Swap meta allocators with much more reserve.

We increase the reserve from 2x to 3x the minimum number of blocks
needed for our reserve, and change the algorithm that determines when
to swap them.

The old algorithm swaps them if _avail is just larger than _freed. While
the simplest algorithm, it suffers from the problem that in practice,
when we hit ENOSPC conditions, it will almost always swap on every
iteration when we hit our low water mark.

In our testing, we regularly see failures because what is effectively
happening is that we starve both allocators by slowly draining them
block by block, trying to do work. The work of course requires us to
drain more blocks to commit changes. This cycle doesn't end until both
allocators are almost completely drained and not enough blocks remain to
do any real work anymore.

The new algorithm will not swap allocators unless _freed is 50%
larger than _avail.

The outcome is that, during meta space pressure, we're allowing _avail to
slowly drain down to the same levels as before, effectively. However, we
then swap to _freed which is now 1.5x larger.

This results in us being able to do a whole chunk of work without
needing to swap. While draining _avail for longer, we allow work to
commit and recycle blocks back into _freed muich more effectively.

Signed-off-by: Auke Kok <auke.kok@versity.com>

ReleaseNotes.md

@@ -1,6 +1,58 @@
 Versity ScoutFS Release Notes
 =============================
 
+---
+v1.23
+\
+*Dec 11, 2024*
+
+Add support for kernels in the RHEL 9.5 minor release.
+
+---
+v1.22
+\
+*Nov 1, 2024*
+
+Add support for building against the RHEL9 family of kernels.
+
+Fix failure of the setattr\_more ioctl() to set the attributes of a
+zero-length file when restoring.
+
+Fix support for POSIX ACLs in the RHEL8 and later family of kernels.
+
+Fix a race condition in the lock server that could drop lock requests
+under heavy load and cause cluster lock attempts to hang.
+
+---
+v1.21
+\
+*Jul 1, 2024*
+
+This release adds features that rely on incompatible changes to
+structure the file system.  The process of advancing the format version
+to enable these features is described in scoutfs(5).
+
+Added the ".indx." extended attribute tag which can be used to determine
+the sorting of files in a global index.
+
+Added ScoutFS quotas which let rules define file size and count limits
+in terms of ".totl." extended attribute totals.
+
+Added the project ID file attribute which is inherited from parent
+directories on creation.  ScoutFS quota rules can reference project IDs.
+
+Add a retention attribute for files which prevents modification once
+enabled.
+
+---
+v1.20
+\
+*Apr 22, 2024*
+
+Minor changes to packaging to better support "weak" module linking of
+the kernel module, and to including git hashes in the built package.  No
+changes in runtime behaviour.
+
 ---
 v1.19
 \

kmod/Makefile

@@ -12,17 +12,22 @@ else
 SP = @:
 endif
 
-SCOUTFS_GIT_DESCRIBE := \
+SCOUTFS_GIT_DESCRIBE ?= \
 	$(shell git describe --all --abbrev=6 --long 2>/dev/null || \
 		echo no-git)
 
+ESCAPED_GIT_DESCRIBE := \
+	$(shell echo $(SCOUTFS_GIT_DESCRIBE) |sed -e 's/\//\\\//g')
+
+RPM_GITHASH ?= $(shell git rev-parse --short HEAD)
+
 SCOUTFS_ARGS := SCOUTFS_GIT_DESCRIBE=$(SCOUTFS_GIT_DESCRIBE) \
+		RPM_GITHASH=$(RPM_GITHASH) \
 		CONFIG_SCOUTFS_FS=m -C $(SK_KSRC) M=$(CURDIR)/src \
 		EXTRA_CFLAGS="-Werror"
 
 # - We use the git describe from tags to set up the RPM versioning
 RPM_VERSION := $(shell git describe --long --tags | awk -F '-' '{gsub(/^v/,""); print $$1}')
-RPM_GITHASH := $(shell git rev-parse --short HEAD)
 TARFILE = scoutfs-kmod-$(RPM_VERSION).tar
 
 
@@ -41,7 +46,8 @@ modules_install:
 
 %.spec: %.spec.in .FORCE
 	sed -e 's/@@VERSION@@/$(RPM_VERSION)/g' \
-	    -e 's/@@GITHASH@@/$(RPM_GITHASH)/g' < $< > $@+
+	    -e 's/@@GITHASH@@/$(RPM_GITHASH)/g' \
+	    -e 's/@@GITDESCRIBE@@/$(ESCAPED_GIT_DESCRIBE)/g' < $< > $@+
 	mv $@+ $@
 
 

kmod/scoutfs-kmod.spec.in

@@ -1,19 +1,16 @@
 %define kmod_name scoutfs
 %define kmod_version @@VERSION@@
 %define kmod_git_hash @@GITHASH@@
+%define kmod_git_describe @@GITDESCRIBE@@
 %define pkg_date %(date +%%Y%%m%%d)
 
-# Disable the building of the debug package(s).
-%define debug_package %{nil}
-
 # take kernel version or default to uname -r
 %{!?kversion: %global kversion %(uname -r)}
 %global kernel_version %{kversion}
 
 %if 0%{?el7}
 %global kernel_source() /usr/src/kernels/%{kernel_version}.$(arch)
-%endif
-%if 0%{?el8}
+%else
 %global kernel_source() /usr/src/kernels/%{kernel_version}
 %endif
 
@@ -21,8 +18,7 @@
 
 %if 0%{?el7}
 Name:           %{kmod_name}
-%endif
-%if 0%{?el8}
+%else
 Name:           kmod-%{kmod_name}
 %endif
 Summary:        %{kmod_name} kernel module
@@ -34,8 +30,7 @@ URL:            http://scoutfs.org/
 
 %if 0%{?el7}
 BuildRequires:  %{kernel_module_package_buildreqs}
-%endif
-%if 0%{?el8}
+%else
 BuildRequires:  elfutils-libelf-devel
 %endif
 BuildRequires:  kernel-devel-uname-r = %{kernel_version}
@@ -53,10 +48,23 @@ Source:		%{kmod_name}-kmod-%{kmod_version}.tar
 %endif
 
 %global install_mod_dir extra/%{kmod_name}
-%if 0%{?el8}
+
+%if ! 0%{?el7}
 %global flavors_to_build x86_64
 %endif
 
+# el9 sanity: make sure we lock to the minor release we built for and block upgrades
+%{lua:
+  if string.match(rpm.expand("%{dist}"), "%.el9") then
+    rpm.define("el9 1")
+  end
+}
+
+%if 0%{?el9}
+%define release_major_minor 9.%{lua: print(rpm.expand("%{dist}"):match("%.el9_(%d)"))}
+Requires: system-release = %{release_major_minor}
+%endif
+
 %description
 %{kmod_name} - kernel module
 
@@ -75,7 +83,7 @@ echo "Building for kernel: %{kernel_version} flavors: '%{flavors_to_build}'"
 for flavor in %flavors_to_build; do
     rm -rf obj/$flavor
     cp -r source obj/$flavor
-    make SK_KSRC=%{kernel_source $flavor} -C obj/$flavor module
+    make RPM_GITHASH=%{kmod_git_hash} SCOUTFS_GIT_DESCRIBE=%{kmod_git_describe} SK_KSRC=%{kernel_source $flavor} -C obj/$flavor module
 done
 
 %install
@@ -92,15 +100,23 @@ done
 # mark modules executable so that strip-to-file can strip them
 find %{buildroot} -type f -name \*.ko -exec %{__chmod} u+x \{\} \;
 
-%if 0%{?el8}
+%if ! 0%{?el7}
 %files
 /lib/modules
 
 %post
-weak-modules --add-kernel --no-initramfs
+echo /lib/modules/%{kversion}/%{install_mod_dir}/scoutfs.ko | weak-modules --add-modules --no-initramfs
 depmod -a
 %endif
 
 %clean
 rm -rf %{buildroot}
 
+%preun
+# stash our modules for postun cleanup
+SCOUTFS_RPM_NAME=$(rpm -q %{name} | grep "%{version}-%{release}")
+rpm -ql $SCOUTFS_RPM_NAME | grep '\.ko$' > /var/run/%{name}-modules-%{version}-%{release} || true
+
+%postun
+cat /var/run/%{name}-modules-%{version}-%{release} | weak-modules --remove-modules --no-initramfs
+rm /var/run/%{name}-modules-%{version}-%{release} || true

kmod/src/Makefile

@@ -9,6 +9,7 @@ CFLAGS_scoutfs_trace.o = -I$(src) # define_trace.h double include
  
 scoutfs-y +=			\
 	acl.o			\
+	attr_x.o		\
 	avl.o			\
 	alloc.o			\
 	block.o			\
@@ -34,6 +35,7 @@ scoutfs-y +=			\
 	options.o		\
 	per_task.o		\
 	quorum.o		\
+	quota.o			\
 	recov.o			\
 	scoutfs_trace.o		\
 	server.o		\
@@ -42,10 +44,12 @@ scoutfs-y +=			\
 	srch.o			\
 	super.o			\
 	sysfs.o			\
+	totl.o			\
 	trans.o			\
 	triggers.o		\
 	tseq.o			\
 	volopt.o		\
+	wkic.o			\
 	xattr.o
 
 #

kmod/src/Makefile.kernelcompat

@@ -78,8 +78,9 @@ endif
 # v4.8-rc1-29-g31051c85b5e2
 #
 # inode_change_ok() removed - replace with setattr_prepare()
+# v5.11-rc4-7-g2f221d6f7b88 removes extern attribute
 #
-ifneq (,$(shell grep 'extern int setattr_prepare' include/linux/fs.h))
+ifneq (,$(shell grep 'int setattr_prepare' include/linux/fs.h))
 ccflags-y += -DKC_SETATTR_PREPARE
 endif
 
@@ -191,7 +192,7 @@ endif
 #
 # Kernel has current_time(inode) to uniformly retreive timespec in the right unit
 #
-ifneq (,$(shell grep 'extern struct timespec64 current_time' include/linux/fs.h))
+ifneq (,$(shell grep 'struct timespec64 current_time' include/linux/fs.h))
 ccflags-y += -DKC_CURRENT_TIME_INODE=1
 endif
 
@@ -258,3 +259,175 @@ endif
 ifneq (,$(shell grep 'static inline const char .xattr_prefix' include/linux/xattr.h))
 ccflags-y += -DKC_XATTR_HANDLER_NAME=1
 endif
+
+#
+# v5.19-rc4-96-g342a72a33407
+#
+# Adds `typedef __u32 __bitwise blk_opf_t` to aid flag checking
+ifneq (,$(shell grep 'typedef __u32 __bitwise blk_opf_t' include/linux/blk_types.h))
+ccflags-y += -DKC_HAVE_BLK_OPF_T=1
+endif
+
+#
+# v5.12-rc6-9-g4f0f586bf0c8
+#
+# list_sort cmp function takes const list_head args
+ifneq (,$(shell grep 'const struct list_head ., const struct list_head .' include/linux/list_sort.h))
+ccflags-y += -DKC_LIST_CMP_CONST_ARG_LIST_HEAD
+endif
+
+# v5.7-523-g88dca4ca5a93
+#
+# The pgprot argument to vmalloc is always PAGE_KERNEL, so it is removed.
+ifneq (,$(shell grep 'extern void .__vmalloc.unsigned long size, gfp_t gfp_mask, pgprot_t prot' include/linux/vmalloc.h))
+ccflags-y += -DKC_VMALLOC_PGPROT_T
+endif
+
+# v6.2-rc1-18-g01beba7957a2
+#
+# fs: port inode_owner_or_capable() to mnt_idmap
+ifneq (,$(shell grep 'bool inode_owner_or_capable.struct user_namespace .mnt_userns' include/linux/fs.h))
+ccflags-y += -DKC_INODE_OWNER_OR_CAPABLE_USERNS
+endif
+
+#
+# v5.11-rc4-5-g47291baa8ddf
+#
+# namei: make permission helpers idmapped mount aware
+ifneq (,$(shell grep 'int inode_permission.struct user_namespace' include/linux/fs.h))
+ccflags-y += -DKC_INODE_PERMISSION_USERNS
+endif
+
+#
+# v5.11-rc4-24-g549c7297717c
+#
+# fs: make helpers idmap mount aware
+# Enlarges the VFS API methods to include user namespace argument.
+ifneq (,$(shell grep 'int ..mknod. .struct user_namespace' include/linux/fs.h))
+ccflags-y += -DKC_VFS_METHOD_USER_NAMESPACE_ARG
+endif
+
+#
+# v5.17-rc2-21-g07888c665b40
+#
+# Detect new style bio_alloc - pass bdev and opf.
+ifneq (,$(shell grep 'struct bio .bio_alloc.struct block_device .bdev' include/linux/bio.h))
+ccflags-y += -DKC_BIO_ALLOC_DEV_OPF_ARGS
+endif
+
+#
+# v5.7-rc4-53-gcddf8a2c4a82
+#
+# fiemap_prep() replaces fiemap_check_flags()
+ifneq (,$(shell grep -s 'int fiemap_prep.struct inode' include/linux/fiemap.h))
+ccflags-y += -DKC_FIEMAP_PREP
+endif
+
+#
+# v5.17-13043-g800ba29547e1
+#
+# generic_perform_write args use kiocb for passing filp and pos
+ifneq (,$(shell grep 'ssize_t generic_perform_write.struct kiocb ., struct iov_iter' include/linux/fs.h))
+ccflags-y += -DKC_GENERIC_PERFORM_WRITE_KIOCB_IOV_ITER
+endif
+
+#
+# v5.7-rc6-2496-g76ee0785f42a
+#
+# net: add sock_set_sndtimeo
+ifneq (,$(shell grep 'void sock_set_sndtimeo.struct sock' include/net/sock.h))
+ccflags-y += -DKC_SOCK_SET_SNDTIMEO
+endif
+
+#
+# v5.8-rc4-1931-gba423fdaa589
+#
+# setsockopt functions are now passed a sockptr_t value instead of char*
+ifneq (,$(shell grep -s 'include .linux/sockptr.h.' include/linux/net.h))
+ccflags-y += -DKC_SETSOCKOPT_SOCKPTR_T
+endif
+
+#
+# v5.7-rc6-2507-g71c48eb81c9e
+#
+# Adds a bunch of low level TCP sock parameter functions that we want to use.
+ifneq (,$(shell grep 'int tcp_sock_set_keepintvl' include/linux/tcp.h))
+ccflags-y += -DKC_HAVE_TCP_SET_SOCKFN
+endif
+
+#
+# v4.16-rc3-13-ga84d1169164b
+#
+# Fixes y2038 issues with struct timeval.
+ifneq (,$(shell grep -s '^struct __kernel_old_timeval .' include/uapi/linux/time_types.h))
+ccflags-y += -DKC_KERNEL_OLD_TIMEVAL_STRUCT
+endif
+
+#
+# v5.19-rc4-52-ge33c267ab70d
+#
+# register_shrinker now requires a name, used for debug stats etc.
+ifneq (,$(shell grep 'int __printf.*register_shrinker.struct shrinker .shrinker,' include/linux/shrinker.h))
+ccflags-y += -DKC_SHRINKER_NAME
+endif
+
+#
+# v5.18-rc5-246-gf132ab7d3ab0
+#
+# mpage_readpage() is now replaced with mpage_read_folio.
+ifneq (,$(shell grep 'int mpage_read_folio.struct folio .folio' include/linux/mpage.h))
+ccflags-y += -DKC_MPAGE_READ_FOLIO
+endif
+
+#
+# v5.18-rc5-219-gb3992d1e2ebc
+#
+# block_write_begin() no longer is being passed aop_flags
+ifneq (,$(shell grep -C1 'int block_write_begin' include/linux/buffer_head.h | tail -n 2 | grep 'unsigned flags'))
+ccflags-y += -DKC_BLOCK_WRITE_BEGIN_AOP_FLAGS
+endif
+
+#
+# v6.0-rc6-9-g863f144f12ad
+#
+# the .tmpfile() vfs method calling convention changed and now a struct
+# file* is passed to this metiond instead of a dentry. The function also
+# should open the created file and call finish_open_simple() before returning.
+ifneq (,$(shell grep 'extern void d_tmpfile.struct dentry' include/linux/dcache.h))
+ccflags-y += -DKC_D_TMPFILE_DENTRY
+endif
+
+#
+# v6.4-rc2-201-g0733ad800291
+#
+# New blk_mode_t replaces abuse of fmode_t
+ifneq (,$(shell grep 'typedef unsigned int __bitwise blk_mode_t' include/linux/blkdev.h))
+ccflags-y += -DKC_HAVE_BLK_MODE_T
+endif
+
+#
+# v6.4-rc2-186-g2736e8eeb0cc
+#
+# Reworks FMODE_EXCL kludge and instead modifies the blkdev_put() call to pass in
+# the (exclusive) holder to implement FMODE_EXCL handling.
+ifneq (,$(shell grep 'blkdev_put.struct block_device .bdev, void .holder' include/linux/blkdev.h))
+ccflags-y += -DKC_BLKDEV_PUT_HOLDER_ARG
+endif
+
+#
+# v6.4-rc4-163-g0d625446d0a4
+#
+# Entirely removes current->backing_dev_info to ultimately remove buffer_head
+# completely at some point.
+ifneq (,$(shell grep 'struct backing_dev_info.*backing_dev_info;' include/linux/sched.h))
+ccflags-y += -DKC_CURRENT_BACKING_DEV_INFO
+endif
+
+#
+# v6.8-rc1-4-gf3a608827d1f
+#
+# adds bdev_file_open_by_path() and later in v6.8-rc1-30-ge97d06a46526 removes bdev_open_by_path()
+# which requires us to use the file method from now on.
+ifneq (,$(shell grep 'struct file.*bdev_file_open_by_path.const char.*path' include/linux/blkdev.h))
+ccflags-y += -DKC_BDEV_FILE_OPEN_BY_PATH
+endif

kmod/src/acl.c

@@ -98,11 +98,9 @@ struct posix_acl *scoutfs_get_acl_locked(struct inode *inode, int type, struct s
 		acl = ERR_PTR(ret);
 	}
 
-#ifndef KC___POSIX_ACL_CREATE
 	/* can set null negative cache */
 	if (!IS_ERR(acl))
 		set_cached_acl(inode, type, acl);
-#endif
 
 	kfree(value);
 
@@ -155,7 +153,8 @@ int scoutfs_set_acl_locked(struct inode *inode, struct posix_acl *acl, int type,
 	switch (type) {
 	case ACL_TYPE_ACCESS:
 		if (acl) {
-			ret = posix_acl_update_mode(inode, &new_mode, &acl);
+			ret = posix_acl_update_mode(KC_VFS_INIT_NS
+						    inode, &new_mode, &acl);
 			if (ret < 0)
 				goto out;
 			set_mode = true;
@@ -194,10 +193,8 @@ int scoutfs_set_acl_locked(struct inode *inode, struct posix_acl *acl, int type,
 	}
 
 out:
-#ifndef KC___POSIX_ACL_CREATE
 	if (!ret)
 		set_cached_acl(inode, type, acl);
-#endif
 
 	kfree(value);
 
@@ -256,7 +253,9 @@ int scoutfs_acl_get_xattr(struct dentry *dentry, const char *name, void *value,
 }
 
 #ifdef KC_XATTR_STRUCT_XATTR_HANDLER
-int scoutfs_acl_set_xattr(const struct xattr_handler *handler, struct dentry *dentry,
+int scoutfs_acl_set_xattr(const struct xattr_handler *handler,
+			  KC_VFS_NS_DEF
+			  struct dentry *dentry,
 			  struct inode *inode, const char *name, const void *value,
 			  size_t size, int flags)
 {
@@ -269,7 +268,7 @@ int scoutfs_acl_set_xattr(struct dentry *dentry, const char *name, const void *v
 	struct posix_acl *acl = NULL;
 	int ret;
 
-	if (!inode_owner_or_capable(dentry->d_inode))
+	if (!inode_owner_or_capable(KC_VFS_INIT_NS dentry->d_inode))
 		return -EPERM;
 
 	if (!IS_POSIXACL(dentry->d_inode))

kmod/src/acl.h

@@ -10,7 +10,9 @@ int scoutfs_set_acl_locked(struct inode *inode, struct posix_acl *acl, int type,
 int scoutfs_acl_get_xattr(const struct xattr_handler *, struct dentry *dentry,
 			  struct inode *inode, const char *name, void *value,
 			  size_t size);
-int scoutfs_acl_set_xattr(const struct xattr_handler *, struct dentry *dentry,
+int scoutfs_acl_set_xattr(const struct xattr_handler *,
+			  KC_VFS_NS_DEF
+			  struct dentry *dentry,
 			  struct inode *inode, const char *name, const void *value,
 			  size_t size, int flags);
 #else

kmod/src/alloc.c

@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/blkdev.h>
 #include <linux/sort.h>
 #include <linux/random.h>
 

kmod/src/attr_x.c

@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 2024 Versity Software, Inc.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/fs.h>
+
+#include "format.h"
+#include "super.h"
+#include "inode.h"
+#include "ioctl.h"
+#include "lock.h"
+#include "trans.h"
+#include "attr_x.h"
+
+static int validate_attr_x_input(struct super_block *sb, struct scoutfs_ioctl_inode_attr_x *iax)
+{
+	int ret;
+
+	if ((iax->x_mask & SCOUTFS_IOC_IAX__UNKNOWN) ||
+	    (iax->x_flags & SCOUTFS_IOC_IAX_F__UNKNOWN))
+		return -EINVAL;
+
+	if ((iax->x_mask & SCOUTFS_IOC_IAX_RETENTION) &&
+	    (ret = scoutfs_fmt_vers_unsupported(sb, SCOUTFS_FORMAT_VERSION_FEAT_RETENTION)))
+		    return ret;
+
+	if ((iax->x_mask & SCOUTFS_IOC_IAX_PROJECT_ID) &&
+	    (ret = scoutfs_fmt_vers_unsupported(sb, SCOUTFS_FORMAT_VERSION_FEAT_PROJECT_ID)))
+		    return ret;
+
+	return 0;
+}
+
+/*
+ * If the mask indicates interest in the given attr then set the field
+ * to the caller's value and return the new size if it didn't already
+ * include the attr field.
+ */
+#define fill_attr(size, iax, bit, field, val)							\
+({												\
+	__typeof__(iax) _iax = (iax);								\
+	__typeof__(size) _size = (size);							\
+												\
+	if (_iax->x_mask & (bit)) {								\
+		_iax->field = (val);								\
+		_size = max(_size, offsetof(struct scoutfs_ioctl_inode_attr_x, field) +		\
+				   sizeof_field(struct scoutfs_ioctl_inode_attr_x, field));	\
+	}											\
+												\
+	_size;											\
+})
+
+/*
+ * Returns -errno on error, or >= number of bytes filled by the
+ * response.  0 can be returned if no attributes are requested in the
+ * input x_mask.
+ */
+int scoutfs_get_attr_x(struct inode *inode, struct scoutfs_ioctl_inode_attr_x *iax)
+{
+	struct super_block *sb = inode->i_sb;
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+	struct scoutfs_lock *lock = NULL;
+	size_t size = 0;
+	u64 offline;
+	u64 online;
+	u64 bits;
+	int ret;
+
+	if (iax->x_mask == 0) {
+		ret = 0;
+		goto out;
+	}
+
+	ret = validate_attr_x_input(sb, iax);
+	if (ret < 0)
+		goto out;
+
+	inode_lock(inode);
+
+	ret = scoutfs_lock_inode(sb, SCOUTFS_LOCK_READ, SCOUTFS_LKF_REFRESH_INODE, inode, &lock);
+	if (ret)
+		goto unlock;
+
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_META_SEQ,
+			 meta_seq, scoutfs_inode_meta_seq(inode));
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_DATA_SEQ,
+			 data_seq, scoutfs_inode_data_seq(inode));
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_DATA_VERSION,
+			 data_version, scoutfs_inode_data_version(inode));
+	if (iax->x_mask & (SCOUTFS_IOC_IAX_ONLINE_BLOCKS | SCOUTFS_IOC_IAX_OFFLINE_BLOCKS)) {
+		scoutfs_inode_get_onoff(inode, &online, &offline);
+		size = fill_attr(size, iax, SCOUTFS_IOC_IAX_ONLINE_BLOCKS,
+				 online_blocks, online);
+		size = fill_attr(size, iax, SCOUTFS_IOC_IAX_OFFLINE_BLOCKS,
+				 offline_blocks, offline);
+	}
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_CTIME, ctime_sec, inode->i_ctime.tv_sec);
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_CTIME, ctime_nsec, inode->i_ctime.tv_nsec);
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_CRTIME, crtime_sec, si->crtime.tv_sec);
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_CRTIME, crtime_nsec, si->crtime.tv_nsec);
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_SIZE, size, i_size_read(inode));
+	if (iax->x_mask & SCOUTFS_IOC_IAX__BITS) {
+		bits = 0;
+		if ((iax->x_mask & SCOUTFS_IOC_IAX_RETENTION) &&
+		    (scoutfs_inode_get_flags(inode) & SCOUTFS_INO_FLAG_RETENTION))
+			bits |= SCOUTFS_IOC_IAX_B_RETENTION;
+		size = fill_attr(size, iax, SCOUTFS_IOC_IAX__BITS, bits, bits);
+	}
+	size = fill_attr(size, iax, SCOUTFS_IOC_IAX_PROJECT_ID,
+			 project_id, scoutfs_inode_get_proj(inode));
+
+	ret = size;
+unlock:
+	scoutfs_unlock(sb, lock, SCOUTFS_LOCK_READ);
+	inode_unlock(inode);
+out:
+	return ret;
+}
+
+static bool valid_attr_changes(struct inode *inode, struct scoutfs_ioctl_inode_attr_x *iax)
+{
+	/* provided data_version must be non-zero */
+	if ((iax->x_mask & SCOUTFS_IOC_IAX_DATA_VERSION) && (iax->data_version == 0))
+		return false;
+
+	/* can only set size or data version in new regular files */
+	if (((iax->x_mask & SCOUTFS_IOC_IAX_SIZE) ||
+	     (iax->x_mask & SCOUTFS_IOC_IAX_DATA_VERSION)) &&
+	    (!S_ISREG(inode->i_mode) || scoutfs_inode_data_version(inode) != 0))
+		return false;
+
+	/* must provide non-zero data_version with non-zero size */
+	if (((iax->x_mask & SCOUTFS_IOC_IAX_SIZE) && (iax->size > 0)) &&
+	    (!(iax->x_mask & SCOUTFS_IOC_IAX_DATA_VERSION) || (iax->data_version == 0)))
+		return false;
+
+	/* must provide non-zero size when setting offline extents to that size */
+	if ((iax->x_flags & SCOUTFS_IOC_IAX_F_SIZE_OFFLINE) &&
+	    (!(iax->x_mask & SCOUTFS_IOC_IAX_SIZE) || (iax->size == 0)))
+		return false;
+
+	/* the retention bit only applies to regular files */
+	if ((iax->x_mask & SCOUTFS_IOC_IAX_RETENTION) && !S_ISREG(inode->i_mode))
+		return false;
+
+	return true;
+}
+
+int scoutfs_set_attr_x(struct inode *inode, struct scoutfs_ioctl_inode_attr_x *iax)
+{
+	struct super_block *sb = inode->i_sb;
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+	struct scoutfs_lock *lock = NULL;
+	LIST_HEAD(ind_locks);
+	bool set_data_seq;
+	int ret;
+
+	/* initially all setting is root only, could loosen with finer grained checks */
+	if (!capable(CAP_SYS_ADMIN)) {
+		ret = -EPERM;
+		goto out;
+	}
+
+	if (iax->x_mask == 0) {
+		ret = 0;
+		goto out;
+	}
+
+	ret = validate_attr_x_input(sb, iax);
+	if (ret < 0)
+		goto out;
+
+	inode_lock(inode);
+
+	ret = scoutfs_lock_inode(sb, SCOUTFS_LOCK_WRITE, SCOUTFS_LKF_REFRESH_INODE, inode, &lock);
+	if (ret)
+		goto unlock;
+
+	/* check for errors before making any changes */
+	if (!valid_attr_changes(inode, iax)) {
+		ret = -EINVAL;
+		goto unlock;
+	}
+
+	/* retention prevents modification unless also clearing retention */
+	ret = scoutfs_inode_check_retention(inode);
+	if (ret < 0 && !((iax->x_mask & SCOUTFS_IOC_IAX_RETENTION) &&
+			 !(iax->bits & SCOUTFS_IOC_IAX_B_RETENTION)))
+		goto unlock;
+
+	/* setting only so we don't see 0 data seq with nonzero data_version */
+	if ((iax->x_mask & SCOUTFS_IOC_IAX_DATA_VERSION) && (iax->data_version > 0))
+		set_data_seq = true;
+	else
+		set_data_seq = false;
+
+	ret = scoutfs_inode_index_lock_hold(inode, &ind_locks, set_data_seq, true);
+	if (ret)
+		goto unlock;
+
+	ret = scoutfs_dirty_inode_item(inode, lock);
+	if (ret < 0)
+		goto release;
+
+	/* creating offline extent first, it might fail */
+	if (iax->x_flags & SCOUTFS_IOC_IAX_F_SIZE_OFFLINE) {
+		ret = scoutfs_data_init_offline_extent(inode, iax->size, lock);
+		if (ret)
+			goto release;
+	}
+
+	/* make all changes once they're all checked and will succeed */
+	if (iax->x_mask & SCOUTFS_IOC_IAX_DATA_VERSION)
+		scoutfs_inode_set_data_version(inode, iax->data_version);
+	if (iax->x_mask & SCOUTFS_IOC_IAX_SIZE)
+		i_size_write(inode, iax->size);
+	if (iax->x_mask & SCOUTFS_IOC_IAX_CTIME) {
+		inode->i_ctime.tv_sec = iax->ctime_sec;
+		inode->i_ctime.tv_nsec = iax->ctime_nsec;
+	}
+	if (iax->x_mask & SCOUTFS_IOC_IAX_CRTIME) {
+		si->crtime.tv_sec = iax->crtime_sec;
+		si->crtime.tv_nsec = iax->crtime_nsec;
+	}
+	if (iax->x_mask & SCOUTFS_IOC_IAX_RETENTION) {
+		scoutfs_inode_set_flags(inode, ~SCOUTFS_INO_FLAG_RETENTION,
+					(iax->bits & SCOUTFS_IOC_IAX_B_RETENTION) ?
+					SCOUTFS_INO_FLAG_RETENTION : 0);
+	}
+	if (iax->x_mask & SCOUTFS_IOC_IAX_PROJECT_ID)
+		scoutfs_inode_set_proj(inode, iax->project_id);
+
+	scoutfs_update_inode_item(inode, lock, &ind_locks);
+	ret = 0;
+release:
+	scoutfs_release_trans(sb);
+unlock:
+	scoutfs_inode_index_unlock(sb, &ind_locks);
+	scoutfs_unlock(sb, lock, SCOUTFS_LOCK_WRITE);
+	inode_unlock(inode);
+out:
+	return ret;
+}

kmod/src/attr_x.h

@@ -0,0 +1,11 @@
+#ifndef _SCOUTFS_ATTR_X_H_
+#define _SCOUTFS_ATTR_X_H_
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include "ioctl.h"
+
+int scoutfs_get_attr_x(struct inode *inode, struct scoutfs_ioctl_inode_attr_x *iax);
+int scoutfs_set_attr_x(struct inode *inode, struct scoutfs_ioctl_inode_attr_x *iax);
+
+#endif

kmod/src/block.c

@@ -120,8 +120,7 @@ do {												\
 
 static __le32 block_calc_crc(struct scoutfs_block_header *hdr, u32 size)
 {
-	int off = offsetof(struct scoutfs_block_header, crc) +
-		  FIELD_SIZEOF(struct scoutfs_block_header, crc);
+	int off = offsetofend(struct scoutfs_block_header, crc);
 	u32 calc = crc32c(~0, (char *)hdr + off, size - off);
 
 	return cpu_to_le32(calc);
@@ -159,7 +158,7 @@ static struct block_private *block_alloc(struct super_block *sb, u64 blkno)
 		 */
 		lockdep_off();
 		nofs_flags = memalloc_nofs_save();
-		bp->virt = __vmalloc(SCOUTFS_BLOCK_LG_SIZE, GFP_NOFS | __GFP_HIGHMEM, PAGE_KERNEL);
+		bp->virt = kc__vmalloc(SCOUTFS_BLOCK_LG_SIZE, GFP_NOFS | __GFP_HIGHMEM);
 		memalloc_nofs_restore(nofs_flags);
 		lockdep_on();
 
@@ -438,7 +437,7 @@ static void block_remove_all(struct super_block *sb)
  * possible.  Final freeing, verifying checksums, and unlinking errored
  * blocks are all done by future users of the blocks.
  */
-static void block_end_io(struct super_block *sb, unsigned int opf,
+static void block_end_io(struct super_block *sb, blk_opf_t opf,
 			 struct block_private *bp, int err)
 {
 	DECLARE_BLOCK_INFO(sb, binf);
@@ -478,7 +477,7 @@ static void KC_DECLARE_BIO_END_IO(block_bio_end_io, struct bio *bio)
  * Kick off IO for a single block.
  */
 static int block_submit_bio(struct super_block *sb, struct block_private *bp,
-			    unsigned int opf)
+			    blk_opf_t opf)
 {
 	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	struct bio *bio = NULL;
@@ -505,15 +504,13 @@ static int block_submit_bio(struct super_block *sb, struct block_private *bp,
 
 	for (off = 0; off < SCOUTFS_BLOCK_LG_SIZE; off += PAGE_SIZE) {
 		if (!bio) {
-			bio = bio_alloc(GFP_NOFS, SCOUTFS_BLOCK_LG_PAGES_PER);
+			bio = kc_bio_alloc(sbi->meta_bdev, SCOUTFS_BLOCK_LG_PAGES_PER, opf, GFP_NOFS);
 			if (!bio) {
 				ret = -ENOMEM;
 				break;
 			}
 
-			kc_bio_set_opf(bio, opf);
 			kc_bio_set_sector(bio, sector + (off >> 9));
-			bio_set_dev(bio, sbi->meta_bdev);
 			bio->bi_end_io = block_bio_end_io;
 			bio->bi_private = bp;
 
@@ -683,6 +680,7 @@ int scoutfs_block_read_ref(struct super_block *sb, struct scoutfs_block_ref *ref
 	struct scoutfs_block_header *hdr;
 	struct block_private *bp = NULL;
 	bool retried = false;
+	__le32 crc = 0;
 	int ret;
 
 retry:
@@ -695,7 +693,9 @@ retry:
 
 	/* corrupted writes might be a sign of a stale reference */
 	if (!test_bit(BLOCK_BIT_CRC_VALID, &bp->bits)) {
-		if (hdr->crc != block_calc_crc(hdr, SCOUTFS_BLOCK_LG_SIZE)) {
+		crc = block_calc_crc(hdr, SCOUTFS_BLOCK_LG_SIZE);
+		if (hdr->crc != crc) {
+			trace_scoutfs_block_stale(sb, ref, hdr, magic, le32_to_cpu(crc));
 			ret = -ESTALE;
 			goto out;
 		}
@@ -705,6 +705,7 @@ retry:
 
 	if (hdr->magic != cpu_to_le32(magic) || hdr->fsid != cpu_to_le64(sbi->fsid) ||
 	    hdr->seq != ref->seq || hdr->blkno != ref->blkno) {
+		trace_scoutfs_block_stale(sb, ref, hdr, magic, 0);
 		ret = -ESTALE;
 		goto out;
 	}
@@ -1197,7 +1198,7 @@ static void KC_DECLARE_BIO_END_IO(sm_block_bio_end_io, struct bio *bio)
  * only layer that sees the full block buffer so we pass the calculated
  * crc to the caller for them to check in their context.
  */
-static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsigned int opf,
+static int sm_block_io(struct super_block *sb, struct block_device *bdev, blk_opf_t opf,
 		       u64 blkno, struct scoutfs_block_header *hdr, size_t len, __le32 *blk_crc)
 {
 	struct scoutfs_block_header *pg_hdr;
@@ -1229,15 +1230,13 @@ static int sm_block_io(struct super_block *sb, struct block_device *bdev, unsign
 		pg_hdr->crc = block_calc_crc(pg_hdr, SCOUTFS_BLOCK_SM_SIZE);
 	}
 
-	bio = bio_alloc(GFP_NOFS, 1);
+	bio = kc_bio_alloc(bdev, 1, opf, GFP_NOFS);
 	if (!bio) {
 		ret = -ENOMEM;
 		goto out;
 	}
 
-	kc_bio_set_opf(bio, opf | REQ_SYNC);
 	kc_bio_set_sector(bio, blkno << (SCOUTFS_BLOCK_SM_SHIFT - 9));
-	bio_set_dev(bio, bdev);
 	bio->bi_end_io = sm_block_bio_end_io;
 	bio->bi_private = &sbc;
 	bio_add_page(bio, page, SCOUTFS_BLOCK_SM_SIZE, 0);
@@ -1298,7 +1297,7 @@ int scoutfs_block_setup(struct super_block *sb)
 	init_waitqueue_head(&binf->waitq);
 	KC_INIT_SHRINKER_FUNCS(&binf->shrinker, block_count_objects,
 			       block_scan_objects);
-	KC_REGISTER_SHRINKER(&binf->shrinker);
+	KC_REGISTER_SHRINKER(&binf->shrinker, "scoutfs-block:" SCSBF, SCSB_ARGS(sb));
 	INIT_WORK(&binf->free_work, block_free_work);
 	init_llist_head(&binf->free_llist);
 

kmod/src/client.c

@@ -20,6 +20,7 @@
 #include <net/sock.h>
 #include <net/tcp.h>
 #include <asm/barrier.h>
+#include <linux/overflow.h>
 
 #include "format.h"
 #include "counters.h"
@@ -68,6 +69,7 @@ int scoutfs_client_alloc_inodes(struct super_block *sb, u64 count,
 	struct client_info *client = SCOUTFS_SB(sb)->client_info;
 	struct scoutfs_net_inode_alloc ial;
 	__le64 lecount = cpu_to_le64(count);
+	u64 tmp;
 	int ret;
 
 	ret = scoutfs_net_sync_request(sb, client->conn,
@@ -80,7 +82,7 @@ int scoutfs_client_alloc_inodes(struct super_block *sb, u64 count,
 
 		if (*nr == 0)
 			ret = -ENOSPC;
-		else if (*ino + *nr < *ino)
+		else if (check_add_overflow(*ino, *nr - 1, &tmp))
 			ret = -EINVAL;
 	}
 

kmod/src/counters.h

@@ -162,6 +162,8 @@
 	EXPAND_COUNTER(orphan_scan_error)			\
 	EXPAND_COUNTER(orphan_scan_item)			\
 	EXPAND_COUNTER(orphan_scan_omap_set)			\
+	EXPAND_COUNTER(quota_info_count_objects)		\
+	EXPAND_COUNTER(quota_info_scan_objects)			\
 	EXPAND_COUNTER(quorum_candidate_server_stopping)	\
 	EXPAND_COUNTER(quorum_elected)				\
 	EXPAND_COUNTER(quorum_fence_error)			\
@@ -199,20 +201,19 @@
 	EXPAND_COUNTER(srch_read_stale)				\
 	EXPAND_COUNTER(statfs)					\
 	EXPAND_COUNTER(totl_read_copied)			\
-	EXPAND_COUNTER(totl_read_finalized)			\
-	EXPAND_COUNTER(totl_read_fs)				\
 	EXPAND_COUNTER(totl_read_item)				\
-	EXPAND_COUNTER(totl_read_logged)			\
 	EXPAND_COUNTER(trans_commit_data_alloc_low)		\
 	EXPAND_COUNTER(trans_commit_dirty_meta_full)		\
 	EXPAND_COUNTER(trans_commit_fsync)			\
 	EXPAND_COUNTER(trans_commit_meta_alloc_low)		\
 	EXPAND_COUNTER(trans_commit_sync_fs)			\
 	EXPAND_COUNTER(trans_commit_timer)			\
-	EXPAND_COUNTER(trans_commit_written)
+	EXPAND_COUNTER(trans_commit_written)			\
+	EXPAND_COUNTER(wkic_count_objects)			\
+	EXPAND_COUNTER(wkic_scan_objects)
 
 #define FIRST_COUNTER	alloc_alloc_data
-#define LAST_COUNTER	trans_commit_written
+#define LAST_COUNTER	wkic_scan_objects
 
 #undef EXPAND_COUNTER
 #define EXPAND_COUNTER(which) struct percpu_counter which;

kmod/src/data.c

@@ -20,7 +20,9 @@
 #include <linux/hash.h>
 #include <linux/log2.h>
 #include <linux/falloc.h>
+#include <linux/fiemap.h>
 #include <linux/writeback.h>
+#include <linux/overflow.h>
 
 #include "format.h"
 #include "super.h"
@@ -586,6 +588,12 @@ static int scoutfs_get_block(struct inode *inode, sector_t iblock,
 		goto out;
 	}
 
+	if (create && !si->staging) {
+		ret = scoutfs_inode_check_retention(inode);
+		if (ret < 0)
+			goto out;
+	}
+
 	/* convert unwritten to written, could be staging */
 	if (create && ext.map && (ext.flags & SEF_UNWRITTEN)) {
 		un.start = iblock;
@@ -673,8 +681,14 @@ int scoutfs_get_block_write(struct inode *inode, sector_t iblock, struct buffer_
  * We can return errors from locking and checking offline extents.  The
  * page is unlocked if we return an error.
  */
+#ifdef KC_MPAGE_READ_FOLIO
+static int scoutfs_read_folio(struct file *file, struct folio *folio)
+{
+	struct page *page = &folio->page;
+#else
 static int scoutfs_readpage(struct file *file, struct page *page)
 {
+#endif
 	struct inode *inode = file->f_inode;
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 	struct super_block *sb = inode->i_sb;
@@ -721,7 +735,11 @@ static int scoutfs_readpage(struct file *file, struct page *page)
 			return ret;
 	}
 
+#ifdef KC_MPAGE_READ_FOLIO
+	ret = mpage_read_folio(folio, scoutfs_get_block_read);
+#else
 	ret = mpage_readpage(page, scoutfs_get_block_read);
+#endif
 
 	scoutfs_unlock(sb, inode_lock, SCOUTFS_LOCK_READ);
 	scoutfs_per_task_del(&si->pt_data_lock, &pt_ent);
@@ -819,7 +837,10 @@ struct write_begin_data {
 
 static int scoutfs_write_begin(struct file *file,
 			       struct address_space *mapping, loff_t pos,
-			       unsigned len, unsigned flags,
+			       unsigned len,
+#ifdef KC_BLOCK_WRITE_BEGIN_AOP_FLAGS
+			       unsigned flags,
+#endif
 			       struct page **pagep, void **fsdata)
 {
 	struct inode *inode = mapping->host;
@@ -854,13 +875,18 @@ retry:
 	if (ret < 0)
 		goto out;
 
+#ifdef KC_BLOCK_WRITE_BEGIN_AOP_FLAGS
 	/* can't re-enter fs, have trans */
 	flags |= AOP_FLAG_NOFS;
+#endif
 
 	/* generic write_end updates i_size and calls dirty_inode */
 	ret = scoutfs_dirty_inode_item(inode, wbd->lock) ?:
-	      block_write_begin(mapping, pos, len, flags, pagep,
-				scoutfs_get_block_write);
+	      block_write_begin(mapping, pos, len,
+#ifdef KC_BLOCK_WRITE_BEGIN_AOP_FLAGS
+				flags,
+#endif
+				pagep, scoutfs_get_block_write);
 	if (ret < 0) {
 		scoutfs_release_trans(sb);
 		scoutfs_inode_index_unlock(sb, &wbd->ind_locks);
@@ -1062,6 +1088,7 @@ long scoutfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 	loff_t end;
 	u64 iblock;
 	u64 last;
+	loff_t tmp;
 	s64 ret;
 
 	/* XXX support more flags */
@@ -1070,14 +1097,14 @@ long scoutfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 		goto out;
 	}
 
-	/* catch wrapping */
-	if (offset + len < offset) {
-		ret = -EINVAL;
+	if (len == 0) {
+		ret = 0;
 		goto out;
 	}
 
-	if (len == 0) {
-		ret = 0;
+	/* catch wrapping */
+	if (check_add_overflow(offset, len - 1, &tmp)) {
+		ret = -EINVAL;
 		goto out;
 	}
 
@@ -1104,6 +1131,10 @@ long scoutfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 
 	while(iblock <= last) {
 
+		ret = scoutfs_quota_check_data(sb, inode);
+		if (ret)
+			goto out_extent;
+
 		ret = scoutfs_inode_index_lock_hold(inode, &ind_locks, false, true);
 		if (ret)
 			goto out_extent;
@@ -1155,9 +1186,9 @@ out:
  * on regular files with no data extents.  It's used to restore a file
  * with an offline extent which can then trigger staging.
  *
- * The caller has taken care of locking the inode.  We're updating the
- * inode offline count as we create the offline extent so we take care
- * of the index locking, updating, and transaction.
+ * The caller must take care of cluster locking, transactions, inode
+ * updates, and index updates (so that they can atomically make this
+ * change along with other metadata changes).
  */
 int scoutfs_data_init_offline_extent(struct inode *inode, u64 size,
 				     struct scoutfs_lock *lock)
@@ -1171,7 +1202,6 @@ int scoutfs_data_init_offline_extent(struct inode *inode, u64 size,
 		.lock = lock,
 	};
 	const u64 count = DIV_ROUND_UP(size, SCOUTFS_BLOCK_SM_SIZE);
-	LIST_HEAD(ind_locks);
 	u64 on;
 	u64 off;
 	int ret;
@@ -1184,28 +1214,10 @@ int scoutfs_data_init_offline_extent(struct inode *inode, u64 size,
 		goto out;
 	}
 
-	/* we're updating meta_seq with offline block count */
-	ret = scoutfs_inode_index_lock_hold(inode, &ind_locks, false, true);
-	if (ret < 0)
-		goto out;
-
-	ret = scoutfs_dirty_inode_item(inode, lock);
-	if (ret < 0)
-		goto unlock;
-
 	down_write(&si->extent_sem);
 	ret = scoutfs_ext_insert(sb, &data_ext_ops, &args,
 				 0, count, 0, SEF_OFFLINE);
 	up_write(&si->extent_sem);
-	if (ret < 0)
-		goto unlock;
-
-	scoutfs_update_inode_item(inode, lock, &ind_locks);
-
-unlock:
-	scoutfs_release_trans(sb);
-	scoutfs_inode_index_unlock(sb, &ind_locks);
-	ret = 0;
 out:
 	return ret;
 }
@@ -1273,6 +1285,9 @@ int scoutfs_data_move_blocks(struct inode *from, u64 from_off,
 	if (ret)
 		goto out;
 
+	if (!is_stage && (ret = scoutfs_inode_check_retention(to)))
+		goto out;
+
 	if ((from_off & SCOUTFS_BLOCK_SM_MASK) ||
 	    (to_off & SCOUTFS_BLOCK_SM_MASK) ||
 	    ((byte_len & SCOUTFS_BLOCK_SM_MASK) &&
@@ -1310,8 +1325,8 @@ int scoutfs_data_move_blocks(struct inode *from, u64 from_off,
 		goto out;
 	}
 
-	ret = inode_permission(from, MAY_WRITE) ?:
-	      inode_permission(to, MAY_WRITE);
+	ret = inode_permission(KC_VFS_INIT_NS from, MAY_WRITE) ?:
+	      inode_permission(KC_VFS_INIT_NS to, MAY_WRITE);
 	if (ret < 0)
 		goto out;
 
@@ -1549,7 +1564,7 @@ int scoutfs_data_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 		goto out;
 	}
 
-	ret = fiemap_check_flags(fieinfo, FIEMAP_FLAG_SYNC);
+	ret = fiemap_prep(inode, fieinfo, start, &len, FIEMAP_FLAG_SYNC);
 	if (ret)
 		goto out;
 
@@ -1715,12 +1730,16 @@ int scoutfs_data_wait_check(struct inode *inode, loff_t pos, loff_t len,
 	u64 last_block;
 	u64 on;
 	u64 off;
+	loff_t tmp;
 	int ret = 0;
 
+	if (len == 0)
+		goto out;
+
 	if (WARN_ON_ONCE(sef & SEF_UNKNOWN) ||
 	    WARN_ON_ONCE(op & SCOUTFS_IOC_DWO_UNKNOWN) ||
 	    WARN_ON_ONCE(dw && !RB_EMPTY_NODE(&dw->node)) ||
-	    WARN_ON_ONCE(pos + len < pos)) {
+	    WARN_ON_ONCE(check_add_overflow(pos, len - 1, &tmp))) {
 		ret = -EINVAL;
 		goto out;
 	}
@@ -1807,37 +1826,6 @@ int scoutfs_data_wait_check_iov(struct inode *inode, const struct iovec *iov,
 	return ret;
 }
 
-int scoutfs_data_wait_check_iter(struct inode *inode, loff_t pos, struct iov_iter *iter,
-				 u8 sef, u8 op, struct scoutfs_data_wait *dw,
-				 struct scoutfs_lock *lock)
-{
-	size_t count = iov_iter_count(iter);
-	size_t off = iter->iov_offset;
-	const struct iovec *iov;
-	size_t len;
-	int ret = 0;
-
-	for (iov = iter->iov; count > 0; iov++) {
-		len = iov->iov_len - off;
-		if (len == 0)
-			continue;
-
-		/* aren't we waiting on too much data here ? */
-		ret = scoutfs_data_wait_check(inode, pos, len,
-					      sef, op, dw, lock);
-
-		if (ret != 0)
-			break;
-
-
-		pos += len;
-		count -= len;
-		off = 0;
-	}
-
-	return ret;
-}
-
 int scoutfs_data_wait(struct inode *inode, struct scoutfs_data_wait *dw)
 {
 	DECLARE_DATA_WAIT_ROOT(inode->i_sb, rt);
@@ -1927,7 +1915,13 @@ int scoutfs_data_waiting(struct super_block *sb, u64 ino, u64 iblock,
 }
 
 const struct address_space_operations scoutfs_file_aops = {
+#ifdef KC_MPAGE_READ_FOLIO
+	.dirty_folio		= block_dirty_folio,
+	.invalidate_folio	= block_invalidate_folio,
+	.read_folio		= scoutfs_read_folio,
+#else
 	.readpage		= scoutfs_readpage,
+#endif
 #ifndef KC_FILE_AOPS_READAHEAD
 	.readpages		= scoutfs_readpages,
 #else
@@ -1948,6 +1942,8 @@ const struct file_operations scoutfs_file_fops = {
 #else
 	.read_iter	= scoutfs_file_read_iter,
 	.write_iter	= scoutfs_file_write_iter,
+	.splice_read	= generic_file_splice_read,
+	.splice_write	= iter_file_splice_write,
 #endif
 	.unlocked_ioctl	= scoutfs_ioctl,
 	.fsync		= scoutfs_file_fsync,

kmod/src/data.h

@@ -65,9 +65,6 @@ int scoutfs_data_wait_check_iov(struct inode *inode, const struct iovec *iov,
 				unsigned long nr_segs, loff_t pos, u8 sef,
 				u8 op, struct scoutfs_data_wait *ow,
 				struct scoutfs_lock *lock);
-int scoutfs_data_wait_check_iter(struct inode *inode, loff_t pos, struct iov_iter *iter,
-				 u8 sef, u8 op, struct scoutfs_data_wait *ow,
-				 struct scoutfs_lock *lock);
 bool scoutfs_data_wait_found(struct scoutfs_data_wait *ow);
 int scoutfs_data_wait(struct inode *inode,
 			      struct scoutfs_data_wait *ow);

kmod/src/dir.c

@@ -34,6 +34,7 @@
 #include "forest.h"
 #include "acl.h"
 #include "counters.h"
+#include "quota.h"
 #include "scoutfs_trace.h"
 
 /*
@@ -651,6 +652,10 @@ static struct inode *lock_hold_create(struct inode *dir, struct dentry *dentry,
 	if (ret)
 		goto out_unlock;
 
+	ret = scoutfs_quota_check_inode(sb, dir);
+	if (ret)
+		goto out_unlock;
+
 	if (orph_lock) {
 		ret = scoutfs_lock_orphan(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, ino, orph_lock);
 		if (ret < 0)
@@ -672,6 +677,8 @@ retry:
 	if (ret < 0)
 		goto out;
 
+	scoutfs_inode_set_proj(inode, scoutfs_inode_get_proj(dir));
+
 	ret = scoutfs_dirty_inode_item(dir, *dir_lock);
 out:
 	if (ret)
@@ -696,8 +703,9 @@ out_unlock:
 	return inode;
 }
 
-static int scoutfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
-		       dev_t rdev)
+static int scoutfs_mknod(KC_VFS_NS_DEF
+			 struct inode *dir,
+			 struct dentry *dentry, umode_t mode, dev_t rdev)
 {
 	struct super_block *sb = dir->i_sb;
 	struct inode *inode = NULL;
@@ -766,15 +774,20 @@ out:
 }
 
 /* XXX hmm, do something with excl? */
-static int scoutfs_create(struct inode *dir, struct dentry *dentry,
-			  umode_t mode, bool excl)
+static int scoutfs_create(KC_VFS_NS_DEF
+			  struct inode *dir,
+			  struct dentry *dentry, umode_t mode, bool excl)
 {
-	return scoutfs_mknod(dir, dentry, mode | S_IFREG, 0);
+	return scoutfs_mknod(KC_VFS_NS
+			     dir, dentry, mode | S_IFREG, 0);
 }
 
-static int scoutfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int scoutfs_mkdir(KC_VFS_NS_DEF
+			 struct inode *dir,
+			 struct dentry *dentry, umode_t mode)
 {
-	return scoutfs_mknod(dir, dentry, mode | S_IFDIR, 0);
+	return scoutfs_mknod(KC_VFS_NS
+			     dir, dentry, mode | S_IFDIR, 0);
 }
 
 static int scoutfs_link(struct dentry *old_dentry,
@@ -926,12 +939,16 @@ static int scoutfs_unlink(struct inode *dir, struct dentry *dentry)
 		goto unlock;
 	}
 
+	ret = scoutfs_inode_check_retention(inode);
+	if (ret < 0)
+		goto unlock;
+
 	hash = dirent_name_hash(dentry->d_name.name, dentry->d_name.len);
 
 	ret = lookup_dirent(sb, scoutfs_ino(dir), dentry->d_name.name, dentry->d_name.len, hash,
 			    &dent, dir_lock);
 	if (ret < 0)
-		goto out;
+		goto unlock;
 
 	if (should_orphan(inode)) {
 		ret = scoutfs_lock_orphan(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, scoutfs_ino(inode),
@@ -1165,7 +1182,8 @@ static const char *scoutfs_get_link(struct dentry *dentry, struct inode *inode,
  * Symlink target paths can be annoyingly large.  We store relatively
  * rare large paths in multiple items.
  */
-static int scoutfs_symlink(struct inode *dir, struct dentry *dentry,
+static int scoutfs_symlink(KC_VFS_NS_DEF
+			   struct inode *dir, struct dentry *dentry,
 			   const char *symname)
 {
 	struct super_block *sb = dir->i_sb;
@@ -1552,7 +1570,8 @@ static int verify_ancestors(struct super_block *sb, u64 p1, u64 p2,
  * from using parent/child locking orders as two groups can have both
  * parent and child relationships to each other.
  */
-static int scoutfs_rename_common(struct inode *old_dir,
+static int scoutfs_rename_common(KC_VFS_NS_DEF
+				 struct inode *old_dir,
 				 struct dentry *old_dentry, struct inode *new_dir,
 				 struct dentry *new_dentry, unsigned int flags)
 {
@@ -1632,6 +1651,10 @@ static int scoutfs_rename_common(struct inode *old_dir,
 		goto out_unlock;
 	}
 
+	if ((old_inode && (ret = scoutfs_inode_check_retention(old_inode))) ||
+	    (new_inode && (ret = scoutfs_inode_check_retention(new_inode))))
+		goto out_unlock;
+
 	if (should_orphan(new_inode)) {
 		ret = scoutfs_lock_orphan(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, scoutfs_ino(new_inode),
 					  &orph_lock);
@@ -1825,18 +1848,21 @@ static int scoutfs_rename(struct inode *old_dir,
 			  struct dentry *old_dentry, struct inode *new_dir,
 			  struct dentry *new_dentry)
 {
-	return scoutfs_rename_common(old_dir, old_dentry, new_dir, new_dentry, 0);
+	return scoutfs_rename_common(KC_VFS_INIT_NS
+				     old_dir, old_dentry, new_dir, new_dentry, 0);
 }
 #endif
 
-static int scoutfs_rename2(struct inode *old_dir,
+static int scoutfs_rename2(KC_VFS_NS_DEF
+			  struct inode *old_dir,
 			  struct dentry *old_dentry, struct inode *new_dir,
 			  struct dentry *new_dentry, unsigned int flags)
 {
 	if (flags & ~RENAME_NOREPLACE)
 		return -EINVAL;
 
-	return scoutfs_rename_common(old_dir, old_dentry, new_dir, new_dentry, flags);
+	return scoutfs_rename_common(KC_VFS_NS
+				     old_dir, old_dentry, new_dir, new_dentry, flags);
 }
 
 #ifdef KC_FMODE_KABI_ITERATE
@@ -1848,8 +1874,18 @@ static int scoutfs_dir_open(struct inode *inode, struct file *file)
 }
 #endif
 
-static int scoutfs_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int scoutfs_tmpfile(KC_VFS_NS_DEF
+			   struct inode *dir,
+#ifdef KC_D_TMPFILE_DENTRY
+			   struct dentry *dentry,
+#else
+			   struct file *file,
+#endif
+			   umode_t mode)
 {
+#ifndef KC_D_TMPFILE_DENTRY
+	struct dentry *dentry = file->f_path.dentry;
+#endif
 	struct super_block *sb = dir->i_sb;
 	struct inode *inode = NULL;
 	struct scoutfs_lock *dir_lock = NULL;
@@ -1876,7 +1912,11 @@ static int scoutfs_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mod
 	si->crtime = inode->i_mtime;
 	insert_inode_hash(inode);
 	ihold(inode); /* need to update inode modifications in d_tmpfile */
+#ifdef KC_D_TMPFILE_DENTRY
 	d_tmpfile(dentry, inode);
+#else
+	d_tmpfile(file, inode);
+#endif
 	inode_inc_iversion(inode);
 	scoutfs_forest_inc_inode_count(sb);
 
@@ -1884,6 +1924,10 @@ static int scoutfs_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mod
 	scoutfs_update_inode_item(dir, dir_lock, &ind_locks);
 	scoutfs_inode_index_unlock(sb, &ind_locks);
 
+#ifndef KC_D_TMPFILE_DENTRY
+	ret = finish_open_simple(file, 0);
+#endif
+
 out:
 	scoutfs_release_trans(sb);
 	scoutfs_inode_index_unlock(sb, &ind_locks);

kmod/src/fence.c

@@ -105,12 +105,12 @@ static ssize_t elapsed_secs_show(struct kobject *kobj,
 {
 	DECLARE_FENCE_FROM_KOBJ(fence, kobj);
 	ktime_t now = ktime_get();
-	struct timeval tv = { 0, };
+	ktime_t t = ns_to_ktime(0);
 
 	if (ktime_after(now, fence->start_kt))
-		tv = ktime_to_timeval(ktime_sub(now, fence->start_kt));
+		t = ktime_sub(now, fence->start_kt);
 
-	return snprintf(buf, PAGE_SIZE, "%llu", (long long)tv.tv_sec);
+	return snprintf(buf, PAGE_SIZE, "%llu", (long long)ktime_divns(t, NSEC_PER_SEC));
 }
 SCOUTFS_ATTR_RO(elapsed_secs);
 

kmod/src/file.c

@@ -28,6 +28,7 @@
 #include "inode.h"
 #include "per_task.h"
 #include "omap.h"
+#include "quota.h"
 
 #ifdef KC_LINUX_HAVE_FOP_AIO_READ
 /*
@@ -108,6 +109,10 @@ retry:
 	if (ret)
 		goto out;
 
+	ret = scoutfs_inode_check_retention(inode);
+	if (ret < 0)
+		goto out;
+
 	ret = scoutfs_complete_truncate(inode, scoutfs_inode_lock);
 	if (ret)
 		goto out;
@@ -122,6 +127,10 @@ retry:
 			goto out;
 	}
 
+	ret = scoutfs_quota_check_data(sb, inode);
+	if (ret)
+		goto out;
+
 	/* XXX: remove SUID bit */
 
 	ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
@@ -171,10 +180,8 @@ retry:
 		goto out;
 
 	if (scoutfs_per_task_add_excl(&si->pt_data_lock, &pt_ent, scoutfs_inode_lock)) {
-		ret = scoutfs_data_wait_check_iter(inode, iocb->ki_pos, to,
-						   SEF_OFFLINE,
-						   SCOUTFS_IOC_DWO_READ,
-						   &dw, scoutfs_inode_lock);
+		ret = scoutfs_data_wait_check(inode, iocb->ki_pos, iov_iter_count(to), SEF_OFFLINE,
+					      SCOUTFS_IOC_DWO_READ, &dw, scoutfs_inode_lock);
 		if (ret != 0)
 			goto out;
 	} else {
@@ -205,8 +212,7 @@ ssize_t scoutfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	struct scoutfs_lock *scoutfs_inode_lock = NULL;
 	SCOUTFS_DECLARE_PER_TASK_ENTRY(pt_ent);
 	DECLARE_DATA_WAIT(dw);
-	int ret;
-	int written;
+	ssize_t ret;
 
 retry:
 	inode_lock(inode);
@@ -219,23 +225,29 @@ retry:
 	if (ret <= 0)
 		goto out;
 
+	ret = scoutfs_inode_check_retention(inode);
+	if (ret < 0)
+		goto out;
+
 	ret = scoutfs_complete_truncate(inode, scoutfs_inode_lock);
 	if (ret)
 		goto out;
 
+	ret = scoutfs_quota_check_data(sb, inode);
+	if (ret)
+		goto out;
+
 	if (scoutfs_per_task_add_excl(&si->pt_data_lock, &pt_ent, scoutfs_inode_lock)) {
 		/* data_version is per inode, whole file must be online */
-		ret = scoutfs_data_wait_check_iter(inode, iocb->ki_pos, from,
-						   SEF_OFFLINE,
-						   SCOUTFS_IOC_DWO_WRITE,
-						   &dw, scoutfs_inode_lock);
+		ret = scoutfs_data_wait_check(inode, 0, i_size_read(inode), SEF_OFFLINE,
+					      SCOUTFS_IOC_DWO_WRITE, &dw, scoutfs_inode_lock);
 		if (ret != 0)
 			goto out;
 	}
 
 	/* XXX: remove SUID bit */
 
-	written = __generic_file_write_iter(iocb, from);
+	ret = __generic_file_write_iter(iocb, from);
 
 out:
 	scoutfs_per_task_del(&si->pt_data_lock, &pt_ent);
@@ -248,14 +260,15 @@ out:
 			goto retry;
 	}
 
-	if (ret > 0 || ret == -EIOCBQUEUED)
-		ret = generic_write_sync(iocb, written);
+	if (ret > 0)
+		ret = generic_write_sync(iocb, ret);
 
-	return written ? written : ret;
+	return ret;
 }
 #endif
 
-int scoutfs_permission(struct inode *inode, int mask)
+int scoutfs_permission(KC_VFS_NS_DEF
+		       struct inode *inode, int mask)
 {
 	struct super_block *sb = inode->i_sb;
 	struct scoutfs_lock *inode_lock = NULL;
@@ -269,7 +282,8 @@ int scoutfs_permission(struct inode *inode, int mask)
 	if (ret)
 		return ret;
 
-	ret = generic_permission(inode, mask);
+	ret = generic_permission(KC_VFS_INIT_NS
+				 inode, mask);
 
 	scoutfs_unlock(sb, inode_lock, SCOUTFS_LOCK_READ);
 

kmod/src/file.h

@@ -10,7 +10,8 @@ ssize_t scoutfs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 ssize_t scoutfs_file_read_iter(struct kiocb *, struct iov_iter *);
 ssize_t scoutfs_file_write_iter(struct kiocb *, struct iov_iter *);
 #endif
-int scoutfs_permission(struct inode *inode, int mask);
+int scoutfs_permission(KC_VFS_NS_DEF
+		       struct inode *inode, int mask);
 loff_t scoutfs_file_llseek(struct file *file, loff_t offset, int whence);
 
 #endif	/* _SCOUTFS_FILE_H_ */

kmod/src/forest.c

@@ -238,19 +238,16 @@ static int forest_read_items(struct super_block *sb, struct scoutfs_key *key, u6
  * We return -ESTALE if we hit stale blocks to give the caller a chance
  * to reset their state and retry with a newer version of the btrees.
  */
-int scoutfs_forest_read_items(struct super_block *sb,
-			      struct scoutfs_key *key,
-			      struct scoutfs_key *bloom_key,
-			      struct scoutfs_key *start,
-			      struct scoutfs_key *end,
-			      scoutfs_forest_item_cb cb, void *arg)
+int scoutfs_forest_read_items_roots(struct super_block *sb, struct scoutfs_net_roots *roots,
+				    struct scoutfs_key *key, struct scoutfs_key *bloom_key,
+				    struct scoutfs_key *start, struct scoutfs_key *end,
+				    scoutfs_forest_item_cb cb, void *arg)
 {
 	struct forest_read_items_data rid = {
 		.cb = cb,
 		.cb_arg = arg,
 	};
 	struct scoutfs_log_trees lt;
-	struct scoutfs_net_roots roots;
 	struct scoutfs_bloom_block *bb;
 	struct forest_bloom_nrs bloom;
 	SCOUTFS_BTREE_ITEM_REF(iref);
@@ -264,18 +261,14 @@ int scoutfs_forest_read_items(struct super_block *sb,
 	scoutfs_inc_counter(sb, forest_read_items);
 	calc_bloom_nrs(&bloom, bloom_key);
 
-	ret = scoutfs_client_get_roots(sb, &roots);
-	if (ret)
-		goto out;
-
-	trace_scoutfs_forest_using_roots(sb, &roots.fs_root, &roots.logs_root);
+	trace_scoutfs_forest_using_roots(sb, &roots->fs_root, &roots->logs_root);
 
 	*start = orig_start;
 	*end = orig_end;
 
 	/* start with fs root items */
 	rid.fic |= FIC_FS_ROOT;
-	ret = scoutfs_btree_read_items(sb, &roots.fs_root, key, start, end,
+	ret = scoutfs_btree_read_items(sb, &roots->fs_root, key, start, end,
 				       forest_read_items, &rid);
 	if (ret < 0)
 		goto out;
@@ -283,7 +276,7 @@ int scoutfs_forest_read_items(struct super_block *sb,
 
 	scoutfs_key_init_log_trees(&ltk, 0, 0);
 	for (;; scoutfs_key_inc(&ltk)) {
-		ret = scoutfs_btree_next(sb, &roots.logs_root, &ltk, &iref);
+		ret = scoutfs_btree_next(sb, &roots->logs_root, &ltk, &iref);
 		if (ret == 0) {
 			if (iref.val_len == sizeof(lt)) {
 				ltk = *iref.key;
@@ -340,6 +333,23 @@ out:
 	return ret;
 }
 
+int scoutfs_forest_read_items(struct super_block *sb,
+			      struct scoutfs_key *key,
+			      struct scoutfs_key *bloom_key,
+			      struct scoutfs_key *start,
+			      struct scoutfs_key *end,
+			      scoutfs_forest_item_cb cb, void *arg)
+{
+	struct scoutfs_net_roots roots;
+	int ret;
+
+	ret = scoutfs_client_get_roots(sb, &roots);
+	if (ret == 0)
+		ret = scoutfs_forest_read_items_roots(sb, &roots, key, bloom_key, start, end,
+						      cb, arg);
+	return ret;
+}
+
 /*
  * If the items are deltas then combine the src with the destination
  * value and store the result in the destination.

kmod/src/forest.h

@@ -4,6 +4,7 @@
 struct scoutfs_alloc;
 struct scoutfs_block_writer;
 struct scoutfs_block;
+struct scoutfs_lock;
 
 #include "btree.h"
 
@@ -23,6 +24,10 @@ int scoutfs_forest_read_items(struct super_block *sb,
 			      struct scoutfs_key *start,
 			      struct scoutfs_key *end,
 			      scoutfs_forest_item_cb cb, void *arg);
+int scoutfs_forest_read_items_roots(struct super_block *sb, struct scoutfs_net_roots *roots,
+				    struct scoutfs_key *key, struct scoutfs_key *bloom_key,
+				    struct scoutfs_key *start, struct scoutfs_key *end,
+				    scoutfs_forest_item_cb cb, void *arg);
 int scoutfs_forest_set_bloom_bits(struct super_block *sb,
 				  struct scoutfs_lock *lock);
 void scoutfs_forest_set_max_seq(struct super_block *sb, u64 max_seq);

kmod/src/format.h

@@ -8,9 +8,14 @@
  */
 #define SCOUTFS_FORMAT_VERSION_MIN		1
 #define SCOUTFS_FORMAT_VERSION_MIN_STR	__stringify(SCOUTFS_FORMAT_VERSION_MIN)
-#define SCOUTFS_FORMAT_VERSION_MAX		1
+#define SCOUTFS_FORMAT_VERSION_MAX		2
 #define SCOUTFS_FORMAT_VERSION_MAX_STR	__stringify(SCOUTFS_FORMAT_VERSION_MAX)
 
+#define SCOUTFS_FORMAT_VERSION_FEAT_RETENTION	2
+#define SCOUTFS_FORMAT_VERSION_FEAT_PROJECT_ID	2
+#define SCOUTFS_FORMAT_VERSION_FEAT_QUOTA	2
+#define SCOUTFS_FORMAT_VERSION_FEAT_INDX_TAG	2
+
 /* statfs(2) f_type */
 #define SCOUTFS_SUPER_MAGIC	0x554f4353		/* "SCOU" */
 
@@ -175,6 +180,10 @@ struct scoutfs_key {
 #define sko_rid		_sk_first
 #define sko_ino		_sk_second
 
+/* quota rules */
+#define skqr_hash	_sk_second
+#define skqr_coll_nr	_sk_third
+
 /* xattr totl */
 #define skxt_a		_sk_first
 #define skxt_b		_sk_second
@@ -585,7 +594,9 @@ struct scoutfs_log_merge_freeing {
  */
 #define SCOUTFS_INODE_INDEX_ZONE		4
 #define SCOUTFS_ORPHAN_ZONE			8
+#define SCOUTFS_QUOTA_ZONE			10
 #define SCOUTFS_XATTR_TOTL_ZONE			12
+#define SCOUTFS_XATTR_INDX_ZONE			14
 #define SCOUTFS_FS_ZONE				16
 #define SCOUTFS_LOCK_ZONE			20
 /* Items only stored in server btrees */
@@ -608,6 +619,9 @@ struct scoutfs_log_merge_freeing {
 /* orphan zone, redundant type used for clarity */
 #define SCOUTFS_ORPHAN_TYPE			4
 
+/* quota zone */
+#define SCOUTFS_QUOTA_RULE_TYPE			4
+
 /* fs zone */
 #define SCOUTFS_INODE_TYPE			4
 #define SCOUTFS_XATTR_TYPE			8
@@ -661,6 +675,34 @@ struct scoutfs_xattr_totl_val {
 	__le64 count;
 };
 
+#define SQ_RF_TOTL_COUNT	(1 << 0)
+#define SQ_RF__UNKNOWN	(~((1 << 1) - 1))
+
+#define SQ_NS_LITERAL		0
+#define SQ_NS_PROJ		1
+#define SQ_NS_UID		2
+#define SQ_NS_GID		3
+#define SQ_NS__NR		4
+#define SQ_NS__NR_SELECT	(SQ_NS__NR - 1) /* !literal */
+
+#define SQ_NF_SELECT	(1 << 0)
+#define SQ_NF__UNKNOWN	(~((1 << 1) - 1))
+
+#define SQ_OP_INODE	0
+#define SQ_OP_DATA	1
+#define SQ_OP__NR	2
+
+struct scoutfs_quota_rule_val {
+	__le64 name_val[3];
+	__le64 limit;
+	__u8 prio;
+	__u8 op;
+	__u8 rule_flags;
+	__u8 name_source[3];
+	__u8 name_flags[3];
+	__u8 _pad[7];
+};
+
 /* XXX does this exist upstream somewhere? */
 #define member_sizeof(TYPE, MEMBER) (sizeof(((TYPE *)0)->MEMBER))
 
@@ -859,9 +901,38 @@ struct scoutfs_inode {
 	struct scoutfs_timespec ctime;
 	struct scoutfs_timespec mtime;
 	struct scoutfs_timespec crtime;
+	__le64 proj;
 };
 
-#define SCOUTFS_INO_FLAG_TRUNCATE 0x1
+#define SCOUTFS_INODE_FMT_V1_BYTES offsetof(struct scoutfs_inode, proj)
+
+/*
+ * There are so few versions that we don't mind doing this work inline
+ * so that both utils and kernel can share these.  Mounting has already
+ * checked that the format version is within the supported min and max,
+ * so these functions only deal with size variance within that band.
+ */
+/* Returns the native written inode size for the given format version, 0 for bad version */
+static inline int scoutfs_inode_vers_bytes(__u64 fmt_vers)
+{
+	if (fmt_vers == 1)
+		return SCOUTFS_INODE_FMT_V1_BYTES;
+	else
+		return sizeof(struct scoutfs_inode);
+}
+/*
+ * Returns true if bytes is a valid inode size to read from the given
+ * version.  The given version must be greater than the version that
+ * introduced the size.
+ */
+static inline int scoutfs_inode_valid_vers_bytes(__u64 fmt_vers, int bytes)
+{
+	return (bytes == sizeof(struct scoutfs_inode) && fmt_vers == SCOUTFS_FORMAT_VERSION_MAX) ||
+	       (bytes == SCOUTFS_INODE_FMT_V1_BYTES);
+}
+
+#define SCOUTFS_INO_FLAG_TRUNCATE	0x1
+#define SCOUTFS_INO_FLAG_RETENTION	0x2
 
 #define SCOUTFS_ROOT_INO 1
 

kmod/src/inode.c

@@ -91,7 +91,7 @@ static void scoutfs_inode_ctor(void *obj)
 
 	init_rwsem(&si->extent_sem);
 	mutex_init(&si->item_mutex);
-	seqcount_init(&si->seqcount);
+	seqlock_init(&si->seqlock);
 	si->staging = false;
 	scoutfs_per_task_init(&si->pt_data_lock);
 	atomic64_set(&si->data_waitq.changed, 0);
@@ -250,7 +250,7 @@ static void set_item_info(struct scoutfs_inode_info *si,
 	set_item_major(si, SCOUTFS_INODE_INDEX_DATA_SEQ_TYPE, sinode->data_seq);
 }
 
-static void load_inode(struct inode *inode, struct scoutfs_inode *cinode)
+static void load_inode(struct inode *inode, struct scoutfs_inode *cinode, int inode_bytes)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 
@@ -278,6 +278,7 @@ static void load_inode(struct inode *inode, struct scoutfs_inode *cinode)
 	si->flags = le32_to_cpu(cinode->flags);
 	si->crtime.tv_sec = le64_to_cpu(cinode->crtime.sec);
 	si->crtime.tv_nsec = le32_to_cpu(cinode->crtime.nsec);
+	si->proj = le64_to_cpu(cinode->proj);
 
 	/*
 	 * i_blocks is initialized from online and offline and is then
@@ -298,6 +299,24 @@ void scoutfs_inode_init_key(struct scoutfs_key *key, u64 ino)
 	};
 }
 
+/*
+ * Read an inode item into the caller's buffer and return the size that
+ * we read.   Returns errors if the inode size is unsupported or doesn't
+ * make sense for the format version.
+ */
+static int lookup_inode_item(struct super_block *sb, struct scoutfs_key *key,
+			     struct scoutfs_inode *sinode, struct scoutfs_lock *lock)
+{
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
+	int ret;
+
+	ret = scoutfs_item_lookup_smaller_zero(sb, key, sinode, sizeof(struct scoutfs_inode), lock);
+	if (ret >= 0 && !scoutfs_inode_valid_vers_bytes(sbi->fmt_vers, ret))
+		return -EIO;
+
+	return ret;
+}
+
 /*
  * Refresh the vfs inode fields if the lock indicates that the current
  * contents could be stale.
@@ -333,12 +352,12 @@ int scoutfs_inode_refresh(struct inode *inode, struct scoutfs_lock *lock)
 
 	mutex_lock(&si->item_mutex);
 	if (atomic64_read(&si->last_refreshed) < refresh_gen) {
-		ret = scoutfs_item_lookup_exact(sb, &key, &sinode,
-						sizeof(sinode), lock);
-		if (ret == 0) {
-			load_inode(inode, &sinode);
+		ret = lookup_inode_item(sb, &key, &sinode, lock);
+		if (ret > 0) {
+			load_inode(inode, &sinode, ret);
 			atomic64_set(&si->last_refreshed, refresh_gen);
 			scoutfs_lock_add_coverage(sb, lock, &si->ino_lock_cov);
+			ret = 0;
 		}
 	} else {
 		ret = 0;
@@ -354,7 +373,8 @@ int scoutfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 {
 	struct inode *inode = dentry->d_inode;
 #else
-int scoutfs_getattr(const struct path *path, struct kstat *stat,
+int scoutfs_getattr(KC_VFS_NS_DEF
+		    const struct path *path, struct kstat *stat,
 		    u32 request_mask, unsigned int query_flags)
 {
 	struct inode *inode = d_inode(path->dentry);
@@ -366,7 +386,8 @@ int scoutfs_getattr(const struct path *path, struct kstat *stat,
 	ret = scoutfs_lock_inode(sb, SCOUTFS_LOCK_READ,
 				 SCOUTFS_LKF_REFRESH_INODE, inode, &lock);
 	if (ret == 0) {
-		generic_fillattr(inode, stat);
+		generic_fillattr(KC_VFS_INIT_NS
+				 inode, stat);
 		scoutfs_unlock(sb, lock, SCOUTFS_LOCK_READ);
 	}
 	return ret;
@@ -464,7 +485,8 @@ int scoutfs_complete_truncate(struct inode *inode, struct scoutfs_lock *lock)
  * re-acquire it.  Ideally we'd fix this so that we can acquire the lock
  * instead of the caller.
  */
-int scoutfs_setattr(struct dentry *dentry, struct iattr *attr)
+int scoutfs_setattr(KC_VFS_NS_DEF
+		    struct dentry *dentry, struct iattr *attr)
 {
 	struct inode *inode = dentry->d_inode;
 	struct super_block *sb = inode->i_sb;
@@ -482,10 +504,15 @@ retry:
 				 SCOUTFS_LKF_REFRESH_INODE, inode, &lock);
 	if (ret)
 		return ret;
-	ret = setattr_prepare(dentry, attr);
+	ret = setattr_prepare(KC_VFS_INIT_NS
+			      dentry, attr);
 	if (ret)
 		goto out;
 
+	ret = scoutfs_inode_check_retention(inode);
+	if (ret < 0)
+		goto out;
+
 	attr_size = (attr->ia_valid & ATTR_SIZE) ? attr->ia_size :
 		i_size_read(inode);
 
@@ -542,7 +569,8 @@ retry:
 	if (ret < 0)
 		goto release;
 
-	setattr_copy(inode, attr);
+	setattr_copy(KC_VFS_INIT_NS
+		     inode, attr);
 	inode_inc_iversion(inode);
 	scoutfs_update_inode_item(inode, lock, &ind_locks);
 
@@ -566,11 +594,9 @@ static void set_trans_seq(struct inode *inode, u64 *seq)
 	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 
 	if (*seq != sbi->trans_seq) {
-		preempt_disable();
-		write_seqcount_begin(&si->seqcount);
+		write_seqlock(&si->seqlock);
 		*seq = sbi->trans_seq;
-		write_seqcount_end(&si->seqcount);
-		preempt_enable();
+		write_sequnlock(&si->seqlock);
 	}
 }
 
@@ -592,22 +618,18 @@ void scoutfs_inode_inc_data_version(struct inode *inode)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 
-	preempt_disable();
-	write_seqcount_begin(&si->seqcount);
+	write_seqlock(&si->seqlock);
 	si->data_version++;
-	write_seqcount_end(&si->seqcount);
-	preempt_enable();
+	write_sequnlock(&si->seqlock);
 }
 
 void scoutfs_inode_set_data_version(struct inode *inode, u64 data_version)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 
-	preempt_disable();
-	write_seqcount_begin(&si->seqcount);
+	write_seqlock(&si->seqlock);
 	si->data_version = data_version;
-	write_seqcount_end(&si->seqcount);
-	preempt_enable();
+	write_sequnlock(&si->seqlock);
 }
 
 void scoutfs_inode_add_onoff(struct inode *inode, s64 on, s64 off)
@@ -616,8 +638,7 @@ void scoutfs_inode_add_onoff(struct inode *inode, s64 on, s64 off)
 
 	if (inode && (on || off)) {
 		si = SCOUTFS_I(inode);
-		preempt_disable();
-		write_seqcount_begin(&si->seqcount);
+		write_seqlock(&si->seqlock);
 
 		/* inode and extents out of sync, bad callers */
 		if (((s64)si->online_blocks + on < 0) ||
@@ -638,8 +659,7 @@ void scoutfs_inode_add_onoff(struct inode *inode, s64 on, s64 off)
 						    si->online_blocks,
 						    si->offline_blocks);
 
-		write_seqcount_end(&si->seqcount);
-		preempt_enable();
+		write_sequnlock(&si->seqlock);
 	}
 
 	/* any time offline extents decreased we try and wake waiters */
@@ -647,16 +667,16 @@ void scoutfs_inode_add_onoff(struct inode *inode, s64 on, s64 off)
 		scoutfs_data_wait_changed(inode);
 }
 
-static u64 read_seqcount_u64(struct inode *inode, u64 *val)
+static u64 read_seqlock_u64(struct inode *inode, u64 *val)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
-	unsigned int seq;
+	unsigned seq;
 	u64 v;
 
 	do {
-		seq = read_seqcount_begin(&si->seqcount);
+		seq = read_seqbegin(&si->seqlock);
 		v = *val;
-	} while (read_seqcount_retry(&si->seqcount, seq));
+	} while (read_seqretry(&si->seqlock, seq));
 
 	return v;
 }
@@ -665,33 +685,82 @@ u64 scoutfs_inode_meta_seq(struct inode *inode)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 
-	return read_seqcount_u64(inode, &si->meta_seq);
+	return read_seqlock_u64(inode, &si->meta_seq);
 }
 
 u64 scoutfs_inode_data_seq(struct inode *inode)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 
-	return read_seqcount_u64(inode, &si->data_seq);
+	return read_seqlock_u64(inode, &si->data_seq);
 }
 
 u64 scoutfs_inode_data_version(struct inode *inode)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 
-	return read_seqcount_u64(inode, &si->data_version);
+	return read_seqlock_u64(inode, &si->data_version);
 }
 
 void scoutfs_inode_get_onoff(struct inode *inode, s64 *on, s64 *off)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
-	unsigned int seq;
+	unsigned seq;
 
 	do {
-		seq = read_seqcount_begin(&si->seqcount);
+		seq = read_seqbegin(&si->seqlock);
 		*on = SCOUTFS_I(inode)->online_blocks;
 		*off = SCOUTFS_I(inode)->offline_blocks;
-	} while (read_seqcount_retry(&si->seqcount, seq));
+	} while (read_seqretry(&si->seqlock, seq));
+}
+
+/*
+ * Get our private scoutfs inode flags, not the vfs i_flags.
+ */
+u32 scoutfs_inode_get_flags(struct inode *inode)
+{
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+	unsigned seq;
+	u32 flags;
+
+	do {
+		seq = read_seqbegin(&si->seqlock);
+		flags = si->flags;
+	} while (read_seqretry(&si->seqlock, seq));
+
+	return flags;
+}
+
+void scoutfs_inode_set_flags(struct inode *inode, u32 and, u32 or)
+{
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+
+	write_seqlock(&si->seqlock);
+	si->flags = (si->flags & and) | or;
+	write_sequnlock(&si->seqlock);
+}
+
+u64 scoutfs_inode_get_proj(struct inode *inode)
+{
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+	unsigned seq;
+	u64 proj;
+
+	do {
+		seq = read_seqbegin(&si->seqlock);
+		proj = si->proj;
+	} while (read_seqretry(&si->seqlock, seq));
+
+	return proj;
+}
+
+void scoutfs_inode_set_proj(struct inode *inode, u64 proj)
+{
+	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
+
+	write_seqlock(&si->seqlock);
+	si->proj = proj;
+	write_sequnlock(&si->seqlock);
 }
 
 static int scoutfs_iget_test(struct inode *inode, void *arg)
@@ -803,7 +872,7 @@ out:
 	return inode;
 }
 
-static void store_inode(struct scoutfs_inode *cinode, struct inode *inode)
+static void store_inode(struct scoutfs_inode *cinode, struct inode *inode, int inode_bytes)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 	u64 online_blocks;
@@ -839,6 +908,7 @@ static void store_inode(struct scoutfs_inode *cinode, struct inode *inode)
 	cinode->crtime.sec = cpu_to_le64(si->crtime.tv_sec);
 	cinode->crtime.nsec = cpu_to_le32(si->crtime.tv_nsec);
 	memset(cinode->crtime.__pad, 0, sizeof(cinode->crtime.__pad));
+	cinode->proj = cpu_to_le64(si->proj);
 }
 
 /*
@@ -862,15 +932,18 @@ static void store_inode(struct scoutfs_inode *cinode, struct inode *inode)
 int scoutfs_dirty_inode_item(struct inode *inode, struct scoutfs_lock *lock)
 {
 	struct super_block *sb = inode->i_sb;
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	struct scoutfs_inode sinode;
 	struct scoutfs_key key;
+	int inode_bytes;
 	int ret;
 
-	store_inode(&sinode, inode);
+	inode_bytes = scoutfs_inode_vers_bytes(sbi->fmt_vers);
+	store_inode(&sinode, inode, inode_bytes);
 
 	scoutfs_inode_init_key(&key, scoutfs_ino(inode));
 
-	ret = scoutfs_item_update(sb, &key, &sinode, sizeof(sinode), lock);
+	ret = scoutfs_item_update(sb, &key, &sinode, inode_bytes, lock);
 	if (!ret)
 		trace_scoutfs_dirty_inode(inode);
 	return ret;
@@ -911,10 +984,10 @@ static bool inode_has_index(umode_t mode, u8 type)
 	}
 }
 
-static int cmp_index_lock(void *priv, struct list_head *A, struct list_head *B)
+static int cmp_index_lock(void *priv, KC_LIST_CMP_CONST struct list_head *A, KC_LIST_CMP_CONST struct list_head *B)
 {
-	struct index_lock *a = list_entry(A, struct index_lock, head);
-	struct index_lock *b = list_entry(B, struct index_lock, head);
+	KC_LIST_CMP_CONST struct index_lock *a = list_entry(A, KC_LIST_CMP_CONST struct index_lock, head);
+	KC_LIST_CMP_CONST struct index_lock *b = list_entry(B, KC_LIST_CMP_CONST struct index_lock, head);
 
 	return ((int)a->type - (int)b->type) ?:
 	       scoutfs_cmp_u64s(a->major, b->major) ?:
@@ -1072,9 +1145,11 @@ void scoutfs_update_inode_item(struct inode *inode, struct scoutfs_lock *lock,
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
 	struct super_block *sb = inode->i_sb;
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	const u64 ino = scoutfs_ino(inode);
-	struct scoutfs_key key;
 	struct scoutfs_inode sinode;
+	struct scoutfs_key key;
+	int inode_bytes;
 	int ret;
 	int err;
 
@@ -1083,15 +1158,17 @@ void scoutfs_update_inode_item(struct inode *inode, struct scoutfs_lock *lock,
 	/* set the meta version once per trans for any inode updates */
 	scoutfs_inode_set_meta_seq(inode);
 
+	inode_bytes = scoutfs_inode_vers_bytes(sbi->fmt_vers);
+
 	/* only race with other inode field stores once */
-	store_inode(&sinode, inode);
+	store_inode(&sinode, inode, inode_bytes);
 
 	ret = update_indices(sb, si, ino, inode->i_mode, &sinode, lock_list, lock);
 	BUG_ON(ret);
 
 	scoutfs_inode_init_key(&key, ino);
 
-	err = scoutfs_item_update(sb, &key, &sinode, sizeof(sinode), lock);
+	err = scoutfs_item_update(sb, &key, &sinode, inode_bytes, lock);
 	if (err) {
 		scoutfs_err(sb, "inode %llu update err %d", ino, err);
 		BUG_ON(err);
@@ -1459,10 +1536,12 @@ out:
 int scoutfs_new_inode(struct super_block *sb, struct inode *dir, umode_t mode, dev_t rdev,
 		      u64 ino, struct scoutfs_lock *lock, struct inode **inode_ret)
 {
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	struct scoutfs_inode_info *si;
-	struct scoutfs_key key;
 	struct scoutfs_inode sinode;
+	struct scoutfs_key key;
 	struct inode *inode;
+	int inode_bytes;
 	int ret;
 
 	inode = new_inode(sb);
@@ -1478,6 +1557,7 @@ int scoutfs_new_inode(struct super_block *sb, struct inode *dir, umode_t mode, d
 	si->offline_blocks = 0;
 	si->next_readdir_pos = SCOUTFS_DIRENT_FIRST_POS;
 	si->next_xattr_id = 0;
+	si->proj = 0;
 	si->have_item = false;
 	atomic64_set(&si->last_refreshed, lock->refresh_gen);
 	scoutfs_lock_add_coverage(sb, lock, &si->ino_lock_cov);
@@ -1487,20 +1567,23 @@ int scoutfs_new_inode(struct super_block *sb, struct inode *dir, umode_t mode, d
 	scoutfs_inode_set_data_seq(inode);
 
 	inode->i_ino = ino; /* XXX overflow */
-	inode_init_owner(inode, dir, mode);
+	inode_init_owner(KC_VFS_INIT_NS
+			 inode, dir, mode);
 	inode_set_bytes(inode, 0);
 	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
 	inode->i_rdev = rdev;
 	set_inode_ops(inode);
 
-	store_inode(&sinode, inode);
+	inode_bytes = scoutfs_inode_vers_bytes(sbi->fmt_vers);
+
+	store_inode(&sinode, inode, inode_bytes);
 	scoutfs_inode_init_key(&key, scoutfs_ino(inode));
 
 	ret = scoutfs_omap_set(sb, ino);
 	if (ret < 0)
 		goto out;
 
-	ret = scoutfs_item_create(sb, &key, &sinode, sizeof(sinode), lock);
+	ret = scoutfs_item_create(sb, &key, &sinode, inode_bytes, lock);
 	if (ret < 0)
 		scoutfs_omap_clear(sb, ino);
 out:
@@ -1754,7 +1837,7 @@ static int try_delete_inode_items(struct super_block *sb, u64 ino)
 	}
 
 	scoutfs_inode_init_key(&key, ino);
-	ret = scoutfs_item_lookup_exact(sb, &key, &sinode, sizeof(sinode), lock);
+	ret = lookup_inode_item(sb, &key, &sinode, lock);
 	if (ret < 0) {
 		if (ret == -ENOENT)
 			ret = 0;
@@ -2143,6 +2226,17 @@ out:
 	return ret;
 }
 
+/*
+ * Return an error if the inode has the retention flag set and can not
+ * be modified.  This mimics the errno returned by the vfs whan an
+ * inode's immutable flag is set.  The flag won't be set on older format
+ * versions so we don't check the mounted format version here.
+ */
+int scoutfs_inode_check_retention(struct inode *inode)
+{
+	return (scoutfs_inode_get_flags(inode) & SCOUTFS_INO_FLAG_RETENTION) ? -EPERM : 0;
+}
+
 int scoutfs_inode_setup(struct super_block *sb)
 {
 	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);

kmod/src/inode.h

@@ -21,6 +21,7 @@ struct scoutfs_inode_info {
 	u64 data_version;
 	u64 online_blocks;
 	u64 offline_blocks;
+	u64 proj;
 	u32 flags;
 	struct kc_timespec crtime;
 
@@ -47,7 +48,7 @@ struct scoutfs_inode_info {
 	atomic64_t last_refreshed;
 
 	/* initialized once for slab object */
-	seqcount_t seqcount;
+	seqlock_t seqlock;
 	bool staging;			/* holder of i_mutex is staging */
 	struct scoutfs_per_task pt_data_lock;
 	struct scoutfs_data_waitq data_waitq;
@@ -120,17 +121,26 @@ u64 scoutfs_inode_meta_seq(struct inode *inode);
 u64 scoutfs_inode_data_seq(struct inode *inode);
 u64 scoutfs_inode_data_version(struct inode *inode);
 void scoutfs_inode_get_onoff(struct inode *inode, s64 *on, s64 *off);
+u32 scoutfs_inode_get_flags(struct inode *inode);
+void scoutfs_inode_set_flags(struct inode *inode, u32 and, u32 or);
+u64 scoutfs_inode_get_proj(struct inode *inode);
+void scoutfs_inode_set_proj(struct inode *inode, u64 proj);
+
 int scoutfs_complete_truncate(struct inode *inode, struct scoutfs_lock *lock);
 
+int scoutfs_inode_check_retention(struct inode *inode);
+
 int scoutfs_inode_refresh(struct inode *inode, struct scoutfs_lock *lock);
 #ifdef KC_LINUX_HAVE_RHEL_IOPS_WRAPPER
 int scoutfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 		    struct kstat *stat);
 #else
-int scoutfs_getattr(const struct path *path, struct kstat *stat,
+int scoutfs_getattr(KC_VFS_NS_DEF
+		    const struct path *path, struct kstat *stat,
 		    u32 request_mask, unsigned int query_flags);
 #endif
-int scoutfs_setattr(struct dentry *dentry, struct iattr *attr);
+int scoutfs_setattr(KC_VFS_NS_DEF
+		    struct dentry *dentry, struct iattr *attr);
 
 int scoutfs_inode_orphan_create(struct super_block *sb, u64 ino, struct scoutfs_lock *lock,
 				struct scoutfs_lock *primary);

kmod/src/ioctl.c

@@ -23,6 +23,7 @@
 #include <linux/aio.h>
 #include <linux/list_sort.h>
 #include <linux/backing-dev.h>
+#include <linux/overflow.h>
 
 #include "format.h"
 #include "key.h"
@@ -42,7 +43,12 @@
 #include "alloc.h"
 #include "server.h"
 #include "counters.h"
+#include "attr_x.h"
+#include "totl.h"
+#include "wkic.h"
+#include "quota.h"
 #include "scoutfs_trace.h"
+#include "util.h"
 
 /*
  * We make inode index items coherent by locking fixed size regions of
@@ -284,6 +290,7 @@ static long scoutfs_ioc_release(struct file *file, unsigned long arg)
 	u64 online;
 	u64 offline;
 	u64 isize;
+	__u64 tmp;
 	int ret;
 
 	if (copy_from_user(&args, (void __user *)arg, sizeof(args)))
@@ -293,12 +300,11 @@ static long scoutfs_ioc_release(struct file *file, unsigned long arg)
 
 	if (args.length == 0)
 		return 0;
-	if (((args.offset + args.length) < args.offset) ||
+	if ((check_add_overflow(args.offset, args.length - 1, &tmp)) ||
 	    (args.offset & SCOUTFS_BLOCK_SM_MASK) ||
 	    (args.length & SCOUTFS_BLOCK_SM_MASK))
 		return -EINVAL;
 
-
 	ret = mnt_want_write_file(file);
 	if (ret)
 		return ret;
@@ -518,7 +524,9 @@ static long scoutfs_ioc_stage(struct file *file, unsigned long arg)
 	}
 
 	si->staging = true;
+#ifdef KC_CURRENT_BACKING_DEV_INFO
 	current->backing_dev_info = inode_to_bdi(inode);
+#endif
 
 	pos = args.offset;
 	written = 0;
@@ -531,7 +539,9 @@ static long scoutfs_ioc_stage(struct file *file, unsigned long arg)
 	} while (ret > 0 && written < args.length);
 
 	si->staging = false;
+#ifdef KC_CURRENT_BACKING_DEV_INFO
 	current->backing_dev_info = NULL;
+#endif
 out:
 	scoutfs_per_task_del(&si->pt_data_lock, &pt_ent);
 	scoutfs_unlock(sb, lock, SCOUTFS_LOCK_WRITE);
@@ -545,20 +555,41 @@ out:
 static long scoutfs_ioc_stat_more(struct file *file, unsigned long arg)
 {
 	struct inode *inode = file_inode(file);
-	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
-	struct scoutfs_ioctl_stat_more stm;
+	struct scoutfs_ioctl_inode_attr_x *iax = NULL;
+	struct scoutfs_ioctl_stat_more *stm = NULL;
+	int ret;
 
-	stm.meta_seq = scoutfs_inode_meta_seq(inode);
-	stm.data_seq = scoutfs_inode_data_seq(inode);
-	stm.data_version = scoutfs_inode_data_version(inode);
-	scoutfs_inode_get_onoff(inode, &stm.online_blocks, &stm.offline_blocks);
-	stm.crtime_sec = si->crtime.tv_sec;
-	stm.crtime_nsec = si->crtime.tv_nsec;
+	iax = kmalloc(sizeof(struct scoutfs_ioctl_inode_attr_x), GFP_KERNEL);
+	stm = kmalloc(sizeof(struct scoutfs_ioctl_stat_more), GFP_KERNEL);
+	if (!iax || !stm) {
+		ret = -ENOMEM;
+		goto out;
+	}
 
-	if (copy_to_user((void __user *)arg, &stm, sizeof(stm)))
-		return -EFAULT;
+	iax->x_mask = SCOUTFS_IOC_IAX_META_SEQ | SCOUTFS_IOC_IAX_DATA_SEQ |
+		      SCOUTFS_IOC_IAX_DATA_VERSION | SCOUTFS_IOC_IAX_ONLINE_BLOCKS |
+		      SCOUTFS_IOC_IAX_OFFLINE_BLOCKS | SCOUTFS_IOC_IAX_CRTIME;
+	iax->x_flags = 0;
+	ret = scoutfs_get_attr_x(inode, iax);
+	if (ret < 0)
+		goto out;
 
-	return 0;
+	stm->meta_seq = iax->meta_seq;
+	stm->data_seq = iax->data_seq;
+	stm->data_version = iax->data_version;
+	stm->online_blocks = iax->online_blocks;
+	stm->offline_blocks = iax->offline_blocks;
+	stm->crtime_sec = iax->crtime_sec;
+	stm->crtime_nsec = iax->crtime_nsec;
+
+	if (copy_to_user((void __user *)arg, stm, sizeof(struct scoutfs_ioctl_stat_more)))
+		ret = -EFAULT;
+	else
+		ret = 0;
+out:
+	kfree(iax);
+	kfree(stm);
+	return ret;
 }
 
 static bool inc_wrapped(u64 *ino, u64 *iblock)
@@ -615,24 +646,19 @@ static long scoutfs_ioc_data_waiting(struct file *file, unsigned long arg)
  * This is used when restoring files, it lets the caller set all the
  * inode attributes which are otherwise unreachable.  Changing the file
  * size can only be done for regular files with a data_version of 0.
+ *
+ * We unconditionally fill the iax attributes from the sm set and let
+ * set_attr_x check them.
  */
 static long scoutfs_ioc_setattr_more(struct file *file, unsigned long arg)
 {
-	struct inode *inode = file->f_inode;
-	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
-	struct super_block *sb = inode->i_sb;
+	struct inode *inode = file_inode(file);
 	struct scoutfs_ioctl_setattr_more __user *usm = (void __user *)arg;
+	struct scoutfs_ioctl_inode_attr_x *iax = NULL;
 	struct scoutfs_ioctl_setattr_more sm;
-	struct scoutfs_lock *lock = NULL;
 	LIST_HEAD(ind_locks);
-	bool set_data_seq;
 	int ret;
 
-	if (!capable(CAP_SYS_ADMIN)) {
-		ret = -EPERM;
-		goto out;
-	}
-
 	if (!(file->f_mode & FMODE_WRITE)) {
 		ret = -EBADF;
 		goto out;
@@ -643,65 +669,41 @@ static long scoutfs_ioc_setattr_more(struct file *file, unsigned long arg)
 		goto out;
 	}
 
-	if ((sm.i_size > 0 && sm.data_version == 0) ||
-	    ((sm.flags & SCOUTFS_IOC_SETATTR_MORE_OFFLINE) && !sm.i_size) ||
-	    (sm.flags & SCOUTFS_IOC_SETATTR_MORE_UNKNOWN)) {
+	if (sm.flags & SCOUTFS_IOC_SETATTR_MORE_UNKNOWN) {
 		ret = -EINVAL;
 		goto out;
 	}
 
+	iax = kzalloc(sizeof(struct scoutfs_ioctl_inode_attr_x), GFP_KERNEL);
+	if (!iax) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	iax->x_mask = SCOUTFS_IOC_IAX_CTIME | SCOUTFS_IOC_IAX_CRTIME |
+		      SCOUTFS_IOC_IAX_SIZE;
+	iax->data_version = sm.data_version;
+	iax->ctime_sec = sm.ctime_sec;
+	iax->ctime_nsec = sm.ctime_nsec;
+	iax->crtime_sec = sm.crtime_sec;
+	iax->crtime_nsec = sm.crtime_nsec;
+	iax->size = sm.i_size;
+
+	if (sm.flags & SCOUTFS_IOC_SETATTR_MORE_OFFLINE)
+		iax->x_flags |= SCOUTFS_IOC_IAX_F_SIZE_OFFLINE;
+
+	if (sm.data_version != 0)
+		iax->x_mask |= SCOUTFS_IOC_IAX_DATA_VERSION;
+
 	ret = mnt_want_write_file(file);
-	if (ret)
+	if (ret < 0)
 		goto out;
 
-	inode_lock(inode);
+	ret = scoutfs_set_attr_x(inode, iax);
 
-	ret = scoutfs_lock_inode(sb, SCOUTFS_LOCK_WRITE,
-				 SCOUTFS_LKF_REFRESH_INODE, inode, &lock);
-	if (ret)
-		goto unlock;
-
-	/* can only change size/dv on untouched regular files */
-	if ((sm.i_size != 0 || sm.data_version != 0) &&
-	    ((!S_ISREG(inode->i_mode) ||
-	      scoutfs_inode_data_version(inode) != 0))) {
-		ret = -EINVAL;
-		goto unlock;
-	}
-
-	/* create offline extents in potentially many transactions */
-	if (sm.flags & SCOUTFS_IOC_SETATTR_MORE_OFFLINE) {
-		ret = scoutfs_data_init_offline_extent(inode, sm.i_size, lock);
-		if (ret)
-			goto unlock;
-	}
-
-	/* setting only so we don't see 0 data seq with nonzero data_version */
-	set_data_seq = sm.data_version != 0 ? true : false;
-	ret = scoutfs_inode_index_lock_hold(inode, &ind_locks, set_data_seq, false);
-	if (ret)
-		goto unlock;
-
-	if (sm.data_version)
-		scoutfs_inode_set_data_version(inode, sm.data_version);
-	if (sm.i_size)
-		i_size_write(inode, sm.i_size);
-	inode->i_ctime.tv_sec = sm.ctime_sec;
-	inode->i_ctime.tv_nsec = sm.ctime_nsec;
-	si->crtime.tv_sec = sm.crtime_sec;
-	si->crtime.tv_nsec = sm.crtime_nsec;
-
-	scoutfs_update_inode_item(inode, lock, &ind_locks);
-	ret = 0;
-
-	scoutfs_release_trans(sb);
-unlock:
-	scoutfs_inode_index_unlock(sb, &ind_locks);
-	scoutfs_unlock(sb, lock, SCOUTFS_LOCK_WRITE);
-	inode_unlock(inode);
 	mnt_drop_write_file(file);
 out:
-
+	kfree(iax);
 	return ret;
 }
 
@@ -720,7 +722,8 @@ static long scoutfs_ioc_listxattr_hidden(struct file *file, unsigned long arg)
 	int total = 0;
 	int ret;
 
-	ret = inode_permission(inode, MAY_READ);
+	ret = inode_permission(KC_VFS_INIT_NS
+			       inode, MAY_READ);
 	if (ret < 0)
 		goto out;
 
@@ -958,6 +961,7 @@ static long scoutfs_ioc_move_blocks(struct file *file, unsigned long arg)
 	struct scoutfs_ioctl_move_blocks mb;
 	struct file *from_file;
 	struct inode *from;
+	u64 tmp;
 	int ret;
 
 	if (copy_from_user(&mb, umb, sizeof(mb)))
@@ -966,8 +970,8 @@ static long scoutfs_ioc_move_blocks(struct file *file, unsigned long arg)
 	if (mb.len == 0)
 		return 0;
 
-	if (mb.from_off + mb.len < mb.from_off ||
-	    mb.to_off + mb.len < mb.to_off)
+	if ((check_add_overflow(mb.from_off, mb.len - 1, &tmp)) ||
+	    (check_add_overflow(mb.to_off, mb.len - 1, &tmp)))
 		return -EOVERFLOW;
 
 	from_file = fget(mb.from_fd);
@@ -1035,124 +1039,32 @@ out:
 	return ret;
 }
 
-struct xattr_total_entry {
-	struct rb_node node;
-	struct scoutfs_ioctl_xattr_total xt;
-	u64 fs_seq;
-	u64 fs_total;
-	u64 fs_count;
-	u64 fin_seq;
-	u64 fin_total;
-	s64 fin_count;
-	u64 log_seq;
-	u64 log_total;
-	s64 log_count;
+struct read_xattr_total_iter_cb_args {
+	struct scoutfs_ioctl_xattr_total *xt;
+	unsigned int copied;
+	unsigned int total;
 };
 
-static int cmp_xt_entry_name(const struct xattr_total_entry *a,
-			     const struct xattr_total_entry *b)
-
-{
-	return scoutfs_cmp_u64s(a->xt.name[0], b->xt.name[0]) ?:
-	       scoutfs_cmp_u64s(a->xt.name[1], b->xt.name[1]) ?:
-	       scoutfs_cmp_u64s(a->xt.name[2], b->xt.name[2]);
-}
-
 /*
- * Record the contribution of the three classes of logged items we can
- * see: the item in the fs_root, items from finalized log btrees, and
- * items from active log btrees.  Once we have the full set the caller
- * can decide which of the items contribute to the total it sends to the
- * user.
+ * This is called under an RCU read lock so it can't copy to userspace.
  */
-static int read_xattr_total_item(struct super_block *sb, struct scoutfs_key *key,
-				 u64 seq, u8 flags, void *val, int val_len, int fic, void *arg)
+static int read_xattr_total_iter_cb(struct scoutfs_key *key, void *val, unsigned int val_len,
+				    void *cb_arg)
 {
+	struct read_xattr_total_iter_cb_args *cba = cb_arg;
 	struct scoutfs_xattr_totl_val *tval = val;
-	struct xattr_total_entry *ent;
-	struct xattr_total_entry rd;
-	struct rb_root *root = arg;
-	struct rb_node *parent;
-	struct rb_node **node;
-	int cmp;
+	struct scoutfs_ioctl_xattr_total *xt = &cba->xt[cba->copied];
 
-	rd.xt.name[0] = le64_to_cpu(key->skxt_a);
-	rd.xt.name[1] = le64_to_cpu(key->skxt_b);
-	rd.xt.name[2] = le64_to_cpu(key->skxt_c);
+	xt->name[0] = le64_to_cpu(key->skxt_a);
+	xt->name[1] = le64_to_cpu(key->skxt_b);
+	xt->name[2] = le64_to_cpu(key->skxt_c);
+	xt->total = le64_to_cpu(tval->total);
+	xt->count = le64_to_cpu(tval->count);
 
-	/* find entry matching name */
-	node = &root->rb_node;
-	parent = NULL;
-	cmp = -1;
-	while (*node) {
-		parent = *node;
-		ent = container_of(*node, struct xattr_total_entry, node);
-
-		/* sort merge items by key then newest to oldest */
-		cmp = cmp_xt_entry_name(&rd, ent);
-		if (cmp < 0)
-			node = &(*node)->rb_left;
-		else if (cmp > 0)
-			node = &(*node)->rb_right;
-		else
-			break;
-	}
-
-	/* allocate and insert new node if we need to */
-	if (cmp != 0) {
-		ent = kzalloc(sizeof(*ent), GFP_KERNEL);
-		if (!ent)
-			return -ENOMEM;
-
-		memcpy(&ent->xt.name, &rd.xt.name, sizeof(ent->xt.name));
-
-		rb_link_node(&ent->node, parent, node);
-		rb_insert_color(&ent->node, root);
-	}
-
-	if (fic & FIC_FS_ROOT) {
-		ent->fs_seq = seq;
-		ent->fs_total = le64_to_cpu(tval->total);
-		ent->fs_count = le64_to_cpu(tval->count);
-	} else if (fic & FIC_FINALIZED) {
-		ent->fin_seq = seq;
-		ent->fin_total += le64_to_cpu(tval->total);
-		ent->fin_count += le64_to_cpu(tval->count);
-	} else {
-		ent->log_seq = seq;
-		ent->log_total += le64_to_cpu(tval->total);
-		ent->log_count += le64_to_cpu(tval->count);
-	}
-
-	scoutfs_inc_counter(sb, totl_read_item);
-
-	return 0;
-}
-
-/* these are always _safe, node stores next */
-#define for_each_xt_ent(ent, node, root)					\
-	for (node = rb_first(root);						\
-	     node && (ent = rb_entry(node, struct xattr_total_entry, node),	\
-		      node = rb_next(node), 1); )
-
-#define for_each_xt_ent_reverse(ent, node, root)				\
-	for (node = rb_last(root);						\
-	     node && (ent = rb_entry(node, struct xattr_total_entry, node),	\
-		      node = rb_prev(node), 1); )
-
-static void free_xt_ent(struct rb_root *root, struct xattr_total_entry *ent)
-{
-	rb_erase(&ent->node, root);
-	kfree(ent);
-}
-
-static void free_all_xt_ents(struct rb_root *root)
-{
-	struct xattr_total_entry *ent;
-	struct rb_node *node;
-
-	for_each_xt_ent(ent, node, root)
-		free_xt_ent(root, ent);
+	if (++cba->copied < cba->total)
+		return -EAGAIN;
+	else
+		return 0;
 }
 
 /*
@@ -1162,30 +1074,6 @@ static void free_all_xt_ents(struct rb_root *root)
  * have been committed.  It doesn't use locking to force commits and
  * block writers so it can be a little bit out of date with respect to
  * dirty xattrs in memory across the system.
- *
- * Our reader has to be careful because the log btree merging code can
- * write partial results to the fs_root.  This means that a reader can
- * see both cases where new finalized logs should be applied to the old
- * fs items and where old finalized logs have already been applied to
- * the partially merged fs items.  Currently active logged items are
- * always applied on top of all cases.
- *
- * These cases are differentiated with a combination of sequence numbers
- * in items, the count of contributing xattrs, and a flag
- * differentiating finalized and active logged items.  This lets us
- * recognize all cases, including when finalized logs were merged and
- * deleted the fs item.
- *
- * We're allocating a tracking struct for each totl name we see while
- * traversing the item btrees.  The forest reader is providing the items
- * it finds in leaf blocks that contain the search key.  In the worst
- * case all of these blocks are full and none of the items overlap.  At
- * most, figure order a thousand names per mount.  But in practice many
- * of these factors fall away: leaf blocks aren't fill, leaf items
- * overlap, there aren't finalized log btrees, and not all mounts are
- * actively changing totals.   We're much more likely to only read a
- * leaf block's worth of totals that have been long since merged into
- * the fs_root.
  */
 static long scoutfs_ioc_read_xattr_totals(struct file *file, unsigned long arg)
 {
@@ -1193,14 +1081,13 @@ static long scoutfs_ioc_read_xattr_totals(struct file *file, unsigned long arg)
 	struct scoutfs_ioctl_read_xattr_totals __user *urxt = (void __user *)arg;
 	struct scoutfs_ioctl_read_xattr_totals rxt;
 	struct scoutfs_ioctl_xattr_total __user *uxt;
-	struct xattr_total_entry *ent;
+	struct read_xattr_total_iter_cb_args cba = {NULL, };
+	struct scoutfs_key range_start;
+	struct scoutfs_key range_end;
 	struct scoutfs_key key;
-	struct scoutfs_key bloom_key;
-	struct scoutfs_key start;
-	struct scoutfs_key end;
-	struct rb_root root = RB_ROOT;
-	struct rb_node *node;
-	int count = 0;
+	unsigned int copied = 0;
+	unsigned int total;
+	unsigned int ready;
 	int ret;
 
 	if (!(file->f_mode & FMODE_READ)) {
@@ -1213,6 +1100,13 @@ static long scoutfs_ioc_read_xattr_totals(struct file *file, unsigned long arg)
 		goto out;
 	}
 
+	cba.xt = (void *)__get_free_page(GFP_KERNEL);
+	if (!cba.xt) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	cba.total = PAGE_SIZE / sizeof(struct scoutfs_ioctl_xattr_total);
+
 	if (copy_from_user(&rxt, urxt, sizeof(rxt))) {
 		ret = -EFAULT;
 		goto out;
@@ -1225,101 +1119,40 @@ static long scoutfs_ioc_read_xattr_totals(struct file *file, unsigned long arg)
 		goto out;
 	}
 
-	scoutfs_key_set_zeros(&bloom_key);
-	bloom_key.sk_zone = SCOUTFS_XATTR_TOTL_ZONE;
-	scoutfs_xattr_init_totl_key(&start, rxt.pos_name);
+	total = div_u64(min_t(u64, rxt.totals_bytes, INT_MAX),
+			sizeof(struct scoutfs_ioctl_xattr_total));
 
-	while (rxt.totals_bytes >= sizeof(struct scoutfs_ioctl_xattr_total)) {
+	scoutfs_totl_set_range(&range_start, &range_end);
+	scoutfs_xattr_init_totl_key(&key, rxt.pos_name);
 
-		scoutfs_key_set_ones(&end);
-		end.sk_zone = SCOUTFS_XATTR_TOTL_ZONE;
-		if (scoutfs_key_compare(&start, &end) > 0)
+	while (copied < total) {
+		cba.copied = 0;
+		ret = scoutfs_wkic_iterate(sb, &key, &range_end, &range_start, &range_end,
+					   read_xattr_total_iter_cb, &cba);
+		if (ret < 0)
+			goto out;
+
+		if (cba.copied == 0)
 			break;
 
-		key = start;
-		ret = scoutfs_forest_read_items(sb, &key, &bloom_key, &start, &end,
-						read_xattr_total_item, &root);
-		if (ret < 0) {
-			if (ret == -ESTALE) {
-				free_all_xt_ents(&root);
-				continue;
-			}
+		ready = min(total - copied, cba.copied);
+
+		if (copy_to_user(&uxt[copied], cba.xt, ready * sizeof(cba.xt[0]))) {
+			ret = -EFAULT;
 			goto out;
 		}
 
-		if (RB_EMPTY_ROOT(&root))
-			break;
-
-		/* trim totals that fall outside of the consistent range */
-		for_each_xt_ent(ent, node, &root) {
-			scoutfs_xattr_init_totl_key(&key, ent->xt.name);
-			if (scoutfs_key_compare(&key, &start) < 0) {
-				free_xt_ent(&root, ent);
-			} else {
-				break;
-			}
-		}
-		for_each_xt_ent_reverse(ent, node, &root) {
-			scoutfs_xattr_init_totl_key(&key, ent->xt.name);
-			if (scoutfs_key_compare(&key, &end) > 0) {
-				free_xt_ent(&root, ent);
-			} else {
-				break;
-			}
-		}
-
-		/* copy resulting unique non-zero totals to userspace */
-		for_each_xt_ent(ent, node, &root) {
-			if (rxt.totals_bytes < sizeof(ent->xt))
-				break;
-
-			/* start with the fs item if we have it */
-			if (ent->fs_seq != 0) {
-				ent->xt.total = ent->fs_total;
-				ent->xt.count = ent->fs_count;
-				scoutfs_inc_counter(sb, totl_read_fs);
-			}
-
-			/* apply finalized logs if they're newer or creating */
-			if (((ent->fs_seq != 0) && (ent->fin_seq > ent->fs_seq)) ||
-			    ((ent->fs_seq == 0) && (ent->fin_count > 0))) {
-				ent->xt.total += ent->fin_total;
-				ent->xt.count += ent->fin_count;
-				scoutfs_inc_counter(sb, totl_read_finalized);
-			}
-
-			/* always apply active logs which must be newer than fs and finalized */
-			if (ent->log_seq > 0) {
-				ent->xt.total += ent->log_total;
-				ent->xt.count += ent->log_count;
-				scoutfs_inc_counter(sb, totl_read_logged);
-			}
-
-			if (ent->xt.total != 0 || ent->xt.count != 0) {
-				if (copy_to_user(uxt, &ent->xt, sizeof(ent->xt))) {
-					ret = -EFAULT;
-					goto out;
-				}
-
-				uxt++;
-				rxt.totals_bytes -= sizeof(ent->xt);
-				count++;
-				scoutfs_inc_counter(sb, totl_read_copied);
-			}
-
-			free_xt_ent(&root, ent);
-		}
-
-		/* continue after the last possible key read */
-		start = end;
-		scoutfs_key_inc(&start);
+		scoutfs_xattr_init_totl_key(&key, cba.xt[ready - 1].name);
+		scoutfs_key_inc(&key);
+		copied += ready;
 	}
 
 	ret = 0;
 out:
-	free_all_xt_ents(&root);
+	if (cba.xt)
+		free_page((long)cba.xt);
 
-	return ret ?: count;
+	return ret ?: copied;
 }
 
 static long scoutfs_ioc_get_allocated_inos(struct file *file, unsigned long arg)
@@ -1504,6 +1337,265 @@ out:
 	return nr ?: ret;
 }
 
+static long scoutfs_ioc_get_attr_x(struct file *file, unsigned long arg)
+{
+	struct inode *inode = file_inode(file);
+	struct scoutfs_ioctl_inode_attr_x __user *uiax = (void __user *)arg;
+	struct scoutfs_ioctl_inode_attr_x *iax = NULL;
+	int ret;
+
+	iax = kmalloc(sizeof(struct scoutfs_ioctl_inode_attr_x), GFP_KERNEL);
+	if (!iax) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	ret = get_user(iax->x_mask, &uiax->x_mask) ?:
+	      get_user(iax->x_flags, &uiax->x_flags);
+	if (ret < 0)
+		goto out;
+
+	ret = scoutfs_get_attr_x(inode, iax);
+	if (ret < 0)
+		goto out;
+
+	/* only copy results after dropping cluster locks (could fault) */
+	if (ret > 0 && copy_to_user(uiax, iax, ret) != 0)
+		ret = -EFAULT;
+	else
+		ret = 0;
+out:
+	kfree(iax);
+	return ret;
+}
+
+static long scoutfs_ioc_set_attr_x(struct file *file, unsigned long arg)
+{
+	struct inode *inode = file_inode(file);
+	struct scoutfs_ioctl_inode_attr_x __user *uiax = (void __user *)arg;
+	struct scoutfs_ioctl_inode_attr_x *iax = NULL;
+	int ret;
+
+	iax = kmalloc(sizeof(struct scoutfs_ioctl_inode_attr_x), GFP_KERNEL);
+	if (!iax) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	if (copy_from_user(iax, uiax, sizeof(struct scoutfs_ioctl_inode_attr_x))) {
+		ret = -EFAULT;
+		goto out;
+	}
+
+	ret = mnt_want_write_file(file);
+	if (ret < 0)
+		goto out;
+
+	ret = scoutfs_set_attr_x(inode, iax);
+
+	mnt_drop_write_file(file);
+out:
+	kfree(iax);
+	return ret;
+}
+
+static long scoutfs_ioc_get_quota_rules(struct file *file, unsigned long arg)
+{
+	struct super_block *sb = file_inode(file)->i_sb;
+	struct scoutfs_ioctl_get_quota_rules __user *ugqr = (void __user *)arg;
+	struct scoutfs_ioctl_get_quota_rules gqr;
+	struct scoutfs_ioctl_quota_rule __user *uirules;
+	struct scoutfs_ioctl_quota_rule *irules;
+	struct page *page = NULL;
+	int copied = 0;
+	int nr;
+	int ret;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	if (copy_from_user(&gqr, ugqr, sizeof(gqr)))
+		return -EFAULT;
+
+	if (gqr.rules_nr == 0)
+		return 0;
+
+	uirules = (void __user *)gqr.rules_ptr;
+	/* limit rules copied per call */
+	gqr.rules_nr = min_t(u64, gqr.rules_nr, INT_MAX);
+
+	page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+	if (!page) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	irules = page_address(page);
+
+	while (copied < gqr.rules_nr) {
+		nr = min_t(u64, gqr.rules_nr - copied,
+				PAGE_SIZE / sizeof(struct scoutfs_ioctl_quota_rule));
+		ret = scoutfs_quota_get_rules(sb, gqr.iterator, page_address(page), nr);
+		if (ret <= 0)
+			goto out;
+
+		if (copy_to_user(&uirules[copied], irules, ret * sizeof(irules[0]))) {
+			ret = -EFAULT;
+			goto out;
+		}
+
+		copied += ret;
+	}
+
+	ret = 0;
+out:
+	if (page)
+		__free_page(page);
+
+	if (ret == 0 && copy_to_user(ugqr->iterator, gqr.iterator, sizeof(gqr.iterator)))
+		ret = -EFAULT;
+
+	return ret ?: copied;
+}
+
+static long scoutfs_ioc_mod_quota_rule(struct file *file, unsigned long arg, bool is_add)
+{
+	struct super_block *sb = file_inode(file)->i_sb;
+	struct scoutfs_ioctl_quota_rule __user *uirule = (void __user *)arg;
+	struct scoutfs_ioctl_quota_rule irule;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	if (copy_from_user(&irule, uirule, sizeof(irule)))
+		return -EFAULT;
+
+	return scoutfs_quota_mod_rule(sb, is_add, &irule);
+}
+
+struct read_index_buf {
+	int nr;
+	int size;
+	struct scoutfs_ioctl_xattr_index_entry ents[0];
+};
+
+#define READ_INDEX_BUF_MAX_ENTS \
+	((PAGE_SIZE - sizeof(struct read_index_buf)) / \
+		sizeof(struct scoutfs_ioctl_xattr_index_entry))
+
+/*
+ * This doesn't filter out duplicates, the caller filters them out to
+ * catch duplicates between iteration calls.
+ */
+static int read_index_cb(struct scoutfs_key *key, void *val, unsigned int val_len, void *cb_arg)
+{
+	struct read_index_buf *rib = cb_arg;
+	struct scoutfs_ioctl_xattr_index_entry *ent = &rib->ents[rib->nr];
+	u64 xid;
+
+	if (val_len != 0)
+		return -EIO;
+
+	/* discard the xid, they're not exposed to ioctl callers */
+	scoutfs_xattr_get_indx_key(key, &ent->major, &ent->minor, &ent->ino, &xid);
+
+	if (++rib->nr == rib->size)
+		return rib->nr;
+
+	return -EAGAIN;
+}
+
+static long scoutfs_ioc_read_xattr_index(struct file *file, unsigned long arg)
+{
+	struct super_block *sb = file_inode(file)->i_sb;
+	struct scoutfs_ioctl_read_xattr_index __user *urxi = (void __user *)arg;
+	struct scoutfs_ioctl_xattr_index_entry __user *uents;
+	struct scoutfs_ioctl_xattr_index_entry *ent;
+	struct scoutfs_ioctl_xattr_index_entry prev;
+	struct scoutfs_ioctl_read_xattr_index rxi;
+	struct read_index_buf *rib;
+	struct page *page = NULL;
+	struct scoutfs_key first;
+	struct scoutfs_key last;
+	struct scoutfs_key start;
+	struct scoutfs_key end;
+	int copied = 0;
+	int ret;
+	int i;
+
+	if (!capable(CAP_SYS_ADMIN)) {
+		ret = -EPERM;
+		goto out;
+	}
+
+	if (copy_from_user(&rxi, urxi, sizeof(rxi))) {
+		ret = -EFAULT;
+		goto out;
+	}
+	uents = (void __user *)rxi.entries_ptr;
+	rxi.entries_nr = min_t(u64, rxi.entries_nr, INT_MAX);
+
+	page = alloc_page(GFP_KERNEL);
+	if (!page) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	rib = page_address(page);
+
+	scoutfs_xattr_init_indx_key(&first, rxi.first.major, rxi.first.minor, rxi.first.ino, 0);
+	scoutfs_xattr_init_indx_key(&last, rxi.last.major, rxi.last.minor, rxi.last.ino, U64_MAX);
+	scoutfs_xattr_indx_get_range(&start, &end);
+
+	if (scoutfs_key_compare(&first, &last) > 0) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	/* 0 ino doesn't exist, can't ever match entry to return */
+	memset(&prev, 0, sizeof(prev));
+
+	while (copied < rxi.entries_nr) {
+		rib->nr = 0;
+		rib->size = min_t(u64, rxi.entries_nr - copied, READ_INDEX_BUF_MAX_ENTS);
+		ret = scoutfs_wkic_iterate(sb, &first, &last, &start, &end,
+					   read_index_cb, rib);
+		if (ret < 0)
+			goto out;
+		if (rib->nr == 0)
+			break;
+
+		/*
+		 * Copy entries to userspace, skipping duplicate entries
+		 * that can result from multiple xattrs indexing an
+		 * inode at the same position and which can span
+		 * multiple cache iterations.  (Comparing in order of
+		 * most likely to change to fail fast.)
+		 */
+		for (i = 0, ent = rib->ents; i < rib->nr; i++, ent++) {
+			if (ent->ino == prev.ino && ent->minor == prev.minor &&
+			    ent->major == prev.major)
+				continue;
+
+			if (copy_to_user(&uents[copied], ent, sizeof(*ent))) {
+				ret = -EFAULT;
+				goto out;
+			}
+
+			prev = *ent;
+			copied++;
+		}
+
+		scoutfs_xattr_init_indx_key(&first, prev.major, prev.minor, prev.ino, U64_MAX);
+		scoutfs_key_inc(&first);
+	}
+
+	ret = copied;
+out:
+	if (page)
+		__free_page(page);
+
+	return ret;
+}
+
 long scoutfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	switch (cmd) {
@@ -1541,6 +1633,18 @@ long scoutfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		return scoutfs_ioc_get_allocated_inos(file, arg);
 	case SCOUTFS_IOC_GET_REFERRING_ENTRIES:
 		return scoutfs_ioc_get_referring_entries(file, arg);
+	case SCOUTFS_IOC_GET_ATTR_X:
+		return scoutfs_ioc_get_attr_x(file, arg);
+	case SCOUTFS_IOC_SET_ATTR_X:
+		return scoutfs_ioc_set_attr_x(file, arg);
+	case SCOUTFS_IOC_GET_QUOTA_RULES:
+		return scoutfs_ioc_get_quota_rules(file, arg);
+	case SCOUTFS_IOC_ADD_QUOTA_RULE:
+		return scoutfs_ioc_mod_quota_rule(file, arg, true);
+	case SCOUTFS_IOC_DEL_QUOTA_RULE:
+		return scoutfs_ioc_mod_quota_rule(file, arg, false);
+	case SCOUTFS_IOC_READ_XATTR_INDEX:
+		return scoutfs_ioc_read_xattr_index(file, arg);
 	}
 
 	return -ENOTTY;

kmod/src/ioctl.h

@@ -673,4 +673,174 @@ struct scoutfs_ioctl_dirent {
 #define SCOUTFS_IOC_GET_REFERRING_ENTRIES \
 	_IOW(SCOUTFS_IOCTL_MAGIC, 17, struct scoutfs_ioctl_get_referring_entries)
 
+struct scoutfs_ioctl_inode_attr_x {
+	__u64 x_mask;
+	__u64 x_flags;
+	__u64 meta_seq;
+	__u64 data_seq;
+	__u64 data_version;
+	__u64 online_blocks;
+	__u64 offline_blocks;
+	__u64 ctime_sec;
+	__u32 ctime_nsec;
+	__u32 crtime_nsec;
+	__u64 crtime_sec;
+	__u64 size;
+	__u64 bits;
+	__u64 project_id;
+};
+
+/*
+ * Behavioral flags set in the x_flags field.  These flags don't
+ * necessarily correspond to specific attributes, but instead change the
+ * behaviour of a _get_ or _set_ operation.
+ *
+ * @SCOUTFS_IOC_IAX_F_SIZE_OFFLINE: When setting i_size, also create
+ * extents which are marked offline for the region of the file from
+ * offset 0 to the new set size.  This can only be set when setting the
+ * size and has no effect if setting the size fails.
+ */
+#define SCOUTFS_IOC_IAX_F_SIZE_OFFLINE	(1ULL << 0)
+#define SCOUTFS_IOC_IAX_F__UNKNOWN	(U64_MAX << 1)
+
+/*
+ * Single-bit values stored in the @bits field.  These indicate whether
+ * the bit is set, or not.  The main _IAX_ bits set in the mask indicate
+ * whether this value bit is populated by _get or stored by _set. 
+ */
+#define SCOUTFS_IOC_IAX_B_RETENTION	(1ULL << 0)
+
+/*
+ * x_mask bits which indicate which attributes of the inode to populate
+ * on return for _get or to set on the inode for _set.  Each mask bit
+ * corresponds to the matching named field in the attr_x struct passed
+ * to the _get_ and _set_ calls.
+ *
+ * Each field can have different permissions or other attribute
+ * requirements which can cause calls to fail.  If _set_ fails then no
+ * other attribute changes will have been made by the same call.
+ *
+ * @SCOUTFS_IOC_IAX_RETENTION: Mark a file for retention.  When marked,
+ * no modification can be made to the file other than changing extended
+ * attributes outside the "user." prefix and clearing the retention
+ * mark.  This can only be set on regular files and requires root (the
+ * CAP_SYS_ADMIN capability).  Other attributes can be set with a
+ * set_attr_x call on a retention inode as long as that call also
+ * successfully clears the retention mark.
+ */
+#define SCOUTFS_IOC_IAX_META_SEQ	(1ULL << 0)
+#define SCOUTFS_IOC_IAX_DATA_SEQ	(1ULL << 1)
+#define SCOUTFS_IOC_IAX_DATA_VERSION	(1ULL << 2)
+#define SCOUTFS_IOC_IAX_ONLINE_BLOCKS	(1ULL << 3)
+#define SCOUTFS_IOC_IAX_OFFLINE_BLOCKS	(1ULL << 4)
+#define SCOUTFS_IOC_IAX_CTIME		(1ULL << 5)
+#define SCOUTFS_IOC_IAX_CRTIME		(1ULL << 6)
+#define SCOUTFS_IOC_IAX_SIZE		(1ULL << 7)
+#define SCOUTFS_IOC_IAX_RETENTION	(1ULL << 8)
+#define SCOUTFS_IOC_IAX_PROJECT_ID	(1ULL << 9)
+
+/* single bit attributes that are packed in the bits field as _B_ */
+#define SCOUTFS_IOC_IAX__BITS		(SCOUTFS_IOC_IAX_RETENTION)
+/* inverse of all the bits we understand */
+#define SCOUTFS_IOC_IAX__UNKNOWN	(U64_MAX << 10)
+
+#define SCOUTFS_IOC_GET_ATTR_X \
+	_IOW(SCOUTFS_IOCTL_MAGIC, 18, struct scoutfs_ioctl_inode_attr_x)
+
+#define SCOUTFS_IOC_SET_ATTR_X \
+	_IOW(SCOUTFS_IOCTL_MAGIC, 19, struct scoutfs_ioctl_inode_attr_x)
+
+/*
+ * (These fields are documented in the order that they're displayed by
+ * the scoutfs cli utility which matches the sort order of the rules.)
+ *
+ * @prio: The priority of the rule.  Rules are sorted by their fields
+ * with prio at the highest magnitude.  When multiple rules match the
+ * rule with the highest sort order is enforced.  The priority field
+ * lets rules override the default field sort order.
+ *
+ * @name_val[3]: The three 64bit values that make up the name of the
+ * totl xattr whose total will be checked against the rule's limit to
+ * see if the quota rule has been exceeded.  The behavior of the values
+ * can be changed by their corresponding name_source and name_flags.
+ *
+ * @name_source[3]: The SQ_NS_ enums that control where the value comes
+ * from.  _LITERAL uses the value from name_val.  Inode attribute
+ * sources (_PROJ, _UID, _GID) are taken from the inode of the operation
+ * that is being checked against the rule.
+ *
+ * @name_flags[3]: The SQ_NF_ enums that alter the name values.  _SELECT
+ * makes the rule only match if the inode attribute of the operation
+ * matches the attribute value stored in name_val.  This lets rules
+ * match a specific value of an attribute rather than mapping all
+ * attribute values of to totl names.
+ *
+ * @op: The SQ_OP_ enums which specify the operation that can't exceed
+ * the rule's limit.  _INODE checks inode creation and the inode
+ * attributes are taken from the inode that would be created.  _DATA
+ * checks file data block allocation and the inode fields come from the
+ * inode that is allocating the blocks.
+ *
+ * @limit: The 64bit value that is checked against the totl value
+ * described by the rule.  If the totl value is greater than or equal to
+ * this value of the matching rule then the operation will return
+ * -EDQUOT.
+ *
+ * @rule_flags: SQ_RF_TOTL_COUNT indicates that the rule's limit should
+ * be checked against the number of xattrs contributing to a totl value
+ * instead of the sum of the xattrs.
+ */
+struct scoutfs_ioctl_quota_rule {
+	__u64 name_val[3];
+	__u64 limit;
+	__u8 prio;
+	__u8 op;
+	__u8 rule_flags;
+	__u8 name_source[3];
+	__u8 name_flags[3];
+	__u8 _pad[7];
+};
+
+struct scoutfs_ioctl_get_quota_rules {
+	__u64 iterator[2];
+	__u64 rules_ptr;
+	__u64 rules_nr;
+};
+
+/*
+ * Rules are uniquely identified by their non-padded fields.  Addition will fail
+ * with -EEXIST if the specified rule already exists and deletion must find a rule
+ * with all matching fields to delete.
+ */
+#define SCOUTFS_IOC_GET_QUOTA_RULES \
+	_IOR(SCOUTFS_IOCTL_MAGIC, 20, struct scoutfs_ioctl_get_quota_rules)
+#define SCOUTFS_IOC_ADD_QUOTA_RULE \
+	_IOW(SCOUTFS_IOCTL_MAGIC, 21, struct scoutfs_ioctl_quota_rule)
+#define SCOUTFS_IOC_DEL_QUOTA_RULE \
+	_IOW(SCOUTFS_IOCTL_MAGIC, 22, struct scoutfs_ioctl_quota_rule)
+
+/*
+ * Inodes can be indexed in a global key space at a position determined
+ * by a .indx. tagged xattr.  The xattr name specifies the two index
+ * position values, with major having the more significant comparison
+ * order.
+ */
+struct scoutfs_ioctl_xattr_index_entry {
+	__u64 minor;
+	__u64 ino;
+	__u8 major;
+	__u8 _pad[7];
+};
+
+struct scoutfs_ioctl_read_xattr_index {
+	__u64 flags;
+	struct scoutfs_ioctl_xattr_index_entry first;
+	struct scoutfs_ioctl_xattr_index_entry last;
+	__u64 entries_ptr;
+	__u64 entries_nr;
+};
+
+#define SCOUTFS_IOC_READ_XATTR_INDEX \
+	_IOR(SCOUTFS_IOCTL_MAGIC, 23, struct scoutfs_ioctl_read_xattr_index)
+
 #endif

kmod/src/item.c

@@ -24,6 +24,7 @@
 #include "item.h"
 #include "forest.h"
 #include "block.h"
+#include "msg.h"
 #include "trans.h"
 #include "counters.h"
 #include "scoutfs_trace.h"
@@ -1670,13 +1671,24 @@ out:
 	return ret;
 }
 
-static int lock_safe(struct scoutfs_lock *lock, struct scoutfs_key *key,
+static int lock_safe(struct super_block *sb, struct scoutfs_lock *lock, struct scoutfs_key *key,
 		     int mode)
 {
-	if (WARN_ON_ONCE(!scoutfs_lock_protected(lock, key, mode)))
+	bool prot = scoutfs_lock_protected(lock, key, mode);
+
+	if (!prot) {
+		static bool once = false;
+		if (!once) {
+			scoutfs_err(sb, "lock (start "SK_FMT" end "SK_FMT" mode 0x%x) does not protect operation (key "SK_FMT" mode 0x%x)",
+				    SK_ARG(&lock->start), SK_ARG(&lock->end), lock->mode,
+				    SK_ARG(key), mode);
+			dump_stack();
+			once = true;
+		}
 		return -EINVAL;
-	else
-		return 0;
+	}
+
+	return 0;
 }
 
 static int optional_lock_mode_match(struct scoutfs_lock *lock, int mode)
@@ -1708,8 +1720,8 @@ static int copy_val(void *dst, int dst_len, void *src, int src_len)
  * The amount of bytes copied is returned which can be 0 or truncated if
  * the caller's buffer isn't big enough.
  */
-int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
-			void *val, int val_len, struct scoutfs_lock *lock)
+static int item_lookup(struct super_block *sb, struct scoutfs_key *key,
+		       void *val, int val_len, int len_limit, struct scoutfs_lock *lock)
 {
 	DECLARE_ITEM_CACHE_INFO(sb, cinf);
 	struct cached_item *item;
@@ -1718,7 +1730,7 @@ int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
 
 	scoutfs_inc_counter(sb, item_lookup);
 
-	if ((ret = lock_safe(lock, key, SCOUTFS_LOCK_READ)))
+	if ((ret = lock_safe(sb, lock, key, SCOUTFS_LOCK_READ)))
 		goto out;
 
 	ret = get_cached_page(sb, cinf, lock, key, false, false, 0, &pg);
@@ -1729,6 +1741,8 @@ int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
 	item = item_rbtree_walk(&pg->item_root, key, NULL, NULL, NULL);
 	if (!item || item->deletion)
 		ret = -ENOENT;
+	else if (len_limit > 0 && item->val_len > len_limit)
+		ret = -EIO;
 	else
 		ret = copy_val(val, val_len, item->val, item->val_len);
 
@@ -1737,13 +1751,38 @@ out:
 	return ret;
 }
 
+int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
+			void *val, int val_len, struct scoutfs_lock *lock)
+{
+	return item_lookup(sb, key, val, val_len, 0, lock);
+}
+
+/*
+ * Copy an item's value into the caller's buffer.  If the item's value
+ * is larger than the caller's buffer then -EIO is returned.  If the
+ * item is smaller then the bytes from the end of the copied value to
+ * the end of the buffer are zeroed.  The number of value bytes copied
+ * is returned, and 0 can be returned for an item with no value.
+ */
+int scoutfs_item_lookup_smaller_zero(struct super_block *sb, struct scoutfs_key *key,
+				     void *val, int val_len, struct scoutfs_lock *lock)
+{
+	int ret;
+
+	ret = item_lookup(sb, key, val, val_len, val_len, lock);
+	if (ret >= 0 && ret < val_len)
+		memset(val + ret, 0, val_len - ret);
+
+	return ret;
+}
+
 int scoutfs_item_lookup_exact(struct super_block *sb, struct scoutfs_key *key,
 			      void *val, int val_len,
 			      struct scoutfs_lock *lock)
 {
 	int ret;
 
-	ret = scoutfs_item_lookup(sb, key, val, val_len, lock);
+	ret = item_lookup(sb, key, val, val_len, 0, lock);
 	if (ret == val_len)
 		ret = 0;
 	else if (ret >= 0)
@@ -1793,7 +1832,7 @@ int scoutfs_item_next(struct super_block *sb, struct scoutfs_key *key,
 		goto out;
 	}
 
-	if ((ret = lock_safe(lock, key, SCOUTFS_LOCK_READ)))
+	if ((ret = lock_safe(sb, lock, key, SCOUTFS_LOCK_READ)))
 		goto out;
 
 	pos = *key;
@@ -1874,7 +1913,7 @@ int scoutfs_item_dirty(struct super_block *sb, struct scoutfs_key *key,
 
 	scoutfs_inc_counter(sb, item_dirty);
 
-	if ((ret = lock_safe(lock, key, SCOUTFS_LOCK_WRITE)))
+	if ((ret = lock_safe(sb, lock, key, SCOUTFS_LOCK_WRITE)))
 		goto out;
 
 	ret = scoutfs_forest_set_bloom_bits(sb, lock);
@@ -1920,7 +1959,7 @@ static int item_create(struct super_block *sb, struct scoutfs_key *key,
 
 	scoutfs_inc_counter(sb, item_create);
 
-	if ((ret = lock_safe(lock, key, mode)) ||
+	if ((ret = lock_safe(sb, lock, key, mode)) ||
 	    (ret = optional_lock_mode_match(primary, SCOUTFS_LOCK_WRITE)))
 		goto out;
 
@@ -1963,7 +2002,7 @@ int scoutfs_item_create(struct super_block *sb, struct scoutfs_key *key,
 			void *val, int val_len, struct scoutfs_lock *lock)
 {
 	return item_create(sb, key, val, val_len, lock, NULL,
-			   SCOUTFS_LOCK_READ, false);
+			   SCOUTFS_LOCK_WRITE, false);
 }
 
 int scoutfs_item_create_force(struct super_block *sb, struct scoutfs_key *key,
@@ -1994,7 +2033,7 @@ int scoutfs_item_update(struct super_block *sb, struct scoutfs_key *key,
 
 	scoutfs_inc_counter(sb, item_update);
 
-	if ((ret = lock_safe(lock, key, SCOUTFS_LOCK_WRITE)))
+	if ((ret = lock_safe(sb, lock, key, SCOUTFS_LOCK_WRITE)))
 		goto out;
 
 	ret = scoutfs_forest_set_bloom_bits(sb, lock);
@@ -2062,7 +2101,7 @@ int scoutfs_item_delta(struct super_block *sb, struct scoutfs_key *key,
 
 	scoutfs_inc_counter(sb, item_delta);
 
-	if ((ret = lock_safe(lock, key, SCOUTFS_LOCK_WRITE_ONLY)))
+	if ((ret = lock_safe(sb, lock, key, SCOUTFS_LOCK_WRITE_ONLY)))
 		goto out;
 
 	ret = scoutfs_forest_set_bloom_bits(sb, lock);
@@ -2135,7 +2174,7 @@ static int item_delete(struct super_block *sb, struct scoutfs_key *key,
 
 	scoutfs_inc_counter(sb, item_delete);
 
-	if ((ret = lock_safe(lock, key, mode)) ||
+	if ((ret = lock_safe(sb, lock, key, mode)) ||
 	    (ret = optional_lock_mode_match(primary, SCOUTFS_LOCK_WRITE)))
 		goto out;
 
@@ -2202,18 +2241,18 @@ u64 scoutfs_item_dirty_pages(struct super_block *sb)
 	return (u64)atomic_read(&cinf->dirty_pages);
 }
 
-static int cmp_pg_start(void *priv, struct list_head *A, struct list_head *B)
+static int cmp_pg_start(void *priv, KC_LIST_CMP_CONST struct list_head *A, KC_LIST_CMP_CONST struct list_head *B)
 {
-	struct cached_page *a = list_entry(A, struct cached_page, dirty_head);
-	struct cached_page *b = list_entry(B, struct cached_page, dirty_head);
+	KC_LIST_CMP_CONST struct cached_page *a = list_entry(A, KC_LIST_CMP_CONST struct cached_page, dirty_head);
+	KC_LIST_CMP_CONST struct cached_page *b = list_entry(B, KC_LIST_CMP_CONST struct cached_page, dirty_head);
 
 	return scoutfs_key_compare(&a->start, &b->start);
 }
 
-static int cmp_item_key(void *priv, struct list_head *A, struct list_head *B)
+static int cmp_item_key(void *priv, KC_LIST_CMP_CONST struct list_head *A, KC_LIST_CMP_CONST struct list_head *B)
 {
-	struct cached_item *a = list_entry(A, struct cached_item, dirty_head);
-	struct cached_item *b = list_entry(B, struct cached_item, dirty_head);
+	KC_LIST_CMP_CONST struct cached_item *a = list_entry(A, KC_LIST_CMP_CONST struct cached_item, dirty_head);
+	KC_LIST_CMP_CONST struct cached_item *b = list_entry(B, KC_LIST_CMP_CONST struct cached_item, dirty_head);
 
 	return scoutfs_key_compare(&a->key, &b->key);
 }
@@ -2654,7 +2693,7 @@ int scoutfs_item_setup(struct super_block *sb)
 
 	KC_INIT_SHRINKER_FUNCS(&cinf->shrinker, item_cache_count_objects,
 			       item_cache_scan_objects);
-	KC_REGISTER_SHRINKER(&cinf->shrinker);
+	KC_REGISTER_SHRINKER(&cinf->shrinker, "scoutfs-item:" SCSBF, SCSB_ARGS(sb));
 #ifdef KC_CPU_NOTIFIER
         cinf->notifier.notifier_call = item_cpu_callback;
         register_hotcpu_notifier(&cinf->notifier);

kmod/src/item.h

@@ -3,6 +3,8 @@
 
 int scoutfs_item_lookup(struct super_block *sb, struct scoutfs_key *key,
 			void *val, int val_len, struct scoutfs_lock *lock);
+int scoutfs_item_lookup_smaller_zero(struct super_block *sb, struct scoutfs_key *key,
+				     void *val, int val_len, struct scoutfs_lock *lock);
 int scoutfs_item_lookup_exact(struct super_block *sb, struct scoutfs_key *key,
 			      void *val, int val_len,
 			      struct scoutfs_lock *lock);

kmod/src/kernelcompat.c

@@ -67,12 +67,11 @@ kc_generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
 			       unsigned long nr_segs, loff_t pos, loff_t *ppos,
 			       size_t count, ssize_t written)
 {
-	struct file *file = iocb->ki_filp;
 	ssize_t status;
 	struct iov_iter i;
 
 	iov_iter_init(&i, WRITE, iov, nr_segs, count);
-	status = generic_perform_write(file, &i, pos);
+	status = kc_generic_perform_write(iocb, &i, pos);
 
 	if (likely(status >= 0)) {
 		written += status;

kmod/src/kernelcompat.h

@@ -197,7 +197,11 @@ struct timespec64 kc_current_time(struct inode *inode);
 } while (0)
 
 #define KC_SHRINKER_CONTAINER_OF(ptr, type) container_of(ptr, type, shrinker)
-#define KC_REGISTER_SHRINKER(ptr) (register_shrinker(ptr))
+#ifdef KC_SHRINKER_NAME
+#define KC_REGISTER_SHRINKER register_shrinker
+#else
+#define KC_REGISTER_SHRINKER(ptr, fmt, ...) (register_shrinker(ptr))
+#endif /* KC_SHRINKER_NAME */
 #define KC_UNREGISTER_SHRINKER(ptr) (unregister_shrinker(ptr))
 #define KC_SHRINKER_FN(ptr) (ptr)
 #else
@@ -224,7 +228,7 @@ struct kc_shrinker_wrapper {
 	_wrap->shrink.seeks = DEFAULT_SEEKS;			\
 } while (0)
 #define KC_SHRINKER_CONTAINER_OF(ptr, type) container_of(container_of(ptr, struct kc_shrinker_wrapper, shrink), type, shrinker)
-#define KC_REGISTER_SHRINKER(ptr) (register_shrinker(ptr.shrink))
+#define KC_REGISTER_SHRINKER(ptr, fmt, ...) (register_shrinker(ptr.shrink))
 #define KC_UNREGISTER_SHRINKER(ptr) (unregister_shrinker(ptr.shrink))
 #define KC_SHRINKER_FN(ptr) (ptr.shrink)
 
@@ -271,6 +275,167 @@ ssize_t kc_generic_file_buffered_write(struct kiocb *iocb, const struct iovec *i
                unsigned long nr_segs, loff_t pos, loff_t *ppos,
                size_t count, ssize_t written);
 #define generic_file_buffered_write kc_generic_file_buffered_write
+#ifdef KC_GENERIC_PERFORM_WRITE_KIOCB_IOV_ITER
+static inline int kc_generic_perform_write(struct kiocb *iocb, struct iov_iter *iter, loff_t pos)
+{
+	iocb->ki_pos = pos;
+	return generic_perform_write(iocb, iter);
+}
+#else
+static inline int kc_generic_perform_write(struct kiocb *iocb, struct iov_iter *iter, loff_t pos)
+{
+	struct file *file = iocb->ki_filp;
+	return generic_perform_write(file, iter, pos);
+}
+#endif
+#endif // KC_GENERIC_FILE_BUFFERED_WRITE
+
+#ifndef KC_HAVE_BLK_OPF_T
+/* typedef __u32 __bitwise blk_opf_t; */
+typedef unsigned int blk_opf_t;
+#endif
+
+#ifdef KC_LIST_CMP_CONST_ARG_LIST_HEAD
+#define KC_LIST_CMP_CONST const
+#else
+#define KC_LIST_CMP_CONST
+#endif
+
+#ifdef KC_VMALLOC_PGPROT_T
+#define kc__vmalloc(size, gfp_mask) __vmalloc(size, gfp_mask, PAGE_KERNEL)
+#else
+#define kc__vmalloc __vmalloc
+#endif
+
+#ifdef KC_VFS_METHOD_USER_NAMESPACE_ARG
+#define KC_VFS_NS_DEF struct user_namespace *mnt_user_ns,
+#define KC_VFS_NS mnt_user_ns,
+#define KC_VFS_INIT_NS &init_user_ns,
+#else
+#define KC_VFS_NS_DEF
+#define KC_VFS_NS
+#define KC_VFS_INIT_NS
+#endif
+
+#ifdef KC_BIO_ALLOC_DEV_OPF_ARGS
+#define kc_bio_alloc bio_alloc
+#else
+#include <linux/bio.h>
+static inline struct bio *kc_bio_alloc(struct block_device *bdev, unsigned short nr_vecs,
+				       blk_opf_t opf, gfp_t gfp_mask)
+{
+	struct bio *b = bio_alloc(gfp_mask, nr_vecs);
+	if (b) {
+		kc_bio_set_opf(b, opf);
+		bio_set_dev(b, bdev);
+	}
+	return b;
+}
+#endif
+
+#ifndef KC_FIEMAP_PREP
+#define fiemap_prep(inode, fieinfo, start, len, flags) fiemap_check_flags(fieinfo, flags)
+#endif
+
+#ifndef KC_KERNEL_OLD_TIMEVAL_STRUCT
+#define __kernel_old_timeval timeval
+#define ns_to_kernel_old_timeval(ktime) ns_to_timeval(ktime.tv64)
+#endif
+
+#ifdef KC_SOCK_SET_SNDTIMEO
+#include <net/sock.h>
+static inline int kc_sock_set_sndtimeo(struct socket *sock, s64 secs)
+{
+	sock_set_sndtimeo(sock->sk, secs);
+	return 0;
+}
+static inline int kc_tcp_sock_set_rcvtimeo(struct socket *sock, ktime_t to)
+{
+	struct __kernel_old_timeval tv;
+	sockptr_t kopt;
+
+	tv = ns_to_kernel_old_timeval(to);
+
+	kopt = KERNEL_SOCKPTR(&tv);
+
+	return sock_setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO_NEW,
+			       kopt, sizeof(tv));
+}
+#else
+#include <net/sock.h>
+static inline int kc_sock_set_sndtimeo(struct socket *sock, s64 secs)
+{
+	struct timeval tv = { .tv_sec = secs, .tv_usec = 0 };
+	return kernel_setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO,
+				 (char *)&tv, sizeof(tv));
+}
+static inline int kc_tcp_sock_set_rcvtimeo(struct socket *sock, ktime_t to)
+{
+	struct __kernel_old_timeval tv;
+
+	tv = ns_to_kernel_old_timeval(to);
+	return kernel_setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO,
+				 (char *)&tv, sizeof(tv));
+}
+#endif
+
+#ifdef KC_SETSOCKOPT_SOCKPTR_T
+static inline int kc_sock_setsockopt(struct socket *sock, int level, int op, int *optval, unsigned int optlen)
+{
+	sockptr_t kopt = KERNEL_SOCKPTR(optval);
+	return sock_setsockopt(sock, level, op, kopt, sizeof(optval));
+}
+#else
+static inline int kc_sock_setsockopt(struct socket *sock, int level, int op, int *optval, unsigned int optlen)
+{
+	return kernel_setsockopt(sock, level, op, (char *)optval, sizeof(optval));
+}
+#endif
+
+#ifdef KC_HAVE_TCP_SET_SOCKFN
+#include <linux/net.h>
+#include <net/tcp.h>
+static inline int kc_tcp_sock_set_keepintvl(struct socket *sock, int val)
+{
+	return tcp_sock_set_keepintvl(sock->sk, val);
+}
+static inline int kc_tcp_sock_set_keepidle(struct socket *sock, int val)
+{
+	return tcp_sock_set_keepidle(sock->sk, val);
+}
+static inline int kc_tcp_sock_set_user_timeout(struct socket *sock, int val)
+{
+	tcp_sock_set_user_timeout(sock->sk, val);
+	return 0;
+}
+static inline int kc_tcp_sock_set_nodelay(struct socket *sock)
+{
+	tcp_sock_set_nodelay(sock->sk);
+	return 0;
+}
+#else
+#include <linux/net.h>
+#include <net/tcp.h>
+static inline int kc_tcp_sock_set_keepintvl(struct socket *sock, int val)
+{
+	int optval = val;
+	return kernel_setsockopt(sock, SOL_TCP, TCP_KEEPINTVL, (char *)&optval, sizeof(optval));
+}
+static inline int kc_tcp_sock_set_keepidle(struct socket *sock, int val)
+{
+	int optval = val;
+	return kernel_setsockopt(sock, SOL_TCP, TCP_KEEPIDLE, (char *)&optval, sizeof(optval));
+}
+static inline int kc_tcp_sock_set_user_timeout(struct socket *sock, int val)
+{
+	int optval = val;
+	return kernel_setsockopt(sock, SOL_TCP, TCP_USER_TIMEOUT, (char *)&optval, sizeof(optval));
+}
+static inline int kc_tcp_sock_set_nodelay(struct socket *sock)
+{
+	int optval = 1;
+	return kernel_setsockopt(sock, SOL_TCP, TCP_NODELAY, (char *)&optval, sizeof(optval));
+}
 #endif
 
 #endif

kmod/src/key.h

@@ -125,8 +125,8 @@ static inline bool scoutfs_key_is_ones(struct scoutfs_key *key)
  * other alternatives across keys that first differ in any of the
  * values.  Say maybe 20% faster than memcmp.
  */
-static inline int scoutfs_key_compare(struct scoutfs_key *a,
-				      struct scoutfs_key *b)
+static inline int scoutfs_key_compare(const struct scoutfs_key *a,
+				      const struct scoutfs_key *b)
 {
 	return scoutfs_cmp(a->sk_zone, b->sk_zone) ?:
 	  scoutfs_cmp(le64_to_cpu(a->_sk_first), le64_to_cpu(b->_sk_first)) ?:
@@ -142,10 +142,10 @@ static inline int scoutfs_key_compare(struct scoutfs_key *a,
  *       1: a_start > b_end
  *  else 0: ranges overlap
  */
-static inline int scoutfs_key_compare_ranges(struct scoutfs_key *a_start,
-				             struct scoutfs_key *a_end,
-				             struct scoutfs_key *b_start,
-				             struct scoutfs_key *b_end)
+static inline int scoutfs_key_compare_ranges(const struct scoutfs_key *a_start,
+				             const struct scoutfs_key *a_end,
+				             const struct scoutfs_key *b_start,
+				             const struct scoutfs_key *b_end)
 {
 	return scoutfs_key_compare(a_end, b_start) < 0 ? -1 :
 	       scoutfs_key_compare(a_start, b_end) > 0 ? 1 :

kmod/src/lock.c

@@ -36,6 +36,8 @@
 #include "item.h"
 #include "omap.h"
 #include "util.h"
+#include "totl.h"
+#include "quota.h"
 
 /*
  * scoutfs uses a lock service to manage item cache consistency between
@@ -185,6 +187,9 @@ static int lock_invalidate(struct super_block *sb, struct scoutfs_lock *lock,
 			return ret;
 	}
 
+	if (lock->start.sk_zone == SCOUTFS_QUOTA_ZONE && !lock_mode_can_read(mode))
+		scoutfs_quota_invalidate(sb);
+
 	/* have to invalidate if we're not in the only usable case */
 	if (!(prev == SCOUTFS_LOCK_WRITE && mode == SCOUTFS_LOCK_READ)) {
 retry:
@@ -1244,10 +1249,29 @@ int scoutfs_lock_xattr_totl(struct super_block *sb, enum scoutfs_lock_mode mode,
 	struct scoutfs_key start;
 	struct scoutfs_key end;
 
-	scoutfs_key_set_zeros(&start);
-	start.sk_zone = SCOUTFS_XATTR_TOTL_ZONE;
-	scoutfs_key_set_ones(&end);
-	end.sk_zone = SCOUTFS_XATTR_TOTL_ZONE;
+	scoutfs_totl_set_range(&start, &end);
+
+	return lock_key_range(sb, mode, flags, &start, &end, lock);
+}
+
+int scoutfs_lock_xattr_indx(struct super_block *sb, enum scoutfs_lock_mode mode, int flags,
+			    struct scoutfs_lock **lock)
+{
+	struct scoutfs_key start;
+	struct scoutfs_key end;
+
+	scoutfs_xattr_indx_get_range(&start, &end);
+
+	return lock_key_range(sb, mode, flags, &start, &end, lock);
+}
+
+int scoutfs_lock_quota(struct super_block *sb, enum scoutfs_lock_mode mode, int flags,
+		       struct scoutfs_lock **lock)
+{
+	struct scoutfs_key start;
+	struct scoutfs_key end;
+
+	scoutfs_quota_get_lock_range(&start, &end);
 
 	return lock_key_range(sb, mode, flags, &start, &end, lock);
 }
@@ -1708,7 +1732,7 @@ int scoutfs_lock_setup(struct super_block *sb)
 	linfo->lock_range_tree = RB_ROOT;
 	KC_INIT_SHRINKER_FUNCS(&linfo->shrinker, lock_count_objects,
 			       lock_scan_objects);
-	KC_REGISTER_SHRINKER(&linfo->shrinker);
+	KC_REGISTER_SHRINKER(&linfo->shrinker, "scoutfs-lock:" SCSBF, SCSB_ARGS(sb));
 	INIT_LIST_HEAD(&linfo->lru_list);
 	INIT_WORK(&linfo->inv_work, lock_invalidate_worker);
 	INIT_LIST_HEAD(&linfo->inv_list);

kmod/src/lock.h

@@ -86,6 +86,10 @@ int scoutfs_lock_orphan(struct super_block *sb, enum scoutfs_lock_mode mode, int
 		        u64 ino, struct scoutfs_lock **lock);
 int scoutfs_lock_xattr_totl(struct super_block *sb, enum scoutfs_lock_mode mode, int flags,
 			    struct scoutfs_lock **lock);
+int scoutfs_lock_xattr_indx(struct super_block *sb, enum scoutfs_lock_mode mode, int flags,
+			    struct scoutfs_lock **lock);
+int scoutfs_lock_quota(struct super_block *sb, enum scoutfs_lock_mode mode, int flags,
+		       struct scoutfs_lock **lock);
 void scoutfs_unlock(struct super_block *sb, struct scoutfs_lock *lock,
 		    enum scoutfs_lock_mode mode);
 

kmod/src/lock_server.c

@@ -202,21 +202,48 @@ static u8 invalidation_mode(u8 granted, u8 requested)
 
 /*
  * Return true of the client lock instances described by the entries can
- * be granted at the same time.  Typically this only means they're both
- * modes that are compatible between nodes. In addition there's the
- * special case where a read lock on a client is compatible with a write
- * lock on the same client because the client's cache covered by the
- * read lock is still valid if they get a write lock.
+ * be granted at the same time.  There's only three cases where this is
+ * true.
+ *
+ * First, the two locks are both of the same mode that allows full
+ * sharing -- read and write only.  The only point of these modes is
+ * that everyone can share them.
+ *
+ * Second, a write lock gives the client permission to read as well.
+ * This means that a client can upgrade its read lock to a write lock
+ * without having to invalidate the existing read and drop caches.
+ *
+ * Third, null locks are always compatible between clients.  It's as
+ * though the client with the null lock has no lock at all.  But it's
+ * never compatible with all locks on the client requesting null.
+ * Sending invalidations for existing locks on a client when we get a
+ * null request is how we resolve races in shrinking locks -- we turn it
+ * into the unsolicited remote invalidation case.
+ *
+ * All other mode and client combinations can not be shared, most
+ * typically a write lock invalidating all other non-write holders to
+ * drop caches and force a read after the write has completed.
  */
 static bool client_entries_compatible(struct client_lock_entry *granted,
 				      struct client_lock_entry *requested)
 {
-	return (granted->mode == requested->mode &&
-		(granted->mode == SCOUTFS_LOCK_READ ||
-		 granted->mode == SCOUTFS_LOCK_WRITE_ONLY)) ||
-	       (granted->rid == requested->rid &&
-		granted->mode == SCOUTFS_LOCK_READ &&
-		requested->mode == SCOUTFS_LOCK_WRITE);
+	/* only read and write_only can be full shared */
+	if ((granted->mode == requested->mode) &&
+	    (granted->mode == SCOUTFS_LOCK_READ || granted->mode == SCOUTFS_LOCK_WRITE_ONLY))
+		return true;
+
+	/* _write includes reading, so a client can upgrade its read to write */
+	if (granted->rid == requested->rid &&
+	    granted->mode == SCOUTFS_LOCK_READ &&
+	    requested->mode == SCOUTFS_LOCK_WRITE)
+		return true;
+
+	/* null is always compatible across clients, never within a client */
+	if ((granted->rid != requested->rid) &&
+	    (granted->mode == SCOUTFS_LOCK_NULL || requested->mode == SCOUTFS_LOCK_NULL))
+		return true;
+
+	return false;
 }
 
 /*
@@ -317,16 +344,18 @@ static void put_server_lock(struct lock_server_info *inf,
 
 	BUG_ON(!mutex_is_locked(&snode->mutex));
 
+	spin_lock(&inf->lock);
+
 	if (atomic_dec_and_test(&snode->refcount) &&
 	    list_empty(&snode->granted) &&
 	    list_empty(&snode->requested) &&
 	    list_empty(&snode->invalidated)) {
-		spin_lock(&inf->lock);
 		rb_erase(&snode->node, &inf->locks_root);
-		spin_unlock(&inf->lock);
 		should_free = true;
 	}
 
+	spin_unlock(&inf->lock);
+
 	mutex_unlock(&snode->mutex);
 
 	if (should_free) {

kmod/src/net.c

@@ -502,12 +502,12 @@ static void scoutfs_net_proc_worker(struct work_struct *work)
  * Free live responses up to and including the seq by marking them dead
  * and moving them to the send queue to be freed.
  */
-static int move_acked_responses(struct scoutfs_net_connection *conn,
-				struct list_head *list, u64 seq)
+static bool move_acked_responses(struct scoutfs_net_connection *conn,
+				 struct list_head *list, u64 seq)
 {
 	struct message_send *msend;
 	struct message_send *tmp;
-	int ret = 0;
+	bool moved = false;
 
 	assert_spin_locked(&conn->lock);
 
@@ -519,20 +519,20 @@ static int move_acked_responses(struct scoutfs_net_connection *conn,
 
 		msend->dead = 1;
 		list_move(&msend->head, &conn->send_queue);
-		ret = 1;
+		moved = true;
 	}
 
-	return ret;
+	return moved;
 }
 
 /* acks are processed inline in the recv worker */
 static void free_acked_responses(struct scoutfs_net_connection *conn, u64 seq)
 {
-	int moved;
+	bool moved;
 
 	spin_lock(&conn->lock);
 
-	moved = move_acked_responses(conn, &conn->send_queue, seq) +
+	moved = move_acked_responses(conn, &conn->send_queue, seq) |
 		move_acked_responses(conn, &conn->resend_queue, seq);
 
 	spin_unlock(&conn->lock);
@@ -904,53 +904,44 @@ static void destroy_conn(struct scoutfs_net_connection *conn)
 static int sock_opts_and_names(struct scoutfs_net_connection *conn,
 			       struct socket *sock)
 {
-	struct timeval tv;
 	int optval;
 	int ret;
 
 	/* we use a keepalive timeout instead of send timeout */
-	tv.tv_sec = 0;
-	tv.tv_usec = 0;
-	ret = kernel_setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO,
-				(char *)&tv, sizeof(tv));
+	ret = kc_sock_set_sndtimeo(sock, 0);
 	if (ret)
 		goto out;
 
 	/* not checked when user_timeout != 0, but for clarity */
 	optval = UNRESPONSIVE_PROBES;
-	ret = kernel_setsockopt(sock, SOL_TCP, TCP_KEEPCNT,
-				(char *)&optval, sizeof(optval));
+	ret = kc_sock_setsockopt(sock, SOL_TCP, TCP_KEEPCNT,
+				&optval, sizeof(optval));
 	if (ret)
 		goto out;
 
 	BUILD_BUG_ON(UNRESPONSIVE_PROBES >= UNRESPONSIVE_TIMEOUT_SECS);
 	optval = UNRESPONSIVE_TIMEOUT_SECS - (UNRESPONSIVE_PROBES);
-	ret = kernel_setsockopt(sock, SOL_TCP, TCP_KEEPIDLE,
-				(char *)&optval, sizeof(optval));
+	ret = kc_tcp_sock_set_keepidle(sock, optval);
 	if (ret)
 		goto out;
 
 	optval = 1;
-	ret = kernel_setsockopt(sock, SOL_TCP, TCP_KEEPINTVL,
-				(char *)&optval, sizeof(optval));
+	ret = kc_tcp_sock_set_keepintvl(sock, optval);
 	if (ret)
 		goto out;
 
 	optval = UNRESPONSIVE_TIMEOUT_SECS * MSEC_PER_SEC;
-	ret = kernel_setsockopt(sock, SOL_TCP, TCP_USER_TIMEOUT,
-				(char *)&optval, sizeof(optval));
+	ret = kc_tcp_sock_set_user_timeout(sock, optval);
 	if (ret)
 		goto out;
 
 	optval = 1;
-	ret = kernel_setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
-				(char *)&optval, sizeof(optval));
+	ret = kc_sock_setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
+				&optval, sizeof(optval));
 	if (ret)
 		goto out;
 
-	optval = 1;
-	ret = kernel_setsockopt(sock, SOL_TCP, TCP_NODELAY,
-				(char *)&optval, sizeof(optval));
+	ret = kc_tcp_sock_set_nodelay(sock);
 	if (ret)
 		goto out;
 
@@ -1049,7 +1040,6 @@ static void scoutfs_net_connect_worker(struct work_struct *work)
 	DEFINE_CONN_FROM_WORK(conn, work, connect_work);
 	struct super_block *sb = conn->sb;
 	struct socket *sock;
-	struct timeval tv;
 	int ret;
 
 	trace_scoutfs_net_connect_work_enter(sb, 0, 0);
@@ -1060,11 +1050,8 @@ static void scoutfs_net_connect_worker(struct work_struct *work)
 
 	sock->sk->sk_allocation = GFP_NOFS;
 
-	/* caller specified connect timeout */
-	tv.tv_sec = conn->connect_timeout_ms / MSEC_PER_SEC;
-	tv.tv_usec = (conn->connect_timeout_ms % MSEC_PER_SEC) * USEC_PER_MSEC;
-	ret = kernel_setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO,
-				(char *)&tv, sizeof(tv));
+	/* caller specified connect timeout, defaults to 1 sec */
+	ret = kc_sock_set_sndtimeo(sock, conn->connect_timeout_ms / MSEC_PER_SEC);
 	if (ret) {
 		sock_release(sock);
 		goto out;
@@ -1462,8 +1449,8 @@ int scoutfs_net_bind(struct super_block *sb,
 	sock->sk->sk_allocation = GFP_NOFS;
 
 	optval = 1;
-	ret = kernel_setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
-				(char *)&optval, sizeof(optval));
+	ret = kc_sock_setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
+				&optval, sizeof(optval));
 	if (ret)
 		goto out;
 

kmod/src/quorum.c

@@ -303,7 +303,6 @@ static int recv_msg(struct super_block *sb, struct quorum_host_msg *msg,
 	DECLARE_QUORUM_INFO(sb, qinf);
 	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
 	struct scoutfs_quorum_message qmes;
-	struct timeval tv;
 	ktime_t rel_to;
 	ktime_t now;
 	int ret;
@@ -328,14 +327,10 @@ static int recv_msg(struct super_block *sb, struct quorum_host_msg *msg,
 	else
 		rel_to = ns_to_ktime(0);
 
-	tv = ktime_to_timeval(rel_to);
-	if (tv.tv_sec == 0 && tv.tv_usec == 0) {
+	if (ktime_compare(rel_to, ns_to_ktime(NSEC_PER_USEC)) <= 0) {
 		mh.msg_flags |= MSG_DONTWAIT;
 	} else {
-		ret = kernel_setsockopt(qinf->sock, SOL_SOCKET, SO_RCVTIMEO,
-					(char *)&tv, sizeof(tv));
-		if (ret < 0)
-			return ret;
+		ret = kc_tcp_sock_set_rcvtimeo(qinf->sock, rel_to);
 	}
 
 #ifdef KC_MSGHDR_STRUCT_IOV_ITER
@@ -486,7 +481,7 @@ static void set_quorum_block_event(struct super_block *sb, struct scoutfs_quorum
 	if (WARN_ON_ONCE(event < 0 || event >= SCOUTFS_QUORUM_EVENT_NR))
 		return;
 
-	getnstimeofday64(&ts);
+	ktime_get_ts64(&ts);
 	le64_add_cpu(&blk->write_nr, 1);
 
 	ev = &blk->events[event];
@@ -1325,8 +1320,8 @@ int scoutfs_quorum_setup(struct super_block *sb)
 	qinf = kzalloc(sizeof(struct quorum_info), GFP_KERNEL);
 	super = kmalloc(sizeof(struct scoutfs_super_block), GFP_KERNEL);
 	if (qinf)
-		qinf->hb_delay = __vmalloc(HB_DELAY_NR * sizeof(struct count_recent),
-					   GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+		qinf->hb_delay = kc__vmalloc(HB_DELAY_NR * sizeof(struct count_recent),
+					   GFP_KERNEL | __GFP_ZERO);
 	if (!qinf || !super || !qinf->hb_delay) {
 		if (qinf)
 			vfree(qinf->hb_delay);

kmod/src/quota.h

@@ -0,0 +1,48 @@
+#ifndef _SCOUTFS_QUOTA_H_
+#define _SCOUTFS_QUOTA_H_
+
+#include "ioctl.h"
+
+/*
+ * Each rule's name can be in the ruleset's rbtree associated with the
+ * source attr that it selects.  This lets checks only test rules that
+ * the inputs could match.  The 'i' field indicates which name is in the
+ * tree so we can find the containing rule.
+ *
+ * This is mostly private to quota.c but we expose it for tracing.
+ */
+struct squota_rule {
+	u64 limit;
+	u8 prio;
+	u8 op;
+	u8 rule_flags;
+	struct squota_rule_name {
+		struct rb_node node;
+		u64 val;
+		u8 source;
+		u8 flags;
+		u8 i;
+	} names[3];
+};
+
+/* private to quota.c, only here for tracing */
+struct squota_input {
+	u64 attrs[SQ_NS__NR_SELECT];
+	u8 op;
+};
+
+int scoutfs_quota_check_inode(struct super_block *sb, struct inode *dir);
+int scoutfs_quota_check_data(struct super_block *sb, struct inode *inode);
+
+int scoutfs_quota_get_rules(struct super_block *sb, u64 *iterator,
+			    struct scoutfs_ioctl_quota_rule *irules, int nr);
+int scoutfs_quota_mod_rule(struct super_block *sb, bool is_add,
+			   struct scoutfs_ioctl_quota_rule *irule);
+
+void scoutfs_quota_get_lock_range(struct scoutfs_key *start, struct scoutfs_key *end);
+void scoutfs_quota_invalidate(struct super_block *sb);
+
+int scoutfs_quota_setup(struct super_block *sb);
+void scoutfs_quota_destroy(struct super_block *sb);
+
+#endif

kmod/src/recov.c

@@ -76,10 +76,10 @@ static struct recov_pending *lookup_pending(struct recov_info *recinf, u64 rid,
  * We keep the pending list sorted by rid so that we can iterate over
  * them.  The list should be small and shouldn't be used often.
  */
-static int cmp_pending_rid(void *priv, struct list_head *A, struct list_head *B)
+static int cmp_pending_rid(void *priv, KC_LIST_CMP_CONST struct list_head *A, KC_LIST_CMP_CONST struct list_head *B)
 {
-	struct recov_pending *a = list_entry(A, struct recov_pending, head);
-	struct recov_pending *b = list_entry(B, struct recov_pending, head);
+	KC_LIST_CMP_CONST struct recov_pending *a = list_entry(A, KC_LIST_CMP_CONST struct recov_pending, head);
+	KC_LIST_CMP_CONST struct recov_pending *b = list_entry(B, KC_LIST_CMP_CONST struct recov_pending, head);
 
 	return scoutfs_cmp_u64s(a->rid, b->rid);
 }

kmod/src/scoutfs_trace.h

@@ -24,7 +24,6 @@
 
 #include <linux/tracepoint.h>
 #include <linux/in.h>
-#include <linux/unaligned/access_ok.h>
 
 #include "key.h"
 #include "format.h"
@@ -37,6 +36,10 @@
 #include "net.h"
 #include "data.h"
 #include "ext.h"
+#include "quota.h"
+
+#include "trace/quota.h"
+#include "trace/wkic.h"
 
 struct lock_info;
 
@@ -1043,9 +1046,12 @@ DECLARE_EVENT_CLASS(scoutfs_lock_class,
 		sk_trace_define(start)
 		sk_trace_define(end)
 		__field(u64, refresh_gen)
+		__field(u64, write_seq)
+		__field(u64, dirty_trans_seq)
 		__field(unsigned char, request_pending)
 		__field(unsigned char, invalidate_pending)
 		__field(int, mode)
+		__field(int, invalidating_mode)
 		__field(unsigned int, waiters_cw)
 		__field(unsigned int, waiters_pr)
 		__field(unsigned int, waiters_ex)
@@ -1058,9 +1064,12 @@ DECLARE_EVENT_CLASS(scoutfs_lock_class,
 		sk_trace_assign(start, &lck->start);
 		sk_trace_assign(end, &lck->end);
 		__entry->refresh_gen = lck->refresh_gen;
+		__entry->write_seq = lck->write_seq;
+		__entry->dirty_trans_seq = lck->dirty_trans_seq;
 		__entry->request_pending = lck->request_pending;
 		__entry->invalidate_pending = lck->invalidate_pending;
 		__entry->mode = lck->mode;
+		__entry->invalidating_mode = lck->invalidating_mode;
 		__entry->waiters_pr = lck->waiters[SCOUTFS_LOCK_READ];
 		__entry->waiters_ex = lck->waiters[SCOUTFS_LOCK_WRITE];
 		__entry->waiters_cw = lck->waiters[SCOUTFS_LOCK_WRITE_ONLY];
@@ -1068,10 +1077,11 @@ DECLARE_EVENT_CLASS(scoutfs_lock_class,
 		__entry->users_ex = lck->users[SCOUTFS_LOCK_WRITE];
 		__entry->users_cw = lck->users[SCOUTFS_LOCK_WRITE_ONLY];
         ),
-        TP_printk(SCSBF" start "SK_FMT" end "SK_FMT" mode %u reqpnd %u invpnd %u rfrgen %llu waiters: pr %u ex %u cw %u users: pr %u ex %u cw %u",
+        TP_printk(SCSBF" start "SK_FMT" end "SK_FMT" mode %u invmd %u reqp %u invp %u refg %llu wris %llu dts %llu waiters: pr %u ex %u cw %u users: pr %u ex %u cw %u",
 		  SCSB_TRACE_ARGS, sk_trace_args(start), sk_trace_args(end),
-		  __entry->mode, __entry->request_pending,
-		  __entry->invalidate_pending, __entry->refresh_gen,
+		  __entry->mode, __entry->invalidating_mode, __entry->request_pending,
+		  __entry->invalidate_pending, __entry->refresh_gen, __entry->write_seq,
+		  __entry->dirty_trans_seq,
 		  __entry->waiters_pr, __entry->waiters_ex, __entry->waiters_cw,
 		  __entry->users_pr, __entry->users_ex, __entry->users_cw)
 );
@@ -2395,6 +2405,44 @@ TRACE_EVENT(scoutfs_block_dirty_ref,
 		  __entry->block_blkno, __entry->block_seq)
 );
 
+TRACE_EVENT(scoutfs_block_stale,
+	TP_PROTO(struct super_block *sb, struct scoutfs_block_ref *ref,
+		 struct scoutfs_block_header *hdr, u32 magic, u32 crc),
+
+	TP_ARGS(sb, ref, hdr, magic, crc),
+
+	TP_STRUCT__entry(
+		SCSB_TRACE_FIELDS
+		__field(__u64, ref_blkno)
+		__field(__u64, ref_seq)
+		__field(__u32, hdr_crc)
+		__field(__u32, hdr_magic)
+		__field(__u64, hdr_fsid)
+		__field(__u64, hdr_seq)
+		__field(__u64, hdr_blkno)
+		__field(__u32, magic)
+		__field(__u32, crc)
+	),
+
+	TP_fast_assign(
+		SCSB_TRACE_ASSIGN(sb);
+		__entry->ref_blkno = le64_to_cpu(ref->blkno);
+		__entry->ref_seq = le64_to_cpu(ref->seq);
+		__entry->hdr_crc = le32_to_cpu(hdr->crc);
+		__entry->hdr_magic = le32_to_cpu(hdr->magic);
+		__entry->hdr_fsid = le64_to_cpu(hdr->fsid);
+		__entry->hdr_seq = le64_to_cpu(hdr->seq);
+		__entry->hdr_blkno = le64_to_cpu(hdr->blkno);
+		__entry->magic = magic;
+		__entry->crc = crc;
+	),
+
+	TP_printk(SCSBF" ref_blkno %llu ref_seq %016llx hdr_crc %08x hdr_magic %08x hdr_fsid %016llx hdr_seq %016llx hdr_blkno %llu magic %08x crc %08x",
+		  SCSB_TRACE_ARGS, __entry->ref_blkno, __entry->ref_seq, __entry->hdr_crc,
+		  __entry->hdr_magic, __entry->hdr_fsid, __entry->hdr_seq, __entry->hdr_blkno,
+		  __entry->magic, __entry->crc)
+);
+
 DECLARE_EVENT_CLASS(scoutfs_block_class,
 	TP_PROTO(struct super_block *sb, void *bp, u64 blkno, int refcount, int io_count,
 		 unsigned long bits, __u64 accessed),

kmod/src/server.c

@@ -298,7 +298,7 @@ static void check_holder_budget(struct super_block *sb, struct server_info *serv
 {
 	static bool exceeded_once = false;
 	struct commit_hold *hold;
-	struct timespec ts;
+	struct timespec64 ts;
 	u32 avail_used;
 	u32 freed_used;
 	u32 avail_now;
@@ -330,7 +330,7 @@ static void check_holder_budget(struct super_block *sb, struct server_info *serv
 		    cusers->freed_before, freed_now);
 
 	list_for_each_entry(hold, &cusers->holding, entry) {
-		ts = ktime_to_timespec(hold->start);
+		ts = ktime_to_timespec64(hold->start);
 		scoutfs_err(sb, "exceeding hold start %llu.%09llu av %u fr %u",
 			    (u64)ts.tv_sec, (u64)ts.tv_nsec, hold->avail, hold->freed);
 		hold->exceeded = true;
@@ -445,7 +445,7 @@ static int server_apply_commit(struct super_block *sb, struct commit_hold *hold,
 {
 	DECLARE_SERVER_INFO(sb, server);
 	struct commit_users *cusers = &server->cusers;
-	struct timespec ts;
+	struct timespec64 ts;
 
 	spin_lock(&cusers->lock);
 
@@ -454,7 +454,7 @@ static int server_apply_commit(struct super_block *sb, struct commit_hold *hold,
 	check_holder_budget(sb, server, cusers);
 
 	if (hold->exceeded) {
-		ts = ktime_to_timespec(hold->start);
+		ts = ktime_to_timespec64(hold->start);
 		scoutfs_err(sb, "exceeding hold start %llu.%09llu stack:",
 			    (u64)ts.tv_sec, (u64)ts.tv_nsec);
 		dump_stack();
@@ -668,14 +668,16 @@ static void scoutfs_server_commit_func(struct work_struct *work)
 	 * the reserved blocks after having filled the log trees's avail
 	 * allocator during its transaction.  To avoid prematurely
 	 * setting the low flag and causing enospc we make sure that the
-	 * next transaction's meta_avail has 2x the reserved blocks so
+	 * next transaction's meta_avail has 3x the reserved blocks so
 	 * that it can consume a full reserved amount and still have
 	 * enough to avoid enospc.  We swap to freed if avail is under
-	 * the buffer and freed is larger.
+	 * the buffer and freed is larger by 50%. This results in much less
+	 * swapping overall and allows the pools to refill naturally.
 	 */
 	if ((le64_to_cpu(server->meta_avail->total_len) <
-	     (scoutfs_server_reserved_meta_blocks(sb) * 2)) &&
-	    (le64_to_cpu(server->meta_freed->total_len) >
+	     (scoutfs_server_reserved_meta_blocks(sb) * 3)) &&
+	    ((le64_to_cpu(server->meta_freed->total_len) +
+	     (le64_to_cpu(server->meta_freed->total_len) >> 1)) >
 	     le64_to_cpu(server->meta_avail->total_len)))
 		swap(server->meta_avail, server->meta_freed);
 

kmod/src/srch.c

@@ -18,6 +18,7 @@
 #include <linux/pagemap.h>
 #include <linux/vmalloc.h>
 #include <linux/sort.h>
+#include <asm/unaligned.h>
 
 #include "super.h"
 #include "format.h"
@@ -1588,8 +1589,7 @@ static int kway_merge(struct super_block *sb,
 	nr_parents = max_t(unsigned long, 1, roundup_pow_of_two(nr) - 1);
 	/* root at [1] for easy sib/parent index calc, final pad for odd sib */
 	nr_nodes = 1 + nr_parents + nr + 1;
-	tnodes = __vmalloc(nr_nodes * sizeof(struct tourn_node),
-			   GFP_NOFS, PAGE_KERNEL);
+	tnodes = kc__vmalloc(nr_nodes * sizeof(struct tourn_node), GFP_NOFS);
 	if (!tnodes)
 		return -ENOMEM;
 

kmod/src/super.c

@@ -49,6 +49,8 @@
 #include "volopt.h"
 #include "fence.h"
 #include "xattr.h"
+#include "wkic.h"
+#include "quota.h"
 #include "scoutfs_trace.h"
 
 static struct dentry *scoutfs_debugfs_root;
@@ -158,7 +160,17 @@ static void scoutfs_metadev_close(struct super_block *sb)
 		 * from kill_sb->put_super.
 		 */
 		lockdep_off();
+
+#ifdef KC_BDEV_FILE_OPEN_BY_PATH
+		bdev_fput(sbi->meta_bdev_file);
+#else
+#ifdef KC_BLKDEV_PUT_HOLDER_ARG
+		blkdev_put(sbi->meta_bdev, sb);
+#else
 		blkdev_put(sbi->meta_bdev, SCOUTFS_META_BDEV_MODE);
+#endif
+#endif
+
 		lockdep_on();
 		sbi->meta_bdev = NULL;
 	}
@@ -194,7 +206,9 @@ static void scoutfs_put_super(struct super_block *sb)
 	scoutfs_shutdown_trans(sb);
 	scoutfs_volopt_destroy(sb);
 	scoutfs_client_destroy(sb);
+	scoutfs_quota_destroy(sb);
 	scoutfs_inode_destroy(sb);
+	scoutfs_wkic_destroy(sb);
 	scoutfs_item_destroy(sb);
 	scoutfs_forest_destroy(sb);
 	scoutfs_data_destroy(sb);
@@ -473,7 +487,11 @@ out:
 static int scoutfs_fill_super(struct super_block *sb, void *data, int silent)
 {
 	struct scoutfs_mount_options opts;
+#ifdef KC_BDEV_FILE_OPEN_BY_PATH
+	struct file *meta_bdev_file;
+#else
 	struct block_device *meta_bdev;
+#endif
 	struct scoutfs_sb_info *sbi;
 	struct inode *inode;
 	int ret;
@@ -519,7 +537,27 @@ static int scoutfs_fill_super(struct super_block *sb, void *data, int silent)
 		goto out;
 	}
 
+#ifdef KC_BDEV_FILE_OPEN_BY_PATH
+	/*
+	 * pass sbi as holder, since dev_mount already passes sb, which triggers a
+	 * WARN_ON because dev_mount also passes non-NULL hops. By passing sbi
+	 * here we just get a simple error in our test cases.
+	 */
+	meta_bdev_file = bdev_file_open_by_path(opts.metadev_path, SCOUTFS_META_BDEV_MODE, sbi, NULL);
+	if (IS_ERR(meta_bdev_file)) {
+		scoutfs_err(sb, "could not open metadev: error %ld",
+			    PTR_ERR(meta_bdev_file));
+		ret = PTR_ERR(meta_bdev_file);
+		goto out;
+	}
+	sbi->meta_bdev_file = meta_bdev_file;
+	sbi->meta_bdev = file_bdev(meta_bdev_file);
+#else
+#ifdef KC_BLKDEV_PUT_HOLDER_ARG
+	meta_bdev = blkdev_get_by_path(opts.metadev_path, SCOUTFS_META_BDEV_MODE, sb, NULL);
+#else
 	meta_bdev = blkdev_get_by_path(opts.metadev_path, SCOUTFS_META_BDEV_MODE, sb);
+#endif
 	if (IS_ERR(meta_bdev)) {
 		scoutfs_err(sb, "could not open metadev: error %ld",
 			    PTR_ERR(meta_bdev));
@@ -527,6 +565,8 @@ static int scoutfs_fill_super(struct super_block *sb, void *data, int silent)
 		goto out;
 	}
 	sbi->meta_bdev = meta_bdev;
+#endif
+
 	ret = set_blocksize(sbi->meta_bdev, SCOUTFS_BLOCK_SM_SIZE);
 	if (ret != 0) {
 		scoutfs_err(sb, "failed to set metadev blocksize, returned %d",
@@ -544,7 +584,9 @@ static int scoutfs_fill_super(struct super_block *sb, void *data, int silent)
 	      scoutfs_block_setup(sb) ?:
 	      scoutfs_forest_setup(sb) ?:
 	      scoutfs_item_setup(sb) ?:
+	      scoutfs_wkic_setup(sb) ?:
 	      scoutfs_inode_setup(sb) ?:
+	      scoutfs_quota_setup(sb) ?:
 	      scoutfs_data_setup(sb) ?:
 	      scoutfs_setup_trans(sb) ?:
 	      scoutfs_omap_setup(sb) ?:

kmod/src/super.h

@@ -30,6 +30,8 @@ struct recov_info;
 struct omap_info;
 struct volopt_info;
 struct fence_info;
+struct wkic_info;
+struct squota_info;
 
 struct scoutfs_sb_info {
 	struct super_block *sb;
@@ -40,6 +42,9 @@ struct scoutfs_sb_info {
 	u64 fmt_vers;
 
 	struct block_device *meta_bdev;
+#ifdef KC_BDEV_FILE_OPEN_BY_PATH
+	struct file *meta_bdev_file;
+#endif
 
 	spinlock_t next_ino_lock;
 
@@ -55,6 +60,8 @@ struct scoutfs_sb_info {
 	struct omap_info *omap_info;
 	struct volopt_info *volopt_info;
 	struct item_cache_info *item_cache_info;
+	struct wkic_info *wkic_info;
+	struct squota_info *squota_info;
 	struct fence_info *fence_info;
 
 	/* tracks tasks waiting for data extents */
@@ -97,7 +104,11 @@ static inline bool SCOUTFS_IS_META_BDEV(struct scoutfs_super_block *super_block)
 	return !!(le64_to_cpu(super_block->flags) & SCOUTFS_FLAG_IS_META_BDEV);
 }
 
+#ifdef KC_HAVE_BLK_MODE_T
+#define SCOUTFS_META_BDEV_MODE (BLK_OPEN_READ | BLK_OPEN_WRITE | BLK_OPEN_EXCL)
+#else
 #define SCOUTFS_META_BDEV_MODE (FMODE_READ | FMODE_WRITE | FMODE_EXCL)
+#endif
 
 static inline bool scoutfs_forcing_unmount(struct super_block *sb)
 {
@@ -156,4 +167,17 @@ int scoutfs_write_super(struct super_block *sb,
 /* to keep this out of the ioctl.h public interface definition */
 long scoutfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 
+/*
+ * Returns 0 when supported, non-zero -errno when unsupported.
+ */
+static inline int scoutfs_fmt_vers_unsupported(struct super_block *sb, u64 vers)
+{
+	struct scoutfs_sb_info *sbi = SCOUTFS_SB(sb);
+
+	if (sbi && (sbi->fmt_vers < vers))
+		return -EOPNOTSUPP;
+	else
+		return 0;
+}
+
 #endif

kmod/src/sysfs.c

@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/fs.h>
+#include <linux/blkdev.h>
 
 #include "super.h"
 #include "sysfs.h"

kmod/src/totl.c

@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2023 Versity Software, Inc.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/string.h>
+
+#include "format.h"
+#include "forest.h"
+#include "totl.h"
+
+void scoutfs_totl_set_range(struct scoutfs_key *start, struct scoutfs_key *end)
+{
+	scoutfs_key_set_zeros(start);
+	start->sk_zone = SCOUTFS_XATTR_TOTL_ZONE;
+	scoutfs_key_set_ones(end);
+	end->sk_zone = SCOUTFS_XATTR_TOTL_ZONE;
+}
+
+void scoutfs_totl_merge_init(struct scoutfs_totl_merging *merg)
+{
+	memset(merg, 0, sizeof(struct scoutfs_totl_merging));
+}
+
+void scoutfs_totl_merge_contribute(struct scoutfs_totl_merging *merg,
+				   u64 seq, u8 flags, void *val, int val_len, int fic)
+{
+	struct scoutfs_xattr_totl_val *tval = val;
+
+	if (fic & FIC_FS_ROOT) {
+		merg->fs_seq = seq;
+		merg->fs_total = le64_to_cpu(tval->total);
+		merg->fs_count = le64_to_cpu(tval->count);
+	} else if (fic & FIC_FINALIZED) {
+		merg->fin_seq = seq;
+		merg->fin_total += le64_to_cpu(tval->total);
+		merg->fin_count += le64_to_cpu(tval->count);
+	} else {
+		merg->log_seq = seq;
+		merg->log_total += le64_to_cpu(tval->total);
+		merg->log_count += le64_to_cpu(tval->count);
+	}
+}
+
+/*
+ * .totl. item merging has to be careful because the log btree merging
+ * code can write partial results to the fs_root.  This means that a
+ * reader can see both cases where new finalized logs should be applied
+ * to the old fs items and where old finalized logs have already been
+ * applied to the partially merged fs items.  Currently active logged
+ * items are always applied on top of all cases.
+ *
+ * These cases are differentiated with a combination of sequence numbers
+ * in items, the count of contributing xattrs, and a flag
+ * differentiating finalized and active logged items.  This lets us
+ * recognize all cases, including when finalized logs were merged and
+ * deleted the fs item.
+ */
+void scoutfs_totl_merge_resolve(struct scoutfs_totl_merging *merg, __u64 *total, __u64 *count)
+{
+	*total = 0;
+	*count = 0;
+
+	/* start with the fs item if we have it */
+	if (merg->fs_seq != 0) {
+		*total = merg->fs_total;
+		*count = merg->fs_count;
+	}
+
+	/* apply finalized logs if they're newer or creating */
+	if (((merg->fs_seq != 0) && (merg->fin_seq > merg->fs_seq)) ||
+	    ((merg->fs_seq == 0) && (merg->fin_count > 0))) {
+		*total += merg->fin_total;
+		*count += merg->fin_count;
+	}
+
+	/* always apply active logs which must be newer than fs and finalized */
+	if (merg->log_seq > 0) {
+		*total += merg->log_total;
+		*count += merg->log_count;
+	}
+}

kmod/src/totl.h

@@ -0,0 +1,24 @@
+#ifndef _SCOUTFS_TOTL_H_
+#define _SCOUTFS_TOTL_H_
+
+#include "key.h"
+
+struct scoutfs_totl_merging {
+	u64 fs_seq;
+	u64 fs_total;
+	u64 fs_count;
+	u64 fin_seq;
+	u64 fin_total;
+	s64 fin_count;
+	u64 log_seq;
+	u64 log_total;
+	s64 log_count;
+};
+
+void scoutfs_totl_set_range(struct scoutfs_key *start, struct scoutfs_key *end);
+void scoutfs_totl_merge_init(struct scoutfs_totl_merging *merg);
+void scoutfs_totl_merge_contribute(struct scoutfs_totl_merging *merg,
+				   u64 seq, u8 flags, void *val, int val_len, int fic);
+void scoutfs_totl_merge_resolve(struct scoutfs_totl_merging *merg, __u64 *total, __u64 *count);
+
+#endif

kmod/src/trace/quota.h

@@ -0,0 +1,143 @@
+
+/*
+ * Tracing squota_input
+ */
+#define SQI_FMT "[%u %llu %llu %llu]"
+
+#define SQI_ARGS(i)						\
+	(i)->op, (i)->attrs[0], (i)->attrs[1], (i)->attrs[2]
+
+#define SQI_FIELDS(pref)					\
+	__array(__u64, pref##_attrs, SQ_NS__NR_SELECT)		\
+	__field(__u8, pref##_op)
+
+#define SQI_ASSIGN(pref, i)					\
+	__entry->pref##_attrs[0] = (i)->attrs[0];		\
+	__entry->pref##_attrs[1] = (i)->attrs[1];		\
+	__entry->pref##_attrs[2] = (i)->attrs[2];		\
+	__entry->pref##_op = (i)->op;
+
+#define SQI_ENTRY_ARGS(pref)					\
+	__entry->pref##_op, __entry->pref##_attrs[0],		\
+	__entry->pref##_attrs[1], __entry->pref##_attrs[2]
+
+/*
+ * Tracing squota_rule
+ */
+#define SQR_FMT "[%u %llu,%u,%x %llu,%u,%x %llu,%u,%x %u %llu]"
+
+#define SQR_ARGS(r)							\
+	(r)->prio,							\
+	(r)->name_val[0], (r)->name_source[0], (r)->name_flags[0],	\
+	(r)->name_val[1], (r)->name_source[1], (r)->name_flags[1],	\
+	(r)->name_val[2], (r)->name_source[2], (r)->name_flags[2],	\
+	(r)->op, (r)->limit						\
+
+#define SQR_FIELDS(pref)			\
+	__array(__u64, pref##_name_val, 3)	\
+	__field(__u64, pref##_limit)		\
+	__array(__u8, pref##_name_source, 3)	\
+	__array(__u8, pref##_name_flags, 3)	\
+	__field(__u8, pref##_prio)		\
+	__field(__u8, pref##_op)
+
+#define SQR_ASSIGN(pref, r)					\
+	__entry->pref##_name_val[0] = (r)->names[0].val;	\
+	__entry->pref##_name_val[1] = (r)->names[1].val;	\
+	__entry->pref##_name_val[2] = (r)->names[2].val;	\
+	__entry->pref##_limit = (r)->limit;			\
+	__entry->pref##_name_source[0] = (r)->names[0].source;	\
+	__entry->pref##_name_source[1] = (r)->names[1].source;	\
+	__entry->pref##_name_source[2] = (r)->names[2].source;	\
+	__entry->pref##_name_flags[0] = (r)->names[0].flags;	\
+	__entry->pref##_name_flags[1] = (r)->names[1].flags;	\
+	__entry->pref##_name_flags[2] = (r)->names[2].flags;	\
+	__entry->pref##_prio = (r)->prio;			\
+	__entry->pref##_op = (r)->op;
+
+#define SQR_ENTRY_ARGS(pref)						\
+	__entry->pref##_prio, __entry->pref##_name_val[0],		\
+	__entry->pref##_name_source[0], __entry->pref##_name_flags[0],	\
+	__entry->pref##_name_val[1], __entry->pref##_name_source[1],	\
+	__entry->pref##_name_flags[1], __entry->pref##_name_val[2],	\
+	__entry->pref##_name_source[2], __entry->pref##_name_flags[2],	\
+	__entry->pref##_op, __entry->pref##_limit
+
+TRACE_EVENT(scoutfs_quota_check,
+	TP_PROTO(struct super_block *sb, long rs_ptr, struct squota_input *inp, int ret),
+
+	TP_ARGS(sb, rs_ptr, inp, ret),
+
+	TP_STRUCT__entry(
+		SCSB_TRACE_FIELDS
+		__field(long, rs_ptr)
+		SQI_FIELDS(i)
+		__field(int, ret)
+	),
+
+	TP_fast_assign(
+		SCSB_TRACE_ASSIGN(sb);
+		__entry->rs_ptr = rs_ptr;
+		SQI_ASSIGN(i, inp);
+		__entry->ret = ret;
+	),
+
+	TP_printk(SCSBF" rs_ptr %ld ret %d inp "SQI_FMT,
+		  SCSB_TRACE_ARGS, __entry->rs_ptr, __entry->ret, SQI_ENTRY_ARGS(i))
+);
+
+DECLARE_EVENT_CLASS(scoutfs_quota_rule_op_class,
+	TP_PROTO(struct super_block *sb, struct squota_rule *rule, int ret),
+
+	TP_ARGS(sb, rule, ret),
+
+	TP_STRUCT__entry(
+		SCSB_TRACE_FIELDS
+		SQR_FIELDS(r)
+		__field(int, ret)
+	),
+
+	TP_fast_assign(
+		SCSB_TRACE_ASSIGN(sb);
+		SQR_ASSIGN(r, rule);
+		__entry->ret = ret;
+	),
+
+	TP_printk(SCSBF" "SQR_FMT" ret %d",
+		  SCSB_TRACE_ARGS, SQR_ENTRY_ARGS(r), __entry->ret)
+);
+DEFINE_EVENT(scoutfs_quota_rule_op_class, scoutfs_quota_add_rule,
+	TP_PROTO(struct super_block *sb, struct squota_rule *rule, int ret),
+	TP_ARGS(sb, rule, ret)
+);
+DEFINE_EVENT(scoutfs_quota_rule_op_class, scoutfs_quota_del_rule,
+	TP_PROTO(struct super_block *sb, struct squota_rule *rule, int ret),
+	TP_ARGS(sb, rule, ret)
+);
+
+TRACE_EVENT(scoutfs_quota_totl_check,
+	TP_PROTO(struct super_block *sb, struct squota_input *inp, struct scoutfs_key *key,
+		 u64 limit, int ret),
+
+	TP_ARGS(sb, inp, key, limit, ret),
+
+	TP_STRUCT__entry(
+		SCSB_TRACE_FIELDS
+		SQI_FIELDS(i)
+		sk_trace_define(k)
+		__field(__u64, limit)
+		__field(int, ret)
+	),
+
+	TP_fast_assign(
+		SCSB_TRACE_ASSIGN(sb);
+		SQI_ASSIGN(i, inp);
+		sk_trace_assign(k, key);
+		__entry->limit = limit;
+		__entry->ret = ret;
+	),
+
+	TP_printk(SCSBF" inp "SQI_FMT" key "SK_FMT" limit %llu ret %d",
+		  SCSB_TRACE_ARGS, SQI_ENTRY_ARGS(i), sk_trace_args(k), __entry->limit,
+		  __entry->ret)
+);

kmod/src/trace/wkic.h

@@ -0,0 +1,112 @@
+
+DECLARE_EVENT_CLASS(scoutfs_wkic_wpage_class,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end),
+
+	TP_STRUCT__entry(
+		SCSB_TRACE_FIELDS
+		__field(void *, ptr)
+		__field(int, which)
+		__field(bool, n0l)
+		__field(bool, n1l)
+		sk_trace_define(start)
+		sk_trace_define(end)
+	),
+
+	TP_fast_assign(
+		SCSB_TRACE_ASSIGN(sb);
+		__entry->ptr = ptr;
+		__entry->which = which;
+		__entry->n0l = n0l;
+		__entry->n1l = n1l;
+		sk_trace_assign(start, start);
+		sk_trace_assign(end, end);
+		__entry->which = which;
+	),
+
+	TP_printk(SCSBF" ptr %p wh %d nl %u,%u start "SK_FMT " end "SK_FMT, SCSB_TRACE_ARGS,
+			__entry->ptr, __entry->which, __entry->n0l, __entry->n1l,
+			sk_trace_args(start), sk_trace_args(end))
+);
+
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_alloced,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_freeing,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_found,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_trimmed,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_erased,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_inserting,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_inserted,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_shrinking,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_dropping,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_replaying,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+DEFINE_EVENT(scoutfs_wkic_wpage_class, scoutfs_wkic_wpage_filled,
+	TP_PROTO(struct super_block *sb, void *ptr, int which, bool n0l, bool n1l,
+		 struct scoutfs_key *start, struct scoutfs_key *end),
+	TP_ARGS(sb, ptr, which, n0l, n1l, start, end)
+);
+
+TRACE_EVENT(scoutfs_wkic_read_items,
+	TP_PROTO(struct super_block *sb, struct scoutfs_key *key, struct scoutfs_key *start,
+		 struct scoutfs_key *end),
+
+	TP_ARGS(sb, key, start, end),
+
+	TP_STRUCT__entry(
+		SCSB_TRACE_FIELDS
+		sk_trace_define(key)
+		sk_trace_define(start)
+		sk_trace_define(end)
+	),
+
+	TP_fast_assign(
+		SCSB_TRACE_ASSIGN(sb);
+		sk_trace_assign(key, start);
+		sk_trace_assign(start, start);
+		sk_trace_assign(end, end);
+	),
+
+	TP_printk(SCSBF" key "SK_FMT" start "SK_FMT " end "SK_FMT, SCSB_TRACE_ARGS,
+			sk_trace_args(key), sk_trace_args(start), sk_trace_args(end))
+);

kmod/src/triggers.c

@@ -93,13 +93,9 @@ int scoutfs_setup_triggers(struct super_block *sb)
 		goto out;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(triggers->atomics); i++) {
-		if (!debugfs_create_atomic_t(names[i], 0644, triggers->dir,
-					     &triggers->atomics[i])) {
-			ret = -ENOMEM;
-			goto out;
-		}
-	}
+	for (i = 0; i < ARRAY_SIZE(triggers->atomics); i++)
+		debugfs_create_atomic_t(names[i], 0644, triggers->dir,
+					&triggers->atomics[i]);
 
 	ret = 0;
 out:

kmod/src/tseq.c

@@ -183,6 +183,13 @@ static void *scoutfs_tseq_seq_next(struct seq_file *m, void *v, loff_t *pos)
 	ent = tseq_rb_next(ent);
 	if (ent)
 		*pos = ent->pos;
+	else
+		/*
+		 * once we hit the end, *pos is never used, but it has to
+		 * be updated to avoid an error in bpf_seq_read()
+		 */
+		(*pos)++;
+
 	return ent;
 }
 

kmod/src/wkic.h

@@ -0,0 +1,19 @@
+#ifndef _SCOUTFS_WKIC_H_
+#define _SCOUTFS_WKIC_H_
+
+#include "format.h"
+
+typedef int (*wkic_iter_cb_t)(struct scoutfs_key *key, void *val, unsigned int val_len,
+			      void *cb_arg);
+
+int scoutfs_wkic_iterate(struct super_block *sb, struct scoutfs_key *key, struct scoutfs_key *last,
+			 struct scoutfs_key *range_start, struct scoutfs_key *range_end,
+			 wkic_iter_cb_t cb, void *cb_arg);
+int scoutfs_wkic_iterate_stable(struct super_block *sb, struct scoutfs_key *key,
+				struct scoutfs_key *last, struct scoutfs_key *range_start,
+				struct scoutfs_key *range_end, wkic_iter_cb_t cb, void *cb_arg);
+
+int scoutfs_wkic_setup(struct super_block *sb);
+void scoutfs_wkic_destroy(struct super_block *sb);
+
+#endif

kmod/src/xattr.c

@@ -81,7 +81,20 @@ static void init_xattr_key(struct scoutfs_key *key, u64 ino, u32 name_hash,
 #define SCOUTFS_XATTR_PREFIX		"scoutfs."
 #define SCOUTFS_XATTR_PREFIX_LEN	(sizeof(SCOUTFS_XATTR_PREFIX) - 1)
 
+/*
+ * We could have hidden the logic that needs this in a user-prefix
+ * specific .set handler, but I wanted to make sure that we always
+ * applied that logic from any call chains to _xattr_set.  The
+ * additional strcmp isn't so expensive given all the rest of the work
+ * we're doing in here.
+ */
+static inline bool is_user(const char *name)
+{
+	return !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
+}
+
 #define HIDE_TAG	"hide."
+#define INDX_TAG	"indx."
 #define SRCH_TAG	"srch."
 #define TOTL_TAG	"totl."
 #define TAG_LEN		(sizeof(HIDE_TAG) - 1)
@@ -103,6 +116,9 @@ int scoutfs_xattr_parse_tags(const char *name, unsigned int name_len,
 		if (!strncmp(name, HIDE_TAG, TAG_LEN)) {
 			if (++tgs->hide == 0)
 				return -EINVAL;
+		} else if (!strncmp(name, INDX_TAG, TAG_LEN)) {
+			if (++tgs->indx == 0)
+				return -EINVAL;
 		} else if (!strncmp(name, SRCH_TAG, TAG_LEN)) {
 			if (++tgs->srch == 0)
 				return -EINVAL;
@@ -540,47 +556,57 @@ static int parse_totl_u64(const char *s, int len, u64 *res)
 }
 
 /*
- * non-destructive relatively quick parse of the last 3 dotted u64s that
- * make up the name of the xattr total.  -EINVAL is returned if there
- * are anything but 3 valid u64 encodings between single dots at the end
- * of the name.
+ * non-destructive relatively quick parse of final dotted u64s in an
+ * xattr name.  If the required number of values are found then we
+ * return the number of bytes in the name that are not the final dotted
+ * u64s with their dots.  -EINVAL is returned if we didn't find the
+ * required number of values.
  */
-static int parse_totl_key(struct scoutfs_key *key, const char *name, int name_len)
+static int parse_dotted_u64s(u64 *u64s, int nr, const char *name, int name_len)
 {
-	u64 tot_name[3];
 	int end = name_len;
-	int nr = 0;
 	int len;
 	int ret;
 	int i;
+	int u;
 
 	/* parse name elements in reserve order from end of xattr name string */
-	for (i = name_len - 1; i >= 0 && nr < ARRAY_SIZE(tot_name); i--) {
+	for (u = nr - 1, i = name_len - 1; u >= 0 && i >= 0; i--) {
 		if (name[i] != '.')
 			continue;
 
 		len = end - (i + 1);
-		ret = parse_totl_u64(&name[i + 1], len, &tot_name[nr]);
+		ret = parse_totl_u64(&name[i + 1], len, &u64s[u]);
 		if (ret < 0)
 			goto out;
 
 		end = i;
-		nr++;
+		u--;
 	}
 
-	if (nr == ARRAY_SIZE(tot_name)) {
-		/* swap to account for parsing in reverse */
-		swap(tot_name[0], tot_name[2]);
-		scoutfs_xattr_init_totl_key(key, tot_name);
-		ret = 0;
-	} else {
+	if (u == -1)
+		ret = end;
+	else
 		ret = -EINVAL;
-	}
 
 out:
 	return ret;
 }
 
+static int parse_totl_key(struct scoutfs_key *key, const char *name, int name_len)
+{
+	u64 u64s[3];
+	int ret;
+
+	ret = parse_dotted_u64s(u64s, ARRAY_SIZE(u64s), name, name_len);
+	if (ret >= 0) {
+		scoutfs_xattr_init_totl_key(key, u64s);
+		ret = 0;
+	}
+
+	return ret;
+}
+
 static int apply_totl_delta(struct super_block *sb, struct scoutfs_key *key,
 			    struct scoutfs_xattr_totl_val *tval, struct scoutfs_lock *lock)
 {
@@ -607,6 +633,72 @@ int scoutfs_xattr_combine_totl(void *dst, int dst_len, void *src, int src_len)
 	return SCOUTFS_DELTA_COMBINED;
 }
 
+void scoutfs_xattr_indx_get_range(struct scoutfs_key *start, struct scoutfs_key *end)
+{
+	scoutfs_key_set_zeros(start);
+	start->sk_zone = SCOUTFS_XATTR_INDX_ZONE;
+	scoutfs_key_set_ones(end);
+	end->sk_zone = SCOUTFS_XATTR_INDX_ZONE;
+}
+
+/*
+ * .indx. keys are a bit funny because we're iterating over index keys
+ * by major:minor:inode:xattr_id.  That doesn't map nicely to the
+ * comparison precedence of the key fields.  We have to mess around a
+ * little bit to get the major into the most significant key bits and
+ * the low bits of xattr id into the least significant key bits.
+ */
+void scoutfs_xattr_init_indx_key(struct scoutfs_key *key, u8 major, u64 minor, u64 ino, u64 xid)
+{
+	scoutfs_key_set_zeros(key);
+	key->sk_zone = SCOUTFS_XATTR_INDX_ZONE;
+
+	key->_sk_first = cpu_to_le64(((u64)major << 56) | (minor >> 8));
+	key->_sk_second = cpu_to_le64((minor << 56) | (ino >> 8));
+	key->_sk_third = cpu_to_le64((ino << 56) | (xid >> 8));
+	key->_sk_fourth = xid & 0xff;
+}
+
+void scoutfs_xattr_get_indx_key(struct scoutfs_key *key, u8 *major, u64 *minor, u64 *ino, u64 *xid)
+{
+	*major = le64_to_cpu(key->_sk_first) >> 56;
+	*minor = (le64_to_cpu(key->_sk_first) << 8) | (le64_to_cpu(key->_sk_second) >> 56);
+	*ino = (le64_to_cpu(key->_sk_second) << 8) | (le64_to_cpu(key->_sk_third) >> 56);
+	*xid = (le64_to_cpu(key->_sk_third) << 8) | key->_sk_fourth;
+}
+
+void scoutfs_xattr_set_indx_key_xid(struct scoutfs_key *key, u64 xid)
+{
+	u8 major;
+	u64 minor;
+	u64 ino;
+	u64 dummy;
+
+	scoutfs_xattr_get_indx_key(key, &major, &minor, &ino, &dummy);
+	scoutfs_xattr_init_indx_key(key, major, minor, ino, xid);
+}
+
+/*
+ * This initial parsing of the name doesn't yet have access to an xattr
+ * id to put in the key.  That's added later as the existing xattr is
+ * found or a new xattr's id is allocated.
+ */
+static int parse_indx_key(struct scoutfs_key *key, const char *name, int name_len, u64 ino)
+{
+	u64 u64s[2];
+	int ret;
+
+	ret = parse_dotted_u64s(u64s, ARRAY_SIZE(u64s), name, name_len);
+	if (ret < 0)
+		return ret;
+
+	if (u64s[0] > U8_MAX)
+		return -EINVAL;
+
+	scoutfs_xattr_init_indx_key(key, u64s[0], u64s[1], ino, 0);
+	return 0;
+}
+
 /*
  * The confusing swiss army knife of creating, modifying, and deleting
  * xattrs.
@@ -627,7 +719,7 @@ int scoutfs_xattr_combine_totl(void *dst, int dst_len, void *src, int src_len)
 int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_len,
 			     const void *value, size_t size, int flags,
 			     const struct scoutfs_xattr_prefix_tags *tgs,
-			     struct scoutfs_lock *lck, struct scoutfs_lock *totl_lock,
+			     struct scoutfs_lock *lck, struct scoutfs_lock *tag_lock,
 			     struct list_head *ind_locks)
 {
 	struct scoutfs_inode_info *si = SCOUTFS_I(inode);
@@ -635,10 +727,11 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 	const u64 ino = scoutfs_ino(inode);
 	struct scoutfs_xattr_totl_val tval = {0,};
 	struct scoutfs_xattr *xat = NULL;
-	struct scoutfs_key totl_key;
+	struct scoutfs_key tag_key;
 	struct scoutfs_key key;
 	bool undo_srch = false;
 	bool undo_totl = false;
+	bool undo_indx = false;
 	u8 found_parts;
 	unsigned int xat_bytes_totl;
 	unsigned int xat_bytes;
@@ -651,7 +744,8 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 
 	trace_scoutfs_xattr_set(sb, name_len, value, size, flags);
 
-	if (WARN_ON_ONCE(tgs->totl && !totl_lock))
+	if (WARN_ON_ONCE(tgs->totl && tgs->indx) ||
+	    WARN_ON_ONCE((tgs->totl | tgs->indx) && !tag_lock))
 		return -EINVAL;
 
 	/* mirror the syscall's errors for large names and values */
@@ -664,10 +758,22 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 	    (flags & ~(XATTR_CREATE | XATTR_REPLACE)))
 		return -EINVAL;
 
-	if ((tgs->hide | tgs->srch | tgs->totl) && !capable(CAP_SYS_ADMIN))
+	if ((tgs->hide | tgs->indx | tgs->srch | tgs->totl) && !capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-	if (tgs->totl && ((ret = parse_totl_key(&totl_key, name, name_len)) != 0))
+	if (tgs->totl && ((ret = parse_totl_key(&tag_key, name, name_len)) != 0))
+		return ret;
+
+	if (tgs->indx &&
+	    (ret = scoutfs_fmt_vers_unsupported(sb, SCOUTFS_FORMAT_VERSION_FEAT_INDX_TAG)))
+		return ret;
+
+	if (tgs->indx && ((ret = parse_indx_key(&tag_key, name, name_len, ino)) != 0))
+		return ret;
+
+	/* retention blocks user. xattr modification, all else allowed */
+	ret = scoutfs_inode_check_retention(inode);
+	if (ret < 0 && is_user(name))
 		return ret;
 
 	/* allocate enough to always read an existing xattr's totl */
@@ -708,6 +814,12 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 	/* found fields in key will also be used */
 	found_parts = ret >= 0 ? xattr_nr_parts(xat) : 0;
 
+	/* use existing xattr's id or allocate new when creating */
+	if (found_parts)
+		id = le64_to_cpu(key.skx_id);
+	else if (value)
+		id = si->next_xattr_id++;
+
 	if (found_parts && tgs->totl) {
 		/* parse old totl value before we clobber xat buf */
 		val_len = ret - offsetof(struct scoutfs_xattr, name[xat->name_len]);
@@ -718,12 +830,25 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 		le64_add_cpu(&tval.total, -total);
 	}
 
+	/*
+	 * indx xattrs don't have a value.  After returning an error for
+	 * non-zero val length or short circuiting modifying with the
+	 * same 0 length, all we're left with is creating or deleting
+	 * the xattr.
+	 */
+	if (tgs->indx) {
+		if (size != 0) {
+			ret = -EINVAL;
+			goto out;
+		}
+		if (found_parts && value) {
+			ret = 0;
+			goto out;
+		}
+	}
+
 	/* prepare the xattr header, name, and start of value in first item */
 	if (value) {
-		if (found_parts)
-			id = le64_to_cpu(key.skx_id);
-		else
-			id = si->next_xattr_id++;
 		xat->name_len = name_len;
 		xat->val_len = cpu_to_le16(size);
 		memset(xat->__pad, 0, sizeof(xat->__pad));
@@ -741,9 +866,18 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 		le64_add_cpu(&tval.total, total);
 	}
 
+	if (tgs->indx) {
+		scoutfs_xattr_set_indx_key_xid(&tag_key, id);
+		if (value)
+			ret = scoutfs_item_create_force(sb, &tag_key, NULL, 0, tag_lock, NULL);
+		else
+			ret = scoutfs_item_delete_force(sb, &tag_key, tag_lock, NULL);
+		if (ret < 0)
+			goto out;
+		undo_indx = true;
+	}
+
 	if (tgs->srch && !(found_parts && value)) {
-		if (found_parts)
-			id = le64_to_cpu(key.skx_id);
 		hash = scoutfs_hash64(name, name_len);
 		ret = scoutfs_forest_srch_add(sb, hash, ino, id);
 		if (ret < 0)
@@ -752,7 +886,7 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 	}
 
 	if (tgs->totl) {
-		ret = apply_totl_delta(sb, &totl_key, &tval, totl_lock);
+		ret = apply_totl_delta(sb, &tag_key, &tval, tag_lock);
 		if (ret < 0)
 			goto out;
 		undo_totl = true;
@@ -777,6 +911,13 @@ int scoutfs_xattr_set_locked(struct inode *inode, const char *name, size_t name_
 	ret = 0;
 
 out:
+	if (ret < 0 && undo_indx) {
+		if (value)
+			err = scoutfs_item_delete_force(sb, &tag_key, tag_lock, NULL);
+		else
+			err = scoutfs_item_create_force(sb, &tag_key, NULL, 0, tag_lock, NULL);
+		BUG_ON(err); /* inconsistent */
+	}
 	if (ret < 0 && undo_srch) {
 		err = scoutfs_forest_srch_add(sb, hash, ino, id);
 		BUG_ON(err);
@@ -785,7 +926,7 @@ out:
 		/* _delta() on dirty items shouldn't fail */
 		tval.total = cpu_to_le64(-le64_to_cpu(tval.total));
 		tval.count = cpu_to_le64(-le64_to_cpu(tval.count));
-		err = apply_totl_delta(sb, &totl_key, &tval, totl_lock);
+		err = apply_totl_delta(sb, &tag_key, &tval, tag_lock);
 		BUG_ON(err);
 	}
 
@@ -801,7 +942,7 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name, const void
 	struct inode *inode = dentry->d_inode;
 	struct super_block *sb = inode->i_sb;
 	struct scoutfs_xattr_prefix_tags tgs;
-	struct scoutfs_lock *totl_lock = NULL;
+	struct scoutfs_lock *tag_lock = NULL;
 	struct scoutfs_lock *lck = NULL;
 	size_t name_len = strlen(name);
 	LIST_HEAD(ind_locks);
@@ -816,8 +957,11 @@ static int scoutfs_xattr_set(struct dentry *dentry, const char *name, const void
 	if (ret)
 		goto unlock;
 
-	if (tgs.totl) {
-		ret = scoutfs_lock_xattr_totl(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, &totl_lock);
+	if (tgs.totl || tgs.indx) {
+		if (tgs.totl)
+			ret = scoutfs_lock_xattr_totl(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, &tag_lock);
+		else
+			ret = scoutfs_lock_xattr_indx(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, &tag_lock);
 		if (ret)
 			goto unlock;
 	}
@@ -836,7 +980,7 @@ retry:
 		goto release;
 
 	ret = scoutfs_xattr_set_locked(dentry->d_inode, name, name_len, value, size, flags, &tgs,
-				       lck, totl_lock, &ind_locks);
+				       lck, tag_lock, &ind_locks);
 	if (ret == 0)
 		scoutfs_update_inode_item(inode, lck, &ind_locks);
 
@@ -845,7 +989,7 @@ release:
 	scoutfs_inode_index_unlock(sb, &ind_locks);
 unlock:
 	scoutfs_unlock(sb, lck, SCOUTFS_LOCK_WRITE);
-	scoutfs_unlock(sb, totl_lock, SCOUTFS_LOCK_WRITE_ONLY);
+	scoutfs_unlock(sb, tag_lock, SCOUTFS_LOCK_WRITE_ONLY);
 
 	return ret;
 }
@@ -882,7 +1026,9 @@ static int scoutfs_xattr_get_handler
 
 static int scoutfs_xattr_set_handler
 #ifdef KC_XATTR_STRUCT_XATTR_HANDLER
-		(const struct xattr_handler *handler, struct dentry *dentry,
+		(const struct xattr_handler *handler,
+		 KC_VFS_NS_DEF
+		 struct dentry *dentry,
 		 struct inode *inode, const char *name, const void *value,
 		 size_t size, int flags)
 {
@@ -1055,14 +1201,15 @@ int scoutfs_xattr_drop(struct super_block *sb, u64 ino,
 {
 	struct scoutfs_xattr_prefix_tags tgs;
 	struct scoutfs_xattr *xat = NULL;
-	struct scoutfs_lock *totl_lock = NULL;
+	struct scoutfs_lock *tag_lock = NULL;
 	struct scoutfs_xattr_totl_val tval;
-	struct scoutfs_key totl_key;
+	struct scoutfs_key tag_key;
 	struct scoutfs_key last;
 	struct scoutfs_key key;
 	bool release = false;
 	unsigned int bytes;
 	unsigned int val_len;
+	u8 locked_zone = 0;
 	void *value;
 	u64 total;
 	u64 hash;
@@ -1108,16 +1255,32 @@ int scoutfs_xattr_drop(struct super_block *sb, u64 ino,
 				goto out;
 			}
 
-			ret = parse_totl_key(&totl_key, xat->name, xat->name_len) ?:
+			ret = parse_totl_key(&tag_key, xat->name, xat->name_len) ?:
 			      parse_totl_u64(value, val_len, &total);
 			if (ret < 0)
 				break;
 		}
 
-		if (tgs.totl && totl_lock == NULL) {
-			ret = scoutfs_lock_xattr_totl(sb, SCOUTFS_LOCK_WRITE_ONLY, 0, &totl_lock);
+		if (tgs.indx) {
+			ret = parse_indx_key(&tag_key, xat->name, xat->name_len, ino);
+			if (ret < 0)
+				goto out;
+		}
+
+		if ((tgs.totl || tgs.indx) && locked_zone != tag_key.sk_zone) {
+			if (tag_lock) {
+				scoutfs_unlock(sb, tag_lock, SCOUTFS_LOCK_WRITE_ONLY);
+				tag_lock = NULL;
+			}
+			if (tgs.totl)
+				ret = scoutfs_lock_xattr_totl(sb, SCOUTFS_LOCK_WRITE_ONLY, 0,
+							      &tag_lock);
+			else
+				ret = scoutfs_lock_xattr_indx(sb, SCOUTFS_LOCK_WRITE_ONLY, 0,
+							      &tag_lock);
 			if (ret < 0)
 				break;
+			locked_zone = tag_key.sk_zone;
 		}
 
 		ret = scoutfs_hold_trans(sb, false);
@@ -1140,7 +1303,13 @@ int scoutfs_xattr_drop(struct super_block *sb, u64 ino,
 		if (tgs.totl) {
 			tval.total = cpu_to_le64(-total);
 			tval.count = cpu_to_le64(-1LL);
-			ret = apply_totl_delta(sb, &totl_key, &tval, totl_lock);
+			ret = apply_totl_delta(sb, &tag_key, &tval, tag_lock);
+			if (ret < 0)
+				break;
+		}
+
+		if (tgs.indx) {
+			ret = scoutfs_item_delete_force(sb, &tag_key, tag_lock, NULL);
 			if (ret < 0)
 				break;
 		}
@@ -1153,7 +1322,7 @@ int scoutfs_xattr_drop(struct super_block *sb, u64 ino,
 
 	if (release)
 		scoutfs_release_trans(sb);
-	scoutfs_unlock(sb, totl_lock, SCOUTFS_LOCK_WRITE_ONLY);
+	scoutfs_unlock(sb, tag_lock, SCOUTFS_LOCK_WRITE_ONLY);
 	kfree(xat);
 out:
 	return ret;

kmod/src/xattr.h

@@ -3,6 +3,7 @@
 
 struct scoutfs_xattr_prefix_tags {
 	unsigned long hide:1,
+		      indx:1,
 		      srch:1,
 		      totl:1;
 };
@@ -30,4 +31,9 @@ int scoutfs_xattr_parse_tags(const char *name, unsigned int name_len,
 void scoutfs_xattr_init_totl_key(struct scoutfs_key *key, u64 *name);
 int scoutfs_xattr_combine_totl(void *dst, int dst_len, void *src, int src_len);
 
+void scoutfs_xattr_indx_get_range(struct scoutfs_key *start, struct scoutfs_key *end);
+void scoutfs_xattr_init_indx_key(struct scoutfs_key *key, u8 major, u64 minor, u64 ino, u64 xid);
+void scoutfs_xattr_get_indx_key(struct scoutfs_key *key, u8 *major, u64 *minor, u64 *ino, u64 *xid);
+void scoutfs_xattr_set_indx_key_xid(struct scoutfs_key *key, u64 xid);
+
 #endif

tests/.gitignore

@@ -9,3 +9,4 @@ src/find_xattrs
 src/stage_tmpfile
 src/create_xattr_loop
 src/o_tmpfile_umask
+src/o_tmpfile_linkat

tests/.xfstests-branch

@@ -0,0 +1 @@
+v2022.05.01-2-g787cd20

tests/Makefile

@@ -12,7 +12,8 @@ BIN := src/createmany			\
 	src/find_xattrs			\
 	src/create_xattr_loop		\
 	src/fragmented_data_extents	\
-	src/o_tmpfile_umask
+	src/o_tmpfile_umask		\
+	src/o_tmpfile_linkat
 
 DEPS := $(wildcard src/*.d)
 

tests/README.md

@@ -113,6 +113,7 @@ used during the test.
 | T\_EX\_META\_DEV | scratch meta bdev    | -f              | /dev/vdd          |
 | T\_EX\_DATA\_DEV | scratch meta bdev    | -e              | /dev/vdc          |
 | T\_M[0-9]        | mount paths          | mounted per run | /mnt/test.[0-9]/  |
+| T\_MODULE        | built kernel module  | created per run | ../kmod/src/..ko  |
 | T\_NR\_MOUNTS    | number of mounts     | -n              | 3                 |
 | T\_O[0-9]        | mount options        | created per run | -o server\_addr=  |
 | T\_QUORUM        | quorum count         | -q              | 2                 |

tests/funcs/exec.sh

@@ -7,8 +7,9 @@ t_status_msg()
 export T_PASS_STATUS=100
 export T_SKIP_STATUS=101
 export T_FAIL_STATUS=102
+export T_SKIP_PERMITTED_STATUS=103
 export T_FIRST_STATUS="$T_PASS_STATUS"
-export T_LAST_STATUS="$T_FAIL_STATUS"
+export T_LAST_STATUS="$T_SKIP_PERMITTED_STATUS"
 
 t_pass()
 {
@@ -21,6 +22,17 @@ t_skip()
 	exit $T_SKIP_STATUS
 }
 
+#
+# This exit code is *reserved* for tests that are up-front never going to work
+# in certain cases. This should be expressly documented per-case and made
+# abundantly clear before merging. The test itself should document its case.
+#
+t_skip_permitted()
+{
+	t_status_msg "$@"
+	exit $T_SKIP_PERMITTED_STATUS
+}
+
 t_fail()
 {
 	t_status_msg "$@"

tests/funcs/filter.sh

@@ -143,10 +143,23 @@ t_filter_dmesg()
 	# change-devices causes loop device resizing
 	re="$re|loop: module loaded"
 	re="$re|loop[0-9].* detected capacity change from.*"
+	re="$re|dm-[0-9].* detected capacity change from.*"
 
 	# ignore systemd-journal rotating
 	re="$re|systemd-journald.*"
 
+	# process accounting can be noisy
+	re="$re|Process accounting resumed.*"
+
+	# format vers back/compat tries bad mounts
+	re="$re|scoutfs .* error.*outside of supported version.*"
+	re="$re|scoutfs .* error.*could not get .*super.*"
+
+	# ignore "unsafe core pattern" when xfstests tries to disable cores"
+	re="$re|Unsafe core_pattern used with fs.suid_dumpable=2.*"
+	re="$re|Pipe handler or fully qualified core dump path required.*"
+	re="$re|Set kernel.core_pattern before fs.suid_dumpable.*"
+
 	egrep -v "($re)" | \
 		ignore_harmless_unwind_kasan_stack_oob
 }

tests/funcs/fs.sh

@@ -29,13 +29,12 @@ t_mount_rid()
 }
 
 #
-# Output the "f.$fsid.r.$rid" identifier string for the given mount
-# number, 0 is used by default if none is specified. 
+# Output the "f.$fsid.r.$rid" identifier string for the given path
+# in a mounted scoutfs volume.
 #
-t_ident()
+t_ident_from_mnt()
 {
-	local nr="${1:-0}"
-	local mnt="$(eval echo \$T_M$nr)"
+	local mnt="$1"
 	local fsid
 	local rid
 
@@ -45,6 +44,38 @@ t_ident()
 	echo "f.${fsid:0:6}.r.${rid:0:6}"
 }
 
+#
+# Output the "f.$fsid.r.$rid" identifier string for the given mount
+# number, 0 is used by default if none is specified.
+#
+t_ident()
+{
+	local nr="${1:-0}"
+	local mnt="$(eval echo \$T_M$nr)"
+
+	t_ident_from_mnt "$mnt"
+}
+
+#
+# Output the sysfs path for a path in a mounted fs.
+#
+t_sysfs_path_from_ident()
+{
+	local ident="$1"
+
+	echo "/sys/fs/scoutfs/$ident"
+}
+
+#
+# Output the sysfs path for a path in a mounted fs.
+#
+t_sysfs_path_from_mnt()
+{
+	local mnt="$1"
+
+	t_sysfs_path_from_ident $(t_ident_from_mnt $mnt)
+}
+
 #
 # Output the mount's sysfs path, defaulting to mount 0 if none is
 # specified.
@@ -53,7 +84,7 @@ t_sysfs_path()
 {
 	local nr="$1"
 
-	echo "/sys/fs/scoutfs/$(t_ident $nr)"
+	t_sysfs_path_from_ident $(t_ident $nr)
 }
 
 #

tests/golden/basic-posix-acl

@@ -0,0 +1,155 @@
+== setup test directory
+== getfacl
+directory drwxr-xr-x 0 0 0 '.'
+# file: .
+# owner: root
+# group: root
+user::rwx
+group::r-x
+other::r-x
+
+== basic non-acl access through permissions
+directory drwxr-xr-x 0 44444 0 'dir-testuid'
+touch: cannot touch 'dir-testuid/file-group-write': Permission denied
+touch: cannot touch 'symlinkdir-testuid/symlink-file-group-write': Permission denied
+regular empty file -rw-r--r-- 22222 44444 0 'dir-testuid/file-group-write'
+regular empty file -rw-r--r-- 22222 44444 0 'symlinkdir-testuid/symlink-file-group-write'
+== basic acl access
+directory drwxr-xr-x 0 0 0 'dir-root'
+touch: cannot touch 'dir-root/file-group-write': Permission denied
+touch: cannot touch 'symlinkdir-root/file-group-write': Permission denied
+# file: dir-root
+# owner: root
+# group: root
+user::rwx
+user:22222:rwx
+group::r-x
+mask::rwx
+other::r-x
+
+regular empty file -rw-r--r-- 22222 0 0 'dir-root/file-group-write'
+regular empty file -rw-r--r-- 22222 0 0 'symlinkdir-root/file-group-write'
+== directory exec
+Success
+Success
+# file: dir-root
+# owner: root
+# group: root
+user::rwx
+user:22222:rw-
+group::r-x
+mask::rwx
+other::r-x
+
+Failed
+Failed
+# file: dir-root
+# owner: root
+# group: root
+user::rwx
+user:22222:rw-
+group::r-x
+group:44444:rwx
+mask::rwx
+other::r-x
+
+Success
+Success
+== get/set attr
+regular empty file -rw-r--r-- 0 0 0 'file-root'
+setfattr: file-root: Permission denied
+# file: file-root
+# owner: root
+# group: root
+user::rw-
+user:22222:rw-
+group::r--
+mask::rw-
+other::r--
+
+# file: file-root
+user.test2="Success"
+
+# file: file-root
+# owner: root
+# group: root
+user::rw-
+group::r--
+mask::r--
+other::r--
+
+setfattr: file-root: Permission denied
+# file: file-root
+user.test2="Success"
+
+# file: file-root
+# owner: root
+# group: root
+user::rw-
+group::r--
+group:44444:rw-
+mask::rw-
+other::r--
+
+# file: file-root
+user.test2="Success"
+user.test4="Success"
+
+== inheritance / default acl
+directory drwxr-xr-x 0 0 0 'dir-root2'
+mkdir: cannot create directory 'dir-root2/dir': Permission denied
+touch: cannot touch 'dir-root2/dir/file': No such file or directory
+# file: dir-root2
+# owner: root
+# group: root
+user::rwx
+group::r-x
+other::r-x
+default:user::rwx
+default:user:22222:rwx
+default:group::r-x
+default:mask::rwx
+default:other::r-x
+
+mkdir: cannot create directory 'dir-root2/dir': Permission denied
+touch: cannot touch 'dir-root2/dir/file': No such file or directory
+# file: dir-root2
+# owner: root
+# group: root
+user::rwx
+user:22222:rwx
+group::r-x
+mask::rwx
+other::r-x
+default:user::rwx
+default:user:22222:rwx
+default:group::r-x
+default:mask::rwx
+default:other::r-x
+
+directory drwxrwxr-x 22222 0 4 'dir-root2/dir'
+# file: dir-root2/dir
+# owner: 22222
+# group: root
+user::rwx
+user:22222:rwx
+group::r-x
+mask::rwx
+other::r-x
+default:user::rwx
+default:user:22222:rwx
+default:group::r-x
+default:mask::rwx
+default:other::r-x
+
+regular empty file -rw-rw-r-- 22222 0 0 'dir-root2/dir/file'
+# file: dir-root2/dir/file
+# owner: 22222
+# group: root
+user::rw-
+user:22222:rwx	#effective:rw-
+group::r-x	#effective:r--
+mask::rw-
+other::r--
+
+== cleanup

tests/golden/basic-posix-consistency

@@ -56,3 +56,4 @@ mv: cannot move '/mnt/test/test/basic-posix-consistency/dir/c/clobber' to '/mnt/
 == inode indexes match after removing and syncing
 == concurrent creates make one file
 one-file
+== cleanup

tests/golden/change-devices

@@ -25,3 +25,4 @@ rc: 0
 equal_prepared
 large_prepared
 resized larger test rc: 0
+== cleanup

tests/golden/data-prealloc

@@ -1,29 +1,29 @@
 == initial writes smaller than prealloc grow to prealloc size
-/mnt/test/test/data-prealloc/file-1: 7 extents found
-/mnt/test/test/data-prealloc/file-2: 7 extents found
+/mnt/test/test/data-prealloc/file-1: extents: 7
+/mnt/test/test/data-prealloc/file-2: extents: 7
 == larger files get full prealloc extents
-/mnt/test/test/data-prealloc/file-1: 9 extents found
-/mnt/test/test/data-prealloc/file-2: 9 extents found
+/mnt/test/test/data-prealloc/file-1: extents: 9
+/mnt/test/test/data-prealloc/file-2: extents: 9
 == non-streaming writes with contig have per-block extents
-/mnt/test/test/data-prealloc/file-1: 32 extents found
-/mnt/test/test/data-prealloc/file-2: 32 extents found
+/mnt/test/test/data-prealloc/file-1: extents: 32
+/mnt/test/test/data-prealloc/file-2: extents: 32
 == any writes to region prealloc get full extents
-/mnt/test/test/data-prealloc/file-1: 4 extents found
-/mnt/test/test/data-prealloc/file-2: 4 extents found
-/mnt/test/test/data-prealloc/file-1: 4 extents found
-/mnt/test/test/data-prealloc/file-2: 4 extents found
+/mnt/test/test/data-prealloc/file-1: extents: 4
+/mnt/test/test/data-prealloc/file-2: extents: 4
+/mnt/test/test/data-prealloc/file-1: extents: 4
+/mnt/test/test/data-prealloc/file-2: extents: 4
 == streaming offline writes get full extents either way
-/mnt/test/test/data-prealloc/file-1: 4 extents found
-/mnt/test/test/data-prealloc/file-2: 4 extents found
-/mnt/test/test/data-prealloc/file-1: 4 extents found
-/mnt/test/test/data-prealloc/file-2: 4 extents found
+/mnt/test/test/data-prealloc/file-1: extents: 4
+/mnt/test/test/data-prealloc/file-2: extents: 4
+/mnt/test/test/data-prealloc/file-1: extents: 4
+/mnt/test/test/data-prealloc/file-2: extents: 4
 == goofy preallocation amounts work
-/mnt/test/test/data-prealloc/file-1: 5 extents found
-/mnt/test/test/data-prealloc/file-2: 5 extents found
-/mnt/test/test/data-prealloc/file-1: 5 extents found
-/mnt/test/test/data-prealloc/file-2: 5 extents found
-/mnt/test/test/data-prealloc/file-1: 3 extents found
-/mnt/test/test/data-prealloc/file-2: 3 extents found
+/mnt/test/test/data-prealloc/file-1: extents: 6
+/mnt/test/test/data-prealloc/file-2: extents: 6
+/mnt/test/test/data-prealloc/file-1: extents: 6
+/mnt/test/test/data-prealloc/file-2: extents: 6
+/mnt/test/test/data-prealloc/file-1: extents: 3
+/mnt/test/test/data-prealloc/file-2: extents: 3
 == block writes into region allocs hole
 wrote blk 24
 wrote blk 32

tests/golden/format-version-forward-back

@@ -0,0 +1,4 @@
+== ensuring utils and module for old versions
+== unmounting test fs and removing test module
+== testing combinations of old and new format versions
+== restoring test module and mount

tests/golden/lock-shrink-read-race

@@ -0,0 +1,2 @@
+=== setup
+=== spin reading and shrinking

tests/golden/projects

@@ -0,0 +1,24 @@
+== default new files don't have project
+0
+== set new project on files and dirs
+8675309
+8675309
+== non-root can see id
+8675309
+== can use IDs around long width limits
+2147483647
+2147483648
+4294967295
+9223372036854775807
+9223372036854775808
+18446744073709551615
+== created files and dirs inherit project id
+8675309
+8675309
+== inheritance continues
+8675309
+== clearing project id stops inheritance
+0
+0
+== o_tmpfile creations inherit dir
+8675309

tests/golden/quota

@@ -0,0 +1,41 @@
+== prepare dir with write perm for test ids
+== test assumes starting with no rules, empty list
+== add rule
+  7 13,L,- 15,L,- 17,L,- I 33 -
+== list is empty again after delete
+== can change limits without deleting
+  1 1,L,- 1,L,- 1,L,- I 100 -
+  1 1,L,- 1,L,- 1,L,- I 101 -
+  1 1,L,- 1,L,- 1,L,- I 99 -
+== wipe and restore rules in bulk
+  7 15,L,- 0,L,- 0,L,- I 33 -
+  7 14,L,- 0,L,- 0,L,- I 33 -
+  7 13,L,- 0,L,- 0,L,- I 33 -
+  7 12,L,- 0,L,- 0,L,- I 33 -
+  7 11,L,- 0,L,- 0,L,- I 33 -
+  7 10,L,- 0,L,- 0,L,- I 33 -
+  7 15,L,- 0,L,- 0,L,- I 33 -
+  7 14,L,- 0,L,- 0,L,- I 33 -
+  7 13,L,- 0,L,- 0,L,- I 33 -
+  7 12,L,- 0,L,- 0,L,- I 33 -
+  7 11,L,- 0,L,- 0,L,- I 33 -
+  7 10,L,- 0,L,- 0,L,- I 33 -
+== default rule prevents file creation
+touch: cannot touch '/mnt/test/test/quota/dir/file': Disk quota exceeded
+== decreasing totl allows file creation again
+== attr selecting rules prevent creation
+touch: cannot touch '/mnt/test/test/quota/dir/file': Disk quota exceeded
+touch: cannot touch '/mnt/test/test/quota/dir/file': Disk quota exceeded
+== multi attr selecting doesn't prevent partial
+touch: cannot touch '/mnt/test/test/quota/dir/file': Disk quota exceeded
+== op differentiates
+== higher priority rule applies
+touch: cannot touch '/mnt/test/test/quota/dir/file': Disk quota exceeded
+== data rules with total and count prevent write and fallocate
+dd: error writing '/mnt/test/test/quota/dir/file': Disk quota exceeded
+fallocate: fallocate failed: Disk quota exceeded
+dd: error writing '/mnt/test/test/quota/dir/file': Disk quota exceeded
+fallocate: fallocate failed: Disk quota exceeded
+== added rules work after bulk restore
+touch: cannot touch '/mnt/test/test/quota/dir/file': Disk quota exceeded
+== cleanup

tests/golden/retention-basic

@@ -0,0 +1,28 @@
+== setting retention on dir fails
+attr_x ioctl failed on '/mnt/test/test/retention-basic': Invalid argument (22)
+scoutfs: set-attr-x failed: Invalid argument (22)
+== set retention
+== get-attr-x shows retention
+1
+== unpriv can't clear retention
+attr_x ioctl failed on '/mnt/test/test/retention-basic/file-1': Operation not permitted (1)
+scoutfs: set-attr-x failed: Operation not permitted (1)
+== can set hidden scoutfs xattr in retention
+== setting user. xattr fails in retention
+setfattr: /mnt/test/test/retention-basic/file-1: Operation not permitted
+== file deletion fails in retention
+rm: cannot remove '/mnt/test/test/retention-basic/file-1': Operation not permitted
+== file rename fails in retention
+mv: cannot move '/mnt/test/test/retention-basic/file-1' to '/mnt/test/test/retention-basic/file-2': Operation not permitted
+== file write fails in retention
+date: write error: Operation not permitted
+== file truncate fails in retention
+truncate: failed to truncate '/mnt/test/test/retention-basic/file-1' at 0 bytes: Operation not permitted
+== setattr fails in retention
+touch: setting times of '/mnt/test/test/retention-basic/file-1': Operation not permitted
+== clear retention
+== file write
+== file rename
+== setattr
+== xattr deletion
+== cleanup

tests/golden/setattr_more

@@ -22,10 +22,8 @@ scoutfs: setattr failed: Invalid argument (22)
 == large ctime is set
 1972-02-19 00:06:25.999999999 +0000
 == large offline extents are created
-Filesystem type is: 554f4353
-File size of /mnt/test/test/setattr_more/file is 40988672 (10007 blocks of 4096 bytes)
- ext:     logical_offset:        physical_offset: length:   expected: flags:
-   0:        0..   10006:          0..     10006:  10007:             unknown,eof
-/mnt/test/test/setattr_more/file: 1 extent found
+0: offset: 0 0 length: 10007 flags: O.L
+extents: 1
 == correct offline extent length
 976563
+== omitting data_version should not fail

tests/golden/simple-staging

@@ -1,5 +1,9 @@
 == create/release/stage single block file
+0: offset: 0 0 length: 1 flags: O.L
+extents: 1
 == create/release/stage larger file
+0: offset: 0 0 length: 4096 flags: O.L
+extents: 1
 == multiple release,drop_cache,stage cycles
 == release+stage shouldn't change stat, data seq or vers
 == stage does change meta_seq
@@ -7,16 +11,22 @@
 stage: must provide file version with --data-version
 Try `stage --help' or `stage --usage' for more information.
 == wrapped region fails
-stage returned -1, not 4096: error Invalid argument (22)
+stage returned -1, not 8192: error Invalid argument (22)
 scoutfs: stage failed: Input/output error (5)
 == non-block aligned offset fails
 stage returned -1, not 4095: error Invalid argument (22)
 scoutfs: stage failed: Input/output error (5)
+0: offset: 0 0 length: 1 flags: O.L
+extents: 1
 == non-block aligned len within block fails
 stage returned -1, not 1024: error Invalid argument (22)
 scoutfs: stage failed: Input/output error (5)
+0: offset: 0 0 length: 1 flags: O.L
+extents: 1
 == partial final block that writes to i_size does work
 == zero length stage doesn't bring blocks online
+0: offset: 0 0 length: 100 flags: O.L
+extents: 1
 == stage of non-regular file fails
 ioctl failed: Inappropriate ioctl for device (25)
 stage: must provide file version with --data-version

tests/golden/stage-release-race-alloc

@@ -1,2 +1,3 @@
 == create initial files
 == race stage and release
+== cleanup

tests/golden/xfstests

@@ -5,24 +5,44 @@ generic/004
 generic/005
 generic/006
 generic/007
+generic/008
+generic/009
 generic/011
+generic/012
 generic/013
 generic/014
+generic/015
+generic/016
+generic/018
 generic/020
+generic/021
+generic/022
 generic/023
 generic/024
+generic/025
+generic/026
 generic/028
+generic/031
 generic/032
+generic/033
 generic/034
 generic/035
 generic/037
 generic/039
 generic/040
 generic/041
+generic/050
+generic/052
 generic/053
 generic/056
 generic/057
+generic/058
+generic/059
+generic/060
+generic/061
 generic/062
+generic/063
+generic/064
 generic/065
 generic/066
 generic/067
@@ -31,42 +51,193 @@ generic/070
 generic/071
 generic/073
 generic/076
+generic/078
+generic/079
+generic/081
+generic/082
 generic/084
 generic/086
 generic/087
 generic/088
 generic/090
+generic/091
 generic/092
+generic/094
+generic/096
+generic/097
 generic/098
+generic/099
 generic/101
 generic/104
 generic/105
 generic/106
 generic/107
+generic/110
+generic/111
+generic/113
+generic/114
+generic/115
+generic/116
 generic/117
+generic/118
+generic/119
+generic/121
+generic/122
+generic/123
 generic/124
+generic/128
 generic/129
+generic/130
 generic/131
+generic/134
+generic/135
+generic/136
+generic/138
+generic/139
+generic/140
+generic/142
+generic/143
+generic/144
+generic/145
+generic/146
+generic/147
+generic/148
+generic/149
+generic/150
+generic/151
+generic/152
+generic/153
+generic/154
+generic/155
+generic/156
+generic/157
+generic/158
+generic/159
+generic/160
+generic/161
+generic/162
+generic/163
 generic/169
+generic/171
+generic/172
+generic/173
+generic/174
+generic/177
+generic/178
+generic/179
+generic/180
+generic/181
+generic/182
+generic/183
 generic/184
+generic/185
+generic/188
+generic/189
+generic/190
+generic/191
+generic/193
+generic/194
+generic/195
+generic/196
+generic/197
+generic/198
+generic/199
+generic/200
+generic/201
+generic/202
+generic/203
+generic/205
+generic/206
+generic/207
+generic/210
+generic/211
+generic/212
+generic/214
+generic/216
+generic/217
+generic/218
+generic/219
+generic/220
 generic/221
+generic/222
+generic/223
+generic/225
+generic/227
 generic/228
+generic/229
+generic/230
+generic/235
 generic/236
 generic/237
+generic/238
+generic/240
+generic/244
 generic/245
 generic/249
+generic/250
+generic/252
+generic/253
+generic/254
+generic/255
+generic/256
 generic/257
 generic/258
+generic/259
+generic/260
+generic/261
+generic/262
+generic/263
+generic/264
+generic/265
+generic/266
+generic/267
+generic/268
+generic/271
+generic/272
+generic/276
+generic/277
+generic/278
+generic/279
+generic/281
+generic/282
+generic/283
+generic/284
 generic/286
+generic/287
+generic/288
+generic/289
+generic/290
+generic/291
+generic/292
+generic/293
 generic/294
+generic/295
+generic/296
+generic/301
+generic/302
+generic/303
+generic/304
+generic/305
 generic/306
 generic/307
 generic/308
 generic/309
+generic/312
 generic/313
+generic/314
 generic/315
+generic/316
+generic/317
 generic/319
 generic/322
+generic/324
+generic/326
+generic/327
+generic/328
+generic/329
+generic/330
+generic/331
+generic/332
 generic/335
 generic/336
 generic/337
@@ -74,10 +245,255 @@ generic/341
 generic/342
 generic/343
 generic/348
+generic/353
+generic/355
+generic/358
+generic/359
 generic/360
+generic/361
+generic/362
+generic/363
+generic/364
+generic/365
+generic/366
+generic/367
+generic/368
+generic/369
+generic/370
+generic/371
+generic/372
+generic/373
+generic/374
 generic/375
 generic/376
 generic/377
+generic/378
+generic/379
+generic/380
+generic/381
+generic/382
+generic/383
+generic/384
+generic/385
+generic/386
+generic/389
+generic/391
+generic/392
+generic/393
+generic/394
+generic/395
+generic/396
+generic/397
+generic/398
+generic/400
+generic/401
+generic/402
+generic/403
+generic/404
+generic/406
+generic/407
+generic/408
+generic/412
+generic/413
+generic/414
+generic/417
+generic/419
+generic/420
+generic/421
+generic/422
+generic/424
+generic/425
+generic/426
+generic/427
+generic/436
+generic/439
+generic/440
+generic/443
+generic/445
+generic/446
+generic/448
+generic/449
+generic/450
+generic/451
+generic/453
+generic/454
+generic/456
+generic/458
+generic/460
+generic/462
+generic/463
+generic/465
+generic/466
+generic/468
+generic/469
+generic/470
+generic/471
+generic/474
+generic/477
+generic/478
+generic/479
+generic/480
+generic/481
+generic/483
+generic/485
+generic/486
+generic/487
+generic/488
+generic/489
+generic/490
+generic/491
+generic/492
+generic/498
+generic/499
+generic/501
+generic/502
+generic/503
+generic/504
+generic/505
+generic/506
+generic/507
+generic/508
+generic/509
+generic/510
+generic/511
+generic/512
+generic/513
+generic/514
+generic/515
+generic/516
+generic/517
+generic/518
+generic/519
+generic/520
+generic/523
+generic/524
+generic/525
+generic/526
+generic/527
+generic/528
+generic/529
+generic/530
+generic/531
+generic/533
+generic/534
+generic/535
+generic/536
+generic/537
+generic/538
+generic/539
+generic/540
+generic/541
+generic/542
+generic/543
+generic/544
+generic/545
+generic/546
+generic/547
+generic/548
+generic/549
+generic/550
+generic/552
+generic/553
+generic/555
+generic/556
+generic/557
+generic/566
+generic/567
+generic/571
+generic/572
+generic/573
+generic/574
+generic/575
+generic/576
+generic/577
+generic/578
+generic/580
+generic/581
+generic/582
+generic/583
+generic/584
+generic/586
+generic/587
+generic/588
+generic/591
+generic/592
+generic/593
+generic/594
+generic/595
+generic/596
+generic/597
+generic/598
+generic/599
+generic/600
+generic/601
+generic/602
+generic/603
+generic/604
+generic/605
+generic/606
+generic/607
+generic/608
+generic/609
+generic/610
+generic/611
+generic/612
+generic/613
+generic/618
+generic/621
+generic/623
+generic/624
+generic/625
+generic/626
+generic/628
+generic/629
+generic/630
+generic/632
+generic/634
+generic/635
+generic/637
+generic/639
+generic/640
+generic/644
+generic/645
+generic/646
+generic/647
+generic/651
+generic/652
+generic/653
+generic/654
+generic/655
+generic/657
+generic/658
+generic/659
+generic/660
+generic/661
+generic/662
+generic/663
+generic/664
+generic/665
+generic/666
+generic/667
+generic/668
+generic/669
+generic/673
+generic/674
+generic/675
+generic/676
+generic/677
+generic/678
+generic/679
+generic/680
+generic/681
+generic/682
+generic/683
+generic/684
+generic/685
+generic/686
+generic/687
+generic/688
+generic/689
+shared/002
+shared/032
 Not
 run:
 generic/008
@@ -251,8 +667,6 @@ generic/331
 generic/332
 generic/353
 generic/355
-generic/356
-generic/357
 generic/358
 generic/359
 generic/361
@@ -278,11 +692,174 @@ generic/383
 generic/384
 generic/385
 generic/386
-shared/001
+generic/391
+generic/392
+generic/395
+generic/396
+generic/397
+generic/398
+generic/400
+generic/402
+generic/404
+generic/406
+generic/407
+generic/408
+generic/412
+generic/413
+generic/414
+generic/417
+generic/419
+generic/420
+generic/421
+generic/422
+generic/424
+generic/425
+generic/427
+generic/439
+generic/440
+generic/446
+generic/449
+generic/450
+generic/451
+generic/453
+generic/454
+generic/456
+generic/458
+generic/462
+generic/463
+generic/465
+generic/466
+generic/468
+generic/469
+generic/470
+generic/471
+generic/474
+generic/485
+generic/487
+generic/488
+generic/491
+generic/492
+generic/499
+generic/501
+generic/503
+generic/505
+generic/506
+generic/507
+generic/508
+generic/511
+generic/513
+generic/514
+generic/515
+generic/516
+generic/517
+generic/518
+generic/519
+generic/520
+generic/528
+generic/530
+generic/536
+generic/537
+generic/538
+generic/539
+generic/540
+generic/541
+generic/542
+generic/543
+generic/544
+generic/545
+generic/546
+generic/548
+generic/549
+generic/550
+generic/552
+generic/553
+generic/555
+generic/556
+generic/566
+generic/567
+generic/572
+generic/573
+generic/574
+generic/575
+generic/576
+generic/577
+generic/578
+generic/580
+generic/581
+generic/582
+generic/583
+generic/584
+generic/586
+generic/587
+generic/588
+generic/591
+generic/592
+generic/593
+generic/594
+generic/595
+generic/596
+generic/597
+generic/598
+generic/599
+generic/600
+generic/601
+generic/602
+generic/603
+generic/605
+generic/606
+generic/607
+generic/608
+generic/609
+generic/610
+generic/612
+generic/613
+generic/621
+generic/623
+generic/624
+generic/625
+generic/626
+generic/628
+generic/629
+generic/630
+generic/635
+generic/644
+generic/645
+generic/646
+generic/647
+generic/651
+generic/652
+generic/653
+generic/654
+generic/655
+generic/657
+generic/658
+generic/659
+generic/660
+generic/661
+generic/662
+generic/663
+generic/664
+generic/665
+generic/666
+generic/667
+generic/668
+generic/669
+generic/673
+generic/674
+generic/675
+generic/677
+generic/678
+generic/679
+generic/680
+generic/681
+generic/682
+generic/683
+generic/684
+generic/685
+generic/686
+generic/687
+generic/688
+generic/689
 shared/002
-shared/003
-shared/004
 shared/032
-shared/051
-shared/289
-Passed all 79 tests
+Passed all 495 tests

tests/run-tests.sh

@@ -73,6 +73,7 @@ $(basename $0) options:
     -t        | Enabled trace events that match the given glob argument.
               | Multiple options enable multiple globbed events.
     -T <nr>   | Multiply the original trace buffer size by nr during the run.
+    -V <nr>   | Set mkfs device format version.
     -X        | xfstests git repo. Used by tests/xfstests.sh.
     -x        | xfstests git branch to checkout and track.
     -y        | xfstests ./check additional args
@@ -176,6 +177,11 @@ while true; do
 		T_TRACE_MULT="$2"
 		shift
 		;;
+	-V)
+		test -n "$2" || die "-V must have a format version argument"
+		T_MKFS_FORMAT_VERSION="-V $2"
+		shift
+		;;
 	-X)
 		test -n "$2" || die "-X requires xfstests git repo dir argument"
 		T_XFSTESTS_REPO="$2"
@@ -344,7 +350,7 @@ if [ -n "$T_MKFS" ]; then
 	done
 
 	msg "making new filesystem with $T_QUORUM quorum members"
-	cmd scoutfs mkfs -f $quo $T_DATA_ALLOC_ZONE_BLOCKS \
+	cmd scoutfs mkfs -f $quo $T_DATA_ALLOC_ZONE_BLOCKS $T_MKFS_FORMAT_VERSION \
 		"$T_META_DEVICE" "$T_DATA_DEVICE"
 fi
 
@@ -352,7 +358,8 @@ if [ -n "$T_INSMOD" ]; then
 	msg "removing and reinserting scoutfs module"
 	test -e /sys/module/scoutfs && cmd rmmod scoutfs
 	cmd modprobe libcrc32c
-	cmd insmod "$T_KMOD/src/scoutfs.ko"
+	T_MODULE="$T_KMOD/src/scoutfs.ko"
+	cmd insmod "$T_MODULE"
 fi
 
 if [ -n "$T_TRACE_MULT" ]; then
@@ -508,6 +515,7 @@ msg "running tests"
 passed=0
 skipped=0
 failed=0
+skipped_permitted=0
 for t in $tests; do
 	# tests has basenames from sequence, get path and name
 	t="tests/$t"
@@ -550,6 +558,9 @@ for t in $tests; do
 
 	printf "  %-30s $stats" "$test_name"
 
+	# mark in dmesg as to what test we are running
+	echo "run scoutfs test $test_name" > /dev/kmsg
+
 	# record dmesg before
 	dmesg | t_filter_dmesg > "$T_TMPDIR/dmesg.before"
 
@@ -611,6 +622,10 @@ for t in $tests; do
 		grep -s -v "^$test_name " "$last" > "$last.tmp"
 		echo "$test_name $stats" >> "$last.tmp"
 		mv -f "$last.tmp" "$last"
+	elif [ "$sts" == "$T_SKIP_PERMITTED_STATUS" ]; then
+		echo "  [ skipped (permitted): $message ]"
+		echo "$test_name skipped (permitted) $message " >> "$T_RESULTS/skip.log"
+		((skipped_permitted++))
 	elif [ "$sts" == "$T_SKIP_STATUS" ]; then
 		echo "  [ skipped: $message ]"
 		echo "$test_name $message" >> "$T_RESULTS/skip.log"
@@ -624,7 +639,7 @@ for t in $tests; do
 	fi
 done
 
-msg "all tests run: $passed passed, $skipped skipped, $failed failed"
+msg "all tests run: $passed passed, $skipped skipped, $skipped_permitted skipped (permitted), $failed failed"
 
 
 if [ -n "$T_TRACE_GLOB" -o -n "$T_TRACE_PRINTK" ]; then

tests/sequence

@@ -1,6 +1,7 @@
 export-get-name-parent.sh
 basic-block-counts.sh
 basic-bad-mounts.sh
+basic-posix-acl.sh
 inode-items-updated.sh
 simple-inode-index.sh
 simple-staging.sh
@@ -12,14 +13,19 @@ data-prealloc.sh
 setattr_more.sh
 offline-extent-waiting.sh
 move-blocks.sh
+projects.sh
 large-fragmented-free.sh
+format-version-forward-back.sh
 enospc.sh
 srch-safe-merge-pos.sh
 srch-basic-functionality.sh
 simple-xattr-unit.sh
+retention-basic.sh
 totl-xattr-tag.sh
+quota.sh
 lock-refleak.sh
 lock-shrink-consistency.sh
+lock-shrink-read-race.sh
 lock-pr-cw-conflict.sh
 lock-revoke-getcwd.sh
 lock-recover-invalidate.sh

tests/src/o_tmpfile_linkat.c

@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2023 Versity Software, Inc.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/stat.h>
+#include <assert.h>
+#include <limits.h>
+
+static void linkat_tmpfile(char *dir, char *lpath)
+{
+	char proc_self[PATH_MAX];
+	int ret;
+	int fd;
+
+	fd = open(dir, O_RDWR | O_TMPFILE, 0777);
+	if (fd < 0) {
+		perror("open(O_TMPFILE)");
+		exit(1);
+	}
+
+	snprintf(proc_self, sizeof(proc_self), "/proc/self/fd/%d", fd);
+
+	ret = linkat(AT_FDCWD, proc_self, AT_FDCWD, lpath, AT_SYMLINK_FOLLOW);
+	if (ret < 0) {
+		perror("linkat");
+		exit(1);
+	}
+
+	close(fd);
+}
+
+/*
+ * Use O_TMPFILE and linkat to create a new visible file, used to test
+ * the O_TMPFILE creation path by inspecting the created file.
+ */
+int main(int argc, char **argv)
+{
+	char *lpath;
+	char *dir;
+
+	if (argc < 3) {
+		printf("%s <open_dir> <linkat_path>\n", argv[0]);
+		return 1;
+	}
+
+	dir = argv[1];
+	lpath = argv[2];
+
+	linkat_tmpfile(dir, lpath);
+
+	return 0;
+}

tests/tests/basic-posix-acl.sh

@@ -0,0 +1,110 @@
+
+#
+# test basic POSIX acl functionality.
+#
+
+t_require_commands stat rm touch mkdir getfacl setfacl id sudo
+t_require_mounts 2
+
+# from quota.sh
+TEST_UID=22222
+TEST_GID=44444
+
+# sys_setreuid() set fs[uid] to e[ug]id
+SET_UID="--ruid=$TEST_UID --euid=$TEST_UID"
+SET_GID="--rgid=$TEST_GID --egid=$TEST_GID --clear-groups"
+
+# helper to avoid capturing dates from ls output
+L() {
+	stat -c "%F %A %u %g %s %N" $@
+}
+
+echo "== setup test directory"
+cd "$T_D0"
+
+echo "== getfacl"
+L .
+getfacl .
+
+echo "== basic non-acl access through permissions"
+rm -rf dir-testuid
+mkdir dir-testuid
+ln -sf dir-testuid symlinkdir-testuid
+chown root:44444 dir-testuid
+L dir-testuid
+setpriv $SET_UID $SET_GID touch dir-testuid/file-group-write
+setpriv $SET_UID $SET_GID touch symlinkdir-testuid/symlink-file-group-write
+chmod g+w dir-testuid
+setpriv $SET_UID $SET_GID touch dir-testuid/file-group-write
+setpriv $SET_UID $SET_GID touch symlinkdir-testuid/symlink-file-group-write
+L dir-testuid/file-group-write
+L symlinkdir-testuid/symlink-file-group-write
+
+echo "== basic acl access"
+rm -rf dir-root
+mkdir dir-root
+ln -sf dir-root symlinkdir-root
+L dir-root
+setpriv $SET_UID touch dir-root/file-group-write
+setpriv $SET_UID touch symlinkdir-root/file-group-write
+setfacl -m u:22222:rwx dir-root
+getfacl dir-root
+setpriv $SET_UID touch dir-root/file-group-write
+setpriv $SET_UID touch symlinkdir-root/file-group-write
+L dir-root/file-group-write
+L symlinkdir-root/file-group-write
+
+echo "== directory exec"
+setpriv $SET_UID bash -c "cd dir-root 2>&- && echo Success"
+setpriv $SET_UID bash -c "cd symlinkdir-root 2>&- && echo Success"
+setfacl -m u:22222:rw dir-root
+getfacl dir-root
+setpriv $SET_UID bash -c "cd dir-root 2>&- || echo Failed"
+setpriv $SET_UID bash -c "cd symlinkdir-root 2>&- || echo Failed"
+setfacl -m g:44444:rwx dir-root
+getfacl dir-root
+setpriv $SET_GID bash -c "cd dir-root 2>&- && echo Success"
+setpriv $SET_GID bash -c "cd symlinkdir-root 2>&- && echo Success"
+
+echo "== get/set attr"
+rm -rf file-root
+touch file-root
+L file-root
+setpriv $SET_UID getfattr -d file-root
+setpriv $SET_UID setfattr -n "user.test1" -v "Success" file-root
+setpriv $SET_UID getfattr -d file-root
+setfacl -m u:22222:rw file-root
+getfacl file-root
+setpriv $SET_UID setfattr -n "user.test2" -v "Success" file-root
+setpriv $SET_UID getfattr -d file-root
+setfacl -x u:22222 file-root
+getfacl file-root
+setpriv $SET_UID setfattr -n "user.test3" -v "Success" file-root
+setpriv $SET_UID getfattr -d file-root
+setfacl -m g:44444:rw file-root
+getfacl file-root
+setpriv $SET_GID setfattr -n "user.test4" -v "Success" file-root
+setpriv $SET_GID getfattr -d file-root
+
+echo "== inheritance / default acl"
+rm -rf dir-root2
+mkdir dir-root2
+L dir-root2
+setpriv $SET_UID mkdir dir-root2/dir
+setpriv $SET_UID touch dir-root2/dir/file
+setfacl -m d:u:22222:rwx dir-root2
+getfacl dir-root2
+setpriv $SET_UID mkdir dir-root2/dir
+setpriv $SET_UID touch dir-root2/dir/file
+setfacl -m u:22222:rwx dir-root2
+getfacl dir-root2
+setpriv $SET_UID mkdir dir-root2/dir
+setpriv $SET_UID touch dir-root2/dir/file
+L dir-root2/dir
+getfacl dir-root2/dir
+L dir-root2/dir/file
+getfacl dir-root2/dir/file
+
+echo "== cleanup"
+
+t_pass

tests/tests/basic-posix-consistency.sh

@@ -3,13 +3,13 @@
 # operations in one mount and verify the results in another.
 #
 
-t_require_commands getfattr setfattr dd filefrag diff touch stat scoutfs
+t_require_commands getfattr setfattr dd diff touch stat scoutfs
 t_require_mounts 2
 
 GETFATTR="getfattr --absolute-names"
 SETFATTR="setfattr"
 DD="dd status=none"
-FILEFRAG="filefrag -v -b4096"
+FIEMAP="scoutfs get-fiemap"
 
 echo "== root inode updates flow back and forth"
 sleep 1
@@ -55,8 +55,8 @@ for i in $(seq 1 10); do
 		conv=notrunc oflag=append &
 	wait
 done
-$FILEFRAG "$T_D0/file" | t_filter_fs > "$T_TMP.0"
-$FILEFRAG "$T_D1/file" | t_filter_fs > "$T_TMP.1"
+$FIEMAP "$T_D0/file" > "$T_TMP.0"
+$FIEMAP "$T_D1/file" > "$T_TMP.1"
 diff -u "$T_TMP.0" "$T_TMP.1"
 
 echo "== unlinked file isn't found"
@@ -210,4 +210,7 @@ done
 wait
 ls "$T_D0/concurrent"
 
+echo "== cleanup"
+rm -f "$T_TMP.0" "$T_TMP.1"
+
 t_pass

tests/tests/change-devices.sh

@@ -73,4 +73,7 @@ test "$large_tot" -gt "$equal_tot" ; echo "resized larger test rc: $?"
 umount "$SCR"
 losetup -d "$scr_loop"
 
+echo "== cleanup"
+rm -f "$T_TMP.small" "$T_TMP.equal" "$T_TMP.large"
+
 t_pass

tests/tests/client-unmount-recovery.sh

@@ -28,7 +28,7 @@ while [ "$SECONDS" -lt "$END" ]; do
         for i in $(t_fs_nrs); do
                 if [ "$i" -ge "$quorum_nr" ]; then
                         t_umount $i &
-                        echo "umount $i pid $pid quo $quorum_nr" \
+                        echo "umount $i rid $rid quo $quorum_nr" \
                                 >> $T_TMP.log
                         mounted[$i]=0
                 fi
@@ -53,6 +53,9 @@ while [ "$SECONDS" -lt "$END" ]; do
 
         for i in "${lock_arr[@]}"; do
                 if [[ ! " ${rid_arr[*]} " =~ " $i " ]]; then
+                        echo -e "RID($i) exists" >> $T_TMP.log
+                        echo -e "rid_arr:\n${rid_arr[@]}" >> $T_TMP.log
+                        echo -e "lock_arr:\n${lock_arr[@]}" >> $T_TMP.log
                         t_fail "RID($i): exists when not mounted"
                 fi
         done

tests/tests/createmany-parallel-mounts.sh

@@ -2,7 +2,7 @@
 # Test clustered parallel createmany
 #
 
-t_require_commands mkdir createmany
+t_require_commands mkdir createmany bc
 t_require_mounts 2
 
 COUNT=50000
@@ -17,14 +17,14 @@ mkdir -p $T_D0/dir/0
 mkdir $T_D1/dir/1
 
 echo "== measure initial createmany"
-START=$SECONDS
+START=$(date +%s.%N)
 createmany -o "$T_D0/file_" $COUNT >> $T_TMP.full
 sync
-SINGLE=$((SECONDS - START))
-echo single $SINGLE >> $T_TMP.full
+END=$(date +%s.%N)
+SINGLE=$(echo "$END - $START" | bc)
 
 echo "== measure two concurrent createmany runs"
-START=$SECONDS
+START=$(date +%s.%N)
 (cd $T_D0/dir/0; createmany -o ./file_ $COUNT > /dev/null) &
 pids="$!"
 (cd $T_D1/dir/1; createmany -o ./file_ $COUNT > /dev/null) &
@@ -33,7 +33,9 @@ for p in $pids; do
         wait $p
 done
 sync
-BOTH=$((SECONDS - START))
+END=$(date +%s.%N)
+BOTH=$(echo "$END - $START" | bc)
+
 echo both $BOTH >> $T_TMP.full
 
 # Multi node still adds significant overhead, even with our CW locks
@@ -44,7 +46,7 @@ echo both $BOTH >> $T_TMP.full
 # exceed this factor should the CW locked items go back to fully
 # synchronized operation.
 FACTOR=200
-if [ "$BOTH" -gt $(($SINGLE*$FACTOR)) ]; then
+if [ $(echo "$BOTH > ( $SINGLE * $FACTOR )" | bc) == "1" ]; then
 	t_fail "both createmany took $BOTH sec, more than $FACTOR x single $SINGLE sec"
 fi
 

tests/tests/data-prealloc.sh

@@ -4,7 +4,16 @@
 # merge adjacent consecutive allocations.  (we don't have multiple
 # allocation cursors)
 #
-t_require_commands scoutfs stat filefrag dd touch truncate
+t_require_commands scoutfs stat dd touch truncate
+
+get_fiemap()
+{
+	scoutfs get-fiemap "$1" | awk '($1 != "extents:") {
+			unwritten = (substr($8, 2, 1) == "U") ? "unwritten" : "";
+			eof = (substr($8, 3, 1) == "L") ? "eof" : "";
+			print $3 ".. " $6 ": " unwritten eof;
+			};'
+}
 
 write_block()
 {
@@ -76,26 +85,9 @@ print_extents_found()
 {
 	local prefix="$1"
 
-	filefrag "$prefix"* 2>&1 | grep "extent.*found" | t_filter_fs
-}
-
-#
-# print the logical start, len, and flags if they're there.
-#
-print_logical_extents()
-{
-	local file="$1"
-
-	filefrag -v -b4096 "$file" 2>&1 | t_filter_fs | awk '
-		($1 ~ /[0-9]+:/) {
-			if ($NF !~  /[0-9]+:/) {
-				flags=$NF
-			} else {
-				flags=""
-			}
-			print $2, $6, flags
-		}
-	' | sed 's/last,eof/eof/'
+	for f in "$prefix"-*; do
+		echo "$f: $(scoutfs get-fiemap "$f" | tail -n 1)" | t_filter_fs
+	done
 }
 
 t_save_all_sysfs_mount_options data_prealloc_blocks
@@ -197,7 +189,7 @@ for sides in 0 1 2 3; do
 done
 
 echo before:
-print_logical_extents "$prefix"
+get_fiemap "$prefix"
 
 # now write into the first, middle, and last empty block of each
 t_set_sysfs_mount_option 0 data_prealloc_contig_only 0
@@ -223,7 +215,7 @@ for sides in 0 1 2 3; do
 			# mid (both has 6 blocks internally)
 			2) write_block $prefix $((left + 3)) ;;
 		esac
-		print_logical_extents "$prefix"
+		get_fiemap "$prefix"
 		((base+=8))
 	done
 done

tests/tests/format-version-forward-back.sh

@@ -0,0 +1,184 @@
+#
+# Test our basic ability to work with different format versions.
+#
+# The current code being tested has a range of supported format
+# versions.   For each of the older supported format versions we have a
+# git hash of the commit before the next greater version was introduced.
+# We build versions of the scoutfs utility and kernel module for the
+# last commit in tree that had a lesser supported version as its max
+# supported version.   We use those binaries to test forward and back
+# compat as new and old code works with a persistent volume with a given
+# format version.
+#
+
+# not supported on el9!
+if [ $(source /etc/os-release ; echo ${VERSION_ID:0:1}) -gt 8 ]; then
+	t_skip_permitted "Unsupported OS version"
+fi
+
+mount_has_format_version()
+{
+	local mnt="$1"
+	local vers="$2"
+	local sysfs_fmt_vers="$(t_sysfs_path_from_mnt $SCR)/format_version"
+
+	test "$(cat $sysfs_fmt_vers)" == "$vers"
+}
+
+SCR="/mnt/scoutfs.scratch"
+
+MIN=$(modinfo $T_MODULE | awk '($1 == "scoutfs_format_version_min:"){print $2}')
+MAX=$(modinfo $T_MODULE | awk '($1 == "scoutfs_format_version_max:"){print $2}')
+
+echo "min: $MIN max: $MAX" > "$T_TMP.log"
+
+test "$MIN" -gt 0 -a "$MAX" -gt 0 -a "$MIN" -le "$MAX" || \
+	t_fail "parsed bad versions, min: $MIN max: $MAX"
+
+test "$MIN" == "$MAX" && \
+	t_skip "only one supported format version: $MIN"
+
+# prepare dir and wipe any weird old partial state
+builds="$T_RESULTS/format_version_builds"
+mkdir -p "$builds"
+
+echo "== ensuring utils and module for old versions"
+declare -A commits
+commits[1]=c3c4b080
+for vers in $(seq $MIN $((MAX - 1))); do
+	dir="$builds/$vers"
+	platform=$(uname -rp)
+	buildmark="$dir/buildmark"
+	commit="${commits[$vers]}"
+
+	test -n "$commit" || \
+		t_fail "no commit for vers $vers"
+
+	# have our files for this version
+	test "$(cat $buildmark 2>&1)" == "$platform" && \
+		continue
+
+	# build as one big sequence of commands that can return failure
+	(
+		set -o pipefail
+
+		rm -rf $dir							&&
+		mkdir -p $dir/building						&&
+		cd "$T_TESTS/.."						&&
+		git archive --format=tar "$commit" | tar -C "$dir/building" -xf - &&
+		cd -								&&
+		find $dir							&&
+		make -C "$dir/building"						&&
+		mv $dir/building/utils/src/scoutfs $dir				&&
+		mv $dir/building/kmod/src/scoutfs.ko $dir			&&
+		rm -rf $dir/building						&&
+		echo "$platform" > $buildmark					&&
+		find $dir							&&
+		cat $buildmark
+	) >> "$T_TMP.log" 2>&1 || t_fail "version $vers build failed"
+done
+
+echo "== unmounting test fs and removing test module"
+t_quiet t_umount_all
+t_quiet rmmod scoutfs
+
+echo "== testing combinations of old and new format versions"
+mkdir -p "$SCR"
+for vers in $(seq $MIN $((MAX - 1))); do
+	old_scoutfs="$builds/$vers/scoutfs"
+	old_module="$builds/$vers/scoutfs.ko"
+
+	echo "mkfs $vers" >> "$T_TMP.log"
+	t_quiet $old_scoutfs mkfs -f -Q 0,127.0.0.1,53000 "$T_EX_META_DEV" "$T_EX_DATA_DEV" \
+		|| t_fail "mkfs $vers failed"
+
+	echo "mount $vers with $vers" >> "$T_TMP.log"
+	t_quiet insmod $old_module
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$vers"
+
+	echo "creating files in $vers" >> "$T_TMP.log"
+	t_quiet touch "$SCR/file-"{1,2,3}
+	stat "$SCR"/file-* > "$T_TMP.stat" || \
+		t_fail "stat in $vers failed"
+
+	echo "remounting $vers fs with $MAX" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+	insmod "$T_MODULE"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$vers"
+
+	echo "verifying stat in $vers with $MAX" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "keep/update/del existing, create new in $vers" >> "$T_TMP.log"
+	t_quiet touch "$SCR/file-2"
+	t_quiet rm -f "$SCR/file-3"
+	t_quiet touch "$SCR/file-4"
+	stat "$SCR"/file-* > "$T_TMP.stat" || \
+		t_fail "stat in $vers failed"
+
+	echo "remounting $vers fs with $vers" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+	insmod "$old_module"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$vers"
+
+	echo "verifying stat in $vers with $vers" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "changing format vers to $MAX" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+	t_quiet scoutfs change-format-version -F -V $MAX $T_EX_META_DEV "$T_EX_DATA_DEV"
+
+	echo "mount fs $MAX with old $vers should fail" >> "$T_TMP.log"
+	insmod "$old_module"
+	mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR" >> "$T_TMP.log" 2>&1
+	if [ "$?" == "0" ]; then
+		umount "$SCR"
+		t_fail "old code ver $vers able to mount new ver $MAX"
+	fi
+
+	echo "remounting $MAX fs with $MAX" >> "$T_TMP.log"
+	rmmod scoutfs
+	insmod "$T_MODULE"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$MAX"
+
+	echo "verifying stat in $MAX with $MAX" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "keep/update/del existing, create new in $MAX" >> "$T_TMP.log"
+	t_quiet touch "$SCR/file-2"
+	t_quiet rm -f "$SCR/file-4"
+	t_quiet touch "$SCR/file-5"
+	stat "$SCR"/file-* > "$T_TMP.stat" || \
+		t_fail "stat in $MAX failed"
+
+	echo "remounting $MAX fs with $MAX again" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	t_quiet mount -t scoutfs -o metadev_path=$T_EX_META_DEV,quorum_slot_nr=0 \
+		"$T_EX_DATA_DEV" "$SCR"
+	t_quiet mount_has_format_version "$SCR" "$MAX"
+
+	echo "verifying stat in $MAX with $MAX again" >> "$T_TMP.log"
+	diff -u "$T_TMP.stat" <(stat "$SCR"/file-*)
+
+	echo "done with old vers $vers" >> "$T_TMP.log"
+	t_quiet umount "$SCR"
+	rmmod scoutfs
+done
+
+echo "== restoring test module and mount"
+insmod "$T_MODULE"
+t_mount_all
+
+t_pass

tests/tests/lock-shrink-read-race.sh

@@ -0,0 +1,40 @@
+#
+# We had a lock server refcounting bug that could let one thread get a
+# reference on a lock struct that was being freed by another thread.  We
+# were able to reproduce this by having all clients try and produce a
+# lot of read and null requests.
+#
+# This will manfiest as a hung lock and timed out test runs, probably
+# with hung task messages on the console.  Depending on how the race
+# turns out, it can trigger KASAN warnings in
+# process_waiting_requests().
+#
+
+READERS_PER=3
+SECS=30
+
+echo "=== setup"
+touch "$T_D0/file"
+
+echo "=== spin reading and shrinking"
+END=$((SECONDS + SECS))
+for m in $(t_fs_nrs); do
+	eval file="\$T_D${m}/file"
+
+	# lots of tasks reading as fast as they can
+	for t in $(seq 1 $READERS_PER); do
+		(while [ $SECONDS -lt $END ]; do
+			stat $file > /dev/null
+		 done) &
+	done
+	# one task shrinking (triggering null requests) and reading
+	(while [ $SECONDS -lt $END ]; do
+		stat $file > /dev/null
+		t_trigger_arm_silent statfs_lock_purge $m
+		stat -f "$file" > /dev/null
+	 done) &
+done
+
+wait
+
+t_pass

tests/tests/move-blocks.sh

@@ -83,9 +83,9 @@ touch "$OTHER"
 ln "$FROM" "$HARD"
 
 echo "== wrapped offsets should fail"
-HUGE=0x8000000000000000
-scoutfs move-blocks "$FROM" -f "$HUGE" -l "$HUGE" "$TO" -t 0 2>&1 | t_filter_fs
-scoutfs move-blocks "$FROM" -f 0 -l "$HUGE" "$TO" -t "$HUGE" 2>&1 | t_filter_fs
+HUGE=0xfffffffffffff000
+scoutfs move-blocks "$FROM" -f "$HUGE" -l "8192" "$TO" -t 0 2>&1 | t_filter_fs
+scoutfs move-blocks "$FROM" -f 0 -l "$HUGE" "$TO" -t "8192" 2>&1 | t_filter_fs
 
 echo "== specifying same file fails"
 scoutfs move-blocks "$FROM" -f 0 -l "$BS" "$HARD" -t 0 2>&1 | t_filter_fs

tests/tests/projects.sh

@@ -0,0 +1,52 @@
+
+# notable id to recognize in output
+ID=8675309
+
+echo "== default new files don't have project"
+touch "$T_D0/file"
+scoutfs get-attr-x -p "$T_D0/file"
+
+echo "== set new project on files and dirs"
+mkdir "$T_D0/dir"
+scoutfs set-attr-x -p $ID "$T_D0/file"
+scoutfs set-attr-x -p $ID "$T_D0/dir"
+scoutfs get-attr-x -p "$T_D0/file"
+scoutfs get-attr-x -p "$T_D0/dir"
+
+echo "== non-root can see id"
+chmod 644 "$T_D0/file"
+setpriv --ruid=12345 --euid=12345 scoutfs get-attr-x -p "$T_D0/file"
+
+echo "== can use IDs around long width limits"
+touch "$T_D0/ids"
+for id in         0x7FFFFFFF         0x80000000         0xFFFFFFFF \
+          0x7FFFFFFFFFFFFFFF 0x8000000000000000 0xFFFFFFFFFFFFFFFF; do
+	scoutfs set-attr-x -p $id "$T_D0/ids"
+	scoutfs get-attr-x -p "$T_D0/ids"
+done
+
+echo "== created files and dirs inherit project id"
+touch "$T_D0/dir/file"
+mkdir "$T_D0/dir/sub"
+scoutfs get-attr-x -p "$T_D0/dir/file"
+scoutfs get-attr-x -p "$T_D0/dir/sub"
+
+echo "== inheritance continues"
+mkdir "$T_D0/dir/sub/more"
+scoutfs get-attr-x -p "$T_D0/dir/sub/more"
+
+# .. just inherits 0 :) 
+echo "== clearing project id stops inheritance"
+scoutfs set-attr-x -p 0 "$T_D0/dir"
+touch "$T_D0/dir/another-file"
+mkdir "$T_D0/dir/another-sub"
+scoutfs get-attr-x -p "$T_D0/dir/another-file"
+scoutfs get-attr-x -p "$T_D0/dir/another-sub"
+
+echo "== o_tmpfile creations inherit dir"
+scoutfs set-attr-x -p $ID "$T_D0/dir"
+o_tmpfile_linkat "$T_D0/dir" "$T_D0/dir/tmpfile"
+scoutfs get-attr-x -p "$T_D0/dir/tmpfile"
+
+
+t_pass

tests/tests/quota.sh

@@ -0,0 +1,153 @@
+
+TEST_UID=22222
+TEST_GID=44444
+
+# sys_setreuid() set fs[uid] to e[ug]id
+SET_UID="--ruid=$TEST_UID --euid=$TEST_UID"
+SET_GID="--rgid=$TEST_GID --egid=$TEST_GID --clear-groups"
+
+FILE="$T_D0/dir/file"
+
+sync_and_drop()
+{
+	sync
+	echo 1 > $(t_debugfs_path)/drop_weak_item_cache
+	echo 1 > $(t_debugfs_path)/drop_quota_check_cache
+}
+
+reset_all()
+{
+	rm -f "$FILE"
+	scoutfs quota-wipe -p "$T_M0"
+	getfattr --absolute-names -d -m - "$T_D0" | \
+		grep "^scoutfs.totl." | \
+		cut -d '=' -f 1 | \
+		xargs -I'{}'  setfattr -x '{}' "$T_D0"
+}
+
+echo "== prepare dir with write perm for test ids"
+mkdir "$T_D0/dir"
+chown --quiet $TEST_UID "$T_D0/dir"
+chgrp --quiet $TEST_GID "$T_D0/dir"
+
+echo "== test assumes starting with no rules, empty list"
+scoutfs quota-list -p "$T_M0"
+
+echo "== add rule"
+scoutfs quota-add -p "$T_M0" -r "7 13,L,- 15,L,- 17,L,- I 33 -"
+scoutfs quota-list -p "$T_M0"
+
+echo "== list is empty again after delete"
+scoutfs quota-del -p "$T_M0" -r "7 13,L,- 15,L,- 17,L,- I 33 -"
+scoutfs quota-list -p "$T_M0"
+
+echo "== can change limits without deleting"
+scoutfs quota-add -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 100 -"
+scoutfs quota-list -p "$T_M0"
+scoutfs quota-add -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 101 -"
+scoutfs quota-del -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 100 -"
+scoutfs quota-list -p "$T_M0"
+scoutfs quota-add -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 99 -"
+scoutfs quota-del -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 101 -"
+scoutfs quota-list -p "$T_M0"
+scoutfs quota-del -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 99 -"
+reset_all
+
+echo "== wipe and restore rules in bulk"
+for a in $(seq 10 15); do
+	scoutfs quota-add -p "$T_M0" -r "7 $a,L,- 0,L,- 0,L,- I 33 -"
+done
+scoutfs quota-list -p "$T_M0"
+scoutfs quota-list -p "$T_M0" > "$T_TMP.list"
+scoutfs quota-wipe -p "$T_M0"
+scoutfs quota-list -p "$T_M0"
+scoutfs quota-restore -p "$T_M0" < "$T_TMP.list"
+scoutfs quota-list -p "$T_M0"
+reset_all
+
+echo "== default rule prevents file creation"
+scoutfs quota-add -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- I 1 -"
+setfattr -n scoutfs.totl.test.1.1.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE" 2>&1 | t_filter_fs
+
+echo "== decreasing totl allows file creation again"
+setfattr -x scoutfs.totl.test.1.1.1 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE"
+reset_all
+
+echo "== attr selecting rules prevent creation"
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_UID,U,S 1,L,- 1,L,- I 1 -"
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_GID,G,S 1,L,- 1,L,- I 1 -"
+setfattr -n scoutfs.totl.test.$TEST_UID.1.1 -v 2 "$T_D0"
+setfattr -n scoutfs.totl.test.$TEST_GID.1.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE" 2>&1 | t_filter_fs
+setpriv $SET_GID touch "$FILE" 2>&1 | t_filter_fs
+reset_all
+
+echo "== multi attr selecting doesn't prevent partial"
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_UID,U,S $TEST_GID,G,S 1,L,- I 1 -"
+setfattr -n scoutfs.totl.test.$TEST_UID.$TEST_GID.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE"
+rm -f "$FILE"
+setpriv $SET_GID touch "$FILE"
+rm -f "$FILE"
+setpriv $SET_UID $SET_GID touch "$FILE" 2>&1 | t_filter_fs
+reset_all
+
+echo "== op differentiates"
+# inode ops succeed in presence of data rule
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_UID,U,S 1,L,- 1,L,- D 1 -"
+setfattr -n scoutfs.totl.test.$TEST_UID.1.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE" 2>&1 | t_filter_fs
+reset_all
+# data ops succeed in presence of inode rule
+touch "$FILE"
+chown --quiet $TEST_UID "$FILE"
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_UID,U,S 1,L,- 1,L,- I 1 -"
+setfattr -n scoutfs.totl.test.$TEST_UID.1.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID fallocate -l 4096 "$FILE" 2>&1 | t_filter_fs
+reset_all
+
+echo "== higher priority rule applies"
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_UID,U,S 1,L,- 1,L,- I 1000 -"
+scoutfs quota-add -p "$T_M0" -r "2 $TEST_UID,U,S 1,L,- 1,L,- I 1 -"
+setfattr -n scoutfs.totl.test.$TEST_UID.1.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE" 2>&1 | t_filter_fs
+reset_all
+
+echo "== data rules with total and count prevent write and fallocate" 
+touch "$FILE"
+scoutfs quota-add -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- D 1 -"
+setfattr -n scoutfs.totl.test.1.1.1 -v 2 "$T_D0"
+sync_and_drop
+dd if=/dev/zero of="$FILE" bs=4096 count=1 conv=notrunc status=none 2>&1 | t_filter_fs
+fallocate -l 4096 "$FILE" 2>&1 | t_filter_fs
+scoutfs quota-del -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- D 1 -"
+scoutfs quota-add -p "$T_M0" -r "1 1,L,- 1,L,- 1,L,- D 0 C"
+sync_and_drop
+dd if=/dev/zero of="$FILE" bs=4096 count=1 conv=notrunc status=none 2>&1 | t_filter_fs
+fallocate -l 4096 "$FILE" 2>&1 | t_filter_fs
+reset_all
+
+echo "== added rules work after bulk restore"
+seq -f "  1 %.0f,U,S 1,L,- 1,L,- I 1 -" 9000050000 -1 9000000000 > "$T_TMP.lots"
+scoutfs quota-restore -p "$T_M0" < "$T_TMP.lots"
+scoutfs quota-list -p "$T_M0" > "$T_TMP.list"
+diff -u "$T_TMP.lots" "$T_TMP.list"
+scoutfs quota-add -p "$T_M0" -r "1 $TEST_UID,U,S 1,L,- 1,L,- I 1 -"
+setfattr -n scoutfs.totl.test.$TEST_UID.1.1 -v 2 "$T_D0"
+sync_and_drop
+setpriv $SET_UID touch "$FILE" 2>&1 | t_filter_fs
+reset_all
+
+echo "== cleanup"
+rm -f "$T_TMP.lots" "$T_TMP.list"
+
+t_pass

tests/tests/retention-basic.sh

@@ -0,0 +1,57 @@
+t_require_commands scoutfs touch rm setfattr
+
+touch "$T_D0/file-1"
+
+echo "== setting retention on dir fails"
+scoutfs set-attr-x -t 1 "$T_D0" 2>&1 | t_filter_fs
+
+echo "== set retention"
+scoutfs set-attr-x -t 1 "$T_D0/file-1"
+
+echo "== get-attr-x shows retention"
+scoutfs get-attr-x -t "$T_D0/file-1"
+
+echo "== unpriv can't clear retention"
+setpriv --ruid=12345 --euid=12345 scoutfs set-attr-x -t 0 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== can set hidden scoutfs xattr in retention"
+setfattr -n scoutfs.hide.srch.retention_test -v val "$T_D0/file-1"
+
+echo "== setting user. xattr fails in retention"
+setfattr -n user.retention_test -v val "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== file deletion fails in retention"
+rm -f "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== file rename fails in retention"
+mv $T_D0/file-1 $T_D0/file-2 2>&1 | t_filter_fs
+
+echo "== file write fails in retention"
+date >> $T_D0/file-1
+
+echo "== file truncate fails in retention"
+truncate -s 0 $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== setattr fails in retention"
+touch $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== clear retention"
+scoutfs set-attr-x -t 0 "$T_D0/file-1"
+
+echo "== file write"
+date >> $T_D0/file-1
+
+echo "== file rename"
+mv $T_D0/file-1 $T_D0/file-2
+mv $T_D0/file-2 $T_D0/file-1
+
+echo "== setattr"
+touch $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== xattr deletion"
+setfattr -x scoutfs.hide.srch.retention_test "$T_D0/file-1"
+
+echo "== cleanup"
+rm -f "$T_D0/file-1"
+
+t_pass

tests/tests/setattr_more.sh

@@ -2,7 +2,7 @@
 # Test correctness of the setattr_more ioctl.
 #
 
-t_require_commands filefrag scoutfs touch mkdir rm stat mknod
+t_require_commands scoutfs touch mkdir rm stat mknod
 
 FILE="$T_D0/file"
 
@@ -55,17 +55,10 @@ scoutfs setattr -t 67305985.999999999 -V 1 -s 1 "$FILE" 2>&1 | t_filter_fs
 TZ=GMT stat -c "%z" "$FILE"
 rm "$FILE"
 
-#
-# With e2fsprogs-v1.42.10-10-g29758d2f, the output of filefrag 'flags' changes
-# significantly. First, the _LAST flag is now output. Second, the 'unknown'
-# flag is now printed out as 'unknown_loc'. To compensate for this, we check
-# and replace the "correct" output for new versions here with the expected
-# value.
-#
 echo "== large offline extents are created"
 touch "$FILE"
 scoutfs setattr -V 1 -o -s $((10007 * 4096)) "$FILE" 2>&1 | t_filter_fs
-filefrag -v -b4096 "$FILE" 2>&1 | sed 's/last,unknown_loc,eof$/unknown,eof/' | t_filter_fs
+scoutfs get-fiemap "$FILE"
 rm "$FILE"
 
 # had a bug where we were creating extents that were too long
@@ -75,4 +68,11 @@ scoutfs setattr -V 1 -o -s 4000000000 "$FILE" 2>&1 | t_filter_fs
 scoutfs stat -s offline_blocks "$FILE"
 rm "$FILE"
 
+# Do not fail if data_version is unset - the unset `0` value should not
+# be passed down to attr_x handling code which will -EINVAL on that.
+echo "== omitting data_version should not fail"
+touch "$FILE"
+scoutfs setattr -s 0 -t 1725670311.0 -r 1725670311.0 "$FILE"
+rm "$FILE"
+
 t_pass

tests/tests/simple-release-extents.sh

@@ -7,6 +7,7 @@ t_require_commands xfs_io filefrag scoutfs mknod
 # this test wants to ignore unwritten extents
 fiemap_file() {
 	filefrag -v -b4096 "$1" | grep -v "unwritten"
+	scoutfs get-fiemap "$1" | grep -v 'flags:.*U'
 }
 
 create_file() {
@@ -61,7 +62,10 @@ echo "== release past i_size is fine"
 release_vers "$FILE" stat 400K 4K
 
 echo "== wrapped blocks fails"
-release_vers "$FILE" stat $vers 0x8000000000000000 0x8000000000000000
+# just under!
+release_vers "$FILE" stat $vers 0xfffffffffffff000 4096
+# this goes over
+release_vers "$FILE" stat $vers 0xfffffffffffff000 8192
 
 echo "== releasing non-file fails"
 mknod "$CHAR" c 1 3
@@ -105,25 +109,20 @@ for c in $(seq 0 4); do
 		fi
 	done
 
-	start=$(fiemap_file "$FILE" | \
-		awk '($1 == "0:"){print substr($4, 0, length($4)- 2)}')
-
 	release_vers "$FILE" stat $(($a * 4))K 4K
 	release_vers "$FILE" stat $(($b * 4))K 4K
 	release_vers "$FILE" stat $(($c * 4))K 4K
 
 	echo -n "$a $b $c:"
 
-	fiemap_file "$FILE" | \
-		awk 'BEGIN{ORS=""}($1 == (NR - 4)":") {
-			off=substr($2, 0, length($2)- 2);
-			phys=substr($4, 0, length($4)- 2);
-			if (phys > 100) {
-				phys = phys - phys + 100 + off;
-			}
-			len=substr($6, 0, length($6)- 1);
-			print "  (" off, phys, len ")";
-		}'
+	scoutfs get-fiemap "$FILE" | \
+		awk 'BEGIN{ORS=""}($1 != "extents:") {
+			off=$3;
+			len=$6;
+			phys=substr($8, 0, 1);
+			phys = (phys == ".") ? off + 100 : 0;
+			print "  (" off, phys, len ")"
+		};'
 	echo
 
 	rm "$FILE"

tests/tests/simple-staging.sh

@@ -2,11 +2,7 @@
 # Test correctness of the staging operation
 #
 
-t_require_commands filefrag dd scoutfs cp cmp rm
-
-fiemap_file() {
-	filefrag -v -b4096 "$1"
-}
+t_require_commands dd scoutfs cp cmp rm
 
 create_file() {
 	local file="$1"
@@ -62,7 +58,7 @@ create_file "$FILE" 4096
 cp "$FILE"  "$T_TMP"
 release_vers "$FILE" stat 0 4K
 # make sure there only offline extents
-fiemap_file "$FILE" | grep "^[ 0-9]*:" | grep -v "unknown"
+scoutfs get-fiemap "$FILE"
 stage_vers "$FILE" stat 0 4096 "$T_TMP"
 cmp "$FILE" "$T_TMP"
 rm -f "$FILE"
@@ -72,7 +68,7 @@ create_file "$FILE" $((4096 * 4096))
 cp "$FILE"  "$T_TMP"
 release_vers "$FILE" stat 0 16M
 # make sure there only offline extents
-fiemap_file "$FILE" | grep "^[ 0-9]*:" | grep -v "unknown"
+scoutfs get-fiemap "$FILE"
 stage_vers "$FILE" stat 0 $((4096 * 4096)) "$T_TMP"
 cmp "$FILE" "$T_TMP"
 rm -f "$FILE"
@@ -143,8 +139,8 @@ hexdump -C "$FILE"
 rm -f "$FILE"
 
 echo "== wrapped region fails"
-create_file "$FILE" 4096
-stage_vers "$FILE" stat 0xFFFFFFFFFFFFF000 4096 /dev/zero
+create_file "$FILE" 8192
+stage_vers "$FILE" stat 0xFFFFFFFFFFFFF000 8192 /dev/zero
 rm -f "$FILE"
 
 echo "== non-block aligned offset fails"
@@ -152,7 +148,7 @@ create_file "$FILE" 4096
 cp "$FILE"  "$T_TMP"
 release_vers "$FILE" stat 0 4K
 stage_vers "$FILE" stat 1 4095 "$T_TMP"
-fiemap_file "$FILE" | grep "^[ 0-9]*:" | grep -v "unknown"
+scoutfs get-fiemap "$FILE"
 rm -f "$FILE"
 
 echo "== non-block aligned len within block fails"
@@ -160,7 +156,7 @@ create_file "$FILE" 4096
 cp "$FILE"  "$T_TMP"
 release_vers "$FILE" stat 0 4K
 stage_vers "$FILE" stat 0 1024 "$T_TMP"
-fiemap_file "$FILE" | grep "^[ 0-9]*:" | grep -v "unknown"
+scoutfs get-fiemap "$FILE"
 rm -f "$FILE"
 
 echo "== partial final block that writes to i_size does work"
@@ -175,7 +171,7 @@ echo "== zero length stage doesn't bring blocks online"
 create_file "$FILE" $((4096 * 100))
 release_vers "$FILE" stat 0 400K
 stage_vers "$FILE" stat 4096 0 /dev/zero
-fiemap_file "$FILE" | grep "^[ 0-9]*:" | grep -v "unknown"
+scoutfs get-fiemap "$FILE"
 rm -f "$FILE"
 
 # XXX yup, needs to be updated for demand staging

tests/tests/stage-release-race-alloc.sh

@@ -62,4 +62,7 @@ for r in $(seq 1 1000); do
 	done
 done
 
+echo "== cleanup"
+rm -f "$T_TMP.log"
+
 t_pass

tests/tests/totl-xattr-tag.sh

@@ -3,6 +3,7 @@ t_require_commands touch rm setfattr scoutfs find_xattrs
 read_xattr_totals()
 {
 	sync
+	echo 1 > $(t_debugfs_path)/drop_weak_item_cache
 	scoutfs read-xattr-totals -p "$T_M0"
 }
 
@@ -112,7 +113,6 @@ for phase in create update remove; do
 				echo "$k.0.0 = ${totals[$k]}, ${counts[$k]}"
 			  done ) | grep -v "= 0, 0$" | sort -n >> $T_TMP.check_arr
 
-			sync
 			read_xattr_totals | sort -n >> $T_TMP.check_read
 
 			diff -u $T_TMP.check_arr $T_TMP.check_read || \

tests/tests/xfstests.sh

@@ -30,8 +30,13 @@ t_quiet mkdir -p "$T_TMPDIR/mnt.scratch"
 t_quiet cd "$T_XFSTESTS_REPO"
 if [ -z "$T_SKIP_CHECKOUT" ]; then
 	t_quiet git fetch
+	# if we're passed a tag instead of a branch, we can't --track
+	TRACK="--track"
+	if git tag -l | grep -q "$T_XFSTESTS_BRANCH" ; then
+		TRACK=""
+	fi
 	# this remote use is bad, do better
-	t_quiet git checkout -B "$T_XFSTESTS_BRANCH" --track "origin/$T_XFSTESTS_BRANCH"
+	t_quiet git checkout -B "$T_XFSTESTS_BRANCH" ${TRACK} "origin/$T_XFSTESTS_BRANCH"
 fi
 t_quiet make
 t_quiet sync
@@ -81,6 +86,45 @@ generic/325	# mmap missing
 generic/338	# BUG_ON update inode error handling
 generic/346	# mmap missing
 generic/347	# _dmthin_mount doesn't work?
+generic/356	# swap
+generic/357	# swap
+generic/409	# bind mounts not scripted yet
+generic/410	# bind mounts not scripted yet
+generic/411	# bind mounts not scripted yet
+generic/423	# symlink inode size is strlen() + 1 on scoutfs
+generic/428	# mmap missing
+generic/430	# xfs_io copy_range missing in el7
+generic/431	# xfs_io copy_range missing in el7
+generic/432	# xfs_io copy_range missing in el7
+generic/433	# xfs_io copy_range missing in el7
+generic/434	# xfs_io copy_range missing in el7
+generic/437	# mmap missing
+generic/441	# dm-mapper
+generic/444	# el9's posix_acl_update_mode is buggy ?
+generic/452	# exec test - no mmap
+generic/467	# open_by_handle ESTALE
+generic/472	# swap
+generic/484	# dm-mapper
+generic/493	# swap
+generic/494	# swap
+generic/495	# swap
+generic/496	# swap
+generic/497	# swap
+generic/532	# xfs_io statx attrib_mask missing in el7
+generic/554	# swap
+generic/563	# cgroup+loopdev
+generic/564	# xfs_io copy_range missing in el7
+generic/565	# xfs_io copy_range missing in el7
+generic/568	# falloc not resulting in block count increase
+generic/569	# swap
+generic/570	# swap
+generic/614	# mmap missing
+generic/620	# dm-hugedisk
+generic/633	# mmap, id-mapped mounts missing in el7
+generic/636	# swap
+generic/638	# mmap missing
+generic/641	# swap
+generic/643	# swap
 EOF
 
 t_restore_output

utils/man/scoutfs.5

@@ -270,6 +270,21 @@ metadata that is bound to a specific volume and should not be
 transferred with the file by tools that read extended attributes, like
 .BR tar(1) .
 .TP
+.B .indx.
+Attributes with the .indx. tag dd the inode containing the attribute to
+a filesystem-wide index.  The name of the extended attribute must end
+with strings representing two values separated by dots.  The first value
+is an unsigned 8bit value and the second is an unsigned 64bit value.
+These attributes can only be modified with root privileges and the
+attributes can not have a value.
+.sp
+The inodes in the index are stored in increasing sort order of the
+values, with the first u8 value being most significant.  Inodes can be
+at many positions as tracked by many extended attributes, and their
+position follows the creation, renaming, or deletion of the attributes.
+The index can be read with the read-xattr-index command which uses the
+underlying READ_XATTR_INDEX ioctl.
+.TP
 .B .srch.
 Attributes with the .srch. tag are indexed so that they can be
 found by the
@@ -295,6 +310,36 @@ with the
 ioctl.
 .RE
 
+.SH FILE RETENTION MODE
+A file can be set to retention mode by setting the
+.IB RETENTION
+attribute with the
+.IB SET_ATTR_X
+ioctl.  This flag can only be set on regular files and requires root
+permission (the
+.IB CAP_SYS_ADMIN
+capability).
+.sp
+Once in retention mode all modifications of the file will fail.  The
+only exceptions are that system extended attributes (all those without
+the "user." prefix) may be modified.  The retention bit may be cleared
+with sufficient priveledges to remove the retention restrictions on
+other modifications.
+.RE
+
+.SH PROJECT IDs
+All inodes have a project ID attribute that can be set via the
+SET_ATTR_X ioctl and displayed with the GET_ATTR_X ioctl.  Project IDs
+are an unsigned 64bit value and the value of 0 is reserved to indicate
+that no project ID is assigned.   If a project ID is set on a directory
+then all inodes created with it as the initial parent inheret that ID,
+for all file types.  This includes files initially unlinked from the
+namespace when created with O_TMPFILE.  Project IDs are only
+automatically inherited from the parent dir on initial creation.
+They're not changed as directory entry linkes to the inode are created
+or renamed.
+.RE
+
 .SH FORMAT VERSION
 The format version defines the layout and use of structures stored on
 devices and passed over the network.  The version is incremented for
@@ -373,6 +418,19 @@ The version that a mount is using is shown in the
 file in the mount's sysfs directory, typically
 .I /sys/fs/scoutfs/f.FSID.r.RID/
 .RE
+.sp
+The defined format versions are:
+.RS
+.TP
+.sp
+.B 1
+Initial format version.
+.TP
+.B 2
+Added retention mode by setting the retention attribute.  Added the
+project ID inode attribute.  Added quota rules and enforcement.  Added
+the .indx. extended attribute tag.
+.RE
 
 .SH CORRUPTION DETECTION
 A

utils/man/scoutfs.8

@@ -209,6 +209,16 @@ A path within a ScoutFS filesystem.
 .RE
 .PD
 
+.TP
+.BI "get-attr-x FILE"
+.sp
+Display ScoutFS-specific attributes from a file.  If no options are
+given than all the attributes that the command supports will be
+displayed.  If attributes are specified with options then only those
+attributes are displayed.  If only one attribute is specified then it
+will not have a label prefix in the display output.  The --help option
+will list the attributes that the command supports.  The file system may
+support a different set of attributes.
 .TP
 .BI "get-referring-entries [-p|--path PATH] INO"
 .sp
@@ -506,6 +516,15 @@ A path within a ScoutFS filesystem.
 .RE
 .PD
 
+.TP
+.BI "set-attr-x FILE"
+.sp
+Set ScoutFS-specific attributes on a file.  Only the attributes that are
+spcified by options will be set.  The --help option will list the
+attributes that the command understands.  The file system may support a
+different set of attributes.
+.PD
+
 .TP
 .BI "setattr FILE [-d, --data-version=VERSION [-s, --size=SIZE [-o, --offline]]] [-t, --ctime=TIMESPEC]"
 .sp

utils/sparse.sh

@@ -37,10 +37,23 @@ search=$(gcc -print-search-dirs | awk '($1 == "install:"){print "-I" $2}')
 #
 # We're trying to use sparse against glibc headers which go wild trying to
 # use internal compiler macros to test features.  We copy gcc's and give
-# them to sparse.  But not __SIZE_TYPE__ 'cause sparse defines that one.
+# them to sparse, but not the ones that sparse already has.
 #
-defines=".sparse.gcc-defines.h"
-gcc -dM -E -x c - < /dev/null | grep -v __SIZE_TYPE__ > $defines
+defines=".sparse.gcc-defines.$$.h"
+awk '
+	# save defines from gcc
+	( FNR == NR ) { lines[$2]=$0 }
+
+	# delete defines that sparse also has
+	( FNR < NR ) { delete lines[$2] }
+
+	# dump remaining lines unique to gcc
+	END {
+		for (a in lines) {
+			print lines[a]
+		}
+	}
+' <(gcc -dM -E -x c - < /dev/null) <(sparse -dM -E -x c - < /dev/null) > $defines
 include="-include $defines"
 
 #
@@ -54,6 +67,9 @@ else
 fi
 
 sparse $m64 $include $search/include "$@" 2>&1 | egrep -v "($RE)" | tee .sparse.output
+
+rm -f $defines
+
 if  [ -s .sparse.output ]; then
 	exit 1
 else

utils/src/attr_x.c

@@ -0,0 +1,304 @@
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <string.h>
+#include <assert.h>
+#include <argp.h>
+#include <stdbool.h>
+
+#include "sparse.h"
+#include "util.h"
+#include "format.h"
+#include "ioctl.h"
+#include "parse.h"
+#include "cmd.h"
+
+struct attr_x_args {
+	bool set;
+	char *filename;
+	struct scoutfs_ioctl_inode_attr_x iax;
+};
+
+#define pr(iax, name, label, fmt, args...)			\
+do {								\
+	if ((iax->x_mask & SCOUTFS_IOC_IAX_##name)) {		\
+		if (__builtin_popcount(iax->x_mask) > 1)	\
+			printf(label ": " fmt "\n", ##args);	\
+		else						\
+			printf(fmt "\n", ##args);		\
+	}							\
+} while (0)
+
+#define prb(iax, name, label) \
+	pr(iax, name, label, "%u", !!((iax)->bits & SCOUTFS_IOC_IAX_B_##name))
+
+static int do_attr_x(struct attr_x_args *args)
+{
+	struct scoutfs_ioctl_inode_attr_x *iax = &args->iax;
+	int fd = -1;
+	int ret;
+	int op;
+
+	if (args->set) {
+		/* nothing to do if not setting */
+		if (iax->x_mask == 0)
+			return 0;
+		op = SCOUTFS_IOC_SET_ATTR_X;
+	} else {
+		/* get all known if none specified */
+		if (iax->x_mask == 0)
+			iax->x_mask = ~SCOUTFS_IOC_IAX__UNKNOWN;
+		op = SCOUTFS_IOC_GET_ATTR_X;
+	}
+
+	fd = open(args->filename, O_RDONLY);
+	if (fd < 0) {
+		ret = -errno;
+		fprintf(stderr, "failed to open '%s': %s (%d)\n",
+			args->filename, strerror(errno), errno);
+		goto out;
+	}
+
+	ret = ioctl(fd, op, iax);
+	if (ret < 0) {
+		ret = -errno;
+		fprintf(stderr, "attr_x ioctl failed on '%s': "
+			"%s (%d)\n", args->filename, strerror(errno), errno);
+		goto out;
+	}
+
+	if (!args->set) {
+		pr(iax, META_SEQ, "meta_seq", "%llu", iax->meta_seq);
+		pr(iax, DATA_SEQ, "data_seq", "%llu", iax->data_seq);
+		pr(iax, DATA_VERSION, "data_version", "%llu", iax->data_version);
+		pr(iax, ONLINE_BLOCKS, "online_blocks", "%llu", iax->online_blocks);
+		pr(iax, OFFLINE_BLOCKS, "offline_blocks", "%llu", iax->offline_blocks);
+		pr(iax, CTIME, "ctime", "%llu.%u", iax->ctime_sec, iax->ctime_nsec);
+		pr(iax, CRTIME, "crtime", "%llu.%u", iax->crtime_sec, iax->crtime_nsec);
+		pr(iax, SIZE, "size", "%llu", iax->size);
+		prb(iax, RETENTION, "retention");
+		pr(iax, PROJECT_ID, "project_id", "%llu", iax->project_id);
+	}
+
+	ret = 0;
+out:
+	if (fd >= 0)
+		close(fd);
+	return ret;
+}
+
+/*
+ * This is called for both get and set.  The get calls won't have
+ * arguments and are only setting the mask.  The set calls parse the
+ * value to set.  We could have defaults by making set option arguments
+ * optional, like setting the current time for timestamps, but that
+ * hasn't been needed.
+ *
+ * Option value parsing places no constraints on the attributes or
+ * values themselves once parsed.  This lets us use the set command to
+ * test the kernel's testing for invalid attribute combinations and
+ * values.
+ */
+static int parse_opt(int key, char *arg, struct argp_state *state)
+{
+	struct attr_x_args *args = state->input;
+	struct timespec ts;
+	int ret;
+	u64 x;
+
+	switch (key) {
+	case 'm':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_META_SEQ;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.meta_seq);
+			if (ret)
+				return ret;
+		}
+		break;
+	case 'd':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_DATA_SEQ;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.data_seq);
+			if (ret)
+				return ret;
+		}
+		break;
+	case 'v':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_DATA_VERSION;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.data_version);
+			if (ret)
+				return ret;
+			if (args->iax.data_version == 0)
+				argp_error(state, "data version must not be 0");
+		}
+		break;
+	case 'n':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_ONLINE_BLOCKS;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.online_blocks);
+			if (ret)
+				return ret;
+		}
+		break;
+	case 'f':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_OFFLINE_BLOCKS;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.offline_blocks);
+			if (ret)
+				return ret;
+		}
+		break;
+	case 'c':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_CTIME;
+		if (arg) {
+			ret = parse_timespec(arg, &ts);
+			if (ret)
+				return ret;
+			args->iax.ctime_sec = ts.tv_sec;
+			args->iax.ctime_nsec = ts.tv_nsec;
+		}
+		break;
+	case 'r':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_CRTIME;
+		if (arg) {
+			ret = parse_timespec(arg, &ts);
+			if (ret)
+				return ret;
+			args->iax.crtime_sec = ts.tv_sec;
+			args->iax.crtime_nsec = ts.tv_nsec;
+		}
+		break;
+	case 's':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_SIZE;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.size);
+			if (ret)
+				return ret;
+		}
+		break;
+	case 't':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_RETENTION;
+		if (arg) {
+			ret = parse_u64(arg, &x);
+			if (ret)
+				return ret;
+			if (x)
+				args->iax.bits |= SCOUTFS_IOC_IAX_B_RETENTION;
+		}
+		break;
+	case 'p':
+		args->iax.x_mask |= SCOUTFS_IOC_IAX_PROJECT_ID;
+		if (arg) {
+			ret = parse_u64(arg, &args->iax.project_id);
+			if (ret)
+				return ret;
+		}
+		break;
+	case ARGP_KEY_ARG:
+		if (!args->filename)
+			args->filename = strdup_or_error(state, arg);
+		else
+			argp_error(state, "more than one argument given");
+		break;
+	case ARGP_KEY_FINI:
+		if (!args->filename)
+			argp_error(state, "no filename given");
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+/*
+ * The get options are derived from these by copying the struct and
+ * modifying fields.
+ */
+static struct argp_option set_options[] = {
+	{ "meta_seq", 'm', "SEQ", 0, "Inode Metadata change index sequence number"},
+	{ "data_seq", 'd', "SEQ", 0, "File Data change index sequence number"},
+	{ "data_version", 'v', "VERSION", 0, "File Data contents version"},
+	{ "online_blocks", 'n', "COUNT", 0, "Online data block count"},
+	{ "offline_blocks", 'f', "COUNT", 0, "Offline data block count"},
+	{ "ctime", 'c', "SECS.NSECS", 0, "Inode change time (posix ctime)"},
+	{ "crtime", 'r', "SECS.NSECS", 0, "ScoutFS creation time"},
+	{ "size", 's', "SIZE", 0, "Inode i_size field"},
+	{ "retention", 't', "0|1", 0, "Retention flag"},
+	{ "project_id", 'p', "PROJECT_ID", 0, "Project ID"},
+	{ NULL }
+};
+
+static struct argp get_argp = {
+	NULL, /* dynamically built */
+	parse_opt,
+	"FILE",
+	"get extensible file attributes"
+};
+
+static int get_attr_x_cmd(int argc, char **argv)
+{
+	struct attr_x_args args = {0,};
+	int ret;
+
+	ret = argp_parse(&get_argp, argc, argv, 0, NULL, &args);
+	if (ret)
+		return ret;
+
+	return do_attr_x(&args);
+}
+
+/*
+ * The set options match the get arguments but don't take argument
+ * values to set.
+ */
+static void build_get_options(void)
+{
+	struct argp_option **opts = (struct argp_option **)&get_argp.options;
+	int i;
+
+	*opts = calloc(array_size(set_options), sizeof(set_options[0]));
+	assert(*opts);
+
+	memcpy(*opts, set_options, array_size(set_options) * sizeof(set_options[0]));
+
+	for (i = 0; i < array_size(set_options) - 1; i++)
+		(*opts)[i].arg = NULL;
+}
+
+static void __attribute__((constructor)) get_ctor(void)
+{
+	build_get_options();
+
+	cmd_register_argp("get-attr-x", &get_argp, GROUP_AGENT, get_attr_x_cmd);
+}
+
+static struct argp set_argp = {
+	set_options,
+	parse_opt,
+	"FILE",
+	"Set extensible file attributes"
+};
+
+static int set_attr_x_cmd(int argc, char **argv)
+{
+	struct attr_x_args args = {.set = true,};
+	int ret;
+
+	ret = argp_parse(&set_argp, argc, argv, 0, NULL, &args);
+	if (ret)
+		return ret;
+
+	return do_attr_x(&args);
+}
+
+static void __attribute__((constructor)) set_ctor(void)
+{
+	cmd_register_argp("set-attr-x", &set_argp, GROUP_AGENT, set_attr_x_cmd);
+}