map[DenialOfService:false Explanation:The bug is a `kernel BUG` triggered in `f2fs_do_truncate_blocks` when `count <
0`. This happens because `count` is calculated as `ADDRS_PER_PAGE(dn.node_folio,
inode) - dn.ofs_in_node`. For compressed files, `ADDRS_PER_PAGE` aligns the
number of addresses down to the cluster size. If the cluster size is large
(e.g., 256 blocks) and the truncation offset falls within the unaligned
remainder of the node block (e.g., between 768 and 922 for an inode block),
`dn.ofs_in_node` can be greater than `ADDRS_PER_PAGE`, resulting in a negative
`count`.

**Exploitable / Denial of Service:**
In the syzbot report, this triggers a `kernel BUG` because the kernel was
compiled with `CONFIG_F2FS_CHECK_FS=y`, which defines `f2fs_bug_on` as `BUG_ON`.
However, in production builds, `CONFIG_F2FS_CHECK_FS` is disabled (it is a
debugging feature). When disabled, `f2fs_bug_on` is defined as a `WARN_ON` that
sets the `SBI_NEED_FSCK` flag.
If we trace the execution with a negative `count` in a production build:
1. `f2fs_truncate_data_blocks_range` is called with a negative `count`. Its
internal loop `for (; count > 0; ...)` immediately terminates, doing nothing.
2. `free_from += count` decreases the `free_from` offset.
3. `f2fs_truncate_inode_blocks` is called with the decreased `free_from`. It
either returns `-EFSCORRUPTED` (if `free_from` falls into the direct pointers of
the inode) or truncates the entire direct node block (causing data loss for the
user's own file).
In all cases, there is no out-of-bounds memory access, no infinite loop, no
deadlock, and no kernel panic. The bug is completely benign in production
builds, causing only a kernel warning and potential data loss for the user's own
file. Therefore, it is neither exploitable nor a Denial of Service.

**Unprivileged / User Namespace:**
An unprivileged user can trigger this bug on any mounted F2FS filesystem that
has compression enabled. They can create a file, enable compression
(`FS_COMPR_FL`), set the cluster size to 256 via the
`F2FS_IOC_SET_COMPRESS_OPTION` ioctl (which requires no special capabilities),
and then call `truncate()` to a specific size that maps to the vulnerable offset
range. Since no capabilities are required, it is accessible from unprivileged
processes and user namespaces.

**Malicious Filesystem Trigger:**
The bug can also be triggered during the `mount` of a maliciously crafted F2FS
image. As seen in the call trace, if `f2fs_fill_super` fails and cleans up
orphan inodes, it calls `evict` -> `f2fs_truncate`, which triggers the bug if
the image contains a compressed inode with a malicious size and cluster size. Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]

map[SimplifiedCRepro:]

map[KernelSrc:/app/workdir/cache/src/e38afd075ec101b77b219b3a7e38f81a60b6acf7]

map[KernelObj:/app/workdir/cache/build/10058ff44de61ff6d8f347a71f8d4c1431bd0846]

map[Index:codesearch-index]

gemini-3.1-pro-preview

map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]

You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.

Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).

Don't make assumptions; verify them with source code access. Try different strategies when analyzing the bug:
 - think of ways in which the vulnerable code is unreachable
 - or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.

Analysis dimensions:

* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.

Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.

* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.

* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).

* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.

* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.

* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).

* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.

* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).

* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.

* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The kernel bug report is:

loop0: detected capacity change from 0 to 131072
F2FS-fs (loop0): QUOTA feature is enabled, so ignore qf_name
F2FS-fs (loop0): build fault injection rate: 7
F2FS-fs (loop0): build fault injection type: 0x40004
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of read_compacted_summaries fs/f2fs/segment.c:4301 [inline]
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of restore_curseg_summaries fs/f2fs/segment.c:4445 [inline]
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of build_curseg+0x105c/0x30c0 fs/f2fs/segment.c:4983
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of restore_curseg_summaries fs/f2fs/segment.c:4452 [inline]
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of build_curseg+0x18ea/0x30c0 fs/f2fs/segment.c:4983
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of build_sit_entries+0x26c/0x1f10 fs/f2fs/segment.c:5000
F2FS-fs (loop0): inject invalid blkaddr in f2fs_is_valid_blkaddr of f2fs_ra_meta_pages+0x21c/0xd60 fs/f2fs/checkpoint.c:472
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of f2fs_get_meta_folio_retry+0x27/0x80 fs/f2fs/checkpoint.c:318
F2FS-fs (loop0): inject page alloc in f2fs_grab_cache_folio of f2fs_get_meta_folio_retry+0x27/0x80 fs/f2fs/checkpoint.c:318
------------[ cut here ]------------
kernel BUG at fs/f2fs/file.c:845!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845
Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 <0f> 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90
RSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283
RAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000
RDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504
RBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002
R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001
R13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c
FS:  00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff0305c4000 CR3: 0000000012d4c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:882
 f2fs_truncate+0x471/0x7c0 fs/f2fs/file.c:940
 f2fs_evict_inode+0xa3f/0x1ac0 fs/f2fs/inode.c:907
 evict+0x61e/0xb10 fs/inode.c:841
 f2fs_fill_super+0x5f43/0x78f0 fs/f2fs/super.c:5224
 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
 vfs_get_tree+0x92/0x2a0 fs/super.c:1754
 fc_mount fs/namespace.c:1193 [inline]
 do_new_mount_fc fs/namespace.c:3758 [inline]
 do_new_mount+0x341/0xd30 fs/namespace.c:3834
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7e01f9e04a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7e02ee2e18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f7e02ee2ea0 RCX: 00007f7e01f9e04a
RDX: 0000200000000080 RSI: 00002000000105c0 RDI: 00007f7e02ee2e60
RBP: 0000200000000080 R08: 00007f7e02ee2ea0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000105c0
R13: 00007f7e02ee2e60 R14: 0000000000010589 R15: 0000200000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845
Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1 1a 8c e8 54 f1 fc fc 90 0f 0b e8 6c 9d 9a fd 90 <0f> 0b e8 64 9d 9a fd 90 0f 0b 90 e9 93 fd ff ff e8 56 9d 9a fd 90
RSP: 0018:ffffc9000e4474c0 EFLAGS: 00010283
RAX: ffffffff842b1d34 RBX: 0000000000000003 RCX: 0000000000100000
RDX: ffffc9000f03a000 RSI: 0000000000035503 RDI: 0000000000035504
RBP: ffffc9000e447608 R08: ffff8880123b0000 R09: 0000000000000002
R10: 00000000fffffffe R11: 0000000000000002 R12: 0000000000000001
R13: 0000000000000000 R14: 1ffff92001c88ea0 R15: 00000000ffff039c
FS:  00007f7e02ee36c0(0000) GS:ffff88808c887000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e028509c38 CR3: 0000000012d4c000 CR4: 0000000000352ef0

The bug is a `kernel BUG` triggered in `f2fs_do_truncate_blocks` when `count < 0`. This happens because `count` is calculated as `ADDRS_PER_PAGE(dn.node_folio, inode) - dn.ofs_in_node`. For compressed files, `ADDRS_PER_PAGE` aligns the number of addresses down to the cluster size. If the cluster size is large (e.g., 256 blocks) and the truncation offset falls within the unaligned remainder of the node block (e.g., between 768 and 922 for an inode block), `dn.ofs_in_node` can be greater than `ADDRS_PER_PAGE`, resulting in a negative `count`.

**Exploitable / Denial of Service:**
In the syzbot report, this triggers a `kernel BUG` because the kernel was compiled with `CONFIG_F2FS_CHECK_FS=y`, which defines `f2fs_bug_on` as `BUG_ON`. However, in production builds, `CONFIG_F2FS_CHECK_FS` is disabled (it is a debugging feature). When disabled, `f2fs_bug_on` is defined as a `WARN_ON` that sets the `SBI_NEED_FSCK` flag. 
If we trace the execution with a negative `count` in a production build:
1. `f2fs_truncate_data_blocks_range` is called with a negative `count`. Its internal loop `for (; count > 0; ...)` immediately terminates, doing nothing.
2. `free_from += count` decreases the `free_from` offset.
3. `f2fs_truncate_inode_blocks` is called with the decreased `free_from`. It either returns `-EFSCORRUPTED` (if `free_from` falls into the direct pointers of the inode) or truncates the entire direct node block (causing data loss for the user's own file).
In all cases, there is no out-of-bounds memory access, no infinite loop, no deadlock, and no kernel panic. The bug is completely benign in production builds, causing only a kernel warning and potential data loss for the user's own file. Therefore, it is neither exploitable nor a Denial of Service.

**Unprivileged / User Namespace:**
An unprivileged user can trigger this bug on any mounted F2FS filesystem that has compression enabled. They can create a file, enable compression (`FS_COMPR_FL`), set the cluster size to 256 via the `F2FS_IOC_SET_COMPRESS_OPTION` ioctl (which requires no special capabilities), and then call `truncate()` to a specific size that maps to the vulnerable offset range. Since no capabilities are required, it is accessible from unprivileged processes and user namespaces.

**Malicious Filesystem Trigger:**
The bug can also be triggered during the `mount` of a maliciously crafted F2FS image. As seen in the call trace, if `f2fs_fill_super` fails and cleans up orphan inodes, it calls `evict` -> `f2fs_truncate`, which triggers the bug if the image contains a compressed inode with a malicious size and cluster size.

gemini-3.1-pro-preview

							input: 7481
							output: 47
							thoughts: 226
						

**Analyzing a Truncation Bug During f2fs Mount**

Okay, so I've got a kernel BUG report, and it's pointing me directly to `f2fs_do_truncate_blocks` in the f2fs file system code, specifically at line 845 in `fs/f2fs/file.c`. The call trace is pretty clear: it starts with `f2fs_do_truncate_blocks`, then moves through `f2fs_truncate_blocks`, `f2fs_truncate`, and winds its way back through `f2fs_evict_inode`, `evict`, and eventually into the mount process with `f2fs_fill_super`, `get_tree_bdev_flags`, `vfs_get_tree`, and so on, all the way back to the system call level. 

The immediate trigger is a mount operation, which narrows down the scope of the problem considerably. This means something in the initialization or setup phase of the filesystem is causing this truncation function to be called in an invalid context, or with incorrect parameters.

My next step is definitely to examine the code at `fs/f2fs/file.c:845`. I need to understand what's happening within that specific function call, its inputs, and its relationship to the mount process. I'll need to look at what conditions trigger that particular bug check and what could be leading to this problematic truncation during mount. I'll be focused on how the inode eviction process is interacting with the underlying block allocation and deallocation during filesystem initialization. This should give me a better understanding of what exactly is going on.

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_do_truncate_blocks]

map[SourceCode: 783:	int f2fs_do_truncate_blocks(struct inode *inode, u64 from, bool lock)
 784:	{
 785:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 786:		struct dnode_of_data dn;
 787:		struct f2fs_lock_context lc;
 788:		pgoff_t free_from;
 789:		int count = 0, err = 0;
 790:		struct folio *ifolio;
 791:		bool truncate_page = false;
 792:	
 793:		trace_f2fs_truncate_blocks_enter(inode, from);
 794:	
 795:		if (IS_DEVICE_ALIASING(inode) && from) {
 796:			err = -EINVAL;
 797:			goto out_err;
 798:		}
 799:	
 800:		free_from = (pgoff_t)F2FS_BLK_ALIGN(from);
 801:	
 802:		if (free_from >= max_file_blocks(inode))
 803:			goto free_partial;
 804:	
 805:		if (lock)
 806:			f2fs_lock_op(sbi, &lc);
 807:	
 808:		ifolio = f2fs_get_inode_folio(sbi, inode->i_ino);
 809:		if (IS_ERR(ifolio)) {
 810:			err = PTR_ERR(ifolio);
 811:			goto out;
 812:		}
 813:	
 814:		if (IS_DEVICE_ALIASING(inode)) {
 815:			struct extent_tree *et = F2FS_I(inode)->extent_tree[EX_READ];
 816:			struct extent_info ei = et->largest;
 817:	
 818:			f2fs_invalidate_blocks(sbi, ei.blk, ei.len);
 819:	
 820:			dec_valid_block_count(sbi, inode, ei.len);
 821:			f2fs_update_time(sbi, REQ_TIME);
 822:	
 823:			f2fs_folio_put(ifolio, true);
 824:			goto out;
 825:		}
 826:	
 827:		if (f2fs_has_inline_data(inode)) {
 828:			f2fs_truncate_inline_inode(inode, ifolio, from);
 829:			f2fs_folio_put(ifolio, true);
 830:			truncate_page = true;
 831:			goto out;
 832:		}
 833:	
 834:		set_new_dnode(&dn, inode, ifolio, NULL, 0);
 835:		err = f2fs_get_dnode_of_data(&dn, free_from, LOOKUP_NODE_RA);
 836:		if (err) {
 837:			if (err == -ENOENT)
 838:				goto free_next;
 839:			goto out;
 840:		}
 841:	
 842:		count = ADDRS_PER_PAGE(dn.node_folio, inode);
 843:	
 844:		count -= dn.ofs_in_node;
 845:		f2fs_bug_on(sbi, count < 0);
 846:	
 847:		if (dn.ofs_in_node || IS_INODE(dn.node_folio)) {
 848:			f2fs_truncate_data_blocks_range(&dn, count);
 849:			free_from += count;
 850:		}
 851:	
 852:		f2fs_put_dnode(&dn);
 853:	free_next:
 854:		err = f2fs_truncate_inode_blocks(inode, free_from);
 855:	out:
 856:		if (lock)
 857:			f2fs_unlock_op(sbi, &lc);
 858:	free_partial:
 859:		/* lastly zero out the first data page */
 860:		if (!err)
 861:			err = truncate_partial_data_page(inode, from, truncate_page);
 862:	out_err:
 863:		trace_f2fs_truncate_blocks_exit(inode, err);
 864:		return err;
 865:	}
 SourceFile:fs/f2fs/file.c]

gemini-3.1-pro-preview

							input: 9399
							output: 25
							thoughts: 328
						

**Analyzing a File System Bug**

Okay, so I'm looking at this f2fs code, specifically line 845: `f2fs_bug_on(sbi, count < 0);`. That `f2fs_bug_on` macro...that's a kernel panic, plain and simple. It's designed to halt execution if the condition is met. In this case, the condition is `count < 0`. Now, `count` is derived from `ADDRS_PER_PAGE(dn.node_folio, inode) - dn.ofs_in_node`. Therefore, the bug triggers when `dn.ofs_in_node` is *greater* than `ADDRS_PER_PAGE(dn.node_folio, inode)`.

I see that this manifests during a mount operation with a malicious filesystem image, which makes things interesting. The call trace traces back through `f2fs_fill_super`, `evict`, and eventually ends up in `f2fs_do_truncate_blocks`. It sounds like it's happening during cleanup, after `f2fs_fill_super` fails, or maybe when dealing with orphaned inodes during the mount process.

The big question now is, what's the impact? It's a `BUG()` macro, so it's a denial-of-service, a guaranteed kernel crash. While not ideal, it's not a privilege escalation or memory corruption vulnerability. It halts execution, so, in and of itself, it's not directly exploitable for those purposes.

Now, accessibility is the next concern. The trigger, mounting a filesystem, needs CAP_SYS_ADMIN in the initial user namespace, or the capability of mounting in a user namespace. Since mounting is required to exploit this bug, it's necessary to determine if f2fs can be mounted in a user namespace. Let me check that quickly...

map[Expression:fs_flags.*FS_USERNS_MOUNT]

map[Output:drivers/android/binder/rust_binderfs.c=753=static struct file_system_type binder_fs_type = {
--
drivers/android/binder/rust_binderfs.c-757-	.kill_sb		= binderfs_kill_super,
drivers/android/binder/rust_binderfs.c:758:	.fs_flags		= FS_USERNS_MOUNT,
drivers/android/binder/rust_binderfs.c-759-};
--
drivers/android/binderfs.c=749=static struct file_system_type binder_fs_type = {
--
drivers/android/binderfs.c-753-	.kill_sb		= binderfs_kill_super,
drivers/android/binderfs.c:754:	.fs_flags		= FS_USERNS_MOUNT,
drivers/android/binderfs.c-755-};
--
fs/binfmt_misc.c=1021=static struct file_system_type bm_fs_type = {
--
fs/binfmt_misc.c-1024-	.init_fs_context = bm_init_fs_context,
fs/binfmt_misc.c:1025:	.fs_flags	= FS_USERNS_MOUNT,
fs/binfmt_misc.c-1026-	.kill_sb	= kill_anon_super,
--
fs/devpts/inode.c=453=static struct file_system_type devpts_fs_type = {
--
fs/devpts/inode.c-457-	.kill_sb	= devpts_kill_sb,
fs/devpts/inode.c:458:	.fs_flags	= FS_USERNS_MOUNT,
fs/devpts/inode.c-459-};
--
fs/fuse/inode.c=2157=static struct file_system_type fuse_fs_type = {
--
fs/fuse/inode.c-2159-	.name		= "fuse",
fs/fuse/inode.c:2160:	.fs_flags	= FS_HAS_SUBTYPE | FS_USERNS_MOUNT | FS_ALLOW_IDMAP,
fs/fuse/inode.c-2161-	.init_fs_context = fuse_init_fs_context,
--
fs/overlayfs/super.c=1571=struct file_system_type ovl_fs_type = {
--
fs/overlayfs/super.c-1575-	.parameters		= ovl_parameter_spec,
fs/overlayfs/super.c:1576:	.fs_flags		= FS_USERNS_MOUNT,
fs/overlayfs/super.c-1577-	.kill_sb		= kill_anon_super,
--
fs/proc/root.c=357=static struct file_system_type proc_fs_type = {
--
fs/proc/root.c-361-	.kill_sb		= proc_kill_sb,
fs/proc/root.c:362:	.fs_flags		= FS_USERNS_MOUNT | FS_DISALLOW_NOTIFY_PERM,
fs/proc/root.c-363-};
--
fs/ramfs/inode.c=317=static struct file_system_type ramfs_fs_type = {
--
fs/ramfs/inode.c-321-	.kill_sb	= ramfs_kill_sb,
fs/ramfs/inode.c:322:	.fs_flags	= FS_USERNS_MOUNT,
fs/ramfs/inode.c-323-};
--
fs/super.c=694=bool mount_capable(struct fs_context *fc)
fs/super.c-695-{
fs/super.c:696:	if (!(fc->fs_type->fs_flags & FS_USERNS_MOUNT))
fs/super.c-697-		return capable(CAP_SYS_ADMIN);
--
fs/super.c=734=struct super_block *sget_fc(struct fs_context *fc,
--
fs/super.c-748-	 */
fs/super.c:749:	if (user_ns != &init_user_ns && !(fc->fs_type->fs_flags & FS_USERNS_MOUNT)) {
fs/super.c-750-		errorfc(fc, "VFS: Mounting from non-initial user namespace is not allowed");
--
fs/sysfs/mount.c=92=static struct file_system_type sysfs_fs_type = {
--
fs/sysfs/mount.c-95-	.kill_sb		= sysfs_kill_sb,
fs/sysfs/mount.c:96:	.fs_flags		= FS_USERNS_MOUNT,
fs/sysfs/mount.c-97-};
--
ipc/mqueue.c=1613=static struct file_system_type mqueue_fs_type = {
--
ipc/mqueue.c-1616-	.kill_sb		= kill_anon_super,
ipc/mqueue.c:1617:	.fs_flags		= FS_USERNS_MOUNT,
ipc/mqueue.c-1618-};
--
kernel/bpf/inode.c=1074=static struct file_system_type bpf_fs_type = {
--
kernel/bpf/inode.c-1079-	.kill_sb	= bpf_kill_super,
kernel/bpf/inode.c:1080:	.fs_flags	= FS_USERNS_MOUNT,
kernel/bpf/inode.c-1081-};
--
kernel/cgroup/cgroup.c=2332=struct file_system_type cgroup_fs_type = {
--
kernel/cgroup/cgroup.c-2336-	.kill_sb		= cgroup_kill_sb,
kernel/cgroup/cgroup.c:2337:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2338-};
--
kernel/cgroup/cgroup.c=2340=static struct file_system_type cgroup2_fs_type = {
--
kernel/cgroup/cgroup.c-2344-	.kill_sb		= cgroup_kill_sb,
kernel/cgroup/cgroup.c:2345:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2346-};
--
kernel/cgroup/cgroup.c=2413=static struct file_system_type cpuset_fs_type = {
--
kernel/cgroup/cgroup.c-2416-	.parameters		= cpuset_fs_parameters,
kernel/cgroup/cgroup.c:2417:	.fs_flags		= FS_USERNS_MOUNT,
kernel/cgroup/cgroup.c-2418-};
--
mm/shmem.c=5349=static struct file_system_type shmem_fs_type = {
--
mm/shmem.c-5356-	.kill_sb	= kill_anon_super,
mm/shmem.c:5357:	.fs_flags	= FS_USERNS_MOUNT | FS_ALLOW_IDMAP | FS_MGTIME,
mm/shmem.c-5358-};
--
mm/shmem.c=5758=static struct file_system_type shmem_fs_type = {
--
mm/shmem.c-5762-	.kill_sb	= ramfs_kill_sb,
mm/shmem.c:5763:	.fs_flags	= FS_USERNS_MOUNT,
mm/shmem.c-5764-};
]

gemini-3.1-pro-preview

							input: 12148
							output: 47
							thoughts: 1130
						

**My Analysis of the F2FS Bug**

Okay, so I'm looking at this f2fs bug, and here's my breakdown. First off, because f2fs lacks `FS_USERNS_MOUNT`, it's not mountable from a user namespace, and requires `CAP_SYS_ADMIN` in the initial namespace. That immediately limits its accessibility to unprivileged processes and user namespaces.

Now, let's get into the nitty-gritty. This is a `kernel BUG`, a Denial of Service (DoS) vulnerability caused by mounting a malicious filesystem image. So, it's definitely a "Malicious Filesystem Trigger" – that's a given. The real question is how else can this be triggered.

Can a VM guest directly trigger it? Nope, a guest can't just mount filesystems on the host directly. What about in a confidential computing context, with a VM host? Technically, if the host serves the guest a malicious f2fs image and the guest *mounts* it, yes, it’s triggered. But typically, guests mount block devices provided by the host. If the guest auto-mounts f2fs, then it can trigger, but f2fs isn’t usually auto-mounted. But, given that the bug is in a filesystem, yes, "VM Host Trigger in The Confidential Computing Context" could be true if the guest mounts it. If the host provides a virtio-blk device with a malicious f2fs image, and the guest mounts it, the bug is triggered. But does the guest automatically mount f2fs? Usually not, unless it's the rootfs or configured in fstab, or there's an auto-mounter. For the purpose of these dimensions, I'm sticking with "Malicious Filesystem Trigger".

What about a "Peripheral Trigger"? A USB drive with a bad f2fs image could trigger it, *if* the system auto-mounts it. The bug is in the filesystem parsing, not the USB stack. Since "Malicious Filesystem Trigger" covers this, I'm leaning toward keeping "Peripheral Trigger" as False, for precision, unless there's an actual bug in the USB/Thunderbolt driver.

However, I'm thinking, this dimension is asking specifically about how a KVM host can trigger the bug. If the host provides a block device, the guest *has* to mount it. If it isn't auto-mounted, the host can't trigger it directly. So, I'll set "VM Host Trigger in The Confidential Computing Context" to False.

On exploitability, this `kernel BUG at fs/f2fs/file.c:845!` causes a kernel panic, halting execution. So, it's not "Exploitable" in the sense of privilege escalation or memory corruption.

It's a definite "Denial Of Service," since a `BUG()` halts the system. And since mounting requires `CAP_SYS_ADMIN`, this bug isn't "Accessible From Unprivileged Processes" or "Accessible From User Namespaces".

Now, I need to double-check: is there *any* way to reach `f2fs_do_truncate_blocks` *without* mounting? Let's trace it. It seems this specific trace is during mount, but `f2fs_do_truncate_blocks` *can* also be called during normal file operations (e.g., `truncate`, `ftruncate`) on a mounted f2fs filesystem. If an unprivileged user has access to a *mounted* f2fs filesystem, could they trigger this bug with `truncate` or `ftruncate`? That's a point to investigate further, let's look at `f2fs_do_truncate_blocks` again to be sure.

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_do_truncate_blocks]

map[SourceCode: 783:	int f2fs_do_truncate_blocks(struct inode *inode, u64 from, bool lock)
 784:	{
 785:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 786:		struct dnode_of_data dn;
 787:		struct f2fs_lock_context lc;
 788:		pgoff_t free_from;
 789:		int count = 0, err = 0;
 790:		struct folio *ifolio;
 791:		bool truncate_page = false;
 792:	
 793:		trace_f2fs_truncate_blocks_enter(inode, from);
 794:	
 795:		if (IS_DEVICE_ALIASING(inode) && from) {
 796:			err = -EINVAL;
 797:			goto out_err;
 798:		}
 799:	
 800:		free_from = (pgoff_t)F2FS_BLK_ALIGN(from);
 801:	
 802:		if (free_from >= max_file_blocks(inode))
 803:			goto free_partial;
 804:	
 805:		if (lock)
 806:			f2fs_lock_op(sbi, &lc);
 807:	
 808:		ifolio = f2fs_get_inode_folio(sbi, inode->i_ino);
 809:		if (IS_ERR(ifolio)) {
 810:			err = PTR_ERR(ifolio);
 811:			goto out;
 812:		}
 813:	
 814:		if (IS_DEVICE_ALIASING(inode)) {
 815:			struct extent_tree *et = F2FS_I(inode)->extent_tree[EX_READ];
 816:			struct extent_info ei = et->largest;
 817:	
 818:			f2fs_invalidate_blocks(sbi, ei.blk, ei.len);
 819:	
 820:			dec_valid_block_count(sbi, inode, ei.len);
 821:			f2fs_update_time(sbi, REQ_TIME);
 822:	
 823:			f2fs_folio_put(ifolio, true);
 824:			goto out;
 825:		}
 826:	
 827:		if (f2fs_has_inline_data(inode)) {
 828:			f2fs_truncate_inline_inode(inode, ifolio, from);
 829:			f2fs_folio_put(ifolio, true);
 830:			truncate_page = true;
 831:			goto out;
 832:		}
 833:	
 834:		set_new_dnode(&dn, inode, ifolio, NULL, 0);
 835:		err = f2fs_get_dnode_of_data(&dn, free_from, LOOKUP_NODE_RA);
 836:		if (err) {
 837:			if (err == -ENOENT)
 838:				goto free_next;
 839:			goto out;
 840:		}
 841:	
 842:		count = ADDRS_PER_PAGE(dn.node_folio, inode);
 843:	
 844:		count -= dn.ofs_in_node;
 845:		f2fs_bug_on(sbi, count < 0);
 846:	
 847:		if (dn.ofs_in_node || IS_INODE(dn.node_folio)) {
 848:			f2fs_truncate_data_blocks_range(&dn, count);
 849:			free_from += count;
 850:		}
 851:	
 852:		f2fs_put_dnode(&dn);
 853:	free_next:
 854:		err = f2fs_truncate_inode_blocks(inode, free_from);
 855:	out:
 856:		if (lock)
 857:			f2fs_unlock_op(sbi, &lc);
 858:	free_partial:
 859:		/* lastly zero out the first data page */
 860:		if (!err)
 861:			err = truncate_partial_data_page(inode, from, truncate_page);
 862:	out_err:
 863:		trace_f2fs_truncate_blocks_exit(inode, err);
 864:		return err;
 865:	}
 SourceFile:fs/f2fs/file.c]

gemini-3.1-pro-preview

							input: 15432
							output: 50
							thoughts: 127
						

**Debugging a Potential F2FS Issue**

Okay, so I've hit a potential snag. It looks like the core of the problem lies in `count < 0`. That `count` variable is calculated as the difference between `ADDRS_PER_PAGE(dn.node_folio, inode)` and `dn.ofs_in_node`. My spidey senses are tingling because a negative count here strongly implies that `dn.ofs_in_node` is *larger* than `ADDRS_PER_PAGE(dn.node_folio, inode)`.

Now, where does `dn.ofs_in_node` get its value? Right, that's set by `f2fs_get_dnode_of_data`. My next move is clear. I need to dive into that function and meticulously trace how `dn.ofs_in_node` is being assigned, and under what conditions. I need to understand the logic flow within `f2fs_get_dnode_of_data` that leads to this potentially invalid offset value. It's time to put on my debugging hat and dig deeper. This seems like a critical piece of the puzzle I need to understand before I can determine if this is a bug, or an unusual corner case within the code.

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_get_dnode_of_data]

map[SourceCode: 802:	/*
 803:	 * Caller should call f2fs_put_dnode(dn).
 804:	 * Also, it should grab and release a rwsem by calling f2fs_lock_op() and
 805:	 * f2fs_unlock_op() only if mode is set with ALLOC_NODE.
 806:	 */
 807:	int f2fs_get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode)
 808:	{
 809:		struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
 810:		struct folio *nfolio[4];
 811:		struct folio *parent = NULL;
 812:		int offset[4];
 813:		unsigned int noffset[4];
 814:		nid_t nids[4];
 815:		int level, i = 0;
 816:		int err = 0;
 817:	
 818:		level = get_node_path(dn->inode, index, offset, noffset);
 819:		if (level < 0)
 820:			return level;
 821:	
 822:		nids[0] = dn->inode->i_ino;
 823:	
 824:		if (!dn->inode_folio) {
 825:			nfolio[0] = f2fs_get_inode_folio(sbi, nids[0]);
 826:			if (IS_ERR(nfolio[0]))
 827:				return PTR_ERR(nfolio[0]);
 828:		} else {
 829:			nfolio[0] = dn->inode_folio;
 830:		}
 831:	
 832:		/* if inline_data is set, should not report any block indices */
 833:		if (f2fs_has_inline_data(dn->inode) && index) {
 834:			err = -ENOENT;
 835:			f2fs_folio_put(nfolio[0], true);
 836:			goto release_out;
 837:		}
 838:	
 839:		parent = nfolio[0];
 840:		if (level != 0)
 841:			nids[1] = get_nid(parent, offset[0], true);
 842:		dn->inode_folio = nfolio[0];
 843:		dn->inode_folio_locked = true;
 844:	
 845:		/* get indirect or direct nodes */
 846:		for (i = 1; i <= level; i++) {
 847:			bool done = false;
 848:	
 849:			if (nids[i] && nids[i] == dn->inode->i_ino) {
 850:				err = -EFSCORRUPTED;
 851:				f2fs_err_ratelimited(sbi,
 852:					"inode mapping table is corrupted, run fsck to fix it, "
 853:					"ino:%llu, nid:%u, level:%d, offset:%d",
 854:					dn->inode->i_ino, nids[i], level, offset[level]);
 855:				set_sbi_flag(sbi, SBI_NEED_FSCK);
 856:				goto release_pages;
 857:			}
 858:	
 859:			if (!nids[i] && mode == ALLOC_NODE) {
 860:				/* alloc new node */
 861:				if (!f2fs_alloc_nid(sbi, &(nids[i]))) {
 862:					err = -ENOSPC;
 863:					goto release_pages;
 864:				}
 865:	
 866:				dn->nid = nids[i];
 867:				nfolio[i] = f2fs_new_node_folio(dn, noffset[i]);
 868:				if (IS_ERR(nfolio[i])) {
 869:					f2fs_alloc_nid_failed(sbi, nids[i]);
 870:					err = PTR_ERR(nfolio[i]);
 871:					goto release_pages;
 872:				}
 873:	
 874:				set_nid(parent, offset[i - 1], nids[i], i == 1);
 875:				f2fs_alloc_nid_done(sbi, nids[i]);
 876:				done = true;
 877:			} else if (mode == LOOKUP_NODE_RA && i == level && level > 1) {
 878:				nfolio[i] = f2fs_get_node_folio_ra(parent, offset[i - 1]);
 879:				if (IS_ERR(nfolio[i])) {
 880:					err = PTR_ERR(nfolio[i]);
 881:					goto release_pages;
 882:				}
 883:				done = true;
 884:			}
 885:			if (i == 1) {
 886:				dn->inode_folio_locked = false;
 887:				folio_unlock(parent);
 888:			} else {
 889:				f2fs_folio_put(parent, true);
 890:			}
 891:	
 892:			if (!done) {
 893:				nfolio[i] = f2fs_get_node_folio(sbi, nids[i],
 894:							NODE_TYPE_NON_INODE);
 895:				if (IS_ERR(nfolio[i])) {
 896:					err = PTR_ERR(nfolio[i]);
 897:					f2fs_folio_put(nfolio[0], false);
 898:					goto release_out;
 899:				}
 900:			}
 901:			if (i < level) {
 902:				parent = nfolio[i];
 903:				nids[i + 1] = get_nid(parent, offset[i], false);
 904:			}
 905:		}
 906:		dn->nid = nids[level];
 907:		dn->ofs_in_node = offset[level];
 908:		dn->node_folio = nfolio[level];
 909:		dn->data_blkaddr = f2fs_data_blkaddr(dn);
 910:	
 911:		if (is_inode_flag_set(dn->inode, FI_COMPRESSED_FILE) &&
 912:						f2fs_sb_has_readonly(sbi)) {
 913:			unsigned int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
 914:			unsigned int ofs_in_node = dn->ofs_in_node;
 915:			pgoff_t fofs = index;
 916:			unsigned int c_len;
 917:			block_t blkaddr;
 918:	
 919:			/* should align fofs and ofs_in_node to cluster_size */
 920:			if (fofs % cluster_size) {
 921:				fofs = round_down(fofs, cluster_size);
 922:				ofs_in_node = round_down(ofs_in_node, cluster_size);
 923:			}
 924:	
 925:			c_len = f2fs_cluster_blocks_are_contiguous(dn, ofs_in_node);
 926:			if (!c_len)
 927:				goto out;
 928:	
 929:			blkaddr = data_blkaddr(dn->inode, dn->node_folio, ofs_in_node);
 930:			if (blkaddr == COMPRESS_ADDR)
 931:				blkaddr = data_blkaddr(dn->inode, dn->node_folio,
 932:							ofs_in_node + 1);
 933:	
 934:			f2fs_update_read_extent_tree_range_compressed(dn->inode,
 935:						fofs, blkaddr, cluster_size, c_len);
 936:		}
 937:	out:
 938:		return 0;
 939:	
 940:	release_pages:
 941:		f2fs_folio_put(parent, true);
 942:		if (i > 1)
 943:			f2fs_folio_put(nfolio[0], false);
 944:	release_out:
 945:		dn->inode_folio = NULL;
 946:		dn->node_folio = NULL;
 947:		if (err == -ENOENT) {
 948:			dn->cur_level = i;
 949:			dn->max_level = level;
 950:			dn->ofs_in_node = offset[level];
 951:		}
 952:		return err;
 953:	}
 SourceFile:fs/f2fs/node.c]

gemini-3.1-pro-preview

							input: 18392
							output: 43
							thoughts: 32
						

Okay, here's my interpretation of those thoughts, framed as my own:

**Navigating the File System Hierarchy**

Alright, so I'm focusing on how we're tracking a file's position within the inode's data structure. `dn->ofs_in_node` is getting assigned a crucial value: `offset[level]`. I immediately recognize that `offset` is coming directly from `get_node_path`. This is standard, this function's job is to trace the file's path.

So, the `offset` array is built up as we descend through the file system hierarchy, level by level. At each stage, `get_node_path` is providing the specific byte offset *within the current node*. We're storing this offset in our `offset` array. And the current level is used as the index.
This means `dn->ofs_in_node` is holding the precise position of the file data *within the current node* at this particular level of the traversal. This makes perfect sense; we're essentially capturing the "address" of the file component at each point on the way to the real data, right?
We're keeping track of where we are, within the block.
This helps us know exactly where to start reading or writing data.

map[ContextFile:fs/f2fs/node.c IncludeLines:true Name:get_node_path]

map[SourceCode: 722:	/*
 723:	 * The maximum depth is four.
 724:	 * Offset[0] will have raw inode offset.
 725:	 */
 726:	static int get_node_path(struct inode *inode, long block,
 727:					int offset[4], unsigned int noffset[4])
 728:	{
 729:		const long direct_index = ADDRS_PER_INODE(inode);
 730:		const long direct_blks = ADDRS_PER_BLOCK(inode);
 731:		const long dptrs_per_blk = NIDS_PER_BLOCK;
 732:		const long indirect_blks = ADDRS_PER_BLOCK(inode) * NIDS_PER_BLOCK;
 733:		const long dindirect_blks = indirect_blks * NIDS_PER_BLOCK;
 734:		int n = 0;
 735:		int level = 0;
 736:	
 737:		noffset[0] = 0;
 738:	
 739:		if (block < direct_index) {
 740:			offset[n] = block;
 741:			goto got;
 742:		}
 743:		block -= direct_index;
 744:		if (block < direct_blks) {
 745:			offset[n++] = NODE_DIR1_BLOCK;
 746:			noffset[n] = 1;
 747:			offset[n] = block;
 748:			level = 1;
 749:			goto got;
 750:		}
 751:		block -= direct_blks;
 752:		if (block < direct_blks) {
 753:			offset[n++] = NODE_DIR2_BLOCK;
 754:			noffset[n] = 2;
 755:			offset[n] = block;
 756:			level = 1;
 757:			goto got;
 758:		}
 759:		block -= direct_blks;
 760:		if (block < indirect_blks) {
 761:			offset[n++] = NODE_IND1_BLOCK;
 762:			noffset[n] = 3;
 763:			offset[n++] = block / direct_blks;
 764:			noffset[n] = 4 + offset[n - 1];
 765:			offset[n] = block % direct_blks;
 766:			level = 2;
 767:			goto got;
 768:		}
 769:		block -= indirect_blks;
 770:		if (block < indirect_blks) {
 771:			offset[n++] = NODE_IND2_BLOCK;
 772:			noffset[n] = 4 + dptrs_per_blk;
 773:			offset[n++] = block / direct_blks;
 774:			noffset[n] = 5 + dptrs_per_blk + offset[n - 1];
 775:			offset[n] = block % direct_blks;
 776:			level = 2;
 777:			goto got;
 778:		}
 779:		block -= indirect_blks;
 780:		if (block < dindirect_blks) {
 781:			offset[n++] = NODE_DIND_BLOCK;
 782:			noffset[n] = 5 + (dptrs_per_blk * 2);
 783:			offset[n++] = block / indirect_blks;
 784:			noffset[n] = 6 + (dptrs_per_blk * 2) +
 785:				      offset[n - 1] * (dptrs_per_blk + 1);
 786:			offset[n++] = (block / direct_blks) % dptrs_per_blk;
 787:			noffset[n] = 7 + (dptrs_per_blk * 2) +
 788:				      offset[n - 2] * (dptrs_per_blk + 1) +
 789:				      offset[n - 1];
 790:			offset[n] = block % direct_blks;
 791:			level = 3;
 792:			goto got;
 793:		} else {
 794:			return -E2BIG;
 795:		}
 796:	got:
 797:		return level;
 798:	}
 SourceFile:fs/f2fs/node.c]

gemini-3.1-pro-preview

							input: 20014
							output: 44
							thoughts: 517
						

**Analyzing the Block Truncation in F2FS**

Okay, let's break down this `f2fs_do_truncate_blocks` logic. My initial thought is to examine how the offset calculations work within the context of block truncation. I see that `get_node_path` is central to calculating the offset based on the `block` value. When the level is 0, the first element of `offset` is directly set to the `block`. I need to ensure the logic here is sound.

I'm focusing in particular on where `count` is calculated and how it might become negative, triggering a `f2fs_bug_on`. In `f2fs_do_truncate_blocks`, `count` is initially determined by `ADDRS_PER_PAGE(dn.node_folio, inode)` and then adjusted by subtracting `dn.ofs_in_node`. If `dn.node_folio` is an inode, `ADDRS_PER_PAGE` gives us `ADDRS_PER_INODE(inode)`; if it's a direct node, we get `ADDRS_PER_BLOCK(inode)`. I'm already aware of these constants.

I notice that truncation is only performed if `free_from`, which is aligned to the block size, is within the file's bounds (i.e., less than `max_file_blocks(inode)`). This is important: truncation starts from a certain block (`free_from`). Now, `get_node_path` uses this `free_from`. At level 0, the offset is equal to `free_from`. If `free_from` is smaller than `ADDRS_PER_INODE(inode)`, then the count is always positive.

Let's look at level > 0. The offset calculation at these levels uses the modulo operation, `block % direct_blks`, where `direct_blks = ADDRS_PER_BLOCK(inode)`. So `offset[level]` is always less than `ADDRS_PER_BLOCK(inode)`. This means `count` will also always be greater than zero.

So, *how* can this `count` ever be less than zero? It seems like it should never be. I'll re-examine the `ADDRS_PER_PAGE` calculations. It might be related to `dn.ofs_in_node`. Could there be a case where `dn.ofs_in_node` ends up being larger than what `ADDRS_PER_PAGE` returns, causing this negative count? I need to focus on how `dn.ofs_in_node` is set. I will revisit this function later, but for now, I will keep in mind that the bounds checking seems logical.

log-in to see details

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:ADDRS_PER_PAGE]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 21183
							output: 23
							thoughts: 12
						

Okay, here's my summary, taking on the persona you requested:

**Finding `ADDRS_PER_PAGE`**

Alright, let's get down to brass tacks. I need to figure out this `ADDRS_PER_PAGE` constant. It's a key piece of the puzzle, clearly, and I can't proceed effectively until I understand its value and its significance within the broader context. Is it defined locally, globally, in a configuration file, or perhaps derived from some system-specific parameter? My first instinct is to start by searching the code base. I'll need to use my usual methods, grep, find, whatever is appropriate for the language or environment. I'll start with a case-sensitive and case-insensitive search, looking for the exact string, and then variations like `ADRS_PER_PAGE` or any comments related to the term. I'll need to quickly filter results, checking for any relevant context such as related data structures. Once I have the definition I should study the surrounding code to determine how it's being used. The goal is to understand how the system is organized with respect to memory and how pages are handled in this system. I want to build a clear understanding of its role in memory management, data access optimization, or whatever it is controlling. Is it a hardware-imposed limit, a design choice, a performance tuning parameter? Grasping its purpose is critical. I'll need to determine the origin of the value. Is it a compile-time constant, a runtime variable? If the value is a variable, what are the factors that determine its specific value? This will be a key step to building a mental model of the system's memory architecture.

map[Expression:#define ADDRS_PER_PAGE]

map[Output:include/linux/f2fs_fs.h=253=struct node_footer {
--
include/linux/f2fs_fs.h-274-
include/linux/f2fs_fs.h:275:#define ADDRS_PER_PAGE(folio, inode)	(addrs_per_page(inode, IS_INODE(folio)))
include/linux/f2fs_fs.h-276-
]

gemini-3.1-pro-preview

							input: 21695
							output: 46
							thoughts: 12
						

Okay, let's dive into this. Here's how I'd approach summarizing the prompt, keeping in mind my expert perspective:

**Investigating `addrs_per_page`**

Alright, so the first thing I'm doing is zeroing in on this variable, `addrs_per_page`. Hmm, that name rings a bell. My initial thought is it's likely related to memory management, specifically how addresses are organized within a page. Could be physical memory, virtual memory, or even something lower-level like cache lines, depending on the context. I need to understand *where* this variable is used, and what system I am using.

My immediate follow up would be to consider its potential impact. If this relates to memory, what's its relationship with memory allocation and deallocation? Is this setting a fixed value, or dynamically configurable? Does this variable have performance implications? Does this apply to all pages or just a subset? Are there any dependencies on the architecture or operating system?

Let's start by digging into its definition to understand the underlying context. I need to see where this fits in the grand scheme of things.

map[ContextFile:include/linux/f2fs_fs.h IncludeLines:true Name:addrs_per_page]

map[SourceCode:3533:	static inline unsigned int addrs_per_page(struct inode *inode,
3534:								bool is_inode)
3535:	{
3536:		unsigned int addrs = is_inode ? (CUR_ADDRS_PER_INODE(inode) -
3537:				get_inline_xattr_addrs(inode)) : DEF_ADDRS_PER_BLOCK;
3538:	
3539:		if (f2fs_compressed_file(inode))
3540:			return ALIGN_DOWN(addrs, F2FS_I(inode)->i_cluster_size);
3541:		return addrs;
3542:	}
 SourceFile:fs/f2fs/f2fs.h]

gemini-3.1-pro-preview

							input: 22206
							output: 47
							thoughts: 173
						

**F2FS Address Calculation Concern**

Okay, so I'm looking at this `addrs_per_page` function in F2FS, and something's bugging me. Specifically, the part where it's using `ALIGN_DOWN` to adjust the `addrs` value when dealing with compressed files. It seems like if `f2fs_compressed_file(inode)` is true, the function cleverly calculates `ALIGN_DOWN(addrs, F2FS_I(inode)->i_cluster_size)`.

Now, if that `i_cluster_size` is particularly large – let's say, a pretty typical large block size – this `ALIGN_DOWN` operation could potentially *drastically* reduce `addrs`. And here's the kicker: it could make `addrs` *smaller* than the `dn.ofs_in_node` value!

Take this example: let's say `addrs` is 1018, and `i_cluster_size` is 1024. `ALIGN_DOWN(1018, 1024)` is going to result in 0! Now, the subsequent calculation becomes `count = 0 - dn.ofs_in_node`, which is a negative value. A negative `count` doesn't make sense in this context.

It looks like I need to double-check that `i_cluster_size` value and how it's being used in this whole calculation.

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_compressed_file]

map[SourceCode:3511:	static inline int f2fs_compressed_file(struct inode *inode)
3512:	{
3513:		return S_ISREG(inode->i_mode) &&
3514:			is_inode_flag_set(inode, FI_COMPRESSED_FILE);
3515:	}
 SourceFile:fs/f2fs/f2fs.h]

gemini-3.1-pro-preview

							input: 22864
							output: 20
							thoughts: 29
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating i_cluster_size**

Alright, so `i_cluster_size` is directly pulled from the inode, that's the starting point. Now, the real question I need to answer is: where does this value *originate*? I need to trace back the code and figure out the setting mechanism for `i_cluster_size`. Understanding its initialization and modification points will be crucial for any in-depth analysis or debugging related to disk allocation and file system performance. I need to understand the lifecycle of this value. Let's dig in and track down the code responsible for assigning it.

map[Expression:i_cluster_size =]

map[Output:fs/f2fs/f2fs.h=4754=static inline int set_compress_context(struct inode *inode)
--
fs/f2fs/f2fs.h-4763-					BIT(COMPRESS_CHKSUM) : 0;
fs/f2fs/f2fs.h:4764:	fi->i_cluster_size = BIT(fi->i_log_cluster_size);
fs/f2fs/f2fs.h-4765-	if ((fi->i_compress_algorithm == COMPRESS_LZ4 ||
--
fs/f2fs/file.c=4376=static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg)
--
fs/f2fs/file.c-4421-	fi->i_log_cluster_size = option.log_cluster_size;
fs/f2fs/file.c:4422:	fi->i_cluster_size = BIT(option.log_cluster_size);
fs/f2fs/file.c-4423-	/* Set default level */
--
fs/f2fs/inode.c=413=static int do_read_inode(struct inode *inode)
--
fs/f2fs/inode.c-533-					GENMASK(COMPRESS_LEVEL_OFFSET - 1, 0);
fs/f2fs/inode.c:534:			fi->i_cluster_size = BIT(fi->i_log_cluster_size);
fs/f2fs/inode.c-535-			set_inode_flag(inode, FI_COMPRESSED_FILE);
]

gemini-3.1-pro-preview

							input: 23481
							output: 43
							thoughts: 51
						

Okay, here's my interpretation of that code snippet, presented as my own thought process:

**Understanding Inode Cluster Size**

Right, so I'm looking at `do_read_inode`, and it seems like we're setting up the cluster size for this particular inode. The line `fi->i_cluster_size = BIT(fi->i_log_cluster_size);` is crucial here.  It's telling me that the actual cluster size, `fi->i_cluster_size`, isn't directly stored; instead, we're using a *logarithmic* representation, `fi->i_log_cluster_size`.

This is a pretty standard optimization, right? Using a log-based representation allows us to represent a potentially very large cluster size with a smaller, more manageable value, potentially reducing storage overhead. Then `BIT()` is probably a macro or function that efficiently calculates 2 raised to the power of `fi->i_log_cluster_size`. Effectively, it's calculating 2<sup>`fi->i_log_cluster_size`</sup>.

And the critical detail is that `fi->i_log_cluster_size` is being *read* from the inode on disk. So, somewhere in the persistent inode structure, there's a field indicating the log base 2 of the cluster size. This value, read from disk, is what drives the calculation of the actual cluster size that the file system will use for allocation and addressing. I'll need to remember that when I'm chasing down block allocation issues later. It's often the root of the problem.

map[ContextFile:fs/f2fs/inode.c IncludeLines:true Name:do_read_inode]

map[SourceCode: 413:	static int do_read_inode(struct inode *inode)
 414:	{
 415:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 416:		struct f2fs_inode_info *fi = F2FS_I(inode);
 417:		struct folio *node_folio;
 418:		struct f2fs_inode *ri;
 419:		projid_t i_projid;
 420:	
 421:		/* Check if ino is within scope */
 422:		if (f2fs_check_nid_range(sbi, inode->i_ino))
 423:			return -EINVAL;
 424:	
 425:		node_folio = f2fs_get_inode_folio(sbi, inode->i_ino);
 426:		if (IS_ERR(node_folio))
 427:			return PTR_ERR(node_folio);
 428:	
 429:		ri = F2FS_INODE(node_folio);
 430:	
 431:		inode->i_mode = le16_to_cpu(ri->i_mode);
 432:		i_uid_write(inode, le32_to_cpu(ri->i_uid));
 433:		i_gid_write(inode, le32_to_cpu(ri->i_gid));
 434:		set_nlink(inode, le32_to_cpu(ri->i_links));
 435:		inode->i_size = le64_to_cpu(ri->i_size);
 436:		inode->i_blocks = SECTOR_FROM_BLOCK(le64_to_cpu(ri->i_blocks) - 1);
 437:	
 438:		inode_set_atime(inode, le64_to_cpu(ri->i_atime),
 439:				le32_to_cpu(ri->i_atime_nsec));
 440:		inode_set_ctime(inode, le64_to_cpu(ri->i_ctime),
 441:				le32_to_cpu(ri->i_ctime_nsec));
 442:		inode_set_mtime(inode, le64_to_cpu(ri->i_mtime),
 443:				le32_to_cpu(ri->i_mtime_nsec));
 444:		inode->i_generation = le32_to_cpu(ri->i_generation);
 445:		if (S_ISDIR(inode->i_mode))
 446:			fi->i_current_depth = le32_to_cpu(ri->i_current_depth);
 447:		else if (S_ISREG(inode->i_mode))
 448:			fi->i_gc_failures = le16_to_cpu(ri->i_gc_failures);
 449:		fi->i_xattr_nid = le32_to_cpu(ri->i_xattr_nid);
 450:		fi->i_flags = le32_to_cpu(ri->i_flags);
 451:		if (S_ISREG(inode->i_mode))
 452:			fi->i_flags &= ~F2FS_PROJINHERIT_FL;
 453:		bitmap_zero(fi->flags, FI_MAX);
 454:		fi->i_advise = ri->i_advise;
 455:		fi->i_pino = le32_to_cpu(ri->i_pino);
 456:		fi->i_dir_level = ri->i_dir_level;
 457:	
 458:		get_inline_info(inode, ri);
 459:	
 460:		fi->i_extra_isize = f2fs_has_extra_attr(inode) ?
 461:						le16_to_cpu(ri->i_extra_isize) : 0;
 462:	
 463:		if (f2fs_sb_has_flexible_inline_xattr(sbi)) {
 464:			fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
 465:		} else if (f2fs_has_inline_xattr(inode) ||
 466:					f2fs_has_inline_dentry(inode)) {
 467:			fi->i_inline_xattr_size = DEFAULT_INLINE_XATTR_ADDRS;
 468:		} else {
 469:	
 470:			/*
 471:			 * Previous inline data or directory always reserved 200 bytes
 472:			 * in inode layout, even if inline_xattr is disabled. In order
 473:			 * to keep inline_dentry's structure for backward compatibility,
 474:			 * we get the space back only from inline_data.
 475:			 */
 476:			fi->i_inline_xattr_size = 0;
 477:		}
 478:	
 479:		if (!sanity_check_inode(inode, node_folio)) {
 480:			f2fs_folio_put(node_folio, true);
 481:			set_sbi_flag(sbi, SBI_NEED_FSCK);
 482:			f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
 483:			return -EFSCORRUPTED;
 484:		}
 485:	
 486:		/* check data exist */
 487:		if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
 488:			__recover_inline_status(inode, node_folio);
 489:	
 490:		/* try to recover cold bit for non-dir inode */
 491:		if (!S_ISDIR(inode->i_mode) && !is_cold_node(node_folio)) {
 492:			f2fs_folio_wait_writeback(node_folio, NODE, true, true);
 493:			set_cold_node(node_folio, false);
 494:			folio_mark_dirty(node_folio);
 495:		}
 496:	
 497:		/* get rdev by using inline_info */
 498:		__get_inode_rdev(inode, node_folio);
 499:	
 500:		if (!f2fs_need_inode_block_update(sbi, inode->i_ino))
 501:			fi->last_disk_size = inode->i_size;
 502:	
 503:		if (fi->i_flags & F2FS_PROJINHERIT_FL)
 504:			set_inode_flag(inode, FI_PROJ_INHERIT);
 505:	
 506:		if (f2fs_has_extra_attr(inode) && f2fs_sb_has_project_quota(sbi) &&
 507:				F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, i_projid))
 508:			i_projid = (projid_t)le32_to_cpu(ri->i_projid);
 509:		else
 510:			i_projid = F2FS_DEF_PROJID;
 511:		fi->i_projid = make_kprojid(&init_user_ns, i_projid);
 512:	
 513:		if (f2fs_has_extra_attr(inode) && f2fs_sb_has_inode_crtime(sbi) &&
 514:				F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, i_crtime)) {
 515:			fi->i_crtime.tv_sec = le64_to_cpu(ri->i_crtime);
 516:			fi->i_crtime.tv_nsec = le32_to_cpu(ri->i_crtime_nsec);
 517:		}
 518:	
 519:		if (f2fs_has_extra_attr(inode) && f2fs_sb_has_compression(sbi) &&
 520:						(fi->i_flags & F2FS_COMPR_FL)) {
 521:			if (F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
 522:						i_compress_flag)) {
 523:				unsigned short compress_flag;
 524:	
 525:				atomic_set(&fi->i_compr_blocks,
 526:						le64_to_cpu(ri->i_compr_blocks));
 527:				fi->i_compress_algorithm = ri->i_compress_algorithm;
 528:				fi->i_log_cluster_size = ri->i_log_cluster_size;
 529:				compress_flag = le16_to_cpu(ri->i_compress_flag);
 530:				fi->i_compress_level = compress_flag >>
 531:							COMPRESS_LEVEL_OFFSET;
 532:				fi->i_compress_flag = compress_flag &
 533:						GENMASK(COMPRESS_LEVEL_OFFSET - 1, 0);
 534:				fi->i_cluster_size = BIT(fi->i_log_cluster_size);
 535:				set_inode_flag(inode, FI_COMPRESSED_FILE);
 536:			}
 537:		}
 538:	
 539:		init_idisk_time(inode);
 540:	
 541:		if (!sanity_check_extent_cache(inode, node_folio)) {
 542:			f2fs_folio_put(node_folio, true);
 543:			f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
 544:			return -EFSCORRUPTED;
 545:		}
 546:	
 547:		/* Need all the flag bits */
 548:		f2fs_init_read_extent_tree(inode, node_folio);
 549:		f2fs_init_age_extent_tree(inode);
 550:	
 551:		f2fs_folio_put(node_folio, true);
 552:	
 553:		stat_inc_inline_xattr(inode);
 554:		stat_inc_inline_inode(inode);
 555:		stat_inc_inline_dir(inode);
 556:		stat_inc_compr_inode(inode);
 557:		stat_add_compr_blocks(inode, atomic_read(&fi->i_compr_blocks));
 558:	
 559:		return 0;
 560:	}
 SourceFile:fs/f2fs/inode.c]

gemini-3.1-pro-preview

							input: 26869
							output: 43
							thoughts: 83
						

**Examining the Inode Read Process**

Okay, let's break down this `do_read_inode` function. I'm focusing on how the cluster size is handled during inode initialization. I see the assignments: `fi->i_log_cluster_size = ri->i_log_cluster_size;` and then `fi->i_cluster_size = BIT(fi->i_log_cluster_size);`. That's standard practice, assigning the raw value and calculating the actual size using a bit shift. But something's niggling at me – is there *any* validation of `i_log_cluster_size` before this bit-shifting operation? Without a proper sanity check, this could lead to all sorts of problems – extremely large or even negative cluster sizes, leading to memory corruption or crashes. I need to make absolutely sure there's some kind of guardrail in place. Time to dig into `sanity_check_inode` and see if this vital check is being performed. It's critical to verify the log cluster size falls within acceptable boundaries.

map[ContextFile:fs/f2fs/inode.c IncludeLines:true Name:sanity_check_inode]

map[SourceCode: 270:	static bool sanity_check_inode(struct inode *inode, struct folio *node_folio)
 271:	{
 272:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 273:		struct f2fs_inode_info *fi = F2FS_I(inode);
 274:		struct f2fs_inode *ri = F2FS_INODE(node_folio);
 275:		unsigned long long iblocks;
 276:	
 277:		iblocks = le64_to_cpu(F2FS_INODE(node_folio)->i_blocks);
 278:		if (!iblocks) {
 279:			f2fs_warn(sbi, "%s: corrupted inode i_blocks i_ino=%llx iblocks=%llu, run fsck to fix.",
 280:				  __func__, inode->i_ino, iblocks);
 281:			return false;
 282:		}
 283:	
 284:		if (ino_of_node(node_folio) != nid_of_node(node_folio)) {
 285:			f2fs_warn(sbi, "%s: corrupted inode footer i_ino=%llx, ino,nid: [%u, %u] run fsck to fix.",
 286:				  __func__, inode->i_ino,
 287:				  ino_of_node(node_folio), nid_of_node(node_folio));
 288:			return false;
 289:		}
 290:	
 291:		if (ino_of_node(node_folio) == fi->i_xattr_nid) {
 292:			f2fs_warn(sbi, "%s: corrupted inode i_ino=%llx, xnid=%x, run fsck to fix.",
 293:				  __func__, inode->i_ino, fi->i_xattr_nid);
 294:			return false;
 295:		}
 296:	
 297:		if (S_ISDIR(inode->i_mode) && unlikely(inode->i_nlink == 1)) {
 298:			f2fs_warn(sbi, "%s: directory inode (ino=%llx) has a single i_nlink",
 299:				  __func__, inode->i_ino);
 300:			return false;
 301:		}
 302:	
 303:		if (f2fs_has_extra_attr(inode)) {
 304:			if (!f2fs_sb_has_extra_attr(sbi)) {
 305:				f2fs_warn(sbi, "%s: inode (ino=%llx) is with extra_attr, but extra_attr feature is off",
 306:					  __func__, inode->i_ino);
 307:				return false;
 308:			}
 309:			if (fi->i_extra_isize > F2FS_TOTAL_EXTRA_ATTR_SIZE ||
 310:				fi->i_extra_isize < F2FS_MIN_EXTRA_ATTR_SIZE ||
 311:				fi->i_extra_isize % sizeof(__le32)) {
 312:				f2fs_warn(sbi, "%s: inode (ino=%llx) has corrupted i_extra_isize: %d, max: %zu",
 313:					  __func__, inode->i_ino, fi->i_extra_isize,
 314:					  F2FS_TOTAL_EXTRA_ATTR_SIZE);
 315:				return false;
 316:			}
 317:			if (f2fs_sb_has_compression(sbi) &&
 318:				fi->i_flags & F2FS_COMPR_FL &&
 319:				F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
 320:							i_compress_flag)) {
 321:				if (!sanity_check_compress_inode(inode, ri))
 322:					return false;
 323:			}
 324:		}
 325:	
 326:		if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
 327:			f2fs_has_inline_xattr(inode) &&
 328:			(fi->i_inline_xattr_size < MIN_INLINE_XATTR_SIZE ||
 329:			fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
 330:			f2fs_warn(sbi, "%s: inode (ino=%llx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %lu",
 331:				  __func__, inode->i_ino, fi->i_inline_xattr_size,
 332:				  MIN_INLINE_XATTR_SIZE, MAX_INLINE_XATTR_SIZE);
 333:			return false;
 334:		}
 335:	
 336:		if (!f2fs_sb_has_extra_attr(sbi)) {
 337:			if (f2fs_sb_has_project_quota(sbi)) {
 338:				f2fs_warn(sbi, "%s: corrupted inode ino=%llx, wrong feature flag: %u, run fsck to fix.",
 339:					  __func__, inode->i_ino, F2FS_FEATURE_PRJQUOTA);
 340:				return false;
 341:			}
 342:			if (f2fs_sb_has_inode_chksum(sbi)) {
 343:				f2fs_warn(sbi, "%s: corrupted inode ino=%llx, wrong feature flag: %u, run fsck to fix.",
 344:					  __func__, inode->i_ino, F2FS_FEATURE_INODE_CHKSUM);
 345:				return false;
 346:			}
 347:			if (f2fs_sb_has_flexible_inline_xattr(sbi)) {
 348:				f2fs_warn(sbi, "%s: corrupted inode ino=%llx, wrong feature flag: %u, run fsck to fix.",
 349:					  __func__, inode->i_ino, F2FS_FEATURE_FLEXIBLE_INLINE_XATTR);
 350:				return false;
 351:			}
 352:			if (f2fs_sb_has_inode_crtime(sbi)) {
 353:				f2fs_warn(sbi, "%s: corrupted inode ino=%llx, wrong feature flag: %u, run fsck to fix.",
 354:					  __func__, inode->i_ino, F2FS_FEATURE_INODE_CRTIME);
 355:				return false;
 356:			}
 357:			if (f2fs_sb_has_compression(sbi)) {
 358:				f2fs_warn(sbi, "%s: corrupted inode ino=%llx, wrong feature flag: %u, run fsck to fix.",
 359:					  __func__, inode->i_ino, F2FS_FEATURE_COMPRESSION);
 360:				return false;
 361:			}
 362:		}
 363:	
 364:		if (f2fs_sanity_check_inline_data(inode, node_folio)) {
 365:			f2fs_warn(sbi, "%s: inode (ino=%llx, mode=%u) should not have inline_data, run fsck to fix",
 366:				  __func__, inode->i_ino, inode->i_mode);
 367:			return false;
 368:		}
 369:	
 370:		if (f2fs_has_inline_dentry(inode) && !S_ISDIR(inode->i_mode)) {
 371:			f2fs_warn(sbi, "%s: inode (ino=%llx, mode=%u) should not have inline_dentry, run fsck to fix",
 372:				  __func__, inode->i_ino, inode->i_mode);
 373:			return false;
 374:		}
 375:	
 376:		if ((fi->i_flags & F2FS_CASEFOLD_FL) && !f2fs_sb_has_casefold(sbi)) {
 377:			f2fs_warn(sbi, "%s: inode (ino=%llx) has casefold flag, but casefold feature is off",
 378:				  __func__, inode->i_ino);
 379:			return false;
 380:		}
 381:	
 382:		if (fi->i_xattr_nid && f2fs_check_nid_range(sbi, fi->i_xattr_nid)) {
 383:			f2fs_warn(sbi, "%s: inode (ino=%llx) has corrupted i_xattr_nid: %u, run fsck to fix.",
 384:				  __func__, inode->i_ino, fi->i_xattr_nid);
 385:			return false;
 386:		}
 387:	
 388:		if (IS_DEVICE_ALIASING(inode)) {
 389:			if (!f2fs_sb_has_device_alias(sbi)) {
 390:				f2fs_warn(sbi, "%s: inode (ino=%llx) has device alias flag, but the feature is off",
 391:					  __func__, inode->i_ino);
 392:				return false;
 393:			}
 394:			if (!f2fs_is_pinned_file(inode)) {
 395:				f2fs_warn(sbi, "%s: inode (ino=%llx) has device alias flag, but is not pinned",
 396:					  __func__, inode->i_ino);
 397:				return false;
 398:			}
 399:		}
 400:	
 401:		return true;
 402:	}
 SourceFile:fs/f2fs/inode.c]

gemini-3.1-pro-preview

							input: 29939
							output: 45
							thoughts: 22
						

Here's my take on the thought process, as if it were my own:

**Compression Sanity Check - Let's Dig In**

Okay, so we're dealing with compression, and I see `sanity_check_compress_inode` being called. My first thought is: "Alright, let's take a look at what this function is doing. I need to understand its role within the compression workflow." Since I'm knee-deep in this area, my mind immediately starts pulling up the relevant documentation and code paths. I need to quickly assess what it's checking, what assumptions it's making about the inode, and what potential failure modes it's trying to catch. Is it verifying metadata consistency? Data integrity after compression/decompression? Or perhaps it's a security check related to compressed data? Understanding the function's purpose is absolutely crucial to knowing how to diagnose problems, make improvements, or even write solid tests. I'll get to it.

map[ContextFile:fs/f2fs/inode.c IncludeLines:true Name:sanity_check_compress_inode]

map[SourceCode: 198:	static bool sanity_check_compress_inode(struct inode *inode,
 199:				struct f2fs_inode *ri)
 200:	{
 201:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 202:		unsigned char clevel;
 203:	
 204:		if (ri->i_compress_algorithm >= COMPRESS_MAX) {
 205:			f2fs_warn(sbi,
 206:				"%s: inode (ino=%llx) has unsupported compress algorithm: %u, run fsck to fix",
 207:				__func__, inode->i_ino, ri->i_compress_algorithm);
 208:			return false;
 209:		}
 210:		if (le64_to_cpu(ri->i_compr_blocks) >
 211:				SECTOR_TO_BLOCK(inode->i_blocks)) {
 212:			f2fs_warn(sbi,
 213:				"%s: inode (ino=%llx) has inconsistent i_compr_blocks:%llu, i_blocks:%llu, run fsck to fix",
 214:				__func__, inode->i_ino, le64_to_cpu(ri->i_compr_blocks),
 215:				SECTOR_TO_BLOCK(inode->i_blocks));
 216:			return false;
 217:		}
 218:		if (ri->i_log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
 219:			ri->i_log_cluster_size > MAX_COMPRESS_LOG_SIZE) {
 220:			f2fs_warn(sbi,
 221:				"%s: inode (ino=%llx) has unsupported log cluster size: %u, run fsck to fix",
 222:				__func__, inode->i_ino, ri->i_log_cluster_size);
 223:			return false;
 224:		}
 225:	
 226:		clevel = le16_to_cpu(ri->i_compress_flag) >>
 227:					COMPRESS_LEVEL_OFFSET;
 228:		switch (ri->i_compress_algorithm) {
 229:		case COMPRESS_LZO:
 230:	#ifdef CONFIG_F2FS_FS_LZO
 231:			if (clevel)
 232:				goto err_level;
 233:	#endif
 234:			break;
 235:		case COMPRESS_LZORLE:
 236:	#ifdef CONFIG_F2FS_FS_LZORLE
 237:			if (clevel)
 238:				goto err_level;
 239:	#endif
 240:			break;
 241:		case COMPRESS_LZ4:
 242:	#ifdef CONFIG_F2FS_FS_LZ4
 243:	#ifdef CONFIG_F2FS_FS_LZ4HC
 244:			if (clevel &&
 245:			   (clevel < LZ4HC_MIN_CLEVEL || clevel > LZ4HC_MAX_CLEVEL))
 246:				goto err_level;
 247:	#else
 248:			if (clevel)
 249:				goto err_level;
 250:	#endif
 251:	#endif
 252:			break;
 253:		case COMPRESS_ZSTD:
 254:	#ifdef CONFIG_F2FS_FS_ZSTD
 255:			if (clevel < zstd_min_clevel() || clevel > zstd_max_clevel())
 256:				goto err_level;
 257:	#endif
 258:			break;
 259:		default:
 260:			goto err_level;
 261:		}
 262:	
 263:		return true;
 264:	err_level:
 265:		f2fs_warn(sbi, "%s: inode (ino=%llx) has unsupported compress level: %u, run fsck to fix",
 266:			  __func__, inode->i_ino, clevel);
 267:		return false;
 268:	}
 SourceFile:fs/f2fs/inode.c]

gemini-3.1-pro-preview

							input: 31391
							output: 49
							thoughts: 536
						

**Analyzing a Potential F2FS Bug**

Okay, let's break this down. My initial observation is that `MIN_COMPRESS_LOG_SIZE` is 2 and `MAX_COMPRESS_LOG_SIZE` is 8, which means `i_cluster_size` is somewhere between 4 and 256. The core issue seems to arise when `i_cluster_size` is at its maximum, 256. Specifically, `ALIGN_DOWN(addrs, 256)` might be less than `dn.ofs_in_node`.

Let's look into the variables. `addrs` is equal to `CUR_ADDRS_PER_INODE(inode) - get_inline_xattr_addrs(inode)`. Typically, for an inode, `CUR_ADDRS_PER_INODE` is 923. Therefore, `ALIGN_DOWN(923, 256)` equals 768.

Here's where it gets interesting. If `dn.ofs_in_node` is between 768 and 922, the subsequent `count` calculation will result in `768 - dn.ofs_in_node`, and that's negative! Bingo! It seems I've found the bug. When `dn.node_folio` is an inode, `ADDRS_PER_PAGE` is set to `ALIGN_DOWN(addrs, cluster_size)`. Consequently, if `dn.ofs_in_node` is greater than `ALIGN_DOWN(addrs, cluster_size)`, `count` gets negative.

Now, how does this happen? `dn.ofs_in_node` is derived from `offset[level]` in `f2fs_get_dnode_of_data`. For `level == 0` which represents direct pointers within the inode, `offset[0]` is equal to `free_from`. This makes it clear that if `free_from` is between 768 and 922, `dn.ofs_in_node` ends up in the same range. The negative `count`, which is the result of `768 - free_from` then triggers the `f2fs_bug_on(sbi, count < 0)`.

A key question is whether an unprivileged user can trigger this. If they can, it's a security risk. Given that the cluster size can be set to 256 (log_cluster_size = 8), an unprivileged user can potentially create a compressed file, set the cluster size, and truncate the file to a block offset between 768 and 922. The next step is to test this scenario.

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_ioc_set_compress_option]

map[SourceCode:4376:	static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg)
4377:	{
4378:		struct inode *inode = file_inode(filp);
4379:		struct f2fs_inode_info *fi = F2FS_I(inode);
4380:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
4381:		struct f2fs_comp_option option;
4382:		int ret = 0;
4383:	
4384:		if (!f2fs_sb_has_compression(sbi))
4385:			return -EOPNOTSUPP;
4386:	
4387:		if (!(filp->f_mode & FMODE_WRITE))
4388:			return -EBADF;
4389:	
4390:		if (copy_from_user(&option, (struct f2fs_comp_option __user *)arg,
4391:					sizeof(option)))
4392:			return -EFAULT;
4393:	
4394:		if (option.log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
4395:			option.log_cluster_size > MAX_COMPRESS_LOG_SIZE ||
4396:			option.algorithm >= COMPRESS_MAX)
4397:			return -EINVAL;
4398:	
4399:		ret = mnt_want_write_file(filp);
4400:		if (ret)
4401:			return ret;
4402:		inode_lock(inode);
4403:	
4404:		f2fs_down_write(&F2FS_I(inode)->i_sem);
4405:		if (!f2fs_compressed_file(inode)) {
4406:			ret = -EINVAL;
4407:			goto out;
4408:		}
4409:	
4410:		if (f2fs_is_mmap_file(inode) || get_dirty_pages(inode)) {
4411:			ret = -EBUSY;
4412:			goto out;
4413:		}
4414:	
4415:		if (F2FS_HAS_BLOCKS(inode)) {
4416:			ret = -EFBIG;
4417:			goto out;
4418:		}
4419:	
4420:		fi->i_compress_algorithm = option.algorithm;
4421:		fi->i_log_cluster_size = option.log_cluster_size;
4422:		fi->i_cluster_size = BIT(option.log_cluster_size);
4423:		/* Set default level */
4424:		if (fi->i_compress_algorithm == COMPRESS_ZSTD)
4425:			fi->i_compress_level = F2FS_ZSTD_DEFAULT_CLEVEL;
4426:		else
4427:			fi->i_compress_level = 0;
4428:		/* Adjust mount option level */
4429:		if (option.algorithm == F2FS_OPTION(sbi).compress_algorithm &&
4430:		    F2FS_OPTION(sbi).compress_level)
4431:			fi->i_compress_level = F2FS_OPTION(sbi).compress_level;
4432:		f2fs_mark_inode_dirty_sync(inode, true);
4433:	
4434:		if (!f2fs_is_compress_backend_ready(inode))
4435:			f2fs_warn(sbi, "compression algorithm is successfully set, "
4436:				"but current kernel doesn't support this algorithm.");
4437:	out:
4438:		f2fs_up_write(&fi->i_sem);
4439:		inode_unlock(inode);
4440:		mnt_drop_write_file(filp);
4441:	
4442:		return ret;
4443:	}
 SourceFile:fs/f2fs/file.c]

gemini-3.1-pro-preview

							input: 33683
							output: 55
							thoughts: 101
						

**Analyzing F2FS Compression Vulnerability**

Okay, so I'm digging into this F2FS file system stuff, and it looks like a standard, non-privileged user can, surprisingly, call `F2FS_IOC_SET_COMPRESS_OPTION`. They can set `log_cluster_size` to 8, which translates to a `cluster_size` of 256. That's interesting, but not necessarily a huge deal on its own. Now, where this gets potentially interesting is that they can then truncate the file to a controlled size.

Hmm, I need to jog my memory, does the `truncate` operation call `f2fs_do_truncate_blocks`? If so, this is where it might get juicy. I'll need to check the call graph to confirm, because that's the key. I need to understand if `truncate`, in combination with the earlier compression setting, leads to a specific sequence in `f2fs_do_truncate_blocks` that could be exploitable. This warrants deeper investigation. I want to see how these operations interact.

map[ContextFile:fs/f2fs/file.c IncludeSnippetLines:0 Name:f2fs_do_truncate_blocks SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__complete_revoke_list SourceFile:fs/f2fs/segment.c SourceLine:305] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_ioc_start_atomic_write SourceFile:fs/f2fs/file.c SourceLine:2345] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_truncate_blocks SourceFile:fs/f2fs/file.c SourceLine:882] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_truncate_partial_cluster SourceFile:fs/f2fs/compress.c SourceLine:1229] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_truncate_partial_cluster SourceFile:fs/f2fs/compress.c SourceLine:1264]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 34367
							output: 53
							thoughts: 21
						

Okay, here's my interpretation of that.

**Analyzing the Truncation Process in F2FS**

Alright, so I'm looking at how F2FS handles block truncation. The initial function, `f2fs_truncate_blocks`, seems to be the entry point for this operation. My understanding is that this call then delegates the heavy lifting to `f2fs_do_truncate_blocks`. That's a pretty standard pattern – have a high-level function handle the initial setup and any necessary checks, and then pass the core logic to a dedicated helper function. I need to dig deeper into `f2fs_do_truncate_blocks` now; this is where the real work of removing data blocks is probably happening, and where I'll find the finer details of the allocation and deallocation strategies for the blocks.

map[ContextFile:fs/f2fs/file.c IncludeSnippetLines:0 Name:f2fs_truncate_blocks SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_add_inline_entries SourceFile:fs/f2fs/inline.c SourceLine:532] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_collapse_range SourceFile:fs/f2fs/file.c SourceLine:1622] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_insert_range SourceFile:fs/f2fs/file.c SourceLine:1820] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_recover_inline_data SourceFile:fs/f2fs/inline.c SourceLine:345] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_truncate SourceFile:fs/f2fs/file.c SourceLine:940] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_write_failed SourceFile:fs/f2fs/data.c SourceLine:3669]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 34959
							output: 51
							thoughts: 17
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**F2FS Truncation – A Deep Dive**

Right, so `f2fs_truncate` is clearly the entry point for handling file truncation in F2FS. And what's it doing? It's immediately calling `f2fs_truncate_blocks`. That's not surprising. Truncation, at its core, is a block-level operation. We're not just adjusting the file size metadata; we're actually *freeing* those data blocks on disk that are no longer needed. The key here is that `f2fs_truncate_blocks` is the workhorse of the entire operation. It's the function responsible for the actual block manipulation. It's the core routine to understanding how the file system frees up space after a truncation call is made to a file.

map[ContextFile:fs/f2fs/file.c IncludeSnippetLines:0 Name:f2fs_truncate SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_drop_inode SourceFile:fs/f2fs/super.c SourceLine:1872] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_end_enable_verity SourceFile:fs/f2fs/verity.c SourceLine:208] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_evict_inode SourceFile:fs/f2fs/inode.c SourceLine:907] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_file_write_iter SourceFile:fs/f2fs/file.c SourceLine:5285] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:f2fs_setattr SourceFile:fs/f2fs/file.c SourceLine:1175] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:finish_preallocate_blocks SourceFile:fs/f2fs/file.c SourceLine:610]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 35564
							output: 49
							thoughts: 1294
						

**F2FS Vulnerability Analysis: A Deep Dive**

Okay, here's what I've got. `f2fs_setattr` calls `f2fs_truncate`, which is, of course, triggered by `truncate` or `ftruncate`. That's the entry point. This is an unprivileged operation, meaning a regular user could potentially trigger something if they have access to an f2fs filesystem.

I need to confirm if `f2fs_ioc_set_compress_option` requires any special privileges. Let me re-examine that function... nope, no capability checks. It checks for compression support on the filesystem (`f2fs_sb_has_compression`), write access, and a few other things, but nothing that would prevent an unprivileged user from exploiting it.

So, here's a likely scenario for a user:

1.  Create a file on an f2fs filesystem.
2.  Enable compression on that file, likely using `FS_COMPR_FL` via `F2FS_IOC_SETFLAGS`.
3.  Then, use `F2FS_IOC_SET_COMPRESS_OPTION` to set the `log_cluster_size` to 8.
4.  Finally, truncate the file to a size that maps to a block offset between 768 and 922.

However, `F2FS_HAS_BLOCKS(inode)` must be false while setting the compress option, meaning the file must be empty initially. Ok, the user could write some data, allocate some blocks, and then truncate *down* the file. Now, the `f2fs_do_truncate_blocks` routine is involved, as I recall from previous debugging sessions.

Let's check if `f2fs_do_truncate_blocks` is hit when truncating down. Yes, `f2fs_setattr` calls `f2fs_truncate` if the new size is smaller than the old size, and the `ATTR_SIZE` flag is set. `f2fs_truncate` calls `f2fs_truncate_blocks`, which then calls `f2fs_do_truncate_blocks`. The critical part here is when the `from` parameter in `f2fs_do_truncate_blocks` is equal to `inode->i_size` which is where the truncation happens.

Essentially, `free_from` is `F2FS_BLK_ALIGN(inode->i_size)`. If that aligned size falls between 768 and 922, we hit the condition where `count < 0` will be true.

Let's verify this... `ADDRS_PER_PAGE(dn.node_folio, inode)` returns `ALIGN_DOWN(addrs, cluster_size)`. In the inode case, `addrs` is `CUR_ADDRS_PER_INODE(inode) - get_inline_xattr_addrs(inode)`. Let's assume `addrs` is 923, and `cluster_size` is 256. Then `ALIGN_DOWN(923, 256)` is 768. If `free_from` is 769, then `count` becomes `768 - 769`, or -1, and that triggers `f2fs_bug_on`.

Now, does `f2fs_get_dnode_of_data` succeed when `free_from` is 769? It does, after an initial call to `get_node_path`. The path returns offset 769. `dn->ofs_in_node` is set to 769. Then `f2fs_get_dnode_of_data` returns zero if it's not a read-only filesystem and it skips the compressed file check, allowing the calculation to continue. Therefore, `count` goes to `768 - 769 = -1`. The BUG triggers.

Can an unprivileged user reach this scenario? Yes. If they have access to an f2fs filesystem with compression enabled, which is a common setup on Android devices, and possibly even some Linux desktop distributions, it is totally possible. Since it's a local operation, and an unprivileged process can trigger it, it is a local DoS. The user doesn't even need to mount the filesystem, just access it.

Now, I should confirm what the default behavior is, does f2fs enable compression by default? Let me check `f2fs_sb_has_compression`. This is very likely a security issue that needs immediate attention.

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_sb_has_compression]

map[SourceCode:4823:	F2FS_FEATURE_FUNCS(compression, COMPRESSION);
 SourceFile:fs/f2fs/f2fs.h]

gemini-3.1-pro-preview

							input: 37962
							output: 46
							thoughts: 86
						

**Assessing the Security Implications of F2FS Compression**

Okay, so I'm looking at this and my initial thought is: first, it's checking whether the `COMPRESSION` feature is enabled in the filesystem. That's either going to be a `mkfs` or `mount` time option, right? And if compression *is* active, that's where the vulnerability lies: an unprivileged user *could* potentially exploit a bug. Based on that, I'm marking "Accessible From Unprivileged Processes" as True, which seems correct given the premise.

Now, I need to confirm this. The real crux of this problem is whether `F2FS_IOC_SETFLAGS` actually allows a non-root user to set the `FS_COMPR_FL` flag. I have to check the relevant syscall implementation to be sure. This is where I'll find my real answer.

log-in to see details

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_ioc_setflags]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 38307
							output: 20
							thoughts: 25
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Hunting Down `FS_COMPR_FL` in the F2FS Filesystem**

Alright, time to dive in. I need to get to the source of where the `FS_COMPR_FL` flag is defined and used within the F2FS filesystem. First, the instinct is to jump to where it would likely be implemented. Let's start with a targeted search. I'm thinking, `fs/f2fs/file.c` is a reasonable place to begin. The file management stuff usually lives there, and file-specific flags are certainly that. I'll search that file for the literal string `FS_COMPR_FL`. That should give me a good jumping-off point. It'll probably turn up the definition, and from there I can trace usage through the code. That’s the most efficient way to get a quick overview of how compression is handled at the file level in this filesystem. Let's see what that search turns up.

map[Expression:FS_COMPR_FL]

map[Output:Documentation/filesystems/f2fs.rst=878=Compression implementation
--
Documentation/filesystems/f2fs.rst-907-
Documentation/filesystems/f2fs.rst:908:- Priority in between FS_COMPR_FL, FS_NOCOMP_FS, extensions:
Documentation/filesystems/f2fs.rst-909-
--
fs/btrfs/ioctl.c=136=static unsigned int btrfs_inode_flags_to_fsflags(const struct btrfs_inode *inode)
--
fs/btrfs/ioctl.c-161-	else if (flags & BTRFS_INODE_COMPRESS)
fs/btrfs/ioctl.c:162:		iflags |= FS_COMPR_FL;
fs/btrfs/ioctl.c-163-
--
fs/btrfs/ioctl.c=196=static int check_fsflags(unsigned int old_flags, unsigned int flags)
--
fs/btrfs/ioctl.c-200-		      FS_SYNC_FL | FS_DIRSYNC_FL | \
fs/btrfs/ioctl.c:201:		      FS_NOCOMP_FL | FS_COMPR_FL |
fs/btrfs/ioctl.c-202-		      FS_NOCOW_FL))
--
fs/btrfs/ioctl.c-205-	/* COMPR and NOCOMP on new/old are valid */
fs/btrfs/ioctl.c:206:	if ((flags & FS_NOCOMP_FL) && (flags & FS_COMPR_FL))
fs/btrfs/ioctl.c-207-		return -EINVAL;
fs/btrfs/ioctl.c-208-
fs/btrfs/ioctl.c:209:	if ((flags & FS_COMPR_FL) && (flags & FS_NOCOW_FL))
fs/btrfs/ioctl.c-210-		return -EINVAL;
--
fs/btrfs/ioctl.c-212-	/* NOCOW and compression options are mutually exclusive */
fs/btrfs/ioctl.c:213:	if ((old_flags & FS_NOCOW_FL) && (flags & (FS_COMPR_FL | FS_NOCOMP_FL)))
fs/btrfs/ioctl.c-214-		return -EINVAL;
fs/btrfs/ioctl.c:215:	if ((flags & FS_NOCOW_FL) && (old_flags & (FS_COMPR_FL | FS_NOCOMP_FL)))
fs/btrfs/ioctl.c-216-		return -EINVAL;
--
fs/btrfs/ioctl.c=256=int btrfs_fileattr_set(struct mnt_idmap *idmap,
--
fs/btrfs/ioctl.c-352-		inode_flags |= BTRFS_INODE_NOCOMPRESS;
fs/btrfs/ioctl.c:353:	} else if (fsflags & FS_COMPR_FL) {
fs/btrfs/ioctl.c-354-
--
fs/ext2/ext2.h=191=struct ext2_group_desc
--
fs/ext2/ext2.h-224-#define	EXT2_UNRM_FL			FS_UNRM_FL	/* Undelete */
fs/ext2/ext2.h:225:#define	EXT2_COMPR_FL			FS_COMPR_FL	/* Compress file */
fs/ext2/ext2.h-226-#define EXT2_SYNC_FL			FS_SYNC_FL	/* Synchronous updates */
--
fs/f2fs/f2fs.h=3287=static inline void f2fs_change_bit(unsigned int nr, char *addr)
--
fs/f2fs/f2fs.h-3298- */
fs/f2fs/f2fs.h:3299:#define F2FS_COMPR_FL			0x00000004 /* Compress file */
fs/f2fs/f2fs.h-3300-#define F2FS_SYNC_FL			0x00000008 /* Synchronous updates */
--
fs/f2fs/f2fs.h=4754=static inline int set_compress_context(struct inode *inode)
--
fs/f2fs/f2fs.h-4768-		fi->i_compress_level = F2FS_OPTION(sbi).compress_level;
fs/f2fs/f2fs.h:4769:	fi->i_flags |= F2FS_COMPR_FL;
fs/f2fs/f2fs.h-4770-	set_inode_flag(inode, FI_COMPRESSED_FILE);
--
fs/f2fs/f2fs.h=4780=static inline bool f2fs_disable_compressed_file(struct inode *inode)
--
fs/f2fs/f2fs.h-4795-
fs/f2fs/f2fs.h:4796:	fi->i_flags &= ~F2FS_COMPR_FL;
fs/f2fs/f2fs.h-4797-	stat_dec_compr_inode(inode);
--
fs/f2fs/file.c=982=int f2fs_getattr(struct mnt_idmap *idmap, const struct path *path,
--
fs/f2fs/file.c-1016-	flags = fi->i_flags;
fs/f2fs/file.c:1017:	if (flags & F2FS_COMPR_FL)
fs/f2fs/file.c-1018-		stat->attributes |= STATX_ATTR_COMPRESSED;
--
fs/f2fs/file.c=2112=static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
--
fs/f2fs/file.c-2130-
fs/f2fs/file.c:2131:	if (iflags & (F2FS_COMPR_FL | F2FS_NOCOMP_FL)) {
fs/f2fs/file.c-2132-		if (!f2fs_sb_has_compression(F2FS_I_SB(inode)))
fs/f2fs/file.c-2133-			return -EOPNOTSUPP;
fs/f2fs/file.c:2134:		if ((iflags & F2FS_COMPR_FL) && (iflags & F2FS_NOCOMP_FL))
fs/f2fs/file.c-2135-			return -EINVAL;
--
fs/f2fs/file.c-2137-
fs/f2fs/file.c:2138:	if ((iflags ^ masked_flags) & F2FS_COMPR_FL) {
fs/f2fs/file.c:2139:		if (masked_flags & F2FS_COMPR_FL) {
fs/f2fs/file.c-2140-			if (!f2fs_disable_compressed_file(inode))
--
fs/f2fs/file.c-2164-	fi->i_flags = iflags | (fi->i_flags & ~mask);
fs/f2fs/file.c:2165:	f2fs_bug_on(F2FS_I_SB(inode), (fi->i_flags & F2FS_COMPR_FL) &&
fs/f2fs/file.c-2166-					(fi->i_flags & F2FS_NOCOMP_FL));
--
fs/f2fs/file.c=2191=static const struct {
--
fs/f2fs/file.c-2194-} f2fs_fsflags_map[] = {
fs/f2fs/file.c:2195:	{ F2FS_COMPR_FL,	FS_COMPR_FL },
fs/f2fs/file.c-2196-	{ F2FS_SYNC_FL,		FS_SYNC_FL },
--
fs/f2fs/file.c-2208-#define F2FS_GETTABLE_FS_FL (		\
fs/f2fs/file.c:2209:		FS_COMPR_FL |		\
fs/f2fs/file.c-2210-		FS_SYNC_FL |		\
--
fs/f2fs/file.c-2225-#define F2FS_SETTABLE_FS_FL (		\
fs/f2fs/file.c:2226:		FS_COMPR_FL |		\
fs/f2fs/file.c-2227-		FS_SYNC_FL |		\
--
fs/f2fs/inline.c=51=bool f2fs_sanity_check_inline_data(struct inode *inode, struct folio *ifolio)
--
fs/f2fs/inline.c-67-		(file_is_encrypt(inode) || file_is_verity(inode) ||
fs/f2fs/inline.c:68:		(F2FS_I(inode)->i_flags & F2FS_COMPR_FL)));
fs/f2fs/inline.c-69-}
--
fs/f2fs/inode.c=270=static bool sanity_check_inode(struct inode *inode, struct folio *node_folio)
--
fs/f2fs/inode.c-317-		if (f2fs_sb_has_compression(sbi) &&
fs/f2fs/inode.c:318:			fi->i_flags & F2FS_COMPR_FL &&
fs/f2fs/inode.c-319-			F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
--
fs/f2fs/inode.c=413=static int do_read_inode(struct inode *inode)
--
fs/f2fs/inode.c-519-	if (f2fs_has_extra_attr(inode) && f2fs_sb_has_compression(sbi) &&
fs/f2fs/inode.c:520:					(fi->i_flags & F2FS_COMPR_FL)) {
fs/f2fs/inode.c-521-		if (F2FS_FITS_IN_INODE(ri, fi->i_extra_isize,
--
fs/f2fs/namei.c=154=static void set_compress_new_inode(struct f2fs_sb_info *sbi, struct inode *dir,
--
fs/f2fs/namei.c-202-		f2fs_mark_inode_dirty_sync(inode, true);
fs/f2fs/namei.c:203:	} else if (F2FS_I(dir)->i_flags & F2FS_COMPR_FL) {
fs/f2fs/namei.c-204-		set_compress_context(inode);
--
fs/nilfs2/nilfs.h=227=static inline int nilfs_init_acl(struct inode *inode, struct inode *dir)
--
fs/nilfs2/nilfs.h-240-#define NILFS_FL_INHERITED						\
fs/nilfs2/nilfs.h:241:	(FS_SECRM_FL | FS_UNRM_FL | FS_COMPR_FL | FS_SYNC_FL |		\
fs/nilfs2/nilfs.h-242-	 FS_IMMUTABLE_FL | FS_APPEND_FL | FS_NODUMP_FL | FS_NOATIME_FL |\
--
fs/ocfs2/ocfs2_fs.h-240-#define OCFS2_UNRM_FL			FS_UNRM_FL	/* Undelete */
fs/ocfs2/ocfs2_fs.h:241:#define OCFS2_COMPR_FL			FS_COMPR_FL	/* Compress file */
fs/ocfs2/ocfs2_fs.h-242-#define OCFS2_SYNC_FL			FS_SYNC_FL	/* Synchronous updates */
--
fs/smb/client/ioctl.c=348=long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
--
fs/smb/client/ioctl.c-397-				/* add in the compressed bit */
fs/smb/client/ioctl.c:398:				ExtAttrBits = FS_COMPR_FL;
fs/smb/client/ioctl.c-399-				rc = put_user(ExtAttrBits & FS_FL_USER_VISIBLE,
--
fs/smb/client/ioctl.c-424-			/* Currently only flag we can set is compressed flag */
fs/smb/client/ioctl.c:425:			if ((ExtAttrBits & FS_COMPR_FL) == 0)
fs/smb/client/ioctl.c-426-				break;
--
fs/ubifs/dir.c-39- * parent directory inode @dir. UBIFS inodes inherit the following flags:
fs/ubifs/dir.c:40: * o %UBIFS_COMPR_FL, which is useful to switch compression on/of on
fs/ubifs/dir.c-41- *   sub-directory basis;
--
fs/ubifs/dir.c=47=static int inherit_flags(const struct inode *dir, umode_t mode)
--
fs/ubifs/dir.c-58-
fs/ubifs/dir.c:59:	flags = ui->flags & (UBIFS_COMPR_FL | UBIFS_SYNC_FL | UBIFS_DIRSYNC_FL);
fs/ubifs/dir.c-60-	if (!S_ISDIR(mode))
--
fs/ubifs/dir.c=1670=int ubifs_getattr(struct mnt_idmap *idmap, const struct path *path,
--
fs/ubifs/dir.c-1680-		stat->attributes |= STATX_ATTR_APPEND;
fs/ubifs/dir.c:1681:	if (ui->flags & UBIFS_COMPR_FL)
fs/ubifs/dir.c-1682-		stat->attributes |= STATX_ATTR_COMPRESSED;
--
fs/ubifs/ioctl.c-21-#define UBIFS_SETTABLE_IOCTL_FLAGS \
fs/ubifs/ioctl.c:22:	(FS_COMPR_FL | FS_SYNC_FL | FS_APPEND_FL | \
fs/ubifs/ioctl.c-23-	 FS_IMMUTABLE_FL | FS_DIRSYNC_FL)
--
fs/ubifs/ioctl.c=35=void ubifs_set_inode_flags(struct inode *inode)
--
fs/ubifs/ioctl.c-56- *
fs/ubifs/ioctl.c:57: * This function converts ioctl flags (@FS_COMPR_FL, etc) to UBIFS inode flags
fs/ubifs/ioctl.c:58: * (@UBIFS_COMPR_FL, etc).
fs/ubifs/ioctl.c-59- */
fs/ubifs/ioctl.c=60=static int ioctl2ubifs(int ioctl_flags)
--
fs/ubifs/ioctl.c-63-
fs/ubifs/ioctl.c:64:	if (ioctl_flags & FS_COMPR_FL)
fs/ubifs/ioctl.c:65:		ubifs_flags |= UBIFS_COMPR_FL;
fs/ubifs/ioctl.c-66-	if (ioctl_flags & FS_SYNC_FL)
--
fs/ubifs/ioctl.c-81- *
fs/ubifs/ioctl.c:82: * This function converts UBIFS inode flags (@UBIFS_COMPR_FL, etc) to ioctl
fs/ubifs/ioctl.c:83: * flags (@FS_COMPR_FL, etc).
fs/ubifs/ioctl.c-84- */
fs/ubifs/ioctl.c=85=static int ubifs2ioctl(int ubifs_flags)
--
fs/ubifs/ioctl.c-88-
fs/ubifs/ioctl.c:89:	if (ubifs_flags & UBIFS_COMPR_FL)
fs/ubifs/ioctl.c:90:		ioctl_flags |= FS_COMPR_FL;
fs/ubifs/ioctl.c-91-	if (ubifs_flags & UBIFS_SYNC_FL)
--
fs/ubifs/journal.c=855=int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
--
fs/ubifs/journal.c-893-
fs/ubifs/journal.c:894:	if (!(ui->flags & UBIFS_COMPR_FL))
fs/ubifs/journal.c-895-		/* Compression is disabled for this inode */
--
fs/ubifs/sb.c=75=static int create_default_filesystem(struct ubifs_info *c)
--
fs/ubifs/sb.c-308-	/* Set compression enabled by default */
fs/ubifs/sb.c:309:	ino->flags = cpu_to_le32(UBIFS_COMPR_FL);
fs/ubifs/sb.c-310-
--
fs/ubifs/ubifs-media.h=213=enum {
--
fs/ubifs/ubifs-media.h-311- *
fs/ubifs/ubifs-media.h:312: * UBIFS_COMPR_FL: use compression for this inode
fs/ubifs/ubifs-media.h-313- * UBIFS_SYNC_FL:  I/O on this inode has to be synchronous
--
fs/ubifs/ubifs-media.h-320- * Note, these are on-flash flags which correspond to ioctl flags
fs/ubifs/ubifs-media.h:321: * (@FS_COMPR_FL, etc). They have the same values now, but generally, do not
fs/ubifs/ubifs-media.h-322- * have to be the same.
--
fs/ubifs/ubifs-media.h=324=enum {
fs/ubifs/ubifs-media.h:325:	UBIFS_COMPR_FL     = 0x01,
fs/ubifs/ubifs-media.h-326-	UBIFS_SYNC_FL      = 0x02,
--
fs/ubifs/ubifs-media.h=475=union ubifs_dev_desc {
--
fs/ubifs/ubifs-media.h-495- * @mode: access flags
fs/ubifs/ubifs-media.h:496: * @flags: per-inode flags (%UBIFS_COMPR_FL, %UBIFS_SYNC_FL, etc)
fs/ubifs/ubifs-media.h-497- * @data_len: inode data length
--
fs/ubifs/ubifs.h=334=struct ubifs_gced_idx_leb {
--
fs/ubifs/ubifs.h-361- * @ui_size: inode size used by UBIFS when writing to flash
fs/ubifs/ubifs.h:362: * @flags: inode flags (@UBIFS_COMPR_FL, etc)
fs/ubifs/ubifs.h-363- * @compr_type: default compression type used for this inode
--
include/uapi/linux/fs.h=226=struct file_attr {
--
include/uapi/linux/fs.h-362-#define	FS_UNRM_FL			0x00000002 /* Undelete */
include/uapi/linux/fs.h:363:#define	FS_COMPR_FL			0x00000004 /* Compress file */
include/uapi/linux/fs.h-364-#define FS_SYNC_FL			0x00000008 /* Synchronous updates */
--
tools/include/uapi/linux/fs.h=142=struct fsxattr {
--
tools/include/uapi/linux/fs.h-274-#define	FS_UNRM_FL			0x00000002 /* Undelete */
tools/include/uapi/linux/fs.h:275:#define	FS_COMPR_FL			0x00000004 /* Compress file */
tools/include/uapi/linux/fs.h-276-#define FS_SYNC_FL			0x00000008 /* Synchronous updates */
--
tools/perf/trace/beauty/include/uapi/linux/fs.h=226=struct file_attr {
--
tools/perf/trace/beauty/include/uapi/linux/fs.h-362-#define	FS_UNRM_FL			0x00000002 /* Undelete */
tools/perf/trace/beauty/include/uapi/linux/fs.h:363:#define	FS_COMPR_FL			0x00000004 /* Compress file */
tools/perf/trace/beauty/include/uapi/linux/fs.h-364-#define FS_SYNC_FL			0x00000008 /* Synchronous updates */
]

gemini-3.1-pro-preview

							input: 43949
							output: 47
							thoughts: 1705
						

**Analysis of the F2FS Truncate Bug**

Okay, let's break this down systematically. It looks like the `FS_COMPR_FL` flag, a standard ioctl flag, is at the heart of the problem. Specifically, the vulnerability stems from a combination of setting the compression flag on a file and then using a specific compression option, followed by a strategically sized truncate operation. No special capabilities are needed for this process; a standard unprivileged user can manipulate file flags and size through standard interfaces.

My initial thought is that an unprivileged user can trigger this. They set `FS_COMPR_FL` on a file they own, call `F2FS_IOC_SET_COMPRESS_OPTION` to force `log_cluster_size` to 8 (which is a valid setting according to my review of the min and max compression values), and then truncate the file to a precise size. This points directly to the "Accessible From Unprivileged Processes" being True.

Looking at the dimensions: "Exploitable" is False; this is a kernel panic, not a memory corruption or escalation vulnerability. "Denial of Service" is True; a `BUG()` halts the kernel. Because the process is unprivileged, it follows that this is also accessible from user namespaces. The prompt explicitly confirms this, as capabilities are not required. "VM Guest Trigger" and "VM Host Trigger" are false, since the bug doesn't allow one VM to trigger it on another. "Network Trigger", "Remote Trigger", and "Peripheral Trigger" are all false as well; it's local filesystem interaction.

The bug report also references a "Malicious Filesystem Trigger". A corrupted f2fs image can trigger this during mount. It sounds like an inode with a specific size and compression settings causes this issue. So the vulnerability is accessible through this vector too.

Let's dig deeper: I checked `F2FS_IOC_SET_COMPRESS_OPTION` and confirmed that setting `log_cluster_size` to 8 (MAX_COMPRESS_LOG_SIZE) is valid.

The key to the vulnerability lies in how the block addresses are calculated during the truncate operation. Specifically, there's a specific calculation relating to address calculations, based on the `CUR_ADDRS_PER_INODE`, `get_inline_xattr_addrs`, `DEF_ADDRS_PER_INODE`, and block size. When you align down, and do the alignment with the number of cluster log sizes, an exact count of bytes causes a divide by zero error.

I can confirm my math aligns precisely with the observed BUG condition. If `free_from` ends up being 769, the `count` calculation will be negative. This means, by strategically setting the file size, compression option, and then truncating the file to a specific size, a user can trigger the `f2fs_bug_on` condition.

I need to confirm if `f2fs_do_truncate_blocks` can be called such that `free_from` equals 769. The signature `int f2fs_do_truncate_blocks(struct inode *inode, u64 from, bool lock)` and `F2FS_BLK_ALIGN` makes this work with `from = 768 * 4096 + 1`. This results in `free_from = 769`. `f2fs_get_dnode_of_data` is called with this `free_from`, which causes a write to `dn.ofs_in_node` with the same value, resulting in `count = ADDRS_PER_PAGE(dn.node_folio, inode) - dn.ofs_in_node`. The result of this operation is, of course, -1, and, in turn, this causes `f2fs_bug_on`.

Looking for any checks that might prevent `truncate` to `768 * 4096 + 1` came up empty.

There are no checks.

Therefore, an unprivileged user can crash the system with this.

The bug report shows this happening during mount too. The call trace (`f2fs_do_truncate_blocks`, `f2fs_truncate_blocks`, `f2fs_truncate`, `f2fs_evict_inode`, `evict`, `f2fs_fill_super`) shows that during mount, if the filesystem image has some malicious inodes with `i_size` such that `free_from = 769`, `i_log_cluster_size = 8`, and is a compressed file, the `evict` function calls `f2fs_truncate`, ultimately triggering the bug.

So, in addition to being user-triggered, it's also a malicious filesystem trigger.

log-in to see details

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_bug_on]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 46747
							output: 23
							thoughts: 14
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Investigating a Potential F2FS Bug**

Alright, time to get to the bottom of this. The first step, naturally, is to pinpoint the exact source of the problem. That means diving right into the code. My initial thought is to search for instances of `f2fs_bug_on`. It's a pretty standard macro for error detection in F2FS, so a quick search should give me a good starting point. I'm expecting this will take me to various conditional checks and error handling routines within the F2FS codebase. Hopefully, it'll immediately reveal the context of this bug, what conditions trigger it, and what data structures or operations are likely involved. From there, I can begin to assess the impact and possible causes. Let's see what we find.

map[Expression:#define f2fs_bug_on]

map[Output:fs/f2fs/f2fs.h-32-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:33:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-34-#else
fs/f2fs/f2fs.h:35:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-36-	do {								\
]

gemini-3.1-pro-preview

							input: 47114
							output: 47
							thoughts: 19
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the `#else` of `f2fs_bug_on`**

Okay, so I'm focusing in on the `#else` block within `f2fs_bug_on`. It's where the real meat of the handling resides when a specific condition *isn't* met, which, as a general rule, probably means something has gone awry that is *not* a blatant, immediate showstopper requiring an immediate kernel panic. I need to get a better handle on the recovery options, or, at least, what's *supposed* to happen when things are less dire.

My initial thoughts are, what constitutes that ‘less dire’ scenario? Is it a soft error, recoverable issue or something that, while problematic, can be contained or logged? My experience says it depends on the context, and how deeply this error is nested, and the criticality of the module where this code resides.

I'm thinking about the different possible outcomes here. Does this just log a warning and continue, hoping for the best? Does it attempt some form of repair, or maybe force a read-only remount? Or does it attempt to escalate the issue towards a panic? Knowing this detail allows me to reason about which types of problems are the worst case, and which can be more safely tolerated. I need to understand the error-handling paradigm within the F2FS codebase itself.

log-in to see details

map[ContextFile:fs/f2fs/f2fs.h IncludeLines:true Name:f2fs_bug_on]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 47511
							output: 23
							thoughts: 11
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing Conditional Logic**

Right, let's dive into this code. My immediate instinct is to pinpoint the `#else` branch within this conditional structure. I want to see how the logic diverges when the initial condition *isn't* met. Understanding the "else" path is crucial for comprehensive code analysis. It tells me what happens in the fallback scenarios, the situations where the primary condition fails. This will inform my assessment of the function's robustness and edge-case handling. I'm going to quickly use `grep` to quickly find where `#else` is implemented. I expect there to be a few of them and that I will need to iterate on my search to focus in on the right part of the code.

map[Expression:#define f2fs_bug_on]

map[Output:fs/f2fs/f2fs.h-32-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:33:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-34-#else
fs/f2fs/f2fs.h:35:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-36-	do {								\
]

gemini-3.1-pro-preview

							input: 47858
							output: 24
							thoughts: 23
						

Here's a summary of my thought process, as requested:

**Diving into F2FS's Header**

Okay, time to dig in. I need to understand some core aspects of the F2FS file system, and the best place to start is often the header file, specifically `fs/f2fs/f2fs.h`. Let's jump to around line 35. That's usually where the foundational definitions and structures begin to take shape. I'm expecting to find key constants, enumerations, maybe some basic data structure declarations that are critical to grasping the overall architecture. I'll need to pay close attention to things like block sizes, inode definitions, perhaps some vital flags or magic numbers that define F2FS's operational parameters. I'll mentally map these definitions to the bigger picture to understand how this code works to manage and access data, and ultimately perform on a storage device. Let's see what we've got!

map[Expression:#define f2fs_bug_on.*]

map[Output:fs/f2fs/f2fs.h-32-#ifdef CONFIG_F2FS_CHECK_FS
fs/f2fs/f2fs.h:33:#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
fs/f2fs/f2fs.h-34-#else
fs/f2fs/f2fs.h:35:#define f2fs_bug_on(sbi, condition)					\
fs/f2fs/f2fs.h-36-	do {								\
]

gemini-3.1-pro-preview

							input: 48253
							output: 26
							thoughts: 12
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial File Access and Read Operation**

Alright, the objective here is to get access to and process the file's data. My initial instinct, assuming a familiar environment, is to leverage a direct file reading function. I'm going to start by calling the function `read-file`. This is the most efficient first approach. I'll need to make sure I have the correct file path.

map[File:fs/f2fs/f2fs.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0 */
/*
 * fs/f2fs/f2fs.h
 *
 * Copyright (c) 2012 Samsung Electronics Co., Ltd.
 *             http://www.samsung.com/
 */
#ifndef _LINUX_F2FS_H
#define _LINUX_F2FS_H

#include <linux/uio.h>
#include <linux/types.h>
#include <linux/mmzone.h>
#include <linux/page-flags.h>
#include <linux/slab.h>
#include <linux/crc32.h>
#include <linux/magic.h>
#include <linux/kobject.h>
#include <linux/sched.h>
#include <linux/cred.h>
#include <linux/sched/mm.h>
#include <linux/vmalloc.h>
#include <linux/bio.h>
#include <linux/blkdev.h>
#include <linux/quotaops.h>
#include <linux/part_stat.h>
#include <linux/rw_hint.h>

#include <linux/fscrypt.h>
#include <linux/fsverity.h>

#ifdef CONFIG_F2FS_CHECK_FS
#define f2fs_bug_on(sbi, condition)	BUG_ON(condition)
#else
#define f2fs_bug_on(sbi, condition)					\
	do {								\
		if (WARN_ON(condition))					\
			set_sbi_flag(sbi, SBI_NEED_FSCK);		\
	} while (0)
#endif

enum {
	FAULT_KMALLOC,
	FAULT_KVMALLOC,
	FAULT_PAGE_ALLOC,
	FAULT_PAGE_GET,
	FAULT_ALLOC_BIO,	/* it's obsolete due to bio_alloc() will never fail */
	FAULT_ALLOC_NID,
	FAULT_ORPHAN,
	FAULT_BLOCK,
	FAULT_DIR_DEPTH,
	FAULT_EVICT_INODE,
	FAULT_TRUNCATE,
	FAULT_READ_IO,
	FAULT_CHECKPOINT,
	FAULT_DISCARD,		/* it's obsolete due to __blkdev_issue_discard() will never fail */
	FAULT_WRITE_IO,
	FAULT_SLAB_ALLOC,
	FAULT_DQUOT_INIT,
	FAULT_LOCK_OP,
	FAULT_BLKADDR_VALIDITY,
	FAULT_BLKADDR_CONSISTENCE,
	FAULT_NO_SEGMENT,
	FAULT_INCONSISTENT_FOOTER,
	FAULT_ATOMIC_TIMEOUT,
	FAULT_VMALLOC,
	FAULT_LOCK_TIMEOUT,
	FAULT_SKIP_WRITE,
	FAULT_MAX,
};

/* indicate which option to update */
enum fault_option {
	FAULT_RATE	= 1,	/* only update fault rate */
	FAULT_TYPE	= 2,	/* only update fault type */
	FAULT_TIMEOUT	= 4,	/* only update fault timeout type */
	FAULT_ALL	= 8,	/* reset all fault injection options/stats */
};

#ifdef CONFIG_F2FS_FAULT_INJECTION
struct f2fs_fault_info {
	atomic_t inject_ops;
	int inject_rate;
	unsigned int inject_type;
	/* Used to account total count of injection for each type */
	unsigned int inject_count[FAULT_MAX];
	unsigned int inject_lock_timeout;	/* inject lock timeout */
};

extern const char *f2fs_fault_name[FAULT_MAX];
#define IS_FAULT_SET(fi, type) ((fi)->inject_type & BIT(type))

/* maximum retry count for injected failure */
#define DEFAULT_FAILURE_RETRY_COUNT		8
#else
#define DEFAULT_FAILURE_RETRY_COUNT		1
#endif

/*
 * For mount options
 */
enum f2fs_mount_opt {
	F2FS_MOUNT_DISABLE_ROLL_FORWARD,
	F2FS_MOUNT_DISCARD,
	F2FS_MOUNT_NOHEAP,
	F2FS_MOUNT_XATTR_USER,
	F2FS_MOUNT_POSIX_ACL,
	F2FS_MOUNT_DISABLE_EXT_IDENTIFY,
	F2FS_MOUNT_INLINE_XATTR,
	F2FS_MOUNT_INLINE_DATA,
	F2FS_MOUNT_INLINE_DENTRY,
	F2FS_MOUNT_FLUSH_MERGE,
	F2FS_MOUNT_NOBARRIER,
	F2FS_MOUNT_FASTBOOT,
	F2FS_MOUNT_READ_EXTENT_CACHE,
	F2FS_MOUNT_DATA_FLUSH,
	F2FS_MOUNT_FAULT_INJECTION,
	F2FS_MOUNT_USRQUOTA,
	F2FS_MOUNT_GRPQUOTA,
	F2FS_MOUNT_PRJQUOTA,
	F2FS_MOUNT_QUOTA,
	F2FS_MOUNT_INLINE_XATTR_SIZE,
	F2FS_MOUNT_RESERVE_ROOT,
	F2FS_MOUNT_DISABLE_CHECKPOINT,
	F2FS_MOUNT_NORECOVERY,
	F2FS_MOUNT_ATGC,
	F2FS_MOUNT_MERGE_CHECKPOINT,
	F2FS_MOUNT_GC_MERGE,
	F2FS_MOUNT_COMPRESS_CACHE,
	F2FS_MOUNT_AGE_EXTENT_CACHE,
	F2FS_MOUNT_NAT_BITS,
	F2FS_MOUNT_INLINECRYPT,
	/*
	 * Some f2fs environments expect to be able to pass the "lazytime" option
	 * string rather than using the MS_LAZYTIME flag, so this must remain.
	 */
	F2FS_MOUNT_LAZYTIME,
	F2FS_MOUNT_RESERVE_NODE,
};

#define F2FS_OPTION(sbi)	((sbi)->mount_opt)
#define clear_opt(sbi, option)		\
	(F2FS_OPTION(sbi).opt &= ~BIT(F2FS_MOUNT_##option))
#define set_opt(sbi, option)		\
	(F2FS_OPTION(sbi).opt |= BIT(F2FS_MOUNT_##option))
#define test_opt(sbi, option)		\
	(F2FS_OPTION(sbi).opt & BIT(F2FS_MOUNT_##option))

#define ver_after(a, b)	(typecheck(unsigned long long, a) &&		\
		typecheck(unsigned long long, b) &&			\
		((long long)((a) - (b)) > 0))

typedef u32 block_t;	/*
			 * should not change u32, since it is the on-disk block
			 * address format, __le32.
			 */
typedef u32 nid_t;

#define COMPRESS_EXT_NUM		16

enum blkzone_allocation_policy {
	BLKZONE_ALLOC_PRIOR_SEQ,	/* Prioritize writing to sequential zones */
	BLKZONE_ALLOC_ONLY_SEQ,		/* Only allow writing to sequential zones */
	BLKZONE_ALLOC_PRIOR_CONV,	/* Prioritize writing to conventional zones */
};

enum bggc_io_aware_policy {
	AWARE_ALL_IO,		/* skip background GC if there is any kind of pending IO */
	AWARE_READ_IO,		/* skip background GC if there is pending read IO */
	AWARE_NONE,			/* don't aware IO for background GC */
};

enum device_allocation_policy {
	ALLOCATE_FORWARD_NOHINT,
	ALLOCATE_FORWARD_WITHIN_HINT,
	ALLOCATE_FORWARD_FROM_HINT,
};

enum f2fs_lock_name {
	LOCK_NAME_NONE,
	LOCK_NAME_CP_RWSEM,
	LOCK_NAME_NODE_CHANGE,
	LOCK_NAME_NODE_WRITE,
	LOCK_NAME_GC_LOCK,
	LOCK_NAME_CP_GLOBAL,
	LOCK_NAME_IO_RWSEM,
	LOCK_NAME_MAX,
};

enum f2fs_timeout_type {
	TIMEOUT_TYPE_NONE,
	TIMEOUT_TYPE_RUNNING,
	TIMEOUT_TYPE_IO_SLEEP,
	TIMEOUT_TYPE_NONIO_SLEEP,
	TIMEOUT_TYPE_RUNNABLE,
	TIMEOUT_TYPE_MAX,
};

/*
 * An implementation of an rwsem that is explicitly unfair to readers. This
 * prevents priority inversion when a low-priority reader acquires the read lock
 * while sleeping on the write lock but the write lock is needed by
 * higher-priority clients.
 */

struct f2fs_rwsem {
	struct f2fs_sb_info *sbi;
	enum f2fs_lock_name name;
        struct rw_semaphore internal_rwsem;
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
        wait_queue_head_t read_waiters;
#endif
};

struct f2fs_mount_info {
	unsigned long long opt;
	block_t root_reserved_blocks;	/* root reserved blocks */
	block_t root_reserved_nodes;	/* root reserved nodes */
	kuid_t s_resuid;		/* reserved blocks for uid */
	kgid_t s_resgid;		/* reserved blocks for gid */
	int active_logs;		/* # of active logs */
	int inline_xattr_size;		/* inline xattr size */
#ifdef CONFIG_F2FS_FAULT_INJECTION
	struct f2fs_fault_info fault_info;	/* For fault injection */
#endif
#ifdef CONFIG_QUOTA
	/* Names of quota files with journalled quota */
	char *s_qf_names[MAXQUOTAS];
	int s_jquota_fmt;			/* Format of quota to use */
#endif
	/* For which write hints are passed down to block layer */
	int alloc_mode;			/* segment allocation policy */
	int fsync_mode;			/* fsync policy */
	int fs_mode;			/* fs mode: LFS or ADAPTIVE */
	int bggc_mode;			/* bggc mode: off, on or sync */
	int memory_mode;		/* memory mode */
	int errors;			/* errors parameter */
	int discard_unit;		/*
					 * discard command's offset/size should
					 * be aligned to this unit: block,
					 * segment or section
					 */
	struct fscrypt_dummy_policy dummy_enc_policy; /* test dummy encryption */
	block_t unusable_cap_perc;	/* percentage for cap */
	block_t unusable_cap;		/* Amount of space allowed to be
					 * unusable when disabling checkpoint
					 */

	/* For compression */
	unsigned char compress_algorithm;	/* algorithm type */
	unsigned char compress_log_size;	/* cluster log size */
	unsigned char compress_level;		/* compress level */
	bool compress_chksum;			/* compressed data chksum */
	unsigned char compress_ext_cnt;		/* extension count */
	unsigned char nocompress_ext_cnt;		/* nocompress extension count */
	int compress_mode;			/* compression mode */
	unsigned char extensions[COMPRESS_EXT_NUM][F2FS_EXTENSION_LEN];	/* extensions */
	unsigned char noextensions[COMPRESS_EXT_NUM][F2FS_EXTENSION_LEN]; /* extensions */
	unsigned int lookup_mode;
};

#define F2FS_FEATURE_ENCRYPT			0x00000001
#define F2FS_FEATURE_BLKZONED			0x00000002
#define F2FS_FEATURE_ATOMIC_WRITE		0x00000004
#define F2FS_FEATURE_EXTRA_ATTR			0x00000008
#define F2FS_FEATURE_PRJQUOTA			0x00000010
#define F2FS_FEATURE_INODE_CHKSUM		0x00000020
#define F2FS_FEATURE_FLEXIBLE_INLINE_XATTR	0x00000040
#define F2FS_FEATURE_QUOTA_INO			0x00000080
#define F2FS_FEATURE_INODE_CRTIME		0x00000100
#define F2FS_FEATURE_LOST_FOUND			0x00000200
#define F2FS_FEATURE_VERITY			0x00000400
#define F2FS_FEATURE_SB_CHKSUM			0x00000800
#define F2FS_FEATURE_CASEFOLD			0x00001000
#define F2FS_FEATURE_COMPRESSION		0x00002000
#define F2FS_FEATURE_RO				0x00004000
#define F2FS_FEATURE_DEVICE_ALIAS		0x00008000
#define F2FS_FEATURE_PACKED_SSA			0x00010000

#define __F2FS_HAS_FEATURE(raw_super, mask)				\
	((raw_super->feature & cpu_to_le32(mask)) != 0)
#define F2FS_HAS_FEATURE(sbi, mask)	__F2FS_HAS_FEATURE(sbi->raw_super, mask)

/*
 * Default values for user and/or group using reserved blocks
 */
#define	F2FS_DEF_RESUID		0
#define	F2FS_DEF_RESGID		0

/*
 * For checkpoint manager
 */
enum {
	NAT_BITMAP,
	SIT_BITMAP
};

#define	CP_UMOUNT	0x00000001
#define	CP_FASTBOOT	0x00000002
#define	CP_SYNC		0x00000004
#define	CP_RECOVERY	0x00000008
#define	CP_DISCARD	0x00000010
#define CP_TRIMMED	0x00000020
#define CP_PAUSE	0x00000040
#define CP_RESIZE 	0x00000080

#define DEF_MAX_DISCARD_REQUEST		8	/* issue 8 discards per round */
#define DEF_MIN_DISCARD_ISSUE_TIME	50	/* 50 ms, if exists */
#define DEF_MID_DISCARD_ISSUE_TIME	500	/* 500 ms, if device busy */
#define DEF_MAX_DISCARD_ISSUE_TIME	60000	/* 60 s, if no candidates */
#define DEF_DISCARD_URGENT_UTIL		80	/* do more discard over 80% */
#define DEF_CP_INTERVAL			60	/* 60 secs */
#define DEF_IDLE_INTERVAL		5	/* 5 secs */
#define DEF_DISABLE_INTERVAL		5	/* 5 secs */
#define DEF_DISABLE_QUICK_INTERVAL	1	/* 1 secs */
#define DEF_UMOUNT_DISCARD_TIMEOUT	5	/* 5 secs */

enum cp_time {
	CP_TIME_START,		/* begin */
	CP_TIME_LOCK,		/* after cp_global_sem */
	CP_TIME_OP_LOCK,	/* after block_operation */
	CP_TIME_MERGE_WRITE,	/* after flush DATA/NODE/META */
	CP_TIME_FLUSH_NAT,	/* after flush nat */
	CP_TIME_FLUSH_SIT,	/* after flush sit */
	CP_TIME_SYNC_META,	/* after sync_meta_pages */
	CP_TIME_SYNC_CP_META,	/* after sync cp meta pages */
	CP_TIME_WAIT_DIRTY_META,/* after wait on dirty meta */
	CP_TIME_WAIT_CP_DATA,	/* after wait on cp data */
	CP_TIME_FLUSH_DEVICE,	/* after flush device cache */
	CP_TIME_WAIT_LAST_CP,	/* after wait on last cp pack */
	CP_TIME_END,		/* after unblock_operation */
	CP_TIME_MAX,
};

/* time cost stats of checkpoint */
struct cp_stats {
	ktime_t times[CP_TIME_MAX];
};

struct cp_control {
	int reason;
	__u64 trim_start;
	__u64 trim_end;
	__u64 trim_minlen;
	struct cp_stats stats;
};

enum f2fs_cp_phase {
	CP_PHASE_START_BLOCK_OPS,
	CP_PHASE_FINISH_BLOCK_OPS,
	CP_PHASE_FINISH_CHECKPOINT,
};

/*
 * indicate meta/data type
 */
enum {
	META_CP,
	META_NAT,
	META_SIT,
	META_SSA,
	META_MAX,
	META_POR,
	DATA_GENERIC,		/* check range only */
	DATA_GENERIC_ENHANCE,	/* strong check on range and segment bitmap */
	DATA_GENERIC_ENHANCE_READ,	/*
					 * strong check on range and segment
					 * bitmap but no warning due to race
					 * condition of read on truncated area
					 * by extent_cache
					 */
	DATA_GENERIC_ENHANCE_UPDATE,	/*
					 * strong check on range and segment
					 * bitmap for update case
					 */
	META_GENERIC,
};

/* for the list of ino */
enum {
	ORPHAN_INO,		/* for orphan ino list */
	APPEND_INO,		/* for append ino list */
	UPDATE_INO,		/* for update ino list */
	TRANS_DIR_INO,		/* for transactions dir ino list */
	XATTR_DIR_INO,		/* for xattr updated dir ino list */
	FLUSH_INO,		/* for multiple device flushing */
	MAX_INO_ENTRY,		/* max. list */
};

struct ino_entry {
	struct list_head list;		/* list head */
	nid_t ino;			/* inode number */
	unsigned int dirty_device;	/* dirty device bitmap */
};

/* for the list of inodes to be GCed */
struct inode_entry {
	struct list_head list;	/* list head */
	struct inode *inode;	/* vfs inode pointer */
};

struct fsync_node_entry {
	struct list_head list;	/* list head */
	struct folio *folio;	/* warm node folio pointer */
	unsigned int seq_id;	/* sequence id */
};

struct ckpt_req {
	struct completion wait;		/* completion for checkpoint done */
	struct llist_node llnode;	/* llist_node to be linked in wait queue */
	int ret;			/* return code of checkpoint */
	union {
		ktime_t queue_time;	/* request queued time */
		ktime_t delta_time;	/* time in queue */
	};
};

struct ckpt_req_control {
	struct task_struct *f2fs_issue_ckpt;	/* checkpoint task */
	int ckpt_thread_ioprio;			/* checkpoint merge thread ioprio */
	wait_queue_head_t ckpt_wait_queue;	/* waiting queue for wake-up */
	atomic_t issued_ckpt;		/* # of actually issued ckpts */
	atomic_t total_ckpt;		/* # of total ckpts */
	atomic_t queued_ckpt;		/* # of queued ckpts */
	struct llist_head issue_list;	/* list for command issue */
	spinlock_t stat_lock;		/* lock for below checkpoint time stats */
	unsigned int cur_time;		/* cur wait time in msec for currently issued checkpoint */
	unsigned int peak_time;		/* peak wait time in msec until now */
};

/* a time threshold that checkpoint was blocked for, unit: ms */
#define CP_LONG_LATENCY_THRESHOLD	5000

/* for the bitmap indicate blocks to be discarded */
struct discard_entry {
	struct list_head list;	/* list head */
	block_t start_blkaddr;	/* start blockaddr of current segment */
	unsigned char discard_map[SIT_VBLOCK_MAP_SIZE];	/* segment discard bitmap */
};

/* minimum discard granularity, unit: block count */
#define MIN_DISCARD_GRANULARITY		1
/* default discard granularity of inner discard thread, unit: block count */
#define DEFAULT_DISCARD_GRANULARITY		16
/* default maximum discard granularity of ordered discard, unit: block count */
#define DEFAULT_MAX_ORDERED_DISCARD_GRANULARITY	16
/* default interval of periodical discard submission */
#define DEFAULT_DISCARD_INTERVAL	(msecs_to_jiffies(20))

/* max discard pend list number */
#define MAX_PLIST_NUM		512
#define plist_idx(blk_num)	((blk_num) >= MAX_PLIST_NUM ?		\
					(MAX_PLIST_NUM - 1) : ((blk_num) - 1))

enum {
	D_PREP,			/* initial */
	D_PARTIAL,		/* partially submitted */
	D_SUBMIT,		/* all submitted */
	D_DONE,			/* finished */
};

struct discard_info {
	block_t lstart;			/* logical start address */
	block_t len;			/* length */
	block_t start;			/* actual start address in dev */
};

struct discard_cmd {
	struct rb_node rb_node;		/* rb node located in rb-tree */
	struct discard_info di;		/* discard info */
	struct list_head list;		/* command list */
	struct completion wait;		/* completion */
	struct block_device *bdev;	/* bdev */
	unsigned short ref;		/* reference count */
	unsigned char state;		/* state */
	unsigned char queued;		/* queued discard */
	int error;			/* bio error */
	spinlock_t lock;		/* for state/bio_ref updating */
	unsigned short bio_ref;		/* bio reference count */
};

enum {
	DPOLICY_BG,
	DPOLICY_FORCE,
	DPOLICY_FSTRIM,
	DPOLICY_UMOUNT,
	MAX_DPOLICY,
};

enum {
	DPOLICY_IO_AWARE_DISABLE,	/* force to not be aware of IO */
	DPOLICY_IO_AWARE_ENABLE,	/* force to be aware of IO */
	DPOLICY_IO_AWARE_MAX,
};

struct discard_policy {
	int type;			/* type of discard */
	unsigned int min_interval;	/* used for candidates exist */
	unsigned int mid_interval;	/* used for device busy */
	unsigned int max_interval;	/* used for candidates not exist */
	unsigned int max_requests;	/* # of discards issued per round */
	unsigned int io_aware_gran;	/* minimum granularity discard not be aware of I/O */
	bool io_aware;			/* issue discard in idle time */
	bool sync;			/* submit discard with REQ_SYNC flag */
	bool ordered;			/* issue discard by lba order */
	bool timeout;			/* discard timeout for put_super */
	unsigned int granularity;	/* discard granularity */
};

struct discard_cmd_control {
	struct task_struct *f2fs_issue_discard;	/* discard thread */
	struct list_head entry_list;		/* 4KB discard entry list */
	struct list_head pend_list[MAX_PLIST_NUM];/* store pending entries */
	struct list_head wait_list;		/* store on-flushing entries */
	struct list_head fstrim_list;		/* in-flight discard from fstrim */
	wait_queue_head_t discard_wait_queue;	/* waiting queue for wake-up */
	struct mutex cmd_lock;
	unsigned int nr_discards;		/* # of discards in the list */
	unsigned int max_discards;		/* max. discards to be issued */
	unsigned int max_discard_request;	/* max. discard request per round */
	unsigned int min_discard_issue_time;	/* min. interval between discard issue */
	unsigned int mid_discard_issue_time;	/* mid. interval between discard issue */
	unsigned int max_discard_issue_time;	/* max. interval between discard issue */
	unsigned int discard_io_aware_gran; /* minimum discard granularity not be aware of I/O */
	unsigned int discard_urgent_util;	/* utilization which issue discard proactively */
	unsigned int discard_granularity;	/* discard granularity */
	unsigned int max_ordered_discard;	/* maximum discard granularity issued by lba order */
	unsigned int discard_io_aware;		/* io_aware policy */
	unsigned int undiscard_blks;		/* # of undiscard blocks */
	unsigned int next_pos;			/* next discard position */
	atomic_t issued_discard;		/* # of issued discard */
	atomic_t queued_discard;		/* # of queued discard */
	atomic_t discard_cmd_cnt;		/* # of cached cmd count */
	struct rb_root_cached root;		/* root of discard rb-tree */
	bool rbtree_check;			/* config for consistence check */
	bool discard_wake;			/* to wake up discard thread */
};

/* for the list of fsync inodes, used only during recovery */
struct fsync_inode_entry {
	struct list_head list;	/* list head */
	struct inode *inode;	/* vfs inode pointer */
	block_t blkaddr;	/* block address locating the last fsync */
	block_t last_dentry;	/* block address locating the last dentry */
};

#define nats_in_cursum(jnl)		(le16_to_cpu((jnl)->n_nats))
#define sits_in_cursum(jnl)		(le16_to_cpu((jnl)->n_sits))

#define nat_in_journal(jnl, i) \
	(((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].ne)
#define nid_in_journal(jnl, i) \
	(((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].nid)
#define sit_in_journal(jnl, i) \
	(((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].se)
#define segno_in_journal(jnl, i) \
	(((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].segno)

#define sum_entries(sum)	((struct f2fs_summary *)(sum))
#define sum_journal(sbi, sum) \
	((struct f2fs_journal *)((char *)(sum) + \
	((sbi)->entries_in_sum * sizeof(struct f2fs_summary))))
#define sum_footer(sbi, sum) \
	((struct summary_footer *)((char *)(sum) + (sbi)->sum_blocksize - \
	sizeof(struct summary_footer)))

#define MAX_NAT_JENTRIES(sbi, jnl)	((sbi)->nat_journal_entries - nats_in_cursum(jnl))
#define MAX_SIT_JENTRIES(sbi, jnl)	((sbi)->sit_journal_entries - sits_in_cursum(jnl))

static inline int update_nats_in_cursum(struct f2fs_journal *journal, int i)
{
	int before = nats_in_cursum(journal);

	journal->n_nats = cpu_to_le16(before + i);
	return before;
}

static inline int update_sits_in_cursum(struct f2fs_journal *journal, int i)
{
	int before = sits_in_cursum(journal);

	journal->n_sits = cpu_to_le16(before + i);
	return before;
}

/* for inline stuff */
#define DEF_INLINE_RESERVED_SIZE	1
static inline int get_extra_isize(struct inode *inode);
static inline int get_inline_xattr_addrs(struct inode *inode);
#define MAX_INLINE_DATA(inode)	(sizeof(__le32) *			\
				(CUR_ADDRS_PER_INODE(inode) -		\
				get_inline_xattr_addrs(inode) -	\
				DEF_INLINE_RESERVED_SIZE))

/* for inline dir */
#define NR_INLINE_DENTRY(inode)	(MAX_INLINE_DATA(inode) * BITS_PER_BYTE / \
				((SIZE_OF_DIR_ENTRY + F2FS_SLOT_LEN) * \
				BITS_PER_BYTE + 1))
#define INLINE_DENTRY_BITMAP_SIZE(inode) \
	DIV_ROUND_UP(NR_INLINE_DENTRY(inode), BITS_PER_BYTE)
#define INLINE_RESERVED_SIZE(inode)	(MAX_INLINE_DATA(inode) - \
				((SIZE_OF_DIR_ENTRY + F2FS_SLOT_LEN) * \
				NR_INLINE_DENTRY(inode) + \
				INLINE_DENTRY_BITMAP_SIZE(inode)))

/*
 * For INODE and NODE manager
 */
/* for directory operations */

struct f2fs_filename {
	/*
	 * The filename the user specified.  This is NULL for some
	 * filesystem-internal operations, e.g. converting an inline directory
	 * to a non-inline one, or roll-forward recovering an encrypted dentry.
	 */
	const struct qstr *usr_fname;

	/*
	 * The on-disk filename.  For encrypted directories, this is encrypted.
	 * This may be NULL for lookups in an encrypted dir without the key.
	 */
	struct fscrypt_str disk_name;

	/* The dirhash of this filename */
	f2fs_hash_t hash;

#ifdef CONFIG_FS_ENCRYPTION
	/*
	 * For lookups in encrypted directories: either the buffer backing
	 * disk_name, or a buffer that holds the decoded no-key name.
	 */
	struct fscrypt_str crypto_buf;
#endif
#if IS_ENABLED(CONFIG_UNICODE)
	/*
	 * For casefolded directories: the casefolded name, but it's left NULL
	 * if the original name is not valid Unicode, if the original name is
	 * "." or "..", if the directory is both casefolded and encrypted and
	 * its encryption key is unavailable, or if the filesystem is doing an
	 * internal operation where usr_fname is also NULL.  In all these cases
	 * we fall back to treating the name as an opaque byte sequence.
	 */
	struct qstr cf_name;
#endif
};

struct f2fs_dentry_ptr {
	struct inode *inode;
	void *bitmap;
	struct f2fs_dir_entry *dentry;
	__u8 (*filename)[F2FS_SLOT_LEN];
	int max;
	int nr_bitmap;
};

static inline void make_dentry_ptr_block(struct inode *inode,
		struct f2fs_dentry_ptr *d, struct f2fs_dentry_block *t)
{
	d->inode = inode;
	d->max = NR_DENTRY_IN_BLOCK;
	d->nr_bitmap = SIZE_OF_DENTRY_BITMAP;
	d->bitmap = t->dentry_bitmap;
	d->dentry = t->dentry;
	d->filename = t->filename;
}

static inline void make_dentry_ptr_inline(struct inode *inode,
					struct f2fs_dentry_ptr *d, void *t)
{
	int entry_cnt = NR_INLINE_DENTRY(inode);
	int bitmap_size = INLINE_DENTRY_BITMAP_SIZE(inode);
	int reserved_size = INLINE_RESERVED_SIZE(inode);

	d->inode = inode;
	d->max = entry_cnt;
	d->nr_bitmap = bitmap_size;
	d->bitmap = t;
	d->dentry = t + bitmap_size + reserved_size;
	d->filename = t + bitmap_size + reserved_size +
					SIZE_OF_DIR_ENTRY * entry_cnt;
}

/*
 * XATTR_NODE_OFFSET stores xattrs to one node block per file keeping -1
 * as its node offset to distinguish from index node blocks.
 * But some bits are used to mark the node block.
 */
#define XATTR_NODE_OFFSET	((((unsigned int)-1) << OFFSET_BIT_SHIFT) \
				>> OFFSET_BIT_SHIFT)
enum {
	ALLOC_NODE,			/* allocate a new node page if needed */
	LOOKUP_NODE,			/* look up a node without readahead */
	LOOKUP_NODE_RA,			/*
					 * look up a node with readahead called
					 * by get_data_block.
					 */
};

#define DEFAULT_RETRY_IO_COUNT	8	/* maximum retry read IO or flush count */

#define MAX_FLUSH_RETRY_COUNT	3	/* maximum flush retry count in f2fs_enable_checkpoint() */

/* IO/non-IO congestion wait timeout value, default: 1 jiffies */
#define	DEFAULT_SCHEDULE_TIMEOUT	1

/* timeout value injected, default: 1000ms */
#define DEFAULT_FAULT_TIMEOUT	(msecs_to_jiffies(1000))

/* maximum retry quota flush count */
#define DEFAULT_RETRY_QUOTA_FLUSH_COUNT		8

/* maximum retry of EIO'ed page */
#define MAX_RETRY_PAGE_EIO			100

#define F2FS_LINK_MAX	0xffffffff	/* maximum link count per file */

#define MAX_DIR_RA_PAGES	4	/* maximum ra pages of dir */

/* dirty segments threshold for triggering CP */
#define DEFAULT_DIRTY_THRESHOLD		4

#define RECOVERY_MAX_RA_BLOCKS		BIO_MAX_VECS
#define RECOVERY_MIN_RA_BLOCKS		1

#define F2FS_ONSTACK_PAGES	16	/* nr of onstack pages */

/* for in-memory extent cache entry */
#define F2FS_MIN_EXTENT_LEN	64	/* minimum extent length */

/* number of extent info in extent cache we try to shrink */
#define READ_EXTENT_CACHE_SHRINK_NUMBER	128

/* number of age extent info in extent cache we try to shrink */
#define AGE_EXTENT_CACHE_SHRINK_NUMBER	128
#define LAST_AGE_WEIGHT			30
#define SAME_AGE_REGION			1024

/*
 * Define data block with age less than 1GB as hot data
 * define data block with age less than 10GB but more than 1GB as warm data
 */
#define DEF_HOT_DATA_AGE_THRESHOLD	262144
#define DEF_WARM_DATA_AGE_THRESHOLD	2621440

/* default max read extent count per inode */
#define DEF_MAX_READ_EXTENT_COUNT	10240

/* extent cache type */
enum extent_type {
	EX_READ,
	EX_BLOCK_AGE,
	NR_EXTENT_CACHES,
};

/*
 * Reserved value to mark invalid age extents, hence valid block range
 * from 0 to ULLONG_MAX-1
 */
#define F2FS_EXTENT_AGE_INVALID	ULLONG_MAX

struct extent_info {
	unsigned int fofs;		/* start offset in a file */
	unsigned int len;		/* length of the extent */
	union {
		/* read extent_cache */
		struct {
			/* start block address of the extent */
			block_t blk;
#ifdef CONFIG_F2FS_FS_COMPRESSION
			/* physical extent length of compressed blocks */
			unsigned int c_len;
#endif
		};
		/* block age extent_cache */
		struct {
			/* block age of the extent */
			unsigned long long age;
			/* last total blocks allocated */
			unsigned long long last_blocks;
		};
	};
};

struct extent_node {
	struct rb_node rb_node;		/* rb node located in rb-tree */
	struct extent_info ei;		/* extent info */
	struct list_head list;		/* node in global extent list of sbi */
	struct extent_tree *et;		/* extent tree pointer */
};

struct extent_tree {
	nid_t ino;			/* inode number */
	enum extent_type type;		/* keep the extent tree type */
	struct rb_root_cached root;	/* root of extent info rb-tree */
	struct extent_node *cached_en;	/* recently accessed extent node */
	struct list_head list;		/* to be used by sbi->zombie_list */
	rwlock_t lock;			/* protect extent info rb-tree */
	atomic_t node_cnt;		/* # of extent node in rb-tree*/
	bool largest_updated;		/* largest extent updated */
	struct extent_info largest;	/* largest cached extent for EX_READ */
};

struct extent_tree_info {
	struct radix_tree_root extent_tree_root;/* cache extent cache entries */
	struct mutex extent_tree_lock;	/* locking extent radix tree */
	struct list_head extent_list;		/* lru list for shrinker */
	spinlock_t extent_lock;			/* locking extent lru list */
	atomic_t total_ext_tree;		/* extent tree count */
	struct list_head zombie_list;		/* extent zombie tree list */
	atomic_t total_zombie_tree;		/* extent zombie tree count */
	atomic_t total_ext_node;		/* extent info count */
};

/*
 * State of block returned by f2fs_map_blocks.
 */
#define F2FS_MAP_NEW		(1U << 0)
#define F2FS_MAP_MAPPED		(1U << 1)
#define F2FS_MAP_DELALLOC	(1U << 2)
#define F2FS_MAP_FLAGS		(F2FS_MAP_NEW | F2FS_MAP_MAPPED |\
				F2FS_MAP_DELALLOC)

struct f2fs_map_blocks {
	struct block_device *m_bdev;	/* for multi-device dio */
	block_t m_pblk;
	block_t m_lblk;
	unsigned int m_len;
	unsigned int m_flags;
	unsigned long m_last_pblk;	/* last allocated block, only used for DIO in LFS mode */
	pgoff_t *m_next_pgofs;		/* point next possible non-hole pgofs */
	pgoff_t *m_next_extent;		/* point to next possible extent */
	int m_seg_type;
	bool m_may_create;		/* indicate it is from write path */
	bool m_multidev_dio;		/* indicate it allows multi-device dio */
};

/* for flag in get_data_block */
enum {
	F2FS_GET_BLOCK_DEFAULT,
	F2FS_GET_BLOCK_FIEMAP,
	F2FS_GET_BLOCK_BMAP,
	F2FS_GET_BLOCK_DIO,
	F2FS_GET_BLOCK_PRE_DIO,
	F2FS_GET_BLOCK_PRE_AIO,
	F2FS_GET_BLOCK_PRECACHE,
};

/*
 * i_advise uses FADVISE_XXX_BIT. We can add additional hints later.
 */
#define FADVISE_COLD_BIT	0x01
#define FADVISE_LOST_PINO_BIT	0x02
#define FADVISE_ENCRYPT_BIT	0x04
#define FADVISE_ENC_NAME_BIT	0x08
#define FADVISE_KEEP_SIZE_BIT	0x10
#define FADVISE_HOT_BIT		0x20
#define FADVISE_VERITY_BIT	0x40
#define FADVISE_TRUNC_BIT	0x80

#define FADVISE_MODIFIABLE_BITS	(FADVISE_COLD_BIT | FADVISE_HOT_BIT)

#define file_is_cold(inode)	is_file(inode, FADVISE_COLD_BIT)
#define file_set_cold(inode)	set_file(inode, FADVISE_COLD_BIT)
#define file_clear_cold(inode)	clear_file(inode, FADVISE_COLD_BIT)

#define file_wrong_pino(inode)	is_file(inode, FADVISE_LOST_PINO_BIT)
#define file_lost_pino(inode)	set_file(inode, FADVISE_LOST_PINO_BIT)
#define file_got_pino(inode)	clear_file(inode, FADVISE_LOST_PINO_BIT)

#define file_is_encrypt(inode)	is_file(inode, FADVISE_ENCRYPT_BIT)
#define file_set_encrypt(inode)	set_file(inode, FADVISE_ENCRYPT_BIT)

#define file_enc_name(inode)	is_file(inode, FADVISE_ENC_NAME_BIT)
#define file_set_enc_name(inode) set_file(inode, FADVISE_ENC_NAME_BIT)

#define file_keep_isize(inode)	is_file(inode, FADVISE_KEEP_SIZE_BIT)
#define file_set_keep_isize(inode) set_file(inode, FADVISE_KEEP_SIZE_BIT)

#define file_is_hot(inode)	is_file(inode, FADVISE_HOT_BIT)
#define file_set_hot(inode)	set_file(inode, FADVISE_HOT_BIT)
#define file_clear_hot(inode)	clear_file(inode, FADVISE_HOT_BIT)

#define file_is_verity(inode)	is_file(inode, FADVISE_VERITY_BIT)
#define file_set_verity(inode)	set_file(inode, FADVISE_VERITY_BIT)

#define file_should_truncate(inode)	is_file(inode, FADVISE_TRUNC_BIT)
#define file_need_truncate(inode)	set_file(inode, FADVISE_TRUNC_BIT)
#define file_dont_truncate(inode)	clear_file(inode, FADVISE_TRUNC_BIT)

#define DEF_DIR_LEVEL		0

/* used for f2fs_inode_info->flags */
enum {
	FI_NEW_INODE,		/* indicate newly allocated inode */
	FI_DIRTY_INODE,		/* indicate inode is dirty or not */
	FI_AUTO_RECOVER,	/* indicate inode is recoverable */
	FI_DIRTY_DIR,		/* indicate directory has dirty pages */
	FI_INC_LINK,		/* need to increment i_nlink */
	FI_ACL_MODE,		/* indicate acl mode */
	FI_NO_ALLOC,		/* should not allocate any blocks */
	FI_FREE_NID,		/* free allocated nide */
	FI_NO_EXTENT,		/* not to use the extent cache */
	FI_INLINE_XATTR,	/* used for inline xattr */
	FI_INLINE_DATA,		/* used for inline data*/
	FI_INLINE_DENTRY,	/* used for inline dentry */
	FI_APPEND_WRITE,	/* inode has appended data */
	FI_UPDATE_WRITE,	/* inode has in-place-update data */
	FI_NEED_IPU,		/* used for ipu per file */
	FI_ATOMIC_FILE,		/* indicate atomic file */
	FI_DATA_EXIST,		/* indicate data exists */
	FI_SKIP_WRITES,		/* should skip data page writeback */
	FI_OPU_WRITE,		/* used for opu per file */
	FI_DIRTY_FILE,		/* indicate regular/symlink has dirty pages */
	FI_PREALLOCATED_ALL,	/* all blocks for write were preallocated */
	FI_HOT_DATA,		/* indicate file is hot */
	FI_EXTRA_ATTR,		/* indicate file has extra attribute */
	FI_PROJ_INHERIT,	/* indicate file inherits projectid */
	FI_PIN_FILE,		/* indicate file should not be gced */
	FI_VERITY_IN_PROGRESS,	/* building fs-verity Merkle tree */
	FI_COMPRESSED_FILE,	/* indicate file's data can be compressed */
	FI_COMPRESS_CORRUPT,	/* indicate compressed cluster is corrupted */
	FI_MMAP_FILE,		/* indicate file was mmapped */
	FI_ENABLE_COMPRESS,	/* enable compression in "user" compression mode */
	FI_COMPRESS_RELEASED,	/* compressed blocks were released */
	FI_ALIGNED_WRITE,	/* enable aligned write */
	FI_COW_FILE,		/* indicate COW file */
	FI_ATOMIC_COMMITTED,	/* indicate atomic commit completed except disk sync */
	FI_ATOMIC_DIRTIED,	/* indicate atomic file is dirtied */
	FI_ATOMIC_REPLACE,	/* indicate atomic replace */
	FI_OPENED_FILE,		/* indicate file has been opened */
	FI_DONATE_FINISHED,	/* indicate page donation of file has been finished */
	FI_MAX,			/* max flag, never be used */
};

struct f2fs_inode_info {
	struct inode vfs_inode;		/* serve a vfs inode */
	unsigned long i_flags;		/* keep an inode flags for ioctl */
	unsigned char i_advise;		/* use to give file attribute hints */
	unsigned char i_dir_level;	/* use for dentry level for large dir */
	union {
		unsigned int i_current_depth;	/* only for directory depth */
		unsigned short i_gc_failures;	/* for gc failure statistic */
	};
	unsigned int i_pino;		/* parent inode number */
	umode_t i_acl_mode;		/* keep file acl mode temporarily */

	/* Use below internally in f2fs*/
	unsigned long flags[BITS_TO_LONGS(FI_MAX)];	/* use to pass per-file flags */
	unsigned int ioprio_hint;	/* hint for IO priority */
	struct f2fs_rwsem i_sem;	/* protect fi info */
	atomic_t dirty_pages;		/* # of dirty pages */
	f2fs_hash_t chash;		/* hash value of given file name */
	unsigned int clevel;		/* maximum level of given file name */
	struct task_struct *task;	/* lookup and create consistency */
	struct task_struct *cp_task;	/* separate cp/wb IO stats*/
	struct task_struct *wb_task;	/* indicate inode is in context of writeback */
	nid_t i_xattr_nid;		/* node id that contains xattrs */
	loff_t	last_disk_size;		/* lastly written file size */
	spinlock_t i_size_lock;		/* protect last_disk_size */

#ifdef CONFIG_QUOTA
	struct dquot __rcu *i_dquot[MAXQUOTAS];

	/* quota space reservation, managed internally by quota code */
	qsize_t i_reserved_quota;
#endif
	struct list_head dirty_list;	/* dirty list for dirs and files */
	struct list_head gdirty_list;	/* linked in global dirty list */

	/* linked in global inode list for cache donation */
	struct list_head gdonate_list;
	pgoff_t donate_start, donate_end; /* inclusive */
	atomic_t open_count;		/* # of open files */

	struct task_struct *atomic_write_task;	/* store atomic write task */
	struct extent_tree *extent_tree[NR_EXTENT_CACHES];
					/* cached extent_tree entry */
	union {
		struct inode *cow_inode;	/* copy-on-write inode for atomic write */
		struct inode *atomic_inode;
					/* point to atomic_inode, available only for cow_inode */
	};

	/* avoid racing between foreground op and gc */
	struct f2fs_rwsem i_gc_rwsem[2];
	struct f2fs_rwsem i_xattr_sem; /* avoid racing between reading and changing EAs */

	int i_extra_isize;		/* size of extra space located in i_addr */
	kprojid_t i_projid;		/* id for project quota */
	int i_inline_xattr_size;	/* inline xattr size */
	struct timespec64 i_crtime;	/* inode creation time */
	struct timespec64 i_disk_time[3];/* inode disk times */

	/* for file compress */
	atomic_t i_compr_blocks;		/* # of compressed blocks */
	unsigned char i_compress_algorithm;	/* algorithm type */
	unsigned char i_log_cluster_size;	/* log of cluster size */
	unsigned char i_compress_level;		/* compress level (lz4hc,zstd) */
	unsigned char i_compress_flag;		/* compress flag */
	unsigned int i_cluster_size;		/* cluster size */
	atomic_t writeback;			/* count # of writeback thread */

	unsigned int atomic_write_cnt;
	loff_t original_i_size;		/* original i_size before atomic write */
#ifdef CONFIG_FS_ENCRYPTION
	struct fscrypt_inode_info *i_crypt_info; /* filesystem encryption info */
#endif
};

static inline void get_read_extent_info(struct extent_info *ext,
					struct f2fs_extent *i_ext)
{
	ext->fofs = le32_to_cpu(i_ext->fofs);
	ext->blk = le32_to_cpu(i_ext->blk);
	ext->len = le32_to_cpu(i_ext->len);
}

static inline void set_raw_read_extent(struct extent_info *ext,
					struct f2fs_extent *i_ext)
{
	i_ext->fofs = cpu_to_le32(ext->fofs);
	i_ext->blk = cpu_to_le32(ext->blk);
	i_ext->len = cpu_to_le32(ext->len);
}

static inline bool __is_discard_mergeable(struct discard_info *back,
			struct discard_info *front, unsigned int max_len)
{
	return (back->lstart + back->len == front->lstart) &&
		(back->len + front->len <= max_len);
}

static inline bool __is_discard_back_mergeable(struct discard_info *cur,
			struct discard_info *back, unsigned int max_len)
{
	return __is_discard_mergeable(back, cur, max_len);
}

static inline bool __is_discard_front_mergeable(struct discard_info *cur,
			struct discard_info *front, unsigned int max_len)
{
	return __is_discard_mergeable(cur, front, max_len);
}

/*
 * For free nid management
 */
enum nid_state {
	FREE_NID,		/* newly added to free nid list */
	PREALLOC_NID,		/* it is preallocated */
	MAX_NID_STATE,
};

enum nat_state {
	TOTAL_NAT,
	DIRTY_NAT,
	RECLAIMABLE_NAT,
	MAX_NAT_STATE,
};

struct f2fs_nm_info {
	block_t nat_blkaddr;		/* base disk address of NAT */
	nid_t max_nid;			/* maximum possible node ids */
	nid_t available_nids;		/* # of available node ids */
	nid_t next_scan_nid;		/* the next nid to be scanned */
	nid_t max_rf_node_blocks;	/* max # of nodes for recovery */
	unsigned int ram_thresh;	/* control the memory footprint */
	unsigned int ra_nid_pages;	/* # of nid pages to be readaheaded */
	unsigned int dirty_nats_ratio;	/* control dirty nats ratio threshold */

	/* NAT cache management */
	struct radix_tree_root nat_root;/* root of the nat entry cache */
	struct radix_tree_root nat_set_root;/* root of the nat set cache */
	struct f2fs_rwsem nat_tree_lock;	/* protect nat entry tree */
	struct list_head nat_entries;	/* cached nat entry list (clean) */
	spinlock_t nat_list_lock;	/* protect clean nat entry list */
	unsigned int nat_cnt[MAX_NAT_STATE]; /* the # of cached nat entries */
	unsigned int nat_blocks;	/* # of nat blocks */

	/* free node ids management */
	struct radix_tree_root free_nid_root;/* root of the free_nid cache */
	struct list_head free_nid_list;		/* list for free nids excluding preallocated nids */
	unsigned int nid_cnt[MAX_NID_STATE];	/* the number of free node id */
	spinlock_t nid_list_lock;	/* protect nid lists ops */
	struct mutex build_lock;	/* lock for build free nids */
	unsigned char **free_nid_bitmap;
	unsigned char *nat_block_bitmap;
	unsigned short *free_nid_count;	/* free nid count of NAT block */

	/* for checkpoint */
	char *nat_bitmap;		/* NAT bitmap pointer */

	unsigned int nat_bits_blocks;	/* # of nat bits blocks */
	unsigned char *nat_bits;	/* NAT bits blocks */
	unsigned char *full_nat_bits;	/* full NAT pages */
	unsigned char *empty_nat_bits;	/* empty NAT pages */
#ifdef CONFIG_F2FS_CHECK_FS
	char *nat_bitmap_mir;		/* NAT bitmap mirror */
#endif
	int bitmap_size;		/* bitmap size */
};

/*
 * this structure is used as one of function parameters.
 * all the information are dedicated to a given direct node block determined
 * by the data offset in a file.
 */
struct dnode_of_data {
	struct inode *inode;		/* vfs inode pointer */
	struct folio *inode_folio;	/* its inode folio, NULL is possible */
	struct folio *node_folio;	/* cached direct node folio */
	nid_t nid;			/* node id of the direct node block */
	unsigned int ofs_in_node;	/* data offset in the node page */
	bool inode_folio_locked;	/* inode folio is locked or not */
	bool node_changed;		/* is node block changed */
	char cur_level;			/* level of hole node page */
	char max_level;			/* level of current page located */
	block_t	data_blkaddr;		/* block address of the node block */
};

static inline void set_new_dnode(struct dnode_of_data *dn, struct inode *inode,
		struct folio *ifolio, struct folio *nfolio, nid_t nid)
{
	memset(dn, 0, sizeof(*dn));
	dn->inode = inode;
	dn->inode_folio = ifolio;
	dn->node_folio = nfolio;
	dn->nid = nid;
}

/*
 * For SIT manager
 *
 * By default, there are 6 active log areas across the whole main area.
 * When considering hot and cold data separation to reduce cleaning overhead,
 * we split 3 for data logs and 3 for node logs as hot, warm, and cold types,
 * respectively.
 * In the current design, you should not change the numbers intentionally.
 * Instead, as a mount option such as active_logs=x, you can use 2, 4, and 6
 * logs individually according to the underlying devices. (default: 6)
 * Just in case, on-disk layout covers maximum 16 logs that consist of 8 for
 * data and 8 for node logs.
 */
#define	NR_CURSEG_DATA_TYPE	(3)
#define NR_CURSEG_NODE_TYPE	(3)
#define NR_CURSEG_INMEM_TYPE	(2)
#define NR_CURSEG_RO_TYPE	(2)
#define NR_CURSEG_PERSIST_TYPE	(NR_CURSEG_DATA_TYPE + NR_CURSEG_NODE_TYPE)
#define NR_CURSEG_TYPE		(NR_CURSEG_INMEM_TYPE + NR_CURSEG_PERSIST_TYPE)

enum log_type {
	CURSEG_HOT_DATA	= 0,	/* directory entry blocks */
	CURSEG_WARM_DATA,	/* data blocks */
	CURSEG_COLD_DATA,	/* multimedia or GCed data blocks */
	CURSEG_HOT_NODE,	/* direct node blocks of directory files */
	CURSEG_WARM_NODE,	/* direct node blocks of normal files */
	CURSEG_COLD_NODE,	/* indirect node blocks */
	NR_PERSISTENT_LOG,	/* number of persistent log */
	CURSEG_COLD_DATA_PINNED = NR_PERSISTENT_LOG,
				/* pinned file that needs consecutive block address */
	CURSEG_ALL_DATA_ATGC,	/* SSR alloctor in hot/warm/cold data area */
	NO_CHECK_TYPE,		/* number of persistent & inmem log */
};

struct flush_cmd {
	struct completion wait;
	struct llist_node llnode;
	nid_t ino;
	int ret;
};

struct flush_cmd_control {
	struct task_struct *f2fs_issue_flush;	/* flush thread */
	wait_queue_head_t flush_wait_queue;	/* waiting queue for wake-up */
	atomic_t issued_flush;			/* # of issued flushes */
	atomic_t queued_flush;			/* # of queued flushes */
	struct llist_head issue_list;		/* list for command issue */
	struct llist_node *dispatch_list;	/* list for command dispatch */
};

struct f2fs_sm_info {
	struct sit_info *sit_info;		/* whole segment information */
	struct free_segmap_info *free_info;	/* free segment information */
	struct dirty_seglist_info *dirty_info;	/* dirty segment information */
	struct curseg_info *curseg_array;	/* active segment information */

	struct f2fs_rwsem curseg_lock;	/* for preventing curseg change */

	block_t seg0_blkaddr;		/* block address of 0'th segment */
	block_t main_blkaddr;		/* start block address of main area */
	block_t ssa_blkaddr;		/* start block address of SSA area */

	unsigned int segment_count;	/* total # of segments */
	unsigned int main_segments;	/* # of segments in main area */
	unsigned int reserved_segments;	/* # of reserved segments */
	unsigned int ovp_segments;	/* # of overprovision segments */

	/* a threshold to reclaim prefree segments */
	unsigned int rec_prefree_segments;

	struct list_head sit_entry_set;	/* sit entry set list */

	unsigned int ipu_policy;	/* in-place-update policy */
	unsigned int min_ipu_util;	/* in-place-update threshold */
	unsigned int min_fsync_blocks;	/* threshold for fsync */
	unsigned int min_seq_blocks;	/* threshold for sequential blocks */
	unsigned int min_hot_blocks;	/* threshold for hot block allocation */
	unsigned int min_ssr_sections;	/* threshold to trigger SSR allocation */

	/* for flush command control */
	struct flush_cmd_control *fcc_info;

	/* for discard command control */
	struct discard_cmd_control *dcc_info;
};

/*
 * For superblock
 */
/*
 * COUNT_TYPE for monitoring
 *
 * f2fs monitors the number of several block types such as on-writeback,
 * dirty dentry blocks, dirty node blocks, and dirty meta blocks.
 */
#define WB_DATA_TYPE(folio, f)			\
	(f || f2fs_is_cp_guaranteed(folio) ? F2FS_WB_CP_DATA : F2FS_WB_DATA)
enum count_type {
	F2FS_DIRTY_DENTS,
	F2FS_DIRTY_DATA,
	F2FS_DIRTY_QDATA,
	F2FS_DIRTY_NODES,
	F2FS_DIRTY_META,
	F2FS_DIRTY_IMETA,
	F2FS_WB_CP_DATA,
	F2FS_WB_DATA,
	F2FS_RD_DATA,
	F2FS_RD_NODE,
	F2FS_RD_META,
	F2FS_DIO_WRITE,
	F2FS_DIO_READ,
	F2FS_SKIPPED_WRITE,	/* skip or fail during f2fs_enable_checkpoint() */
	NR_COUNT_TYPE,
};

/*
 * The below are the page types of bios used in submit_bio().
 * The available types are:
 * DATA			User data pages. It operates as async mode.
 * NODE			Node pages. It operates as async mode.
 * META			FS metadata pages such as SIT, NAT, CP.
 * NR_PAGE_TYPE		The number of page types.
 * META_FLUSH		Make sure the previous pages are written
 *			with waiting the bio's completion
 * ...			Only can be used with META.
 */
#define PAGE_TYPE_OF_BIO(type)	((type) > META ? META : (type))
#define PAGE_TYPE_ON_MAIN(type)	((type) == DATA || (type) == NODE)
enum page_type {
	DATA = 0,
	NODE = 1,	/* should not change this */
	META,
	NR_PAGE_TYPE,
	META_FLUSH,
	IPU,		/* the below types are used by tracepoints only. */
	OPU,
};

enum temp_type {
	HOT = 0,	/* must be zero for meta bio */
	WARM,
	COLD,
	NR_TEMP_TYPE,
};

enum need_lock_type {
	LOCK_REQ = 0,
	LOCK_DONE,
	LOCK_RETRY,
};

enum cp_reason_type {
	CP_NO_NEEDED,
	CP_NON_REGULAR,
	CP_COMPRESSED,
	CP_HARDLINK,
	CP_SB_NEED_CP,
	CP_WRONG_PINO,
	CP_NO_SPC_ROLL,
	CP_NODE_NEED_CP,
	CP_FASTBOOT_MODE,
	CP_SPEC_LOG_NUM,
	CP_RECOVER_DIR,
	CP_XATTR_DIR,
};

enum iostat_type {
	/* WRITE IO */
	APP_DIRECT_IO,			/* app direct write IOs */
	APP_BUFFERED_IO,		/* app buffered write IOs */
	APP_WRITE_IO,			/* app write IOs */
	APP_MAPPED_IO,			/* app mapped IOs */
	APP_BUFFERED_CDATA_IO,		/* app buffered write IOs on compressed file */
	APP_MAPPED_CDATA_IO,		/* app mapped write IOs on compressed file */
	FS_DATA_IO,			/* data IOs from kworker/fsync/reclaimer */
	FS_CDATA_IO,			/* data IOs from kworker/fsync/reclaimer on compressed file */
	FS_NODE_IO,			/* node IOs from kworker/fsync/reclaimer */
	FS_META_IO,			/* meta IOs from kworker/reclaimer */
	FS_GC_DATA_IO,			/* data IOs from forground gc */
	FS_GC_NODE_IO,			/* node IOs from forground gc */
	FS_CP_DATA_IO,			/* data IOs from checkpoint */
	FS_CP_NODE_IO,			/* node IOs from checkpoint */
	FS_CP_META_IO,			/* meta IOs from checkpoint */

	/* READ IO */
	APP_DIRECT_READ_IO,		/* app direct read IOs */
	APP_BUFFERED_READ_IO,		/* app buffered read IOs */
	APP_READ_IO,			/* app read IOs */
	APP_MAPPED_READ_IO,		/* app mapped read IOs */
	APP_BUFFERED_CDATA_READ_IO,	/* app buffered read IOs on compressed file  */
	APP_MAPPED_CDATA_READ_IO,	/* app mapped read IOs on compressed file  */
	FS_DATA_READ_IO,		/* data read IOs */
	FS_GDATA_READ_IO,		/* data read IOs from background gc */
	FS_CDATA_READ_IO,		/* compressed data read IOs */
	FS_NODE_READ_IO,		/* node read IOs */
	FS_META_READ_IO,		/* meta read IOs */

	/* other */
	FS_DISCARD_IO,			/* discard */
	FS_FLUSH_IO,			/* flush */
	FS_ZONE_RESET_IO,		/* zone reset */
	NR_IO_TYPE,
};

struct f2fs_io_info {
	struct f2fs_sb_info *sbi;	/* f2fs_sb_info pointer */
	nid_t ino;		/* inode number */
	enum page_type type;	/* contains DATA/NODE/META/META_FLUSH */
	enum temp_type temp;	/* contains HOT/WARM/COLD */
	enum req_op op;		/* contains REQ_OP_ */
	blk_opf_t op_flags;	/* req_flag_bits */
	block_t new_blkaddr;	/* new block address to be written */
	block_t old_blkaddr;	/* old block address before Cow */
	union {
		struct page *page;	/* page to be written */
		struct folio *folio;
	};
	struct page *encrypted_page;	/* encrypted page */
	struct page *compressed_page;	/* compressed page */
	struct list_head list;		/* serialize IOs */
	unsigned int compr_blocks;	/* # of compressed block addresses */
	unsigned int need_lock:8;	/* indicate we need to lock cp_rwsem */
	unsigned int version:8;		/* version of the node */
	unsigned int submitted:1;	/* indicate IO submission */
	unsigned int in_list:1;		/* indicate fio is in io_list */
	unsigned int is_por:1;		/* indicate IO is from recovery or not */
	unsigned int encrypted:1;	/* indicate file is encrypted */
	unsigned int meta_gc:1;		/* require meta inode GC */
	enum iostat_type io_type;	/* io type */
	struct writeback_control *io_wbc; /* writeback control */
	struct bio **bio;		/* bio for ipu */
	sector_t *last_block;		/* last block number in bio */
};

struct bio_entry {
	struct bio *bio;
	struct list_head list;
};

#define is_read_io(rw) ((rw) == READ)
struct f2fs_bio_info {
	struct f2fs_sb_info *sbi;	/* f2fs superblock */
	struct bio *bio;		/* bios to merge */
	sector_t last_block_in_bio;	/* last block number */
	struct f2fs_io_info fio;	/* store buffered io info. */
#ifdef CONFIG_BLK_DEV_ZONED
	struct completion zone_wait;	/* condition value for the previous open zone to close */
	struct bio *zone_pending_bio;	/* pending bio for the previous zone */
	void *bi_private;		/* previous bi_private for pending bio */
#endif
	struct f2fs_rwsem io_rwsem;	/* blocking op for bio */
	spinlock_t io_lock;		/* serialize DATA/NODE IOs */
	struct list_head io_list;	/* track fios */
	struct list_head bio_list;	/* bio entry list head */
	struct f2fs_rwsem bio_list_lock;	/* lock to protect bio entry list */
};

#define FDEV(i)				(sbi->devs[i])
#define RDEV(i)				(raw_super->devs[i])
struct f2fs_dev_info {
	struct file *bdev_file;
	struct block_device *bdev;
	char path[MAX_PATH_LEN + 1];
	unsigned int total_segments;
	block_t start_blk;
	block_t end_blk;
#ifdef CONFIG_BLK_DEV_ZONED
	unsigned int nr_blkz;		/* Total number of zones */
	unsigned long *blkz_seq;	/* Bitmap indicating sequential zones */
#endif
};

enum inode_type {
	DIR_INODE,			/* for dirty dir inode */
	FILE_INODE,			/* for dirty regular/symlink inode */
	DIRTY_META,			/* for all dirtied inode metadata */
	DONATE_INODE,			/* for all inode to donate pages */
	NR_INODE_TYPE,
};

/* for inner inode cache management */
struct inode_management {
	struct radix_tree_root ino_root;	/* ino entry array */
	spinlock_t ino_lock;			/* for ino entry lock */
	struct list_head ino_list;		/* inode list head */
	unsigned long ino_num;			/* number of entries */
};

/* for GC_AT */
struct atgc_management {
	bool atgc_enabled;			/* ATGC is enabled or not */
	struct rb_root_cached root;		/* root of victim rb-tree */
	struct list_head victim_list;		/* linked with all victim entries */
	unsigned int victim_count;		/* victim count in rb-tree */
	unsigned int candidate_ratio;		/* candidate ratio */
	unsigned int max_candidate_count;	/* max candidate count */
	unsigned int age_weight;		/* age weight, vblock_weight = 100 - age_weight */
	unsigned long long age_threshold;	/* age threshold */
};

struct f2fs_time_stat {
	unsigned long long total_time;		/* total wall clock time */
#ifdef CONFIG_64BIT
	unsigned long long running_time;	/* running time */
#endif
#if defined(CONFIG_SCHED_INFO) && defined(CONFIG_SCHEDSTATS)
	unsigned long long runnable_time;	/* runnable(including preempted) time */
#endif
#ifdef CONFIG_TASK_DELAY_ACCT
	unsigned long long io_sleep_time;	/* IO sleep time */
#endif
};

struct f2fs_lock_context {
	struct f2fs_time_stat ts;
	int orig_nice;
	int new_nice;
	bool lock_trace;
	bool need_restore;
};

struct f2fs_gc_control {
	unsigned int victim_segno;	/* target victim segment number */
	int init_gc_type;		/* FG_GC or BG_GC */
	bool no_bg_gc;			/* check the space and stop bg_gc */
	bool should_migrate_blocks;	/* should migrate blocks */
	bool err_gc_skipped;		/* return EAGAIN if GC skipped */
	bool one_time;			/* require one time GC in one migration unit */
	unsigned int nr_free_secs;	/* # of free sections to do GC */
	struct f2fs_lock_context lc;	/* lock context for gc_lock */
};

/*
 * For s_flag in struct f2fs_sb_info
 * Modification on enum should be synchronized with s_flag array
 */
enum {
	SBI_IS_DIRTY,				/* dirty flag for checkpoint */
	SBI_IS_CLOSE,				/* specify unmounting */
	SBI_NEED_FSCK,				/* need fsck.f2fs to fix */
	SBI_POR_DOING,				/* recovery is doing or not */
	SBI_NEED_SB_WRITE,			/* need to recover superblock */
	SBI_NEED_CP,				/* need to checkpoint */
	SBI_IS_SHUTDOWN,			/* shutdown by ioctl */
	SBI_IS_RECOVERED,			/* recovered orphan/data */
	SBI_CP_DISABLED,			/* CP was disabled last mount */
	SBI_CP_DISABLED_QUICK,			/* CP was disabled quickly */
	SBI_QUOTA_NEED_FLUSH,			/* need to flush quota info in CP */
	SBI_QUOTA_SKIP_FLUSH,			/* skip flushing quota in current CP */
	SBI_QUOTA_NEED_REPAIR,			/* quota file may be corrupted */
	SBI_IS_RESIZEFS,			/* resizefs is in process */
	SBI_IS_FREEZING,			/* freezefs is in process */
	SBI_IS_WRITABLE,			/* remove ro mountoption transiently */
	SBI_ENABLE_CHECKPOINT,			/* indicate it's during f2fs_enable_checkpoint() */
	MAX_SBI_FLAG,
};

enum {
	CP_TIME,
	REQ_TIME,
	DISCARD_TIME,
	GC_TIME,
	DISABLE_TIME,
	UMOUNT_DISCARD_TIMEOUT,
	MAX_TIME,
};

/* Note that you need to keep synchronization with this gc_mode_names array */
enum {
	GC_NORMAL,
	GC_IDLE_CB,
	GC_IDLE_GREEDY,
	GC_IDLE_AT,
	GC_URGENT_HIGH,
	GC_URGENT_LOW,
	GC_URGENT_MID,
	MAX_GC_MODE,
};

enum {
	BGGC_MODE_ON,		/* background gc is on */
	BGGC_MODE_OFF,		/* background gc is off */
	BGGC_MODE_SYNC,		/*
				 * background gc is on, migrating blocks
				 * like foreground gc
				 */
};

enum {
	FS_MODE_ADAPTIVE,		/* use both lfs/ssr allocation */
	FS_MODE_LFS,			/* use lfs allocation only */
	FS_MODE_FRAGMENT_SEG,		/* segment fragmentation mode */
	FS_MODE_FRAGMENT_BLK,		/* block fragmentation mode */
};

enum {
	ALLOC_MODE_DEFAULT,	/* stay default */
	ALLOC_MODE_REUSE,	/* reuse segments as much as possible */
};

enum fsync_mode {
	FSYNC_MODE_POSIX,	/* fsync follows posix semantics */
	FSYNC_MODE_STRICT,	/* fsync behaves in line with ext4 */
	FSYNC_MODE_NOBARRIER,	/* fsync behaves nobarrier based on posix */
};

enum {
	COMPR_MODE_FS,		/*
				 * automatically compress compression
				 * enabled files
				 */
	COMPR_MODE_USER,	/*
				 * automatical compression is disabled.
				 * user can control the file compression
				 * using ioctls
				 */
};

enum {
	DISCARD_UNIT_BLOCK,	/* basic discard unit is block */
	DISCARD_UNIT_SEGMENT,	/* basic discard unit is segment */
	DISCARD_UNIT_SECTION,	/* basic discard unit is section */
};

enum {
	MEMORY_MODE_NORMAL,	/* memory mode for normal devices */
	MEMORY_MODE_LOW,	/* memory mode for low memory devices */
};

enum errors_option {
	MOUNT_ERRORS_READONLY,	/* remount fs ro on errors */
	MOUNT_ERRORS_CONTINUE,	/* continue on errors */
	MOUNT_ERRORS_PANIC,	/* panic on errors */
};

enum {
	BACKGROUND,
	FOREGROUND,
	MAX_CALL_TYPE,
	TOTAL_CALL = FOREGROUND,
};

enum f2fs_lookup_mode {
	LOOKUP_PERF,
	LOOKUP_COMPAT,
	LOOKUP_AUTO,
};

/* For node type in __get_node_folio() */
enum node_type {
	NODE_TYPE_REGULAR,
	NODE_TYPE_INODE,
	NODE_TYPE_XATTR,
	NODE_TYPE_NON_INODE,
};

/* a threshold of maximum elapsed time in critical region to print tracepoint */
#define MAX_LOCK_ELAPSED_TIME		500

#define F2FS_DEFAULT_TASK_PRIORITY		(DEFAULT_PRIO)
#define F2FS_CRITICAL_TASK_PRIORITY		NICE_TO_PRIO(0)

static inline int f2fs_test_bit(unsigned int nr, char *addr);
static inline void f2fs_set_bit(unsigned int nr, char *addr);
static inline void f2fs_clear_bit(unsigned int nr, char *addr);

/*
 * Layout of f2fs page.private:
 *
 * Layout A: lowest bit should be 1
 * | bit0 = 1 | bit1 | bit2 | ... | bit MAX | private data .... |
 * bit 0	PAGE_PRIVATE_NOT_POINTER
 * bit 1	PAGE_PRIVATE_ONGOING_MIGRATION
 * bit 2	PAGE_PRIVATE_INLINE_INODE
 * bit 3	PAGE_PRIVATE_REF_RESOURCE
 * bit 4	PAGE_PRIVATE_ATOMIC_WRITE
 * bit 5-	f2fs private data
 *
 * Layout B: lowest bit should be 0
 * page.private is a wrapped pointer.
 */
enum {
	PAGE_PRIVATE_NOT_POINTER,		/* private contains non-pointer data */
	PAGE_PRIVATE_ONGOING_MIGRATION,		/* data page which is on-going migrating */
	PAGE_PRIVATE_INLINE_INODE,		/* inode page contains inline data */
	PAGE_PRIVATE_REF_RESOURCE,		/* dirty page has referenced resources */
	PAGE_PRIVATE_ATOMIC_WRITE,		/* data page from atomic write path */
	PAGE_PRIVATE_MAX
};

/* For compression */
enum compress_algorithm_type {
	COMPRESS_LZO,
	COMPRESS_LZ4,
	COMPRESS_ZSTD,
	COMPRESS_LZORLE,
	COMPRESS_MAX,
};

enum compress_flag {
	COMPRESS_CHKSUM,
	COMPRESS_MAX_FLAG,
};

#define	COMPRESS_WATERMARK			20
#define	COMPRESS_PERCENT			20

#define COMPRESS_DATA_RESERVED_SIZE		4
struct compress_data {
	__le32 clen;			/* compressed data size */
	__le32 chksum;			/* compressed data checksum */
	__le32 reserved[COMPRESS_DATA_RESERVED_SIZE];	/* reserved */
	u8 cdata[];			/* compressed data */
};

#define COMPRESS_HEADER_SIZE	(sizeof(struct compress_data))

#define F2FS_COMPRESSED_PAGE_MAGIC	0xF5F2C000

#define F2FS_ZSTD_DEFAULT_CLEVEL	1

#define	COMPRESS_LEVEL_OFFSET	8

/* compress context */
struct compress_ctx {
	struct inode *inode;		/* inode the context belong to */
	pgoff_t cluster_idx;		/* cluster index number */
	unsigned int cluster_size;	/* page count in cluster */
	unsigned int log_cluster_size;	/* log of cluster size */
	struct page **rpages;		/* pages store raw data in cluster */
	unsigned int nr_rpages;		/* total page number in rpages */
	struct page **cpages;		/* pages store compressed data in cluster */
	unsigned int nr_cpages;		/* total page number in cpages */
	unsigned int valid_nr_cpages;	/* valid page number in cpages */
	void *rbuf;			/* virtual mapped address on rpages */
	struct compress_data *cbuf;	/* virtual mapped address on cpages */
	size_t rlen;			/* valid data length in rbuf */
	size_t clen;			/* valid data length in cbuf */
	void *private;			/* payload buffer for specified compression algorithm */
	void *private2;			/* extra payload buffer */
	struct fsverity_info *vi;	/* verity info if needed */
};

/* compress context for write IO path */
struct compress_io_ctx {
	u32 magic;			/* magic number to indicate page is compressed */
	struct inode *inode;		/* inode the context belong to */
	struct page **rpages;		/* pages store raw data in cluster */
	unsigned int nr_rpages;		/* total page number in rpages */
	atomic_t pending_pages;		/* in-flight compressed page count */
};

/* Context for decompressing one cluster on the read IO path */
struct decompress_io_ctx {
	u32 magic;			/* magic number to indicate page is compressed */
	struct inode *inode;		/* inode the context belong to */
	struct f2fs_sb_info *sbi;	/* f2fs_sb_info pointer */
	pgoff_t cluster_idx;		/* cluster index number */
	unsigned int cluster_size;	/* page count in cluster */
	unsigned int log_cluster_size;	/* log of cluster size */
	struct page **rpages;		/* pages store raw data in cluster */
	unsigned int nr_rpages;		/* total page number in rpages */
	struct page **cpages;		/* pages store compressed data in cluster */
	unsigned int nr_cpages;		/* total page number in cpages */
	struct page **tpages;		/* temp pages to pad holes in cluster */
	void *rbuf;			/* virtual mapped address on rpages */
	struct compress_data *cbuf;	/* virtual mapped address on cpages */
	size_t rlen;			/* valid data length in rbuf */
	size_t clen;			/* valid data length in cbuf */

	/*
	 * The number of compressed pages remaining to be read in this cluster.
	 * This is initially nr_cpages.  It is decremented by 1 each time a page
	 * has been read (or failed to be read).  When it reaches 0, the cluster
	 * is decompressed (or an error is reported).
	 *
	 * If an error occurs before all the pages have been submitted for I/O,
	 * then this will never reach 0.  In this case the I/O submitter is
	 * responsible for calling f2fs_decompress_end_io() instead.
	 */
	atomic_t remaining_pages;

	/*
	 * Number of references to this decompress_io_ctx.
	 *
	 * One reference is held for I/O completion.  This reference is dropped
	 * after the pagecache pages are updated and unlocked -- either after
	 * decompression (and verity if enabled), or after an error.
	 *
	 * In addition, each compressed page holds a reference while it is in a
	 * bio.  These references are necessary prevent compressed pages from
	 * being freed while they are still in a bio.
	 */
	refcount_t refcnt;

	bool failed;			/* IO error occurred before decompression? */
	struct fsverity_info *vi;	/* fs-verity context if needed */
	unsigned char compress_algorithm;	/* backup algorithm type */
	void *private;			/* payload buffer for specified decompression algorithm */
	void *private2;			/* extra payload buffer */
	struct work_struct verity_work;	/* work to verify the decompressed pages */
	struct work_struct free_work;	/* work for late free this structure itself */
};

#define NULL_CLUSTER			((unsigned int)(~0))
#define MIN_COMPRESS_LOG_SIZE		2
#define MAX_COMPRESS_LOG_SIZE		8
#define MAX_COMPRESS_WINDOW_SIZE(log_size)	((PAGE_SIZE) << (log_size))

struct f2fs_sb_info {
	struct super_block *sb;			/* pointer to VFS super block */
	struct proc_dir_entry *s_proc;		/* proc entry */
	struct f2fs_super_block *raw_super;	/* raw super block pointer */
	struct f2fs_rwsem sb_lock;		/* lock for raw super block */
	int valid_super_block;			/* valid super block no */
	unsigned long s_flag;				/* flags for sbi */
	struct mutex writepages;		/* mutex for writepages() */

#ifdef CONFIG_BLK_DEV_ZONED
	unsigned int blocks_per_blkz;		/* F2FS blocks per zone */
	unsigned int unusable_blocks_per_sec;   /* unusable blocks per section */
	unsigned int max_open_zones;		/* max open zone resources of the zoned device */
	/* For adjust the priority writing position of data in zone UFS */
	unsigned int blkzone_alloc_policy;
#endif

	/* for node-related operations */
	struct f2fs_nm_info *nm_info;		/* node manager */
	struct inode *node_inode;		/* cache node blocks */

	/* for segment-related operations */
	struct f2fs_sm_info *sm_info;		/* segment manager */

	/* for bio operations */
	struct f2fs_bio_info *write_io[NR_PAGE_TYPE];	/* for write bios */
	/* keep migration IO order for LFS mode */
	struct f2fs_rwsem io_order_lock;
	pgoff_t page_eio_ofs[NR_PAGE_TYPE];	/* EIO page offset */
	int page_eio_cnt[NR_PAGE_TYPE];		/* EIO count */

	/* for checkpoint */
	struct f2fs_checkpoint *ckpt;		/* raw checkpoint pointer */
	int cur_cp_pack;			/* remain current cp pack */
	spinlock_t cp_lock;			/* for flag in ckpt */
	struct inode *meta_inode;		/* cache meta blocks */
	struct f2fs_rwsem cp_global_sem;	/* checkpoint procedure lock */
	struct f2fs_rwsem cp_rwsem;		/* blocking FS operations */
	struct f2fs_rwsem node_write;		/* locking node writes */
	struct f2fs_rwsem node_change;	/* locking node change */
	wait_queue_head_t cp_wait;
	unsigned long last_time[MAX_TIME];	/* to store time in jiffies */
	long interval_time[MAX_TIME];		/* to store thresholds */
	struct ckpt_req_control cprc_info;	/* for checkpoint request control */
	struct cp_stats cp_stats;		/* for time stat of checkpoint */

	struct inode_management im[MAX_INO_ENTRY];	/* manage inode cache */

	spinlock_t fsync_node_lock;		/* for node entry lock */
	struct list_head fsync_node_list;	/* node list head */
	unsigned int fsync_seg_id;		/* sequence id */
	unsigned int fsync_node_num;		/* number of node entries */

	/* for orphan inode, use 0'th array */
	unsigned int max_orphans;		/* max orphan inodes */

	/* for inode management */
	struct list_head inode_list[NR_INODE_TYPE];	/* dirty inode list */
	spinlock_t inode_lock[NR_INODE_TYPE];	/* for dirty inode list lock */
	struct mutex flush_lock;		/* for flush exclusion */

	/* for extent tree cache */
	struct extent_tree_info extent_tree[NR_EXTENT_CACHES];
	atomic64_t allocated_data_blocks;	/* for block age extent_cache */
	unsigned int max_read_extent_count;	/* max read extent count per inode */

	/* The threshold used for hot and warm data seperation*/
	unsigned int hot_data_age_threshold;
	unsigned int warm_data_age_threshold;
	unsigned int last_age_weight;

	/* control donate caches */
	unsigned int donate_files;

	/* basic filesystem units */
	unsigned int log_sectors_per_block;	/* log2 sectors per block */
	unsigned int log_blocksize;		/* log2 block size */
	unsigned int blocksize;			/* block size */
	unsigned int root_ino_num;		/* root inode number*/
	unsigned int node_ino_num;		/* node inode number*/
	unsigned int meta_ino_num;		/* meta inode number*/
	unsigned int log_blocks_per_seg;	/* log2 blocks per segment */
	unsigned int blocks_per_seg;		/* blocks per segment */
	unsigned int segs_per_sec;		/* segments per section */
	unsigned int secs_per_zone;		/* sections per zone */
	unsigned int total_sections;		/* total section count */
	unsigned int total_node_count;		/* total node block count */
	unsigned int total_valid_node_count;	/* valid node block count */
	int dir_level;				/* directory level */
	bool readdir_ra;			/* readahead inode in readdir */
	unsigned int max_io_bytes;		/* max io bytes to merge IOs */

	/* variable summary block units */
	unsigned int sum_blocksize;		/* sum block size */
	unsigned int sums_per_block;		/* sum block count per block */
	unsigned int entries_in_sum;		/* entry count in sum block */
	unsigned int sum_entry_size;		/* total entry size in sum block */
	unsigned int sum_journal_size;		/* journal size in sum block */
	unsigned int nat_journal_entries;	/* nat journal entry count in the journal */
	unsigned int sit_journal_entries;	/* sit journal entry count in the journal */

	block_t user_block_count;		/* # of user blocks */
	block_t total_valid_block_count;	/* # of valid blocks */
	block_t discard_blks;			/* discard command candidats */
	block_t last_valid_block_count;		/* for recovery */
	block_t reserved_blocks;		/* configurable reserved blocks */
	block_t current_reserved_blocks;	/* current reserved blocks */

	/* Additional tracking for no checkpoint mode */
	block_t unusable_block_count;		/* # of blocks saved by last cp */

	unsigned int nquota_files;		/* # of quota sysfile */
	struct f2fs_rwsem quota_sem;		/* blocking cp for flags */
	struct task_struct *umount_lock_holder;	/* s_umount lock holder */

	/* # of pages, see count_type */
	atomic_t nr_pages[NR_COUNT_TYPE];
	/* # of allocated blocks */
	struct percpu_counter alloc_valid_block_count;
	/* # of node block writes as roll forward recovery */
	struct percpu_counter rf_node_block_count;

	/* writeback control */
	atomic_t wb_sync_req[META];	/* count # of WB_SYNC threads */

	/* valid inode count */
	struct percpu_counter total_valid_inode_count;

	struct f2fs_mount_info mount_opt;	/* mount options */

	/* for cleaning operations */
	struct f2fs_rwsem gc_lock;		/*
						 * semaphore for GC, avoid
						 * race between GC and GC or CP
						 */
	struct f2fs_gc_kthread	*gc_thread;	/* GC thread */
	struct atgc_management am;		/* atgc management */
	unsigned int cur_victim_sec;		/* current victim section num */
	unsigned int gc_mode;			/* current GC state */
	unsigned int next_victim_seg[2];	/* next segment in victim section */
	spinlock_t gc_remaining_trials_lock;
	/* remaining trial count for GC_URGENT_* and GC_IDLE_* */
	unsigned int gc_remaining_trials;

	/* for skip statistic */
	unsigned long long skipped_gc_rwsem;		/* FG_GC only */

	/* free sections reserved for pinned file */
	unsigned int reserved_pin_section;

	/* threshold for gc trials on pinned files */
	unsigned short gc_pin_file_threshold;
	struct f2fs_rwsem pin_sem;

	/* maximum # of trials to find a victim segment for SSR and GC */
	unsigned int max_victim_search;
	/* migration granularity of garbage collection, unit: segment */
	unsigned int migration_granularity;
	/* migration window granularity of garbage collection, unit: segment */
	unsigned int migration_window_granularity;

	/*
	 * for stat information.
	 * one is for the LFS mode, and the other is for the SSR mode.
	 */
#ifdef CONFIG_F2FS_STAT_FS
	struct f2fs_stat_info *stat_info;	/* FS status information */
	atomic_t meta_count[META_MAX];		/* # of meta blocks */
	unsigned int segment_count[2];		/* # of allocated segments */
	unsigned int block_count[2];		/* # of allocated blocks */
	atomic_t inplace_count;		/* # of inplace update */
	/* # of lookup extent cache */
	atomic64_t total_hit_ext[NR_EXTENT_CACHES];
	/* # of hit rbtree extent node */
	atomic64_t read_hit_rbtree[NR_EXTENT_CACHES];
	/* # of hit cached extent node */
	atomic64_t read_hit_cached[NR_EXTENT_CACHES];
	/* # of hit largest extent node in read extent cache */
	atomic64_t read_hit_largest;
	atomic_t inline_xattr;			/* # of inline_xattr inodes */
	atomic_t inline_inode;			/* # of inline_data inodes */
	atomic_t inline_dir;			/* # of inline_dentry inodes */
	atomic_t compr_inode;			/* # of compressed inodes */
	atomic64_t compr_blocks;		/* # of compressed blocks */
	atomic_t swapfile_inode;		/* # of swapfile inodes */
	atomic_t atomic_files;			/* # of opened atomic file */
	atomic_t max_aw_cnt;			/* max # of atomic writes */
	unsigned int io_skip_bggc;		/* skip background gc for in-flight IO */
	unsigned int other_skip_bggc;		/* skip background gc for other reasons */
	unsigned int ndirty_inode[NR_INODE_TYPE];	/* # of dirty inodes */
	atomic_t cp_call_count[MAX_CALL_TYPE];	/* # of cp call */
#endif
	spinlock_t stat_lock;			/* lock for stat operations */

	/* to attach REQ_META|REQ_FUA flags */
	unsigned int data_io_flag;
	unsigned int node_io_flag;

	/* For sysfs support */
	struct kobject s_kobj;			/* /sys/fs/f2fs/<devname> */
	struct completion s_kobj_unregister;

	struct kobject s_stat_kobj;		/* /sys/fs/f2fs/<devname>/stat */
	struct completion s_stat_kobj_unregister;

	struct kobject s_feature_list_kobj;		/* /sys/fs/f2fs/<devname>/feature_list */
	struct completion s_feature_list_kobj_unregister;

	/* For shrinker support */
	struct list_head s_list;
	struct mutex umount_mutex;
	unsigned int shrinker_run_no;

	/* For multi devices */
	int s_ndevs;				/* number of devices */
	struct f2fs_dev_info *devs;		/* for device list */
	unsigned int dirty_device;		/* for checkpoint data flush */
	spinlock_t dev_lock;			/* protect dirty_device */
	bool aligned_blksize;			/* all devices has the same logical blksize */
	unsigned int first_seq_zone_segno;	/* first segno in sequential zone */
	unsigned int bggc_io_aware;		/* For adjust the BG_GC priority when pending IO */
	unsigned int allocate_section_hint;	/* the boundary position between devices */
	unsigned int allocate_section_policy;	/* determine the section writing priority */

	/* For write statistics */
	u64 sectors_written_start;
	u64 kbytes_written;

	/* Precomputed FS UUID checksum for seeding other checksums */
	__u32 s_chksum_seed;

	struct workqueue_struct *post_read_wq;	/* post read workqueue */

	/*
	 * If we are in irq context, let's update error information into
	 * on-disk superblock in the work.
	 */
	struct work_struct s_error_work;
	unsigned char errors[MAX_F2FS_ERRORS];		/* error flags */
	unsigned char stop_reason[MAX_STOP_REASON];	/* stop reason */
	spinlock_t error_lock;			/* protect errors/stop_reason array */
	bool error_dirty;			/* errors of sb is dirty */

	/* For reclaimed segs statistics per each GC mode */
	unsigned int gc_segment_mode;		/* GC state for reclaimed segments */
	unsigned int gc_reclaimed_segs[MAX_GC_MODE];	/* Reclaimed segs for each mode */

	unsigned int seq_file_ra_mul;		/* multiplier for ra_pages of seq. files in fadvise */

	int max_fragment_chunk;			/* max chunk size for block fragmentation mode */
	int max_fragment_hole;			/* max hole size for block fragmentation mode */

	/* For atomic write statistics */
	atomic64_t current_atomic_write;
	s64 peak_atomic_write;
	u64 committed_atomic_block;
	u64 revoked_atomic_block;

	/* carve out reserved_blocks from total blocks */
	bool carve_out;

	/* max elapsed time threshold in critical region that lock covered */
	unsigned long long max_lock_elapsed_time;

	/* enable/disable to adjust task priority in critical region covered by lock */
	unsigned int adjust_lock_priority;

	/* adjust priority for task which is in critical region covered by lock */
	unsigned int lock_duration_priority;

	/* priority for critical task, e.g. f2fs_ckpt, f2fs_gc threads */
	long critical_task_priority;

#ifdef CONFIG_F2FS_FS_COMPRESSION
	struct kmem_cache *page_array_slab;	/* page array entry */
	unsigned int page_array_slab_size;	/* default page array slab size */

	/* For runtime compression statistics */
	u64 compr_written_block;
	u64 compr_saved_block;
	u32 compr_new_inode;

	/* For compressed block cache */
	struct inode *compress_inode;		/* cache compressed blocks */
	unsigned int compress_percent;		/* cache page percentage */
	unsigned int compress_watermark;	/* cache page watermark */
	atomic_t compress_page_hit;		/* cache hit count */
#endif

#ifdef CONFIG_F2FS_IOSTAT
	/* For app/fs IO statistics */
	spinlock_t iostat_lock;
	unsigned long long iostat_count[NR_IO_TYPE];
	unsigned long long iostat_bytes[NR_IO_TYPE];
	unsigned long long prev_iostat_bytes[NR_IO_TYPE];
	unsigned long long iostat_read_folio_count[NR_PAGE_ORDERS];
	unsigned long long prev_iostat_read_folio_count[NR_PAGE_ORDERS];
	bool iostat_enable;
	unsigned long iostat_next_period;
	unsigned int iostat_period_ms;

	/* For io latency related statistics info in one iostat period */
	spinlock_t iostat_lat_lock;
	struct iostat_lat_info *iostat_io_lat;
#endif
#ifdef CONFIG_DEBUG_LOCK_ALLOC
	struct lock_class_key cp_global_sem_key;
#endif
};

/* Definitions to access f2fs_sb_info */
#define SEGS_TO_BLKS(sbi, segs)					\
		((segs) << (sbi)->log_blocks_per_seg)
#define BLKS_TO_SEGS(sbi, blks)					\
		((blks) >> (sbi)->log_blocks_per_seg)

#define BLKS_PER_SEG(sbi)	((sbi)->blocks_per_seg)
#define BLKS_PER_SEC(sbi)	(SEGS_TO_BLKS(sbi, (sbi)->segs_per_sec))
#define SEGS_PER_SEC(sbi)	((sbi)->segs_per_sec)

__printf(3, 4)
void f2fs_printk(struct f2fs_sb_info *sbi, bool limit_rate, const char *fmt, ...);

#define f2fs_err(sbi, fmt, ...)						\
	f2fs_printk(sbi, false, KERN_ERR fmt, ##__VA_ARGS__)
#define f2fs_warn(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_WARNING fmt, ##__VA_ARGS__)
#define f2fs_notice(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_NOTICE fmt, ##__VA_ARGS__)
#define f2fs_info(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_INFO fmt, ##__VA_ARGS__)
#define f2fs_debug(sbi, fmt, ...)					\
	f2fs_printk(sbi, false, KERN_DEBUG fmt, ##__VA_ARGS__)

#define f2fs_err_ratelimited(sbi, fmt, ...)				\
	f2fs_printk(sbi, true, KERN_ERR fmt, ##__VA_ARGS__)
#define f2fs_warn_ratelimited(sbi, fmt, ...)				\
	f2fs_printk(sbi, true, KERN_WARNING fmt, ##__VA_ARGS__)
#define f2fs_info_ratelimited(sbi, fmt, ...)				\
	f2fs_printk(sbi, true, KERN_INFO fmt, ##__VA_ARGS__)

#ifdef CONFIG_F2FS_FAULT_INJECTION
#define time_to_inject(sbi, type) __time_to_inject(sbi, type, __func__,	\
									__builtin_return_address(0))
static inline bool __time_to_inject(struct f2fs_sb_info *sbi, int type,
				const char *func, const char *parent_func)
{
	struct f2fs_fault_info *ffi = &F2FS_OPTION(sbi).fault_info;

	if (!ffi->inject_rate)
		return false;

	if (!IS_FAULT_SET(ffi, type))
		return false;

	atomic_inc(&ffi->inject_ops);
	if (atomic_read(&ffi->inject_ops) >= ffi->inject_rate) {
		atomic_set(&ffi->inject_ops, 0);
		ffi->inject_count[type]++;
		f2fs_info_ratelimited(sbi, "inject %s in %s of %pS",
				f2fs_fault_name[type], func, parent_func);
		return true;
	}
	return false;
}
#else
static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type)
{
	return false;
}
#endif

/*
 * Test if the mounted volume is a multi-device volume.
 *   - For a single regular disk volume, sbi->s_ndevs is 0.
 *   - For a single zoned disk volume, sbi->s_ndevs is 1.
 *   - For a multi-device volume, sbi->s_ndevs is always 2 or more.
 */
static inline bool f2fs_is_multi_device(struct f2fs_sb_info *sbi)
{
	return sbi->s_ndevs > 1;
}

static inline void f2fs_update_time(struct f2fs_sb_info *sbi, int type)
{
	unsigned long now = jiffies;

	sbi->last_time[type] = now;

	/* DISCARD_TIME and GC_TIME are based on REQ_TIME */
	if (type == REQ_TIME) {
		sbi->last_time[DISCARD_TIME] = now;
		sbi->last_time[GC_TIME] = now;
	}
}

static inline bool f2fs_time_over(struct f2fs_sb_info *sbi, int type)
{
	unsigned long interval = sbi->interval_time[type] * HZ;

	return time_after(jiffies, sbi->last_time[type] + interval);
}

static inline unsigned int f2fs_time_to_wait(struct f2fs_sb_info *sbi,
						int type)
{
	unsigned long interval = sbi->interval_time[type] * HZ;
	unsigned int wait_ms = 0;
	long delta;

	delta = (sbi->last_time[type] + interval) - jiffies;
	if (delta > 0)
		wait_ms = jiffies_to_msecs(delta);

	return wait_ms;
}

/*
 * Inline functions
 */
static inline u32 __f2fs_crc32(u32 crc, const void *address,
			       unsigned int length)
{
	return crc32(crc, address, length);
}

static inline u32 f2fs_crc32(const void *address, unsigned int length)
{
	return __f2fs_crc32(F2FS_SUPER_MAGIC, address, length);
}

static inline u32 f2fs_chksum(u32 crc, const void *address, unsigned int length)
{
	return __f2fs_crc32(crc, address, length);
}

static inline struct f2fs_inode_info *F2FS_I(struct inode *inode)
{
	return container_of(inode, struct f2fs_inode_info, vfs_inode);
}

static inline struct f2fs_sb_info *F2FS_SB(struct super_block *sb)
{
	return sb->s_fs_info;
}

static inline struct f2fs_sb_info *F2FS_I_SB(struct inode *inode)
{
	return F2FS_SB(inode->i_sb);
}

static inline struct f2fs_sb_info *F2FS_M_SB(struct address_space *mapping)
{
	return F2FS_I_SB(mapping->host);
}

static inline struct f2fs_sb_info *F2FS_F_SB(const struct folio *folio)
{
	return F2FS_M_SB(folio->mapping);
}

static inline struct f2fs_super_block *F2FS_RAW_SUPER(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_super_block *)(sbi->raw_super);
}

static inline struct f2fs_super_block *F2FS_SUPER_BLOCK(struct folio *folio,
								pgoff_t index)
{
	pgoff_t idx_in_folio = index % folio_nr_pages(folio);

	return (struct f2fs_super_block *)
		(page_address(folio_page(folio, idx_in_folio)) +
						F2FS_SUPER_OFFSET);
}

static inline struct f2fs_checkpoint *F2FS_CKPT(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_checkpoint *)(sbi->ckpt);
}

static inline struct f2fs_node *F2FS_NODE(const struct folio *folio)
{
	return (struct f2fs_node *)folio_address(folio);
}

static inline struct f2fs_inode *F2FS_INODE(const struct folio *folio)
{
	return &((struct f2fs_node *)folio_address(folio))->i;
}

static inline struct f2fs_nm_info *NM_I(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_nm_info *)(sbi->nm_info);
}

static inline struct f2fs_sm_info *SM_I(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_sm_info *)(sbi->sm_info);
}

static inline struct sit_info *SIT_I(struct f2fs_sb_info *sbi)
{
	return (struct sit_info *)(SM_I(sbi)->sit_info);
}

static inline struct free_segmap_info *FREE_I(struct f2fs_sb_info *sbi)
{
	return (struct free_segmap_info *)(SM_I(sbi)->free_info);
}

static inline struct dirty_seglist_info *DIRTY_I(struct f2fs_sb_info *sbi)
{
	return (struct dirty_seglist_info *)(SM_I(sbi)->dirty_info);
}

static inline struct address_space *META_MAPPING(struct f2fs_sb_info *sbi)
{
	return sbi->meta_inode->i_mapping;
}

static inline struct address_space *NODE_MAPPING(struct f2fs_sb_info *sbi)
{
	return sbi->node_inode->i_mapping;
}

static inline bool is_meta_folio(struct folio *folio)
{
	return folio->mapping == META_MAPPING(F2FS_F_SB(folio));
}

static inline bool is_node_folio(struct folio *folio)
{
	return folio->mapping == NODE_MAPPING(F2FS_F_SB(folio));
}

static inline bool is_sbi_flag_set(struct f2fs_sb_info *sbi, unsigned int type)
{
	return test_bit(type, &sbi->s_flag);
}

static inline void set_sbi_flag(struct f2fs_sb_info *sbi, unsigned int type)
{
	set_bit(type, &sbi->s_flag);
}

static inline void clear_sbi_flag(struct f2fs_sb_info *sbi, unsigned int type)
{
	clear_bit(type, &sbi->s_flag);
}

static inline unsigned long long cur_cp_version(struct f2fs_checkpoint *cp)
{
	return le64_to_cpu(cp->checkpoint_ver);
}

static inline unsigned long f2fs_qf_ino(struct super_block *sb, int type)
{
	if (type < F2FS_MAX_QUOTAS)
		return le32_to_cpu(F2FS_SB(sb)->raw_super->qf_ino[type]);
	return 0;
}

static inline __u64 cur_cp_crc(struct f2fs_checkpoint *cp)
{
	size_t crc_offset = le32_to_cpu(cp->checksum_offset);
	return le32_to_cpu(*((__le32 *)((unsigned char *)cp + crc_offset)));
}

static inline bool __is_set_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
{
	unsigned int ckpt_flags = le32_to_cpu(cp->ckpt_flags);

	return ckpt_flags & f;
}

static inline bool is_set_ckpt_flags(struct f2fs_sb_info *sbi, unsigned int f)
{
	return __is_set_ckpt_flags(F2FS_CKPT(sbi), f);
}

static inline void __set_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
{
	unsigned int ckpt_flags;

	ckpt_flags = le32_to_cpu(cp->ckpt_flags);
	ckpt_flags |= f;
	cp->ckpt_flags = cpu_to_le32(ckpt_flags);
}

static inline void set_ckpt_flags(struct f2fs_sb_info *sbi, unsigned int f)
{
	unsigned long flags;

	spin_lock_irqsave(&sbi->cp_lock, flags);
	__set_ckpt_flags(F2FS_CKPT(sbi), f);
	spin_unlock_irqrestore(&sbi->cp_lock, flags);
}

static inline void __clear_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
{
	unsigned int ckpt_flags;

	ckpt_flags = le32_to_cpu(cp->ckpt_flags);
	ckpt_flags &= (~f);
	cp->ckpt_flags = cpu_to_le32(ckpt_flags);
}

static inline void clear_ckpt_flags(struct f2fs_sb_info *sbi, unsigned int f)
{
	unsigned long flags;

	spin_lock_irqsave(&sbi->cp_lock, flags);
	__clear_ckpt_flags(F2FS_CKPT(sbi), f);
	spin_unlock_irqrestore(&sbi->cp_lock, flags);
}

#define init_f2fs_rwsem(sem)	__init_f2fs_rwsem(sem, NULL, LOCK_NAME_NONE)
#define init_f2fs_rwsem_trace	__init_f2fs_rwsem

#define __init_f2fs_rwsem(sem, sbi, name)			\
do {								\
	static struct lock_class_key __key;			\
								\
	do_init_f2fs_rwsem((sem), #sem, &__key, sbi, name);	\
} while (0)

static inline void do_init_f2fs_rwsem(struct f2fs_rwsem *sem,
		const char *sem_name, struct lock_class_key *key,
		struct f2fs_sb_info *sbi, enum f2fs_lock_name name)
{
	sem->sbi = sbi;
	sem->name = name;
	__init_rwsem(&sem->internal_rwsem, sem_name, key);
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
	init_waitqueue_head(&sem->read_waiters);
#endif
}

static inline int f2fs_rwsem_is_locked(struct f2fs_rwsem *sem)
{
	return rwsem_is_locked(&sem->internal_rwsem);
}

static inline int f2fs_rwsem_is_contended(struct f2fs_rwsem *sem)
{
	return rwsem_is_contended(&sem->internal_rwsem);
}

static inline void f2fs_down_read(struct f2fs_rwsem *sem)
{
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
	wait_event(sem->read_waiters, down_read_trylock(&sem->internal_rwsem));
#else
	down_read(&sem->internal_rwsem);
#endif
}

static inline int f2fs_down_read_trylock(struct f2fs_rwsem *sem)
{
	return down_read_trylock(&sem->internal_rwsem);
}

static inline void f2fs_up_read(struct f2fs_rwsem *sem)
{
	up_read(&sem->internal_rwsem);
}

static inline void f2fs_down_write(struct f2fs_rwsem *sem)
{
	down_write(&sem->internal_rwsem);
}

#ifdef CONFIG_DEBUG_LOCK_ALLOC
static inline void f2fs_down_read_nested(struct f2fs_rwsem *sem, int subclass)
{
	down_read_nested(&sem->internal_rwsem, subclass);
}

static inline void f2fs_down_write_nested(struct f2fs_rwsem *sem, int subclass)
{
	down_write_nested(&sem->internal_rwsem, subclass);
}
#else
#define f2fs_down_read_nested(sem, subclass) f2fs_down_read(sem)
#define f2fs_down_write_nested(sem, subclass) f2fs_down_write(sem)
#endif

static inline int f2fs_down_write_trylock(struct f2fs_rwsem *sem)
{
	return down_write_trylock(&sem->internal_rwsem);
}

static inline void f2fs_up_write(struct f2fs_rwsem *sem)
{
	up_write(&sem->internal_rwsem);
#ifdef CONFIG_F2FS_UNFAIR_RWSEM
	wake_up_all(&sem->read_waiters);
#endif
}

void f2fs_down_read_trace(struct f2fs_rwsem *sem, struct f2fs_lock_context *lc);
int f2fs_down_read_trylock_trace(struct f2fs_rwsem *sem,
						struct f2fs_lock_context *lc);
void f2fs_up_read_trace(struct f2fs_rwsem *sem, struct f2fs_lock_context *lc);
void f2fs_down_write_trace(struct f2fs_rwsem *sem,
						struct f2fs_lock_context *lc);
int f2fs_down_write_trylock_trace(struct f2fs_rwsem *sem,
						struct f2fs_lock_context *lc);
void f2fs_up_write_trace(struct f2fs_rwsem *sem, struct f2fs_lock_context *lc);

static inline void disable_nat_bits(struct f2fs_sb_info *sbi, bool lock)
{
	unsigned long flags;
	unsigned char *nat_bits;

	/*
	 * In order to re-enable nat_bits we need to call fsck.f2fs by
	 * set_sbi_flag(sbi, SBI_NEED_FSCK). But it may give huge cost,
	 * so let's rely on regular fsck or unclean shutdown.
	 */

	if (lock)
		spin_lock_irqsave(&sbi->cp_lock, flags);
	__clear_ckpt_flags(F2FS_CKPT(sbi), CP_NAT_BITS_FLAG);
	nat_bits = NM_I(sbi)->nat_bits;
	NM_I(sbi)->nat_bits = NULL;
	if (lock)
		spin_unlock_irqrestore(&sbi->cp_lock, flags);

	kvfree(nat_bits);
}

static inline bool enabled_nat_bits(struct f2fs_sb_info *sbi,
					struct cp_control *cpc)
{
	bool set = is_set_ckpt_flags(sbi, CP_NAT_BITS_FLAG);

	return (cpc) ? (cpc->reason & CP_UMOUNT) && set : set;
}

static inline int __get_cp_reason(struct f2fs_sb_info *sbi)
{
	int reason = CP_SYNC;

	if (test_opt(sbi, FASTBOOT))
		reason = CP_FASTBOOT;
	if (is_sbi_flag_set(sbi, SBI_IS_CLOSE))
		reason = CP_UMOUNT;
	return reason;
}

static inline bool __remain_node_summaries(int reason)
{
	return (reason & (CP_UMOUNT | CP_FASTBOOT));
}

static inline bool __exist_node_summaries(struct f2fs_sb_info *sbi)
{
	return (is_set_ckpt_flags(sbi, CP_UMOUNT_FLAG) ||
			is_set_ckpt_flags(sbi, CP_FASTBOOT_FLAG));
}

/*
 * Check whether the inode has blocks or not
 */
static inline int F2FS_HAS_BLOCKS(struct inode *inode)
{
	block_t xattr_block = F2FS_I(inode)->i_xattr_nid ? 1 : 0;

	return (inode->i_blocks >> F2FS_LOG_SECTORS_PER_BLOCK) > xattr_block;
}

static inline bool f2fs_has_xattr_block(unsigned int ofs)
{
	return ofs == XATTR_NODE_OFFSET;
}

static inline bool __allow_reserved_root(struct f2fs_sb_info *sbi,
					struct inode *inode, bool cap)
{
	if (!inode)
		return true;
	if (IS_NOQUOTA(inode))
		return true;
	if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
		return true;
	if (!gid_eq(F2FS_OPTION(sbi).s_resgid, GLOBAL_ROOT_GID) &&
					in_group_p(F2FS_OPTION(sbi).s_resgid))
		return true;
	if (cap && capable(CAP_SYS_RESOURCE))
		return true;
	return false;
}

static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
						struct inode *inode, bool cap)
{
	block_t avail_user_block_count;

	avail_user_block_count = sbi->user_block_count -
					sbi->current_reserved_blocks;

	if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_root(sbi, inode, cap))
		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;

	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
		if (avail_user_block_count > sbi->unusable_block_count)
			avail_user_block_count -= sbi->unusable_block_count;
		else
			avail_user_block_count = 0;
	}

	return avail_user_block_count;
}

static inline void f2fs_i_blocks_write(struct inode *, block_t, bool, bool);
static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
				 struct inode *inode, blkcnt_t *count, bool partial)
{
	long long diff = 0, release = 0;
	block_t avail_user_block_count;
	int ret;

	ret = dquot_reserve_block(inode, *count);
	if (ret)
		return ret;

	if (time_to_inject(sbi, FAULT_BLOCK)) {
		release = *count;
		goto release_quota;
	}

	/*
	 * let's increase this in prior to actual block count change in order
	 * for f2fs_sync_file to avoid data races when deciding checkpoint.
	 */
	percpu_counter_add(&sbi->alloc_valid_block_count, (*count));

	spin_lock(&sbi->stat_lock);

	avail_user_block_count = get_available_block_count(sbi, inode, true);
	diff = (long long)sbi->total_valid_block_count + *count -
						avail_user_block_count;
	if (unlikely(diff > 0)) {
		if (!partial) {
			spin_unlock(&sbi->stat_lock);
			release = *count;
			goto enospc;
		}
		if (diff > *count)
			diff = *count;
		*count -= diff;
		release = diff;
		if (!*count) {
			spin_unlock(&sbi->stat_lock);
			goto enospc;
		}
	}
	sbi->total_valid_block_count += (block_t)(*count);

	spin_unlock(&sbi->stat_lock);

	if (unlikely(release)) {
		percpu_counter_sub(&sbi->alloc_valid_block_count, release);
		dquot_release_reservation_block(inode, release);
	}
	f2fs_i_blocks_write(inode, *count, true, true);
	return 0;

enospc:
	percpu_counter_sub(&sbi->alloc_valid_block_count, release);
release_quota:
	dquot_release_reservation_block(inode, release);
	return -ENOSPC;
}

#define PAGE_PRIVATE_GET_FUNC(name, flagname) \
static inline bool folio_test_f2fs_##name(const struct folio *folio)	\
{									\
	unsigned long priv = (unsigned long)folio->private;		\
	unsigned long v = (1UL << PAGE_PRIVATE_NOT_POINTER) |		\
			     (1UL << PAGE_PRIVATE_##flagname);		\
	return (priv & v) == v;						\
}									\
static inline bool page_private_##name(struct page *page) \
{ \
	return PagePrivate(page) && \
		test_bit(PAGE_PRIVATE_NOT_POINTER, &page_private(page)) && \
		test_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \
}

#define PAGE_PRIVATE_SET_FUNC(name, flagname) \
static inline void folio_set_f2fs_##name(struct folio *folio)		\
{									\
	unsigned long v = (1UL << PAGE_PRIVATE_NOT_POINTER) |		\
			     (1UL << PAGE_PRIVATE_##flagname);		\
	if (!folio->private)						\
		folio_attach_private(folio, (void *)v);			\
	else {								\
		v |= (unsigned long)folio->private;			\
		folio->private = (void *)v;				\
	}								\
}									\
static inline void set_page_private_##name(struct page *page) \
{ \
	if (!PagePrivate(page)) \
		attach_page_private(page, (void *)0); \
	set_bit(PAGE_PRIVATE_NOT_POINTER, &page_private(page)); \
	set_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \
}

#define PAGE_PRIVATE_CLEAR_FUNC(name, flagname) \
static inline void folio_clear_f2fs_##name(struct folio *folio)		\
{									\
	unsigned long v = (unsigned long)folio->private;		\
									\
	v &= ~(1UL << PAGE_PRIVATE_##flagname);				\
	if (v == (1UL << PAGE_PRIVATE_NOT_POINTER))			\
		folio_detach_private(folio);				\
	else								\
		folio->private = (void *)v;				\
}									\
static inline void clear_page_private_##name(struct page *page) \
{ \
	clear_bit(PAGE_PRIVATE_##flagname, &page_private(page)); \
	if (page_private(page) == BIT(PAGE_PRIVATE_NOT_POINTER)) \
		detach_page_private(page); \
}

PAGE_PRIVATE_GET_FUNC(nonpointer, NOT_POINTER);
PAGE_PRIVATE_GET_FUNC(inline, INLINE_INODE);
PAGE_PRIVATE_GET_FUNC(gcing, ONGOING_MIGRATION);
PAGE_PRIVATE_GET_FUNC(atomic, ATOMIC_WRITE);

PAGE_PRIVATE_SET_FUNC(reference, REF_RESOURCE);
PAGE_PRIVATE_SET_FUNC(inline, INLINE_INODE);
PAGE_PRIVATE_SET_FUNC(gcing, ONGOING_MIGRATION);
PAGE_PRIVATE_SET_FUNC(atomic, ATOMIC_WRITE);

PAGE_PRIVATE_CLEAR_FUNC(reference, REF_RESOURCE);
PAGE_PRIVATE_CLEAR_FUNC(inline, INLINE_INODE);
PAGE_PRIVATE_CLEAR_FUNC(gcing, ONGOING_MIGRATION);
PAGE_PRIVATE_CLEAR_FUNC(atomic, ATOMIC_WRITE);

static inline unsigned long folio_get_f2fs_data(struct folio *folio)
{
	unsigned long data = (unsigned long)folio->private;

	if (!test_bit(PAGE_PRIVATE_NOT_POINTER, &data))
		return 0;
	return data >> PAGE_PRIVATE_MAX;
}

static inline void folio_set_f2fs_data(struct folio *folio, unsigned long data)
{
	data = (1UL << PAGE_PRIVATE_NOT_POINTER) | (data << PAGE_PRIVATE_MAX);

	if (!folio_test_private(folio))
		folio_attach_private(folio, (void *)data);
	else
		folio->private = (void *)((unsigned long)folio->private | data);
}

static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,
						struct inode *inode,
						block_t count)
{
	blkcnt_t sectors = count << F2FS_LOG_SECTORS_PER_BLOCK;

	spin_lock(&sbi->stat_lock);
	if (unlikely(sbi->total_valid_block_count < count)) {
		f2fs_warn(sbi, "Inconsistent total_valid_block_count:%u, ino:%llu, count:%u",
			  sbi->total_valid_block_count, inode->i_ino, count);
		sbi->total_valid_block_count = 0;
		set_sbi_flag(sbi, SBI_NEED_FSCK);
	} else {
		sbi->total_valid_block_count -= count;
	}
	if (sbi->reserved_blocks &&
		sbi->current_reserved_blocks < sbi->reserved_blocks)
		sbi->current_reserved_blocks = min(sbi->reserved_blocks,
					sbi->current_reserved_blocks + count);
	spin_unlock(&sbi->stat_lock);
	if (unlikely(inode->i_blocks < sectors)) {
		f2fs_warn(sbi, "Inconsistent i_blocks, ino:%llu, iblocks:%llu, sectors:%llu",
			  inode->i_ino,
			  (unsigned long long)inode->i_blocks,
			  (unsigned long long)sectors);
		set_sbi_flag(sbi, SBI_NEED_FSCK);
		return;
	}
	f2fs_i_blocks_write(inode, count, false, true);
}

static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type)
{
	atomic_inc(&sbi->nr_pages[count_type]);

	if (count_type == F2FS_DIRTY_DENTS ||
			count_type == F2FS_DIRTY_NODES ||
			count_type == F2FS_DIRTY_META ||
			count_type == F2FS_DIRTY_QDATA ||
			count_type == F2FS_DIRTY_IMETA)
		set_sbi_flag(sbi, SBI_IS_DIRTY);
}

static inline void inode_inc_dirty_pages(struct inode *inode)
{
	atomic_inc(&F2FS_I(inode)->dirty_pages);
	inc_page_count(F2FS_I_SB(inode), S_ISDIR(inode->i_mode) ?
				F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA);
	if (IS_NOQUOTA(inode))
		inc_page_count(F2FS_I_SB(inode), F2FS_DIRTY_QDATA);
}

static inline void dec_page_count(struct f2fs_sb_info *sbi, int count_type)
{
	atomic_dec(&sbi->nr_pages[count_type]);
}

static inline void inode_dec_dirty_pages(struct inode *inode)
{
	if (!S_ISDIR(inode->i_mode) && !S_ISREG(inode->i_mode) &&
			!S_ISLNK(inode->i_mode))
		return;

	atomic_dec(&F2FS_I(inode)->dirty_pages);
	dec_page_count(F2FS_I_SB(inode), S_ISDIR(inode->i_mode) ?
				F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA);
	if (IS_NOQUOTA(inode))
		dec_page_count(F2FS_I_SB(inode), F2FS_DIRTY_QDATA);
}

static inline void inc_atomic_write_cnt(struct inode *inode)
{
	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
	struct f2fs_inode_info *fi = F2FS_I(inode);
	u64 current_write;

	fi->atomic_write_cnt++;
	atomic64_inc(&sbi->current_atomic_write);
	current_write = atomic64_read(&sbi->current_atomic_write);
	if (current_write > sbi->peak_atomic_write)
		sbi->peak_atomic_write = current_write;
}

static inline void release_atomic_write_cnt(struct inode *inode)
{
	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
	struct f2fs_inode_info *fi = F2FS_I(inode);

	atomic64_sub(fi->atomic_write_cnt, &sbi->current_atomic_write);
	fi->atomic_write_cnt = 0;
}

static inline s64 get_pages(struct f2fs_sb_info *sbi, int count_type)
{
	return atomic_read(&sbi->nr_pages[count_type]);
}

static inline int get_dirty_pages(struct inode *inode)
{
	return atomic_read(&F2FS_I(inode)->dirty_pages);
}

static inline int get_blocktype_secs(struct f2fs_sb_info *sbi, int block_type)
{
	return div_u64(get_pages(sbi, block_type) + BLKS_PER_SEC(sbi) - 1,
							BLKS_PER_SEC(sbi));
}

static inline block_t valid_user_blocks(struct f2fs_sb_info *sbi)
{
	return sbi->total_valid_block_count;
}

static inline block_t discard_blocks(struct f2fs_sb_info *sbi)
{
	return sbi->discard_blks;
}

static inline unsigned long __bitmap_size(struct f2fs_sb_info *sbi, int flag)
{
	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);

	/* return NAT or SIT bitmap */
	if (flag == NAT_BITMAP)
		return le32_to_cpu(ckpt->nat_ver_bitmap_bytesize);
	else if (flag == SIT_BITMAP)
		return le32_to_cpu(ckpt->sit_ver_bitmap_bytesize);

	return 0;
}

static inline block_t __cp_payload(struct f2fs_sb_info *sbi)
{
	return le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_payload);
}

static inline void *__bitmap_ptr(struct f2fs_sb_info *sbi, int flag)
{
	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
	void *tmp_ptr = &ckpt->sit_nat_version_bitmap;
	int offset;

	if (is_set_ckpt_flags(sbi, CP_LARGE_NAT_BITMAP_FLAG)) {
		offset = (flag == SIT_BITMAP) ?
			le32_to_cpu(ckpt->nat_ver_bitmap_bytesize) : 0;
		/*
		 * if large_nat_bitmap feature is enabled, leave checksum
		 * protection for all nat/sit bitmaps.
		 */
		return tmp_ptr + offset + sizeof(__le32);
	}

	if (__cp_payload(sbi) > 0) {
		if (flag == NAT_BITMAP)
			return tmp_ptr;
		else
			return (unsigned char *)ckpt + F2FS_BLKSIZE;
	} else {
		offset = (flag == NAT_BITMAP) ?
			le32_to_cpu(ckpt->sit_ver_bitmap_bytesize) : 0;
		return tmp_ptr + offset;
	}
}

static inline block_t __start_cp_addr(struct f2fs_sb_info *sbi)
{
	block_t start_addr = le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_blkaddr);

	if (sbi->cur_cp_pack == 2)
		start_addr += BLKS_PER_SEG(sbi);
	return start_addr;
}

static inline block_t __start_cp_next_addr(struct f2fs_sb_info *sbi)
{
	block_t start_addr = le32_to_cpu(F2FS_RAW_SUPER(sbi)->cp_blkaddr);

	if (sbi->cur_cp_pack == 1)
		start_addr += BLKS_PER_SEG(sbi);
	return start_addr;
}

static inline void __set_cp_next_pack(struct f2fs_sb_info *sbi)
{
	sbi->cur_cp_pack = (sbi->cur_cp_pack == 1) ? 2 : 1;
}

static inline block_t __start_sum_addr(struct f2fs_sb_info *sbi)
{
	return le32_to_cpu(F2FS_CKPT(sbi)->cp_pack_start_sum);
}

static inline bool __has_cursum_space(struct f2fs_sb_info *sbi,
		struct f2fs_journal *journal, unsigned int size, int type)
{
	if (type == NAT_JOURNAL)
		return size <= MAX_NAT_JENTRIES(sbi, journal);
	return size <= MAX_SIT_JENTRIES(sbi, journal);
}

extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
static inline int inc_valid_node_count(struct f2fs_sb_info *sbi,
					struct inode *inode, bool is_inode)
{
	block_t	valid_block_count;
	unsigned int valid_node_count, avail_user_node_count;
	unsigned int avail_user_block_count;
	int err;

	if (is_inode) {
		if (inode) {
			err = dquot_alloc_inode(inode);
			if (err)
				return err;
		}
	} else {
		err = dquot_reserve_block(inode, 1);
		if (err)
			return err;
	}

	if (time_to_inject(sbi, FAULT_BLOCK))
		goto enospc;

	spin_lock(&sbi->stat_lock);

	valid_block_count = sbi->total_valid_block_count + 1;
	avail_user_block_count = get_available_block_count(sbi, inode,
			test_opt(sbi, RESERVE_NODE));

	if (unlikely(valid_block_count > avail_user_block_count)) {
		spin_unlock(&sbi->stat_lock);
		goto enospc;
	}

	avail_user_node_count = sbi->total_node_count - F2FS_RESERVED_NODE_NUM;
	if (test_opt(sbi, RESERVE_NODE) &&
			!__allow_reserved_root(sbi, inode, true))
		avail_user_node_count -= F2FS_OPTION(sbi).root_reserved_nodes;
	valid_node_count = sbi->total_valid_node_count + 1;
	if (unlikely(valid_node_count > avail_user_node_count)) {
		spin_unlock(&sbi->stat_lock);
		goto enospc;
	}

	sbi->total_valid_node_count++;
	sbi->total_valid_block_count++;
	spin_unlock(&sbi->stat_lock);

	if (inode) {
		if (is_inode)
			f2fs_mark_inode_dirty_sync(inode, true);
		else
			f2fs_i_blocks_write(inode, 1, true, true);
	}

	percpu_counter_inc(&sbi->alloc_valid_block_count);
	return 0;

enospc:
	if (is_inode) {
		if (inode)
			dquot_free_inode(inode);
	} else {
		dquot_release_reservation_block(inode, 1);
	}
	return -ENOSPC;
}

static inline void dec_valid_node_count(struct f2fs_sb_info *sbi,
					struct inode *inode, bool is_inode)
{
	spin_lock(&sbi->stat_lock);

	if (unlikely(!sbi->total_valid_block_count ||
			!sbi->total_valid_node_count)) {
		f2fs_warn(sbi, "dec_valid_node_count: inconsistent block counts, total_valid_block:%u, total_valid_node:%u",
			  sbi->total_valid_block_count,
			  sbi->total_valid_node_count);
		set_sbi_flag(sbi, SBI_NEED_FSCK);
	} else {
		sbi->total_valid_block_count--;
		sbi->total_valid_node_count--;
	}

	if (sbi->reserved_blocks &&
		sbi->current_reserved_blocks < sbi->reserved_blocks)
		sbi->current_reserved_blocks++;

	spin_unlock(&sbi->stat_lock);

	if (is_inode) {
		dquot_free_inode(inode);
	} else {
		if (unlikely(inode->i_blocks == 0)) {
			f2fs_warn(sbi, "dec_valid_node_count: inconsistent i_blocks, ino:%llu, iblocks:%llu",
				  inode->i_ino,
				  (unsigned long long)inode->i_blocks);
			set_sbi_flag(sbi, SBI_NEED_FSCK);
			return;
		}
		f2fs_i_blocks_write(inode, 1, false, true);
	}
}

static inline unsigned int valid_node_count(struct f2fs_sb_info *sbi)
{
	return sbi->total_valid_node_count;
}

static inline void inc_valid_inode_count(struct f2fs_sb_info *sbi)
{
	percpu_counter_inc(&sbi->total_valid_inode_count);
}

static inline void dec_valid_inode_count(struct f2fs_sb_info *sbi)
{
	percpu_counter_dec(&sbi->total_valid_inode_count);
}

static inline s64 valid_inode_count(struct f2fs_sb_info *sbi)
{
	return percpu_counter_sum_positive(&sbi->total_valid_inode_count);
}

static inline struct folio *f2fs_grab_cache_folio(struct address_space *mapping,
		pgoff_t index, bool for_write)
{
	struct folio *folio;
	unsigned int flags;

	if (IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION)) {
		fgf_t fgf_flags;

		if (!for_write)
			fgf_flags = FGP_LOCK | FGP_ACCESSED;
		else
			fgf_flags = FGP_LOCK;
		folio = __filemap_get_folio(mapping, index, fgf_flags, 0);
		if (!IS_ERR(folio))
			return folio;

		if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_ALLOC))
			return ERR_PTR(-ENOMEM);
	}

	if (!for_write)
		return filemap_grab_folio(mapping, index);

	flags = memalloc_nofs_save();
	folio = __filemap_get_folio(mapping, index, FGP_WRITEBEGIN,
			mapping_gfp_mask(mapping));
	memalloc_nofs_restore(flags);

	return folio;
}

static inline struct folio *f2fs_filemap_get_folio(
				struct address_space *mapping, pgoff_t index,
				fgf_t fgp_flags, gfp_t gfp_mask)
{
	if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_GET))
		return ERR_PTR(-ENOMEM);

	return __filemap_get_folio(mapping, index, fgp_flags, gfp_mask);
}

static inline void f2fs_folio_put(struct folio *folio, bool unlock)
{
	if (IS_ERR_OR_NULL(folio))
		return;

	if (unlock) {
		f2fs_bug_on(F2FS_F_SB(folio), !folio_test_locked(folio));
		folio_unlock(folio);
	}
	folio_put(folio);
}

static inline void f2fs_put_page(struct page *page, bool unlock)
{
	if (!page)
		return;
	f2fs_folio_put(page_folio(page), unlock);
}

static inline void f2fs_put_dnode(struct dnode_of_data *dn)
{
	if (dn->node_folio)
		f2fs_folio_put(dn->node_folio, true);
	if (dn->inode_folio && dn->node_folio != dn->inode_folio)
		f2fs_folio_put(dn->inode_folio, false);
	dn->node_folio = NULL;
	dn->inode_folio = NULL;
}

static inline struct kmem_cache *f2fs_kmem_cache_create(const char *name,
					size_t size)
{
	return kmem_cache_create(name, size, 0, SLAB_RECLAIM_ACCOUNT, NULL);
}

static inline void *f2fs_kmem_cache_alloc_nofail(struct kmem_cache *cachep,
						gfp_t flags)
{
	void *entry;

	entry = kmem_cache_alloc(cachep, flags);
	if (!entry)
		entry = kmem_cache_alloc(cachep, flags | __GFP_NOFAIL);
	return entry;
}

static inline void *f2fs_kmem_cache_alloc(struct kmem_cache *cachep,
			gfp_t flags, bool nofail, struct f2fs_sb_info *sbi)
{
	if (nofail)
		return f2fs_kmem_cache_alloc_nofail(cachep, flags);

	if (time_to_inject(sbi, FAULT_SLAB_ALLOC))
		return NULL;

	return kmem_cache_alloc(cachep, flags);
}

static inline bool is_inflight_io(struct f2fs_sb_info *sbi, int type)
{
	if (get_pages(sbi, F2FS_RD_DATA) || get_pages(sbi, F2FS_RD_NODE) ||
		get_pages(sbi, F2FS_RD_META) || get_pages(sbi, F2FS_WB_DATA) ||
		get_pages(sbi, F2FS_WB_CP_DATA) ||
		get_pages(sbi, F2FS_DIO_READ) ||
		get_pages(sbi, F2FS_DIO_WRITE))
		return true;

	if (type != DISCARD_TIME && SM_I(sbi) && SM_I(sbi)->dcc_info &&
			atomic_read(&SM_I(sbi)->dcc_info->queued_discard))
		return true;

	if (SM_I(sbi) && SM_I(sbi)->fcc_info &&
			atomic_read(&SM_I(sbi)->fcc_info->queued_flush))
		return true;
	return false;
}

static inline bool is_inflight_read_io(struct f2fs_sb_info *sbi)
{
	return get_pages(sbi, F2FS_RD_DATA) || get_pages(sbi, F2FS_DIO_READ);
}

static inline bool is_idle(struct f2fs_sb_info *sbi, int type)
{
	bool zoned_gc = (type == GC_TIME &&
			F2FS_HAS_FEATURE(sbi, F2FS_FEATURE_BLKZONED));

	if (sbi->gc_mode == GC_URGENT_HIGH)
		return true;

	if (sbi->bggc_io_aware == AWARE_READ_IO && is_inflight_read_io(sbi))
		return false;
	if (sbi->bggc_io_aware == AWARE_ALL_IO && is_inflight_io(sbi, type))
		return false;

	if (sbi->gc_mode == GC_URGENT_MID)
		return true;

	if (sbi->gc_mode == GC_URGENT_LOW &&
			(type == DISCARD_TIME || type == GC_TIME))
		return true;

	if (zoned_gc)
		return true;

	return f2fs_time_over(sbi, type);
}

static inline void f2fs_radix_tree_insert(struct radix_tree_root *root,
				unsigned long index, void *item)
{
	while (radix_tree_insert(root, index, item))
		cond_resched();
}

#define RAW_IS_INODE(p)	((p)->footer.nid == (p)->footer.ino)

static inline bool IS_INODE(const struct folio *folio)
{
	struct f2fs_node *p = F2FS_NODE(folio);

	return RAW_IS_INODE(p);
}

static inline int offset_in_addr(struct f2fs_inode *i)
{
	return (i->i_inline & F2FS_EXTRA_ATTR) ?
			(le16_to_cpu(i->i_extra_isize) / sizeof(__le32)) : 0;
}

static inline __le32 *blkaddr_in_node(struct f2fs_node *node)
{
	return RAW_IS_INODE(node) ? node->i.i_addr : node->dn.addr;
}

static inline int f2fs_has_extra_attr(struct inode *inode);
static inline unsigned int get_dnode_base(struct inode *inode,
					struct folio *node_folio)
{
	if (!IS_INODE(node_folio))
		return 0;

	return inode ? get_extra_isize(inode) :
			offset_in_addr(&F2FS_NODE(node_folio)->i);
}

static inline __le32 *get_dnode_addr(struct inode *inode,
					struct folio *node_folio)
{
	return blkaddr_in_node(F2FS_NODE(node_folio)) +
			get_dnode_base(inode, node_folio);
}

static inline block_t data_blkaddr(struct inode *inode,
			struct folio *node_folio, unsigned int offset)
{
	return le32_to_cpu(*(get_dnode_addr(inode, node_folio) + offset));
}

static inline block_t f2fs_data_blkaddr(struct dnode_of_data *dn)
{
	return data_blkaddr(dn->inode, dn->node_folio, dn->ofs_in_node);
}

static inline int f2fs_test_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	return mask & *addr;
}

static inline void f2fs_set_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	*addr |= mask;
}

static inline void f2fs_clear_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	*addr &= ~mask;
}

static inline int f2fs_test_and_set_bit(unsigned int nr, char *addr)
{
	int mask;
	int ret;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	ret = mask & *addr;
	*addr |= mask;
	return ret;
}

static inline int f2fs_test_and_clear_bit(unsigned int nr, char *addr)
{
	int mask;
	int ret;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	ret = mask & *addr;
	*addr &= ~mask;
	return ret;
}

static inline void f2fs_change_bit(unsigned int nr, char *addr)
{
	int mask;

	addr += (nr >> 3);
	mask = BIT(7 - (nr & 0x07));
	*addr ^= mask;
}

/*
 * On-disk inode flags (f2fs_inode::i_flags)
 */
#define F2FS_COMPR_FL			0x00000004 /* Compress file */
#define F2FS_SYNC_FL			0x00000008 /* Synchronous updates */
#define F2FS_IMMUTABLE_FL		0x00000010 /* Immutable file */
#define F2FS_APPEND_FL			0x00000020 /* writes to file may only append */
#define F2FS_NODUMP_FL			0x00000040 /* do not dump file */
#define F2FS_NOATIME_FL			0x00000080 /* do not update atime */
#define F2FS_NOCOMP_FL			0x00000400 /* Don't compress */
#define F2FS_INDEX_FL			0x00001000 /* hash-indexed directory */
#define F2FS_DIRSYNC_FL			0x00010000 /* dirsync behaviour (directories only) */
#define F2FS_PROJINHERIT_FL		0x20000000 /* Create with parents projid */
#define F2FS_CASEFOLD_FL		0x40000000 /* Casefolded file */
#define F2FS_DEVICE_ALIAS_FL		0x80000000 /* File for aliasing a device */

#define F2FS_QUOTA_DEFAULT_FL		(F2FS_NOATIME_FL | F2FS_IMMUTABLE_FL)

/* Flags that should be inherited by new inodes from their parent. */
#define F2FS_FL_INHERITED (F2FS_SYNC_FL | F2FS_NODUMP_FL | F2FS_NOATIME_FL | \
			   F2FS_DIRSYNC_FL | F2FS_PROJINHERIT_FL | \
			   F2FS_CASEFOLD_FL)

/* Flags that are appropriate for regular files (all but dir-specific ones). */
#define F2FS_REG_FLMASK		(~(F2FS_DIRSYNC_FL | F2FS_PROJINHERIT_FL | \
				F2FS_CASEFOLD_FL))

/* Flags that are appropriate for non-directories/regular files. */
#define F2FS_OTHER_FLMASK	(F2FS_NODUMP_FL | F2FS_NOATIME_FL)

#define IS_DEVICE_ALIASING(inode)	(F2FS_I(inode)->i_flags & F2FS_DEVICE_ALIAS_FL)

static inline __u32 f2fs_mask_flags(umode_t mode, __u32 flags)
{
	if (S_ISDIR(mode))
		return flags;
	else if (S_ISREG(mode))
		return flags & F2FS_REG_FLMASK;
	else
		return flags & F2FS_OTHER_FLMASK;
}

static inline void __mark_inode_dirty_flag(struct inode *inode,
						int flag, bool set)
{
	switch (flag) {
	case FI_INLINE_XATTR:
	case FI_INLINE_DATA:
	case FI_INLINE_DENTRY:
	case FI_NEW_INODE:
		if (set)
			return;
		fallthrough;
	case FI_DATA_EXIST:
	case FI_PIN_FILE:
	case FI_COMPRESS_RELEASED:
		f2fs_mark_inode_dirty_sync(inode, true);
	}
}

static inline void set_inode_flag(struct inode *inode, int flag)
{
	set_bit(flag, F2FS_I(inode)->flags);
	__mark_inode_dirty_flag(inode, flag, true);
}

static inline int is_inode_flag_set(struct inode *inode, int flag)
{
	return test_bit(flag, F2FS_I(inode)->flags);
}

static inline void clear_inode_flag(struct inode *inode, int flag)
{
	clear_bit(flag, F2FS_I(inode)->flags);
	__mark_inode_dirty_flag(inode, flag, false);
}

static inline bool f2fs_verity_in_progress(struct inode *inode)
{
	return IS_ENABLED(CONFIG_FS_VERITY) &&
	       is_inode_flag_set(inode, FI_VERITY_IN_PROGRESS);
}

static inline void set_acl_inode(struct inode *inode, umode_t mode)
{
	F2FS_I(inode)->i_acl_mode = mode;
	set_inode_flag(inode, FI_ACL_MODE);
	f2fs_mark_inode_dirty_sync(inode, false);
}

static inline void f2fs_i_links_write(struct inode *inode, bool inc)
{
	if (inc)
		inc_nlink(inode);
	else
		drop_nlink(inode);
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_blocks_write(struct inode *inode,
					block_t diff, bool add, bool claim)
{
	bool clean = !is_inode_flag_set(inode, FI_DIRTY_INODE);
	bool recover = is_inode_flag_set(inode, FI_AUTO_RECOVER);

	/* add = 1, claim = 1 should be dquot_reserve_block in pair */
	if (add) {
		if (claim)
			dquot_claim_block(inode, diff);
		else
			dquot_alloc_block_nofail(inode, diff);
	} else {
		dquot_free_block(inode, diff);
	}

	f2fs_mark_inode_dirty_sync(inode, true);
	if (clean || recover)
		set_inode_flag(inode, FI_AUTO_RECOVER);
}

static inline bool f2fs_is_atomic_file(struct inode *inode);

static inline void f2fs_i_size_write(struct inode *inode, loff_t i_size)
{
	bool clean = !is_inode_flag_set(inode, FI_DIRTY_INODE);
	bool recover = is_inode_flag_set(inode, FI_AUTO_RECOVER);

	if (i_size_read(inode) == i_size)
		return;

	i_size_write(inode, i_size);

	if (f2fs_is_atomic_file(inode))
		return;

	f2fs_mark_inode_dirty_sync(inode, true);
	if (clean || recover)
		set_inode_flag(inode, FI_AUTO_RECOVER);
}

static inline void f2fs_i_depth_write(struct inode *inode, unsigned int depth)
{
	F2FS_I(inode)->i_current_depth = depth;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_gc_failures_write(struct inode *inode,
					unsigned int count)
{
	F2FS_I(inode)->i_gc_failures = count;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_xnid_write(struct inode *inode, nid_t xnid)
{
	F2FS_I(inode)->i_xattr_nid = xnid;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void f2fs_i_pino_write(struct inode *inode, nid_t pino)
{
	F2FS_I(inode)->i_pino = pino;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri)
{
	struct f2fs_inode_info *fi = F2FS_I(inode);

	if (ri->i_inline & F2FS_INLINE_XATTR)
		set_bit(FI_INLINE_XATTR, fi->flags);
	if (ri->i_inline & F2FS_INLINE_DATA)
		set_bit(FI_INLINE_DATA, fi->flags);
	if (ri->i_inline & F2FS_INLINE_DENTRY)
		set_bit(FI_INLINE_DENTRY, fi->flags);
	if (ri->i_inline & F2FS_DATA_EXIST)
		set_bit(FI_DATA_EXIST, fi->flags);
	if (ri->i_inline & F2FS_EXTRA_ATTR)
		set_bit(FI_EXTRA_ATTR, fi->flags);
	if (ri->i_inline & F2FS_PIN_FILE)
		set_bit(FI_PIN_FILE, fi->flags);
	if (ri->i_inline & F2FS_COMPRESS_RELEASED)
		set_bit(FI_COMPRESS_RELEASED, fi->flags);
}

static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri)
{
	ri->i_inline = 0;

	if (is_inode_flag_set(inode, FI_INLINE_XATTR))
		ri->i_inline |= F2FS_INLINE_XATTR;
	if (is_inode_flag_set(inode, FI_INLINE_DATA))
		ri->i_inline |= F2FS_INLINE_DATA;
	if (is_inode_flag_set(inode, FI_INLINE_DENTRY))
		ri->i_inline |= F2FS_INLINE_DENTRY;
	if (is_inode_flag_set(inode, FI_DATA_EXIST))
		ri->i_inline |= F2FS_DATA_EXIST;
	if (is_inode_flag_set(inode, FI_EXTRA_ATTR))
		ri->i_inline |= F2FS_EXTRA_ATTR;
	if (is_inode_flag_set(inode, FI_PIN_FILE))
		ri->i_inline |= F2FS_PIN_FILE;
	if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED))
		ri->i_inline |= F2FS_COMPRESS_RELEASED;
}

static inline int f2fs_has_extra_attr(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_EXTRA_ATTR);
}

static inline int f2fs_has_inline_xattr(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_INLINE_XATTR);
}

static inline int f2fs_compressed_file(struct inode *inode)
{
	return S_ISREG(inode->i_mode) &&
		is_inode_flag_set(inode, FI_COMPRESSED_FILE);
}

static inline bool f2fs_need_compress_data(struct inode *inode)
{
	int compress_mode = F2FS_OPTION(F2FS_I_SB(inode)).compress_mode;

	if (!f2fs_compressed_file(inode))
		return false;

	if (compress_mode == COMPR_MODE_FS)
		return true;
	else if (compress_mode == COMPR_MODE_USER &&
			is_inode_flag_set(inode, FI_ENABLE_COMPRESS))
		return true;

	return false;
}

static inline unsigned int addrs_per_page(struct inode *inode,
							bool is_inode)
{
	unsigned int addrs = is_inode ? (CUR_ADDRS_PER_INODE(inode) -
			get_inline_xattr_addrs(inode)) : DEF_ADDRS_PER_BLOCK;

	if (f2fs_compressed_file(inode))
		return ALIGN_DOWN(addrs, F2FS_I(inode)->i_cluster_size);
	return addrs;
}

static inline
void *inline_xattr_addr(struct inode *inode, const struct folio *folio)
{
	struct f2fs_inode *ri = F2FS_INODE(folio);

	return (void *)&(ri->i_addr[DEF_ADDRS_PER_INODE -
					get_inline_xattr_addrs(inode)]);
}

static inline int inline_xattr_size(struct inode *inode)
{
	if (f2fs_has_inline_xattr(inode))
		return get_inline_xattr_addrs(inode) * sizeof(__le32);
	return 0;
}

/*
 * Notice: check inline_data flag without inode page lock is unsafe.
 * It could change at any time by f2fs_convert_inline_folio().
 */
static inline int f2fs_has_inline_data(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_INLINE_DATA);
}

static inline int f2fs_exist_data(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_DATA_EXIST);
}

static inline int f2fs_is_mmap_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_MMAP_FILE);
}

static inline bool f2fs_is_pinned_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_PIN_FILE);
}

static inline bool f2fs_is_atomic_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_ATOMIC_FILE);
}

static inline bool f2fs_is_cow_file(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_COW_FILE);
}

static inline void *inline_data_addr(struct inode *inode, struct folio *folio)
{
	__le32 *addr = get_dnode_addr(inode, folio);

	return (void *)(addr + DEF_INLINE_RESERVED_SIZE);
}

static inline int f2fs_has_inline_dentry(struct inode *inode)
{
	return is_inode_flag_set(inode, FI_INLINE_DENTRY);
}

static inline int is_file(struct inode *inode, int type)
{
	return F2FS_I(inode)->i_advise & type;
}

static inline void set_file(struct inode *inode, int type)
{
	if (is_file(inode, type))
		return;
	F2FS_I(inode)->i_advise |= type;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline void clear_file(struct inode *inode, int type)
{
	if (!is_file(inode, type))
		return;
	F2FS_I(inode)->i_advise &= ~type;
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline bool f2fs_is_time_consistent(struct inode *inode)
{
	struct timespec64 ts = inode_get_atime(inode);

	if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &ts))
		return false;
	ts = inode_get_ctime(inode);
	if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &ts))
		return false;
	ts = inode_get_mtime(inode);
	if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &ts))
		return false;
	return true;
}

static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync)
{
	bool ret;

	if (dsync) {
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);

		spin_lock(&sbi->inode_lock[DIRTY_META]);
		ret = list_empty(&F2FS_I(inode)->gdirty_list);
		spin_unlock(&sbi->inode_lock[DIRTY_META]);
		return ret;
	}
	if (!is_inode_flag_set(inode, FI_AUTO_RECOVER) ||
			file_keep_isize(inode) ||
			i_size_read(inode) & ~PAGE_MASK)
		return false;

	if (!f2fs_is_time_consistent(inode))
		return false;

	spin_lock(&F2FS_I(inode)->i_size_lock);
	ret = F2FS_I(inode)->last_disk_size == i_size_read(inode);
	spin_unlock(&F2FS_I(inode)->i_size_lock);

	return ret;
}

static inline bool f2fs_readonly(struct super_block *sb)
{
	return sb_rdonly(sb);
}

static inline bool f2fs_cp_error(struct f2fs_sb_info *sbi)
{
	return is_set_ckpt_flags(sbi, CP_ERROR_FLAG);
}

static inline void *f2fs_kmalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	if (time_to_inject(sbi, FAULT_KMALLOC))
		return NULL;

	return kmalloc(size, flags);
}

static inline void *f2fs_getname(struct f2fs_sb_info *sbi)
{
	if (time_to_inject(sbi, FAULT_KMALLOC))
		return NULL;

	return __getname();
}

static inline void f2fs_putname(char *buf)
{
	__putname(buf);
}

static inline void *f2fs_kzalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	return f2fs_kmalloc(sbi, size, flags | __GFP_ZERO);
}

static inline void *f2fs_kvmalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	if (time_to_inject(sbi, FAULT_KVMALLOC))
		return NULL;

	return kvmalloc(size, flags);
}

static inline void *f2fs_kvzalloc(struct f2fs_sb_info *sbi,
					size_t size, gfp_t flags)
{
	return f2fs_kvmalloc(sbi, size, flags | __GFP_ZERO);
}

static inline void *f2fs_vmalloc(struct f2fs_sb_info *sbi, size_t size)
{
	if (time_to_inject(sbi, FAULT_VMALLOC))
		return NULL;

	return vmalloc(size);
}

static inline int get_extra_isize(struct inode *inode)
{
	return F2FS_I(inode)->i_extra_isize / sizeof(__le32);
}

static inline int get_inline_xattr_addrs(struct inode *inode)
{
	return F2FS_I(inode)->i_inline_xattr_size;
}

#define f2fs_get_inode_mode(i) \
	((is_inode_flag_set(i, FI_ACL_MODE)) ? \
	 (F2FS_I(i)->i_acl_mode) : ((i)->i_mode))

#define F2FS_MIN_EXTRA_ATTR_SIZE		(sizeof(__le32))

#define F2FS_TOTAL_EXTRA_ATTR_SIZE			\
	(offsetof(struct f2fs_inode, i_extra_end) -	\
	offsetof(struct f2fs_inode, i_extra_isize))	\

#define F2FS_OLD_ATTRIBUTE_SIZE	(offsetof(struct f2fs_inode, i_addr))
#define F2FS_FITS_IN_INODE(f2fs_inode, extra_isize, field)		\
		((offsetof(typeof(*(f2fs_inode)), field) +	\
		sizeof((f2fs_inode)->field))			\
		<= (F2FS_OLD_ATTRIBUTE_SIZE + (extra_isize)))	\

#define __is_large_section(sbi)		(SEGS_PER_SEC(sbi) > 1)

#define __is_meta_io(fio) (PAGE_TYPE_OF_BIO((fio)->type) == META)

bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type);
static inline void verify_blkaddr(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type)
{
	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type))
		f2fs_err(sbi, "invalid blkaddr: %u, type: %d, run fsck to fix.",
			 blkaddr, type);
}

static inline bool __is_valid_data_blkaddr(block_t blkaddr)
{
	if (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR ||
			blkaddr == COMPRESS_ADDR)
		return false;
	return true;
}

/*
 * file.c
 */
int f2fs_sync_file(struct file *file, loff_t start, loff_t end, int datasync);
int f2fs_do_truncate_blocks(struct inode *inode, u64 from, bool lock);
int f2fs_truncate_blocks(struct inode *inode, u64 from, bool lock);
int f2fs_truncate(struct inode *inode);
int f2fs_getattr(struct mnt_idmap *idmap, const struct path *path,
		 struct kstat *stat, u32 request_mask, unsigned int flags);
int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
		 struct iattr *attr);
int f2fs_truncate_hole(struct inode *inode, pgoff_t pg_start, pgoff_t pg_end);
void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count);
int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
						bool readonly, bool need_lock);
int f2fs_precache_extents(struct inode *inode);
int f2fs_fileattr_get(struct dentry *dentry, struct file_kattr *fa);
int f2fs_fileattr_set(struct mnt_idmap *idmap,
		      struct dentry *dentry, struct file_kattr *fa);
long f2fs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
long f2fs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid);
int f2fs_pin_file_control(struct inode *inode, bool inc);

/*
 * inode.c
 */
void f2fs_set_inode_flags(struct inode *inode);
bool f2fs_inode_chksum_verify(struct f2fs_sb_info *sbi, struct folio *folio);
void f2fs_inode_chksum_set(struct f2fs_sb_info *sbi, struct folio *folio);
struct inode *f2fs_iget(struct super_block *sb, unsigned long ino);
struct inode *f2fs_iget_retry(struct super_block *sb, unsigned long ino);
int f2fs_try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink);
void f2fs_update_inode(struct inode *inode, struct folio *node_folio);
void f2fs_update_inode_page(struct inode *inode);
int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc);
void f2fs_remove_donate_inode(struct inode *inode);
void f2fs_evict_inode(struct inode *inode);
void f2fs_handle_failed_inode(struct inode *inode, struct f2fs_lock_context *lc);

/*
 * namei.c
 */
int f2fs_update_extension_list(struct f2fs_sb_info *sbi, const char *name,
							bool hot, bool set);
struct dentry *f2fs_get_parent(struct dentry *child);
int f2fs_get_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
		     struct inode **new_inode);

/*
 * dir.c
 */
#if IS_ENABLED(CONFIG_UNICODE)
int f2fs_init_casefolded_name(const struct inode *dir,
			      struct f2fs_filename *fname);
void f2fs_free_casefolded_name(struct f2fs_filename *fname);
#else
static inline int f2fs_init_casefolded_name(const struct inode *dir,
					    struct f2fs_filename *fname)
{
	return 0;
}

static inline void f2fs_free_casefolded_name(struct f2fs_filename *fname)
{
}
#endif /* CONFIG_UNICODE */

int f2fs_setup_filename(struct inode *dir, const struct qstr *iname,
			int lookup, struct f2fs_filename *fname);
int f2fs_prepare_lookup(struct inode *dir, struct dentry *dentry,
			struct f2fs_filename *fname);
void f2fs_free_filename(struct f2fs_filename *fname);
struct f2fs_dir_entry *f2fs_find_target_dentry(const struct f2fs_dentry_ptr *d,
			const struct f2fs_filename *fname, int *max_slots,
			bool use_hash);
int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
			unsigned int start_pos, struct fscrypt_str *fstr);
void f2fs_do_make_empty_dir(struct inode *inode, struct inode *parent,
			struct f2fs_dentry_ptr *d);
struct folio *f2fs_init_inode_metadata(struct inode *inode, struct inode *dir,
		const struct f2fs_filename *fname, struct folio *dfolio);
void f2fs_update_parent_metadata(struct inode *dir, struct inode *inode,
			unsigned int current_depth);
int f2fs_room_for_filename(const void *bitmap, int slots, int max_slots);
void f2fs_drop_nlink(struct inode *dir, struct inode *inode);
struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir,
		const struct f2fs_filename *fname, struct folio **res_folio);
struct f2fs_dir_entry *f2fs_find_entry(struct inode *dir,
			const struct qstr *child, struct folio **res_folio);
struct f2fs_dir_entry *f2fs_parent_dir(struct inode *dir, struct folio **f);
ino_t f2fs_inode_by_name(struct inode *dir, const struct qstr *qstr,
			struct folio **folio);
void f2fs_set_link(struct inode *dir, struct f2fs_dir_entry *de,
			struct folio *folio, struct inode *inode);
bool f2fs_has_enough_room(struct inode *dir, struct folio *ifolio,
			  const struct f2fs_filename *fname);
void f2fs_update_dentry(nid_t ino, umode_t mode, struct f2fs_dentry_ptr *d,
			const struct fscrypt_str *name, f2fs_hash_t name_hash,
			unsigned int bit_pos);
int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
			struct inode *inode, nid_t ino, umode_t mode);
int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
			struct inode *inode, nid_t ino, umode_t mode);
int f2fs_do_add_link(struct inode *dir, const struct qstr *name,
			struct inode *inode, nid_t ino, umode_t mode);
void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct folio *folio,
			struct inode *dir, struct inode *inode);
int f2fs_do_tmpfile(struct inode *inode, struct inode *dir,
					struct f2fs_filename *fname);
bool f2fs_empty_dir(struct inode *dir);

static inline int f2fs_add_link(struct dentry *dentry, struct inode *inode)
{
	if (fscrypt_is_nokey_name(dentry))
		return -ENOKEY;
	return f2fs_do_add_link(d_inode(dentry->d_parent), &dentry->d_name,
				inode, inode->i_ino, inode->i_mode);
}

/*
 * super.c
 */
int f2fs_inode_dirtied(struct inode *inode, bool sync);
void f2fs_inode_synced(struct inode *inode);
int f2fs_dquot_initialize(struct inode *inode);
int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly);
int f2fs_do_quota_sync(struct super_block *sb, int type);
loff_t max_file_blocks(struct inode *inode);
void f2fs_quota_off_umount(struct super_block *sb);
void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
int f2fs_sync_fs(struct super_block *sb, int sync);
int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi);

/*
 * hash.c
 */
void f2fs_hash_filename(const struct inode *dir, struct f2fs_filename *fname);

/*
 * node.c
 */
struct node_info;
enum node_type;

int f2fs_check_nid_range(struct f2fs_sb_info *sbi, nid_t nid);
bool f2fs_available_free_memory(struct f2fs_sb_info *sbi, int type);
bool f2fs_in_warm_node_list(struct folio *folio);
void f2fs_init_fsync_node_info(struct f2fs_sb_info *sbi);
void f2fs_del_fsync_node_entry(struct f2fs_sb_info *sbi, struct folio *folio);
void f2fs_reset_fsync_node_info(struct f2fs_sb_info *sbi);
bool f2fs_need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid);
bool f2fs_is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid);
bool f2fs_need_inode_block_update(struct f2fs_sb_info *sbi, nid_t ino);
int f2fs_get_node_info(struct f2fs_sb_info *sbi, nid_t nid,
				struct node_info *ni, bool checkpoint_context);
pgoff_t f2fs_get_next_page_offset(struct dnode_of_data *dn, pgoff_t pgofs);
int f2fs_get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode);
int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from);
int f2fs_truncate_xattr_node(struct inode *inode);
int f2fs_wait_on_node_pages_writeback(struct f2fs_sb_info *sbi,
					unsigned int seq_id);
int f2fs_remove_inode_page(struct inode *inode);
struct folio *f2fs_new_inode_folio(struct inode *inode);
struct folio *f2fs_new_node_folio(struct dnode_of_data *dn, unsigned int ofs);
void f2fs_ra_node_page(struct f2fs_sb_info *sbi, nid_t nid);
struct folio *f2fs_get_node_folio(struct f2fs_sb_info *sbi, pgoff_t nid,
						enum node_type node_type);
int f2fs_sanity_check_node_footer(struct f2fs_sb_info *sbi,
					struct folio *folio, pgoff_t nid,
					enum node_type ntype, bool in_irq);
struct folio *f2fs_get_inode_folio(struct f2fs_sb_info *sbi, pgoff_t ino);
struct folio *f2fs_get_xnode_folio(struct f2fs_sb_info *sbi, pgoff_t xnid);
int f2fs_write_single_node_folio(struct folio *node_folio, int sync_mode,
			bool mark_dirty, enum iostat_type io_type);
int f2fs_move_node_folio(struct folio *node_folio, int gc_type);
void f2fs_flush_inline_data(struct f2fs_sb_info *sbi);
int f2fs_fsync_node_pages(struct f2fs_sb_info *sbi, struct inode *inode,
			struct writeback_control *wbc, bool atomic,
			unsigned int *seq_id);
int f2fs_sync_node_pages(struct f2fs_sb_info *sbi,
			struct writeback_control *wbc,
			bool do_balance, enum iostat_type io_type);
int f2fs_build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount);
bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);
void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid);
void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid);
int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink);
int f2fs_recover_inline_xattr(struct inode *inode, struct folio *folio);
int f2fs_recover_xattr_data(struct inode *inode, struct folio *folio);
int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct folio *folio);
int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
			unsigned int segno, struct f2fs_summary_block *sum);
int f2fs_flush_nat_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc);
int f2fs_build_node_manager(struct f2fs_sb_info *sbi);
void f2fs_destroy_node_manager(struct f2fs_sb_info *sbi);
int __init f2fs_create_node_manager_caches(void);
void f2fs_destroy_node_manager_caches(void);

/*
 * segment.c
 */
bool f2fs_need_SSR(struct f2fs_sb_info *sbi);
int f2fs_commit_atomic_write(struct inode *inode);
void f2fs_abort_atomic_write(struct inode *inode, bool clean);
void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need);
void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi, bool from_bg);
int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino);
int f2fs_create_flush_cmd_control(struct f2fs_sb_info *sbi);
int f2fs_flush_device_cache(struct f2fs_sb_info *sbi);
void f2fs_destroy_flush_cmd_control(struct f2fs_sb_info *sbi, bool free);
void f2fs_invalidate_blocks(struct f2fs_sb_info *sbi, block_t addr,
						unsigned int len);
bool f2fs_is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
int f2fs_start_discard_thread(struct f2fs_sb_info *sbi);
void f2fs_drop_discard_cmd(struct f2fs_sb_info *sbi);
void f2fs_stop_discard_thread(struct f2fs_sb_info *sbi);
bool f2fs_issue_discard_timeout(struct f2fs_sb_info *sbi, bool need_check);
void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi,
					struct cp_control *cpc);
void f2fs_dirty_to_prefree(struct f2fs_sb_info *sbi);
block_t f2fs_get_unusable_blocks(struct f2fs_sb_info *sbi);
int f2fs_disable_cp_again(struct f2fs_sb_info *sbi, block_t unusable);
void f2fs_release_discard_addrs(struct f2fs_sb_info *sbi);
int f2fs_npages_for_summary_flush(struct f2fs_sb_info *sbi, bool for_ra);
bool f2fs_segment_has_free_slot(struct f2fs_sb_info *sbi, int segno);
int f2fs_init_inmem_curseg(struct f2fs_sb_info *sbi);
int f2fs_reinit_atgc_curseg(struct f2fs_sb_info *sbi);
void f2fs_save_inmem_curseg(struct f2fs_sb_info *sbi);
void f2fs_restore_inmem_curseg(struct f2fs_sb_info *sbi);
int f2fs_allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type,
					unsigned int start, unsigned int end);
int f2fs_allocate_new_section(struct f2fs_sb_info *sbi, int type, bool force);
int f2fs_allocate_pinning_section(struct f2fs_sb_info *sbi);
int f2fs_allocate_new_segments(struct f2fs_sb_info *sbi);
int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range);
bool f2fs_exist_trim_candidates(struct f2fs_sb_info *sbi,
					struct cp_control *cpc);
struct folio *f2fs_get_sum_folio(struct f2fs_sb_info *sbi, unsigned int segno);
void f2fs_update_meta_page(struct f2fs_sb_info *sbi, void *src,
					block_t blk_addr);
void f2fs_do_write_meta_page(struct f2fs_sb_info *sbi, struct folio *folio,
						enum iostat_type io_type);
void f2fs_do_write_node_page(unsigned int nid, struct f2fs_io_info *fio);
void f2fs_outplace_write_data(struct dnode_of_data *dn,
			struct f2fs_io_info *fio);
int f2fs_inplace_write_data(struct f2fs_io_info *fio);
void f2fs_do_replace_block(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
			block_t old_blkaddr, block_t new_blkaddr,
			bool recover_curseg, bool recover_newaddr,
			bool from_gc);
void f2fs_replace_block(struct f2fs_sb_info *sbi, struct dnode_of_data *dn,
			block_t old_addr, block_t new_addr,
			unsigned char version, bool recover_curseg,
			bool recover_newaddr);
enum temp_type f2fs_get_segment_temp(struct f2fs_sb_info *sbi,
						enum log_type seg_type);
int f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct folio *folio,
			block_t old_blkaddr, block_t *new_blkaddr,
			struct f2fs_summary *sum, int type,
			struct f2fs_io_info *fio);
void f2fs_update_device_state(struct f2fs_sb_info *sbi, nid_t ino,
					block_t blkaddr, unsigned int blkcnt);
void f2fs_folio_wait_writeback(struct folio *folio, enum page_type type,
		bool ordered, bool locked);
#define f2fs_wait_on_page_writeback(page, type, ordered, locked)	\
		f2fs_folio_wait_writeback(page_folio(page), type, ordered, locked)
void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr);
void f2fs_wait_on_block_writeback_range(struct inode *inode, block_t blkaddr,
								block_t len);
void f2fs_write_data_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
void f2fs_write_node_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
int f2fs_lookup_journal_in_cursum(struct f2fs_sb_info *sbi,
			struct f2fs_journal *journal, int type,
			unsigned int val, int alloc);
void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc);
int f2fs_check_and_fix_write_pointer(struct f2fs_sb_info *sbi);
int f2fs_build_segment_manager(struct f2fs_sb_info *sbi);
void f2fs_destroy_segment_manager(struct f2fs_sb_info *sbi);
int __init f2fs_create_segment_manager_caches(void);
void f2fs_destroy_segment_manager_caches(void);
int f2fs_rw_hint_to_seg_type(struct f2fs_sb_info *sbi, enum rw_hint hint);
enum rw_hint f2fs_io_type_to_rw_hint(struct f2fs_sb_info *sbi,
			enum page_type type, enum temp_type temp);
unsigned int f2fs_usable_segs_in_sec(struct f2fs_sb_info *sbi);
unsigned int f2fs_usable_blks_in_seg(struct f2fs_sb_info *sbi,
			unsigned int segno);
unsigned long long f2fs_get_section_mtime(struct f2fs_sb_info *sbi,
			unsigned int segno);

static inline struct inode *fio_inode(struct f2fs_io_info *fio)
{
	return fio->folio->mapping->host;
}

#define DEF_FRAGMENT_SIZE	4
#define MIN_FRAGMENT_SIZE	1
#define MAX_FRAGMENT_SIZE	512

static inline bool f2fs_need_rand_seg(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).fs_mode == FS_MODE_FRAGMENT_SEG ||
		F2FS_OPTION(sbi).fs_mode == FS_MODE_FRAGMENT_BLK;
}

/*
 * checkpoint.c
 */
void f2fs_lock_op(struct f2fs_sb_info *sbi, struct f2fs_lock_context *lc);
int f2fs_trylock_op(struct f2fs_sb_info *sbi, struct f2fs_lock_context *lc);
void f2fs_unlock_op(struct f2fs_sb_info *sbi, struct f2fs_lock_context *lc);
void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io,
							unsigned char reason);
void f2fs_flush_ckpt_thread(struct f2fs_sb_info *sbi);
struct folio *f2fs_grab_meta_folio(struct f2fs_sb_info *sbi, pgoff_t index);
struct folio *f2fs_get_meta_folio(struct f2fs_sb_info *sbi, pgoff_t index);
struct folio *f2fs_get_meta_folio_retry(struct f2fs_sb_info *sbi, pgoff_t index);
struct folio *f2fs_get_tmp_folio(struct f2fs_sb_info *sbi, pgoff_t index);
bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type);
bool f2fs_is_valid_blkaddr_raw(struct f2fs_sb_info *sbi,
					block_t blkaddr, int type);
int f2fs_ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
			int type, bool sync);
void f2fs_ra_meta_pages_cond(struct f2fs_sb_info *sbi, pgoff_t index,
							unsigned int ra_blocks);
long f2fs_sync_meta_pages(struct f2fs_sb_info *sbi, long nr_to_write,
			enum iostat_type io_type);
void f2fs_add_ino_entry(struct f2fs_sb_info *sbi, nid_t ino, int type);
void f2fs_remove_ino_entry(struct f2fs_sb_info *sbi, nid_t ino, int type);
void f2fs_release_ino_entry(struct f2fs_sb_info *sbi, bool all);
bool f2fs_exist_written_data(struct f2fs_sb_info *sbi, nid_t ino, int mode);
void f2fs_set_dirty_device(struct f2fs_sb_info *sbi, nid_t ino,
					unsigned int devidx, int type);
bool f2fs_is_dirty_device(struct f2fs_sb_info *sbi, nid_t ino,
					unsigned int devidx, int type);
int f2fs_acquire_orphan_inode(struct f2fs_sb_info *sbi);
void f2fs_release_orphan_inode(struct f2fs_sb_info *sbi);
void f2fs_add_orphan_inode(struct inode *inode);
void f2fs_remove_orphan_inode(struct f2fs_sb_info *sbi, nid_t ino);
int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi);
int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi);
void f2fs_update_dirty_folio(struct inode *inode, struct folio *folio);
void f2fs_remove_dirty_inode(struct inode *inode);
int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type,
								bool from_cp);
void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type);
u64 f2fs_get_sectors_written(struct f2fs_sb_info *sbi);
int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc);
void f2fs_init_ino_entry_info(struct f2fs_sb_info *sbi);
int __init f2fs_create_checkpoint_caches(void);
void f2fs_destroy_checkpoint_caches(void);
int f2fs_issue_checkpoint(struct f2fs_sb_info *sbi);
int f2fs_start_ckpt_thread(struct f2fs_sb_info *sbi);
void f2fs_stop_ckpt_thread(struct f2fs_sb_info *sbi);
void f2fs_init_ckpt_req_control(struct f2fs_sb_info *sbi);

/*
 * data.c
 */
int __init f2fs_init_bioset(void);
void f2fs_destroy_bioset(void);
bool f2fs_is_cp_guaranteed(const struct folio *folio);
int f2fs_init_bio_entry_cache(void);
void f2fs_destroy_bio_entry_cache(void);
void f2fs_submit_read_bio(struct f2fs_sb_info *sbi, struct bio *bio,
			  enum page_type type);
int f2fs_init_write_merge_io(struct f2fs_sb_info *sbi);
void f2fs_submit_merged_write(struct f2fs_sb_info *sbi, enum page_type type);
void f2fs_submit_merged_write_cond(struct f2fs_sb_info *sbi,
				struct inode *inode, struct folio *folio,
				nid_t ino, enum page_type type);
void f2fs_submit_merged_write_folio(struct f2fs_sb_info *sbi,
				struct folio *folio, enum page_type type);
void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
					struct bio **bio, struct folio *folio);
void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
int f2fs_submit_page_bio(struct f2fs_io_info *fio);
int f2fs_merge_page_bio(struct f2fs_io_info *fio);
void f2fs_submit_page_write(struct f2fs_io_info *fio);
struct block_device *f2fs_target_device(struct f2fs_sb_info *sbi,
		block_t blk_addr, sector_t *sector);
int f2fs_target_device_index(struct f2fs_sb_info *sbi, block_t blkaddr);
void f2fs_set_data_blkaddr(struct dnode_of_data *dn, block_t blkaddr);
void f2fs_update_data_blkaddr(struct dnode_of_data *dn, block_t blkaddr);
int f2fs_reserve_new_blocks(struct dnode_of_data *dn, blkcnt_t count);
int f2fs_reserve_new_block(struct dnode_of_data *dn);
int f2fs_get_block_locked(struct dnode_of_data *dn, pgoff_t index);
int f2fs_reserve_block(struct dnode_of_data *dn, pgoff_t index);
struct folio *f2fs_get_read_data_folio(struct inode *inode, pgoff_t index,
		blk_opf_t op_flags, bool for_write, pgoff_t *next_pgofs);
struct folio *f2fs_find_data_folio(struct inode *inode, pgoff_t index,
		pgoff_t *next_pgofs);
struct folio *f2fs_get_lock_data_folio(struct inode *inode, pgoff_t index,
			bool for_write);
struct folio *f2fs_get_new_data_folio(struct inode *inode,
			struct folio *ifolio, pgoff_t index, bool new_i_size);
int f2fs_do_write_data_page(struct f2fs_io_info *fio);
int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag);
int f2fs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
			u64 start, u64 len);
int f2fs_encrypt_one_page(struct f2fs_io_info *fio);
bool f2fs_should_update_inplace(struct inode *inode, struct f2fs_io_info *fio);
bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio);
int f2fs_write_single_data_page(struct folio *folio, int *submitted,
				struct bio **bio, sector_t *last_block,
				struct writeback_control *wbc,
				enum iostat_type io_type,
				int compr_blocks, bool allow_balance);
void f2fs_write_failed(struct inode *inode, loff_t to);
void f2fs_invalidate_folio(struct folio *folio, size_t offset, size_t length);
bool f2fs_release_folio(struct folio *folio, gfp_t wait);
bool f2fs_overwrite_io(struct inode *inode, loff_t pos, size_t len);
void f2fs_clear_page_cache_dirty_tag(struct folio *folio);
int f2fs_init_post_read_processing(void);
void f2fs_destroy_post_read_processing(void);
int f2fs_init_post_read_wq(struct f2fs_sb_info *sbi);
void f2fs_destroy_post_read_wq(struct f2fs_sb_info *sbi);
extern const struct iomap_ops f2fs_iomap_ops;

/*
 * gc.c
 */
int f2fs_start_gc_thread(struct f2fs_sb_info *sbi);
void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi);
block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode);
int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control);
void f2fs_build_gc_manager(struct f2fs_sb_info *sbi);
int f2fs_gc_range(struct f2fs_sb_info *sbi,
		unsigned int start_seg, unsigned int end_seg,
		bool dry_run, unsigned int dry_run_sections);
int f2fs_resize_fs(struct file *filp, __u64 block_count);
int __init f2fs_create_garbage_collection_cache(void);
void f2fs_destroy_garbage_collection_cache(void);
/* victim selection function for cleaning and SSR */
int f2fs_get_victim(struct f2fs_sb_info *sbi, unsigned int *result,
			int gc_type, int type, char alloc_mode,
			unsigned long long age, bool one_time);

/*
 * recovery.c
 */
int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only);
bool f2fs_space_for_roll_forward(struct f2fs_sb_info *sbi);
int __init f2fs_create_recovery_cache(void);
void f2fs_destroy_recovery_cache(void);

/*
 * debug.c
 */
#ifdef CONFIG_F2FS_STAT_FS
enum {
	DEVSTAT_INUSE,
	DEVSTAT_DIRTY,
	DEVSTAT_FULL,
	DEVSTAT_FREE,
	DEVSTAT_PREFREE,
	DEVSTAT_MAX,
};

struct f2fs_dev_stats {
	unsigned int devstats[2][DEVSTAT_MAX];		/* 0: segs, 1: secs */
};

struct f2fs_stat_info {
	struct list_head stat_list;
	struct f2fs_sb_info *sbi;
	int all_area_segs, sit_area_segs, nat_area_segs, ssa_area_segs;
	int main_area_segs, main_area_sections, main_area_zones;
	unsigned long long hit_cached[NR_EXTENT_CACHES];
	unsigned long long hit_rbtree[NR_EXTENT_CACHES];
	unsigned long long total_ext[NR_EXTENT_CACHES];
	unsigned long long hit_total[NR_EXTENT_CACHES];
	int ext_tree[NR_EXTENT_CACHES];
	int zombie_tree[NR_EXTENT_CACHES];
	int ext_node[NR_EXTENT_CACHES];
	/* to count memory footprint */
	unsigned long long ext_mem[NR_EXTENT_CACHES];
	/* for read extent cache */
	unsigned long long hit_largest;
	/* for block age extent cache */
	unsigned long long allocated_data_blocks;
	int ndirty_node, ndirty_dent, ndirty_meta, ndirty_imeta;
	int ndirty_data, ndirty_qdata;
	unsigned int ndirty_dirs, ndirty_files, ndirty_all;
	unsigned int nquota_files, ndonate_files;
	int nats, dirty_nats, sits, dirty_sits;
	int free_nids, avail_nids, alloc_nids;
	int total_count, utilization;
	int nr_wb_cp_data, nr_wb_data;
	int nr_rd_data, nr_rd_node, nr_rd_meta;
	int nr_dio_read, nr_dio_write;
	unsigned int io_skip_bggc, other_skip_bggc;
	int nr_flushing, nr_flushed, flush_list_empty;
	int nr_discarding, nr_discarded;
	int nr_discard_cmd;
	unsigned int undiscard_blks;
	int nr_issued_ckpt, nr_total_ckpt, nr_queued_ckpt;
	unsigned int cur_ckpt_time, peak_ckpt_time;
	int inline_xattr, inline_inode, inline_dir, append, update, orphans;
	int compr_inode, swapfile_inode;
	unsigned long long compr_blocks;
	int aw_cnt, max_aw_cnt;
	unsigned int valid_count, valid_node_count, valid_inode_count, discard_blks;
	unsigned int bimodal, avg_vblocks;
	int util_free, util_valid, util_invalid;
	int rsvd_segs, overp_segs;
	int dirty_count, node_pages, meta_pages, compress_pages;
	int compress_page_hit;
	int prefree_count, free_segs, free_secs;
	int cp_call_count[MAX_CALL_TYPE], cp_count;
	int gc_call_count[MAX_CALL_TYPE];
	int gc_segs[2][2];
	int gc_secs[2][2];
	int tot_blks, data_blks, node_blks;
	int bg_data_blks, bg_node_blks;
	unsigned int defrag_blks;
	int blkoff[NR_CURSEG_TYPE];
	int curseg[NR_CURSEG_TYPE];
	int cursec[NR_CURSEG_TYPE];
	int curzone[NR_CURSEG_TYPE];
	unsigned int dirty_seg[NR_CURSEG_TYPE];
	unsigned int full_seg[NR_CURSEG_TYPE];
	unsigned int valid_blks[NR_CURSEG_TYPE];

	unsigned int meta_count[META_MAX];
	unsigned int segment_count[2];
	unsigned int block_count[2];
	unsigned int inplace_count;
	unsigned long long base_mem, cache_mem, page_mem;
	struct f2fs_dev_stats *dev_stats;
};

static inline struct f2fs_stat_info *F2FS_STAT(struct f2fs_sb_info *sbi)
{
	return (struct f2fs_stat_info *)sbi->stat_info;
}

#define stat_inc_cp_call_count(sbi, foreground)				\
		atomic_inc(&sbi->cp_call_count[(foreground)])
#define stat_inc_cp_count(sbi)		(F2FS_STAT(sbi)->cp_count++)
#define stat_io_skip_bggc_count(sbi)	((sbi)->io_skip_bggc++)
#define stat_other_skip_bggc_count(sbi)	((sbi)->other_skip_bggc++)
#define stat_inc_dirty_inode(sbi, type)	((sbi)->ndirty_inode[type]++)
#define stat_dec_dirty_inode(sbi, type)	((sbi)->ndirty_inode[type]--)
#define stat_inc_total_hit(sbi, type)		(atomic64_inc(&(sbi)->total_hit_ext[type]))
#define stat_inc_rbtree_node_hit(sbi, type)	(atomic64_inc(&(sbi)->read_hit_rbtree[type]))
#define stat_inc_largest_node_hit(sbi)	(atomic64_inc(&(sbi)->read_hit_largest))
#define stat_inc_cached_node_hit(sbi, type)	(atomic64_inc(&(sbi)->read_hit_cached[type]))
#define stat_inc_inline_xattr(inode)					\
	do {								\
		if (f2fs_has_inline_xattr(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->inline_xattr));	\
	} while (0)
#define stat_dec_inline_xattr(inode)					\
	do {								\
		if (f2fs_has_inline_xattr(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->inline_xattr));	\
	} while (0)
#define stat_inc_inline_inode(inode)					\
	do {								\
		if (f2fs_has_inline_data(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->inline_inode));	\
	} while (0)
#define stat_dec_inline_inode(inode)					\
	do {								\
		if (f2fs_has_inline_data(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->inline_inode));	\
	} while (0)
#define stat_inc_inline_dir(inode)					\
	do {								\
		if (f2fs_has_inline_dentry(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->inline_dir));	\
	} while (0)
#define stat_dec_inline_dir(inode)					\
	do {								\
		if (f2fs_has_inline_dentry(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->inline_dir));	\
	} while (0)
#define stat_inc_compr_inode(inode)					\
	do {								\
		if (f2fs_compressed_file(inode))			\
			(atomic_inc(&F2FS_I_SB(inode)->compr_inode));	\
	} while (0)
#define stat_dec_compr_inode(inode)					\
	do {								\
		if (f2fs_compressed_file(inode))			\
			(atomic_dec(&F2FS_I_SB(inode)->compr_inode));	\
	} while (0)
#define stat_add_compr_blocks(inode, blocks)				\
		(atomic64_add(blocks, &F2FS_I_SB(inode)->compr_blocks))
#define stat_sub_compr_blocks(inode, blocks)				\
		(atomic64_sub(blocks, &F2FS_I_SB(inode)->compr_blocks))
#define stat_inc_swapfile_inode(inode)					\
		(atomic_inc(&F2FS_I_SB(inode)->swapfile_inode))
#define stat_dec_swapfile_inode(inode)					\
		(atomic_dec(&F2FS_I_SB(inode)->swapfile_inode))
#define stat_inc_atomic_inode(inode)					\
			(atomic_inc(&F2FS_I_SB(inode)->atomic_files))
#define stat_dec_atomic_inode(inode)					\
			(atomic_dec(&F2FS_I_SB(inode)->atomic_files))
#define stat_inc_meta_count(sbi, blkaddr)				\
	do {								\
		if (blkaddr < SIT_I(sbi)->sit_base_addr)		\
			atomic_inc(&(sbi)->meta_count[META_CP]);	\
		else if (blkaddr < NM_I(sbi)->nat_blkaddr)		\
			atomic_inc(&(sbi)->meta_count[META_SIT]);	\
		else if (blkaddr < SM_I(sbi)->ssa_blkaddr)		\
			atomic_inc(&(sbi)->meta_count[META_NAT]);	\
		else if (blkaddr < SM_I(sbi)->main_blkaddr)		\
			atomic_inc(&(sbi)->meta_count[META_SSA]);	\
	} while (0)
#define stat_inc_seg_type(sbi, curseg)					\
		((sbi)->segment_count[(curseg)->alloc_type]++)
#define stat_inc_block_count(sbi, curseg)				\
		((sbi)->block_count[(curseg)->alloc_type]++)
#define stat_inc_inplace_blocks(sbi)					\
		(atomic_inc(&(sbi)->inplace_count))
#define stat_update_max_atomic_write(inode)				\
	do {								\
		int cur = atomic_read(&F2FS_I_SB(inode)->atomic_files);	\
		int max = atomic_read(&F2FS_I_SB(inode)->max_aw_cnt);	\
		if (cur > max)						\
			atomic_set(&F2FS_I_SB(inode)->max_aw_cnt, cur);	\
	} while (0)
#define stat_inc_gc_call_count(sbi, foreground)				\
		(F2FS_STAT(sbi)->gc_call_count[(foreground)]++)
#define stat_inc_gc_sec_count(sbi, type, gc_type)			\
		(F2FS_STAT(sbi)->gc_secs[(type)][(gc_type)]++)
#define stat_inc_gc_seg_count(sbi, type, gc_type)			\
		(F2FS_STAT(sbi)->gc_segs[(type)][(gc_type)]++)

#define stat_inc_tot_blk_count(si, blks)				\
	((si)->tot_blks += (blks))

#define stat_inc_data_blk_count(sbi, blks, gc_type)			\
	do {								\
		struct f2fs_stat_info *si = F2FS_STAT(sbi);		\
		stat_inc_tot_blk_count(si, blks);			\
		si->data_blks += (blks);				\
		si->bg_data_blks += ((gc_type) == BG_GC) ? (blks) : 0;	\
	} while (0)

#define stat_inc_node_blk_count(sbi, blks, gc_type)			\
	do {								\
		struct f2fs_stat_info *si = F2FS_STAT(sbi);		\
		stat_inc_tot_blk_count(si, blks);			\
		si->node_blks += (blks);				\
		si->bg_node_blks += ((gc_type) == BG_GC) ? (blks) : 0;	\
	} while (0)

#define stat_inc_defrag_blk_count(sbi, blks)				\
	(F2FS_STAT(sbi)->defrag_blks += (blks))

int f2fs_build_stats(struct f2fs_sb_info *sbi);
void f2fs_destroy_stats(struct f2fs_sb_info *sbi);
void __init f2fs_create_root_stats(void);
void f2fs_destroy_root_stats(void);
void f2fs_update_sit_info(struct f2fs_sb_info *sbi);
#else
#define stat_inc_cp_call_count(sbi, foreground)		do { } while (0)
#define stat_inc_cp_count(sbi)				do { } while (0)
#define stat_io_skip_bggc_count(sbi)			do { } while (0)
#define stat_other_skip_bggc_count(sbi)			do { } while (0)
#define stat_inc_dirty_inode(sbi, type)			do { } while (0)
#define stat_dec_dirty_inode(sbi, type)			do { } while (0)
#define stat_inc_total_hit(sbi, type)			do { } while (0)
#define stat_inc_rbtree_node_hit(sbi, type)		do { } while (0)
#define stat_inc_largest_node_hit(sbi)			do { } while (0)
#define stat_inc_cached_node_hit(sbi, type)		do { } while (0)
#define stat_inc_inline_xattr(inode)			do { } while (0)
#define stat_dec_inline_xattr(inode)			do { } while (0)
#define stat_inc_inline_inode(inode)			do { } while (0)
#define stat_dec_inline_inode(inode)			do { } while (0)
#define stat_inc_inline_dir(inode)			do { } while (0)
#define stat_dec_inline_dir(inode)			do { } while (0)
#define stat_inc_compr_inode(inode)			do { } while (0)
#define stat_dec_compr_inode(inode)			do { } while (0)
#define stat_add_compr_blocks(inode, blocks)		do { } while (0)
#define stat_sub_compr_blocks(inode, blocks)		do { } while (0)
#define stat_inc_swapfile_inode(inode)			do { } while (0)
#define stat_dec_swapfile_inode(inode)			do { } while (0)
#define stat_inc_atomic_inode(inode)			do { } while (0)
#define stat_dec_atomic_inode(inode)			do { } while (0)
#define stat_update_max_atomic_write(inode)		do { } while (0)
#define stat_inc_meta_count(sbi, blkaddr)		do { } while (0)
#define stat_inc_seg_type(sbi, curseg)			do { } while (0)
#define stat_inc_block_count(sbi, curseg)		do { } while (0)
#define stat_inc_inplace_blocks(sbi)			do { } while (0)
#define stat_inc_gc_call_count(sbi, foreground)		do { } while (0)
#define stat_inc_gc_sec_count(sbi, type, gc_type)	do { } while (0)
#define stat_inc_gc_seg_count(sbi, type, gc_type)	do { } while (0)
#define stat_inc_tot_blk_count(si, blks)		do { } while (0)
#define stat_inc_data_blk_count(sbi, blks, gc_type)	do { } while (0)
#define stat_inc_node_blk_count(sbi, blks, gc_type)	do { } while (0)
#define stat_inc_defrag_blk_count(sbi, blks)		do { } while (0)

static inline int f2fs_build_stats(struct f2fs_sb_info *sbi) { return 0; }
static inline void f2fs_destroy_stats(struct f2fs_sb_info *sbi) { }
static inline void __init f2fs_create_root_stats(void) { }
static inline void f2fs_destroy_root_stats(void) { }
static inline void f2fs_update_sit_info(struct f2fs_sb_info *sbi) {}
#endif

extern const struct file_operations f2fs_dir_operations;
extern const struct file_operations f2fs_file_operations;
extern const struct inode_operations f2fs_file_inode_operations;
extern const struct address_space_operations f2fs_dblock_aops;
extern const struct address_space_operations f2fs_node_aops;
extern const struct address_space_operations f2fs_meta_aops;
extern const struct inode_operations f2fs_dir_inode_operations;
extern const struct inode_operations f2fs_symlink_inode_operations;
extern const struct inode_operations f2fs_encrypted_symlink_inode_operations;
extern const struct inode_operations f2fs_special_inode_operations;
extern struct kmem_cache *f2fs_inode_entry_slab;

/*
 * inline.c
 */
bool f2fs_may_inline_data(struct inode *inode);
bool f2fs_sanity_check_inline_data(struct inode *inode, struct folio *ifolio);
bool f2fs_may_inline_dentry(struct inode *inode);
void f2fs_do_read_inline_data(struct folio *folio, struct folio *ifolio);
void f2fs_truncate_inline_inode(struct inode *inode, struct folio *ifolio,
		u64 from);
int f2fs_read_inline_data(struct inode *inode, struct folio *folio);
int f2fs_convert_inline_folio(struct dnode_of_data *dn, struct folio *folio);
int f2fs_convert_inline_inode(struct inode *inode);
int f2fs_try_convert_inline_dir(struct inode *dir, struct dentry *dentry);
int f2fs_write_inline_data(struct inode *inode, struct folio *folio);
int f2fs_recover_inline_data(struct inode *inode, struct folio *nfolio);
struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
		const struct f2fs_filename *fname, struct folio **res_folio,
		bool use_hash);
int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent,
			struct folio *ifolio);
int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
			struct inode *inode, nid_t ino, umode_t mode);
void f2fs_delete_inline_entry(struct f2fs_dir_entry *dentry,
		struct folio *folio, struct inode *dir, struct inode *inode);
bool f2fs_empty_inline_dir(struct inode *dir);
int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
			struct fscrypt_str *fstr);
int f2fs_inline_data_fiemap(struct inode *inode,
			struct fiemap_extent_info *fieinfo,
			__u64 start, __u64 len);

/*
 * shrinker.c
 */
unsigned long f2fs_shrink_count(struct shrinker *shrink,
			struct shrink_control *sc);
unsigned long f2fs_shrink_scan(struct shrinker *shrink,
			struct shrink_control *sc);
unsigned int f2fs_donate_files(void);
void f2fs_reclaim_caches(unsigned int reclaim_caches_kb);
void f2fs_join_shrinker(struct f2fs_sb_info *sbi);
void f2fs_leave_shrinker(struct f2fs_sb_info *sbi);

/*
 * extent_cache.c
 */
bool sanity_check_extent_cache(struct inode *inode, struct folio *ifolio);
void f2fs_init_extent_tree(struct inode *inode);
void f2fs_drop_extent_tree(struct inode *inode);
void f2fs_destroy_extent_node(struct inode *inode);
void f2fs_destroy_extent_tree(struct inode *inode);
void f2fs_init_extent_cache_info(struct f2fs_sb_info *sbi);
int __init f2fs_create_extent_cache(void);
void f2fs_destroy_extent_cache(void);

/* read extent cache ops */
void f2fs_init_read_extent_tree(struct inode *inode, struct folio *ifolio);
bool f2fs_lookup_read_extent_cache(struct inode *inode, pgoff_t pgofs,
			struct extent_info *ei);
bool f2fs_lookup_read_extent_cache_block(struct inode *inode, pgoff_t index,
			block_t *blkaddr);
void f2fs_update_read_extent_cache(struct dnode_of_data *dn);
void f2fs_update_read_extent_cache_range(struct dnode_of_data *dn,
			pgoff_t fofs, block_t blkaddr, unsigned int len);
unsigned int f2fs_shrink_read_extent_tree(struct f2fs_sb_info *sbi,
			int nr_shrink);

/* block age extent cache ops */
void f2fs_init_age_extent_tree(struct inode *inode);
bool f2fs_lookup_age_extent_cache(struct inode *inode, pgoff_t pgofs,
			struct extent_info *ei);
void f2fs_update_age_extent_cache(struct dnode_of_data *dn);
void f2fs_update_age_extent_cache_range(struct dnode_of_data *dn,
			pgoff_t fofs, unsigned int len);
unsigned int f2fs_shrink_age_extent_tree(struct f2fs_sb_info *sbi,
			int nr_shrink);

/*
 * sysfs.c
 */
#define MIN_RA_MUL	2
#define MAX_RA_MUL	256

int __init f2fs_init_sysfs(void);
void f2fs_exit_sysfs(void);
int f2fs_register_sysfs(struct f2fs_sb_info *sbi);
void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi);

/* verity.c */
extern const struct fsverity_operations f2fs_verityops;

/*
 * crypto support
 */
static inline bool f2fs_encrypted_file(struct inode *inode)
{
	return IS_ENCRYPTED(inode) && S_ISREG(inode->i_mode);
}

static inline void f2fs_set_encrypted_inode(struct inode *inode)
{
#ifdef CONFIG_FS_ENCRYPTION
	file_set_encrypt(inode);
	f2fs_set_inode_flags(inode);
#endif
}

/*
 * Returns true if the reads of the inode's data need to undergo some
 * postprocessing step, like decryption or authenticity verification.
 */
static inline bool f2fs_post_read_required(struct inode *inode)
{
	return f2fs_encrypted_file(inode) || fsverity_active(inode) ||
		f2fs_compressed_file(inode);
}

static inline bool f2fs_used_in_atomic_write(struct inode *inode)
{
	return f2fs_is_atomic_file(inode) || f2fs_is_cow_file(inode);
}

static inline bool f2fs_meta_inode_gc_required(struct inode *inode)
{
	return f2fs_post_read_required(inode) || f2fs_used_in_atomic_write(inode);
}

/*
 * compress.c
 */
#ifdef CONFIG_F2FS_FS_COMPRESSION
enum cluster_check_type {
	CLUSTER_IS_COMPR,   /* check only if compressed cluster */
	CLUSTER_COMPR_BLKS, /* return # of compressed blocks in a cluster */
	CLUSTER_RAW_BLKS    /* return # of raw blocks in a cluster */
};
bool f2fs_is_compressed_page(struct folio *folio);
struct folio *f2fs_compress_control_folio(struct folio *folio);
int f2fs_prepare_compress_overwrite(struct inode *inode,
			struct page **pagep, pgoff_t index, void **fsdata);
bool f2fs_compress_write_end(struct inode *inode, void *fsdata,
					pgoff_t index, unsigned copied);
int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock);
void f2fs_compress_write_end_io(struct bio *bio, struct folio *folio);
bool f2fs_is_compress_backend_ready(struct inode *inode);
bool f2fs_is_compress_level_valid(int alg, int lvl);
int __init f2fs_init_compress_mempool(void);
void f2fs_destroy_compress_mempool(void);
void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task);
void f2fs_end_read_compressed_page(struct folio *folio, bool failed,
				block_t blkaddr, bool in_task);
bool f2fs_cluster_is_empty(struct compress_ctx *cc);
bool f2fs_cluster_can_merge_page(struct compress_ctx *cc, pgoff_t index);
bool f2fs_all_cluster_page_ready(struct compress_ctx *cc, struct page **pages,
				int index, int nr_pages, bool uptodate);
bool f2fs_sanity_check_cluster(struct dnode_of_data *dn);
void f2fs_compress_ctx_add_page(struct compress_ctx *cc, struct folio *folio);
int f2fs_write_multi_pages(struct compress_ctx *cc,
						int *submitted,
						struct writeback_control *wbc,
						enum iostat_type io_type);
int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index);
bool f2fs_is_sparse_cluster(struct inode *inode, pgoff_t index);
void f2fs_update_read_extent_tree_range_compressed(struct inode *inode,
				pgoff_t fofs, block_t blkaddr,
				unsigned int llen, unsigned int c_len);
int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
				unsigned nr_pages, sector_t *last_block_in_bio,
				struct readahead_control *rac, bool for_write);
struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc);
void f2fs_decompress_end_io(struct decompress_io_ctx *dic, bool failed,
				bool in_task);
void f2fs_put_folio_dic(struct folio *folio, bool in_task);
unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn,
						unsigned int ofs_in_node);
int f2fs_init_compress_ctx(struct compress_ctx *cc);
void f2fs_destroy_compress_ctx(struct compress_ctx *cc, bool reuse);
void f2fs_init_compress_info(struct f2fs_sb_info *sbi);
int f2fs_init_compress_inode(struct f2fs_sb_info *sbi);
void f2fs_destroy_compress_inode(struct f2fs_sb_info *sbi);
int f2fs_init_page_array_cache(struct f2fs_sb_info *sbi);
void f2fs_destroy_page_array_cache(struct f2fs_sb_info *sbi);
int __init f2fs_init_compress_cache(void);
void f2fs_destroy_compress_cache(void);
struct address_space *COMPRESS_MAPPING(struct f2fs_sb_info *sbi);
void f2fs_invalidate_compress_pages_range(struct f2fs_sb_info *sbi,
					block_t blkaddr, unsigned int len);
bool f2fs_load_compressed_folio(struct f2fs_sb_info *sbi, struct folio *folio,
								block_t blkaddr);
void f2fs_invalidate_compress_pages(struct f2fs_sb_info *sbi, nid_t ino);
#define inc_compr_inode_stat(inode)					\
	do {								\
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);		\
		sbi->compr_new_inode++;					\
	} while (0)
#define add_compr_block_stat(inode, blocks)				\
	do {								\
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);		\
		int diff = F2FS_I(inode)->i_cluster_size - blocks;	\
		sbi->compr_written_block += blocks;			\
		sbi->compr_saved_block += diff;				\
	} while (0)
#else
static inline bool f2fs_is_compressed_page(struct folio *folio) { return false; }
static inline bool f2fs_is_compress_backend_ready(struct inode *inode)
{
	if (!f2fs_compressed_file(inode))
		return true;
	/* not support compression */
	return false;
}
static inline bool f2fs_is_compress_level_valid(int alg, int lvl) { return false; }
static inline struct folio *f2fs_compress_control_folio(struct folio *folio)
{
	WARN_ON_ONCE(1);
	return ERR_PTR(-EINVAL);
}
static inline int __init f2fs_init_compress_mempool(void) { return 0; }
static inline void f2fs_destroy_compress_mempool(void) { }
static inline void f2fs_decompress_cluster(struct decompress_io_ctx *dic,
				bool in_task) { }
static inline void f2fs_end_read_compressed_page(struct folio *folio,
				bool failed, block_t blkaddr, bool in_task)
{
	WARN_ON_ONCE(1);
}
static inline void f2fs_put_folio_dic(struct folio *folio, bool in_task)
{
	WARN_ON_ONCE(1);
}
static inline unsigned int f2fs_cluster_blocks_are_contiguous(
			struct dnode_of_data *dn, unsigned int ofs_in_node) { return 0; }
static inline bool f2fs_sanity_check_cluster(struct dnode_of_data *dn) { return false; }
static inline int f2fs_init_compress_inode(struct f2fs_sb_info *sbi) { return 0; }
static inline void f2fs_destroy_compress_inode(struct f2fs_sb_info *sbi) { }
static inline int f2fs_init_page_array_cache(struct f2fs_sb_info *sbi) { return 0; }
static inline void f2fs_destroy_page_array_cache(struct f2fs_sb_info *sbi) { }
static inline int __init f2fs_init_compress_cache(void) { return 0; }
static inline void f2fs_destroy_compress_cache(void) { }
static inline void f2fs_invalidate_compress_pages_range(struct f2fs_sb_info *sbi,
				block_t blkaddr, unsigned int len) { }
static inline bool f2fs_load_compressed_folio(struct f2fs_sb_info *sbi,
		struct folio *folio, block_t blkaddr) { return false; }
static inline void f2fs_invalidate_compress_pages(struct f2fs_sb_info *sbi,
							nid_t ino) { }
#define inc_compr_inode_stat(inode)		do { } while (0)
static inline int f2fs_is_compressed_cluster(
				struct inode *inode,
				pgoff_t index) { return 0; }
static inline bool f2fs_is_sparse_cluster(
				struct inode *inode,
				pgoff_t index) { return true; }
static inline void f2fs_update_read_extent_tree_range_compressed(
				struct inode *inode,
				pgoff_t fofs, block_t blkaddr,
				unsigned int llen, unsigned int c_len) { }
#endif

static inline int set_compress_context(struct inode *inode)
{
#ifdef CONFIG_F2FS_FS_COMPRESSION
	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
	struct f2fs_inode_info *fi = F2FS_I(inode);

	fi->i_compress_algorithm = F2FS_OPTION(sbi).compress_algorithm;
	fi->i_log_cluster_size = F2FS_OPTION(sbi).compress_log_size;
	fi->i_compress_flag = F2FS_OPTION(sbi).compress_chksum ?
					BIT(COMPRESS_CHKSUM) : 0;
	fi->i_cluster_size = BIT(fi->i_log_cluster_size);
	if ((fi->i_compress_algorithm == COMPRESS_LZ4 ||
		fi->i_compress_algorithm == COMPRESS_ZSTD) &&
			F2FS_OPTION(sbi).compress_level)
		fi->i_compress_level = F2FS_OPTION(sbi).compress_level;
	fi->i_flags |= F2FS_COMPR_FL;
	set_inode_flag(inode, FI_COMPRESSED_FILE);
	stat_inc_compr_inode(inode);
	inc_compr_inode_stat(inode);
	f2fs_mark_inode_dirty_sync(inode, true);
	return 0;
#else
	return -EOPNOTSUPP;
#endif
}

static inline bool f2fs_disable_compressed_file(struct inode *inode)
{
	struct f2fs_inode_info *fi = F2FS_I(inode);

	f2fs_down_write(&fi->i_sem);

	if (!f2fs_compressed_file(inode)) {
		f2fs_up_write(&fi->i_sem);
		return true;
	}
	if (f2fs_is_mmap_file(inode) || atomic_read(&fi->writeback) ||
		(S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode))) {
		f2fs_up_write(&fi->i_sem);
		return false;
	}

	fi->i_flags &= ~F2FS_COMPR_FL;
	stat_dec_compr_inode(inode);
	clear_inode_flag(inode, FI_COMPRESSED_FILE);
	f2fs_mark_inode_dirty_sync(inode, true);

	f2fs_up_write(&fi->i_sem);
	return true;
}

#define F2FS_FEATURE_FUNCS(name, flagname) \
static inline bool f2fs_sb_has_##name(struct f2fs_sb_info *sbi) \
{ \
	return F2FS_HAS_FEATURE(sbi, F2FS_FEATURE_##flagname); \
}

F2FS_FEATURE_FUNCS(encrypt, ENCRYPT);
F2FS_FEATURE_FUNCS(blkzoned, BLKZONED);
F2FS_FEATURE_FUNCS(extra_attr, EXTRA_ATTR);
F2FS_FEATURE_FUNCS(project_quota, PRJQUOTA);
F2FS_FEATURE_FUNCS(inode_chksum, INODE_CHKSUM);
F2FS_FEATURE_FUNCS(flexible_inline_xattr, FLEXIBLE_INLINE_XATTR);
F2FS_FEATURE_FUNCS(quota_ino, QUOTA_INO);
F2FS_FEATURE_FUNCS(inode_crtime, INODE_CRTIME);
F2FS_FEATURE_FUNCS(lost_found, LOST_FOUND);
F2FS_FEATURE_FUNCS(verity, VERITY);
F2FS_FEATURE_FUNCS(sb_chksum, SB_CHKSUM);
F2FS_FEATURE_FUNCS(casefold, CASEFOLD);
F2FS_FEATURE_FUNCS(compression, COMPRESSION);
F2FS_FEATURE_FUNCS(readonly, RO);
F2FS_FEATURE_FUNCS(device_alias, DEVICE_ALIAS);
F2FS_FEATURE_FUNCS(packed_ssa, PACKED_SSA);

#ifdef CONFIG_BLK_DEV_ZONED
static inline bool f2fs_zone_is_seq(struct f2fs_sb_info *sbi, int devi,
							unsigned int zone)
{
	return test_bit(zone, FDEV(devi).blkz_seq);
}

static inline bool f2fs_blkz_is_seq(struct f2fs_sb_info *sbi, int devi,
								block_t blkaddr)
{
	return f2fs_zone_is_seq(sbi, devi, blkaddr / sbi->blocks_per_blkz);
}
#endif

static inline int f2fs_bdev_index(struct f2fs_sb_info *sbi,
				  struct block_device *bdev)
{
	int i;

	if (!f2fs_is_multi_device(sbi))
		return 0;

	for (i = 0; i < sbi->s_ndevs; i++)
		if (FDEV(i).bdev == bdev)
			return i;

	WARN_ON(1);
	return -1;
}

static inline bool f2fs_hw_should_discard(struct f2fs_sb_info *sbi)
{
	return f2fs_sb_has_blkzoned(sbi);
}

static inline bool f2fs_bdev_support_discard(struct block_device *bdev)
{
	return bdev_max_discard_sectors(bdev) || bdev_is_zoned(bdev);
}

static inline bool f2fs_hw_support_discard(struct f2fs_sb_info *sbi)
{
	int i;

	if (!f2fs_is_multi_device(sbi))
		return f2fs_bdev_support_discard(sbi->sb->s_bdev);

	for (i = 0; i < sbi->s_ndevs; i++)
		if (f2fs_bdev_support_discard(FDEV(i).bdev))
			return true;
	return false;
}

static inline unsigned int f2fs_hw_discard_granularity(struct f2fs_sb_info *sbi)
{
	int i = 1;
	unsigned int discard_granularity = bdev_discard_granularity(sbi->sb->s_bdev);

	if (f2fs_is_multi_device(sbi))
		for (; i < sbi->s_ndevs && !bdev_is_zoned(FDEV(i).bdev); i++)
			discard_granularity = max_t(unsigned int, discard_granularity,
						bdev_discard_granularity(FDEV(i).bdev));
	return discard_granularity;
}

static inline bool f2fs_realtime_discard_enable(struct f2fs_sb_info *sbi)
{
	return (test_opt(sbi, DISCARD) && f2fs_hw_support_discard(sbi)) ||
					f2fs_hw_should_discard(sbi);
}

static inline bool f2fs_hw_is_readonly(struct f2fs_sb_info *sbi)
{
	int i;

	if (!f2fs_is_multi_device(sbi))
		return bdev_read_only(sbi->sb->s_bdev);

	for (i = 0; i < sbi->s_ndevs; i++)
		if (bdev_read_only(FDEV(i).bdev))
			return true;
	return false;
}

static inline bool f2fs_dev_is_readonly(struct f2fs_sb_info *sbi)
{
	return f2fs_sb_has_readonly(sbi) || f2fs_hw_is_readonly(sbi);
}

static inline bool f2fs_lfs_mode(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).fs_mode == FS_MODE_LFS;
}

static inline bool f2fs_is_sequential_zone_area(struct f2fs_sb_info *sbi,
					  block_t blkaddr)
{
	if (f2fs_sb_has_blkzoned(sbi)) {
#ifdef CONFIG_BLK_DEV_ZONED
		int devi = f2fs_target_device_index(sbi, blkaddr);

		if (!bdev_is_zoned(FDEV(devi).bdev))
			return false;

		if (f2fs_is_multi_device(sbi)) {
			if (blkaddr < FDEV(devi).start_blk ||
				blkaddr > FDEV(devi).end_blk) {
				f2fs_err(sbi, "Invalid block %x", blkaddr);
				return false;
			}
			blkaddr -= FDEV(devi).start_blk;
		}

		return f2fs_blkz_is_seq(sbi, devi, blkaddr);
#else
		return false;
#endif
	}
	return false;
}

static inline bool f2fs_low_mem_mode(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).memory_mode == MEMORY_MODE_LOW;
}

static inline bool f2fs_may_compress(struct inode *inode)
{
	if (IS_SWAPFILE(inode) || f2fs_is_pinned_file(inode) ||
		f2fs_is_atomic_file(inode) || f2fs_has_inline_data(inode) ||
		f2fs_is_mmap_file(inode))
		return false;
	return S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode);
}

static inline void f2fs_i_compr_blocks_update(struct inode *inode,
						u64 blocks, bool add)
{
	struct f2fs_inode_info *fi = F2FS_I(inode);
	int diff = fi->i_cluster_size - blocks;

	/* don't update i_compr_blocks if saved blocks were released */
	if (!add && !atomic_read(&fi->i_compr_blocks))
		return;

	if (add) {
		atomic_add(diff, &fi->i_compr_blocks);
		stat_add_compr_blocks(inode, diff);
	} else {
		atomic_sub(diff, &fi->i_compr_blocks);
		stat_sub_compr_blocks(inode, diff);
	}
	f2fs_mark_inode_dirty_sync(inode, true);
}

static inline bool f2fs_allow_multi_device_dio(struct f2fs_sb_info *sbi,
								int flag)
{
	if (!f2fs_is_multi_device(sbi))
		return false;
	if (flag != F2FS_GET_BLOCK_DIO)
		return false;
	return sbi->aligned_blksize;
}

#ifdef CONFIG_F2FS_FAULT_INJECTION
extern int f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned long rate,
					unsigned long type, enum fault_option fo);
extern void f2fs_simulate_lock_timeout(struct f2fs_sb_info *sbi);
#else
static inline int f2fs_build_fault_attr(struct f2fs_sb_info *sbi,
					unsigned long rate, unsigned long type,
					enum fault_option fo)
{
	return 0;
}
static inline void f2fs_simulate_lock_timeout(struct f2fs_sb_info *sbi)
{
	return;
}
#endif

static inline bool is_journalled_quota(struct f2fs_sb_info *sbi)
{
#ifdef CONFIG_QUOTA
	if (f2fs_sb_has_quota_ino(sbi))
		return true;
	if (F2FS_OPTION(sbi).s_qf_names[USRQUOTA] ||
		F2FS_OPTION(sbi).s_qf_names[GRPQUOTA] ||
		F2FS_OPTION(sbi).s_qf_names[PRJQUOTA])
		return true;
#endif
	return false;
}

static inline bool f2fs_quota_file(struct f2fs_sb_info *sbi, nid_t ino)
{
#ifdef CONFIG_QUOTA
	int i;

	if (!f2fs_sb_has_quota_ino(sbi))
		return false;

	for (i = 0; i < MAXQUOTAS; i++) {
		if (f2fs_qf_ino(sbi->sb, i) == ino)
			return true;
	}
#endif
	return false;
}

static inline bool f2fs_block_unit_discard(struct f2fs_sb_info *sbi)
{
	return F2FS_OPTION(sbi).discard_unit == DISCARD_UNIT_BLOCK;
}

static inline void __f2fs_schedule_timeout(long timeout, bool io)
{
	set_current_state(TASK_UNINTERRUPTIBLE);
	if (io)
		io_schedule_timeout(timeout);
	else
		schedule_timeout(timeout);
}

#define f2fs_io_schedule_timeout(timeout)		\
			__f2fs_schedule_timeout(timeout, true)
#define f2fs_schedule_timeout(timeout)			\
			__f2fs_schedule_timeout(timeout, false)

static inline void f2fs_schedule_timeout_killable(long timeout, bool io)
{
	unsigned long last_time = jiffies + timeout;

	while (jiffies < last_time) {
		if (fatal_signal_pending(current))
			return;
		__f2fs_schedule_timeout(DEFAULT_SCHEDULE_TIMEOUT, io);
	}
}

static inline void f2fs_handle_page_eio(struct f2fs_sb_info *sbi,
				struct folio *folio, enum page_type type)
{
	pgoff_t ofs = folio->index;

	if (unlikely(f2fs_cp_error(sbi)))
		return;

	if (ofs == sbi->page_eio_ofs[type]) {
		if (sbi->page_eio_cnt[type]++ == MAX_RETRY_PAGE_EIO) {
			enum stop_cp_reason stop_reason;

			switch (type) {
			case META:
				stop_reason = STOP_CP_REASON_READ_META;
				break;
			case NODE:
				stop_reason = STOP_CP_REASON_READ_NODE;
				break;
			case DATA:
				stop_reason = STOP_CP_REASON_READ_DATA;
				break;
			default:
				f2fs_bug_on(sbi, 1);
				return;
			}
			f2fs_stop_checkpoint(sbi, false, stop_reason);
		}
	} else {
		sbi->page_eio_ofs[type] = ofs;
		sbi->page_eio_cnt[type] = 0;
	}
}

static inline bool f2fs_is_readonly(struct f2fs_sb_info *sbi)
{
	return f2fs_sb_has_readonly(sbi) || f2fs_readonly(sbi->sb);
}

static inline void f2fs_truncate_meta_inode_pages(struct f2fs_sb_info *sbi,
					block_t blkaddr, unsigned int cnt)
{
	bool need_submit = false;
	int i = 0;

	do {
		struct folio *folio;

		folio = filemap_get_folio(META_MAPPING(sbi), blkaddr + i);
		if (!IS_ERR(folio)) {
			if (folio_test_writeback(folio))
				need_submit = true;
			f2fs_folio_put(folio, false);
		}
	} while (++i < cnt && !need_submit);

	if (need_submit)
		f2fs_submit_merged_write_cond(sbi, sbi->meta_inode,
							NULL, 0, DATA);

	truncate_inode_pages_range(META_MAPPING(sbi),
			F2FS_BLK_TO_BYTES((loff_t)blkaddr),
			F2FS_BLK_END_BYTES((loff_t)(blkaddr + cnt - 1)));
}

static inline void f2fs_invalidate_internal_cache(struct f2fs_sb_info *sbi,
						block_t blkaddr, unsigned int len)
{
	f2fs_truncate_meta_inode_pages(sbi, blkaddr, len);
	f2fs_invalidate_compress_pages_range(sbi, blkaddr, len);
}

#endif /* _LINUX_F2FS_H */
]

gemini-3.1-pro-preview

							input: 111957
							output: 22
							thoughts: 326
						

**Analyzing a F2FS Bug in a Production Build**

Okay, so I'm looking at this f2fs code snippet in `f2fs.h`. It's got this conditional definition for `f2fs_bug_on`. If `CONFIG_F2FS_CHECK_FS` is defined, it's a straight `BUG_ON`. Otherwise, it's a `WARN_ON` and sets the `SBI_NEED_FSCK` flag. The bug report points to `fs/f2fs/file.c:845`, indicating a kernel bug.

The initial thought is that `CONFIG_F2FS_CHECK_FS` *must* be enabled, which would mean `BUG_ON` triggered, given the "kernel BUG at" message. That’s the typical case. However, the prompt specifically says to analyze this for a production build *without* debugging tools, like KASAN or UBSAN. That's the key wrinkle.

So, the question is: is `CONFIG_F2FS_CHECK_FS` even enabled in production? My immediate assumption is usually "no", as it's typically a debugging option. I need to confirm that. I'm going to quickly check `fs/f2fs/Kconfig` to see how `CONFIG_F2FS_CHECK_FS` is defined and what its default setting or dependency is. That should tell me if it *could* be enabled even in a "production" context, perhaps by some other configuration option. Once I check that Kconfig file, I'll be able to decide if this a "true" bug or a false alarm because debugging is enabled.

map[Expression:config F2FS_CHECK_FS]

map[Output:fs/f2fs/Kconfig=65=config F2FS_FS_SECURITY
--
fs/f2fs/Kconfig-78-
fs/f2fs/Kconfig:79:config F2FS_CHECK_FS
fs/f2fs/Kconfig-80-	bool "F2FS consistency checking feature"
]

gemini-3.1-pro-preview

							input: 112754
							output: 23
							thoughts: 17
						

Okay, here's my take on those thoughts, tailored for an expert audience like yourself:

**Diving into the `F2FS_CHECK_FS` Documentation**

Alright, time to get down to brass tacks. I'm thinking, "Let's crack open the documentation for `F2FS_CHECK_FS`." No sense going in blind when you're dealing with filesystem integrity, right? I want to refresh my memory on the specifics, the nuances, the gotchas. Gotta make sure I haven't forgotten anything important about its behavior and parameters. This tool is critical for maintaining F2FS filesystem health, and I need to be completely in the loop before running any checks. Time to see what the manual has to say.

map[Expression:config F2FS_CHECK_FS.*]

map[Output:fs/f2fs/Kconfig=65=config F2FS_FS_SECURITY
--
fs/f2fs/Kconfig-78-
fs/f2fs/Kconfig:79:config F2FS_CHECK_FS
fs/f2fs/Kconfig-80-	bool "F2FS consistency checking feature"
]

gemini-3.1-pro-preview

							input: 113044
							output: 20
							thoughts: 20
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into F2FS Configuration**

Alright, let's get down to brass tacks. I'm thinking, "Where do I start digging into the F2FS configuration options?" Line 79 of `fs/f2fs/Kconfig` sounds like a good starting point. I suspect that's where the core set of configurable features are defined, or perhaps where the top-level menu structure begins. Knowing the typical layout of Kconfig files, I'm expecting to find either a main menu block, a selection of dependencies, or at least a high-level overview of the most crucial F2FS settings. From there, I can trace dependencies, understand how features are interconnected, and start building a mental map of what's configurable and how it works. That's always my preferred method for learning a new system. Let's see what gems are hidden in there.

map[Expression:F2FS consistency checking feature]

map[Output:fs/f2fs/Kconfig=79=config F2FS_CHECK_FS
fs/f2fs/Kconfig:80:	bool "F2FS consistency checking feature"
fs/f2fs/Kconfig-81-	depends on F2FS_FS
]

gemini-3.1-pro-preview

							input: 113366
							output: 23
							thoughts: 20
						

Here's my summary, as though I'm thinking through this process:

**Diving into the F2FS Configuration**

Alright, time to dig into the heart of the F2FS configuration. I'll start by reading the `fs/f2fs/Kconfig` file. I'll use `read-file` to do that, of course, because that's the natural way to get the content of a file. I’m expecting to find the standard structure here: options, dependencies, descriptions… the usual suspects for a kernel config. It's the blueprint that dictates what features are enabled, what's linked together, and all those dependencies. I'm especially interested in seeing how F2FS has evolved, the design choices they've made, the areas they've emphasized, and what's newly supported. Time to see what's what.

map[File:fs/f2fs/Kconfig]

map[Contents:# SPDX-License-Identifier: GPL-2.0-only
config F2FS_FS
	tristate "F2FS filesystem support"
	depends on BLOCK
	select BUFFER_HEAD
	select NLS
	select CRC32
	select F2FS_FS_XATTR if FS_ENCRYPTION
	select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
	select FS_IOMAP
	select LZ4_COMPRESS if F2FS_FS_LZ4
	select LZ4_DECOMPRESS if F2FS_FS_LZ4
	select LZ4HC_COMPRESS if F2FS_FS_LZ4HC
	select LZO_COMPRESS if F2FS_FS_LZO
	select LZO_DECOMPRESS if F2FS_FS_LZO
	select ZSTD_COMPRESS if F2FS_FS_ZSTD
	select ZSTD_DECOMPRESS if F2FS_FS_ZSTD
	help
	  F2FS is based on Log-structured File System (LFS), which supports
	  versatile "flash-friendly" features. The design has been focused on
	  addressing the fundamental issues in LFS, which are snowball effect
	  of wandering tree and high cleaning overhead.

	  Since flash-based storages show different characteristics according to
	  the internal geometry or flash memory management schemes aka FTL, F2FS
	  and tools support various parameters not only for configuring on-disk
	  layout, but also for selecting allocation and cleaning algorithms.

	  If unsure, say N.

config F2FS_STAT_FS
	bool "F2FS Status Information"
	depends on F2FS_FS
	default y
	help
	  /sys/kernel/debug/f2fs/ contains information about all the partitions
	  mounted as f2fs. Each file shows the whole f2fs information.

	  /sys/kernel/debug/f2fs/status includes:
	    - major filesystem information managed by f2fs currently
	    - average SIT information about whole segments
	    - current memory footprint consumed by f2fs.

config F2FS_FS_XATTR
	bool "F2FS extended attributes"
	depends on F2FS_FS
	default y
	help
	  Extended attributes are name:value pairs associated with inodes by
	  the kernel or by users (see the attr(5) manual page for details).

	  If unsure, say N.

config F2FS_FS_POSIX_ACL
	bool "F2FS Access Control Lists"
	depends on F2FS_FS_XATTR
	select FS_POSIX_ACL
	default y
	help
	  Posix Access Control Lists (ACLs) support permissions for users and
	  groups beyond the owner/group/world scheme.

	  If you don't know what Access Control Lists are, say N

config F2FS_FS_SECURITY
	bool "F2FS Security Labels"
	depends on F2FS_FS_XATTR
	help
	  Security labels provide an access control facility to support Linux
	  Security Models (LSMs) accepted by AppArmor, SELinux, Smack and TOMOYO
	  Linux. This option enables an extended attribute handler for file
	  security labels in the f2fs filesystem, so that it requires enabling
	  the extended attribute support in advance. In particular you need this
	  option if you use the setcap command to assign initial process capabi-
	  lities to executables (the security.* extended attributes).

	  If you are not using a security module, say N.

config F2FS_CHECK_FS
	bool "F2FS consistency checking feature"
	depends on F2FS_FS
	help
	  Enables BUG_ONs which check the filesystem consistency in runtime.

	  If you want to improve the performance, say N.

config F2FS_FAULT_INJECTION
	bool "F2FS fault injection facility"
	depends on F2FS_FS
	help
	  Test F2FS to inject faults such as ENOMEM, ENOSPC, and so on.

	  If unsure, say N.

config F2FS_FS_COMPRESSION
	bool "F2FS compression feature"
	depends on F2FS_FS
	help
	  Enable filesystem-level compression on f2fs regular files,
	  multiple back-end compression algorithms are supported.

config F2FS_FS_LZO
	bool "LZO compression support"
	depends on F2FS_FS_COMPRESSION
	default y
	help
	  Support LZO compress algorithm, if unsure, say Y.

config F2FS_FS_LZORLE
	bool "LZO-RLE compression support"
	depends on F2FS_FS_LZO
	default y
	help
	  Support LZO-RLE compress algorithm, if unsure, say Y.

config F2FS_FS_LZ4
	bool "LZ4 compression support"
	depends on F2FS_FS_COMPRESSION
	default y
	help
	  Support LZ4 compress algorithm, if unsure, say Y.

config F2FS_FS_LZ4HC
	bool "LZ4HC compression support"
	depends on F2FS_FS_LZ4
	default y
	help
	  Support LZ4HC compress algorithm, LZ4HC has compatible on-disk
	  layout with LZ4, if unsure, say Y.

config F2FS_FS_ZSTD
	bool "ZSTD compression support"
	depends on F2FS_FS_COMPRESSION
	default y
	help
	  Support ZSTD compress algorithm, if unsure, say Y.

config F2FS_IOSTAT
	bool "F2FS IO statistics information"
	depends on F2FS_FS
	default y
	help
	  Support getting IO statistics through sysfs and printing out periodic
	  IO statistics tracepoint events. You have to turn on "iostat_enable"
	  sysfs node to enable this feature.

config F2FS_UNFAIR_RWSEM
	bool "F2FS unfair rw_semaphore"
	depends on F2FS_FS && BLK_CGROUP
	help
	  Use unfair rw_semaphore, if system configured IO priority by block
	  cgroup.
]

gemini-3.1-pro-preview

							input: 115059
							output: 49
							thoughts: 373
						

**Analyzing F2FS Error Handling in `f2fs_do_truncate_blocks`**

Okay, so I'm looking at this F2FS code, specifically the `F2FS_CHECK_FS` debugging option. The comments say it's for performance, so if it's *not* set, the `f2fs_bug_on` macro gets defined. I see that `f2fs_bug_on` uses `WARN_ON` and then sets the `SBI_NEED_FSCK` flag. Right, so in a production build (where `F2FS_CHECK_FS` is typically off), it *won't* halt the kernel, it'll just log a warning and mark the filesystem for checking.

But that makes me wonder, what happens *after* the warning? It's like, the kernel's chugging along, ignoring the potential problem. Let's look further. I'm focusing on `f2fs_do_truncate_blocks`, specifically this chunk of code:

```c
	count = ADDRS_PER_PAGE(dn.node_folio, inode);

	count -= dn.ofs_in_node;
	f2fs_bug_on(sbi, count < 0);

	if (dn.ofs_in_node || IS_INODE(dn.node_folio)) {
		f2fs_truncate_data_blocks_range(&dn, count);
		free_from += count;
	}
```

Okay, so there's a calculation of `count`, and then a check for `count < 0`. If `count` is negative, `f2fs_bug_on` is triggered. We already established it's just a warning. But then, *`f2fs_truncate_data_blocks_range(&dn, count)`* gets called, with a *negative* `count`! Now, *that's* a problem. `count` is an `int`, not unsigned. Calling that function with a negative `count` seems like it would be really bad. I need to look at what `f2fs_truncate_data_blocks_range` actually does. I need to see if it even expects, or handles, a negative input at all!

map[ContextFile:fs/f2fs/file.c IncludeLines:true Name:f2fs_truncate_data_blocks_range]

map[SourceCode: 658:	void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count)
 659:	{
 660:		struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
 661:		int nr_free = 0, ofs = dn->ofs_in_node, len = count;
 662:		__le32 *addr;
 663:		bool compressed_cluster = false;
 664:		int cluster_index = 0, valid_blocks = 0;
 665:		int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
 666:		bool released = !atomic_read(&F2FS_I(dn->inode)->i_compr_blocks);
 667:		block_t blkstart;
 668:		int blklen = 0;
 669:	
 670:		addr = get_dnode_addr(dn->inode, dn->node_folio) + ofs;
 671:		blkstart = le32_to_cpu(*addr);
 672:	
 673:		/* Assumption: truncation starts with cluster */
 674:		for (; count > 0; count--, addr++, dn->ofs_in_node++, cluster_index++) {
 675:			block_t blkaddr = le32_to_cpu(*addr);
 676:	
 677:			if (f2fs_compressed_file(dn->inode) &&
 678:						!(cluster_index & (cluster_size - 1))) {
 679:				if (compressed_cluster)
 680:					f2fs_i_compr_blocks_update(dn->inode,
 681:								valid_blocks, false);
 682:				compressed_cluster = (blkaddr == COMPRESS_ADDR);
 683:				valid_blocks = 0;
 684:			}
 685:	
 686:			if (blkaddr == NULL_ADDR)
 687:				goto next;
 688:	
 689:			f2fs_set_data_blkaddr(dn, NULL_ADDR);
 690:	
 691:			if (__is_valid_data_blkaddr(blkaddr)) {
 692:				if (time_to_inject(sbi, FAULT_BLKADDR_CONSISTENCE))
 693:					goto next;
 694:				if (!f2fs_is_valid_blkaddr_raw(sbi, blkaddr,
 695:							DATA_GENERIC_ENHANCE))
 696:					goto next;
 697:				if (compressed_cluster)
 698:					valid_blocks++;
 699:			}
 700:	
 701:			if (blkstart + blklen == blkaddr) {
 702:				blklen++;
 703:			} else {
 704:				f2fs_invalidate_blocks(sbi, blkstart, blklen);
 705:				blkstart = blkaddr;
 706:				blklen = 1;
 707:			}
 708:	
 709:			if (!released || blkaddr != COMPRESS_ADDR)
 710:				nr_free++;
 711:	
 712:			continue;
 713:	
 714:	next:
 715:			if (blklen)
 716:				f2fs_invalidate_blocks(sbi, blkstart, blklen);
 717:	
 718:			blkstart = le32_to_cpu(*(addr + 1));
 719:			blklen = 0;
 720:		}
 721:	
 722:		if (blklen)
 723:			f2fs_invalidate_blocks(sbi, blkstart, blklen);
 724:	
 725:		if (compressed_cluster)
 726:			f2fs_i_compr_blocks_update(dn->inode, valid_blocks, false);
 727:	
 728:		if (nr_free) {
 729:			pgoff_t fofs;
 730:			/*
 731:			 * once we invalidate valid blkaddr in range [ofs, ofs + count],
 732:			 * we will invalidate all blkaddr in the whole range.
 733:			 */
 734:			fofs = f2fs_start_bidx_of_node(ofs_of_node(dn->node_folio),
 735:								dn->inode) + ofs;
 736:			f2fs_update_read_extent_cache_range(dn, fofs, 0, len);
 737:			f2fs_update_age_extent_cache_range(dn, fofs, len);
 738:			dec_valid_block_count(sbi, dn->inode, nr_free);
 739:		}
 740:		dn->ofs_in_node = ofs;
 741:	
 742:		f2fs_update_time(sbi, REQ_TIME);
 743:		trace_f2fs_truncate_data_blocks_range(dn->inode, dn->nid,
 744:						 dn->ofs_in_node, nr_free);
 745:	}
 SourceFile:fs/f2fs/file.c]

gemini-3.1-pro-preview

							input: 117451
							output: 47
							thoughts: 363
						

**Analyzing a Curious F2FS Truncation Path**

Okay, so I'm digging into this F2FS code, specifically `f2fs_truncate_data_blocks_range`, and something's not quite right. If the `count` value passed to that function is *negative*, the code seems to do absolutely nothing within the main loop. It just skips right over it. Specifically, it goes straight to the end of the initial block freeing logic: I see that `blklen` ends up being zero, `compressed_cluster` is false, and `nr_free` is zero; so the function effectively *does nothing*.

But then, within `f2fs_do_truncate_blocks`, we call `f2fs_truncate_data_blocks_range` again, this time with our negative `count`. After that, `free_from` is *decremented* by `count`, since `count` is negative. My spidey-sense is tingling here. We're effectively subtracting from `free_from`.

Now, the really intriguing part is where it moves to `f2fs_truncate_inode_blocks` after calling `f2fs_put_dnode(&dn)`. I see that `free_from` has now decreased. I suspect this will cause some confusion, so I better check the implementation of `f2fs_truncate_inode_blocks` to understand what exactly is going on now that `free_from` is smaller than expected. I need to understand how the truncation is really happening, as the function might not be behaving as intended because of this subtraction.

map[ContextFile:fs/f2fs/node.c IncludeLines:true Name:f2fs_truncate_inode_blocks]

map[SourceCode:1181:	/*
1182:	 * All the block addresses of data and nodes should be nullified.
1183:	 */
1184:	int f2fs_truncate_inode_blocks(struct inode *inode, pgoff_t from)
1185:	{
1186:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
1187:		int err = 0, cont = 1;
1188:		int level, offset[4], noffset[4];
1189:		unsigned int nofs = 0;
1190:		struct dnode_of_data dn;
1191:		struct folio *folio;
1192:	
1193:		trace_f2fs_truncate_inode_blocks_enter(inode, from);
1194:	
1195:		level = get_node_path(inode, from, offset, noffset);
1196:		if (level <= 0) {
1197:			if (!level) {
1198:				level = -EFSCORRUPTED;
1199:				f2fs_err(sbi, "%s: inode ino=%llx has corrupted node block, from:%lu addrs:%u",
1200:						__func__, inode->i_ino,
1201:						from, ADDRS_PER_INODE(inode));
1202:				set_sbi_flag(sbi, SBI_NEED_FSCK);
1203:			}
1204:			trace_f2fs_truncate_inode_blocks_exit(inode, level);
1205:			return level;
1206:		}
1207:	
1208:		folio = f2fs_get_inode_folio(sbi, inode->i_ino);
1209:		if (IS_ERR(folio)) {
1210:			trace_f2fs_truncate_inode_blocks_exit(inode, PTR_ERR(folio));
1211:			return PTR_ERR(folio);
1212:		}
1213:	
1214:		set_new_dnode(&dn, inode, folio, NULL, 0);
1215:		folio_unlock(folio);
1216:	
1217:		switch (level) {
1218:		case 0:
1219:		case 1:
1220:			nofs = noffset[1];
1221:			break;
1222:		case 2:
1223:			nofs = noffset[1];
1224:			if (!offset[level - 1])
1225:				goto skip_partial;
1226:			err = truncate_partial_nodes(&dn, offset, level);
1227:			if (err < 0 && err != -ENOENT)
1228:				goto fail;
1229:			nofs += 1 + NIDS_PER_BLOCK;
1230:			break;
1231:		case 3:
1232:			nofs = 5 + 2 * NIDS_PER_BLOCK;
1233:			if (!offset[level - 1])
1234:				goto skip_partial;
1235:			err = truncate_partial_nodes(&dn, offset, level);
1236:			if (err < 0 && err != -ENOENT)
1237:				goto fail;
1238:			break;
1239:		default:
1240:			BUG();
1241:		}
1242:	
1243:	skip_partial:
1244:		while (cont) {
1245:			dn.nid = get_nid(folio, offset[0], true);
1246:			switch (offset[0]) {
1247:			case NODE_DIR1_BLOCK:
1248:			case NODE_DIR2_BLOCK:
1249:				err = truncate_dnode(&dn);
1250:				break;
1251:	
1252:			case NODE_IND1_BLOCK:
1253:			case NODE_IND2_BLOCK:
1254:				err = truncate_nodes(&dn, nofs, offset[1], 2);
1255:				break;
1256:	
1257:			case NODE_DIND_BLOCK:
1258:				err = truncate_nodes(&dn, nofs, offset[1], 3);
1259:				cont = 0;
1260:				break;
1261:	
1262:			default:
1263:				BUG();
1264:			}
1265:			if (err == -ENOENT) {
1266:				set_sbi_flag(F2FS_F_SB(folio), SBI_NEED_FSCK);
1267:				f2fs_handle_error(sbi, ERROR_INVALID_BLKADDR);
1268:				f2fs_err_ratelimited(sbi,
1269:					"truncate node fail, ino:%llu, nid:%u, "
1270:					"offset[0]:%d, offset[1]:%d, nofs:%d",
1271:					inode->i_ino, dn.nid, offset[0],
1272:					offset[1], nofs);
1273:				err = 0;
1274:			}
1275:			if (err < 0)
1276:				goto fail;
1277:			if (offset[1] == 0 && get_nid(folio, offset[0], true)) {
1278:				folio_lock(folio);
1279:				BUG_ON(!is_node_folio(folio));
1280:				set_nid(folio, offset[0], 0, true);
1281:				folio_unlock(folio);
1282:			}
1283:			offset[1] = 0;
1284:			offset[0]++;
1285:			nofs += err;
1286:		}
1287:	fail:
1288:		f2fs_folio_put(folio, false);
1289:		trace_f2fs_truncate_inode_blocks_exit(inode, err);
1290:		return err > 0 ? 0 : err;
1291:	}
 SourceFile:fs/f2fs/node.c]

gemini-3.1-pro-preview

							input: 119915
							output: 47
							thoughts: 3150
						

**Analysis of the F2FS Truncation Bug**

Okay, here's what I've pieced together about this F2FS truncation bug. It seems we have a situation where, under specific circumstances, truncating a file can lead to data loss and potential corruption, but not in a way that causes a kernel crash in production. My focus is understanding the root cause and the impact.

Initially, a negative `count` value triggers a check (`f2fs_bug_on`) that normally leads to a kernel `BUG` with `CONFIG_F2FS_CHECK_FS`. However, in a production environment where that option is *not* enabled, it merely generates a warning (`WARN_ON`) and sets a flag, `SBI_NEED_FSCK`, effectively returning an error code (-EFSCORRUPTED) and marking the file system for checking. The system proceeds without a crash, which is good.

The issue stems from how the truncation process handles partial blocks, especially within direct node blocks. The flow is: `f2fs_truncate_inode_blocks` is called after `f2fs_do_truncate_blocks`, but the `f2fs_truncate_data_blocks_range` within `f2fs_do_truncate_blocks` can incorrectly adjust the truncation start (`free_from`) relative to the direct node. The core problem occurs if `f2fs_truncate_inode_blocks` is called with a `from` address offset *within* a direct node block. It calculates an `offset` (e.g., 768), but then, it ignores that offset and calls `truncate_dnode`, which indiscriminately truncates the *entire* direct node block, including those blocks before the intended `from` point.

Specifically, it looks like `count` becomes negative when `free_from` is close to the `ADDRS_PER_INODE` boundary. This is followed by `f2fs_truncate_inode_blocks` getting an incorrect `offset` value which leads to calling `truncate_dnode` which wipes out an entire direct node when it should only be working with the final partial block within the direct node. It incorrectly truncates data blocks that should not have been truncated, causing the user data loss.

In essence, the code in `f2fs_truncate_inode_blocks` isn't correctly handling the case where it needs to truncate *from* a position within a direct node block. It assumes partial truncation has already happened. The net result: data is lost due to an incorrect truncation of the direct node block, deleting data from a file when it should not be. No security vulnerability here, just data loss for a regular user. It does not cause a crash or hang, only user data loss.

map[ContextFile:fs/f2fs/node.c IncludeLines:true Name:f2fs_remove_inode_page]

map[SourceCode:1321:	/*
1322:	 * Caller should grab and release a rwsem by calling f2fs_lock_op() and
1323:	 * f2fs_unlock_op().
1324:	 */
1325:	int f2fs_remove_inode_page(struct inode *inode)
1326:	{
1327:		struct dnode_of_data dn;
1328:		int err;
1329:	
1330:		set_new_dnode(&dn, inode, NULL, NULL, inode->i_ino);
1331:		err = f2fs_get_dnode_of_data(&dn, 0, LOOKUP_NODE);
1332:		if (err)
1333:			return err;
1334:	
1335:		err = f2fs_truncate_xattr_node(inode);
1336:		if (err) {
1337:			f2fs_put_dnode(&dn);
1338:			return err;
1339:		}
1340:	
1341:		/* remove potential inline_data blocks */
1342:		if (!IS_DEVICE_ALIASING(inode) &&
1343:		    (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
1344:		     S_ISLNK(inode->i_mode)))
1345:			f2fs_truncate_data_blocks_range(&dn, 1);
1346:	
1347:		/* 0 is possible, after f2fs_new_inode() has failed */
1348:		if (unlikely(f2fs_cp_error(F2FS_I_SB(inode)))) {
1349:			f2fs_put_dnode(&dn);
1350:			return -EIO;
1351:		}
1352:	
1353:		if (unlikely(inode->i_blocks != 0 && inode->i_blocks != 8)) {
1354:			f2fs_warn(F2FS_I_SB(inode),
1355:				"f2fs_remove_inode_page: inconsistent i_blocks, ino:%llu, iblocks:%llu",
1356:				inode->i_ino, (unsigned long long)inode->i_blocks);
1357:			set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
1358:		}
1359:	
1360:		/* will put inode & node pages */
1361:		err = truncate_node(&dn);
1362:		if (err) {
1363:			f2fs_put_dnode(&dn);
1364:			return err;
1365:		}
1366:		return 0;
1367:	}
 SourceFile:fs/f2fs/node.c]

gemini-3.1-pro-preview

							input: 124493
							output: 42
							thoughts: 38
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating the Data Node Truncation**

Alright, hold on a second. I'm seeing something that's making me pause. The `truncate_dnode` function is calling `f2fs_remove_inode_page(dn->inode)`? Now, that's not what I initially expected, and I know the implications of that call. We're directly removing a page associated with an inode during a truncation. That feels like it could have some potential side effects that I need to mentally trace. I'm going to quickly re-examine the logic within `truncate_dnode` to ensure I'm not missing anything. I need to understand *why* this call is made *when* it's made, and precisely what context it's operating within. Okay, time to dive back in... let's see what's going on within that function call.

map[ContextFile:fs/f2fs/node.c IncludeLines:true Name:truncate_dnode]

map[SourceCode:1002:	static int truncate_dnode(struct dnode_of_data *dn)
1003:	{
1004:		struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
1005:		struct folio *folio;
1006:		int err;
1007:	
1008:		if (dn->nid == 0)
1009:			return 1;
1010:	
1011:		/* get direct node */
1012:		folio = f2fs_get_node_folio(sbi, dn->nid, NODE_TYPE_NON_INODE);
1013:		if (PTR_ERR(folio) == -ENOENT)
1014:			return 1;
1015:		else if (IS_ERR(folio))
1016:			return PTR_ERR(folio);
1017:	
1018:		if (IS_INODE(folio) || ino_of_node(folio) != dn->inode->i_ino) {
1019:			f2fs_err(sbi, "incorrect node reference, ino: %llu, nid: %u, ino_of_node: %u",
1020:					dn->inode->i_ino, dn->nid, ino_of_node(folio));
1021:			set_sbi_flag(sbi, SBI_NEED_FSCK);
1022:			f2fs_handle_error(sbi, ERROR_INVALID_NODE_REFERENCE);
1023:			f2fs_folio_put(folio, true);
1024:			return -EFSCORRUPTED;
1025:		}
1026:	
1027:		/* Make dnode_of_data for parameter */
1028:		dn->node_folio = folio;
1029:		dn->ofs_in_node = 0;
1030:		f2fs_truncate_data_blocks_range(dn, ADDRS_PER_BLOCK(dn->inode));
1031:		err = truncate_node(dn);
1032:		if (err) {
1033:			f2fs_folio_put(folio, true);
1034:			return err;
1035:		}
1036:	
1037:		return 1;
1038:	}
 SourceFile:fs/f2fs/node.c]

gemini-3.1-pro-preview

							input: 125431
							output: 53
							thoughts: 230
						

**Analyzing the Impact of the `truncate_node` Call**

Okay, so the code snippet in question calls `truncate_node(dn)`, not that other function I was initially thinking of. Good. That's the first critical piece. `truncate_node` specifically targets freeing the node block, right? So, in effect, we're just deleting that direct node block. From that perspective, it's just a straight-up data loss scenario for the user's file. We're talking about those initial blocks, 0 through 767 within that direct node block, just gone. At first glance, that seemed pretty benign; no immediate concerns about memory corruption, DoS attacks, or any privilege escalation vulnerabilities that I could readily identify. But, I need to be more thorough, let's look further.

Wait, what's this? I see that `count` can be `-1`. If that's the case, then `f2fs_truncate_data_blocks_range` is called with that negative value. The value `-1` is assigned to `len` which becomes `-1`... and that `-1` is passed to `f2fs_update_read_extent_cache_range`? This is suspicious.

Hold on, I see that `len` is ultimately treated as an `unsigned int` within `f2fs_update_read_extent_cache_range`. This is starting to look very interesting. We've got a signed integer being used where an unsigned integer is expected. I need to dig deeper into the implications of that potentially causing integer wraparound or something unexpected. Time to check the implementation of `f2fs_update_read_extent_cache_range`.

map[ContextFile:fs/f2fs/extent_cache.c IncludeLines:true Name:f2fs_update_read_extent_cache_range]

map[SourceCode:1076:	void f2fs_update_read_extent_cache_range(struct dnode_of_data *dn,
1077:					pgoff_t fofs, block_t blkaddr, unsigned int len)
1078:	{
1079:		struct extent_info ei = {
1080:			.fofs = fofs,
1081:			.len = len,
1082:			.blk = blkaddr,
1083:		};
1084:	
1085:		if (!__may_extent_tree(dn->inode, EX_READ))
1086:			return;
1087:	
1088:		__update_extent_tree_range(dn->inode, &ei, EX_READ);
1089:	}
 SourceFile:fs/f2fs/extent_cache.c]

gemini-3.1-pro-preview

							input: 126322
							output: 48
							thoughts: 66
						

**Analyzing Potential Integer Overflow**

Okay, so I'm looking at this code and I see that `len` is defined as an `unsigned int`. That immediately flags a potential issue in my mind. The crux of it seems to hinge on what happens when `count` takes on a value of -1. If that happens, because it's being assigned to `len`, an unsigned integer, the negative one effectively wraps around to become the maximum value representable by an `unsigned int`, which is `0xFFFFFFFF`.

And that's the point where `__update_extent_tree_range` gets called. Critically, we're passing in `ei.len = 0xFFFFFFFF`. So now I need to dive into the implementation of `__update_extent_tree_range` to see *how* it handles that extremely large value. Does it perform any sanity checks? Are there any calculations that could overflow further with such a large input? Is this an intentional value or not? I need to analyze how that function behaves when it sees a potentially very large extent.

map[ContextFile:fs/f2fs/extent_cache.c IncludeLines:true Name:__update_extent_tree_range]

map[SourceCode: 659:	static void __update_extent_tree_range(struct inode *inode,
 660:				struct extent_info *tei, enum extent_type type)
 661:	{
 662:		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 663:		struct extent_tree *et = F2FS_I(inode)->extent_tree[type];
 664:		struct extent_node *en = NULL, *en1 = NULL;
 665:		struct extent_node *prev_en = NULL, *next_en = NULL;
 666:		struct extent_info ei, dei, prev;
 667:		struct rb_node **insert_p = NULL, *insert_parent = NULL;
 668:		unsigned int fofs = tei->fofs, len = tei->len;
 669:		unsigned int end = fofs + len;
 670:		bool updated = false;
 671:		bool leftmost = false;
 672:	
 673:		if (!et)
 674:			return;
 675:	
 676:		if (unlikely(len == 0)) {
 677:			f2fs_err_ratelimited(sbi, "%s: extent len is zero, type: %d, "
 678:				"extent [%u, %u, %u], age [%llu, %llu]",
 679:				__func__, type, tei->fofs, tei->blk, tei->len,
 680:				tei->age, tei->last_blocks);
 681:			f2fs_bug_on(sbi, 1);
 682:			return;
 683:		}
 684:	
 685:		if (type == EX_READ)
 686:			trace_f2fs_update_read_extent_tree_range(inode, fofs, len,
 687:							tei->blk, 0);
 688:		else if (type == EX_BLOCK_AGE)
 689:			trace_f2fs_update_age_extent_tree_range(inode, fofs, len,
 690:							tei->age, tei->last_blocks);
 691:	
 692:		write_lock(&et->lock);
 693:	
 694:		if (is_inode_flag_set(inode, FI_NO_EXTENT)) {
 695:			write_unlock(&et->lock);
 696:			return;
 697:		}
 698:	
 699:		if (type == EX_READ) {
 700:			prev = et->largest;
 701:			dei.len = 0;
 702:	
 703:			/*
 704:			 * drop largest extent before lookup, in case it's already
 705:			 * been shrunk from extent tree
 706:			 */
 707:			__drop_largest_extent(et, fofs, len);
 708:		}
 709:	
 710:		/* 1. lookup first extent node in range [fofs, fofs + len - 1] */
 711:		en = __lookup_extent_node_ret(&et->root,
 712:						et->cached_en, fofs,
 713:						&prev_en, &next_en,
 714:						&insert_p, &insert_parent,
 715:						&leftmost);
 716:		if (!en)
 717:			en = next_en;
 718:	
 719:		/* 2. invalidate all extent nodes in range [fofs, fofs + len - 1] */
 720:		while (en && en->ei.fofs < end) {
 721:			unsigned int org_end;
 722:			int parts = 0;	/* # of parts current extent split into */
 723:	
 724:			next_en = en1 = NULL;
 725:	
 726:			dei = en->ei;
 727:			org_end = dei.fofs + dei.len;
 728:			f2fs_bug_on(sbi, fofs >= org_end);
 729:	
 730:			if (fofs > dei.fofs && (type != EX_READ ||
 731:					fofs - dei.fofs >= F2FS_MIN_EXTENT_LEN)) {
 732:				en->ei.len = fofs - en->ei.fofs;
 733:				prev_en = en;
 734:				parts = 1;
 735:			}
 736:	
 737:			if (end < org_end && (type != EX_READ ||
 738:				(org_end - end >= F2FS_MIN_EXTENT_LEN &&
 739:				atomic_read(&et->node_cnt) <
 740:						sbi->max_read_extent_count))) {
 741:				if (parts) {
 742:					__set_extent_info(&ei,
 743:						end, org_end - end,
 744:						end - dei.fofs + dei.blk, false,
 745:						dei.age, dei.last_blocks,
 746:						type);
 747:					en1 = __insert_extent_tree(sbi, et, &ei,
 748:								NULL, NULL, true);
 749:					next_en = en1;
 750:				} else {
 751:					__set_extent_info(&en->ei,
 752:						end, en->ei.len - (end - dei.fofs),
 753:						en->ei.blk + (end - dei.fofs), true,
 754:						dei.age, dei.last_blocks,
 755:						type);
 756:					next_en = en;
 757:				}
 758:				parts++;
 759:			}
 760:	
 761:			if (!next_en) {
 762:				struct rb_node *node = rb_next(&en->rb_node);
 763:	
 764:				next_en = rb_entry_safe(node, struct extent_node,
 765:							rb_node);
 766:			}
 767:	
 768:			if (parts)
 769:				__try_update_largest_extent(et, en);
 770:			else
 771:				__release_extent_node(sbi, et, en);
 772:	
 773:			/*
 774:			 * if original extent is split into zero or two parts, extent
 775:			 * tree has been altered by deletion or insertion, therefore
 776:			 * invalidate pointers regard to tree.
 777:			 */
 778:			if (parts != 1) {
 779:				insert_p = NULL;
 780:				insert_parent = NULL;
 781:			}
 782:			en = next_en;
 783:		}
 784:	
 785:		if (type == EX_BLOCK_AGE)
 786:			goto update_age_extent_cache;
 787:	
 788:		/* 3. update extent in read extent cache */
 789:		BUG_ON(type != EX_READ);
 790:	
 791:		if (tei->blk) {
 792:			__set_extent_info(&ei, fofs, len, tei->blk, false,
 793:					  0, 0, EX_READ);
 794:			if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en))
 795:				__insert_extent_tree(sbi, et, &ei,
 796:						insert_p, insert_parent, leftmost);
 797:	
 798:			/* give up extent_cache, if split and small updates happen */
 799:			if (dei.len >= 1 &&
 800:					prev.len < F2FS_MIN_EXTENT_LEN &&
 801:					et->largest.len < F2FS_MIN_EXTENT_LEN) {
 802:				et->largest.len = 0;
 803:				et->largest_updated = true;
 804:				set_inode_flag(inode, FI_NO_EXTENT);
 805:			}
 806:		}
 807:	
 808:		if (et->largest_updated) {
 809:			et->largest_updated = false;
 810:			updated = true;
 811:		}
 812:		goto out_read_extent_cache;
 813:	update_age_extent_cache:
 814:		if (tei->last_blocks == F2FS_EXTENT_AGE_INVALID)
 815:			goto out_read_extent_cache;
 816:	
 817:		__set_extent_info(&ei, fofs, len, 0, false,
 818:				tei->age, tei->last_blocks, EX_BLOCK_AGE);
 819:		if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en))
 820:			__insert_extent_tree(sbi, et, &ei,
 821:						insert_p, insert_parent, leftmost);
 822:	out_read_extent_cache:
 823:		write_unlock(&et->lock);
 824:	
 825:		if (is_inode_flag_set(inode, FI_NO_EXTENT))
 826:			__destroy_extent_node(inode, EX_READ);
 827:	
 828:		if (updated)
 829:			f2fs_mark_inode_dirty_sync(inode, true);
 830:	}
 SourceFile:fs/f2fs/extent_cache.c]

gemini-3.1-pro-preview

							input: 129405
							output: 66
							thoughts: 4401
						

**My Analysis of the F2FS Truncation Bug**

Alright, let's break this down. My initial thought is that in the `__update_extent_tree_range` function, there's a potential integer overflow when calculating `end` if `len` is `0xFFFFFFFF`. However, after examining the subsequent logic, it looks like this overflow doesn't lead to any immediate issues due to how the `while` loop condition is structured. Even though `end` would wrap, the loop condition `en->ei.fofs < end` would always be false because `en->ei.fofs` starts at least from the offset, preventing the loop from executing. Now, the crucial part is that `tei->blk` is zero, so the if block is skipped, doing nothing. The consequence is just the function effectively does nothing in those scenarios. This sets off some alarm bells.

Digging deeper, the real issue seems to stem from how `count` becomes negative and is subsequently passed into `f2fs_truncate_inode_blocks`. The warning `WARN_ON` is triggered due to the negative `count` which flags that a kernel assumption is violated. However, even with this warning, the system doesn't crash in production builds. The consequences, as I see it, are that the `count` is incorrectly calculated, leading to some truncation, but it's *incorrect truncation* of the *user's data*, not a system-level crash or resource exhaustion. Since a negative `count` causes `f2fs_truncate_data_blocks_range` to essentially do nothing and then it causes data loss. The call to `f2fs_truncate_inode_blocks` *does* truncate the *user's* file, but there are no memory corruption or other critical issues.

After careful evaluation, it seems the bug only causes a user to lose some of their file data and sets the `SBI_NEED_FSCK` flag. This flag doesn't *directly* cause a denial of service. The file system check on the next boot might *delay* the system but does not prevent further operations on a mounted filesystem.

Looking at the code again, if `count` is negative, `f2fs_truncate_data_blocks_range` won't truncate anything, but then `free_from += count` reduces the amount of data being "freed" and calls `f2fs_truncate_inode_blocks` with the wrong `from` value (less than the blocks in the inode), causing that truncation call to return an error, but does not crash the system.

So, in conclusion, this bug does not cause a Denial of Service, it is not exploitable and because it affects a file, it is only triggerable by the Filesystem trigger.

So, here's my final assessment:

*   Exploitable: False
*   DenialOfService: False
*   Unprivileged: True
*   UserNamespace: True
*   VMGuestTrigger: False
*   VMHostTrigger: False
*   NetworkTrigger: False
*   RemoteTrigger: False
*   PeripheralTrigger: False
*   FilesystemTrigger: True

map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]

map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:true VMGuestTrigger:false VMHostTrigger:false]

gemini-3.1-pro-preview

							input: 134614
							output: 703
							thoughts: 14
						

Okay, here's the summary, formatted as you requested:

**Final Reasoning: My Post-Analysis Thought Process**

Alright, the data is in, the calculations are complete, and now it's time to solidify my reasoning. I've meticulously reviewed the results; double-checked assumptions, and considered the implications of each significant finding. This isn't just about presenting the "answer," it's about crafting a narrative that logically connects the evidence to the conclusions. I need to ensure that the argument is airtight, acknowledging any limitations or potential alternative interpretations, while firmly grounding the conclusions in the observed phenomena. The process of formulating this final reasoning is where the true value lies, translating technical findings into something meaningful and actionable. I'm aiming for clarity and precision, allowing the audience to fully grasp not just *what* happened, but also *why* it happened, and what that means in the broader context of my field. It's about providing a robust and justifiable framework for understanding.

map[Explanation:The bug is a `kernel BUG` triggered in `f2fs_do_truncate_blocks` when `count <
0`. This happens because `count` is calculated as `ADDRS_PER_PAGE(dn.node_folio,
inode) - dn.ofs_in_node`. For compressed files, `ADDRS_PER_PAGE` aligns the
number of addresses down to the cluster size. If the cluster size is large
(e.g., 256 blocks) and the truncation offset falls within the unaligned
remainder of the node block (e.g., between 768 and 922 for an inode block),
`dn.ofs_in_node` can be greater than `ADDRS_PER_PAGE`, resulting in a negative
`count`.

**Exploitable / Denial of Service:**
In the syzbot report, this triggers a `kernel BUG` because the kernel was
compiled with `CONFIG_F2FS_CHECK_FS=y`, which defines `f2fs_bug_on` as `BUG_ON`.
However, in production builds, `CONFIG_F2FS_CHECK_FS` is disabled (it is a
debugging feature). When disabled, `f2fs_bug_on` is defined as a `WARN_ON` that
sets the `SBI_NEED_FSCK` flag.
If we trace the execution with a negative `count` in a production build:
1. `f2fs_truncate_data_blocks_range` is called with a negative `count`. Its
internal loop `for (; count > 0; ...)` immediately terminates, doing nothing.
2. `free_from += count` decreases the `free_from` offset.
3. `f2fs_truncate_inode_blocks` is called with the decreased `free_from`. It
either returns `-EFSCORRUPTED` (if `free_from` falls into the direct pointers of
the inode) or truncates the entire direct node block (causing data loss for the
user's own file).
In all cases, there is no out-of-bounds memory access, no infinite loop, no
deadlock, and no kernel panic. The bug is completely benign in production
builds, causing only a kernel warning and potential data loss for the user's own
file. Therefore, it is neither exploitable nor a Denial of Service.

**Unprivileged / User Namespace:**
An unprivileged user can trigger this bug on any mounted F2FS filesystem that
has compression enabled. They can create a file, enable compression
(`FS_COMPR_FL`), set the cluster size to 256 via the
`F2FS_IOC_SET_COMPRESS_OPTION` ioctl (which requires no special capabilities),
and then call `truncate()` to a specific size that maps to the vulnerable offset
range. Since no capabilities are required, it is accessible from unprivileged
processes and user namespaces.

**Malicious Filesystem Trigger:**
The bug can also be triggered during the `mount` of a maliciously crafted F2FS
image. As seen in the call trace, if `f2fs_fill_super` fails and cleans up
orphan inodes, it calls `evict` -> `f2fs_truncate`, which triggers the bug if
the image contains a compressed inode with a malicious size and cluster size.]