Merge tag 'keys-cve-2020-26541-v3' of git://git.kernel.org/pub/scm/linux/kernel/git...
[linux-2.6-microblaze.git] / fs / jffs2 / erase.c
1 /*
2  * JFFS2 -- Journalling Flash File System, Version 2.
3  *
4  * Copyright © 2001-2007 Red Hat, Inc.
5  * Copyright © 2004-2010 David Woodhouse <dwmw2@infradead.org>
6  *
7  * Created by David Woodhouse <dwmw2@infradead.org>
8  *
9  * For licensing information, see the file 'LICENCE' in this directory.
10  *
11  */
12
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15 #include <linux/kernel.h>
16 #include <linux/slab.h>
17 #include <linux/mtd/mtd.h>
18 #include <linux/compiler.h>
19 #include <linux/crc32.h>
20 #include <linux/sched.h>
21 #include <linux/pagemap.h>
22 #include "nodelist.h"
23
24 static void jffs2_erase_failed(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, uint32_t bad_offset);
25 static void jffs2_erase_succeeded(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
26 static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
27
28 static void jffs2_erase_block(struct jffs2_sb_info *c,
29                               struct jffs2_eraseblock *jeb)
30 {
31         int ret;
32         uint32_t bad_offset;
33 #ifdef __ECOS
34        ret = jffs2_flash_erase(c, jeb);
35        if (!ret) {
36                jffs2_erase_succeeded(c, jeb);
37                return;
38        }
39        bad_offset = jeb->offset;
40 #else /* Linux */
41         struct erase_info *instr;
42
43         jffs2_dbg(1, "%s(): erase block %#08x (range %#08x-%#08x)\n",
44                   __func__,
45                   jeb->offset, jeb->offset, jeb->offset + c->sector_size);
46         instr = kmalloc(sizeof(struct erase_info), GFP_KERNEL);
47         if (!instr) {
48                 pr_warn("kmalloc for struct erase_info in jffs2_erase_block failed. Refiling block for later\n");
49                 mutex_lock(&c->erase_free_sem);
50                 spin_lock(&c->erase_completion_lock);
51                 list_move(&jeb->list, &c->erase_pending_list);
52                 c->erasing_size -= c->sector_size;
53                 c->dirty_size += c->sector_size;
54                 jeb->dirty_size = c->sector_size;
55                 spin_unlock(&c->erase_completion_lock);
56                 mutex_unlock(&c->erase_free_sem);
57                 return;
58         }
59
60         memset(instr, 0, sizeof(*instr));
61
62         instr->addr = jeb->offset;
63         instr->len = c->sector_size;
64
65         ret = mtd_erase(c->mtd, instr);
66         if (!ret) {
67                 jffs2_erase_succeeded(c, jeb);
68                 kfree(instr);
69                 return;
70         }
71
72         bad_offset = instr->fail_addr;
73         kfree(instr);
74 #endif /* __ECOS */
75
76         if (ret == -ENOMEM || ret == -EAGAIN) {
77                 /* Erase failed immediately. Refile it on the list */
78                 jffs2_dbg(1, "Erase at 0x%08x failed: %d. Refiling on erase_pending_list\n",
79                           jeb->offset, ret);
80                 mutex_lock(&c->erase_free_sem);
81                 spin_lock(&c->erase_completion_lock);
82                 list_move(&jeb->list, &c->erase_pending_list);
83                 c->erasing_size -= c->sector_size;
84                 c->dirty_size += c->sector_size;
85                 jeb->dirty_size = c->sector_size;
86                 spin_unlock(&c->erase_completion_lock);
87                 mutex_unlock(&c->erase_free_sem);
88                 return;
89         }
90
91         if (ret == -EROFS)
92                 pr_warn("Erase at 0x%08x failed immediately: -EROFS. Is the sector locked?\n",
93                         jeb->offset);
94         else
95                 pr_warn("Erase at 0x%08x failed immediately: errno %d\n",
96                         jeb->offset, ret);
97
98         jffs2_erase_failed(c, jeb, bad_offset);
99 }
100
101 int jffs2_erase_pending_blocks(struct jffs2_sb_info *c, int count)
102 {
103         struct jffs2_eraseblock *jeb;
104         int work_done = 0;
105
106         mutex_lock(&c->erase_free_sem);
107
108         spin_lock(&c->erase_completion_lock);
109
110         while (!list_empty(&c->erase_complete_list) ||
111                !list_empty(&c->erase_pending_list)) {
112
113                 if (!list_empty(&c->erase_complete_list)) {
114                         jeb = list_entry(c->erase_complete_list.next, struct jffs2_eraseblock, list);
115                         list_move(&jeb->list, &c->erase_checking_list);
116                         spin_unlock(&c->erase_completion_lock);
117                         mutex_unlock(&c->erase_free_sem);
118                         jffs2_mark_erased_block(c, jeb);
119
120                         work_done++;
121                         if (!--count) {
122                                 jffs2_dbg(1, "Count reached. jffs2_erase_pending_blocks leaving\n");
123                                 goto done;
124                         }
125
126                 } else if (!list_empty(&c->erase_pending_list)) {
127                         jeb = list_entry(c->erase_pending_list.next, struct jffs2_eraseblock, list);
128                         jffs2_dbg(1, "Starting erase of pending block 0x%08x\n",
129                                   jeb->offset);
130                         list_del(&jeb->list);
131                         c->erasing_size += c->sector_size;
132                         c->wasted_size -= jeb->wasted_size;
133                         c->free_size -= jeb->free_size;
134                         c->used_size -= jeb->used_size;
135                         c->dirty_size -= jeb->dirty_size;
136                         jeb->wasted_size = jeb->used_size = jeb->dirty_size = jeb->free_size = 0;
137                         jffs2_free_jeb_node_refs(c, jeb);
138                         list_add(&jeb->list, &c->erasing_list);
139                         spin_unlock(&c->erase_completion_lock);
140                         mutex_unlock(&c->erase_free_sem);
141
142                         jffs2_erase_block(c, jeb);
143
144                 } else {
145                         BUG();
146                 }
147
148                 /* Be nice */
149                 cond_resched();
150                 mutex_lock(&c->erase_free_sem);
151                 spin_lock(&c->erase_completion_lock);
152         }
153
154         spin_unlock(&c->erase_completion_lock);
155         mutex_unlock(&c->erase_free_sem);
156  done:
157         jffs2_dbg(1, "jffs2_erase_pending_blocks completed\n");
158         return work_done;
159 }
160
161 static void jffs2_erase_succeeded(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
162 {
163         jffs2_dbg(1, "Erase completed successfully at 0x%08x\n", jeb->offset);
164         mutex_lock(&c->erase_free_sem);
165         spin_lock(&c->erase_completion_lock);
166         list_move_tail(&jeb->list, &c->erase_complete_list);
167         /* Wake the GC thread to mark them clean */
168         jffs2_garbage_collect_trigger(c);
169         spin_unlock(&c->erase_completion_lock);
170         mutex_unlock(&c->erase_free_sem);
171         wake_up(&c->erase_wait);
172 }
173
174 static void jffs2_erase_failed(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, uint32_t bad_offset)
175 {
176         /* For NAND, if the failure did not occur at the device level for a
177            specific physical page, don't bother updating the bad block table. */
178         if (jffs2_cleanmarker_oob(c) && (bad_offset != (uint32_t)MTD_FAIL_ADDR_UNKNOWN)) {
179                 /* We had a device-level failure to erase.  Let's see if we've
180                    failed too many times. */
181                 if (!jffs2_write_nand_badblock(c, jeb, bad_offset)) {
182                         /* We'd like to give this block another try. */
183                         mutex_lock(&c->erase_free_sem);
184                         spin_lock(&c->erase_completion_lock);
185                         list_move(&jeb->list, &c->erase_pending_list);
186                         c->erasing_size -= c->sector_size;
187                         c->dirty_size += c->sector_size;
188                         jeb->dirty_size = c->sector_size;
189                         spin_unlock(&c->erase_completion_lock);
190                         mutex_unlock(&c->erase_free_sem);
191                         return;
192                 }
193         }
194
195         mutex_lock(&c->erase_free_sem);
196         spin_lock(&c->erase_completion_lock);
197         c->erasing_size -= c->sector_size;
198         c->bad_size += c->sector_size;
199         list_move(&jeb->list, &c->bad_list);
200         c->nr_erasing_blocks--;
201         spin_unlock(&c->erase_completion_lock);
202         mutex_unlock(&c->erase_free_sem);
203         wake_up(&c->erase_wait);
204 }
205
206 /* Hmmm. Maybe we should accept the extra space it takes and make
207    this a standard doubly-linked list? */
208 static inline void jffs2_remove_node_refs_from_ino_list(struct jffs2_sb_info *c,
209                         struct jffs2_raw_node_ref *ref, struct jffs2_eraseblock *jeb)
210 {
211         struct jffs2_inode_cache *ic = NULL;
212         struct jffs2_raw_node_ref **prev;
213
214         prev = &ref->next_in_ino;
215
216         /* Walk the inode's list once, removing any nodes from this eraseblock */
217         while (1) {
218                 if (!(*prev)->next_in_ino) {
219                         /* We're looking at the jffs2_inode_cache, which is
220                            at the end of the linked list. Stash it and continue
221                            from the beginning of the list */
222                         ic = (struct jffs2_inode_cache *)(*prev);
223                         prev = &ic->nodes;
224                         continue;
225                 }
226
227                 if (SECTOR_ADDR((*prev)->flash_offset) == jeb->offset) {
228                         /* It's in the block we're erasing */
229                         struct jffs2_raw_node_ref *this;
230
231                         this = *prev;
232                         *prev = this->next_in_ino;
233                         this->next_in_ino = NULL;
234
235                         if (this == ref)
236                                 break;
237
238                         continue;
239                 }
240                 /* Not to be deleted. Skip */
241                 prev = &((*prev)->next_in_ino);
242         }
243
244         /* PARANOIA */
245         if (!ic) {
246                 JFFS2_WARNING("inode_cache/xattr_datum/xattr_ref"
247                               " not found in remove_node_refs()!!\n");
248                 return;
249         }
250
251         jffs2_dbg(1, "Removed nodes in range 0x%08x-0x%08x from ino #%u\n",
252                   jeb->offset, jeb->offset + c->sector_size, ic->ino);
253
254         D2({
255                 int i=0;
256                 struct jffs2_raw_node_ref *this;
257                 printk(KERN_DEBUG "After remove_node_refs_from_ino_list: \n");
258
259                 this = ic->nodes;
260
261                 printk(KERN_DEBUG);
262                 while(this) {
263                         pr_cont("0x%08x(%d)->",
264                                ref_offset(this), ref_flags(this));
265                         if (++i == 5) {
266                                 printk(KERN_DEBUG);
267                                 i=0;
268                         }
269                         this = this->next_in_ino;
270                 }
271                 pr_cont("\n");
272         });
273
274         switch (ic->class) {
275 #ifdef CONFIG_JFFS2_FS_XATTR
276                 case RAWNODE_CLASS_XATTR_DATUM:
277                         jffs2_release_xattr_datum(c, (struct jffs2_xattr_datum *)ic);
278                         break;
279                 case RAWNODE_CLASS_XATTR_REF:
280                         jffs2_release_xattr_ref(c, (struct jffs2_xattr_ref *)ic);
281                         break;
282 #endif
283                 default:
284                         if (ic->nodes == (void *)ic && ic->pino_nlink == 0)
285                                 jffs2_del_ino_cache(c, ic);
286         }
287 }
288
289 void jffs2_free_jeb_node_refs(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
290 {
291         struct jffs2_raw_node_ref *block, *ref;
292         jffs2_dbg(1, "Freeing all node refs for eraseblock offset 0x%08x\n",
293                   jeb->offset);
294
295         block = ref = jeb->first_node;
296
297         while (ref) {
298                 if (ref->flash_offset == REF_LINK_NODE) {
299                         ref = ref->next_in_ino;
300                         jffs2_free_refblock(block);
301                         block = ref;
302                         continue;
303                 }
304                 if (ref->flash_offset != REF_EMPTY_NODE && ref->next_in_ino)
305                         jffs2_remove_node_refs_from_ino_list(c, ref, jeb);
306                 /* else it was a non-inode node or already removed, so don't bother */
307
308                 ref++;
309         }
310         jeb->first_node = jeb->last_node = NULL;
311 }
312
313 static int jffs2_block_check_erase(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, uint32_t *bad_offset)
314 {
315         void *ebuf;
316         uint32_t ofs;
317         size_t retlen;
318         int ret;
319         unsigned long *wordebuf;
320
321         ret = mtd_point(c->mtd, jeb->offset, c->sector_size, &retlen,
322                         &ebuf, NULL);
323         if (ret != -EOPNOTSUPP) {
324                 if (ret) {
325                         jffs2_dbg(1, "MTD point failed %d\n", ret);
326                         goto do_flash_read;
327                 }
328                 if (retlen < c->sector_size) {
329                         /* Don't muck about if it won't let us point to the whole erase sector */
330                         jffs2_dbg(1, "MTD point returned len too short: 0x%zx\n",
331                                   retlen);
332                         mtd_unpoint(c->mtd, jeb->offset, retlen);
333                         goto do_flash_read;
334                 }
335                 wordebuf = ebuf-sizeof(*wordebuf);
336                 retlen /= sizeof(*wordebuf);
337                 do {
338                    if (*++wordebuf != ~0)
339                            break;
340                 } while(--retlen);
341                 mtd_unpoint(c->mtd, jeb->offset, c->sector_size);
342                 if (retlen) {
343                         pr_warn("Newly-erased block contained word 0x%lx at offset 0x%08tx\n",
344                                 *wordebuf,
345                                 jeb->offset +
346                                 c->sector_size-retlen * sizeof(*wordebuf));
347                         return -EIO;
348                 }
349                 return 0;
350         }
351  do_flash_read:
352         ebuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
353         if (!ebuf) {
354                 pr_warn("Failed to allocate page buffer for verifying erase at 0x%08x. Refiling\n",
355                         jeb->offset);
356                 return -EAGAIN;
357         }
358
359         jffs2_dbg(1, "Verifying erase at 0x%08x\n", jeb->offset);
360
361         for (ofs = jeb->offset; ofs < jeb->offset + c->sector_size; ) {
362                 uint32_t readlen = min((uint32_t)PAGE_SIZE, jeb->offset + c->sector_size - ofs);
363                 int i;
364
365                 *bad_offset = ofs;
366
367                 ret = mtd_read(c->mtd, ofs, readlen, &retlen, ebuf);
368                 if (ret) {
369                         pr_warn("Read of newly-erased block at 0x%08x failed: %d. Putting on bad_list\n",
370                                 ofs, ret);
371                         ret = -EIO;
372                         goto fail;
373                 }
374                 if (retlen != readlen) {
375                         pr_warn("Short read from newly-erased block at 0x%08x. Wanted %d, got %zd\n",
376                                 ofs, readlen, retlen);
377                         ret = -EIO;
378                         goto fail;
379                 }
380                 for (i=0; i<readlen; i += sizeof(unsigned long)) {
381                         /* It's OK. We know it's properly aligned */
382                         unsigned long *datum = ebuf + i;
383                         if (*datum + 1) {
384                                 *bad_offset += i;
385                                 pr_warn("Newly-erased block contained word 0x%lx at offset 0x%08x\n",
386                                         *datum, *bad_offset);
387                                 ret = -EIO;
388                                 goto fail;
389                         }
390                 }
391                 ofs += readlen;
392                 cond_resched();
393         }
394         ret = 0;
395 fail:
396         kfree(ebuf);
397         return ret;
398 }
399
400 static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
401 {
402         size_t retlen;
403         int ret;
404         uint32_t bad_offset;
405
406         switch (jffs2_block_check_erase(c, jeb, &bad_offset)) {
407         case -EAGAIN:   goto refile;
408         case -EIO:      goto filebad;
409         }
410
411         /* Write the erase complete marker */
412         jffs2_dbg(1, "Writing erased marker to block at 0x%08x\n", jeb->offset);
413         bad_offset = jeb->offset;
414
415         /* Cleanmarker in oob area or no cleanmarker at all ? */
416         if (jffs2_cleanmarker_oob(c) || c->cleanmarker_size == 0) {
417
418                 if (jffs2_cleanmarker_oob(c)) {
419                         if (jffs2_write_nand_cleanmarker(c, jeb))
420                                 goto filebad;
421                 }
422         } else {
423
424                 struct kvec vecs[1];
425                 struct jffs2_unknown_node marker = {
426                         .magic =        cpu_to_je16(JFFS2_MAGIC_BITMASK),
427                         .nodetype =     cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
428                         .totlen =       cpu_to_je32(c->cleanmarker_size)
429                 };
430
431                 jffs2_prealloc_raw_node_refs(c, jeb, 1);
432
433                 marker.hdr_crc = cpu_to_je32(crc32(0, &marker, sizeof(struct jffs2_unknown_node)-4));
434
435                 vecs[0].iov_base = (unsigned char *) &marker;
436                 vecs[0].iov_len = sizeof(marker);
437                 ret = jffs2_flash_direct_writev(c, vecs, 1, jeb->offset, &retlen);
438
439                 if (ret || retlen != sizeof(marker)) {
440                         if (ret)
441                                 pr_warn("Write clean marker to block at 0x%08x failed: %d\n",
442                                        jeb->offset, ret);
443                         else
444                                 pr_warn("Short write to newly-erased block at 0x%08x: Wanted %zd, got %zd\n",
445                                        jeb->offset, sizeof(marker), retlen);
446
447                         goto filebad;
448                 }
449         }
450         /* Everything else got zeroed before the erase */
451         jeb->free_size = c->sector_size;
452
453         mutex_lock(&c->erase_free_sem);
454         spin_lock(&c->erase_completion_lock);
455
456         c->erasing_size -= c->sector_size;
457         c->free_size += c->sector_size;
458
459         /* Account for cleanmarker now, if it's in-band */
460         if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c))
461                 jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
462
463         list_move_tail(&jeb->list, &c->free_list);
464         c->nr_erasing_blocks--;
465         c->nr_free_blocks++;
466
467         jffs2_dbg_acct_sanity_check_nolock(c, jeb);
468         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
469
470         spin_unlock(&c->erase_completion_lock);
471         mutex_unlock(&c->erase_free_sem);
472         wake_up(&c->erase_wait);
473         return;
474
475 filebad:
476         jffs2_erase_failed(c, jeb, bad_offset);
477         return;
478
479 refile:
480         /* Stick it back on the list from whence it came and come back later */
481         mutex_lock(&c->erase_free_sem);
482         spin_lock(&c->erase_completion_lock);
483         jffs2_garbage_collect_trigger(c);
484         list_move(&jeb->list, &c->erase_complete_list);
485         spin_unlock(&c->erase_completion_lock);
486         mutex_unlock(&c->erase_free_sem);
487         return;
488 }