fd, FS_IOC_FIEMAP));
]

gemini-3.1-pro-preview

							input: 146094
							output: 45
							thoughts: 1099
						

**Analyzing the Trigger Conditions for `destroy_discard_cmd_control` in F2FS**

Okay, so I'm revisiting this potential issue with `destroy_discard_cmd_control`.  First, the initial thought process was:  `FIFREEZE` and `FITHAW` are clearly protected by `CAP_SYS_ADMIN`, so an unprivileged user can't exploit those functions to call `f2fs_unfreeze`.  That's a given.

Now, what about `destroy_discard_cmd_control` itself? It's called from `f2fs_destroy_segment_manager`, which is, in turn, called from `f2fs_put_super` and, importantly for this discussion, `f2fs_fill_super`.  `f2fs_fill_super` is called during the mount process. Mount, obviously, requires `CAP_SYS_ADMIN`. Therefore, an unprivileged user shouldn't be able to directly trigger the function.

However, the question is, can a *malicious filesystem image* trigger it *during* `f2fs_fill_super` if it's auto-mounted? I need to analyze the error paths within `f2fs_fill_super`.  If an error occurs *after* `f2fs_build_segment_manager`, the code jumps to `free_sm`, or a similar label.  That path then calls `f2fs_destroy_segment_manager`. The function is called during the `f2fs_fill_super` process. Crucially, during the mount, the background threads like the checkpoint thread might be started.

The code in `f2fs_fill_super` includes the following sequence: it calls `f2fs_start_ckpt_thread`. Then, if that call fails, it goes to `stop_discard_thread`, and then calls `f2fs_destroy_segment_manager`. This is interesting because the call to `f2fs_destroy_segment_manager` includes a call to `destroy_discard_cmd_control`, which calls `f2fs_issue_discard_timeout`.

Now, the critical question: does this error path create a race condition?  The code also calls `f2fs_stop_ckpt_thread` *before* it calls `f2fs_destroy_segment_manager`. Therefore, the checkpoint thread is *stopped* before `destroy_discard_cmd_control` gets called. Thus, there should be no concurrent checkpoint thread running during `destroy_discard_cmd_control`. So, the race condition is unlikely to occur during the `f2fs_fill_super` error path, which is good.

But, I must consider all angles. What about after `f2fs_fill_super` has partially completed, and then `iput(sbi->node_inode)` is called? This could trigger `balance_fs_bg`, which might trigger `f2fs_write_checkpoint`. The comment in the code addresses this concern directly:

"Some dirty meta pages can be produced by recover_orphan_inodes() failed by EIO. Then, `iput(node_inode)` can trigger `balance_fs_bg()` followed by `f2fs_write_checkpoint()` through `f2fs_write_node_pages()`. This has the risk of deadlock since we disable MT_SUPPORTED during build_segment_manager()."

That’s the key! `set_sbi_flag(sbi, SBI_CP_DISABLED)` is called.  This means `f2fs_write_checkpoint` will either return early or not do anything because `SBI_CP_DISABLED` is set! This means `f2fs_write_checkpoint` shouldn't be a vector to exploit. I should confirm that directly, by looking at the code for `f2fs_write_checkpoint`.

map[ContextFile:fs/f2fs/checkpoint.c IncludeLines:true Name:f2fs_write_checkpoint]

map[SourceCode:1852:	int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
1853:	{
1854:		struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
1855:		struct f2fs_lock_context lc;
1856:		unsigned long long ckpt_ver;
1857:		int err = 0;
1858:	
1859:		stat_cp_time(cpc, CP_TIME_START);
1860:	
1861:		if (f2fs_readonly(sbi->sb) || f2fs_hw_is_readonly(sbi))
1862:			return -EROFS;
1863:	
1864:		if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
1865:			if (cpc->reason != CP_PAUSE)
1866:				return 0;
1867:			f2fs_warn(sbi, "Start checkpoint disabled!");
1868:		}
1869:		if (cpc->reason != CP_RESIZE)
1870:			f2fs_down_write_trace(&sbi->cp_global_sem, &lc);
1871:	
1872:		stat_cp_time(cpc, CP_TIME_LOCK);
1873:	
1874:		if (!is_sbi_flag_set(sbi, SBI_IS_DIRTY) &&
1875:			((cpc->reason & CP_FASTBOOT) || (cpc->reason & CP_SYNC) ||
1876:			((cpc->reason & CP_DISCARD) && !sbi->discard_blks)))
1877:			goto out;
1878:		if (unlikely(f2fs_cp_error(sbi))) {
1879:			err = -EIO;
1880:			goto out;
1881:		}
1882:	
1883:		trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, CP_PHASE_START_BLOCK_OPS);
1884:	
1885:		err = block_operations(sbi);
1886:		if (err)
1887:			goto out;
1888:	
1889:		stat_cp_time(cpc, CP_TIME_OP_LOCK);
1890:	
1891:		trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, CP_PHASE_FINISH_BLOCK_OPS);
1892:	
1893:		f2fs_flush_merged_writes(sbi);
1894:	
1895:		/* this is the case of multiple fstrims without any changes */
1896:		if (cpc->reason & CP_DISCARD) {
1897:			if (!f2fs_exist_trim_candidates(sbi, cpc)) {
1898:				unblock_operations(sbi);
1899:				goto out;
1900:			}
1901:	
1902:			if (NM_I(sbi)->nat_cnt[DIRTY_NAT] == 0 &&
1903:					SIT_I(sbi)->dirty_sentries == 0 &&
1904:					prefree_segments(sbi) == 0) {
1905:				f2fs_flush_sit_entries(sbi, cpc);
1906:				f2fs_clear_prefree_segments(sbi, cpc);
1907:				unblock_operations(sbi);
1908:				goto out;
1909:			}
1910:		}
1911:		stat_cp_time(cpc, CP_TIME_MERGE_WRITE);
1912:	
1913:		/*
1914:		 * update checkpoint pack index
1915:		 * Increase the version number so that
1916:		 * SIT entries and seg summaries are written at correct place
1917:		 */
1918:		ckpt_ver = cur_cp_version(ckpt);
1919:		ckpt->checkpoint_ver = cpu_to_le64(++ckpt_ver);
1920:	
1921:		/* write cached NAT/SIT entries to NAT/SIT area */
1922:		err = f2fs_flush_nat_entries(sbi, cpc);
1923:		if (err) {
1924:			f2fs_err(sbi, "f2fs_flush_nat_entries failed err:%d, stop checkpoint", err);
1925:			f2fs_bug_on(sbi, !f2fs_cp_error(sbi));
1926:			goto stop;
1927:		}
1928:		stat_cp_time(cpc, CP_TIME_FLUSH_NAT);
1929:	
1930:		f2fs_flush_sit_entries(sbi, cpc);
1931:	
1932:		stat_cp_time(cpc, CP_TIME_FLUSH_SIT);
1933:	
1934:		/* save inmem log status */
1935:		f2fs_save_inmem_curseg(sbi);
1936:	
1937:		err = do_checkpoint(sbi, cpc);
1938:		if (err) {
1939:			f2fs_err(sbi, "do_checkpoint failed err:%d, stop checkpoint", err);
1940:			f2fs_bug_on(sbi, !f2fs_cp_error(sbi));
1941:			f2fs_release_discard_addrs(sbi);
1942:		} else {
1943:			f2fs_clear_prefree_segments(sbi, cpc);
1944:		}
1945:	
1946:		f2fs_restore_inmem_curseg(sbi);
1947:		f2fs_reinit_atgc_curseg(sbi);
1948:		stat_inc_cp_count(sbi);
1949:	stop:
1950:		unblock_operations(sbi);
1951:		stat_cp_time(cpc, CP_TIME_END);
1952:		check_cp_time(sbi, cpc);
1953:	
1954:		if (cpc->reason & CP_RECOVERY)
1955:			f2fs_notice(sbi, "checkpoint: version = %llx", ckpt_ver);
1956:	
1957:		/* update CP_TIME to trigger checkpoint periodically */
1958:		f2fs_update_time(sbi, CP_TIME);
1959:		trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, CP_PHASE_FINISH_CHECKPOINT);
1960:	out:
1961:		if (cpc->reason != CP_RESIZE)
1962:			f2fs_up_write_trace(&sbi->cp_global_sem, &lc);
1963:		return err;
1964:	}
 SourceFile:fs/f2fs/checkpoint.c]

gemini-3.1-pro-preview

							input: 150027
							output: 18
							thoughts: 1801
						

**F2FS Discard Command Analysis**

Okay, so if `SBI_CP_DISABLED` is set, `f2fs_write_checkpoint` immediately returns, that's straightforward. So, `f2fs_clear_prefree_segments` won't be called. This means no new discard commands will be added during the error path of `f2fs_fill_super`.

Thus, the only way to trigger this seems to be through `__f2fs_remount` with the `nodiscard` option. But, `__f2fs_remount` needs `CAP_SYS_ADMIN` in the initial user namespace. This makes the bug inaccessible to unprivileged processes and user namespaces.

I need to confirm there is no other way to reach `__f2fs_remount`. No, it is only invoked from VFS `reconfigure_super`.

Let's break down the dimensions: Exploitable? No, it's just a warning/crash. Denial of Service? Yes, if `CONFIG_F2FS_CHECK_FS` is enabled, it crashes the kernel. Accessibility? No, not from unprivileged or user namespace processes. Triggerable from VMs, networks, peripherals, or malicious filesystems? No, because of the `CAP_SYS_ADMIN` requirement and no automatic remount.

Could a crafted filesystem image somehow trigger `f2fs_issue_discard_timeout` during the mount (error) path? During mount errors, we go through `free_sm`, `f2fs_destroy_segment_manager`, `destroy_discard_cmd_control`, and ultimately `f2fs_issue_discard_timeout`. However, during an error, the checkpoint thread is already stopped (`f2fs_stop_ckpt_thread`) and `SBI_CP_DISABLED` is set. So there's no concurrent checkpoint adding discards. Okay, what if an image has corrupted data so that `discard_cmd_cnt` is non-zero, even without the checkpoint?

How could `discard_cmd_cnt` be non-zero? Only if `__wait_all_discard_cmd` doesn't wait for all commands. When would it *not* wait for all commands? If a command is in `pend_list` but not in `D_PREP` state? No, it is always `D_PREP`. If a command is in `wait_list` but the `di.len` is less than `dpolicy->granularity`? `dpolicy->granularity` is 1 and `di.len` is always >= 1. If `__submit_discard_cmd` fails with `-EOPNOTSUPP`? The command remains in `pend_list` with `D_PREP` state and is removed by `__drop_discard_cmd`. If `__submit_zone_reset_cmd` is called? It moves it to the `wait_list`, and then `__wait_all_discard_cmd` will wait for it. If `__remove_discard_cmd` returns early because `dc->bio_ref` is not 0? No, that can't happen.

Alright, what about `f2fs_issue_discard_timeout` getting called? This calls `__issue_discard_cmd`. If `dpolicy.timeout` is true, `__issue_discard_cmd` might break early. Then `__drop_discard_cmd` removes remaining commands from `pend_list`. Then `__wait_all_discard_cmd` waits for commands from `wait_list` and `fstrim_list`. Does `__drop_discard_cmd` ever *not* remove a command from `pend_list`? No, it iterates through all of them and removes everything. So `pend_list` is always empty after this.

What if `__remove_discard_cmd` is called but `dc->ref` is not 0? It triggers a `f2fs_bug_on`. But `dc->ref` is incremented in `__wait_discard_cmd_range` when waiting for a command in `wait_list`. Commands in `pend_list` have `ref == 0`.

What if `__wait_discard_cmd_range` is called, finds a command, increments the ref, and calls `__wait_one_discard_bio`? It waits for the bio, decrements `ref`, and if `ref == 0`, it calls `__remove_discard_cmd`. Concurrency: `f2fs_issue_discard_timeout` is called by `__f2fs_remount` or `destroy_discard_cmd_control`. The discard thread is stopped during `__f2fs_remount`. What if another thread

map[Expression:case FITRIM:]

map[Output:fs/btrfs/ioctl.c=5141=long btrfs_ioctl(struct file *file, unsigned int
--
fs/btrfs/ioctl.c-5155-		return btrfs_ioctl_set_fslabel(file, argp);
fs/btrfs/ioctl.c:5156:	case FITRIM:
fs/btrfs/ioctl.c-5157-		return btrfs_ioctl_fitrim(fs_info, argp);
--
fs/ecryptfs/file.c=365=ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
--
fs/ecryptfs/file.c-373-	switch (cmd) {
fs/ecryptfs/file.c:374:	case FITRIM:
fs/ecryptfs/file.c-375-	case FS_IOC_GETFLAGS:
--
fs/ecryptfs/file.c=390=ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
--
fs/ecryptfs/file.c-398-	switch (cmd) {
fs/ecryptfs/file.c:399:	case FITRIM:
fs/ecryptfs/file.c-400-	case FS_IOC32_GETFLAGS:
--
fs/exfat/file.c=541=long exfat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/exfat/file.c-552-		return exfat_ioctl_shutdown(inode->i_sb, arg);
fs/exfat/file.c:553:	case FITRIM:
fs/exfat/file.c-554-		return exfat_ioctl_fitrim(inode, arg);
--
fs/ext4/ioctl.c=1532=static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/ext4/ioctl.c-1765-
fs/ext4/ioctl.c:1766:	case FITRIM:
fs/ext4/ioctl.c-1767-	{
--
fs/ext4/ioctl.c=1926=long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
--
fs/ext4/ioctl.c-1969-	case EXT4_IOC_RESIZE_FS:
fs/ext4/ioctl.c:1970:	case FITRIM:
fs/ext4/ioctl.c-1971-	case EXT4_IOC_PRECACHE_EXTENTS:
--
fs/f2fs/file.c=4636=static long __f2fs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/f2fs/file.c-4653-		return f2fs_ioc_shutdown(filp, arg);
fs/f2fs/file.c:4654:	case FITRIM:
fs/f2fs/file.c-4655-		return f2fs_ioc_fitrim(filp, arg);
--
fs/f2fs/file.c=5395=long f2fs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
--
fs/f2fs/file.c-5416-	case F2FS_IOC_SHUTDOWN:
fs/f2fs/file.c:5417:	case FITRIM:
fs/f2fs/file.c-5418-	case FS_IOC_SET_ENCRYPTION_POLICY:
--
fs/fat/file.c=156=long fat_generic_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/fat/file.c-167-		return fat_ioctl_get_volume_id(inode, user_attr);
fs/fat/file.c:168:	case FITRIM:
fs/fat/file.c-169-		return fat_ioctl_fitrim(inode, arg);
--
fs/gfs2/file.c=325=static long gfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/gfs2/file.c-327-	switch(cmd) {
fs/gfs2/file.c:328:	case FITRIM:
fs/gfs2/file.c-329-		return gfs2_fitrim(filp, (void __user *)arg);
--
fs/gfs2/file.c=338=static long gfs2_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/gfs2/file.c-341-	/* Keep this list in sync with gfs2_ioctl */
fs/gfs2/file.c:342:	case FITRIM:
fs/gfs2/file.c-343-	case FS_IOC_GETFSLABEL:
--
fs/hpfs/super.c=206=long hpfs_ioctl(struct file *file, unsigned cmd, unsigned long arg)
--
fs/hpfs/super.c-208-	switch (cmd) {
fs/hpfs/super.c:209:		case FITRIM: {
fs/hpfs/super.c-210-			struct fstrim_range range;
--
fs/jfs/ioctl.c=105=long jfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/jfs/ioctl.c-109-	switch (cmd) {
fs/jfs/ioctl.c:110:	case FITRIM:
fs/jfs/ioctl.c-111-	{
--
fs/nilfs2/ioctl.c=1313=long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/nilfs2/ioctl.c-1352-		return nilfs_ioctl_set_alloc_range(inode, argp);
fs/nilfs2/ioctl.c:1353:	case FITRIM:
fs/nilfs2/ioctl.c-1354-		return nilfs_ioctl_trim_fs(inode, argp);
--
fs/nilfs2/ioctl.c=1365=long nilfs_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/nilfs2/ioctl.c-1383-	case NILFS_IOCTL_SET_ALLOC_RANGE:
fs/nilfs2/ioctl.c:1384:	case FITRIM:
fs/nilfs2/ioctl.c-1385-	case FS_IOC_GETFSLABEL:
--
fs/ntfs3/file.c=152=long ntfs_ioctl(struct file *filp, u32 cmd, unsigned long arg)
--
fs/ntfs3/file.c-162-	switch (cmd) {
fs/ntfs3/file.c:163:	case FITRIM:
fs/ntfs3/file.c-164-		return ntfs_ioctl_fitrim(sbi, arg);
--
fs/ocfs2/ioctl.c=837=long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
--
fs/ocfs2/ioctl.c-914-	}
fs/ocfs2/ioctl.c:915:	case FITRIM:
fs/ocfs2/ioctl.c-916-	{
--
fs/ocfs2/ioctl.c=949=long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg)
--
fs/ocfs2/ioctl.c-977-		return ocfs2_info_handle(inode, &info, 1);
fs/ocfs2/ioctl.c:978:	case FITRIM:
fs/ocfs2/ioctl.c-979-	case OCFS2_IOC_MOVE_EXT:
--
fs/xfs/xfs_ioctl.c=1179=xfs_file_ioctl(
--
fs/xfs/xfs_ioctl.c-1192-	switch (cmd) {
fs/xfs/xfs_ioctl.c:1193:	case FITRIM:
fs/xfs/xfs_ioctl.c-1194-		return xfs_ioc_trim(mp, arg);
]

gemini-3.1-pro-preview

							input: 155008
							output: 46
							thoughts: 14
						

Okay, let's dive into this. Here's my thought process on checking `f2fs_ioc_fitrim`, summarized as if I'm thinking it:

**Analyzing the `f2fs_ioc_fitrim` Function**

Alright, time to focus on `f2fs_ioc_fitrim`. This one's important, as it deals with TRIM functionality for F2FS. Let me refresh my memory of the general F2FS architecture first. I need to understand how TRIM is implemented in this specific filesystem. Specifically, I need to know how it interfaces with the underlying hardware and the potential performance implications. 

First, I need to look at the interface itself. What are the inputs to `f2fs_ioc_fitrim`? What data structures does it utilize? I'm expecting to see something that defines the start sector and the length of the TRIM range. Are there any flags or options involved? Understanding these details will be key to identifying potential issues or areas for optimization.

Then, I need to trace the execution flow. Where is this function called from? Is it initiated by user-space applications through a specific `ioctl` call, or perhaps triggered internally by the kernel? That's going to be critical.

Next, I have to figure out the actual TRIM implementation within the function. Does it use the standard block device interface? Does it handle any F2FS-specific metadata updates? Does it need to consider the wear-leveling algorithm? Also, I need to verify that all the correct error handling is in place. Are there any race conditions or data corruption risks?

I also need to check for potential performance bottlenecks. Is it using asynchronous TRIM commands, or are there blocking operations? How does the TRIM process interact with the garbage collection mechanism? Is there any opportunity to batch TRIM commands to reduce overhead? Any lock contention?

I want to assess the robustness of this function. How does it deal with unexpected errors like hardware failures or power loss? Does it incorporate any safeguards to prevent data loss during TRIM operations? I'll probably be looking for any potential vulnerabilities.

Finally, I'll need to think about future improvements. Are there any opportunities to leverage new features in newer hardware or firmware? Can we optimize the TRIM process further for better performance and reliability?

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_ioc_fitrim]

map[SourceCode:2599:	static int f2fs_ioc_fitrim(struct file *filp, unsigned long arg)
2600:	{
2601:		struct inode *inode = file_inode(filp);
2602:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
2603:		struct fstrim_range range;
2604:		int ret;
2605:	
2606:		if (!capable(CAP_SYS_ADMIN))
2607:			return -EPERM;
2608:	
2609:		if (!f2fs_hw_support_discard(sbi))
2610:			return -EOPNOTSUPP;
2611:	
2612:		if (copy_from_user(&range, (struct fstrim_range __user *)arg,
2613:					sizeof(range)))
2614:			return -EFAULT;
2615:	
2616:		ret = mnt_want_write_file(filp);
2617:		if (ret)
2618:			return ret;
2619:	
2620:		range.minlen = max_t(unsigned int, range.minlen,
2621:				f2fs_hw_discard_granularity(sbi));
2622:		ret = f2fs_trim_fs(sbi, &range);
2623:		mnt_drop_write_file(filp);
2624:		if (ret < 0)
2625:			return ret;
2626:	
2627:		if (copy_to_user((struct fstrim_range __user *)arg, &range,
2628:					sizeof(range)))
2629:			return -EFAULT;
2630:		f2fs_update_time(sbi, REQ_TIME);
2631:		return 0;
2632:	}
 SourceFile:fs/f2fs/file.c]

gemini-3.1-pro-preview

							input: 156094
							output: 17
							thoughts: 839
						

**F2FS TRIM Bug Analysis**

Okay, so here's the deal with this `f2fs_ioc_fitrim` thing. It needs `CAP_SYS_ADMIN`, which means a regular, unprivileged user can't just go running `FITRIM`. That much is straightforward.

My next thought was, is there any other way to get to `__wait_discard_cmd_range`? Turns out, no. It's only called from `__wait_all_discard_cmd` and `f2fs_trim_fs`. Both of those also need `CAP_SYS_ADMIN`. So, right off the bat, this looks like a privileged user (root) issue.

And even then, the worst-case scenario in a production build is a `WARN_ON` and setting `SBI_NEED_FSCK`. If `CONFIG_F2FS_CHECK_FS` is on, you get a `BUG_ON`, effectively a Denial of Service. But since it needs `CAP_SYS_ADMIN`, it's not a security vulnerability in the usual sense. This is not exploitable by a normal user.

But wait, could something else trigger `f2fs_issue_discard_timeout`? Let's consider unmounting. Nope, that also requires `CAP_SYS_ADMIN`. How about unplugging a USB drive? That forces an unmount, but during that process, `f2fs_put_super` gets called. Now, I've analyzed `f2fs_put_super`, and it stops the checkpoint thread BEFORE calling `f2fs_destroy_segment_manager`. So, there's no concurrent checkpoint thread active during unplug. That race condition is a non-issue in that scenario.

Okay, new thought, what if a user plugs in a USB drive, it gets auto-mounted, and then they run something that triggers `f2fs_issue_discard_timeout`? But the user can't trigger `f2fs_issue_discard_timeout` without `CAP_SYS_ADMIN`. That means the user can't trigger the bug.

Hang on... the syzkaller report says `UID: 0 PID: 7532 Comm: syz.1.186`. It was triggered by root! The call trace: `__f2fs_remount` -> `f2fs_reconfigure` -> `reconfigure_super` -> `do_remount` -> `path_mount` -> `do_mount` -> `__do_sys_mount` -> `__se_sys_mount` -> `do_syscall_x64`. That matches up perfectly. Looks like `mount -o remount` is the key – it triggers `__f2fs_remount`. Because this also needs `CAP_SYS_ADMIN`, an unprivileged process can't cause this issue.

Now, can a user namespace somehow get around this? Let's check if `f2fs` can even be mounted in a user namespace. I check the `FS_USERNS_MOUNT` flag and *f2fs* doesn't have it. No go. So it cannot be mounted in a user namespace. But, can a user namespace remount something mounted by the initial user namespace?

Well, `mount -o remount` also needs `CAP_SYS_ADMIN` in the *owning* user namespace. If the mount namespace was created by the initial one, the user namespace can't remount it. If the user namespace *creates* a new mount namespace, it *can* remount filesystems mounted in that new namespace. But because `f2fs` lacks `FS_USERNS_MOUNT`, it can't be mounted in the new mount namespace.

But wait again, new mount namespaces inherit mounts from their parent! Can the user namespace remount those inherited mounts? No, the kernel prevents remounting inherited mounts unless the user namespace *owns* the mount namespace where the original mount was created. Let's dig into `fs/namespace.c` to be sure. This reinforces my understanding: This is only a privilege escalation vector that can't be exploited from unprivileged processes.

map[Expression:may_mount]

map[Output:fs/fsopen.c=120=SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
--
fs/fsopen.c-126-
fs/fsopen.c:127:	if (!may_mount())
fs/fsopen.c-128-		return -EPERM;
--
fs/fsopen.c=163=SYSCALL_DEFINE3(fspick, int, dfd, const char __user *, path, unsigned int, flags)
--
fs/fsopen.c-169-
fs/fsopen.c:170:	if (!may_mount())
fs/fsopen.c-171-		return -EPERM;
--
fs/gfs2/lock_dlm.c=384=static void gdlm_cancel(struct gfs2_glock *gl)
--
fs/gfs2/lock_dlm.c-494- * the first mount recovery, blocking mounts from other nodes, then demotes
fs/gfs2/lock_dlm.c:495: * control_lock to NL when it's done (others_may_mount/first_done),
fs/gfs2/lock_dlm.c-496- * allowing other nodes to continue mounting.
--
fs/gfs2/ops_fstype.c=441=static int init_sb(struct gfs2_sbd *sdp, int silent)
--
fs/gfs2/ops_fstype.c-511-
fs/gfs2/ops_fstype.c:512:static void gfs2_others_may_mount(struct gfs2_sbd *sdp)
fs/gfs2/ops_fstype.c-513-{
--
fs/gfs2/ops_fstype.c=694=static int init_journal(struct gfs2_sbd *sdp, int undo)
--
fs/gfs2/ops_fstype.c-801-
fs/gfs2/ops_fstype.c:802:		gfs2_others_may_mount(sdp);
fs/gfs2/ops_fstype.c-803-	} else if (!sdp->sd_args.ar_spectator) {
--
fs/internal.h=89=extern void dissolve_on_fput(struct vfsmount *);
fs/internal.h:90:extern bool may_mount(void);
fs/internal.h-91-
--
fs/namespace.c=1976=void __detach_mounts(struct dentry *dentry)
--
fs/namespace.c-2001- */
fs/namespace.c:2002:bool may_mount(void)
fs/namespace.c-2003-{
--
fs/namespace.c=2016=static int can_umount(const struct path *path, int flags)
--
fs/namespace.c-2020-
fs/namespace.c:2021:	if (!may_mount())
fs/namespace.c-2022-		return -EPERM;
--
fs/namespace.c=2351=static bool check_for_nsfs_mounts(struct mount *subtree)
--
fs/namespace.c-2366- *
fs/namespace.c:2367: * This assumes caller has called or done the equivalent of may_mount().
fs/namespace.c-2368- *
--
fs/namespace.c=3177=static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned int flags)
--
fs/namespace.c-3210-
fs/namespace.c:3211:	if ((flags & OPEN_TREE_CLONE) && !may_mount())
fs/namespace.c-3212-		return ERR_PTR(-EPERM);
--
fs/namespace.c=4084=int path_mount(const char *dev_name, const struct path *path,
--
fs/namespace.c-4103-		return ret;
fs/namespace.c:4104:	if (!may_mount())
fs/namespace.c-4105-		return -EPERM;
--
fs/namespace.c=4406=SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
--
fs/namespace.c-4416-
fs/namespace.c:4417:	if (!may_mount())
fs/namespace.c-4418-		return -EPERM;
--
fs/namespace.c=4536=SYSCALL_DEFINE5(move_mount,
--
fs/namespace.c-4546-
fs/namespace.c:4547:	if (!may_mount())
fs/namespace.c-4548-		return -EPERM;
--
fs/namespace.c=4630=int path_pivot_root(struct path *new, struct path *old)
--
fs/namespace.c-4635-
fs/namespace.c:4636:	if (!may_mount())
fs/namespace.c-4637-		return -EPERM;
--
fs/namespace.c=5071=static int wants_mount_setattr(struct mount_attr __user *uattr, size_t usize,
--
fs/namespace.c-5083-
fs/namespace.c:5084:	if (!may_mount())
fs/namespace.c-5085-		return -EPERM;
--
fs/sysfs/mount.c=55=static int sysfs_init_fs_context(struct fs_context *fc)
--
fs/sysfs/mount.c-60-	if (!(fc->sb_flags & SB_KERNMOUNT)) {
fs/sysfs/mount.c:61:		if (!kobj_ns_current_may_mount(KOBJ_NS_TYPE_NET))
fs/sysfs/mount.c-62-			return -EPERM;
--
include/linux/kobject_ns.h=39=struct kobj_ns_type_operations {
include/linux/kobject_ns.h-40-	enum kobj_ns_type type;
include/linux/kobject_ns.h:41:	bool (*current_may_mount)(void);
include/linux/kobject_ns.h-42-	void *(*grab_current_ns)(void);
--
include/linux/kobject_ns.h=51=const struct kobj_ns_type_operations *kobj_ns_ops(const struct kobject *kobj);
include/linux/kobject_ns.h-52-
include/linux/kobject_ns.h:53:bool kobj_ns_current_may_mount(enum kobj_ns_type type);
include/linux/kobject_ns.h-54-void *kobj_ns_grab_current(enum kobj_ns_type type);
--
lib/kobject.c=1069=const struct kobj_ns_type_operations *kobj_ns_ops(const struct kobject *kobj)
--
lib/kobject.c-1073-
lib/kobject.c:1074:bool kobj_ns_current_may_mount(enum kobj_ns_type type)
lib/kobject.c-1075-{
lib/kobject.c:1076:	bool may_mount = true;
lib/kobject.c-1077-
--
lib/kobject.c-1079-	if (kobj_ns_type_is_valid(type) && kobj_ns_ops_tbl[type])
lib/kobject.c:1080:		may_mount = kobj_ns_ops_tbl[type]->current_may_mount();
lib/kobject.c-1081-	spin_unlock(&kobj_ns_type_lock);
lib/kobject.c-1082-
lib/kobject.c:1083:	return may_mount;
lib/kobject.c-1084-}
--
net/core/net-sysfs.c=2160=static void remove_queue_kobjects(struct net_device *dev)
--
net/core/net-sysfs.c-2180-
net/core/net-sysfs.c:2181:static bool net_current_may_mount(void)
net/core/net-sysfs.c-2182-{
--
net/core/net-sysfs.c=2208=const struct kobj_ns_type_operations net_ns_type_operations = {
net/core/net-sysfs.c-2209-	.type = KOBJ_NS_TYPE_NET,
net/core/net-sysfs.c:2210:	.current_may_mount = net_current_may_mount,
net/core/net-sysfs.c-2211-	.grab_current_ns = net_grab_current_ns,
]

gemini-3.1-pro-preview

							input: 160129
							output: 44
							thoughts: 412
						

**Analyzing Mount Capability in Linux Kernel**

Okay, so I'm diving into the `fs/namespace.c` code to understand how mount permissions are handled, specifically the interaction between user namespaces and mount namespaces. My immediate thought is that `may_mount()` requires `CAP_SYS_ADMIN` within the user namespace that owns the mount namespace. Makes sense – if a user creates a new user namespace *and* a new mount namespace, they'll have `CAP_SYS_ADMIN` in *that* user namespace, and `may_mount()` will evaluate to true.

But hold on, there's `path_mount`, which also calls `mount_capable(fc)`. Now, that's interesting because `mount_capable` is called during the `fsopen` or `fsmount` operations, and it looks like it requires `CAP_SYS_ADMIN` unless the filesystem is explicitly marked with `FS_USERNS_MOUNT`, in which case it checks for `CAP_SYS_ADMIN` in the provided `user_ns`.

Now, I'm tracing the `mount -o remount` path, and I'm seeing it goes through `do_remount`. This is where it gets interesting, because `do_remount` checks *only* `may_mount()`. There's no check for `mount_capable(fc)` here! That's a potential vulnerability.

Then, there's `reconfigure_super`, which creates an `fs_context` to reconfigure the mount.  And `fs_context_for_reconfigure` is the key. Let me see where that's called. This needs further investigation. It seems like the reconfiguration path might be bypassing the more stringent `mount_capable` check.

map[ContextFile:fs/fs_context.c IncludeLines:true Name:fs_context_for_reconfigure]

map[SourceCode: 314:	struct fs_context *fs_context_for_reconfigure(struct dentry *dentry,
 315:						unsigned int sb_flags,
 316:						unsigned int sb_flags_mask)
 317:	{
 318:		return alloc_fs_context(dentry->d_sb->s_type, dentry, sb_flags,
 319:					sb_flags_mask, FS_CONTEXT_FOR_RECONFIGURE);
 320:	}
 SourceFile:fs/fs_context.c]

gemini-3.1-pro-preview

							input: 161116
							output: 41
							thoughts: 11
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `alloc_fs_context`**

Alright, time to dive in. My mind immediately goes to `alloc_fs_context`. Let's get right to it. I want to check this function. What exactly is happening here? I want to see how this function works, considering the context.

map[ContextFile:fs/fs_context.c IncludeLines:true Name:alloc_fs_context]

map[SourceCode: 245:	/**
 246:	 * alloc_fs_context - Create a filesystem context.
 247:	 * @fs_type: The filesystem type.
 248:	 * @reference: The dentry from which this one derives (or NULL)
 249:	 * @sb_flags: Filesystem/superblock flags (SB_*)
 250:	 * @sb_flags_mask: Applicable members of @sb_flags
 251:	 * @purpose: The purpose that this configuration shall be used for.
 252:	 *
 253:	 * Open a filesystem and create a mount context.  The mount context is
 254:	 * initialised with the supplied flags and, if a submount/automount from
 255:	 * another superblock (referred to by @reference) is supplied, may have
 256:	 * parameters such as namespaces copied across from that superblock.
 257:	 */
 258:	static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
 259:					      struct dentry *reference,
 260:					      unsigned int sb_flags,
 261:					      unsigned int sb_flags_mask,
 262:					      enum fs_context_purpose purpose)
 263:	{
 264:		struct fs_context *fc;
 265:		int ret = -ENOMEM;
 266:	
 267:		fc = kzalloc_obj(struct fs_context, GFP_KERNEL_ACCOUNT);
 268:		if (!fc)
 269:			return ERR_PTR(-ENOMEM);
 270:	
 271:		fc->purpose	= purpose;
 272:		fc->sb_flags	= sb_flags;
 273:		fc->sb_flags_mask = sb_flags_mask;
 274:		fc->fs_type	= get_filesystem(fs_type);
 275:		fc->cred	= get_current_cred();
 276:		fc->net_ns	= get_net(current->nsproxy->net_ns);
 277:		fc->log.prefix	= fs_type->name;
 278:	
 279:		mutex_init(&fc->uapi_mutex);
 280:	
 281:		switch (purpose) {
 282:		case FS_CONTEXT_FOR_MOUNT:
 283:			fc->user_ns = get_user_ns(fc->cred->user_ns);
 284:			break;
 285:		case FS_CONTEXT_FOR_SUBMOUNT:
 286:			fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);
 287:			break;
 288:		case FS_CONTEXT_FOR_RECONFIGURE:
 289:			atomic_inc(&reference->d_sb->s_active);
 290:			fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);
 291:			fc->root = dget(reference);
 292:			break;
 293:		}
 294:	
 295:		ret = fc->fs_type->init_fs_context(fc);
 296:		if (ret < 0)
 297:			goto err_fc;
 298:		fc->need_free = true;
 299:		return fc;
 300:	
 301:	err_fc:
 302:		put_fs_context(fc);
 303:		return ERR_PTR(ret);
 304:	}
 SourceFile:fs/fs_context.c]

gemini-3.1-pro-preview

							input: 162251
							output: 66
							thoughts: 1684
						

**Analysis of the F2FS Discard Timeout Bug**

Okay, let's break this down. My initial thought was that `alloc_fs_context` was the key, but it's not checking `mount_capable` as I had assumed. However, `reconfigure_super` does check `ns_capable`. And since the filesystem in question, f2fs, does not have `FS_USERNS_MOUNT`, it can only be mounted in the initial user namespace. Thus, `reconfigure_super` is going to check against the initial user namespace. This means that an unprivileged user in a user namespace CANNOT remount, even with `CAP_SYS_ADMIN` in their own namespace, because `reconfigure_super` is checking the superblock's user namespace, which is `init_user_ns`.

So, straight away, this is not something an unprivileged process or user namespace can trigger.

Let's summarise. It's not exploitable because it's only a `WARN_ON` in production code. A denial-of-service is possible if `CONFIG_F2FS_CHECK_FS` is enabled, but it requires `CAP_SYS_ADMIN`. And it's not accessible from unprivileged processes or user namespaces. VM guests and hosts are not relevant here, and it's not an ethernet network or peripheral trigger, nor is there a malicious filesystem trigger since remounting with the `nodiscard` option doesn't happen automatically.

The next question: Is there any *other* way to get to that `f2fs_issue_discard_timeout` function? What if `f2fs_put_super` is called during unmount? I've analyzed that the checkpoint thread is already stopped then, so no concurrent checkpoint can run to add new discard commands. What about `f2fs_unfreeze`? That also requires `CAP_SYS_ADMIN`. So there's no unprivileged trigger.

What if there's a concurrent `FITRIM` ioctl with `f2fs_put_super` calling `f2fs_issue_discard_timeout`? No good, because `FITRIM` requires `CAP_SYS_ADMIN` (or the equivalent).

Okay, what about a maliciously crafted filesystem image? Could corrupted data cause `discard_cmd_cnt` to be non-zero without a checkpoint? But wait, `discard_cmd_cnt` is initialized to zero and incremented only when new discard commands are created during runtime operations (checkpoint, trim), not from reading corrupted data from disk. However, `f2fs_clear_prefree_segments` reads the `prefree_map` from `dirty_i->dirty_segmap[PRE]`. If the filesystem *is* corrupted, it might have many bits set, but this call happens during a checkpoint, and isn't triggered during mount.

What about `f2fs_recover_fsync_data`? If it recovers data after mount, this triggers a checkpoint, it might dirty pages and then run `f2fs_write_checkpoint`. However, `f2fs_fill_super` doesn't call `f2fs_write_checkpoint` directly. `f2fs_fill_super` does start the checkpoint thread, and an error might occur *after* the checkpoint thread has started and is writing a checkpoint. Now, the checkpoint thread has run, potentially calling `f2fs_clear_prefree_segments` which may create discard commands. If an error occurs, it stops the thread, and `destroy_discard_cmd_control` is called. However, there's no concurrent checkpoint and the thread is stopped, so `discard_cmd_cnt` should be zero. No bug.

What if the discard thread is running at the same time? `f2fs_fill_super` also starts the discard thread. Again, if an error occurs, it stops the thread before `f2fs_destroy_segment_manager` is called. So, the discard thread is stopped.

So, there is *no* way to trigger this from a malicious filesystem image during mount.

Therefore, this bug is *only* triggerable by a privileged user (root) executing `mount -o remount,nodiscard` while a checkpoint is running concurrently. And because root privileges are required, this is not a security vulnerability.

Let's quickly double-check: is there any other way to get to `__f2fs_remount`? No, it's only called from `reconfigure_super` which requires `ns_capable(fc->user_ns, CAP_SYS_ADMIN)`. For f2fs, that `fc->user_ns` is the initial user namespace.

I'm confident in this analysis.

map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

map[DenialOfService:false Exploitable:false FilesystemTrigger:false NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:false UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]

gemini-3.1-pro-preview

							input: 165085
							output: 605
							thoughts: 601
						

**My Analysis of the F2FS Remount Bug**

Okay, so I initially set DenialOfService to false, and that's the right call here. If root can crash the kernel, it's generally *not* a security vulnerability, as root already has unfettered control. So, the `DenialOfService=false` setting is accurate given the established security boundaries.

Let me break down the core issue: It's a race condition. Specifically, a race between `__f2fs_remount` when using the `nodiscard` option, and a concurrent checkpoint operation, be it the background thread or a `sync` call. The problem arises because `__f2fs_remount`, when handling `nodiscard`, stops the discard thread and then calls `f2fs_issue_discard_timeout()`. This routine attempts to flush or wait for existing discard commands and *then* checks if `discard_cmd_cnt` is zero using `f2fs_bug_on()`.

The critical vulnerability is that `__f2fs_remount` doesn't hold the checkpoint lock (`sbi->cp_global_sem`). This opens the door for a concurrent checkpoint process to run, which could call `f2fs_clear_prefree_segments()`. This in turn adds new discard commands, incrementing `discard_cmd_cnt`. If this happens *after* `f2fs_issue_discard_timeout()` has cleared the existing commands but *before* the count is checked, then `discard_cmd_cnt` ends up non-zero, and the `f2fs_bug_on()` is triggered.

Now, even though the bug exists, it's not a major threat. In typical production kernels, `CONFIG_F2FS_CHECK_FS` is disabled, so the `f2fs_bug_on()` turns into a simple `WARN_ON` and sets the `SBI_NEED_FSCK` flag. This doesn't crash the system or corrupt memory. If `CONFIG_F2FS_CHECK_FS` is enabled, it results in a kernel panic via `BUG_ON`, but this is still not exploitable in terms of memory corruption.

Importantly, triggering this requires the `mount -o remount,nodiscard` command. The `f2fs` filesystem doesn't support `FS_USERNS_MOUNT`, so it cannot be mounted or remounted from within an unprivileged user namespace. You need `CAP_SYS_ADMIN` in the initial user namespace (root privileges) to remount. This means the bug is strictly within the domain of a fully privileged user. Since it doesn't cross any security boundaries, it's not a security vulnerability. There's no way to trigger it as an unprivileged user, via user namespaces, or by auto-mounting a malicious filesystem. So, it's not an immediate risk.

map[Explanation:Based on the analysis of the bug report and the kernel source code, here is the
assessment of the security impact:

**Root Cause Analysis:**
The bug is a race condition between `__f2fs_remount` (specifically when
remounting with the `nodiscard` option) and a concurrent checkpoint operation
(e.g., from the background checkpoint thread or a `sync` call).
When `__f2fs_remount` processes the `nodiscard` option, it stops the discard
thread and calls `f2fs_issue_discard_timeout()`. This function attempts to drop
or wait for all pending discard commands and then asserts that `discard_cmd_cnt`
is zero using `f2fs_bug_on()`.
However, `__f2fs_remount` does not hold the checkpoint lock
(`sbi->cp_global_sem`) during this process. A concurrent checkpoint can run and
call `f2fs_clear_prefree_segments()`, which adds new discard commands to the
pending list and increments `discard_cmd_cnt`. If this happens after
`f2fs_issue_discard_timeout()` has dropped the existing commands but before it
checks the count, `discard_cmd_cnt` will be non-zero, triggering the
`f2fs_bug_on()`.

**Security Impact:**
* **Exploitable / Denial of Service:** In production kernels,
`CONFIG_F2FS_CHECK_FS` is typically disabled. In this configuration,
`f2fs_bug_on()` is defined to merely emit a `WARN_ON` and set the
`SBI_NEED_FSCK` flag, which does not crash the system or cause memory
corruption. Even if `CONFIG_F2FS_CHECK_FS` is enabled (as in the syzkaller
reproducer), it results in a `BUG_ON` (a kernel panic), but it does not lead to
an exploitable memory corruption (like a use-after-free or out-of-bounds
access).
* **Privilege Requirements:** Triggering this bug requires executing `mount -o
remount,nodiscard`. The `f2fs` filesystem does not have the `FS_USERNS_MOUNT`
flag, meaning it cannot be mounted or remounted within an unprivileged user
namespace. The VFS `reconfigure_super()` function enforces that remounting an
`f2fs` filesystem requires `CAP_SYS_ADMIN` in the initial user namespace (i.e.,
root privileges).

Since the bug can only be triggered by a fully privileged user (root), it does
not cross any security boundaries and is not considered a security
vulnerability. It cannot be triggered by unprivileged users, via user
namespaces, or by auto-mounting a malicious filesystem image (as auto-mounting
does not concurrently remount with `nodiscard`).]