1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * linux/fs/jbd2/recovery.c
4 *
5 * Written by Stephen C. Tweedie <sct@redhat.com>, 1999
6 *
7 * Copyright 1999-2000 Red Hat Software --- All Rights Reserved
8 *
9 * Journal recovery routines for the generic filesystem journaling code;
10 * part of the ext2fs journaling system.
11 */
12
13 #ifndef __KERNEL__
14 #include "jfs_user.h"
15 #else
16 #include <linux/time.h>
17 #include <linux/fs.h>
18 #include <linux/jbd2.h>
19 #include <linux/errno.h>
20 #include <linux/crc32.h>
21 #include <linux/blkdev.h>
22 #include <linux/string_choices.h>
23 #endif
24
25 /*
26 * Maintain information about the progress of the recovery job, so that
27 * the different passes can carry information between them.
28 */
29 struct recovery_info
30 {
31 tid_t start_transaction;
32 tid_t end_transaction;
33 unsigned long head_block;
34
35 int nr_replays;
36 int nr_revokes;
37 int nr_revoke_hits;
38 };
39
40 static int do_one_pass(journal_t *journal,
41 struct recovery_info *info, enum passtype pass);
42 static int scan_revoke_records(journal_t *, struct buffer_head *,
43 tid_t, struct recovery_info *);
44
45 #ifdef __KERNEL__
46
47 /* Release readahead buffers after use */
journal_brelse_array(struct buffer_head * b[],int n)48 static void journal_brelse_array(struct buffer_head *b[], int n)
49 {
50 while (--n >= 0)
51 brelse (b[n]);
52 }
53
54
55 /*
56 * When reading from the journal, we are going through the block device
57 * layer directly and so there is no readahead being done for us. We
58 * need to implement any readahead ourselves if we want it to happen at
59 * all. Recovery is basically one long sequential read, so make sure we
60 * do the IO in reasonably large chunks.
61 *
62 * This is not so critical that we need to be enormously clever about
63 * the readahead size, though. 128K is a purely arbitrary, good-enough
64 * fixed value.
65 */
66
67 #define MAXBUF 8
do_readahead(journal_t * journal,unsigned int start)68 static int do_readahead(journal_t *journal, unsigned int start)
69 {
70 int err;
71 unsigned int max, nbufs, next;
72 unsigned long long blocknr;
73 struct buffer_head *bh;
74
75 struct buffer_head * bufs[MAXBUF];
76
77 /* Do up to 128K of readahead */
78 max = start + (128 * 1024 / journal->j_blocksize);
79 if (max > journal->j_total_len)
80 max = journal->j_total_len;
81
82 /* Do the readahead itself. We'll submit MAXBUF buffer_heads at
83 * a time to the block device IO layer. */
84
85 nbufs = 0;
86
87 for (next = start; next < max; next++) {
88 err = jbd2_journal_bmap(journal, next, &blocknr);
89
90 if (err) {
91 printk(KERN_ERR "JBD2: bad block at offset %u\n",
92 next);
93 goto failed;
94 }
95
96 bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
97 if (!bh) {
98 err = -ENOMEM;
99 goto failed;
100 }
101
102 if (!buffer_uptodate(bh) && !buffer_locked(bh)) {
103 bufs[nbufs++] = bh;
104 if (nbufs == MAXBUF) {
105 bh_readahead_batch(nbufs, bufs, 0);
106 journal_brelse_array(bufs, nbufs);
107 nbufs = 0;
108 }
109 } else
110 brelse(bh);
111 }
112
113 if (nbufs)
114 bh_readahead_batch(nbufs, bufs, 0);
115 err = 0;
116
117 failed:
118 if (nbufs)
119 journal_brelse_array(bufs, nbufs);
120 return err;
121 }
122
123 #endif /* __KERNEL__ */
124
125
126 /*
127 * Read a block from the journal
128 */
129
jread(struct buffer_head ** bhp,journal_t * journal,unsigned int offset)130 static int jread(struct buffer_head **bhp, journal_t *journal,
131 unsigned int offset)
132 {
133 int err;
134 unsigned long long blocknr;
135 struct buffer_head *bh;
136
137 *bhp = NULL;
138
139 if (offset >= journal->j_total_len) {
140 printk(KERN_ERR "JBD2: corrupted journal superblock\n");
141 return -EFSCORRUPTED;
142 }
143
144 err = jbd2_journal_bmap(journal, offset, &blocknr);
145
146 if (err) {
147 printk(KERN_ERR "JBD2: bad block at offset %u\n",
148 offset);
149 return err;
150 }
151
152 bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
153 if (!bh)
154 return -ENOMEM;
155
156 if (!buffer_uptodate(bh)) {
157 /*
158 * If this is a brand new buffer, start readahead.
159 * Otherwise, we assume we are already reading it.
160 */
161 bool need_readahead = !buffer_req(bh);
162
163 bh_read_nowait(bh, 0);
164 if (need_readahead)
165 do_readahead(journal, offset);
166 wait_on_buffer(bh);
167 }
168
169 if (!buffer_uptodate(bh)) {
170 printk(KERN_ERR "JBD2: Failed to read block at offset %u\n",
171 offset);
172 brelse(bh);
173 return -EIO;
174 }
175
176 *bhp = bh;
177 return 0;
178 }
179
jbd2_descriptor_block_csum_verify(journal_t * j,void * buf)180 static int jbd2_descriptor_block_csum_verify(journal_t *j, void *buf)
181 {
182 struct jbd2_journal_block_tail *tail;
183 __be32 provided;
184 __u32 calculated;
185
186 if (!jbd2_journal_has_csum_v2or3(j))
187 return 1;
188
189 tail = (struct jbd2_journal_block_tail *)((char *)buf +
190 j->j_blocksize - sizeof(struct jbd2_journal_block_tail));
191 provided = tail->t_checksum;
192 tail->t_checksum = 0;
193 calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
194 tail->t_checksum = provided;
195
196 return provided == cpu_to_be32(calculated);
197 }
198
199 /*
200 * Count the number of in-use tags in a journal descriptor block.
201 */
202
count_tags(journal_t * journal,struct buffer_head * bh)203 static int count_tags(journal_t *journal, struct buffer_head *bh)
204 {
205 char * tagp;
206 journal_block_tag_t tag;
207 int nr = 0, size = journal->j_blocksize;
208 int tag_bytes = journal_tag_bytes(journal);
209
210 if (jbd2_journal_has_csum_v2or3(journal))
211 size -= sizeof(struct jbd2_journal_block_tail);
212
213 tagp = &bh->b_data[sizeof(journal_header_t)];
214
215 while ((tagp - bh->b_data + tag_bytes) <= size) {
216 memcpy(&tag, tagp, sizeof(tag));
217
218 nr++;
219 tagp += tag_bytes;
220 if (!(tag.t_flags & cpu_to_be16(JBD2_FLAG_SAME_UUID)))
221 tagp += 16;
222
223 if (tag.t_flags & cpu_to_be16(JBD2_FLAG_LAST_TAG))
224 break;
225 }
226
227 return nr;
228 }
229
230
231 /* Make sure we wrap around the log correctly! */
232 #define wrap(journal, var) \
233 do { \
234 if (var >= (journal)->j_last) \
235 var -= ((journal)->j_last - (journal)->j_first); \
236 } while (0)
237
fc_do_one_pass(journal_t * journal,struct recovery_info * info,enum passtype pass)238 static int fc_do_one_pass(journal_t *journal,
239 struct recovery_info *info, enum passtype pass)
240 {
241 unsigned int expected_commit_id = info->end_transaction;
242 unsigned long next_fc_block;
243 struct buffer_head *bh;
244 int err = 0;
245
246 next_fc_block = journal->j_fc_first;
247 if (!journal->j_fc_replay_callback)
248 return 0;
249
250 while (next_fc_block <= journal->j_fc_last) {
251 jbd2_debug(3, "Fast commit replay: next block %ld\n",
252 next_fc_block);
253 err = jread(&bh, journal, next_fc_block);
254 if (err) {
255 jbd2_debug(3, "Fast commit replay: read error\n");
256 break;
257 }
258
259 err = journal->j_fc_replay_callback(journal, bh, pass,
260 next_fc_block - journal->j_fc_first,
261 expected_commit_id);
262 brelse(bh);
263 next_fc_block++;
264 if (err < 0 || err == JBD2_FC_REPLAY_STOP)
265 break;
266 err = 0;
267 }
268
269 if (err)
270 jbd2_debug(3, "Fast commit replay failed, err = %d\n", err);
271
272 return err;
273 }
274
275 /**
276 * jbd2_journal_recover - recovers a on-disk journal
277 * @journal: the journal to recover
278 *
279 * The primary function for recovering the log contents when mounting a
280 * journaled device.
281 *
282 * Recovery is done in three passes. In the first pass, we look for the
283 * end of the log. In the second, we assemble the list of revoke
284 * blocks. In the third and final pass, we replay any un-revoked blocks
285 * in the log.
286 */
jbd2_journal_recover(journal_t * journal)287 int jbd2_journal_recover(journal_t *journal)
288 {
289 int err, err2;
290 struct recovery_info info;
291
292 memset(&info, 0, sizeof(info));
293
294 /*
295 * The journal superblock's s_start field (the current log head)
296 * is always zero if, and only if, the journal was cleanly
297 * unmounted. We use its in-memory version j_tail here because
298 * jbd2_journal_wipe() could have updated it without updating journal
299 * superblock.
300 */
301 if (!journal->j_tail) {
302 journal_superblock_t *sb = journal->j_superblock;
303
304 jbd2_debug(1, "No recovery required, last transaction %d, head block %u\n",
305 be32_to_cpu(sb->s_sequence), be32_to_cpu(sb->s_head));
306 journal->j_transaction_sequence = be32_to_cpu(sb->s_sequence) + 1;
307 journal->j_head = be32_to_cpu(sb->s_head);
308 return 0;
309 }
310
311 err = do_one_pass(journal, &info, PASS_SCAN);
312 if (!err)
313 err = do_one_pass(journal, &info, PASS_REVOKE);
314 if (!err)
315 err = do_one_pass(journal, &info, PASS_REPLAY);
316
317 jbd2_debug(1, "JBD2: recovery, exit status %d, "
318 "recovered transactions %u to %u\n",
319 err, info.start_transaction, info.end_transaction);
320 jbd2_debug(1, "JBD2: Replayed %d and revoked %d/%d blocks\n",
321 info.nr_replays, info.nr_revoke_hits, info.nr_revokes);
322
323 /* Restart the log at the next transaction ID, thus invalidating
324 * any existing commit records in the log. */
325 journal->j_transaction_sequence = ++info.end_transaction;
326 journal->j_head = info.head_block;
327 jbd2_debug(1, "JBD2: last transaction %d, head block %lu\n",
328 journal->j_transaction_sequence, journal->j_head);
329
330 jbd2_journal_clear_revoke(journal);
331 err2 = sync_blockdev(journal->j_fs_dev);
332 if (!err)
333 err = err2;
334 err2 = jbd2_check_fs_dev_write_error(journal);
335 if (!err)
336 err = err2;
337 /* Make sure all replayed data is on permanent storage */
338 if (journal->j_flags & JBD2_BARRIER) {
339 err2 = blkdev_issue_flush(journal->j_fs_dev);
340 if (!err)
341 err = err2;
342 }
343 return err;
344 }
345
346 /**
347 * jbd2_journal_skip_recovery - Start journal and wipe exiting records
348 * @journal: journal to startup
349 *
350 * Locate any valid recovery information from the journal and set up the
351 * journal structures in memory to ignore it (presumably because the
352 * caller has evidence that it is out of date).
353 * This function doesn't appear to be exported..
354 *
355 * We perform one pass over the journal to allow us to tell the user how
356 * much recovery information is being erased, and to let us initialise
357 * the journal transaction sequence numbers to the next unused ID.
358 */
jbd2_journal_skip_recovery(journal_t * journal)359 int jbd2_journal_skip_recovery(journal_t *journal)
360 {
361 int err;
362
363 struct recovery_info info;
364
365 memset (&info, 0, sizeof(info));
366
367 err = do_one_pass(journal, &info, PASS_SCAN);
368
369 if (err) {
370 printk(KERN_ERR "JBD2: error %d scanning journal\n", err);
371 ++journal->j_transaction_sequence;
372 journal->j_head = journal->j_first;
373 } else {
374 #ifdef CONFIG_JBD2_DEBUG
375 int dropped = info.end_transaction -
376 be32_to_cpu(journal->j_superblock->s_sequence);
377 jbd2_debug(1,
378 "JBD2: ignoring %d transaction%s from the journal.\n",
379 dropped, str_plural(dropped));
380 #endif
381 journal->j_transaction_sequence = ++info.end_transaction;
382 journal->j_head = info.head_block;
383 }
384
385 journal->j_tail = 0;
386 return err;
387 }
388
read_tag_block(journal_t * journal,journal_block_tag_t * tag)389 static inline unsigned long long read_tag_block(journal_t *journal,
390 journal_block_tag_t *tag)
391 {
392 unsigned long long block = be32_to_cpu(tag->t_blocknr);
393 if (jbd2_has_feature_64bit(journal))
394 block |= (u64)be32_to_cpu(tag->t_blocknr_high) << 32;
395 return block;
396 }
397
398 /*
399 * calc_chksums calculates the checksums for the blocks described in the
400 * descriptor block.
401 */
calc_chksums(journal_t * journal,struct buffer_head * bh,unsigned long * next_log_block,__u32 * crc32_sum)402 static int calc_chksums(journal_t *journal, struct buffer_head *bh,
403 unsigned long *next_log_block, __u32 *crc32_sum)
404 {
405 int i, num_blks, err;
406 unsigned long io_block;
407 struct buffer_head *obh;
408
409 num_blks = count_tags(journal, bh);
410 /* Calculate checksum of the descriptor block. */
411 *crc32_sum = crc32_be(*crc32_sum, (void *)bh->b_data, bh->b_size);
412
413 for (i = 0; i < num_blks; i++) {
414 io_block = (*next_log_block)++;
415 wrap(journal, *next_log_block);
416 err = jread(&obh, journal, io_block);
417 if (err) {
418 printk(KERN_ERR "JBD2: IO error %d recovering block "
419 "%lu in log\n", err, io_block);
420 return 1;
421 } else {
422 *crc32_sum = crc32_be(*crc32_sum, (void *)obh->b_data,
423 obh->b_size);
424 }
425 put_bh(obh);
426 }
427 return 0;
428 }
429
jbd2_commit_block_csum_verify(journal_t * j,void * buf)430 static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
431 {
432 struct commit_header *h;
433 __be32 provided;
434 __u32 calculated;
435
436 if (!jbd2_journal_has_csum_v2or3(j))
437 return 1;
438
439 h = buf;
440 provided = h->h_chksum[0];
441 h->h_chksum[0] = 0;
442 calculated = jbd2_chksum(j, j->j_csum_seed, buf, j->j_blocksize);
443 h->h_chksum[0] = provided;
444
445 return provided == cpu_to_be32(calculated);
446 }
447
jbd2_commit_block_csum_verify_partial(journal_t * j,void * buf)448 static bool jbd2_commit_block_csum_verify_partial(journal_t *j, void *buf)
449 {
450 struct commit_header *h;
451 __be32 provided;
452 __u32 calculated;
453 void *tmpbuf;
454
455 tmpbuf = kzalloc(j->j_blocksize, GFP_KERNEL);
456 if (!tmpbuf)
457 return false;
458
459 memcpy(tmpbuf, buf, sizeof(struct commit_header));
460 h = tmpbuf;
461 provided = h->h_chksum[0];
462 h->h_chksum[0] = 0;
463 calculated = jbd2_chksum(j, j->j_csum_seed, tmpbuf, j->j_blocksize);
464 kfree(tmpbuf);
465
466 return provided == cpu_to_be32(calculated);
467 }
468
jbd2_block_tag_csum_verify(journal_t * j,journal_block_tag_t * tag,journal_block_tag3_t * tag3,void * buf,__u32 sequence)469 static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
470 journal_block_tag3_t *tag3,
471 void *buf, __u32 sequence)
472 {
473 __u32 csum32;
474 __be32 seq;
475
476 if (!jbd2_journal_has_csum_v2or3(j))
477 return 1;
478
479 seq = cpu_to_be32(sequence);
480 csum32 = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&seq, sizeof(seq));
481 csum32 = jbd2_chksum(j, csum32, buf, j->j_blocksize);
482
483 if (jbd2_has_feature_csum3(j))
484 return tag3->t_checksum == cpu_to_be32(csum32);
485 else
486 return tag->t_checksum == cpu_to_be16(csum32);
487 }
488
do_one_pass(journal_t * journal,struct recovery_info * info,enum passtype pass)489 static int do_one_pass(journal_t *journal,
490 struct recovery_info *info, enum passtype pass)
491 {
492 unsigned int first_commit_ID, next_commit_ID;
493 unsigned long next_log_block, head_block;
494 int err, success = 0;
495 journal_superblock_t * sb;
496 journal_header_t * tmp;
497 struct buffer_head * bh;
498 unsigned int sequence;
499 int blocktype;
500 int tag_bytes = journal_tag_bytes(journal);
501 __u32 crc32_sum = ~0; /* Transactional Checksums */
502 int descr_csum_size = 0;
503 int block_error = 0;
504 bool need_check_commit_time = false;
505 __u64 last_trans_commit_time = 0, commit_time;
506
507 /*
508 * First thing is to establish what we expect to find in the log
509 * (in terms of transaction IDs), and where (in terms of log
510 * block offsets): query the superblock.
511 */
512
513 sb = journal->j_superblock;
514 next_commit_ID = be32_to_cpu(sb->s_sequence);
515 next_log_block = be32_to_cpu(sb->s_start);
516 head_block = next_log_block;
517
518 first_commit_ID = next_commit_ID;
519 if (pass == PASS_SCAN)
520 info->start_transaction = first_commit_ID;
521
522 jbd2_debug(1, "Starting recovery pass %d\n", pass);
523
524 /*
525 * Now we walk through the log, transaction by transaction,
526 * making sure that each transaction has a commit block in the
527 * expected place. Each complete transaction gets replayed back
528 * into the main filesystem.
529 */
530
531 while (1) {
532 int flags;
533 char * tagp;
534 journal_block_tag_t tag;
535 struct buffer_head * obh;
536 struct buffer_head * nbh;
537
538 cond_resched();
539
540 /* If we already know where to stop the log traversal,
541 * check right now that we haven't gone past the end of
542 * the log. */
543
544 if (pass != PASS_SCAN)
545 if (tid_geq(next_commit_ID, info->end_transaction))
546 break;
547
548 jbd2_debug(2, "Scanning for sequence ID %u at %lu/%lu\n",
549 next_commit_ID, next_log_block, journal->j_last);
550
551 /* Skip over each chunk of the transaction looking
552 * either the next descriptor block or the final commit
553 * record. */
554
555 jbd2_debug(3, "JBD2: checking block %ld\n", next_log_block);
556 err = jread(&bh, journal, next_log_block);
557 if (err)
558 goto failed;
559
560 next_log_block++;
561 wrap(journal, next_log_block);
562
563 /* What kind of buffer is it?
564 *
565 * If it is a descriptor block, check that it has the
566 * expected sequence number. Otherwise, we're all done
567 * here. */
568
569 tmp = (journal_header_t *)bh->b_data;
570
571 if (tmp->h_magic != cpu_to_be32(JBD2_MAGIC_NUMBER)) {
572 brelse(bh);
573 break;
574 }
575
576 blocktype = be32_to_cpu(tmp->h_blocktype);
577 sequence = be32_to_cpu(tmp->h_sequence);
578 jbd2_debug(3, "Found magic %d, sequence %d\n",
579 blocktype, sequence);
580
581 if (sequence != next_commit_ID) {
582 brelse(bh);
583 break;
584 }
585
586 /* OK, we have a valid descriptor block which matches
587 * all of the sequence number checks. What are we going
588 * to do with it? That depends on the pass... */
589
590 switch(blocktype) {
591 case JBD2_DESCRIPTOR_BLOCK:
592 /* Verify checksum first */
593 if (jbd2_journal_has_csum_v2or3(journal))
594 descr_csum_size =
595 sizeof(struct jbd2_journal_block_tail);
596 if (descr_csum_size > 0 &&
597 !jbd2_descriptor_block_csum_verify(journal,
598 bh->b_data)) {
599 /*
600 * PASS_SCAN can see stale blocks due to lazy
601 * journal init. Don't error out on those yet.
602 */
603 if (pass != PASS_SCAN) {
604 pr_err("JBD2: Invalid checksum recovering block %lu in log\n",
605 next_log_block);
606 err = -EFSBADCRC;
607 brelse(bh);
608 goto failed;
609 }
610 need_check_commit_time = true;
611 jbd2_debug(1,
612 "invalid descriptor block found in %lu\n",
613 next_log_block);
614 }
615
616 /* If it is a valid descriptor block, replay it
617 * in pass REPLAY; if journal_checksums enabled, then
618 * calculate checksums in PASS_SCAN, otherwise,
619 * just skip over the blocks it describes. */
620 if (pass != PASS_REPLAY) {
621 if (pass == PASS_SCAN &&
622 jbd2_has_feature_checksum(journal) &&
623 !need_check_commit_time &&
624 !info->end_transaction) {
625 if (calc_chksums(journal, bh,
626 &next_log_block,
627 &crc32_sum)) {
628 put_bh(bh);
629 break;
630 }
631 put_bh(bh);
632 continue;
633 }
634 next_log_block += count_tags(journal, bh);
635 wrap(journal, next_log_block);
636 put_bh(bh);
637 continue;
638 }
639
640 /* A descriptor block: we can now write all of
641 * the data blocks. Yay, useful work is finally
642 * getting done here! */
643
644 tagp = &bh->b_data[sizeof(journal_header_t)];
645 while ((tagp - bh->b_data + tag_bytes)
646 <= journal->j_blocksize - descr_csum_size) {
647 unsigned long io_block;
648
649 memcpy(&tag, tagp, sizeof(tag));
650 flags = be16_to_cpu(tag.t_flags);
651
652 io_block = next_log_block++;
653 wrap(journal, next_log_block);
654 err = jread(&obh, journal, io_block);
655 if (err) {
656 /* Recover what we can, but
657 * report failure at the end. */
658 success = err;
659 printk(KERN_ERR
660 "JBD2: IO error %d recovering "
661 "block %lu in log\n",
662 err, io_block);
663 } else {
664 unsigned long long blocknr;
665
666 J_ASSERT(obh != NULL);
667 blocknr = read_tag_block(journal,
668 &tag);
669
670 /* If the block has been
671 * revoked, then we're all done
672 * here. */
673 if (jbd2_journal_test_revoke
674 (journal, blocknr,
675 next_commit_ID)) {
676 brelse(obh);
677 ++info->nr_revoke_hits;
678 goto skip_write;
679 }
680
681 /* Look for block corruption */
682 if (!jbd2_block_tag_csum_verify(
683 journal, &tag, (journal_block_tag3_t *)tagp,
684 obh->b_data, be32_to_cpu(tmp->h_sequence))) {
685 brelse(obh);
686 success = -EFSBADCRC;
687 printk(KERN_ERR "JBD2: Invalid "
688 "checksum recovering "
689 "data block %llu in "
690 "journal block %lu\n",
691 blocknr, io_block);
692 block_error = 1;
693 goto skip_write;
694 }
695
696 /* Find a buffer for the new
697 * data being restored */
698 nbh = __getblk(journal->j_fs_dev,
699 blocknr,
700 journal->j_blocksize);
701 if (nbh == NULL) {
702 printk(KERN_ERR
703 "JBD2: Out of memory "
704 "during recovery.\n");
705 err = -ENOMEM;
706 brelse(bh);
707 brelse(obh);
708 goto failed;
709 }
710
711 lock_buffer(nbh);
712 memcpy(nbh->b_data, obh->b_data,
713 journal->j_blocksize);
714 if (flags & JBD2_FLAG_ESCAPE) {
715 *((__be32 *)nbh->b_data) =
716 cpu_to_be32(JBD2_MAGIC_NUMBER);
717 }
718
719 BUFFER_TRACE(nbh, "marking dirty");
720 set_buffer_uptodate(nbh);
721 mark_buffer_dirty(nbh);
722 BUFFER_TRACE(nbh, "marking uptodate");
723 ++info->nr_replays;
724 unlock_buffer(nbh);
725 brelse(obh);
726 brelse(nbh);
727 }
728
729 skip_write:
730 tagp += tag_bytes;
731 if (!(flags & JBD2_FLAG_SAME_UUID))
732 tagp += 16;
733
734 if (flags & JBD2_FLAG_LAST_TAG)
735 break;
736 }
737
738 brelse(bh);
739 continue;
740
741 case JBD2_COMMIT_BLOCK:
742 /* How to differentiate between interrupted commit
743 * and journal corruption ?
744 *
745 * {nth transaction}
746 * Checksum Verification Failed
747 * |
748 * ____________________
749 * | |
750 * async_commit sync_commit
751 * | |
752 * | GO TO NEXT "Journal Corruption"
753 * | TRANSACTION
754 * |
755 * {(n+1)th transanction}
756 * |
757 * _______|______________
758 * | |
759 * Commit block found Commit block not found
760 * | |
761 * "Journal Corruption" |
762 * _____________|_________
763 * | |
764 * nth trans corrupt OR nth trans
765 * and (n+1)th interrupted interrupted
766 * before commit block
767 * could reach the disk.
768 * (Cannot find the difference in above
769 * mentioned conditions. Hence assume
770 * "Interrupted Commit".)
771 */
772 commit_time = be64_to_cpu(
773 ((struct commit_header *)bh->b_data)->h_commit_sec);
774 /*
775 * If need_check_commit_time is set, it means we are in
776 * PASS_SCAN and csum verify failed before. If
777 * commit_time is increasing, it's the same journal,
778 * otherwise it is stale journal block, just end this
779 * recovery.
780 */
781 if (need_check_commit_time) {
782 if (commit_time >= last_trans_commit_time) {
783 pr_err("JBD2: Invalid checksum found in transaction %u\n",
784 next_commit_ID);
785 err = -EFSBADCRC;
786 brelse(bh);
787 goto failed;
788 }
789 ignore_crc_mismatch:
790 /*
791 * It likely does not belong to same journal,
792 * just end this recovery with success.
793 */
794 jbd2_debug(1, "JBD2: Invalid checksum ignored in transaction %u, likely stale data\n",
795 next_commit_ID);
796 brelse(bh);
797 goto done;
798 }
799
800 /*
801 * Found an expected commit block: if checksums
802 * are present, verify them in PASS_SCAN; else not
803 * much to do other than move on to the next sequence
804 * number.
805 */
806 if (pass == PASS_SCAN &&
807 jbd2_has_feature_checksum(journal)) {
808 struct commit_header *cbh =
809 (struct commit_header *)bh->b_data;
810 unsigned found_chksum =
811 be32_to_cpu(cbh->h_chksum[0]);
812
813 if (info->end_transaction) {
814 journal->j_failed_commit =
815 info->end_transaction;
816 brelse(bh);
817 break;
818 }
819
820 /* Neither checksum match nor unused? */
821 if (!((crc32_sum == found_chksum &&
822 cbh->h_chksum_type ==
823 JBD2_CRC32_CHKSUM &&
824 cbh->h_chksum_size ==
825 JBD2_CRC32_CHKSUM_SIZE) ||
826 (cbh->h_chksum_type == 0 &&
827 cbh->h_chksum_size == 0 &&
828 found_chksum == 0)))
829 goto chksum_error;
830
831 crc32_sum = ~0;
832 }
833 if (pass == PASS_SCAN &&
834 !jbd2_commit_block_csum_verify(journal,
835 bh->b_data)) {
836 if (jbd2_commit_block_csum_verify_partial(
837 journal,
838 bh->b_data)) {
839 pr_notice("JBD2: Find incomplete commit block in transaction %u block %lu\n",
840 next_commit_ID, next_log_block);
841 goto chksum_ok;
842 }
843 chksum_error:
844 if (commit_time < last_trans_commit_time)
845 goto ignore_crc_mismatch;
846 info->end_transaction = next_commit_ID;
847 info->head_block = head_block;
848
849 if (!jbd2_has_feature_async_commit(journal)) {
850 journal->j_failed_commit =
851 next_commit_ID;
852 brelse(bh);
853 break;
854 }
855 }
856 if (pass == PASS_SCAN) {
857 chksum_ok:
858 last_trans_commit_time = commit_time;
859 head_block = next_log_block;
860 }
861 brelse(bh);
862 next_commit_ID++;
863 continue;
864
865 case JBD2_REVOKE_BLOCK:
866 /*
867 * Check revoke block crc in pass_scan, if csum verify
868 * failed, check commit block time later.
869 */
870 if (pass == PASS_SCAN &&
871 !jbd2_descriptor_block_csum_verify(journal,
872 bh->b_data)) {
873 jbd2_debug(1, "JBD2: invalid revoke block found in %lu\n",
874 next_log_block);
875 need_check_commit_time = true;
876 }
877
878 /* If we aren't in the REVOKE pass, then we can
879 * just skip over this block. */
880 if (pass != PASS_REVOKE) {
881 brelse(bh);
882 continue;
883 }
884
885 err = scan_revoke_records(journal, bh,
886 next_commit_ID, info);
887 brelse(bh);
888 if (err)
889 goto failed;
890 continue;
891
892 default:
893 jbd2_debug(3, "Unrecognised magic %d, end of scan.\n",
894 blocktype);
895 brelse(bh);
896 goto done;
897 }
898 }
899
900 done:
901 /*
902 * We broke out of the log scan loop: either we came to the
903 * known end of the log or we found an unexpected block in the
904 * log. If the latter happened, then we know that the "current"
905 * transaction marks the end of the valid log.
906 */
907
908 if (pass == PASS_SCAN) {
909 if (!info->end_transaction)
910 info->end_transaction = next_commit_ID;
911 if (!info->head_block)
912 info->head_block = head_block;
913 } else {
914 /* It's really bad news if different passes end up at
915 * different places (but possible due to IO errors). */
916 if (info->end_transaction != next_commit_ID) {
917 printk(KERN_ERR "JBD2: recovery pass %d ended at "
918 "transaction %u, expected %u\n",
919 pass, next_commit_ID, info->end_transaction);
920 if (!success)
921 success = -EIO;
922 }
923 }
924
925 if (jbd2_has_feature_fast_commit(journal) && pass != PASS_REVOKE) {
926 err = fc_do_one_pass(journal, info, pass);
927 if (err)
928 success = err;
929 }
930
931 if (block_error && success == 0)
932 success = -EIO;
933 return success;
934
935 failed:
936 return err;
937 }
938
939 /* Scan a revoke record, marking all blocks mentioned as revoked. */
940
scan_revoke_records(journal_t * journal,struct buffer_head * bh,tid_t sequence,struct recovery_info * info)941 static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
942 tid_t sequence, struct recovery_info *info)
943 {
944 jbd2_journal_revoke_header_t *header;
945 int offset, max;
946 unsigned csum_size = 0;
947 __u32 rcount;
948 int record_len = 4;
949
950 header = (jbd2_journal_revoke_header_t *) bh->b_data;
951 offset = sizeof(jbd2_journal_revoke_header_t);
952 rcount = be32_to_cpu(header->r_count);
953
954 if (jbd2_journal_has_csum_v2or3(journal))
955 csum_size = sizeof(struct jbd2_journal_block_tail);
956 if (rcount > journal->j_blocksize - csum_size)
957 return -EINVAL;
958 max = rcount;
959
960 if (jbd2_has_feature_64bit(journal))
961 record_len = 8;
962
963 while (offset + record_len <= max) {
964 unsigned long long blocknr;
965 int err;
966
967 if (record_len == 4)
968 blocknr = be32_to_cpu(* ((__be32 *) (bh->b_data+offset)));
969 else
970 blocknr = be64_to_cpu(* ((__be64 *) (bh->b_data+offset)));
971 offset += record_len;
972 err = jbd2_journal_set_revoke(journal, blocknr, sequence);
973 if (err)
974 return err;
975 ++info->nr_revokes;
976 }
977 return 0;
978 }
979