• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Copyright (c) International Business Machines Corp., 2006
4  *
5  * Author: Artem Bityutskiy (Битюцкий Артём)
6  */
7 
8 /*
9  * The UBI Eraseblock Association (EBA) sub-system.
10  *
11  * This sub-system is responsible for I/O to/from logical eraseblock.
12  *
13  * Although in this implementation the EBA table is fully kept and managed in
14  * RAM, which assumes poor scalability, it might be (partially) maintained on
15  * flash in future implementations.
16  *
17  * The EBA sub-system implements per-logical eraseblock locking. Before
18  * accessing a logical eraseblock it is locked for reading or writing. The
19  * per-logical eraseblock locking is implemented by means of the lock tree. The
20  * lock tree is an RB-tree which refers all the currently locked logical
21  * eraseblocks. The lock tree elements are &struct ubi_ltree_entry objects.
22  * They are indexed by (@vol_id, @lnum) pairs.
23  *
24  * EBA also maintains the global sequence counter which is incremented each
25  * time a logical eraseblock is mapped to a physical eraseblock and it is
26  * stored in the volume identifier header. This means that each VID header has
27  * a unique sequence number. The sequence number is only increased an we assume
28  * 64 bits is enough to never overflow.
29  */
30 
31 #include <linux/slab.h>
32 #include <linux/crc32.h>
33 #include <linux/err.h>
34 #include "ubi.h"
35 
36 /* Number of physical eraseblocks reserved for atomic LEB change operation */
37 #define EBA_RESERVED_PEBS 1
38 
39 /**
40  * struct ubi_eba_entry - structure encoding a single LEB -> PEB association
41  * @pnum: the physical eraseblock number attached to the LEB
42  *
43  * This structure is encoding a LEB -> PEB association. Note that the LEB
44  * number is not stored here, because it is the index used to access the
45  * entries table.
46  */
47 struct ubi_eba_entry {
48 	int pnum;
49 };
50 
51 /**
52  * struct ubi_eba_table - LEB -> PEB association information
53  * @entries: the LEB to PEB mapping (one entry per LEB).
54  *
55  * This structure is private to the EBA logic and should be kept here.
56  * It is encoding the LEB to PEB association table, and is subject to
57  * changes.
58  */
59 struct ubi_eba_table {
60 	struct ubi_eba_entry *entries;
61 };
62 
63 /**
64  * next_sqnum - get next sequence number.
65  * @ubi: UBI device description object
66  *
67  * This function returns next sequence number to use, which is just the current
68  * global sequence counter value. It also increases the global sequence
69  * counter.
70  */
ubi_next_sqnum(struct ubi_device * ubi)71 unsigned long long ubi_next_sqnum(struct ubi_device *ubi)
72 {
73 	unsigned long long sqnum;
74 
75 	spin_lock(&ubi->ltree_lock);
76 	sqnum = ubi->global_sqnum++;
77 	spin_unlock(&ubi->ltree_lock);
78 
79 	return sqnum;
80 }
81 
82 /**
83  * ubi_get_compat - get compatibility flags of a volume.
84  * @ubi: UBI device description object
85  * @vol_id: volume ID
86  *
87  * This function returns compatibility flags for an internal volume. User
88  * volumes have no compatibility flags, so %0 is returned.
89  */
ubi_get_compat(const struct ubi_device * ubi,int vol_id)90 static int ubi_get_compat(const struct ubi_device *ubi, int vol_id)
91 {
92 	if (vol_id == UBI_LAYOUT_VOLUME_ID)
93 		return UBI_LAYOUT_VOLUME_COMPAT;
94 	return 0;
95 }
96 
97 /**
98  * ubi_eba_get_ldesc - get information about a LEB
99  * @vol: volume description object
100  * @lnum: logical eraseblock number
101  * @ldesc: the LEB descriptor to fill
102  *
103  * Used to query information about a specific LEB.
104  * It is currently only returning the physical position of the LEB, but will be
105  * extended to provide more information.
106  */
ubi_eba_get_ldesc(struct ubi_volume * vol,int lnum,struct ubi_eba_leb_desc * ldesc)107 void ubi_eba_get_ldesc(struct ubi_volume *vol, int lnum,
108 		       struct ubi_eba_leb_desc *ldesc)
109 {
110 	ldesc->lnum = lnum;
111 	ldesc->pnum = vol->eba_tbl->entries[lnum].pnum;
112 }
113 
114 /**
115  * ubi_eba_create_table - allocate a new EBA table and initialize it with all
116  *			  LEBs unmapped
117  * @vol: volume containing the EBA table to copy
118  * @nentries: number of entries in the table
119  *
120  * Allocate a new EBA table and initialize it with all LEBs unmapped.
121  * Returns a valid pointer if it succeed, an ERR_PTR() otherwise.
122  */
ubi_eba_create_table(struct ubi_volume * vol,int nentries)123 struct ubi_eba_table *ubi_eba_create_table(struct ubi_volume *vol,
124 					   int nentries)
125 {
126 	struct ubi_eba_table *tbl;
127 	int err = -ENOMEM;
128 	int i;
129 
130 	tbl = kzalloc(sizeof(*tbl), GFP_KERNEL);
131 	if (!tbl)
132 		return ERR_PTR(-ENOMEM);
133 
134 	tbl->entries = kmalloc_array(nentries, sizeof(*tbl->entries),
135 				     GFP_KERNEL);
136 	if (!tbl->entries)
137 		goto err;
138 
139 	for (i = 0; i < nentries; i++)
140 		tbl->entries[i].pnum = UBI_LEB_UNMAPPED;
141 
142 	return tbl;
143 
144 err:
145 	kfree(tbl);
146 
147 	return ERR_PTR(err);
148 }
149 
150 /**
151  * ubi_eba_destroy_table - destroy an EBA table
152  * @tbl: the table to destroy
153  *
154  * Destroy an EBA table.
155  */
ubi_eba_destroy_table(struct ubi_eba_table * tbl)156 void ubi_eba_destroy_table(struct ubi_eba_table *tbl)
157 {
158 	if (!tbl)
159 		return;
160 
161 	kfree(tbl->entries);
162 	kfree(tbl);
163 }
164 
165 /**
166  * ubi_eba_copy_table - copy the EBA table attached to vol into another table
167  * @vol: volume containing the EBA table to copy
168  * @dst: destination
169  * @nentries: number of entries to copy
170  *
171  * Copy the EBA table stored in vol into the one pointed by dst.
172  */
ubi_eba_copy_table(struct ubi_volume * vol,struct ubi_eba_table * dst,int nentries)173 void ubi_eba_copy_table(struct ubi_volume *vol, struct ubi_eba_table *dst,
174 			int nentries)
175 {
176 	struct ubi_eba_table *src;
177 	int i;
178 
179 	ubi_assert(dst && vol && vol->eba_tbl);
180 
181 	src = vol->eba_tbl;
182 
183 	for (i = 0; i < nentries; i++)
184 		dst->entries[i].pnum = src->entries[i].pnum;
185 }
186 
187 /**
188  * ubi_eba_replace_table - assign a new EBA table to a volume
189  * @vol: volume containing the EBA table to copy
190  * @tbl: new EBA table
191  *
192  * Assign a new EBA table to the volume and release the old one.
193  */
ubi_eba_replace_table(struct ubi_volume * vol,struct ubi_eba_table * tbl)194 void ubi_eba_replace_table(struct ubi_volume *vol, struct ubi_eba_table *tbl)
195 {
196 	ubi_eba_destroy_table(vol->eba_tbl);
197 	vol->eba_tbl = tbl;
198 }
199 
200 /**
201  * ltree_lookup - look up the lock tree.
202  * @ubi: UBI device description object
203  * @vol_id: volume ID
204  * @lnum: logical eraseblock number
205  *
206  * This function returns a pointer to the corresponding &struct ubi_ltree_entry
207  * object if the logical eraseblock is locked and %NULL if it is not.
208  * @ubi->ltree_lock has to be locked.
209  */
ltree_lookup(struct ubi_device * ubi,int vol_id,int lnum)210 static struct ubi_ltree_entry *ltree_lookup(struct ubi_device *ubi, int vol_id,
211 					    int lnum)
212 {
213 	struct rb_node *p;
214 
215 	p = ubi->ltree.rb_node;
216 	while (p) {
217 		struct ubi_ltree_entry *le;
218 
219 		le = rb_entry(p, struct ubi_ltree_entry, rb);
220 
221 		if (vol_id < le->vol_id)
222 			p = p->rb_left;
223 		else if (vol_id > le->vol_id)
224 			p = p->rb_right;
225 		else {
226 			if (lnum < le->lnum)
227 				p = p->rb_left;
228 			else if (lnum > le->lnum)
229 				p = p->rb_right;
230 			else
231 				return le;
232 		}
233 	}
234 
235 	return NULL;
236 }
237 
238 /**
239  * ltree_add_entry - add new entry to the lock tree.
240  * @ubi: UBI device description object
241  * @vol_id: volume ID
242  * @lnum: logical eraseblock number
243  *
244  * This function adds new entry for logical eraseblock (@vol_id, @lnum) to the
245  * lock tree. If such entry is already there, its usage counter is increased.
246  * Returns pointer to the lock tree entry or %-ENOMEM if memory allocation
247  * failed.
248  */
ltree_add_entry(struct ubi_device * ubi,int vol_id,int lnum)249 static struct ubi_ltree_entry *ltree_add_entry(struct ubi_device *ubi,
250 					       int vol_id, int lnum)
251 {
252 	struct ubi_ltree_entry *le, *le1, *le_free;
253 
254 	le = kmalloc(sizeof(struct ubi_ltree_entry), GFP_NOFS);
255 	if (!le)
256 		return ERR_PTR(-ENOMEM);
257 
258 	le->users = 0;
259 	init_rwsem(&le->mutex);
260 	le->vol_id = vol_id;
261 	le->lnum = lnum;
262 
263 	spin_lock(&ubi->ltree_lock);
264 	le1 = ltree_lookup(ubi, vol_id, lnum);
265 
266 	if (le1) {
267 		/*
268 		 * This logical eraseblock is already locked. The newly
269 		 * allocated lock entry is not needed.
270 		 */
271 		le_free = le;
272 		le = le1;
273 	} else {
274 		struct rb_node **p, *parent = NULL;
275 
276 		/*
277 		 * No lock entry, add the newly allocated one to the
278 		 * @ubi->ltree RB-tree.
279 		 */
280 		le_free = NULL;
281 
282 		p = &ubi->ltree.rb_node;
283 		while (*p) {
284 			parent = *p;
285 			le1 = rb_entry(parent, struct ubi_ltree_entry, rb);
286 
287 			if (vol_id < le1->vol_id)
288 				p = &(*p)->rb_left;
289 			else if (vol_id > le1->vol_id)
290 				p = &(*p)->rb_right;
291 			else {
292 				ubi_assert(lnum != le1->lnum);
293 				if (lnum < le1->lnum)
294 					p = &(*p)->rb_left;
295 				else
296 					p = &(*p)->rb_right;
297 			}
298 		}
299 
300 		rb_link_node(&le->rb, parent, p);
301 		rb_insert_color(&le->rb, &ubi->ltree);
302 	}
303 	le->users += 1;
304 	spin_unlock(&ubi->ltree_lock);
305 
306 	kfree(le_free);
307 	return le;
308 }
309 
310 /**
311  * leb_read_lock - lock logical eraseblock for reading.
312  * @ubi: UBI device description object
313  * @vol_id: volume ID
314  * @lnum: logical eraseblock number
315  *
316  * This function locks a logical eraseblock for reading. Returns zero in case
317  * of success and a negative error code in case of failure.
318  */
leb_read_lock(struct ubi_device * ubi,int vol_id,int lnum)319 static int leb_read_lock(struct ubi_device *ubi, int vol_id, int lnum)
320 {
321 	struct ubi_ltree_entry *le;
322 
323 	le = ltree_add_entry(ubi, vol_id, lnum);
324 	if (IS_ERR(le))
325 		return PTR_ERR(le);
326 	down_read(&le->mutex);
327 	return 0;
328 }
329 
330 /**
331  * leb_read_unlock - unlock logical eraseblock.
332  * @ubi: UBI device description object
333  * @vol_id: volume ID
334  * @lnum: logical eraseblock number
335  */
leb_read_unlock(struct ubi_device * ubi,int vol_id,int lnum)336 static void leb_read_unlock(struct ubi_device *ubi, int vol_id, int lnum)
337 {
338 	struct ubi_ltree_entry *le;
339 
340 	spin_lock(&ubi->ltree_lock);
341 	le = ltree_lookup(ubi, vol_id, lnum);
342 	le->users -= 1;
343 	ubi_assert(le->users >= 0);
344 	up_read(&le->mutex);
345 	if (le->users == 0) {
346 		rb_erase(&le->rb, &ubi->ltree);
347 		kfree(le);
348 	}
349 	spin_unlock(&ubi->ltree_lock);
350 }
351 
352 /**
353  * leb_write_lock - lock logical eraseblock for writing.
354  * @ubi: UBI device description object
355  * @vol_id: volume ID
356  * @lnum: logical eraseblock number
357  *
358  * This function locks a logical eraseblock for writing. Returns zero in case
359  * of success and a negative error code in case of failure.
360  */
leb_write_lock(struct ubi_device * ubi,int vol_id,int lnum)361 static int leb_write_lock(struct ubi_device *ubi, int vol_id, int lnum)
362 {
363 	struct ubi_ltree_entry *le;
364 
365 	le = ltree_add_entry(ubi, vol_id, lnum);
366 	if (IS_ERR(le))
367 		return PTR_ERR(le);
368 	down_write(&le->mutex);
369 	return 0;
370 }
371 
372 /**
373  * leb_write_trylock - try to lock logical eraseblock for writing.
374  * @ubi: UBI device description object
375  * @vol_id: volume ID
376  * @lnum: logical eraseblock number
377  *
378  * This function locks a logical eraseblock for writing if there is no
379  * contention and does nothing if there is contention. Returns %0 in case of
380  * success, %1 in case of contention, and a negative error code in case of
381  * failure.
382  */
leb_write_trylock(struct ubi_device * ubi,int vol_id,int lnum)383 static int leb_write_trylock(struct ubi_device *ubi, int vol_id, int lnum)
384 {
385 	struct ubi_ltree_entry *le;
386 
387 	le = ltree_add_entry(ubi, vol_id, lnum);
388 	if (IS_ERR(le))
389 		return PTR_ERR(le);
390 	if (down_write_trylock(&le->mutex))
391 		return 0;
392 
393 	/* Contention, cancel */
394 	spin_lock(&ubi->ltree_lock);
395 	le->users -= 1;
396 	ubi_assert(le->users >= 0);
397 	if (le->users == 0) {
398 		rb_erase(&le->rb, &ubi->ltree);
399 		kfree(le);
400 	}
401 	spin_unlock(&ubi->ltree_lock);
402 
403 	return 1;
404 }
405 
406 /**
407  * leb_write_unlock - unlock logical eraseblock.
408  * @ubi: UBI device description object
409  * @vol_id: volume ID
410  * @lnum: logical eraseblock number
411  */
leb_write_unlock(struct ubi_device * ubi,int vol_id,int lnum)412 static void leb_write_unlock(struct ubi_device *ubi, int vol_id, int lnum)
413 {
414 	struct ubi_ltree_entry *le;
415 
416 	spin_lock(&ubi->ltree_lock);
417 	le = ltree_lookup(ubi, vol_id, lnum);
418 	le->users -= 1;
419 	ubi_assert(le->users >= 0);
420 	up_write(&le->mutex);
421 	if (le->users == 0) {
422 		rb_erase(&le->rb, &ubi->ltree);
423 		kfree(le);
424 	}
425 	spin_unlock(&ubi->ltree_lock);
426 }
427 
428 /**
429  * ubi_eba_is_mapped - check if a LEB is mapped.
430  * @vol: volume description object
431  * @lnum: logical eraseblock number
432  *
433  * This function returns true if the LEB is mapped, false otherwise.
434  */
ubi_eba_is_mapped(struct ubi_volume * vol,int lnum)435 bool ubi_eba_is_mapped(struct ubi_volume *vol, int lnum)
436 {
437 	return vol->eba_tbl->entries[lnum].pnum >= 0;
438 }
439 
440 /**
441  * ubi_eba_unmap_leb - un-map logical eraseblock.
442  * @ubi: UBI device description object
443  * @vol: volume description object
444  * @lnum: logical eraseblock number
445  *
446  * This function un-maps logical eraseblock @lnum and schedules corresponding
447  * physical eraseblock for erasure. Returns zero in case of success and a
448  * negative error code in case of failure.
449  */
ubi_eba_unmap_leb(struct ubi_device * ubi,struct ubi_volume * vol,int lnum)450 int ubi_eba_unmap_leb(struct ubi_device *ubi, struct ubi_volume *vol,
451 		      int lnum)
452 {
453 	int err, pnum, vol_id = vol->vol_id;
454 
455 	if (ubi->ro_mode)
456 		return -EROFS;
457 
458 	err = leb_write_lock(ubi, vol_id, lnum);
459 	if (err)
460 		return err;
461 
462 	pnum = vol->eba_tbl->entries[lnum].pnum;
463 	if (pnum < 0)
464 		/* This logical eraseblock is already unmapped */
465 		goto out_unlock;
466 
467 	dbg_eba("erase LEB %d:%d, PEB %d", vol_id, lnum, pnum);
468 
469 	down_read(&ubi->fm_eba_sem);
470 	vol->eba_tbl->entries[lnum].pnum = UBI_LEB_UNMAPPED;
471 	up_read(&ubi->fm_eba_sem);
472 	err = ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 0);
473 
474 out_unlock:
475 	leb_write_unlock(ubi, vol_id, lnum);
476 	return err;
477 }
478 
479 #ifdef CONFIG_MTD_UBI_FASTMAP
480 /**
481  * check_mapping - check and fixup a mapping
482  * @ubi: UBI device description object
483  * @vol: volume description object
484  * @lnum: logical eraseblock number
485  * @pnum: physical eraseblock number
486  *
487  * Checks whether a given mapping is valid. Fastmap cannot track LEB unmap
488  * operations, if such an operation is interrupted the mapping still looks
489  * good, but upon first read an ECC is reported to the upper layer.
490  * Normaly during the full-scan at attach time this is fixed, for Fastmap
491  * we have to deal with it while reading.
492  * If the PEB behind a LEB shows this symthom we change the mapping to
493  * %UBI_LEB_UNMAPPED and schedule the PEB for erasure.
494  *
495  * Returns 0 on success, negative error code in case of failure.
496  */
check_mapping(struct ubi_device * ubi,struct ubi_volume * vol,int lnum,int * pnum)497 static int check_mapping(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
498 			 int *pnum)
499 {
500 	int err;
501 	struct ubi_vid_io_buf *vidb;
502 	struct ubi_vid_hdr *vid_hdr;
503 
504 	if (!ubi->fast_attach)
505 		return 0;
506 
507 	if (!vol->checkmap || test_bit(lnum, vol->checkmap))
508 		return 0;
509 
510 	vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
511 	if (!vidb)
512 		return -ENOMEM;
513 
514 	err = ubi_io_read_vid_hdr(ubi, *pnum, vidb, 0);
515 	if (err > 0 && err != UBI_IO_BITFLIPS) {
516 		int torture = 0;
517 
518 		switch (err) {
519 			case UBI_IO_FF:
520 			case UBI_IO_FF_BITFLIPS:
521 			case UBI_IO_BAD_HDR:
522 			case UBI_IO_BAD_HDR_EBADMSG:
523 				break;
524 			default:
525 				ubi_assert(0);
526 		}
527 
528 		if (err == UBI_IO_BAD_HDR_EBADMSG || err == UBI_IO_FF_BITFLIPS)
529 			torture = 1;
530 
531 		down_read(&ubi->fm_eba_sem);
532 		vol->eba_tbl->entries[lnum].pnum = UBI_LEB_UNMAPPED;
533 		up_read(&ubi->fm_eba_sem);
534 		ubi_wl_put_peb(ubi, vol->vol_id, lnum, *pnum, torture);
535 
536 		*pnum = UBI_LEB_UNMAPPED;
537 	} else if (err < 0) {
538 		ubi_err(ubi, "unable to read VID header back from PEB %i: %i",
539 			*pnum, err);
540 
541 		goto out_free;
542 	} else {
543 		int found_vol_id, found_lnum;
544 
545 		ubi_assert(err == 0 || err == UBI_IO_BITFLIPS);
546 
547 		vid_hdr = ubi_get_vid_hdr(vidb);
548 		found_vol_id = be32_to_cpu(vid_hdr->vol_id);
549 		found_lnum = be32_to_cpu(vid_hdr->lnum);
550 
551 		if (found_lnum != lnum || found_vol_id != vol->vol_id) {
552 			ubi_err(ubi, "EBA mismatch! PEB %i is LEB %i:%i instead of LEB %i:%i",
553 				*pnum, found_vol_id, found_lnum, vol->vol_id, lnum);
554 			ubi_ro_mode(ubi);
555 			err = -EINVAL;
556 			goto out_free;
557 		}
558 	}
559 
560 	set_bit(lnum, vol->checkmap);
561 	err = 0;
562 
563 out_free:
564 	ubi_free_vid_buf(vidb);
565 
566 	return err;
567 }
568 #else
check_mapping(struct ubi_device * ubi,struct ubi_volume * vol,int lnum,int * pnum)569 static int check_mapping(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
570 		  int *pnum)
571 {
572 	return 0;
573 }
574 #endif
575 
576 /**
577  * ubi_eba_read_leb - read data.
578  * @ubi: UBI device description object
579  * @vol: volume description object
580  * @lnum: logical eraseblock number
581  * @buf: buffer to store the read data
582  * @offset: offset from where to read
583  * @len: how many bytes to read
584  * @check: data CRC check flag
585  *
586  * If the logical eraseblock @lnum is unmapped, @buf is filled with 0xFF
587  * bytes. The @check flag only makes sense for static volumes and forces
588  * eraseblock data CRC checking.
589  *
590  * In case of success this function returns zero. In case of a static volume,
591  * if data CRC mismatches - %-EBADMSG is returned. %-EBADMSG may also be
592  * returned for any volume type if an ECC error was detected by the MTD device
593  * driver. Other negative error cored may be returned in case of other errors.
594  */
ubi_eba_read_leb(struct ubi_device * ubi,struct ubi_volume * vol,int lnum,void * buf,int offset,int len,int check)595 int ubi_eba_read_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
596 		     void *buf, int offset, int len, int check)
597 {
598 	int err, pnum, scrub = 0, vol_id = vol->vol_id;
599 	struct ubi_vid_io_buf *vidb;
600 	struct ubi_vid_hdr *vid_hdr;
601 	uint32_t crc;
602 
603 	err = leb_read_lock(ubi, vol_id, lnum);
604 	if (err)
605 		return err;
606 
607 	pnum = vol->eba_tbl->entries[lnum].pnum;
608 	if (pnum >= 0) {
609 		err = check_mapping(ubi, vol, lnum, &pnum);
610 		if (err < 0)
611 			goto out_unlock;
612 	}
613 
614 	if (pnum == UBI_LEB_UNMAPPED) {
615 		/*
616 		 * The logical eraseblock is not mapped, fill the whole buffer
617 		 * with 0xFF bytes. The exception is static volumes for which
618 		 * it is an error to read unmapped logical eraseblocks.
619 		 */
620 		dbg_eba("read %d bytes from offset %d of LEB %d:%d (unmapped)",
621 			len, offset, vol_id, lnum);
622 		leb_read_unlock(ubi, vol_id, lnum);
623 		ubi_assert(vol->vol_type != UBI_STATIC_VOLUME);
624 		memset(buf, 0xFF, len);
625 		return 0;
626 	}
627 
628 	dbg_eba("read %d bytes from offset %d of LEB %d:%d, PEB %d",
629 		len, offset, vol_id, lnum, pnum);
630 
631 	if (vol->vol_type == UBI_DYNAMIC_VOLUME)
632 		check = 0;
633 
634 retry:
635 	if (check) {
636 		vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
637 		if (!vidb) {
638 			err = -ENOMEM;
639 			goto out_unlock;
640 		}
641 
642 		vid_hdr = ubi_get_vid_hdr(vidb);
643 
644 		err = ubi_io_read_vid_hdr(ubi, pnum, vidb, 1);
645 		if (err && err != UBI_IO_BITFLIPS) {
646 			if (err > 0) {
647 				/*
648 				 * The header is either absent or corrupted.
649 				 * The former case means there is a bug -
650 				 * switch to read-only mode just in case.
651 				 * The latter case means a real corruption - we
652 				 * may try to recover data. FIXME: but this is
653 				 * not implemented.
654 				 */
655 				if (err == UBI_IO_BAD_HDR_EBADMSG ||
656 				    err == UBI_IO_BAD_HDR) {
657 					ubi_warn(ubi, "corrupted VID header at PEB %d, LEB %d:%d",
658 						 pnum, vol_id, lnum);
659 					err = -EBADMSG;
660 				} else {
661 					/*
662 					 * Ending up here in the non-Fastmap case
663 					 * is a clear bug as the VID header had to
664 					 * be present at scan time to have it referenced.
665 					 * With fastmap the story is more complicated.
666 					 * Fastmap has the mapping info without the need
667 					 * of a full scan. So the LEB could have been
668 					 * unmapped, Fastmap cannot know this and keeps
669 					 * the LEB referenced.
670 					 * This is valid and works as the layer above UBI
671 					 * has to do bookkeeping about used/referenced
672 					 * LEBs in any case.
673 					 */
674 					if (ubi->fast_attach) {
675 						err = -EBADMSG;
676 					} else {
677 						err = -EINVAL;
678 						ubi_ro_mode(ubi);
679 					}
680 				}
681 			}
682 			goto out_free;
683 		} else if (err == UBI_IO_BITFLIPS)
684 			scrub = 1;
685 
686 		ubi_assert(lnum < be32_to_cpu(vid_hdr->used_ebs));
687 		ubi_assert(len == be32_to_cpu(vid_hdr->data_size));
688 
689 		crc = be32_to_cpu(vid_hdr->data_crc);
690 		ubi_free_vid_buf(vidb);
691 	}
692 
693 	err = ubi_io_read_data(ubi, buf, pnum, offset, len);
694 	if (err) {
695 		if (err == UBI_IO_BITFLIPS)
696 			scrub = 1;
697 		else if (mtd_is_eccerr(err)) {
698 			if (vol->vol_type == UBI_DYNAMIC_VOLUME)
699 				goto out_unlock;
700 			scrub = 1;
701 			if (!check) {
702 				ubi_msg(ubi, "force data checking");
703 				check = 1;
704 				goto retry;
705 			}
706 		} else
707 			goto out_unlock;
708 	}
709 
710 	if (check) {
711 		uint32_t crc1 = crc32(UBI_CRC32_INIT, buf, len);
712 		if (crc1 != crc) {
713 			ubi_warn(ubi, "CRC error: calculated %#08x, must be %#08x",
714 				 crc1, crc);
715 			err = -EBADMSG;
716 			goto out_unlock;
717 		}
718 	}
719 
720 	if (scrub)
721 		err = ubi_wl_scrub_peb(ubi, pnum);
722 
723 	leb_read_unlock(ubi, vol_id, lnum);
724 	return err;
725 
726 out_free:
727 	ubi_free_vid_buf(vidb);
728 out_unlock:
729 	leb_read_unlock(ubi, vol_id, lnum);
730 	return err;
731 }
732 
733 /**
734  * ubi_eba_read_leb_sg - read data into a scatter gather list.
735  * @ubi: UBI device description object
736  * @vol: volume description object
737  * @lnum: logical eraseblock number
738  * @sgl: UBI scatter gather list to store the read data
739  * @offset: offset from where to read
740  * @len: how many bytes to read
741  * @check: data CRC check flag
742  *
743  * This function works exactly like ubi_eba_read_leb(). But instead of
744  * storing the read data into a buffer it writes to an UBI scatter gather
745  * list.
746  */
ubi_eba_read_leb_sg(struct ubi_device * ubi,struct ubi_volume * vol,struct ubi_sgl * sgl,int lnum,int offset,int len,int check)747 int ubi_eba_read_leb_sg(struct ubi_device *ubi, struct ubi_volume *vol,
748 			struct ubi_sgl *sgl, int lnum, int offset, int len,
749 			int check)
750 {
751 	int to_read;
752 	int ret;
753 	struct scatterlist *sg;
754 
755 	for (;;) {
756 		ubi_assert(sgl->list_pos < UBI_MAX_SG_COUNT);
757 		sg = &sgl->sg[sgl->list_pos];
758 		if (len < sg->length - sgl->page_pos)
759 			to_read = len;
760 		else
761 			to_read = sg->length - sgl->page_pos;
762 
763 		ret = ubi_eba_read_leb(ubi, vol, lnum,
764 				       sg_virt(sg) + sgl->page_pos, offset,
765 				       to_read, check);
766 		if (ret < 0)
767 			return ret;
768 
769 		offset += to_read;
770 		len -= to_read;
771 		if (!len) {
772 			sgl->page_pos += to_read;
773 			if (sgl->page_pos == sg->length) {
774 				sgl->list_pos++;
775 				sgl->page_pos = 0;
776 			}
777 
778 			break;
779 		}
780 
781 		sgl->list_pos++;
782 		sgl->page_pos = 0;
783 	}
784 
785 	return ret;
786 }
787 
788 /**
789  * try_recover_peb - try to recover from write failure.
790  * @vol: volume description object
791  * @pnum: the physical eraseblock to recover
792  * @lnum: logical eraseblock number
793  * @buf: data which was not written because of the write failure
794  * @offset: offset of the failed write
795  * @len: how many bytes should have been written
796  * @vidb: VID buffer
797  * @retry: whether the caller should retry in case of failure
798  *
799  * This function is called in case of a write failure and moves all good data
800  * from the potentially bad physical eraseblock to a good physical eraseblock.
801  * This function also writes the data which was not written due to the failure.
802  * Returns 0 in case of success, and a negative error code in case of failure.
803  * In case of failure, the %retry parameter is set to false if this is a fatal
804  * error (retrying won't help), and true otherwise.
805  */
try_recover_peb(struct ubi_volume * vol,int pnum,int lnum,const void * buf,int offset,int len,struct ubi_vid_io_buf * vidb,bool * retry)806 static int try_recover_peb(struct ubi_volume *vol, int pnum, int lnum,
807 			   const void *buf, int offset, int len,
808 			   struct ubi_vid_io_buf *vidb, bool *retry)
809 {
810 	struct ubi_device *ubi = vol->ubi;
811 	struct ubi_vid_hdr *vid_hdr;
812 	int new_pnum, err, vol_id = vol->vol_id, data_size;
813 	uint32_t crc;
814 
815 	*retry = false;
816 
817 	new_pnum = ubi_wl_get_peb(ubi);
818 	if (new_pnum < 0) {
819 		err = new_pnum;
820 		goto out_put;
821 	}
822 
823 	ubi_msg(ubi, "recover PEB %d, move data to PEB %d",
824 		pnum, new_pnum);
825 
826 	err = ubi_io_read_vid_hdr(ubi, pnum, vidb, 1);
827 	if (err && err != UBI_IO_BITFLIPS) {
828 		if (err > 0)
829 			err = -EIO;
830 		goto out_put;
831 	}
832 
833 	vid_hdr = ubi_get_vid_hdr(vidb);
834 	ubi_assert(vid_hdr->vol_type == UBI_VID_DYNAMIC);
835 
836 	mutex_lock(&ubi->buf_mutex);
837 	memset(ubi->peb_buf + offset, 0xFF, len);
838 
839 	/* Read everything before the area where the write failure happened */
840 	if (offset > 0) {
841 		err = ubi_io_read_data(ubi, ubi->peb_buf, pnum, 0, offset);
842 		if (err && err != UBI_IO_BITFLIPS)
843 			goto out_unlock;
844 	}
845 
846 	*retry = true;
847 
848 	memcpy(ubi->peb_buf + offset, buf, len);
849 
850 	data_size = offset + len;
851 	crc = crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size);
852 	vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
853 	vid_hdr->copy_flag = 1;
854 	vid_hdr->data_size = cpu_to_be32(data_size);
855 	vid_hdr->data_crc = cpu_to_be32(crc);
856 	err = ubi_io_write_vid_hdr(ubi, new_pnum, vidb);
857 	if (err)
858 		goto out_unlock;
859 
860 	err = ubi_io_write_data(ubi, ubi->peb_buf, new_pnum, 0, data_size);
861 
862 out_unlock:
863 	mutex_unlock(&ubi->buf_mutex);
864 
865 	if (!err)
866 		vol->eba_tbl->entries[lnum].pnum = new_pnum;
867 
868 out_put:
869 	up_read(&ubi->fm_eba_sem);
870 
871 	if (!err) {
872 		ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1);
873 		ubi_msg(ubi, "data was successfully recovered");
874 	} else if (new_pnum >= 0) {
875 		/*
876 		 * Bad luck? This physical eraseblock is bad too? Crud. Let's
877 		 * try to get another one.
878 		 */
879 		ubi_wl_put_peb(ubi, vol_id, lnum, new_pnum, 1);
880 		ubi_warn(ubi, "failed to write to PEB %d", new_pnum);
881 	}
882 
883 	return err;
884 }
885 
886 /**
887  * recover_peb - recover from write failure.
888  * @ubi: UBI device description object
889  * @pnum: the physical eraseblock to recover
890  * @vol_id: volume ID
891  * @lnum: logical eraseblock number
892  * @buf: data which was not written because of the write failure
893  * @offset: offset of the failed write
894  * @len: how many bytes should have been written
895  *
896  * This function is called in case of a write failure and moves all good data
897  * from the potentially bad physical eraseblock to a good physical eraseblock.
898  * This function also writes the data which was not written due to the failure.
899  * Returns 0 in case of success, and a negative error code in case of failure.
900  * This function tries %UBI_IO_RETRIES before giving up.
901  */
recover_peb(struct ubi_device * ubi,int pnum,int vol_id,int lnum,const void * buf,int offset,int len)902 static int recover_peb(struct ubi_device *ubi, int pnum, int vol_id, int lnum,
903 		       const void *buf, int offset, int len)
904 {
905 	int err, idx = vol_id2idx(ubi, vol_id), tries;
906 	struct ubi_volume *vol = ubi->volumes[idx];
907 	struct ubi_vid_io_buf *vidb;
908 
909 	vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
910 	if (!vidb)
911 		return -ENOMEM;
912 
913 	for (tries = 0; tries <= UBI_IO_RETRIES; tries++) {
914 		bool retry;
915 
916 		err = try_recover_peb(vol, pnum, lnum, buf, offset, len, vidb,
917 				      &retry);
918 		if (!err || !retry)
919 			break;
920 
921 		ubi_msg(ubi, "try again");
922 	}
923 
924 	ubi_free_vid_buf(vidb);
925 
926 	return err;
927 }
928 
929 /**
930  * try_write_vid_and_data - try to write VID header and data to a new PEB.
931  * @vol: volume description object
932  * @lnum: logical eraseblock number
933  * @vidb: the VID buffer to write
934  * @buf: buffer containing the data
935  * @offset: where to start writing data
936  * @len: how many bytes should be written
937  *
938  * This function tries to write VID header and data belonging to logical
939  * eraseblock @lnum of volume @vol to a new physical eraseblock. Returns zero
940  * in case of success and a negative error code in case of failure.
941  * In case of error, it is possible that something was still written to the
942  * flash media, but may be some garbage.
943  */
try_write_vid_and_data(struct ubi_volume * vol,int lnum,struct ubi_vid_io_buf * vidb,const void * buf,int offset,int len)944 static int try_write_vid_and_data(struct ubi_volume *vol, int lnum,
945 				  struct ubi_vid_io_buf *vidb, const void *buf,
946 				  int offset, int len)
947 {
948 	struct ubi_device *ubi = vol->ubi;
949 	int pnum, opnum, err, err2, vol_id = vol->vol_id;
950 
951 	pnum = ubi_wl_get_peb(ubi);
952 	if (pnum < 0) {
953 		err = pnum;
954 		goto out_put;
955 	}
956 
957 	opnum = vol->eba_tbl->entries[lnum].pnum;
958 
959 	dbg_eba("write VID hdr and %d bytes at offset %d of LEB %d:%d, PEB %d",
960 		len, offset, vol_id, lnum, pnum);
961 
962 	err = ubi_io_write_vid_hdr(ubi, pnum, vidb);
963 	if (err) {
964 		ubi_warn(ubi, "failed to write VID header to LEB %d:%d, PEB %d",
965 			 vol_id, lnum, pnum);
966 		goto out_put;
967 	}
968 
969 	if (len) {
970 		err = ubi_io_write_data(ubi, buf, pnum, offset, len);
971 		if (err) {
972 			ubi_warn(ubi,
973 				 "failed to write %d bytes at offset %d of LEB %d:%d, PEB %d",
974 				 len, offset, vol_id, lnum, pnum);
975 			goto out_put;
976 		}
977 	}
978 
979 	vol->eba_tbl->entries[lnum].pnum = pnum;
980 
981 out_put:
982 	up_read(&ubi->fm_eba_sem);
983 
984 	if (err && pnum >= 0) {
985 		err2 = ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1);
986 		if (err2) {
987 			ubi_warn(ubi, "failed to return physical eraseblock %d, error %d",
988 				 pnum, err2);
989 		}
990 	} else if (!err && opnum >= 0) {
991 		err2 = ubi_wl_put_peb(ubi, vol_id, lnum, opnum, 0);
992 		if (err2) {
993 			ubi_warn(ubi, "failed to return physical eraseblock %d, error %d",
994 				 opnum, err2);
995 		}
996 	}
997 
998 	return err;
999 }
1000 
1001 /**
1002  * ubi_eba_write_leb - write data to dynamic volume.
1003  * @ubi: UBI device description object
1004  * @vol: volume description object
1005  * @lnum: logical eraseblock number
1006  * @buf: the data to write
1007  * @offset: offset within the logical eraseblock where to write
1008  * @len: how many bytes to write
1009  *
1010  * This function writes data to logical eraseblock @lnum of a dynamic volume
1011  * @vol. Returns zero in case of success and a negative error code in case
1012  * of failure. In case of error, it is possible that something was still
1013  * written to the flash media, but may be some garbage.
1014  * This function retries %UBI_IO_RETRIES times before giving up.
1015  */
ubi_eba_write_leb(struct ubi_device * ubi,struct ubi_volume * vol,int lnum,const void * buf,int offset,int len)1016 int ubi_eba_write_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
1017 		      const void *buf, int offset, int len)
1018 {
1019 	int err, pnum, tries, vol_id = vol->vol_id;
1020 	struct ubi_vid_io_buf *vidb;
1021 	struct ubi_vid_hdr *vid_hdr;
1022 
1023 	if (ubi->ro_mode)
1024 		return -EROFS;
1025 
1026 	err = leb_write_lock(ubi, vol_id, lnum);
1027 	if (err)
1028 		return err;
1029 
1030 	pnum = vol->eba_tbl->entries[lnum].pnum;
1031 	if (pnum >= 0) {
1032 		err = check_mapping(ubi, vol, lnum, &pnum);
1033 		if (err < 0)
1034 			goto out;
1035 	}
1036 
1037 	if (pnum >= 0) {
1038 		dbg_eba("write %d bytes at offset %d of LEB %d:%d, PEB %d",
1039 			len, offset, vol_id, lnum, pnum);
1040 
1041 		err = ubi_io_write_data(ubi, buf, pnum, offset, len);
1042 		if (err) {
1043 			ubi_warn(ubi, "failed to write data to PEB %d", pnum);
1044 			if (err == -EIO && ubi->bad_allowed)
1045 				err = recover_peb(ubi, pnum, vol_id, lnum, buf,
1046 						  offset, len);
1047 		}
1048 
1049 		goto out;
1050 	}
1051 
1052 	/*
1053 	 * The logical eraseblock is not mapped. We have to get a free physical
1054 	 * eraseblock and write the volume identifier header there first.
1055 	 */
1056 	vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
1057 	if (!vidb) {
1058 		leb_write_unlock(ubi, vol_id, lnum);
1059 		return -ENOMEM;
1060 	}
1061 
1062 	vid_hdr = ubi_get_vid_hdr(vidb);
1063 
1064 	vid_hdr->vol_type = UBI_VID_DYNAMIC;
1065 	vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1066 	vid_hdr->vol_id = cpu_to_be32(vol_id);
1067 	vid_hdr->lnum = cpu_to_be32(lnum);
1068 	vid_hdr->compat = ubi_get_compat(ubi, vol_id);
1069 	vid_hdr->data_pad = cpu_to_be32(vol->data_pad);
1070 
1071 	for (tries = 0; tries <= UBI_IO_RETRIES; tries++) {
1072 		err = try_write_vid_and_data(vol, lnum, vidb, buf, offset, len);
1073 		if (err != -EIO || !ubi->bad_allowed)
1074 			break;
1075 
1076 		/*
1077 		 * Fortunately, this is the first write operation to this
1078 		 * physical eraseblock, so just put it and request a new one.
1079 		 * We assume that if this physical eraseblock went bad, the
1080 		 * erase code will handle that.
1081 		 */
1082 		vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1083 		ubi_msg(ubi, "try another PEB");
1084 	}
1085 
1086 	ubi_free_vid_buf(vidb);
1087 
1088 out:
1089 	if (err)
1090 		ubi_ro_mode(ubi);
1091 
1092 	leb_write_unlock(ubi, vol_id, lnum);
1093 
1094 	return err;
1095 }
1096 
1097 /**
1098  * ubi_eba_write_leb_st - write data to static volume.
1099  * @ubi: UBI device description object
1100  * @vol: volume description object
1101  * @lnum: logical eraseblock number
1102  * @buf: data to write
1103  * @len: how many bytes to write
1104  * @used_ebs: how many logical eraseblocks will this volume contain
1105  *
1106  * This function writes data to logical eraseblock @lnum of static volume
1107  * @vol. The @used_ebs argument should contain total number of logical
1108  * eraseblock in this static volume.
1109  *
1110  * When writing to the last logical eraseblock, the @len argument doesn't have
1111  * to be aligned to the minimal I/O unit size. Instead, it has to be equivalent
1112  * to the real data size, although the @buf buffer has to contain the
1113  * alignment. In all other cases, @len has to be aligned.
1114  *
1115  * It is prohibited to write more than once to logical eraseblocks of static
1116  * volumes. This function returns zero in case of success and a negative error
1117  * code in case of failure.
1118  */
ubi_eba_write_leb_st(struct ubi_device * ubi,struct ubi_volume * vol,int lnum,const void * buf,int len,int used_ebs)1119 int ubi_eba_write_leb_st(struct ubi_device *ubi, struct ubi_volume *vol,
1120 			 int lnum, const void *buf, int len, int used_ebs)
1121 {
1122 	int err, tries, data_size = len, vol_id = vol->vol_id;
1123 	struct ubi_vid_io_buf *vidb;
1124 	struct ubi_vid_hdr *vid_hdr;
1125 	uint32_t crc;
1126 
1127 	if (ubi->ro_mode)
1128 		return -EROFS;
1129 
1130 	if (lnum == used_ebs - 1)
1131 		/* If this is the last LEB @len may be unaligned */
1132 		len = ALIGN(data_size, ubi->min_io_size);
1133 	else
1134 		ubi_assert(!(len & (ubi->min_io_size - 1)));
1135 
1136 	vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
1137 	if (!vidb)
1138 		return -ENOMEM;
1139 
1140 	vid_hdr = ubi_get_vid_hdr(vidb);
1141 
1142 	err = leb_write_lock(ubi, vol_id, lnum);
1143 	if (err)
1144 		goto out;
1145 
1146 	vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1147 	vid_hdr->vol_id = cpu_to_be32(vol_id);
1148 	vid_hdr->lnum = cpu_to_be32(lnum);
1149 	vid_hdr->compat = ubi_get_compat(ubi, vol_id);
1150 	vid_hdr->data_pad = cpu_to_be32(vol->data_pad);
1151 
1152 	crc = crc32(UBI_CRC32_INIT, buf, data_size);
1153 	vid_hdr->vol_type = UBI_VID_STATIC;
1154 	vid_hdr->data_size = cpu_to_be32(data_size);
1155 	vid_hdr->used_ebs = cpu_to_be32(used_ebs);
1156 	vid_hdr->data_crc = cpu_to_be32(crc);
1157 
1158 	ubi_assert(vol->eba_tbl->entries[lnum].pnum < 0);
1159 
1160 	for (tries = 0; tries <= UBI_IO_RETRIES; tries++) {
1161 		err = try_write_vid_and_data(vol, lnum, vidb, buf, 0, len);
1162 		if (err != -EIO || !ubi->bad_allowed)
1163 			break;
1164 
1165 		vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1166 		ubi_msg(ubi, "try another PEB");
1167 	}
1168 
1169 	if (err)
1170 		ubi_ro_mode(ubi);
1171 
1172 	leb_write_unlock(ubi, vol_id, lnum);
1173 
1174 out:
1175 	ubi_free_vid_buf(vidb);
1176 
1177 	return err;
1178 }
1179 
1180 /*
1181  * ubi_eba_atomic_leb_change - change logical eraseblock atomically.
1182  * @ubi: UBI device description object
1183  * @vol: volume description object
1184  * @lnum: logical eraseblock number
1185  * @buf: data to write
1186  * @len: how many bytes to write
1187  *
1188  * This function changes the contents of a logical eraseblock atomically. @buf
1189  * has to contain new logical eraseblock data, and @len - the length of the
1190  * data, which has to be aligned. This function guarantees that in case of an
1191  * unclean reboot the old contents is preserved. Returns zero in case of
1192  * success and a negative error code in case of failure.
1193  *
1194  * UBI reserves one LEB for the "atomic LEB change" operation, so only one
1195  * LEB change may be done at a time. This is ensured by @ubi->alc_mutex.
1196  */
ubi_eba_atomic_leb_change(struct ubi_device * ubi,struct ubi_volume * vol,int lnum,const void * buf,int len)1197 int ubi_eba_atomic_leb_change(struct ubi_device *ubi, struct ubi_volume *vol,
1198 			      int lnum, const void *buf, int len)
1199 {
1200 	int err, tries, vol_id = vol->vol_id;
1201 	struct ubi_vid_io_buf *vidb;
1202 	struct ubi_vid_hdr *vid_hdr;
1203 	uint32_t crc;
1204 
1205 	if (ubi->ro_mode)
1206 		return -EROFS;
1207 
1208 	if (len == 0) {
1209 		/*
1210 		 * Special case when data length is zero. In this case the LEB
1211 		 * has to be unmapped and mapped somewhere else.
1212 		 */
1213 		err = ubi_eba_unmap_leb(ubi, vol, lnum);
1214 		if (err)
1215 			return err;
1216 		return ubi_eba_write_leb(ubi, vol, lnum, NULL, 0, 0);
1217 	}
1218 
1219 	vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS);
1220 	if (!vidb)
1221 		return -ENOMEM;
1222 
1223 	vid_hdr = ubi_get_vid_hdr(vidb);
1224 
1225 	mutex_lock(&ubi->alc_mutex);
1226 	err = leb_write_lock(ubi, vol_id, lnum);
1227 	if (err)
1228 		goto out_mutex;
1229 
1230 	vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1231 	vid_hdr->vol_id = cpu_to_be32(vol_id);
1232 	vid_hdr->lnum = cpu_to_be32(lnum);
1233 	vid_hdr->compat = ubi_get_compat(ubi, vol_id);
1234 	vid_hdr->data_pad = cpu_to_be32(vol->data_pad);
1235 
1236 	crc = crc32(UBI_CRC32_INIT, buf, len);
1237 	vid_hdr->vol_type = UBI_VID_DYNAMIC;
1238 	vid_hdr->data_size = cpu_to_be32(len);
1239 	vid_hdr->copy_flag = 1;
1240 	vid_hdr->data_crc = cpu_to_be32(crc);
1241 
1242 	dbg_eba("change LEB %d:%d", vol_id, lnum);
1243 
1244 	for (tries = 0; tries <= UBI_IO_RETRIES; tries++) {
1245 		err = try_write_vid_and_data(vol, lnum, vidb, buf, 0, len);
1246 		if (err != -EIO || !ubi->bad_allowed)
1247 			break;
1248 
1249 		vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1250 		ubi_msg(ubi, "try another PEB");
1251 	}
1252 
1253 	/*
1254 	 * This flash device does not admit of bad eraseblocks or
1255 	 * something nasty and unexpected happened. Switch to read-only
1256 	 * mode just in case.
1257 	 */
1258 	if (err)
1259 		ubi_ro_mode(ubi);
1260 
1261 	leb_write_unlock(ubi, vol_id, lnum);
1262 
1263 out_mutex:
1264 	mutex_unlock(&ubi->alc_mutex);
1265 	ubi_free_vid_buf(vidb);
1266 	return err;
1267 }
1268 
1269 /**
1270  * is_error_sane - check whether a read error is sane.
1271  * @err: code of the error happened during reading
1272  *
1273  * This is a helper function for 'ubi_eba_copy_leb()' which is called when we
1274  * cannot read data from the target PEB (an error @err happened). If the error
1275  * code is sane, then we treat this error as non-fatal. Otherwise the error is
1276  * fatal and UBI will be switched to R/O mode later.
1277  *
1278  * The idea is that we try not to switch to R/O mode if the read error is
1279  * something which suggests there was a real read problem. E.g., %-EIO. Or a
1280  * memory allocation failed (-%ENOMEM). Otherwise, it is safer to switch to R/O
1281  * mode, simply because we do not know what happened at the MTD level, and we
1282  * cannot handle this. E.g., the underlying driver may have become crazy, and
1283  * it is safer to switch to R/O mode to preserve the data.
1284  *
1285  * And bear in mind, this is about reading from the target PEB, i.e. the PEB
1286  * which we have just written.
1287  */
is_error_sane(int err)1288 static int is_error_sane(int err)
1289 {
1290 	if (err == -EIO || err == -ENOMEM || err == UBI_IO_BAD_HDR ||
1291 	    err == UBI_IO_BAD_HDR_EBADMSG || err == -ETIMEDOUT)
1292 		return 0;
1293 	return 1;
1294 }
1295 
1296 /**
1297  * ubi_eba_copy_leb - copy logical eraseblock.
1298  * @ubi: UBI device description object
1299  * @from: physical eraseblock number from where to copy
1300  * @to: physical eraseblock number where to copy
1301  * @vidb: data structure from where the VID header is derived
1302  *
1303  * This function copies logical eraseblock from physical eraseblock @from to
1304  * physical eraseblock @to. The @vid_hdr buffer may be changed by this
1305  * function. Returns:
1306  *   o %0 in case of success;
1307  *   o %MOVE_CANCEL_RACE, %MOVE_TARGET_WR_ERR, %MOVE_TARGET_BITFLIPS, etc;
1308  *   o a negative error code in case of failure.
1309  */
ubi_eba_copy_leb(struct ubi_device * ubi,int from,int to,struct ubi_vid_io_buf * vidb)1310 int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
1311 		     struct ubi_vid_io_buf *vidb)
1312 {
1313 	int err, vol_id, lnum, data_size, aldata_size, idx;
1314 	struct ubi_vid_hdr *vid_hdr = ubi_get_vid_hdr(vidb);
1315 	struct ubi_volume *vol;
1316 	uint32_t crc;
1317 
1318 	ubi_assert(rwsem_is_locked(&ubi->fm_eba_sem));
1319 
1320 	vol_id = be32_to_cpu(vid_hdr->vol_id);
1321 	lnum = be32_to_cpu(vid_hdr->lnum);
1322 
1323 	dbg_wl("copy LEB %d:%d, PEB %d to PEB %d", vol_id, lnum, from, to);
1324 
1325 	if (vid_hdr->vol_type == UBI_VID_STATIC) {
1326 		data_size = be32_to_cpu(vid_hdr->data_size);
1327 		aldata_size = ALIGN(data_size, ubi->min_io_size);
1328 	} else
1329 		data_size = aldata_size =
1330 			    ubi->leb_size - be32_to_cpu(vid_hdr->data_pad);
1331 
1332 	idx = vol_id2idx(ubi, vol_id);
1333 	spin_lock(&ubi->volumes_lock);
1334 	/*
1335 	 * Note, we may race with volume deletion, which means that the volume
1336 	 * this logical eraseblock belongs to might be being deleted. Since the
1337 	 * volume deletion un-maps all the volume's logical eraseblocks, it will
1338 	 * be locked in 'ubi_wl_put_peb()' and wait for the WL worker to finish.
1339 	 */
1340 	vol = ubi->volumes[idx];
1341 	spin_unlock(&ubi->volumes_lock);
1342 	if (!vol) {
1343 		/* No need to do further work, cancel */
1344 		dbg_wl("volume %d is being removed, cancel", vol_id);
1345 		return MOVE_CANCEL_RACE;
1346 	}
1347 
1348 	/*
1349 	 * We do not want anybody to write to this logical eraseblock while we
1350 	 * are moving it, so lock it.
1351 	 *
1352 	 * Note, we are using non-waiting locking here, because we cannot sleep
1353 	 * on the LEB, since it may cause deadlocks. Indeed, imagine a task is
1354 	 * unmapping the LEB which is mapped to the PEB we are going to move
1355 	 * (@from). This task locks the LEB and goes sleep in the
1356 	 * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
1357 	 * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
1358 	 * LEB is already locked, we just do not move it and return
1359 	 * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because
1360 	 * we do not know the reasons of the contention - it may be just a
1361 	 * normal I/O on this LEB, so we want to re-try.
1362 	 */
1363 	err = leb_write_trylock(ubi, vol_id, lnum);
1364 	if (err) {
1365 		dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
1366 		return MOVE_RETRY;
1367 	}
1368 
1369 	/*
1370 	 * The LEB might have been put meanwhile, and the task which put it is
1371 	 * probably waiting on @ubi->move_mutex. No need to continue the work,
1372 	 * cancel it.
1373 	 */
1374 	if (vol->eba_tbl->entries[lnum].pnum != from) {
1375 		dbg_wl("LEB %d:%d is no longer mapped to PEB %d, mapped to PEB %d, cancel",
1376 		       vol_id, lnum, from, vol->eba_tbl->entries[lnum].pnum);
1377 		err = MOVE_CANCEL_RACE;
1378 		goto out_unlock_leb;
1379 	}
1380 
1381 	/*
1382 	 * OK, now the LEB is locked and we can safely start moving it. Since
1383 	 * this function utilizes the @ubi->peb_buf buffer which is shared
1384 	 * with some other functions - we lock the buffer by taking the
1385 	 * @ubi->buf_mutex.
1386 	 */
1387 	mutex_lock(&ubi->buf_mutex);
1388 	dbg_wl("read %d bytes of data", aldata_size);
1389 	err = ubi_io_read_data(ubi, ubi->peb_buf, from, 0, aldata_size);
1390 	if (err && err != UBI_IO_BITFLIPS) {
1391 		ubi_warn(ubi, "error %d while reading data from PEB %d",
1392 			 err, from);
1393 		err = MOVE_SOURCE_RD_ERR;
1394 		goto out_unlock_buf;
1395 	}
1396 
1397 	/*
1398 	 * Now we have got to calculate how much data we have to copy. In
1399 	 * case of a static volume it is fairly easy - the VID header contains
1400 	 * the data size. In case of a dynamic volume it is more difficult - we
1401 	 * have to read the contents, cut 0xFF bytes from the end and copy only
1402 	 * the first part. We must do this to avoid writing 0xFF bytes as it
1403 	 * may have some side-effects. And not only this. It is important not
1404 	 * to include those 0xFFs to CRC because later the they may be filled
1405 	 * by data.
1406 	 */
1407 	if (vid_hdr->vol_type == UBI_VID_DYNAMIC)
1408 		aldata_size = data_size =
1409 			ubi_calc_data_len(ubi, ubi->peb_buf, data_size);
1410 
1411 	cond_resched();
1412 	crc = crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size);
1413 	cond_resched();
1414 
1415 	/*
1416 	 * It may turn out to be that the whole @from physical eraseblock
1417 	 * contains only 0xFF bytes. Then we have to only write the VID header
1418 	 * and do not write any data. This also means we should not set
1419 	 * @vid_hdr->copy_flag, @vid_hdr->data_size, and @vid_hdr->data_crc.
1420 	 */
1421 	if (data_size > 0) {
1422 		vid_hdr->copy_flag = 1;
1423 		vid_hdr->data_size = cpu_to_be32(data_size);
1424 		vid_hdr->data_crc = cpu_to_be32(crc);
1425 	}
1426 	vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
1427 
1428 	err = ubi_io_write_vid_hdr(ubi, to, vidb);
1429 	if (err) {
1430 		if (err == -EIO)
1431 			err = MOVE_TARGET_WR_ERR;
1432 		goto out_unlock_buf;
1433 	}
1434 
1435 	cond_resched();
1436 
1437 	/* Read the VID header back and check if it was written correctly */
1438 	err = ubi_io_read_vid_hdr(ubi, to, vidb, 1);
1439 	if (err) {
1440 		if (err != UBI_IO_BITFLIPS) {
1441 			ubi_warn(ubi, "error %d while reading VID header back from PEB %d",
1442 				 err, to);
1443 			if (is_error_sane(err))
1444 				err = MOVE_TARGET_RD_ERR;
1445 		} else
1446 			err = MOVE_TARGET_BITFLIPS;
1447 		goto out_unlock_buf;
1448 	}
1449 
1450 	if (data_size > 0) {
1451 		err = ubi_io_write_data(ubi, ubi->peb_buf, to, 0, aldata_size);
1452 		if (err) {
1453 			if (err == -EIO)
1454 				err = MOVE_TARGET_WR_ERR;
1455 			goto out_unlock_buf;
1456 		}
1457 
1458 		cond_resched();
1459 	}
1460 
1461 	ubi_assert(vol->eba_tbl->entries[lnum].pnum == from);
1462 	vol->eba_tbl->entries[lnum].pnum = to;
1463 
1464 out_unlock_buf:
1465 	mutex_unlock(&ubi->buf_mutex);
1466 out_unlock_leb:
1467 	leb_write_unlock(ubi, vol_id, lnum);
1468 	return err;
1469 }
1470 
1471 /**
1472  * print_rsvd_warning - warn about not having enough reserved PEBs.
1473  * @ubi: UBI device description object
1474  * @ai: UBI attach info object
1475  *
1476  * This is a helper function for 'ubi_eba_init()' which is called when UBI
1477  * cannot reserve enough PEBs for bad block handling. This function makes a
1478  * decision whether we have to print a warning or not. The algorithm is as
1479  * follows:
1480  *   o if this is a new UBI image, then just print the warning
1481  *   o if this is an UBI image which has already been used for some time, print
1482  *     a warning only if we can reserve less than 10% of the expected amount of
1483  *     the reserved PEB.
1484  *
1485  * The idea is that when UBI is used, PEBs become bad, and the reserved pool
1486  * of PEBs becomes smaller, which is normal and we do not want to scare users
1487  * with a warning every time they attach the MTD device. This was an issue
1488  * reported by real users.
1489  */
print_rsvd_warning(struct ubi_device * ubi,struct ubi_attach_info * ai)1490 static void print_rsvd_warning(struct ubi_device *ubi,
1491 			       struct ubi_attach_info *ai)
1492 {
1493 	/*
1494 	 * The 1 << 18 (256KiB) number is picked randomly, just a reasonably
1495 	 * large number to distinguish between newly flashed and used images.
1496 	 */
1497 	if (ai->max_sqnum > (1 << 18)) {
1498 		int min = ubi->beb_rsvd_level / 10;
1499 
1500 		if (!min)
1501 			min = 1;
1502 		if (ubi->beb_rsvd_pebs > min)
1503 			return;
1504 	}
1505 
1506 	ubi_warn(ubi, "cannot reserve enough PEBs for bad PEB handling, reserved %d, need %d",
1507 		 ubi->beb_rsvd_pebs, ubi->beb_rsvd_level);
1508 	if (ubi->corr_peb_count)
1509 		ubi_warn(ubi, "%d PEBs are corrupted and not used",
1510 			 ubi->corr_peb_count);
1511 }
1512 
1513 /**
1514  * self_check_eba - run a self check on the EBA table constructed by fastmap.
1515  * @ubi: UBI device description object
1516  * @ai_fastmap: UBI attach info object created by fastmap
1517  * @ai_scan: UBI attach info object created by scanning
1518  *
1519  * Returns < 0 in case of an internal error, 0 otherwise.
1520  * If a bad EBA table entry was found it will be printed out and
1521  * ubi_assert() triggers.
1522  */
self_check_eba(struct ubi_device * ubi,struct ubi_attach_info * ai_fastmap,struct ubi_attach_info * ai_scan)1523 int self_check_eba(struct ubi_device *ubi, struct ubi_attach_info *ai_fastmap,
1524 		   struct ubi_attach_info *ai_scan)
1525 {
1526 	int i, j, num_volumes, ret = 0;
1527 	int **scan_eba, **fm_eba;
1528 	struct ubi_ainf_volume *av;
1529 	struct ubi_volume *vol;
1530 	struct ubi_ainf_peb *aeb;
1531 	struct rb_node *rb;
1532 
1533 	num_volumes = ubi->vtbl_slots + UBI_INT_VOL_COUNT;
1534 
1535 	scan_eba = kmalloc_array(num_volumes, sizeof(*scan_eba), GFP_KERNEL);
1536 	if (!scan_eba)
1537 		return -ENOMEM;
1538 
1539 	fm_eba = kmalloc_array(num_volumes, sizeof(*fm_eba), GFP_KERNEL);
1540 	if (!fm_eba) {
1541 		kfree(scan_eba);
1542 		return -ENOMEM;
1543 	}
1544 
1545 	for (i = 0; i < num_volumes; i++) {
1546 		vol = ubi->volumes[i];
1547 		if (!vol)
1548 			continue;
1549 
1550 		scan_eba[i] = kmalloc_array(vol->reserved_pebs,
1551 					    sizeof(**scan_eba),
1552 					    GFP_KERNEL);
1553 		if (!scan_eba[i]) {
1554 			ret = -ENOMEM;
1555 			goto out_free;
1556 		}
1557 
1558 		fm_eba[i] = kmalloc_array(vol->reserved_pebs,
1559 					  sizeof(**fm_eba),
1560 					  GFP_KERNEL);
1561 		if (!fm_eba[i]) {
1562 			ret = -ENOMEM;
1563 			goto out_free;
1564 		}
1565 
1566 		for (j = 0; j < vol->reserved_pebs; j++)
1567 			scan_eba[i][j] = fm_eba[i][j] = UBI_LEB_UNMAPPED;
1568 
1569 		av = ubi_find_av(ai_scan, idx2vol_id(ubi, i));
1570 		if (!av)
1571 			continue;
1572 
1573 		ubi_rb_for_each_entry(rb, aeb, &av->root, u.rb)
1574 			scan_eba[i][aeb->lnum] = aeb->pnum;
1575 
1576 		av = ubi_find_av(ai_fastmap, idx2vol_id(ubi, i));
1577 		if (!av)
1578 			continue;
1579 
1580 		ubi_rb_for_each_entry(rb, aeb, &av->root, u.rb)
1581 			fm_eba[i][aeb->lnum] = aeb->pnum;
1582 
1583 		for (j = 0; j < vol->reserved_pebs; j++) {
1584 			if (scan_eba[i][j] != fm_eba[i][j]) {
1585 				if (scan_eba[i][j] == UBI_LEB_UNMAPPED ||
1586 					fm_eba[i][j] == UBI_LEB_UNMAPPED)
1587 					continue;
1588 
1589 				ubi_err(ubi, "LEB:%i:%i is PEB:%i instead of %i!",
1590 					vol->vol_id, j, fm_eba[i][j],
1591 					scan_eba[i][j]);
1592 				ubi_assert(0);
1593 			}
1594 		}
1595 	}
1596 
1597 out_free:
1598 	for (i = 0; i < num_volumes; i++) {
1599 		if (!ubi->volumes[i])
1600 			continue;
1601 
1602 		kfree(scan_eba[i]);
1603 		kfree(fm_eba[i]);
1604 	}
1605 
1606 	kfree(scan_eba);
1607 	kfree(fm_eba);
1608 	return ret;
1609 }
1610 
1611 /**
1612  * ubi_eba_init - initialize the EBA sub-system using attaching information.
1613  * @ubi: UBI device description object
1614  * @ai: attaching information
1615  *
1616  * This function returns zero in case of success and a negative error code in
1617  * case of failure.
1618  */
ubi_eba_init(struct ubi_device * ubi,struct ubi_attach_info * ai)1619 int ubi_eba_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
1620 {
1621 	int i, err, num_volumes;
1622 	struct ubi_ainf_volume *av;
1623 	struct ubi_volume *vol;
1624 	struct ubi_ainf_peb *aeb;
1625 	struct rb_node *rb;
1626 
1627 	dbg_eba("initialize EBA sub-system");
1628 
1629 	spin_lock_init(&ubi->ltree_lock);
1630 	mutex_init(&ubi->alc_mutex);
1631 	ubi->ltree = RB_ROOT;
1632 
1633 	ubi->global_sqnum = ai->max_sqnum + 1;
1634 	num_volumes = ubi->vtbl_slots + UBI_INT_VOL_COUNT;
1635 
1636 	for (i = 0; i < num_volumes; i++) {
1637 		struct ubi_eba_table *tbl;
1638 
1639 		vol = ubi->volumes[i];
1640 		if (!vol)
1641 			continue;
1642 
1643 		cond_resched();
1644 
1645 		tbl = ubi_eba_create_table(vol, vol->reserved_pebs);
1646 		if (IS_ERR(tbl)) {
1647 			err = PTR_ERR(tbl);
1648 			goto out_free;
1649 		}
1650 
1651 		ubi_eba_replace_table(vol, tbl);
1652 
1653 		av = ubi_find_av(ai, idx2vol_id(ubi, i));
1654 		if (!av)
1655 			continue;
1656 
1657 		ubi_rb_for_each_entry(rb, aeb, &av->root, u.rb) {
1658 			if (aeb->lnum >= vol->reserved_pebs) {
1659 				/*
1660 				 * This may happen in case of an unclean reboot
1661 				 * during re-size.
1662 				 */
1663 				ubi_move_aeb_to_list(av, aeb, &ai->erase);
1664 			} else {
1665 				struct ubi_eba_entry *entry;
1666 
1667 				entry = &vol->eba_tbl->entries[aeb->lnum];
1668 				entry->pnum = aeb->pnum;
1669 			}
1670 		}
1671 	}
1672 
1673 	if (ubi->avail_pebs < EBA_RESERVED_PEBS) {
1674 		ubi_err(ubi, "no enough physical eraseblocks (%d, need %d)",
1675 			ubi->avail_pebs, EBA_RESERVED_PEBS);
1676 		if (ubi->corr_peb_count)
1677 			ubi_err(ubi, "%d PEBs are corrupted and not used",
1678 				ubi->corr_peb_count);
1679 		err = -ENOSPC;
1680 		goto out_free;
1681 	}
1682 	ubi->avail_pebs -= EBA_RESERVED_PEBS;
1683 	ubi->rsvd_pebs += EBA_RESERVED_PEBS;
1684 
1685 	if (ubi->bad_allowed) {
1686 		ubi_calculate_reserved(ubi);
1687 
1688 		if (ubi->avail_pebs < ubi->beb_rsvd_level) {
1689 			/* No enough free physical eraseblocks */
1690 			ubi->beb_rsvd_pebs = ubi->avail_pebs;
1691 			print_rsvd_warning(ubi, ai);
1692 		} else
1693 			ubi->beb_rsvd_pebs = ubi->beb_rsvd_level;
1694 
1695 		ubi->avail_pebs -= ubi->beb_rsvd_pebs;
1696 		ubi->rsvd_pebs  += ubi->beb_rsvd_pebs;
1697 	}
1698 
1699 	dbg_eba("EBA sub-system is initialized");
1700 	return 0;
1701 
1702 out_free:
1703 	for (i = 0; i < num_volumes; i++) {
1704 		if (!ubi->volumes[i])
1705 			continue;
1706 		ubi_eba_replace_table(ubi->volumes[i], NULL);
1707 	}
1708 	return err;
1709 }
1710