1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * linux/fs/jbd2/recovery.c
4 *
5 * Written by Stephen C. Tweedie <sct@redhat.com>, 1999
6 *
7 * Copyright 1999-2000 Red Hat Software --- All Rights Reserved
8 *
9 * Journal recovery routines for the generic filesystem journaling code;
10 * part of the ext2fs journaling system.
11 */
12
13#ifndef __KERNEL__
14#include "jfs_user.h"
15#else
16#include <linux/time.h>
17#include <linux/fs.h>
18#include <linux/jbd2.h>
19#include <linux/errno.h>
20#include <linux/crc32.h>
21#include <linux/blkdev.h>
22#include <linux/string_choices.h>
23#endif
24
25/*
26 * Maintain information about the progress of the recovery job, so that
27 * the different passes can carry information between them.
28 */
29struct recovery_info
30{
31 tid_t start_transaction;
32 tid_t end_transaction;
33 unsigned long head_block;
34
35 int nr_replays;
36 int nr_revokes;
37 int nr_revoke_hits;
38};
39
40static int do_one_pass(journal_t *journal,
41 struct recovery_info *info, enum passtype pass);
42static int scan_revoke_records(journal_t *, enum passtype, struct buffer_head *,
43 tid_t, struct recovery_info *);
44
45#ifdef __KERNEL__
46
47/* Release readahead buffers after use */
48static void journal_brelse_array(struct buffer_head *b[], int n)
49{
50 while (--n >= 0)
51 brelse (bh: b[n]);
52}
53
54
55/*
56 * When reading from the journal, we are going through the block device
57 * layer directly and so there is no readahead being done for us. We
58 * need to implement any readahead ourselves if we want it to happen at
59 * all. Recovery is basically one long sequential read, so make sure we
60 * do the IO in reasonably large chunks.
61 *
62 * This is not so critical that we need to be enormously clever about
63 * the readahead size, though. 128K is a purely arbitrary, good-enough
64 * fixed value.
65 */
66
67#define MAXBUF 8
68static void do_readahead(journal_t *journal, unsigned int start)
69{
70 unsigned int max, nbufs, next;
71 unsigned long long blocknr;
72 struct buffer_head *bh;
73
74 struct buffer_head * bufs[MAXBUF];
75
76 /* Do up to 128K of readahead */
77 max = start + (128 * 1024 / journal->j_blocksize);
78 if (max > journal->j_total_len)
79 max = journal->j_total_len;
80
81 /* Do the readahead itself. We'll submit MAXBUF buffer_heads at
82 * a time to the block device IO layer. */
83
84 nbufs = 0;
85
86 for (next = start; next < max; next++) {
87 int err = jbd2_journal_bmap(journal, next, &blocknr);
88
89 if (err) {
90 printk(KERN_ERR "JBD2: bad block at offset %u\n",
91 next);
92 goto failed;
93 }
94
95 bh = __getblk(bdev: journal->j_dev, block: blocknr, size: journal->j_blocksize);
96 if (!bh)
97 goto failed;
98
99 if (!buffer_uptodate(bh) && !buffer_locked(bh)) {
100 bufs[nbufs++] = bh;
101 if (nbufs == MAXBUF) {
102 bh_readahead_batch(nr: nbufs, bhs: bufs, op_flags: 0);
103 journal_brelse_array(b: bufs, n: nbufs);
104 nbufs = 0;
105 }
106 } else
107 brelse(bh);
108 }
109
110 if (nbufs)
111 bh_readahead_batch(nr: nbufs, bhs: bufs, op_flags: 0);
112
113failed:
114 if (nbufs)
115 journal_brelse_array(b: bufs, n: nbufs);
116}
117
118#endif /* __KERNEL__ */
119
120
121/*
122 * Read a block from the journal
123 */
124
125static int jread(struct buffer_head **bhp, journal_t *journal,
126 unsigned int offset)
127{
128 int err;
129 unsigned long long blocknr;
130 struct buffer_head *bh;
131
132 *bhp = NULL;
133
134 if (offset >= journal->j_total_len) {
135 printk(KERN_ERR "JBD2: corrupted journal superblock\n");
136 return -EFSCORRUPTED;
137 }
138
139 err = jbd2_journal_bmap(journal, offset, &blocknr);
140
141 if (err) {
142 printk(KERN_ERR "JBD2: bad block at offset %u\n",
143 offset);
144 return err;
145 }
146
147 bh = __getblk(bdev: journal->j_dev, block: blocknr, size: journal->j_blocksize);
148 if (!bh)
149 return -ENOMEM;
150
151 if (!buffer_uptodate(bh)) {
152 /*
153 * If this is a brand new buffer, start readahead.
154 * Otherwise, we assume we are already reading it.
155 */
156 bool need_readahead = !buffer_req(bh);
157
158 bh_read_nowait(bh, op_flags: 0);
159 if (need_readahead)
160 do_readahead(journal, start: offset);
161 wait_on_buffer(bh);
162 }
163
164 if (!buffer_uptodate(bh)) {
165 printk(KERN_ERR "JBD2: Failed to read block at offset %u\n",
166 offset);
167 brelse(bh);
168 return -EIO;
169 }
170
171 *bhp = bh;
172 return 0;
173}
174
175static int jbd2_descriptor_block_csum_verify(journal_t *j, void *buf)
176{
177 struct jbd2_journal_block_tail *tail;
178 __be32 provided;
179 __u32 calculated;
180
181 if (!jbd2_journal_has_csum_v2or3(journal: j))
182 return 1;
183
184 tail = (struct jbd2_journal_block_tail *)((char *)buf +
185 j->j_blocksize - sizeof(struct jbd2_journal_block_tail));
186 provided = tail->t_checksum;
187 tail->t_checksum = 0;
188 calculated = jbd2_chksum(crc: j->j_csum_seed, address: buf, length: j->j_blocksize);
189 tail->t_checksum = provided;
190
191 return provided == cpu_to_be32(calculated);
192}
193
194/*
195 * Count the number of in-use tags in a journal descriptor block.
196 */
197
198static int count_tags(journal_t *journal, struct buffer_head *bh)
199{
200 char * tagp;
201 journal_block_tag_t tag;
202 int nr = 0, size = journal->j_blocksize;
203 int tag_bytes = journal_tag_bytes(journal);
204
205 if (jbd2_journal_has_csum_v2or3(journal))
206 size -= sizeof(struct jbd2_journal_block_tail);
207
208 tagp = &bh->b_data[sizeof(journal_header_t)];
209
210 while ((tagp - bh->b_data + tag_bytes) <= size) {
211 memcpy(to: &tag, from: tagp, len: sizeof(tag));
212
213 nr++;
214 tagp += tag_bytes;
215 if (!(tag.t_flags & cpu_to_be16(JBD2_FLAG_SAME_UUID)))
216 tagp += 16;
217
218 if (tag.t_flags & cpu_to_be16(JBD2_FLAG_LAST_TAG))
219 break;
220 }
221
222 return nr;
223}
224
225
226/* Make sure we wrap around the log correctly! */
227#define wrap(journal, var) \
228do { \
229 if (var >= (journal)->j_last) \
230 var -= ((journal)->j_last - (journal)->j_first); \
231} while (0)
232
233static int fc_do_one_pass(journal_t *journal,
234 struct recovery_info *info, enum passtype pass)
235{
236 unsigned int expected_commit_id = info->end_transaction;
237 unsigned long next_fc_block;
238 struct buffer_head *bh;
239 int err = 0;
240
241 next_fc_block = journal->j_fc_first;
242 if (!journal->j_fc_replay_callback)
243 return 0;
244
245 while (next_fc_block <= journal->j_fc_last) {
246 jbd2_debug(3, "Fast commit replay: next block %ld\n",
247 next_fc_block);
248 err = jread(bhp: &bh, journal, offset: next_fc_block);
249 if (err) {
250 jbd2_debug(3, "Fast commit replay: read error\n");
251 break;
252 }
253
254 err = journal->j_fc_replay_callback(journal, bh, pass,
255 next_fc_block - journal->j_fc_first,
256 expected_commit_id);
257 brelse(bh);
258 next_fc_block++;
259 if (err < 0 || err == JBD2_FC_REPLAY_STOP)
260 break;
261 err = 0;
262 }
263
264 if (err)
265 jbd2_debug(3, "Fast commit replay failed, err = %d\n", err);
266
267 return err;
268}
269
270/**
271 * jbd2_journal_recover - recovers a on-disk journal
272 * @journal: the journal to recover
273 *
274 * The primary function for recovering the log contents when mounting a
275 * journaled device.
276 *
277 * Recovery is done in three passes. In the first pass, we look for the
278 * end of the log. In the second, we assemble the list of revoke
279 * blocks. In the third and final pass, we replay any un-revoked blocks
280 * in the log.
281 */
282int jbd2_journal_recover(journal_t *journal)
283{
284 int err, err2;
285 struct recovery_info info;
286
287 memset(s: &info, c: 0, n: sizeof(info));
288
289 /*
290 * The journal superblock's s_start field (the current log head)
291 * is always zero if, and only if, the journal was cleanly
292 * unmounted. We use its in-memory version j_tail here because
293 * jbd2_journal_wipe() could have updated it without updating journal
294 * superblock.
295 */
296 if (!journal->j_tail) {
297 journal_superblock_t *sb = journal->j_superblock;
298
299 jbd2_debug(1, "No recovery required, last transaction %d, head block %u\n",
300 be32_to_cpu(sb->s_sequence), be32_to_cpu(sb->s_head));
301 journal->j_transaction_sequence = be32_to_cpu(sb->s_sequence) + 1;
302 journal->j_head = be32_to_cpu(sb->s_head);
303 return 0;
304 }
305
306 err = do_one_pass(journal, info: &info, pass: PASS_SCAN);
307 if (!err)
308 err = do_one_pass(journal, info: &info, pass: PASS_REVOKE);
309 if (!err)
310 err = do_one_pass(journal, info: &info, pass: PASS_REPLAY);
311
312 jbd2_debug(1, "JBD2: recovery, exit status %d, "
313 "recovered transactions %u to %u\n",
314 err, info.start_transaction, info.end_transaction);
315 jbd2_debug(1, "JBD2: Replayed %d and revoked %d/%d blocks\n",
316 info.nr_replays, info.nr_revoke_hits, info.nr_revokes);
317
318 /* Restart the log at the next transaction ID, thus invalidating
319 * any existing commit records in the log. */
320 journal->j_transaction_sequence = ++info.end_transaction;
321 journal->j_head = info.head_block;
322 jbd2_debug(1, "JBD2: last transaction %d, head block %lu\n",
323 journal->j_transaction_sequence, journal->j_head);
324
325 jbd2_journal_clear_revoke(journal);
326 /* Free revoke table allocated for replay */
327 if (journal->j_revoke != journal->j_revoke_table[0] &&
328 journal->j_revoke != journal->j_revoke_table[1]) {
329 jbd2_journal_destroy_revoke_table(table: journal->j_revoke);
330 journal->j_revoke = journal->j_revoke_table[1];
331 }
332 err2 = sync_blockdev(bdev: journal->j_fs_dev);
333 if (!err)
334 err = err2;
335 err2 = jbd2_check_fs_dev_write_error(journal);
336 if (!err)
337 err = err2;
338 /* Make sure all replayed data is on permanent storage */
339 if (journal->j_flags & JBD2_BARRIER) {
340 err2 = blkdev_issue_flush(bdev: journal->j_fs_dev);
341 if (!err)
342 err = err2;
343 }
344 return err;
345}
346
347/**
348 * jbd2_journal_skip_recovery - Start journal and wipe exiting records
349 * @journal: journal to startup
350 *
351 * Locate any valid recovery information from the journal and set up the
352 * journal structures in memory to ignore it (presumably because the
353 * caller has evidence that it is out of date).
354 * This function doesn't appear to be exported..
355 *
356 * We perform one pass over the journal to allow us to tell the user how
357 * much recovery information is being erased, and to let us initialise
358 * the journal transaction sequence numbers to the next unused ID.
359 */
360int jbd2_journal_skip_recovery(journal_t *journal)
361{
362 int err;
363
364 struct recovery_info info;
365
366 memset (s: &info, c: 0, n: sizeof(info));
367
368 err = do_one_pass(journal, info: &info, pass: PASS_SCAN);
369
370 if (err) {
371 printk(KERN_ERR "JBD2: error %d scanning journal\n", err);
372 ++journal->j_transaction_sequence;
373 journal->j_head = journal->j_first;
374 } else {
375#ifdef CONFIG_JBD2_DEBUG
376 int dropped = info.end_transaction -
377 be32_to_cpu(journal->j_superblock->s_sequence);
378 jbd2_debug(1,
379 "JBD2: ignoring %d transaction%s from the journal.\n",
380 dropped, str_plural(dropped));
381#endif
382 journal->j_transaction_sequence = ++info.end_transaction;
383 journal->j_head = info.head_block;
384 }
385
386 journal->j_tail = 0;
387 return err;
388}
389
390static inline unsigned long long read_tag_block(journal_t *journal,
391 journal_block_tag_t *tag)
392{
393 unsigned long long block = be32_to_cpu(tag->t_blocknr);
394 if (jbd2_has_feature_64bit(j: journal))
395 block |= (u64)be32_to_cpu(tag->t_blocknr_high) << 32;
396 return block;
397}
398
399/*
400 * calc_chksums calculates the checksums for the blocks described in the
401 * descriptor block.
402 */
403static int calc_chksums(journal_t *journal, struct buffer_head *bh,
404 unsigned long *next_log_block, __u32 *crc32_sum)
405{
406 int i, num_blks, err;
407 unsigned long io_block;
408 struct buffer_head *obh;
409
410 num_blks = count_tags(journal, bh);
411 /* Calculate checksum of the descriptor block. */
412 *crc32_sum = crc32_be(crc: *crc32_sum, p: (void *)bh->b_data, len: bh->b_size);
413
414 for (i = 0; i < num_blks; i++) {
415 io_block = (*next_log_block)++;
416 wrap(journal, *next_log_block);
417 err = jread(bhp: &obh, journal, offset: io_block);
418 if (err) {
419 printk(KERN_ERR "JBD2: IO error %d recovering block "
420 "%lu in log\n", err, io_block);
421 return 1;
422 } else {
423 *crc32_sum = crc32_be(crc: *crc32_sum, p: (void *)obh->b_data,
424 len: obh->b_size);
425 }
426 put_bh(bh: obh);
427 }
428 return 0;
429}
430
431static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
432{
433 struct commit_header *h;
434 __be32 provided;
435 __u32 calculated;
436
437 if (!jbd2_journal_has_csum_v2or3(journal: j))
438 return 1;
439
440 h = buf;
441 provided = h->h_chksum[0];
442 h->h_chksum[0] = 0;
443 calculated = jbd2_chksum(crc: j->j_csum_seed, address: buf, length: j->j_blocksize);
444 h->h_chksum[0] = provided;
445
446 return provided == cpu_to_be32(calculated);
447}
448
449static bool jbd2_commit_block_csum_verify_partial(journal_t *j, void *buf)
450{
451 struct commit_header *h;
452 __be32 provided;
453 __u32 calculated;
454 void *tmpbuf;
455
456 tmpbuf = kzalloc(j->j_blocksize, GFP_KERNEL);
457 if (!tmpbuf)
458 return false;
459
460 memcpy(to: tmpbuf, from: buf, len: sizeof(struct commit_header));
461 h = tmpbuf;
462 provided = h->h_chksum[0];
463 h->h_chksum[0] = 0;
464 calculated = jbd2_chksum(crc: j->j_csum_seed, address: tmpbuf, length: j->j_blocksize);
465 kfree(objp: tmpbuf);
466
467 return provided == cpu_to_be32(calculated);
468}
469
470static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
471 journal_block_tag3_t *tag3,
472 void *buf, __u32 sequence)
473{
474 __u32 csum32;
475 __be32 seq;
476
477 if (!jbd2_journal_has_csum_v2or3(journal: j))
478 return 1;
479
480 seq = cpu_to_be32(sequence);
481 csum32 = jbd2_chksum(crc: j->j_csum_seed, address: (__u8 *)&seq, length: sizeof(seq));
482 csum32 = jbd2_chksum(crc: csum32, address: buf, length: j->j_blocksize);
483
484 if (jbd2_has_feature_csum3(j))
485 return tag3->t_checksum == cpu_to_be32(csum32);
486 else
487 return tag->t_checksum == cpu_to_be16(csum32);
488}
489
490static __always_inline int jbd2_do_replay(journal_t *journal,
491 struct recovery_info *info,
492 struct buffer_head *bh,
493 unsigned long *next_log_block,
494 unsigned int next_commit_ID)
495{
496 char *tagp;
497 int flags;
498 int ret = 0;
499 int tag_bytes = journal_tag_bytes(journal);
500 int descr_csum_size = 0;
501 unsigned long io_block;
502 journal_block_tag_t tag;
503 struct buffer_head *obh;
504 struct buffer_head *nbh;
505
506 if (jbd2_journal_has_csum_v2or3(journal))
507 descr_csum_size = sizeof(struct jbd2_journal_block_tail);
508
509 tagp = &bh->b_data[sizeof(journal_header_t)];
510 while (tagp - bh->b_data + tag_bytes <=
511 journal->j_blocksize - descr_csum_size) {
512 int err;
513
514 memcpy(to: &tag, from: tagp, len: sizeof(tag));
515 flags = be16_to_cpu(tag.t_flags);
516
517 io_block = (*next_log_block)++;
518 wrap(journal, *next_log_block);
519 err = jread(bhp: &obh, journal, offset: io_block);
520 if (err) {
521 /* Recover what we can, but report failure at the end. */
522 ret = err;
523 pr_err("JBD2: IO error %d recovering block %lu in log\n",
524 err, io_block);
525 } else {
526 unsigned long long blocknr;
527
528 J_ASSERT(obh != NULL);
529 blocknr = read_tag_block(journal, tag: &tag);
530
531 /* If the block has been revoked, then we're all done here. */
532 if (jbd2_journal_test_revoke(journal, blocknr,
533 next_commit_ID)) {
534 brelse(bh: obh);
535 ++info->nr_revoke_hits;
536 goto skip_write;
537 }
538
539 /* Look for block corruption */
540 if (!jbd2_block_tag_csum_verify(j: journal, tag: &tag,
541 tag3: (journal_block_tag3_t *)tagp,
542 buf: obh->b_data, sequence: next_commit_ID)) {
543 brelse(bh: obh);
544 ret = -EFSBADCRC;
545 pr_err("JBD2: Invalid checksum recovering data block %llu in journal block %lu\n",
546 blocknr, io_block);
547 goto skip_write;
548 }
549
550 /* Find a buffer for the new data being restored */
551 nbh = __getblk(bdev: journal->j_fs_dev, block: blocknr,
552 size: journal->j_blocksize);
553 if (nbh == NULL) {
554 pr_err("JBD2: Out of memory during recovery.\n");
555 brelse(bh: obh);
556 return -ENOMEM;
557 }
558
559 lock_buffer(bh: nbh);
560 memcpy(to: nbh->b_data, from: obh->b_data, len: journal->j_blocksize);
561 if (flags & JBD2_FLAG_ESCAPE) {
562 *((__be32 *)nbh->b_data) =
563 cpu_to_be32(JBD2_MAGIC_NUMBER);
564 }
565
566 BUFFER_TRACE(nbh, "marking dirty");
567 set_buffer_uptodate(nbh);
568 mark_buffer_dirty(bh: nbh);
569 BUFFER_TRACE(nbh, "marking uptodate");
570 ++info->nr_replays;
571 unlock_buffer(bh: nbh);
572 brelse(bh: obh);
573 brelse(bh: nbh);
574 }
575
576skip_write:
577 tagp += tag_bytes;
578 if (!(flags & JBD2_FLAG_SAME_UUID))
579 tagp += 16;
580
581 if (flags & JBD2_FLAG_LAST_TAG)
582 break;
583 }
584
585 return ret;
586}
587
588static int do_one_pass(journal_t *journal,
589 struct recovery_info *info, enum passtype pass)
590{
591 unsigned int first_commit_ID, next_commit_ID;
592 unsigned long next_log_block, head_block;
593 int err, success = 0;
594 journal_superblock_t * sb;
595 journal_header_t * tmp;
596 struct buffer_head *bh = NULL;
597 unsigned int sequence;
598 int blocktype;
599 __u32 crc32_sum = ~0; /* Transactional Checksums */
600 bool need_check_commit_time = false;
601 __u64 last_trans_commit_time = 0, commit_time;
602
603 /*
604 * First thing is to establish what we expect to find in the log
605 * (in terms of transaction IDs), and where (in terms of log
606 * block offsets): query the superblock.
607 */
608
609 sb = journal->j_superblock;
610 next_commit_ID = be32_to_cpu(sb->s_sequence);
611 next_log_block = be32_to_cpu(sb->s_start);
612 head_block = next_log_block;
613
614 first_commit_ID = next_commit_ID;
615 if (pass == PASS_SCAN)
616 info->start_transaction = first_commit_ID;
617 else if (pass == PASS_REVOKE) {
618 /*
619 * Would the default revoke table have too long hash chains
620 * during replay?
621 */
622 if (info->nr_revokes > JOURNAL_REVOKE_DEFAULT_HASH * 16) {
623 unsigned int hash_size;
624
625 /*
626 * Aim for average chain length of 8, limit at 1M
627 * entries to avoid problems with malicious
628 * filesystems.
629 */
630 hash_size = min(roundup_pow_of_two(info->nr_revokes / 8),
631 1U << 20);
632 journal->j_revoke =
633 jbd2_journal_init_revoke_table(hash_size);
634 if (!journal->j_revoke) {
635 printk(KERN_ERR
636 "JBD2: failed to allocate revoke table for replay with %u entries. "
637 "Journal replay may be slow.\n", hash_size);
638 journal->j_revoke = journal->j_revoke_table[1];
639 }
640 }
641 }
642
643 jbd2_debug(1, "Starting recovery pass %d\n", pass);
644
645 /*
646 * Now we walk through the log, transaction by transaction,
647 * making sure that each transaction has a commit block in the
648 * expected place. Each complete transaction gets replayed back
649 * into the main filesystem.
650 */
651
652 while (1) {
653 cond_resched();
654
655 /* If we already know where to stop the log traversal,
656 * check right now that we haven't gone past the end of
657 * the log. */
658
659 if (pass != PASS_SCAN)
660 if (tid_geq(x: next_commit_ID, y: info->end_transaction))
661 break;
662
663 jbd2_debug(2, "Scanning for sequence ID %u at %lu/%lu\n",
664 next_commit_ID, next_log_block, journal->j_last);
665
666 /* Skip over each chunk of the transaction looking
667 * either the next descriptor block or the final commit
668 * record. */
669
670 jbd2_debug(3, "JBD2: checking block %ld\n", next_log_block);
671 brelse(bh);
672 bh = NULL;
673 err = jread(bhp: &bh, journal, offset: next_log_block);
674 if (err)
675 goto failed;
676
677 next_log_block++;
678 wrap(journal, next_log_block);
679
680 /* What kind of buffer is it?
681 *
682 * If it is a descriptor block, check that it has the
683 * expected sequence number. Otherwise, we're all done
684 * here. */
685
686 tmp = (journal_header_t *)bh->b_data;
687
688 if (tmp->h_magic != cpu_to_be32(JBD2_MAGIC_NUMBER))
689 break;
690
691 blocktype = be32_to_cpu(tmp->h_blocktype);
692 sequence = be32_to_cpu(tmp->h_sequence);
693 jbd2_debug(3, "Found magic %d, sequence %d\n",
694 blocktype, sequence);
695
696 if (sequence != next_commit_ID)
697 break;
698
699 /* OK, we have a valid descriptor block which matches
700 * all of the sequence number checks. What are we going
701 * to do with it? That depends on the pass... */
702
703 switch(blocktype) {
704 case JBD2_DESCRIPTOR_BLOCK:
705 /* Verify checksum first */
706 if (!jbd2_descriptor_block_csum_verify(j: journal,
707 buf: bh->b_data)) {
708 /*
709 * PASS_SCAN can see stale blocks due to lazy
710 * journal init. Don't error out on those yet.
711 */
712 if (pass != PASS_SCAN) {
713 pr_err("JBD2: Invalid checksum recovering block %lu in log\n",
714 next_log_block);
715 err = -EFSBADCRC;
716 goto failed;
717 }
718 need_check_commit_time = true;
719 jbd2_debug(1,
720 "invalid descriptor block found in %lu\n",
721 next_log_block);
722 }
723
724 /* If it is a valid descriptor block, replay it
725 * in pass REPLAY; if journal_checksums enabled, then
726 * calculate checksums in PASS_SCAN, otherwise,
727 * just skip over the blocks it describes. */
728 if (pass != PASS_REPLAY) {
729 if (pass == PASS_SCAN &&
730 jbd2_has_feature_checksum(j: journal) &&
731 !info->end_transaction) {
732 if (calc_chksums(journal, bh,
733 next_log_block: &next_log_block,
734 crc32_sum: &crc32_sum))
735 break;
736 continue;
737 }
738 next_log_block += count_tags(journal, bh);
739 wrap(journal, next_log_block);
740 continue;
741 }
742
743 /*
744 * A descriptor block: we can now write all of the
745 * data blocks. Yay, useful work is finally getting
746 * done here!
747 */
748 err = jbd2_do_replay(journal, info, bh, next_log_block: &next_log_block,
749 next_commit_ID);
750 if (err) {
751 if (err == -ENOMEM)
752 goto failed;
753 success = err;
754 }
755
756 continue;
757
758 case JBD2_COMMIT_BLOCK:
759 if (pass != PASS_SCAN) {
760 next_commit_ID++;
761 continue;
762 }
763
764 /* How to differentiate between interrupted commit
765 * and journal corruption ?
766 *
767 * {nth transaction}
768 * Checksum Verification Failed
769 * |
770 * ____________________
771 * | |
772 * async_commit sync_commit
773 * | |
774 * | GO TO NEXT "Journal Corruption"
775 * | TRANSACTION
776 * |
777 * {(n+1)th transanction}
778 * |
779 * _______|______________
780 * | |
781 * Commit block found Commit block not found
782 * | |
783 * "Journal Corruption" |
784 * _____________|_________
785 * | |
786 * nth trans corrupt OR nth trans
787 * and (n+1)th interrupted interrupted
788 * before commit block
789 * could reach the disk.
790 * (Cannot find the difference in above
791 * mentioned conditions. Hence assume
792 * "Interrupted Commit".)
793 */
794 commit_time = be64_to_cpu(
795 ((struct commit_header *)bh->b_data)->h_commit_sec);
796 /*
797 * If need_check_commit_time is set, it means we are in
798 * PASS_SCAN and csum verify failed before. If
799 * commit_time is increasing, it's the same journal,
800 * otherwise it is stale journal block, just end this
801 * recovery.
802 */
803 if (need_check_commit_time) {
804 if (commit_time >= last_trans_commit_time) {
805 pr_err("JBD2: Invalid checksum found in transaction %u\n",
806 next_commit_ID);
807 err = -EFSBADCRC;
808 goto failed;
809 }
810 ignore_crc_mismatch:
811 /*
812 * It likely does not belong to same journal,
813 * just end this recovery with success.
814 */
815 jbd2_debug(1, "JBD2: Invalid checksum ignored in transaction %u, likely stale data\n",
816 next_commit_ID);
817 goto done;
818 }
819
820 /*
821 * Found an expected commit block: if checksums
822 * are present, verify them in PASS_SCAN; else not
823 * much to do other than move on to the next sequence
824 * number.
825 */
826 if (jbd2_has_feature_checksum(j: journal)) {
827 struct commit_header *cbh =
828 (struct commit_header *)bh->b_data;
829 unsigned found_chksum =
830 be32_to_cpu(cbh->h_chksum[0]);
831
832 if (info->end_transaction) {
833 journal->j_failed_commit =
834 info->end_transaction;
835 break;
836 }
837
838 /* Neither checksum match nor unused? */
839 if (!((crc32_sum == found_chksum &&
840 cbh->h_chksum_type ==
841 JBD2_CRC32_CHKSUM &&
842 cbh->h_chksum_size ==
843 JBD2_CRC32_CHKSUM_SIZE) ||
844 (cbh->h_chksum_type == 0 &&
845 cbh->h_chksum_size == 0 &&
846 found_chksum == 0)))
847 goto chksum_error;
848
849 crc32_sum = ~0;
850 goto chksum_ok;
851 }
852
853 if (jbd2_commit_block_csum_verify(j: journal, buf: bh->b_data))
854 goto chksum_ok;
855
856 if (jbd2_commit_block_csum_verify_partial(j: journal,
857 buf: bh->b_data)) {
858 pr_notice("JBD2: Find incomplete commit block in transaction %u block %lu\n",
859 next_commit_ID, next_log_block);
860 goto chksum_ok;
861 }
862
863chksum_error:
864 if (commit_time < last_trans_commit_time)
865 goto ignore_crc_mismatch;
866 info->end_transaction = next_commit_ID;
867 info->head_block = head_block;
868
869 if (!jbd2_has_feature_async_commit(j: journal)) {
870 journal->j_failed_commit = next_commit_ID;
871 break;
872 }
873
874chksum_ok:
875 last_trans_commit_time = commit_time;
876 head_block = next_log_block;
877 next_commit_ID++;
878 continue;
879
880 case JBD2_REVOKE_BLOCK:
881 /*
882 * If we aren't in the SCAN or REVOKE pass, then we can
883 * just skip over this block.
884 */
885 if (pass != PASS_REVOKE && pass != PASS_SCAN)
886 continue;
887
888 /*
889 * Check revoke block crc in pass_scan, if csum verify
890 * failed, check commit block time later.
891 */
892 if (pass == PASS_SCAN &&
893 !jbd2_descriptor_block_csum_verify(j: journal,
894 buf: bh->b_data)) {
895 jbd2_debug(1, "JBD2: invalid revoke block found in %lu\n",
896 next_log_block);
897 need_check_commit_time = true;
898 }
899
900 err = scan_revoke_records(journal, pass, bh,
901 next_commit_ID, info);
902 if (err)
903 goto failed;
904 continue;
905
906 default:
907 jbd2_debug(3, "Unrecognised magic %d, end of scan.\n",
908 blocktype);
909 goto done;
910 }
911 }
912
913 done:
914 brelse(bh);
915 /*
916 * We broke out of the log scan loop: either we came to the
917 * known end of the log or we found an unexpected block in the
918 * log. If the latter happened, then we know that the "current"
919 * transaction marks the end of the valid log.
920 */
921
922 if (pass == PASS_SCAN) {
923 if (!info->end_transaction)
924 info->end_transaction = next_commit_ID;
925 if (!info->head_block)
926 info->head_block = head_block;
927 } else {
928 /* It's really bad news if different passes end up at
929 * different places (but possible due to IO errors). */
930 if (info->end_transaction != next_commit_ID) {
931 printk(KERN_ERR "JBD2: recovery pass %d ended at "
932 "transaction %u, expected %u\n",
933 pass, next_commit_ID, info->end_transaction);
934 if (!success)
935 success = -EIO;
936 }
937 }
938
939 if (jbd2_has_feature_fast_commit(j: journal) && pass != PASS_REVOKE) {
940 err = fc_do_one_pass(journal, info, pass);
941 if (err)
942 success = err;
943 }
944
945 return success;
946
947 failed:
948 brelse(bh);
949 return err;
950}
951
952/* Scan a revoke record, marking all blocks mentioned as revoked. */
953
954static int scan_revoke_records(journal_t *journal, enum passtype pass,
955 struct buffer_head *bh, tid_t sequence,
956 struct recovery_info *info)
957{
958 jbd2_journal_revoke_header_t *header;
959 int offset, max;
960 unsigned csum_size = 0;
961 __u32 rcount;
962 int record_len = 4;
963
964 header = (jbd2_journal_revoke_header_t *) bh->b_data;
965 offset = sizeof(jbd2_journal_revoke_header_t);
966 rcount = be32_to_cpu(header->r_count);
967
968 if (jbd2_journal_has_csum_v2or3(journal))
969 csum_size = sizeof(struct jbd2_journal_block_tail);
970 if (rcount > journal->j_blocksize - csum_size)
971 return -EINVAL;
972 max = rcount;
973
974 if (jbd2_has_feature_64bit(j: journal))
975 record_len = 8;
976
977 if (pass == PASS_SCAN) {
978 info->nr_revokes += (max - offset) / record_len;
979 return 0;
980 }
981
982 while (offset + record_len <= max) {
983 unsigned long long blocknr;
984 int err;
985
986 if (record_len == 4)
987 blocknr = be32_to_cpu(* ((__be32 *) (bh->b_data+offset)));
988 else
989 blocknr = be64_to_cpu(* ((__be64 *) (bh->b_data+offset)));
990 offset += record_len;
991 err = jbd2_journal_set_revoke(journal, blocknr, sequence);
992 if (err)
993 return err;
994 }
995 return 0;
996}
997