xref: /openbmc/linux/fs/ubifs/debug.c (revision 565d76cb)
1 /*
2  * This file is part of UBIFS.
3  *
4  * Copyright (C) 2006-2008 Nokia Corporation
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms of the GNU General Public License version 2 as published by
8  * the Free Software Foundation.
9  *
10  * This program is distributed in the hope that it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  * You should have received a copy of the GNU General Public License along with
16  * this program; if not, write to the Free Software Foundation, Inc., 51
17  * Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
18  *
19  * Authors: Artem Bityutskiy (Битюцкий Артём)
20  *          Adrian Hunter
21  */
22 
23 /*
24  * This file implements most of the debugging stuff which is compiled in only
25  * when it is enabled. But some debugging check functions are implemented in
26  * corresponding subsystem, just because they are closely related and utilize
27  * various local functions of those subsystems.
28  */
29 
30 #define UBIFS_DBG_PRESERVE_UBI
31 
32 #include "ubifs.h"
33 #include <linux/module.h>
34 #include <linux/moduleparam.h>
35 #include <linux/debugfs.h>
36 #include <linux/math64.h>
37 #include <linux/slab.h>
38 
39 #ifdef CONFIG_UBIFS_FS_DEBUG
40 
41 DEFINE_SPINLOCK(dbg_lock);
42 
43 static char dbg_key_buf0[128];
44 static char dbg_key_buf1[128];
45 
46 unsigned int ubifs_msg_flags;
47 unsigned int ubifs_chk_flags;
48 unsigned int ubifs_tst_flags;
49 
50 module_param_named(debug_msgs, ubifs_msg_flags, uint, S_IRUGO | S_IWUSR);
51 module_param_named(debug_chks, ubifs_chk_flags, uint, S_IRUGO | S_IWUSR);
52 module_param_named(debug_tsts, ubifs_tst_flags, uint, S_IRUGO | S_IWUSR);
53 
54 MODULE_PARM_DESC(debug_msgs, "Debug message type flags");
55 MODULE_PARM_DESC(debug_chks, "Debug check flags");
56 MODULE_PARM_DESC(debug_tsts, "Debug special test flags");
57 
58 static const char *get_key_fmt(int fmt)
59 {
60 	switch (fmt) {
61 	case UBIFS_SIMPLE_KEY_FMT:
62 		return "simple";
63 	default:
64 		return "unknown/invalid format";
65 	}
66 }
67 
68 static const char *get_key_hash(int hash)
69 {
70 	switch (hash) {
71 	case UBIFS_KEY_HASH_R5:
72 		return "R5";
73 	case UBIFS_KEY_HASH_TEST:
74 		return "test";
75 	default:
76 		return "unknown/invalid name hash";
77 	}
78 }
79 
80 static const char *get_key_type(int type)
81 {
82 	switch (type) {
83 	case UBIFS_INO_KEY:
84 		return "inode";
85 	case UBIFS_DENT_KEY:
86 		return "direntry";
87 	case UBIFS_XENT_KEY:
88 		return "xentry";
89 	case UBIFS_DATA_KEY:
90 		return "data";
91 	case UBIFS_TRUN_KEY:
92 		return "truncate";
93 	default:
94 		return "unknown/invalid key";
95 	}
96 }
97 
98 static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
99 			char *buffer)
100 {
101 	char *p = buffer;
102 	int type = key_type(c, key);
103 
104 	if (c->key_fmt == UBIFS_SIMPLE_KEY_FMT) {
105 		switch (type) {
106 		case UBIFS_INO_KEY:
107 			sprintf(p, "(%lu, %s)", (unsigned long)key_inum(c, key),
108 			       get_key_type(type));
109 			break;
110 		case UBIFS_DENT_KEY:
111 		case UBIFS_XENT_KEY:
112 			sprintf(p, "(%lu, %s, %#08x)",
113 				(unsigned long)key_inum(c, key),
114 				get_key_type(type), key_hash(c, key));
115 			break;
116 		case UBIFS_DATA_KEY:
117 			sprintf(p, "(%lu, %s, %u)",
118 				(unsigned long)key_inum(c, key),
119 				get_key_type(type), key_block(c, key));
120 			break;
121 		case UBIFS_TRUN_KEY:
122 			sprintf(p, "(%lu, %s)",
123 				(unsigned long)key_inum(c, key),
124 				get_key_type(type));
125 			break;
126 		default:
127 			sprintf(p, "(bad key type: %#08x, %#08x)",
128 				key->u32[0], key->u32[1]);
129 		}
130 	} else
131 		sprintf(p, "bad key format %d", c->key_fmt);
132 }
133 
134 const char *dbg_key_str0(const struct ubifs_info *c, const union ubifs_key *key)
135 {
136 	/* dbg_lock must be held */
137 	sprintf_key(c, key, dbg_key_buf0);
138 	return dbg_key_buf0;
139 }
140 
141 const char *dbg_key_str1(const struct ubifs_info *c, const union ubifs_key *key)
142 {
143 	/* dbg_lock must be held */
144 	sprintf_key(c, key, dbg_key_buf1);
145 	return dbg_key_buf1;
146 }
147 
148 const char *dbg_ntype(int type)
149 {
150 	switch (type) {
151 	case UBIFS_PAD_NODE:
152 		return "padding node";
153 	case UBIFS_SB_NODE:
154 		return "superblock node";
155 	case UBIFS_MST_NODE:
156 		return "master node";
157 	case UBIFS_REF_NODE:
158 		return "reference node";
159 	case UBIFS_INO_NODE:
160 		return "inode node";
161 	case UBIFS_DENT_NODE:
162 		return "direntry node";
163 	case UBIFS_XENT_NODE:
164 		return "xentry node";
165 	case UBIFS_DATA_NODE:
166 		return "data node";
167 	case UBIFS_TRUN_NODE:
168 		return "truncate node";
169 	case UBIFS_IDX_NODE:
170 		return "indexing node";
171 	case UBIFS_CS_NODE:
172 		return "commit start node";
173 	case UBIFS_ORPH_NODE:
174 		return "orphan node";
175 	default:
176 		return "unknown node";
177 	}
178 }
179 
180 static const char *dbg_gtype(int type)
181 {
182 	switch (type) {
183 	case UBIFS_NO_NODE_GROUP:
184 		return "no node group";
185 	case UBIFS_IN_NODE_GROUP:
186 		return "in node group";
187 	case UBIFS_LAST_OF_NODE_GROUP:
188 		return "last of node group";
189 	default:
190 		return "unknown";
191 	}
192 }
193 
194 const char *dbg_cstate(int cmt_state)
195 {
196 	switch (cmt_state) {
197 	case COMMIT_RESTING:
198 		return "commit resting";
199 	case COMMIT_BACKGROUND:
200 		return "background commit requested";
201 	case COMMIT_REQUIRED:
202 		return "commit required";
203 	case COMMIT_RUNNING_BACKGROUND:
204 		return "BACKGROUND commit running";
205 	case COMMIT_RUNNING_REQUIRED:
206 		return "commit running and required";
207 	case COMMIT_BROKEN:
208 		return "broken commit";
209 	default:
210 		return "unknown commit state";
211 	}
212 }
213 
214 const char *dbg_jhead(int jhead)
215 {
216 	switch (jhead) {
217 	case GCHD:
218 		return "0 (GC)";
219 	case BASEHD:
220 		return "1 (base)";
221 	case DATAHD:
222 		return "2 (data)";
223 	default:
224 		return "unknown journal head";
225 	}
226 }
227 
228 static void dump_ch(const struct ubifs_ch *ch)
229 {
230 	printk(KERN_DEBUG "\tmagic          %#x\n", le32_to_cpu(ch->magic));
231 	printk(KERN_DEBUG "\tcrc            %#x\n", le32_to_cpu(ch->crc));
232 	printk(KERN_DEBUG "\tnode_type      %d (%s)\n", ch->node_type,
233 	       dbg_ntype(ch->node_type));
234 	printk(KERN_DEBUG "\tgroup_type     %d (%s)\n", ch->group_type,
235 	       dbg_gtype(ch->group_type));
236 	printk(KERN_DEBUG "\tsqnum          %llu\n",
237 	       (unsigned long long)le64_to_cpu(ch->sqnum));
238 	printk(KERN_DEBUG "\tlen            %u\n", le32_to_cpu(ch->len));
239 }
240 
241 void dbg_dump_inode(const struct ubifs_info *c, const struct inode *inode)
242 {
243 	const struct ubifs_inode *ui = ubifs_inode(inode);
244 
245 	printk(KERN_DEBUG "Dump in-memory inode:");
246 	printk(KERN_DEBUG "\tinode          %lu\n", inode->i_ino);
247 	printk(KERN_DEBUG "\tsize           %llu\n",
248 	       (unsigned long long)i_size_read(inode));
249 	printk(KERN_DEBUG "\tnlink          %u\n", inode->i_nlink);
250 	printk(KERN_DEBUG "\tuid            %u\n", (unsigned int)inode->i_uid);
251 	printk(KERN_DEBUG "\tgid            %u\n", (unsigned int)inode->i_gid);
252 	printk(KERN_DEBUG "\tatime          %u.%u\n",
253 	       (unsigned int)inode->i_atime.tv_sec,
254 	       (unsigned int)inode->i_atime.tv_nsec);
255 	printk(KERN_DEBUG "\tmtime          %u.%u\n",
256 	       (unsigned int)inode->i_mtime.tv_sec,
257 	       (unsigned int)inode->i_mtime.tv_nsec);
258 	printk(KERN_DEBUG "\tctime          %u.%u\n",
259 	       (unsigned int)inode->i_ctime.tv_sec,
260 	       (unsigned int)inode->i_ctime.tv_nsec);
261 	printk(KERN_DEBUG "\tcreat_sqnum    %llu\n", ui->creat_sqnum);
262 	printk(KERN_DEBUG "\txattr_size     %u\n", ui->xattr_size);
263 	printk(KERN_DEBUG "\txattr_cnt      %u\n", ui->xattr_cnt);
264 	printk(KERN_DEBUG "\txattr_names    %u\n", ui->xattr_names);
265 	printk(KERN_DEBUG "\tdirty          %u\n", ui->dirty);
266 	printk(KERN_DEBUG "\txattr          %u\n", ui->xattr);
267 	printk(KERN_DEBUG "\tbulk_read      %u\n", ui->xattr);
268 	printk(KERN_DEBUG "\tsynced_i_size  %llu\n",
269 	       (unsigned long long)ui->synced_i_size);
270 	printk(KERN_DEBUG "\tui_size        %llu\n",
271 	       (unsigned long long)ui->ui_size);
272 	printk(KERN_DEBUG "\tflags          %d\n", ui->flags);
273 	printk(KERN_DEBUG "\tcompr_type     %d\n", ui->compr_type);
274 	printk(KERN_DEBUG "\tlast_page_read %lu\n", ui->last_page_read);
275 	printk(KERN_DEBUG "\tread_in_a_row  %lu\n", ui->read_in_a_row);
276 	printk(KERN_DEBUG "\tdata_len       %d\n", ui->data_len);
277 }
278 
279 void dbg_dump_node(const struct ubifs_info *c, const void *node)
280 {
281 	int i, n;
282 	union ubifs_key key;
283 	const struct ubifs_ch *ch = node;
284 
285 	if (dbg_failure_mode)
286 		return;
287 
288 	/* If the magic is incorrect, just hexdump the first bytes */
289 	if (le32_to_cpu(ch->magic) != UBIFS_NODE_MAGIC) {
290 		printk(KERN_DEBUG "Not a node, first %zu bytes:", UBIFS_CH_SZ);
291 		print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
292 			       (void *)node, UBIFS_CH_SZ, 1);
293 		return;
294 	}
295 
296 	spin_lock(&dbg_lock);
297 	dump_ch(node);
298 
299 	switch (ch->node_type) {
300 	case UBIFS_PAD_NODE:
301 	{
302 		const struct ubifs_pad_node *pad = node;
303 
304 		printk(KERN_DEBUG "\tpad_len        %u\n",
305 		       le32_to_cpu(pad->pad_len));
306 		break;
307 	}
308 	case UBIFS_SB_NODE:
309 	{
310 		const struct ubifs_sb_node *sup = node;
311 		unsigned int sup_flags = le32_to_cpu(sup->flags);
312 
313 		printk(KERN_DEBUG "\tkey_hash       %d (%s)\n",
314 		       (int)sup->key_hash, get_key_hash(sup->key_hash));
315 		printk(KERN_DEBUG "\tkey_fmt        %d (%s)\n",
316 		       (int)sup->key_fmt, get_key_fmt(sup->key_fmt));
317 		printk(KERN_DEBUG "\tflags          %#x\n", sup_flags);
318 		printk(KERN_DEBUG "\t  big_lpt      %u\n",
319 		       !!(sup_flags & UBIFS_FLG_BIGLPT));
320 		printk(KERN_DEBUG "\tmin_io_size    %u\n",
321 		       le32_to_cpu(sup->min_io_size));
322 		printk(KERN_DEBUG "\tleb_size       %u\n",
323 		       le32_to_cpu(sup->leb_size));
324 		printk(KERN_DEBUG "\tleb_cnt        %u\n",
325 		       le32_to_cpu(sup->leb_cnt));
326 		printk(KERN_DEBUG "\tmax_leb_cnt    %u\n",
327 		       le32_to_cpu(sup->max_leb_cnt));
328 		printk(KERN_DEBUG "\tmax_bud_bytes  %llu\n",
329 		       (unsigned long long)le64_to_cpu(sup->max_bud_bytes));
330 		printk(KERN_DEBUG "\tlog_lebs       %u\n",
331 		       le32_to_cpu(sup->log_lebs));
332 		printk(KERN_DEBUG "\tlpt_lebs       %u\n",
333 		       le32_to_cpu(sup->lpt_lebs));
334 		printk(KERN_DEBUG "\torph_lebs      %u\n",
335 		       le32_to_cpu(sup->orph_lebs));
336 		printk(KERN_DEBUG "\tjhead_cnt      %u\n",
337 		       le32_to_cpu(sup->jhead_cnt));
338 		printk(KERN_DEBUG "\tfanout         %u\n",
339 		       le32_to_cpu(sup->fanout));
340 		printk(KERN_DEBUG "\tlsave_cnt      %u\n",
341 		       le32_to_cpu(sup->lsave_cnt));
342 		printk(KERN_DEBUG "\tdefault_compr  %u\n",
343 		       (int)le16_to_cpu(sup->default_compr));
344 		printk(KERN_DEBUG "\trp_size        %llu\n",
345 		       (unsigned long long)le64_to_cpu(sup->rp_size));
346 		printk(KERN_DEBUG "\trp_uid         %u\n",
347 		       le32_to_cpu(sup->rp_uid));
348 		printk(KERN_DEBUG "\trp_gid         %u\n",
349 		       le32_to_cpu(sup->rp_gid));
350 		printk(KERN_DEBUG "\tfmt_version    %u\n",
351 		       le32_to_cpu(sup->fmt_version));
352 		printk(KERN_DEBUG "\ttime_gran      %u\n",
353 		       le32_to_cpu(sup->time_gran));
354 		printk(KERN_DEBUG "\tUUID           %pUB\n",
355 		       sup->uuid);
356 		break;
357 	}
358 	case UBIFS_MST_NODE:
359 	{
360 		const struct ubifs_mst_node *mst = node;
361 
362 		printk(KERN_DEBUG "\thighest_inum   %llu\n",
363 		       (unsigned long long)le64_to_cpu(mst->highest_inum));
364 		printk(KERN_DEBUG "\tcommit number  %llu\n",
365 		       (unsigned long long)le64_to_cpu(mst->cmt_no));
366 		printk(KERN_DEBUG "\tflags          %#x\n",
367 		       le32_to_cpu(mst->flags));
368 		printk(KERN_DEBUG "\tlog_lnum       %u\n",
369 		       le32_to_cpu(mst->log_lnum));
370 		printk(KERN_DEBUG "\troot_lnum      %u\n",
371 		       le32_to_cpu(mst->root_lnum));
372 		printk(KERN_DEBUG "\troot_offs      %u\n",
373 		       le32_to_cpu(mst->root_offs));
374 		printk(KERN_DEBUG "\troot_len       %u\n",
375 		       le32_to_cpu(mst->root_len));
376 		printk(KERN_DEBUG "\tgc_lnum        %u\n",
377 		       le32_to_cpu(mst->gc_lnum));
378 		printk(KERN_DEBUG "\tihead_lnum     %u\n",
379 		       le32_to_cpu(mst->ihead_lnum));
380 		printk(KERN_DEBUG "\tihead_offs     %u\n",
381 		       le32_to_cpu(mst->ihead_offs));
382 		printk(KERN_DEBUG "\tindex_size     %llu\n",
383 		       (unsigned long long)le64_to_cpu(mst->index_size));
384 		printk(KERN_DEBUG "\tlpt_lnum       %u\n",
385 		       le32_to_cpu(mst->lpt_lnum));
386 		printk(KERN_DEBUG "\tlpt_offs       %u\n",
387 		       le32_to_cpu(mst->lpt_offs));
388 		printk(KERN_DEBUG "\tnhead_lnum     %u\n",
389 		       le32_to_cpu(mst->nhead_lnum));
390 		printk(KERN_DEBUG "\tnhead_offs     %u\n",
391 		       le32_to_cpu(mst->nhead_offs));
392 		printk(KERN_DEBUG "\tltab_lnum      %u\n",
393 		       le32_to_cpu(mst->ltab_lnum));
394 		printk(KERN_DEBUG "\tltab_offs      %u\n",
395 		       le32_to_cpu(mst->ltab_offs));
396 		printk(KERN_DEBUG "\tlsave_lnum     %u\n",
397 		       le32_to_cpu(mst->lsave_lnum));
398 		printk(KERN_DEBUG "\tlsave_offs     %u\n",
399 		       le32_to_cpu(mst->lsave_offs));
400 		printk(KERN_DEBUG "\tlscan_lnum     %u\n",
401 		       le32_to_cpu(mst->lscan_lnum));
402 		printk(KERN_DEBUG "\tleb_cnt        %u\n",
403 		       le32_to_cpu(mst->leb_cnt));
404 		printk(KERN_DEBUG "\tempty_lebs     %u\n",
405 		       le32_to_cpu(mst->empty_lebs));
406 		printk(KERN_DEBUG "\tidx_lebs       %u\n",
407 		       le32_to_cpu(mst->idx_lebs));
408 		printk(KERN_DEBUG "\ttotal_free     %llu\n",
409 		       (unsigned long long)le64_to_cpu(mst->total_free));
410 		printk(KERN_DEBUG "\ttotal_dirty    %llu\n",
411 		       (unsigned long long)le64_to_cpu(mst->total_dirty));
412 		printk(KERN_DEBUG "\ttotal_used     %llu\n",
413 		       (unsigned long long)le64_to_cpu(mst->total_used));
414 		printk(KERN_DEBUG "\ttotal_dead     %llu\n",
415 		       (unsigned long long)le64_to_cpu(mst->total_dead));
416 		printk(KERN_DEBUG "\ttotal_dark     %llu\n",
417 		       (unsigned long long)le64_to_cpu(mst->total_dark));
418 		break;
419 	}
420 	case UBIFS_REF_NODE:
421 	{
422 		const struct ubifs_ref_node *ref = node;
423 
424 		printk(KERN_DEBUG "\tlnum           %u\n",
425 		       le32_to_cpu(ref->lnum));
426 		printk(KERN_DEBUG "\toffs           %u\n",
427 		       le32_to_cpu(ref->offs));
428 		printk(KERN_DEBUG "\tjhead          %u\n",
429 		       le32_to_cpu(ref->jhead));
430 		break;
431 	}
432 	case UBIFS_INO_NODE:
433 	{
434 		const struct ubifs_ino_node *ino = node;
435 
436 		key_read(c, &ino->key, &key);
437 		printk(KERN_DEBUG "\tkey            %s\n", DBGKEY(&key));
438 		printk(KERN_DEBUG "\tcreat_sqnum    %llu\n",
439 		       (unsigned long long)le64_to_cpu(ino->creat_sqnum));
440 		printk(KERN_DEBUG "\tsize           %llu\n",
441 		       (unsigned long long)le64_to_cpu(ino->size));
442 		printk(KERN_DEBUG "\tnlink          %u\n",
443 		       le32_to_cpu(ino->nlink));
444 		printk(KERN_DEBUG "\tatime          %lld.%u\n",
445 		       (long long)le64_to_cpu(ino->atime_sec),
446 		       le32_to_cpu(ino->atime_nsec));
447 		printk(KERN_DEBUG "\tmtime          %lld.%u\n",
448 		       (long long)le64_to_cpu(ino->mtime_sec),
449 		       le32_to_cpu(ino->mtime_nsec));
450 		printk(KERN_DEBUG "\tctime          %lld.%u\n",
451 		       (long long)le64_to_cpu(ino->ctime_sec),
452 		       le32_to_cpu(ino->ctime_nsec));
453 		printk(KERN_DEBUG "\tuid            %u\n",
454 		       le32_to_cpu(ino->uid));
455 		printk(KERN_DEBUG "\tgid            %u\n",
456 		       le32_to_cpu(ino->gid));
457 		printk(KERN_DEBUG "\tmode           %u\n",
458 		       le32_to_cpu(ino->mode));
459 		printk(KERN_DEBUG "\tflags          %#x\n",
460 		       le32_to_cpu(ino->flags));
461 		printk(KERN_DEBUG "\txattr_cnt      %u\n",
462 		       le32_to_cpu(ino->xattr_cnt));
463 		printk(KERN_DEBUG "\txattr_size     %u\n",
464 		       le32_to_cpu(ino->xattr_size));
465 		printk(KERN_DEBUG "\txattr_names    %u\n",
466 		       le32_to_cpu(ino->xattr_names));
467 		printk(KERN_DEBUG "\tcompr_type     %#x\n",
468 		       (int)le16_to_cpu(ino->compr_type));
469 		printk(KERN_DEBUG "\tdata len       %u\n",
470 		       le32_to_cpu(ino->data_len));
471 		break;
472 	}
473 	case UBIFS_DENT_NODE:
474 	case UBIFS_XENT_NODE:
475 	{
476 		const struct ubifs_dent_node *dent = node;
477 		int nlen = le16_to_cpu(dent->nlen);
478 
479 		key_read(c, &dent->key, &key);
480 		printk(KERN_DEBUG "\tkey            %s\n", DBGKEY(&key));
481 		printk(KERN_DEBUG "\tinum           %llu\n",
482 		       (unsigned long long)le64_to_cpu(dent->inum));
483 		printk(KERN_DEBUG "\ttype           %d\n", (int)dent->type);
484 		printk(KERN_DEBUG "\tnlen           %d\n", nlen);
485 		printk(KERN_DEBUG "\tname           ");
486 
487 		if (nlen > UBIFS_MAX_NLEN)
488 			printk(KERN_DEBUG "(bad name length, not printing, "
489 					  "bad or corrupted node)");
490 		else {
491 			for (i = 0; i < nlen && dent->name[i]; i++)
492 				printk(KERN_CONT "%c", dent->name[i]);
493 		}
494 		printk(KERN_CONT "\n");
495 
496 		break;
497 	}
498 	case UBIFS_DATA_NODE:
499 	{
500 		const struct ubifs_data_node *dn = node;
501 		int dlen = le32_to_cpu(ch->len) - UBIFS_DATA_NODE_SZ;
502 
503 		key_read(c, &dn->key, &key);
504 		printk(KERN_DEBUG "\tkey            %s\n", DBGKEY(&key));
505 		printk(KERN_DEBUG "\tsize           %u\n",
506 		       le32_to_cpu(dn->size));
507 		printk(KERN_DEBUG "\tcompr_typ      %d\n",
508 		       (int)le16_to_cpu(dn->compr_type));
509 		printk(KERN_DEBUG "\tdata size      %d\n",
510 		       dlen);
511 		printk(KERN_DEBUG "\tdata:\n");
512 		print_hex_dump(KERN_DEBUG, "\t", DUMP_PREFIX_OFFSET, 32, 1,
513 			       (void *)&dn->data, dlen, 0);
514 		break;
515 	}
516 	case UBIFS_TRUN_NODE:
517 	{
518 		const struct ubifs_trun_node *trun = node;
519 
520 		printk(KERN_DEBUG "\tinum           %u\n",
521 		       le32_to_cpu(trun->inum));
522 		printk(KERN_DEBUG "\told_size       %llu\n",
523 		       (unsigned long long)le64_to_cpu(trun->old_size));
524 		printk(KERN_DEBUG "\tnew_size       %llu\n",
525 		       (unsigned long long)le64_to_cpu(trun->new_size));
526 		break;
527 	}
528 	case UBIFS_IDX_NODE:
529 	{
530 		const struct ubifs_idx_node *idx = node;
531 
532 		n = le16_to_cpu(idx->child_cnt);
533 		printk(KERN_DEBUG "\tchild_cnt      %d\n", n);
534 		printk(KERN_DEBUG "\tlevel          %d\n",
535 		       (int)le16_to_cpu(idx->level));
536 		printk(KERN_DEBUG "\tBranches:\n");
537 
538 		for (i = 0; i < n && i < c->fanout - 1; i++) {
539 			const struct ubifs_branch *br;
540 
541 			br = ubifs_idx_branch(c, idx, i);
542 			key_read(c, &br->key, &key);
543 			printk(KERN_DEBUG "\t%d: LEB %d:%d len %d key %s\n",
544 			       i, le32_to_cpu(br->lnum), le32_to_cpu(br->offs),
545 			       le32_to_cpu(br->len), DBGKEY(&key));
546 		}
547 		break;
548 	}
549 	case UBIFS_CS_NODE:
550 		break;
551 	case UBIFS_ORPH_NODE:
552 	{
553 		const struct ubifs_orph_node *orph = node;
554 
555 		printk(KERN_DEBUG "\tcommit number  %llu\n",
556 		       (unsigned long long)
557 				le64_to_cpu(orph->cmt_no) & LLONG_MAX);
558 		printk(KERN_DEBUG "\tlast node flag %llu\n",
559 		       (unsigned long long)(le64_to_cpu(orph->cmt_no)) >> 63);
560 		n = (le32_to_cpu(ch->len) - UBIFS_ORPH_NODE_SZ) >> 3;
561 		printk(KERN_DEBUG "\t%d orphan inode numbers:\n", n);
562 		for (i = 0; i < n; i++)
563 			printk(KERN_DEBUG "\t  ino %llu\n",
564 			       (unsigned long long)le64_to_cpu(orph->inos[i]));
565 		break;
566 	}
567 	default:
568 		printk(KERN_DEBUG "node type %d was not recognized\n",
569 		       (int)ch->node_type);
570 	}
571 	spin_unlock(&dbg_lock);
572 }
573 
574 void dbg_dump_budget_req(const struct ubifs_budget_req *req)
575 {
576 	spin_lock(&dbg_lock);
577 	printk(KERN_DEBUG "Budgeting request: new_ino %d, dirtied_ino %d\n",
578 	       req->new_ino, req->dirtied_ino);
579 	printk(KERN_DEBUG "\tnew_ino_d   %d, dirtied_ino_d %d\n",
580 	       req->new_ino_d, req->dirtied_ino_d);
581 	printk(KERN_DEBUG "\tnew_page    %d, dirtied_page %d\n",
582 	       req->new_page, req->dirtied_page);
583 	printk(KERN_DEBUG "\tnew_dent    %d, mod_dent     %d\n",
584 	       req->new_dent, req->mod_dent);
585 	printk(KERN_DEBUG "\tidx_growth  %d\n", req->idx_growth);
586 	printk(KERN_DEBUG "\tdata_growth %d dd_growth     %d\n",
587 	       req->data_growth, req->dd_growth);
588 	spin_unlock(&dbg_lock);
589 }
590 
591 void dbg_dump_lstats(const struct ubifs_lp_stats *lst)
592 {
593 	spin_lock(&dbg_lock);
594 	printk(KERN_DEBUG "(pid %d) Lprops statistics: empty_lebs %d, "
595 	       "idx_lebs  %d\n", current->pid, lst->empty_lebs, lst->idx_lebs);
596 	printk(KERN_DEBUG "\ttaken_empty_lebs %d, total_free %lld, "
597 	       "total_dirty %lld\n", lst->taken_empty_lebs, lst->total_free,
598 	       lst->total_dirty);
599 	printk(KERN_DEBUG "\ttotal_used %lld, total_dark %lld, "
600 	       "total_dead %lld\n", lst->total_used, lst->total_dark,
601 	       lst->total_dead);
602 	spin_unlock(&dbg_lock);
603 }
604 
605 void dbg_dump_budg(struct ubifs_info *c)
606 {
607 	int i;
608 	struct rb_node *rb;
609 	struct ubifs_bud *bud;
610 	struct ubifs_gced_idx_leb *idx_gc;
611 	long long available, outstanding, free;
612 
613 	ubifs_assert(spin_is_locked(&c->space_lock));
614 	spin_lock(&dbg_lock);
615 	printk(KERN_DEBUG "(pid %d) Budgeting info: budg_data_growth %lld, "
616 	       "budg_dd_growth %lld, budg_idx_growth %lld\n", current->pid,
617 	       c->budg_data_growth, c->budg_dd_growth, c->budg_idx_growth);
618 	printk(KERN_DEBUG "\tdata budget sum %lld, total budget sum %lld, "
619 	       "freeable_cnt %d\n", c->budg_data_growth + c->budg_dd_growth,
620 	       c->budg_data_growth + c->budg_dd_growth + c->budg_idx_growth,
621 	       c->freeable_cnt);
622 	printk(KERN_DEBUG "\tmin_idx_lebs %d, old_idx_sz %lld, "
623 	       "calc_idx_sz %lld, idx_gc_cnt %d\n", c->min_idx_lebs,
624 	       c->old_idx_sz, c->calc_idx_sz, c->idx_gc_cnt);
625 	printk(KERN_DEBUG "\tdirty_pg_cnt %ld, dirty_zn_cnt %ld, "
626 	       "clean_zn_cnt %ld\n", atomic_long_read(&c->dirty_pg_cnt),
627 	       atomic_long_read(&c->dirty_zn_cnt),
628 	       atomic_long_read(&c->clean_zn_cnt));
629 	printk(KERN_DEBUG "\tdark_wm %d, dead_wm %d, max_idx_node_sz %d\n",
630 	       c->dark_wm, c->dead_wm, c->max_idx_node_sz);
631 	printk(KERN_DEBUG "\tgc_lnum %d, ihead_lnum %d\n",
632 	       c->gc_lnum, c->ihead_lnum);
633 	/* If we are in R/O mode, journal heads do not exist */
634 	if (c->jheads)
635 		for (i = 0; i < c->jhead_cnt; i++)
636 			printk(KERN_DEBUG "\tjhead %s\t LEB %d\n",
637 			       dbg_jhead(c->jheads[i].wbuf.jhead),
638 			       c->jheads[i].wbuf.lnum);
639 	for (rb = rb_first(&c->buds); rb; rb = rb_next(rb)) {
640 		bud = rb_entry(rb, struct ubifs_bud, rb);
641 		printk(KERN_DEBUG "\tbud LEB %d\n", bud->lnum);
642 	}
643 	list_for_each_entry(bud, &c->old_buds, list)
644 		printk(KERN_DEBUG "\told bud LEB %d\n", bud->lnum);
645 	list_for_each_entry(idx_gc, &c->idx_gc, list)
646 		printk(KERN_DEBUG "\tGC'ed idx LEB %d unmap %d\n",
647 		       idx_gc->lnum, idx_gc->unmap);
648 	printk(KERN_DEBUG "\tcommit state %d\n", c->cmt_state);
649 
650 	/* Print budgeting predictions */
651 	available = ubifs_calc_available(c, c->min_idx_lebs);
652 	outstanding = c->budg_data_growth + c->budg_dd_growth;
653 	free = ubifs_get_free_space_nolock(c);
654 	printk(KERN_DEBUG "Budgeting predictions:\n");
655 	printk(KERN_DEBUG "\tavailable: %lld, outstanding %lld, free %lld\n",
656 	       available, outstanding, free);
657 	spin_unlock(&dbg_lock);
658 }
659 
660 void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
661 {
662 	int i, spc, dark = 0, dead = 0;
663 	struct rb_node *rb;
664 	struct ubifs_bud *bud;
665 
666 	spc = lp->free + lp->dirty;
667 	if (spc < c->dead_wm)
668 		dead = spc;
669 	else
670 		dark = ubifs_calc_dark(c, spc);
671 
672 	if (lp->flags & LPROPS_INDEX)
673 		printk(KERN_DEBUG "LEB %-7d free %-8d dirty %-8d used %-8d "
674 		       "free + dirty %-8d flags %#x (", lp->lnum, lp->free,
675 		       lp->dirty, c->leb_size - spc, spc, lp->flags);
676 	else
677 		printk(KERN_DEBUG "LEB %-7d free %-8d dirty %-8d used %-8d "
678 		       "free + dirty %-8d dark %-4d dead %-4d nodes fit %-3d "
679 		       "flags %#-4x (", lp->lnum, lp->free, lp->dirty,
680 		       c->leb_size - spc, spc, dark, dead,
681 		       (int)(spc / UBIFS_MAX_NODE_SZ), lp->flags);
682 
683 	if (lp->flags & LPROPS_TAKEN) {
684 		if (lp->flags & LPROPS_INDEX)
685 			printk(KERN_CONT "index, taken");
686 		else
687 			printk(KERN_CONT "taken");
688 	} else {
689 		const char *s;
690 
691 		if (lp->flags & LPROPS_INDEX) {
692 			switch (lp->flags & LPROPS_CAT_MASK) {
693 			case LPROPS_DIRTY_IDX:
694 				s = "dirty index";
695 				break;
696 			case LPROPS_FRDI_IDX:
697 				s = "freeable index";
698 				break;
699 			default:
700 				s = "index";
701 			}
702 		} else {
703 			switch (lp->flags & LPROPS_CAT_MASK) {
704 			case LPROPS_UNCAT:
705 				s = "not categorized";
706 				break;
707 			case LPROPS_DIRTY:
708 				s = "dirty";
709 				break;
710 			case LPROPS_FREE:
711 				s = "free";
712 				break;
713 			case LPROPS_EMPTY:
714 				s = "empty";
715 				break;
716 			case LPROPS_FREEABLE:
717 				s = "freeable";
718 				break;
719 			default:
720 				s = NULL;
721 				break;
722 			}
723 		}
724 		printk(KERN_CONT "%s", s);
725 	}
726 
727 	for (rb = rb_first((struct rb_root *)&c->buds); rb; rb = rb_next(rb)) {
728 		bud = rb_entry(rb, struct ubifs_bud, rb);
729 		if (bud->lnum == lp->lnum) {
730 			int head = 0;
731 			for (i = 0; i < c->jhead_cnt; i++) {
732 				if (lp->lnum == c->jheads[i].wbuf.lnum) {
733 					printk(KERN_CONT ", jhead %s",
734 					       dbg_jhead(i));
735 					head = 1;
736 				}
737 			}
738 			if (!head)
739 				printk(KERN_CONT ", bud of jhead %s",
740 				       dbg_jhead(bud->jhead));
741 		}
742 	}
743 	if (lp->lnum == c->gc_lnum)
744 		printk(KERN_CONT ", GC LEB");
745 	printk(KERN_CONT ")\n");
746 }
747 
748 void dbg_dump_lprops(struct ubifs_info *c)
749 {
750 	int lnum, err;
751 	struct ubifs_lprops lp;
752 	struct ubifs_lp_stats lst;
753 
754 	printk(KERN_DEBUG "(pid %d) start dumping LEB properties\n",
755 	       current->pid);
756 	ubifs_get_lp_stats(c, &lst);
757 	dbg_dump_lstats(&lst);
758 
759 	for (lnum = c->main_first; lnum < c->leb_cnt; lnum++) {
760 		err = ubifs_read_one_lp(c, lnum, &lp);
761 		if (err)
762 			ubifs_err("cannot read lprops for LEB %d", lnum);
763 
764 		dbg_dump_lprop(c, &lp);
765 	}
766 	printk(KERN_DEBUG "(pid %d) finish dumping LEB properties\n",
767 	       current->pid);
768 }
769 
770 void dbg_dump_lpt_info(struct ubifs_info *c)
771 {
772 	int i;
773 
774 	spin_lock(&dbg_lock);
775 	printk(KERN_DEBUG "(pid %d) dumping LPT information\n", current->pid);
776 	printk(KERN_DEBUG "\tlpt_sz:        %lld\n", c->lpt_sz);
777 	printk(KERN_DEBUG "\tpnode_sz:      %d\n", c->pnode_sz);
778 	printk(KERN_DEBUG "\tnnode_sz:      %d\n", c->nnode_sz);
779 	printk(KERN_DEBUG "\tltab_sz:       %d\n", c->ltab_sz);
780 	printk(KERN_DEBUG "\tlsave_sz:      %d\n", c->lsave_sz);
781 	printk(KERN_DEBUG "\tbig_lpt:       %d\n", c->big_lpt);
782 	printk(KERN_DEBUG "\tlpt_hght:      %d\n", c->lpt_hght);
783 	printk(KERN_DEBUG "\tpnode_cnt:     %d\n", c->pnode_cnt);
784 	printk(KERN_DEBUG "\tnnode_cnt:     %d\n", c->nnode_cnt);
785 	printk(KERN_DEBUG "\tdirty_pn_cnt:  %d\n", c->dirty_pn_cnt);
786 	printk(KERN_DEBUG "\tdirty_nn_cnt:  %d\n", c->dirty_nn_cnt);
787 	printk(KERN_DEBUG "\tlsave_cnt:     %d\n", c->lsave_cnt);
788 	printk(KERN_DEBUG "\tspace_bits:    %d\n", c->space_bits);
789 	printk(KERN_DEBUG "\tlpt_lnum_bits: %d\n", c->lpt_lnum_bits);
790 	printk(KERN_DEBUG "\tlpt_offs_bits: %d\n", c->lpt_offs_bits);
791 	printk(KERN_DEBUG "\tlpt_spc_bits:  %d\n", c->lpt_spc_bits);
792 	printk(KERN_DEBUG "\tpcnt_bits:     %d\n", c->pcnt_bits);
793 	printk(KERN_DEBUG "\tlnum_bits:     %d\n", c->lnum_bits);
794 	printk(KERN_DEBUG "\tLPT root is at %d:%d\n", c->lpt_lnum, c->lpt_offs);
795 	printk(KERN_DEBUG "\tLPT head is at %d:%d\n",
796 	       c->nhead_lnum, c->nhead_offs);
797 	printk(KERN_DEBUG "\tLPT ltab is at %d:%d\n",
798 	       c->ltab_lnum, c->ltab_offs);
799 	if (c->big_lpt)
800 		printk(KERN_DEBUG "\tLPT lsave is at %d:%d\n",
801 		       c->lsave_lnum, c->lsave_offs);
802 	for (i = 0; i < c->lpt_lebs; i++)
803 		printk(KERN_DEBUG "\tLPT LEB %d free %d dirty %d tgc %d "
804 		       "cmt %d\n", i + c->lpt_first, c->ltab[i].free,
805 		       c->ltab[i].dirty, c->ltab[i].tgc, c->ltab[i].cmt);
806 	spin_unlock(&dbg_lock);
807 }
808 
809 void dbg_dump_leb(const struct ubifs_info *c, int lnum)
810 {
811 	struct ubifs_scan_leb *sleb;
812 	struct ubifs_scan_node *snod;
813 	void *buf;
814 
815 	if (dbg_failure_mode)
816 		return;
817 
818 	printk(KERN_DEBUG "(pid %d) start dumping LEB %d\n",
819 	       current->pid, lnum);
820 
821 	buf = __vmalloc(c->leb_size, GFP_KERNEL | GFP_NOFS, PAGE_KERNEL);
822 	if (!buf) {
823 		ubifs_err("cannot allocate memory for dumping LEB %d", lnum);
824 		return;
825 	}
826 
827 	sleb = ubifs_scan(c, lnum, 0, buf, 0);
828 	if (IS_ERR(sleb)) {
829 		ubifs_err("scan error %d", (int)PTR_ERR(sleb));
830 		goto out;
831 	}
832 
833 	printk(KERN_DEBUG "LEB %d has %d nodes ending at %d\n", lnum,
834 	       sleb->nodes_cnt, sleb->endpt);
835 
836 	list_for_each_entry(snod, &sleb->nodes, list) {
837 		cond_resched();
838 		printk(KERN_DEBUG "Dumping node at LEB %d:%d len %d\n", lnum,
839 		       snod->offs, snod->len);
840 		dbg_dump_node(c, snod->node);
841 	}
842 
843 	printk(KERN_DEBUG "(pid %d) finish dumping LEB %d\n",
844 	       current->pid, lnum);
845 	ubifs_scan_destroy(sleb);
846 
847 out:
848 	vfree(buf);
849 	return;
850 }
851 
852 void dbg_dump_znode(const struct ubifs_info *c,
853 		    const struct ubifs_znode *znode)
854 {
855 	int n;
856 	const struct ubifs_zbranch *zbr;
857 
858 	spin_lock(&dbg_lock);
859 	if (znode->parent)
860 		zbr = &znode->parent->zbranch[znode->iip];
861 	else
862 		zbr = &c->zroot;
863 
864 	printk(KERN_DEBUG "znode %p, LEB %d:%d len %d parent %p iip %d level %d"
865 	       " child_cnt %d flags %lx\n", znode, zbr->lnum, zbr->offs,
866 	       zbr->len, znode->parent, znode->iip, znode->level,
867 	       znode->child_cnt, znode->flags);
868 
869 	if (znode->child_cnt <= 0 || znode->child_cnt > c->fanout) {
870 		spin_unlock(&dbg_lock);
871 		return;
872 	}
873 
874 	printk(KERN_DEBUG "zbranches:\n");
875 	for (n = 0; n < znode->child_cnt; n++) {
876 		zbr = &znode->zbranch[n];
877 		if (znode->level > 0)
878 			printk(KERN_DEBUG "\t%d: znode %p LEB %d:%d len %d key "
879 					  "%s\n", n, zbr->znode, zbr->lnum,
880 					  zbr->offs, zbr->len,
881 					  DBGKEY(&zbr->key));
882 		else
883 			printk(KERN_DEBUG "\t%d: LNC %p LEB %d:%d len %d key "
884 					  "%s\n", n, zbr->znode, zbr->lnum,
885 					  zbr->offs, zbr->len,
886 					  DBGKEY(&zbr->key));
887 	}
888 	spin_unlock(&dbg_lock);
889 }
890 
891 void dbg_dump_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat)
892 {
893 	int i;
894 
895 	printk(KERN_DEBUG "(pid %d) start dumping heap cat %d (%d elements)\n",
896 	       current->pid, cat, heap->cnt);
897 	for (i = 0; i < heap->cnt; i++) {
898 		struct ubifs_lprops *lprops = heap->arr[i];
899 
900 		printk(KERN_DEBUG "\t%d. LEB %d hpos %d free %d dirty %d "
901 		       "flags %d\n", i, lprops->lnum, lprops->hpos,
902 		       lprops->free, lprops->dirty, lprops->flags);
903 	}
904 	printk(KERN_DEBUG "(pid %d) finish dumping heap\n", current->pid);
905 }
906 
907 void dbg_dump_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
908 		    struct ubifs_nnode *parent, int iip)
909 {
910 	int i;
911 
912 	printk(KERN_DEBUG "(pid %d) dumping pnode:\n", current->pid);
913 	printk(KERN_DEBUG "\taddress %zx parent %zx cnext %zx\n",
914 	       (size_t)pnode, (size_t)parent, (size_t)pnode->cnext);
915 	printk(KERN_DEBUG "\tflags %lu iip %d level %d num %d\n",
916 	       pnode->flags, iip, pnode->level, pnode->num);
917 	for (i = 0; i < UBIFS_LPT_FANOUT; i++) {
918 		struct ubifs_lprops *lp = &pnode->lprops[i];
919 
920 		printk(KERN_DEBUG "\t%d: free %d dirty %d flags %d lnum %d\n",
921 		       i, lp->free, lp->dirty, lp->flags, lp->lnum);
922 	}
923 }
924 
925 void dbg_dump_tnc(struct ubifs_info *c)
926 {
927 	struct ubifs_znode *znode;
928 	int level;
929 
930 	printk(KERN_DEBUG "\n");
931 	printk(KERN_DEBUG "(pid %d) start dumping TNC tree\n", current->pid);
932 	znode = ubifs_tnc_levelorder_next(c->zroot.znode, NULL);
933 	level = znode->level;
934 	printk(KERN_DEBUG "== Level %d ==\n", level);
935 	while (znode) {
936 		if (level != znode->level) {
937 			level = znode->level;
938 			printk(KERN_DEBUG "== Level %d ==\n", level);
939 		}
940 		dbg_dump_znode(c, znode);
941 		znode = ubifs_tnc_levelorder_next(c->zroot.znode, znode);
942 	}
943 	printk(KERN_DEBUG "(pid %d) finish dumping TNC tree\n", current->pid);
944 }
945 
946 static int dump_znode(struct ubifs_info *c, struct ubifs_znode *znode,
947 		      void *priv)
948 {
949 	dbg_dump_znode(c, znode);
950 	return 0;
951 }
952 
953 /**
954  * dbg_dump_index - dump the on-flash index.
955  * @c: UBIFS file-system description object
956  *
957  * This function dumps whole UBIFS indexing B-tree, unlike 'dbg_dump_tnc()'
958  * which dumps only in-memory znodes and does not read znodes which from flash.
959  */
960 void dbg_dump_index(struct ubifs_info *c)
961 {
962 	dbg_walk_index(c, NULL, dump_znode, NULL);
963 }
964 
965 /**
966  * dbg_save_space_info - save information about flash space.
967  * @c: UBIFS file-system description object
968  *
969  * This function saves information about UBIFS free space, dirty space, etc, in
970  * order to check it later.
971  */
972 void dbg_save_space_info(struct ubifs_info *c)
973 {
974 	struct ubifs_debug_info *d = c->dbg;
975 
976 	ubifs_get_lp_stats(c, &d->saved_lst);
977 
978 	spin_lock(&c->space_lock);
979 	d->saved_free = ubifs_get_free_space_nolock(c);
980 	spin_unlock(&c->space_lock);
981 }
982 
983 /**
984  * dbg_check_space_info - check flash space information.
985  * @c: UBIFS file-system description object
986  *
987  * This function compares current flash space information with the information
988  * which was saved when the 'dbg_save_space_info()' function was called.
989  * Returns zero if the information has not changed, and %-EINVAL it it has
990  * changed.
991  */
992 int dbg_check_space_info(struct ubifs_info *c)
993 {
994 	struct ubifs_debug_info *d = c->dbg;
995 	struct ubifs_lp_stats lst;
996 	long long avail, free;
997 
998 	spin_lock(&c->space_lock);
999 	avail = ubifs_calc_available(c, c->min_idx_lebs);
1000 	spin_unlock(&c->space_lock);
1001 	free = ubifs_get_free_space(c);
1002 
1003 	if (free != d->saved_free) {
1004 		ubifs_err("free space changed from %lld to %lld",
1005 			  d->saved_free, free);
1006 		goto out;
1007 	}
1008 
1009 	return 0;
1010 
1011 out:
1012 	ubifs_msg("saved lprops statistics dump");
1013 	dbg_dump_lstats(&d->saved_lst);
1014 	ubifs_get_lp_stats(c, &lst);
1015 
1016 	ubifs_msg("current lprops statistics dump");
1017 	dbg_dump_lstats(&lst);
1018 
1019 	spin_lock(&c->space_lock);
1020 	dbg_dump_budg(c);
1021 	spin_unlock(&c->space_lock);
1022 	dump_stack();
1023 	return -EINVAL;
1024 }
1025 
1026 /**
1027  * dbg_check_synced_i_size - check synchronized inode size.
1028  * @inode: inode to check
1029  *
1030  * If inode is clean, synchronized inode size has to be equivalent to current
1031  * inode size. This function has to be called only for locked inodes (@i_mutex
1032  * has to be locked). Returns %0 if synchronized inode size if correct, and
1033  * %-EINVAL if not.
1034  */
1035 int dbg_check_synced_i_size(struct inode *inode)
1036 {
1037 	int err = 0;
1038 	struct ubifs_inode *ui = ubifs_inode(inode);
1039 
1040 	if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
1041 		return 0;
1042 	if (!S_ISREG(inode->i_mode))
1043 		return 0;
1044 
1045 	mutex_lock(&ui->ui_mutex);
1046 	spin_lock(&ui->ui_lock);
1047 	if (ui->ui_size != ui->synced_i_size && !ui->dirty) {
1048 		ubifs_err("ui_size is %lld, synced_i_size is %lld, but inode "
1049 			  "is clean", ui->ui_size, ui->synced_i_size);
1050 		ubifs_err("i_ino %lu, i_mode %#x, i_size %lld", inode->i_ino,
1051 			  inode->i_mode, i_size_read(inode));
1052 		dbg_dump_stack();
1053 		err = -EINVAL;
1054 	}
1055 	spin_unlock(&ui->ui_lock);
1056 	mutex_unlock(&ui->ui_mutex);
1057 	return err;
1058 }
1059 
1060 /*
1061  * dbg_check_dir - check directory inode size and link count.
1062  * @c: UBIFS file-system description object
1063  * @dir: the directory to calculate size for
1064  * @size: the result is returned here
1065  *
1066  * This function makes sure that directory size and link count are correct.
1067  * Returns zero in case of success and a negative error code in case of
1068  * failure.
1069  *
1070  * Note, it is good idea to make sure the @dir->i_mutex is locked before
1071  * calling this function.
1072  */
1073 int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
1074 {
1075 	unsigned int nlink = 2;
1076 	union ubifs_key key;
1077 	struct ubifs_dent_node *dent, *pdent = NULL;
1078 	struct qstr nm = { .name = NULL };
1079 	loff_t size = UBIFS_INO_NODE_SZ;
1080 
1081 	if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
1082 		return 0;
1083 
1084 	if (!S_ISDIR(dir->i_mode))
1085 		return 0;
1086 
1087 	lowest_dent_key(c, &key, dir->i_ino);
1088 	while (1) {
1089 		int err;
1090 
1091 		dent = ubifs_tnc_next_ent(c, &key, &nm);
1092 		if (IS_ERR(dent)) {
1093 			err = PTR_ERR(dent);
1094 			if (err == -ENOENT)
1095 				break;
1096 			return err;
1097 		}
1098 
1099 		nm.name = dent->name;
1100 		nm.len = le16_to_cpu(dent->nlen);
1101 		size += CALC_DENT_SIZE(nm.len);
1102 		if (dent->type == UBIFS_ITYPE_DIR)
1103 			nlink += 1;
1104 		kfree(pdent);
1105 		pdent = dent;
1106 		key_read(c, &dent->key, &key);
1107 	}
1108 	kfree(pdent);
1109 
1110 	if (i_size_read(dir) != size) {
1111 		ubifs_err("directory inode %lu has size %llu, "
1112 			  "but calculated size is %llu", dir->i_ino,
1113 			  (unsigned long long)i_size_read(dir),
1114 			  (unsigned long long)size);
1115 		dump_stack();
1116 		return -EINVAL;
1117 	}
1118 	if (dir->i_nlink != nlink) {
1119 		ubifs_err("directory inode %lu has nlink %u, but calculated "
1120 			  "nlink is %u", dir->i_ino, dir->i_nlink, nlink);
1121 		dump_stack();
1122 		return -EINVAL;
1123 	}
1124 
1125 	return 0;
1126 }
1127 
1128 /**
1129  * dbg_check_key_order - make sure that colliding keys are properly ordered.
1130  * @c: UBIFS file-system description object
1131  * @zbr1: first zbranch
1132  * @zbr2: following zbranch
1133  *
1134  * In UBIFS indexing B-tree colliding keys has to be sorted in binary order of
1135  * names of the direntries/xentries which are referred by the keys. This
1136  * function reads direntries/xentries referred by @zbr1 and @zbr2 and makes
1137  * sure the name of direntry/xentry referred by @zbr1 is less than
1138  * direntry/xentry referred by @zbr2. Returns zero if this is true, %1 if not,
1139  * and a negative error code in case of failure.
1140  */
1141 static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
1142 			       struct ubifs_zbranch *zbr2)
1143 {
1144 	int err, nlen1, nlen2, cmp;
1145 	struct ubifs_dent_node *dent1, *dent2;
1146 	union ubifs_key key;
1147 
1148 	ubifs_assert(!keys_cmp(c, &zbr1->key, &zbr2->key));
1149 	dent1 = kmalloc(UBIFS_MAX_DENT_NODE_SZ, GFP_NOFS);
1150 	if (!dent1)
1151 		return -ENOMEM;
1152 	dent2 = kmalloc(UBIFS_MAX_DENT_NODE_SZ, GFP_NOFS);
1153 	if (!dent2) {
1154 		err = -ENOMEM;
1155 		goto out_free;
1156 	}
1157 
1158 	err = ubifs_tnc_read_node(c, zbr1, dent1);
1159 	if (err)
1160 		goto out_free;
1161 	err = ubifs_validate_entry(c, dent1);
1162 	if (err)
1163 		goto out_free;
1164 
1165 	err = ubifs_tnc_read_node(c, zbr2, dent2);
1166 	if (err)
1167 		goto out_free;
1168 	err = ubifs_validate_entry(c, dent2);
1169 	if (err)
1170 		goto out_free;
1171 
1172 	/* Make sure node keys are the same as in zbranch */
1173 	err = 1;
1174 	key_read(c, &dent1->key, &key);
1175 	if (keys_cmp(c, &zbr1->key, &key)) {
1176 		dbg_err("1st entry at %d:%d has key %s", zbr1->lnum,
1177 			zbr1->offs, DBGKEY(&key));
1178 		dbg_err("but it should have key %s according to tnc",
1179 			DBGKEY(&zbr1->key));
1180 		dbg_dump_node(c, dent1);
1181 		goto out_free;
1182 	}
1183 
1184 	key_read(c, &dent2->key, &key);
1185 	if (keys_cmp(c, &zbr2->key, &key)) {
1186 		dbg_err("2nd entry at %d:%d has key %s", zbr1->lnum,
1187 			zbr1->offs, DBGKEY(&key));
1188 		dbg_err("but it should have key %s according to tnc",
1189 			DBGKEY(&zbr2->key));
1190 		dbg_dump_node(c, dent2);
1191 		goto out_free;
1192 	}
1193 
1194 	nlen1 = le16_to_cpu(dent1->nlen);
1195 	nlen2 = le16_to_cpu(dent2->nlen);
1196 
1197 	cmp = memcmp(dent1->name, dent2->name, min_t(int, nlen1, nlen2));
1198 	if (cmp < 0 || (cmp == 0 && nlen1 < nlen2)) {
1199 		err = 0;
1200 		goto out_free;
1201 	}
1202 	if (cmp == 0 && nlen1 == nlen2)
1203 		dbg_err("2 xent/dent nodes with the same name");
1204 	else
1205 		dbg_err("bad order of colliding key %s",
1206 			DBGKEY(&key));
1207 
1208 	ubifs_msg("first node at %d:%d\n", zbr1->lnum, zbr1->offs);
1209 	dbg_dump_node(c, dent1);
1210 	ubifs_msg("second node at %d:%d\n", zbr2->lnum, zbr2->offs);
1211 	dbg_dump_node(c, dent2);
1212 
1213 out_free:
1214 	kfree(dent2);
1215 	kfree(dent1);
1216 	return err;
1217 }
1218 
1219 /**
1220  * dbg_check_znode - check if znode is all right.
1221  * @c: UBIFS file-system description object
1222  * @zbr: zbranch which points to this znode
1223  *
1224  * This function makes sure that znode referred to by @zbr is all right.
1225  * Returns zero if it is, and %-EINVAL if it is not.
1226  */
1227 static int dbg_check_znode(struct ubifs_info *c, struct ubifs_zbranch *zbr)
1228 {
1229 	struct ubifs_znode *znode = zbr->znode;
1230 	struct ubifs_znode *zp = znode->parent;
1231 	int n, err, cmp;
1232 
1233 	if (znode->child_cnt <= 0 || znode->child_cnt > c->fanout) {
1234 		err = 1;
1235 		goto out;
1236 	}
1237 	if (znode->level < 0) {
1238 		err = 2;
1239 		goto out;
1240 	}
1241 	if (znode->iip < 0 || znode->iip >= c->fanout) {
1242 		err = 3;
1243 		goto out;
1244 	}
1245 
1246 	if (zbr->len == 0)
1247 		/* Only dirty zbranch may have no on-flash nodes */
1248 		if (!ubifs_zn_dirty(znode)) {
1249 			err = 4;
1250 			goto out;
1251 		}
1252 
1253 	if (ubifs_zn_dirty(znode)) {
1254 		/*
1255 		 * If znode is dirty, its parent has to be dirty as well. The
1256 		 * order of the operation is important, so we have to have
1257 		 * memory barriers.
1258 		 */
1259 		smp_mb();
1260 		if (zp && !ubifs_zn_dirty(zp)) {
1261 			/*
1262 			 * The dirty flag is atomic and is cleared outside the
1263 			 * TNC mutex, so znode's dirty flag may now have
1264 			 * been cleared. The child is always cleared before the
1265 			 * parent, so we just need to check again.
1266 			 */
1267 			smp_mb();
1268 			if (ubifs_zn_dirty(znode)) {
1269 				err = 5;
1270 				goto out;
1271 			}
1272 		}
1273 	}
1274 
1275 	if (zp) {
1276 		const union ubifs_key *min, *max;
1277 
1278 		if (znode->level != zp->level - 1) {
1279 			err = 6;
1280 			goto out;
1281 		}
1282 
1283 		/* Make sure the 'parent' pointer in our znode is correct */
1284 		err = ubifs_search_zbranch(c, zp, &zbr->key, &n);
1285 		if (!err) {
1286 			/* This zbranch does not exist in the parent */
1287 			err = 7;
1288 			goto out;
1289 		}
1290 
1291 		if (znode->iip >= zp->child_cnt) {
1292 			err = 8;
1293 			goto out;
1294 		}
1295 
1296 		if (znode->iip != n) {
1297 			/* This may happen only in case of collisions */
1298 			if (keys_cmp(c, &zp->zbranch[n].key,
1299 				     &zp->zbranch[znode->iip].key)) {
1300 				err = 9;
1301 				goto out;
1302 			}
1303 			n = znode->iip;
1304 		}
1305 
1306 		/*
1307 		 * Make sure that the first key in our znode is greater than or
1308 		 * equal to the key in the pointing zbranch.
1309 		 */
1310 		min = &zbr->key;
1311 		cmp = keys_cmp(c, min, &znode->zbranch[0].key);
1312 		if (cmp == 1) {
1313 			err = 10;
1314 			goto out;
1315 		}
1316 
1317 		if (n + 1 < zp->child_cnt) {
1318 			max = &zp->zbranch[n + 1].key;
1319 
1320 			/*
1321 			 * Make sure the last key in our znode is less or
1322 			 * equivalent than the key in the zbranch which goes
1323 			 * after our pointing zbranch.
1324 			 */
1325 			cmp = keys_cmp(c, max,
1326 				&znode->zbranch[znode->child_cnt - 1].key);
1327 			if (cmp == -1) {
1328 				err = 11;
1329 				goto out;
1330 			}
1331 		}
1332 	} else {
1333 		/* This may only be root znode */
1334 		if (zbr != &c->zroot) {
1335 			err = 12;
1336 			goto out;
1337 		}
1338 	}
1339 
1340 	/*
1341 	 * Make sure that next key is greater or equivalent then the previous
1342 	 * one.
1343 	 */
1344 	for (n = 1; n < znode->child_cnt; n++) {
1345 		cmp = keys_cmp(c, &znode->zbranch[n - 1].key,
1346 			       &znode->zbranch[n].key);
1347 		if (cmp > 0) {
1348 			err = 13;
1349 			goto out;
1350 		}
1351 		if (cmp == 0) {
1352 			/* This can only be keys with colliding hash */
1353 			if (!is_hash_key(c, &znode->zbranch[n].key)) {
1354 				err = 14;
1355 				goto out;
1356 			}
1357 
1358 			if (znode->level != 0 || c->replaying)
1359 				continue;
1360 
1361 			/*
1362 			 * Colliding keys should follow binary order of
1363 			 * corresponding xentry/dentry names.
1364 			 */
1365 			err = dbg_check_key_order(c, &znode->zbranch[n - 1],
1366 						  &znode->zbranch[n]);
1367 			if (err < 0)
1368 				return err;
1369 			if (err) {
1370 				err = 15;
1371 				goto out;
1372 			}
1373 		}
1374 	}
1375 
1376 	for (n = 0; n < znode->child_cnt; n++) {
1377 		if (!znode->zbranch[n].znode &&
1378 		    (znode->zbranch[n].lnum == 0 ||
1379 		     znode->zbranch[n].len == 0)) {
1380 			err = 16;
1381 			goto out;
1382 		}
1383 
1384 		if (znode->zbranch[n].lnum != 0 &&
1385 		    znode->zbranch[n].len == 0) {
1386 			err = 17;
1387 			goto out;
1388 		}
1389 
1390 		if (znode->zbranch[n].lnum == 0 &&
1391 		    znode->zbranch[n].len != 0) {
1392 			err = 18;
1393 			goto out;
1394 		}
1395 
1396 		if (znode->zbranch[n].lnum == 0 &&
1397 		    znode->zbranch[n].offs != 0) {
1398 			err = 19;
1399 			goto out;
1400 		}
1401 
1402 		if (znode->level != 0 && znode->zbranch[n].znode)
1403 			if (znode->zbranch[n].znode->parent != znode) {
1404 				err = 20;
1405 				goto out;
1406 			}
1407 	}
1408 
1409 	return 0;
1410 
1411 out:
1412 	ubifs_err("failed, error %d", err);
1413 	ubifs_msg("dump of the znode");
1414 	dbg_dump_znode(c, znode);
1415 	if (zp) {
1416 		ubifs_msg("dump of the parent znode");
1417 		dbg_dump_znode(c, zp);
1418 	}
1419 	dump_stack();
1420 	return -EINVAL;
1421 }
1422 
1423 /**
1424  * dbg_check_tnc - check TNC tree.
1425  * @c: UBIFS file-system description object
1426  * @extra: do extra checks that are possible at start commit
1427  *
1428  * This function traverses whole TNC tree and checks every znode. Returns zero
1429  * if everything is all right and %-EINVAL if something is wrong with TNC.
1430  */
1431 int dbg_check_tnc(struct ubifs_info *c, int extra)
1432 {
1433 	struct ubifs_znode *znode;
1434 	long clean_cnt = 0, dirty_cnt = 0;
1435 	int err, last;
1436 
1437 	if (!(ubifs_chk_flags & UBIFS_CHK_TNC))
1438 		return 0;
1439 
1440 	ubifs_assert(mutex_is_locked(&c->tnc_mutex));
1441 	if (!c->zroot.znode)
1442 		return 0;
1443 
1444 	znode = ubifs_tnc_postorder_first(c->zroot.znode);
1445 	while (1) {
1446 		struct ubifs_znode *prev;
1447 		struct ubifs_zbranch *zbr;
1448 
1449 		if (!znode->parent)
1450 			zbr = &c->zroot;
1451 		else
1452 			zbr = &znode->parent->zbranch[znode->iip];
1453 
1454 		err = dbg_check_znode(c, zbr);
1455 		if (err)
1456 			return err;
1457 
1458 		if (extra) {
1459 			if (ubifs_zn_dirty(znode))
1460 				dirty_cnt += 1;
1461 			else
1462 				clean_cnt += 1;
1463 		}
1464 
1465 		prev = znode;
1466 		znode = ubifs_tnc_postorder_next(znode);
1467 		if (!znode)
1468 			break;
1469 
1470 		/*
1471 		 * If the last key of this znode is equivalent to the first key
1472 		 * of the next znode (collision), then check order of the keys.
1473 		 */
1474 		last = prev->child_cnt - 1;
1475 		if (prev->level == 0 && znode->level == 0 && !c->replaying &&
1476 		    !keys_cmp(c, &prev->zbranch[last].key,
1477 			      &znode->zbranch[0].key)) {
1478 			err = dbg_check_key_order(c, &prev->zbranch[last],
1479 						  &znode->zbranch[0]);
1480 			if (err < 0)
1481 				return err;
1482 			if (err) {
1483 				ubifs_msg("first znode");
1484 				dbg_dump_znode(c, prev);
1485 				ubifs_msg("second znode");
1486 				dbg_dump_znode(c, znode);
1487 				return -EINVAL;
1488 			}
1489 		}
1490 	}
1491 
1492 	if (extra) {
1493 		if (clean_cnt != atomic_long_read(&c->clean_zn_cnt)) {
1494 			ubifs_err("incorrect clean_zn_cnt %ld, calculated %ld",
1495 				  atomic_long_read(&c->clean_zn_cnt),
1496 				  clean_cnt);
1497 			return -EINVAL;
1498 		}
1499 		if (dirty_cnt != atomic_long_read(&c->dirty_zn_cnt)) {
1500 			ubifs_err("incorrect dirty_zn_cnt %ld, calculated %ld",
1501 				  atomic_long_read(&c->dirty_zn_cnt),
1502 				  dirty_cnt);
1503 			return -EINVAL;
1504 		}
1505 	}
1506 
1507 	return 0;
1508 }
1509 
1510 /**
1511  * dbg_walk_index - walk the on-flash index.
1512  * @c: UBIFS file-system description object
1513  * @leaf_cb: called for each leaf node
1514  * @znode_cb: called for each indexing node
1515  * @priv: private data which is passed to callbacks
1516  *
1517  * This function walks the UBIFS index and calls the @leaf_cb for each leaf
1518  * node and @znode_cb for each indexing node. Returns zero in case of success
1519  * and a negative error code in case of failure.
1520  *
1521  * It would be better if this function removed every znode it pulled to into
1522  * the TNC, so that the behavior more closely matched the non-debugging
1523  * behavior.
1524  */
1525 int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
1526 		   dbg_znode_callback znode_cb, void *priv)
1527 {
1528 	int err;
1529 	struct ubifs_zbranch *zbr;
1530 	struct ubifs_znode *znode, *child;
1531 
1532 	mutex_lock(&c->tnc_mutex);
1533 	/* If the root indexing node is not in TNC - pull it */
1534 	if (!c->zroot.znode) {
1535 		c->zroot.znode = ubifs_load_znode(c, &c->zroot, NULL, 0);
1536 		if (IS_ERR(c->zroot.znode)) {
1537 			err = PTR_ERR(c->zroot.znode);
1538 			c->zroot.znode = NULL;
1539 			goto out_unlock;
1540 		}
1541 	}
1542 
1543 	/*
1544 	 * We are going to traverse the indexing tree in the postorder manner.
1545 	 * Go down and find the leftmost indexing node where we are going to
1546 	 * start from.
1547 	 */
1548 	znode = c->zroot.znode;
1549 	while (znode->level > 0) {
1550 		zbr = &znode->zbranch[0];
1551 		child = zbr->znode;
1552 		if (!child) {
1553 			child = ubifs_load_znode(c, zbr, znode, 0);
1554 			if (IS_ERR(child)) {
1555 				err = PTR_ERR(child);
1556 				goto out_unlock;
1557 			}
1558 			zbr->znode = child;
1559 		}
1560 
1561 		znode = child;
1562 	}
1563 
1564 	/* Iterate over all indexing nodes */
1565 	while (1) {
1566 		int idx;
1567 
1568 		cond_resched();
1569 
1570 		if (znode_cb) {
1571 			err = znode_cb(c, znode, priv);
1572 			if (err) {
1573 				ubifs_err("znode checking function returned "
1574 					  "error %d", err);
1575 				dbg_dump_znode(c, znode);
1576 				goto out_dump;
1577 			}
1578 		}
1579 		if (leaf_cb && znode->level == 0) {
1580 			for (idx = 0; idx < znode->child_cnt; idx++) {
1581 				zbr = &znode->zbranch[idx];
1582 				err = leaf_cb(c, zbr, priv);
1583 				if (err) {
1584 					ubifs_err("leaf checking function "
1585 						  "returned error %d, for leaf "
1586 						  "at LEB %d:%d",
1587 						  err, zbr->lnum, zbr->offs);
1588 					goto out_dump;
1589 				}
1590 			}
1591 		}
1592 
1593 		if (!znode->parent)
1594 			break;
1595 
1596 		idx = znode->iip + 1;
1597 		znode = znode->parent;
1598 		if (idx < znode->child_cnt) {
1599 			/* Switch to the next index in the parent */
1600 			zbr = &znode->zbranch[idx];
1601 			child = zbr->znode;
1602 			if (!child) {
1603 				child = ubifs_load_znode(c, zbr, znode, idx);
1604 				if (IS_ERR(child)) {
1605 					err = PTR_ERR(child);
1606 					goto out_unlock;
1607 				}
1608 				zbr->znode = child;
1609 			}
1610 			znode = child;
1611 		} else
1612 			/*
1613 			 * This is the last child, switch to the parent and
1614 			 * continue.
1615 			 */
1616 			continue;
1617 
1618 		/* Go to the lowest leftmost znode in the new sub-tree */
1619 		while (znode->level > 0) {
1620 			zbr = &znode->zbranch[0];
1621 			child = zbr->znode;
1622 			if (!child) {
1623 				child = ubifs_load_znode(c, zbr, znode, 0);
1624 				if (IS_ERR(child)) {
1625 					err = PTR_ERR(child);
1626 					goto out_unlock;
1627 				}
1628 				zbr->znode = child;
1629 			}
1630 			znode = child;
1631 		}
1632 	}
1633 
1634 	mutex_unlock(&c->tnc_mutex);
1635 	return 0;
1636 
1637 out_dump:
1638 	if (znode->parent)
1639 		zbr = &znode->parent->zbranch[znode->iip];
1640 	else
1641 		zbr = &c->zroot;
1642 	ubifs_msg("dump of znode at LEB %d:%d", zbr->lnum, zbr->offs);
1643 	dbg_dump_znode(c, znode);
1644 out_unlock:
1645 	mutex_unlock(&c->tnc_mutex);
1646 	return err;
1647 }
1648 
1649 /**
1650  * add_size - add znode size to partially calculated index size.
1651  * @c: UBIFS file-system description object
1652  * @znode: znode to add size for
1653  * @priv: partially calculated index size
1654  *
1655  * This is a helper function for 'dbg_check_idx_size()' which is called for
1656  * every indexing node and adds its size to the 'long long' variable pointed to
1657  * by @priv.
1658  */
1659 static int add_size(struct ubifs_info *c, struct ubifs_znode *znode, void *priv)
1660 {
1661 	long long *idx_size = priv;
1662 	int add;
1663 
1664 	add = ubifs_idx_node_sz(c, znode->child_cnt);
1665 	add = ALIGN(add, 8);
1666 	*idx_size += add;
1667 	return 0;
1668 }
1669 
1670 /**
1671  * dbg_check_idx_size - check index size.
1672  * @c: UBIFS file-system description object
1673  * @idx_size: size to check
1674  *
1675  * This function walks the UBIFS index, calculates its size and checks that the
1676  * size is equivalent to @idx_size. Returns zero in case of success and a
1677  * negative error code in case of failure.
1678  */
1679 int dbg_check_idx_size(struct ubifs_info *c, long long idx_size)
1680 {
1681 	int err;
1682 	long long calc = 0;
1683 
1684 	if (!(ubifs_chk_flags & UBIFS_CHK_IDX_SZ))
1685 		return 0;
1686 
1687 	err = dbg_walk_index(c, NULL, add_size, &calc);
1688 	if (err) {
1689 		ubifs_err("error %d while walking the index", err);
1690 		return err;
1691 	}
1692 
1693 	if (calc != idx_size) {
1694 		ubifs_err("index size check failed: calculated size is %lld, "
1695 			  "should be %lld", calc, idx_size);
1696 		dump_stack();
1697 		return -EINVAL;
1698 	}
1699 
1700 	return 0;
1701 }
1702 
1703 /**
1704  * struct fsck_inode - information about an inode used when checking the file-system.
1705  * @rb: link in the RB-tree of inodes
1706  * @inum: inode number
1707  * @mode: inode type, permissions, etc
1708  * @nlink: inode link count
1709  * @xattr_cnt: count of extended attributes
1710  * @references: how many directory/xattr entries refer this inode (calculated
1711  *              while walking the index)
1712  * @calc_cnt: for directory inode count of child directories
1713  * @size: inode size (read from on-flash inode)
1714  * @xattr_sz: summary size of all extended attributes (read from on-flash
1715  *            inode)
1716  * @calc_sz: for directories calculated directory size
1717  * @calc_xcnt: count of extended attributes
1718  * @calc_xsz: calculated summary size of all extended attributes
1719  * @xattr_nms: sum of lengths of all extended attribute names belonging to this
1720  *             inode (read from on-flash inode)
1721  * @calc_xnms: calculated sum of lengths of all extended attribute names
1722  */
1723 struct fsck_inode {
1724 	struct rb_node rb;
1725 	ino_t inum;
1726 	umode_t mode;
1727 	unsigned int nlink;
1728 	unsigned int xattr_cnt;
1729 	int references;
1730 	int calc_cnt;
1731 	long long size;
1732 	unsigned int xattr_sz;
1733 	long long calc_sz;
1734 	long long calc_xcnt;
1735 	long long calc_xsz;
1736 	unsigned int xattr_nms;
1737 	long long calc_xnms;
1738 };
1739 
1740 /**
1741  * struct fsck_data - private FS checking information.
1742  * @inodes: RB-tree of all inodes (contains @struct fsck_inode objects)
1743  */
1744 struct fsck_data {
1745 	struct rb_root inodes;
1746 };
1747 
1748 /**
1749  * add_inode - add inode information to RB-tree of inodes.
1750  * @c: UBIFS file-system description object
1751  * @fsckd: FS checking information
1752  * @ino: raw UBIFS inode to add
1753  *
1754  * This is a helper function for 'check_leaf()' which adds information about
1755  * inode @ino to the RB-tree of inodes. Returns inode information pointer in
1756  * case of success and a negative error code in case of failure.
1757  */
1758 static struct fsck_inode *add_inode(struct ubifs_info *c,
1759 				    struct fsck_data *fsckd,
1760 				    struct ubifs_ino_node *ino)
1761 {
1762 	struct rb_node **p, *parent = NULL;
1763 	struct fsck_inode *fscki;
1764 	ino_t inum = key_inum_flash(c, &ino->key);
1765 
1766 	p = &fsckd->inodes.rb_node;
1767 	while (*p) {
1768 		parent = *p;
1769 		fscki = rb_entry(parent, struct fsck_inode, rb);
1770 		if (inum < fscki->inum)
1771 			p = &(*p)->rb_left;
1772 		else if (inum > fscki->inum)
1773 			p = &(*p)->rb_right;
1774 		else
1775 			return fscki;
1776 	}
1777 
1778 	if (inum > c->highest_inum) {
1779 		ubifs_err("too high inode number, max. is %lu",
1780 			  (unsigned long)c->highest_inum);
1781 		return ERR_PTR(-EINVAL);
1782 	}
1783 
1784 	fscki = kzalloc(sizeof(struct fsck_inode), GFP_NOFS);
1785 	if (!fscki)
1786 		return ERR_PTR(-ENOMEM);
1787 
1788 	fscki->inum = inum;
1789 	fscki->nlink = le32_to_cpu(ino->nlink);
1790 	fscki->size = le64_to_cpu(ino->size);
1791 	fscki->xattr_cnt = le32_to_cpu(ino->xattr_cnt);
1792 	fscki->xattr_sz = le32_to_cpu(ino->xattr_size);
1793 	fscki->xattr_nms = le32_to_cpu(ino->xattr_names);
1794 	fscki->mode = le32_to_cpu(ino->mode);
1795 	if (S_ISDIR(fscki->mode)) {
1796 		fscki->calc_sz = UBIFS_INO_NODE_SZ;
1797 		fscki->calc_cnt = 2;
1798 	}
1799 	rb_link_node(&fscki->rb, parent, p);
1800 	rb_insert_color(&fscki->rb, &fsckd->inodes);
1801 	return fscki;
1802 }
1803 
1804 /**
1805  * search_inode - search inode in the RB-tree of inodes.
1806  * @fsckd: FS checking information
1807  * @inum: inode number to search
1808  *
1809  * This is a helper function for 'check_leaf()' which searches inode @inum in
1810  * the RB-tree of inodes and returns an inode information pointer or %NULL if
1811  * the inode was not found.
1812  */
1813 static struct fsck_inode *search_inode(struct fsck_data *fsckd, ino_t inum)
1814 {
1815 	struct rb_node *p;
1816 	struct fsck_inode *fscki;
1817 
1818 	p = fsckd->inodes.rb_node;
1819 	while (p) {
1820 		fscki = rb_entry(p, struct fsck_inode, rb);
1821 		if (inum < fscki->inum)
1822 			p = p->rb_left;
1823 		else if (inum > fscki->inum)
1824 			p = p->rb_right;
1825 		else
1826 			return fscki;
1827 	}
1828 	return NULL;
1829 }
1830 
1831 /**
1832  * read_add_inode - read inode node and add it to RB-tree of inodes.
1833  * @c: UBIFS file-system description object
1834  * @fsckd: FS checking information
1835  * @inum: inode number to read
1836  *
1837  * This is a helper function for 'check_leaf()' which finds inode node @inum in
1838  * the index, reads it, and adds it to the RB-tree of inodes. Returns inode
1839  * information pointer in case of success and a negative error code in case of
1840  * failure.
1841  */
1842 static struct fsck_inode *read_add_inode(struct ubifs_info *c,
1843 					 struct fsck_data *fsckd, ino_t inum)
1844 {
1845 	int n, err;
1846 	union ubifs_key key;
1847 	struct ubifs_znode *znode;
1848 	struct ubifs_zbranch *zbr;
1849 	struct ubifs_ino_node *ino;
1850 	struct fsck_inode *fscki;
1851 
1852 	fscki = search_inode(fsckd, inum);
1853 	if (fscki)
1854 		return fscki;
1855 
1856 	ino_key_init(c, &key, inum);
1857 	err = ubifs_lookup_level0(c, &key, &znode, &n);
1858 	if (!err) {
1859 		ubifs_err("inode %lu not found in index", (unsigned long)inum);
1860 		return ERR_PTR(-ENOENT);
1861 	} else if (err < 0) {
1862 		ubifs_err("error %d while looking up inode %lu",
1863 			  err, (unsigned long)inum);
1864 		return ERR_PTR(err);
1865 	}
1866 
1867 	zbr = &znode->zbranch[n];
1868 	if (zbr->len < UBIFS_INO_NODE_SZ) {
1869 		ubifs_err("bad node %lu node length %d",
1870 			  (unsigned long)inum, zbr->len);
1871 		return ERR_PTR(-EINVAL);
1872 	}
1873 
1874 	ino = kmalloc(zbr->len, GFP_NOFS);
1875 	if (!ino)
1876 		return ERR_PTR(-ENOMEM);
1877 
1878 	err = ubifs_tnc_read_node(c, zbr, ino);
1879 	if (err) {
1880 		ubifs_err("cannot read inode node at LEB %d:%d, error %d",
1881 			  zbr->lnum, zbr->offs, err);
1882 		kfree(ino);
1883 		return ERR_PTR(err);
1884 	}
1885 
1886 	fscki = add_inode(c, fsckd, ino);
1887 	kfree(ino);
1888 	if (IS_ERR(fscki)) {
1889 		ubifs_err("error %ld while adding inode %lu node",
1890 			  PTR_ERR(fscki), (unsigned long)inum);
1891 		return fscki;
1892 	}
1893 
1894 	return fscki;
1895 }
1896 
1897 /**
1898  * check_leaf - check leaf node.
1899  * @c: UBIFS file-system description object
1900  * @zbr: zbranch of the leaf node to check
1901  * @priv: FS checking information
1902  *
1903  * This is a helper function for 'dbg_check_filesystem()' which is called for
1904  * every single leaf node while walking the indexing tree. It checks that the
1905  * leaf node referred from the indexing tree exists, has correct CRC, and does
1906  * some other basic validation. This function is also responsible for building
1907  * an RB-tree of inodes - it adds all inodes into the RB-tree. It also
1908  * calculates reference count, size, etc for each inode in order to later
1909  * compare them to the information stored inside the inodes and detect possible
1910  * inconsistencies. Returns zero in case of success and a negative error code
1911  * in case of failure.
1912  */
1913 static int check_leaf(struct ubifs_info *c, struct ubifs_zbranch *zbr,
1914 		      void *priv)
1915 {
1916 	ino_t inum;
1917 	void *node;
1918 	struct ubifs_ch *ch;
1919 	int err, type = key_type(c, &zbr->key);
1920 	struct fsck_inode *fscki;
1921 
1922 	if (zbr->len < UBIFS_CH_SZ) {
1923 		ubifs_err("bad leaf length %d (LEB %d:%d)",
1924 			  zbr->len, zbr->lnum, zbr->offs);
1925 		return -EINVAL;
1926 	}
1927 
1928 	node = kmalloc(zbr->len, GFP_NOFS);
1929 	if (!node)
1930 		return -ENOMEM;
1931 
1932 	err = ubifs_tnc_read_node(c, zbr, node);
1933 	if (err) {
1934 		ubifs_err("cannot read leaf node at LEB %d:%d, error %d",
1935 			  zbr->lnum, zbr->offs, err);
1936 		goto out_free;
1937 	}
1938 
1939 	/* If this is an inode node, add it to RB-tree of inodes */
1940 	if (type == UBIFS_INO_KEY) {
1941 		fscki = add_inode(c, priv, node);
1942 		if (IS_ERR(fscki)) {
1943 			err = PTR_ERR(fscki);
1944 			ubifs_err("error %d while adding inode node", err);
1945 			goto out_dump;
1946 		}
1947 		goto out;
1948 	}
1949 
1950 	if (type != UBIFS_DENT_KEY && type != UBIFS_XENT_KEY &&
1951 	    type != UBIFS_DATA_KEY) {
1952 		ubifs_err("unexpected node type %d at LEB %d:%d",
1953 			  type, zbr->lnum, zbr->offs);
1954 		err = -EINVAL;
1955 		goto out_free;
1956 	}
1957 
1958 	ch = node;
1959 	if (le64_to_cpu(ch->sqnum) > c->max_sqnum) {
1960 		ubifs_err("too high sequence number, max. is %llu",
1961 			  c->max_sqnum);
1962 		err = -EINVAL;
1963 		goto out_dump;
1964 	}
1965 
1966 	if (type == UBIFS_DATA_KEY) {
1967 		long long blk_offs;
1968 		struct ubifs_data_node *dn = node;
1969 
1970 		/*
1971 		 * Search the inode node this data node belongs to and insert
1972 		 * it to the RB-tree of inodes.
1973 		 */
1974 		inum = key_inum_flash(c, &dn->key);
1975 		fscki = read_add_inode(c, priv, inum);
1976 		if (IS_ERR(fscki)) {
1977 			err = PTR_ERR(fscki);
1978 			ubifs_err("error %d while processing data node and "
1979 				  "trying to find inode node %lu",
1980 				  err, (unsigned long)inum);
1981 			goto out_dump;
1982 		}
1983 
1984 		/* Make sure the data node is within inode size */
1985 		blk_offs = key_block_flash(c, &dn->key);
1986 		blk_offs <<= UBIFS_BLOCK_SHIFT;
1987 		blk_offs += le32_to_cpu(dn->size);
1988 		if (blk_offs > fscki->size) {
1989 			ubifs_err("data node at LEB %d:%d is not within inode "
1990 				  "size %lld", zbr->lnum, zbr->offs,
1991 				  fscki->size);
1992 			err = -EINVAL;
1993 			goto out_dump;
1994 		}
1995 	} else {
1996 		int nlen;
1997 		struct ubifs_dent_node *dent = node;
1998 		struct fsck_inode *fscki1;
1999 
2000 		err = ubifs_validate_entry(c, dent);
2001 		if (err)
2002 			goto out_dump;
2003 
2004 		/*
2005 		 * Search the inode node this entry refers to and the parent
2006 		 * inode node and insert them to the RB-tree of inodes.
2007 		 */
2008 		inum = le64_to_cpu(dent->inum);
2009 		fscki = read_add_inode(c, priv, inum);
2010 		if (IS_ERR(fscki)) {
2011 			err = PTR_ERR(fscki);
2012 			ubifs_err("error %d while processing entry node and "
2013 				  "trying to find inode node %lu",
2014 				  err, (unsigned long)inum);
2015 			goto out_dump;
2016 		}
2017 
2018 		/* Count how many direntries or xentries refers this inode */
2019 		fscki->references += 1;
2020 
2021 		inum = key_inum_flash(c, &dent->key);
2022 		fscki1 = read_add_inode(c, priv, inum);
2023 		if (IS_ERR(fscki1)) {
2024 			err = PTR_ERR(fscki1);
2025 			ubifs_err("error %d while processing entry node and "
2026 				  "trying to find parent inode node %lu",
2027 				  err, (unsigned long)inum);
2028 			goto out_dump;
2029 		}
2030 
2031 		nlen = le16_to_cpu(dent->nlen);
2032 		if (type == UBIFS_XENT_KEY) {
2033 			fscki1->calc_xcnt += 1;
2034 			fscki1->calc_xsz += CALC_DENT_SIZE(nlen);
2035 			fscki1->calc_xsz += CALC_XATTR_BYTES(fscki->size);
2036 			fscki1->calc_xnms += nlen;
2037 		} else {
2038 			fscki1->calc_sz += CALC_DENT_SIZE(nlen);
2039 			if (dent->type == UBIFS_ITYPE_DIR)
2040 				fscki1->calc_cnt += 1;
2041 		}
2042 	}
2043 
2044 out:
2045 	kfree(node);
2046 	return 0;
2047 
2048 out_dump:
2049 	ubifs_msg("dump of node at LEB %d:%d", zbr->lnum, zbr->offs);
2050 	dbg_dump_node(c, node);
2051 out_free:
2052 	kfree(node);
2053 	return err;
2054 }
2055 
2056 /**
2057  * free_inodes - free RB-tree of inodes.
2058  * @fsckd: FS checking information
2059  */
2060 static void free_inodes(struct fsck_data *fsckd)
2061 {
2062 	struct rb_node *this = fsckd->inodes.rb_node;
2063 	struct fsck_inode *fscki;
2064 
2065 	while (this) {
2066 		if (this->rb_left)
2067 			this = this->rb_left;
2068 		else if (this->rb_right)
2069 			this = this->rb_right;
2070 		else {
2071 			fscki = rb_entry(this, struct fsck_inode, rb);
2072 			this = rb_parent(this);
2073 			if (this) {
2074 				if (this->rb_left == &fscki->rb)
2075 					this->rb_left = NULL;
2076 				else
2077 					this->rb_right = NULL;
2078 			}
2079 			kfree(fscki);
2080 		}
2081 	}
2082 }
2083 
2084 /**
2085  * check_inodes - checks all inodes.
2086  * @c: UBIFS file-system description object
2087  * @fsckd: FS checking information
2088  *
2089  * This is a helper function for 'dbg_check_filesystem()' which walks the
2090  * RB-tree of inodes after the index scan has been finished, and checks that
2091  * inode nlink, size, etc are correct. Returns zero if inodes are fine,
2092  * %-EINVAL if not, and a negative error code in case of failure.
2093  */
2094 static int check_inodes(struct ubifs_info *c, struct fsck_data *fsckd)
2095 {
2096 	int n, err;
2097 	union ubifs_key key;
2098 	struct ubifs_znode *znode;
2099 	struct ubifs_zbranch *zbr;
2100 	struct ubifs_ino_node *ino;
2101 	struct fsck_inode *fscki;
2102 	struct rb_node *this = rb_first(&fsckd->inodes);
2103 
2104 	while (this) {
2105 		fscki = rb_entry(this, struct fsck_inode, rb);
2106 		this = rb_next(this);
2107 
2108 		if (S_ISDIR(fscki->mode)) {
2109 			/*
2110 			 * Directories have to have exactly one reference (they
2111 			 * cannot have hardlinks), although root inode is an
2112 			 * exception.
2113 			 */
2114 			if (fscki->inum != UBIFS_ROOT_INO &&
2115 			    fscki->references != 1) {
2116 				ubifs_err("directory inode %lu has %d "
2117 					  "direntries which refer it, but "
2118 					  "should be 1",
2119 					  (unsigned long)fscki->inum,
2120 					  fscki->references);
2121 				goto out_dump;
2122 			}
2123 			if (fscki->inum == UBIFS_ROOT_INO &&
2124 			    fscki->references != 0) {
2125 				ubifs_err("root inode %lu has non-zero (%d) "
2126 					  "direntries which refer it",
2127 					  (unsigned long)fscki->inum,
2128 					  fscki->references);
2129 				goto out_dump;
2130 			}
2131 			if (fscki->calc_sz != fscki->size) {
2132 				ubifs_err("directory inode %lu size is %lld, "
2133 					  "but calculated size is %lld",
2134 					  (unsigned long)fscki->inum,
2135 					  fscki->size, fscki->calc_sz);
2136 				goto out_dump;
2137 			}
2138 			if (fscki->calc_cnt != fscki->nlink) {
2139 				ubifs_err("directory inode %lu nlink is %d, "
2140 					  "but calculated nlink is %d",
2141 					  (unsigned long)fscki->inum,
2142 					  fscki->nlink, fscki->calc_cnt);
2143 				goto out_dump;
2144 			}
2145 		} else {
2146 			if (fscki->references != fscki->nlink) {
2147 				ubifs_err("inode %lu nlink is %d, but "
2148 					  "calculated nlink is %d",
2149 					  (unsigned long)fscki->inum,
2150 					  fscki->nlink, fscki->references);
2151 				goto out_dump;
2152 			}
2153 		}
2154 		if (fscki->xattr_sz != fscki->calc_xsz) {
2155 			ubifs_err("inode %lu has xattr size %u, but "
2156 				  "calculated size is %lld",
2157 				  (unsigned long)fscki->inum, fscki->xattr_sz,
2158 				  fscki->calc_xsz);
2159 			goto out_dump;
2160 		}
2161 		if (fscki->xattr_cnt != fscki->calc_xcnt) {
2162 			ubifs_err("inode %lu has %u xattrs, but "
2163 				  "calculated count is %lld",
2164 				  (unsigned long)fscki->inum,
2165 				  fscki->xattr_cnt, fscki->calc_xcnt);
2166 			goto out_dump;
2167 		}
2168 		if (fscki->xattr_nms != fscki->calc_xnms) {
2169 			ubifs_err("inode %lu has xattr names' size %u, but "
2170 				  "calculated names' size is %lld",
2171 				  (unsigned long)fscki->inum, fscki->xattr_nms,
2172 				  fscki->calc_xnms);
2173 			goto out_dump;
2174 		}
2175 	}
2176 
2177 	return 0;
2178 
2179 out_dump:
2180 	/* Read the bad inode and dump it */
2181 	ino_key_init(c, &key, fscki->inum);
2182 	err = ubifs_lookup_level0(c, &key, &znode, &n);
2183 	if (!err) {
2184 		ubifs_err("inode %lu not found in index",
2185 			  (unsigned long)fscki->inum);
2186 		return -ENOENT;
2187 	} else if (err < 0) {
2188 		ubifs_err("error %d while looking up inode %lu",
2189 			  err, (unsigned long)fscki->inum);
2190 		return err;
2191 	}
2192 
2193 	zbr = &znode->zbranch[n];
2194 	ino = kmalloc(zbr->len, GFP_NOFS);
2195 	if (!ino)
2196 		return -ENOMEM;
2197 
2198 	err = ubifs_tnc_read_node(c, zbr, ino);
2199 	if (err) {
2200 		ubifs_err("cannot read inode node at LEB %d:%d, error %d",
2201 			  zbr->lnum, zbr->offs, err);
2202 		kfree(ino);
2203 		return err;
2204 	}
2205 
2206 	ubifs_msg("dump of the inode %lu sitting in LEB %d:%d",
2207 		  (unsigned long)fscki->inum, zbr->lnum, zbr->offs);
2208 	dbg_dump_node(c, ino);
2209 	kfree(ino);
2210 	return -EINVAL;
2211 }
2212 
2213 /**
2214  * dbg_check_filesystem - check the file-system.
2215  * @c: UBIFS file-system description object
2216  *
2217  * This function checks the file system, namely:
2218  * o makes sure that all leaf nodes exist and their CRCs are correct;
2219  * o makes sure inode nlink, size, xattr size/count are correct (for all
2220  *   inodes).
2221  *
2222  * The function reads whole indexing tree and all nodes, so it is pretty
2223  * heavy-weight. Returns zero if the file-system is consistent, %-EINVAL if
2224  * not, and a negative error code in case of failure.
2225  */
2226 int dbg_check_filesystem(struct ubifs_info *c)
2227 {
2228 	int err;
2229 	struct fsck_data fsckd;
2230 
2231 	if (!(ubifs_chk_flags & UBIFS_CHK_FS))
2232 		return 0;
2233 
2234 	fsckd.inodes = RB_ROOT;
2235 	err = dbg_walk_index(c, check_leaf, NULL, &fsckd);
2236 	if (err)
2237 		goto out_free;
2238 
2239 	err = check_inodes(c, &fsckd);
2240 	if (err)
2241 		goto out_free;
2242 
2243 	free_inodes(&fsckd);
2244 	return 0;
2245 
2246 out_free:
2247 	ubifs_err("file-system check failed with error %d", err);
2248 	dump_stack();
2249 	free_inodes(&fsckd);
2250 	return err;
2251 }
2252 
2253 /**
2254  * dbg_check_data_nodes_order - check that list of data nodes is sorted.
2255  * @c: UBIFS file-system description object
2256  * @head: the list of nodes ('struct ubifs_scan_node' objects)
2257  *
2258  * This function returns zero if the list of data nodes is sorted correctly,
2259  * and %-EINVAL if not.
2260  */
2261 int dbg_check_data_nodes_order(struct ubifs_info *c, struct list_head *head)
2262 {
2263 	struct list_head *cur;
2264 	struct ubifs_scan_node *sa, *sb;
2265 
2266 	if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
2267 		return 0;
2268 
2269 	for (cur = head->next; cur->next != head; cur = cur->next) {
2270 		ino_t inuma, inumb;
2271 		uint32_t blka, blkb;
2272 
2273 		cond_resched();
2274 		sa = container_of(cur, struct ubifs_scan_node, list);
2275 		sb = container_of(cur->next, struct ubifs_scan_node, list);
2276 
2277 		if (sa->type != UBIFS_DATA_NODE) {
2278 			ubifs_err("bad node type %d", sa->type);
2279 			dbg_dump_node(c, sa->node);
2280 			return -EINVAL;
2281 		}
2282 		if (sb->type != UBIFS_DATA_NODE) {
2283 			ubifs_err("bad node type %d", sb->type);
2284 			dbg_dump_node(c, sb->node);
2285 			return -EINVAL;
2286 		}
2287 
2288 		inuma = key_inum(c, &sa->key);
2289 		inumb = key_inum(c, &sb->key);
2290 
2291 		if (inuma < inumb)
2292 			continue;
2293 		if (inuma > inumb) {
2294 			ubifs_err("larger inum %lu goes before inum %lu",
2295 				  (unsigned long)inuma, (unsigned long)inumb);
2296 			goto error_dump;
2297 		}
2298 
2299 		blka = key_block(c, &sa->key);
2300 		blkb = key_block(c, &sb->key);
2301 
2302 		if (blka > blkb) {
2303 			ubifs_err("larger block %u goes before %u", blka, blkb);
2304 			goto error_dump;
2305 		}
2306 		if (blka == blkb) {
2307 			ubifs_err("two data nodes for the same block");
2308 			goto error_dump;
2309 		}
2310 	}
2311 
2312 	return 0;
2313 
2314 error_dump:
2315 	dbg_dump_node(c, sa->node);
2316 	dbg_dump_node(c, sb->node);
2317 	return -EINVAL;
2318 }
2319 
2320 /**
2321  * dbg_check_nondata_nodes_order - check that list of data nodes is sorted.
2322  * @c: UBIFS file-system description object
2323  * @head: the list of nodes ('struct ubifs_scan_node' objects)
2324  *
2325  * This function returns zero if the list of non-data nodes is sorted correctly,
2326  * and %-EINVAL if not.
2327  */
2328 int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head)
2329 {
2330 	struct list_head *cur;
2331 	struct ubifs_scan_node *sa, *sb;
2332 
2333 	if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
2334 		return 0;
2335 
2336 	for (cur = head->next; cur->next != head; cur = cur->next) {
2337 		ino_t inuma, inumb;
2338 		uint32_t hasha, hashb;
2339 
2340 		cond_resched();
2341 		sa = container_of(cur, struct ubifs_scan_node, list);
2342 		sb = container_of(cur->next, struct ubifs_scan_node, list);
2343 
2344 		if (sa->type != UBIFS_INO_NODE && sa->type != UBIFS_DENT_NODE &&
2345 		    sa->type != UBIFS_XENT_NODE) {
2346 			ubifs_err("bad node type %d", sa->type);
2347 			dbg_dump_node(c, sa->node);
2348 			return -EINVAL;
2349 		}
2350 		if (sa->type != UBIFS_INO_NODE && sa->type != UBIFS_DENT_NODE &&
2351 		    sa->type != UBIFS_XENT_NODE) {
2352 			ubifs_err("bad node type %d", sb->type);
2353 			dbg_dump_node(c, sb->node);
2354 			return -EINVAL;
2355 		}
2356 
2357 		if (sa->type != UBIFS_INO_NODE && sb->type == UBIFS_INO_NODE) {
2358 			ubifs_err("non-inode node goes before inode node");
2359 			goto error_dump;
2360 		}
2361 
2362 		if (sa->type == UBIFS_INO_NODE && sb->type != UBIFS_INO_NODE)
2363 			continue;
2364 
2365 		if (sa->type == UBIFS_INO_NODE && sb->type == UBIFS_INO_NODE) {
2366 			/* Inode nodes are sorted in descending size order */
2367 			if (sa->len < sb->len) {
2368 				ubifs_err("smaller inode node goes first");
2369 				goto error_dump;
2370 			}
2371 			continue;
2372 		}
2373 
2374 		/*
2375 		 * This is either a dentry or xentry, which should be sorted in
2376 		 * ascending (parent ino, hash) order.
2377 		 */
2378 		inuma = key_inum(c, &sa->key);
2379 		inumb = key_inum(c, &sb->key);
2380 
2381 		if (inuma < inumb)
2382 			continue;
2383 		if (inuma > inumb) {
2384 			ubifs_err("larger inum %lu goes before inum %lu",
2385 				  (unsigned long)inuma, (unsigned long)inumb);
2386 			goto error_dump;
2387 		}
2388 
2389 		hasha = key_block(c, &sa->key);
2390 		hashb = key_block(c, &sb->key);
2391 
2392 		if (hasha > hashb) {
2393 			ubifs_err("larger hash %u goes before %u", hasha, hashb);
2394 			goto error_dump;
2395 		}
2396 	}
2397 
2398 	return 0;
2399 
2400 error_dump:
2401 	ubifs_msg("dumping first node");
2402 	dbg_dump_node(c, sa->node);
2403 	ubifs_msg("dumping second node");
2404 	dbg_dump_node(c, sb->node);
2405 	return -EINVAL;
2406 	return 0;
2407 }
2408 
2409 static int invocation_cnt;
2410 
2411 int dbg_force_in_the_gaps(void)
2412 {
2413 	if (!dbg_force_in_the_gaps_enabled)
2414 		return 0;
2415 	/* Force in-the-gaps every 8th commit */
2416 	return !((invocation_cnt++) & 0x7);
2417 }
2418 
2419 /* Failure mode for recovery testing */
2420 
2421 #define chance(n, d) (simple_rand() <= (n) * 32768LL / (d))
2422 
2423 struct failure_mode_info {
2424 	struct list_head list;
2425 	struct ubifs_info *c;
2426 };
2427 
2428 static LIST_HEAD(fmi_list);
2429 static DEFINE_SPINLOCK(fmi_lock);
2430 
2431 static unsigned int next;
2432 
2433 static int simple_rand(void)
2434 {
2435 	if (next == 0)
2436 		next = current->pid;
2437 	next = next * 1103515245 + 12345;
2438 	return (next >> 16) & 32767;
2439 }
2440 
2441 static void failure_mode_init(struct ubifs_info *c)
2442 {
2443 	struct failure_mode_info *fmi;
2444 
2445 	fmi = kmalloc(sizeof(struct failure_mode_info), GFP_NOFS);
2446 	if (!fmi) {
2447 		ubifs_err("Failed to register failure mode - no memory");
2448 		return;
2449 	}
2450 	fmi->c = c;
2451 	spin_lock(&fmi_lock);
2452 	list_add_tail(&fmi->list, &fmi_list);
2453 	spin_unlock(&fmi_lock);
2454 }
2455 
2456 static void failure_mode_exit(struct ubifs_info *c)
2457 {
2458 	struct failure_mode_info *fmi, *tmp;
2459 
2460 	spin_lock(&fmi_lock);
2461 	list_for_each_entry_safe(fmi, tmp, &fmi_list, list)
2462 		if (fmi->c == c) {
2463 			list_del(&fmi->list);
2464 			kfree(fmi);
2465 		}
2466 	spin_unlock(&fmi_lock);
2467 }
2468 
2469 static struct ubifs_info *dbg_find_info(struct ubi_volume_desc *desc)
2470 {
2471 	struct failure_mode_info *fmi;
2472 
2473 	spin_lock(&fmi_lock);
2474 	list_for_each_entry(fmi, &fmi_list, list)
2475 		if (fmi->c->ubi == desc) {
2476 			struct ubifs_info *c = fmi->c;
2477 
2478 			spin_unlock(&fmi_lock);
2479 			return c;
2480 		}
2481 	spin_unlock(&fmi_lock);
2482 	return NULL;
2483 }
2484 
2485 static int in_failure_mode(struct ubi_volume_desc *desc)
2486 {
2487 	struct ubifs_info *c = dbg_find_info(desc);
2488 
2489 	if (c && dbg_failure_mode)
2490 		return c->dbg->failure_mode;
2491 	return 0;
2492 }
2493 
2494 static int do_fail(struct ubi_volume_desc *desc, int lnum, int write)
2495 {
2496 	struct ubifs_info *c = dbg_find_info(desc);
2497 	struct ubifs_debug_info *d;
2498 
2499 	if (!c || !dbg_failure_mode)
2500 		return 0;
2501 	d = c->dbg;
2502 	if (d->failure_mode)
2503 		return 1;
2504 	if (!d->fail_cnt) {
2505 		/* First call - decide delay to failure */
2506 		if (chance(1, 2)) {
2507 			unsigned int delay = 1 << (simple_rand() >> 11);
2508 
2509 			if (chance(1, 2)) {
2510 				d->fail_delay = 1;
2511 				d->fail_timeout = jiffies +
2512 						  msecs_to_jiffies(delay);
2513 				dbg_rcvry("failing after %ums", delay);
2514 			} else {
2515 				d->fail_delay = 2;
2516 				d->fail_cnt_max = delay;
2517 				dbg_rcvry("failing after %u calls", delay);
2518 			}
2519 		}
2520 		d->fail_cnt += 1;
2521 	}
2522 	/* Determine if failure delay has expired */
2523 	if (d->fail_delay == 1) {
2524 		if (time_before(jiffies, d->fail_timeout))
2525 			return 0;
2526 	} else if (d->fail_delay == 2)
2527 		if (d->fail_cnt++ < d->fail_cnt_max)
2528 			return 0;
2529 	if (lnum == UBIFS_SB_LNUM) {
2530 		if (write) {
2531 			if (chance(1, 2))
2532 				return 0;
2533 		} else if (chance(19, 20))
2534 			return 0;
2535 		dbg_rcvry("failing in super block LEB %d", lnum);
2536 	} else if (lnum == UBIFS_MST_LNUM || lnum == UBIFS_MST_LNUM + 1) {
2537 		if (chance(19, 20))
2538 			return 0;
2539 		dbg_rcvry("failing in master LEB %d", lnum);
2540 	} else if (lnum >= UBIFS_LOG_LNUM && lnum <= c->log_last) {
2541 		if (write) {
2542 			if (chance(99, 100))
2543 				return 0;
2544 		} else if (chance(399, 400))
2545 			return 0;
2546 		dbg_rcvry("failing in log LEB %d", lnum);
2547 	} else if (lnum >= c->lpt_first && lnum <= c->lpt_last) {
2548 		if (write) {
2549 			if (chance(7, 8))
2550 				return 0;
2551 		} else if (chance(19, 20))
2552 			return 0;
2553 		dbg_rcvry("failing in LPT LEB %d", lnum);
2554 	} else if (lnum >= c->orph_first && lnum <= c->orph_last) {
2555 		if (write) {
2556 			if (chance(1, 2))
2557 				return 0;
2558 		} else if (chance(9, 10))
2559 			return 0;
2560 		dbg_rcvry("failing in orphan LEB %d", lnum);
2561 	} else if (lnum == c->ihead_lnum) {
2562 		if (chance(99, 100))
2563 			return 0;
2564 		dbg_rcvry("failing in index head LEB %d", lnum);
2565 	} else if (c->jheads && lnum == c->jheads[GCHD].wbuf.lnum) {
2566 		if (chance(9, 10))
2567 			return 0;
2568 		dbg_rcvry("failing in GC head LEB %d", lnum);
2569 	} else if (write && !RB_EMPTY_ROOT(&c->buds) &&
2570 		   !ubifs_search_bud(c, lnum)) {
2571 		if (chance(19, 20))
2572 			return 0;
2573 		dbg_rcvry("failing in non-bud LEB %d", lnum);
2574 	} else if (c->cmt_state == COMMIT_RUNNING_BACKGROUND ||
2575 		   c->cmt_state == COMMIT_RUNNING_REQUIRED) {
2576 		if (chance(999, 1000))
2577 			return 0;
2578 		dbg_rcvry("failing in bud LEB %d commit running", lnum);
2579 	} else {
2580 		if (chance(9999, 10000))
2581 			return 0;
2582 		dbg_rcvry("failing in bud LEB %d commit not running", lnum);
2583 	}
2584 	ubifs_err("*** SETTING FAILURE MODE ON (LEB %d) ***", lnum);
2585 	d->failure_mode = 1;
2586 	dump_stack();
2587 	return 1;
2588 }
2589 
2590 static void cut_data(const void *buf, int len)
2591 {
2592 	int flen, i;
2593 	unsigned char *p = (void *)buf;
2594 
2595 	flen = (len * (long long)simple_rand()) >> 15;
2596 	for (i = flen; i < len; i++)
2597 		p[i] = 0xff;
2598 }
2599 
2600 int dbg_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
2601 		 int len, int check)
2602 {
2603 	if (in_failure_mode(desc))
2604 		return -EIO;
2605 	return ubi_leb_read(desc, lnum, buf, offset, len, check);
2606 }
2607 
2608 int dbg_leb_write(struct ubi_volume_desc *desc, int lnum, const void *buf,
2609 		  int offset, int len, int dtype)
2610 {
2611 	int err, failing;
2612 
2613 	if (in_failure_mode(desc))
2614 		return -EIO;
2615 	failing = do_fail(desc, lnum, 1);
2616 	if (failing)
2617 		cut_data(buf, len);
2618 	err = ubi_leb_write(desc, lnum, buf, offset, len, dtype);
2619 	if (err)
2620 		return err;
2621 	if (failing)
2622 		return -EIO;
2623 	return 0;
2624 }
2625 
2626 int dbg_leb_change(struct ubi_volume_desc *desc, int lnum, const void *buf,
2627 		   int len, int dtype)
2628 {
2629 	int err;
2630 
2631 	if (do_fail(desc, lnum, 1))
2632 		return -EIO;
2633 	err = ubi_leb_change(desc, lnum, buf, len, dtype);
2634 	if (err)
2635 		return err;
2636 	if (do_fail(desc, lnum, 1))
2637 		return -EIO;
2638 	return 0;
2639 }
2640 
2641 int dbg_leb_erase(struct ubi_volume_desc *desc, int lnum)
2642 {
2643 	int err;
2644 
2645 	if (do_fail(desc, lnum, 0))
2646 		return -EIO;
2647 	err = ubi_leb_erase(desc, lnum);
2648 	if (err)
2649 		return err;
2650 	if (do_fail(desc, lnum, 0))
2651 		return -EIO;
2652 	return 0;
2653 }
2654 
2655 int dbg_leb_unmap(struct ubi_volume_desc *desc, int lnum)
2656 {
2657 	int err;
2658 
2659 	if (do_fail(desc, lnum, 0))
2660 		return -EIO;
2661 	err = ubi_leb_unmap(desc, lnum);
2662 	if (err)
2663 		return err;
2664 	if (do_fail(desc, lnum, 0))
2665 		return -EIO;
2666 	return 0;
2667 }
2668 
2669 int dbg_is_mapped(struct ubi_volume_desc *desc, int lnum)
2670 {
2671 	if (in_failure_mode(desc))
2672 		return -EIO;
2673 	return ubi_is_mapped(desc, lnum);
2674 }
2675 
2676 int dbg_leb_map(struct ubi_volume_desc *desc, int lnum, int dtype)
2677 {
2678 	int err;
2679 
2680 	if (do_fail(desc, lnum, 0))
2681 		return -EIO;
2682 	err = ubi_leb_map(desc, lnum, dtype);
2683 	if (err)
2684 		return err;
2685 	if (do_fail(desc, lnum, 0))
2686 		return -EIO;
2687 	return 0;
2688 }
2689 
2690 /**
2691  * ubifs_debugging_init - initialize UBIFS debugging.
2692  * @c: UBIFS file-system description object
2693  *
2694  * This function initializes debugging-related data for the file system.
2695  * Returns zero in case of success and a negative error code in case of
2696  * failure.
2697  */
2698 int ubifs_debugging_init(struct ubifs_info *c)
2699 {
2700 	c->dbg = kzalloc(sizeof(struct ubifs_debug_info), GFP_KERNEL);
2701 	if (!c->dbg)
2702 		return -ENOMEM;
2703 
2704 	failure_mode_init(c);
2705 	return 0;
2706 }
2707 
2708 /**
2709  * ubifs_debugging_exit - free debugging data.
2710  * @c: UBIFS file-system description object
2711  */
2712 void ubifs_debugging_exit(struct ubifs_info *c)
2713 {
2714 	failure_mode_exit(c);
2715 	kfree(c->dbg);
2716 }
2717 
2718 /*
2719  * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
2720  * contain the stuff specific to particular file-system mounts.
2721  */
2722 static struct dentry *dfs_rootdir;
2723 
2724 /**
2725  * dbg_debugfs_init - initialize debugfs file-system.
2726  *
2727  * UBIFS uses debugfs file-system to expose various debugging knobs to
2728  * user-space. This function creates "ubifs" directory in the debugfs
2729  * file-system. Returns zero in case of success and a negative error code in
2730  * case of failure.
2731  */
2732 int dbg_debugfs_init(void)
2733 {
2734 	dfs_rootdir = debugfs_create_dir("ubifs", NULL);
2735 	if (IS_ERR(dfs_rootdir)) {
2736 		int err = PTR_ERR(dfs_rootdir);
2737 		ubifs_err("cannot create \"ubifs\" debugfs directory, "
2738 			  "error %d\n", err);
2739 		return err;
2740 	}
2741 
2742 	return 0;
2743 }
2744 
2745 /**
2746  * dbg_debugfs_exit - remove the "ubifs" directory from debugfs file-system.
2747  */
2748 void dbg_debugfs_exit(void)
2749 {
2750 	debugfs_remove(dfs_rootdir);
2751 }
2752 
2753 static int open_debugfs_file(struct inode *inode, struct file *file)
2754 {
2755 	file->private_data = inode->i_private;
2756 	return 0;
2757 }
2758 
2759 static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
2760 				  size_t count, loff_t *ppos)
2761 {
2762 	struct ubifs_info *c = file->private_data;
2763 	struct ubifs_debug_info *d = c->dbg;
2764 
2765 	if (file->f_path.dentry == d->dfs_dump_lprops)
2766 		dbg_dump_lprops(c);
2767 	else if (file->f_path.dentry == d->dfs_dump_budg) {
2768 		spin_lock(&c->space_lock);
2769 		dbg_dump_budg(c);
2770 		spin_unlock(&c->space_lock);
2771 	} else if (file->f_path.dentry == d->dfs_dump_tnc) {
2772 		mutex_lock(&c->tnc_mutex);
2773 		dbg_dump_tnc(c);
2774 		mutex_unlock(&c->tnc_mutex);
2775 	} else
2776 		return -EINVAL;
2777 
2778 	*ppos += count;
2779 	return count;
2780 }
2781 
2782 static const struct file_operations dfs_fops = {
2783 	.open = open_debugfs_file,
2784 	.write = write_debugfs_file,
2785 	.owner = THIS_MODULE,
2786 	.llseek = default_llseek,
2787 };
2788 
2789 /**
2790  * dbg_debugfs_init_fs - initialize debugfs for UBIFS instance.
2791  * @c: UBIFS file-system description object
2792  *
2793  * This function creates all debugfs files for this instance of UBIFS. Returns
2794  * zero in case of success and a negative error code in case of failure.
2795  *
2796  * Note, the only reason we have not merged this function with the
2797  * 'ubifs_debugging_init()' function is because it is better to initialize
2798  * debugfs interfaces at the very end of the mount process, and remove them at
2799  * the very beginning of the mount process.
2800  */
2801 int dbg_debugfs_init_fs(struct ubifs_info *c)
2802 {
2803 	int err;
2804 	const char *fname;
2805 	struct dentry *dent;
2806 	struct ubifs_debug_info *d = c->dbg;
2807 
2808 	sprintf(d->dfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
2809 	d->dfs_dir = debugfs_create_dir(d->dfs_dir_name, dfs_rootdir);
2810 	if (IS_ERR(d->dfs_dir)) {
2811 		err = PTR_ERR(d->dfs_dir);
2812 		ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
2813 			  d->dfs_dir_name, err);
2814 		goto out;
2815 	}
2816 
2817 	fname = "dump_lprops";
2818 	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
2819 	if (IS_ERR(dent))
2820 		goto out_remove;
2821 	d->dfs_dump_lprops = dent;
2822 
2823 	fname = "dump_budg";
2824 	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
2825 	if (IS_ERR(dent))
2826 		goto out_remove;
2827 	d->dfs_dump_budg = dent;
2828 
2829 	fname = "dump_tnc";
2830 	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
2831 	if (IS_ERR(dent))
2832 		goto out_remove;
2833 	d->dfs_dump_tnc = dent;
2834 
2835 	return 0;
2836 
2837 out_remove:
2838 	err = PTR_ERR(dent);
2839 	ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
2840 		  fname, err);
2841 	debugfs_remove_recursive(d->dfs_dir);
2842 out:
2843 	return err;
2844 }
2845 
2846 /**
2847  * dbg_debugfs_exit_fs - remove all debugfs files.
2848  * @c: UBIFS file-system description object
2849  */
2850 void dbg_debugfs_exit_fs(struct ubifs_info *c)
2851 {
2852 	debugfs_remove_recursive(c->dbg->dfs_dir);
2853 }
2854 
2855 #endif /* CONFIG_UBIFS_FS_DEBUG */
2856