1 /* 2 * linux/fs/jbd/recovery.c 3 * 4 * Written by Stephen C. Tweedie <sct (at) redhat.com>, 1999 5 * 6 * Copyright 1999-2000 Red Hat Software --- All Rights Reserved 7 * 8 * This file is part of the Linux kernel and is made available under 9 * the terms of the GNU General Public License, version 2, or at your 10 * option, any later version, incorporated herein by reference. 11 * 12 * Journal recovery routines for the generic filesystem journaling code; 13 * part of the ext2fs journaling system. 14 */ 15 16 #ifndef __KERNEL__ 17 #include "jfs_user.h" 18 #else 19 #include <linux/time.h> 20 #include <linux/fs.h> 21 #include <linux/jbd.h> 22 #include <linux/errno.h> 23 #include <linux/slab.h> 24 #endif 25 26 /* 27 * Maintain information about the progress of the recovery job, so that 28 * the different passes can carry information between them. 29 */ 30 struct recovery_info 31 { 32 tid_t start_transaction; 33 tid_t end_transaction; 34 35 int nr_replays; 36 int nr_revokes; 37 int nr_revoke_hits; 38 }; 39 40 enum passtype {PASS_SCAN, PASS_REVOKE, PASS_REPLAY}; 41 static int do_one_pass(journal_t *journal, 42 struct recovery_info *info, enum passtype pass); 43 static int scan_revoke_records(journal_t *, struct buffer_head *, 44 tid_t, struct recovery_info *); 45 46 #ifdef __KERNEL__ 47 48 /* Release readahead buffers after use */ 49 static void journal_brelse_array(struct buffer_head *b[], int n) 50 { 51 while (--n >= 0) 52 brelse (b[n]); 53 } 54 55 56 /* 57 * When reading from the journal, we are going through the block device 58 * layer directly and so there is no readahead being done for us. We 59 * need to implement any readahead ourselves if we want it to happen at 60 * all. Recovery is basically one long sequential read, so make sure we 61 * do the IO in reasonably large chunks. 62 * 63 * This is not so critical that we need to be enormously clever about 64 * the readahead size, though. 128K is a purely arbitrary, good-enough 65 * fixed value. 66 */ 67 68 #define MAXBUF 8 69 static int do_readahead(journal_t *journal, unsigned int start) 70 { 71 int err; 72 unsigned int max, nbufs, next; 73 unsigned long blocknr; 74 struct buffer_head *bh; 75 76 struct buffer_head * bufs[MAXBUF]; 77 78 /* Do up to 128K of readahead */ 79 max = start + (128 * 1024 / journal->j_blocksize); 80 if (max > journal->j_maxlen) 81 max = journal->j_maxlen; 82 83 /* Do the readahead itself. We'll submit MAXBUF buffer_heads at 84 * a time to the block device IO layer. */ 85 86 nbufs = 0; 87 88 for (next = start; next < max; next++) { 89 err = journal_bmap(journal, next, &blocknr); 90 91 if (err) { 92 printk (KERN_ERR "JBD: bad block at offset %u\n", 93 next); 94 goto failed; 95 } 96 97 bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize); 98 if (!bh) { 99 err = -ENOMEM; 100 goto failed; 101 } 102 103 if (!buffer_uptodate(bh) && !buffer_locked(bh)) { 104 bufs[nbufs++] = bh; 105 if (nbufs == MAXBUF) { 106 ll_rw_block(READ, nbufs, bufs); 107 journal_brelse_array(bufs, nbufs); 108 nbufs = 0; 109 } 110 } else 111 brelse(bh); 112 } 113 114 if (nbufs) 115 ll_rw_block(READ, nbufs, bufs); 116 err = 0; 117 118 failed: 119 if (nbufs) 120 journal_brelse_array(bufs, nbufs); 121 return err; 122 } 123 124 #endif /* __KERNEL__ */ 125 126 127 /* 128 * Read a block from the journal 129 */ 130 131 static int jread(struct buffer_head **bhp, journal_t *journal, 132 unsigned int offset) 133 { 134 int err; 135 unsigned long blocknr; 136 struct buffer_head *bh; 137 138 *bhp = NULL; 139 140 if (offset >= journal->j_maxlen) { 141 printk(KERN_ERR "JBD: corrupted journal superblock\n"); 142 return -EIO; 143 } 144 145 err = journal_bmap(journal, offset, &blocknr); 146 147 if (err) { 148 printk (KERN_ERR "JBD: bad block at offset %u\n", 149 offset); 150 return err; 151 } 152 153 bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize); 154 if (!bh) 155 return -ENOMEM; 156 157 if (!buffer_uptodate(bh)) { 158 /* If this is a brand new buffer, start readahead. 159 Otherwise, we assume we are already reading it. */ 160 if (!buffer_req(bh)) 161 do_readahead(journal, offset); 162 wait_on_buffer(bh); 163 } 164 165 if (!buffer_uptodate(bh)) { 166 printk (KERN_ERR "JBD: Failed to read block at offset %u\n", 167 offset); 168 brelse(bh); 169 return -EIO; 170 } 171 172 *bhp = bh; 173 return 0; 174 } 175 176 177 /* 178 * Count the number of in-use tags in a journal descriptor block. 179 */ 180 181 static int count_tags(journal_t *journal, struct buffer_head *bh) 182 { 183 char * tagp; 184 journal_block_tag_t * tag; 185 int nr = 0, size = journal->j_blocksize; 186 int tag_bytes = journal_tag_bytes(journal); 187 188 tagp = &bh->b_data[sizeof(journal_header_t)]; 189 190 while ((tagp - bh->b_data + tag_bytes) <= size) { 191 tag = (journal_block_tag_t *) tagp; 192 193 nr++; 194 tagp += tag_bytes; 195 if (!(tag->t_flags & cpu_to_be32(JFS_FLAG_SAME_UUID))) 196 tagp += 16; 197 198 if (tag->t_flags & cpu_to_be32(JFS_FLAG_LAST_TAG)) 199 break; 200 } 201 202 return nr; 203 } 204 205 206 /* Make sure we wrap around the log correctly! */ 207 #define wrap(journal, var) \ 208 do { \ 209 if (var >= (journal)->j_last) \ 210 var -= ((journal)->j_last - (journal)->j_first); \ 211 } while (0) 212 213 /** 214 * journal_recover - recovers a on-disk journal 215 * @journal: the journal to recover 216 * 217 * The primary function for recovering the log contents when mounting a 218 * journaled device. 219 * 220 * Recovery is done in three passes. In the first pass, we look for the 221 * end of the log. In the second, we assemble the list of revoke 222 * blocks. In the third and final pass, we replay any un-revoked blocks 223 * in the log. 224 */ 225 int journal_recover(journal_t *journal) 226 { 227 int err; 228 journal_superblock_t * sb; 229 230 struct recovery_info info; 231 232 memset(&info, 0, sizeof(info)); 233 sb = journal->j_superblock; 234 235 /* 236 * The journal superblock's s_start field (the current log head) 237 * is always zero if, and only if, the journal was cleanly 238 * unmounted. 239 */ 240 241 if (!sb->s_start) { 242 jbd_debug(1, "No recovery required, last transaction %d\n", 243 be32_to_cpu(sb->s_sequence)); 244 journal->j_transaction_sequence = be32_to_cpu(sb->s_sequence) + 1; 245 return 0; 246 } 247 248 err = do_one_pass(journal, &info, PASS_SCAN); 249 if (!err) 250 err = do_one_pass(journal, &info, PASS_REVOKE); 251 if (!err) 252 err = do_one_pass(journal, &info, PASS_REPLAY); 253 254 jbd_debug(1, "JBD: recovery, exit status %d, " 255 "recovered transactions %u to %u\n", 256 err, info.start_transaction, info.end_transaction); 257 jbd_debug(1, "JBD: Replayed %d and revoked %d/%d blocks\n", 258 info.nr_replays, info.nr_revoke_hits, info.nr_revokes); 259 260 /* Restart the log at the next transaction ID, thus invalidating 261 * any existing commit records in the log. */ 262 journal->j_transaction_sequence = ++info.end_transaction; 263 264 journal_clear_revoke(journal); 265 sync_blockdev(journal->j_fs_dev); 266 return err; 267 } 268 269 /** 270 * journal_skip_recovery - Start journal and wipe exiting records 271 * @journal: journal to startup 272 * 273 * Locate any valid recovery information from the journal and set up the 274 * journal structures in memory to ignore it (presumably because the 275 * caller has evidence that it is out of date). 276 * This function does'nt appear to be exorted.. 277 * 278 * We perform one pass over the journal to allow us to tell the user how 279 * much recovery information is being erased, and to let us initialise 280 * the journal transaction sequence numbers to the next unused ID. 281 */ 282 int journal_skip_recovery(journal_t *journal) 283 { 284 int err; 285 journal_superblock_t * sb; 286 287 struct recovery_info info; 288 289 memset (&info, 0, sizeof(info)); 290 sb = journal->j_superblock; 291 292 err = do_one_pass(journal, &info, PASS_SCAN); 293 294 if (err) { 295 printk(KERN_ERR "JBD: error %d scanning journal\n", err); 296 ++journal->j_transaction_sequence; 297 } else { 298 #ifdef CONFIG_JBD_DEBUG 299 int dropped = info.end_transaction - be32_to_cpu(sb->s_sequence); 300 #endif 301 jbd_debug(1, 302 "JBD: ignoring %d transaction%s from the journal.\n", 303 dropped, (dropped == 1) ? "" : "s"); 304 journal->j_transaction_sequence = ++info.end_transaction; 305 } 306 307 journal->j_tail = 0; 308 return err; 309 } 310 311 #if 0 312 static inline unsigned long long read_tag_block(int tag_bytes, journal_block_tag_t *tag) 313 { 314 unsigned long long block = be32_to_cpu(tag->t_blocknr); 315 if (tag_bytes > JBD_TAG_SIZE32) 316 block |= (__u64)be32_to_cpu(tag->t_blocknr_high) << 32; 317 return block; 318 } 319 #endif 320 321 /* 322 * calc_chksums calculates the checksums for the blocks described in the 323 * descriptor block. 324 */ 325 static int calc_chksums(journal_t *journal, struct buffer_head *bh, 326 unsigned long *next_log_block, __u32 *crc32_sum) 327 { 328 int i, num_blks, err; 329 unsigned long io_block; 330 struct buffer_head *obh; 331 332 num_blks = count_tags(journal, bh); 333 /* Calculate checksum of the descriptor block. */ 334 *crc32_sum = crc32_be(*crc32_sum, (void *)bh->b_data, bh->b_size); 335 336 for (i = 0; i < num_blks; i++) { 337 io_block = (*next_log_block)++; 338 wrap(journal, *next_log_block); 339 err = jread(&obh, journal, io_block); 340 if (err) { 341 printk(KERN_ERR "JBD: IO error %d recovering block " 342 "%lu in log\n", err, io_block); 343 return 1; 344 } else { 345 *crc32_sum = crc32_be(*crc32_sum, (void *)obh->b_data, 346 obh->b_size); 347 } 348 brelse(obh); 349 } 350 return 0; 351 } 352 353 static int do_one_pass(journal_t *journal, 354 struct recovery_info *info, enum passtype pass) 355 { 356 unsigned int first_commit_ID, next_commit_ID; 357 unsigned long next_log_block; 358 int err, success = 0; 359 journal_superblock_t * sb; 360 journal_header_t * tmp; 361 struct buffer_head * bh; 362 unsigned int sequence; 363 int blocktype; 364 int tag_bytes = journal_tag_bytes(journal); 365 __u32 crc32_sum = ~0; /* Transactional Checksums */ 366 367 /* Precompute the maximum metadata descriptors in a descriptor block */ 368 int MAX_BLOCKS_PER_DESC; 369 MAX_BLOCKS_PER_DESC = ((journal->j_blocksize-sizeof(journal_header_t)) 370 / tag_bytes); 371 372 /* 373 * First thing is to establish what we expect to find in the log 374 * (in terms of transaction IDs), and where (in terms of log 375 * block offsets): query the superblock. 376 */ 377 378 sb = journal->j_superblock; 379 next_commit_ID = be32_to_cpu(sb->s_sequence); 380 next_log_block = be32_to_cpu(sb->s_start); 381 382 first_commit_ID = next_commit_ID; 383 if (pass == PASS_SCAN) 384 info->start_transaction = first_commit_ID; 385 386 jbd_debug(1, "Starting recovery pass %d\n", pass); 387 388 /* 389 * Now we walk through the log, transaction by transaction, 390 * making sure that each transaction has a commit block in the 391 * expected place. Each complete transaction gets replayed back 392 * into the main filesystem. 393 */ 394 395 while (1) { 396 int flags; 397 char * tagp; 398 journal_block_tag_t * tag; 399 struct buffer_head * obh; 400 struct buffer_head * nbh; 401 402 cond_resched(); 403 404 /* If we already know where to stop the log traversal, 405 * check right now that we haven't gone past the end of 406 * the log. */ 407 408 if (pass != PASS_SCAN) 409 if (tid_geq(next_commit_ID, info->end_transaction)) 410 break; 411 412 jbd_debug(2, "Scanning for sequence ID %u at %lu/%lu\n", 413 next_commit_ID, next_log_block, journal->j_last); 414 415 /* Skip over each chunk of the transaction looking 416 * either the next descriptor block or the final commit 417 * record. */ 418 419 jbd_debug(3, "JBD: checking block %ld\n", next_log_block); 420 err = jread(&bh, journal, next_log_block); 421 if (err) 422 goto failed; 423 424 next_log_block++; 425 wrap(journal, next_log_block); 426 427 /* What kind of buffer is it? 428 * 429 * If it is a descriptor block, check that it has the 430 * expected sequence number. Otherwise, we're all done 431 * here. */ 432 433 tmp = (journal_header_t *)bh->b_data; 434 435 if (tmp->h_magic != cpu_to_be32(JFS_MAGIC_NUMBER)) { 436 brelse(bh); 437 break; 438 } 439 440 blocktype = be32_to_cpu(tmp->h_blocktype); 441 sequence = be32_to_cpu(tmp->h_sequence); 442 jbd_debug(3, "Found magic %d, sequence %d\n", 443 blocktype, sequence); 444 445 if (sequence != next_commit_ID) { 446 brelse(bh); 447 break; 448 } 449 450 /* OK, we have a valid descriptor block which matches 451 * all of the sequence number checks. What are we going 452 * to do with it? That depends on the pass... */ 453 454 switch(blocktype) { 455 case JFS_DESCRIPTOR_BLOCK: 456 /* If it is a valid descriptor block, replay it 457 * in pass REPLAY; if journal_checksums enabled, then 458 * calculate checksums in PASS_SCAN, otherwise, 459 * just skip over the blocks it describes. */ 460 if (pass != PASS_REPLAY) { 461 if (pass == PASS_SCAN && 462 JFS_HAS_COMPAT_FEATURE(journal, 463 JFS_FEATURE_COMPAT_CHECKSUM) && 464 !info->end_transaction) { 465 if (calc_chksums(journal, bh, 466 &next_log_block, 467 &crc32_sum)) { 468 brelse(bh); 469 break; 470 } 471 brelse(bh); 472 continue; 473 } 474 next_log_block += count_tags(journal, bh); 475 wrap(journal, next_log_block); 476 brelse(bh); 477 continue; 478 } 479 480 /* A descriptor block: we can now write all of 481 * the data blocks. Yay, useful work is finally 482 * getting done here! */ 483 484 tagp = &bh->b_data[sizeof(journal_header_t)]; 485 while ((tagp - bh->b_data + tag_bytes) 486 <= journal->j_blocksize) { 487 unsigned long io_block; 488 489 tag = (journal_block_tag_t *) tagp; 490 flags = be32_to_cpu(tag->t_flags); 491 492 io_block = next_log_block++; 493 wrap(journal, next_log_block); 494 err = jread(&obh, journal, io_block); 495 if (err) { 496 /* Recover what we can, but 497 * report failure at the end. */ 498 success = err; 499 printk (KERN_ERR 500 "JBD: IO error %d recovering " 501 "block %ld in log\n", 502 err, io_block); 503 } else { 504 unsigned long blocknr; 505 506 J_ASSERT(obh != NULL); 507 blocknr = be32_to_cpu(tag->t_blocknr); 508 509 /* If the block has been 510 * revoked, then we're all done 511 * here. */ 512 if (journal_test_revoke 513 (journal, blocknr, 514 next_commit_ID)) { 515 brelse(obh); 516 ++info->nr_revoke_hits; 517 goto skip_write; 518 } 519 520 /* Find a buffer for the new 521 * data being restored */ 522 nbh = __getblk(journal->j_fs_dev, 523 blocknr, 524 journal->j_blocksize); 525 if (nbh == NULL) { 526 printk(KERN_ERR 527 "JBD: Out of memory " 528 "during recovery.\n"); 529 err = -ENOMEM; 530 brelse(bh); 531 brelse(obh); 532 goto failed; 533 } 534 535 lock_buffer(nbh); 536 memcpy(nbh->b_data, obh->b_data, 537 journal->j_blocksize); 538 if (flags & JFS_FLAG_ESCAPE) { 539 journal_header_t *header; 540 541 header = (journal_header_t *) &nbh->b_data[0]; 542 header->h_magic = cpu_to_be32(JFS_MAGIC_NUMBER); 543 } 544 545 BUFFER_TRACE(nbh, "marking dirty"); 546 set_buffer_uptodate(nbh); 547 mark_buffer_dirty(nbh); 548 BUFFER_TRACE(nbh, "marking uptodate"); 549 ++info->nr_replays; 550 /* ll_rw_block(WRITE, 1, &nbh); */ 551 unlock_buffer(nbh); 552 brelse(obh); 553 brelse(nbh); 554 } 555 556 skip_write: 557 tagp += tag_bytes; 558 if (!(flags & JFS_FLAG_SAME_UUID)) 559 tagp += 16; 560 561 if (flags & JFS_FLAG_LAST_TAG) 562 break; 563 } 564 565 brelse(bh); 566 continue; 567 568 case JFS_COMMIT_BLOCK: 569 jbd_debug(3, "Commit block for #%u found\n", 570 next_commit_ID); 571 /* How to differentiate between interrupted commit 572 * and journal corruption ? 573 * 574 * {nth transaction} 575 * Checksum Verification Failed 576 * | 577 * ____________________ 578 * | | 579 * async_commit sync_commit 580 * | | 581 * | GO TO NEXT "Journal Corruption" 582 * | TRANSACTION 583 * | 584 * {(n+1)th transanction} 585 * | 586 * _______|______________ 587 * | | 588 * Commit block found Commit block not found 589 * | | 590 * "Journal Corruption" | 591 * _____________|_________ 592 * | | 593 * nth trans corrupt OR nth trans 594 * and (n+1)th interrupted interrupted 595 * before commit block 596 * could reach the disk. 597 * (Cannot find the difference in above 598 * mentioned conditions. Hence assume 599 * "Interrupted Commit".) 600 */ 601 602 /* Found an expected commit block: if checksums 603 * are present verify them in PASS_SCAN; else not 604 * much to do other than move on to the next sequence 605 * number. */ 606 if (pass == PASS_SCAN && 607 JFS_HAS_COMPAT_FEATURE(journal, 608 JFS_FEATURE_COMPAT_CHECKSUM)) { 609 int chksum_err, chksum_seen; 610 struct commit_header *cbh = 611 (struct commit_header *)bh->b_data; 612 unsigned found_chksum = 613 be32_to_cpu(cbh->h_chksum[0]); 614 615 chksum_err = chksum_seen = 0; 616 617 jbd_debug(3, "Checksums %x %x\n", 618 crc32_sum, found_chksum); 619 if (info->end_transaction) { 620 journal->j_failed_commit = 621 info->end_transaction; 622 brelse(bh); 623 break; 624 } 625 626 if (crc32_sum == found_chksum && 627 cbh->h_chksum_type == JBD2_CRC32_CHKSUM && 628 cbh->h_chksum_size == 629 JBD2_CRC32_CHKSUM_SIZE) 630 chksum_seen = 1; 631 else if (!(cbh->h_chksum_type == 0 && 632 cbh->h_chksum_size == 0 && 633 found_chksum == 0 && 634 !chksum_seen)) 635 /* 636 * If fs is mounted using an old kernel and then 637 * kernel with journal_chksum is used then we 638 * get a situation where the journal flag has 639 * checksum flag set but checksums are not 640 * present i.e chksum = 0, in the individual 641 * commit blocks. 642 * Hence to avoid checksum failures, in this 643 * situation, this extra check is added. 644 */ 645 chksum_err = 1; 646 647 if (chksum_err) { 648 info->end_transaction = next_commit_ID; 649 jbd_debug(1, "Checksum_err %x %x\n", 650 crc32_sum, found_chksum); 651 if (!JFS_HAS_INCOMPAT_FEATURE(journal, 652 JFS_FEATURE_INCOMPAT_ASYNC_COMMIT)){ 653 journal->j_failed_commit = 654 next_commit_ID; 655 brelse(bh); 656 break; 657 } 658 } 659 crc32_sum = ~0; 660 } 661 brelse(bh); 662 next_commit_ID++; 663 continue; 664 665 case JFS_REVOKE_BLOCK: 666 /* If we aren't in the REVOKE pass, then we can 667 * just skip over this block. */ 668 if (pass != PASS_REVOKE) { 669 brelse(bh); 670 continue; 671 } 672 673 err = scan_revoke_records(journal, bh, 674 next_commit_ID, info); 675 brelse(bh); 676 if (err) 677 goto failed; 678 continue; 679 680 default: 681 jbd_debug(3, "Unrecognised magic %d, end of scan.\n", 682 blocktype); 683 brelse(bh); 684 goto done; 685 } 686 } 687 688 done: 689 /* 690 * We broke out of the log scan loop: either we came to the 691 * known end of the log or we found an unexpected block in the 692 * log. If the latter happened, then we know that the "current" 693 * transaction marks the end of the valid log. 694 */ 695 696 if (pass == PASS_SCAN) { 697 if (!info->end_transaction) 698 info->end_transaction = next_commit_ID; 699 } else { 700 /* It's really bad news if different passes end up at 701 * different places (but possible due to IO errors). */ 702 if (info->end_transaction != next_commit_ID) { 703 printk (KERN_ERR "JBD: recovery pass %d ended at " 704 "transaction %u, expected %u\n", 705 pass, next_commit_ID, info->end_transaction); 706 if (!success) 707 success = -EIO; 708 } 709 } 710 711 return success; 712 713 failed: 714 return err; 715 } 716 717 718 /* Scan a revoke record, marking all blocks mentioned as revoked. */ 719 720 static int scan_revoke_records(journal_t *journal, struct buffer_head *bh, 721 tid_t sequence, struct recovery_info *info) 722 { 723 journal_revoke_header_t *header; 724 int offset, max; 725 726 header = (journal_revoke_header_t *) bh->b_data; 727 offset = sizeof(journal_revoke_header_t); 728 max = be32_to_cpu(header->r_count); 729 730 while (offset < max) { 731 unsigned long blocknr; 732 int err; 733 734 blocknr = be32_to_cpu(* ((__be32 *) (bh->b_data+offset))); 735 offset += 4; 736 err = journal_set_revoke(journal, blocknr, sequence); 737 if (err) 738 return err; 739 ++info->nr_revokes; 740 } 741 return 0; 742 } 743
