1 /* 2 * This file is part of UBIFS. 3 * 4 * Copyright (C) 2006-2008 Nokia Corporation 5 * 6 * SPDX-License-Identifier: GPL-2.0+ 7 * 8 * Authors: Adrian Hunter 9 * Artem Bityutskiy (Битюцкий Артём) 10 */ 11 12 /* 13 * This file implements functions needed to recover from unclean un-mounts. 14 * When UBIFS is mounted, it checks a flag on the master node to determine if 15 * an un-mount was completed successfully. If not, the process of mounting 16 * incorporates additional checking and fixing of on-flash data structures. 17 * UBIFS always cleans away all remnants of an unclean un-mount, so that 18 * errors do not accumulate. However UBIFS defers recovery if it is mounted 19 * read-only, and the flash is not modified in that case. 20 * 21 * The general UBIFS approach to the recovery is that it recovers from 22 * corruptions which could be caused by power cuts, but it refuses to recover 23 * from corruption caused by other reasons. And UBIFS tries to distinguish 24 * between these 2 reasons of corruptions and silently recover in the former 25 * case and loudly complain in the latter case. 26 * 27 * UBIFS writes only to erased LEBs, so it writes only to the flash space 28 * containing only 0xFFs. UBIFS also always writes strictly from the beginning 29 * of the LEB to the end. And UBIFS assumes that the underlying flash media 30 * writes in @c->max_write_size bytes at a time. 31 * 32 * Hence, if UBIFS finds a corrupted node at offset X, it expects only the min. 33 * I/O unit corresponding to offset X to contain corrupted data, all the 34 * following min. I/O units have to contain empty space (all 0xFFs). If this is 35 * not true, the corruption cannot be the result of a power cut, and UBIFS 36 * refuses to mount. 37 */ 38 39 #define __UBOOT__ 40 #ifndef __UBOOT__ 41 #include <linux/crc32.h> 42 #include <linux/slab.h> 43 #else 44 #include <linux/err.h> 45 #endif 46 #include "ubifs.h" 47 48 /** 49 * is_empty - determine whether a buffer is empty (contains all 0xff). 50 * @buf: buffer to clean 51 * @len: length of buffer 52 * 53 * This function returns %1 if the buffer is empty (contains all 0xff) otherwise 54 * %0 is returned. 55 */ 56 static int is_empty(void *buf, int len) 57 { 58 uint8_t *p = buf; 59 int i; 60 61 for (i = 0; i < len; i++) 62 if (*p++ != 0xff) 63 return 0; 64 return 1; 65 } 66 67 /** 68 * first_non_ff - find offset of the first non-0xff byte. 69 * @buf: buffer to search in 70 * @len: length of buffer 71 * 72 * This function returns offset of the first non-0xff byte in @buf or %-1 if 73 * the buffer contains only 0xff bytes. 74 */ 75 static int first_non_ff(void *buf, int len) 76 { 77 uint8_t *p = buf; 78 int i; 79 80 for (i = 0; i < len; i++) 81 if (*p++ != 0xff) 82 return i; 83 return -1; 84 } 85 86 /** 87 * get_master_node - get the last valid master node allowing for corruption. 88 * @c: UBIFS file-system description object 89 * @lnum: LEB number 90 * @pbuf: buffer containing the LEB read, is returned here 91 * @mst: master node, if found, is returned here 92 * @cor: corruption, if found, is returned here 93 * 94 * This function allocates a buffer, reads the LEB into it, and finds and 95 * returns the last valid master node allowing for one area of corruption. 96 * The corrupt area, if there is one, must be consistent with the assumption 97 * that it is the result of an unclean unmount while the master node was being 98 * written. Under those circumstances, it is valid to use the previously written 99 * master node. 100 * 101 * This function returns %0 on success and a negative error code on failure. 102 */ 103 static int get_master_node(const struct ubifs_info *c, int lnum, void **pbuf, 104 struct ubifs_mst_node **mst, void **cor) 105 { 106 const int sz = c->mst_node_alsz; 107 int err, offs, len; 108 void *sbuf, *buf; 109 110 sbuf = vmalloc(c->leb_size); 111 if (!sbuf) 112 return -ENOMEM; 113 114 err = ubifs_leb_read(c, lnum, sbuf, 0, c->leb_size, 0); 115 if (err && err != -EBADMSG) 116 goto out_free; 117 118 /* Find the first position that is definitely not a node */ 119 offs = 0; 120 buf = sbuf; 121 len = c->leb_size; 122 while (offs + UBIFS_MST_NODE_SZ <= c->leb_size) { 123 struct ubifs_ch *ch = buf; 124 125 if (le32_to_cpu(ch->magic) != UBIFS_NODE_MAGIC) 126 break; 127 offs += sz; 128 buf += sz; 129 len -= sz; 130 } 131 /* See if there was a valid master node before that */ 132 if (offs) { 133 int ret; 134 135 offs -= sz; 136 buf -= sz; 137 len += sz; 138 ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 1); 139 if (ret != SCANNED_A_NODE && offs) { 140 /* Could have been corruption so check one place back */ 141 offs -= sz; 142 buf -= sz; 143 len += sz; 144 ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 1); 145 if (ret != SCANNED_A_NODE) 146 /* 147 * We accept only one area of corruption because 148 * we are assuming that it was caused while 149 * trying to write a master node. 150 */ 151 goto out_err; 152 } 153 if (ret == SCANNED_A_NODE) { 154 struct ubifs_ch *ch = buf; 155 156 if (ch->node_type != UBIFS_MST_NODE) 157 goto out_err; 158 dbg_rcvry("found a master node at %d:%d", lnum, offs); 159 *mst = buf; 160 offs += sz; 161 buf += sz; 162 len -= sz; 163 } 164 } 165 /* Check for corruption */ 166 if (offs < c->leb_size) { 167 if (!is_empty(buf, min_t(int, len, sz))) { 168 *cor = buf; 169 dbg_rcvry("found corruption at %d:%d", lnum, offs); 170 } 171 offs += sz; 172 buf += sz; 173 len -= sz; 174 } 175 /* Check remaining empty space */ 176 if (offs < c->leb_size) 177 if (!is_empty(buf, len)) 178 goto out_err; 179 *pbuf = sbuf; 180 return 0; 181 182 out_err: 183 err = -EINVAL; 184 out_free: 185 vfree(sbuf); 186 *mst = NULL; 187 *cor = NULL; 188 return err; 189 } 190 191 /** 192 * write_rcvrd_mst_node - write recovered master node. 193 * @c: UBIFS file-system description object 194 * @mst: master node 195 * 196 * This function returns %0 on success and a negative error code on failure. 197 */ 198 static int write_rcvrd_mst_node(struct ubifs_info *c, 199 struct ubifs_mst_node *mst) 200 { 201 int err = 0, lnum = UBIFS_MST_LNUM, sz = c->mst_node_alsz; 202 __le32 save_flags; 203 204 dbg_rcvry("recovery"); 205 206 save_flags = mst->flags; 207 mst->flags |= cpu_to_le32(UBIFS_MST_RCVRY); 208 209 ubifs_prepare_node(c, mst, UBIFS_MST_NODE_SZ, 1); 210 err = ubifs_leb_change(c, lnum, mst, sz); 211 if (err) 212 goto out; 213 err = ubifs_leb_change(c, lnum + 1, mst, sz); 214 if (err) 215 goto out; 216 out: 217 mst->flags = save_flags; 218 return err; 219 } 220 221 /** 222 * ubifs_recover_master_node - recover the master node. 223 * @c: UBIFS file-system description object 224 * 225 * This function recovers the master node from corruption that may occur due to 226 * an unclean unmount. 227 * 228 * This function returns %0 on success and a negative error code on failure. 229 */ 230 int ubifs_recover_master_node(struct ubifs_info *c) 231 { 232 void *buf1 = NULL, *buf2 = NULL, *cor1 = NULL, *cor2 = NULL; 233 struct ubifs_mst_node *mst1 = NULL, *mst2 = NULL, *mst; 234 const int sz = c->mst_node_alsz; 235 int err, offs1, offs2; 236 237 dbg_rcvry("recovery"); 238 239 err = get_master_node(c, UBIFS_MST_LNUM, &buf1, &mst1, &cor1); 240 if (err) 241 goto out_free; 242 243 err = get_master_node(c, UBIFS_MST_LNUM + 1, &buf2, &mst2, &cor2); 244 if (err) 245 goto out_free; 246 247 if (mst1) { 248 offs1 = (void *)mst1 - buf1; 249 if ((le32_to_cpu(mst1->flags) & UBIFS_MST_RCVRY) && 250 (offs1 == 0 && !cor1)) { 251 /* 252 * mst1 was written by recovery at offset 0 with no 253 * corruption. 254 */ 255 dbg_rcvry("recovery recovery"); 256 mst = mst1; 257 } else if (mst2) { 258 offs2 = (void *)mst2 - buf2; 259 if (offs1 == offs2) { 260 /* Same offset, so must be the same */ 261 if (memcmp((void *)mst1 + UBIFS_CH_SZ, 262 (void *)mst2 + UBIFS_CH_SZ, 263 UBIFS_MST_NODE_SZ - UBIFS_CH_SZ)) 264 goto out_err; 265 mst = mst1; 266 } else if (offs2 + sz == offs1) { 267 /* 1st LEB was written, 2nd was not */ 268 if (cor1) 269 goto out_err; 270 mst = mst1; 271 } else if (offs1 == 0 && 272 c->leb_size - offs2 - sz < sz) { 273 /* 1st LEB was unmapped and written, 2nd not */ 274 if (cor1) 275 goto out_err; 276 mst = mst1; 277 } else 278 goto out_err; 279 } else { 280 /* 281 * 2nd LEB was unmapped and about to be written, so 282 * there must be only one master node in the first LEB 283 * and no corruption. 284 */ 285 if (offs1 != 0 || cor1) 286 goto out_err; 287 mst = mst1; 288 } 289 } else { 290 if (!mst2) 291 goto out_err; 292 /* 293 * 1st LEB was unmapped and about to be written, so there must 294 * be no room left in 2nd LEB. 295 */ 296 offs2 = (void *)mst2 - buf2; 297 if (offs2 + sz + sz <= c->leb_size) 298 goto out_err; 299 mst = mst2; 300 } 301 302 ubifs_msg("recovered master node from LEB %d", 303 (mst == mst1 ? UBIFS_MST_LNUM : UBIFS_MST_LNUM + 1)); 304 305 memcpy(c->mst_node, mst, UBIFS_MST_NODE_SZ); 306 307 if (c->ro_mount) { 308 /* Read-only mode. Keep a copy for switching to rw mode */ 309 c->rcvrd_mst_node = kmalloc(sz, GFP_KERNEL); 310 if (!c->rcvrd_mst_node) { 311 err = -ENOMEM; 312 goto out_free; 313 } 314 memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ); 315 316 /* 317 * We had to recover the master node, which means there was an 318 * unclean reboot. However, it is possible that the master node 319 * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set. 320 * E.g., consider the following chain of events: 321 * 322 * 1. UBIFS was cleanly unmounted, so the master node is clean 323 * 2. UBIFS is being mounted R/W and starts changing the master 324 * node in the first (%UBIFS_MST_LNUM). A power cut happens, 325 * so this LEB ends up with some amount of garbage at the 326 * end. 327 * 3. UBIFS is being mounted R/O. We reach this place and 328 * recover the master node from the second LEB 329 * (%UBIFS_MST_LNUM + 1). But we cannot update the media 330 * because we are being mounted R/O. We have to defer the 331 * operation. 332 * 4. However, this master node (@c->mst_node) is marked as 333 * clean (since the step 1). And if we just return, the 334 * mount code will be confused and won't recover the master 335 * node when it is re-mounter R/W later. 336 * 337 * Thus, to force the recovery by marking the master node as 338 * dirty. 339 */ 340 c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY); 341 #ifndef __UBOOT__ 342 } else { 343 /* Write the recovered master node */ 344 c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1; 345 err = write_rcvrd_mst_node(c, c->mst_node); 346 if (err) 347 goto out_free; 348 #endif 349 } 350 351 vfree(buf2); 352 vfree(buf1); 353 354 return 0; 355 356 out_err: 357 err = -EINVAL; 358 out_free: 359 ubifs_err("failed to recover master node"); 360 if (mst1) { 361 ubifs_err("dumping first master node"); 362 ubifs_dump_node(c, mst1); 363 } 364 if (mst2) { 365 ubifs_err("dumping second master node"); 366 ubifs_dump_node(c, mst2); 367 } 368 vfree(buf2); 369 vfree(buf1); 370 return err; 371 } 372 373 /** 374 * ubifs_write_rcvrd_mst_node - write the recovered master node. 375 * @c: UBIFS file-system description object 376 * 377 * This function writes the master node that was recovered during mounting in 378 * read-only mode and must now be written because we are remounting rw. 379 * 380 * This function returns %0 on success and a negative error code on failure. 381 */ 382 int ubifs_write_rcvrd_mst_node(struct ubifs_info *c) 383 { 384 int err; 385 386 if (!c->rcvrd_mst_node) 387 return 0; 388 c->rcvrd_mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY); 389 c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY); 390 err = write_rcvrd_mst_node(c, c->rcvrd_mst_node); 391 if (err) 392 return err; 393 kfree(c->rcvrd_mst_node); 394 c->rcvrd_mst_node = NULL; 395 return 0; 396 } 397 398 /** 399 * is_last_write - determine if an offset was in the last write to a LEB. 400 * @c: UBIFS file-system description object 401 * @buf: buffer to check 402 * @offs: offset to check 403 * 404 * This function returns %1 if @offs was in the last write to the LEB whose data 405 * is in @buf, otherwise %0 is returned. The determination is made by checking 406 * for subsequent empty space starting from the next @c->max_write_size 407 * boundary. 408 */ 409 static int is_last_write(const struct ubifs_info *c, void *buf, int offs) 410 { 411 int empty_offs, check_len; 412 uint8_t *p; 413 414 /* 415 * Round up to the next @c->max_write_size boundary i.e. @offs is in 416 * the last wbuf written. After that should be empty space. 417 */ 418 empty_offs = ALIGN(offs + 1, c->max_write_size); 419 check_len = c->leb_size - empty_offs; 420 p = buf + empty_offs - offs; 421 return is_empty(p, check_len); 422 } 423 424 /** 425 * clean_buf - clean the data from an LEB sitting in a buffer. 426 * @c: UBIFS file-system description object 427 * @buf: buffer to clean 428 * @lnum: LEB number to clean 429 * @offs: offset from which to clean 430 * @len: length of buffer 431 * 432 * This function pads up to the next min_io_size boundary (if there is one) and 433 * sets empty space to all 0xff. @buf, @offs and @len are updated to the next 434 * @c->min_io_size boundary. 435 */ 436 static void clean_buf(const struct ubifs_info *c, void **buf, int lnum, 437 int *offs, int *len) 438 { 439 int empty_offs, pad_len; 440 441 lnum = lnum; 442 dbg_rcvry("cleaning corruption at %d:%d", lnum, *offs); 443 444 ubifs_assert(!(*offs & 7)); 445 empty_offs = ALIGN(*offs, c->min_io_size); 446 pad_len = empty_offs - *offs; 447 ubifs_pad(c, *buf, pad_len); 448 *offs += pad_len; 449 *buf += pad_len; 450 *len -= pad_len; 451 memset(*buf, 0xff, c->leb_size - empty_offs); 452 } 453 454 /** 455 * no_more_nodes - determine if there are no more nodes in a buffer. 456 * @c: UBIFS file-system description object 457 * @buf: buffer to check 458 * @len: length of buffer 459 * @lnum: LEB number of the LEB from which @buf was read 460 * @offs: offset from which @buf was read 461 * 462 * This function ensures that the corrupted node at @offs is the last thing 463 * written to a LEB. This function returns %1 if more data is not found and 464 * %0 if more data is found. 465 */ 466 static int no_more_nodes(const struct ubifs_info *c, void *buf, int len, 467 int lnum, int offs) 468 { 469 struct ubifs_ch *ch = buf; 470 int skip, dlen = le32_to_cpu(ch->len); 471 472 /* Check for empty space after the corrupt node's common header */ 473 skip = ALIGN(offs + UBIFS_CH_SZ, c->max_write_size) - offs; 474 if (is_empty(buf + skip, len - skip)) 475 return 1; 476 /* 477 * The area after the common header size is not empty, so the common 478 * header must be intact. Check it. 479 */ 480 if (ubifs_check_node(c, buf, lnum, offs, 1, 0) != -EUCLEAN) { 481 dbg_rcvry("unexpected bad common header at %d:%d", lnum, offs); 482 return 0; 483 } 484 /* Now we know the corrupt node's length we can skip over it */ 485 skip = ALIGN(offs + dlen, c->max_write_size) - offs; 486 /* After which there should be empty space */ 487 if (is_empty(buf + skip, len - skip)) 488 return 1; 489 dbg_rcvry("unexpected data at %d:%d", lnum, offs + skip); 490 return 0; 491 } 492 493 /** 494 * fix_unclean_leb - fix an unclean LEB. 495 * @c: UBIFS file-system description object 496 * @sleb: scanned LEB information 497 * @start: offset where scan started 498 */ 499 static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb, 500 int start) 501 { 502 int lnum = sleb->lnum, endpt = start; 503 504 /* Get the end offset of the last node we are keeping */ 505 if (!list_empty(&sleb->nodes)) { 506 struct ubifs_scan_node *snod; 507 508 snod = list_entry(sleb->nodes.prev, 509 struct ubifs_scan_node, list); 510 endpt = snod->offs + snod->len; 511 } 512 513 if (c->ro_mount && !c->remounting_rw) { 514 /* Add to recovery list */ 515 struct ubifs_unclean_leb *ucleb; 516 517 dbg_rcvry("need to fix LEB %d start %d endpt %d", 518 lnum, start, sleb->endpt); 519 ucleb = kzalloc(sizeof(struct ubifs_unclean_leb), GFP_NOFS); 520 if (!ucleb) 521 return -ENOMEM; 522 ucleb->lnum = lnum; 523 ucleb->endpt = endpt; 524 list_add_tail(&ucleb->list, &c->unclean_leb_list); 525 #ifndef __UBOOT__ 526 } else { 527 /* Write the fixed LEB back to flash */ 528 int err; 529 530 dbg_rcvry("fixing LEB %d start %d endpt %d", 531 lnum, start, sleb->endpt); 532 if (endpt == 0) { 533 err = ubifs_leb_unmap(c, lnum); 534 if (err) 535 return err; 536 } else { 537 int len = ALIGN(endpt, c->min_io_size); 538 539 if (start) { 540 err = ubifs_leb_read(c, lnum, sleb->buf, 0, 541 start, 1); 542 if (err) 543 return err; 544 } 545 /* Pad to min_io_size */ 546 if (len > endpt) { 547 int pad_len = len - ALIGN(endpt, 8); 548 549 if (pad_len > 0) { 550 void *buf = sleb->buf + len - pad_len; 551 552 ubifs_pad(c, buf, pad_len); 553 } 554 } 555 err = ubifs_leb_change(c, lnum, sleb->buf, len); 556 if (err) 557 return err; 558 } 559 #endif 560 } 561 return 0; 562 } 563 564 /** 565 * drop_last_group - drop the last group of nodes. 566 * @sleb: scanned LEB information 567 * @offs: offset of dropped nodes is returned here 568 * 569 * This is a helper function for 'ubifs_recover_leb()' which drops the last 570 * group of nodes of the scanned LEB. 571 */ 572 static void drop_last_group(struct ubifs_scan_leb *sleb, int *offs) 573 { 574 while (!list_empty(&sleb->nodes)) { 575 struct ubifs_scan_node *snod; 576 struct ubifs_ch *ch; 577 578 snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node, 579 list); 580 ch = snod->node; 581 if (ch->group_type != UBIFS_IN_NODE_GROUP) 582 break; 583 584 dbg_rcvry("dropping grouped node at %d:%d", 585 sleb->lnum, snod->offs); 586 *offs = snod->offs; 587 list_del(&snod->list); 588 kfree(snod); 589 sleb->nodes_cnt -= 1; 590 } 591 } 592 593 /** 594 * drop_last_node - drop the last node. 595 * @sleb: scanned LEB information 596 * @offs: offset of dropped nodes is returned here 597 * @grouped: non-zero if whole group of nodes have to be dropped 598 * 599 * This is a helper function for 'ubifs_recover_leb()' which drops the last 600 * node of the scanned LEB. 601 */ 602 static void drop_last_node(struct ubifs_scan_leb *sleb, int *offs) 603 { 604 struct ubifs_scan_node *snod; 605 606 if (!list_empty(&sleb->nodes)) { 607 snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node, 608 list); 609 610 dbg_rcvry("dropping last node at %d:%d", 611 sleb->lnum, snod->offs); 612 *offs = snod->offs; 613 list_del(&snod->list); 614 kfree(snod); 615 sleb->nodes_cnt -= 1; 616 } 617 } 618 619 /** 620 * ubifs_recover_leb - scan and recover a LEB. 621 * @c: UBIFS file-system description object 622 * @lnum: LEB number 623 * @offs: offset 624 * @sbuf: LEB-sized buffer to use 625 * @jhead: journal head number this LEB belongs to (%-1 if the LEB does not 626 * belong to any journal head) 627 * 628 * This function does a scan of a LEB, but caters for errors that might have 629 * been caused by the unclean unmount from which we are attempting to recover. 630 * Returns %0 in case of success, %-EUCLEAN if an unrecoverable corruption is 631 * found, and a negative error code in case of failure. 632 */ 633 struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum, 634 int offs, void *sbuf, int jhead) 635 { 636 int ret = 0, err, len = c->leb_size - offs, start = offs, min_io_unit; 637 int grouped = jhead == -1 ? 0 : c->jheads[jhead].grouped; 638 struct ubifs_scan_leb *sleb; 639 void *buf = sbuf + offs; 640 641 dbg_rcvry("%d:%d, jhead %d, grouped %d", lnum, offs, jhead, grouped); 642 643 sleb = ubifs_start_scan(c, lnum, offs, sbuf); 644 if (IS_ERR(sleb)) 645 return sleb; 646 647 ubifs_assert(len >= 8); 648 while (len >= 8) { 649 dbg_scan("look at LEB %d:%d (%d bytes left)", 650 lnum, offs, len); 651 652 cond_resched(); 653 654 /* 655 * Scan quietly until there is an error from which we cannot 656 * recover 657 */ 658 ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 1); 659 if (ret == SCANNED_A_NODE) { 660 /* A valid node, and not a padding node */ 661 struct ubifs_ch *ch = buf; 662 int node_len; 663 664 err = ubifs_add_snod(c, sleb, buf, offs); 665 if (err) 666 goto error; 667 node_len = ALIGN(le32_to_cpu(ch->len), 8); 668 offs += node_len; 669 buf += node_len; 670 len -= node_len; 671 } else if (ret > 0) { 672 /* Padding bytes or a valid padding node */ 673 offs += ret; 674 buf += ret; 675 len -= ret; 676 } else if (ret == SCANNED_EMPTY_SPACE || 677 ret == SCANNED_GARBAGE || 678 ret == SCANNED_A_BAD_PAD_NODE || 679 ret == SCANNED_A_CORRUPT_NODE) { 680 dbg_rcvry("found corruption (%d) at %d:%d", 681 ret, lnum, offs); 682 break; 683 } else { 684 ubifs_err("unexpected return value %d", ret); 685 err = -EINVAL; 686 goto error; 687 } 688 } 689 690 if (ret == SCANNED_GARBAGE || ret == SCANNED_A_BAD_PAD_NODE) { 691 if (!is_last_write(c, buf, offs)) 692 goto corrupted_rescan; 693 } else if (ret == SCANNED_A_CORRUPT_NODE) { 694 if (!no_more_nodes(c, buf, len, lnum, offs)) 695 goto corrupted_rescan; 696 } else if (!is_empty(buf, len)) { 697 if (!is_last_write(c, buf, offs)) { 698 int corruption = first_non_ff(buf, len); 699 700 /* 701 * See header comment for this file for more 702 * explanations about the reasons we have this check. 703 */ 704 ubifs_err("corrupt empty space LEB %d:%d, corruption starts at %d", 705 lnum, offs, corruption); 706 /* Make sure we dump interesting non-0xFF data */ 707 offs += corruption; 708 buf += corruption; 709 goto corrupted; 710 } 711 } 712 713 min_io_unit = round_down(offs, c->min_io_size); 714 if (grouped) 715 /* 716 * If nodes are grouped, always drop the incomplete group at 717 * the end. 718 */ 719 drop_last_group(sleb, &offs); 720 721 if (jhead == GCHD) { 722 /* 723 * If this LEB belongs to the GC head then while we are in the 724 * middle of the same min. I/O unit keep dropping nodes. So 725 * basically, what we want is to make sure that the last min. 726 * I/O unit where we saw the corruption is dropped completely 727 * with all the uncorrupted nodes which may possibly sit there. 728 * 729 * In other words, let's name the min. I/O unit where the 730 * corruption starts B, and the previous min. I/O unit A. The 731 * below code tries to deal with a situation when half of B 732 * contains valid nodes or the end of a valid node, and the 733 * second half of B contains corrupted data or garbage. This 734 * means that UBIFS had been writing to B just before the power 735 * cut happened. I do not know how realistic is this scenario 736 * that half of the min. I/O unit had been written successfully 737 * and the other half not, but this is possible in our 'failure 738 * mode emulation' infrastructure at least. 739 * 740 * So what is the problem, why we need to drop those nodes? Why 741 * can't we just clean-up the second half of B by putting a 742 * padding node there? We can, and this works fine with one 743 * exception which was reproduced with power cut emulation 744 * testing and happens extremely rarely. 745 * 746 * Imagine the file-system is full, we run GC which starts 747 * moving valid nodes from LEB X to LEB Y (obviously, LEB Y is 748 * the current GC head LEB). The @c->gc_lnum is -1, which means 749 * that GC will retain LEB X and will try to continue. Imagine 750 * that LEB X is currently the dirtiest LEB, and the amount of 751 * used space in LEB Y is exactly the same as amount of free 752 * space in LEB X. 753 * 754 * And a power cut happens when nodes are moved from LEB X to 755 * LEB Y. We are here trying to recover LEB Y which is the GC 756 * head LEB. We find the min. I/O unit B as described above. 757 * Then we clean-up LEB Y by padding min. I/O unit. And later 758 * 'ubifs_rcvry_gc_commit()' function fails, because it cannot 759 * find a dirty LEB which could be GC'd into LEB Y! Even LEB X 760 * does not match because the amount of valid nodes there does 761 * not fit the free space in LEB Y any more! And this is 762 * because of the padding node which we added to LEB Y. The 763 * user-visible effect of this which I once observed and 764 * analysed is that we cannot mount the file-system with 765 * -ENOSPC error. 766 * 767 * So obviously, to make sure that situation does not happen we 768 * should free min. I/O unit B in LEB Y completely and the last 769 * used min. I/O unit in LEB Y should be A. This is basically 770 * what the below code tries to do. 771 */ 772 while (offs > min_io_unit) 773 drop_last_node(sleb, &offs); 774 } 775 776 buf = sbuf + offs; 777 len = c->leb_size - offs; 778 779 clean_buf(c, &buf, lnum, &offs, &len); 780 ubifs_end_scan(c, sleb, lnum, offs); 781 782 err = fix_unclean_leb(c, sleb, start); 783 if (err) 784 goto error; 785 786 return sleb; 787 788 corrupted_rescan: 789 /* Re-scan the corrupted data with verbose messages */ 790 ubifs_err("corruption %d", ret); 791 ubifs_scan_a_node(c, buf, len, lnum, offs, 1); 792 corrupted: 793 ubifs_scanned_corruption(c, lnum, offs, buf); 794 err = -EUCLEAN; 795 error: 796 ubifs_err("LEB %d scanning failed", lnum); 797 ubifs_scan_destroy(sleb); 798 return ERR_PTR(err); 799 } 800 801 /** 802 * get_cs_sqnum - get commit start sequence number. 803 * @c: UBIFS file-system description object 804 * @lnum: LEB number of commit start node 805 * @offs: offset of commit start node 806 * @cs_sqnum: commit start sequence number is returned here 807 * 808 * This function returns %0 on success and a negative error code on failure. 809 */ 810 static int get_cs_sqnum(struct ubifs_info *c, int lnum, int offs, 811 unsigned long long *cs_sqnum) 812 { 813 struct ubifs_cs_node *cs_node = NULL; 814 int err, ret; 815 816 dbg_rcvry("at %d:%d", lnum, offs); 817 cs_node = kmalloc(UBIFS_CS_NODE_SZ, GFP_KERNEL); 818 if (!cs_node) 819 return -ENOMEM; 820 if (c->leb_size - offs < UBIFS_CS_NODE_SZ) 821 goto out_err; 822 err = ubifs_leb_read(c, lnum, (void *)cs_node, offs, 823 UBIFS_CS_NODE_SZ, 0); 824 if (err && err != -EBADMSG) 825 goto out_free; 826 ret = ubifs_scan_a_node(c, cs_node, UBIFS_CS_NODE_SZ, lnum, offs, 0); 827 if (ret != SCANNED_A_NODE) { 828 ubifs_err("Not a valid node"); 829 goto out_err; 830 } 831 if (cs_node->ch.node_type != UBIFS_CS_NODE) { 832 ubifs_err("Node a CS node, type is %d", cs_node->ch.node_type); 833 goto out_err; 834 } 835 if (le64_to_cpu(cs_node->cmt_no) != c->cmt_no) { 836 ubifs_err("CS node cmt_no %llu != current cmt_no %llu", 837 (unsigned long long)le64_to_cpu(cs_node->cmt_no), 838 c->cmt_no); 839 goto out_err; 840 } 841 *cs_sqnum = le64_to_cpu(cs_node->ch.sqnum); 842 dbg_rcvry("commit start sqnum %llu", *cs_sqnum); 843 kfree(cs_node); 844 return 0; 845 846 out_err: 847 err = -EINVAL; 848 out_free: 849 ubifs_err("failed to get CS sqnum"); 850 kfree(cs_node); 851 return err; 852 } 853 854 /** 855 * ubifs_recover_log_leb - scan and recover a log LEB. 856 * @c: UBIFS file-system description object 857 * @lnum: LEB number 858 * @offs: offset 859 * @sbuf: LEB-sized buffer to use 860 * 861 * This function does a scan of a LEB, but caters for errors that might have 862 * been caused by unclean reboots from which we are attempting to recover 863 * (assume that only the last log LEB can be corrupted by an unclean reboot). 864 * 865 * This function returns %0 on success and a negative error code on failure. 866 */ 867 struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum, 868 int offs, void *sbuf) 869 { 870 struct ubifs_scan_leb *sleb; 871 int next_lnum; 872 873 dbg_rcvry("LEB %d", lnum); 874 next_lnum = lnum + 1; 875 if (next_lnum >= UBIFS_LOG_LNUM + c->log_lebs) 876 next_lnum = UBIFS_LOG_LNUM; 877 if (next_lnum != c->ltail_lnum) { 878 /* 879 * We can only recover at the end of the log, so check that the 880 * next log LEB is empty or out of date. 881 */ 882 sleb = ubifs_scan(c, next_lnum, 0, sbuf, 0); 883 if (IS_ERR(sleb)) 884 return sleb; 885 if (sleb->nodes_cnt) { 886 struct ubifs_scan_node *snod; 887 unsigned long long cs_sqnum = c->cs_sqnum; 888 889 snod = list_entry(sleb->nodes.next, 890 struct ubifs_scan_node, list); 891 if (cs_sqnum == 0) { 892 int err; 893 894 err = get_cs_sqnum(c, lnum, offs, &cs_sqnum); 895 if (err) { 896 ubifs_scan_destroy(sleb); 897 return ERR_PTR(err); 898 } 899 } 900 if (snod->sqnum > cs_sqnum) { 901 ubifs_err("unrecoverable log corruption in LEB %d", 902 lnum); 903 ubifs_scan_destroy(sleb); 904 return ERR_PTR(-EUCLEAN); 905 } 906 } 907 ubifs_scan_destroy(sleb); 908 } 909 return ubifs_recover_leb(c, lnum, offs, sbuf, -1); 910 } 911 912 /** 913 * recover_head - recover a head. 914 * @c: UBIFS file-system description object 915 * @lnum: LEB number of head to recover 916 * @offs: offset of head to recover 917 * @sbuf: LEB-sized buffer to use 918 * 919 * This function ensures that there is no data on the flash at a head location. 920 * 921 * This function returns %0 on success and a negative error code on failure. 922 */ 923 static int recover_head(struct ubifs_info *c, int lnum, int offs, void *sbuf) 924 { 925 int len = c->max_write_size, err; 926 927 if (offs + len > c->leb_size) 928 len = c->leb_size - offs; 929 930 if (!len) 931 return 0; 932 933 /* Read at the head location and check it is empty flash */ 934 err = ubifs_leb_read(c, lnum, sbuf, offs, len, 1); 935 if (err || !is_empty(sbuf, len)) { 936 dbg_rcvry("cleaning head at %d:%d", lnum, offs); 937 if (offs == 0) 938 return ubifs_leb_unmap(c, lnum); 939 err = ubifs_leb_read(c, lnum, sbuf, 0, offs, 1); 940 if (err) 941 return err; 942 return ubifs_leb_change(c, lnum, sbuf, offs); 943 } 944 945 return 0; 946 } 947 948 /** 949 * ubifs_recover_inl_heads - recover index and LPT heads. 950 * @c: UBIFS file-system description object 951 * @sbuf: LEB-sized buffer to use 952 * 953 * This function ensures that there is no data on the flash at the index and 954 * LPT head locations. 955 * 956 * This deals with the recovery of a half-completed journal commit. UBIFS is 957 * careful never to overwrite the last version of the index or the LPT. Because 958 * the index and LPT are wandering trees, data from a half-completed commit will 959 * not be referenced anywhere in UBIFS. The data will be either in LEBs that are 960 * assumed to be empty and will be unmapped anyway before use, or in the index 961 * and LPT heads. 962 * 963 * This function returns %0 on success and a negative error code on failure. 964 */ 965 int ubifs_recover_inl_heads(struct ubifs_info *c, void *sbuf) 966 { 967 int err; 968 969 ubifs_assert(!c->ro_mount || c->remounting_rw); 970 971 dbg_rcvry("checking index head at %d:%d", c->ihead_lnum, c->ihead_offs); 972 err = recover_head(c, c->ihead_lnum, c->ihead_offs, sbuf); 973 if (err) 974 return err; 975 976 dbg_rcvry("checking LPT head at %d:%d", c->nhead_lnum, c->nhead_offs); 977 err = recover_head(c, c->nhead_lnum, c->nhead_offs, sbuf); 978 if (err) 979 return err; 980 981 return 0; 982 } 983 984 /** 985 * clean_an_unclean_leb - read and write a LEB to remove corruption. 986 * @c: UBIFS file-system description object 987 * @ucleb: unclean LEB information 988 * @sbuf: LEB-sized buffer to use 989 * 990 * This function reads a LEB up to a point pre-determined by the mount recovery, 991 * checks the nodes, and writes the result back to the flash, thereby cleaning 992 * off any following corruption, or non-fatal ECC errors. 993 * 994 * This function returns %0 on success and a negative error code on failure. 995 */ 996 static int clean_an_unclean_leb(struct ubifs_info *c, 997 struct ubifs_unclean_leb *ucleb, void *sbuf) 998 { 999 int err, lnum = ucleb->lnum, offs = 0, len = ucleb->endpt, quiet = 1; 1000 void *buf = sbuf; 1001 1002 dbg_rcvry("LEB %d len %d", lnum, len); 1003 1004 if (len == 0) { 1005 /* Nothing to read, just unmap it */ 1006 err = ubifs_leb_unmap(c, lnum); 1007 if (err) 1008 return err; 1009 return 0; 1010 } 1011 1012 err = ubifs_leb_read(c, lnum, buf, offs, len, 0); 1013 if (err && err != -EBADMSG) 1014 return err; 1015 1016 while (len >= 8) { 1017 int ret; 1018 1019 cond_resched(); 1020 1021 /* Scan quietly until there is an error */ 1022 ret = ubifs_scan_a_node(c, buf, len, lnum, offs, quiet); 1023 1024 if (ret == SCANNED_A_NODE) { 1025 /* A valid node, and not a padding node */ 1026 struct ubifs_ch *ch = buf; 1027 int node_len; 1028 1029 node_len = ALIGN(le32_to_cpu(ch->len), 8); 1030 offs += node_len; 1031 buf += node_len; 1032 len -= node_len; 1033 continue; 1034 } 1035 1036 if (ret > 0) { 1037 /* Padding bytes or a valid padding node */ 1038 offs += ret; 1039 buf += ret; 1040 len -= ret; 1041 continue; 1042 } 1043 1044 if (ret == SCANNED_EMPTY_SPACE) { 1045 ubifs_err("unexpected empty space at %d:%d", 1046 lnum, offs); 1047 return -EUCLEAN; 1048 } 1049 1050 if (quiet) { 1051 /* Redo the last scan but noisily */ 1052 quiet = 0; 1053 continue; 1054 } 1055 1056 ubifs_scanned_corruption(c, lnum, offs, buf); 1057 return -EUCLEAN; 1058 } 1059 1060 /* Pad to min_io_size */ 1061 len = ALIGN(ucleb->endpt, c->min_io_size); 1062 if (len > ucleb->endpt) { 1063 int pad_len = len - ALIGN(ucleb->endpt, 8); 1064 1065 if (pad_len > 0) { 1066 buf = c->sbuf + len - pad_len; 1067 ubifs_pad(c, buf, pad_len); 1068 } 1069 } 1070 1071 /* Write back the LEB atomically */ 1072 err = ubifs_leb_change(c, lnum, sbuf, len); 1073 if (err) 1074 return err; 1075 1076 dbg_rcvry("cleaned LEB %d", lnum); 1077 1078 return 0; 1079 } 1080 1081 /** 1082 * ubifs_clean_lebs - clean LEBs recovered during read-only mount. 1083 * @c: UBIFS file-system description object 1084 * @sbuf: LEB-sized buffer to use 1085 * 1086 * This function cleans a LEB identified during recovery that needs to be 1087 * written but was not because UBIFS was mounted read-only. This happens when 1088 * remounting to read-write mode. 1089 * 1090 * This function returns %0 on success and a negative error code on failure. 1091 */ 1092 int ubifs_clean_lebs(struct ubifs_info *c, void *sbuf) 1093 { 1094 dbg_rcvry("recovery"); 1095 while (!list_empty(&c->unclean_leb_list)) { 1096 struct ubifs_unclean_leb *ucleb; 1097 int err; 1098 1099 ucleb = list_entry(c->unclean_leb_list.next, 1100 struct ubifs_unclean_leb, list); 1101 err = clean_an_unclean_leb(c, ucleb, sbuf); 1102 if (err) 1103 return err; 1104 list_del(&ucleb->list); 1105 kfree(ucleb); 1106 } 1107 return 0; 1108 } 1109 1110 #ifndef __UBOOT__ 1111 /** 1112 * grab_empty_leb - grab an empty LEB to use as GC LEB and run commit. 1113 * @c: UBIFS file-system description object 1114 * 1115 * This is a helper function for 'ubifs_rcvry_gc_commit()' which grabs an empty 1116 * LEB to be used as GC LEB (@c->gc_lnum), and then runs the commit. Returns 1117 * zero in case of success and a negative error code in case of failure. 1118 */ 1119 static int grab_empty_leb(struct ubifs_info *c) 1120 { 1121 int lnum, err; 1122 1123 /* 1124 * Note, it is very important to first search for an empty LEB and then 1125 * run the commit, not vice-versa. The reason is that there might be 1126 * only one empty LEB at the moment, the one which has been the 1127 * @c->gc_lnum just before the power cut happened. During the regular 1128 * UBIFS operation (not now) @c->gc_lnum is marked as "taken", so no 1129 * one but GC can grab it. But at this moment this single empty LEB is 1130 * not marked as taken, so if we run commit - what happens? Right, the 1131 * commit will grab it and write the index there. Remember that the 1132 * index always expands as long as there is free space, and it only 1133 * starts consolidating when we run out of space. 1134 * 1135 * IOW, if we run commit now, we might not be able to find a free LEB 1136 * after this. 1137 */ 1138 lnum = ubifs_find_free_leb_for_idx(c); 1139 if (lnum < 0) { 1140 ubifs_err("could not find an empty LEB"); 1141 ubifs_dump_lprops(c); 1142 ubifs_dump_budg(c, &c->bi); 1143 return lnum; 1144 } 1145 1146 /* Reset the index flag */ 1147 err = ubifs_change_one_lp(c, lnum, LPROPS_NC, LPROPS_NC, 0, 1148 LPROPS_INDEX, 0); 1149 if (err) 1150 return err; 1151 1152 c->gc_lnum = lnum; 1153 dbg_rcvry("found empty LEB %d, run commit", lnum); 1154 1155 return ubifs_run_commit(c); 1156 } 1157 1158 /** 1159 * ubifs_rcvry_gc_commit - recover the GC LEB number and run the commit. 1160 * @c: UBIFS file-system description object 1161 * 1162 * Out-of-place garbage collection requires always one empty LEB with which to 1163 * start garbage collection. The LEB number is recorded in c->gc_lnum and is 1164 * written to the master node on unmounting. In the case of an unclean unmount 1165 * the value of gc_lnum recorded in the master node is out of date and cannot 1166 * be used. Instead, recovery must allocate an empty LEB for this purpose. 1167 * However, there may not be enough empty space, in which case it must be 1168 * possible to GC the dirtiest LEB into the GC head LEB. 1169 * 1170 * This function also runs the commit which causes the TNC updates from 1171 * size-recovery and orphans to be written to the flash. That is important to 1172 * ensure correct replay order for subsequent mounts. 1173 * 1174 * This function returns %0 on success and a negative error code on failure. 1175 */ 1176 int ubifs_rcvry_gc_commit(struct ubifs_info *c) 1177 { 1178 struct ubifs_wbuf *wbuf = &c->jheads[GCHD].wbuf; 1179 struct ubifs_lprops lp; 1180 int err; 1181 1182 dbg_rcvry("GC head LEB %d, offs %d", wbuf->lnum, wbuf->offs); 1183 1184 c->gc_lnum = -1; 1185 if (wbuf->lnum == -1 || wbuf->offs == c->leb_size) 1186 return grab_empty_leb(c); 1187 1188 err = ubifs_find_dirty_leb(c, &lp, wbuf->offs, 2); 1189 if (err) { 1190 if (err != -ENOSPC) 1191 return err; 1192 1193 dbg_rcvry("could not find a dirty LEB"); 1194 return grab_empty_leb(c); 1195 } 1196 1197 ubifs_assert(!(lp.flags & LPROPS_INDEX)); 1198 ubifs_assert(lp.free + lp.dirty >= wbuf->offs); 1199 1200 /* 1201 * We run the commit before garbage collection otherwise subsequent 1202 * mounts will see the GC and orphan deletion in a different order. 1203 */ 1204 dbg_rcvry("committing"); 1205 err = ubifs_run_commit(c); 1206 if (err) 1207 return err; 1208 1209 dbg_rcvry("GC'ing LEB %d", lp.lnum); 1210 mutex_lock_nested(&wbuf->io_mutex, wbuf->jhead); 1211 err = ubifs_garbage_collect_leb(c, &lp); 1212 if (err >= 0) { 1213 int err2 = ubifs_wbuf_sync_nolock(wbuf); 1214 1215 if (err2) 1216 err = err2; 1217 } 1218 mutex_unlock(&wbuf->io_mutex); 1219 if (err < 0) { 1220 ubifs_err("GC failed, error %d", err); 1221 if (err == -EAGAIN) 1222 err = -EINVAL; 1223 return err; 1224 } 1225 1226 ubifs_assert(err == LEB_RETAINED); 1227 if (err != LEB_RETAINED) 1228 return -EINVAL; 1229 1230 err = ubifs_leb_unmap(c, c->gc_lnum); 1231 if (err) 1232 return err; 1233 1234 dbg_rcvry("allocated LEB %d for GC", lp.lnum); 1235 return 0; 1236 } 1237 #else 1238 int ubifs_rcvry_gc_commit(struct ubifs_info *c) 1239 { 1240 return 0; 1241 } 1242 #endif 1243 1244 /** 1245 * struct size_entry - inode size information for recovery. 1246 * @rb: link in the RB-tree of sizes 1247 * @inum: inode number 1248 * @i_size: size on inode 1249 * @d_size: maximum size based on data nodes 1250 * @exists: indicates whether the inode exists 1251 * @inode: inode if pinned in memory awaiting rw mode to fix it 1252 */ 1253 struct size_entry { 1254 struct rb_node rb; 1255 ino_t inum; 1256 loff_t i_size; 1257 loff_t d_size; 1258 int exists; 1259 struct inode *inode; 1260 }; 1261 1262 /** 1263 * add_ino - add an entry to the size tree. 1264 * @c: UBIFS file-system description object 1265 * @inum: inode number 1266 * @i_size: size on inode 1267 * @d_size: maximum size based on data nodes 1268 * @exists: indicates whether the inode exists 1269 */ 1270 static int add_ino(struct ubifs_info *c, ino_t inum, loff_t i_size, 1271 loff_t d_size, int exists) 1272 { 1273 struct rb_node **p = &c->size_tree.rb_node, *parent = NULL; 1274 struct size_entry *e; 1275 1276 while (*p) { 1277 parent = *p; 1278 e = rb_entry(parent, struct size_entry, rb); 1279 if (inum < e->inum) 1280 p = &(*p)->rb_left; 1281 else 1282 p = &(*p)->rb_right; 1283 } 1284 1285 e = kzalloc(sizeof(struct size_entry), GFP_KERNEL); 1286 if (!e) 1287 return -ENOMEM; 1288 1289 e->inum = inum; 1290 e->i_size = i_size; 1291 e->d_size = d_size; 1292 e->exists = exists; 1293 1294 rb_link_node(&e->rb, parent, p); 1295 rb_insert_color(&e->rb, &c->size_tree); 1296 1297 return 0; 1298 } 1299 1300 /** 1301 * find_ino - find an entry on the size tree. 1302 * @c: UBIFS file-system description object 1303 * @inum: inode number 1304 */ 1305 static struct size_entry *find_ino(struct ubifs_info *c, ino_t inum) 1306 { 1307 struct rb_node *p = c->size_tree.rb_node; 1308 struct size_entry *e; 1309 1310 while (p) { 1311 e = rb_entry(p, struct size_entry, rb); 1312 if (inum < e->inum) 1313 p = p->rb_left; 1314 else if (inum > e->inum) 1315 p = p->rb_right; 1316 else 1317 return e; 1318 } 1319 return NULL; 1320 } 1321 1322 /** 1323 * remove_ino - remove an entry from the size tree. 1324 * @c: UBIFS file-system description object 1325 * @inum: inode number 1326 */ 1327 static void remove_ino(struct ubifs_info *c, ino_t inum) 1328 { 1329 struct size_entry *e = find_ino(c, inum); 1330 1331 if (!e) 1332 return; 1333 rb_erase(&e->rb, &c->size_tree); 1334 kfree(e); 1335 } 1336 1337 /** 1338 * ubifs_destroy_size_tree - free resources related to the size tree. 1339 * @c: UBIFS file-system description object 1340 */ 1341 void ubifs_destroy_size_tree(struct ubifs_info *c) 1342 { 1343 struct size_entry *e, *n; 1344 1345 rbtree_postorder_for_each_entry_safe(e, n, &c->size_tree, rb) { 1346 if (e->inode) 1347 iput(e->inode); 1348 kfree(e); 1349 } 1350 1351 c->size_tree = RB_ROOT; 1352 } 1353 1354 /** 1355 * ubifs_recover_size_accum - accumulate inode sizes for recovery. 1356 * @c: UBIFS file-system description object 1357 * @key: node key 1358 * @deletion: node is for a deletion 1359 * @new_size: inode size 1360 * 1361 * This function has two purposes: 1362 * 1) to ensure there are no data nodes that fall outside the inode size 1363 * 2) to ensure there are no data nodes for inodes that do not exist 1364 * To accomplish those purposes, a rb-tree is constructed containing an entry 1365 * for each inode number in the journal that has not been deleted, and recording 1366 * the size from the inode node, the maximum size of any data node (also altered 1367 * by truncations) and a flag indicating a inode number for which no inode node 1368 * was present in the journal. 1369 * 1370 * Note that there is still the possibility that there are data nodes that have 1371 * been committed that are beyond the inode size, however the only way to find 1372 * them would be to scan the entire index. Alternatively, some provision could 1373 * be made to record the size of inodes at the start of commit, which would seem 1374 * very cumbersome for a scenario that is quite unlikely and the only negative 1375 * consequence of which is wasted space. 1376 * 1377 * This functions returns %0 on success and a negative error code on failure. 1378 */ 1379 int ubifs_recover_size_accum(struct ubifs_info *c, union ubifs_key *key, 1380 int deletion, loff_t new_size) 1381 { 1382 ino_t inum = key_inum(c, key); 1383 struct size_entry *e; 1384 int err; 1385 1386 switch (key_type(c, key)) { 1387 case UBIFS_INO_KEY: 1388 if (deletion) 1389 remove_ino(c, inum); 1390 else { 1391 e = find_ino(c, inum); 1392 if (e) { 1393 e->i_size = new_size; 1394 e->exists = 1; 1395 } else { 1396 err = add_ino(c, inum, new_size, 0, 1); 1397 if (err) 1398 return err; 1399 } 1400 } 1401 break; 1402 case UBIFS_DATA_KEY: 1403 e = find_ino(c, inum); 1404 if (e) { 1405 if (new_size > e->d_size) 1406 e->d_size = new_size; 1407 } else { 1408 err = add_ino(c, inum, 0, new_size, 0); 1409 if (err) 1410 return err; 1411 } 1412 break; 1413 case UBIFS_TRUN_KEY: 1414 e = find_ino(c, inum); 1415 if (e) 1416 e->d_size = new_size; 1417 break; 1418 } 1419 return 0; 1420 } 1421 1422 #ifndef __UBOOT__ 1423 /** 1424 * fix_size_in_place - fix inode size in place on flash. 1425 * @c: UBIFS file-system description object 1426 * @e: inode size information for recovery 1427 */ 1428 static int fix_size_in_place(struct ubifs_info *c, struct size_entry *e) 1429 { 1430 struct ubifs_ino_node *ino = c->sbuf; 1431 unsigned char *p; 1432 union ubifs_key key; 1433 int err, lnum, offs, len; 1434 loff_t i_size; 1435 uint32_t crc; 1436 1437 /* Locate the inode node LEB number and offset */ 1438 ino_key_init(c, &key, e->inum); 1439 err = ubifs_tnc_locate(c, &key, ino, &lnum, &offs); 1440 if (err) 1441 goto out; 1442 /* 1443 * If the size recorded on the inode node is greater than the size that 1444 * was calculated from nodes in the journal then don't change the inode. 1445 */ 1446 i_size = le64_to_cpu(ino->size); 1447 if (i_size >= e->d_size) 1448 return 0; 1449 /* Read the LEB */ 1450 err = ubifs_leb_read(c, lnum, c->sbuf, 0, c->leb_size, 1); 1451 if (err) 1452 goto out; 1453 /* Change the size field and recalculate the CRC */ 1454 ino = c->sbuf + offs; 1455 ino->size = cpu_to_le64(e->d_size); 1456 len = le32_to_cpu(ino->ch.len); 1457 crc = crc32(UBIFS_CRC32_INIT, (void *)ino + 8, len - 8); 1458 ino->ch.crc = cpu_to_le32(crc); 1459 /* Work out where data in the LEB ends and free space begins */ 1460 p = c->sbuf; 1461 len = c->leb_size - 1; 1462 while (p[len] == 0xff) 1463 len -= 1; 1464 len = ALIGN(len + 1, c->min_io_size); 1465 /* Atomically write the fixed LEB back again */ 1466 err = ubifs_leb_change(c, lnum, c->sbuf, len); 1467 if (err) 1468 goto out; 1469 dbg_rcvry("inode %lu at %d:%d size %lld -> %lld", 1470 (unsigned long)e->inum, lnum, offs, i_size, e->d_size); 1471 return 0; 1472 1473 out: 1474 ubifs_warn("inode %lu failed to fix size %lld -> %lld error %d", 1475 (unsigned long)e->inum, e->i_size, e->d_size, err); 1476 return err; 1477 } 1478 #endif 1479 1480 /** 1481 * ubifs_recover_size - recover inode size. 1482 * @c: UBIFS file-system description object 1483 * 1484 * This function attempts to fix inode size discrepancies identified by the 1485 * 'ubifs_recover_size_accum()' function. 1486 * 1487 * This functions returns %0 on success and a negative error code on failure. 1488 */ 1489 int ubifs_recover_size(struct ubifs_info *c) 1490 { 1491 struct rb_node *this = rb_first(&c->size_tree); 1492 1493 while (this) { 1494 struct size_entry *e; 1495 int err; 1496 1497 e = rb_entry(this, struct size_entry, rb); 1498 if (!e->exists) { 1499 union ubifs_key key; 1500 1501 ino_key_init(c, &key, e->inum); 1502 err = ubifs_tnc_lookup(c, &key, c->sbuf); 1503 if (err && err != -ENOENT) 1504 return err; 1505 if (err == -ENOENT) { 1506 /* Remove data nodes that have no inode */ 1507 dbg_rcvry("removing ino %lu", 1508 (unsigned long)e->inum); 1509 err = ubifs_tnc_remove_ino(c, e->inum); 1510 if (err) 1511 return err; 1512 } else { 1513 struct ubifs_ino_node *ino = c->sbuf; 1514 1515 e->exists = 1; 1516 e->i_size = le64_to_cpu(ino->size); 1517 } 1518 } 1519 1520 if (e->exists && e->i_size < e->d_size) { 1521 if (c->ro_mount) { 1522 /* Fix the inode size and pin it in memory */ 1523 struct inode *inode; 1524 struct ubifs_inode *ui; 1525 1526 ubifs_assert(!e->inode); 1527 1528 inode = ubifs_iget(c->vfs_sb, e->inum); 1529 if (IS_ERR(inode)) 1530 return PTR_ERR(inode); 1531 1532 ui = ubifs_inode(inode); 1533 if (inode->i_size < e->d_size) { 1534 dbg_rcvry("ino %lu size %lld -> %lld", 1535 (unsigned long)e->inum, 1536 inode->i_size, e->d_size); 1537 inode->i_size = e->d_size; 1538 ui->ui_size = e->d_size; 1539 ui->synced_i_size = e->d_size; 1540 e->inode = inode; 1541 this = rb_next(this); 1542 continue; 1543 } 1544 iput(inode); 1545 #ifndef __UBOOT__ 1546 } else { 1547 /* Fix the size in place */ 1548 err = fix_size_in_place(c, e); 1549 if (err) 1550 return err; 1551 if (e->inode) 1552 iput(e->inode); 1553 #endif 1554 } 1555 } 1556 1557 this = rb_next(this); 1558 rb_erase(&e->rb, &c->size_tree); 1559 kfree(e); 1560 } 1561 1562 return 0; 1563 } 1564