--- /dev/null
+diff --git a/drivers/mtd/ubi/Kconfig b/drivers/mtd/ubi/Kconfig
+index 3cf193f..4dcc752 100644
+--- a/drivers/mtd/ubi/Kconfig
++++ b/drivers/mtd/ubi/Kconfig
+@@ -52,6 +52,12 @@ config MTD_UBI_GLUEBI
+ work on top of UBI. Do not enable this unless you use legacy
+ software.
+
+-source "drivers/mtd/ubi/Kconfig.debug"
++config MTD_UBI_DEBUG
++ bool "UBI debugging"
++ depends on SYSFS
++ select DEBUG_FS
++ select KALLSYMS
++ help
++ This option enables UBI debugging.
+
+ endif # MTD_UBI
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index fba2b66..ba73c00 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -690,11 +690,25 @@ static int io_init(struct ubi_device *ubi)
+ ubi_assert(ubi->hdrs_min_io_size <= ubi->min_io_size);
+ ubi_assert(ubi->min_io_size % ubi->hdrs_min_io_size == 0);
+
++ ubi->max_write_size = ubi->mtd->writebufsize;
++ /*
++ * Maximum write size has to be greater or equivalent to min. I/O
++ * size, and be multiple of min. I/O size.
++ */
++ if (ubi->max_write_size < ubi->min_io_size ||
++ ubi->max_write_size % ubi->min_io_size ||
++ !is_power_of_2(ubi->max_write_size)) {
++ ubi_err("bad write buffer size %d for %d min. I/O unit",
++ ubi->max_write_size, ubi->min_io_size);
++ return -EINVAL;
++ }
++
+ /* Calculate default aligned sizes of EC and VID headers */
+ ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
+ ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
+
+ dbg_msg("min_io_size %d", ubi->min_io_size);
++ dbg_msg("max_write_size %d", ubi->max_write_size);
+ dbg_msg("hdrs_min_io_size %d", ubi->hdrs_min_io_size);
+ dbg_msg("ec_hdr_alsize %d", ubi->ec_hdr_alsize);
+ dbg_msg("vid_hdr_alsize %d", ubi->vid_hdr_alsize);
+@@ -711,7 +725,7 @@ static int io_init(struct ubi_device *ubi)
+ }
+
+ /* Similar for the data offset */
+- ubi->leb_start = ubi->vid_hdr_offset + UBI_EC_HDR_SIZE;
++ ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE;
+ ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);
+
+ dbg_msg("vid_hdr_offset %d", ubi->vid_hdr_offset);
+@@ -923,31 +937,26 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
+ spin_lock_init(&ubi->volumes_lock);
+
+ ubi_msg("attaching mtd%d to ubi%d", mtd->index, ubi_num);
++ dbg_msg("sizeof(struct ubi_scan_leb) %zu", sizeof(struct ubi_scan_leb));
++ dbg_msg("sizeof(struct ubi_wl_entry) %zu", sizeof(struct ubi_wl_entry));
+
+ err = io_init(ubi);
+ if (err)
+ goto out_free;
+
+ err = -ENOMEM;
+- ubi->peb_buf1 = vmalloc(ubi->peb_size);
+- if (!ubi->peb_buf1)
++ ubi->peb_buf = vmalloc(ubi->peb_size);
++ if (!ubi->peb_buf)
+ goto out_free;
+
+- ubi->peb_buf2 = vmalloc(ubi->peb_size);
+- if (!ubi->peb_buf2)
+- goto out_free;
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
+- mutex_init(&ubi->dbg_buf_mutex);
+- ubi->dbg_peb_buf = vmalloc(ubi->peb_size);
+- if (!ubi->dbg_peb_buf)
++ err = ubi_debugging_init_dev(ubi);
++ if (err)
+ goto out_free;
+-#endif
+
+ err = attach_by_scanning(ubi);
+ if (err) {
+ dbg_err("failed to attach by scanning, error %d", err);
+- goto out_free;
++ goto out_debugging;
+ }
+
+ if (ubi->autoresize_vol_id != -1) {
+@@ -960,12 +969,16 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
+ if (err)
+ goto out_detach;
+
++ err = ubi_debugfs_init_dev(ubi);
++ if (err)
++ goto out_uif;
++
+ ubi->bgt_thread = kthread_create(ubi_thread, ubi, ubi->bgt_name);
+ if (IS_ERR(ubi->bgt_thread)) {
+ err = PTR_ERR(ubi->bgt_thread);
+ ubi_err("cannot spawn \"%s\", error %d", ubi->bgt_name,
+ err);
+- goto out_uif;
++ goto out_debugfs;
+ }
+
+ ubi_msg("attached mtd%d to ubi%d", mtd->index, ubi_num);
+@@ -991,8 +1004,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
+ * checks @ubi->thread_enabled. Otherwise we may fail to wake it up.
+ */
+ spin_lock(&ubi->wl_lock);
+- if (!DBG_DISABLE_BGT)
+- ubi->thread_enabled = 1;
++ ubi->thread_enabled = 1;
+ wake_up_process(ubi->bgt_thread);
+ spin_unlock(&ubi->wl_lock);
+
+@@ -1000,18 +1012,20 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
+ ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);
+ return ubi_num;
+
++out_debugfs:
++ ubi_debugfs_exit_dev(ubi);
+ out_uif:
++ get_device(&ubi->dev);
++ ubi_assert(ref);
+ uif_close(ubi);
+ out_detach:
+ ubi_wl_close(ubi);
+ free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
++out_debugging:
++ ubi_debugging_exit_dev(ubi);
+ out_free:
+- vfree(ubi->peb_buf1);
+- vfree(ubi->peb_buf2);
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
+- vfree(ubi->dbg_peb_buf);
+-#endif
++ vfree(ubi->peb_buf);
+ if (ref)
+ put_device(&ubi->dev);
+ else
+@@ -1075,16 +1089,14 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ */
+ get_device(&ubi->dev);
+
++ ubi_debugfs_exit_dev(ubi);
+ uif_close(ubi);
+ ubi_wl_close(ubi);
+ free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+ put_mtd_device(ubi->mtd);
+- vfree(ubi->peb_buf1);
+- vfree(ubi->peb_buf2);
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
+- vfree(ubi->dbg_peb_buf);
+-#endif
++ ubi_debugging_exit_dev(ubi);
++ vfree(ubi->peb_buf);
+ ubi_msg("mtd%d is detached from ubi%d", ubi->mtd->index, ubi->ubi_num);
+ put_device(&ubi->dev);
+ return 0;
+@@ -1197,6 +1209,11 @@ static int __init ubi_init(void)
+ if (!ubi_wl_entry_slab)
+ goto out_dev_unreg;
+
++ err = ubi_debugfs_init();
++ if (err)
++ goto out_slab;
++
++
+ /* Attach MTD devices */
+ for (i = 0; i < mtd_devs; i++) {
+ struct mtd_dev_param *p = &mtd_dev_param[i];
+@@ -1245,6 +1262,8 @@ out_detach:
+ ubi_detach_mtd_dev(ubi_devices[k]->ubi_num, 1);
+ mutex_unlock(&ubi_devices_mutex);
+ }
++ ubi_debugfs_exit();
++out_slab:
+ kmem_cache_destroy(ubi_wl_entry_slab);
+ out_dev_unreg:
+ misc_deregister(&ubi_ctrl_cdev);
+@@ -1256,11 +1275,7 @@ out:
+ ubi_err("UBI error: cannot initialize UBI, error %d", err);
+ return err;
+ }
+-#if defined(CONFIG_BRCMSTB) && !defined(MODULE)
+-late_initcall(ubi_init); /* need to wait for the MTD driver */
+-#else
+ module_init(ubi_init);
+-#endif
+
+ static void __exit ubi_exit(void)
+ {
+@@ -1272,6 +1287,7 @@ static void __exit ubi_exit(void)
+ ubi_detach_mtd_dev(ubi_devices[i]->ubi_num, 1);
+ mutex_unlock(&ubi_devices_mutex);
+ }
++ ubi_debugfs_exit();
+ kmem_cache_destroy(ubi_wl_entry_slab);
+ misc_deregister(&ubi_ctrl_cdev);
+ class_remove_file(ubi_class, &ubi_version);
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index af9fb0f..cdea669 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -115,7 +115,7 @@ static int vol_cdev_open(struct inode *inode, struct file *file)
+ mode = UBI_READONLY;
+
+ dbg_gen("open device %d, volume %d, mode %d",
+- ubi_num, vol_id, mode);
++ ubi_num, vol_id, mode);
+
+ desc = ubi_open_volume(ubi_num, vol_id, mode);
+ if (IS_ERR(desc))
+@@ -158,7 +158,7 @@ static loff_t vol_cdev_llseek(struct file *file, loff_t offset, int origin)
+ loff_t new_offset;
+
+ if (vol->updating) {
+- /* Update is in progress, seeking is prohibited */
++ /* Update is in progress, seeking is prohibited */
+ dbg_err("updating");
+ return -EBUSY;
+ }
+@@ -561,18 +561,18 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ }
+
+ /* Set volume property command */
+- case UBI_IOCSETPROP:
++ case UBI_IOCSETVOLPROP:
+ {
+- struct ubi_set_prop_req req;
++ struct ubi_set_vol_prop_req req;
+
+ err = copy_from_user(&req, argp,
+- sizeof(struct ubi_set_prop_req));
++ sizeof(struct ubi_set_vol_prop_req));
+ if (err) {
+ err = -EFAULT;
+ break;
+ }
+ switch (req.property) {
+- case UBI_PROP_DIRECT_WRITE:
++ case UBI_VOL_PROP_DIRECT_WRITE:
+ mutex_lock(&ubi->device_mutex);
+ desc->vol->direct_writes = !!req.value;
+ mutex_unlock(&ubi->device_mutex);
+@@ -628,6 +628,9 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
+ if (req->alignment != 1 && n)
+ goto bad;
+
++ if (!req->name[0] || !req->name_len)
++ goto bad;
++
+ if (req->name_len > UBI_VOL_NAME_MAX) {
+ err = -ENAMETOOLONG;
+ goto bad;
+@@ -1100,5 +1103,5 @@ const struct file_operations ubi_ctrl_cdev_operations = {
+ .owner = THIS_MODULE,
+ .unlocked_ioctl = ctrl_cdev_ioctl,
+ .compat_ioctl = ctrl_cdev_compat_ioctl,
+- .llseek = noop_llseek,
++ .llseek = no_llseek,
+ };
+diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
+index 4876977..ab80c0d 100644
+--- a/drivers/mtd/ubi/debug.c
++++ b/drivers/mtd/ubi/debug.c
+@@ -27,6 +27,9 @@
+ #ifdef CONFIG_MTD_UBI_DEBUG
+
+ #include "ubi.h"
++#include <linux/debugfs.h>
++#include <linux/uaccess.h>
++#include <linux/module.h>
+
+ /**
+ * ubi_dbg_dump_ec_hdr - dump an erase counter header.
+@@ -61,15 +64,15 @@ void ubi_dbg_dump_vid_hdr(const struct ubi_vid_hdr *vid_hdr)
+ {
+ printk(KERN_DEBUG "Volume identifier header dump:\n");
+ printk(KERN_DEBUG "\tmagic %08x\n", be32_to_cpu(vid_hdr->magic));
+- printk(KERN_DEBUG "\tversion %d\n", (int)vid_hdr->version);
+- printk(KERN_DEBUG "\tvol_type %d\n", (int)vid_hdr->vol_type);
+- printk(KERN_DEBUG "\tcopy_flag %d\n", (int)vid_hdr->copy_flag);
+- printk(KERN_DEBUG "\tcompat %d\n", (int)vid_hdr->compat);
+- printk(KERN_DEBUG "\tvol_id %d\n", be32_to_cpu(vid_hdr->vol_id));
+- printk(KERN_DEBUG "\tlnum %d\n", be32_to_cpu(vid_hdr->lnum));
+- printk(KERN_DEBUG "\tdata_size %d\n", be32_to_cpu(vid_hdr->data_size));
+- printk(KERN_DEBUG "\tused_ebs %d\n", be32_to_cpu(vid_hdr->used_ebs));
+- printk(KERN_DEBUG "\tdata_pad %d\n", be32_to_cpu(vid_hdr->data_pad));
++ printk(KERN_DEBUG "\tversion %d\n", (int)vid_hdr->version);
++ printk(KERN_DEBUG "\tvol_type %d\n", (int)vid_hdr->vol_type);
++ printk(KERN_DEBUG "\tcopy_flag %d\n", (int)vid_hdr->copy_flag);
++ printk(KERN_DEBUG "\tcompat %d\n", (int)vid_hdr->compat);
++ printk(KERN_DEBUG "\tvol_id %d\n", be32_to_cpu(vid_hdr->vol_id));
++ printk(KERN_DEBUG "\tlnum %d\n", be32_to_cpu(vid_hdr->lnum));
++ printk(KERN_DEBUG "\tdata_size %d\n", be32_to_cpu(vid_hdr->data_size));
++ printk(KERN_DEBUG "\tused_ebs %d\n", be32_to_cpu(vid_hdr->used_ebs));
++ printk(KERN_DEBUG "\tdata_pad %d\n", be32_to_cpu(vid_hdr->data_pad));
+ printk(KERN_DEBUG "\tsqnum %llu\n",
+ (unsigned long long)be64_to_cpu(vid_hdr->sqnum));
+ printk(KERN_DEBUG "\thdr_crc %08x\n", be32_to_cpu(vid_hdr->hdr_crc));
+@@ -228,4 +231,261 @@ out:
+ return;
+ }
+
++/**
++ * ubi_debugging_init_dev - initialize debugging for an UBI device.
++ * @ubi: UBI device description object
++ *
++ * This function initializes debugging-related data for UBI device @ubi.
++ * Returns zero in case of success and a negative error code in case of
++ * failure.
++ */
++int ubi_debugging_init_dev(struct ubi_device *ubi)
++{
++ ubi->dbg = kzalloc(sizeof(struct ubi_debug_info), GFP_KERNEL);
++ if (!ubi->dbg)
++ return -ENOMEM;
++
++ return 0;
++}
++
++/**
++ * ubi_debugging_exit_dev - free debugging data for an UBI device.
++ * @ubi: UBI device description object
++ */
++void ubi_debugging_exit_dev(struct ubi_device *ubi)
++{
++ kfree(ubi->dbg);
++}
++
++/*
++ * Root directory for UBI stuff in debugfs. Contains sub-directories which
++ * contain the stuff specific to particular UBI devices.
++ */
++static struct dentry *dfs_rootdir;
++
++/**
++ * ubi_debugfs_init - create UBI debugfs directory.
++ *
++ * Create UBI debugfs directory. Returns zero in case of success and a negative
++ * error code in case of failure.
++ */
++int ubi_debugfs_init(void)
++{
++ dfs_rootdir = debugfs_create_dir("ubi", NULL);
++ if (IS_ERR_OR_NULL(dfs_rootdir)) {
++ int err = dfs_rootdir ? -ENODEV : PTR_ERR(dfs_rootdir);
++
++ ubi_err("cannot create \"ubi\" debugfs directory, error %d\n",
++ err);
++ return err;
++ }
++
++ return 0;
++}
++
++/**
++ * ubi_debugfs_exit - remove UBI debugfs directory.
++ */
++void ubi_debugfs_exit(void)
++{
++ debugfs_remove(dfs_rootdir);
++}
++
++/* Read an UBI debugfs file */
++static ssize_t dfs_file_read(struct file *file, char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ unsigned long ubi_num = (unsigned long)file->private_data;
++ struct dentry *dent = file->f_path.dentry;
++ struct ubi_device *ubi;
++ struct ubi_debug_info *d;
++ char buf[3];
++ int val;
++
++ ubi = ubi_get_device(ubi_num);
++ if (!ubi)
++ return -ENODEV;
++ d = ubi->dbg;
++
++ if (dent == d->dfs_chk_gen)
++ val = d->chk_gen;
++ else if (dent == d->dfs_chk_io)
++ val = d->chk_io;
++ else if (dent == d->dfs_disable_bgt)
++ val = d->disable_bgt;
++ else if (dent == d->dfs_emulate_bitflips)
++ val = d->emulate_bitflips;
++ else if (dent == d->dfs_emulate_io_failures)
++ val = d->emulate_io_failures;
++ else {
++ count = -EINVAL;
++ goto out;
++ }
++
++ if (val)
++ buf[0] = '1';
++ else
++ buf[0] = '0';
++ buf[1] = '\n';
++ buf[2] = 0x00;
++
++ count = simple_read_from_buffer(user_buf, count, ppos, buf, 2);
++
++out:
++ ubi_put_device(ubi);
++ return count;
++}
++
++/* Write an UBI debugfs file */
++static ssize_t dfs_file_write(struct file *file, const char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ unsigned long ubi_num = (unsigned long)file->private_data;
++ struct dentry *dent = file->f_path.dentry;
++ struct ubi_device *ubi;
++ struct ubi_debug_info *d;
++ size_t buf_size;
++ char buf[8];
++ int val;
++
++ ubi = ubi_get_device(ubi_num);
++ if (!ubi)
++ return -ENODEV;
++ d = ubi->dbg;
++
++ buf_size = min_t(size_t, count, (sizeof(buf) - 1));
++ if (copy_from_user(buf, user_buf, buf_size)) {
++ count = -EFAULT;
++ goto out;
++ }
++
++ if (buf[0] == '1')
++ val = 1;
++ else if (buf[0] == '0')
++ val = 0;
++ else {
++ count = -EINVAL;
++ goto out;
++ }
++
++ if (dent == d->dfs_chk_gen)
++ d->chk_gen = val;
++ else if (dent == d->dfs_chk_io)
++ d->chk_io = val;
++ else if (dent == d->dfs_disable_bgt)
++ d->disable_bgt = val;
++ else if (dent == d->dfs_emulate_bitflips)
++ d->emulate_bitflips = val;
++ else if (dent == d->dfs_emulate_io_failures)
++ d->emulate_io_failures = val;
++ else
++ count = -EINVAL;
++
++out:
++ ubi_put_device(ubi);
++ return count;
++}
++
++static int default_open(struct inode *inode, struct file *file)
++{
++ if (inode->i_private)
++ file->private_data = inode->i_private;
++
++ return 0;
++}
++
++/* File operations for all UBI debugfs files */
++static const struct file_operations dfs_fops = {
++ .read = dfs_file_read,
++ .write = dfs_file_write,
++ .open = default_open,
++ .llseek = no_llseek,
++ .owner = THIS_MODULE,
++};
++
++/**
++ * ubi_debugfs_init_dev - initialize debugfs for an UBI device.
++ * @ubi: UBI device description object
++ *
++ * This function creates all debugfs files for UBI device @ubi. Returns zero in
++ * case of success and a negative error code in case of failure.
++ */
++int ubi_debugfs_init_dev(struct ubi_device *ubi)
++{
++ int err, n;
++ unsigned long ubi_num = ubi->ubi_num;
++ const char *fname;
++ struct dentry *dent;
++ struct ubi_debug_info *d = ubi->dbg;
++
++ n = snprintf(d->dfs_dir_name, UBI_DFS_DIR_LEN + 1, UBI_DFS_DIR_NAME,
++ ubi->ubi_num);
++ if (n == UBI_DFS_DIR_LEN) {
++ /* The array size is too small */
++ fname = UBI_DFS_DIR_NAME;
++ dent = ERR_PTR(-EINVAL);
++ goto out;
++ }
++
++ fname = d->dfs_dir_name;
++ dent = debugfs_create_dir(fname, dfs_rootdir);
++ if (IS_ERR_OR_NULL(dent))
++ goto out;
++ d->dfs_dir = dent;
++
++ fname = "chk_gen";
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, (void *)ubi_num,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_gen = dent;
++
++ fname = "chk_io";
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, (void *)ubi_num,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_io = dent;
++
++ fname = "tst_disable_bgt";
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, (void *)ubi_num,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_disable_bgt = dent;
++
++ fname = "tst_emulate_bitflips";
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, (void *)ubi_num,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_emulate_bitflips = dent;
++
++ fname = "tst_emulate_io_failures";
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, (void *)ubi_num,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_emulate_io_failures = dent;
++
++ return 0;
++
++out_remove:
++ debugfs_remove_recursive(d->dfs_dir);
++out:
++ err = dent ? PTR_ERR(dent) : -ENODEV;
++ ubi_err("cannot create \"%s\" debugfs file or directory, error %d\n",
++ fname, err);
++ return err;
++}
++
++/**
++ * dbg_debug_exit_dev - free all debugfs files corresponding to device @ubi
++ * @ubi: UBI device description object
++ */
++void ubi_debugfs_exit_dev(struct ubi_device *ubi)
++{
++ debugfs_remove_recursive(ubi->dbg->dfs_dir);
++}
++
+ #endif /* CONFIG_MTD_UBI_DEBUG */
+diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
+index 9eca950..8c513ee 100644
+--- a/drivers/mtd/ubi/debug.h
++++ b/drivers/mtd/ubi/debug.h
+@@ -24,8 +24,6 @@
+ #ifdef CONFIG_MTD_UBI_DEBUG
+ #include <linux/random.h>
+
+-#define dbg_err(fmt, ...) ubi_err(fmt, ##__VA_ARGS__)
+-
+ #define ubi_assert(expr) do { \
+ if (unlikely(!(expr))) { \
+ printk(KERN_CRIT "UBI assert failed in %s at %u (pid %d)\n", \
+@@ -34,19 +32,31 @@
+ } \
+ } while (0)
+
++#define dbg_err(fmt, ...) ubi_err(fmt, ##__VA_ARGS__)
++
++#define ubi_dbg_dump_stack() dump_stack()
++
++#define ubi_dbg_print_hex_dump(l, ps, pt, r, g, b, len, a) \
++ print_hex_dump(l, ps, pt, r, g, b, len, a)
++
++#define ubi_dbg_msg(type, fmt, ...) \
++ pr_debug("UBI DBG " type ": " fmt "\n", ##__VA_ARGS__)
++
++/* Just a debugging messages not related to any specific UBI subsystem */
+ #define dbg_msg(fmt, ...) \
+ printk(KERN_DEBUG "UBI DBG (pid %d): %s: " fmt "\n", \
+ current->pid, __func__, ##__VA_ARGS__)
+
+-#define ubi_dbg_dump_stack() dump_stack()
+-
+-struct ubi_ec_hdr;
+-struct ubi_vid_hdr;
+-struct ubi_volume;
+-struct ubi_vtbl_record;
+-struct ubi_scan_volume;
+-struct ubi_scan_leb;
+-struct ubi_mkvol_req;
++/* General debugging messages */
++#define dbg_gen(fmt, ...) ubi_dbg_msg("gen", fmt, ##__VA_ARGS__)
++/* Messages from the eraseblock association sub-system */
++#define dbg_eba(fmt, ...) ubi_dbg_msg("eba", fmt, ##__VA_ARGS__)
++/* Messages from the wear-leveling sub-system */
++#define dbg_wl(fmt, ...) ubi_dbg_msg("wl", fmt, ##__VA_ARGS__)
++/* Messages from the input/output sub-system */
++#define dbg_io(fmt, ...) ubi_dbg_msg("io", fmt, ##__VA_ARGS__)
++/* Initialization and build messages */
++#define dbg_bld(fmt, ...) ubi_dbg_msg("bld", fmt, ##__VA_ARGS__)
+
+ void ubi_dbg_dump_ec_hdr(const struct ubi_ec_hdr *ec_hdr);
+ void ubi_dbg_dump_vid_hdr(const struct ubi_vid_hdr *vid_hdr);
+@@ -56,134 +66,174 @@ void ubi_dbg_dump_sv(const struct ubi_scan_volume *sv);
+ void ubi_dbg_dump_seb(const struct ubi_scan_leb *seb, int type);
+ void ubi_dbg_dump_mkvol_req(const struct ubi_mkvol_req *req);
+ void ubi_dbg_dump_flash(struct ubi_device *ubi, int pnum, int offset, int len);
+-
+-#define ubi_dbg_print_hex_dump(l, ps, pt, r, g, b, len, a) \
+- print_hex_dump(l, ps, pt, r, g, b, len, a)
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_MSG
+-/* General debugging messages */
+-#define dbg_gen(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#else
+-#define dbg_gen(fmt, ...) ({})
+-#endif
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_MSG_EBA
+-/* Messages from the eraseblock association sub-system */
+-#define dbg_eba(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#else
+-#define dbg_eba(fmt, ...) ({})
+-#endif
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_MSG_WL
+-/* Messages from the wear-leveling sub-system */
+-#define dbg_wl(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#else
+-#define dbg_wl(fmt, ...) ({})
+-#endif
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_MSG_IO
+-/* Messages from the input/output sub-system */
+-#define dbg_io(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#else
+-#define dbg_io(fmt, ...) ({})
+-#endif
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_MSG_BLD
+-/* Initialization and build messages */
+-#define dbg_bld(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define UBI_IO_DEBUG 1
+-#else
+-#define dbg_bld(fmt, ...) ({})
+-#define UBI_IO_DEBUG 0
+-#endif
+-
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
+ int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len);
+ int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+ int offset, int len);
+-#else
+-#define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+-#define ubi_dbg_check_write(ubi, buf, pnum, offset, len) 0
+-#endif
++int ubi_debugging_init_dev(struct ubi_device *ubi);
++void ubi_debugging_exit_dev(struct ubi_device *ubi);
++int ubi_debugfs_init(void);
++void ubi_debugfs_exit(void);
++int ubi_debugfs_init_dev(struct ubi_device *ubi);
++void ubi_debugfs_exit_dev(struct ubi_device *ubi);
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_DISABLE_BGT
+-#define DBG_DISABLE_BGT 1
+-#else
+-#define DBG_DISABLE_BGT 0
+-#endif
++/*
++ * The UBI debugfs directory name pattern and maximum name length (3 for "ubi"
++ * + 2 for the number plus 1 for the trailing zero byte.
++ */
++#define UBI_DFS_DIR_NAME "ubi%d"
++#define UBI_DFS_DIR_LEN (3 + 2 + 1)
++
++/**
++ * struct ubi_debug_info - debugging information for an UBI device.
++ *
++ * @chk_gen: if UBI general extra checks are enabled
++ * @chk_io: if UBI I/O extra checks are enabled
++ * @disable_bgt: disable the background task for testing purposes
++ * @emulate_bitflips: emulate bit-flips for testing purposes
++ * @emulate_io_failures: emulate write/erase failures for testing purposes
++ * @dfs_dir_name: name of debugfs directory containing files of this UBI device
++ * @dfs_dir: direntry object of the UBI device debugfs directory
++ * @dfs_chk_gen: debugfs knob to enable UBI general extra checks
++ * @dfs_chk_io: debugfs knob to enable UBI I/O extra checks
++ * @dfs_disable_bgt: debugfs knob to disable the background task
++ * @dfs_emulate_bitflips: debugfs knob to emulate bit-flips
++ * @dfs_emulate_io_failures: debugfs knob to emulate write/erase failures
++ */
++struct ubi_debug_info {
++ unsigned int chk_gen:1;
++ unsigned int chk_io:1;
++ unsigned int disable_bgt:1;
++ unsigned int emulate_bitflips:1;
++ unsigned int emulate_io_failures:1;
++ char dfs_dir_name[UBI_DFS_DIR_LEN + 1];
++ struct dentry *dfs_dir;
++ struct dentry *dfs_chk_gen;
++ struct dentry *dfs_chk_io;
++ struct dentry *dfs_disable_bgt;
++ struct dentry *dfs_emulate_bitflips;
++ struct dentry *dfs_emulate_io_failures;
++};
++
++/**
++ * ubi_dbg_is_bgt_disabled - if the background thread is disabled.
++ * @ubi: UBI device description object
++ *
++ * Returns non-zero if the UBI background thread is disabled for testing
++ * purposes.
++ */
++static inline int ubi_dbg_is_bgt_disabled(const struct ubi_device *ubi)
++{
++ return ubi->dbg->disable_bgt;
++}
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_EMULATE_BITFLIPS
+ /**
+ * ubi_dbg_is_bitflip - if it is time to emulate a bit-flip.
++ * @ubi: UBI device description object
+ *
+ * Returns non-zero if a bit-flip should be emulated, otherwise returns zero.
+ */
+-static inline int ubi_dbg_is_bitflip(void)
++static inline int ubi_dbg_is_bitflip(const struct ubi_device *ubi)
+ {
+- return !(random32() % 200);
++ if (ubi->dbg->emulate_bitflips)
++ return !(random32() % 200);
++ return 0;
+ }
+-#else
+-#define ubi_dbg_is_bitflip() 0
+-#endif
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_EMULATE_WRITE_FAILURES
+ /**
+ * ubi_dbg_is_write_failure - if it is time to emulate a write failure.
++ * @ubi: UBI device description object
+ *
+ * Returns non-zero if a write failure should be emulated, otherwise returns
+ * zero.
+ */
+-static inline int ubi_dbg_is_write_failure(void)
++static inline int ubi_dbg_is_write_failure(const struct ubi_device *ubi)
+ {
+- return !(random32() % 500);
++ if (ubi->dbg->emulate_io_failures)
++ return !(random32() % 500);
++ return 0;
+ }
+-#else
+-#define ubi_dbg_is_write_failure() 0
+-#endif
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_EMULATE_ERASE_FAILURES
+ /**
+ * ubi_dbg_is_erase_failure - if its time to emulate an erase failure.
++ * @ubi: UBI device description object
+ *
+ * Returns non-zero if an erase failure should be emulated, otherwise returns
+ * zero.
+ */
+-static inline int ubi_dbg_is_erase_failure(void)
++static inline int ubi_dbg_is_erase_failure(const struct ubi_device *ubi)
+ {
++ if (ubi->dbg->emulate_io_failures)
+ return !(random32() % 400);
++ return 0;
+ }
+-#else
+-#define ubi_dbg_is_erase_failure() 0
+-#endif
+
+ #else
+
+-#define ubi_assert(expr) ({})
+-#define dbg_err(fmt, ...) ({})
+-#define dbg_msg(fmt, ...) ({})
+-#define dbg_gen(fmt, ...) ({})
+-#define dbg_eba(fmt, ...) ({})
+-#define dbg_wl(fmt, ...) ({})
+-#define dbg_io(fmt, ...) ({})
+-#define dbg_bld(fmt, ...) ({})
+-#define ubi_dbg_dump_stack() ({})
+-#define ubi_dbg_dump_ec_hdr(ec_hdr) ({})
+-#define ubi_dbg_dump_vid_hdr(vid_hdr) ({})
+-#define ubi_dbg_dump_vol_info(vol) ({})
+-#define ubi_dbg_dump_vtbl_record(r, idx) ({})
+-#define ubi_dbg_dump_sv(sv) ({})
+-#define ubi_dbg_dump_seb(seb, type) ({})
+-#define ubi_dbg_dump_mkvol_req(req) ({})
+-#define ubi_dbg_dump_flash(ubi, pnum, offset, len) ({})
+-#define ubi_dbg_print_hex_dump(l, ps, pt, r, g, b, len, a) ({})
+-
+-#define UBI_IO_DEBUG 0
+-#define DBG_DISABLE_BGT 0
+-#define ubi_dbg_is_bitflip() 0
+-#define ubi_dbg_is_write_failure() 0
+-#define ubi_dbg_is_erase_failure() 0
+-#define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+-#define ubi_dbg_check_write(ubi, buf, pnum, offset, len) 0
++/* Use "if (0)" to make compiler check arguments even if debugging is off */
++#define ubi_assert(expr) do { \
++ if (0) { \
++ printk(KERN_CRIT "UBI assert failed in %s at %u (pid %d)\n", \
++ __func__, __LINE__, current->pid); \
++ } \
++} while (0)
++
++#define dbg_err(fmt, ...) do { \
++ if (0) \
++ ubi_err(fmt, ##__VA_ARGS__); \
++} while (0)
++
++#define ubi_dbg_msg(fmt, ...) do { \
++ if (0) \
++ pr_debug(fmt "\n", ##__VA_ARGS__); \
++} while (0)
++
++#define dbg_msg(fmt, ...) ubi_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_gen(fmt, ...) ubi_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_eba(fmt, ...) ubi_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_wl(fmt, ...) ubi_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_io(fmt, ...) ubi_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_bld(fmt, ...) ubi_dbg_msg(fmt, ##__VA_ARGS__)
++
++static inline void ubi_dbg_dump_stack(void) { return; }
++static inline void
++ubi_dbg_dump_ec_hdr(const struct ubi_ec_hdr *ec_hdr) { return; }
++static inline void
++ubi_dbg_dump_vid_hdr(const struct ubi_vid_hdr *vid_hdr) { return; }
++static inline void
++ubi_dbg_dump_vol_info(const struct ubi_volume *vol) { return; }
++static inline void
++ubi_dbg_dump_vtbl_record(const struct ubi_vtbl_record *r, int idx) { return; }
++static inline void ubi_dbg_dump_sv(const struct ubi_scan_volume *sv) { return; }
++static inline void ubi_dbg_dump_seb(const struct ubi_scan_leb *seb,
++ int type) { return; }
++static inline void
++ubi_dbg_dump_mkvol_req(const struct ubi_mkvol_req *req) { return; }
++static inline void ubi_dbg_dump_flash(struct ubi_device *ubi,
++ int pnum, int offset, int len) { return; }
++static inline void
++ubi_dbg_print_hex_dump(const char *l, const char *ps, int pt, int r,
++ int g, const void *b, size_t len, bool a) { return; }
++static inline int ubi_dbg_check_all_ff(struct ubi_device *ubi,
++ int pnum, int offset,
++ int len) { return 0; }
++static inline int ubi_dbg_check_write(struct ubi_device *ubi,
++ const void *buf, int pnum,
++ int offset, int len) { return 0; }
++
++static inline int ubi_debugging_init_dev(struct ubi_device *ubi) { return 0; }
++static inline void ubi_debugging_exit_dev(struct ubi_device *ubi) { return; }
++static inline int ubi_debugfs_init(void) { return 0; }
++static inline void ubi_debugfs_exit(void) { return; }
++static inline int ubi_debugfs_init_dev(struct ubi_device *ubi) { return 0; }
++static inline void ubi_debugfs_exit_dev(struct ubi_device *ubi) { return; }
++
++static inline int
++ubi_dbg_is_bgt_disabled(const struct ubi_device *ubi) { return 0; }
++static inline int ubi_dbg_is_bitflip(const struct ubi_device *ubi) { return 0; }
++static inline int
++ubi_dbg_is_write_failure(const struct ubi_device *ubi) { return 0; }
++static inline int
++ubi_dbg_is_erase_failure(const struct ubi_device *ubi) { return 0; }
+
+ #endif /* !CONFIG_MTD_UBI_DEBUG */
+ #endif /* !__UBI_DEBUG_H__ */
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index fb7f19b..9b7f87e 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -443,7 +443,7 @@ retry:
+ if (err == UBI_IO_BITFLIPS) {
+ scrub = 1;
+ err = 0;
+- } else if (mtd_is_eccerr(err)) {
++ } else if (err == -EBADMSG) {
+ if (vol->vol_type == UBI_DYNAMIC_VOLUME)
+ goto out_unlock;
+ scrub = 1;
+@@ -529,18 +529,18 @@ retry:
+
+ data_size = offset + len;
+ mutex_lock(&ubi->buf_mutex);
+- memset(ubi->peb_buf1 + offset, 0xFF, len);
++ memset(ubi->peb_buf + offset, 0xFF, len);
+
+ /* Read everything before the area where the write failure happened */
+ if (offset > 0) {
+- err = ubi_io_read_data(ubi, ubi->peb_buf1, pnum, 0, offset);
++ err = ubi_io_read_data(ubi, ubi->peb_buf, pnum, 0, offset);
+ if (err && err != UBI_IO_BITFLIPS)
+ goto out_unlock;
+ }
+
+- memcpy(ubi->peb_buf1 + offset, buf, len);
++ memcpy(ubi->peb_buf + offset, buf, len);
+
+- err = ubi_io_write_data(ubi, ubi->peb_buf1, new_pnum, 0, data_size);
++ err = ubi_io_write_data(ubi, ubi->peb_buf, new_pnum, 0, data_size);
+ if (err) {
+ mutex_unlock(&ubi->buf_mutex);
+ goto write_error;
+@@ -979,7 +979,7 @@ static int is_error_sane(int err)
+ * physical eraseblock @to. The @vid_hdr buffer may be changed by this
+ * function. Returns:
+ * o %0 in case of success;
+- * o %MOVE_CANCEL_RACE, %MOVE_TARGET_WR_ERR, %MOVE_CANCEL_BITFLIPS, etc;
++ * o %MOVE_CANCEL_RACE, %MOVE_TARGET_WR_ERR, %MOVE_TARGET_BITFLIPS, etc;
+ * o a negative error code in case of failure.
+ */
+ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+@@ -1028,12 +1028,14 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
+ * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
+ * LEB is already locked, we just do not move it and return
+- * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.
++ * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because
++ * we do not know the reasons of the contention - it may be just a
++ * normal I/O on this LEB, so we want to re-try.
+ */
+ err = leb_write_trylock(ubi, vol_id, lnum);
+ if (err) {
+ dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
+- return MOVE_CANCEL_RACE;
++ return MOVE_RETRY;
+ }
+
+ /*
+@@ -1051,13 +1053,13 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+
+ /*
+ * OK, now the LEB is locked and we can safely start moving it. Since
+- * this function utilizes the @ubi->peb_buf1 buffer which is shared
++ * this function utilizes the @ubi->peb_buf buffer which is shared
+ * with some other functions - we lock the buffer by taking the
+ * @ubi->buf_mutex.
+ */
+ mutex_lock(&ubi->buf_mutex);
+ dbg_wl("read %d bytes of data", aldata_size);
+- err = ubi_io_read_data(ubi, ubi->peb_buf1, from, 0, aldata_size);
++ err = ubi_io_read_data(ubi, ubi->peb_buf, from, 0, aldata_size);
+ if (err && err != UBI_IO_BITFLIPS) {
+ ubi_warn("error %d while reading data from PEB %d",
+ err, from);
+@@ -1077,10 +1079,10 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ */
+ if (vid_hdr->vol_type == UBI_VID_DYNAMIC)
+ aldata_size = data_size =
+- ubi_calc_data_len(ubi, ubi->peb_buf1, data_size);
++ ubi_calc_data_len(ubi, ubi->peb_buf, data_size);
+
+ cond_resched();
+- crc = crc32(UBI_CRC32_INIT, ubi->peb_buf1, data_size);
++ crc = crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size);
+ cond_resched();
+
+ /*
+@@ -1114,12 +1116,12 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ if (is_error_sane(err))
+ err = MOVE_TARGET_RD_ERR;
+ } else
+- err = MOVE_CANCEL_BITFLIPS;
++ err = MOVE_TARGET_BITFLIPS;
+ goto out_unlock_buf;
+ }
+
+ if (data_size > 0) {
+- err = ubi_io_write_data(ubi, ubi->peb_buf1, to, 0, aldata_size);
++ err = ubi_io_write_data(ubi, ubi->peb_buf, to, 0, aldata_size);
+ if (err) {
+ if (err == -EIO)
+ err = MOVE_TARGET_WR_ERR;
+@@ -1132,8 +1134,8 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ * We've written the data and are going to read it back to make
+ * sure it was written correctly.
+ */
+-
+- err = ubi_io_read_data(ubi, ubi->peb_buf2, to, 0, aldata_size);
++ memset(ubi->peb_buf, 0xFF, aldata_size);
++ err = ubi_io_read_data(ubi, ubi->peb_buf, to, 0, aldata_size);
+ if (err) {
+ if (err != UBI_IO_BITFLIPS) {
+ ubi_warn("error %d while reading data back "
+@@ -1141,13 +1143,13 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ if (is_error_sane(err))
+ err = MOVE_TARGET_RD_ERR;
+ } else
+- err = MOVE_CANCEL_BITFLIPS;
++ err = MOVE_TARGET_BITFLIPS;
+ goto out_unlock_buf;
+ }
+
+ cond_resched();
+
+- if (memcmp(ubi->peb_buf1, ubi->peb_buf2, aldata_size)) {
++ if (crc != crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size)) {
+ ubi_warn("read data back from PEB %d and it is "
+ "different", to);
+ err = -EINVAL;
+diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
+index 8ca890c..2614dcc 100644
+--- a/drivers/mtd/ubi/io.c
++++ b/drivers/mtd/ubi/io.c
+@@ -91,7 +91,7 @@
+ #include <linux/slab.h>
+ #include "ubi.h"
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+ static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum);
+ static int paranoid_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum);
+ static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
+@@ -146,13 +146,35 @@ int ubi_io_read(const struct ubi_device *ubi, void *buf, int pnum, int offset,
+ if (err)
+ return err;
+
++ /*
++ * Deliberately corrupt the buffer to improve robustness. Indeed, if we
++ * do not do this, the following may happen:
++ * 1. The buffer contains data from previous operation, e.g., read from
++ * another PEB previously. The data looks like expected, e.g., if we
++ * just do not read anything and return - the caller would not
++ * notice this. E.g., if we are reading a VID header, the buffer may
++ * contain a valid VID header from another PEB.
++ * 2. The driver is buggy and returns us success or -EBADMSG or
++ * -EUCLEAN, but it does not actually put any data to the buffer.
++ *
++ * This may confuse UBI or upper layers - they may think the buffer
++ * contains valid data while in fact it is just old data. This is
++ * especially possible because UBI (and UBIFS) relies on CRC, and
++ * treats data as correct even in case of ECC errors if the CRC is
++ * correct.
++ *
++ * Try to prevent this situation by changing the first byte of the
++ * buffer.
++ */
++ *((uint8_t *)buf) ^= 0xFF;
++
+ addr = (loff_t)pnum * ubi->peb_size + offset;
+ retry:
+ err = ubi->mtd->read(ubi->mtd, addr, len, &read, buf);
+ if (err) {
+- const char *errstr = mtd_is_eccerr(err) ? " (ECC error)" : "";
++ const char *errstr = (err == -EBADMSG) ? " (ECC error)" : "";
+
+- if (mtd_is_bitflip(err)) {
++ if (err == -EUCLEAN) {
+ /*
+ * -EUCLEAN is reported if there was a bit-flip which
+ * was corrected, so this is harmless.
+@@ -166,9 +188,9 @@ retry:
+ return UBI_IO_BITFLIPS;
+ }
+
+- if (read != len && retries++ < UBI_IO_RETRIES) {
+- dbg_io("error %d%s while reading %d bytes from PEB %d:%d,"
+- " read only %zd bytes, retry",
++ if (retries++ < UBI_IO_RETRIES) {
++ dbg_io("error %d%s while reading %d bytes from PEB "
++ "%d:%d, read only %zd bytes, retry",
+ err, errstr, len, pnum, offset, read);
+ yield();
+ goto retry;
+@@ -183,14 +205,14 @@ retry:
+ * all the requested data. But some buggy drivers might do
+ * this, so we change it to -EIO.
+ */
+- if (read != len && mtd_is_eccerr(err)) {
++ if (read != len && err == -EBADMSG) {
+ ubi_assert(0);
+ err = -EIO;
+ }
+ } else {
+ ubi_assert(len == read);
+
+- if (ubi_dbg_is_bitflip()) {
++ if (ubi_dbg_is_bitflip(ubi)) {
+ dbg_gen("bit-flip (emulated)");
+ err = UBI_IO_BITFLIPS;
+ }
+@@ -259,7 +281,7 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
+ return err;
+ }
+
+- if (ubi_dbg_is_write_failure()) {
++ if (ubi_dbg_is_write_failure(ubi)) {
+ dbg_err("cannot write %d bytes to PEB %d:%d "
+ "(emulated)", len, pnum, offset);
+ ubi_dbg_dump_stack();
+@@ -322,6 +344,12 @@ static int do_sync_erase(struct ubi_device *ubi, int pnum)
+ wait_queue_head_t wq;
+
+ dbg_io("erase PEB %d", pnum);
++ ubi_assert(pnum >= 0 && pnum < ubi->peb_count);
++
++ if (ubi->ro_mode) {
++ ubi_err("read-only mode");
++ return -EROFS;
++ }
+
+ retry:
+ init_waitqueue_head(&wq);
+@@ -368,7 +396,7 @@ retry:
+ if (err)
+ return err;
+
+- if (ubi_dbg_is_erase_failure() && !err) {
++ if (ubi_dbg_is_erase_failure(ubi)) {
+ dbg_err("cannot erase PEB %d (emulated)", pnum);
+ return -EIO;
+ }
+@@ -403,11 +431,11 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
+ goto out;
+
+ /* Make sure the PEB contains only 0xFF bytes */
+- err = ubi_io_read(ubi, ubi->peb_buf1, pnum, 0, ubi->peb_size);
++ err = ubi_io_read(ubi, ubi->peb_buf, pnum, 0, ubi->peb_size);
+ if (err)
+ goto out;
+
+- err = ubi_check_pattern(ubi->peb_buf1, 0xFF, ubi->peb_size);
++ err = ubi_check_pattern(ubi->peb_buf, 0xFF, ubi->peb_size);
+ if (err == 0) {
+ ubi_err("erased PEB %d, but a non-0xFF byte found",
+ pnum);
+@@ -416,17 +444,17 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
+ }
+
+ /* Write a pattern and check it */
+- memset(ubi->peb_buf1, patterns[i], ubi->peb_size);
+- err = ubi_io_write(ubi, ubi->peb_buf1, pnum, 0, ubi->peb_size);
++ memset(ubi->peb_buf, patterns[i], ubi->peb_size);
++ err = ubi_io_write(ubi, ubi->peb_buf, pnum, 0, ubi->peb_size);
+ if (err)
+ goto out;
+
+- memset(ubi->peb_buf1, ~patterns[i], ubi->peb_size);
+- err = ubi_io_read(ubi, ubi->peb_buf1, pnum, 0, ubi->peb_size);
++ memset(ubi->peb_buf, ~patterns[i], ubi->peb_size);
++ err = ubi_io_read(ubi, ubi->peb_buf, pnum, 0, ubi->peb_size);
+ if (err)
+ goto out;
+
+- err = ubi_check_pattern(ubi->peb_buf1, patterns[i],
++ err = ubi_check_pattern(ubi->peb_buf, patterns[i],
+ ubi->peb_size);
+ if (err == 0) {
+ ubi_err("pattern %x checking failed for PEB %d",
+@@ -437,11 +465,11 @@ static int torture_peb(struct ubi_device *ubi, int pnum)
+ }
+
+ err = patt_count;
+- ubi_msg("PEB %d passed torture test, do not mark it a bad", pnum);
++ ubi_msg("PEB %d passed torture test, do not mark it as bad", pnum);
+
+ out:
+ mutex_unlock(&ubi->buf_mutex);
+- if (err == UBI_IO_BITFLIPS || mtd_is_eccerr(err)) {
++ if (err == UBI_IO_BITFLIPS || err == -EBADMSG) {
+ /*
+ * If a bit-flip or data integrity error was detected, the test
+ * has not passed because it happened on a freshly erased
+@@ -480,6 +508,13 @@ static int nor_erase_prepare(struct ubi_device *ubi, int pnum)
+ size_t written;
+ loff_t addr;
+ uint32_t data = 0;
++ /*
++ * Note, we cannot generally define VID header buffers on stack,
++ * because of the way we deal with these buffers (see the header
++ * comment in this file). But we know this is a NOR-specific piece of
++ * code, so we can do this. But yes, this is error-prone and we should
++ * (pre-)allocate VID header buffer instead.
++ */
+ struct ubi_vid_hdr vid_hdr;
+
+ /*
+@@ -507,11 +542,13 @@ static int nor_erase_prepare(struct ubi_device *ubi, int pnum)
+ * PEB.
+ */
+ err1 = ubi_io_read_vid_hdr(ubi, pnum, &vid_hdr, 0);
+- if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR) {
++ if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR ||
++ err1 == UBI_IO_FF) {
+ struct ubi_ec_hdr ec_hdr;
+
+ err1 = ubi_io_read_ec_hdr(ubi, pnum, &ec_hdr, 0);
+- if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR)
++ if (err1 == UBI_IO_BAD_HDR_EBADMSG || err1 == UBI_IO_BAD_HDR ||
++ err1 == UBI_IO_FF)
+ /*
+ * Both VID and EC headers are corrupted, so we can
+ * safely erase this PEB and not afraid that it will be
+@@ -723,7 +760,7 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
+
+ read_err = ubi_io_read(ubi, ec_hdr, pnum, 0, UBI_EC_HDR_SIZE);
+ if (read_err) {
+- if (read_err != UBI_IO_BITFLIPS && !mtd_is_eccerr(read_err))
++ if (read_err != UBI_IO_BITFLIPS && read_err != -EBADMSG)
+ return read_err;
+
+ /*
+@@ -739,7 +776,7 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
+
+ magic = be32_to_cpu(ec_hdr->magic);
+ if (magic != UBI_EC_HDR_MAGIC) {
+- if (mtd_is_eccerr(read_err))
++ if (read_err == -EBADMSG)
+ return UBI_IO_BAD_HDR_EBADMSG;
+
+ /*
+@@ -752,9 +789,8 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
+ if (verbose)
+ ubi_warn("no EC header found at PEB %d, "
+ "only 0xFF bytes", pnum);
+- else if (UBI_IO_DEBUG)
+- dbg_msg("no EC header found at PEB %d, "
+- "only 0xFF bytes", pnum);
++ dbg_bld("no EC header found at PEB %d, "
++ "only 0xFF bytes", pnum);
+ if (!read_err)
+ return UBI_IO_FF;
+ else
+@@ -769,9 +805,9 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
+ ubi_warn("bad magic number at PEB %d: %08x instead of "
+ "%08x", pnum, magic, UBI_EC_HDR_MAGIC);
+ ubi_dbg_dump_ec_hdr(ec_hdr);
+- } else if (UBI_IO_DEBUG)
+- dbg_msg("bad magic number at PEB %d: %08x instead of "
+- "%08x", pnum, magic, UBI_EC_HDR_MAGIC);
++ }
++ dbg_bld("bad magic number at PEB %d: %08x instead of "
++ "%08x", pnum, magic, UBI_EC_HDR_MAGIC);
+ return UBI_IO_BAD_HDR;
+ }
+
+@@ -783,9 +819,9 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
+ ubi_warn("bad EC header CRC at PEB %d, calculated "
+ "%#08x, read %#08x", pnum, crc, hdr_crc);
+ ubi_dbg_dump_ec_hdr(ec_hdr);
+- } else if (UBI_IO_DEBUG)
+- dbg_msg("bad EC header CRC at PEB %d, calculated "
+- "%#08x, read %#08x", pnum, crc, hdr_crc);
++ }
++ dbg_bld("bad EC header CRC at PEB %d, calculated "
++ "%#08x, read %#08x", pnum, crc, hdr_crc);
+
+ if (!read_err)
+ return UBI_IO_BAD_HDR;
+@@ -996,21 +1032,20 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
+ p = (char *)vid_hdr - ubi->vid_hdr_shift;
+ read_err = ubi_io_read(ubi, p, pnum, ubi->vid_hdr_aloffset,
+ ubi->vid_hdr_alsize);
+- if (read_err && read_err != UBI_IO_BITFLIPS && !mtd_is_eccerr(read_err))
++ if (read_err && read_err != UBI_IO_BITFLIPS && read_err != -EBADMSG)
+ return read_err;
+
+ magic = be32_to_cpu(vid_hdr->magic);
+ if (magic != UBI_VID_HDR_MAGIC) {
+- if (mtd_is_eccerr(read_err))
++ if (read_err == -EBADMSG)
+ return UBI_IO_BAD_HDR_EBADMSG;
+
+ if (ubi_check_pattern(vid_hdr, 0xFF, UBI_VID_HDR_SIZE)) {
+ if (verbose)
+ ubi_warn("no VID header found at PEB %d, "
+ "only 0xFF bytes", pnum);
+- else if (UBI_IO_DEBUG)
+- dbg_msg("no VID header found at PEB %d, "
+- "only 0xFF bytes", pnum);
++ dbg_bld("no VID header found at PEB %d, "
++ "only 0xFF bytes", pnum);
+ if (!read_err)
+ return UBI_IO_FF;
+ else
+@@ -1021,9 +1056,9 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
+ ubi_warn("bad magic number at PEB %d: %08x instead of "
+ "%08x", pnum, magic, UBI_VID_HDR_MAGIC);
+ ubi_dbg_dump_vid_hdr(vid_hdr);
+- } else if (UBI_IO_DEBUG)
+- dbg_msg("bad magic number at PEB %d: %08x instead of "
+- "%08x", pnum, magic, UBI_VID_HDR_MAGIC);
++ }
++ dbg_bld("bad magic number at PEB %d: %08x instead of "
++ "%08x", pnum, magic, UBI_VID_HDR_MAGIC);
+ return UBI_IO_BAD_HDR;
+ }
+
+@@ -1035,9 +1070,9 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
+ ubi_warn("bad CRC at PEB %d, calculated %#08x, "
+ "read %#08x", pnum, crc, hdr_crc);
+ ubi_dbg_dump_vid_hdr(vid_hdr);
+- } else if (UBI_IO_DEBUG)
+- dbg_msg("bad CRC at PEB %d, calculated %#08x, "
+- "read %#08x", pnum, crc, hdr_crc);
++ }
++ dbg_bld("bad CRC at PEB %d, calculated %#08x, "
++ "read %#08x", pnum, crc, hdr_crc);
+ if (!read_err)
+ return UBI_IO_BAD_HDR;
+ else
+@@ -1097,7 +1132,7 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
+ return err;
+ }
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+
+ /**
+ * paranoid_check_not_bad - ensure that a physical eraseblock is not bad.
+@@ -1111,6 +1146,9 @@ static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
+ {
+ int err;
+
++ if (!ubi->dbg->chk_io)
++ return 0;
++
+ err = ubi_io_is_bad(ubi, pnum);
+ if (!err)
+ return err;
+@@ -1135,6 +1173,9 @@ static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
+ int err;
+ uint32_t magic;
+
++ if (!ubi->dbg->chk_io)
++ return 0;
++
+ magic = be32_to_cpu(ec_hdr->magic);
+ if (magic != UBI_EC_HDR_MAGIC) {
+ ubi_err("bad magic %#08x, must be %#08x",
+@@ -1170,12 +1211,15 @@ static int paranoid_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum)
+ uint32_t crc, hdr_crc;
+ struct ubi_ec_hdr *ec_hdr;
+
++ if (!ubi->dbg->chk_io)
++ return 0;
++
+ ec_hdr = kzalloc(ubi->ec_hdr_alsize, GFP_NOFS);
+ if (!ec_hdr)
+ return -ENOMEM;
+
+ err = ubi_io_read(ubi, ec_hdr, pnum, 0, UBI_EC_HDR_SIZE);
+- if (err && err != UBI_IO_BITFLIPS && !mtd_is_eccerr(err))
++ if (err && err != UBI_IO_BITFLIPS && err != -EBADMSG)
+ goto exit;
+
+ crc = crc32(UBI_CRC32_INIT, ec_hdr, UBI_EC_HDR_SIZE_CRC);
+@@ -1211,6 +1255,9 @@ static int paranoid_check_vid_hdr(const struct ubi_device *ubi, int pnum,
+ int err;
+ uint32_t magic;
+
++ if (!ubi->dbg->chk_io)
++ return 0;
++
+ magic = be32_to_cpu(vid_hdr->magic);
+ if (magic != UBI_VID_HDR_MAGIC) {
+ ubi_err("bad VID header magic %#08x at PEB %d, must be %#08x",
+@@ -1249,6 +1296,9 @@ static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
+ struct ubi_vid_hdr *vid_hdr;
+ void *p;
+
++ if (!ubi->dbg->chk_io)
++ return 0;
++
+ vid_hdr = ubi_zalloc_vid_hdr(ubi, GFP_NOFS);
+ if (!vid_hdr)
+ return -ENOMEM;
+@@ -1256,7 +1306,7 @@ static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
+ p = (char *)vid_hdr - ubi->vid_hdr_shift;
+ err = ubi_io_read(ubi, p, pnum, ubi->vid_hdr_aloffset,
+ ubi->vid_hdr_alsize);
+- if (err && err != UBI_IO_BITFLIPS && !mtd_is_eccerr(err))
++ if (err && err != UBI_IO_BITFLIPS && err != -EBADMSG)
+ goto exit;
+
+ crc = crc32(UBI_CRC32_INIT, vid_hdr, UBI_EC_HDR_SIZE_CRC);
+@@ -1294,15 +1344,26 @@ int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+ int offset, int len)
+ {
+ int err, i;
++ size_t read;
++ void *buf1;
++ loff_t addr = (loff_t)pnum * ubi->peb_size + offset;
+
+- mutex_lock(&ubi->dbg_buf_mutex);
+- err = ubi_io_read(ubi, ubi->dbg_peb_buf, pnum, offset, len);
+- if (err)
+- goto out_unlock;
++ if (!ubi->dbg->chk_io)
++ return 0;
++
++ buf1 = __vmalloc(len, GFP_NOFS, PAGE_KERNEL);
++ if (!buf1) {
++ ubi_err("cannot allocate memory to check writes");
++ return 0;
++ }
++
++ err = ubi->mtd->read(ubi->mtd, addr, len, &read, buf1);
++ if (err && err != -EUCLEAN)
++ goto out_free;
+
+ for (i = 0; i < len; i++) {
+ uint8_t c = ((uint8_t *)buf)[i];
+- uint8_t c1 = ((uint8_t *)ubi->dbg_peb_buf)[i];
++ uint8_t c1 = ((uint8_t *)buf1)[i];
+ int dump_len;
+
+ if (c == c1)
+@@ -1319,17 +1380,17 @@ int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+ ubi_msg("hex dump of the read buffer from %d to %d",
+ i, i + dump_len);
+ print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+- ubi->dbg_peb_buf + i, dump_len, 1);
++ buf1 + i, dump_len, 1);
+ ubi_dbg_dump_stack();
+ err = -EINVAL;
+- goto out_unlock;
++ goto out_free;
+ }
+- mutex_unlock(&ubi->dbg_buf_mutex);
+
++ vfree(buf1);
+ return 0;
+
+-out_unlock:
+- mutex_unlock(&ubi->dbg_buf_mutex);
++out_free:
++ vfree(buf1);
+ return err;
+ }
+
+@@ -1348,36 +1409,44 @@ int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len)
+ {
+ size_t read;
+ int err;
++ void *buf;
+ loff_t addr = (loff_t)pnum * ubi->peb_size + offset;
+
+- mutex_lock(&ubi->dbg_buf_mutex);
+- err = ubi->mtd->read(ubi->mtd, addr, len, &read, ubi->dbg_peb_buf);
+- if (err && !mtd_is_bitflip(err)) {
++ if (!ubi->dbg->chk_io)
++ return 0;
++
++ buf = __vmalloc(len, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubi_err("cannot allocate memory to check for 0xFFs");
++ return 0;
++ }
++
++ err = ubi->mtd->read(ubi->mtd, addr, len, &read, buf);
++ if (err && err != -EUCLEAN) {
+ ubi_err("error %d while reading %d bytes from PEB %d:%d, "
+ "read %zd bytes", err, len, pnum, offset, read);
+ goto error;
+ }
+
+- err = ubi_check_pattern(ubi->dbg_peb_buf, 0xFF, len);
++ err = ubi_check_pattern(buf, 0xFF, len);
+ if (err == 0) {
+ ubi_err("flash region at PEB %d:%d, length %d does not "
+ "contain all 0xFF bytes", pnum, offset, len);
+ goto fail;
+ }
+- mutex_unlock(&ubi->dbg_buf_mutex);
+
++ vfree(buf);
+ return 0;
+
+ fail:
+ ubi_err("paranoid check failed for PEB %d", pnum);
+ ubi_msg("hex dump of the %d-%d region", offset, offset + len);
+- print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+- ubi->dbg_peb_buf, len, 1);
++ print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1, buf, len, 1);
+ err = -EINVAL;
+ error:
+ ubi_dbg_dump_stack();
+- mutex_unlock(&ubi->dbg_buf_mutex);
++ vfree(buf);
+ return err;
+ }
+
+-#endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
++#endif /* CONFIG_MTD_UBI_DEBUG */
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index 1c95758..d39716e 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -40,7 +40,9 @@ void ubi_do_get_device_info(struct ubi_device *ubi, struct ubi_device_info *di)
+ {
+ di->ubi_num = ubi->ubi_num;
+ di->leb_size = ubi->leb_size;
++ di->leb_start = ubi->leb_start;
+ di->min_io_size = ubi->min_io_size;
++ di->max_write_size = ubi->max_write_size;
+ di->ro_mode = ubi->ro_mode;
+ di->cdev = ubi->cdev.dev;
+ }
+@@ -408,7 +410,7 @@ int ubi_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
+ return 0;
+
+ err = ubi_eba_read_leb(ubi, vol, lnum, buf, offset, len, check);
+- if (err && mtd_is_eccerr(err) && vol->vol_type == UBI_STATIC_VOLUME) {
++ if (err && err == -EBADMSG && vol->vol_type == UBI_STATIC_VOLUME) {
+ ubi_warn("mark volume %d as corrupted", vol_id);
+ vol->corrupted = 1;
+ }
+diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
+index f6a7d7a..ff2a65c 100644
+--- a/drivers/mtd/ubi/misc.c
++++ b/drivers/mtd/ubi/misc.c
+@@ -81,7 +81,7 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
+
+ err = ubi_eba_read_leb(ubi, vol, i, buf, 0, size, 1);
+ if (err) {
+- if (mtd_is_eccerr(err))
++ if (err == -EBADMSG)
+ err = 1;
+ break;
+ }
+diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
+index 438ec20..22f03d6 100644
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -39,32 +39,46 @@
+ * eraseblocks are put to the @free list and the physical eraseblock to be
+ * erased are put to the @erase list.
+ *
++ * About corruptions
++ * ~~~~~~~~~~~~~~~~~
++ *
++ * UBI protects EC and VID headers with CRC-32 checksums, so it can detect
++ * whether the headers are corrupted or not. Sometimes UBI also protects the
++ * data with CRC-32, e.g., when it executes the atomic LEB change operation, or
++ * when it moves the contents of a PEB for wear-leveling purposes.
++ *
+ * UBI tries to distinguish between 2 types of corruptions.
+- * 1. Corruptions caused by power cuts. These are harmless and expected
+- * corruptions and UBI tries to handle them gracefully, without printing too
+- * many warnings and error messages. The idea is that we do not lose
+- * important data in these case - we may lose only the data which was being
+- * written to the media just before the power cut happened, and the upper
+- * layers (e.g., UBIFS) are supposed to handle these situations. UBI puts
+- * these PEBs to the head of the @erase list and they are scheduled for
+- * erasure.
++ *
++ * 1. Corruptions caused by power cuts. These are expected corruptions and UBI
++ * tries to handle them gracefully, without printing too many warnings and
++ * error messages. The idea is that we do not lose important data in these case
++ * - we may lose only the data which was being written to the media just before
++ * the power cut happened, and the upper layers (e.g., UBIFS) are supposed to
++ * handle such data losses (e.g., by using the FS journal).
++ *
++ * When UBI detects a corruption (CRC-32 mismatch) in a PEB, and it looks like
++ * the reason is a power cut, UBI puts this PEB to the @erase list, and all
++ * PEBs in the @erase list are scheduled for erasure later.
+ *
+ * 2. Unexpected corruptions which are not caused by power cuts. During
+- * scanning, such PEBs are put to the @corr list and UBI preserves them.
+- * Obviously, this lessens the amount of available PEBs, and if at some
+- * point UBI runs out of free PEBs, it switches to R/O mode. UBI also loudly
+- * informs about such PEBs every time the MTD device is attached.
++ * scanning, such PEBs are put to the @corr list and UBI preserves them.
++ * Obviously, this lessens the amount of available PEBs, and if at some point
++ * UBI runs out of free PEBs, it switches to R/O mode. UBI also loudly informs
++ * about such PEBs every time the MTD device is attached.
+ *
+ * However, it is difficult to reliably distinguish between these types of
+- * corruptions and UBI's strategy is as follows. UBI assumes (2.) if the VID
+- * header is corrupted and the data area does not contain all 0xFFs, and there
+- * were not bit-flips or integrity errors while reading the data area. Otherwise
+- * UBI assumes (1.). The assumptions are:
+- * o if the data area contains only 0xFFs, there is no data, and it is safe
+- * to just erase this PEB.
+- * o if the data area has bit-flips and data integrity errors (ECC errors on
++ * corruptions and UBI's strategy is as follows. UBI assumes corruption type 2
++ * if the VID header is corrupted and the data area does not contain all 0xFFs,
++ * and there were no bit-flips or integrity errors while reading the data area.
++ * Otherwise UBI assumes corruption type 1. So the decision criteria are as
++ * follows.
++ * o If the data area contains only 0xFFs, there is no data, and it is safe
++ * to just erase this PEB - this is corruption type 1.
++ * o If the data area has bit-flips or data integrity errors (ECC errors on
+ * NAND), it is probably a PEB which was being erased when power cut
+- * happened.
++ * happened, so this is corruption type 1. However, this is just a guess,
++ * which might be wrong.
++ * o Otherwise this it corruption type 2.
+ */
+
+ #include <linux/err.h>
+@@ -74,7 +88,7 @@
+ #include <linux/random.h>
+ #include "ubi.h"
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+ static int paranoid_check_si(struct ubi_device *ubi, struct ubi_scan_info *si);
+ #else
+ #define paranoid_check_si(ubi, si) 0
+@@ -115,7 +129,7 @@ static int add_to_list(struct ubi_scan_info *si, int pnum, int ec, int to_head,
+ } else
+ BUG();
+
+- seb = kmalloc(sizeof(struct ubi_scan_leb), GFP_KERNEL);
++ seb = kmem_cache_alloc(si->scan_leb_slab, GFP_KERNEL);
+ if (!seb)
+ return -ENOMEM;
+
+@@ -144,7 +158,7 @@ static int add_corrupted(struct ubi_scan_info *si, int pnum, int ec)
+
+ dbg_bld("add to corrupted: PEB %d, EC %d", pnum, ec);
+
+- seb = kmalloc(sizeof(struct ubi_scan_leb), GFP_KERNEL);
++ seb = kmem_cache_alloc(si->scan_leb_slab, GFP_KERNEL);
+ if (!seb)
+ return -ENOMEM;
+
+@@ -381,7 +395,7 @@ static int compare_lebs(struct ubi_device *ubi, const struct ubi_scan_leb *seb,
+ }
+
+ err = ubi_io_read_data(ubi, buf, pnum, 0, len);
+- if (err && err != UBI_IO_BITFLIPS && !mtd_is_eccerr(err))
++ if (err && err != UBI_IO_BITFLIPS && err != -EBADMSG)
+ goto out_free_buf;
+
+ data_crc = be32_to_cpu(vid_hdr->data_crc);
+@@ -553,7 +567,7 @@ int ubi_scan_add_used(struct ubi_device *ubi, struct ubi_scan_info *si,
+ if (err)
+ return err;
+
+- seb = kmalloc(sizeof(struct ubi_scan_leb), GFP_KERNEL);
++ seb = kmem_cache_alloc(si->scan_leb_slab, GFP_KERNEL);
+ if (!seb)
+ return -ENOMEM;
+
+@@ -775,11 +789,11 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
+ int err;
+
+ mutex_lock(&ubi->buf_mutex);
+- memset(ubi->peb_buf1, 0x00, ubi->leb_size);
++ memset(ubi->peb_buf, 0x00, ubi->leb_size);
+
+- err = ubi_io_read(ubi, ubi->peb_buf1, pnum, ubi->leb_start,
++ err = ubi_io_read(ubi, ubi->peb_buf, pnum, ubi->leb_start,
+ ubi->leb_size);
+- if (err == UBI_IO_BITFLIPS || mtd_is_eccerr(err)) {
++ if (err == UBI_IO_BITFLIPS || err == -EBADMSG) {
+ /*
+ * Bit-flips or integrity errors while reading the data area.
+ * It is difficult to say for sure what type of corruption is
+@@ -794,7 +808,7 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
+ if (err)
+ goto out_unlock;
+
+- if (ubi_check_pattern(ubi->peb_buf1, 0xFF, ubi->leb_size))
++ if (ubi_check_pattern(ubi->peb_buf, 0xFF, ubi->leb_size))
+ goto out_unlock;
+
+ ubi_err("PEB %d contains corrupted VID header, and the data does not "
+@@ -804,7 +818,7 @@ static int check_corruption(struct ubi_device *ubi, struct ubi_vid_hdr *vid_hdr,
+ dbg_msg("hexdump of PEB %d offset %d, length %d",
+ pnum, ubi->leb_start, ubi->leb_size);
+ ubi_dbg_print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+- ubi->peb_buf1, ubi->leb_size, 1);
++ ubi->peb_buf, ubi->leb_size, 1);
+ err = 1;
+
+ out_unlock:
+@@ -1089,7 +1103,7 @@ static int check_what_we_have(struct ubi_device *ubi, struct ubi_scan_info *si)
+ * otherwise, only print a warning.
+ */
+ if (si->corr_peb_count >= max_corr) {
+- ubi_err("too many corrupted PEBs, refusing this device");
++ ubi_err("too many corrupted PEBs, refusing");
+ return -EINVAL;
+ }
+ }
+@@ -1152,6 +1166,12 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
+ si->volumes = RB_ROOT;
+
+ err = -ENOMEM;
++ si->scan_leb_slab = kmem_cache_create("ubi_scan_leb_slab",
++ sizeof(struct ubi_scan_leb),
++ 0, 0, NULL);
++ if (!si->scan_leb_slab)
++ goto out_si;
++
+ ech = kzalloc(ubi->ec_hdr_alsize, GFP_KERNEL);
+ if (!ech)
+ goto out_si;
+@@ -1223,11 +1243,12 @@ out_si:
+ /**
+ * destroy_sv - free the scanning volume information
+ * @sv: scanning volume information
++ * @si: scanning information
+ *
+ * This function destroys the volume RB-tree (@sv->root) and the scanning
+ * volume information.
+ */
+-static void destroy_sv(struct ubi_scan_volume *sv)
++static void destroy_sv(struct ubi_scan_info *si, struct ubi_scan_volume *sv)
+ {
+ struct ubi_scan_leb *seb;
+ struct rb_node *this = sv->root.rb_node;
+@@ -1247,7 +1268,7 @@ static void destroy_sv(struct ubi_scan_volume *sv)
+ this->rb_right = NULL;
+ }
+
+- kfree(seb);
++ kmem_cache_free(si->scan_leb_slab, seb);
+ }
+ }
+ kfree(sv);
+@@ -1265,19 +1286,19 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si)
+
+ list_for_each_entry_safe(seb, seb_tmp, &si->alien, u.list) {
+ list_del(&seb->u.list);
+- kfree(seb);
++ kmem_cache_free(si->scan_leb_slab, seb);
+ }
+ list_for_each_entry_safe(seb, seb_tmp, &si->erase, u.list) {
+ list_del(&seb->u.list);
+- kfree(seb);
++ kmem_cache_free(si->scan_leb_slab, seb);
+ }
+ list_for_each_entry_safe(seb, seb_tmp, &si->corr, u.list) {
+ list_del(&seb->u.list);
+- kfree(seb);
++ kmem_cache_free(si->scan_leb_slab, seb);
+ }
+ list_for_each_entry_safe(seb, seb_tmp, &si->free, u.list) {
+ list_del(&seb->u.list);
+- kfree(seb);
++ kmem_cache_free(si->scan_leb_slab, seb);
+ }
+
+ /* Destroy the volume RB-tree */
+@@ -1298,14 +1319,17 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si)
+ rb->rb_right = NULL;
+ }
+
+- destroy_sv(sv);
++ destroy_sv(si, sv);
+ }
+ }
+
++ if (si->scan_leb_slab)
++ kmem_cache_destroy(si->scan_leb_slab);
++
+ kfree(si);
+ }
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+
+ /**
+ * paranoid_check_si - check the scanning information.
+@@ -1323,6 +1347,9 @@ static int paranoid_check_si(struct ubi_device *ubi, struct ubi_scan_info *si)
+ struct ubi_scan_leb *seb, *last_seb;
+ uint8_t *buf;
+
++ if (!ubi->dbg->chk_gen)
++ return 0;
++
+ /*
+ * At first, check that scanning information is OK.
+ */
+@@ -1575,4 +1602,4 @@ out:
+ return -EINVAL;
+ }
+
+-#endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
++#endif /* CONFIG_MTD_UBI_DEBUG */
+diff --git a/drivers/mtd/ubi/scan.h b/drivers/mtd/ubi/scan.h
+index a3264f0..d48aef1 100644
+--- a/drivers/mtd/ubi/scan.h
++++ b/drivers/mtd/ubi/scan.h
+@@ -109,6 +109,7 @@ struct ubi_scan_volume {
+ * @mean_ec: mean erase counter value
+ * @ec_sum: a temporary variable used when calculating @mean_ec
+ * @ec_count: a temporary variable used when calculating @mean_ec
++ * @scan_leb_slab: slab cache for &struct ubi_scan_leb objects
+ *
+ * This data structure contains the result of scanning and may be used by other
+ * UBI sub-systems to build final UBI data structures, further error-recovery
+@@ -134,6 +135,7 @@ struct ubi_scan_info {
+ int mean_ec;
+ uint64_t ec_sum;
+ int ec_count;
++ struct kmem_cache *scan_leb_slab;
+ };
+
+ struct ubi_device;
+diff --git a/drivers/mtd/ubi/ubi-media.h b/drivers/mtd/ubi/ubi-media.h
+index 503ea9b..6fb8ec2 100644
+--- a/drivers/mtd/ubi/ubi-media.h
++++ b/drivers/mtd/ubi/ubi-media.h
+@@ -164,7 +164,7 @@ struct ubi_ec_hdr {
+ __be32 image_seq;
+ __u8 padding2[32];
+ __be32 hdr_crc;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubi_vid_hdr - on-flash UBI volume identifier header.
+@@ -292,7 +292,7 @@ struct ubi_vid_hdr {
+ __be64 sqnum;
+ __u8 padding3[12];
+ __be32 hdr_crc;
+-} __attribute__ ((packed));
++} __packed;
+
+ /* Internal UBI volumes count */
+ #define UBI_INT_VOL_COUNT 1
+@@ -373,6 +373,6 @@ struct ubi_vtbl_record {
+ __u8 flags;
+ __u8 padding[23];
+ __be32 crc;
+-} __attribute__ ((packed));
++} __packed;
+
+ #endif /* !__UBI_MEDIA_H__ */
+diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
+index 0b0149c..b162790 100644
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -40,10 +40,10 @@
+ #include <linux/notifier.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/ubi.h>
++#include <asm/pgtable.h>
+
+ #include "ubi-media.h"
+ #include "scan.h"
+-#include "debug.h"
+
+ /* Maximum number of supported UBI devices */
+ #define UBI_MAX_DEVICES 32
+@@ -118,15 +118,17 @@ enum {
+ * PEB
+ * MOVE_TARGET_WR_ERR: canceled because there was a write error to the target
+ * PEB
+- * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the
++ * MOVE_TARGET_BITFLIPS: canceled because a bit-flip was detected in the
+ * target PEB
++ * MOVE_RETRY: retry scrubbing the PEB
+ */
+ enum {
+ MOVE_CANCEL_RACE = 1,
+ MOVE_SOURCE_RD_ERR,
+ MOVE_TARGET_RD_ERR,
+ MOVE_TARGET_WR_ERR,
+- MOVE_CANCEL_BITFLIPS,
++ MOVE_TARGET_BITFLIPS,
++ MOVE_RETRY,
+ };
+
+ /**
+@@ -340,8 +342,8 @@ struct ubi_wl_entry;
+ * protected from the wear-leveling worker)
+ * @pq_head: protection queue head
+ * @wl_lock: protects the @used, @free, @pq, @pq_head, @lookuptbl, @move_from,
+- * @move_to, @move_to_put @erase_pending, @wl_scheduled, @works,
+- * @erroneous, and @erroneous_peb_count fields
++ * @move_to, @move_to_put @erase_pending, @wl_scheduled, @works,
++ * @erroneous, and @erroneous_peb_count fields
+ * @move_mutex: serializes eraseblock moves
+ * @work_sem: synchronizes the WL worker with use tasks
+ * @wl_scheduled: non-zero if the wear-leveling was scheduled
+@@ -381,14 +383,15 @@ struct ubi_wl_entry;
+ * @bad_allowed: whether the MTD device admits of bad physical eraseblocks or
+ * not
+ * @nor_flash: non-zero if working on top of NOR flash
++ * @max_write_size: maximum amount of bytes the underlying flash can write at a
++ * time (MTD write buffer size)
+ * @mtd: MTD device descriptor
+ *
+- * @peb_buf1: a buffer of PEB size used for different purposes
+- * @peb_buf2: another buffer of PEB size used for different purposes
+- * @buf_mutex: protects @peb_buf1 and @peb_buf2
++ * @peb_buf: a buffer of PEB size used for different purposes
++ * @buf_mutex: protects @peb_buf
+ * @ckvol_mutex: serializes static volume checking when opening
+- * @dbg_peb_buf: buffer of PEB size used for debugging
+- * @dbg_buf_mutex: protects @dbg_peb_buf
++ *
++ * @dbg: debugging information for this UBI device
+ */
+ struct ubi_device {
+ struct cdev cdev;
+@@ -464,18 +467,18 @@ struct ubi_device {
+ int vid_hdr_shift;
+ unsigned int bad_allowed:1;
+ unsigned int nor_flash:1;
++ int max_write_size;
+ struct mtd_info *mtd;
+
+- void *peb_buf1;
+- void *peb_buf2;
++ void *peb_buf;
+ struct mutex buf_mutex;
+ struct mutex ckvol_mutex;
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
+- void *dbg_peb_buf;
+- struct mutex dbg_buf_mutex;
+-#endif
++
++ struct ubi_debug_info *dbg;
+ };
+
++#include "debug.h"
++
+ extern struct kmem_cache *ubi_wl_entry_slab;
+ extern const struct file_operations ubi_ctrl_cdev_operations;
+ extern const struct file_operations ubi_cdev_operations;
+@@ -664,6 +667,7 @@ static inline void ubi_ro_mode(struct ubi_device *ubi)
+ if (!ubi->ro_mode) {
+ ubi->ro_mode = 1;
+ ubi_warn("switch to read-only mode");
++ ubi_dbg_dump_stack();
+ }
+ }
+
+diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
+index c47620d..97e093d 100644
+--- a/drivers/mtd/ubi/vmt.c
++++ b/drivers/mtd/ubi/vmt.c
+@@ -28,7 +28,7 @@
+ #include <linux/slab.h>
+ #include "ubi.h"
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+ static int paranoid_check_volumes(struct ubi_device *ubi);
+ #else
+ #define paranoid_check_volumes(ubi) 0
+@@ -711,7 +711,7 @@ void ubi_free_volume(struct ubi_device *ubi, struct ubi_volume *vol)
+ volume_sysfs_close(vol);
+ }
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+
+ /**
+ * paranoid_check_volume - check volume information.
+@@ -790,11 +790,6 @@ static int paranoid_check_volume(struct ubi_device *ubi, int vol_id)
+ goto fail;
+ }
+
+- if (!vol->name) {
+- ubi_err("NULL volume name");
+- goto fail;
+- }
+-
+ n = strnlen(vol->name, vol->name_len + 1);
+ if (n != vol->name_len) {
+ ubi_err("bad name_len %lld", n);
+@@ -876,6 +871,9 @@ static int paranoid_check_volumes(struct ubi_device *ubi)
+ {
+ int i, err = 0;
+
++ if (!ubi->dbg->chk_gen)
++ return 0;
++
+ for (i = 0; i < ubi->vtbl_slots; i++) {
+ err = paranoid_check_volume(ubi, i);
+ if (err)
+diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
+index 157d88b..a547990 100644
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -62,7 +62,7 @@
+ #include <asm/div64.h>
+ #include "ubi.h"
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+ static void paranoid_vtbl_check(const struct ubi_device *ubi);
+ #else
+ #define paranoid_vtbl_check(ubi)
+@@ -306,9 +306,8 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_scan_info *si,
+ int copy, void *vtbl)
+ {
+ int err, tries = 0;
+- static struct ubi_vid_hdr *vid_hdr;
+- struct ubi_scan_volume *sv;
+- struct ubi_scan_leb *new_seb, *old_seb = NULL;
++ struct ubi_vid_hdr *vid_hdr;
++ struct ubi_scan_leb *new_seb;
+
+ ubi_msg("create volume table (copy #%d)", copy + 1);
+
+@@ -316,15 +315,6 @@ static int create_vtbl(struct ubi_device *ubi, struct ubi_scan_info *si,
+ if (!vid_hdr)
+ return -ENOMEM;
+
+- /*
+- * Check if there is a logical eraseblock which would have to contain
+- * this volume table copy was found during scanning. It has to be wiped
+- * out.
+- */
+- sv = ubi_scan_find_sv(si, UBI_LAYOUT_VOLUME_ID);
+- if (sv)
+- old_seb = ubi_scan_find_seb(sv, copy);
+-
+ retry:
+ new_seb = ubi_scan_get_free_peb(ubi, si);
+ if (IS_ERR(new_seb)) {
+@@ -332,7 +322,7 @@ retry:
+ goto out_free;
+ }
+
+- vid_hdr->vol_type = UBI_VID_DYNAMIC;
++ vid_hdr->vol_type = UBI_LAYOUT_VOLUME_TYPE;
+ vid_hdr->vol_id = cpu_to_be32(UBI_LAYOUT_VOLUME_ID);
+ vid_hdr->compat = UBI_LAYOUT_VOLUME_COMPAT;
+ vid_hdr->data_size = vid_hdr->used_ebs =
+@@ -351,8 +341,8 @@ retry:
+ goto write_error;
+
+ /*
+- * And add it to the scanning information. Don't delete the old
+- * @old_seb as it will be deleted and freed in 'ubi_scan_add_used()'.
++ * And add it to the scanning information. Don't delete the old version
++ * of this LEB as it will be deleted and freed in 'ubi_scan_add_used()'.
+ */
+ err = ubi_scan_add_used(ubi, si, new_seb->pnum, new_seb->ec,
+ vid_hdr, 0);
+@@ -434,7 +424,7 @@ static struct ubi_vtbl_record *process_lvol(struct ubi_device *ubi,
+
+ err = ubi_io_read_data(ubi, leb[seb->lnum], seb->pnum, 0,
+ ubi->vtbl_size);
+- if (err == UBI_IO_BITFLIPS || mtd_is_eccerr(err))
++ if (err == UBI_IO_BITFLIPS || err == -EBADMSG)
+ /*
+ * Scrub the PEB later. Note, -EBADMSG indicates an
+ * uncorrectable ECC error, but we have our own CRC and
+@@ -644,7 +634,7 @@ static int init_volumes(struct ubi_device *ubi, const struct ubi_scan_info *si,
+ return -ENOMEM;
+
+ vol->reserved_pebs = UBI_LAYOUT_VOLUME_EBS;
+- vol->alignment = 1;
++ vol->alignment = UBI_LAYOUT_VOLUME_ALIGN;
+ vol->vol_type = UBI_DYNAMIC_VOLUME;
+ vol->name_len = sizeof(UBI_LAYOUT_VOLUME_NAME) - 1;
+ memcpy(vol->name, UBI_LAYOUT_VOLUME_NAME, vol->name_len + 1);
+@@ -870,7 +860,7 @@ out_free:
+ return err;
+ }
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+
+ /**
+ * paranoid_vtbl_check - check volume table.
+@@ -878,10 +868,13 @@ out_free:
+ */
+ static void paranoid_vtbl_check(const struct ubi_device *ubi)
+ {
++ if (!ubi->dbg->chk_gen)
++ return;
++
+ if (vtbl_check(ubi, ubi->vtbl)) {
+ ubi_err("paranoid check failed");
+ BUG();
+ }
+ }
+
+-#endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
++#endif /* CONFIG_MTD_UBI_DEBUG */
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 655bbbe..7c1a9bf 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1,4 +1,5 @@
+ /*
++ * @ubi: UBI device description object
+ * Copyright (c) International Business Machines Corp., 2006
+ *
+ * This program is free software; you can redistribute it and/or modify
+@@ -161,14 +162,16 @@ struct ubi_work {
+ int torture;
+ };
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+ static int paranoid_check_ec(struct ubi_device *ubi, int pnum, int ec);
+-static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
++static int paranoid_check_in_wl_tree(const struct ubi_device *ubi,
++ struct ubi_wl_entry *e,
+ struct rb_root *root);
+-static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e);
++static int paranoid_check_in_pq(const struct ubi_device *ubi,
++ struct ubi_wl_entry *e);
+ #else
+ #define paranoid_check_ec(ubi, pnum, ec) 0
+-#define paranoid_check_in_wl_tree(e, root)
++#define paranoid_check_in_wl_tree(ubi, e, root)
+ #define paranoid_check_in_pq(ubi, e) 0
+ #endif
+
+@@ -347,18 +350,19 @@ static void prot_queue_add(struct ubi_device *ubi, struct ubi_wl_entry *e)
+ /**
+ * find_wl_entry - find wear-leveling entry closest to certain erase counter.
+ * @root: the RB-tree where to look for
+- * @max: highest possible erase counter
++ * @diff: maximum possible difference from the smallest erase counter
+ *
+ * This function looks for a wear leveling entry with erase counter closest to
+- * @max and less than @max.
++ * min + @diff, where min is the smallest erase counter.
+ */
+-static struct ubi_wl_entry *find_wl_entry(struct rb_root *root, int max)
++static struct ubi_wl_entry *find_wl_entry(struct rb_root *root, int diff)
+ {
+ struct rb_node *p;
+ struct ubi_wl_entry *e;
++ int max;
+
+ e = rb_entry(rb_first(root), struct ubi_wl_entry, u.rb);
+- max += e->ec;
++ max = e->ec + diff;
+
+ p = root->rb_node;
+ while (p) {
+@@ -386,7 +390,7 @@ static struct ubi_wl_entry *find_wl_entry(struct rb_root *root, int max)
+ */
+ int ubi_wl_get_peb(struct ubi_device *ubi, int dtype)
+ {
+- int err, medium_ec;
++ int err;
+ struct ubi_wl_entry *e, *first, *last;
+
+ ubi_assert(dtype == UBI_LONGTERM || dtype == UBI_SHORTTERM ||
+@@ -424,7 +428,7 @@ retry:
+ * For unknown data we pick a physical eraseblock with medium
+ * erase counter. But we by no means can pick a physical
+ * eraseblock with erase counter greater or equivalent than the
+- * lowest erase counter plus %WL_FREE_MAX_DIFF.
++ * lowest erase counter plus %WL_FREE_MAX_DIFF/2.
+ */
+ first = rb_entry(rb_first(&ubi->free), struct ubi_wl_entry,
+ u.rb);
+@@ -433,10 +437,8 @@ retry:
+ if (last->ec - first->ec < WL_FREE_MAX_DIFF)
+ e = rb_entry(ubi->free.rb_node,
+ struct ubi_wl_entry, u.rb);
+- else {
+- medium_ec = (first->ec + WL_FREE_MAX_DIFF)/2;
+- e = find_wl_entry(&ubi->free, medium_ec);
+- }
++ else
++ e = find_wl_entry(&ubi->free, WL_FREE_MAX_DIFF/2);
+ break;
+ case UBI_SHORTTERM:
+ /*
+@@ -449,7 +451,7 @@ retry:
+ BUG();
+ }
+
+- paranoid_check_in_wl_tree(e, &ubi->free);
++ paranoid_check_in_wl_tree(ubi, e, &ubi->free);
+
+ /*
+ * Move the physical eraseblock to the protection queue where it will
+@@ -613,7 +615,7 @@ static void schedule_ubi_work(struct ubi_device *ubi, struct ubi_work *wrk)
+ list_add_tail(&wrk->list, &ubi->works);
+ ubi_assert(ubi->works_count >= 0);
+ ubi->works_count += 1;
+- if (ubi->thread_enabled)
++ if (ubi->thread_enabled && !ubi_dbg_is_bgt_disabled(ubi))
+ wake_up_process(ubi->bgt_thread);
+ spin_unlock(&ubi->wl_lock);
+ }
+@@ -712,7 +714,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ e1->ec, e2->ec);
+ goto out_cancel;
+ }
+- paranoid_check_in_wl_tree(e1, &ubi->used);
++ paranoid_check_in_wl_tree(ubi, e1, &ubi->used);
+ rb_erase(&e1->u.rb, &ubi->used);
+ dbg_wl("move PEB %d EC %d to PEB %d EC %d",
+ e1->pnum, e1->ec, e2->pnum, e2->ec);
+@@ -721,12 +723,12 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ scrubbing = 1;
+ e1 = rb_entry(rb_first(&ubi->scrub), struct ubi_wl_entry, u.rb);
+ e2 = find_wl_entry(&ubi->free, WL_FREE_MAX_DIFF);
+- paranoid_check_in_wl_tree(e1, &ubi->scrub);
++ paranoid_check_in_wl_tree(ubi, e1, &ubi->scrub);
+ rb_erase(&e1->u.rb, &ubi->scrub);
+ dbg_wl("scrub PEB %d to PEB %d", e1->pnum, e2->pnum);
+ }
+
+- paranoid_check_in_wl_tree(e2, &ubi->free);
++ paranoid_check_in_wl_tree(ubi, e2, &ubi->free);
+ rb_erase(&e2->u.rb, &ubi->free);
+ ubi->move_from = e1;
+ ubi->move_to = e2;
+@@ -792,8 +794,11 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ protect = 1;
+ goto out_not_moved;
+ }
+-
+- if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
++ if (err == MOVE_RETRY) {
++ scrubbing = 1;
++ goto out_not_moved;
++ }
++ if (err == MOVE_TARGET_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
+ err == MOVE_TARGET_RD_ERR) {
+ /*
+ * Target PEB had bit-flips or write error - torture it.
+@@ -1046,7 +1051,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+
+ ubi_err("failed to erase PEB %d, error %d", pnum, err);
+ kfree(wl_wrk);
+- kmem_cache_free(ubi_wl_entry_slab, e);
+
+ if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
+ err == -EBUSY) {
+@@ -1059,14 +1063,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ goto out_ro;
+ }
+ return err;
+- } else if (err != -EIO) {
++ }
++
++ kmem_cache_free(ubi_wl_entry_slab, e);
++ if (err != -EIO)
+ /*
+ * If this is not %-EIO, we have no idea what to do. Scheduling
+ * this physical eraseblock for erasure again would cause
+ * errors again and again. Well, lets switch to R/O mode.
+ */
+ goto out_ro;
+- }
+
+ /* It is %-EIO, the PEB went bad */
+
+@@ -1169,13 +1175,13 @@ retry:
+ return 0;
+ } else {
+ if (in_wl_tree(e, &ubi->used)) {
+- paranoid_check_in_wl_tree(e, &ubi->used);
++ paranoid_check_in_wl_tree(ubi, e, &ubi->used);
+ rb_erase(&e->u.rb, &ubi->used);
+ } else if (in_wl_tree(e, &ubi->scrub)) {
+- paranoid_check_in_wl_tree(e, &ubi->scrub);
++ paranoid_check_in_wl_tree(ubi, e, &ubi->scrub);
+ rb_erase(&e->u.rb, &ubi->scrub);
+ } else if (in_wl_tree(e, &ubi->erroneous)) {
+- paranoid_check_in_wl_tree(e, &ubi->erroneous);
++ paranoid_check_in_wl_tree(ubi, e, &ubi->erroneous);
+ rb_erase(&e->u.rb, &ubi->erroneous);
+ ubi->erroneous_peb_count -= 1;
+ ubi_assert(ubi->erroneous_peb_count >= 0);
+@@ -1242,7 +1248,7 @@ retry:
+ }
+
+ if (in_wl_tree(e, &ubi->used)) {
+- paranoid_check_in_wl_tree(e, &ubi->used);
++ paranoid_check_in_wl_tree(ubi, e, &ubi->used);
+ rb_erase(&e->u.rb, &ubi->used);
+ } else {
+ int err;
+@@ -1364,7 +1370,7 @@ int ubi_thread(void *u)
+
+ spin_lock(&ubi->wl_lock);
+ if (list_empty(&ubi->works) || ubi->ro_mode ||
+- !ubi->thread_enabled) {
++ !ubi->thread_enabled || ubi_dbg_is_bgt_disabled(ubi)) {
+ set_current_state(TASK_INTERRUPTIBLE);
+ spin_unlock(&ubi->wl_lock);
+ schedule();
+@@ -1561,7 +1567,7 @@ void ubi_wl_close(struct ubi_device *ubi)
+ kfree(ubi->lookuptbl);
+ }
+
+-#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
++#ifdef CONFIG_MTD_UBI_DEBUG
+
+ /**
+ * paranoid_check_ec - make sure that the erase counter of a PEB is correct.
+@@ -1570,7 +1576,8 @@ void ubi_wl_close(struct ubi_device *ubi)
+ * @ec: the erase counter to check
+ *
+ * This function returns zero if the erase counter of physical eraseblock @pnum
+- * is equivalent to @ec, and a negative error code if not or if an error occurred.
++ * is equivalent to @ec, and a negative error code if not or if an error
++ * occurred.
+ */
+ static int paranoid_check_ec(struct ubi_device *ubi, int pnum, int ec)
+ {
+@@ -1578,6 +1585,9 @@ static int paranoid_check_ec(struct ubi_device *ubi, int pnum, int ec)
+ long long read_ec;
+ struct ubi_ec_hdr *ec_hdr;
+
++ if (!ubi->dbg->chk_gen)
++ return 0;
++
+ ec_hdr = kzalloc(ubi->ec_hdr_alsize, GFP_NOFS);
+ if (!ec_hdr)
+ return -ENOMEM;
+@@ -1605,15 +1615,20 @@ out_free:
+
+ /**
+ * paranoid_check_in_wl_tree - check that wear-leveling entry is in WL RB-tree.
++ * @ubi: UBI device description object
+ * @e: the wear-leveling entry to check
+ * @root: the root of the tree
+ *
+ * This function returns zero if @e is in the @root RB-tree and %-EINVAL if it
+ * is not.
+ */
+-static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
++static int paranoid_check_in_wl_tree(const struct ubi_device *ubi,
++ struct ubi_wl_entry *e,
+ struct rb_root *root)
+ {
++ if (!ubi->dbg->chk_gen)
++ return 0;
++
+ if (in_wl_tree(e, root))
+ return 0;
+
+@@ -1631,11 +1646,15 @@ static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
+ *
+ * This function returns zero if @e is in @ubi->pq and %-EINVAL if it is not.
+ */
+-static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e)
++static int paranoid_check_in_pq(const struct ubi_device *ubi,
++ struct ubi_wl_entry *e)
+ {
+ struct ubi_wl_entry *p;
+ int i;
+
++ if (!ubi->dbg->chk_gen)
++ return 0;
++
+ for (i = 0; i < UBI_PROT_QUEUE_LEN; ++i)
+ list_for_each_entry(p, &ubi->pq[i], u.list)
+ if (p == e)
+@@ -1646,4 +1665,5 @@ static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e)
+ ubi_dbg_dump_stack();
+ return -EINVAL;
+ }
+-#endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
++
++#endif /* CONFIG_MTD_UBI_DEBUG */
+diff --git a/fs/ubifs/Kconfig b/fs/ubifs/Kconfig
+index 830e3f7..f8b0160 100644
+--- a/fs/ubifs/Kconfig
++++ b/fs/ubifs/Kconfig
+@@ -44,29 +44,17 @@ config UBIFS_FS_ZLIB
+
+ # Debugging-related stuff
+ config UBIFS_FS_DEBUG
+- bool "Enable debugging"
++ bool "Enable debugging support"
+ depends on UBIFS_FS
+ select DEBUG_FS
+- select KALLSYMS_ALL
+- help
+- This option enables UBIFS debugging.
+-
+-config UBIFS_FS_DEBUG_MSG_LVL
+- int "Default message level (0 = no extra messages, 3 = lots)"
+- depends on UBIFS_FS_DEBUG
+- default "0"
+- help
+- This controls the amount of debugging messages produced by UBIFS.
+- If reporting bugs, please try to have available a full dump of the
+- messages at level 1 while the misbehaviour was occurring. Level 2
+- may become necessary if level 1 messages were not enough to find the
+- bug. Generally Level 3 should be avoided.
+-
+-config UBIFS_FS_DEBUG_CHKS
+- bool "Enable extra checks"
+- depends on UBIFS_FS_DEBUG
+- help
+- If extra checks are enabled UBIFS will check the consistency of its
+- internal data structures during operation. However, UBIFS performance
+- is dramatically slower when this option is selected especially if the
+- file system is large.
++ select KALLSYMS
++ help
++ This option enables UBIFS debugging support. It makes sure various
++ assertions, self-checks, debugging messages and test modes are compiled
++ in (this all is compiled out otherwise). Assertions are light-weight
++ and this option also enables them. Self-checks, debugging messages and
++ test modes are switched off by default. Thus, it is safe and actually
++ recommended to have debugging support enabled, and it should not slow
++ down UBIFS. You can then further enable / disable individual debugging
++ features using UBIFS module parameters and the corresponding sysfs
++ interfaces.
+diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
+index c8ff0d1..02c73e7 100644
+--- a/fs/ubifs/budget.c
++++ b/fs/ubifs/budget.c
+@@ -106,7 +106,7 @@ static long long get_liability(struct ubifs_info *c)
+ long long liab;
+
+ spin_lock(&c->space_lock);
+- liab = c->budg_idx_growth + c->budg_data_growth + c->budg_dd_growth;
++ liab = c->bi.idx_growth + c->bi.data_growth + c->bi.dd_growth;
+ spin_unlock(&c->space_lock);
+ return liab;
+ }
+@@ -180,7 +180,7 @@ int ubifs_calc_min_idx_lebs(struct ubifs_info *c)
+ int idx_lebs;
+ long long idx_size;
+
+- idx_size = c->old_idx_sz + c->budg_idx_growth + c->budg_uncommitted_idx;
++ idx_size = c->bi.old_idx_sz + c->bi.idx_growth + c->bi.uncommitted_idx;
+ /* And make sure we have thrice the index size of space reserved */
+ idx_size += idx_size << 1;
+ /*
+@@ -292,13 +292,13 @@ static int can_use_rp(struct ubifs_info *c)
+ * budgeted index space to the size of the current index, multiplies this by 3,
+ * and makes sure this does not exceed the amount of free LEBs.
+ *
+- * Notes about @c->min_idx_lebs and @c->lst.idx_lebs variables:
++ * Notes about @c->bi.min_idx_lebs and @c->lst.idx_lebs variables:
+ * o @c->lst.idx_lebs is the number of LEBs the index currently uses. It might
+ * be large, because UBIFS does not do any index consolidation as long as
+ * there is free space. IOW, the index may take a lot of LEBs, but the LEBs
+ * will contain a lot of dirt.
+- * o @c->min_idx_lebs is the number of LEBS the index presumably takes. IOW,
+- * the index may be consolidated to take up to @c->min_idx_lebs LEBs.
++ * o @c->bi.min_idx_lebs is the number of LEBS the index presumably takes. IOW,
++ * the index may be consolidated to take up to @c->bi.min_idx_lebs LEBs.
+ *
+ * This function returns zero in case of success, and %-ENOSPC in case of
+ * failure.
+@@ -343,13 +343,13 @@ static int do_budget_space(struct ubifs_info *c)
+ c->lst.taken_empty_lebs;
+ if (unlikely(rsvd_idx_lebs > lebs)) {
+ dbg_budg("out of indexing space: min_idx_lebs %d (old %d), "
+- "rsvd_idx_lebs %d", min_idx_lebs, c->min_idx_lebs,
++ "rsvd_idx_lebs %d", min_idx_lebs, c->bi.min_idx_lebs,
+ rsvd_idx_lebs);
+ return -ENOSPC;
+ }
+
+ available = ubifs_calc_available(c, min_idx_lebs);
+- outstanding = c->budg_data_growth + c->budg_dd_growth;
++ outstanding = c->bi.data_growth + c->bi.dd_growth;
+
+ if (unlikely(available < outstanding)) {
+ dbg_budg("out of data space: available %lld, outstanding %lld",
+@@ -360,7 +360,7 @@ static int do_budget_space(struct ubifs_info *c)
+ if (available - outstanding <= c->rp_size && !can_use_rp(c))
+ return -ENOSPC;
+
+- c->min_idx_lebs = min_idx_lebs;
++ c->bi.min_idx_lebs = min_idx_lebs;
+ return 0;
+ }
+
+@@ -393,11 +393,11 @@ static int calc_data_growth(const struct ubifs_info *c,
+ {
+ int data_growth;
+
+- data_growth = req->new_ino ? c->inode_budget : 0;
++ data_growth = req->new_ino ? c->bi.inode_budget : 0;
+ if (req->new_page)
+- data_growth += c->page_budget;
++ data_growth += c->bi.page_budget;
+ if (req->new_dent)
+- data_growth += c->dent_budget;
++ data_growth += c->bi.dent_budget;
+ data_growth += req->new_ino_d;
+ return data_growth;
+ }
+@@ -413,12 +413,12 @@ static int calc_dd_growth(const struct ubifs_info *c,
+ {
+ int dd_growth;
+
+- dd_growth = req->dirtied_page ? c->page_budget : 0;
++ dd_growth = req->dirtied_page ? c->bi.page_budget : 0;
+
+ if (req->dirtied_ino)
+- dd_growth += c->inode_budget << (req->dirtied_ino - 1);
++ dd_growth += c->bi.inode_budget << (req->dirtied_ino - 1);
+ if (req->mod_dent)
+- dd_growth += c->dent_budget;
++ dd_growth += c->bi.dent_budget;
+ dd_growth += req->dirtied_ino_d;
+ return dd_growth;
+ }
+@@ -460,19 +460,19 @@ int ubifs_budget_space(struct ubifs_info *c, struct ubifs_budget_req *req)
+
+ again:
+ spin_lock(&c->space_lock);
+- ubifs_assert(c->budg_idx_growth >= 0);
+- ubifs_assert(c->budg_data_growth >= 0);
+- ubifs_assert(c->budg_dd_growth >= 0);
++ ubifs_assert(c->bi.idx_growth >= 0);
++ ubifs_assert(c->bi.data_growth >= 0);
++ ubifs_assert(c->bi.dd_growth >= 0);
+
+- if (unlikely(c->nospace) && (c->nospace_rp || !can_use_rp(c))) {
++ if (unlikely(c->bi.nospace) && (c->bi.nospace_rp || !can_use_rp(c))) {
+ dbg_budg("no space");
+ spin_unlock(&c->space_lock);
+ return -ENOSPC;
+ }
+
+- c->budg_idx_growth += idx_growth;
+- c->budg_data_growth += data_growth;
+- c->budg_dd_growth += dd_growth;
++ c->bi.idx_growth += idx_growth;
++ c->bi.data_growth += data_growth;
++ c->bi.dd_growth += dd_growth;
+
+ err = do_budget_space(c);
+ if (likely(!err)) {
+@@ -484,9 +484,9 @@ again:
+ }
+
+ /* Restore the old values */
+- c->budg_idx_growth -= idx_growth;
+- c->budg_data_growth -= data_growth;
+- c->budg_dd_growth -= dd_growth;
++ c->bi.idx_growth -= idx_growth;
++ c->bi.data_growth -= data_growth;
++ c->bi.dd_growth -= dd_growth;
+ spin_unlock(&c->space_lock);
+
+ if (req->fast) {
+@@ -506,9 +506,9 @@ again:
+ goto again;
+ }
+ dbg_budg("FS is full, -ENOSPC");
+- c->nospace = 1;
++ c->bi.nospace = 1;
+ if (can_use_rp(c) || c->rp_size == 0)
+- c->nospace_rp = 1;
++ c->bi.nospace_rp = 1;
+ smp_wmb();
+ } else
+ ubifs_err("cannot budget space, error %d", err);
+@@ -523,8 +523,8 @@ again:
+ * This function releases the space budgeted by 'ubifs_budget_space()'. Note,
+ * since the index changes (which were budgeted for in @req->idx_growth) will
+ * only be written to the media on commit, this function moves the index budget
+- * from @c->budg_idx_growth to @c->budg_uncommitted_idx. The latter will be
+- * zeroed by the commit operation.
++ * from @c->bi.idx_growth to @c->bi.uncommitted_idx. The latter will be zeroed
++ * by the commit operation.
+ */
+ void ubifs_release_budget(struct ubifs_info *c, struct ubifs_budget_req *req)
+ {
+@@ -553,23 +553,23 @@ void ubifs_release_budget(struct ubifs_info *c, struct ubifs_budget_req *req)
+ if (!req->data_growth && !req->dd_growth)
+ return;
+
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+
+ spin_lock(&c->space_lock);
+- c->budg_idx_growth -= req->idx_growth;
+- c->budg_uncommitted_idx += req->idx_growth;
+- c->budg_data_growth -= req->data_growth;
+- c->budg_dd_growth -= req->dd_growth;
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+-
+- ubifs_assert(c->budg_idx_growth >= 0);
+- ubifs_assert(c->budg_data_growth >= 0);
+- ubifs_assert(c->budg_dd_growth >= 0);
+- ubifs_assert(c->min_idx_lebs < c->main_lebs);
+- ubifs_assert(!(c->budg_idx_growth & 7));
+- ubifs_assert(!(c->budg_data_growth & 7));
+- ubifs_assert(!(c->budg_dd_growth & 7));
++ c->bi.idx_growth -= req->idx_growth;
++ c->bi.uncommitted_idx += req->idx_growth;
++ c->bi.data_growth -= req->data_growth;
++ c->bi.dd_growth -= req->dd_growth;
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++
++ ubifs_assert(c->bi.idx_growth >= 0);
++ ubifs_assert(c->bi.data_growth >= 0);
++ ubifs_assert(c->bi.dd_growth >= 0);
++ ubifs_assert(c->bi.min_idx_lebs < c->main_lebs);
++ ubifs_assert(!(c->bi.idx_growth & 7));
++ ubifs_assert(!(c->bi.data_growth & 7));
++ ubifs_assert(!(c->bi.dd_growth & 7));
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -586,13 +586,13 @@ void ubifs_convert_page_budget(struct ubifs_info *c)
+ {
+ spin_lock(&c->space_lock);
+ /* Release the index growth reservation */
+- c->budg_idx_growth -= c->max_idx_node_sz << UBIFS_BLOCKS_PER_PAGE_SHIFT;
++ c->bi.idx_growth -= c->max_idx_node_sz << UBIFS_BLOCKS_PER_PAGE_SHIFT;
+ /* Release the data growth reservation */
+- c->budg_data_growth -= c->page_budget;
++ c->bi.data_growth -= c->bi.page_budget;
+ /* Increase the dirty data growth reservation instead */
+- c->budg_dd_growth += c->page_budget;
++ c->bi.dd_growth += c->bi.page_budget;
+ /* And re-calculate the indexing space reservation */
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -612,7 +612,7 @@ void ubifs_release_dirty_inode_budget(struct ubifs_info *c,
+
+ memset(&req, 0, sizeof(struct ubifs_budget_req));
+ /* The "no space" flags will be cleared because dd_growth is > 0 */
+- req.dd_growth = c->inode_budget + ALIGN(ui->data_len, 8);
++ req.dd_growth = c->bi.inode_budget + ALIGN(ui->data_len, 8);
+ ubifs_release_budget(c, &req);
+ }
+
+@@ -682,9 +682,9 @@ long long ubifs_get_free_space_nolock(struct ubifs_info *c)
+ int rsvd_idx_lebs, lebs;
+ long long available, outstanding, free;
+
+- ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
+- outstanding = c->budg_data_growth + c->budg_dd_growth;
+- available = ubifs_calc_available(c, c->min_idx_lebs);
++ ubifs_assert(c->bi.min_idx_lebs == ubifs_calc_min_idx_lebs(c));
++ outstanding = c->bi.data_growth + c->bi.dd_growth;
++ available = ubifs_calc_available(c, c->bi.min_idx_lebs);
+
+ /*
+ * When reporting free space to user-space, UBIFS guarantees that it is
+@@ -697,8 +697,8 @@ long long ubifs_get_free_space_nolock(struct ubifs_info *c)
+ * Note, the calculations below are similar to what we have in
+ * 'do_budget_space()', so refer there for comments.
+ */
+- if (c->min_idx_lebs > c->lst.idx_lebs)
+- rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
++ if (c->bi.min_idx_lebs > c->lst.idx_lebs)
++ rsvd_idx_lebs = c->bi.min_idx_lebs - c->lst.idx_lebs;
+ else
+ rsvd_idx_lebs = 0;
+ lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
+diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
+index 02429d8..fb3b5c8 100644
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -48,6 +48,56 @@
+ #include <linux/slab.h>
+ #include "ubifs.h"
+
++/*
++ * nothing_to_commit - check if there is nothing to commit.
++ * @c: UBIFS file-system description object
++ *
++ * This is a helper function which checks if there is anything to commit. It is
++ * used as an optimization to avoid starting the commit if it is not really
++ * necessary. Indeed, the commit operation always assumes flash I/O (e.g.,
++ * writing the commit start node to the log), and it is better to avoid doing
++ * this unnecessarily. E.g., 'ubifs_sync_fs()' runs the commit, but if there is
++ * nothing to commit, it is more optimal to avoid any flash I/O.
++ *
++ * This function has to be called with @c->commit_sem locked for writing -
++ * this function does not take LPT/TNC locks because the @c->commit_sem
++ * guarantees that we have exclusive access to the TNC and LPT data structures.
++ *
++ * This function returns %1 if there is nothing to commit and %0 otherwise.
++ */
++static int nothing_to_commit(struct ubifs_info *c)
++{
++ /*
++ * During mounting or remounting from R/O mode to R/W mode we may
++ * commit for various recovery-related reasons.
++ */
++ if (c->mounting || c->remounting_rw)
++ return 0;
++
++ /*
++ * If the root TNC node is dirty, we definitely have something to
++ * commit.
++ */
++ if (c->zroot.znode && ubifs_zn_dirty(c->zroot.znode))
++ return 0;
++
++ /*
++ * Even though the TNC is clean, the LPT tree may have dirty nodes. For
++ * example, this may happen if the budgeting subsystem invoked GC to
++ * make some free space, and the GC found an LEB with only dirty and
++ * free space. In this case GC would just change the lprops of this
++ * LEB (by turning all space into free space) and unmap it.
++ */
++ if (c->nroot && test_bit(DIRTY_CNODE, &c->nroot->flags))
++ return 0;
++
++ ubifs_assert(atomic_long_read(&c->dirty_zn_cnt) == 0);
++ ubifs_assert(c->dirty_pn_cnt == 0);
++ ubifs_assert(c->dirty_nn_cnt == 0);
++
++ return 1;
++}
++
+ /**
+ * do_commit - commit the journal.
+ * @c: UBIFS file-system description object
+@@ -70,6 +120,12 @@ static int do_commit(struct ubifs_info *c)
+ goto out_up;
+ }
+
++ if (nothing_to_commit(c)) {
++ up_write(&c->commit_sem);
++ err = 0;
++ goto out_cancel;
++ }
++
+ /* Sync all write buffers (necessary for recovery) */
+ for (i = 0; i < c->jhead_cnt; i++) {
+ err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
+@@ -126,7 +182,7 @@ static int do_commit(struct ubifs_info *c)
+ c->mst_node->root_len = cpu_to_le32(zroot.len);
+ c->mst_node->ihead_lnum = cpu_to_le32(c->ihead_lnum);
+ c->mst_node->ihead_offs = cpu_to_le32(c->ihead_offs);
+- c->mst_node->index_size = cpu_to_le64(c->old_idx_sz);
++ c->mst_node->index_size = cpu_to_le64(c->bi.old_idx_sz);
+ c->mst_node->lpt_lnum = cpu_to_le32(c->lpt_lnum);
+ c->mst_node->lpt_offs = cpu_to_le32(c->lpt_offs);
+ c->mst_node->nhead_lnum = cpu_to_le32(c->nhead_lnum);
+@@ -162,12 +218,12 @@ static int do_commit(struct ubifs_info *c)
+ if (err)
+ goto out;
+
++out_cancel:
+ spin_lock(&c->cs_lock);
+ c->cmt_state = COMMIT_RESTING;
+ wake_up(&c->cmt_wq);
+ dbg_cmt("commit end");
+ spin_unlock(&c->cs_lock);
+-
+ return 0;
+
+ out_up:
+@@ -362,7 +418,7 @@ int ubifs_run_commit(struct ubifs_info *c)
+
+ spin_lock(&c->cs_lock);
+ if (c->cmt_state == COMMIT_BROKEN) {
+- err = -EINVAL;
++ err = -EROFS;
+ goto out;
+ }
+
+@@ -388,7 +444,7 @@ int ubifs_run_commit(struct ubifs_info *c)
+ * re-check it.
+ */
+ if (c->cmt_state == COMMIT_BROKEN) {
+- err = -EINVAL;
++ err = -EROFS;
+ goto out_cmt_unlock;
+ }
+
+@@ -520,8 +576,8 @@ int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot)
+ struct idx_node *i;
+ size_t sz;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_OLD_IDX))
+- goto out;
++ if (!dbg_is_chk_index(c))
++ return 0;
+
+ INIT_LIST_HEAD(&list);
+
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index 0bee4db..1934084 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -27,33 +27,16 @@
+ * various local functions of those subsystems.
+ */
+
+-#define UBIFS_DBG_PRESERVE_UBI
+-
+-#include "ubifs.h"
+ #include <linux/module.h>
+-#include <linux/moduleparam.h>
+ #include <linux/debugfs.h>
+ #include <linux/math64.h>
+-#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/random.h>
++#include "ubifs.h"
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+
+-DEFINE_SPINLOCK(dbg_lock);
+-
+-static char dbg_key_buf0[128];
+-static char dbg_key_buf1[128];
+-
+-unsigned int ubifs_msg_flags = UBIFS_MSG_FLAGS_DEFAULT;
+-unsigned int ubifs_chk_flags = UBIFS_CHK_FLAGS_DEFAULT;
+-unsigned int ubifs_tst_flags;
+-
+-module_param_named(debug_msgs, ubifs_msg_flags, uint, S_IRUGO | S_IWUSR);
+-module_param_named(debug_chks, ubifs_chk_flags, uint, S_IRUGO | S_IWUSR);
+-module_param_named(debug_tsts, ubifs_tst_flags, uint, S_IRUGO | S_IWUSR);
+-
+-MODULE_PARM_DESC(debug_msgs, "Debug message type flags");
+-MODULE_PARM_DESC(debug_chks, "Debug check flags");
+-MODULE_PARM_DESC(debug_tsts, "Debug special test flags");
++static DEFINE_SPINLOCK(dbg_lock);
+
+ static const char *get_key_fmt(int fmt)
+ {
+@@ -95,8 +78,30 @@ static const char *get_key_type(int type)
+ }
+ }
+
+-static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
+- char *buffer)
++static const char *get_dent_type(int type)
++{
++ switch (type) {
++ case UBIFS_ITYPE_REG:
++ return "file";
++ case UBIFS_ITYPE_DIR:
++ return "dir";
++ case UBIFS_ITYPE_LNK:
++ return "symlink";
++ case UBIFS_ITYPE_BLK:
++ return "blkdev";
++ case UBIFS_ITYPE_CHR:
++ return "char dev";
++ case UBIFS_ITYPE_FIFO:
++ return "fifo";
++ case UBIFS_ITYPE_SOCK:
++ return "socket";
++ default:
++ return "unknown/invalid type";
++ }
++}
++
++const char *dbg_snprintf_key(const struct ubifs_info *c,
++ const union ubifs_key *key, char *buffer, int len)
+ {
+ char *p = buffer;
+ int type = key_type(c, key);
+@@ -104,45 +109,34 @@ static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
+ if (c->key_fmt == UBIFS_SIMPLE_KEY_FMT) {
+ switch (type) {
+ case UBIFS_INO_KEY:
+- sprintf(p, "(%lu, %s)", (unsigned long)key_inum(c, key),
+- get_key_type(type));
++ len -= snprintf(p, len, "(%lu, %s)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type));
+ break;
+ case UBIFS_DENT_KEY:
+ case UBIFS_XENT_KEY:
+- sprintf(p, "(%lu, %s, %#08x)",
+- (unsigned long)key_inum(c, key),
+- get_key_type(type), key_hash(c, key));
++ len -= snprintf(p, len, "(%lu, %s, %#08x)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type), key_hash(c, key));
+ break;
+ case UBIFS_DATA_KEY:
+- sprintf(p, "(%lu, %s, %u)",
+- (unsigned long)key_inum(c, key),
+- get_key_type(type), key_block(c, key));
++ len -= snprintf(p, len, "(%lu, %s, %u)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type), key_block(c, key));
+ break;
+ case UBIFS_TRUN_KEY:
+- sprintf(p, "(%lu, %s)",
+- (unsigned long)key_inum(c, key),
+- get_key_type(type));
++ len -= snprintf(p, len, "(%lu, %s)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type));
+ break;
+ default:
+- sprintf(p, "(bad key type: %#08x, %#08x)",
+- key->u32[0], key->u32[1]);
++ len -= snprintf(p, len, "(bad key type: %#08x, %#08x)",
++ key->u32[0], key->u32[1]);
+ }
+ } else
+- sprintf(p, "bad key format %d", c->key_fmt);
+-}
+-
+-const char *dbg_key_str0(const struct ubifs_info *c, const union ubifs_key *key)
+-{
+- /* dbg_lock must be held */
+- sprintf_key(c, key, dbg_key_buf0);
+- return dbg_key_buf0;
+-}
+-
+-const char *dbg_key_str1(const struct ubifs_info *c, const union ubifs_key *key)
+-{
+- /* dbg_lock must be held */
+- sprintf_key(c, key, dbg_key_buf1);
+- return dbg_key_buf1;
++ len -= snprintf(p, len, "bad key format %d", c->key_fmt);
++ ubifs_assert(len > 0);
++ return p;
+ }
+
+ const char *dbg_ntype(int type)
+@@ -227,53 +221,83 @@ const char *dbg_jhead(int jhead)
+
+ static void dump_ch(const struct ubifs_ch *ch)
+ {
+- printk(KERN_DEBUG "\tmagic %#x\n", le32_to_cpu(ch->magic));
+- printk(KERN_DEBUG "\tcrc %#x\n", le32_to_cpu(ch->crc));
+- printk(KERN_DEBUG "\tnode_type %d (%s)\n", ch->node_type,
++ printk(KERN_ERR "\tmagic %#x\n", le32_to_cpu(ch->magic));
++ printk(KERN_ERR "\tcrc %#x\n", le32_to_cpu(ch->crc));
++ printk(KERN_ERR "\tnode_type %d (%s)\n", ch->node_type,
+ dbg_ntype(ch->node_type));
+- printk(KERN_DEBUG "\tgroup_type %d (%s)\n", ch->group_type,
++ printk(KERN_ERR "\tgroup_type %d (%s)\n", ch->group_type,
+ dbg_gtype(ch->group_type));
+- printk(KERN_DEBUG "\tsqnum %llu\n",
++ printk(KERN_ERR "\tsqnum %llu\n",
+ (unsigned long long)le64_to_cpu(ch->sqnum));
+- printk(KERN_DEBUG "\tlen %u\n", le32_to_cpu(ch->len));
++ printk(KERN_ERR "\tlen %u\n", le32_to_cpu(ch->len));
+ }
+
+-void dbg_dump_inode(const struct ubifs_info *c, const struct inode *inode)
++void dbg_dump_inode(struct ubifs_info *c, const struct inode *inode)
+ {
+ const struct ubifs_inode *ui = ubifs_inode(inode);
++ struct qstr nm = { .name = NULL };
++ union ubifs_key key;
++ struct ubifs_dent_node *dent, *pdent = NULL;
++ int count = 2;
+
+- printk(KERN_DEBUG "Dump in-memory inode:");
+- printk(KERN_DEBUG "\tinode %lu\n", inode->i_ino);
+- printk(KERN_DEBUG "\tsize %llu\n",
++ printk(KERN_ERR "Dump in-memory inode:");
++ printk(KERN_ERR "\tinode %lu\n", inode->i_ino);
++ printk(KERN_ERR "\tsize %llu\n",
+ (unsigned long long)i_size_read(inode));
+- printk(KERN_DEBUG "\tnlink %u\n", inode->i_nlink);
+- printk(KERN_DEBUG "\tuid %u\n", (unsigned int)inode->i_uid);
+- printk(KERN_DEBUG "\tgid %u\n", (unsigned int)inode->i_gid);
+- printk(KERN_DEBUG "\tatime %u.%u\n",
++ printk(KERN_ERR "\tnlink %u\n", inode->i_nlink);
++ printk(KERN_ERR "\tuid %u\n", (unsigned int)inode->i_uid);
++ printk(KERN_ERR "\tgid %u\n", (unsigned int)inode->i_gid);
++ printk(KERN_ERR "\tatime %u.%u\n",
+ (unsigned int)inode->i_atime.tv_sec,
+ (unsigned int)inode->i_atime.tv_nsec);
+- printk(KERN_DEBUG "\tmtime %u.%u\n",
++ printk(KERN_ERR "\tmtime %u.%u\n",
+ (unsigned int)inode->i_mtime.tv_sec,
+ (unsigned int)inode->i_mtime.tv_nsec);
+- printk(KERN_DEBUG "\tctime %u.%u\n",
++ printk(KERN_ERR "\tctime %u.%u\n",
+ (unsigned int)inode->i_ctime.tv_sec,
+ (unsigned int)inode->i_ctime.tv_nsec);
+- printk(KERN_DEBUG "\tcreat_sqnum %llu\n", ui->creat_sqnum);
+- printk(KERN_DEBUG "\txattr_size %u\n", ui->xattr_size);
+- printk(KERN_DEBUG "\txattr_cnt %u\n", ui->xattr_cnt);
+- printk(KERN_DEBUG "\txattr_names %u\n", ui->xattr_names);
+- printk(KERN_DEBUG "\tdirty %u\n", ui->dirty);
+- printk(KERN_DEBUG "\txattr %u\n", ui->xattr);
+- printk(KERN_DEBUG "\tbulk_read %u\n", ui->xattr);
+- printk(KERN_DEBUG "\tsynced_i_size %llu\n",
++ printk(KERN_ERR "\tcreat_sqnum %llu\n", ui->creat_sqnum);
++ printk(KERN_ERR "\txattr_size %u\n", ui->xattr_size);
++ printk(KERN_ERR "\txattr_cnt %u\n", ui->xattr_cnt);
++ printk(KERN_ERR "\txattr_names %u\n", ui->xattr_names);
++ printk(KERN_ERR "\tdirty %u\n", ui->dirty);
++ printk(KERN_ERR "\txattr %u\n", ui->xattr);
++ printk(KERN_ERR "\tbulk_read %u\n", ui->xattr);
++ printk(KERN_ERR "\tsynced_i_size %llu\n",
+ (unsigned long long)ui->synced_i_size);
+- printk(KERN_DEBUG "\tui_size %llu\n",
++ printk(KERN_ERR "\tui_size %llu\n",
+ (unsigned long long)ui->ui_size);
+- printk(KERN_DEBUG "\tflags %d\n", ui->flags);
+- printk(KERN_DEBUG "\tcompr_type %d\n", ui->compr_type);
+- printk(KERN_DEBUG "\tlast_page_read %lu\n", ui->last_page_read);
+- printk(KERN_DEBUG "\tread_in_a_row %lu\n", ui->read_in_a_row);
+- printk(KERN_DEBUG "\tdata_len %d\n", ui->data_len);
++ printk(KERN_ERR "\tflags %d\n", ui->flags);
++ printk(KERN_ERR "\tcompr_type %d\n", ui->compr_type);
++ printk(KERN_ERR "\tlast_page_read %lu\n", ui->last_page_read);
++ printk(KERN_ERR "\tread_in_a_row %lu\n", ui->read_in_a_row);
++ printk(KERN_ERR "\tdata_len %d\n", ui->data_len);
++
++ if (!S_ISDIR(inode->i_mode))
++ return;
++
++ printk(KERN_ERR "List of directory entries:\n");
++ ubifs_assert(!mutex_is_locked(&c->tnc_mutex));
++
++ lowest_dent_key(c, &key, inode->i_ino);
++ while (1) {
++ dent = ubifs_tnc_next_ent(c, &key, &nm);
++ if (IS_ERR(dent)) {
++ if (PTR_ERR(dent) != -ENOENT)
++ printk(KERN_ERR "error %ld\n", PTR_ERR(dent));
++ break;
++ }
++
++ printk(KERN_ERR "\t%d: %s (%s)\n",
++ count++, dent->name, get_dent_type(dent->type));
++
++ nm.name = dent->name;
++ nm.len = le16_to_cpu(dent->nlen);
++ kfree(pdent);
++ pdent = dent;
++ key_read(c, &dent->key, &key);
++ }
++ kfree(pdent);
+ }
+
+ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+@@ -281,14 +305,15 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ int i, n;
+ union ubifs_key key;
+ const struct ubifs_ch *ch = node;
++ char key_buf[DBG_KEY_BUF_LEN];
+
+- if (dbg_failure_mode)
++ if (dbg_is_tst_rcvry(c))
+ return;
+
+ /* If the magic is incorrect, just hexdump the first bytes */
+ if (le32_to_cpu(ch->magic) != UBIFS_NODE_MAGIC) {
+- printk(KERN_DEBUG "Not a node, first %zu bytes:", UBIFS_CH_SZ);
+- print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
++ printk(KERN_ERR "Not a node, first %zu bytes:", UBIFS_CH_SZ);
++ print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 32, 1,
+ (void *)node, UBIFS_CH_SZ, 1);
+ return;
+ }
+@@ -301,7 +326,7 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_pad_node *pad = node;
+
+- printk(KERN_DEBUG "\tpad_len %u\n",
++ printk(KERN_ERR "\tpad_len %u\n",
+ le32_to_cpu(pad->pad_len));
+ break;
+ }
+@@ -310,48 +335,50 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ const struct ubifs_sb_node *sup = node;
+ unsigned int sup_flags = le32_to_cpu(sup->flags);
+
+- printk(KERN_DEBUG "\tkey_hash %d (%s)\n",
++ printk(KERN_ERR "\tkey_hash %d (%s)\n",
+ (int)sup->key_hash, get_key_hash(sup->key_hash));
+- printk(KERN_DEBUG "\tkey_fmt %d (%s)\n",
++ printk(KERN_ERR "\tkey_fmt %d (%s)\n",
+ (int)sup->key_fmt, get_key_fmt(sup->key_fmt));
+- printk(KERN_DEBUG "\tflags %#x\n", sup_flags);
+- printk(KERN_DEBUG "\t big_lpt %u\n",
++ printk(KERN_ERR "\tflags %#x\n", sup_flags);
++ printk(KERN_ERR "\t big_lpt %u\n",
+ !!(sup_flags & UBIFS_FLG_BIGLPT));
+- printk(KERN_DEBUG "\tmin_io_size %u\n",
++ printk(KERN_ERR "\t space_fixup %u\n",
++ !!(sup_flags & UBIFS_FLG_SPACE_FIXUP));
++ printk(KERN_ERR "\tmin_io_size %u\n",
+ le32_to_cpu(sup->min_io_size));
+- printk(KERN_DEBUG "\tleb_size %u\n",
++ printk(KERN_ERR "\tleb_size %u\n",
+ le32_to_cpu(sup->leb_size));
+- printk(KERN_DEBUG "\tleb_cnt %u\n",
++ printk(KERN_ERR "\tleb_cnt %u\n",
+ le32_to_cpu(sup->leb_cnt));
+- printk(KERN_DEBUG "\tmax_leb_cnt %u\n",
++ printk(KERN_ERR "\tmax_leb_cnt %u\n",
+ le32_to_cpu(sup->max_leb_cnt));
+- printk(KERN_DEBUG "\tmax_bud_bytes %llu\n",
++ printk(KERN_ERR "\tmax_bud_bytes %llu\n",
+ (unsigned long long)le64_to_cpu(sup->max_bud_bytes));
+- printk(KERN_DEBUG "\tlog_lebs %u\n",
++ printk(KERN_ERR "\tlog_lebs %u\n",
+ le32_to_cpu(sup->log_lebs));
+- printk(KERN_DEBUG "\tlpt_lebs %u\n",
++ printk(KERN_ERR "\tlpt_lebs %u\n",
+ le32_to_cpu(sup->lpt_lebs));
+- printk(KERN_DEBUG "\torph_lebs %u\n",
++ printk(KERN_ERR "\torph_lebs %u\n",
+ le32_to_cpu(sup->orph_lebs));
+- printk(KERN_DEBUG "\tjhead_cnt %u\n",
++ printk(KERN_ERR "\tjhead_cnt %u\n",
+ le32_to_cpu(sup->jhead_cnt));
+- printk(KERN_DEBUG "\tfanout %u\n",
++ printk(KERN_ERR "\tfanout %u\n",
+ le32_to_cpu(sup->fanout));
+- printk(KERN_DEBUG "\tlsave_cnt %u\n",
++ printk(KERN_ERR "\tlsave_cnt %u\n",
+ le32_to_cpu(sup->lsave_cnt));
+- printk(KERN_DEBUG "\tdefault_compr %u\n",
++ printk(KERN_ERR "\tdefault_compr %u\n",
+ (int)le16_to_cpu(sup->default_compr));
+- printk(KERN_DEBUG "\trp_size %llu\n",
++ printk(KERN_ERR "\trp_size %llu\n",
+ (unsigned long long)le64_to_cpu(sup->rp_size));
+- printk(KERN_DEBUG "\trp_uid %u\n",
++ printk(KERN_ERR "\trp_uid %u\n",
+ le32_to_cpu(sup->rp_uid));
+- printk(KERN_DEBUG "\trp_gid %u\n",
++ printk(KERN_ERR "\trp_gid %u\n",
+ le32_to_cpu(sup->rp_gid));
+- printk(KERN_DEBUG "\tfmt_version %u\n",
++ printk(KERN_ERR "\tfmt_version %u\n",
+ le32_to_cpu(sup->fmt_version));
+- printk(KERN_DEBUG "\ttime_gran %u\n",
++ printk(KERN_ERR "\ttime_gran %u\n",
+ le32_to_cpu(sup->time_gran));
+- printk(KERN_DEBUG "\tUUID %pUB\n",
++ printk(KERN_ERR "\tUUID %pUB\n",
+ sup->uuid);
+ break;
+ }
+@@ -359,61 +386,61 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_mst_node *mst = node;
+
+- printk(KERN_DEBUG "\thighest_inum %llu\n",
++ printk(KERN_ERR "\thighest_inum %llu\n",
+ (unsigned long long)le64_to_cpu(mst->highest_inum));
+- printk(KERN_DEBUG "\tcommit number %llu\n",
++ printk(KERN_ERR "\tcommit number %llu\n",
+ (unsigned long long)le64_to_cpu(mst->cmt_no));
+- printk(KERN_DEBUG "\tflags %#x\n",
++ printk(KERN_ERR "\tflags %#x\n",
+ le32_to_cpu(mst->flags));
+- printk(KERN_DEBUG "\tlog_lnum %u\n",
++ printk(KERN_ERR "\tlog_lnum %u\n",
+ le32_to_cpu(mst->log_lnum));
+- printk(KERN_DEBUG "\troot_lnum %u\n",
++ printk(KERN_ERR "\troot_lnum %u\n",
+ le32_to_cpu(mst->root_lnum));
+- printk(KERN_DEBUG "\troot_offs %u\n",
++ printk(KERN_ERR "\troot_offs %u\n",
+ le32_to_cpu(mst->root_offs));
+- printk(KERN_DEBUG "\troot_len %u\n",
++ printk(KERN_ERR "\troot_len %u\n",
+ le32_to_cpu(mst->root_len));
+- printk(KERN_DEBUG "\tgc_lnum %u\n",
++ printk(KERN_ERR "\tgc_lnum %u\n",
+ le32_to_cpu(mst->gc_lnum));
+- printk(KERN_DEBUG "\tihead_lnum %u\n",
++ printk(KERN_ERR "\tihead_lnum %u\n",
+ le32_to_cpu(mst->ihead_lnum));
+- printk(KERN_DEBUG "\tihead_offs %u\n",
++ printk(KERN_ERR "\tihead_offs %u\n",
+ le32_to_cpu(mst->ihead_offs));
+- printk(KERN_DEBUG "\tindex_size %llu\n",
++ printk(KERN_ERR "\tindex_size %llu\n",
+ (unsigned long long)le64_to_cpu(mst->index_size));
+- printk(KERN_DEBUG "\tlpt_lnum %u\n",
++ printk(KERN_ERR "\tlpt_lnum %u\n",
+ le32_to_cpu(mst->lpt_lnum));
+- printk(KERN_DEBUG "\tlpt_offs %u\n",
++ printk(KERN_ERR "\tlpt_offs %u\n",
+ le32_to_cpu(mst->lpt_offs));
+- printk(KERN_DEBUG "\tnhead_lnum %u\n",
++ printk(KERN_ERR "\tnhead_lnum %u\n",
+ le32_to_cpu(mst->nhead_lnum));
+- printk(KERN_DEBUG "\tnhead_offs %u\n",
++ printk(KERN_ERR "\tnhead_offs %u\n",
+ le32_to_cpu(mst->nhead_offs));
+- printk(KERN_DEBUG "\tltab_lnum %u\n",
++ printk(KERN_ERR "\tltab_lnum %u\n",
+ le32_to_cpu(mst->ltab_lnum));
+- printk(KERN_DEBUG "\tltab_offs %u\n",
++ printk(KERN_ERR "\tltab_offs %u\n",
+ le32_to_cpu(mst->ltab_offs));
+- printk(KERN_DEBUG "\tlsave_lnum %u\n",
++ printk(KERN_ERR "\tlsave_lnum %u\n",
+ le32_to_cpu(mst->lsave_lnum));
+- printk(KERN_DEBUG "\tlsave_offs %u\n",
++ printk(KERN_ERR "\tlsave_offs %u\n",
+ le32_to_cpu(mst->lsave_offs));
+- printk(KERN_DEBUG "\tlscan_lnum %u\n",
++ printk(KERN_ERR "\tlscan_lnum %u\n",
+ le32_to_cpu(mst->lscan_lnum));
+- printk(KERN_DEBUG "\tleb_cnt %u\n",
++ printk(KERN_ERR "\tleb_cnt %u\n",
+ le32_to_cpu(mst->leb_cnt));
+- printk(KERN_DEBUG "\tempty_lebs %u\n",
++ printk(KERN_ERR "\tempty_lebs %u\n",
+ le32_to_cpu(mst->empty_lebs));
+- printk(KERN_DEBUG "\tidx_lebs %u\n",
++ printk(KERN_ERR "\tidx_lebs %u\n",
+ le32_to_cpu(mst->idx_lebs));
+- printk(KERN_DEBUG "\ttotal_free %llu\n",
++ printk(KERN_ERR "\ttotal_free %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_free));
+- printk(KERN_DEBUG "\ttotal_dirty %llu\n",
++ printk(KERN_ERR "\ttotal_dirty %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_dirty));
+- printk(KERN_DEBUG "\ttotal_used %llu\n",
++ printk(KERN_ERR "\ttotal_used %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_used));
+- printk(KERN_DEBUG "\ttotal_dead %llu\n",
++ printk(KERN_ERR "\ttotal_dead %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_dead));
+- printk(KERN_DEBUG "\ttotal_dark %llu\n",
++ printk(KERN_ERR "\ttotal_dark %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_dark));
+ break;
+ }
+@@ -421,11 +448,11 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_ref_node *ref = node;
+
+- printk(KERN_DEBUG "\tlnum %u\n",
++ printk(KERN_ERR "\tlnum %u\n",
+ le32_to_cpu(ref->lnum));
+- printk(KERN_DEBUG "\toffs %u\n",
++ printk(KERN_ERR "\toffs %u\n",
+ le32_to_cpu(ref->offs));
+- printk(KERN_DEBUG "\tjhead %u\n",
++ printk(KERN_ERR "\tjhead %u\n",
+ le32_to_cpu(ref->jhead));
+ break;
+ }
+@@ -434,39 +461,40 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ const struct ubifs_ino_node *ino = node;
+
+ key_read(c, &ino->key, &key);
+- printk(KERN_DEBUG "\tkey %s\n", DBGKEY(&key));
+- printk(KERN_DEBUG "\tcreat_sqnum %llu\n",
++ printk(KERN_ERR "\tkey %s\n",
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
++ printk(KERN_ERR "\tcreat_sqnum %llu\n",
+ (unsigned long long)le64_to_cpu(ino->creat_sqnum));
+- printk(KERN_DEBUG "\tsize %llu\n",
++ printk(KERN_ERR "\tsize %llu\n",
+ (unsigned long long)le64_to_cpu(ino->size));
+- printk(KERN_DEBUG "\tnlink %u\n",
++ printk(KERN_ERR "\tnlink %u\n",
+ le32_to_cpu(ino->nlink));
+- printk(KERN_DEBUG "\tatime %lld.%u\n",
++ printk(KERN_ERR "\tatime %lld.%u\n",
+ (long long)le64_to_cpu(ino->atime_sec),
+ le32_to_cpu(ino->atime_nsec));
+- printk(KERN_DEBUG "\tmtime %lld.%u\n",
++ printk(KERN_ERR "\tmtime %lld.%u\n",
+ (long long)le64_to_cpu(ino->mtime_sec),
+ le32_to_cpu(ino->mtime_nsec));
+- printk(KERN_DEBUG "\tctime %lld.%u\n",
++ printk(KERN_ERR "\tctime %lld.%u\n",
+ (long long)le64_to_cpu(ino->ctime_sec),
+ le32_to_cpu(ino->ctime_nsec));
+- printk(KERN_DEBUG "\tuid %u\n",
++ printk(KERN_ERR "\tuid %u\n",
+ le32_to_cpu(ino->uid));
+- printk(KERN_DEBUG "\tgid %u\n",
++ printk(KERN_ERR "\tgid %u\n",
+ le32_to_cpu(ino->gid));
+- printk(KERN_DEBUG "\tmode %u\n",
++ printk(KERN_ERR "\tmode %u\n",
+ le32_to_cpu(ino->mode));
+- printk(KERN_DEBUG "\tflags %#x\n",
++ printk(KERN_ERR "\tflags %#x\n",
+ le32_to_cpu(ino->flags));
+- printk(KERN_DEBUG "\txattr_cnt %u\n",
++ printk(KERN_ERR "\txattr_cnt %u\n",
+ le32_to_cpu(ino->xattr_cnt));
+- printk(KERN_DEBUG "\txattr_size %u\n",
++ printk(KERN_ERR "\txattr_size %u\n",
+ le32_to_cpu(ino->xattr_size));
+- printk(KERN_DEBUG "\txattr_names %u\n",
++ printk(KERN_ERR "\txattr_names %u\n",
+ le32_to_cpu(ino->xattr_names));
+- printk(KERN_DEBUG "\tcompr_type %#x\n",
++ printk(KERN_ERR "\tcompr_type %#x\n",
+ (int)le16_to_cpu(ino->compr_type));
+- printk(KERN_DEBUG "\tdata len %u\n",
++ printk(KERN_ERR "\tdata len %u\n",
+ le32_to_cpu(ino->data_len));
+ break;
+ }
+@@ -477,15 +505,16 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ int nlen = le16_to_cpu(dent->nlen);
+
+ key_read(c, &dent->key, &key);
+- printk(KERN_DEBUG "\tkey %s\n", DBGKEY(&key));
+- printk(KERN_DEBUG "\tinum %llu\n",
++ printk(KERN_ERR "\tkey %s\n",
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
++ printk(KERN_ERR "\tinum %llu\n",
+ (unsigned long long)le64_to_cpu(dent->inum));
+- printk(KERN_DEBUG "\ttype %d\n", (int)dent->type);
+- printk(KERN_DEBUG "\tnlen %d\n", nlen);
+- printk(KERN_DEBUG "\tname ");
++ printk(KERN_ERR "\ttype %d\n", (int)dent->type);
++ printk(KERN_ERR "\tnlen %d\n", nlen);
++ printk(KERN_ERR "\tname ");
+
+ if (nlen > UBIFS_MAX_NLEN)
+- printk(KERN_DEBUG "(bad name length, not printing, "
++ printk(KERN_ERR "(bad name length, not printing, "
+ "bad or corrupted node)");
+ else {
+ for (i = 0; i < nlen && dent->name[i]; i++)
+@@ -501,15 +530,16 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ int dlen = le32_to_cpu(ch->len) - UBIFS_DATA_NODE_SZ;
+
+ key_read(c, &dn->key, &key);
+- printk(KERN_DEBUG "\tkey %s\n", DBGKEY(&key));
+- printk(KERN_DEBUG "\tsize %u\n",
++ printk(KERN_ERR "\tkey %s\n",
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
++ printk(KERN_ERR "\tsize %u\n",
+ le32_to_cpu(dn->size));
+- printk(KERN_DEBUG "\tcompr_typ %d\n",
++ printk(KERN_ERR "\tcompr_typ %d\n",
+ (int)le16_to_cpu(dn->compr_type));
+- printk(KERN_DEBUG "\tdata size %d\n",
++ printk(KERN_ERR "\tdata size %d\n",
+ dlen);
+- printk(KERN_DEBUG "\tdata:\n");
+- print_hex_dump(KERN_DEBUG, "\t", DUMP_PREFIX_OFFSET, 32, 1,
++ printk(KERN_ERR "\tdata:\n");
++ print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
+ (void *)&dn->data, dlen, 0);
+ break;
+ }
+@@ -517,11 +547,11 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_trun_node *trun = node;
+
+- printk(KERN_DEBUG "\tinum %u\n",
++ printk(KERN_ERR "\tinum %u\n",
+ le32_to_cpu(trun->inum));
+- printk(KERN_DEBUG "\told_size %llu\n",
++ printk(KERN_ERR "\told_size %llu\n",
+ (unsigned long long)le64_to_cpu(trun->old_size));
+- printk(KERN_DEBUG "\tnew_size %llu\n",
++ printk(KERN_ERR "\tnew_size %llu\n",
+ (unsigned long long)le64_to_cpu(trun->new_size));
+ break;
+ }
+@@ -530,19 +560,21 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ const struct ubifs_idx_node *idx = node;
+
+ n = le16_to_cpu(idx->child_cnt);
+- printk(KERN_DEBUG "\tchild_cnt %d\n", n);
+- printk(KERN_DEBUG "\tlevel %d\n",
++ printk(KERN_ERR "\tchild_cnt %d\n", n);
++ printk(KERN_ERR "\tlevel %d\n",
+ (int)le16_to_cpu(idx->level));
+- printk(KERN_DEBUG "\tBranches:\n");
++ printk(KERN_ERR "\tBranches:\n");
+
+ for (i = 0; i < n && i < c->fanout - 1; i++) {
+ const struct ubifs_branch *br;
+
+ br = ubifs_idx_branch(c, idx, i);
+ key_read(c, &br->key, &key);
+- printk(KERN_DEBUG "\t%d: LEB %d:%d len %d key %s\n",
++ printk(KERN_ERR "\t%d: LEB %d:%d len %d key %s\n",
+ i, le32_to_cpu(br->lnum), le32_to_cpu(br->offs),
+- le32_to_cpu(br->len), DBGKEY(&key));
++ le32_to_cpu(br->len),
++ dbg_snprintf_key(c, &key, key_buf,
++ DBG_KEY_BUF_LEN));
+ }
+ break;
+ }
+@@ -552,20 +584,20 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_orph_node *orph = node;
+
+- printk(KERN_DEBUG "\tcommit number %llu\n",
++ printk(KERN_ERR "\tcommit number %llu\n",
+ (unsigned long long)
+ le64_to_cpu(orph->cmt_no) & LLONG_MAX);
+- printk(KERN_DEBUG "\tlast node flag %llu\n",
++ printk(KERN_ERR "\tlast node flag %llu\n",
+ (unsigned long long)(le64_to_cpu(orph->cmt_no)) >> 63);
+ n = (le32_to_cpu(ch->len) - UBIFS_ORPH_NODE_SZ) >> 3;
+- printk(KERN_DEBUG "\t%d orphan inode numbers:\n", n);
++ printk(KERN_ERR "\t%d orphan inode numbers:\n", n);
+ for (i = 0; i < n; i++)
+- printk(KERN_DEBUG "\t ino %llu\n",
++ printk(KERN_ERR "\t ino %llu\n",
+ (unsigned long long)le64_to_cpu(orph->inos[i]));
+ break;
+ }
+ default:
+- printk(KERN_DEBUG "node type %d was not recognized\n",
++ printk(KERN_ERR "node type %d was not recognized\n",
+ (int)ch->node_type);
+ }
+ spin_unlock(&dbg_lock);
+@@ -574,16 +606,16 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ void dbg_dump_budget_req(const struct ubifs_budget_req *req)
+ {
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "Budgeting request: new_ino %d, dirtied_ino %d\n",
++ printk(KERN_ERR "Budgeting request: new_ino %d, dirtied_ino %d\n",
+ req->new_ino, req->dirtied_ino);
+- printk(KERN_DEBUG "\tnew_ino_d %d, dirtied_ino_d %d\n",
++ printk(KERN_ERR "\tnew_ino_d %d, dirtied_ino_d %d\n",
+ req->new_ino_d, req->dirtied_ino_d);
+- printk(KERN_DEBUG "\tnew_page %d, dirtied_page %d\n",
++ printk(KERN_ERR "\tnew_page %d, dirtied_page %d\n",
+ req->new_page, req->dirtied_page);
+- printk(KERN_DEBUG "\tnew_dent %d, mod_dent %d\n",
++ printk(KERN_ERR "\tnew_dent %d, mod_dent %d\n",
+ req->new_dent, req->mod_dent);
+- printk(KERN_DEBUG "\tidx_growth %d\n", req->idx_growth);
+- printk(KERN_DEBUG "\tdata_growth %d dd_growth %d\n",
++ printk(KERN_ERR "\tidx_growth %d\n", req->idx_growth);
++ printk(KERN_ERR "\tdata_growth %d dd_growth %d\n",
+ req->data_growth, req->dd_growth);
+ spin_unlock(&dbg_lock);
+ }
+@@ -591,18 +623,18 @@ void dbg_dump_budget_req(const struct ubifs_budget_req *req)
+ void dbg_dump_lstats(const struct ubifs_lp_stats *lst)
+ {
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "(pid %d) Lprops statistics: empty_lebs %d, "
++ printk(KERN_ERR "(pid %d) Lprops statistics: empty_lebs %d, "
+ "idx_lebs %d\n", current->pid, lst->empty_lebs, lst->idx_lebs);
+- printk(KERN_DEBUG "\ttaken_empty_lebs %d, total_free %lld, "
++ printk(KERN_ERR "\ttaken_empty_lebs %d, total_free %lld, "
+ "total_dirty %lld\n", lst->taken_empty_lebs, lst->total_free,
+ lst->total_dirty);
+- printk(KERN_DEBUG "\ttotal_used %lld, total_dark %lld, "
++ printk(KERN_ERR "\ttotal_used %lld, total_dark %lld, "
+ "total_dead %lld\n", lst->total_used, lst->total_dark,
+ lst->total_dead);
+ spin_unlock(&dbg_lock);
+ }
+
+-void dbg_dump_budg(struct ubifs_info *c)
++void dbg_dump_budg(struct ubifs_info *c, const struct ubifs_budg_info *bi)
+ {
+ int i;
+ struct rb_node *rb;
+@@ -610,51 +642,69 @@ void dbg_dump_budg(struct ubifs_info *c)
+ struct ubifs_gced_idx_leb *idx_gc;
+ long long available, outstanding, free;
+
+- ubifs_assert(spin_is_locked(&c->space_lock));
++ spin_lock(&c->space_lock);
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "(pid %d) Budgeting info: budg_data_growth %lld, "
+- "budg_dd_growth %lld, budg_idx_growth %lld\n", current->pid,
+- c->budg_data_growth, c->budg_dd_growth, c->budg_idx_growth);
+- printk(KERN_DEBUG "\tdata budget sum %lld, total budget sum %lld, "
+- "freeable_cnt %d\n", c->budg_data_growth + c->budg_dd_growth,
+- c->budg_data_growth + c->budg_dd_growth + c->budg_idx_growth,
+- c->freeable_cnt);
+- printk(KERN_DEBUG "\tmin_idx_lebs %d, old_idx_sz %lld, "
+- "calc_idx_sz %lld, idx_gc_cnt %d\n", c->min_idx_lebs,
+- c->old_idx_sz, c->calc_idx_sz, c->idx_gc_cnt);
+- printk(KERN_DEBUG "\tdirty_pg_cnt %ld, dirty_zn_cnt %ld, "
++ printk(KERN_ERR "(pid %d) Budgeting info: data budget sum %lld, "
++ "total budget sum %lld\n", current->pid,
++ bi->data_growth + bi->dd_growth,
++ bi->data_growth + bi->dd_growth + bi->idx_growth);
++ printk(KERN_ERR "\tbudg_data_growth %lld, budg_dd_growth %lld, "
++ "budg_idx_growth %lld\n", bi->data_growth, bi->dd_growth,
++ bi->idx_growth);
++ printk(KERN_ERR "\tmin_idx_lebs %d, old_idx_sz %llu, "
++ "uncommitted_idx %lld\n", bi->min_idx_lebs, bi->old_idx_sz,
++ bi->uncommitted_idx);
++ printk(KERN_ERR "\tpage_budget %d, inode_budget %d, dent_budget %d\n",
++ bi->page_budget, bi->inode_budget, bi->dent_budget);
++ printk(KERN_ERR "\tnospace %u, nospace_rp %u\n",
++ bi->nospace, bi->nospace_rp);
++ printk(KERN_ERR "\tdark_wm %d, dead_wm %d, max_idx_node_sz %d\n",
++ c->dark_wm, c->dead_wm, c->max_idx_node_sz);
++
++ if (bi != &c->bi)
++ /*
++ * If we are dumping saved budgeting data, do not print
++ * additional information which is about the current state, not
++ * the old one which corresponded to the saved budgeting data.
++ */
++ goto out_unlock;
++
++ printk(KERN_ERR "\tfreeable_cnt %d, calc_idx_sz %lld, idx_gc_cnt %d\n",
++ c->freeable_cnt, c->calc_idx_sz, c->idx_gc_cnt);
++ printk(KERN_ERR "\tdirty_pg_cnt %ld, dirty_zn_cnt %ld, "
+ "clean_zn_cnt %ld\n", atomic_long_read(&c->dirty_pg_cnt),
+ atomic_long_read(&c->dirty_zn_cnt),
+ atomic_long_read(&c->clean_zn_cnt));
+- printk(KERN_DEBUG "\tdark_wm %d, dead_wm %d, max_idx_node_sz %d\n",
+- c->dark_wm, c->dead_wm, c->max_idx_node_sz);
+- printk(KERN_DEBUG "\tgc_lnum %d, ihead_lnum %d\n",
++ printk(KERN_ERR "\tgc_lnum %d, ihead_lnum %d\n",
+ c->gc_lnum, c->ihead_lnum);
++
+ /* If we are in R/O mode, journal heads do not exist */
+ if (c->jheads)
+ for (i = 0; i < c->jhead_cnt; i++)
+- printk(KERN_DEBUG "\tjhead %s\t LEB %d\n",
++ printk(KERN_ERR "\tjhead %s\t LEB %d\n",
+ dbg_jhead(c->jheads[i].wbuf.jhead),
+ c->jheads[i].wbuf.lnum);
+ for (rb = rb_first(&c->buds); rb; rb = rb_next(rb)) {
+ bud = rb_entry(rb, struct ubifs_bud, rb);
+- printk(KERN_DEBUG "\tbud LEB %d\n", bud->lnum);
++ printk(KERN_ERR "\tbud LEB %d\n", bud->lnum);
+ }
+ list_for_each_entry(bud, &c->old_buds, list)
+- printk(KERN_DEBUG "\told bud LEB %d\n", bud->lnum);
++ printk(KERN_ERR "\told bud LEB %d\n", bud->lnum);
+ list_for_each_entry(idx_gc, &c->idx_gc, list)
+- printk(KERN_DEBUG "\tGC'ed idx LEB %d unmap %d\n",
++ printk(KERN_ERR "\tGC'ed idx LEB %d unmap %d\n",
+ idx_gc->lnum, idx_gc->unmap);
+- printk(KERN_DEBUG "\tcommit state %d\n", c->cmt_state);
++ printk(KERN_ERR "\tcommit state %d\n", c->cmt_state);
+
+ /* Print budgeting predictions */
+- available = ubifs_calc_available(c, c->min_idx_lebs);
+- outstanding = c->budg_data_growth + c->budg_dd_growth;
++ available = ubifs_calc_available(c, c->bi.min_idx_lebs);
++ outstanding = c->bi.data_growth + c->bi.dd_growth;
+ free = ubifs_get_free_space_nolock(c);
+- printk(KERN_DEBUG "Budgeting predictions:\n");
+- printk(KERN_DEBUG "\tavailable: %lld, outstanding %lld, free %lld\n",
++ printk(KERN_ERR "Budgeting predictions:\n");
++ printk(KERN_ERR "\tavailable: %lld, outstanding %lld, free %lld\n",
+ available, outstanding, free);
++out_unlock:
+ spin_unlock(&dbg_lock);
++ spin_unlock(&c->space_lock);
+ }
+
+ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
+@@ -670,11 +720,11 @@ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
+ dark = ubifs_calc_dark(c, spc);
+
+ if (lp->flags & LPROPS_INDEX)
+- printk(KERN_DEBUG "LEB %-7d free %-8d dirty %-8d used %-8d "
++ printk(KERN_ERR "LEB %-7d free %-8d dirty %-8d used %-8d "
+ "free + dirty %-8d flags %#x (", lp->lnum, lp->free,
+ lp->dirty, c->leb_size - spc, spc, lp->flags);
+ else
+- printk(KERN_DEBUG "LEB %-7d free %-8d dirty %-8d used %-8d "
++ printk(KERN_ERR "LEB %-7d free %-8d dirty %-8d used %-8d "
+ "free + dirty %-8d dark %-4d dead %-4d nodes fit %-3d "
+ "flags %#-4x (", lp->lnum, lp->free, lp->dirty,
+ c->leb_size - spc, spc, dark, dead,
+@@ -729,7 +779,13 @@ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
+ if (bud->lnum == lp->lnum) {
+ int head = 0;
+ for (i = 0; i < c->jhead_cnt; i++) {
+- if (lp->lnum == c->jheads[i].wbuf.lnum) {
++ /*
++ * Note, if we are in R/O mode or in the middle
++ * of mounting/re-mounting, the write-buffers do
++ * not exist.
++ */
++ if (c->jheads &&
++ lp->lnum == c->jheads[i].wbuf.lnum) {
+ printk(KERN_CONT ", jhead %s",
+ dbg_jhead(i));
+ head = 1;
+@@ -751,7 +807,7 @@ void dbg_dump_lprops(struct ubifs_info *c)
+ struct ubifs_lprops lp;
+ struct ubifs_lp_stats lst;
+
+- printk(KERN_DEBUG "(pid %d) start dumping LEB properties\n",
++ printk(KERN_ERR "(pid %d) start dumping LEB properties\n",
+ current->pid);
+ ubifs_get_lp_stats(c, &lst);
+ dbg_dump_lstats(&lst);
+@@ -763,7 +819,7 @@ void dbg_dump_lprops(struct ubifs_info *c)
+
+ dbg_dump_lprop(c, &lp);
+ }
+- printk(KERN_DEBUG "(pid %d) finish dumping LEB properties\n",
++ printk(KERN_ERR "(pid %d) finish dumping LEB properties\n",
+ current->pid);
+ }
+
+@@ -772,69 +828,96 @@ void dbg_dump_lpt_info(struct ubifs_info *c)
+ int i;
+
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "(pid %d) dumping LPT information\n", current->pid);
+- printk(KERN_DEBUG "\tlpt_sz: %lld\n", c->lpt_sz);
+- printk(KERN_DEBUG "\tpnode_sz: %d\n", c->pnode_sz);
+- printk(KERN_DEBUG "\tnnode_sz: %d\n", c->nnode_sz);
+- printk(KERN_DEBUG "\tltab_sz: %d\n", c->ltab_sz);
+- printk(KERN_DEBUG "\tlsave_sz: %d\n", c->lsave_sz);
+- printk(KERN_DEBUG "\tbig_lpt: %d\n", c->big_lpt);
+- printk(KERN_DEBUG "\tlpt_hght: %d\n", c->lpt_hght);
+- printk(KERN_DEBUG "\tpnode_cnt: %d\n", c->pnode_cnt);
+- printk(KERN_DEBUG "\tnnode_cnt: %d\n", c->nnode_cnt);
+- printk(KERN_DEBUG "\tdirty_pn_cnt: %d\n", c->dirty_pn_cnt);
+- printk(KERN_DEBUG "\tdirty_nn_cnt: %d\n", c->dirty_nn_cnt);
+- printk(KERN_DEBUG "\tlsave_cnt: %d\n", c->lsave_cnt);
+- printk(KERN_DEBUG "\tspace_bits: %d\n", c->space_bits);
+- printk(KERN_DEBUG "\tlpt_lnum_bits: %d\n", c->lpt_lnum_bits);
+- printk(KERN_DEBUG "\tlpt_offs_bits: %d\n", c->lpt_offs_bits);
+- printk(KERN_DEBUG "\tlpt_spc_bits: %d\n", c->lpt_spc_bits);
+- printk(KERN_DEBUG "\tpcnt_bits: %d\n", c->pcnt_bits);
+- printk(KERN_DEBUG "\tlnum_bits: %d\n", c->lnum_bits);
+- printk(KERN_DEBUG "\tLPT root is at %d:%d\n", c->lpt_lnum, c->lpt_offs);
+- printk(KERN_DEBUG "\tLPT head is at %d:%d\n",
++ printk(KERN_ERR "(pid %d) dumping LPT information\n", current->pid);
++ printk(KERN_ERR "\tlpt_sz: %lld\n", c->lpt_sz);
++ printk(KERN_ERR "\tpnode_sz: %d\n", c->pnode_sz);
++ printk(KERN_ERR "\tnnode_sz: %d\n", c->nnode_sz);
++ printk(KERN_ERR "\tltab_sz: %d\n", c->ltab_sz);
++ printk(KERN_ERR "\tlsave_sz: %d\n", c->lsave_sz);
++ printk(KERN_ERR "\tbig_lpt: %d\n", c->big_lpt);
++ printk(KERN_ERR "\tlpt_hght: %d\n", c->lpt_hght);
++ printk(KERN_ERR "\tpnode_cnt: %d\n", c->pnode_cnt);
++ printk(KERN_ERR "\tnnode_cnt: %d\n", c->nnode_cnt);
++ printk(KERN_ERR "\tdirty_pn_cnt: %d\n", c->dirty_pn_cnt);
++ printk(KERN_ERR "\tdirty_nn_cnt: %d\n", c->dirty_nn_cnt);
++ printk(KERN_ERR "\tlsave_cnt: %d\n", c->lsave_cnt);
++ printk(KERN_ERR "\tspace_bits: %d\n", c->space_bits);
++ printk(KERN_ERR "\tlpt_lnum_bits: %d\n", c->lpt_lnum_bits);
++ printk(KERN_ERR "\tlpt_offs_bits: %d\n", c->lpt_offs_bits);
++ printk(KERN_ERR "\tlpt_spc_bits: %d\n", c->lpt_spc_bits);
++ printk(KERN_ERR "\tpcnt_bits: %d\n", c->pcnt_bits);
++ printk(KERN_ERR "\tlnum_bits: %d\n", c->lnum_bits);
++ printk(KERN_ERR "\tLPT root is at %d:%d\n", c->lpt_lnum, c->lpt_offs);
++ printk(KERN_ERR "\tLPT head is at %d:%d\n",
+ c->nhead_lnum, c->nhead_offs);
+- printk(KERN_DEBUG "\tLPT ltab is at %d:%d\n",
++ printk(KERN_ERR "\tLPT ltab is at %d:%d\n",
+ c->ltab_lnum, c->ltab_offs);
+ if (c->big_lpt)
+- printk(KERN_DEBUG "\tLPT lsave is at %d:%d\n",
++ printk(KERN_ERR "\tLPT lsave is at %d:%d\n",
+ c->lsave_lnum, c->lsave_offs);
+ for (i = 0; i < c->lpt_lebs; i++)
+- printk(KERN_DEBUG "\tLPT LEB %d free %d dirty %d tgc %d "
++ printk(KERN_ERR "\tLPT LEB %d free %d dirty %d tgc %d "
+ "cmt %d\n", i + c->lpt_first, c->ltab[i].free,
+ c->ltab[i].dirty, c->ltab[i].tgc, c->ltab[i].cmt);
+ spin_unlock(&dbg_lock);
+ }
+
++void dbg_dump_sleb(const struct ubifs_info *c,
++ const struct ubifs_scan_leb *sleb, int offs)
++{
++ struct ubifs_scan_node *snod;
++
++ printk(KERN_ERR "(pid %d) start dumping scanned data from LEB %d:%d\n",
++ current->pid, sleb->lnum, offs);
++
++ list_for_each_entry(snod, &sleb->nodes, list) {
++ cond_resched();
++ printk(KERN_ERR "Dumping node at LEB %d:%d len %d\n", sleb->lnum,
++ snod->offs, snod->len);
++ dbg_dump_node(c, snod->node);
++ }
++}
++
+ void dbg_dump_leb(const struct ubifs_info *c, int lnum)
+ {
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
++ void *buf;
+
+- if (dbg_failure_mode)
++ if (dbg_is_tst_rcvry(c))
+ return;
+
+- printk(KERN_DEBUG "(pid %d) start dumping LEB %d\n",
++ printk(KERN_ERR "(pid %d) start dumping LEB %d\n",
+ current->pid, lnum);
+- sleb = ubifs_scan(c, lnum, 0, c->dbg->buf, 0);
++
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory for dumping LEB %d", lnum);
++ return;
++ }
++
++ sleb = ubifs_scan(c, lnum, 0, buf, 0);
+ if (IS_ERR(sleb)) {
+ ubifs_err("scan error %d", (int)PTR_ERR(sleb));
+- return;
++ goto out;
+ }
+
+- printk(KERN_DEBUG "LEB %d has %d nodes ending at %d\n", lnum,
++ printk(KERN_ERR "LEB %d has %d nodes ending at %d\n", lnum,
+ sleb->nodes_cnt, sleb->endpt);
+
+ list_for_each_entry(snod, &sleb->nodes, list) {
+ cond_resched();
+- printk(KERN_DEBUG "Dumping node at LEB %d:%d len %d\n", lnum,
++ printk(KERN_ERR "Dumping node at LEB %d:%d len %d\n", lnum,
+ snod->offs, snod->len);
+ dbg_dump_node(c, snod->node);
+ }
+
+- printk(KERN_DEBUG "(pid %d) finish dumping LEB %d\n",
++ printk(KERN_ERR "(pid %d) finish dumping LEB %d\n",
+ current->pid, lnum);
+ ubifs_scan_destroy(sleb);
++
++out:
++ vfree(buf);
+ return;
+ }
+
+@@ -843,6 +926,7 @@ void dbg_dump_znode(const struct ubifs_info *c,
+ {
+ int n;
+ const struct ubifs_zbranch *zbr;
++ char key_buf[DBG_KEY_BUF_LEN];
+
+ spin_lock(&dbg_lock);
+ if (znode->parent)
+@@ -850,7 +934,7 @@ void dbg_dump_znode(const struct ubifs_info *c,
+ else
+ zbr = &c->zroot;
+
+- printk(KERN_DEBUG "znode %p, LEB %d:%d len %d parent %p iip %d level %d"
++ printk(KERN_ERR "znode %p, LEB %d:%d len %d parent %p iip %d level %d"
+ " child_cnt %d flags %lx\n", znode, zbr->lnum, zbr->offs,
+ zbr->len, znode->parent, znode->iip, znode->level,
+ znode->child_cnt, znode->flags);
+@@ -860,19 +944,23 @@ void dbg_dump_znode(const struct ubifs_info *c,
+ return;
+ }
+
+- printk(KERN_DEBUG "zbranches:\n");
++ printk(KERN_ERR "zbranches:\n");
+ for (n = 0; n < znode->child_cnt; n++) {
+ zbr = &znode->zbranch[n];
+ if (znode->level > 0)
+- printk(KERN_DEBUG "\t%d: znode %p LEB %d:%d len %d key "
++ printk(KERN_ERR "\t%d: znode %p LEB %d:%d len %d key "
+ "%s\n", n, zbr->znode, zbr->lnum,
+ zbr->offs, zbr->len,
+- DBGKEY(&zbr->key));
++ dbg_snprintf_key(c, &zbr->key,
++ key_buf,
++ DBG_KEY_BUF_LEN));
+ else
+- printk(KERN_DEBUG "\t%d: LNC %p LEB %d:%d len %d key "
++ printk(KERN_ERR "\t%d: LNC %p LEB %d:%d len %d key "
+ "%s\n", n, zbr->znode, zbr->lnum,
+ zbr->offs, zbr->len,
+- DBGKEY(&zbr->key));
++ dbg_snprintf_key(c, &zbr->key,
++ key_buf,
++ DBG_KEY_BUF_LEN));
+ }
+ spin_unlock(&dbg_lock);
+ }
+@@ -881,16 +969,16 @@ void dbg_dump_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat)
+ {
+ int i;
+
+- printk(KERN_DEBUG "(pid %d) start dumping heap cat %d (%d elements)\n",
++ printk(KERN_ERR "(pid %d) start dumping heap cat %d (%d elements)\n",
+ current->pid, cat, heap->cnt);
+ for (i = 0; i < heap->cnt; i++) {
+ struct ubifs_lprops *lprops = heap->arr[i];
+
+- printk(KERN_DEBUG "\t%d. LEB %d hpos %d free %d dirty %d "
++ printk(KERN_ERR "\t%d. LEB %d hpos %d free %d dirty %d "
+ "flags %d\n", i, lprops->lnum, lprops->hpos,
+ lprops->free, lprops->dirty, lprops->flags);
+ }
+- printk(KERN_DEBUG "(pid %d) finish dumping heap\n", current->pid);
++ printk(KERN_ERR "(pid %d) finish dumping heap\n", current->pid);
+ }
+
+ void dbg_dump_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
+@@ -898,15 +986,15 @@ void dbg_dump_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
+ {
+ int i;
+
+- printk(KERN_DEBUG "(pid %d) dumping pnode:\n", current->pid);
+- printk(KERN_DEBUG "\taddress %zx parent %zx cnext %zx\n",
++ printk(KERN_ERR "(pid %d) dumping pnode:\n", current->pid);
++ printk(KERN_ERR "\taddress %zx parent %zx cnext %zx\n",
+ (size_t)pnode, (size_t)parent, (size_t)pnode->cnext);
+- printk(KERN_DEBUG "\tflags %lu iip %d level %d num %d\n",
++ printk(KERN_ERR "\tflags %lu iip %d level %d num %d\n",
+ pnode->flags, iip, pnode->level, pnode->num);
+ for (i = 0; i < UBIFS_LPT_FANOUT; i++) {
+ struct ubifs_lprops *lp = &pnode->lprops[i];
+
+- printk(KERN_DEBUG "\t%d: free %d dirty %d flags %d lnum %d\n",
++ printk(KERN_ERR "\t%d: free %d dirty %d flags %d lnum %d\n",
+ i, lp->free, lp->dirty, lp->flags, lp->lnum);
+ }
+ }
+@@ -916,20 +1004,20 @@ void dbg_dump_tnc(struct ubifs_info *c)
+ struct ubifs_znode *znode;
+ int level;
+
+- printk(KERN_DEBUG "\n");
+- printk(KERN_DEBUG "(pid %d) start dumping TNC tree\n", current->pid);
++ printk(KERN_ERR "\n");
++ printk(KERN_ERR "(pid %d) start dumping TNC tree\n", current->pid);
+ znode = ubifs_tnc_levelorder_next(c->zroot.znode, NULL);
+ level = znode->level;
+- printk(KERN_DEBUG "== Level %d ==\n", level);
++ printk(KERN_ERR "== Level %d ==\n", level);
+ while (znode) {
+ if (level != znode->level) {
+ level = znode->level;
+- printk(KERN_DEBUG "== Level %d ==\n", level);
++ printk(KERN_ERR "== Level %d ==\n", level);
+ }
+ dbg_dump_znode(c, znode);
+ znode = ubifs_tnc_levelorder_next(c->zroot.znode, znode);
+ }
+- printk(KERN_DEBUG "(pid %d) finish dumping TNC tree\n", current->pid);
++ printk(KERN_ERR "(pid %d) finish dumping TNC tree\n", current->pid);
+ }
+
+ static int dump_znode(struct ubifs_info *c, struct ubifs_znode *znode,
+@@ -961,11 +1049,41 @@ void dbg_dump_index(struct ubifs_info *c)
+ void dbg_save_space_info(struct ubifs_info *c)
+ {
+ struct ubifs_debug_info *d = c->dbg;
+-
+- ubifs_get_lp_stats(c, &d->saved_lst);
++ int freeable_cnt;
+
+ spin_lock(&c->space_lock);
++ memcpy(&d->saved_lst, &c->lst, sizeof(struct ubifs_lp_stats));
++ memcpy(&d->saved_bi, &c->bi, sizeof(struct ubifs_budg_info));
++ d->saved_idx_gc_cnt = c->idx_gc_cnt;
++
++ /*
++ * We use a dirty hack here and zero out @c->freeable_cnt, because it
++ * affects the free space calculations, and UBIFS might not know about
++ * all freeable eraseblocks. Indeed, we know about freeable eraseblocks
++ * only when we read their lprops, and we do this only lazily, upon the
++ * need. So at any given point of time @c->freeable_cnt might be not
++ * exactly accurate.
++ *
++ * Just one example about the issue we hit when we did not zero
++ * @c->freeable_cnt.
++ * 1. The file-system is mounted R/O, c->freeable_cnt is %0. We save the
++ * amount of free space in @d->saved_free
++ * 2. We re-mount R/W, which makes UBIFS to read the "lsave"
++ * information from flash, where we cache LEBs from various
++ * categories ('ubifs_remount_fs()' -> 'ubifs_lpt_init()'
++ * -> 'lpt_init_wr()' -> 'read_lsave()' -> 'ubifs_lpt_lookup()'
++ * -> 'ubifs_get_pnode()' -> 'update_cats()'
++ * -> 'ubifs_add_to_cat()').
++ * 3. Lsave contains a freeable eraseblock, and @c->freeable_cnt
++ * becomes %1.
++ * 4. We calculate the amount of free space when the re-mount is
++ * finished in 'dbg_check_space_info()' and it does not match
++ * @d->saved_free.
++ */
++ freeable_cnt = c->freeable_cnt;
++ c->freeable_cnt = 0;
+ d->saved_free = ubifs_get_free_space_nolock(c);
++ c->freeable_cnt = freeable_cnt;
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -982,12 +1100,15 @@ int dbg_check_space_info(struct ubifs_info *c)
+ {
+ struct ubifs_debug_info *d = c->dbg;
+ struct ubifs_lp_stats lst;
+- long long avail, free;
++ long long free;
++ int freeable_cnt;
+
+ spin_lock(&c->space_lock);
+- avail = ubifs_calc_available(c, c->min_idx_lebs);
++ freeable_cnt = c->freeable_cnt;
++ c->freeable_cnt = 0;
++ free = ubifs_get_free_space_nolock(c);
++ c->freeable_cnt = freeable_cnt;
+ spin_unlock(&c->space_lock);
+- free = ubifs_get_free_space(c);
+
+ if (free != d->saved_free) {
+ ubifs_err("free space changed from %lld to %lld",
+@@ -1000,20 +1121,21 @@ int dbg_check_space_info(struct ubifs_info *c)
+ out:
+ ubifs_msg("saved lprops statistics dump");
+ dbg_dump_lstats(&d->saved_lst);
+- ubifs_get_lp_stats(c, &lst);
+-
++ ubifs_msg("saved budgeting info dump");
++ dbg_dump_budg(c, &d->saved_bi);
++ ubifs_msg("saved idx_gc_cnt %d", d->saved_idx_gc_cnt);
+ ubifs_msg("current lprops statistics dump");
++ ubifs_get_lp_stats(c, &lst);
+ dbg_dump_lstats(&lst);
+-
+- spin_lock(&c->space_lock);
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
++ ubifs_msg("current budgeting info dump");
++ dbg_dump_budg(c, &c->bi);
+ dump_stack();
+ return -EINVAL;
+ }
+
+ /**
+ * dbg_check_synced_i_size - check synchronized inode size.
++ * @c: UBIFS file-system description object
+ * @inode: inode to check
+ *
+ * If inode is clean, synchronized inode size has to be equivalent to current
+@@ -1021,12 +1143,12 @@ out:
+ * has to be locked). Returns %0 if synchronized inode size if correct, and
+ * %-EINVAL if not.
+ */
+-int dbg_check_synced_i_size(struct inode *inode)
++int dbg_check_synced_i_size(const struct ubifs_info *c, struct inode *inode)
+ {
+ int err = 0;
+ struct ubifs_inode *ui = ubifs_inode(inode);
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+@@ -1059,7 +1181,7 @@ int dbg_check_synced_i_size(struct inode *inode)
+ * Note, it is good idea to make sure the @dir->i_mutex is locked before
+ * calling this function.
+ */
+-int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
++int dbg_check_dir(struct ubifs_info *c, const struct inode *dir)
+ {
+ unsigned int nlink = 2;
+ union ubifs_key key;
+@@ -1067,7 +1189,7 @@ int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
+ struct qstr nm = { .name = NULL };
+ loff_t size = UBIFS_INO_NODE_SZ;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ if (!S_ISDIR(dir->i_mode))
+@@ -1101,12 +1223,14 @@ int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
+ "but calculated size is %llu", dir->i_ino,
+ (unsigned long long)i_size_read(dir),
+ (unsigned long long)size);
++ dbg_dump_inode(c, dir);
+ dump_stack();
+ return -EINVAL;
+ }
+ if (dir->i_nlink != nlink) {
+ ubifs_err("directory inode %lu has nlink %u, but calculated "
+ "nlink is %u", dir->i_ino, dir->i_nlink, nlink);
++ dbg_dump_inode(c, dir);
+ dump_stack();
+ return -EINVAL;
+ }
+@@ -1133,6 +1257,7 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ int err, nlen1, nlen2, cmp;
+ struct ubifs_dent_node *dent1, *dent2;
+ union ubifs_key key;
++ char key_buf[DBG_KEY_BUF_LEN];
+
+ ubifs_assert(!keys_cmp(c, &zbr1->key, &zbr2->key));
+ dent1 = kmalloc(UBIFS_MAX_DENT_NODE_SZ, GFP_NOFS);
+@@ -1163,9 +1288,11 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ key_read(c, &dent1->key, &key);
+ if (keys_cmp(c, &zbr1->key, &key)) {
+ dbg_err("1st entry at %d:%d has key %s", zbr1->lnum,
+- zbr1->offs, DBGKEY(&key));
++ zbr1->offs, dbg_snprintf_key(c, &key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_err("but it should have key %s according to tnc",
+- DBGKEY(&zbr1->key));
++ dbg_snprintf_key(c, &zbr1->key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_dump_node(c, dent1);
+ goto out_free;
+ }
+@@ -1173,9 +1300,11 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ key_read(c, &dent2->key, &key);
+ if (keys_cmp(c, &zbr2->key, &key)) {
+ dbg_err("2nd entry at %d:%d has key %s", zbr1->lnum,
+- zbr1->offs, DBGKEY(&key));
++ zbr1->offs, dbg_snprintf_key(c, &key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_err("but it should have key %s according to tnc",
+- DBGKEY(&zbr2->key));
++ dbg_snprintf_key(c, &zbr2->key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_dump_node(c, dent2);
+ goto out_free;
+ }
+@@ -1192,7 +1321,7 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ dbg_err("2 xent/dent nodes with the same name");
+ else
+ dbg_err("bad order of colliding key %s",
+- DBGKEY(&key));
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
+
+ ubifs_msg("first node at %d:%d\n", zbr1->lnum, zbr1->offs);
+ dbg_dump_node(c, dent1);
+@@ -1423,7 +1552,7 @@ int dbg_check_tnc(struct ubifs_info *c, int extra)
+ long clean_cnt = 0, dirty_cnt = 0;
+ int err, last;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_TNC))
++ if (!dbg_is_chk_index(c))
+ return 0;
+
+ ubifs_assert(mutex_is_locked(&c->tnc_mutex));
+@@ -1670,7 +1799,7 @@ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size)
+ int err;
+ long long calc = 0;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_IDX_SZ))
++ if (!dbg_is_chk_index(c))
+ return 0;
+
+ err = dbg_walk_index(c, NULL, add_size, &calc);
+@@ -1751,6 +1880,8 @@ static struct fsck_inode *add_inode(struct ubifs_info *c,
+ struct rb_node **p, *parent = NULL;
+ struct fsck_inode *fscki;
+ ino_t inum = key_inum_flash(c, &ino->key);
++ struct inode *inode;
++ struct ubifs_inode *ui;
+
+ p = &fsckd->inodes.rb_node;
+ while (*p) {
+@@ -1774,19 +1905,46 @@ static struct fsck_inode *add_inode(struct ubifs_info *c,
+ if (!fscki)
+ return ERR_PTR(-ENOMEM);
+
++ inode = ilookup(c->vfs_sb, inum);
++
+ fscki->inum = inum;
+- fscki->nlink = le32_to_cpu(ino->nlink);
+- fscki->size = le64_to_cpu(ino->size);
+- fscki->xattr_cnt = le32_to_cpu(ino->xattr_cnt);
+- fscki->xattr_sz = le32_to_cpu(ino->xattr_size);
+- fscki->xattr_nms = le32_to_cpu(ino->xattr_names);
+- fscki->mode = le32_to_cpu(ino->mode);
++ /*
++ * If the inode is present in the VFS inode cache, use it instead of
++ * the on-flash inode which might be out-of-date. E.g., the size might
++ * be out-of-date. If we do not do this, the following may happen, for
++ * example:
++ * 1. A power cut happens
++ * 2. We mount the file-system R/O, the replay process fixes up the
++ * inode size in the VFS cache, but on on-flash.
++ * 3. 'check_leaf()' fails because it hits a data node beyond inode
++ * size.
++ */
++ if (!inode) {
++ fscki->nlink = le32_to_cpu(ino->nlink);
++ fscki->size = le64_to_cpu(ino->size);
++ fscki->xattr_cnt = le32_to_cpu(ino->xattr_cnt);
++ fscki->xattr_sz = le32_to_cpu(ino->xattr_size);
++ fscki->xattr_nms = le32_to_cpu(ino->xattr_names);
++ fscki->mode = le32_to_cpu(ino->mode);
++ } else {
++ ui = ubifs_inode(inode);
++ fscki->nlink = inode->i_nlink;
++ fscki->size = inode->i_size;
++ fscki->xattr_cnt = ui->xattr_cnt;
++ fscki->xattr_sz = ui->xattr_size;
++ fscki->xattr_nms = ui->xattr_names;
++ fscki->mode = inode->i_mode;
++ iput(inode);
++ }
++
+ if (S_ISDIR(fscki->mode)) {
+ fscki->calc_sz = UBIFS_INO_NODE_SZ;
+ fscki->calc_cnt = 2;
+ }
++
+ rb_link_node(&fscki->rb, parent, p);
+ rb_insert_color(&fscki->rb, &fsckd->inodes);
++
+ return fscki;
+ }
+
+@@ -2217,7 +2375,7 @@ int dbg_check_filesystem(struct ubifs_info *c)
+ int err;
+ struct fsck_data fsckd;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_FS))
++ if (!dbg_is_chk_fs(c))
+ return 0;
+
+ fsckd.inodes = RB_ROOT;
+@@ -2252,7 +2410,7 @@ int dbg_check_data_nodes_order(struct ubifs_info *c, struct list_head *head)
+ struct list_head *cur;
+ struct ubifs_scan_node *sa, *sb;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ for (cur = head->next; cur->next != head; cur = cur->next) {
+@@ -2319,7 +2477,7 @@ int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head)
+ struct list_head *cur;
+ struct ubifs_scan_node *sa, *sb;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ for (cur = head->next; cur->next != head; cur = cur->next) {
+@@ -2379,7 +2537,8 @@ int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head)
+ hashb = key_block(c, &sb->key);
+
+ if (hasha > hashb) {
+- ubifs_err("larger hash %u goes before %u", hasha, hashb);
++ ubifs_err("larger hash %u goes before %u",
++ hasha, hashb);
+ goto error_dump;
+ }
+ }
+@@ -2395,393 +2554,351 @@ error_dump:
+ return 0;
+ }
+
+-static int invocation_cnt;
+-
+-int dbg_force_in_the_gaps(void)
+-{
+- if (!dbg_force_in_the_gaps_enabled)
+- return 0;
+- /* Force in-the-gaps every 8th commit */
+- return !((invocation_cnt++) & 0x7);
+-}
+-
+-/* Failure mode for recovery testing */
+-
+-#define chance(n, d) (simple_rand() <= (n) * 32768LL / (d))
+-
+-struct failure_mode_info {
+- struct list_head list;
+- struct ubifs_info *c;
+-};
+-
+-static LIST_HEAD(fmi_list);
+-static DEFINE_SPINLOCK(fmi_lock);
+-
+-static unsigned int next;
+-
+-static int simple_rand(void)
+-{
+- if (next == 0)
+- next = current->pid;
+- next = next * 1103515245 + 12345;
+- return (next >> 16) & 32767;
+-}
+-
+-static void failure_mode_init(struct ubifs_info *c)
+-{
+- struct failure_mode_info *fmi;
+-
+- fmi = kmalloc(sizeof(struct failure_mode_info), GFP_NOFS);
+- if (!fmi) {
+- ubifs_err("Failed to register failure mode - no memory");
+- return;
+- }
+- fmi->c = c;
+- spin_lock(&fmi_lock);
+- list_add_tail(&fmi->list, &fmi_list);
+- spin_unlock(&fmi_lock);
+-}
+-
+-static void failure_mode_exit(struct ubifs_info *c)
+-{
+- struct failure_mode_info *fmi, *tmp;
+-
+- spin_lock(&fmi_lock);
+- list_for_each_entry_safe(fmi, tmp, &fmi_list, list)
+- if (fmi->c == c) {
+- list_del(&fmi->list);
+- kfree(fmi);
+- }
+- spin_unlock(&fmi_lock);
+-}
+-
+-static struct ubifs_info *dbg_find_info(struct ubi_volume_desc *desc)
++static inline int chance(unsigned int n, unsigned int out_of)
+ {
+- struct failure_mode_info *fmi;
+-
+- spin_lock(&fmi_lock);
+- list_for_each_entry(fmi, &fmi_list, list)
+- if (fmi->c->ubi == desc) {
+- struct ubifs_info *c = fmi->c;
++ return !!((random32() % out_of) + 1 <= n);
+
+- spin_unlock(&fmi_lock);
+- return c;
+- }
+- spin_unlock(&fmi_lock);
+- return NULL;
+ }
+
+-static int in_failure_mode(struct ubi_volume_desc *desc)
++static int power_cut_emulated(struct ubifs_info *c, int lnum, int write)
+ {
+- struct ubifs_info *c = dbg_find_info(desc);
+-
+- if (c && dbg_failure_mode)
+- return c->dbg->failure_mode;
+- return 0;
+-}
++ struct ubifs_debug_info *d = c->dbg;
+
+-static int do_fail(struct ubi_volume_desc *desc, int lnum, int write)
+-{
+- struct ubifs_info *c = dbg_find_info(desc);
+- struct ubifs_debug_info *d;
++ ubifs_assert(dbg_is_tst_rcvry(c));
+
+- if (!c || !dbg_failure_mode)
+- return 0;
+- d = c->dbg;
+- if (d->failure_mode)
+- return 1;
+- if (!d->fail_cnt) {
+- /* First call - decide delay to failure */
++ if (!d->pc_cnt) {
++ /* First call - decide delay to the power cut */
+ if (chance(1, 2)) {
+- unsigned int delay = 1 << (simple_rand() >> 11);
++ unsigned long delay;
+
+ if (chance(1, 2)) {
+- d->fail_delay = 1;
+- d->fail_timeout = jiffies +
+- msecs_to_jiffies(delay);
+- dbg_rcvry("failing after %ums", delay);
++ d->pc_delay = 1;
++ /* Fail withing 1 minute */
++ delay = random32() % 60000;
++ d->pc_timeout = jiffies;
++ d->pc_timeout += msecs_to_jiffies(delay);
++ ubifs_warn("failing after %lums", delay);
+ } else {
+- d->fail_delay = 2;
+- d->fail_cnt_max = delay;
+- dbg_rcvry("failing after %u calls", delay);
++ d->pc_delay = 2;
++ delay = random32() % 10000;
++ /* Fail within 10000 operations */
++ d->pc_cnt_max = delay;
++ ubifs_warn("failing after %lu calls", delay);
+ }
+ }
+- d->fail_cnt += 1;
++
++ d->pc_cnt += 1;
+ }
++
+ /* Determine if failure delay has expired */
+- if (d->fail_delay == 1) {
+- if (time_before(jiffies, d->fail_timeout))
++ if (d->pc_delay == 1 && time_before(jiffies, d->pc_timeout))
+ return 0;
+- } else if (d->fail_delay == 2)
+- if (d->fail_cnt++ < d->fail_cnt_max)
++ if (d->pc_delay == 2 && d->pc_cnt++ < d->pc_cnt_max)
+ return 0;
++
+ if (lnum == UBIFS_SB_LNUM) {
+- if (write) {
+- if (chance(1, 2))
+- return 0;
+- } else if (chance(19, 20))
++ if (write && chance(1, 2))
+ return 0;
+- dbg_rcvry("failing in super block LEB %d", lnum);
++ if (chance(19, 20))
++ return 0;
++ ubifs_warn("failing in super block LEB %d", lnum);
+ } else if (lnum == UBIFS_MST_LNUM || lnum == UBIFS_MST_LNUM + 1) {
+ if (chance(19, 20))
+ return 0;
+- dbg_rcvry("failing in master LEB %d", lnum);
++ ubifs_warn("failing in master LEB %d", lnum);
+ } else if (lnum >= UBIFS_LOG_LNUM && lnum <= c->log_last) {
+- if (write) {
+- if (chance(99, 100))
+- return 0;
+- } else if (chance(399, 400))
++ if (write && chance(99, 100))
++ return 0;
++ if (chance(399, 400))
+ return 0;
+- dbg_rcvry("failing in log LEB %d", lnum);
++ ubifs_warn("failing in log LEB %d", lnum);
+ } else if (lnum >= c->lpt_first && lnum <= c->lpt_last) {
+- if (write) {
+- if (chance(7, 8))
+- return 0;
+- } else if (chance(19, 20))
++ if (write && chance(7, 8))
+ return 0;
+- dbg_rcvry("failing in LPT LEB %d", lnum);
++ if (chance(19, 20))
++ return 0;
++ ubifs_warn("failing in LPT LEB %d", lnum);
+ } else if (lnum >= c->orph_first && lnum <= c->orph_last) {
+- if (write) {
+- if (chance(1, 2))
+- return 0;
+- } else if (chance(9, 10))
++ if (write && chance(1, 2))
+ return 0;
+- dbg_rcvry("failing in orphan LEB %d", lnum);
++ if (chance(9, 10))
++ return 0;
++ ubifs_warn("failing in orphan LEB %d", lnum);
+ } else if (lnum == c->ihead_lnum) {
+ if (chance(99, 100))
+ return 0;
+- dbg_rcvry("failing in index head LEB %d", lnum);
++ ubifs_warn("failing in index head LEB %d", lnum);
+ } else if (c->jheads && lnum == c->jheads[GCHD].wbuf.lnum) {
+ if (chance(9, 10))
+ return 0;
+- dbg_rcvry("failing in GC head LEB %d", lnum);
++ ubifs_warn("failing in GC head LEB %d", lnum);
+ } else if (write && !RB_EMPTY_ROOT(&c->buds) &&
+ !ubifs_search_bud(c, lnum)) {
+ if (chance(19, 20))
+ return 0;
+- dbg_rcvry("failing in non-bud LEB %d", lnum);
++ ubifs_warn("failing in non-bud LEB %d", lnum);
+ } else if (c->cmt_state == COMMIT_RUNNING_BACKGROUND ||
+ c->cmt_state == COMMIT_RUNNING_REQUIRED) {
+ if (chance(999, 1000))
+ return 0;
+- dbg_rcvry("failing in bud LEB %d commit running", lnum);
++ ubifs_warn("failing in bud LEB %d commit running", lnum);
+ } else {
+ if (chance(9999, 10000))
+ return 0;
+- dbg_rcvry("failing in bud LEB %d commit not running", lnum);
++ ubifs_warn("failing in bud LEB %d commit not running", lnum);
+ }
+- ubifs_err("*** SETTING FAILURE MODE ON (LEB %d) ***", lnum);
+- d->failure_mode = 1;
++
++ d->pc_happened = 1;
++ ubifs_warn("========== Power cut emulated ==========");
+ dump_stack();
+ return 1;
+ }
+
+-static void cut_data(const void *buf, int len)
++static void cut_data(const void *buf, unsigned int len)
+ {
+- int flen, i;
++ unsigned int from, to, i, ffs = chance(1, 2);
+ unsigned char *p = (void *)buf;
+
+- flen = (len * (long long)simple_rand()) >> 15;
+- for (i = flen; i < len; i++)
+- p[i] = 0xff;
+-}
++ from = random32() % (len + 1);
++ if (chance(1, 2))
++ to = random32() % (len - from + 1);
++ else
++ to = len;
+
+-int dbg_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
+- int len, int check)
+-{
+- if (in_failure_mode(desc))
+- return -EIO;
+- return ubi_leb_read(desc, lnum, buf, offset, len, check);
++ if (from < to)
++ ubifs_warn("filled bytes %u-%u with %s", from, to - 1,
++ ffs ? "0xFFs" : "random data");
++
++ if (ffs)
++ for (i = from; i < to; i++)
++ p[i] = 0xFF;
++ else
++ for (i = from; i < to; i++)
++ p[i] = random32() % 0x100;
+ }
+
+-int dbg_leb_write(struct ubi_volume_desc *desc, int lnum, const void *buf,
+- int offset, int len, int dtype)
++int dbg_leb_write(struct ubifs_info *c, int lnum, const void *buf,
++ int offs, int len, int dtype)
+ {
+ int err, failing;
+
+- if (in_failure_mode(desc))
+- return -EIO;
+- failing = do_fail(desc, lnum, 1);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++
++ failing = power_cut_emulated(c, lnum, 1);
+ if (failing)
+ cut_data(buf, len);
+- err = ubi_leb_write(desc, lnum, buf, offset, len, dtype);
++ err = ubi_leb_write(c->ubi, lnum, buf, offs, len, dtype);
+ if (err)
+ return err;
+ if (failing)
+- return -EIO;
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_leb_change(struct ubi_volume_desc *desc, int lnum, const void *buf,
++int dbg_leb_change(struct ubifs_info *c, int lnum, const void *buf,
+ int len, int dtype)
+ {
+ int err;
+
+- if (do_fail(desc, lnum, 1))
+- return -EIO;
+- err = ubi_leb_change(desc, lnum, buf, len, dtype);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++ if (power_cut_emulated(c, lnum, 1))
++ return -EROFS;
++ err = ubi_leb_change(c->ubi, lnum, buf, len, dtype);
+ if (err)
+ return err;
+- if (do_fail(desc, lnum, 1))
+- return -EIO;
++ if (power_cut_emulated(c, lnum, 1))
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_leb_erase(struct ubi_volume_desc *desc, int lnum)
++int dbg_leb_unmap(struct ubifs_info *c, int lnum)
+ {
+ int err;
+
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- err = ubi_leb_erase(desc, lnum);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
++ err = ubi_leb_unmap(c->ubi, lnum);
+ if (err)
+ return err;
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_leb_unmap(struct ubi_volume_desc *desc, int lnum)
++int dbg_leb_map(struct ubifs_info *c, int lnum, int dtype)
+ {
+ int err;
+
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- err = ubi_leb_unmap(desc, lnum);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
++ err = ubi_leb_map(c->ubi, lnum, dtype);
+ if (err)
+ return err;
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_is_mapped(struct ubi_volume_desc *desc, int lnum)
+-{
+- if (in_failure_mode(desc))
+- return -EIO;
+- return ubi_is_mapped(desc, lnum);
+-}
++/*
++ * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
++ * contain the stuff specific to particular file-system mounts.
++ */
++static struct dentry *dfs_rootdir;
+
+-int dbg_leb_map(struct ubi_volume_desc *desc, int lnum, int dtype)
++static int dfs_file_open(struct inode *inode, struct file *file)
+ {
+- int err;
+-
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- err = ubi_leb_map(desc, lnum, dtype);
+- if (err)
+- return err;
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- return 0;
++ file->private_data = inode->i_private;
++ return nonseekable_open(inode, file);
+ }
+
+ /**
+- * ubifs_debugging_init - initialize UBIFS debugging.
+- * @c: UBIFS file-system description object
++ * provide_user_output - provide output to the user reading a debugfs file.
++ * @val: boolean value for the answer
++ * @u: the buffer to store the answer at
++ * @count: size of the buffer
++ * @ppos: position in the @u output buffer
+ *
+- * This function initializes debugging-related data for the file system.
+- * Returns zero in case of success and a negative error code in case of
++ * This is a simple helper function which stores @val boolean value in the user
++ * buffer when the user reads one of UBIFS debugfs files. Returns amount of
++ * bytes written to @u in case of success and a negative error code in case of
+ * failure.
+ */
+-int ubifs_debugging_init(struct ubifs_info *c)
++static int provide_user_output(int val, char __user *u, size_t count,
++ loff_t *ppos)
+ {
+- c->dbg = kzalloc(sizeof(struct ubifs_debug_info), GFP_KERNEL);
+- if (!c->dbg)
+- return -ENOMEM;
+-
+- c->dbg->buf = vmalloc(c->leb_size);
+- if (!c->dbg->buf)
+- goto out;
++ char buf[3];
+
+- failure_mode_init(c);
+- return 0;
++ if (val)
++ buf[0] = '1';
++ else
++ buf[0] = '0';
++ buf[1] = '\n';
++ buf[2] = 0x00;
+
+-out:
+- kfree(c->dbg);
+- return -ENOMEM;
++ return simple_read_from_buffer(u, count, ppos, buf, 2);
+ }
+
+-/**
+- * ubifs_debugging_exit - free debugging data.
+- * @c: UBIFS file-system description object
+- */
+-void ubifs_debugging_exit(struct ubifs_info *c)
++static ssize_t dfs_file_read(struct file *file, char __user *u, size_t count,
++ loff_t *ppos)
+ {
+- failure_mode_exit(c);
+- vfree(c->dbg->buf);
+- kfree(c->dbg);
+-}
++ struct dentry *dent = file->f_path.dentry;
++ struct ubifs_info *c = file->private_data;
++ struct ubifs_debug_info *d = c->dbg;
++ int val;
++
++ if (dent == d->dfs_chk_gen)
++ val = d->chk_gen;
++ else if (dent == d->dfs_chk_index)
++ val = d->chk_index;
++ else if (dent == d->dfs_chk_orph)
++ val = d->chk_orph;
++ else if (dent == d->dfs_chk_lprops)
++ val = d->chk_lprops;
++ else if (dent == d->dfs_chk_fs)
++ val = d->chk_fs;
++ else if (dent == d->dfs_tst_rcvry)
++ val = d->tst_rcvry;
++ else
++ return -EINVAL;
+
+-/*
+- * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
+- * contain the stuff specific to particular file-system mounts.
+- */
+-static struct dentry *dfs_rootdir;
++ return provide_user_output(val, u, count, ppos);
++}
+
+ /**
+- * dbg_debugfs_init - initialize debugfs file-system.
++ * interpret_user_input - interpret user debugfs file input.
++ * @u: user-provided buffer with the input
++ * @count: buffer size
+ *
+- * UBIFS uses debugfs file-system to expose various debugging knobs to
+- * user-space. This function creates "ubifs" directory in the debugfs
+- * file-system. Returns zero in case of success and a negative error code in
+- * case of failure.
++ * This is a helper function which interpret user input to a boolean UBIFS
++ * debugfs file. Returns %0 or %1 in case of success and a negative error code
++ * in case of failure.
+ */
+-int dbg_debugfs_init(void)
++static int interpret_user_input(const char __user *u, size_t count)
+ {
+- dfs_rootdir = debugfs_create_dir("ubifs", NULL);
+- if (IS_ERR(dfs_rootdir)) {
+- int err = PTR_ERR(dfs_rootdir);
+- ubifs_err("cannot create \"ubifs\" debugfs directory, "
+- "error %d\n", err);
+- return err;
+- }
++ size_t buf_size;
++ char buf[8];
+
+- return 0;
+-}
++ buf_size = min_t(size_t, count, (sizeof(buf) - 1));
++ if (copy_from_user(buf, u, buf_size))
++ return -EFAULT;
+
+-/**
+- * dbg_debugfs_exit - remove the "ubifs" directory from debugfs file-system.
+- */
+-void dbg_debugfs_exit(void)
+-{
+- debugfs_remove(dfs_rootdir);
+-}
++ if (buf[0] == '1')
++ return 1;
++ else if (buf[0] == '0')
++ return 0;
+
+-static int open_debugfs_file(struct inode *inode, struct file *file)
+-{
+- file->private_data = inode->i_private;
+- return 0;
++ return -EINVAL;
+ }
+
+-static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
+- size_t count, loff_t *ppos)
++static ssize_t dfs_file_write(struct file *file, const char __user *u,
++ size_t count, loff_t *ppos)
+ {
+ struct ubifs_info *c = file->private_data;
+ struct ubifs_debug_info *d = c->dbg;
++ struct dentry *dent = file->f_path.dentry;
++ int val;
+
+- if (file->f_path.dentry == d->dfs_dump_lprops)
++ /*
++ * TODO: this is racy - the file-system might have already been
++ * unmounted and we'd oops in this case. The plan is to fix it with
++ * help of 'iterate_supers_type()' which we should have in v3.0: when
++ * a debugfs opened, we rember FS's UUID in file->private_data. Then
++ * whenever we access the FS via a debugfs file, we iterate all UBIFS
++ * superblocks and fine the one with the same UUID, and take the
++ * locking right.
++ *
++ * The other way to go suggested by Al Viro is to create a separate
++ * 'ubifs-debug' file-system instead.
++ */
++ if (file->f_path.dentry == d->dfs_dump_lprops) {
+ dbg_dump_lprops(c);
+- else if (file->f_path.dentry == d->dfs_dump_budg) {
+- spin_lock(&c->space_lock);
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
+- } else if (file->f_path.dentry == d->dfs_dump_tnc) {
++ return count;
++ }
++ if (file->f_path.dentry == d->dfs_dump_budg) {
++ dbg_dump_budg(c, &c->bi);
++ return count;
++ }
++ if (file->f_path.dentry == d->dfs_dump_tnc) {
+ mutex_lock(&c->tnc_mutex);
+ dbg_dump_tnc(c);
+ mutex_unlock(&c->tnc_mutex);
+- } else
++ return count;
++ }
++
++ val = interpret_user_input(u, count);
++ if (val < 0)
++ return val;
++
++ if (dent == d->dfs_chk_gen)
++ d->chk_gen = val;
++ else if (dent == d->dfs_chk_index)
++ d->chk_index = val;
++ else if (dent == d->dfs_chk_orph)
++ d->chk_orph = val;
++ else if (dent == d->dfs_chk_lprops)
++ d->chk_lprops = val;
++ else if (dent == d->dfs_chk_fs)
++ d->chk_fs = val;
++ else if (dent == d->dfs_tst_rcvry)
++ d->tst_rcvry = val;
++ else
+ return -EINVAL;
+
+- *ppos += count;
+ return count;
+ }
+
+ static const struct file_operations dfs_fops = {
+- .open = open_debugfs_file,
+- .write = write_debugfs_file,
++ .open = dfs_file_open,
++ .read = dfs_file_read,
++ .write = dfs_file_write,
+ .owner = THIS_MODULE,
+- .llseek = default_llseek,
++ .llseek = no_llseek,
+ };
+
+ /**
+@@ -2798,46 +2915,94 @@ static const struct file_operations dfs_fops = {
+ */
+ int dbg_debugfs_init_fs(struct ubifs_info *c)
+ {
+- int err;
++ int err, n;
+ const char *fname;
+ struct dentry *dent;
+ struct ubifs_debug_info *d = c->dbg;
+
+- sprintf(d->dfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
+- d->dfs_dir = debugfs_create_dir(d->dfs_dir_name, dfs_rootdir);
+- if (IS_ERR(d->dfs_dir)) {
+- err = PTR_ERR(d->dfs_dir);
+- ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
+- d->dfs_dir_name, err);
++ n = snprintf(d->dfs_dir_name, UBIFS_DFS_DIR_LEN + 1, UBIFS_DFS_DIR_NAME,
++ c->vi.ubi_num, c->vi.vol_id);
++ if (n == UBIFS_DFS_DIR_LEN) {
++ /* The array size is too small */
++ fname = UBIFS_DFS_DIR_NAME;
++ dent = ERR_PTR(-EINVAL);
+ goto out;
+ }
+
++ fname = d->dfs_dir_name;
++ dent = debugfs_create_dir(fname, dfs_rootdir);
++ if (IS_ERR_OR_NULL(dent))
++ goto out;
++ d->dfs_dir = dent;
++
+ fname = "dump_lprops";
+- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+- if (IS_ERR(dent))
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
+ goto out_remove;
+ d->dfs_dump_lprops = dent;
+
+ fname = "dump_budg";
+- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+- if (IS_ERR(dent))
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
+ goto out_remove;
+ d->dfs_dump_budg = dent;
+
+ fname = "dump_tnc";
+- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+- if (IS_ERR(dent))
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
+ goto out_remove;
+ d->dfs_dump_tnc = dent;
+
++ fname = "chk_general";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_gen = dent;
++
++ fname = "chk_index";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_index = dent;
++
++ fname = "chk_orphans";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_orph = dent;
++
++ fname = "chk_lprops";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_lprops = dent;
++
++ fname = "chk_fs";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_fs = dent;
++
++ fname = "tst_recovery";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_tst_rcvry = dent;
++
+ return 0;
+
+ out_remove:
+- err = PTR_ERR(dent);
+- ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
+- fname, err);
+ debugfs_remove_recursive(d->dfs_dir);
+ out:
++ err = dent ? PTR_ERR(dent) : -ENODEV;
++ ubifs_err("cannot create \"%s\" debugfs file or directory, error %d\n",
++ fname, err);
+ return err;
+ }
+
+@@ -2850,4 +3015,179 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c)
+ debugfs_remove_recursive(c->dbg->dfs_dir);
+ }
+
++struct ubifs_global_debug_info ubifs_dbg;
++
++static struct dentry *dfs_chk_gen;
++static struct dentry *dfs_chk_index;
++static struct dentry *dfs_chk_orph;
++static struct dentry *dfs_chk_lprops;
++static struct dentry *dfs_chk_fs;
++static struct dentry *dfs_tst_rcvry;
++
++static ssize_t dfs_global_file_read(struct file *file, char __user *u,
++ size_t count, loff_t *ppos)
++{
++ struct dentry *dent = file->f_path.dentry;
++ int val;
++
++ if (dent == dfs_chk_gen)
++ val = ubifs_dbg.chk_gen;
++ else if (dent == dfs_chk_index)
++ val = ubifs_dbg.chk_index;
++ else if (dent == dfs_chk_orph)
++ val = ubifs_dbg.chk_orph;
++ else if (dent == dfs_chk_lprops)
++ val = ubifs_dbg.chk_lprops;
++ else if (dent == dfs_chk_fs)
++ val = ubifs_dbg.chk_fs;
++ else if (dent == dfs_tst_rcvry)
++ val = ubifs_dbg.tst_rcvry;
++ else
++ return -EINVAL;
++
++ return provide_user_output(val, u, count, ppos);
++}
++
++static ssize_t dfs_global_file_write(struct file *file, const char __user *u,
++ size_t count, loff_t *ppos)
++{
++ struct dentry *dent = file->f_path.dentry;
++ int val;
++
++ val = interpret_user_input(u, count);
++ if (val < 0)
++ return val;
++
++ if (dent == dfs_chk_gen)
++ ubifs_dbg.chk_gen = val;
++ else if (dent == dfs_chk_index)
++ ubifs_dbg.chk_index = val;
++ else if (dent == dfs_chk_orph)
++ ubifs_dbg.chk_orph = val;
++ else if (dent == dfs_chk_lprops)
++ ubifs_dbg.chk_lprops = val;
++ else if (dent == dfs_chk_fs)
++ ubifs_dbg.chk_fs = val;
++ else if (dent == dfs_tst_rcvry)
++ ubifs_dbg.tst_rcvry = val;
++ else
++ return -EINVAL;
++
++ return count;
++}
++
++static const struct file_operations dfs_global_fops = {
++ .read = dfs_global_file_read,
++ .write = dfs_global_file_write,
++ .owner = THIS_MODULE,
++ .llseek = no_llseek,
++};
++
++/**
++ * dbg_debugfs_init - initialize debugfs file-system.
++ *
++ * UBIFS uses debugfs file-system to expose various debugging knobs to
++ * user-space. This function creates "ubifs" directory in the debugfs
++ * file-system. Returns zero in case of success and a negative error code in
++ * case of failure.
++ */
++int dbg_debugfs_init(void)
++{
++ int err;
++ const char *fname;
++ struct dentry *dent;
++
++ fname = "ubifs";
++ dent = debugfs_create_dir(fname, NULL);
++ if (IS_ERR_OR_NULL(dent))
++ goto out;
++ dfs_rootdir = dent;
++
++ fname = "chk_general";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_gen = dent;
++
++ fname = "chk_index";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_index = dent;
++
++ fname = "chk_orphans";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_orph = dent;
++
++ fname = "chk_lprops";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_lprops = dent;
++
++ fname = "chk_fs";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_fs = dent;
++
++ fname = "tst_recovery";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_tst_rcvry = dent;
++
++ return 0;
++
++out_remove:
++ debugfs_remove_recursive(dfs_rootdir);
++out:
++ err = dent ? PTR_ERR(dent) : -ENODEV;
++ ubifs_err("cannot create \"%s\" debugfs file or directory, error %d\n",
++ fname, err);
++ return err;
++}
++
++/**
++ * dbg_debugfs_exit - remove the "ubifs" directory from debugfs file-system.
++ */
++void dbg_debugfs_exit(void)
++{
++ debugfs_remove_recursive(dfs_rootdir);
++}
++
++/**
++ * ubifs_debugging_init - initialize UBIFS debugging.
++ * @c: UBIFS file-system description object
++ *
++ * This function initializes debugging-related data for the file system.
++ * Returns zero in case of success and a negative error code in case of
++ * failure.
++ */
++int ubifs_debugging_init(struct ubifs_info *c)
++{
++ c->dbg = kzalloc(sizeof(struct ubifs_debug_info), GFP_KERNEL);
++ if (!c->dbg)
++ return -ENOMEM;
++
++ return 0;
++}
++
++/**
++ * ubifs_debugging_exit - free debugging data.
++ * @c: UBIFS file-system description object
++ */
++void ubifs_debugging_exit(struct ubifs_info *c)
++{
++ kfree(c->dbg);
++}
++
+ #endif /* CONFIG_UBIFS_FS_DEBUG */
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index 555ba13..13917ce 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -31,17 +31,25 @@ typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+
++/*
++ * The UBIFS debugfs directory name pattern and maximum name length (3 for "ubi"
++ * + 1 for "_" and plus 2x2 for 2 UBI numbers and 1 for the trailing zero byte.
++ */
++#define UBIFS_DFS_DIR_NAME "ubi%d_%d"
++#define UBIFS_DFS_DIR_LEN (3 + 1 + 2*2 + 1)
++
+ /**
+ * ubifs_debug_info - per-FS debugging information.
+- * @buf: a buffer of LEB size, used for various purposes
+ * @old_zroot: old index root - used by 'dbg_check_old_index()'
+ * @old_zroot_level: old index root level - used by 'dbg_check_old_index()'
+ * @old_zroot_sqnum: old index root sqnum - used by 'dbg_check_old_index()'
+- * @failure_mode: failure mode for recovery testing
+- * @fail_delay: 0=>don't delay, 1=>delay a time, 2=>delay a number of calls
+- * @fail_timeout: time in jiffies when delay of failure mode expires
+- * @fail_cnt: current number of calls to failure mode I/O functions
+- * @fail_cnt_max: number of calls by which to delay failure mode
++ *
++ * @pc_happened: non-zero if an emulated power cut happened
++ * @pc_delay: 0=>don't delay, 1=>delay a time, 2=>delay a number of calls
++ * @pc_timeout: time in jiffies when delay of failure mode expires
++ * @pc_cnt: current number of calls to failure mode I/O functions
++ * @pc_cnt_max: number of calls by which to delay failure mode
++ *
+ * @chk_lpt_sz: used by LPT tree size checker
+ * @chk_lpt_sz2: used by LPT tree size checker
+ * @chk_lpt_wastage: used by LPT tree size checker
+@@ -51,24 +59,40 @@ typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+ * @new_ihead_offs: used by debugging to check @c->ihead_offs
+ *
+ * @saved_lst: saved lprops statistics (used by 'dbg_save_space_info()')
+- * @saved_free: saved free space (used by 'dbg_save_space_info()')
++ * @saved_bi: saved budgeting information
++ * @saved_free: saved amount of free space
++ * @saved_idx_gc_cnt: saved value of @c->idx_gc_cnt
++ *
++ * @chk_gen: if general extra checks are enabled
++ * @chk_index: if index xtra checks are enabled
++ * @chk_orph: if orphans extra checks are enabled
++ * @chk_lprops: if lprops extra checks are enabled
++ * @chk_fs: if UBIFS contents extra checks are enabled
++ * @tst_rcvry: if UBIFS recovery testing mode enabled
+ *
+- * dfs_dir_name: name of debugfs directory containing this file-system's files
+- * dfs_dir: direntry object of the file-system debugfs directory
+- * dfs_dump_lprops: "dump lprops" debugfs knob
+- * dfs_dump_budg: "dump budgeting information" debugfs knob
+- * dfs_dump_tnc: "dump TNC" debugfs knob
++ * @dfs_dir_name: name of debugfs directory containing this file-system's files
++ * @dfs_dir: direntry object of the file-system debugfs directory
++ * @dfs_dump_lprops: "dump lprops" debugfs knob
++ * @dfs_dump_budg: "dump budgeting information" debugfs knob
++ * @dfs_dump_tnc: "dump TNC" debugfs knob
++ * @dfs_chk_gen: debugfs knob to enable UBIFS general extra checks
++ * @dfs_chk_index: debugfs knob to enable UBIFS index extra checks
++ * @dfs_chk_orph: debugfs knob to enable UBIFS orphans extra checks
++ * @dfs_chk_lprops: debugfs knob to enable UBIFS LEP properties extra checks
++ * @dfs_chk_fs: debugfs knob to enable UBIFS contents extra checks
++ * @dfs_tst_rcvry: debugfs knob to enable UBIFS recovery testing
+ */
+ struct ubifs_debug_info {
+- void *buf;
+ struct ubifs_zbranch old_zroot;
+ int old_zroot_level;
+ unsigned long long old_zroot_sqnum;
+- int failure_mode;
+- int fail_delay;
+- unsigned long fail_timeout;
+- unsigned int fail_cnt;
+- unsigned int fail_cnt_max;
++
++ int pc_happened;
++ int pc_delay;
++ unsigned long pc_timeout;
++ unsigned int pc_cnt;
++ unsigned int pc_cnt_max;
++
+ long long chk_lpt_sz;
+ long long chk_lpt_sz2;
+ long long chk_lpt_wastage;
+@@ -78,13 +102,47 @@ struct ubifs_debug_info {
+ int new_ihead_offs;
+
+ struct ubifs_lp_stats saved_lst;
++ struct ubifs_budg_info saved_bi;
+ long long saved_free;
++ int saved_idx_gc_cnt;
++
++ unsigned int chk_gen:1;
++ unsigned int chk_index:1;
++ unsigned int chk_orph:1;
++ unsigned int chk_lprops:1;
++ unsigned int chk_fs:1;
++ unsigned int tst_rcvry:1;
+
+- char dfs_dir_name[100];
++ char dfs_dir_name[UBIFS_DFS_DIR_LEN + 1];
+ struct dentry *dfs_dir;
+ struct dentry *dfs_dump_lprops;
+ struct dentry *dfs_dump_budg;
+ struct dentry *dfs_dump_tnc;
++ struct dentry *dfs_chk_gen;
++ struct dentry *dfs_chk_index;
++ struct dentry *dfs_chk_orph;
++ struct dentry *dfs_chk_lprops;
++ struct dentry *dfs_chk_fs;
++ struct dentry *dfs_tst_rcvry;
++};
++
++/**
++ * ubifs_global_debug_info - global (not per-FS) UBIFS debugging information.
++ *
++ * @chk_gen: if general extra checks are enabled
++ * @chk_index: if index xtra checks are enabled
++ * @chk_orph: if orphans extra checks are enabled
++ * @chk_lprops: if lprops extra checks are enabled
++ * @chk_fs: if UBIFS contents extra checks are enabled
++ * @tst_rcvry: if UBIFS recovery testing mode enabled
++ */
++struct ubifs_global_debug_info {
++ unsigned int chk_gen:1;
++ unsigned int chk_index:1;
++ unsigned int chk_orph:1;
++ unsigned int chk_lprops:1;
++ unsigned int chk_fs:1;
++ unsigned int tst_rcvry:1;
+ };
+
+ #define ubifs_assert(expr) do { \
+@@ -103,173 +161,90 @@ struct ubifs_debug_info {
+ } \
+ } while (0)
+
+-#define dbg_dump_stack() do { \
+- if (!dbg_failure_mode) \
+- dump_stack(); \
+-} while (0)
+-
+-/* Generic debugging messages */
+-#define dbg_msg(fmt, ...) do { \
+- spin_lock(&dbg_lock); \
+- printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid, \
+- __func__, ##__VA_ARGS__); \
+- spin_unlock(&dbg_lock); \
+-} while (0)
+-
+-#define dbg_do_msg(typ, fmt, ...) do { \
+- if (ubifs_msg_flags & typ) \
+- dbg_msg(fmt, ##__VA_ARGS__); \
+-} while (0)
++#define dbg_dump_stack() dump_stack()
+
+ #define dbg_err(fmt, ...) do { \
+- spin_lock(&dbg_lock); \
+ ubifs_err(fmt, ##__VA_ARGS__); \
+- spin_unlock(&dbg_lock); \
+ } while (0)
+
+-const char *dbg_key_str0(const struct ubifs_info *c,
+- const union ubifs_key *key);
+-const char *dbg_key_str1(const struct ubifs_info *c,
+- const union ubifs_key *key);
++#define ubifs_dbg_msg(type, fmt, ...) \
++ pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+-/*
+- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
+- * macros.
+- */
+-#define DBGKEY(key) dbg_key_str0(c, (key))
+-#define DBGKEY1(key) dbg_key_str1(c, (key))
++#define DBG_KEY_BUF_LEN 32
++#define ubifs_dbg_msg_key(type, key, fmt, ...) do { \
++ char __tmp_key_buf[DBG_KEY_BUF_LEN]; \
++ pr_debug("UBIFS DBG " type ": " fmt "%s\n", ##__VA_ARGS__, \
++ dbg_snprintf_key(c, key, __tmp_key_buf, DBG_KEY_BUF_LEN)); \
++} while (0)
+
+-/* General messages */
+-#define dbg_gen(fmt, ...) dbg_do_msg(UBIFS_MSG_GEN, fmt, ##__VA_ARGS__)
++/* Just a debugging messages not related to any specific UBIFS subsystem */
++#define dbg_msg(fmt, ...) \
++ printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid, \
++ __func__, ##__VA_ARGS__)
+
++/* General messages */
++#define dbg_gen(fmt, ...) ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Additional journal messages */
+-#define dbg_jnl(fmt, ...) dbg_do_msg(UBIFS_MSG_JNL, fmt, ##__VA_ARGS__)
+-
++#define dbg_jnl(fmt, ...) ubifs_dbg_msg("jnl", fmt, ##__VA_ARGS__)
++#define dbg_jnlk(key, fmt, ...) \
++ ubifs_dbg_msg_key("jnl", key, fmt, ##__VA_ARGS__)
+ /* Additional TNC messages */
+-#define dbg_tnc(fmt, ...) dbg_do_msg(UBIFS_MSG_TNC, fmt, ##__VA_ARGS__)
+-
++#define dbg_tnc(fmt, ...) ubifs_dbg_msg("tnc", fmt, ##__VA_ARGS__)
++#define dbg_tnck(key, fmt, ...) \
++ ubifs_dbg_msg_key("tnc", key, fmt, ##__VA_ARGS__)
+ /* Additional lprops messages */
+-#define dbg_lp(fmt, ...) dbg_do_msg(UBIFS_MSG_LP, fmt, ##__VA_ARGS__)
+-
++#define dbg_lp(fmt, ...) ubifs_dbg_msg("lp", fmt, ##__VA_ARGS__)
+ /* Additional LEB find messages */
+-#define dbg_find(fmt, ...) dbg_do_msg(UBIFS_MSG_FIND, fmt, ##__VA_ARGS__)
+-
++#define dbg_find(fmt, ...) ubifs_dbg_msg("find", fmt, ##__VA_ARGS__)
+ /* Additional mount messages */
+-#define dbg_mnt(fmt, ...) dbg_do_msg(UBIFS_MSG_MNT, fmt, ##__VA_ARGS__)
+-
++#define dbg_mnt(fmt, ...) ubifs_dbg_msg("mnt", fmt, ##__VA_ARGS__)
++#define dbg_mntk(key, fmt, ...) \
++ ubifs_dbg_msg_key("mnt", key, fmt, ##__VA_ARGS__)
+ /* Additional I/O messages */
+-#define dbg_io(fmt, ...) dbg_do_msg(UBIFS_MSG_IO, fmt, ##__VA_ARGS__)
+-
++#define dbg_io(fmt, ...) ubifs_dbg_msg("io", fmt, ##__VA_ARGS__)
+ /* Additional commit messages */
+-#define dbg_cmt(fmt, ...) dbg_do_msg(UBIFS_MSG_CMT, fmt, ##__VA_ARGS__)
+-
++#define dbg_cmt(fmt, ...) ubifs_dbg_msg("cmt", fmt, ##__VA_ARGS__)
+ /* Additional budgeting messages */
+-#define dbg_budg(fmt, ...) dbg_do_msg(UBIFS_MSG_BUDG, fmt, ##__VA_ARGS__)
+-
++#define dbg_budg(fmt, ...) ubifs_dbg_msg("budg", fmt, ##__VA_ARGS__)
+ /* Additional log messages */
+-#define dbg_log(fmt, ...) dbg_do_msg(UBIFS_MSG_LOG, fmt, ##__VA_ARGS__)
+-
++#define dbg_log(fmt, ...) ubifs_dbg_msg("log", fmt, ##__VA_ARGS__)
+ /* Additional gc messages */
+-#define dbg_gc(fmt, ...) dbg_do_msg(UBIFS_MSG_GC, fmt, ##__VA_ARGS__)
+-
++#define dbg_gc(fmt, ...) ubifs_dbg_msg("gc", fmt, ##__VA_ARGS__)
+ /* Additional scan messages */
+-#define dbg_scan(fmt, ...) dbg_do_msg(UBIFS_MSG_SCAN, fmt, ##__VA_ARGS__)
+-
++#define dbg_scan(fmt, ...) ubifs_dbg_msg("scan", fmt, ##__VA_ARGS__)
+ /* Additional recovery messages */
+-#define dbg_rcvry(fmt, ...) dbg_do_msg(UBIFS_MSG_RCVRY, fmt, ##__VA_ARGS__)
++#define dbg_rcvry(fmt, ...) ubifs_dbg_msg("rcvry", fmt, ##__VA_ARGS__)
+
+-/*
+- * Debugging message type flags (must match msg_type_names in debug.c).
+- *
+- * UBIFS_MSG_GEN: general messages
+- * UBIFS_MSG_JNL: journal messages
+- * UBIFS_MSG_MNT: mount messages
+- * UBIFS_MSG_CMT: commit messages
+- * UBIFS_MSG_FIND: LEB find messages
+- * UBIFS_MSG_BUDG: budgeting messages
+- * UBIFS_MSG_GC: garbage collection messages
+- * UBIFS_MSG_TNC: TNC messages
+- * UBIFS_MSG_LP: lprops messages
+- * UBIFS_MSG_IO: I/O messages
+- * UBIFS_MSG_LOG: log messages
+- * UBIFS_MSG_SCAN: scan messages
+- * UBIFS_MSG_RCVRY: recovery messages
+- */
+-enum {
+- UBIFS_MSG_GEN = 0x1,
+- UBIFS_MSG_JNL = 0x2,
+- UBIFS_MSG_MNT = 0x4,
+- UBIFS_MSG_CMT = 0x8,
+- UBIFS_MSG_FIND = 0x10,
+- UBIFS_MSG_BUDG = 0x20,
+- UBIFS_MSG_GC = 0x40,
+- UBIFS_MSG_TNC = 0x80,
+- UBIFS_MSG_LP = 0x100,
+- UBIFS_MSG_IO = 0x200,
+- UBIFS_MSG_LOG = 0x400,
+- UBIFS_MSG_SCAN = 0x800,
+- UBIFS_MSG_RCVRY = 0x1000,
+-};
+-
+-/* Debugging message type flags for each default debug message level */
+-#define UBIFS_MSG_LVL_0 0
+-#define UBIFS_MSG_LVL_1 0x1
+-#define UBIFS_MSG_LVL_2 0x7f
+-#define UBIFS_MSG_LVL_3 0xffff
+-
+-/*
+- * Debugging check flags (must match chk_names in debug.c).
+- *
+- * UBIFS_CHK_GEN: general checks
+- * UBIFS_CHK_TNC: check TNC
+- * UBIFS_CHK_IDX_SZ: check index size
+- * UBIFS_CHK_ORPH: check orphans
+- * UBIFS_CHK_OLD_IDX: check the old index
+- * UBIFS_CHK_LPROPS: check lprops
+- * UBIFS_CHK_FS: check the file-system
+- */
+-enum {
+- UBIFS_CHK_GEN = 0x1,
+- UBIFS_CHK_TNC = 0x2,
+- UBIFS_CHK_IDX_SZ = 0x4,
+- UBIFS_CHK_ORPH = 0x8,
+- UBIFS_CHK_OLD_IDX = 0x10,
+- UBIFS_CHK_LPROPS = 0x20,
+- UBIFS_CHK_FS = 0x40,
+-};
++extern struct ubifs_global_debug_info ubifs_dbg;
+
+-/*
+- * Special testing flags (must match tst_names in debug.c).
+- *
+- * UBIFS_TST_FORCE_IN_THE_GAPS: force the use of in-the-gaps method
+- * UBIFS_TST_RCVRY: failure mode for recovery testing
+- */
+-enum {
+- UBIFS_TST_FORCE_IN_THE_GAPS = 0x2,
+- UBIFS_TST_RCVRY = 0x4,
+-};
+-
+-#if CONFIG_UBIFS_FS_DEBUG_MSG_LVL == 1
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_1
+-#elif CONFIG_UBIFS_FS_DEBUG_MSG_LVL == 2
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_2
+-#elif CONFIG_UBIFS_FS_DEBUG_MSG_LVL == 3
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_3
+-#else
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_0
+-#endif
+-
+-#ifdef CONFIG_UBIFS_FS_DEBUG_CHKS
+-#define UBIFS_CHK_FLAGS_DEFAULT 0xffffffff
+-#else
+-#define UBIFS_CHK_FLAGS_DEFAULT 0
+-#endif
+-
+-extern spinlock_t dbg_lock;
+-
+-extern unsigned int ubifs_msg_flags;
+-extern unsigned int ubifs_chk_flags;
+-extern unsigned int ubifs_tst_flags;
++static inline int dbg_is_chk_gen(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_gen || c->dbg->chk_gen);
++}
++static inline int dbg_is_chk_index(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_index || c->dbg->chk_index);
++}
++static inline int dbg_is_chk_orph(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_orph || c->dbg->chk_orph);
++}
++static inline int dbg_is_chk_lprops(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_lprops || c->dbg->chk_lprops);
++}
++static inline int dbg_is_chk_fs(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_fs || c->dbg->chk_fs);
++}
++static inline int dbg_is_tst_rcvry(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.tst_rcvry || c->dbg->tst_rcvry);
++}
++static inline int dbg_is_power_cut(const struct ubifs_info *c)
++{
++ return !!c->dbg->pc_happened;
++}
+
+ int ubifs_debugging_init(struct ubifs_info *c);
+ void ubifs_debugging_exit(struct ubifs_info *c);
+@@ -280,17 +255,21 @@ const char *dbg_cstate(int cmt_state);
+ const char *dbg_jhead(int jhead);
+ const char *dbg_get_key_dump(const struct ubifs_info *c,
+ const union ubifs_key *key);
+-void dbg_dump_inode(const struct ubifs_info *c, const struct inode *inode);
++const char *dbg_snprintf_key(const struct ubifs_info *c,
++ const union ubifs_key *key, char *buffer, int len);
++void dbg_dump_inode(struct ubifs_info *c, const struct inode *inode);
+ void dbg_dump_node(const struct ubifs_info *c, const void *node);
+ void dbg_dump_lpt_node(const struct ubifs_info *c, void *node, int lnum,
+ int offs);
+ void dbg_dump_budget_req(const struct ubifs_budget_req *req);
+ void dbg_dump_lstats(const struct ubifs_lp_stats *lst);
+-void dbg_dump_budg(struct ubifs_info *c);
++void dbg_dump_budg(struct ubifs_info *c, const struct ubifs_budg_info *bi);
+ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp);
+ void dbg_dump_lprops(struct ubifs_info *c);
+ void dbg_dump_lpt_info(struct ubifs_info *c);
+ void dbg_dump_leb(const struct ubifs_info *c, int lnum);
++void dbg_dump_sleb(const struct ubifs_info *c,
++ const struct ubifs_scan_leb *sleb, int offs);
+ void dbg_dump_znode(const struct ubifs_info *c,
+ const struct ubifs_znode *znode);
+ void dbg_dump_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat);
+@@ -313,14 +292,13 @@ int dbg_check_cats(struct ubifs_info *c);
+ int dbg_check_ltab(struct ubifs_info *c);
+ int dbg_chk_lpt_free_spc(struct ubifs_info *c);
+ int dbg_chk_lpt_sz(struct ubifs_info *c, int action, int len);
+-int dbg_check_synced_i_size(struct inode *inode);
+-int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir);
++int dbg_check_synced_i_size(const struct ubifs_info *c, struct inode *inode);
++int dbg_check_dir(struct ubifs_info *c, const struct inode *dir);
+ int dbg_check_tnc(struct ubifs_info *c, int extra);
+ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size);
+ int dbg_check_filesystem(struct ubifs_info *c);
+ void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
+ int add_pos);
+-int dbg_check_lprops(struct ubifs_info *c);
+ int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
+ int row, int col);
+ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+@@ -328,57 +306,12 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+ int dbg_check_data_nodes_order(struct ubifs_info *c, struct list_head *head);
+ int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head);
+
+-/* Force the use of in-the-gaps method for testing */
+-
+-#define dbg_force_in_the_gaps_enabled \
+- (ubifs_tst_flags & UBIFS_TST_FORCE_IN_THE_GAPS)
+-
+-int dbg_force_in_the_gaps(void);
+-
+-/* Failure mode for recovery testing */
+-
+-#define dbg_failure_mode (ubifs_tst_flags & UBIFS_TST_RCVRY)
+-
+-#ifndef UBIFS_DBG_PRESERVE_UBI
+-
+-#define ubi_leb_read dbg_leb_read
+-#define ubi_leb_write dbg_leb_write
+-#define ubi_leb_change dbg_leb_change
+-#define ubi_leb_erase dbg_leb_erase
+-#define ubi_leb_unmap dbg_leb_unmap
+-#define ubi_is_mapped dbg_is_mapped
+-#define ubi_leb_map dbg_leb_map
+-
+-#endif
+-
+-int dbg_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
+- int len, int check);
+-int dbg_leb_write(struct ubi_volume_desc *desc, int lnum, const void *buf,
+- int offset, int len, int dtype);
+-int dbg_leb_change(struct ubi_volume_desc *desc, int lnum, const void *buf,
+- int len, int dtype);
+-int dbg_leb_erase(struct ubi_volume_desc *desc, int lnum);
+-int dbg_leb_unmap(struct ubi_volume_desc *desc, int lnum);
+-int dbg_is_mapped(struct ubi_volume_desc *desc, int lnum);
+-int dbg_leb_map(struct ubi_volume_desc *desc, int lnum, int dtype);
+-
+-static inline int dbg_read(struct ubi_volume_desc *desc, int lnum, char *buf,
+- int offset, int len)
+-{
+- return dbg_leb_read(desc, lnum, buf, offset, len, 0);
+-}
+-
+-static inline int dbg_write(struct ubi_volume_desc *desc, int lnum,
+- const void *buf, int offset, int len)
+-{
+- return dbg_leb_write(desc, lnum, buf, offset, len, UBI_UNKNOWN);
+-}
+-
+-static inline int dbg_change(struct ubi_volume_desc *desc, int lnum,
+- const void *buf, int len)
+-{
+- return dbg_leb_change(desc, lnum, buf, len, UBI_UNKNOWN);
+-}
++int dbg_leb_write(struct ubifs_info *c, int lnum, const void *buf, int offs,
++ int len, int dtype);
++int dbg_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len,
++ int dtype);
++int dbg_leb_unmap(struct ubifs_info *c, int lnum);
++int dbg_leb_map(struct ubifs_info *c, int lnum, int dtype);
+
+ /* Debugfs-related stuff */
+ int dbg_debugfs_init(void);
+@@ -390,116 +323,158 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
+
+ /* Use "if (0)" to make compiler check arguments even if debugging is off */
+ #define ubifs_assert(expr) do { \
+- if (0 && (expr)) \
++ if (0) \
+ printk(KERN_CRIT "UBIFS assert failed in %s at %u (pid %d)\n", \
+ __func__, __LINE__, current->pid); \
+ } while (0)
+
+-#define dbg_err(fmt, ...) do { \
+- if (0) \
+- ubifs_err(fmt, ##__VA_ARGS__); \
++#define dbg_err(fmt, ...) do { \
++ if (0) \
++ ubifs_err(fmt, ##__VA_ARGS__); \
+ } while (0)
+
+-#define dbg_msg(fmt, ...) do { \
+- if (0) \
+- printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", \
+- current->pid, __func__, ##__VA_ARGS__); \
++#define DBGKEY(key) ((char *)(key))
++#define DBGKEY1(key) ((char *)(key))
++
++#define ubifs_dbg_msg(fmt, ...) do { \
++ if (0) \
++ pr_debug(fmt "\n", ##__VA_ARGS__); \
+ } while (0)
+
+ #define dbg_dump_stack()
+ #define ubifs_assert_cmt_locked(c)
+
+-#define dbg_gen(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_jnl(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_tnc(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_lp(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_find(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_mnt(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_io(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_cmt(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_budg(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_log(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_gc(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_scan(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_rcvry(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-
+-#define DBGKEY(key) ((char *)(key))
+-#define DBGKEY1(key) ((char *)(key))
+-
+-static inline int ubifs_debugging_init(struct ubifs_info *c) { return 0; }
+-static inline void ubifs_debugging_exit(struct ubifs_info *c) {}
+-static inline const char *dbg_ntype(int type) { return ""; }
+-static inline const char *dbg_cstate(int cmt_state) { return ""; }
+-static inline const char *dbg_jhead(int jhead) { return ""; }
+-static inline const char *dbg_get_key_dump(const struct ubifs_info *c,
+- const union ubifs_key *key) { return ""; }
+-static inline void dbg_dump_inode(const struct ubifs_info *c,
+- const struct inode *inode) {}
++#define dbg_msg(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_gen(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_jnl(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_jnlk(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_tnc(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_tnck(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_lp(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_find(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_mnt(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_mntk(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_io(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_cmt(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_budg(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_log(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_gc(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_scan(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_rcvry(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++
++static inline int ubifs_debugging_init(struct ubifs_info *c) { return 0; }
++static inline void ubifs_debugging_exit(struct ubifs_info *c) { return; }
++static inline const char *dbg_ntype(int type) { return ""; }
++static inline const char *dbg_cstate(int cmt_state) { return ""; }
++static inline const char *dbg_jhead(int jhead) { return ""; }
++static inline const char *
++dbg_get_key_dump(const struct ubifs_info *c,
++ const union ubifs_key *key) { return ""; }
++static inline const char *
++dbg_snprintf_key(const struct ubifs_info *c,
++ const union ubifs_key *key, char *buffer,
++ int len) { return ""; }
++static inline void dbg_dump_inode(struct ubifs_info *c,
++ const struct inode *inode) { return; }
+ static inline void dbg_dump_node(const struct ubifs_info *c,
+- const void *node) {}
++ const void *node) { return; }
+ static inline void dbg_dump_lpt_node(const struct ubifs_info *c,
+- void *node, int lnum, int offs) {}
+-static inline void dbg_dump_budget_req(const struct ubifs_budget_req *req) {}
+-static inline void dbg_dump_lstats(const struct ubifs_lp_stats *lst) {}
+-static inline void dbg_dump_budg(struct ubifs_info *c) {}
++ void *node, int lnum,
++ int offs) { return; }
++static inline void
++dbg_dump_budget_req(const struct ubifs_budget_req *req) { return; }
++static inline void
++dbg_dump_lstats(const struct ubifs_lp_stats *lst) { return; }
++static inline void
++dbg_dump_budg(struct ubifs_info *c,
++ const struct ubifs_budg_info *bi) { return; }
+ static inline void dbg_dump_lprop(const struct ubifs_info *c,
+- const struct ubifs_lprops *lp) {}
+-static inline void dbg_dump_lprops(struct ubifs_info *c) {}
+-static inline void dbg_dump_lpt_info(struct ubifs_info *c) {}
+-static inline void dbg_dump_leb(const struct ubifs_info *c, int lnum) {}
+-static inline void dbg_dump_znode(const struct ubifs_info *c,
+- const struct ubifs_znode *znode) {}
++ const struct ubifs_lprops *lp) { return; }
++static inline void dbg_dump_lprops(struct ubifs_info *c) { return; }
++static inline void dbg_dump_lpt_info(struct ubifs_info *c) { return; }
++static inline void dbg_dump_leb(const struct ubifs_info *c,
++ int lnum) { return; }
++static inline void
++dbg_dump_sleb(const struct ubifs_info *c,
++ const struct ubifs_scan_leb *sleb, int offs) { return; }
++static inline void
++dbg_dump_znode(const struct ubifs_info *c,
++ const struct ubifs_znode *znode) { return; }
+ static inline void dbg_dump_heap(struct ubifs_info *c,
+- struct ubifs_lpt_heap *heap, int cat) {}
++ struct ubifs_lpt_heap *heap,
++ int cat) { return; }
+ static inline void dbg_dump_pnode(struct ubifs_info *c,
+- struct ubifs_pnode *pnode, struct ubifs_nnode *parent, int iip) {}
+-static inline void dbg_dump_tnc(struct ubifs_info *c) {}
+-static inline void dbg_dump_index(struct ubifs_info *c) {}
+-static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c) {}
++ struct ubifs_pnode *pnode,
++ struct ubifs_nnode *parent,
++ int iip) { return; }
++static inline void dbg_dump_tnc(struct ubifs_info *c) { return; }
++static inline void dbg_dump_index(struct ubifs_info *c) { return; }
++static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c) { return; }
+
+ static inline int dbg_walk_index(struct ubifs_info *c,
+- dbg_leaf_callback leaf_cb, dbg_znode_callback znode_cb, void *priv)
+- { return 0; }
+-
+-/* Checking functions */
+-static inline void dbg_save_space_info(struct ubifs_info *c) {}
+-static inline int dbg_check_space_info(struct ubifs_info *c) { return 0; }
+-static inline int dbg_check_lprops(struct ubifs_info *c) { return 0; }
+-static inline int dbg_old_index_check_init(struct ubifs_info *c,
+- struct ubifs_zbranch *zroot) { return 0; }
+-static inline int dbg_check_old_index(struct ubifs_info *c,
+- struct ubifs_zbranch *zroot) { return 0; }
+-static inline int dbg_check_cats(struct ubifs_info *c) { return 0; }
+-static inline int dbg_check_ltab(struct ubifs_info *c) { return 0; }
+-static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c) { return 0; }
++ dbg_leaf_callback leaf_cb,
++ dbg_znode_callback znode_cb,
++ void *priv) { return 0; }
++static inline void dbg_save_space_info(struct ubifs_info *c) { return; }
++static inline int dbg_check_space_info(struct ubifs_info *c) { return 0; }
++static inline int dbg_check_lprops(struct ubifs_info *c) { return 0; }
++static inline int
++dbg_old_index_check_init(struct ubifs_info *c,
++ struct ubifs_zbranch *zroot) { return 0; }
++static inline int
++dbg_check_old_index(struct ubifs_info *c,
++ struct ubifs_zbranch *zroot) { return 0; }
++static inline int dbg_check_cats(struct ubifs_info *c) { return 0; }
++static inline int dbg_check_ltab(struct ubifs_info *c) { return 0; }
++static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c) { return 0; }
+ static inline int dbg_chk_lpt_sz(struct ubifs_info *c,
+- int action, int len) { return 0; }
+-static inline int dbg_check_synced_i_size(struct inode *inode) { return 0; }
+-static inline int dbg_check_dir_size(struct ubifs_info *c,
+- const struct inode *dir) { return 0; }
+-static inline int dbg_check_tnc(struct ubifs_info *c, int extra) { return 0; }
++ int action, int len) { return 0; }
++static inline int
++dbg_check_synced_i_size(const struct ubifs_info *c,
++ struct inode *inode) { return 0; }
++static inline int dbg_check_dir(struct ubifs_info *c,
++ const struct inode *dir) { return 0; }
++static inline int dbg_check_tnc(struct ubifs_info *c, int extra) { return 0; }
+ static inline int dbg_check_idx_size(struct ubifs_info *c,
+- long long idx_size) { return 0; }
+-static inline int dbg_check_filesystem(struct ubifs_info *c) { return 0; }
++ long long idx_size) { return 0; }
++static inline int dbg_check_filesystem(struct ubifs_info *c) { return 0; }
+ static inline void dbg_check_heap(struct ubifs_info *c,
+- struct ubifs_lpt_heap *heap, int cat, int add_pos) {}
++ struct ubifs_lpt_heap *heap,
++ int cat, int add_pos) { return; }
+ static inline int dbg_check_lpt_nodes(struct ubifs_info *c,
+- struct ubifs_cnode *cnode, int row, int col) { return 0; }
++ struct ubifs_cnode *cnode, int row, int col) { return 0; }
+ static inline int dbg_check_inode_size(struct ubifs_info *c,
+- const struct inode *inode, loff_t size) { return 0; }
+-static inline int dbg_check_data_nodes_order(struct ubifs_info *c,
+- struct list_head *head) { return 0; }
+-static inline int dbg_check_nondata_nodes_order(struct ubifs_info *c,
+- struct list_head *head) { return 0; }
+-
+-#define dbg_force_in_the_gaps_enabled 0
+-static inline int dbg_force_in_the_gaps(void) { return 0; }
+-#define dbg_failure_mode 0
+-
+-static inline int dbg_debugfs_init(void) { return 0; }
+-static inline void dbg_debugfs_exit(void) {}
+-static inline int dbg_debugfs_init_fs(struct ubifs_info *c) { return 0; }
+-static inline int dbg_debugfs_exit_fs(struct ubifs_info *c) { return 0; }
++ const struct inode *inode,
++ loff_t size) { return 0; }
++static inline int
++dbg_check_data_nodes_order(struct ubifs_info *c,
++ struct list_head *head) { return 0; }
++static inline int
++dbg_check_nondata_nodes_order(struct ubifs_info *c,
++ struct list_head *head) { return 0; }
++
++static inline int dbg_leb_write(struct ubifs_info *c, int lnum,
++ const void *buf, int offset,
++ int len, int dtype) { return 0; }
++static inline int dbg_leb_change(struct ubifs_info *c, int lnum,
++ const void *buf, int len,
++ int dtype) { return 0; }
++static inline int dbg_leb_unmap(struct ubifs_info *c, int lnum) { return 0; }
++static inline int dbg_leb_map(struct ubifs_info *c, int lnum,
++ int dtype) { return 0; }
++
++static inline int dbg_is_chk_gen(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_index(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_orph(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_lprops(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_fs(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_tst_rcvry(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_power_cut(const struct ubifs_info *c) { return 0; }
++
++static inline int dbg_debugfs_init(void) { return 0; }
++static inline void dbg_debugfs_exit(void) { return; }
++static inline int dbg_debugfs_init_fs(struct ubifs_info *c) { return 0; }
++static inline int dbg_debugfs_exit_fs(struct ubifs_info *c) { return 0; }
+
+ #endif /* !CONFIG_UBIFS_FS_DEBUG */
+ #endif /* !__UBIFS_DEBUG_H__ */
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 14f64b6..9c5e3c5 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -102,7 +102,7 @@ struct inode *ubifs_new_inode(struct ubifs_info *c, const struct inode *dir,
+ * UBIFS has to fully control "clean <-> dirty" transitions of inodes
+ * to make budgeting work.
+ */
+- inode->i_flags |= (S_NOCMTIME);
++ inode->i_flags |= S_NOCMTIME;
+
+ inode_init_owner(inode, dir, mode);
+ inode->i_mtime = inode->i_atime = inode->i_ctime =
+@@ -172,9 +172,11 @@ struct inode *ubifs_new_inode(struct ubifs_info *c, const struct inode *dir,
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+
+-static int dbg_check_name(struct ubifs_dent_node *dent, struct qstr *nm)
++static int dbg_check_name(const struct ubifs_info *c,
++ const struct ubifs_dent_node *dent,
++ const struct qstr *nm)
+ {
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+ if (le16_to_cpu(dent->nlen) != nm->len)
+ return -EINVAL;
+@@ -185,7 +187,7 @@ static int dbg_check_name(struct ubifs_dent_node *dent, struct qstr *nm)
+
+ #else
+
+-#define dbg_check_name(dent, nm) 0
++#define dbg_check_name(c, dent, nm) 0
+
+ #endif
+
+@@ -219,7 +221,7 @@ static struct dentry *ubifs_lookup(struct inode *dir, struct dentry *dentry,
+ goto out;
+ }
+
+- if (dbg_check_name(dent, &dentry->d_name)) {
++ if (dbg_check_name(c, dent, &dentry->d_name)) {
+ err = -EINVAL;
+ goto out;
+ }
+@@ -540,7 +542,7 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
+ if (inode->i_nlink == 0)
+ return -ENOENT;
+
+- err = dbg_check_synced_i_size(inode);
++ err = dbg_check_synced_i_size(c, inode);
+ if (err)
+ return err;
+
+@@ -595,7 +597,7 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
+ inode->i_nlink, dir->i_ino);
+ ubifs_assert(mutex_is_locked(&dir->i_mutex));
+ ubifs_assert(mutex_is_locked(&inode->i_mutex));
+- err = dbg_check_synced_i_size(inode);
++ err = dbg_check_synced_i_size(c, inode);
+ if (err)
+ return err;
+
+@@ -621,7 +623,7 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
+ ubifs_release_budget(c, &req);
+ else {
+ /* We've deleted something - clean the "no space" flags */
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ return 0;
+@@ -711,7 +713,7 @@ static int ubifs_rmdir(struct inode *dir, struct dentry *dentry)
+ ubifs_release_budget(c, &req);
+ else {
+ /* We've deleted something - clean the "no space" flags */
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ return 0;
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index d77db7e..7cf738a 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -212,7 +212,7 @@ static void release_new_page_budget(struct ubifs_info *c)
+ */
+ static void release_existing_page_budget(struct ubifs_info *c)
+ {
+- struct ubifs_budget_req req = { .dd_growth = c->page_budget};
++ struct ubifs_budget_req req = { .dd_growth = c->bi.page_budget};
+
+ ubifs_release_budget(c, &req);
+ }
+@@ -448,10 +448,12 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
+ if (!(pos & ~PAGE_CACHE_MASK) && len == PAGE_CACHE_SIZE) {
+ /*
+ * We change whole page so no need to load it. But we
+- * have to set the @PG_checked flag to make the further
+- * code know that the page is new. This might be not
+- * true, but it is better to budget more than to read
+- * the page from the media.
++ * do not know whether this page exists on the media or
++ * not, so we assume the latter because it requires
++ * larger budget. The assumption is that it is better
++ * to budget a bit more than to read the page from the
++ * media. Thus, we are setting the @PG_checked flag
++ * here.
+ */
+ SetPageChecked(page);
+ skipped_read = 1;
+@@ -559,6 +561,7 @@ static int ubifs_write_end(struct file *file, struct address_space *mapping,
+ dbg_gen("copied %d instead of %d, read page and repeat",
+ copied, len);
+ cancel_budget(c, page, ui, appending);
++ ClearPageChecked(page);
+
+ /*
+ * Return 0 to force VFS to repeat the whole operation, or the
+@@ -968,11 +971,11 @@ static int do_writepage(struct page *page, int len)
+ * the page locked, and it locks @ui_mutex. However, write-back does take inode
+ * @i_mutex, which means other VFS operations may be run on this inode at the
+ * same time. And the problematic one is truncation to smaller size, from where
+- * we have to call 'truncate_setsize()', which first changes @inode->i_size, then
+- * drops the truncated pages. And while dropping the pages, it takes the page
+- * lock. This means that 'do_truncation()' cannot call 'truncate_setsize()' with
+- * @ui_mutex locked, because it would deadlock with 'ubifs_writepage()'. This
+- * means that @inode->i_size is changed while @ui_mutex is unlocked.
++ * we have to call 'truncate_setsize()', which first changes @inode->i_size,
++ * then drops the truncated pages. And while dropping the pages, it takes the
++ * page lock. This means that 'do_truncation()' cannot call 'truncate_setsize()'
++ * with @ui_mutex locked, because it would deadlock with 'ubifs_writepage()'.
++ * This means that @inode->i_size is changed while @ui_mutex is unlocked.
+ *
+ * XXX(truncate): with the new truncate sequence this is not true anymore,
+ * and the calls to truncate_setsize can be move around freely. They should
+@@ -1186,7 +1189,7 @@ out_budg:
+ if (budgeted)
+ ubifs_release_budget(c, &req);
+ else {
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ return err;
+@@ -1260,7 +1263,7 @@ int ubifs_setattr(struct dentry *dentry, struct iattr *attr)
+ if (err)
+ return err;
+
+- err = dbg_check_synced_i_size(inode);
++ err = dbg_check_synced_i_size(c, inode);
+ if (err)
+ return err;
+
+@@ -1309,6 +1312,13 @@ int ubifs_fsync(struct file *file, int datasync)
+
+ dbg_gen("syncing inode %lu", inode->i_ino);
+
++ if (c->ro_mount)
++ /*
++ * For some really strange reasons VFS does not filter out
++ * 'fsync()' for R/O mounted file-systems as per 2.6.39.
++ */
++ return 0;
++
+ /*
+ * VFS has already synchronized dirty pages for this inode. Synchronize
+ * the inode unless this is a 'datasync()' call.
+@@ -1426,10 +1436,11 @@ static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
+ }
+
+ /*
+- * mmap()d file has taken write protection fault and is being made
+- * writable. UBIFS must ensure page is budgeted for.
++ * mmap()d file has taken write protection fault and is being made writable.
++ * UBIFS must ensure page is budgeted for.
+ */
+-static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
++static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma,
++ struct vm_fault *vmf)
+ {
+ struct page *page = vmf->page;
+ struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
+@@ -1530,7 +1541,6 @@ static int ubifs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ int err;
+
+- /* 'generic_file_mmap()' takes care of NOMMU case */
+ err = generic_file_mmap(file, vma);
+ if (err)
+ return err;
+diff --git a/fs/ubifs/find.c b/fs/ubifs/find.c
+index 1d54383..2559d17 100644
+--- a/fs/ubifs/find.c
++++ b/fs/ubifs/find.c
+@@ -252,8 +252,8 @@ int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
+ * But if the index takes fewer LEBs than it is reserved for it,
+ * this function must avoid picking those reserved LEBs.
+ */
+- if (c->min_idx_lebs >= c->lst.idx_lebs) {
+- rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
++ if (c->bi.min_idx_lebs >= c->lst.idx_lebs) {
++ rsvd_idx_lebs = c->bi.min_idx_lebs - c->lst.idx_lebs;
+ exclude_index = 1;
+ }
+ spin_unlock(&c->space_lock);
+@@ -276,7 +276,7 @@ int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
+ pick_free = 0;
+ } else {
+ spin_lock(&c->space_lock);
+- exclude_index = (c->min_idx_lebs >= c->lst.idx_lebs);
++ exclude_index = (c->bi.min_idx_lebs >= c->lst.idx_lebs);
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -501,8 +501,8 @@ int ubifs_find_free_space(struct ubifs_info *c, int min_space, int *offs,
+
+ /* Check if there are enough empty LEBs for commit */
+ spin_lock(&c->space_lock);
+- if (c->min_idx_lebs > c->lst.idx_lebs)
+- rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
++ if (c->bi.min_idx_lebs > c->lst.idx_lebs)
++ rsvd_idx_lebs = c->bi.min_idx_lebs - c->lst.idx_lebs;
+ else
+ rsvd_idx_lebs = 0;
+ lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
+diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
+index 151f108..ded29f6 100644
+--- a/fs/ubifs/gc.c
++++ b/fs/ubifs/gc.c
+@@ -100,6 +100,10 @@ static int switch_gc_head(struct ubifs_info *c)
+ if (err)
+ return err;
+
++ err = ubifs_wbuf_sync_nolock(wbuf);
++ if (err)
++ return err;
++
+ err = ubifs_add_bud_to_log(c, GCHD, gc_lnum, 0);
+ if (err)
+ return err;
+@@ -118,7 +122,7 @@ static int switch_gc_head(struct ubifs_info *c)
+ * This function compares data nodes @a and @b. Returns %1 if @a has greater
+ * inode or block number, and %-1 otherwise.
+ */
+-int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
++static int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
+ {
+ ino_t inuma, inumb;
+ struct ubifs_info *c = priv;
+@@ -161,7 +165,8 @@ int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
+ * first and sorted by length in descending order. Directory entry nodes go
+ * after inode nodes and are sorted in ascending hash valuer order.
+ */
+-int nondata_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
++static int nondata_nodes_cmp(void *priv, struct list_head *a,
++ struct list_head *b)
+ {
+ ino_t inuma, inumb;
+ struct ubifs_info *c = priv;
+@@ -473,6 +478,37 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
+ ubifs_assert(c->gc_lnum != lnum);
+ ubifs_assert(wbuf->lnum != lnum);
+
++ if (lp->free + lp->dirty == c->leb_size) {
++ /* Special case - a free LEB */
++ dbg_gc("LEB %d is free, return it", lp->lnum);
++ ubifs_assert(!(lp->flags & LPROPS_INDEX));
++
++ if (lp->free != c->leb_size) {
++ /*
++ * Write buffers must be sync'd before unmapping
++ * freeable LEBs, because one of them may contain data
++ * which obsoletes something in 'lp->pnum'.
++ */
++ err = gc_sync_wbufs(c);
++ if (err)
++ return err;
++ err = ubifs_change_one_lp(c, lp->lnum, c->leb_size,
++ 0, 0, 0, 0);
++ if (err)
++ return err;
++ }
++ err = ubifs_leb_unmap(c, lp->lnum);
++ if (err)
++ return err;
++
++ if (c->gc_lnum == -1) {
++ c->gc_lnum = lnum;
++ return LEB_RETAINED;
++ }
++
++ return LEB_FREED;
++ }
++
+ /*
+ * We scan the entire LEB even though we only really need to scan up to
+ * (c->leb_size - lp->free).
+@@ -682,37 +718,6 @@ int ubifs_garbage_collect(struct ubifs_info *c, int anyway)
+ "(min. space %d)", lp.lnum, lp.free, lp.dirty,
+ lp.free + lp.dirty, min_space);
+
+- if (lp.free + lp.dirty == c->leb_size) {
+- /* An empty LEB was returned */
+- dbg_gc("LEB %d is free, return it", lp.lnum);
+- /*
+- * ubifs_find_dirty_leb() doesn't return freeable index
+- * LEBs.
+- */
+- ubifs_assert(!(lp.flags & LPROPS_INDEX));
+- if (lp.free != c->leb_size) {
+- /*
+- * Write buffers must be sync'd before
+- * unmapping freeable LEBs, because one of them
+- * may contain data which obsoletes something
+- * in 'lp.pnum'.
+- */
+- ret = gc_sync_wbufs(c);
+- if (ret)
+- goto out;
+- ret = ubifs_change_one_lp(c, lp.lnum,
+- c->leb_size, 0, 0, 0,
+- 0);
+- if (ret)
+- goto out;
+- }
+- ret = ubifs_leb_unmap(c, lp.lnum);
+- if (ret)
+- goto out;
+- ret = lp.lnum;
+- break;
+- }
+-
+ space_before = c->leb_size - wbuf->offs - wbuf->used;
+ if (wbuf->lnum == -1)
+ space_before = 0;
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index d821731..9228950 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -31,6 +31,26 @@
+ * buffer is full or when it is not used for some time (by timer). This is
+ * similar to the mechanism is used by JFFS2.
+ *
++ * UBIFS distinguishes between minimum write size (@c->min_io_size) and maximum
++ * write size (@c->max_write_size). The latter is the maximum amount of bytes
++ * the underlying flash is able to program at a time, and writing in
++ * @c->max_write_size units should presumably be faster. Obviously,
++ * @c->min_io_size <= @c->max_write_size. Write-buffers are of
++ * @c->max_write_size bytes in size for maximum performance. However, when a
++ * write-buffer is flushed, only the portion of it (aligned to @c->min_io_size
++ * boundary) which contains data is written, not the whole write-buffer,
++ * because this is more space-efficient.
++ *
++ * This optimization adds few complications to the code. Indeed, on the one
++ * hand, we want to write in optimal @c->max_write_size bytes chunks, which
++ * also means aligning writes at the @c->max_write_size bytes offsets. On the
++ * other hand, we do not want to waste space when synchronizing the write
++ * buffer, so during synchronization we writes in smaller chunks. And this makes
++ * the next write offset to be not aligned to @c->max_write_size bytes. So the
++ * have to make sure that the write-buffer offset (@wbuf->offs) becomes aligned
++ * to @c->max_write_size bytes again. We do this by temporarily shrinking
++ * write-buffer size (@wbuf->size).
++ *
+ * Write-buffers are defined by 'struct ubifs_wbuf' objects and protected by
+ * mutexes defined inside these objects. Since sometimes upper-level code
+ * has to lock the write-buffer (e.g. journal space reservation code), many
+@@ -46,8 +66,8 @@
+ * UBIFS uses padding when it pads to the next min. I/O unit. In this case it
+ * uses padding nodes or padding bytes, if the padding node does not fit.
+ *
+- * All UBIFS nodes are protected by CRC checksums and UBIFS checks all nodes
+- * every time they are read from the flash media.
++ * All UBIFS nodes are protected by CRC checksums and UBIFS checks CRC when
++ * they are read from the flash media.
+ */
+
+ #include <linux/crc32.h>
+@@ -66,8 +86,125 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
+ c->no_chk_data_crc = 0;
+ c->vfs_sb->s_flags |= MS_RDONLY;
+ ubifs_warn("switched to read-only mode, error %d", err);
++ dump_stack();
++ }
++}
++
++/*
++ * Below are simple wrappers over UBI I/O functions which include some
++ * additional checks and UBIFS debugging stuff. See corresponding UBI function
++ * for more information.
++ */
++
++int ubifs_leb_read(const struct ubifs_info *c, int lnum, void *buf, int offs,
++ int len, int even_ebadmsg)
++{
++ int err;
++
++ err = ubi_read(c->ubi, lnum, buf, offs, len);
++ /*
++ * In case of %-EBADMSG print the error message only if the
++ * @even_ebadmsg is true.
++ */
++ if (err && (err != -EBADMSG || even_ebadmsg)) {
++ ubifs_err("reading %d bytes from LEB %d:%d failed, error %d",
++ len, lnum, offs, err);
+ dbg_dump_stack();
+ }
++ return err;
++}
++
++int ubifs_leb_write(struct ubifs_info *c, int lnum, const void *buf, int offs,
++ int len, int dtype)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_write(c->ubi, lnum, buf, offs, len, dtype);
++ else
++ err = dbg_leb_write(c, lnum, buf, offs, len, dtype);
++ if (err) {
++ ubifs_err("writing %d bytes to LEB %d:%d failed, error %d",
++ len, lnum, offs, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len,
++ int dtype)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_change(c->ubi, lnum, buf, len, dtype);
++ else
++ err = dbg_leb_change(c, lnum, buf, len, dtype);
++ if (err) {
++ ubifs_err("changing %d bytes in LEB %d failed, error %d",
++ len, lnum, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_leb_unmap(struct ubifs_info *c, int lnum)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_unmap(c->ubi, lnum);
++ else
++ err = dbg_leb_unmap(c, lnum);
++ if (err) {
++ ubifs_err("unmap LEB %d failed, error %d", lnum, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_leb_map(struct ubifs_info *c, int lnum, int dtype)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_map(c->ubi, lnum, dtype);
++ else
++ err = dbg_leb_map(c, lnum, dtype);
++ if (err) {
++ ubifs_err("mapping LEB %d failed, error %d", lnum, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
++{
++ int err;
++
++ err = ubi_is_mapped(c->ubi, lnum);
++ if (err < 0) {
++ ubifs_err("ubi_is_mapped failed for LEB %d, error %d",
++ lnum, err);
++ dbg_dump_stack();
++ }
++ return err;
+ }
+
+ /**
+@@ -88,8 +225,12 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
+ * This function may skip data nodes CRC checking if @c->no_chk_data_crc is
+ * true, which is controlled by corresponding UBIFS mount option. However, if
+ * @must_chk_crc is true, then @c->no_chk_data_crc is ignored and CRC is
+- * checked. Similarly, if @c->always_chk_crc is true, @c->no_chk_data_crc is
+- * ignored and CRC is checked.
++ * checked. Similarly, if @c->mounting or @c->remounting_rw is true (we are
++ * mounting or re-mounting to R/W mode), @c->no_chk_data_crc is ignored and CRC
++ * is checked. This is because during mounting or re-mounting from R/O mode to
++ * R/W mode we may read journal nodes (when replying the journal or doing the
++ * recovery) and the journal nodes may potentially be corrupted, so checking is
++ * required.
+ *
+ * This function returns zero in case of success and %-EUCLEAN in case of bad
+ * CRC or magic.
+@@ -131,8 +272,8 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ node_len > c->ranges[type].max_len)
+ goto out_len;
+
+- if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc &&
+- c->no_chk_data_crc)
++ if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->mounting &&
++ !c->remounting_rw && c->no_chk_data_crc)
+ return 0;
+
+ crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
+@@ -343,11 +484,17 @@ static void cancel_wbuf_timer_nolock(struct ubifs_wbuf *wbuf)
+ *
+ * This function synchronizes write-buffer @buf and returns zero in case of
+ * success or a negative error code in case of failure.
++ *
++ * Note, although write-buffers are of @c->max_write_size, this function does
++ * not necessarily writes all @c->max_write_size bytes to the flash. Instead,
++ * if the write-buffer is only partially filled with data, only the used part
++ * of the write-buffer (aligned on @c->min_io_size boundary) is synchronized.
++ * This way we waste less space.
+ */
+ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
+ {
+ struct ubifs_info *c = wbuf->c;
+- int err, dirt;
++ int err, dirt, sync_len;
+
+ cancel_wbuf_timer_nolock(wbuf);
+ if (!wbuf->used || wbuf->lnum == -1)
+@@ -357,27 +504,49 @@ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
+ dbg_io("LEB %d:%d, %d bytes, jhead %s",
+ wbuf->lnum, wbuf->offs, wbuf->used, dbg_jhead(wbuf->jhead));
+ ubifs_assert(!(wbuf->avail & 7));
+- ubifs_assert(wbuf->offs + c->min_io_size <= c->leb_size);
++ ubifs_assert(wbuf->offs + wbuf->size <= c->leb_size);
++ ubifs_assert(wbuf->size >= c->min_io_size);
++ ubifs_assert(wbuf->size <= c->max_write_size);
++ ubifs_assert(wbuf->size % c->min_io_size == 0);
+ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ ubifs_assert(!((wbuf->offs + wbuf->size) % c->max_write_size));
+
+ if (c->ro_error)
+ return -EROFS;
+
+- ubifs_pad(c, wbuf->buf + wbuf->used, wbuf->avail);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf, wbuf->offs,
+- c->min_io_size, wbuf->dtype);
+- if (err) {
+- ubifs_err("cannot write %d bytes to LEB %d:%d",
+- c->min_io_size, wbuf->lnum, wbuf->offs);
+- dbg_dump_stack();
++ /*
++ * Do not write whole write buffer but write only the minimum necessary
++ * amount of min. I/O units.
++ */
++ sync_len = ALIGN(wbuf->used, c->min_io_size);
++ dirt = sync_len - wbuf->used;
++ if (dirt)
++ ubifs_pad(c, wbuf->buf + wbuf->used, dirt);
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, sync_len,
++ wbuf->dtype);
++ if (err)
+ return err;
+- }
+-
+- dirt = wbuf->avail;
+
+ spin_lock(&wbuf->lock);
+- wbuf->offs += c->min_io_size;
+- wbuf->avail = c->min_io_size;
++ wbuf->offs += sync_len;
++ /*
++ * Now @wbuf->offs is not necessarily aligned to @c->max_write_size.
++ * But our goal is to optimize writes and make sure we write in
++ * @c->max_write_size chunks and to @c->max_write_size-aligned offset.
++ * Thus, if @wbuf->offs is not aligned to @c->max_write_size now, make
++ * sure that @wbuf->offs + @wbuf->size is aligned to
++ * @c->max_write_size. This way we make sure that after next
++ * write-buffer flush we are again at the optimal offset (aligned to
++ * @c->max_write_size).
++ */
++ if (c->leb_size - wbuf->offs < c->max_write_size)
++ wbuf->size = c->leb_size - wbuf->offs;
++ else if (wbuf->offs & (c->max_write_size - 1))
++ wbuf->size = ALIGN(wbuf->offs, c->max_write_size) - wbuf->offs;
++ else
++ wbuf->size = c->max_write_size;
++ wbuf->avail = wbuf->size;
+ wbuf->used = 0;
+ wbuf->next_ino = 0;
+ spin_unlock(&wbuf->lock);
+@@ -396,8 +565,8 @@ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
+ * @dtype: data type
+ *
+ * This function targets the write-buffer to logical eraseblock @lnum:@offs.
+- * The write-buffer is synchronized if it is not empty. Returns zero in case of
+- * success and a negative error code in case of failure.
++ * The write-buffer has to be empty. Returns zero in case of success and a
++ * negative error code in case of failure.
+ */
+ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
+ int dtype)
+@@ -409,18 +578,18 @@ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
+ ubifs_assert(offs >= 0 && offs <= c->leb_size);
+ ubifs_assert(offs % c->min_io_size == 0 && !(offs & 7));
+ ubifs_assert(lnum != wbuf->lnum);
+-
+- if (wbuf->used > 0) {
+- int err = ubifs_wbuf_sync_nolock(wbuf);
+-
+- if (err)
+- return err;
+- }
++ ubifs_assert(wbuf->used == 0);
+
+ spin_lock(&wbuf->lock);
+ wbuf->lnum = lnum;
+ wbuf->offs = offs;
+- wbuf->avail = c->min_io_size;
++ if (c->leb_size - wbuf->offs < c->max_write_size)
++ wbuf->size = c->leb_size - wbuf->offs;
++ else if (wbuf->offs & (c->max_write_size - 1))
++ wbuf->size = ALIGN(wbuf->offs, c->max_write_size) - wbuf->offs;
++ else
++ wbuf->size = c->max_write_size;
++ wbuf->avail = wbuf->size;
+ wbuf->used = 0;
+ spin_unlock(&wbuf->lock);
+ wbuf->dtype = dtype;
+@@ -500,8 +669,9 @@ out_timers:
+ *
+ * This function writes data to flash via write-buffer @wbuf. This means that
+ * the last piece of the node won't reach the flash media immediately if it
+- * does not take whole minimal I/O unit. Instead, the node will sit in RAM
+- * until the write-buffer is synchronized (e.g., by timer).
++ * does not take whole max. write unit (@c->max_write_size). Instead, the node
++ * will sit in RAM until the write-buffer is synchronized (e.g., by timer, or
++ * because more data are appended to the write-buffer).
+ *
+ * This function returns zero in case of success and a negative error code in
+ * case of failure. If the node cannot be written because there is no more
+@@ -510,7 +680,7 @@ out_timers:
+ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ {
+ struct ubifs_info *c = wbuf->c;
+- int err, written, n, aligned_len = ALIGN(len, 8), offs;
++ int err, written, n, aligned_len = ALIGN(len, 8);
+
+ dbg_io("%d bytes (%s) to jhead %s wbuf at LEB %d:%d", len,
+ dbg_ntype(((struct ubifs_ch *)buf)->node_type),
+@@ -518,9 +688,15 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ ubifs_assert(len > 0 && wbuf->lnum >= 0 && wbuf->lnum < c->leb_cnt);
+ ubifs_assert(wbuf->offs >= 0 && wbuf->offs % c->min_io_size == 0);
+ ubifs_assert(!(wbuf->offs & 7) && wbuf->offs <= c->leb_size);
+- ubifs_assert(wbuf->avail > 0 && wbuf->avail <= c->min_io_size);
++ ubifs_assert(wbuf->avail > 0 && wbuf->avail <= wbuf->size);
++ ubifs_assert(wbuf->size >= c->min_io_size);
++ ubifs_assert(wbuf->size <= c->max_write_size);
++ ubifs_assert(wbuf->size % c->min_io_size == 0);
+ ubifs_assert(mutex_is_locked(&wbuf->io_mutex));
+ ubifs_assert(!c->ro_media && !c->ro_mount);
++ ubifs_assert(!c->space_fixup);
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ ubifs_assert(!((wbuf->offs + wbuf->size) % c->max_write_size));
+
+ if (c->leb_size - wbuf->offs - wbuf->used < aligned_len) {
+ err = -ENOSPC;
+@@ -542,15 +718,19 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ if (aligned_len == wbuf->avail) {
+ dbg_io("flush jhead %s wbuf to LEB %d:%d",
+ dbg_jhead(wbuf->jhead), wbuf->lnum, wbuf->offs);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf,
+- wbuf->offs, c->min_io_size,
+- wbuf->dtype);
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf,
++ wbuf->offs, wbuf->size,
++ wbuf->dtype);
+ if (err)
+ goto out;
+
+ spin_lock(&wbuf->lock);
+- wbuf->offs += c->min_io_size;
+- wbuf->avail = c->min_io_size;
++ wbuf->offs += wbuf->size;
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ wbuf->size = c->max_write_size;
++ else
++ wbuf->size = c->leb_size - wbuf->offs;
++ wbuf->avail = wbuf->size;
+ wbuf->used = 0;
+ wbuf->next_ino = 0;
+ spin_unlock(&wbuf->lock);
+@@ -564,39 +744,63 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ goto exit;
+ }
+
+- /*
+- * The node is large enough and does not fit entirely within current
+- * minimal I/O unit. We have to fill and flush write-buffer and switch
+- * to the next min. I/O unit.
+- */
+- dbg_io("flush jhead %s wbuf to LEB %d:%d",
+- dbg_jhead(wbuf->jhead), wbuf->lnum, wbuf->offs);
+- memcpy(wbuf->buf + wbuf->used, buf, wbuf->avail);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf, wbuf->offs,
+- c->min_io_size, wbuf->dtype);
+- if (err)
+- goto out;
++ written = 0;
++
++ if (wbuf->used) {
++ /*
++ * The node is large enough and does not fit entirely within
++ * current available space. We have to fill and flush
++ * write-buffer and switch to the next max. write unit.
++ */
++ dbg_io("flush jhead %s wbuf to LEB %d:%d",
++ dbg_jhead(wbuf->jhead), wbuf->lnum, wbuf->offs);
++ memcpy(wbuf->buf + wbuf->used, buf, wbuf->avail);
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs,
++ wbuf->size, wbuf->dtype);
++ if (err)
++ goto out;
++
++ wbuf->offs += wbuf->size;
++ len -= wbuf->avail;
++ aligned_len -= wbuf->avail;
++ written += wbuf->avail;
++ } else if (wbuf->offs & (c->max_write_size - 1)) {
++ /*
++ * The write-buffer offset is not aligned to
++ * @c->max_write_size and @wbuf->size is less than
++ * @c->max_write_size. Write @wbuf->size bytes to make sure the
++ * following writes are done in optimal @c->max_write_size
++ * chunks.
++ */
++ dbg_io("write %d bytes to LEB %d:%d",
++ wbuf->size, wbuf->lnum, wbuf->offs);
++ err = ubifs_leb_write(c, wbuf->lnum, buf, wbuf->offs,
++ wbuf->size, wbuf->dtype);
++ if (err)
++ goto out;
+
+- offs = wbuf->offs + c->min_io_size;
+- len -= wbuf->avail;
+- aligned_len -= wbuf->avail;
+- written = wbuf->avail;
++ wbuf->offs += wbuf->size;
++ len -= wbuf->size;
++ aligned_len -= wbuf->size;
++ written += wbuf->size;
++ }
+
+ /*
+- * The remaining data may take more whole min. I/O units, so write the
+- * remains multiple to min. I/O unit size directly to the flash media.
++ * The remaining data may take more whole max. write units, so write the
++ * remains multiple to max. write unit size directly to the flash media.
+ * We align node length to 8-byte boundary because we anyway flash wbuf
+ * if the remaining space is less than 8 bytes.
+ */
+- n = aligned_len >> c->min_io_shift;
++ n = aligned_len >> c->max_write_shift;
+ if (n) {
+- n <<= c->min_io_shift;
+- dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum, offs);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, buf + written, offs, n,
+- wbuf->dtype);
++ n <<= c->max_write_shift;
++ dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum,
++ wbuf->offs);
++ err = ubifs_leb_write(c, wbuf->lnum, buf + written,
++ wbuf->offs, n, wbuf->dtype);
+ if (err)
+ goto out;
+- offs += n;
++ wbuf->offs += n;
+ aligned_len -= n;
+ len -= n;
+ written += n;
+@@ -606,14 +810,17 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ if (aligned_len)
+ /*
+ * And now we have what's left and what does not take whole
+- * min. I/O unit, so write it to the write-buffer and we are
++ * max. write unit, so write it to the write-buffer and we are
+ * done.
+ */
+ memcpy(wbuf->buf, buf + written, len);
+
+- wbuf->offs = offs;
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ wbuf->size = c->max_write_size;
++ else
++ wbuf->size = c->leb_size - wbuf->offs;
++ wbuf->avail = wbuf->size - aligned_len;
+ wbuf->used = aligned_len;
+- wbuf->avail = c->min_io_size - aligned_len;
+ wbuf->next_ino = 0;
+ spin_unlock(&wbuf->lock);
+
+@@ -666,18 +873,15 @@ int ubifs_write_node(struct ubifs_info *c, void *buf, int len, int lnum,
+ ubifs_assert(lnum >= 0 && lnum < c->leb_cnt && offs >= 0);
+ ubifs_assert(offs % c->min_io_size == 0 && offs < c->leb_size);
+ ubifs_assert(!c->ro_media && !c->ro_mount);
++ ubifs_assert(!c->space_fixup);
+
+ if (c->ro_error)
+ return -EROFS;
+
+ ubifs_prepare_node(c, buf, len, 1);
+- err = ubi_leb_write(c->ubi, lnum, buf, offs, buf_len, dtype);
+- if (err) {
+- ubifs_err("cannot write %d bytes to LEB %d:%d, error %d",
+- buf_len, lnum, offs, err);
++ err = ubifs_leb_write(c, lnum, buf, offs, buf_len, dtype);
++ if (err)
+ dbg_dump_node(c, buf);
+- dbg_dump_stack();
+- }
+
+ return err;
+ }
+@@ -729,13 +933,9 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
+
+ if (rlen > 0) {
+ /* Read everything that goes before write-buffer */
+- err = ubi_read(c->ubi, lnum, buf, offs, rlen);
+- if (err && err != -EBADMSG) {
+- ubifs_err("failed to read node %d from LEB %d:%d, "
+- "error %d", type, lnum, offs, err);
+- dbg_dump_stack();
++ err = ubifs_leb_read(c, lnum, buf, offs, rlen, 0);
++ if (err && err != -EBADMSG)
+ return err;
+- }
+ }
+
+ if (type != ch->node_type) {
+@@ -790,12 +990,9 @@ int ubifs_read_node(const struct ubifs_info *c, void *buf, int type, int len,
+ ubifs_assert(!(offs & 7) && offs < c->leb_size);
+ ubifs_assert(type >= 0 && type < UBIFS_NODE_TYPES_CNT);
+
+- err = ubi_read(c->ubi, lnum, buf, offs, len);
+- if (err && err != -EBADMSG) {
+- ubifs_err("cannot read node %d from LEB %d:%d, error %d",
+- type, lnum, offs, err);
++ err = ubifs_leb_read(c, lnum, buf, offs, len, 0);
++ if (err && err != -EBADMSG)
+ return err;
+- }
+
+ if (type != ch->node_type) {
+ ubifs_err("bad node type (%d but expected %d)",
+@@ -837,11 +1034,11 @@ int ubifs_wbuf_init(struct ubifs_info *c, struct ubifs_wbuf *wbuf)
+ {
+ size_t size;
+
+- wbuf->buf = kmalloc(c->min_io_size, GFP_KERNEL);
++ wbuf->buf = kmalloc(c->max_write_size, GFP_KERNEL);
+ if (!wbuf->buf)
+ return -ENOMEM;
+
+- size = (c->min_io_size / UBIFS_CH_SZ + 1) * sizeof(ino_t);
++ size = (c->max_write_size / UBIFS_CH_SZ + 1) * sizeof(ino_t);
+ wbuf->inodes = kmalloc(size, GFP_KERNEL);
+ if (!wbuf->inodes) {
+ kfree(wbuf->buf);
+@@ -851,7 +1048,14 @@ int ubifs_wbuf_init(struct ubifs_info *c, struct ubifs_wbuf *wbuf)
+
+ wbuf->used = 0;
+ wbuf->lnum = wbuf->offs = -1;
+- wbuf->avail = c->min_io_size;
++ /*
++ * If the LEB starts at the max. write size aligned address, then
++ * write-buffer size has to be set to @c->max_write_size. Otherwise,
++ * set it to something smaller so that it ends at the closest max.
++ * write size boundary.
++ */
++ size = c->max_write_size - (c->leb_start % c->max_write_size);
++ wbuf->avail = wbuf->size = size;
+ wbuf->dtype = UBI_UNKNOWN;
+ wbuf->sync_callback = NULL;
+ mutex_init(&wbuf->io_mutex);
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index 914f1bd..2f438ab 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -141,14 +141,8 @@ again:
+ * LEB with some empty space.
+ */
+ lnum = ubifs_find_free_space(c, len, &offs, squeeze);
+- if (lnum >= 0) {
+- /* Found an LEB, add it to the journal head */
+- err = ubifs_add_bud_to_log(c, jhead, lnum, offs);
+- if (err)
+- goto out_return;
+- /* A new bud was successfully allocated and added to the log */
++ if (lnum >= 0)
+ goto out;
+- }
+
+ err = lnum;
+ if (err != -ENOSPC)
+@@ -203,12 +197,23 @@ again:
+ return 0;
+ }
+
+- err = ubifs_add_bud_to_log(c, jhead, lnum, 0);
+- if (err)
+- goto out_return;
+ offs = 0;
+
+ out:
++ /*
++ * Make sure we synchronize the write-buffer before we add the new bud
++ * to the log. Otherwise we may have a power cut after the log
++ * reference node for the last bud (@lnum) is written but before the
++ * write-buffer data are written to the next-to-last bud
++ * (@wbuf->lnum). And the effect would be that the recovery would see
++ * that there is corruption in the next-to-last bud.
++ */
++ err = ubifs_wbuf_sync_nolock(wbuf);
++ if (err)
++ goto out_return;
++ err = ubifs_add_bud_to_log(c, jhead, lnum, offs);
++ if (err)
++ goto out_return;
+ err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, wbuf->dtype);
+ if (err)
+ goto out_unlock;
+@@ -380,10 +385,8 @@ out:
+ if (err == -ENOSPC) {
+ /* This are some budgeting problems, print useful information */
+ down_write(&c->commit_sem);
+- spin_lock(&c->space_lock);
+ dbg_dump_stack();
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
++ dbg_dump_budg(c, &c->bi);
+ dbg_dump_lprops(c);
+ cmt_retries = dbg_check_lprops(c);
+ up_write(&c->commit_sem);
+@@ -666,6 +669,7 @@ out_free:
+
+ out_release:
+ release_head(c, BASEHD);
++ kfree(dent);
+ out_ro:
+ ubifs_ro_mode(c, err);
+ if (last_reference)
+@@ -690,17 +694,26 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
+ {
+ struct ubifs_data_node *data;
+ int err, lnum, offs, compr_type, out_len;
+- int dlen = UBIFS_DATA_NODE_SZ + UBIFS_BLOCK_SIZE * WORST_COMPR_FACTOR;
++ int dlen = COMPRESSED_DATA_NODE_BUF_SZ, allocated = 1;
+ struct ubifs_inode *ui = ubifs_inode(inode);
+
+- dbg_jnl("ino %lu, blk %u, len %d, key %s",
+- (unsigned long)key_inum(c, key), key_block(c, key), len,
+- DBGKEY(key));
++ dbg_jnlk(key, "ino %lu, blk %u, len %d, key ",
++ (unsigned long)key_inum(c, key), key_block(c, key), len);
+ ubifs_assert(len <= UBIFS_BLOCK_SIZE);
+
+- data = kmalloc(dlen, GFP_NOFS);
+- if (!data)
+- return -ENOMEM;
++ data = kmalloc(dlen, GFP_NOFS | __GFP_NOWARN);
++ if (!data) {
++ /*
++ * Fall-back to the write reserve buffer. Note, we might be
++ * currently on the memory reclaim path, when the kernel is
++ * trying to free some memory by writing out dirty pages. The
++ * write reserve buffer helps us to guarantee that we are
++ * always able to write the data.
++ */
++ allocated = 0;
++ mutex_lock(&c->write_reserve_mutex);
++ data = c->write_reserve_buf;
++ }
+
+ data->ch.node_type = UBIFS_DATA_NODE;
+ key_write(c, key, &data->key);
+@@ -736,7 +749,10 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
+ goto out_ro;
+
+ finish_reservation(c);
+- kfree(data);
++ if (!allocated)
++ mutex_unlock(&c->write_reserve_mutex);
++ else
++ kfree(data);
+ return 0;
+
+ out_release:
+@@ -745,7 +761,10 @@ out_ro:
+ ubifs_ro_mode(c, err);
+ finish_reservation(c);
+ out_free:
+- kfree(data);
++ if (!allocated)
++ mutex_unlock(&c->write_reserve_mutex);
++ else
++ kfree(data);
+ return err;
+ }
+
+@@ -1157,7 +1176,7 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
+ dn = (void *)trun + UBIFS_TRUN_NODE_SZ;
+ blk = new_size >> UBIFS_BLOCK_SHIFT;
+ data_key_init(c, &key, inum, blk);
+- dbg_jnl("last block key %s", DBGKEY(&key));
++ dbg_jnlk(&key, "last block key ");
+ err = ubifs_tnc_lookup(c, &key, dn);
+ if (err == -ENOENT)
+ dlen = 0; /* Not found (so it is a hole) */
+diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
+index 4d0cb12..f9fd068 100644
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -100,20 +100,6 @@ struct ubifs_wbuf *ubifs_get_wbuf(struct ubifs_info *c, int lnum)
+ }
+
+ /**
+- * next_log_lnum - switch to the next log LEB.
+- * @c: UBIFS file-system description object
+- * @lnum: current log LEB
+- */
+-static inline int next_log_lnum(const struct ubifs_info *c, int lnum)
+-{
+- lnum += 1;
+- if (lnum > c->log_last)
+- lnum = UBIFS_LOG_LNUM;
+-
+- return lnum;
+-}
+-
+-/**
+ * empty_log_bytes - calculate amount of empty space in the log.
+ * @c: UBIFS file-system description object
+ */
+@@ -175,26 +161,6 @@ void ubifs_add_bud(struct ubifs_info *c, struct ubifs_bud *bud)
+ }
+
+ /**
+- * ubifs_create_buds_lists - create journal head buds lists for remount rw.
+- * @c: UBIFS file-system description object
+- */
+-void ubifs_create_buds_lists(struct ubifs_info *c)
+-{
+- struct rb_node *p;
+-
+- spin_lock(&c->buds_lock);
+- p = rb_first(&c->buds);
+- while (p) {
+- struct ubifs_bud *bud = rb_entry(p, struct ubifs_bud, rb);
+- struct ubifs_jhead *jhead = &c->jheads[bud->jhead];
+-
+- list_add_tail(&bud->list, &jhead->buds_list);
+- p = rb_next(p);
+- }
+- spin_unlock(&c->buds_lock);
+-}
+-
+-/**
+ * ubifs_add_bud_to_log - add a new bud to the log.
+ * @c: UBIFS file-system description object
+ * @jhead: journal head the bud belongs to
+@@ -277,7 +243,7 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
+ ref->jhead = cpu_to_le32(jhead);
+
+ if (c->lhead_offs > c->leb_size - c->ref_node_alsz) {
+- c->lhead_lnum = next_log_lnum(c, c->lhead_lnum);
++ c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+ c->lhead_offs = 0;
+ }
+
+@@ -296,7 +262,7 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
+ * an unclean reboot, because the target LEB might have been
+ * unmapped, but not yet physically erased.
+ */
+- err = ubi_leb_map(c->ubi, bud->lnum, UBI_SHORTTERM);
++ err = ubifs_leb_map(c, bud->lnum, UBI_SHORTTERM);
+ if (err)
+ goto out_unlock;
+ }
+@@ -317,8 +283,6 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
+ return 0;
+
+ out_unlock:
+- if (err != -EAGAIN)
+- ubifs_ro_mode(c, err);
+ mutex_unlock(&c->log_mutex);
+ kfree(ref);
+ kfree(bud);
+@@ -445,7 +409,7 @@ int ubifs_log_start_commit(struct ubifs_info *c, int *ltail_lnum)
+
+ /* Switch to the next log LEB */
+ if (c->lhead_offs) {
+- c->lhead_lnum = next_log_lnum(c, c->lhead_lnum);
++ c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+ c->lhead_offs = 0;
+ }
+
+@@ -466,7 +430,7 @@ int ubifs_log_start_commit(struct ubifs_info *c, int *ltail_lnum)
+
+ c->lhead_offs += len;
+ if (c->lhead_offs == c->leb_size) {
+- c->lhead_lnum = next_log_lnum(c, c->lhead_lnum);
++ c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+ c->lhead_offs = 0;
+ }
+
+@@ -553,7 +517,7 @@ int ubifs_log_post_commit(struct ubifs_info *c, int old_ltail_lnum)
+ }
+ mutex_lock(&c->log_mutex);
+ for (lnum = old_ltail_lnum; lnum != c->ltail_lnum;
+- lnum = next_log_lnum(c, lnum)) {
++ lnum = ubifs_next_log_lnum(c, lnum)) {
+ dbg_log("unmap log LEB %d", lnum);
+ err = ubifs_leb_unmap(c, lnum);
+ if (err)
+@@ -662,7 +626,7 @@ static int add_node(struct ubifs_info *c, void *buf, int *lnum, int *offs,
+ err = ubifs_leb_change(c, *lnum, buf, sz, UBI_SHORTTERM);
+ if (err)
+ return err;
+- *lnum = next_log_lnum(c, *lnum);
++ *lnum = ubifs_next_log_lnum(c, *lnum);
+ *offs = 0;
+ }
+ memcpy(buf + *offs, node, len);
+@@ -732,7 +696,7 @@ int ubifs_consolidate_log(struct ubifs_info *c)
+ ubifs_scan_destroy(sleb);
+ if (lnum == c->lhead_lnum)
+ break;
+- lnum = next_log_lnum(c, lnum);
++ lnum = ubifs_next_log_lnum(c, lnum);
+ }
+ if (offs) {
+ int sz = ALIGN(offs, c->min_io_size);
+@@ -752,7 +716,7 @@ int ubifs_consolidate_log(struct ubifs_info *c)
+ /* Unmap remaining LEBs */
+ lnum = write_lnum;
+ do {
+- lnum = next_log_lnum(c, lnum);
++ lnum = ubifs_next_log_lnum(c, lnum);
+ err = ubifs_leb_unmap(c, lnum);
+ if (err)
+ return err;
+@@ -786,7 +750,7 @@ static int dbg_check_bud_bytes(struct ubifs_info *c)
+ struct ubifs_bud *bud;
+ long long bud_bytes = 0;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ spin_lock(&c->buds_lock);
+diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
+index 4d4ca38..f8a181e 100644
+--- a/fs/ubifs/lprops.c
++++ b/fs/ubifs/lprops.c
+@@ -504,7 +504,7 @@ static int is_lprops_dirty(struct ubifs_info *c, struct ubifs_lprops *lprops)
+ pnode = (struct ubifs_pnode *)container_of(lprops - pos,
+ struct ubifs_pnode,
+ lprops[0]);
+- return !test_bit(COW_ZNODE, &pnode->flags) &&
++ return !test_bit(COW_CNODE, &pnode->flags) &&
+ test_bit(DIRTY_CNODE, &pnode->flags);
+ }
+
+@@ -860,7 +860,7 @@ int dbg_check_cats(struct ubifs_info *c)
+ struct list_head *pos;
+ int i, cat;
+
+- if (!(ubifs_chk_flags & (UBIFS_CHK_GEN | UBIFS_CHK_LPROPS)))
++ if (!dbg_is_chk_gen(c) && !dbg_is_chk_lprops(c))
+ return 0;
+
+ list_for_each_entry(lprops, &c->empty_list, list) {
+@@ -958,7 +958,7 @@ void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
+ {
+ int i = 0, j, err = 0;
+
+- if (!(ubifs_chk_flags & (UBIFS_CHK_GEN | UBIFS_CHK_LPROPS)))
++ if (!dbg_is_chk_gen(c) && !dbg_is_chk_lprops(c))
+ return;
+
+ for (i = 0; i < heap->cnt; i++) {
+@@ -1007,21 +1007,11 @@ out:
+ }
+
+ /**
+- * struct scan_check_data - data provided to scan callback function.
+- * @lst: LEB properties statistics
+- * @err: error code
+- */
+-struct scan_check_data {
+- struct ubifs_lp_stats lst;
+- int err;
+-};
+-
+-/**
+ * scan_check_cb - scan callback.
+ * @c: the UBIFS file-system description object
+ * @lp: LEB properties to scan
+ * @in_tree: whether the LEB properties are in main memory
+- * @data: information passed to and from the caller of the scan
++ * @lst: lprops statistics to update
+ *
+ * This function returns a code that indicates whether the scan should continue
+ * (%LPT_SCAN_CONTINUE), whether the LEB properties should be added to the tree
+@@ -1030,12 +1020,12 @@ struct scan_check_data {
+ */
+ static int scan_check_cb(struct ubifs_info *c,
+ const struct ubifs_lprops *lp, int in_tree,
+- struct scan_check_data *data)
++ struct ubifs_lp_stats *lst)
+ {
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
+- struct ubifs_lp_stats *lst = &data->lst;
+- int cat, lnum = lp->lnum, is_idx = 0, used = 0, free, dirty;
++ int cat, lnum = lp->lnum, is_idx = 0, used = 0, free, dirty, ret;
++ void *buf = NULL;
+
+ cat = lp->flags & LPROPS_CAT_MASK;
+ if (cat != LPROPS_UNCAT) {
+@@ -1043,7 +1033,7 @@ static int scan_check_cb(struct ubifs_info *c,
+ if (cat != (lp->flags & LPROPS_CAT_MASK)) {
+ ubifs_err("bad LEB category %d expected %d",
+ (lp->flags & LPROPS_CAT_MASK), cat);
+- goto out;
++ return -EINVAL;
+ }
+ }
+
+@@ -1077,7 +1067,7 @@ static int scan_check_cb(struct ubifs_info *c,
+ }
+ if (!found) {
+ ubifs_err("bad LPT list (category %d)", cat);
+- goto out;
++ return -EINVAL;
+ }
+ }
+ }
+@@ -1089,36 +1079,40 @@ static int scan_check_cb(struct ubifs_info *c,
+ if ((lp->hpos != -1 && heap->arr[lp->hpos]->lnum != lnum) ||
+ lp != heap->arr[lp->hpos]) {
+ ubifs_err("bad LPT heap (category %d)", cat);
+- goto out;
++ return -EINVAL;
+ }
+ }
+
+- sleb = ubifs_scan(c, lnum, 0, c->dbg->buf, 0);
+- if (IS_ERR(sleb)) {
+- /*
+- * After an unclean unmount, empty and freeable LEBs
+- * may contain garbage.
+- */
+- if (lp->free == c->leb_size) {
+- ubifs_err("scan errors were in empty LEB "
+- "- continuing checking");
+- lst->empty_lebs += 1;
+- lst->total_free += c->leb_size;
+- lst->total_dark += ubifs_calc_dark(c, c->leb_size);
+- return LPT_SCAN_CONTINUE;
+- }
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+
+- if (lp->free + lp->dirty == c->leb_size &&
+- !(lp->flags & LPROPS_INDEX)) {
+- ubifs_err("scan errors were in freeable LEB "
+- "- continuing checking");
+- lst->total_free += lp->free;
+- lst->total_dirty += lp->dirty;
+- lst->total_dark += ubifs_calc_dark(c, c->leb_size);
+- return LPT_SCAN_CONTINUE;
++ /*
++ * After an unclean unmount, empty and freeable LEBs
++ * may contain garbage - do not scan them.
++ */
++ if (lp->free == c->leb_size) {
++ lst->empty_lebs += 1;
++ lst->total_free += c->leb_size;
++ lst->total_dark += ubifs_calc_dark(c, c->leb_size);
++ return LPT_SCAN_CONTINUE;
++ }
++ if (lp->free + lp->dirty == c->leb_size &&
++ !(lp->flags & LPROPS_INDEX)) {
++ lst->total_free += lp->free;
++ lst->total_dirty += lp->dirty;
++ lst->total_dark += ubifs_calc_dark(c, c->leb_size);
++ return LPT_SCAN_CONTINUE;
++ }
++
++ sleb = ubifs_scan(c, lnum, 0, buf, 0);
++ if (IS_ERR(sleb)) {
++ ret = PTR_ERR(sleb);
++ if (ret == -EUCLEAN) {
++ dbg_dump_lprops(c);
++ dbg_dump_budg(c, &c->bi);
+ }
+- data->err = PTR_ERR(sleb);
+- return LPT_SCAN_STOP;
++ goto out;
+ }
+
+ is_idx = -1;
+@@ -1236,6 +1230,7 @@ static int scan_check_cb(struct ubifs_info *c,
+ }
+
+ ubifs_scan_destroy(sleb);
++ vfree(buf);
+ return LPT_SCAN_CONTINUE;
+
+ out_print:
+@@ -1245,9 +1240,10 @@ out_print:
+ dbg_dump_leb(c, lnum);
+ out_destroy:
+ ubifs_scan_destroy(sleb);
++ ret = -EINVAL;
+ out:
+- data->err = -EINVAL;
+- return LPT_SCAN_STOP;
++ vfree(buf);
++ return ret;
+ }
+
+ /**
+@@ -1264,10 +1260,9 @@ out:
+ int dbg_check_lprops(struct ubifs_info *c)
+ {
+ int i, err;
+- struct scan_check_data data;
+- struct ubifs_lp_stats *lst = &data.lst;
++ struct ubifs_lp_stats lst;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ /*
+@@ -1280,29 +1275,23 @@ int dbg_check_lprops(struct ubifs_info *c)
+ return err;
+ }
+
+- memset(lst, 0, sizeof(struct ubifs_lp_stats));
+-
+- data.err = 0;
++ memset(&lst, 0, sizeof(struct ubifs_lp_stats));
+ err = ubifs_lpt_scan_nolock(c, c->main_first, c->leb_cnt - 1,
+ (ubifs_lpt_scan_callback)scan_check_cb,
+- &data);
++ &lst);
+ if (err && err != -ENOSPC)
+ goto out;
+- if (data.err) {
+- err = data.err;
+- goto out;
+- }
+
+- if (lst->empty_lebs != c->lst.empty_lebs ||
+- lst->idx_lebs != c->lst.idx_lebs ||
+- lst->total_free != c->lst.total_free ||
+- lst->total_dirty != c->lst.total_dirty ||
+- lst->total_used != c->lst.total_used) {
++ if (lst.empty_lebs != c->lst.empty_lebs ||
++ lst.idx_lebs != c->lst.idx_lebs ||
++ lst.total_free != c->lst.total_free ||
++ lst.total_dirty != c->lst.total_dirty ||
++ lst.total_used != c->lst.total_used) {
+ ubifs_err("bad overall accounting");
+ ubifs_err("calculated: empty_lebs %d, idx_lebs %d, "
+ "total_free %lld, total_dirty %lld, total_used %lld",
+- lst->empty_lebs, lst->idx_lebs, lst->total_free,
+- lst->total_dirty, lst->total_used);
++ lst.empty_lebs, lst.idx_lebs, lst.total_free,
++ lst.total_dirty, lst.total_used);
+ ubifs_err("read from lprops: empty_lebs %d, idx_lebs %d, "
+ "total_free %lld, total_dirty %lld, total_used %lld",
+ c->lst.empty_lebs, c->lst.idx_lebs, c->lst.total_free,
+@@ -1311,11 +1300,11 @@ int dbg_check_lprops(struct ubifs_info *c)
+ goto out;
+ }
+
+- if (lst->total_dead != c->lst.total_dead ||
+- lst->total_dark != c->lst.total_dark) {
++ if (lst.total_dead != c->lst.total_dead ||
++ lst.total_dark != c->lst.total_dark) {
+ ubifs_err("bad dead/dark space accounting");
+ ubifs_err("calculated: total_dead %lld, total_dark %lld",
+- lst->total_dead, lst->total_dark);
++ lst.total_dead, lst.total_dark);
+ ubifs_err("read from lprops: total_dead %lld, total_dark %lld",
+ c->lst.total_dead, c->lst.total_dark);
+ err = -EINVAL;
+diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
+index 72775d3..66d59d0 100644
+--- a/fs/ubifs/lpt.c
++++ b/fs/ubifs/lpt.c
+@@ -701,8 +701,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ alen = ALIGN(len, c->min_io_size);
+ set_ltab(c, lnum, c->leb_size - alen, alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen,
+- UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen,
++ UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -732,8 +732,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ set_ltab(c, lnum, c->leb_size - alen,
+ alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen,
+- UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen,
++ UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -780,8 +780,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ alen = ALIGN(len, c->min_io_size);
+ set_ltab(c, lnum, c->leb_size - alen, alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen,
+- UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen,
++ UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -806,7 +806,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ alen = ALIGN(len, c->min_io_size);
+ set_ltab(c, lnum, c->leb_size - alen, alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen, UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -826,7 +826,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+
+ /* Write remaining buffer */
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum, buf, alen, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum, buf, alen, UBI_SHORTTERM);
+ if (err)
+ goto out;
+
+@@ -1222,7 +1222,7 @@ int ubifs_read_nnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ if (c->big_lpt)
+ nnode->num = calc_nnode_num_from_parent(c, parent, iip);
+ } else {
+- err = ubi_read(c->ubi, lnum, buf, offs, c->nnode_sz);
++ err = ubifs_leb_read(c, lnum, buf, offs, c->nnode_sz, 1);
+ if (err)
+ goto out;
+ err = ubifs_unpack_nnode(c, buf, nnode);
+@@ -1247,6 +1247,7 @@ int ubifs_read_nnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+
+ out:
+ ubifs_err("error %d reading nnode at %d:%d", err, lnum, offs);
++ dbg_dump_stack();
+ kfree(nnode);
+ return err;
+ }
+@@ -1270,10 +1271,9 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ lnum = branch->lnum;
+ offs = branch->offs;
+ pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_NOFS);
+- if (!pnode) {
+- err = -ENOMEM;
+- goto out;
+- }
++ if (!pnode)
++ return -ENOMEM;
++
+ if (lnum == 0) {
+ /*
+ * This pnode was not written which just means that the LEB
+@@ -1291,7 +1291,7 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ lprops->flags = ubifs_categorize_lprops(c, lprops);
+ }
+ } else {
+- err = ubi_read(c->ubi, lnum, buf, offs, c->pnode_sz);
++ err = ubifs_leb_read(c, lnum, buf, offs, c->pnode_sz, 1);
+ if (err)
+ goto out;
+ err = unpack_pnode(c, buf, pnode);
+@@ -1313,6 +1313,7 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ out:
+ ubifs_err("error %d reading pnode at %d:%d", err, lnum, offs);
+ dbg_dump_pnode(c, pnode, parent, iip);
++ dbg_dump_stack();
+ dbg_msg("calc num: %d", calc_pnode_num_from_parent(c, parent, iip));
+ kfree(pnode);
+ return err;
+@@ -1332,7 +1333,7 @@ static int read_ltab(struct ubifs_info *c)
+ buf = vmalloc(c->ltab_sz);
+ if (!buf)
+ return -ENOMEM;
+- err = ubi_read(c->ubi, c->ltab_lnum, buf, c->ltab_offs, c->ltab_sz);
++ err = ubifs_leb_read(c, c->ltab_lnum, buf, c->ltab_offs, c->ltab_sz, 1);
+ if (err)
+ goto out;
+ err = unpack_ltab(c, buf);
+@@ -1355,7 +1356,8 @@ static int read_lsave(struct ubifs_info *c)
+ buf = vmalloc(c->lsave_sz);
+ if (!buf)
+ return -ENOMEM;
+- err = ubi_read(c->ubi, c->lsave_lnum, buf, c->lsave_offs, c->lsave_sz);
++ err = ubifs_leb_read(c, c->lsave_lnum, buf, c->lsave_offs,
++ c->lsave_sz, 1);
+ if (err)
+ goto out;
+ err = unpack_lsave(c, buf);
+@@ -1815,8 +1817,8 @@ static struct ubifs_nnode *scan_get_nnode(struct ubifs_info *c,
+ if (c->big_lpt)
+ nnode->num = calc_nnode_num_from_parent(c, parent, iip);
+ } else {
+- err = ubi_read(c->ubi, branch->lnum, buf, branch->offs,
+- c->nnode_sz);
++ err = ubifs_leb_read(c, branch->lnum, buf, branch->offs,
++ c->nnode_sz, 1);
+ if (err)
+ return ERR_PTR(err);
+ err = ubifs_unpack_nnode(c, buf, nnode);
+@@ -1884,8 +1886,8 @@ static struct ubifs_pnode *scan_get_pnode(struct ubifs_info *c,
+ ubifs_assert(branch->lnum >= c->lpt_first &&
+ branch->lnum <= c->lpt_last);
+ ubifs_assert(branch->offs >= 0 && branch->offs < c->leb_size);
+- err = ubi_read(c->ubi, branch->lnum, buf, branch->offs,
+- c->pnode_sz);
++ err = ubifs_leb_read(c, branch->lnum, buf, branch->offs,
++ c->pnode_sz, 1);
+ if (err)
+ return ERR_PTR(err);
+ err = unpack_pnode(c, buf, pnode);
+@@ -1984,12 +1986,11 @@ again:
+
+ if (path[h].in_tree)
+ continue;
+- nnode = kmalloc(sz, GFP_NOFS);
++ nnode = kmemdup(&path[h].nnode, sz, GFP_NOFS);
+ if (!nnode) {
+ err = -ENOMEM;
+ goto out;
+ }
+- memcpy(nnode, &path[h].nnode, sz);
+ parent = nnode->parent;
+ parent->nbranch[nnode->iip].nnode = nnode;
+ path[h].ptr.nnode = nnode;
+@@ -2002,12 +2003,11 @@ again:
+ const size_t sz = sizeof(struct ubifs_pnode);
+ struct ubifs_nnode *parent;
+
+- pnode = kmalloc(sz, GFP_NOFS);
++ pnode = kmemdup(&path[h].pnode, sz, GFP_NOFS);
+ if (!pnode) {
+ err = -ENOMEM;
+ goto out;
+ }
+- memcpy(pnode, &path[h].pnode, sz);
+ parent = pnode->parent;
+ parent->nbranch[pnode->iip].pnode = pnode;
+ path[h].ptr.pnode = pnode;
+@@ -2225,7 +2225,7 @@ int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
+ struct ubifs_cnode *cn;
+ int num, iip = 0, err;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ while (cnode) {
+diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
+index 5c90dec..cddd6bd 100644
+--- a/fs/ubifs/lpt_commit.c
++++ b/fs/ubifs/lpt_commit.c
+@@ -27,8 +27,15 @@
+
+ #include <linux/crc16.h>
+ #include <linux/slab.h>
++#include <linux/random.h>
+ #include "ubifs.h"
+
++#ifdef CONFIG_UBIFS_FS_DEBUG
++static int dbg_populate_lsave(struct ubifs_info *c);
++#else
++#define dbg_populate_lsave(c) 0
++#endif
++
+ /**
+ * first_dirty_cnode - find first dirty cnode.
+ * @c: UBIFS file-system description object
+@@ -110,8 +117,8 @@ static int get_cnodes_to_commit(struct ubifs_info *c)
+ return 0;
+ cnt += 1;
+ while (1) {
+- ubifs_assert(!test_bit(COW_ZNODE, &cnode->flags));
+- __set_bit(COW_ZNODE, &cnode->flags);
++ ubifs_assert(!test_bit(COW_CNODE, &cnode->flags));
++ __set_bit(COW_CNODE, &cnode->flags);
+ cnext = next_dirty_cnode(cnode);
+ if (!cnext) {
+ cnode->cnext = c->lpt_cnext;
+@@ -459,7 +466,7 @@ static int write_cnodes(struct ubifs_info *c)
+ */
+ clear_bit(DIRTY_CNODE, &cnode->flags);
+ smp_mb__before_clear_bit();
+- clear_bit(COW_ZNODE, &cnode->flags);
++ clear_bit(COW_CNODE, &cnode->flags);
+ smp_mb__after_clear_bit();
+ offs += len;
+ dbg_chk_lpt_sz(c, 1, len);
+@@ -586,7 +593,7 @@ static struct ubifs_pnode *next_pnode_to_dirty(struct ubifs_info *c,
+ if (nnode->nbranch[iip].lnum)
+ break;
+ }
+- } while (iip >= UBIFS_LPT_FANOUT);
++ } while (iip >= UBIFS_LPT_FANOUT);
+
+ /* Go right */
+ nnode = ubifs_get_nnode(c, nnode, iip);
+@@ -815,6 +822,10 @@ static void populate_lsave(struct ubifs_info *c)
+ c->lpt_drty_flgs |= LSAVE_DIRTY;
+ ubifs_add_lpt_dirt(c, c->lsave_lnum, c->lsave_sz);
+ }
++
++ if (dbg_populate_lsave(c))
++ return;
++
+ list_for_each_entry(lprops, &c->empty_list, list) {
+ c->lsave[cnt++] = lprops->lnum;
+ if (cnt >= c->lsave_cnt)
+@@ -1150,11 +1161,11 @@ static int lpt_gc_lnum(struct ubifs_info *c, int lnum)
+ void *buf = c->lpt_buf;
+
+ dbg_lp("LEB %d", lnum);
+- err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
+- if (err) {
+- ubifs_err("cannot read LEB %d, error %d", lnum, err);
++
++ err = ubifs_leb_read(c, lnum, buf, 0, c->leb_size, 1);
++ if (err)
+ return err;
+- }
++
+ while (1) {
+ if (!is_a_node(c, buf, len)) {
+ int pad_len;
+@@ -1628,29 +1639,35 @@ static int dbg_check_ltab_lnum(struct ubifs_info *c, int lnum)
+ {
+ int err, len = c->leb_size, dirty = 0, node_type, node_num, node_len;
+ int ret;
+- void *buf = c->dbg->buf;
++ void *buf, *p;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+- dbg_lp("LEB %d", lnum);
+- err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
+- if (err) {
+- dbg_msg("ubi_read failed, LEB %d, error %d", lnum, err);
+- return err;
++ buf = p = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory for ltab checking");
++ return 0;
+ }
++
++ dbg_lp("LEB %d", lnum);
++
++ err = ubifs_leb_read(c, lnum, buf, 0, c->leb_size, 1);
++ if (err)
++ goto out;
++
+ while (1) {
+- if (!is_a_node(c, buf, len)) {
++ if (!is_a_node(c, p, len)) {
+ int i, pad_len;
+
+- pad_len = get_pad_len(c, buf, len);
++ pad_len = get_pad_len(c, p, len);
+ if (pad_len) {
+- buf += pad_len;
++ p += pad_len;
+ len -= pad_len;
+ dirty += pad_len;
+ continue;
+ }
+- if (!dbg_is_all_ff(buf, len)) {
++ if (!dbg_is_all_ff(p, len)) {
+ dbg_msg("invalid empty space in LEB %d at %d",
+ lnum, c->leb_size - len);
+ err = -EINVAL;
+@@ -1668,16 +1685,21 @@ static int dbg_check_ltab_lnum(struct ubifs_info *c, int lnum)
+ lnum, dirty, c->ltab[i].dirty);
+ err = -EINVAL;
+ }
+- return err;
++ goto out;
+ }
+- node_type = get_lpt_node_type(c, buf, &node_num);
++ node_type = get_lpt_node_type(c, p, &node_num);
+ node_len = get_lpt_node_len(c, node_type);
+ ret = dbg_is_node_dirty(c, node_type, lnum, c->leb_size - len);
+ if (ret == 1)
+ dirty += node_len;
+- buf += node_len;
++ p += node_len;
+ len -= node_len;
+ }
++
++ err = 0;
++out:
++ vfree(buf);
++ return err;
+ }
+
+ /**
+@@ -1690,7 +1712,7 @@ int dbg_check_ltab(struct ubifs_info *c)
+ {
+ int lnum, err, i, cnt;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ /* Bring the entire tree into memory */
+@@ -1733,7 +1755,7 @@ int dbg_chk_lpt_free_spc(struct ubifs_info *c)
+ long long free = 0;
+ int i;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ for (i = 0; i < c->lpt_lebs; i++) {
+@@ -1775,7 +1797,7 @@ int dbg_chk_lpt_sz(struct ubifs_info *c, int action, int len)
+ long long chk_lpt_sz, lpt_sz;
+ int err = 0;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ switch (action) {
+@@ -1870,25 +1892,30 @@ int dbg_chk_lpt_sz(struct ubifs_info *c, int action, int len)
+ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ {
+ int err, len = c->leb_size, node_type, node_num, node_len, offs;
+- void *buf = c->dbg->buf;
++ void *buf, *p;
+
+ printk(KERN_DEBUG "(pid %d) start dumping LEB %d\n",
+ current->pid, lnum);
+- err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
+- if (err) {
+- ubifs_err("cannot read LEB %d, error %d", lnum, err);
++ buf = p = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory to dump LPT");
+ return;
+ }
++
++ err = ubifs_leb_read(c, lnum, buf, 0, c->leb_size, 1);
++ if (err)
++ goto out;
++
+ while (1) {
+ offs = c->leb_size - len;
+- if (!is_a_node(c, buf, len)) {
++ if (!is_a_node(c, p, len)) {
+ int pad_len;
+
+- pad_len = get_pad_len(c, buf, len);
++ pad_len = get_pad_len(c, p, len);
+ if (pad_len) {
+ printk(KERN_DEBUG "LEB %d:%d, pad %d bytes\n",
+ lnum, offs, pad_len);
+- buf += pad_len;
++ p += pad_len;
+ len -= pad_len;
+ continue;
+ }
+@@ -1898,7 +1925,7 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ break;
+ }
+
+- node_type = get_lpt_node_type(c, buf, &node_num);
++ node_type = get_lpt_node_type(c, p, &node_num);
+ switch (node_type) {
+ case UBIFS_LPT_PNODE:
+ {
+@@ -1923,7 +1950,7 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ else
+ printk(KERN_DEBUG "LEB %d:%d, nnode, ",
+ lnum, offs);
+- err = ubifs_unpack_nnode(c, buf, &nnode);
++ err = ubifs_unpack_nnode(c, p, &nnode);
+ for (i = 0; i < UBIFS_LPT_FANOUT; i++) {
+ printk(KERN_CONT "%d:%d", nnode.nbranch[i].lnum,
+ nnode.nbranch[i].offs);
+@@ -1944,15 +1971,18 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ break;
+ default:
+ ubifs_err("LPT node type %d not recognized", node_type);
+- return;
++ goto out;
+ }
+
+- buf += node_len;
++ p += node_len;
+ len -= node_len;
+ }
+
+ printk(KERN_DEBUG "(pid %d) finish dumping LEB %d\n",
+ current->pid, lnum);
++out:
++ vfree(buf);
++ return;
+ }
+
+ /**
+@@ -1974,4 +2004,47 @@ void dbg_dump_lpt_lebs(const struct ubifs_info *c)
+ current->pid);
+ }
+
++/**
++ * dbg_populate_lsave - debugging version of 'populate_lsave()'
++ * @c: UBIFS file-system description object
++ *
++ * This is a debugging version for 'populate_lsave()' which populates lsave
++ * with random LEBs instead of useful LEBs, which is good for test coverage.
++ * Returns zero if lsave has not been populated (this debugging feature is
++ * disabled) an non-zero if lsave has been populated.
++ */
++static int dbg_populate_lsave(struct ubifs_info *c)
++{
++ struct ubifs_lprops *lprops;
++ struct ubifs_lpt_heap *heap;
++ int i;
++
++ if (!dbg_is_chk_gen(c))
++ return 0;
++ if (random32() & 3)
++ return 0;
++
++ for (i = 0; i < c->lsave_cnt; i++)
++ c->lsave[i] = c->main_first;
++
++ list_for_each_entry(lprops, &c->empty_list, list)
++ c->lsave[random32() % c->lsave_cnt] = lprops->lnum;
++ list_for_each_entry(lprops, &c->freeable_list, list)
++ c->lsave[random32() % c->lsave_cnt] = lprops->lnum;
++ list_for_each_entry(lprops, &c->frdi_idx_list, list)
++ c->lsave[random32() % c->lsave_cnt] = lprops->lnum;
++
++ heap = &c->lpt_heap[LPROPS_DIRTY_IDX - 1];
++ for (i = 0; i < heap->cnt; i++)
++ c->lsave[random32() % c->lsave_cnt] = heap->arr[i]->lnum;
++ heap = &c->lpt_heap[LPROPS_DIRTY - 1];
++ for (i = 0; i < heap->cnt; i++)
++ c->lsave[random32() % c->lsave_cnt] = heap->arr[i]->lnum;
++ heap = &c->lpt_heap[LPROPS_FREE - 1];
++ for (i = 0; i < heap->cnt; i++)
++ c->lsave[random32() % c->lsave_cnt] = heap->arr[i]->lnum;
++
++ return 1;
++}
++
+ #endif /* CONFIG_UBIFS_FS_DEBUG */
+diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
+index 21f47af..278c238 100644
+--- a/fs/ubifs/master.c
++++ b/fs/ubifs/master.c
+@@ -148,7 +148,7 @@ static int validate_master(const struct ubifs_info *c)
+ }
+
+ main_sz = (long long)c->main_lebs * c->leb_size;
+- if (c->old_idx_sz & 7 || c->old_idx_sz >= main_sz) {
++ if (c->bi.old_idx_sz & 7 || c->bi.old_idx_sz >= main_sz) {
+ err = 9;
+ goto out;
+ }
+@@ -218,7 +218,7 @@ static int validate_master(const struct ubifs_info *c)
+ }
+
+ if (c->lst.total_dead + c->lst.total_dark +
+- c->lst.total_used + c->old_idx_sz > main_sz) {
++ c->lst.total_used + c->bi.old_idx_sz > main_sz) {
+ err = 21;
+ goto out;
+ }
+@@ -286,7 +286,7 @@ int ubifs_read_master(struct ubifs_info *c)
+ c->gc_lnum = le32_to_cpu(c->mst_node->gc_lnum);
+ c->ihead_lnum = le32_to_cpu(c->mst_node->ihead_lnum);
+ c->ihead_offs = le32_to_cpu(c->mst_node->ihead_offs);
+- c->old_idx_sz = le64_to_cpu(c->mst_node->index_size);
++ c->bi.old_idx_sz = le64_to_cpu(c->mst_node->index_size);
+ c->lpt_lnum = le32_to_cpu(c->mst_node->lpt_lnum);
+ c->lpt_offs = le32_to_cpu(c->mst_node->lpt_offs);
+ c->nhead_lnum = le32_to_cpu(c->mst_node->nhead_lnum);
+@@ -305,7 +305,7 @@ int ubifs_read_master(struct ubifs_info *c)
+ c->lst.total_dead = le64_to_cpu(c->mst_node->total_dead);
+ c->lst.total_dark = le64_to_cpu(c->mst_node->total_dark);
+
+- c->calc_idx_sz = c->old_idx_sz;
++ c->calc_idx_sz = c->bi.old_idx_sz;
+
+ if (c->mst_node->flags & cpu_to_le32(UBIFS_MST_NO_ORPHS))
+ c->no_orphs = 1;
+diff --git a/fs/ubifs/misc.h b/fs/ubifs/misc.h
+index c3de04d..ee7cb5e 100644
+--- a/fs/ubifs/misc.h
++++ b/fs/ubifs/misc.h
+@@ -39,6 +39,29 @@ static inline int ubifs_zn_dirty(const struct ubifs_znode *znode)
+ }
+
+ /**
++ * ubifs_zn_obsolete - check if znode is obsolete.
++ * @znode: znode to check
++ *
++ * This helper function returns %1 if @znode is obsolete and %0 otherwise.
++ */
++static inline int ubifs_zn_obsolete(const struct ubifs_znode *znode)
++{
++ return !!test_bit(OBSOLETE_ZNODE, &znode->flags);
++}
++
++/**
++ * ubifs_zn_cow - check if znode has to be copied on write.
++ * @znode: znode to check
++ *
++ * This helper function returns %1 if @znode is has COW flag set and %0
++ * otherwise.
++ */
++static inline int ubifs_zn_cow(const struct ubifs_znode *znode)
++{
++ return !!test_bit(COW_ZNODE, &znode->flags);
++}
++
++/**
+ * ubifs_wake_up_bgt - wake up background thread.
+ * @c: UBIFS file-system description object
+ */
+@@ -122,86 +145,6 @@ static inline int ubifs_wbuf_sync(struct ubifs_wbuf *wbuf)
+ }
+
+ /**
+- * ubifs_leb_unmap - unmap an LEB.
+- * @c: UBIFS file-system description object
+- * @lnum: LEB number to unmap
+- *
+- * This function returns %0 on success and a negative error code on failure.
+- */
+-static inline int ubifs_leb_unmap(const struct ubifs_info *c, int lnum)
+-{
+- int err;
+-
+- ubifs_assert(!c->ro_media && !c->ro_mount);
+- if (c->ro_error)
+- return -EROFS;
+- err = ubi_leb_unmap(c->ubi, lnum);
+- if (err) {
+- ubifs_err("unmap LEB %d failed, error %d", lnum, err);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * ubifs_leb_write - write to a LEB.
+- * @c: UBIFS file-system description object
+- * @lnum: LEB number to write
+- * @buf: buffer to write from
+- * @offs: offset within LEB to write to
+- * @len: length to write
+- * @dtype: data type
+- *
+- * This function returns %0 on success and a negative error code on failure.
+- */
+-static inline int ubifs_leb_write(const struct ubifs_info *c, int lnum,
+- const void *buf, int offs, int len, int dtype)
+-{
+- int err;
+-
+- ubifs_assert(!c->ro_media && !c->ro_mount);
+- if (c->ro_error)
+- return -EROFS;
+- err = ubi_leb_write(c->ubi, lnum, buf, offs, len, dtype);
+- if (err) {
+- ubifs_err("writing %d bytes at %d:%d, error %d",
+- len, lnum, offs, err);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * ubifs_leb_change - atomic LEB change.
+- * @c: UBIFS file-system description object
+- * @lnum: LEB number to write
+- * @buf: buffer to write from
+- * @len: length to write
+- * @dtype: data type
+- *
+- * This function returns %0 on success and a negative error code on failure.
+- */
+-static inline int ubifs_leb_change(const struct ubifs_info *c, int lnum,
+- const void *buf, int len, int dtype)
+-{
+- int err;
+-
+- ubifs_assert(!c->ro_media && !c->ro_mount);
+- if (c->ro_error)
+- return -EROFS;
+- err = ubi_leb_change(c->ubi, lnum, buf, len, dtype);
+- if (err) {
+- ubifs_err("changing %d bytes in LEB %d, error %d",
+- len, lnum, err);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+-/**
+ * ubifs_encode_dev - encode device node IDs.
+ * @dev: UBIFS device node information
+ * @rdev: device IDs to encode
+@@ -340,4 +283,21 @@ static inline void ubifs_release_lprops(struct ubifs_info *c)
+ mutex_unlock(&c->lp_mutex);
+ }
+
++/**
++ * ubifs_next_log_lnum - switch to the next log LEB.
++ * @c: UBIFS file-system description object
++ * @lnum: current log LEB
++ *
++ * This helper function returns the log LEB number which goes next after LEB
++ * 'lnum'.
++ */
++static inline int ubifs_next_log_lnum(const struct ubifs_info *c, int lnum)
++{
++ lnum += 1;
++ if (lnum > c->log_last)
++ lnum = UBIFS_LOG_LNUM;
++
++ return lnum;
++}
++
+ #endif /* __UBIFS_MISC_H__ */
+diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
+index 82009c7..c542c73 100644
+--- a/fs/ubifs/orphan.c
++++ b/fs/ubifs/orphan.c
+@@ -673,7 +673,8 @@ static int kill_orphans(struct ubifs_info *c)
+ sleb = ubifs_scan(c, lnum, 0, c->sbuf, 1);
+ if (IS_ERR(sleb)) {
+ if (PTR_ERR(sleb) == -EUCLEAN)
+- sleb = ubifs_recover_leb(c, lnum, 0, c->sbuf, 0);
++ sleb = ubifs_recover_leb(c, lnum, 0,
++ c->sbuf, -1);
+ if (IS_ERR(sleb)) {
+ err = PTR_ERR(sleb);
+ break;
+@@ -892,15 +893,22 @@ static int dbg_read_orphans(struct check_info *ci, struct ubifs_scan_leb *sleb)
+ static int dbg_scan_orphans(struct ubifs_info *c, struct check_info *ci)
+ {
+ int lnum, err = 0;
++ void *buf;
+
+ /* Check no-orphans flag and skip this if no orphans */
+ if (c->no_orphs)
+ return 0;
+
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory to check orphans");
++ return 0;
++ }
++
+ for (lnum = c->orph_first; lnum <= c->orph_last; lnum++) {
+ struct ubifs_scan_leb *sleb;
+
+- sleb = ubifs_scan(c, lnum, 0, c->dbg->buf, 0);
++ sleb = ubifs_scan(c, lnum, 0, buf, 0);
+ if (IS_ERR(sleb)) {
+ err = PTR_ERR(sleb);
+ break;
+@@ -912,6 +920,7 @@ static int dbg_scan_orphans(struct ubifs_info *c, struct check_info *ci)
+ break;
+ }
+
++ vfree(buf);
+ return err;
+ }
+
+@@ -920,7 +929,7 @@ static int dbg_check_orphans(struct ubifs_info *c)
+ struct check_info ci;
+ int err;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_ORPH))
++ if (!dbg_is_chk_orph(c))
+ return 0;
+
+ ci.last_ino = 0;
+diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
+index 77e9b87..2a935b3 100644
+--- a/fs/ubifs/recovery.c
++++ b/fs/ubifs/recovery.c
+@@ -28,6 +28,23 @@
+ * UBIFS always cleans away all remnants of an unclean un-mount, so that
+ * errors do not accumulate. However UBIFS defers recovery if it is mounted
+ * read-only, and the flash is not modified in that case.
++ *
++ * The general UBIFS approach to the recovery is that it recovers from
++ * corruptions which could be caused by power cuts, but it refuses to recover
++ * from corruption caused by other reasons. And UBIFS tries to distinguish
++ * between these 2 reasons of corruptions and silently recover in the former
++ * case and loudly complain in the latter case.
++ *
++ * UBIFS writes only to erased LEBs, so it writes only to the flash space
++ * containing only 0xFFs. UBIFS also always writes strictly from the beginning
++ * of the LEB to the end. And UBIFS assumes that the underlying flash media
++ * writes in @c->max_write_size bytes at a time.
++ *
++ * Hence, if UBIFS finds a corrupted node at offset X, it expects only the min.
++ * I/O unit corresponding to offset X to contain corrupted data, all the
++ * following min. I/O units have to contain empty space (all 0xFFs). If this is
++ * not true, the corruption cannot be the result of a power cut, and UBIFS
++ * refuses to mount.
+ */
+
+ #include <linux/crc32.h>
+@@ -100,7 +117,7 @@ static int get_master_node(const struct ubifs_info *c, int lnum, void **pbuf,
+ if (!sbuf)
+ return -ENOMEM;
+
+- err = ubi_read(c->ubi, lnum, sbuf, 0, c->leb_size);
++ err = ubifs_leb_read(c, lnum, sbuf, 0, c->leb_size, 0);
+ if (err && err != -EBADMSG)
+ goto out_free;
+
+@@ -196,10 +213,10 @@ static int write_rcvrd_mst_node(struct ubifs_info *c,
+ mst->flags |= cpu_to_le32(UBIFS_MST_RCVRY);
+
+ ubifs_prepare_node(c, mst, UBIFS_MST_NODE_SZ, 1);
+- err = ubi_leb_change(c->ubi, lnum, mst, sz, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum, mst, sz, UBI_SHORTTERM);
+ if (err)
+ goto out;
+- err = ubi_leb_change(c->ubi, lnum + 1, mst, sz, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum + 1, mst, sz, UBI_SHORTTERM);
+ if (err)
+ goto out;
+ out:
+@@ -257,7 +274,8 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ if (cor1)
+ goto out_err;
+ mst = mst1;
+- } else if (offs1 == 0 && offs2 + sz >= c->leb_size) {
++ } else if (offs1 == 0 &&
++ c->leb_size - offs2 - sz < sz) {
+ /* 1st LEB was unmapped and written, 2nd not */
+ if (cor1)
+ goto out_err;
+@@ -300,6 +318,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ goto out_free;
+ }
+ memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
++
++ /*
++ * We had to recover the master node, which means there was an
++ * unclean reboot. However, it is possible that the master node
++ * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
++ * E.g., consider the following chain of events:
++ *
++ * 1. UBIFS was cleanly unmounted, so the master node is clean
++ * 2. UBIFS is being mounted R/W and starts changing the master
++ * node in the first (%UBIFS_MST_LNUM). A power cut happens,
++ * so this LEB ends up with some amount of garbage at the
++ * end.
++ * 3. UBIFS is being mounted R/O. We reach this place and
++ * recover the master node from the second LEB
++ * (%UBIFS_MST_LNUM + 1). But we cannot update the media
++ * because we are being mounted R/O. We have to defer the
++ * operation.
++ * 4. However, this master node (@c->mst_node) is marked as
++ * clean (since the step 1). And if we just return, the
++ * mount code will be confused and won't recover the master
++ * node when it is re-mounter R/W later.
++ *
++ * Thus, to force the recovery by marking the master node as
++ * dirty.
++ */
++ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ } else {
+ /* Write the recovered master node */
+ c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
+@@ -362,8 +406,9 @@ int ubifs_write_rcvrd_mst_node(struct ubifs_info *c)
+ * @offs: offset to check
+ *
+ * This function returns %1 if @offs was in the last write to the LEB whose data
+- * is in @buf, otherwise %0 is returned. The determination is made by checking
+- * for subsequent empty space starting from the next @c->min_io_size boundary.
++ * is in @buf, otherwise %0 is returned. The determination is made by checking
++ * for subsequent empty space starting from the next @c->max_write_size
++ * boundary.
+ */
+ static int is_last_write(const struct ubifs_info *c, void *buf, int offs)
+ {
+@@ -371,10 +416,10 @@ static int is_last_write(const struct ubifs_info *c, void *buf, int offs)
+ uint8_t *p;
+
+ /*
+- * Round up to the next @c->min_io_size boundary i.e. @offs is in the
+- * last wbuf written. After that should be empty space.
++ * Round up to the next @c->max_write_size boundary i.e. @offs is in
++ * the last wbuf written. After that should be empty space.
+ */
+- empty_offs = ALIGN(offs + 1, c->min_io_size);
++ empty_offs = ALIGN(offs + 1, c->max_write_size);
+ check_len = c->leb_size - empty_offs;
+ p = buf + empty_offs - offs;
+ return is_empty(p, check_len);
+@@ -429,7 +474,7 @@ static int no_more_nodes(const struct ubifs_info *c, void *buf, int len,
+ int skip, dlen = le32_to_cpu(ch->len);
+
+ /* Check for empty space after the corrupt node's common header */
+- skip = ALIGN(offs + UBIFS_CH_SZ, c->min_io_size) - offs;
++ skip = ALIGN(offs + UBIFS_CH_SZ, c->max_write_size) - offs;
+ if (is_empty(buf + skip, len - skip))
+ return 1;
+ /*
+@@ -441,7 +486,7 @@ static int no_more_nodes(const struct ubifs_info *c, void *buf, int len,
+ return 0;
+ }
+ /* Now we know the corrupt node's length we can skip over it */
+- skip = ALIGN(offs + dlen, c->min_io_size) - offs;
++ skip = ALIGN(offs + dlen, c->max_write_size) - offs;
+ /* After which there should be empty space */
+ if (is_empty(buf + skip, len - skip))
+ return 1;
+@@ -495,8 +540,8 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ int len = ALIGN(endpt, c->min_io_size);
+
+ if (start) {
+- err = ubi_read(c->ubi, lnum, sleb->buf, 0,
+- start);
++ err = ubifs_leb_read(c, lnum, sleb->buf, 0,
++ start, 1);
+ if (err)
+ return err;
+ }
+@@ -510,8 +555,8 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ ubifs_pad(c, buf, pad_len);
+ }
+ }
+- err = ubi_leb_change(c->ubi, lnum, sleb->buf, len,
+- UBI_UNKNOWN);
++ err = ubifs_leb_change(c, lnum, sleb->buf, len,
++ UBI_UNKNOWN);
+ if (err)
+ return err;
+ }
+@@ -520,16 +565,15 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ }
+
+ /**
+- * drop_incomplete_group - drop nodes from an incomplete group.
++ * drop_last_group - drop the last group of nodes.
+ * @sleb: scanned LEB information
+ * @offs: offset of dropped nodes is returned here
+ *
+- * This function returns %1 if nodes are dropped and %0 otherwise.
++ * This is a helper function for 'ubifs_recover_leb()' which drops the last
++ * group of nodes of the scanned LEB.
+ */
+-static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
++static void drop_last_group(struct ubifs_scan_leb *sleb, int *offs)
+ {
+- int dropped = 0;
+-
+ while (!list_empty(&sleb->nodes)) {
+ struct ubifs_scan_node *snod;
+ struct ubifs_ch *ch;
+@@ -538,15 +582,40 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
+ list);
+ ch = snod->node;
+ if (ch->group_type != UBIFS_IN_NODE_GROUP)
+- return dropped;
+- dbg_rcvry("dropping node at %d:%d", sleb->lnum, snod->offs);
++ break;
++
++ dbg_rcvry("dropping grouped node at %d:%d",
++ sleb->lnum, snod->offs);
++ *offs = snod->offs;
++ list_del(&snod->list);
++ kfree(snod);
++ sleb->nodes_cnt -= 1;
++ }
++}
++
++/**
++ * drop_last_node - drop the last node.
++ * @sleb: scanned LEB information
++ * @offs: offset of dropped nodes is returned here
++ * @grouped: non-zero if whole group of nodes have to be dropped
++ *
++ * This is a helper function for 'ubifs_recover_leb()' which drops the last
++ * node of the scanned LEB.
++ */
++static void drop_last_node(struct ubifs_scan_leb *sleb, int *offs)
++{
++ struct ubifs_scan_node *snod;
++
++ if (!list_empty(&sleb->nodes)) {
++ snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node,
++ list);
++
++ dbg_rcvry("dropping last node at %d:%d", sleb->lnum, snod->offs);
+ *offs = snod->offs;
+ list_del(&snod->list);
+ kfree(snod);
+ sleb->nodes_cnt -= 1;
+- dropped = 1;
+ }
+- return dropped;
+ }
+
+ /**
+@@ -555,7 +624,8 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
+ * @lnum: LEB number
+ * @offs: offset
+ * @sbuf: LEB-sized buffer to use
+- * @grouped: nodes may be grouped for recovery
++ * @jhead: journal head number this LEB belongs to (%-1 if the LEB does not
++ * belong to any journal head)
+ *
+ * This function does a scan of a LEB, but caters for errors that might have
+ * been caused by the unclean unmount from which we are attempting to recover.
+@@ -563,25 +633,21 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
+ * found, and a negative error code in case of failure.
+ */
+ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+- int offs, void *sbuf, int grouped)
++ int offs, void *sbuf, int jhead)
+ {
+- int err, len = c->leb_size - offs, need_clean = 0, quiet = 1;
+- int empty_chkd = 0, start = offs;
++ int ret = 0, err, len = c->leb_size - offs, start = offs, min_io_unit;
++ int grouped = jhead == -1 ? 0 : c->jheads[jhead].grouped;
+ struct ubifs_scan_leb *sleb;
+ void *buf = sbuf + offs;
+
+- dbg_rcvry("%d:%d", lnum, offs);
++ dbg_rcvry("%d:%d, jhead %d, grouped %d", lnum, offs, jhead, grouped);
+
+ sleb = ubifs_start_scan(c, lnum, offs, sbuf);
+ if (IS_ERR(sleb))
+ return sleb;
+
+- if (sleb->ecc)
+- need_clean = 1;
+-
++ ubifs_assert(len >= 8);
+ while (len >= 8) {
+- int ret;
+-
+ dbg_scan("look at LEB %d:%d (%d bytes left)",
+ lnum, offs, len);
+
+@@ -591,8 +657,7 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+ * Scan quietly until there is an error from which we cannot
+ * recover
+ */
+- ret = ubifs_scan_a_node(c, buf, len, lnum, offs, quiet);
+-
++ ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
+ if (ret == SCANNED_A_NODE) {
+ /* A valid node, and not a padding node */
+ struct ubifs_ch *ch = buf;
+@@ -605,104 +670,127 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+ offs += node_len;
+ buf += node_len;
+ len -= node_len;
+- continue;
+- }
+-
+- if (ret > 0) {
++ } else if (ret > 0) {
+ /* Padding bytes or a valid padding node */
+ offs += ret;
+ buf += ret;
+ len -= ret;
+- continue;
+- }
+-
+- if (ret == SCANNED_EMPTY_SPACE) {
+- if (!is_empty(buf, len)) {
+- if (!is_last_write(c, buf, offs))
+- break;
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- }
+- empty_chkd = 1;
++ } else if (ret == SCANNED_EMPTY_SPACE ||
++ ret == SCANNED_GARBAGE ||
++ ret == SCANNED_A_BAD_PAD_NODE ||
++ ret == SCANNED_A_CORRUPT_NODE) {
++ dbg_rcvry("found corruption (%d) at %d:%d",
++ ret, lnum, offs);
+ break;
+- }
+-
+- if (ret == SCANNED_GARBAGE || ret == SCANNED_A_BAD_PAD_NODE)
+- if (is_last_write(c, buf, offs)) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- empty_chkd = 1;
+- break;
+- }
+-
+- if (ret == SCANNED_A_CORRUPT_NODE)
+- if (no_more_nodes(c, buf, len, lnum, offs)) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- empty_chkd = 1;
+- break;
+- }
+-
+- if (quiet) {
+- /* Redo the last scan but noisily */
+- quiet = 0;
+- continue;
+- }
+-
+- switch (ret) {
+- case SCANNED_GARBAGE:
+- dbg_err("garbage");
+- goto corrupted;
+- case SCANNED_A_CORRUPT_NODE:
+- case SCANNED_A_BAD_PAD_NODE:
+- dbg_err("bad node");
+- goto corrupted;
+- default:
+- dbg_err("unknown");
++ } else {
++ dbg_err("unexpected return value %d", ret);
+ err = -EINVAL;
+ goto error;
+ }
+ }
+
+- if (!empty_chkd && !is_empty(buf, len)) {
+- if (is_last_write(c, buf, offs)) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- } else {
++ if (ret == SCANNED_GARBAGE || ret == SCANNED_A_BAD_PAD_NODE) {
++ if (!is_last_write(c, buf, offs))
++ goto corrupted_rescan;
++ } else if (ret == SCANNED_A_CORRUPT_NODE) {
++ if (!no_more_nodes(c, buf, len, lnum, offs))
++ goto corrupted_rescan;
++ } else if (!is_empty(buf, len)) {
++ if (!is_last_write(c, buf, offs)) {
+ int corruption = first_non_ff(buf, len);
+
++ /*
++ * See header comment for this file for more
++ * explanations about the reasons we have this check.
++ */
+ ubifs_err("corrupt empty space LEB %d:%d, corruption "
+ "starts at %d", lnum, offs, corruption);
+ /* Make sure we dump interesting non-0xFF data */
+- offs = corruption;
++ offs += corruption;
+ buf += corruption;
+ goto corrupted;
+ }
+ }
+
+- /* Drop nodes from incomplete group */
+- if (grouped && drop_incomplete_group(sleb, &offs)) {
+- buf = sbuf + offs;
+- len = c->leb_size - offs;
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- }
++ min_io_unit = round_down(offs, c->min_io_size);
++ if (grouped)
++ /*
++ * If nodes are grouped, always drop the incomplete group at
++ * the end.
++ */
++ drop_last_group(sleb, &offs);
+
+- if (offs % c->min_io_size) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
++ if (jhead == GCHD) {
++ /*
++ * If this LEB belongs to the GC head then while we are in the
++ * middle of the same min. I/O unit keep dropping nodes. So
++ * basically, what we want is to make sure that the last min.
++ * I/O unit where we saw the corruption is dropped completely
++ * with all the uncorrupted nodes which may possibly sit there.
++ *
++ * In other words, let's name the min. I/O unit where the
++ * corruption starts B, and the previous min. I/O unit A. The
++ * below code tries to deal with a situation when half of B
++ * contains valid nodes or the end of a valid node, and the
++ * second half of B contains corrupted data or garbage. This
++ * means that UBIFS had been writing to B just before the power
++ * cut happened. I do not know how realistic is this scenario
++ * that half of the min. I/O unit had been written successfully
++ * and the other half not, but this is possible in our 'failure
++ * mode emulation' infrastructure at least.
++ *
++ * So what is the problem, why we need to drop those nodes? Why
++ * can't we just clean-up the second half of B by putting a
++ * padding node there? We can, and this works fine with one
++ * exception which was reproduced with power cut emulation
++ * testing and happens extremely rarely.
++ *
++ * Imagine the file-system is full, we run GC which starts
++ * moving valid nodes from LEB X to LEB Y (obviously, LEB Y is
++ * the current GC head LEB). The @c->gc_lnum is -1, which means
++ * that GC will retain LEB X and will try to continue. Imagine
++ * that LEB X is currently the dirtiest LEB, and the amount of
++ * used space in LEB Y is exactly the same as amount of free
++ * space in LEB X.
++ *
++ * And a power cut happens when nodes are moved from LEB X to
++ * LEB Y. We are here trying to recover LEB Y which is the GC
++ * head LEB. We find the min. I/O unit B as described above.
++ * Then we clean-up LEB Y by padding min. I/O unit. And later
++ * 'ubifs_rcvry_gc_commit()' function fails, because it cannot
++ * find a dirty LEB which could be GC'd into LEB Y! Even LEB X
++ * does not match because the amount of valid nodes there does
++ * not fit the free space in LEB Y any more! And this is
++ * because of the padding node which we added to LEB Y. The
++ * user-visible effect of this which I once observed and
++ * analysed is that we cannot mount the file-system with
++ * -ENOSPC error.
++ *
++ * So obviously, to make sure that situation does not happen we
++ * should free min. I/O unit B in LEB Y completely and the last
++ * used min. I/O unit in LEB Y should be A. This is basically
++ * what the below code tries to do.
++ */
++ while (offs > min_io_unit)
++ drop_last_node(sleb, &offs);
+ }
+
++ buf = sbuf + offs;
++ len = c->leb_size - offs;
++
++ clean_buf(c, &buf, lnum, &offs, &len);
+ ubifs_end_scan(c, sleb, lnum, offs);
+
+- if (need_clean) {
+- err = fix_unclean_leb(c, sleb, start);
+- if (err)
+- goto error;
+- }
++ err = fix_unclean_leb(c, sleb, start);
++ if (err)
++ goto error;
+
+ return sleb;
+
++corrupted_rescan:
++ /* Re-scan the corrupted data with verbose messages */
++ dbg_err("corruptio %d", ret);
++ ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
+ corrupted:
+ ubifs_scanned_corruption(c, lnum, offs, buf);
+ err = -EUCLEAN;
+@@ -733,7 +821,8 @@ static int get_cs_sqnum(struct ubifs_info *c, int lnum, int offs,
+ return -ENOMEM;
+ if (c->leb_size - offs < UBIFS_CS_NODE_SZ)
+ goto out_err;
+- err = ubi_read(c->ubi, lnum, (void *)cs_node, offs, UBIFS_CS_NODE_SZ);
++ err = ubifs_leb_read(c, lnum, (void *)cs_node, offs,
++ UBIFS_CS_NODE_SZ, 0);
+ if (err && err != -EBADMSG)
+ goto out_free;
+ ret = ubifs_scan_a_node(c, cs_node, UBIFS_CS_NODE_SZ, lnum, offs, 0);
+@@ -819,7 +908,7 @@ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
+ }
+ ubifs_scan_destroy(sleb);
+ }
+- return ubifs_recover_leb(c, lnum, offs, sbuf, 0);
++ return ubifs_recover_leb(c, lnum, offs, sbuf, -1);
+ }
+
+ /**
+@@ -833,15 +922,10 @@ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-static int recover_head(const struct ubifs_info *c, int lnum, int offs,
+- void *sbuf)
++static int recover_head(struct ubifs_info *c, int lnum, int offs, void *sbuf)
+ {
+- int len, err;
++ int len = c->max_write_size, err;
+
+- if (c->min_io_size > 1)
+- len = c->min_io_size;
+- else
+- len = 512;
+ if (offs + len > c->leb_size)
+ len = c->leb_size - offs;
+
+@@ -849,15 +933,15 @@ static int recover_head(const struct ubifs_info *c, int lnum, int offs,
+ return 0;
+
+ /* Read at the head location and check it is empty flash */
+- err = ubi_read(c->ubi, lnum, sbuf, offs, len);
++ err = ubifs_leb_read(c, lnum, sbuf, offs, len, 1);
+ if (err || !is_empty(sbuf, len)) {
+ dbg_rcvry("cleaning head at %d:%d", lnum, offs);
+ if (offs == 0)
+ return ubifs_leb_unmap(c, lnum);
+- err = ubi_read(c->ubi, lnum, sbuf, 0, offs);
++ err = ubifs_leb_read(c, lnum, sbuf, 0, offs, 1);
+ if (err)
+ return err;
+- return ubi_leb_change(c->ubi, lnum, sbuf, offs, UBI_UNKNOWN);
++ return ubifs_leb_change(c, lnum, sbuf, offs, UBI_UNKNOWN);
+ }
+
+ return 0;
+@@ -880,7 +964,7 @@ static int recover_head(const struct ubifs_info *c, int lnum, int offs,
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf)
++int ubifs_recover_inl_heads(struct ubifs_info *c, void *sbuf)
+ {
+ int err;
+
+@@ -900,7 +984,7 @@ int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf)
+ }
+
+ /**
+- * clean_an_unclean_leb - read and write a LEB to remove corruption.
++ * clean_an_unclean_leb - read and write a LEB to remove corruption.
+ * @c: UBIFS file-system description object
+ * @ucleb: unclean LEB information
+ * @sbuf: LEB-sized buffer to use
+@@ -911,7 +995,7 @@ int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf)
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-static int clean_an_unclean_leb(const struct ubifs_info *c,
++static int clean_an_unclean_leb(struct ubifs_info *c,
+ struct ubifs_unclean_leb *ucleb, void *sbuf)
+ {
+ int err, lnum = ucleb->lnum, offs = 0, len = ucleb->endpt, quiet = 1;
+@@ -927,7 +1011,7 @@ static int clean_an_unclean_leb(const struct ubifs_info *c,
+ return 0;
+ }
+
+- err = ubi_read(c->ubi, lnum, buf, offs, len);
++ err = ubifs_leb_read(c, lnum, buf, offs, len, 0);
+ if (err && err != -EBADMSG)
+ return err;
+
+@@ -987,7 +1071,7 @@ static int clean_an_unclean_leb(const struct ubifs_info *c,
+ }
+
+ /* Write back the LEB atomically */
+- err = ubi_leb_change(c->ubi, lnum, sbuf, len, UBI_UNKNOWN);
++ err = ubifs_leb_change(c, lnum, sbuf, len, UBI_UNKNOWN);
+ if (err)
+ return err;
+
+@@ -1007,7 +1091,7 @@ static int clean_an_unclean_leb(const struct ubifs_info *c,
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-int ubifs_clean_lebs(const struct ubifs_info *c, void *sbuf)
++int ubifs_clean_lebs(struct ubifs_info *c, void *sbuf)
+ {
+ dbg_rcvry("recovery");
+ while (!list_empty(&c->unclean_leb_list)) {
+@@ -1026,6 +1110,53 @@ int ubifs_clean_lebs(const struct ubifs_info *c, void *sbuf)
+ }
+
+ /**
++ * grab_empty_leb - grab an empty LEB to use as GC LEB and run commit.
++ * @c: UBIFS file-system description object
++ *
++ * This is a helper function for 'ubifs_rcvry_gc_commit()' which grabs an empty
++ * LEB to be used as GC LEB (@c->gc_lnum), and then runs the commit. Returns
++ * zero in case of success and a negative error code in case of failure.
++ */
++static int grab_empty_leb(struct ubifs_info *c)
++{
++ int lnum, err;
++
++ /*
++ * Note, it is very important to first search for an empty LEB and then
++ * run the commit, not vice-versa. The reason is that there might be
++ * only one empty LEB at the moment, the one which has been the
++ * @c->gc_lnum just before the power cut happened. During the regular
++ * UBIFS operation (not now) @c->gc_lnum is marked as "taken", so no
++ * one but GC can grab it. But at this moment this single empty LEB is
++ * not marked as taken, so if we run commit - what happens? Right, the
++ * commit will grab it and write the index there. Remember that the
++ * index always expands as long as there is free space, and it only
++ * starts consolidating when we run out of space.
++ *
++ * IOW, if we run commit now, we might not be able to find a free LEB
++ * after this.
++ */
++ lnum = ubifs_find_free_leb_for_idx(c);
++ if (lnum < 0) {
++ dbg_err("could not find an empty LEB");
++ dbg_dump_lprops(c);
++ dbg_dump_budg(c, &c->bi);
++ return lnum;
++ }
++
++ /* Reset the index flag */
++ err = ubifs_change_one_lp(c, lnum, LPROPS_NC, LPROPS_NC, 0,
++ LPROPS_INDEX, 0);
++ if (err)
++ return err;
++
++ c->gc_lnum = lnum;
++ dbg_rcvry("found empty LEB %d, run commit", lnum);
++
++ return ubifs_run_commit(c);
++}
++
++/**
+ * ubifs_rcvry_gc_commit - recover the GC LEB number and run the commit.
+ * @c: UBIFS file-system description object
+ *
+@@ -1047,71 +1178,26 @@ int ubifs_rcvry_gc_commit(struct ubifs_info *c)
+ {
+ struct ubifs_wbuf *wbuf = &c->jheads[GCHD].wbuf;
+ struct ubifs_lprops lp;
+- int lnum, err;
++ int err;
++
++ dbg_rcvry("GC head LEB %d, offs %d", wbuf->lnum, wbuf->offs);
+
+ c->gc_lnum = -1;
+- if (wbuf->lnum == -1) {
+- dbg_rcvry("no GC head LEB");
+- goto find_free;
+- }
+- /*
+- * See whether the used space in the dirtiest LEB fits in the GC head
+- * LEB.
+- */
+- if (wbuf->offs == c->leb_size) {
+- dbg_rcvry("no room in GC head LEB");
+- goto find_free;
+- }
++ if (wbuf->lnum == -1 || wbuf->offs == c->leb_size)
++ return grab_empty_leb(c);
++
+ err = ubifs_find_dirty_leb(c, &lp, wbuf->offs, 2);
+ if (err) {
+- /*
+- * There are no dirty or empty LEBs subject to here being
+- * enough for the index. Try to use
+- * 'ubifs_find_free_leb_for_idx()', which will return any empty
+- * LEBs (ignoring index requirements). If the index then
+- * doesn't have enough LEBs the recovery commit will fail -
+- * which is the same result anyway i.e. recovery fails. So
+- * there is no problem ignoring index requirements and just
+- * grabbing a free LEB since we have already established there
+- * is not a dirty LEB we could have used instead.
+- */
+- if (err == -ENOSPC) {
+- dbg_rcvry("could not find a dirty LEB");
+- goto find_free;
+- }
+- return err;
+- }
+- ubifs_assert(!(lp.flags & LPROPS_INDEX));
+- lnum = lp.lnum;
+- if (lp.free + lp.dirty == c->leb_size) {
+- /* An empty LEB was returned */
+- if (lp.free != c->leb_size) {
+- err = ubifs_change_one_lp(c, lnum, c->leb_size,
+- 0, 0, 0, 0);
+- if (err)
+- return err;
+- }
+- err = ubifs_leb_unmap(c, lnum);
+- if (err)
+- return err;
+- c->gc_lnum = lnum;
+- dbg_rcvry("allocated LEB %d for GC", lnum);
+- /* Run the commit */
+- dbg_rcvry("committing");
+- return ubifs_run_commit(c);
+- }
+- /*
+- * There was no empty LEB so the used space in the dirtiest LEB must fit
+- * in the GC head LEB.
+- */
+- if (lp.free + lp.dirty < wbuf->offs) {
+- dbg_rcvry("LEB %d doesn't fit in GC head LEB %d:%d",
+- lnum, wbuf->lnum, wbuf->offs);
+- err = ubifs_return_leb(c, lnum);
+- if (err)
++ if (err != -ENOSPC)
+ return err;
+- goto find_free;
++
++ dbg_rcvry("could not find a dirty LEB");
++ return grab_empty_leb(c);
+ }
++
++ ubifs_assert(!(lp.flags & LPROPS_INDEX));
++ ubifs_assert(lp.free + lp.dirty >= wbuf->offs);
++
+ /*
+ * We run the commit before garbage collection otherwise subsequent
+ * mounts will see the GC and orphan deletion in a different order.
+@@ -1120,11 +1206,8 @@ int ubifs_rcvry_gc_commit(struct ubifs_info *c)
+ err = ubifs_run_commit(c);
+ if (err)
+ return err;
+- /*
+- * The data in the dirtiest LEB fits in the GC head LEB, so do the GC
+- * - use locking to keep 'ubifs_assert()' happy.
+- */
+- dbg_rcvry("GC'ing LEB %d", lnum);
++
++ dbg_rcvry("GC'ing LEB %d", lp.lnum);
+ mutex_lock_nested(&wbuf->io_mutex, wbuf->jhead);
+ err = ubifs_garbage_collect_leb(c, &lp);
+ if (err >= 0) {
+@@ -1140,37 +1223,17 @@ int ubifs_rcvry_gc_commit(struct ubifs_info *c)
+ err = -EINVAL;
+ return err;
+ }
+- if (err != LEB_RETAINED) {
+- dbg_err("GC returned %d", err);
++
++ ubifs_assert(err == LEB_RETAINED);
++ if (err != LEB_RETAINED)
+ return -EINVAL;
+- }
++
+ err = ubifs_leb_unmap(c, c->gc_lnum);
+ if (err)
+ return err;
+- dbg_rcvry("allocated LEB %d for GC", lnum);
+- return 0;
+
+-find_free:
+- /*
+- * There is no GC head LEB or the free space in the GC head LEB is too
+- * small, or there are not dirty LEBs. Allocate gc_lnum by calling
+- * 'ubifs_find_free_leb_for_idx()' so GC is not run.
+- */
+- lnum = ubifs_find_free_leb_for_idx(c);
+- if (lnum < 0) {
+- dbg_err("could not find an empty LEB");
+- return lnum;
+- }
+- /* And reset the index flag */
+- err = ubifs_change_one_lp(c, lnum, LPROPS_NC, LPROPS_NC, 0,
+- LPROPS_INDEX, 0);
+- if (err)
+- return err;
+- c->gc_lnum = lnum;
+- dbg_rcvry("allocated LEB %d for GC", lnum);
+- /* Run the commit */
+- dbg_rcvry("committing");
+- return ubifs_run_commit(c);
++ dbg_rcvry("allocated LEB %d for GC", lp.lnum);
++ return 0;
+ }
+
+ /**
+@@ -1393,7 +1456,7 @@ static int fix_size_in_place(struct ubifs_info *c, struct size_entry *e)
+ if (i_size >= e->d_size)
+ return 0;
+ /* Read the LEB */
+- err = ubi_read(c->ubi, lnum, c->sbuf, 0, c->leb_size);
++ err = ubifs_leb_read(c, lnum, c->sbuf, 0, c->leb_size, 1);
+ if (err)
+ goto out;
+ /* Change the size field and recalculate the CRC */
+@@ -1409,10 +1472,10 @@ static int fix_size_in_place(struct ubifs_info *c, struct size_entry *e)
+ len -= 1;
+ len = ALIGN(len + 1, c->min_io_size);
+ /* Atomically write the fixed LEB back again */
+- err = ubi_leb_change(c->ubi, lnum, c->sbuf, len, UBI_UNKNOWN);
++ err = ubifs_leb_change(c, lnum, c->sbuf, len, UBI_UNKNOWN);
+ if (err)
+ goto out;
+- dbg_rcvry("inode %lu at %d:%d size %lld -> %lld ",
++ dbg_rcvry("inode %lu at %d:%d size %lld -> %lld",
+ (unsigned long)e->inum, lnum, offs, i_size, e->d_size);
+ return 0;
+
+@@ -1461,20 +1524,27 @@ int ubifs_recover_size(struct ubifs_info *c)
+ e->i_size = le64_to_cpu(ino->size);
+ }
+ }
++
+ if (e->exists && e->i_size < e->d_size) {
+- if (!e->inode && c->ro_mount) {
++ if (c->ro_mount) {
+ /* Fix the inode size and pin it in memory */
+ struct inode *inode;
++ struct ubifs_inode *ui;
++
++ ubifs_assert(!e->inode);
+
+ inode = ubifs_iget(c->vfs_sb, e->inum);
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
++
++ ui = ubifs_inode(inode);
+ if (inode->i_size < e->d_size) {
+ dbg_rcvry("ino %lu size %lld -> %lld",
+ (unsigned long)e->inum,
+- e->d_size, inode->i_size);
++ inode->i_size, e->d_size);
+ inode->i_size = e->d_size;
+- ubifs_inode(inode)->ui_size = e->d_size;
++ ui->ui_size = e->d_size;
++ ui->synced_i_size = e->d_size;
+ e->inode = inode;
+ this = rb_next(this);
+ continue;
+@@ -1489,9 +1559,11 @@ int ubifs_recover_size(struct ubifs_info *c)
+ iput(e->inode);
+ }
+ }
++
+ this = rb_next(this);
+ rb_erase(&e->rb, &c->size_tree);
+ kfree(e);
+ }
++
+ return 0;
+ }
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index eed0fcf..b007637 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -33,43 +33,32 @@
+ */
+
+ #include "ubifs.h"
+-
+-/*
+- * Replay flags.
+- *
+- * REPLAY_DELETION: node was deleted
+- * REPLAY_REF: node is a reference node
+- */
+-enum {
+- REPLAY_DELETION = 1,
+- REPLAY_REF = 2,
+-};
++#include <linux/list_sort.h>
+
+ /**
+- * struct replay_entry - replay tree entry.
++ * struct replay_entry - replay list entry.
+ * @lnum: logical eraseblock number of the node
+ * @offs: node offset
+ * @len: node length
++ * @deletion: non-zero if this entry corresponds to a node deletion
+ * @sqnum: node sequence number
+- * @flags: replay flags
+- * @rb: links the replay tree
++ * @list: links the replay list
+ * @key: node key
+ * @nm: directory entry name
+ * @old_size: truncation old size
+ * @new_size: truncation new size
+- * @free: amount of free space in a bud
+- * @dirty: amount of dirty space in a bud from padding and deletion nodes
+ *
+- * UBIFS journal replay must compare node sequence numbers, which means it must
+- * build a tree of node information to insert into the TNC.
++ * The replay process first scans all buds and builds the replay list, then
++ * sorts the replay list in nodes sequence number order, and then inserts all
++ * the replay entries to the TNC.
+ */
+ struct replay_entry {
+ int lnum;
+ int offs;
+ int len;
++ unsigned int deletion:1;
+ unsigned long long sqnum;
+- int flags;
+- struct rb_node rb;
++ struct list_head list;
+ union ubifs_key key;
+ union {
+ struct qstr nm;
+@@ -77,10 +66,6 @@ struct replay_entry {
+ loff_t old_size;
+ loff_t new_size;
+ };
+- struct {
+- int free;
+- int dirty;
+- };
+ };
+ };
+
+@@ -88,57 +73,64 @@ struct replay_entry {
+ * struct bud_entry - entry in the list of buds to replay.
+ * @list: next bud in the list
+ * @bud: bud description object
+- * @free: free bytes in the bud
+ * @sqnum: reference node sequence number
++ * @free: free bytes in the bud
++ * @dirty: dirty bytes in the bud
+ */
+ struct bud_entry {
+ struct list_head list;
+ struct ubifs_bud *bud;
+- int free;
+ unsigned long long sqnum;
++ int free;
++ int dirty;
+ };
+
+ /**
+ * set_bud_lprops - set free and dirty space used by a bud.
+ * @c: UBIFS file-system description object
+- * @r: replay entry of bud
++ * @b: bud entry which describes the bud
++ *
++ * This function makes sure the LEB properties of bud @b are set correctly
++ * after the replay. Returns zero in case of success and a negative error code
++ * in case of failure.
+ */
+-static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
++static int set_bud_lprops(struct ubifs_info *c, struct bud_entry *b)
+ {
+ const struct ubifs_lprops *lp;
+ int err = 0, dirty;
+
+ ubifs_get_lprops(c);
+
+- lp = ubifs_lpt_lookup_dirty(c, r->lnum);
++ lp = ubifs_lpt_lookup_dirty(c, b->bud->lnum);
+ if (IS_ERR(lp)) {
+ err = PTR_ERR(lp);
+ goto out;
+ }
+
+ dirty = lp->dirty;
+- if (r->offs == 0 && (lp->free != c->leb_size || lp->dirty != 0)) {
++ if (b->bud->start == 0 && (lp->free != c->leb_size || lp->dirty != 0)) {
+ /*
+ * The LEB was added to the journal with a starting offset of
+ * zero which means the LEB must have been empty. The LEB
+- * property values should be lp->free == c->leb_size and
+- * lp->dirty == 0, but that is not the case. The reason is that
+- * the LEB was garbage collected. The garbage collector resets
+- * the free and dirty space without recording it anywhere except
+- * lprops, so if there is not a commit then lprops does not have
+- * that information next time the file system is mounted.
++ * property values should be @lp->free == @c->leb_size and
++ * @lp->dirty == 0, but that is not the case. The reason is that
++ * the LEB had been garbage collected before it became the bud,
++ * and there was not commit inbetween. The garbage collector
++ * resets the free and dirty space without recording it
++ * anywhere except lprops, so if there was no commit then
++ * lprops does not have that information.
+ *
+ * We do not need to adjust free space because the scan has told
+ * us the exact value which is recorded in the replay entry as
+- * r->free.
++ * @b->free.
+ *
+ * However we do need to subtract from the dirty space the
+ * amount of space that the garbage collector reclaimed, which
+ * is the whole LEB minus the amount of space that was free.
+ */
+- dbg_mnt("bud LEB %d was GC'd (%d free, %d dirty)", r->lnum,
++ dbg_mnt("bud LEB %d was GC'd (%d free, %d dirty)", b->bud->lnum,
+ lp->free, lp->dirty);
+- dbg_gc("bud LEB %d was GC'd (%d free, %d dirty)", r->lnum,
++ dbg_gc("bud LEB %d was GC'd (%d free, %d dirty)", b->bud->lnum,
+ lp->free, lp->dirty);
+ dirty -= c->leb_size - lp->free;
+ /*
+@@ -150,21 +142,48 @@ static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
+ */
+ if (dirty != 0)
+ dbg_msg("LEB %d lp: %d free %d dirty "
+- "replay: %d free %d dirty", r->lnum, lp->free,
+- lp->dirty, r->free, r->dirty);
++ "replay: %d free %d dirty", b->bud->lnum,
++ lp->free, lp->dirty, b->free, b->dirty);
+ }
+- lp = ubifs_change_lp(c, lp, r->free, dirty + r->dirty,
++ lp = ubifs_change_lp(c, lp, b->free, dirty + b->dirty,
+ lp->flags | LPROPS_TAKEN, 0);
+ if (IS_ERR(lp)) {
+ err = PTR_ERR(lp);
+ goto out;
+ }
++
++ /* Make sure the journal head points to the latest bud */
++ err = ubifs_wbuf_seek_nolock(&c->jheads[b->bud->jhead].wbuf,
++ b->bud->lnum, c->leb_size - b->free,
++ UBI_SHORTTERM);
++
+ out:
+ ubifs_release_lprops(c);
+ return err;
+ }
+
+ /**
++ * set_buds_lprops - set free and dirty space for all replayed buds.
++ * @c: UBIFS file-system description object
++ *
++ * This function sets LEB properties for all replayed buds. Returns zero in
++ * case of success and a negative error code in case of failure.
++ */
++static int set_buds_lprops(struct ubifs_info *c)
++{
++ struct bud_entry *b;
++ int err;
++
++ list_for_each_entry(b, &c->replay_buds, list) {
++ err = set_bud_lprops(c, b);
++ if (err)
++ return err;
++ }
++
++ return 0;
++}
++
++/**
+ * trun_remove_range - apply a replay entry for a truncation to the TNC.
+ * @c: UBIFS file-system description object
+ * @r: replay entry of truncation
+@@ -200,24 +219,22 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r)
+ */
+ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ {
+- int err, deletion = ((r->flags & REPLAY_DELETION) != 0);
++ int err;
+
+- dbg_mnt("LEB %d:%d len %d flgs %d sqnum %llu %s", r->lnum,
+- r->offs, r->len, r->flags, r->sqnum, DBGKEY(&r->key));
++ dbg_mntk(&r->key, "LEB %d:%d len %d deletion %d sqnum %llu key ",
++ r->lnum, r->offs, r->len, r->deletion, r->sqnum);
+
+ /* Set c->replay_sqnum to help deal with dangling branches. */
+ c->replay_sqnum = r->sqnum;
+
+- if (r->flags & REPLAY_REF)
+- err = set_bud_lprops(c, r);
+- else if (is_hash_key(c, &r->key)) {
+- if (deletion)
++ if (is_hash_key(c, &r->key)) {
++ if (r->deletion)
+ err = ubifs_tnc_remove_nm(c, &r->key, &r->nm);
+ else
+ err = ubifs_tnc_add_nm(c, &r->key, r->lnum, r->offs,
+ r->len, &r->nm);
+ } else {
+- if (deletion)
++ if (r->deletion)
+ switch (key_type(c, &r->key)) {
+ case UBIFS_INO_KEY:
+ {
+@@ -240,7 +257,7 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ return err;
+
+ if (c->need_recovery)
+- err = ubifs_recover_size_accum(c, &r->key, deletion,
++ err = ubifs_recover_size_accum(c, &r->key, r->deletion,
+ r->new_size);
+ }
+
+@@ -248,68 +265,77 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ }
+
+ /**
+- * destroy_replay_tree - destroy the replay.
+- * @c: UBIFS file-system description object
++ * replay_entries_cmp - compare 2 replay entries.
++ * @priv: UBIFS file-system description object
++ * @a: first replay entry
++ * @a: second replay entry
+ *
+- * Destroy the replay tree.
++ * This is a comparios function for 'list_sort()' which compares 2 replay
++ * entries @a and @b by comparing their sequence numer. Returns %1 if @a has
++ * greater sequence number and %-1 otherwise.
+ */
+-static void destroy_replay_tree(struct ubifs_info *c)
++static int replay_entries_cmp(void *priv, struct list_head *a,
++ struct list_head *b)
+ {
+- struct rb_node *this = c->replay_tree.rb_node;
+- struct replay_entry *r;
+-
+- while (this) {
+- if (this->rb_left) {
+- this = this->rb_left;
+- continue;
+- } else if (this->rb_right) {
+- this = this->rb_right;
+- continue;
+- }
+- r = rb_entry(this, struct replay_entry, rb);
+- this = rb_parent(this);
+- if (this) {
+- if (this->rb_left == &r->rb)
+- this->rb_left = NULL;
+- else
+- this->rb_right = NULL;
+- }
+- if (is_hash_key(c, &r->key))
+- kfree(r->nm.name);
+- kfree(r);
+- }
+- c->replay_tree = RB_ROOT;
++ struct replay_entry *ra, *rb;
++
++ cond_resched();
++ if (a == b)
++ return 0;
++
++ ra = list_entry(a, struct replay_entry, list);
++ rb = list_entry(b, struct replay_entry, list);
++ ubifs_assert(ra->sqnum != rb->sqnum);
++ if (ra->sqnum > rb->sqnum)
++ return 1;
++ return -1;
+ }
+
+ /**
+- * apply_replay_tree - apply the replay tree to the TNC.
++ * apply_replay_list - apply the replay list to the TNC.
+ * @c: UBIFS file-system description object
+ *
+- * Apply the replay tree.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
++ * Apply all entries in the replay list to the TNC. Returns zero in case of
++ * success and a negative error code in case of failure.
+ */
+-static int apply_replay_tree(struct ubifs_info *c)
++static int apply_replay_list(struct ubifs_info *c)
+ {
+- struct rb_node *this = rb_first(&c->replay_tree);
++ struct replay_entry *r;
++ int err;
+
+- while (this) {
+- struct replay_entry *r;
+- int err;
++ list_sort(c, &c->replay_list, &replay_entries_cmp);
+
++ list_for_each_entry(r, &c->replay_list, list) {
+ cond_resched();
+
+- r = rb_entry(this, struct replay_entry, rb);
+ err = apply_replay_entry(c, r);
+ if (err)
+ return err;
+- this = rb_next(this);
+ }
++
+ return 0;
+ }
+
+ /**
+- * insert_node - insert a node to the replay tree.
++ * destroy_replay_list - destroy the replay.
++ * @c: UBIFS file-system description object
++ *
++ * Destroy the replay list.
++ */
++static void destroy_replay_list(struct ubifs_info *c)
++{
++ struct replay_entry *r, *tmp;
++
++ list_for_each_entry_safe(r, tmp, &c->replay_list, list) {
++ if (is_hash_key(c, &r->key))
++ kfree(r->nm.name);
++ list_del(&r->list);
++ kfree(r);
++ }
++}
++
++/**
++ * insert_node - insert a node to the replay list
+ * @c: UBIFS file-system description object
+ * @lnum: node logical eraseblock number
+ * @offs: node offset
+@@ -321,39 +347,25 @@ static int apply_replay_tree(struct ubifs_info *c)
+ * @old_size: truncation old size
+ * @new_size: truncation new size
+ *
+- * This function inserts a scanned non-direntry node to the replay tree. The
+- * replay tree is an RB-tree containing @struct replay_entry elements which are
+- * indexed by the sequence number. The replay tree is applied at the very end
+- * of the replay process. Since the tree is sorted in sequence number order,
+- * the older modifications are applied first. This function returns zero in
+- * case of success and a negative error code in case of failure.
++ * This function inserts a scanned non-direntry node to the replay list. The
++ * replay list contains @struct replay_entry elements, and we sort this list in
++ * sequence number order before applying it. The replay list is applied at the
++ * very end of the replay process. Since the list is sorted in sequence number
++ * order, the older modifications are applied first. This function returns zero
++ * in case of success and a negative error code in case of failure.
+ */
+ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
+ union ubifs_key *key, unsigned long long sqnum,
+ int deletion, int *used, loff_t old_size,
+ loff_t new_size)
+ {
+- struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
+ struct replay_entry *r;
+
++ dbg_mntk(key, "add LEB %d:%d, key ", lnum, offs);
++
+ if (key_inum(c, key) >= c->highest_inum)
+ c->highest_inum = key_inum(c, key);
+
+- dbg_mnt("add LEB %d:%d, key %s", lnum, offs, DBGKEY(key));
+- while (*p) {
+- parent = *p;
+- r = rb_entry(parent, struct replay_entry, rb);
+- if (sqnum < r->sqnum) {
+- p = &(*p)->rb_left;
+- continue;
+- } else if (sqnum > r->sqnum) {
+- p = &(*p)->rb_right;
+- continue;
+- }
+- ubifs_err("duplicate sqnum in replay");
+- return -EINVAL;
+- }
+-
+ r = kzalloc(sizeof(struct replay_entry), GFP_KERNEL);
+ if (!r)
+ return -ENOMEM;
+@@ -363,19 +375,18 @@ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
+ r->lnum = lnum;
+ r->offs = offs;
+ r->len = len;
++ r->deletion = !!deletion;
+ r->sqnum = sqnum;
+- r->flags = (deletion ? REPLAY_DELETION : 0);
++ key_copy(c, key, &r->key);
+ r->old_size = old_size;
+ r->new_size = new_size;
+- key_copy(c, key, &r->key);
+
+- rb_link_node(&r->rb, parent, p);
+- rb_insert_color(&r->rb, &c->replay_tree);
++ list_add_tail(&r->list, &c->replay_list);
+ return 0;
+ }
+
+ /**
+- * insert_dent - insert a directory entry node into the replay tree.
++ * insert_dent - insert a directory entry node into the replay list.
+ * @c: UBIFS file-system description object
+ * @lnum: node logical eraseblock number
+ * @offs: node offset
+@@ -387,43 +398,25 @@ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
+ * @deletion: non-zero if this is a deletion
+ * @used: number of bytes in use in a LEB
+ *
+- * This function inserts a scanned directory entry node to the replay tree.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
+- *
+- * This function is also used for extended attribute entries because they are
+- * implemented as directory entry nodes.
++ * This function inserts a scanned directory entry node or an extended
++ * attribute entry to the replay list. Returns zero in case of success and a
++ * negative error code in case of failure.
+ */
+ static int insert_dent(struct ubifs_info *c, int lnum, int offs, int len,
+ union ubifs_key *key, const char *name, int nlen,
+ unsigned long long sqnum, int deletion, int *used)
+ {
+- struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
+ struct replay_entry *r;
+ char *nbuf;
+
++ dbg_mntk(key, "add LEB %d:%d, key ", lnum, offs);
+ if (key_inum(c, key) >= c->highest_inum)
+ c->highest_inum = key_inum(c, key);
+
+- dbg_mnt("add LEB %d:%d, key %s", lnum, offs, DBGKEY(key));
+- while (*p) {
+- parent = *p;
+- r = rb_entry(parent, struct replay_entry, rb);
+- if (sqnum < r->sqnum) {
+- p = &(*p)->rb_left;
+- continue;
+- }
+- if (sqnum > r->sqnum) {
+- p = &(*p)->rb_right;
+- continue;
+- }
+- ubifs_err("duplicate sqnum in replay");
+- return -EINVAL;
+- }
+-
+ r = kzalloc(sizeof(struct replay_entry), GFP_KERNEL);
+ if (!r)
+ return -ENOMEM;
++
+ nbuf = kmalloc(nlen + 1, GFP_KERNEL);
+ if (!nbuf) {
+ kfree(r);
+@@ -435,17 +428,15 @@ static int insert_dent(struct ubifs_info *c, int lnum, int offs, int len,
+ r->lnum = lnum;
+ r->offs = offs;
+ r->len = len;
++ r->deletion = !!deletion;
+ r->sqnum = sqnum;
++ key_copy(c, key, &r->key);
+ r->nm.len = nlen;
+ memcpy(nbuf, name, nlen);
+ nbuf[nlen] = '\0';
+ r->nm.name = nbuf;
+- r->flags = (deletion ? REPLAY_DELETION : 0);
+- key_copy(c, key, &r->key);
+
+- ubifs_assert(!*p);
+- rb_link_node(&r->rb, parent, p);
+- rb_insert_color(&r->rb, &c->replay_tree);
++ list_add_tail(&r->list, &c->replay_list);
+ return 0;
+ }
+
+@@ -482,29 +473,90 @@ int ubifs_validate_entry(struct ubifs_info *c,
+ }
+
+ /**
++ * is_last_bud - check if the bud is the last in the journal head.
++ * @c: UBIFS file-system description object
++ * @bud: bud description object
++ *
++ * This function checks if bud @bud is the last bud in its journal head. This
++ * information is then used by 'replay_bud()' to decide whether the bud can
++ * have corruptions or not. Indeed, only last buds can be corrupted by power
++ * cuts. Returns %1 if this is the last bud, and %0 if not.
++ */
++static int is_last_bud(struct ubifs_info *c, struct ubifs_bud *bud)
++{
++ struct ubifs_jhead *jh = &c->jheads[bud->jhead];
++ struct ubifs_bud *next;
++ uint32_t data;
++ int err;
++
++ if (list_is_last(&bud->list, &jh->buds_list))
++ return 1;
++
++ /*
++ * The following is a quirk to make sure we work correctly with UBIFS
++ * images used with older UBIFS.
++ *
++ * Normally, the last bud will be the last in the journal head's list
++ * of bud. However, there is one exception if the UBIFS image belongs
++ * to older UBIFS. This is fairly unlikely: one would need to use old
++ * UBIFS, then have a power cut exactly at the right point, and then
++ * try to mount this image with new UBIFS.
++ *
++ * The exception is: it is possible to have 2 buds A and B, A goes
++ * before B, and B is the last, bud B is contains no data, and bud A is
++ * corrupted at the end. The reason is that in older versions when the
++ * journal code switched the next bud (from A to B), it first added a
++ * log reference node for the new bud (B), and only after this it
++ * synchronized the write-buffer of current bud (A). But later this was
++ * changed and UBIFS started to always synchronize the write-buffer of
++ * the bud (A) before writing the log reference for the new bud (B).
++ *
++ * But because older UBIFS always synchronized A's write-buffer before
++ * writing to B, we can recognize this exceptional situation but
++ * checking the contents of bud B - if it is empty, then A can be
++ * treated as the last and we can recover it.
++ *
++ * TODO: remove this piece of code in a couple of years (today it is
++ * 16.05.2011).
++ */
++ next = list_entry(bud->list.next, struct ubifs_bud, list);
++ if (!list_is_last(&next->list, &jh->buds_list))
++ return 0;
++
++ err = ubifs_leb_read(c, next->lnum, (char *)&data, next->start, 4, 1);
++ if (err)
++ return 0;
++
++ return data == 0xFFFFFFFF;
++}
++
++/**
+ * replay_bud - replay a bud logical eraseblock.
+ * @c: UBIFS file-system description object
+- * @lnum: bud logical eraseblock number to replay
+- * @offs: bud start offset
+- * @jhead: journal head to which this bud belongs
+- * @free: amount of free space in the bud is returned here
+- * @dirty: amount of dirty space from padding and deletion nodes is returned
+- * here
++ * @b: bud entry which describes the bud
+ *
+- * This function returns zero in case of success and a negative error code in
+- * case of failure.
++ * This function replays bud @bud, recovers it if needed, and adds all nodes
++ * from this bud to the replay list. Returns zero in case of success and a
++ * negative error code in case of failure.
+ */
+-static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
+- int *free, int *dirty)
++static int replay_bud(struct ubifs_info *c, struct bud_entry *b)
+ {
+- int err = 0, used = 0;
++ int is_last = is_last_bud(c, b->bud);
++ int err = 0, used = 0, lnum = b->bud->lnum, offs = b->bud->start;
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
+- struct ubifs_bud *bud;
+
+- dbg_mnt("replay bud LEB %d, head %d", lnum, jhead);
+- if (c->need_recovery)
+- sleb = ubifs_recover_leb(c, lnum, offs, c->sbuf, jhead != GCHD);
++ dbg_mnt("replay bud LEB %d, head %d, offs %d, is_last %d",
++ lnum, b->bud->jhead, offs, is_last);
++
++ if (c->need_recovery && is_last)
++ /*
++ * Recover only last LEBs in the journal heads, because power
++ * cuts may cause corruptions only in these LEBs, because only
++ * these LEBs could possibly be written to at the power cut
++ * time.
++ */
++ sleb = ubifs_recover_leb(c, lnum, offs, c->sbuf, b->bud->jhead);
+ else
+ sleb = ubifs_scan(c, lnum, offs, c->sbuf, 0);
+ if (IS_ERR(sleb))
+@@ -620,19 +672,13 @@ static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
+ goto out;
+ }
+
+- bud = ubifs_search_bud(c, lnum);
+- if (!bud)
+- BUG();
+-
++ ubifs_assert(ubifs_search_bud(c, lnum));
+ ubifs_assert(sleb->endpt - offs >= used);
+ ubifs_assert(sleb->endpt % c->min_io_size == 0);
+
+- if (sleb->endpt + c->min_io_size <= c->leb_size && !c->ro_mount)
+- err = ubifs_wbuf_seek_nolock(&c->jheads[jhead].wbuf, lnum,
+- sleb->endpt, UBI_SHORTTERM);
+-
+- *dirty = sleb->endpt - offs - used;
+- *free = c->leb_size - sleb->endpt;
++ b->dirty = sleb->endpt - offs - used;
++ b->free = c->leb_size - sleb->endpt;
++ dbg_mnt("bud LEB %d replied: dirty %d, free %d", lnum, b->dirty, b->free);
+
+ out:
+ ubifs_scan_destroy(sleb);
+@@ -646,55 +692,6 @@ out_dump:
+ }
+
+ /**
+- * insert_ref_node - insert a reference node to the replay tree.
+- * @c: UBIFS file-system description object
+- * @lnum: node logical eraseblock number
+- * @offs: node offset
+- * @sqnum: sequence number
+- * @free: amount of free space in bud
+- * @dirty: amount of dirty space from padding and deletion nodes
+- *
+- * This function inserts a reference node to the replay tree and returns zero
+- * in case of success or a negative error code in case of failure.
+- */
+-static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
+- unsigned long long sqnum, int free, int dirty)
+-{
+- struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
+- struct replay_entry *r;
+-
+- dbg_mnt("add ref LEB %d:%d", lnum, offs);
+- while (*p) {
+- parent = *p;
+- r = rb_entry(parent, struct replay_entry, rb);
+- if (sqnum < r->sqnum) {
+- p = &(*p)->rb_left;
+- continue;
+- } else if (sqnum > r->sqnum) {
+- p = &(*p)->rb_right;
+- continue;
+- }
+- ubifs_err("duplicate sqnum in replay tree");
+- return -EINVAL;
+- }
+-
+- r = kzalloc(sizeof(struct replay_entry), GFP_KERNEL);
+- if (!r)
+- return -ENOMEM;
+-
+- r->lnum = lnum;
+- r->offs = offs;
+- r->sqnum = sqnum;
+- r->flags = REPLAY_REF;
+- r->free = free;
+- r->dirty = dirty;
+-
+- rb_link_node(&r->rb, parent, p);
+- rb_insert_color(&r->rb, &c->replay_tree);
+- return 0;
+-}
+-
+-/**
+ * replay_buds - replay all buds.
+ * @c: UBIFS file-system description object
+ *
+@@ -704,17 +701,16 @@ static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
+ static int replay_buds(struct ubifs_info *c)
+ {
+ struct bud_entry *b;
+- int err, uninitialized_var(free), uninitialized_var(dirty);
++ int err;
++ unsigned long long prev_sqnum = 0;
+
+ list_for_each_entry(b, &c->replay_buds, list) {
+- err = replay_bud(c, b->bud->lnum, b->bud->start, b->bud->jhead,
+- &free, &dirty);
+- if (err)
+- return err;
+- err = insert_ref_node(c, b->bud->lnum, b->bud->start, b->sqnum,
+- free, dirty);
++ err = replay_bud(c, b);
+ if (err)
+ return err;
++
++ ubifs_assert(b->sqnum > prev_sqnum);
++ prev_sqnum = b->sqnum;
+ }
+
+ return 0;
+@@ -1054,25 +1050,29 @@ int ubifs_replay_journal(struct ubifs_info *c)
+ if (err)
+ goto out;
+
+- err = apply_replay_tree(c);
++ err = apply_replay_list(c);
++ if (err)
++ goto out;
++
++ err = set_buds_lprops(c);
+ if (err)
+ goto out;
+
+ /*
+- * UBIFS budgeting calculations use @c->budg_uncommitted_idx variable
+- * to roughly estimate index growth. Things like @c->min_idx_lebs
++ * UBIFS budgeting calculations use @c->bi.uncommitted_idx variable
++ * to roughly estimate index growth. Things like @c->bi.min_idx_lebs
+ * depend on it. This means we have to initialize it to make sure
+ * budgeting works properly.
+ */
+- c->budg_uncommitted_idx = atomic_long_read(&c->dirty_zn_cnt);
+- c->budg_uncommitted_idx *= c->max_idx_node_sz;
++ c->bi.uncommitted_idx = atomic_long_read(&c->dirty_zn_cnt);
++ c->bi.uncommitted_idx *= c->max_idx_node_sz;
+
+ ubifs_assert(c->bud_bytes <= c->max_bud_bytes || c->need_recovery);
+ dbg_mnt("finished, log head LEB %d:%d, max_sqnum %llu, "
+ "highest_inum %lu", c->lhead_lnum, c->lhead_offs, c->max_sqnum,
+ (unsigned long)c->highest_inum);
+ out:
+- destroy_replay_tree(c);
++ destroy_replay_list(c);
+ destroy_bud_list(c);
+ c->replaying = 0;
+ return err;
+diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
+index bf31b47..771f7fb 100644
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -247,7 +247,7 @@ static int create_default_filesystem(struct ubifs_info *c)
+ mst->total_dirty = cpu_to_le64(tmp64);
+
+ /* The indexing LEB does not contribute to dark space */
+- tmp64 = (c->main_lebs - 1) * c->dark_wm;
++ tmp64 = ((long long)(c->main_lebs - 1) * c->dark_wm);
+ mst->total_dark = cpu_to_le64(tmp64);
+
+ mst->total_used = cpu_to_le64(UBIFS_INO_NODE_SZ);
+@@ -410,13 +410,23 @@ static int validate_sb(struct ubifs_info *c, struct ubifs_sb_node *sup)
+ }
+
+ if (c->main_lebs < UBIFS_MIN_MAIN_LEBS) {
+- err = 7;
++ ubifs_err("too few main LEBs count %d, must be at least %d",
++ c->main_lebs, UBIFS_MIN_MAIN_LEBS);
+ goto failed;
+ }
+
+- if (c->max_bud_bytes < (long long)c->leb_size * UBIFS_MIN_BUD_LEBS ||
+- c->max_bud_bytes > (long long)c->leb_size * c->main_lebs) {
+- err = 8;
++ max_bytes = (long long)c->leb_size * UBIFS_MIN_BUD_LEBS;
++ if (c->max_bud_bytes < max_bytes) {
++ ubifs_err("too small journal (%lld bytes), must be at least "
++ "%lld bytes", c->max_bud_bytes, max_bytes);
++ goto failed;
++ }
++
++ max_bytes = (long long)c->leb_size * c->main_lebs;
++ if (c->max_bud_bytes > max_bytes) {
++ ubifs_err("too large journal size (%lld bytes), only %lld bytes"
++ "available in the main area",
++ c->max_bud_bytes, max_bytes);
+ goto failed;
+ }
+
+@@ -450,7 +460,6 @@ static int validate_sb(struct ubifs_info *c, struct ubifs_sb_node *sup)
+ goto failed;
+ }
+
+- max_bytes = c->main_lebs * (long long)c->leb_size;
+ if (c->rp_size < 0 || max_bytes < c->rp_size) {
+ err = 14;
+ goto failed;
+@@ -475,7 +484,8 @@ failed:
+ * @c: UBIFS file-system description object
+ *
+ * This function returns a pointer to the superblock node or a negative error
+- * code.
++ * code. Note, the user of this function is responsible of kfree()'ing the
++ * returned superblock buffer.
+ */
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c)
+ {
+@@ -616,6 +626,7 @@ int ubifs_read_superblock(struct ubifs_info *c)
+ c->vfs_sb->s_time_gran = le32_to_cpu(sup->time_gran);
+ memcpy(&c->uuid, &sup->uuid, 16);
+ c->big_lpt = !!(sup_flags & UBIFS_FLG_BIGLPT);
++ c->space_fixup = !!(sup_flags & UBIFS_FLG_SPACE_FIXUP);
+
+ /* Automatically increase file system size to the maximum size */
+ c->old_leb_cnt = c->leb_cnt;
+@@ -650,3 +661,152 @@ out:
+ kfree(sup);
+ return err;
+ }
++
++/**
++ * fixup_leb - fixup/unmap an LEB containing free space.
++ * @c: UBIFS file-system description object
++ * @lnum: the LEB number to fix up
++ * @len: number of used bytes in LEB (starting at offset 0)
++ *
++ * This function reads the contents of the given LEB number @lnum, then fixes
++ * it up, so that empty min. I/O units in the end of LEB are actually erased on
++ * flash (rather than being just all-0xff real data). If the LEB is completely
++ * empty, it is simply unmapped.
++ */
++static int fixup_leb(struct ubifs_info *c, int lnum, int len)
++{
++ int err;
++
++ ubifs_assert(len >= 0);
++ ubifs_assert(len % c->min_io_size == 0);
++ ubifs_assert(len < c->leb_size);
++
++ if (len == 0) {
++ dbg_mnt("unmap empty LEB %d", lnum);
++ return ubifs_leb_unmap(c, lnum);
++ }
++
++ dbg_mnt("fixup LEB %d, data len %d", lnum, len);
++ err = ubifs_leb_read(c, lnum, c->sbuf, 0, len, 1);
++ if (err)
++ return err;
++
++ return ubifs_leb_change(c, lnum, c->sbuf, len, UBI_UNKNOWN);
++}
++
++/**
++ * fixup_free_space - find & remap all LEBs containing free space.
++ * @c: UBIFS file-system description object
++ *
++ * This function walks through all LEBs in the filesystem and fiexes up those
++ * containing free/empty space.
++ */
++static int fixup_free_space(struct ubifs_info *c)
++{
++ int lnum, err = 0;
++ struct ubifs_lprops *lprops;
++
++ ubifs_get_lprops(c);
++
++ /* Fixup LEBs in the master area */
++ for (lnum = UBIFS_MST_LNUM; lnum < UBIFS_LOG_LNUM; lnum++) {
++ err = fixup_leb(c, lnum, c->mst_offs + c->mst_node_alsz);
++ if (err)
++ goto out;
++ }
++
++ /* Unmap unused log LEBs */
++ lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
++ while (lnum != c->ltail_lnum) {
++ err = fixup_leb(c, lnum, 0);
++ if (err)
++ goto out;
++ lnum = ubifs_next_log_lnum(c, lnum);
++ }
++
++ /* Fixup the current log head */
++ err = fixup_leb(c, c->lhead_lnum, c->lhead_offs);
++ if (err)
++ goto out;
++
++ /* Fixup LEBs in the LPT area */
++ for (lnum = c->lpt_first; lnum <= c->lpt_last; lnum++) {
++ int free = c->ltab[lnum - c->lpt_first].free;
++
++ if (free > 0) {
++ err = fixup_leb(c, lnum, c->leb_size - free);
++ if (err)
++ goto out;
++ }
++ }
++
++ /* Unmap LEBs in the orphans area */
++ for (lnum = c->orph_first; lnum <= c->orph_last; lnum++) {
++ err = fixup_leb(c, lnum, 0);
++ if (err)
++ goto out;
++ }
++
++ /* Fixup LEBs in the main area */
++ for (lnum = c->main_first; lnum < c->leb_cnt; lnum++) {
++ lprops = ubifs_lpt_lookup(c, lnum);
++ if (IS_ERR(lprops)) {
++ err = PTR_ERR(lprops);
++ goto out;
++ }
++
++ if (lprops->free > 0) {
++ err = fixup_leb(c, lnum, c->leb_size - lprops->free);
++ if (err)
++ goto out;
++ }
++ }
++
++out:
++ ubifs_release_lprops(c);
++ return err;
++}
++
++/**
++ * ubifs_fixup_free_space - find & fix all LEBs with free space.
++ * @c: UBIFS file-system description object
++ *
++ * This function fixes up LEBs containing free space on first mount, if the
++ * appropriate flag was set when the FS was created. Each LEB with one or more
++ * empty min. I/O unit (i.e. free-space-count > 0) is re-written, to make sure
++ * the free space is actually erased. E.g., this is necessary for some NAND
++ * chips, since the free space may have been programmed like real "0xff" data
++ * (generating a non-0xff ECC), causing future writes to the not-really-erased
++ * NAND pages to behave badly. After the space is fixed up, the superblock flag
++ * is cleared, so that this is skipped for all future mounts.
++ */
++int ubifs_fixup_free_space(struct ubifs_info *c)
++{
++ int err;
++ struct ubifs_sb_node *sup;
++
++ ubifs_assert(c->space_fixup);
++ ubifs_assert(!c->ro_mount);
++
++ ubifs_msg("start fixing up free space");
++
++ err = fixup_free_space(c);
++ if (err)
++ return err;
++
++ sup = ubifs_read_sb_node(c);
++ if (IS_ERR(sup))
++ return PTR_ERR(sup);
++
++ /* Free-space fixup is no longer required */
++ c->space_fixup = 0;
++ sup->flags &= cpu_to_le32(~UBIFS_FLG_SPACE_FIXUP);
++
++ err = ubifs_write_sb_node(c, sup);
++ kfree(sup);
++ if (err)
++ return err;
++
++ ubifs_msg("free space fixup complete");
++ return err;
++}
+diff --git a/fs/ubifs/scan.c b/fs/ubifs/scan.c
+index 3e1ee57..37383e8 100644
+--- a/fs/ubifs/scan.c
++++ b/fs/ubifs/scan.c
+@@ -148,7 +148,7 @@ struct ubifs_scan_leb *ubifs_start_scan(const struct ubifs_info *c, int lnum,
+ INIT_LIST_HEAD(&sleb->nodes);
+ sleb->buf = sbuf;
+
+- err = ubi_read(c->ubi, lnum, sbuf + offs, offs, c->leb_size - offs);
++ err = ubifs_leb_read(c, lnum, sbuf + offs, offs, c->leb_size - offs, 0);
+ if (err && err != -EBADMSG) {
+ ubifs_err("cannot read %d bytes from LEB %d:%d,"
+ " error %d", c->leb_size - offs, lnum, offs, err);
+@@ -240,7 +240,7 @@ void ubifs_scanned_corruption(const struct ubifs_info *c, int lnum, int offs,
+ int len;
+
+ ubifs_err("corruption at LEB %d:%d", lnum, offs);
+- if (dbg_failure_mode)
++ if (dbg_is_tst_rcvry(c))
+ return;
+ len = c->leb_size - offs;
+ if (len > 8192)
+@@ -328,7 +328,7 @@ struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
+ if (!quiet)
+ ubifs_err("empty space starts at non-aligned offset %d",
+ offs);
+- goto corrupted;;
++ goto corrupted;
+ }
+
+ ubifs_end_scan(c, sleb, lnum, offs);
+diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
+index 46961c0..d8f5d0f 100644
+--- a/fs/ubifs/shrinker.c
++++ b/fs/ubifs/shrinker.c
+@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+ long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
+
+ if (nr == 0)
+- return clean_zn_cnt;
++ /*
++ * Due to the way UBIFS updates the clean znode counter it may
++ * temporarily be negative.
++ */
++ return clean_zn_cnt >= 0 ? clean_zn_cnt : 1;
+
+ if (!clean_zn_cnt) {
+ /*
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 91fac54..83651cd 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -85,7 +85,7 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
+ if (ui->data_len < 0 || ui->data_len > UBIFS_MAX_INO_DATA)
+ return 4;
+
+- if (ui->xattr && (inode->i_mode & S_IFMT) != S_IFREG)
++ if (ui->xattr && !S_ISREG(inode->i_mode))
+ return 5;
+
+ if (!ubifs_compr_present(ui->compr_type)) {
+@@ -94,7 +94,7 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
+ ubifs_compr_name(ui->compr_type));
+ }
+
+- err = dbg_check_dir_size(c, inode);
++ err = dbg_check_dir(c, inode);
+ return err;
+ }
+
+@@ -367,7 +367,7 @@ out:
+ ubifs_release_dirty_inode_budget(c, ui);
+ else {
+ /* We've deleted something - clean the "no space" flags */
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ done:
+@@ -504,9 +504,12 @@ static int init_constants_early(struct ubifs_info *c)
+
+ c->leb_cnt = c->vi.size;
+ c->leb_size = c->vi.usable_leb_size;
++ c->leb_start = c->di.leb_start;
+ c->half_leb_size = c->leb_size / 2;
+ c->min_io_size = c->di.min_io_size;
+ c->min_io_shift = fls(c->min_io_size) - 1;
++ c->max_write_size = c->di.max_write_size;
++ c->max_write_shift = fls(c->max_write_size) - 1;
+
+ if (c->leb_size < UBIFS_MIN_LEB_SZ) {
+ ubifs_err("too small LEBs (%d bytes), min. is %d bytes",
+@@ -526,6 +529,18 @@ static int init_constants_early(struct ubifs_info *c)
+ }
+
+ /*
++ * Maximum write size has to be greater or equivalent to min. I/O
++ * size, and be multiple of min. I/O size.
++ */
++ if (c->max_write_size < c->min_io_size ||
++ c->max_write_size % c->min_io_size ||
++ !is_power_of_2(c->max_write_size)) {
++ ubifs_err("bad write buffer size %d for %d min. I/O unit",
++ c->max_write_size, c->min_io_size);
++ return -EINVAL;
++ }
++
++ /*
+ * UBIFS aligns all node to 8-byte boundary, so to make function in
+ * io.c simpler, assume minimum I/O unit size to be 8 bytes if it is
+ * less than 8.
+@@ -533,6 +548,10 @@ static int init_constants_early(struct ubifs_info *c)
+ if (c->min_io_size < 8) {
+ c->min_io_size = 8;
+ c->min_io_shift = 3;
++ if (c->max_write_size < c->min_io_size) {
++ c->max_write_size = c->min_io_size;
++ c->max_write_shift = c->min_io_shift;
++ }
+ }
+
+ c->ref_node_alsz = ALIGN(UBIFS_REF_NODE_SZ, c->min_io_size);
+@@ -667,11 +686,11 @@ static int init_constants_sb(struct ubifs_info *c)
+ * be compressed and direntries are of the maximum size.
+ *
+ * Note, data, which may be stored in inodes is budgeted separately, so
+- * it is not included into 'c->inode_budget'.
++ * it is not included into 'c->bi.inode_budget'.
+ */
+- c->page_budget = UBIFS_MAX_DATA_NODE_SZ * UBIFS_BLOCKS_PER_PAGE;
+- c->inode_budget = UBIFS_INO_NODE_SZ;
+- c->dent_budget = UBIFS_MAX_DENT_NODE_SZ;
++ c->bi.page_budget = UBIFS_MAX_DATA_NODE_SZ * UBIFS_BLOCKS_PER_PAGE;
++ c->bi.inode_budget = UBIFS_INO_NODE_SZ;
++ c->bi.dent_budget = UBIFS_MAX_DENT_NODE_SZ;
+
+ /*
+ * When the amount of flash space used by buds becomes
+@@ -715,7 +734,7 @@ static void init_constants_master(struct ubifs_info *c)
+ {
+ long long tmp64;
+
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+ c->report_rp_size = ubifs_reported_space(c, c->rp_size);
+
+ /*
+@@ -784,15 +803,18 @@ static int alloc_wbufs(struct ubifs_info *c)
+
+ c->jheads[i].wbuf.sync_callback = &bud_wbuf_callback;
+ c->jheads[i].wbuf.jhead = i;
++ c->jheads[i].grouped = 1;
+ }
+
+ c->jheads[BASEHD].wbuf.dtype = UBI_SHORTTERM;
+ /*
+ * Garbage Collector head likely contains long-term data and
+- * does not need to be synchronized by timer.
++ * does not need to be synchronized by timer. Also GC head nodes are
++ * not grouped.
+ */
+ c->jheads[GCHD].wbuf.dtype = UBI_LONGTERM;
+ c->jheads[GCHD].wbuf.no_timer = 1;
++ c->jheads[GCHD].grouped = 0;
+
+ return 0;
+ }
+@@ -884,7 +906,7 @@ static int check_volume_empty(struct ubifs_info *c)
+
+ c->empty = 1;
+ for (lnum = 0; lnum < c->leb_cnt; lnum++) {
+- err = ubi_is_mapped(c->ubi, lnum);
++ err = ubifs_is_mapped(c, lnum);
+ if (unlikely(err < 0))
+ return err;
+ if (err == 1) {
+@@ -1117,8 +1139,8 @@ static int check_free_space(struct ubifs_info *c)
+ {
+ ubifs_assert(c->dark_wm > 0);
+ if (c->lst.total_free + c->lst.total_dirty < c->dark_wm) {
+- ubifs_err("insufficient free space to mount in read/write mode");
+- dbg_dump_budg(c);
++ ubifs_err("insufficient free space to mount in R/W mode");
++ dbg_dump_budg(c, &c->bi);
+ dbg_dump_lprops(c);
+ return -ENOSPC;
+ }
+@@ -1194,11 +1216,14 @@ static int mount_ubifs(struct ubifs_info *c)
+ if (c->bulk_read == 1)
+ bu_init(c);
+
+- /*
+- * We have to check all CRCs, even for data nodes, when we mount the FS
+- * (specifically, when we are replaying).
+- */
+- c->always_chk_crc = 1;
++ if (!c->ro_mount) {
++ c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ,
++ GFP_KERNEL);
++ if (!c->write_reserve_buf)
++ goto out_free;
++ }
++
++ c->mounting = 1;
+
+ err = ubifs_read_superblock(c);
+ if (err)
+@@ -1227,12 +1252,12 @@ static int mount_ubifs(struct ubifs_info *c)
+ goto out_free;
+ }
+
++ err = alloc_wbufs(c);
++ if (err)
++ goto out_cbuf;
++
+ sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
+ if (!c->ro_mount) {
+- err = alloc_wbufs(c);
+- if (err)
+- goto out_cbuf;
+-
+ /* Create background thread */
+ c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
+ if (IS_ERR(c->bgt)) {
+@@ -1254,12 +1279,25 @@ static int mount_ubifs(struct ubifs_info *c)
+ if ((c->mst_node->flags & cpu_to_le32(UBIFS_MST_DIRTY)) != 0) {
+ ubifs_msg("recovery needed");
+ c->need_recovery = 1;
+- if (!c->ro_mount) {
+- err = ubifs_recover_inl_heads(c, c->sbuf);
+- if (err)
+- goto out_master;
+- }
+- } else if (!c->ro_mount) {
++ }
++
++ if (c->need_recovery && !c->ro_mount) {
++ err = ubifs_recover_inl_heads(c, c->sbuf);
++ if (err)
++ goto out_master;
++ }
++
++ err = ubifs_lpt_init(c, 1, !c->ro_mount);
++ if (err)
++ goto out_master;
++
++ if (!c->ro_mount && c->space_fixup) {
++ err = ubifs_fixup_free_space(c);
++ if (err)
++ goto out_master;
++ }
++
++ if (!c->ro_mount) {
+ /*
+ * Set the "dirty" flag so that if we reboot uncleanly we
+ * will notice this immediately on the next mount.
+@@ -1267,14 +1305,10 @@ static int mount_ubifs(struct ubifs_info *c)
+ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ err = ubifs_write_master(c);
+ if (err)
+- goto out_master;
++ goto out_lpt;
+ }
+
+- err = ubifs_lpt_init(c, 1, !c->ro_mount);
+- if (err)
+- goto out_lpt;
+-
+- err = dbg_check_idx_size(c, c->old_idx_sz);
++ err = dbg_check_idx_size(c, c->bi.old_idx_sz);
+ if (err)
+ goto out_lpt;
+
+@@ -1283,7 +1317,7 @@ static int mount_ubifs(struct ubifs_info *c)
+ goto out_journal;
+
+ /* Calculate 'min_idx_lebs' after journal replay */
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+
+ err = ubifs_mount_orphans(c, c->need_recovery, c->ro_mount);
+ if (err)
+@@ -1374,7 +1408,7 @@ static int mount_ubifs(struct ubifs_info *c)
+ if (err)
+ goto out_infos;
+
+- c->always_chk_crc = 0;
++ c->mounting = 0;
+
+ ubifs_msg("mounted UBI device %d, volume %d, name \"%s\"",
+ c->vi.ubi_num, c->vi.vol_id, c->vi.name);
+@@ -1395,6 +1429,7 @@ static int mount_ubifs(struct ubifs_info *c)
+
+ dbg_msg("compiled on: " __DATE__ " at " __TIME__);
+ dbg_msg("min. I/O unit size: %d bytes", c->min_io_size);
++ dbg_msg("max. write size: %d bytes", c->max_write_size);
+ dbg_msg("LEB size: %d bytes (%d KiB)",
+ c->leb_size, c->leb_size >> 10);
+ dbg_msg("data journal heads: %d",
+@@ -1411,7 +1446,8 @@ static int mount_ubifs(struct ubifs_info *c)
+ c->main_lebs, c->main_first, c->leb_cnt - 1);
+ dbg_msg("index LEBs: %d", c->lst.idx_lebs);
+ dbg_msg("total index bytes: %lld (%lld KiB, %lld MiB)",
+- c->old_idx_sz, c->old_idx_sz >> 10, c->old_idx_sz >> 20);
++ c->bi.old_idx_sz, c->bi.old_idx_sz >> 10,
++ c->bi.old_idx_sz >> 20);
+ dbg_msg("key hash type: %d", c->key_hash_type);
+ dbg_msg("tree fanout: %d", c->fanout);
+ dbg_msg("reserved GC LEB: %d", c->gc_lnum);
+@@ -1424,9 +1460,9 @@ static int mount_ubifs(struct ubifs_info *c)
+ UBIFS_TRUN_NODE_SZ, UBIFS_SB_NODE_SZ, UBIFS_MST_NODE_SZ);
+ dbg_msg("node sizes: ref %zu, cmt. start %zu, orph %zu",
+ UBIFS_REF_NODE_SZ, UBIFS_CS_NODE_SZ, UBIFS_ORPH_NODE_SZ);
+- dbg_msg("max. node sizes: data %zu, inode %zu dentry %zu",
+- UBIFS_MAX_DATA_NODE_SZ, UBIFS_MAX_INO_NODE_SZ,
+- UBIFS_MAX_DENT_NODE_SZ);
++ dbg_msg("max. node sizes: data %zu, inode %zu dentry %zu, idx %d",
++ UBIFS_MAX_DATA_NODE_SZ, UBIFS_MAX_INO_NODE_SZ,
++ UBIFS_MAX_DENT_NODE_SZ, ubifs_idx_node_sz(c, c->fanout));
+ dbg_msg("dead watermark: %d", c->dead_wm);
+ dbg_msg("dark watermark: %d", c->dark_wm);
+ dbg_msg("LEB overhead: %d", c->leb_overhead);
+@@ -1466,6 +1502,7 @@ out_wbufs:
+ out_cbuf:
+ kfree(c->cbuf);
+ out_free:
++ kfree(c->write_reserve_buf);
+ kfree(c->bu.buf);
+ vfree(c->ileb_buf);
+ vfree(c->sbuf);
+@@ -1504,6 +1541,7 @@ static void ubifs_umount(struct ubifs_info *c)
+ kfree(c->cbuf);
+ kfree(c->rcvrd_mst_node);
+ kfree(c->mst_node);
++ kfree(c->write_reserve_buf);
+ kfree(c->bu.buf);
+ vfree(c->ileb_buf);
+ vfree(c->sbuf);
+@@ -1535,7 +1573,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ mutex_lock(&c->umount_mutex);
+ dbg_save_space_info(c);
+ c->remounting_rw = 1;
+- c->always_chk_crc = 1;
++ c->ro_mount = 0;
+
+ err = check_free_space(c);
+ if (err)
+@@ -1551,6 +1589,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ }
+ sup->leb_cnt = cpu_to_le32(c->leb_cnt);
+ err = ubifs_write_sb_node(c, sup);
++ kfree(sup);
+ if (err)
+ goto out;
+ }
+@@ -1590,16 +1629,14 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ goto out;
+ }
+
+- err = ubifs_lpt_init(c, 0, 1);
+- if (err)
++ c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ, GFP_KERNEL);
++ if (!c->write_reserve_buf)
+ goto out;
+
+- err = alloc_wbufs(c);
++ err = ubifs_lpt_init(c, 0, 1);
+ if (err)
+ goto out;
+
+- ubifs_create_buds_lists(c);
+-
+ /* Create background thread */
+ c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
+ if (IS_ERR(c->bgt)) {
+@@ -1634,20 +1671,37 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ if (err)
+ goto out;
+
++ dbg_gen("re-mounted read-write");
++ c->remounting_rw = 0;
++
+ if (c->need_recovery) {
+ c->need_recovery = 0;
+ ubifs_msg("deferred recovery completed");
++ } else {
++ /*
++ * Do not run the debugging space check if the were doing
++ * recovery, because when we saved the information we had the
++ * file-system in a state where the TNC and lprops has been
++ * modified in memory, but all the I/O operations (including a
++ * commit) were deferred. So the file-system was in
++ * "non-committed" state. Now the file-system is in committed
++ * state, and of course the amount of free space will change
++ * because, for example, the old index size was imprecise.
++ */
++ err = dbg_check_space_info(c);
++ }
++
++ if (c->space_fixup) {
++ err = ubifs_fixup_free_space(c);
++ if (err)
++ goto out;
+ }
+
+- dbg_gen("re-mounted read-write");
+- c->ro_mount = 0;
+- c->remounting_rw = 0;
+- c->always_chk_crc = 0;
+- err = dbg_check_space_info(c);
+ mutex_unlock(&c->umount_mutex);
+ return err;
+
+ out:
++ c->ro_mount = 1;
+ vfree(c->orph_buf);
+ c->orph_buf = NULL;
+ if (c->bgt) {
+@@ -1655,11 +1709,12 @@ out:
+ c->bgt = NULL;
+ }
+ free_wbufs(c);
++ kfree(c->write_reserve_buf);
++ c->write_reserve_buf = NULL;
+ vfree(c->ileb_buf);
+ c->ileb_buf = NULL;
+ ubifs_lpt_free(c, 1);
+ c->remounting_rw = 0;
+- c->always_chk_crc = 0;
+ mutex_unlock(&c->umount_mutex);
+ return err;
+ }
+@@ -1696,9 +1751,10 @@ static void ubifs_remount_ro(struct ubifs_info *c)
+ if (err)
+ ubifs_ro_mode(c, err);
+
+- free_wbufs(c);
+ vfree(c->orph_buf);
+ c->orph_buf = NULL;
++ kfree(c->write_reserve_buf);
++ c->write_reserve_buf = NULL;
+ vfree(c->ileb_buf);
+ c->ileb_buf = NULL;
+ ubifs_lpt_free(c, 1);
+@@ -1722,10 +1778,11 @@ static void ubifs_put_super(struct super_block *sb)
+ * of the media. For example, there will be dirty inodes if we failed
+ * to write them back because of I/O errors.
+ */
+- ubifs_assert(atomic_long_read(&c->dirty_pg_cnt) == 0);
+- ubifs_assert(c->budg_idx_growth == 0);
+- ubifs_assert(c->budg_dd_growth == 0);
+- ubifs_assert(c->budg_data_growth == 0);
++ if (!c->ro_error) {
++ ubifs_assert(c->bi.idx_growth == 0);
++ ubifs_assert(c->bi.dd_growth == 0);
++ ubifs_assert(c->bi.data_growth == 0);
++ }
+
+ /*
+ * The 'c->umount_lock' prevents races between UBIFS memory shrinker
+@@ -1929,6 +1986,7 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
+ mutex_init(&c->mst_mutex);
+ mutex_init(&c->umount_mutex);
+ mutex_init(&c->bu_mutex);
++ mutex_init(&c->write_reserve_mutex);
+ init_waitqueue_head(&c->cmt_wq);
+ c->buds = RB_ROOT;
+ c->old_idx = RB_ROOT;
+@@ -1946,6 +2004,7 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
+ INIT_LIST_HEAD(&c->old_buds);
+ INIT_LIST_HEAD(&c->orph_list);
+ INIT_LIST_HEAD(&c->orph_new);
++ c->no_chk_data_crc = 1;
+
+ c->vfs_sb = sb;
+ c->highest_inum = UBIFS_FIRST_INO;
+diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
+index ad9cf01..16ad84d 100644
+--- a/fs/ubifs/tnc.c
++++ b/fs/ubifs/tnc.c
+@@ -223,7 +223,7 @@ static struct ubifs_znode *copy_znode(struct ubifs_info *c,
+ __set_bit(DIRTY_ZNODE, &zn->flags);
+ __clear_bit(COW_ZNODE, &zn->flags);
+
+- ubifs_assert(!test_bit(OBSOLETE_ZNODE, &znode->flags));
++ ubifs_assert(!ubifs_zn_obsolete(znode));
+ __set_bit(OBSOLETE_ZNODE, &znode->flags);
+
+ if (znode->level != 0) {
+@@ -271,7 +271,7 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
+ struct ubifs_znode *zn;
+ int err;
+
+- if (!test_bit(COW_ZNODE, &znode->flags)) {
++ if (!ubifs_zn_cow(znode)) {
+ /* znode is not being committed */
+ if (!test_and_set_bit(DIRTY_ZNODE, &znode->flags)) {
+ atomic_long_inc(&c->dirty_zn_cnt);
+@@ -344,12 +344,11 @@ static int lnc_add(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ return err;
+ }
+
+- lnc_node = kmalloc(zbr->len, GFP_NOFS);
++ lnc_node = kmemdup(node, zbr->len, GFP_NOFS);
+ if (!lnc_node)
+ /* We don't have to have the cache, so no error */
+ return 0;
+
+- memcpy(lnc_node, node, zbr->len);
+ zbr->leaf = lnc_node;
+ return 0;
+ }
+@@ -447,8 +446,11 @@ static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ *
+ * Note, this function does not check CRC of data nodes if @c->no_chk_data_crc
+ * is true (it is controlled by corresponding mount option). However, if
+- * @c->always_chk_crc is true, @c->no_chk_data_crc is ignored and CRC is always
+- * checked.
++ * @c->mounting or @c->remounting_rw is true (we are mounting or re-mounting to
++ * R/W mode), @c->no_chk_data_crc is ignored and CRC is checked. This is
++ * because during mounting or re-mounting from R/O mode to R/W mode we may read
++ * journal nodes (when replying the journal or doing the recovery) and the
++ * journal nodes may potentially be corrupted, so checking is required.
+ */
+ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+ int len, int lnum, int offs)
+@@ -459,7 +461,7 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+
+ dbg_io("LEB %d:%d, %s, length %d", lnum, offs, dbg_ntype(type), len);
+
+- err = ubi_read(c->ubi, lnum, buf, offs, len);
++ err = ubifs_leb_read(c, lnum, buf, offs, len, 1);
+ if (err) {
+ ubifs_err("cannot read node type %d from LEB %d:%d, error %d",
+ type, lnum, offs, err);
+@@ -476,7 +478,8 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+ if (node_len != len)
+ return 0;
+
+- if (type == UBIFS_DATA_NODE && !c->always_chk_crc && c->no_chk_data_crc)
++ if (type == UBIFS_DATA_NODE && c->no_chk_data_crc && !c->mounting &&
++ !c->remounting_rw)
+ return 1;
+
+ crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
+@@ -502,7 +505,7 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
+ {
+ int ret;
+
+- dbg_tnc("LEB %d:%d, key %s", zbr->lnum, zbr->offs, DBGKEY(key));
++ dbg_tnck(key, "LEB %d:%d, key ", zbr->lnum, zbr->offs);
+
+ ret = try_read_node(c, node, key_type(c, key), zbr->len, zbr->lnum,
+ zbr->offs);
+@@ -516,8 +519,8 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
+ ret = 0;
+ }
+ if (ret == 0 && c->replaying)
+- dbg_mnt("dangling branch LEB %d:%d len %d, key %s",
+- zbr->lnum, zbr->offs, zbr->len, DBGKEY(key));
++ dbg_mntk(key, "dangling branch LEB %d:%d len %d, key ",
++ zbr->lnum, zbr->offs, zbr->len);
+ return ret;
+ }
+
+@@ -992,9 +995,9 @@ static int fallible_resolve_collision(struct ubifs_info *c,
+ if (adding || !o_znode)
+ return 0;
+
+- dbg_mnt("dangling match LEB %d:%d len %d %s",
++ dbg_mntk(key, "dangling match LEB %d:%d len %d key ",
+ o_znode->zbranch[o_n].lnum, o_znode->zbranch[o_n].offs,
+- o_znode->zbranch[o_n].len, DBGKEY(key));
++ o_znode->zbranch[o_n].len);
+ *zn = o_znode;
+ *n = o_n;
+ return 1;
+@@ -1176,7 +1179,7 @@ int ubifs_lookup_level0(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+ unsigned long time = get_seconds();
+
+- dbg_tnc("search key %s", DBGKEY(key));
++ dbg_tnck(key, "search key ");
+ ubifs_assert(key_type(c, key) < UBIFS_INVALID_KEY);
+
+ znode = c->zroot.znode;
+@@ -1312,7 +1315,7 @@ static int lookup_level0_dirty(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+ unsigned long time = get_seconds();
+
+- dbg_tnc("search and dirty key %s", DBGKEY(key));
++ dbg_tnck(key, "search and dirty key ");
+
+ znode = c->zroot.znode;
+ if (unlikely(!znode)) {
+@@ -1662,7 +1665,7 @@ static int read_wbuf(struct ubifs_wbuf *wbuf, void *buf, int len, int lnum,
+ if (!overlap) {
+ /* We may safely unlock the write-buffer and read the data */
+ spin_unlock(&wbuf->lock);
+- return ubi_read(c->ubi, lnum, buf, offs, len);
++ return ubifs_leb_read(c, lnum, buf, offs, len, 0);
+ }
+
+ /* Don't read under wbuf */
+@@ -1676,7 +1679,7 @@ static int read_wbuf(struct ubifs_wbuf *wbuf, void *buf, int len, int lnum,
+
+ if (rlen > 0)
+ /* Read everything that goes before write-buffer */
+- return ubi_read(c->ubi, lnum, buf, offs, rlen);
++ return ubifs_leb_read(c, lnum, buf, offs, rlen, 0);
+
+ return 0;
+ }
+@@ -1719,8 +1722,8 @@ static int validate_data_node(struct ubifs_info *c, void *buf,
+ if (!keys_eq(c, &zbr->key, &key1)) {
+ ubifs_err("bad key in node at LEB %d:%d",
+ zbr->lnum, zbr->offs);
+- dbg_tnc("looked for key %s found node's key %s",
+- DBGKEY(&zbr->key), DBGKEY1(&key1));
++ dbg_tnck(&zbr->key, "looked for key ");
++ dbg_tnck(&key1, "found node's key ");
+ goto out_err;
+ }
+
+@@ -1763,7 +1766,7 @@ int ubifs_tnc_bulk_read(struct ubifs_info *c, struct bu_info *bu)
+ if (wbuf)
+ err = read_wbuf(wbuf, bu->buf, len, lnum, offs);
+ else
+- err = ubi_read(c->ubi, lnum, bu->buf, offs, len);
++ err = ubifs_leb_read(c, lnum, bu->buf, offs, len, 0);
+
+ /* Check for a race with GC */
+ if (maybe_leb_gced(c, lnum, bu->gc_seq))
+@@ -1773,7 +1776,7 @@ int ubifs_tnc_bulk_read(struct ubifs_info *c, struct bu_info *bu)
+ ubifs_err("failed to read from LEB %d:%d, error %d",
+ lnum, offs, err);
+ dbg_dump_stack();
+- dbg_tnc("key %s", DBGKEY(&bu->key));
++ dbg_tnck(&bu->key, "key ");
+ return err;
+ }
+
+@@ -1808,7 +1811,7 @@ static int do_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
+ int found, n, err;
+ struct ubifs_znode *znode;
+
+- dbg_tnc("name '%.*s' key %s", nm->len, nm->name, DBGKEY(key));
++ dbg_tnck(key, "name '%.*s' key ", nm->len, nm->name);
+ mutex_lock(&c->tnc_mutex);
+ found = ubifs_lookup_level0(c, key, &znode, &n);
+ if (!found) {
+@@ -1982,8 +1985,7 @@ again:
+ zp = znode->parent;
+ if (znode->child_cnt < c->fanout) {
+ ubifs_assert(n != c->fanout);
+- dbg_tnc("inserted at %d level %d, key %s", n, znode->level,
+- DBGKEY(key));
++ dbg_tnck(key, "inserted at %d level %d, key ", n, znode->level);
+
+ insert_zbranch(znode, zbr, n);
+
+@@ -1998,7 +2000,7 @@ again:
+ * Unfortunately, @znode does not have more empty slots and we have to
+ * split it.
+ */
+- dbg_tnc("splitting level %d, key %s", znode->level, DBGKEY(key));
++ dbg_tnck(key, "splitting level %d, key ", znode->level);
+
+ if (znode->alt)
+ /*
+@@ -2092,7 +2094,7 @@ do_split:
+ }
+
+ /* Insert new key and branch */
+- dbg_tnc("inserting at %d level %d, key %s", n, zn->level, DBGKEY(key));
++ dbg_tnck(key, "inserting at %d level %d, key ", n, zn->level);
+
+ insert_zbranch(zi, zbr, n);
+
+@@ -2168,7 +2170,7 @@ int ubifs_tnc_add(struct ubifs_info *c, const union ubifs_key *key, int lnum,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("%d:%d, len %d, key %s", lnum, offs, len, DBGKEY(key));
++ dbg_tnck(key, "%d:%d, len %d, key ", lnum, offs, len);
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (!found) {
+ struct ubifs_zbranch zbr;
+@@ -2217,8 +2219,8 @@ int ubifs_tnc_replace(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("old LEB %d:%d, new LEB %d:%d, len %d, key %s", old_lnum,
+- old_offs, lnum, offs, len, DBGKEY(key));
++ dbg_tnck(key, "old LEB %d:%d, new LEB %d:%d, len %d, key ", old_lnum,
++ old_offs, lnum, offs, len);
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (found < 0) {
+ err = found;
+@@ -2300,8 +2302,8 @@ int ubifs_tnc_add_nm(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("LEB %d:%d, name '%.*s', key %s", lnum, offs, nm->len, nm->name,
+- DBGKEY(key));
++ dbg_tnck(key, "LEB %d:%d, name '%.*s', key ",
++ lnum, offs, nm->len, nm->name);
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (found < 0) {
+ err = found;
+@@ -2394,7 +2396,7 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
+ /* Delete without merge for now */
+ ubifs_assert(znode->level == 0);
+ ubifs_assert(n >= 0 && n < c->fanout);
+- dbg_tnc("deleting %s", DBGKEY(&znode->zbranch[n].key));
++ dbg_tnck(&znode->zbranch[n].key, "deleting key ");
+
+ zbr = &znode->zbranch[n];
+ lnc_free(zbr);
+@@ -2419,7 +2421,7 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
+ */
+
+ do {
+- ubifs_assert(!test_bit(OBSOLETE_ZNODE, &znode->flags));
++ ubifs_assert(!ubifs_zn_obsolete(znode));
+ ubifs_assert(ubifs_zn_dirty(znode));
+
+ zp = znode->parent;
+@@ -2475,9 +2477,8 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
+ c->zroot.offs = zbr->offs;
+ c->zroot.len = zbr->len;
+ c->zroot.znode = znode;
+- ubifs_assert(!test_bit(OBSOLETE_ZNODE,
+- &zp->flags));
+- ubifs_assert(test_bit(DIRTY_ZNODE, &zp->flags));
++ ubifs_assert(!ubifs_zn_obsolete(zp));
++ ubifs_assert(ubifs_zn_dirty(zp));
+ atomic_long_dec(&c->dirty_zn_cnt);
+
+ if (zp->cnext) {
+@@ -2505,7 +2506,7 @@ int ubifs_tnc_remove(struct ubifs_info *c, const union ubifs_key *key)
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("key %s", DBGKEY(key));
++ dbg_tnck(key, "key ");
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (found < 0) {
+ err = found;
+@@ -2536,7 +2537,7 @@ int ubifs_tnc_remove_nm(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("%.*s, key %s", nm->len, nm->name, DBGKEY(key));
++ dbg_tnck(key, "%.*s, key ", nm->len, nm->name);
+ err = lookup_level0_dirty(c, key, &znode, &n);
+ if (err < 0)
+ goto out_unlock;
+@@ -2553,11 +2554,11 @@ int ubifs_tnc_remove_nm(struct ubifs_info *c, const union ubifs_key *key,
+ if (err) {
+ /* Ensure the znode is dirtied */
+ if (znode->cnext || !ubifs_zn_dirty(znode)) {
+- znode = dirty_cow_bottom_up(c, znode);
+- if (IS_ERR(znode)) {
+- err = PTR_ERR(znode);
+- goto out_unlock;
+- }
++ znode = dirty_cow_bottom_up(c, znode);
++ if (IS_ERR(znode)) {
++ err = PTR_ERR(znode);
++ goto out_unlock;
++ }
+ }
+ err = tnc_delete(c, znode, n);
+ }
+@@ -2651,7 +2652,7 @@ int ubifs_tnc_remove_range(struct ubifs_info *c, union ubifs_key *from_key,
+ dbg_dump_znode(c, znode);
+ goto out_unlock;
+ }
+- dbg_tnc("removing %s", DBGKEY(key));
++ dbg_tnck(key, "removing key ");
+ }
+ if (k) {
+ for (i = n + 1 + k; i < znode->child_cnt; i++)
+@@ -2771,7 +2772,7 @@ struct ubifs_dent_node *ubifs_tnc_next_ent(struct ubifs_info *c,
+ struct ubifs_zbranch *zbr;
+ union ubifs_key *dkey;
+
+- dbg_tnc("%s %s", nm->name ? (char *)nm->name : "(lowest)", DBGKEY(key));
++ dbg_tnck(key, "%s ", nm->name ? (char *)nm->name : "(lowest)");
+ ubifs_assert(is_hash_key(c, key));
+
+ mutex_lock(&c->tnc_mutex);
+@@ -2861,7 +2862,7 @@ static void tnc_destroy_cnext(struct ubifs_info *c)
+ struct ubifs_znode *znode = cnext;
+
+ cnext = cnext->cnext;
+- if (test_bit(OBSOLETE_ZNODE, &znode->flags))
++ if (ubifs_zn_obsolete(znode))
+ kfree(znode);
+ } while (cnext && cnext != c->cnext);
+ }
+@@ -2872,12 +2873,13 @@ static void tnc_destroy_cnext(struct ubifs_info *c)
+ */
+ void ubifs_tnc_close(struct ubifs_info *c)
+ {
+- long clean_freed;
+-
+ tnc_destroy_cnext(c);
+ if (c->zroot.znode) {
+- clean_freed = ubifs_destroy_tnc_subtree(c->zroot.znode);
+- atomic_long_sub(clean_freed, &ubifs_clean_zn_cnt);
++ long n;
++
++ ubifs_destroy_tnc_subtree(c->zroot.znode);
++ n = atomic_long_read(&c->clean_zn_cnt);
++ atomic_long_sub(n, &ubifs_clean_zn_cnt);
+ }
+ kfree(c->gap_lebs);
+ kfree(c->ilebs);
+@@ -3296,7 +3298,7 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ block = (size + UBIFS_BLOCK_SIZE - 1) >> UBIFS_BLOCK_SHIFT;
+@@ -3329,12 +3331,13 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+
+ out_dump:
+ block = key_block(c, key);
+- ubifs_err("inode %lu has size %lld, but there are data at offset %lld "
+- "(data key %s)", (unsigned long)inode->i_ino, size,
+- ((loff_t)block) << UBIFS_BLOCK_SHIFT, DBGKEY(key));
++ ubifs_err("inode %lu has size %lld, but there are data at offset %lld",
++ (unsigned long)inode->i_ino, size,
++ ((loff_t)block) << UBIFS_BLOCK_SHIFT);
++ mutex_unlock(&c->tnc_mutex);
+ dbg_dump_inode(c, inode);
+ dbg_dump_stack();
+- err = -EINVAL;
++ return -EINVAL;
+
+ out_unlock:
+ mutex_unlock(&c->tnc_mutex);
+diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
+index 53288e5..4c15f07 100644
+--- a/fs/ubifs/tnc_commit.c
++++ b/fs/ubifs/tnc_commit.c
+@@ -22,6 +22,7 @@
+
+ /* This file implements TNC functions for committing */
+
++#include <linux/random.h>
+ #include "ubifs.h"
+
+ /**
+@@ -87,8 +88,12 @@ static int make_idx_node(struct ubifs_info *c, struct ubifs_idx_node *idx,
+ atomic_long_dec(&c->dirty_zn_cnt);
+
+ ubifs_assert(ubifs_zn_dirty(znode));
+- ubifs_assert(test_bit(COW_ZNODE, &znode->flags));
++ ubifs_assert(ubifs_zn_cow(znode));
+
++ /*
++ * Note, unlike 'write_index()' we do not add memory barriers here
++ * because this function is called with @c->tnc_mutex locked.
++ */
+ __clear_bit(DIRTY_ZNODE, &znode->flags);
+ __clear_bit(COW_ZNODE, &znode->flags);
+
+@@ -377,15 +382,13 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ c->gap_lebs = NULL;
+ return err;
+ }
+- if (!dbg_force_in_the_gaps_enabled) {
++ if (!dbg_is_chk_index(c)) {
+ /*
+ * Do not print scary warnings if the debugging
+ * option which forces in-the-gaps is enabled.
+ */
+- ubifs_err("out of space");
+- spin_lock(&c->space_lock);
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
++ ubifs_warn("out of space");
++ dbg_dump_budg(c, &c->bi);
+ dbg_dump_lprops(c);
+ }
+ /* Try to commit anyway */
+@@ -493,25 +496,6 @@ static int layout_in_empty_space(struct ubifs_info *c)
+ else
+ next_len = ubifs_idx_node_sz(c, cnext->child_cnt);
+
+- if (c->min_io_size == 1) {
+- buf_offs += ALIGN(len, 8);
+- if (next_len) {
+- if (buf_offs + next_len <= c->leb_size)
+- continue;
+- err = ubifs_update_one_lp(c, lnum, 0,
+- c->leb_size - buf_offs, 0, 0);
+- if (err)
+- return err;
+- lnum = -1;
+- continue;
+- }
+- err = ubifs_update_one_lp(c, lnum,
+- c->leb_size - buf_offs, 0, 0, 0);
+- if (err)
+- return err;
+- break;
+- }
+-
+ /* Update buffer positions */
+ wlen = used + len;
+ used += ALIGN(len, 8);
+@@ -660,7 +644,7 @@ static int get_znodes_to_commit(struct ubifs_info *c)
+ }
+ cnt += 1;
+ while (1) {
+- ubifs_assert(!test_bit(COW_ZNODE, &znode->flags));
++ ubifs_assert(!ubifs_zn_cow(znode));
+ __set_bit(COW_ZNODE, &znode->flags);
+ znode->alt = 0;
+ cnext = find_next_dirty(znode);
+@@ -706,7 +690,7 @@ static int alloc_idx_lebs(struct ubifs_info *c, int cnt)
+ c->ilebs[c->ileb_cnt++] = lnum;
+ dbg_cmt("LEB %d", lnum);
+ }
+- if (dbg_force_in_the_gaps())
++ if (dbg_is_chk_index(c) && !(random32() & 7))
+ return -ENOSPC;
+ return 0;
+ }
+@@ -796,16 +780,16 @@ int ubifs_tnc_start_commit(struct ubifs_info *c, struct ubifs_zbranch *zroot)
+ spin_lock(&c->space_lock);
+ /*
+ * Although we have not finished committing yet, update size of the
+- * committed index ('c->old_idx_sz') and zero out the index growth
++ * committed index ('c->bi.old_idx_sz') and zero out the index growth
+ * budget. It is OK to do this now, because we've reserved all the
+ * space which is needed to commit the index, and it is save for the
+ * budgeting subsystem to assume the index is already committed,
+ * even though it is not.
+ */
+- ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
+- c->old_idx_sz = c->calc_idx_sz;
+- c->budg_uncommitted_idx = 0;
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ ubifs_assert(c->bi.min_idx_lebs == ubifs_calc_min_idx_lebs(c));
++ c->bi.old_idx_sz = c->calc_idx_sz;
++ c->bi.uncommitted_idx = 0;
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+ spin_unlock(&c->space_lock);
+ mutex_unlock(&c->tnc_mutex);
+
+@@ -832,7 +816,7 @@ static int write_index(struct ubifs_info *c)
+ struct ubifs_idx_node *idx;
+ struct ubifs_znode *znode, *cnext;
+ int i, lnum, offs, len, next_len, buf_len, buf_offs, used;
+- int avail, wlen, err, lnum_pos = 0;
++ int avail, wlen, err, lnum_pos = 0, blen, nxt_offs;
+
+ cnext = c->enext;
+ if (!cnext)
+@@ -909,7 +893,7 @@ static int write_index(struct ubifs_info *c)
+ cnext = znode->cnext;
+
+ ubifs_assert(ubifs_zn_dirty(znode));
+- ubifs_assert(test_bit(COW_ZNODE, &znode->flags));
++ ubifs_assert(ubifs_zn_cow(znode));
+
+ /*
+ * It is important that other threads should see %DIRTY_ZNODE
+@@ -924,6 +908,28 @@ static int write_index(struct ubifs_info *c)
+ clear_bit(COW_ZNODE, &znode->flags);
+ smp_mb__after_clear_bit();
+
++ /*
++ * We have marked the znode as clean but have not updated the
++ * @c->clean_zn_cnt counter. If this znode becomes dirty again
++ * before 'free_obsolete_znodes()' is called, then
++ * @c->clean_zn_cnt will be decremented before it gets
++ * incremented (resulting in 2 decrements for the same znode).
++ * This means that @c->clean_zn_cnt may become negative for a
++ * while.
++ *
++ * Q: why we cannot increment @c->clean_zn_cnt?
++ * A: because we do not have the @c->tnc_mutex locked, and the
++ * following code would be racy and buggy:
++ *
++ * if (!ubifs_zn_obsolete(znode)) {
++ * atomic_long_inc(&c->clean_zn_cnt);
++ * atomic_long_inc(&ubifs_clean_zn_cnt);
++ * }
++ *
++ * Thus, we just delay the @c->clean_zn_cnt update until we
++ * have the mutex locked.
++ */
++
+ /* Do not access znode from this point on */
+
+ /* Update buffer positions */
+@@ -940,65 +946,38 @@ static int write_index(struct ubifs_info *c)
+ else
+ next_len = ubifs_idx_node_sz(c, cnext->child_cnt);
+
+- if (c->min_io_size == 1) {
+- /*
+- * Write the prepared index node immediately if there is
+- * no minimum IO size
+- */
+- err = ubifs_leb_write(c, lnum, c->cbuf, buf_offs,
+- wlen, UBI_SHORTTERM);
+- if (err)
+- return err;
+- buf_offs += ALIGN(wlen, 8);
+- if (next_len) {
+- used = 0;
+- avail = buf_len;
+- if (buf_offs + next_len > c->leb_size) {
+- err = ubifs_update_one_lp(c, lnum,
+- LPROPS_NC, 0, 0, LPROPS_TAKEN);
+- if (err)
+- return err;
+- lnum = -1;
+- }
++ nxt_offs = buf_offs + used + next_len;
++ if (next_len && nxt_offs <= c->leb_size) {
++ if (avail > 0)
+ continue;
+- }
++ else
++ blen = buf_len;
+ } else {
+- int blen, nxt_offs = buf_offs + used + next_len;
+-
+- if (next_len && nxt_offs <= c->leb_size) {
+- if (avail > 0)
+- continue;
+- else
+- blen = buf_len;
+- } else {
+- wlen = ALIGN(wlen, 8);
+- blen = ALIGN(wlen, c->min_io_size);
+- ubifs_pad(c, c->cbuf + wlen, blen - wlen);
+- }
+- /*
+- * The buffer is full or there are no more znodes
+- * to do
+- */
+- err = ubifs_leb_write(c, lnum, c->cbuf, buf_offs,
+- blen, UBI_SHORTTERM);
+- if (err)
+- return err;
+- buf_offs += blen;
+- if (next_len) {
+- if (nxt_offs > c->leb_size) {
+- err = ubifs_update_one_lp(c, lnum,
+- LPROPS_NC, 0, 0, LPROPS_TAKEN);
+- if (err)
+- return err;
+- lnum = -1;
+- }
+- used -= blen;
+- if (used < 0)
+- used = 0;
+- avail = buf_len - used;
+- memmove(c->cbuf, c->cbuf + blen, used);
+- continue;
++ wlen = ALIGN(wlen, 8);
++ blen = ALIGN(wlen, c->min_io_size);
++ ubifs_pad(c, c->cbuf + wlen, blen - wlen);
++ }
++
++ /* The buffer is full or there are no more znodes to do */
++ err = ubifs_leb_write(c, lnum, c->cbuf, buf_offs, blen,
++ UBI_SHORTTERM);
++ if (err)
++ return err;
++ buf_offs += blen;
++ if (next_len) {
++ if (nxt_offs > c->leb_size) {
++ err = ubifs_update_one_lp(c, lnum, LPROPS_NC, 0,
++ 0, LPROPS_TAKEN);
++ if (err)
++ return err;
++ lnum = -1;
+ }
++ used -= blen;
++ if (used < 0)
++ used = 0;
++ avail = buf_len - used;
++ memmove(c->cbuf, c->cbuf + blen, used);
++ continue;
+ }
+ break;
+ }
+@@ -1031,7 +1010,7 @@ static void free_obsolete_znodes(struct ubifs_info *c)
+ do {
+ znode = cnext;
+ cnext = znode->cnext;
+- if (test_bit(OBSOLETE_ZNODE, &znode->flags))
++ if (ubifs_zn_obsolete(znode))
+ kfree(znode);
+ else {
+ znode->cnext = NULL;
+diff --git a/fs/ubifs/tnc_misc.c b/fs/ubifs/tnc_misc.c
+index b48db99..dc28fe6 100644
+--- a/fs/ubifs/tnc_misc.c
++++ b/fs/ubifs/tnc_misc.c
+@@ -328,8 +328,8 @@ static int read_znode(struct ubifs_info *c, int lnum, int offs, int len,
+ case UBIFS_XENT_KEY:
+ break;
+ default:
+- dbg_msg("bad key type at slot %d: %s", i,
+- DBGKEY(&zbr->key));
++ dbg_msg("bad key type at slot %d: %d",
++ i, key_type(c, &zbr->key));
+ err = 3;
+ goto out_dump;
+ }
+@@ -475,7 +475,7 @@ int ubifs_tnc_read_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ zbr->offs);
+
+ if (err) {
+- dbg_tnc("key %s", DBGKEY(key));
++ dbg_tnck(key, "key ");
+ return err;
+ }
+
+@@ -484,8 +484,8 @@ int ubifs_tnc_read_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ if (!keys_eq(c, key, &key1)) {
+ ubifs_err("bad key in node at LEB %d:%d",
+ zbr->lnum, zbr->offs);
+- dbg_tnc("looked for key %s found node's key %s",
+- DBGKEY(key), DBGKEY1(&key1));
++ dbg_tnck(key, "looked for key ");
++ dbg_tnck(&key1, "but found node's key ");
+ dbg_dump_node(c, node);
+ return -EINVAL;
+ }
+diff --git a/fs/ubifs/ubifs-media.h b/fs/ubifs/ubifs-media.h
+index 191ca78..e24380c 100644
+--- a/fs/ubifs/ubifs-media.h
++++ b/fs/ubifs/ubifs-media.h
+@@ -408,9 +408,11 @@ enum {
+ * Superblock flags.
+ *
+ * UBIFS_FLG_BIGLPT: if "big" LPT model is used if set
++ * UBIFS_FLG_SPACE_FIXUP: first-mount "fixup" of free space within LEBs needed
+ */
+ enum {
+ UBIFS_FLG_BIGLPT = 0x02,
++ UBIFS_FLG_SPACE_FIXUP = 0x04,
+ };
+
+ /**
+@@ -434,7 +436,7 @@ struct ubifs_ch {
+ __u8 node_type;
+ __u8 group_type;
+ __u8 padding[2];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * union ubifs_dev_desc - device node descriptor.
+@@ -448,7 +450,7 @@ struct ubifs_ch {
+ union ubifs_dev_desc {
+ __le32 new;
+ __le64 huge;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_ino_node - inode node.
+@@ -509,7 +511,7 @@ struct ubifs_ino_node {
+ __le16 compr_type;
+ __u8 padding2[26]; /* Watch 'zero_ino_node_unused()' if changing! */
+ __u8 data[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_dent_node - directory entry node.
+@@ -534,7 +536,7 @@ struct ubifs_dent_node {
+ __le16 nlen;
+ __u8 padding2[4]; /* Watch 'zero_dent_node_unused()' if changing! */
+ __u8 name[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_data_node - data node.
+@@ -555,7 +557,7 @@ struct ubifs_data_node {
+ __le16 compr_type;
+ __u8 padding[2]; /* Watch 'zero_data_node_unused()' if changing! */
+ __u8 data[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_trun_node - truncation node.
+@@ -575,7 +577,7 @@ struct ubifs_trun_node {
+ __u8 padding[12]; /* Watch 'zero_trun_node_unused()' if changing! */
+ __le64 old_size;
+ __le64 new_size;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_pad_node - padding node.
+@@ -586,7 +588,7 @@ struct ubifs_trun_node {
+ struct ubifs_pad_node {
+ struct ubifs_ch ch;
+ __le32 pad_len;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_sb_node - superblock node.
+@@ -644,7 +646,7 @@ struct ubifs_sb_node {
+ __u8 uuid[16];
+ __le32 ro_compat_version;
+ __u8 padding2[3968];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_mst_node - master node.
+@@ -711,7 +713,7 @@ struct ubifs_mst_node {
+ __le32 idx_lebs;
+ __le32 leb_cnt;
+ __u8 padding[344];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_ref_node - logical eraseblock reference node.
+@@ -727,7 +729,7 @@ struct ubifs_ref_node {
+ __le32 offs;
+ __le32 jhead;
+ __u8 padding[28];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_branch - key/reference/length branch
+@@ -741,7 +743,7 @@ struct ubifs_branch {
+ __le32 offs;
+ __le32 len;
+ __u8 key[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_idx_node - indexing node.
+@@ -755,7 +757,7 @@ struct ubifs_idx_node {
+ __le16 child_cnt;
+ __le16 level;
+ __u8 branches[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_cs_node - commit start node.
+@@ -765,7 +767,7 @@ struct ubifs_idx_node {
+ struct ubifs_cs_node {
+ struct ubifs_ch ch;
+ __le64 cmt_no;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_orph_node - orphan node.
+@@ -777,6 +779,6 @@ struct ubifs_orph_node {
+ struct ubifs_ch ch;
+ __le64 cmt_no;
+ __le64 inos[];
+-} __attribute__ ((packed));
++} __packed;
+
+ #endif /* __UBIFS_MEDIA_H__ */
+diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
+index 381d6b2..caf9e4b 100644
+--- a/fs/ubifs/ubifs.h
++++ b/fs/ubifs/ubifs.h
+@@ -84,9 +84,6 @@
+ #define INUM_WARN_WATERMARK 0xFFF00000
+ #define INUM_WATERMARK 0xFFFFFF00
+
+-/* Largest key size supported in this implementation */
+-#define CUR_MAX_KEY_LEN UBIFS_SK_LEN
+-
+ /* Maximum number of entries in each LPT (LEB category) heap */
+ #define LPT_HEAP_SZ 256
+
+@@ -151,6 +148,12 @@
+ */
+ #define WORST_COMPR_FACTOR 2
+
++/*
++ * How much memory is needed for a buffer where we comress a data node.
++ */
++#define COMPRESSED_DATA_NODE_BUF_SZ \
++ (UBIFS_DATA_NODE_SZ + UBIFS_BLOCK_SIZE * WORST_COMPR_FACTOR)
++
+ /* Maximum expected tree height for use by bottom_up_buf */
+ #define BOTTOM_UP_HEIGHT 64
+
+@@ -224,14 +227,14 @@ enum {
+ * LPT cnode flag bits.
+ *
+ * DIRTY_CNODE: cnode is dirty
+- * COW_CNODE: cnode is being committed and must be copied before writing
+ * OBSOLETE_CNODE: cnode is being committed and has been copied (or deleted),
+- * so it can (and must) be freed when the commit is finished
++ * so it can (and must) be freed when the commit is finished
++ * COW_CNODE: cnode is being committed and must be copied before writing
+ */
+ enum {
+ DIRTY_CNODE = 0,
+- COW_CNODE = 1,
+- OBSOLETE_CNODE = 2,
++ OBSOLETE_CNODE = 1,
++ COW_CNODE = 2,
+ };
+
+ /*
+@@ -271,10 +274,10 @@ struct ubifs_old_idx {
+
+ /* The below union makes it easier to deal with keys */
+ union ubifs_key {
+- uint8_t u8[CUR_MAX_KEY_LEN];
+- uint32_t u32[CUR_MAX_KEY_LEN/4];
+- uint64_t u64[CUR_MAX_KEY_LEN/8];
+- __le32 j32[CUR_MAX_KEY_LEN/4];
++ uint8_t u8[UBIFS_SK_LEN];
++ uint32_t u32[UBIFS_SK_LEN/4];
++ uint64_t u64[UBIFS_SK_LEN/8];
++ __le32 j32[UBIFS_SK_LEN/4];
+ };
+
+ /**
+@@ -383,9 +386,9 @@ struct ubifs_gced_idx_leb {
+ * The @ui_size is a "shadow" variable for @inode->i_size and UBIFS uses
+ * @ui_size instead of @inode->i_size. The reason for this is that UBIFS cannot
+ * make sure @inode->i_size is always changed under @ui_mutex, because it
+- * cannot call 'truncate_setsize()' with @ui_mutex locked, because it would deadlock
+- * with 'ubifs_writepage()' (see file.c). All the other inode fields are
+- * changed under @ui_mutex, so they do not need "shadow" fields. Note, one
++ * cannot call 'truncate_setsize()' with @ui_mutex locked, because it would
++ * deadlock with 'ubifs_writepage()' (see file.c). All the other inode fields
++ * are changed under @ui_mutex, so they do not need "shadow" fields. Note, one
+ * could consider to rework locking and base it on "shadow" fields.
+ */
+ struct ubifs_inode {
+@@ -646,6 +649,7 @@ typedef int (*ubifs_lpt_scan_callback)(struct ubifs_info *c,
+ * @offs: write-buffer offset in this logical eraseblock
+ * @avail: number of bytes available in the write-buffer
+ * @used: number of used bytes in the write-buffer
++ * @size: write-buffer size (in [@c->min_io_size, @c->max_write_size] range)
+ * @dtype: type of data stored in this LEB (%UBI_LONGTERM, %UBI_SHORTTERM,
+ * %UBI_UNKNOWN)
+ * @jhead: journal head the mutex belongs to (note, needed only to shut lockdep
+@@ -680,6 +684,7 @@ struct ubifs_wbuf {
+ int offs;
+ int avail;
+ int used;
++ int size;
+ int dtype;
+ int jhead;
+ int (*sync_callback)(struct ubifs_info *c, int lnum, int free, int pad);
+@@ -714,12 +719,14 @@ struct ubifs_bud {
+ * struct ubifs_jhead - journal head.
+ * @wbuf: head's write-buffer
+ * @buds_list: list of bud LEBs belonging to this journal head
++ * @grouped: non-zero if UBIFS groups nodes when writing to this journal head
+ *
+ * Note, the @buds list is protected by the @c->buds_lock.
+ */
+ struct ubifs_jhead {
+ struct ubifs_wbuf wbuf;
+ struct list_head buds_list;
++ unsigned int grouped:1;
+ };
+
+ /**
+@@ -929,6 +936,40 @@ struct ubifs_mount_opts {
+ unsigned int compr_type:2;
+ };
+
++/**
++ * struct ubifs_budg_info - UBIFS budgeting information.
++ * @idx_growth: amount of bytes budgeted for index growth
++ * @data_growth: amount of bytes budgeted for cached data
++ * @dd_growth: amount of bytes budgeted for cached data that will make
++ * other data dirty
++ * @uncommitted_idx: amount of bytes were budgeted for growth of the index, but
++ * which still have to be taken into account because the index
++ * has not been committed so far
++ * @old_idx_sz: size of index on flash
++ * @min_idx_lebs: minimum number of LEBs required for the index
++ * @nospace: non-zero if the file-system does not have flash space (used as
++ * optimization)
++ * @nospace_rp: the same as @nospace, but additionally means that even reserved
++ * pool is full
++ * @page_budget: budget for a page (constant, nenver changed after mount)
++ * @inode_budget: budget for an inode (constant, nenver changed after mount)
++ * @dent_budget: budget for a directory entry (constant, nenver changed after
++ * mount)
++ */
++struct ubifs_budg_info {
++ long long idx_growth;
++ long long data_growth;
++ long long dd_growth;
++ long long uncommitted_idx;
++ unsigned long long old_idx_sz;
++ int min_idx_lebs;
++ unsigned int nospace:1;
++ unsigned int nospace_rp:1;
++ int page_budget;
++ int inode_budget;
++ int dent_budget;
++};
++
+ struct ubifs_debug_info;
+
+ /**
+@@ -972,6 +1013,7 @@ struct ubifs_debug_info;
+ * @cmt_wq: wait queue to sleep on if the log is full and a commit is running
+ *
+ * @big_lpt: flag that LPT is too big to write whole during commit
++ * @space_fixup: flag indicating that free space in LEBs needs to be cleaned up
+ * @no_chk_data_crc: do not check CRCs when reading data nodes (except during
+ * recovery)
+ * @bulk_read: enable bulk-reads
+@@ -1003,6 +1045,11 @@ struct ubifs_debug_info;
+ * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu
+ * @bu: pre-allocated bulk-read information
+ *
++ * @write_reserve_mutex: protects @write_reserve_buf
++ * @write_reserve_buf: on the write path we allocate memory, which might
++ * sometimes be unavailable, in which case we use this
++ * write reserve buffer
++ *
+ * @log_lebs: number of logical eraseblocks in the log
+ * @log_bytes: log size in bytes
+ * @log_last: last LEB of the log
+@@ -1024,7 +1071,12 @@ struct ubifs_debug_info;
+ *
+ * @min_io_size: minimal input/output unit size
+ * @min_io_shift: number of bits in @min_io_size minus one
++ * @max_write_size: maximum amount of bytes the underlying flash can write at a
++ * time (MTD write buffer size)
++ * @max_write_shift: number of bits in @max_write_size minus one
+ * @leb_size: logical eraseblock size in bytes
++ * @leb_start: starting offset of logical eraseblocks within physical
++ * eraseblocks
+ * @half_leb_size: half LEB size
+ * @idx_leb_size: how many bytes of an LEB are effectively available when it is
+ * used to store indexing nodes (@leb_size - @max_idx_node_sz)
+@@ -1039,32 +1091,14 @@ struct ubifs_debug_info;
+ * @dirty_zn_cnt: number of dirty znodes
+ * @clean_zn_cnt: number of clean znodes
+ *
+- * @budg_idx_growth: amount of bytes budgeted for index growth
+- * @budg_data_growth: amount of bytes budgeted for cached data
+- * @budg_dd_growth: amount of bytes budgeted for cached data that will make
+- * other data dirty
+- * @budg_uncommitted_idx: amount of bytes were budgeted for growth of the index,
+- * but which still have to be taken into account because
+- * the index has not been committed so far
+- * @space_lock: protects @budg_idx_growth, @budg_data_growth, @budg_dd_growth,
+- * @budg_uncommited_idx, @min_idx_lebs, @old_idx_sz, @lst,
+- * @nospace, and @nospace_rp;
+- * @min_idx_lebs: minimum number of LEBs required for the index
+- * @old_idx_sz: size of index on flash
++ * @space_lock: protects @bi and @lst
++ * @lst: lprops statistics
++ * @bi: budgeting information
+ * @calc_idx_sz: temporary variable which is used to calculate new index size
+ * (contains accurate new index size at end of TNC commit start)
+- * @lst: lprops statistics
+- * @nospace: non-zero if the file-system does not have flash space (used as
+- * optimization)
+- * @nospace_rp: the same as @nospace, but additionally means that even reserved
+- * pool is full
+- *
+- * @page_budget: budget for a page
+- * @inode_budget: budget for an inode
+- * @dent_budget: budget for a directory entry
+ *
+ * @ref_node_alsz: size of the LEB reference node aligned to the min. flash
+- * I/O unit
++ * I/O unit
+ * @mst_node_alsz: master node aligned size
+ * @min_idx_node_sz: minimum indexing node aligned on 8-bytes boundary
+ * @max_idx_node_sz: maximum indexing node aligned on 8-bytes boundary
+@@ -1166,22 +1200,20 @@ struct ubifs_debug_info;
+ * @rp_uid: reserved pool user ID
+ * @rp_gid: reserved pool group ID
+ *
+- * @empty: if the UBI device is empty
+- * @replay_tree: temporary tree used during journal replay
++ * @empty: %1 if the UBI device is empty
++ * @need_recovery: %1 if the file-system needs recovery
++ * @replaying: %1 during journal replay
++ * @mounting: %1 while mounting
++ * @remounting_rw: %1 while re-mounting from R/O mode to R/W mode
+ * @replay_list: temporary list used during journal replay
+ * @replay_buds: list of buds to replay
+ * @cs_sqnum: sequence number of first node in the log (commit start node)
+ * @replay_sqnum: sequence number of node currently being replayed
+- * @need_recovery: file-system needs recovery
+- * @replaying: set to %1 during journal replay
+ * @unclean_leb_list: LEBs to recover when re-mounting R/O mounted FS to R/W
+ * mode
+ * @rcvrd_mst_node: recovered master node to write when re-mounting R/O mounted
+ * FS to R/W mode
+ * @size_tree: inode size information for recovery
+- * @remounting_rw: set while re-mounting from R/O mode to R/W mode
+- * @always_chk_crc: always check CRCs (while mounting and remounting to R/W
+- * mode)
+ * @mount_opts: UBIFS-specific mount options
+ *
+ * @dbg: debugging-related information
+@@ -1221,6 +1253,7 @@ struct ubifs_info {
+ wait_queue_head_t cmt_wq;
+
+ unsigned int big_lpt:1;
++ unsigned int space_fixup:1;
+ unsigned int no_chk_data_crc:1;
+ unsigned int bulk_read:1;
+ unsigned int default_compr:2;
+@@ -1250,6 +1283,9 @@ struct ubifs_info {
+ struct mutex bu_mutex;
+ struct bu_info bu;
+
++ struct mutex write_reserve_mutex;
++ void *write_reserve_buf;
++
+ int log_lebs;
+ long long log_bytes;
+ int log_last;
+@@ -1271,7 +1307,10 @@ struct ubifs_info {
+
+ int min_io_size;
+ int min_io_shift;
++ int max_write_size;
++ int max_write_shift;
+ int leb_size;
++ int leb_start;
+ int half_leb_size;
+ int idx_leb_size;
+ int leb_cnt;
+@@ -1285,21 +1324,10 @@ struct ubifs_info {
+ atomic_long_t dirty_zn_cnt;
+ atomic_long_t clean_zn_cnt;
+
+- long long budg_idx_growth;
+- long long budg_data_growth;
+- long long budg_dd_growth;
+- long long budg_uncommitted_idx;
+ spinlock_t space_lock;
+- int min_idx_lebs;
+- unsigned long long old_idx_sz;
+- unsigned long long calc_idx_sz;
+ struct ubifs_lp_stats lst;
+- unsigned int nospace:1;
+- unsigned int nospace_rp:1;
+-
+- int page_budget;
+- int inode_budget;
+- int dent_budget;
++ struct ubifs_budg_info bi;
++ unsigned long long calc_idx_sz;
+
+ int ref_node_alsz;
+ int mst_node_alsz;
+@@ -1402,19 +1430,18 @@ struct ubifs_info {
+ gid_t rp_gid;
+
+ /* The below fields are used only during mounting and re-mounting */
+- int empty;
+- struct rb_root replay_tree;
++ unsigned int empty:1;
++ unsigned int need_recovery:1;
++ unsigned int replaying:1;
++ unsigned int mounting:1;
++ unsigned int remounting_rw:1;
+ struct list_head replay_list;
+ struct list_head replay_buds;
+ unsigned long long cs_sqnum;
+ unsigned long long replay_sqnum;
+- int need_recovery;
+- int replaying;
+ struct list_head unclean_leb_list;
+ struct ubifs_mst_node *rcvrd_mst_node;
+ struct rb_root size_tree;
+- int remounting_rw;
+- int always_chk_crc;
+ struct ubifs_mount_opts mount_opts;
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+@@ -1438,6 +1465,15 @@ extern struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
+
+ /* io.c */
+ void ubifs_ro_mode(struct ubifs_info *c, int err);
++int ubifs_leb_read(const struct ubifs_info *c, int lnum, void *buf, int offs,
++ int len, int even_ebadmsg);
++int ubifs_leb_write(struct ubifs_info *c, int lnum, const void *buf, int offs,
++ int len, int dtype);
++int ubifs_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len,
++ int dtype);
++int ubifs_leb_unmap(struct ubifs_info *c, int lnum);
++int ubifs_leb_map(struct ubifs_info *c, int lnum, int dtype);
++int ubifs_is_mapped(const struct ubifs_info *c, int lnum);
+ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len);
+ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
+ int dtype);
+@@ -1605,6 +1641,7 @@ int ubifs_write_master(struct ubifs_info *c);
+ int ubifs_read_superblock(struct ubifs_info *c);
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c);
+ int ubifs_write_sb_node(struct ubifs_info *c, struct ubifs_sb_node *sup);
++int ubifs_fixup_free_space(struct ubifs_info *c);
+
+ /* replay.c */
+ int ubifs_validate_entry(struct ubifs_info *c,
+@@ -1713,11 +1750,11 @@ struct inode *ubifs_iget(struct super_block *sb, unsigned long inum);
+ int ubifs_recover_master_node(struct ubifs_info *c);
+ int ubifs_write_rcvrd_mst_node(struct ubifs_info *c);
+ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+- int offs, void *sbuf, int grouped);
++ int offs, void *sbuf, int jhead);
+ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
+ int offs, void *sbuf);
+-int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf);
+-int ubifs_clean_lebs(const struct ubifs_info *c, void *sbuf);
++int ubifs_recover_inl_heads(struct ubifs_info *c, void *sbuf);
++int ubifs_clean_lebs(struct ubifs_info *c, void *sbuf);
+ int ubifs_rcvry_gc_commit(struct ubifs_info *c);
+ int ubifs_recover_size_accum(struct ubifs_info *c, union ubifs_key *key,
+ int deletion, loff_t new_size);
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index c74400f..2fdc4fa 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -79,9 +79,9 @@ enum {
+ SECURITY_XATTR,
+ };
+
+-static const struct inode_operations none_inode_operations;
+-static const struct address_space_operations none_address_operations;
+-static const struct file_operations none_file_operations;
++static const struct inode_operations empty_iops;
++static const struct file_operations empty_fops;
++static struct address_space_operations empty_aops;
+
+ /**
+ * create_xattr - create an extended attribute.
+@@ -130,20 +130,19 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
+ }
+
+ /* Re-define all operations to be "nothing" */
+- inode->i_mapping->a_ops = &none_address_operations;
+- inode->i_op = &none_inode_operations;
+- inode->i_fop = &none_file_operations;
++ inode->i_mapping->a_ops = &empty_aops;
++ inode->i_op = &empty_iops;
++ inode->i_fop = &empty_fops;
+
+ inode->i_flags |= S_SYNC | S_NOATIME | S_NOCMTIME | S_NOQUOTA;
+ ui = ubifs_inode(inode);
+ ui->xattr = 1;
+ ui->flags |= UBIFS_XATTR_FL;
+- ui->data = kmalloc(size, GFP_NOFS);
++ ui->data = kmemdup(value, size, GFP_NOFS);
+ if (!ui->data) {
+ err = -ENOMEM;
+ goto out_free;
+ }
+- memcpy(ui->data, value, size);
+ inode->i_size = ui->ui_size = size;
+ ui->data_len = size;
+
+@@ -204,12 +203,11 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ return err;
+
+ kfree(ui->data);
+- ui->data = kmalloc(size, GFP_NOFS);
++ ui->data = kmemdup(value, size, GFP_NOFS);
+ if (!ui->data) {
+ err = -ENOMEM;
+ goto out_free;
+ }
+- memcpy(ui->data, value, size);
+ inode->i_size = ui->ui_size = size;
+ ui->data_len = size;
+
+diff --git a/include/linux/mtd/ubi.h b/include/linux/mtd/ubi.h
+index b31bd9e..db4836b 100644
+--- a/include/linux/mtd/ubi.h
++++ b/include/linux/mtd/ubi.h
+@@ -21,7 +21,7 @@
+ #ifndef __LINUX_UBI_H__
+ #define __LINUX_UBI_H__
+
+-#include <asm/ioctl.h>
++#include <linux/ioctl.h>
+ #include <linux/types.h>
+ #include <mtd/ubi-user.h>
+
+@@ -87,7 +87,7 @@ enum {
+ * physical eraseblock size and on how much bytes UBI headers consume. But
+ * because of the volume alignment (@alignment), the usable size of logical
+ * eraseblocks if a volume may be less. The following equation is true:
+- * @usable_leb_size = LEB size - (LEB size mod @alignment),
++ * @usable_leb_size = LEB size - (LEB size mod @alignment),
+ * where LEB size is the logical eraseblock size defined by the UBI device.
+ *
+ * The alignment is multiple to the minimal flash input/output unit size or %1
+@@ -116,29 +116,53 @@ struct ubi_volume_info {
+ * struct ubi_device_info - UBI device description data structure.
+ * @ubi_num: ubi device number
+ * @leb_size: logical eraseblock size on this UBI device
++ * @leb_start: starting offset of logical eraseblocks within physical
++ * eraseblocks
+ * @min_io_size: minimal I/O unit size
++ * @max_write_size: maximum amount of bytes the underlying flash can write at a
++ * time (MTD write buffer size)
+ * @ro_mode: if this device is in read-only mode
+ * @cdev: UBI character device major and minor numbers
+ *
+ * Note, @leb_size is the logical eraseblock size offered by the UBI device.
+ * Volumes of this UBI device may have smaller logical eraseblock size if their
+ * alignment is not equivalent to %1.
++ *
++ * The @max_write_size field describes flash write maximum write unit. For
++ * example, NOR flash allows for changing individual bytes, so @min_io_size is
++ * %1. However, it does not mean than NOR flash has to write data byte-by-byte.
++ * Instead, CFI NOR flashes have a write-buffer of, e.g., 64 bytes, and when
++ * writing large chunks of data, they write 64-bytes at a time. Obviously, this
++ * improves write throughput.
++ *
++ * Also, the MTD device may have N interleaved (striped) flash chips
++ * underneath, in which case @min_io_size can be physical min. I/O size of
++ * single flash chip, while @max_write_size can be N * @min_io_size.
++ *
++ * The @max_write_size field is always greater or equivalent to @min_io_size.
++ * E.g., some NOR flashes may have (@min_io_size = 1, @max_write_size = 64). In
++ * contrast, NAND flashes usually have @min_io_size = @max_write_size = NAND
++ * page size.
+ */
+ struct ubi_device_info {
+ int ubi_num;
+ int leb_size;
++ int leb_start;
+ int min_io_size;
++ int max_write_size;
+ int ro_mode;
+ dev_t cdev;
+ };
+
+ /*
+- * enum - volume notification types.
+- * @UBI_VOLUME_ADDED: volume has been added
+- * @UBI_VOLUME_REMOVED: start volume volume
+- * @UBI_VOLUME_RESIZED: volume size has been re-sized
+- * @UBI_VOLUME_RENAMED: volume name has been re-named
+- * @UBI_VOLUME_UPDATED: volume name has been updated
++ * Volume notification types.
++ * @UBI_VOLUME_ADDED: a volume has been added (an UBI device was attached or a
++ * volume was created)
++ * @UBI_VOLUME_REMOVED: a volume has been removed (an UBI device was detached
++ * or a volume was removed)
++ * @UBI_VOLUME_RESIZED: a volume has been re-sized
++ * @UBI_VOLUME_RENAMED: a volume has been re-named
++ * @UBI_VOLUME_UPDATED: data has been written to a volume
+ *
+ * These constants define which type of event has happened when a volume
+ * notification function is invoked.
--- /dev/null
+diff --git a/fs/ubifs/Kconfig b/fs/ubifs/Kconfig
+index 830e3f7..f8b0160 100644
+--- a/fs/ubifs/Kconfig
++++ b/fs/ubifs/Kconfig
+@@ -44,29 +44,17 @@ config UBIFS_FS_ZLIB
+
+ # Debugging-related stuff
+ config UBIFS_FS_DEBUG
+- bool "Enable debugging"
++ bool "Enable debugging support"
+ depends on UBIFS_FS
+ select DEBUG_FS
+- select KALLSYMS_ALL
+- help
+- This option enables UBIFS debugging.
+-
+-config UBIFS_FS_DEBUG_MSG_LVL
+- int "Default message level (0 = no extra messages, 3 = lots)"
+- depends on UBIFS_FS_DEBUG
+- default "0"
+- help
+- This controls the amount of debugging messages produced by UBIFS.
+- If reporting bugs, please try to have available a full dump of the
+- messages at level 1 while the misbehaviour was occurring. Level 2
+- may become necessary if level 1 messages were not enough to find the
+- bug. Generally Level 3 should be avoided.
+-
+-config UBIFS_FS_DEBUG_CHKS
+- bool "Enable extra checks"
+- depends on UBIFS_FS_DEBUG
+- help
+- If extra checks are enabled UBIFS will check the consistency of its
+- internal data structures during operation. However, UBIFS performance
+- is dramatically slower when this option is selected especially if the
+- file system is large.
++ select KALLSYMS
++ help
++ This option enables UBIFS debugging support. It makes sure various
++ assertions, self-checks, debugging messages and test modes are compiled
++ in (this all is compiled out otherwise). Assertions are light-weight
++ and this option also enables them. Self-checks, debugging messages and
++ test modes are switched off by default. Thus, it is safe and actually
++ recommended to have debugging support enabled, and it should not slow
++ down UBIFS. You can then further enable / disable individual debugging
++ features using UBIFS module parameters and the corresponding sysfs
++ interfaces.
+diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
+index c8ff0d1..02c73e7 100644
+--- a/fs/ubifs/budget.c
++++ b/fs/ubifs/budget.c
+@@ -106,7 +106,7 @@ static long long get_liability(struct ubifs_info *c)
+ long long liab;
+
+ spin_lock(&c->space_lock);
+- liab = c->budg_idx_growth + c->budg_data_growth + c->budg_dd_growth;
++ liab = c->bi.idx_growth + c->bi.data_growth + c->bi.dd_growth;
+ spin_unlock(&c->space_lock);
+ return liab;
+ }
+@@ -180,7 +180,7 @@ int ubifs_calc_min_idx_lebs(struct ubifs_info *c)
+ int idx_lebs;
+ long long idx_size;
+
+- idx_size = c->old_idx_sz + c->budg_idx_growth + c->budg_uncommitted_idx;
++ idx_size = c->bi.old_idx_sz + c->bi.idx_growth + c->bi.uncommitted_idx;
+ /* And make sure we have thrice the index size of space reserved */
+ idx_size += idx_size << 1;
+ /*
+@@ -292,13 +292,13 @@ static int can_use_rp(struct ubifs_info *c)
+ * budgeted index space to the size of the current index, multiplies this by 3,
+ * and makes sure this does not exceed the amount of free LEBs.
+ *
+- * Notes about @c->min_idx_lebs and @c->lst.idx_lebs variables:
++ * Notes about @c->bi.min_idx_lebs and @c->lst.idx_lebs variables:
+ * o @c->lst.idx_lebs is the number of LEBs the index currently uses. It might
+ * be large, because UBIFS does not do any index consolidation as long as
+ * there is free space. IOW, the index may take a lot of LEBs, but the LEBs
+ * will contain a lot of dirt.
+- * o @c->min_idx_lebs is the number of LEBS the index presumably takes. IOW,
+- * the index may be consolidated to take up to @c->min_idx_lebs LEBs.
++ * o @c->bi.min_idx_lebs is the number of LEBS the index presumably takes. IOW,
++ * the index may be consolidated to take up to @c->bi.min_idx_lebs LEBs.
+ *
+ * This function returns zero in case of success, and %-ENOSPC in case of
+ * failure.
+@@ -343,13 +343,13 @@ static int do_budget_space(struct ubifs_info *c)
+ c->lst.taken_empty_lebs;
+ if (unlikely(rsvd_idx_lebs > lebs)) {
+ dbg_budg("out of indexing space: min_idx_lebs %d (old %d), "
+- "rsvd_idx_lebs %d", min_idx_lebs, c->min_idx_lebs,
++ "rsvd_idx_lebs %d", min_idx_lebs, c->bi.min_idx_lebs,
+ rsvd_idx_lebs);
+ return -ENOSPC;
+ }
+
+ available = ubifs_calc_available(c, min_idx_lebs);
+- outstanding = c->budg_data_growth + c->budg_dd_growth;
++ outstanding = c->bi.data_growth + c->bi.dd_growth;
+
+ if (unlikely(available < outstanding)) {
+ dbg_budg("out of data space: available %lld, outstanding %lld",
+@@ -360,7 +360,7 @@ static int do_budget_space(struct ubifs_info *c)
+ if (available - outstanding <= c->rp_size && !can_use_rp(c))
+ return -ENOSPC;
+
+- c->min_idx_lebs = min_idx_lebs;
++ c->bi.min_idx_lebs = min_idx_lebs;
+ return 0;
+ }
+
+@@ -393,11 +393,11 @@ static int calc_data_growth(const struct ubifs_info *c,
+ {
+ int data_growth;
+
+- data_growth = req->new_ino ? c->inode_budget : 0;
++ data_growth = req->new_ino ? c->bi.inode_budget : 0;
+ if (req->new_page)
+- data_growth += c->page_budget;
++ data_growth += c->bi.page_budget;
+ if (req->new_dent)
+- data_growth += c->dent_budget;
++ data_growth += c->bi.dent_budget;
+ data_growth += req->new_ino_d;
+ return data_growth;
+ }
+@@ -413,12 +413,12 @@ static int calc_dd_growth(const struct ubifs_info *c,
+ {
+ int dd_growth;
+
+- dd_growth = req->dirtied_page ? c->page_budget : 0;
++ dd_growth = req->dirtied_page ? c->bi.page_budget : 0;
+
+ if (req->dirtied_ino)
+- dd_growth += c->inode_budget << (req->dirtied_ino - 1);
++ dd_growth += c->bi.inode_budget << (req->dirtied_ino - 1);
+ if (req->mod_dent)
+- dd_growth += c->dent_budget;
++ dd_growth += c->bi.dent_budget;
+ dd_growth += req->dirtied_ino_d;
+ return dd_growth;
+ }
+@@ -460,19 +460,19 @@ int ubifs_budget_space(struct ubifs_info *c, struct ubifs_budget_req *req)
+
+ again:
+ spin_lock(&c->space_lock);
+- ubifs_assert(c->budg_idx_growth >= 0);
+- ubifs_assert(c->budg_data_growth >= 0);
+- ubifs_assert(c->budg_dd_growth >= 0);
++ ubifs_assert(c->bi.idx_growth >= 0);
++ ubifs_assert(c->bi.data_growth >= 0);
++ ubifs_assert(c->bi.dd_growth >= 0);
+
+- if (unlikely(c->nospace) && (c->nospace_rp || !can_use_rp(c))) {
++ if (unlikely(c->bi.nospace) && (c->bi.nospace_rp || !can_use_rp(c))) {
+ dbg_budg("no space");
+ spin_unlock(&c->space_lock);
+ return -ENOSPC;
+ }
+
+- c->budg_idx_growth += idx_growth;
+- c->budg_data_growth += data_growth;
+- c->budg_dd_growth += dd_growth;
++ c->bi.idx_growth += idx_growth;
++ c->bi.data_growth += data_growth;
++ c->bi.dd_growth += dd_growth;
+
+ err = do_budget_space(c);
+ if (likely(!err)) {
+@@ -484,9 +484,9 @@ again:
+ }
+
+ /* Restore the old values */
+- c->budg_idx_growth -= idx_growth;
+- c->budg_data_growth -= data_growth;
+- c->budg_dd_growth -= dd_growth;
++ c->bi.idx_growth -= idx_growth;
++ c->bi.data_growth -= data_growth;
++ c->bi.dd_growth -= dd_growth;
+ spin_unlock(&c->space_lock);
+
+ if (req->fast) {
+@@ -506,9 +506,9 @@ again:
+ goto again;
+ }
+ dbg_budg("FS is full, -ENOSPC");
+- c->nospace = 1;
++ c->bi.nospace = 1;
+ if (can_use_rp(c) || c->rp_size == 0)
+- c->nospace_rp = 1;
++ c->bi.nospace_rp = 1;
+ smp_wmb();
+ } else
+ ubifs_err("cannot budget space, error %d", err);
+@@ -523,8 +523,8 @@ again:
+ * This function releases the space budgeted by 'ubifs_budget_space()'. Note,
+ * since the index changes (which were budgeted for in @req->idx_growth) will
+ * only be written to the media on commit, this function moves the index budget
+- * from @c->budg_idx_growth to @c->budg_uncommitted_idx. The latter will be
+- * zeroed by the commit operation.
++ * from @c->bi.idx_growth to @c->bi.uncommitted_idx. The latter will be zeroed
++ * by the commit operation.
+ */
+ void ubifs_release_budget(struct ubifs_info *c, struct ubifs_budget_req *req)
+ {
+@@ -553,23 +553,23 @@ void ubifs_release_budget(struct ubifs_info *c, struct ubifs_budget_req *req)
+ if (!req->data_growth && !req->dd_growth)
+ return;
+
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+
+ spin_lock(&c->space_lock);
+- c->budg_idx_growth -= req->idx_growth;
+- c->budg_uncommitted_idx += req->idx_growth;
+- c->budg_data_growth -= req->data_growth;
+- c->budg_dd_growth -= req->dd_growth;
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+-
+- ubifs_assert(c->budg_idx_growth >= 0);
+- ubifs_assert(c->budg_data_growth >= 0);
+- ubifs_assert(c->budg_dd_growth >= 0);
+- ubifs_assert(c->min_idx_lebs < c->main_lebs);
+- ubifs_assert(!(c->budg_idx_growth & 7));
+- ubifs_assert(!(c->budg_data_growth & 7));
+- ubifs_assert(!(c->budg_dd_growth & 7));
++ c->bi.idx_growth -= req->idx_growth;
++ c->bi.uncommitted_idx += req->idx_growth;
++ c->bi.data_growth -= req->data_growth;
++ c->bi.dd_growth -= req->dd_growth;
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++
++ ubifs_assert(c->bi.idx_growth >= 0);
++ ubifs_assert(c->bi.data_growth >= 0);
++ ubifs_assert(c->bi.dd_growth >= 0);
++ ubifs_assert(c->bi.min_idx_lebs < c->main_lebs);
++ ubifs_assert(!(c->bi.idx_growth & 7));
++ ubifs_assert(!(c->bi.data_growth & 7));
++ ubifs_assert(!(c->bi.dd_growth & 7));
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -586,13 +586,13 @@ void ubifs_convert_page_budget(struct ubifs_info *c)
+ {
+ spin_lock(&c->space_lock);
+ /* Release the index growth reservation */
+- c->budg_idx_growth -= c->max_idx_node_sz << UBIFS_BLOCKS_PER_PAGE_SHIFT;
++ c->bi.idx_growth -= c->max_idx_node_sz << UBIFS_BLOCKS_PER_PAGE_SHIFT;
+ /* Release the data growth reservation */
+- c->budg_data_growth -= c->page_budget;
++ c->bi.data_growth -= c->bi.page_budget;
+ /* Increase the dirty data growth reservation instead */
+- c->budg_dd_growth += c->page_budget;
++ c->bi.dd_growth += c->bi.page_budget;
+ /* And re-calculate the indexing space reservation */
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -612,7 +612,7 @@ void ubifs_release_dirty_inode_budget(struct ubifs_info *c,
+
+ memset(&req, 0, sizeof(struct ubifs_budget_req));
+ /* The "no space" flags will be cleared because dd_growth is > 0 */
+- req.dd_growth = c->inode_budget + ALIGN(ui->data_len, 8);
++ req.dd_growth = c->bi.inode_budget + ALIGN(ui->data_len, 8);
+ ubifs_release_budget(c, &req);
+ }
+
+@@ -682,9 +682,9 @@ long long ubifs_get_free_space_nolock(struct ubifs_info *c)
+ int rsvd_idx_lebs, lebs;
+ long long available, outstanding, free;
+
+- ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
+- outstanding = c->budg_data_growth + c->budg_dd_growth;
+- available = ubifs_calc_available(c, c->min_idx_lebs);
++ ubifs_assert(c->bi.min_idx_lebs == ubifs_calc_min_idx_lebs(c));
++ outstanding = c->bi.data_growth + c->bi.dd_growth;
++ available = ubifs_calc_available(c, c->bi.min_idx_lebs);
+
+ /*
+ * When reporting free space to user-space, UBIFS guarantees that it is
+@@ -697,8 +697,8 @@ long long ubifs_get_free_space_nolock(struct ubifs_info *c)
+ * Note, the calculations below are similar to what we have in
+ * 'do_budget_space()', so refer there for comments.
+ */
+- if (c->min_idx_lebs > c->lst.idx_lebs)
+- rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
++ if (c->bi.min_idx_lebs > c->lst.idx_lebs)
++ rsvd_idx_lebs = c->bi.min_idx_lebs - c->lst.idx_lebs;
+ else
+ rsvd_idx_lebs = 0;
+ lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
+diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
+index 02429d8..fb3b5c8 100644
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -48,6 +48,56 @@
+ #include <linux/slab.h>
+ #include "ubifs.h"
+
++/*
++ * nothing_to_commit - check if there is nothing to commit.
++ * @c: UBIFS file-system description object
++ *
++ * This is a helper function which checks if there is anything to commit. It is
++ * used as an optimization to avoid starting the commit if it is not really
++ * necessary. Indeed, the commit operation always assumes flash I/O (e.g.,
++ * writing the commit start node to the log), and it is better to avoid doing
++ * this unnecessarily. E.g., 'ubifs_sync_fs()' runs the commit, but if there is
++ * nothing to commit, it is more optimal to avoid any flash I/O.
++ *
++ * This function has to be called with @c->commit_sem locked for writing -
++ * this function does not take LPT/TNC locks because the @c->commit_sem
++ * guarantees that we have exclusive access to the TNC and LPT data structures.
++ *
++ * This function returns %1 if there is nothing to commit and %0 otherwise.
++ */
++static int nothing_to_commit(struct ubifs_info *c)
++{
++ /*
++ * During mounting or remounting from R/O mode to R/W mode we may
++ * commit for various recovery-related reasons.
++ */
++ if (c->mounting || c->remounting_rw)
++ return 0;
++
++ /*
++ * If the root TNC node is dirty, we definitely have something to
++ * commit.
++ */
++ if (c->zroot.znode && ubifs_zn_dirty(c->zroot.znode))
++ return 0;
++
++ /*
++ * Even though the TNC is clean, the LPT tree may have dirty nodes. For
++ * example, this may happen if the budgeting subsystem invoked GC to
++ * make some free space, and the GC found an LEB with only dirty and
++ * free space. In this case GC would just change the lprops of this
++ * LEB (by turning all space into free space) and unmap it.
++ */
++ if (c->nroot && test_bit(DIRTY_CNODE, &c->nroot->flags))
++ return 0;
++
++ ubifs_assert(atomic_long_read(&c->dirty_zn_cnt) == 0);
++ ubifs_assert(c->dirty_pn_cnt == 0);
++ ubifs_assert(c->dirty_nn_cnt == 0);
++
++ return 1;
++}
++
+ /**
+ * do_commit - commit the journal.
+ * @c: UBIFS file-system description object
+@@ -70,6 +120,12 @@ static int do_commit(struct ubifs_info *c)
+ goto out_up;
+ }
+
++ if (nothing_to_commit(c)) {
++ up_write(&c->commit_sem);
++ err = 0;
++ goto out_cancel;
++ }
++
+ /* Sync all write buffers (necessary for recovery) */
+ for (i = 0; i < c->jhead_cnt; i++) {
+ err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
+@@ -126,7 +182,7 @@ static int do_commit(struct ubifs_info *c)
+ c->mst_node->root_len = cpu_to_le32(zroot.len);
+ c->mst_node->ihead_lnum = cpu_to_le32(c->ihead_lnum);
+ c->mst_node->ihead_offs = cpu_to_le32(c->ihead_offs);
+- c->mst_node->index_size = cpu_to_le64(c->old_idx_sz);
++ c->mst_node->index_size = cpu_to_le64(c->bi.old_idx_sz);
+ c->mst_node->lpt_lnum = cpu_to_le32(c->lpt_lnum);
+ c->mst_node->lpt_offs = cpu_to_le32(c->lpt_offs);
+ c->mst_node->nhead_lnum = cpu_to_le32(c->nhead_lnum);
+@@ -162,12 +218,12 @@ static int do_commit(struct ubifs_info *c)
+ if (err)
+ goto out;
+
++out_cancel:
+ spin_lock(&c->cs_lock);
+ c->cmt_state = COMMIT_RESTING;
+ wake_up(&c->cmt_wq);
+ dbg_cmt("commit end");
+ spin_unlock(&c->cs_lock);
+-
+ return 0;
+
+ out_up:
+@@ -362,7 +418,7 @@ int ubifs_run_commit(struct ubifs_info *c)
+
+ spin_lock(&c->cs_lock);
+ if (c->cmt_state == COMMIT_BROKEN) {
+- err = -EINVAL;
++ err = -EROFS;
+ goto out;
+ }
+
+@@ -388,7 +444,7 @@ int ubifs_run_commit(struct ubifs_info *c)
+ * re-check it.
+ */
+ if (c->cmt_state == COMMIT_BROKEN) {
+- err = -EINVAL;
++ err = -EROFS;
+ goto out_cmt_unlock;
+ }
+
+@@ -520,8 +576,8 @@ int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot)
+ struct idx_node *i;
+ size_t sz;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_OLD_IDX))
+- goto out;
++ if (!dbg_is_chk_index(c))
++ return 0;
+
+ INIT_LIST_HEAD(&list);
+
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index 0bee4db..1934084 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -27,33 +27,16 @@
+ * various local functions of those subsystems.
+ */
+
+-#define UBIFS_DBG_PRESERVE_UBI
+-
+-#include "ubifs.h"
+ #include <linux/module.h>
+-#include <linux/moduleparam.h>
+ #include <linux/debugfs.h>
+ #include <linux/math64.h>
+-#include <linux/slab.h>
++#include <linux/uaccess.h>
++#include <linux/random.h>
++#include "ubifs.h"
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+
+-DEFINE_SPINLOCK(dbg_lock);
+-
+-static char dbg_key_buf0[128];
+-static char dbg_key_buf1[128];
+-
+-unsigned int ubifs_msg_flags = UBIFS_MSG_FLAGS_DEFAULT;
+-unsigned int ubifs_chk_flags = UBIFS_CHK_FLAGS_DEFAULT;
+-unsigned int ubifs_tst_flags;
+-
+-module_param_named(debug_msgs, ubifs_msg_flags, uint, S_IRUGO | S_IWUSR);
+-module_param_named(debug_chks, ubifs_chk_flags, uint, S_IRUGO | S_IWUSR);
+-module_param_named(debug_tsts, ubifs_tst_flags, uint, S_IRUGO | S_IWUSR);
+-
+-MODULE_PARM_DESC(debug_msgs, "Debug message type flags");
+-MODULE_PARM_DESC(debug_chks, "Debug check flags");
+-MODULE_PARM_DESC(debug_tsts, "Debug special test flags");
++static DEFINE_SPINLOCK(dbg_lock);
+
+ static const char *get_key_fmt(int fmt)
+ {
+@@ -95,8 +78,30 @@ static const char *get_key_type(int type)
+ }
+ }
+
+-static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
+- char *buffer)
++static const char *get_dent_type(int type)
++{
++ switch (type) {
++ case UBIFS_ITYPE_REG:
++ return "file";
++ case UBIFS_ITYPE_DIR:
++ return "dir";
++ case UBIFS_ITYPE_LNK:
++ return "symlink";
++ case UBIFS_ITYPE_BLK:
++ return "blkdev";
++ case UBIFS_ITYPE_CHR:
++ return "char dev";
++ case UBIFS_ITYPE_FIFO:
++ return "fifo";
++ case UBIFS_ITYPE_SOCK:
++ return "socket";
++ default:
++ return "unknown/invalid type";
++ }
++}
++
++const char *dbg_snprintf_key(const struct ubifs_info *c,
++ const union ubifs_key *key, char *buffer, int len)
+ {
+ char *p = buffer;
+ int type = key_type(c, key);
+@@ -104,45 +109,34 @@ static void sprintf_key(const struct ubifs_info *c, const union ubifs_key *key,
+ if (c->key_fmt == UBIFS_SIMPLE_KEY_FMT) {
+ switch (type) {
+ case UBIFS_INO_KEY:
+- sprintf(p, "(%lu, %s)", (unsigned long)key_inum(c, key),
+- get_key_type(type));
++ len -= snprintf(p, len, "(%lu, %s)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type));
+ break;
+ case UBIFS_DENT_KEY:
+ case UBIFS_XENT_KEY:
+- sprintf(p, "(%lu, %s, %#08x)",
+- (unsigned long)key_inum(c, key),
+- get_key_type(type), key_hash(c, key));
++ len -= snprintf(p, len, "(%lu, %s, %#08x)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type), key_hash(c, key));
+ break;
+ case UBIFS_DATA_KEY:
+- sprintf(p, "(%lu, %s, %u)",
+- (unsigned long)key_inum(c, key),
+- get_key_type(type), key_block(c, key));
++ len -= snprintf(p, len, "(%lu, %s, %u)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type), key_block(c, key));
+ break;
+ case UBIFS_TRUN_KEY:
+- sprintf(p, "(%lu, %s)",
+- (unsigned long)key_inum(c, key),
+- get_key_type(type));
++ len -= snprintf(p, len, "(%lu, %s)",
++ (unsigned long)key_inum(c, key),
++ get_key_type(type));
+ break;
+ default:
+- sprintf(p, "(bad key type: %#08x, %#08x)",
+- key->u32[0], key->u32[1]);
++ len -= snprintf(p, len, "(bad key type: %#08x, %#08x)",
++ key->u32[0], key->u32[1]);
+ }
+ } else
+- sprintf(p, "bad key format %d", c->key_fmt);
+-}
+-
+-const char *dbg_key_str0(const struct ubifs_info *c, const union ubifs_key *key)
+-{
+- /* dbg_lock must be held */
+- sprintf_key(c, key, dbg_key_buf0);
+- return dbg_key_buf0;
+-}
+-
+-const char *dbg_key_str1(const struct ubifs_info *c, const union ubifs_key *key)
+-{
+- /* dbg_lock must be held */
+- sprintf_key(c, key, dbg_key_buf1);
+- return dbg_key_buf1;
++ len -= snprintf(p, len, "bad key format %d", c->key_fmt);
++ ubifs_assert(len > 0);
++ return p;
+ }
+
+ const char *dbg_ntype(int type)
+@@ -227,53 +221,83 @@ const char *dbg_jhead(int jhead)
+
+ static void dump_ch(const struct ubifs_ch *ch)
+ {
+- printk(KERN_DEBUG "\tmagic %#x\n", le32_to_cpu(ch->magic));
+- printk(KERN_DEBUG "\tcrc %#x\n", le32_to_cpu(ch->crc));
+- printk(KERN_DEBUG "\tnode_type %d (%s)\n", ch->node_type,
++ printk(KERN_ERR "\tmagic %#x\n", le32_to_cpu(ch->magic));
++ printk(KERN_ERR "\tcrc %#x\n", le32_to_cpu(ch->crc));
++ printk(KERN_ERR "\tnode_type %d (%s)\n", ch->node_type,
+ dbg_ntype(ch->node_type));
+- printk(KERN_DEBUG "\tgroup_type %d (%s)\n", ch->group_type,
++ printk(KERN_ERR "\tgroup_type %d (%s)\n", ch->group_type,
+ dbg_gtype(ch->group_type));
+- printk(KERN_DEBUG "\tsqnum %llu\n",
++ printk(KERN_ERR "\tsqnum %llu\n",
+ (unsigned long long)le64_to_cpu(ch->sqnum));
+- printk(KERN_DEBUG "\tlen %u\n", le32_to_cpu(ch->len));
++ printk(KERN_ERR "\tlen %u\n", le32_to_cpu(ch->len));
+ }
+
+-void dbg_dump_inode(const struct ubifs_info *c, const struct inode *inode)
++void dbg_dump_inode(struct ubifs_info *c, const struct inode *inode)
+ {
+ const struct ubifs_inode *ui = ubifs_inode(inode);
++ struct qstr nm = { .name = NULL };
++ union ubifs_key key;
++ struct ubifs_dent_node *dent, *pdent = NULL;
++ int count = 2;
+
+- printk(KERN_DEBUG "Dump in-memory inode:");
+- printk(KERN_DEBUG "\tinode %lu\n", inode->i_ino);
+- printk(KERN_DEBUG "\tsize %llu\n",
++ printk(KERN_ERR "Dump in-memory inode:");
++ printk(KERN_ERR "\tinode %lu\n", inode->i_ino);
++ printk(KERN_ERR "\tsize %llu\n",
+ (unsigned long long)i_size_read(inode));
+- printk(KERN_DEBUG "\tnlink %u\n", inode->i_nlink);
+- printk(KERN_DEBUG "\tuid %u\n", (unsigned int)inode->i_uid);
+- printk(KERN_DEBUG "\tgid %u\n", (unsigned int)inode->i_gid);
+- printk(KERN_DEBUG "\tatime %u.%u\n",
++ printk(KERN_ERR "\tnlink %u\n", inode->i_nlink);
++ printk(KERN_ERR "\tuid %u\n", (unsigned int)inode->i_uid);
++ printk(KERN_ERR "\tgid %u\n", (unsigned int)inode->i_gid);
++ printk(KERN_ERR "\tatime %u.%u\n",
+ (unsigned int)inode->i_atime.tv_sec,
+ (unsigned int)inode->i_atime.tv_nsec);
+- printk(KERN_DEBUG "\tmtime %u.%u\n",
++ printk(KERN_ERR "\tmtime %u.%u\n",
+ (unsigned int)inode->i_mtime.tv_sec,
+ (unsigned int)inode->i_mtime.tv_nsec);
+- printk(KERN_DEBUG "\tctime %u.%u\n",
++ printk(KERN_ERR "\tctime %u.%u\n",
+ (unsigned int)inode->i_ctime.tv_sec,
+ (unsigned int)inode->i_ctime.tv_nsec);
+- printk(KERN_DEBUG "\tcreat_sqnum %llu\n", ui->creat_sqnum);
+- printk(KERN_DEBUG "\txattr_size %u\n", ui->xattr_size);
+- printk(KERN_DEBUG "\txattr_cnt %u\n", ui->xattr_cnt);
+- printk(KERN_DEBUG "\txattr_names %u\n", ui->xattr_names);
+- printk(KERN_DEBUG "\tdirty %u\n", ui->dirty);
+- printk(KERN_DEBUG "\txattr %u\n", ui->xattr);
+- printk(KERN_DEBUG "\tbulk_read %u\n", ui->xattr);
+- printk(KERN_DEBUG "\tsynced_i_size %llu\n",
++ printk(KERN_ERR "\tcreat_sqnum %llu\n", ui->creat_sqnum);
++ printk(KERN_ERR "\txattr_size %u\n", ui->xattr_size);
++ printk(KERN_ERR "\txattr_cnt %u\n", ui->xattr_cnt);
++ printk(KERN_ERR "\txattr_names %u\n", ui->xattr_names);
++ printk(KERN_ERR "\tdirty %u\n", ui->dirty);
++ printk(KERN_ERR "\txattr %u\n", ui->xattr);
++ printk(KERN_ERR "\tbulk_read %u\n", ui->xattr);
++ printk(KERN_ERR "\tsynced_i_size %llu\n",
+ (unsigned long long)ui->synced_i_size);
+- printk(KERN_DEBUG "\tui_size %llu\n",
++ printk(KERN_ERR "\tui_size %llu\n",
+ (unsigned long long)ui->ui_size);
+- printk(KERN_DEBUG "\tflags %d\n", ui->flags);
+- printk(KERN_DEBUG "\tcompr_type %d\n", ui->compr_type);
+- printk(KERN_DEBUG "\tlast_page_read %lu\n", ui->last_page_read);
+- printk(KERN_DEBUG "\tread_in_a_row %lu\n", ui->read_in_a_row);
+- printk(KERN_DEBUG "\tdata_len %d\n", ui->data_len);
++ printk(KERN_ERR "\tflags %d\n", ui->flags);
++ printk(KERN_ERR "\tcompr_type %d\n", ui->compr_type);
++ printk(KERN_ERR "\tlast_page_read %lu\n", ui->last_page_read);
++ printk(KERN_ERR "\tread_in_a_row %lu\n", ui->read_in_a_row);
++ printk(KERN_ERR "\tdata_len %d\n", ui->data_len);
++
++ if (!S_ISDIR(inode->i_mode))
++ return;
++
++ printk(KERN_ERR "List of directory entries:\n");
++ ubifs_assert(!mutex_is_locked(&c->tnc_mutex));
++
++ lowest_dent_key(c, &key, inode->i_ino);
++ while (1) {
++ dent = ubifs_tnc_next_ent(c, &key, &nm);
++ if (IS_ERR(dent)) {
++ if (PTR_ERR(dent) != -ENOENT)
++ printk(KERN_ERR "error %ld\n", PTR_ERR(dent));
++ break;
++ }
++
++ printk(KERN_ERR "\t%d: %s (%s)\n",
++ count++, dent->name, get_dent_type(dent->type));
++
++ nm.name = dent->name;
++ nm.len = le16_to_cpu(dent->nlen);
++ kfree(pdent);
++ pdent = dent;
++ key_read(c, &dent->key, &key);
++ }
++ kfree(pdent);
+ }
+
+ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+@@ -281,14 +305,15 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ int i, n;
+ union ubifs_key key;
+ const struct ubifs_ch *ch = node;
++ char key_buf[DBG_KEY_BUF_LEN];
+
+- if (dbg_failure_mode)
++ if (dbg_is_tst_rcvry(c))
+ return;
+
+ /* If the magic is incorrect, just hexdump the first bytes */
+ if (le32_to_cpu(ch->magic) != UBIFS_NODE_MAGIC) {
+- printk(KERN_DEBUG "Not a node, first %zu bytes:", UBIFS_CH_SZ);
+- print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
++ printk(KERN_ERR "Not a node, first %zu bytes:", UBIFS_CH_SZ);
++ print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 32, 1,
+ (void *)node, UBIFS_CH_SZ, 1);
+ return;
+ }
+@@ -301,7 +326,7 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_pad_node *pad = node;
+
+- printk(KERN_DEBUG "\tpad_len %u\n",
++ printk(KERN_ERR "\tpad_len %u\n",
+ le32_to_cpu(pad->pad_len));
+ break;
+ }
+@@ -310,48 +335,50 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ const struct ubifs_sb_node *sup = node;
+ unsigned int sup_flags = le32_to_cpu(sup->flags);
+
+- printk(KERN_DEBUG "\tkey_hash %d (%s)\n",
++ printk(KERN_ERR "\tkey_hash %d (%s)\n",
+ (int)sup->key_hash, get_key_hash(sup->key_hash));
+- printk(KERN_DEBUG "\tkey_fmt %d (%s)\n",
++ printk(KERN_ERR "\tkey_fmt %d (%s)\n",
+ (int)sup->key_fmt, get_key_fmt(sup->key_fmt));
+- printk(KERN_DEBUG "\tflags %#x\n", sup_flags);
+- printk(KERN_DEBUG "\t big_lpt %u\n",
++ printk(KERN_ERR "\tflags %#x\n", sup_flags);
++ printk(KERN_ERR "\t big_lpt %u\n",
+ !!(sup_flags & UBIFS_FLG_BIGLPT));
+- printk(KERN_DEBUG "\tmin_io_size %u\n",
++ printk(KERN_ERR "\t space_fixup %u\n",
++ !!(sup_flags & UBIFS_FLG_SPACE_FIXUP));
++ printk(KERN_ERR "\tmin_io_size %u\n",
+ le32_to_cpu(sup->min_io_size));
+- printk(KERN_DEBUG "\tleb_size %u\n",
++ printk(KERN_ERR "\tleb_size %u\n",
+ le32_to_cpu(sup->leb_size));
+- printk(KERN_DEBUG "\tleb_cnt %u\n",
++ printk(KERN_ERR "\tleb_cnt %u\n",
+ le32_to_cpu(sup->leb_cnt));
+- printk(KERN_DEBUG "\tmax_leb_cnt %u\n",
++ printk(KERN_ERR "\tmax_leb_cnt %u\n",
+ le32_to_cpu(sup->max_leb_cnt));
+- printk(KERN_DEBUG "\tmax_bud_bytes %llu\n",
++ printk(KERN_ERR "\tmax_bud_bytes %llu\n",
+ (unsigned long long)le64_to_cpu(sup->max_bud_bytes));
+- printk(KERN_DEBUG "\tlog_lebs %u\n",
++ printk(KERN_ERR "\tlog_lebs %u\n",
+ le32_to_cpu(sup->log_lebs));
+- printk(KERN_DEBUG "\tlpt_lebs %u\n",
++ printk(KERN_ERR "\tlpt_lebs %u\n",
+ le32_to_cpu(sup->lpt_lebs));
+- printk(KERN_DEBUG "\torph_lebs %u\n",
++ printk(KERN_ERR "\torph_lebs %u\n",
+ le32_to_cpu(sup->orph_lebs));
+- printk(KERN_DEBUG "\tjhead_cnt %u\n",
++ printk(KERN_ERR "\tjhead_cnt %u\n",
+ le32_to_cpu(sup->jhead_cnt));
+- printk(KERN_DEBUG "\tfanout %u\n",
++ printk(KERN_ERR "\tfanout %u\n",
+ le32_to_cpu(sup->fanout));
+- printk(KERN_DEBUG "\tlsave_cnt %u\n",
++ printk(KERN_ERR "\tlsave_cnt %u\n",
+ le32_to_cpu(sup->lsave_cnt));
+- printk(KERN_DEBUG "\tdefault_compr %u\n",
++ printk(KERN_ERR "\tdefault_compr %u\n",
+ (int)le16_to_cpu(sup->default_compr));
+- printk(KERN_DEBUG "\trp_size %llu\n",
++ printk(KERN_ERR "\trp_size %llu\n",
+ (unsigned long long)le64_to_cpu(sup->rp_size));
+- printk(KERN_DEBUG "\trp_uid %u\n",
++ printk(KERN_ERR "\trp_uid %u\n",
+ le32_to_cpu(sup->rp_uid));
+- printk(KERN_DEBUG "\trp_gid %u\n",
++ printk(KERN_ERR "\trp_gid %u\n",
+ le32_to_cpu(sup->rp_gid));
+- printk(KERN_DEBUG "\tfmt_version %u\n",
++ printk(KERN_ERR "\tfmt_version %u\n",
+ le32_to_cpu(sup->fmt_version));
+- printk(KERN_DEBUG "\ttime_gran %u\n",
++ printk(KERN_ERR "\ttime_gran %u\n",
+ le32_to_cpu(sup->time_gran));
+- printk(KERN_DEBUG "\tUUID %pUB\n",
++ printk(KERN_ERR "\tUUID %pUB\n",
+ sup->uuid);
+ break;
+ }
+@@ -359,61 +386,61 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_mst_node *mst = node;
+
+- printk(KERN_DEBUG "\thighest_inum %llu\n",
++ printk(KERN_ERR "\thighest_inum %llu\n",
+ (unsigned long long)le64_to_cpu(mst->highest_inum));
+- printk(KERN_DEBUG "\tcommit number %llu\n",
++ printk(KERN_ERR "\tcommit number %llu\n",
+ (unsigned long long)le64_to_cpu(mst->cmt_no));
+- printk(KERN_DEBUG "\tflags %#x\n",
++ printk(KERN_ERR "\tflags %#x\n",
+ le32_to_cpu(mst->flags));
+- printk(KERN_DEBUG "\tlog_lnum %u\n",
++ printk(KERN_ERR "\tlog_lnum %u\n",
+ le32_to_cpu(mst->log_lnum));
+- printk(KERN_DEBUG "\troot_lnum %u\n",
++ printk(KERN_ERR "\troot_lnum %u\n",
+ le32_to_cpu(mst->root_lnum));
+- printk(KERN_DEBUG "\troot_offs %u\n",
++ printk(KERN_ERR "\troot_offs %u\n",
+ le32_to_cpu(mst->root_offs));
+- printk(KERN_DEBUG "\troot_len %u\n",
++ printk(KERN_ERR "\troot_len %u\n",
+ le32_to_cpu(mst->root_len));
+- printk(KERN_DEBUG "\tgc_lnum %u\n",
++ printk(KERN_ERR "\tgc_lnum %u\n",
+ le32_to_cpu(mst->gc_lnum));
+- printk(KERN_DEBUG "\tihead_lnum %u\n",
++ printk(KERN_ERR "\tihead_lnum %u\n",
+ le32_to_cpu(mst->ihead_lnum));
+- printk(KERN_DEBUG "\tihead_offs %u\n",
++ printk(KERN_ERR "\tihead_offs %u\n",
+ le32_to_cpu(mst->ihead_offs));
+- printk(KERN_DEBUG "\tindex_size %llu\n",
++ printk(KERN_ERR "\tindex_size %llu\n",
+ (unsigned long long)le64_to_cpu(mst->index_size));
+- printk(KERN_DEBUG "\tlpt_lnum %u\n",
++ printk(KERN_ERR "\tlpt_lnum %u\n",
+ le32_to_cpu(mst->lpt_lnum));
+- printk(KERN_DEBUG "\tlpt_offs %u\n",
++ printk(KERN_ERR "\tlpt_offs %u\n",
+ le32_to_cpu(mst->lpt_offs));
+- printk(KERN_DEBUG "\tnhead_lnum %u\n",
++ printk(KERN_ERR "\tnhead_lnum %u\n",
+ le32_to_cpu(mst->nhead_lnum));
+- printk(KERN_DEBUG "\tnhead_offs %u\n",
++ printk(KERN_ERR "\tnhead_offs %u\n",
+ le32_to_cpu(mst->nhead_offs));
+- printk(KERN_DEBUG "\tltab_lnum %u\n",
++ printk(KERN_ERR "\tltab_lnum %u\n",
+ le32_to_cpu(mst->ltab_lnum));
+- printk(KERN_DEBUG "\tltab_offs %u\n",
++ printk(KERN_ERR "\tltab_offs %u\n",
+ le32_to_cpu(mst->ltab_offs));
+- printk(KERN_DEBUG "\tlsave_lnum %u\n",
++ printk(KERN_ERR "\tlsave_lnum %u\n",
+ le32_to_cpu(mst->lsave_lnum));
+- printk(KERN_DEBUG "\tlsave_offs %u\n",
++ printk(KERN_ERR "\tlsave_offs %u\n",
+ le32_to_cpu(mst->lsave_offs));
+- printk(KERN_DEBUG "\tlscan_lnum %u\n",
++ printk(KERN_ERR "\tlscan_lnum %u\n",
+ le32_to_cpu(mst->lscan_lnum));
+- printk(KERN_DEBUG "\tleb_cnt %u\n",
++ printk(KERN_ERR "\tleb_cnt %u\n",
+ le32_to_cpu(mst->leb_cnt));
+- printk(KERN_DEBUG "\tempty_lebs %u\n",
++ printk(KERN_ERR "\tempty_lebs %u\n",
+ le32_to_cpu(mst->empty_lebs));
+- printk(KERN_DEBUG "\tidx_lebs %u\n",
++ printk(KERN_ERR "\tidx_lebs %u\n",
+ le32_to_cpu(mst->idx_lebs));
+- printk(KERN_DEBUG "\ttotal_free %llu\n",
++ printk(KERN_ERR "\ttotal_free %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_free));
+- printk(KERN_DEBUG "\ttotal_dirty %llu\n",
++ printk(KERN_ERR "\ttotal_dirty %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_dirty));
+- printk(KERN_DEBUG "\ttotal_used %llu\n",
++ printk(KERN_ERR "\ttotal_used %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_used));
+- printk(KERN_DEBUG "\ttotal_dead %llu\n",
++ printk(KERN_ERR "\ttotal_dead %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_dead));
+- printk(KERN_DEBUG "\ttotal_dark %llu\n",
++ printk(KERN_ERR "\ttotal_dark %llu\n",
+ (unsigned long long)le64_to_cpu(mst->total_dark));
+ break;
+ }
+@@ -421,11 +448,11 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_ref_node *ref = node;
+
+- printk(KERN_DEBUG "\tlnum %u\n",
++ printk(KERN_ERR "\tlnum %u\n",
+ le32_to_cpu(ref->lnum));
+- printk(KERN_DEBUG "\toffs %u\n",
++ printk(KERN_ERR "\toffs %u\n",
+ le32_to_cpu(ref->offs));
+- printk(KERN_DEBUG "\tjhead %u\n",
++ printk(KERN_ERR "\tjhead %u\n",
+ le32_to_cpu(ref->jhead));
+ break;
+ }
+@@ -434,39 +461,40 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ const struct ubifs_ino_node *ino = node;
+
+ key_read(c, &ino->key, &key);
+- printk(KERN_DEBUG "\tkey %s\n", DBGKEY(&key));
+- printk(KERN_DEBUG "\tcreat_sqnum %llu\n",
++ printk(KERN_ERR "\tkey %s\n",
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
++ printk(KERN_ERR "\tcreat_sqnum %llu\n",
+ (unsigned long long)le64_to_cpu(ino->creat_sqnum));
+- printk(KERN_DEBUG "\tsize %llu\n",
++ printk(KERN_ERR "\tsize %llu\n",
+ (unsigned long long)le64_to_cpu(ino->size));
+- printk(KERN_DEBUG "\tnlink %u\n",
++ printk(KERN_ERR "\tnlink %u\n",
+ le32_to_cpu(ino->nlink));
+- printk(KERN_DEBUG "\tatime %lld.%u\n",
++ printk(KERN_ERR "\tatime %lld.%u\n",
+ (long long)le64_to_cpu(ino->atime_sec),
+ le32_to_cpu(ino->atime_nsec));
+- printk(KERN_DEBUG "\tmtime %lld.%u\n",
++ printk(KERN_ERR "\tmtime %lld.%u\n",
+ (long long)le64_to_cpu(ino->mtime_sec),
+ le32_to_cpu(ino->mtime_nsec));
+- printk(KERN_DEBUG "\tctime %lld.%u\n",
++ printk(KERN_ERR "\tctime %lld.%u\n",
+ (long long)le64_to_cpu(ino->ctime_sec),
+ le32_to_cpu(ino->ctime_nsec));
+- printk(KERN_DEBUG "\tuid %u\n",
++ printk(KERN_ERR "\tuid %u\n",
+ le32_to_cpu(ino->uid));
+- printk(KERN_DEBUG "\tgid %u\n",
++ printk(KERN_ERR "\tgid %u\n",
+ le32_to_cpu(ino->gid));
+- printk(KERN_DEBUG "\tmode %u\n",
++ printk(KERN_ERR "\tmode %u\n",
+ le32_to_cpu(ino->mode));
+- printk(KERN_DEBUG "\tflags %#x\n",
++ printk(KERN_ERR "\tflags %#x\n",
+ le32_to_cpu(ino->flags));
+- printk(KERN_DEBUG "\txattr_cnt %u\n",
++ printk(KERN_ERR "\txattr_cnt %u\n",
+ le32_to_cpu(ino->xattr_cnt));
+- printk(KERN_DEBUG "\txattr_size %u\n",
++ printk(KERN_ERR "\txattr_size %u\n",
+ le32_to_cpu(ino->xattr_size));
+- printk(KERN_DEBUG "\txattr_names %u\n",
++ printk(KERN_ERR "\txattr_names %u\n",
+ le32_to_cpu(ino->xattr_names));
+- printk(KERN_DEBUG "\tcompr_type %#x\n",
++ printk(KERN_ERR "\tcompr_type %#x\n",
+ (int)le16_to_cpu(ino->compr_type));
+- printk(KERN_DEBUG "\tdata len %u\n",
++ printk(KERN_ERR "\tdata len %u\n",
+ le32_to_cpu(ino->data_len));
+ break;
+ }
+@@ -477,15 +505,16 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ int nlen = le16_to_cpu(dent->nlen);
+
+ key_read(c, &dent->key, &key);
+- printk(KERN_DEBUG "\tkey %s\n", DBGKEY(&key));
+- printk(KERN_DEBUG "\tinum %llu\n",
++ printk(KERN_ERR "\tkey %s\n",
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
++ printk(KERN_ERR "\tinum %llu\n",
+ (unsigned long long)le64_to_cpu(dent->inum));
+- printk(KERN_DEBUG "\ttype %d\n", (int)dent->type);
+- printk(KERN_DEBUG "\tnlen %d\n", nlen);
+- printk(KERN_DEBUG "\tname ");
++ printk(KERN_ERR "\ttype %d\n", (int)dent->type);
++ printk(KERN_ERR "\tnlen %d\n", nlen);
++ printk(KERN_ERR "\tname ");
+
+ if (nlen > UBIFS_MAX_NLEN)
+- printk(KERN_DEBUG "(bad name length, not printing, "
++ printk(KERN_ERR "(bad name length, not printing, "
+ "bad or corrupted node)");
+ else {
+ for (i = 0; i < nlen && dent->name[i]; i++)
+@@ -501,15 +530,16 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ int dlen = le32_to_cpu(ch->len) - UBIFS_DATA_NODE_SZ;
+
+ key_read(c, &dn->key, &key);
+- printk(KERN_DEBUG "\tkey %s\n", DBGKEY(&key));
+- printk(KERN_DEBUG "\tsize %u\n",
++ printk(KERN_ERR "\tkey %s\n",
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
++ printk(KERN_ERR "\tsize %u\n",
+ le32_to_cpu(dn->size));
+- printk(KERN_DEBUG "\tcompr_typ %d\n",
++ printk(KERN_ERR "\tcompr_typ %d\n",
+ (int)le16_to_cpu(dn->compr_type));
+- printk(KERN_DEBUG "\tdata size %d\n",
++ printk(KERN_ERR "\tdata size %d\n",
+ dlen);
+- printk(KERN_DEBUG "\tdata:\n");
+- print_hex_dump(KERN_DEBUG, "\t", DUMP_PREFIX_OFFSET, 32, 1,
++ printk(KERN_ERR "\tdata:\n");
++ print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
+ (void *)&dn->data, dlen, 0);
+ break;
+ }
+@@ -517,11 +547,11 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_trun_node *trun = node;
+
+- printk(KERN_DEBUG "\tinum %u\n",
++ printk(KERN_ERR "\tinum %u\n",
+ le32_to_cpu(trun->inum));
+- printk(KERN_DEBUG "\told_size %llu\n",
++ printk(KERN_ERR "\told_size %llu\n",
+ (unsigned long long)le64_to_cpu(trun->old_size));
+- printk(KERN_DEBUG "\tnew_size %llu\n",
++ printk(KERN_ERR "\tnew_size %llu\n",
+ (unsigned long long)le64_to_cpu(trun->new_size));
+ break;
+ }
+@@ -530,19 +560,21 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ const struct ubifs_idx_node *idx = node;
+
+ n = le16_to_cpu(idx->child_cnt);
+- printk(KERN_DEBUG "\tchild_cnt %d\n", n);
+- printk(KERN_DEBUG "\tlevel %d\n",
++ printk(KERN_ERR "\tchild_cnt %d\n", n);
++ printk(KERN_ERR "\tlevel %d\n",
+ (int)le16_to_cpu(idx->level));
+- printk(KERN_DEBUG "\tBranches:\n");
++ printk(KERN_ERR "\tBranches:\n");
+
+ for (i = 0; i < n && i < c->fanout - 1; i++) {
+ const struct ubifs_branch *br;
+
+ br = ubifs_idx_branch(c, idx, i);
+ key_read(c, &br->key, &key);
+- printk(KERN_DEBUG "\t%d: LEB %d:%d len %d key %s\n",
++ printk(KERN_ERR "\t%d: LEB %d:%d len %d key %s\n",
+ i, le32_to_cpu(br->lnum), le32_to_cpu(br->offs),
+- le32_to_cpu(br->len), DBGKEY(&key));
++ le32_to_cpu(br->len),
++ dbg_snprintf_key(c, &key, key_buf,
++ DBG_KEY_BUF_LEN));
+ }
+ break;
+ }
+@@ -552,20 +584,20 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ {
+ const struct ubifs_orph_node *orph = node;
+
+- printk(KERN_DEBUG "\tcommit number %llu\n",
++ printk(KERN_ERR "\tcommit number %llu\n",
+ (unsigned long long)
+ le64_to_cpu(orph->cmt_no) & LLONG_MAX);
+- printk(KERN_DEBUG "\tlast node flag %llu\n",
++ printk(KERN_ERR "\tlast node flag %llu\n",
+ (unsigned long long)(le64_to_cpu(orph->cmt_no)) >> 63);
+ n = (le32_to_cpu(ch->len) - UBIFS_ORPH_NODE_SZ) >> 3;
+- printk(KERN_DEBUG "\t%d orphan inode numbers:\n", n);
++ printk(KERN_ERR "\t%d orphan inode numbers:\n", n);
+ for (i = 0; i < n; i++)
+- printk(KERN_DEBUG "\t ino %llu\n",
++ printk(KERN_ERR "\t ino %llu\n",
+ (unsigned long long)le64_to_cpu(orph->inos[i]));
+ break;
+ }
+ default:
+- printk(KERN_DEBUG "node type %d was not recognized\n",
++ printk(KERN_ERR "node type %d was not recognized\n",
+ (int)ch->node_type);
+ }
+ spin_unlock(&dbg_lock);
+@@ -574,16 +606,16 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
+ void dbg_dump_budget_req(const struct ubifs_budget_req *req)
+ {
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "Budgeting request: new_ino %d, dirtied_ino %d\n",
++ printk(KERN_ERR "Budgeting request: new_ino %d, dirtied_ino %d\n",
+ req->new_ino, req->dirtied_ino);
+- printk(KERN_DEBUG "\tnew_ino_d %d, dirtied_ino_d %d\n",
++ printk(KERN_ERR "\tnew_ino_d %d, dirtied_ino_d %d\n",
+ req->new_ino_d, req->dirtied_ino_d);
+- printk(KERN_DEBUG "\tnew_page %d, dirtied_page %d\n",
++ printk(KERN_ERR "\tnew_page %d, dirtied_page %d\n",
+ req->new_page, req->dirtied_page);
+- printk(KERN_DEBUG "\tnew_dent %d, mod_dent %d\n",
++ printk(KERN_ERR "\tnew_dent %d, mod_dent %d\n",
+ req->new_dent, req->mod_dent);
+- printk(KERN_DEBUG "\tidx_growth %d\n", req->idx_growth);
+- printk(KERN_DEBUG "\tdata_growth %d dd_growth %d\n",
++ printk(KERN_ERR "\tidx_growth %d\n", req->idx_growth);
++ printk(KERN_ERR "\tdata_growth %d dd_growth %d\n",
+ req->data_growth, req->dd_growth);
+ spin_unlock(&dbg_lock);
+ }
+@@ -591,18 +623,18 @@ void dbg_dump_budget_req(const struct ubifs_budget_req *req)
+ void dbg_dump_lstats(const struct ubifs_lp_stats *lst)
+ {
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "(pid %d) Lprops statistics: empty_lebs %d, "
++ printk(KERN_ERR "(pid %d) Lprops statistics: empty_lebs %d, "
+ "idx_lebs %d\n", current->pid, lst->empty_lebs, lst->idx_lebs);
+- printk(KERN_DEBUG "\ttaken_empty_lebs %d, total_free %lld, "
++ printk(KERN_ERR "\ttaken_empty_lebs %d, total_free %lld, "
+ "total_dirty %lld\n", lst->taken_empty_lebs, lst->total_free,
+ lst->total_dirty);
+- printk(KERN_DEBUG "\ttotal_used %lld, total_dark %lld, "
++ printk(KERN_ERR "\ttotal_used %lld, total_dark %lld, "
+ "total_dead %lld\n", lst->total_used, lst->total_dark,
+ lst->total_dead);
+ spin_unlock(&dbg_lock);
+ }
+
+-void dbg_dump_budg(struct ubifs_info *c)
++void dbg_dump_budg(struct ubifs_info *c, const struct ubifs_budg_info *bi)
+ {
+ int i;
+ struct rb_node *rb;
+@@ -610,51 +642,69 @@ void dbg_dump_budg(struct ubifs_info *c)
+ struct ubifs_gced_idx_leb *idx_gc;
+ long long available, outstanding, free;
+
+- ubifs_assert(spin_is_locked(&c->space_lock));
++ spin_lock(&c->space_lock);
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "(pid %d) Budgeting info: budg_data_growth %lld, "
+- "budg_dd_growth %lld, budg_idx_growth %lld\n", current->pid,
+- c->budg_data_growth, c->budg_dd_growth, c->budg_idx_growth);
+- printk(KERN_DEBUG "\tdata budget sum %lld, total budget sum %lld, "
+- "freeable_cnt %d\n", c->budg_data_growth + c->budg_dd_growth,
+- c->budg_data_growth + c->budg_dd_growth + c->budg_idx_growth,
+- c->freeable_cnt);
+- printk(KERN_DEBUG "\tmin_idx_lebs %d, old_idx_sz %lld, "
+- "calc_idx_sz %lld, idx_gc_cnt %d\n", c->min_idx_lebs,
+- c->old_idx_sz, c->calc_idx_sz, c->idx_gc_cnt);
+- printk(KERN_DEBUG "\tdirty_pg_cnt %ld, dirty_zn_cnt %ld, "
++ printk(KERN_ERR "(pid %d) Budgeting info: data budget sum %lld, "
++ "total budget sum %lld\n", current->pid,
++ bi->data_growth + bi->dd_growth,
++ bi->data_growth + bi->dd_growth + bi->idx_growth);
++ printk(KERN_ERR "\tbudg_data_growth %lld, budg_dd_growth %lld, "
++ "budg_idx_growth %lld\n", bi->data_growth, bi->dd_growth,
++ bi->idx_growth);
++ printk(KERN_ERR "\tmin_idx_lebs %d, old_idx_sz %llu, "
++ "uncommitted_idx %lld\n", bi->min_idx_lebs, bi->old_idx_sz,
++ bi->uncommitted_idx);
++ printk(KERN_ERR "\tpage_budget %d, inode_budget %d, dent_budget %d\n",
++ bi->page_budget, bi->inode_budget, bi->dent_budget);
++ printk(KERN_ERR "\tnospace %u, nospace_rp %u\n",
++ bi->nospace, bi->nospace_rp);
++ printk(KERN_ERR "\tdark_wm %d, dead_wm %d, max_idx_node_sz %d\n",
++ c->dark_wm, c->dead_wm, c->max_idx_node_sz);
++
++ if (bi != &c->bi)
++ /*
++ * If we are dumping saved budgeting data, do not print
++ * additional information which is about the current state, not
++ * the old one which corresponded to the saved budgeting data.
++ */
++ goto out_unlock;
++
++ printk(KERN_ERR "\tfreeable_cnt %d, calc_idx_sz %lld, idx_gc_cnt %d\n",
++ c->freeable_cnt, c->calc_idx_sz, c->idx_gc_cnt);
++ printk(KERN_ERR "\tdirty_pg_cnt %ld, dirty_zn_cnt %ld, "
+ "clean_zn_cnt %ld\n", atomic_long_read(&c->dirty_pg_cnt),
+ atomic_long_read(&c->dirty_zn_cnt),
+ atomic_long_read(&c->clean_zn_cnt));
+- printk(KERN_DEBUG "\tdark_wm %d, dead_wm %d, max_idx_node_sz %d\n",
+- c->dark_wm, c->dead_wm, c->max_idx_node_sz);
+- printk(KERN_DEBUG "\tgc_lnum %d, ihead_lnum %d\n",
++ printk(KERN_ERR "\tgc_lnum %d, ihead_lnum %d\n",
+ c->gc_lnum, c->ihead_lnum);
++
+ /* If we are in R/O mode, journal heads do not exist */
+ if (c->jheads)
+ for (i = 0; i < c->jhead_cnt; i++)
+- printk(KERN_DEBUG "\tjhead %s\t LEB %d\n",
++ printk(KERN_ERR "\tjhead %s\t LEB %d\n",
+ dbg_jhead(c->jheads[i].wbuf.jhead),
+ c->jheads[i].wbuf.lnum);
+ for (rb = rb_first(&c->buds); rb; rb = rb_next(rb)) {
+ bud = rb_entry(rb, struct ubifs_bud, rb);
+- printk(KERN_DEBUG "\tbud LEB %d\n", bud->lnum);
++ printk(KERN_ERR "\tbud LEB %d\n", bud->lnum);
+ }
+ list_for_each_entry(bud, &c->old_buds, list)
+- printk(KERN_DEBUG "\told bud LEB %d\n", bud->lnum);
++ printk(KERN_ERR "\told bud LEB %d\n", bud->lnum);
+ list_for_each_entry(idx_gc, &c->idx_gc, list)
+- printk(KERN_DEBUG "\tGC'ed idx LEB %d unmap %d\n",
++ printk(KERN_ERR "\tGC'ed idx LEB %d unmap %d\n",
+ idx_gc->lnum, idx_gc->unmap);
+- printk(KERN_DEBUG "\tcommit state %d\n", c->cmt_state);
++ printk(KERN_ERR "\tcommit state %d\n", c->cmt_state);
+
+ /* Print budgeting predictions */
+- available = ubifs_calc_available(c, c->min_idx_lebs);
+- outstanding = c->budg_data_growth + c->budg_dd_growth;
++ available = ubifs_calc_available(c, c->bi.min_idx_lebs);
++ outstanding = c->bi.data_growth + c->bi.dd_growth;
+ free = ubifs_get_free_space_nolock(c);
+- printk(KERN_DEBUG "Budgeting predictions:\n");
+- printk(KERN_DEBUG "\tavailable: %lld, outstanding %lld, free %lld\n",
++ printk(KERN_ERR "Budgeting predictions:\n");
++ printk(KERN_ERR "\tavailable: %lld, outstanding %lld, free %lld\n",
+ available, outstanding, free);
++out_unlock:
+ spin_unlock(&dbg_lock);
++ spin_unlock(&c->space_lock);
+ }
+
+ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
+@@ -670,11 +720,11 @@ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
+ dark = ubifs_calc_dark(c, spc);
+
+ if (lp->flags & LPROPS_INDEX)
+- printk(KERN_DEBUG "LEB %-7d free %-8d dirty %-8d used %-8d "
++ printk(KERN_ERR "LEB %-7d free %-8d dirty %-8d used %-8d "
+ "free + dirty %-8d flags %#x (", lp->lnum, lp->free,
+ lp->dirty, c->leb_size - spc, spc, lp->flags);
+ else
+- printk(KERN_DEBUG "LEB %-7d free %-8d dirty %-8d used %-8d "
++ printk(KERN_ERR "LEB %-7d free %-8d dirty %-8d used %-8d "
+ "free + dirty %-8d dark %-4d dead %-4d nodes fit %-3d "
+ "flags %#-4x (", lp->lnum, lp->free, lp->dirty,
+ c->leb_size - spc, spc, dark, dead,
+@@ -729,7 +779,13 @@ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp)
+ if (bud->lnum == lp->lnum) {
+ int head = 0;
+ for (i = 0; i < c->jhead_cnt; i++) {
+- if (lp->lnum == c->jheads[i].wbuf.lnum) {
++ /*
++ * Note, if we are in R/O mode or in the middle
++ * of mounting/re-mounting, the write-buffers do
++ * not exist.
++ */
++ if (c->jheads &&
++ lp->lnum == c->jheads[i].wbuf.lnum) {
+ printk(KERN_CONT ", jhead %s",
+ dbg_jhead(i));
+ head = 1;
+@@ -751,7 +807,7 @@ void dbg_dump_lprops(struct ubifs_info *c)
+ struct ubifs_lprops lp;
+ struct ubifs_lp_stats lst;
+
+- printk(KERN_DEBUG "(pid %d) start dumping LEB properties\n",
++ printk(KERN_ERR "(pid %d) start dumping LEB properties\n",
+ current->pid);
+ ubifs_get_lp_stats(c, &lst);
+ dbg_dump_lstats(&lst);
+@@ -763,7 +819,7 @@ void dbg_dump_lprops(struct ubifs_info *c)
+
+ dbg_dump_lprop(c, &lp);
+ }
+- printk(KERN_DEBUG "(pid %d) finish dumping LEB properties\n",
++ printk(KERN_ERR "(pid %d) finish dumping LEB properties\n",
+ current->pid);
+ }
+
+@@ -772,69 +828,96 @@ void dbg_dump_lpt_info(struct ubifs_info *c)
+ int i;
+
+ spin_lock(&dbg_lock);
+- printk(KERN_DEBUG "(pid %d) dumping LPT information\n", current->pid);
+- printk(KERN_DEBUG "\tlpt_sz: %lld\n", c->lpt_sz);
+- printk(KERN_DEBUG "\tpnode_sz: %d\n", c->pnode_sz);
+- printk(KERN_DEBUG "\tnnode_sz: %d\n", c->nnode_sz);
+- printk(KERN_DEBUG "\tltab_sz: %d\n", c->ltab_sz);
+- printk(KERN_DEBUG "\tlsave_sz: %d\n", c->lsave_sz);
+- printk(KERN_DEBUG "\tbig_lpt: %d\n", c->big_lpt);
+- printk(KERN_DEBUG "\tlpt_hght: %d\n", c->lpt_hght);
+- printk(KERN_DEBUG "\tpnode_cnt: %d\n", c->pnode_cnt);
+- printk(KERN_DEBUG "\tnnode_cnt: %d\n", c->nnode_cnt);
+- printk(KERN_DEBUG "\tdirty_pn_cnt: %d\n", c->dirty_pn_cnt);
+- printk(KERN_DEBUG "\tdirty_nn_cnt: %d\n", c->dirty_nn_cnt);
+- printk(KERN_DEBUG "\tlsave_cnt: %d\n", c->lsave_cnt);
+- printk(KERN_DEBUG "\tspace_bits: %d\n", c->space_bits);
+- printk(KERN_DEBUG "\tlpt_lnum_bits: %d\n", c->lpt_lnum_bits);
+- printk(KERN_DEBUG "\tlpt_offs_bits: %d\n", c->lpt_offs_bits);
+- printk(KERN_DEBUG "\tlpt_spc_bits: %d\n", c->lpt_spc_bits);
+- printk(KERN_DEBUG "\tpcnt_bits: %d\n", c->pcnt_bits);
+- printk(KERN_DEBUG "\tlnum_bits: %d\n", c->lnum_bits);
+- printk(KERN_DEBUG "\tLPT root is at %d:%d\n", c->lpt_lnum, c->lpt_offs);
+- printk(KERN_DEBUG "\tLPT head is at %d:%d\n",
++ printk(KERN_ERR "(pid %d) dumping LPT information\n", current->pid);
++ printk(KERN_ERR "\tlpt_sz: %lld\n", c->lpt_sz);
++ printk(KERN_ERR "\tpnode_sz: %d\n", c->pnode_sz);
++ printk(KERN_ERR "\tnnode_sz: %d\n", c->nnode_sz);
++ printk(KERN_ERR "\tltab_sz: %d\n", c->ltab_sz);
++ printk(KERN_ERR "\tlsave_sz: %d\n", c->lsave_sz);
++ printk(KERN_ERR "\tbig_lpt: %d\n", c->big_lpt);
++ printk(KERN_ERR "\tlpt_hght: %d\n", c->lpt_hght);
++ printk(KERN_ERR "\tpnode_cnt: %d\n", c->pnode_cnt);
++ printk(KERN_ERR "\tnnode_cnt: %d\n", c->nnode_cnt);
++ printk(KERN_ERR "\tdirty_pn_cnt: %d\n", c->dirty_pn_cnt);
++ printk(KERN_ERR "\tdirty_nn_cnt: %d\n", c->dirty_nn_cnt);
++ printk(KERN_ERR "\tlsave_cnt: %d\n", c->lsave_cnt);
++ printk(KERN_ERR "\tspace_bits: %d\n", c->space_bits);
++ printk(KERN_ERR "\tlpt_lnum_bits: %d\n", c->lpt_lnum_bits);
++ printk(KERN_ERR "\tlpt_offs_bits: %d\n", c->lpt_offs_bits);
++ printk(KERN_ERR "\tlpt_spc_bits: %d\n", c->lpt_spc_bits);
++ printk(KERN_ERR "\tpcnt_bits: %d\n", c->pcnt_bits);
++ printk(KERN_ERR "\tlnum_bits: %d\n", c->lnum_bits);
++ printk(KERN_ERR "\tLPT root is at %d:%d\n", c->lpt_lnum, c->lpt_offs);
++ printk(KERN_ERR "\tLPT head is at %d:%d\n",
+ c->nhead_lnum, c->nhead_offs);
+- printk(KERN_DEBUG "\tLPT ltab is at %d:%d\n",
++ printk(KERN_ERR "\tLPT ltab is at %d:%d\n",
+ c->ltab_lnum, c->ltab_offs);
+ if (c->big_lpt)
+- printk(KERN_DEBUG "\tLPT lsave is at %d:%d\n",
++ printk(KERN_ERR "\tLPT lsave is at %d:%d\n",
+ c->lsave_lnum, c->lsave_offs);
+ for (i = 0; i < c->lpt_lebs; i++)
+- printk(KERN_DEBUG "\tLPT LEB %d free %d dirty %d tgc %d "
++ printk(KERN_ERR "\tLPT LEB %d free %d dirty %d tgc %d "
+ "cmt %d\n", i + c->lpt_first, c->ltab[i].free,
+ c->ltab[i].dirty, c->ltab[i].tgc, c->ltab[i].cmt);
+ spin_unlock(&dbg_lock);
+ }
+
++void dbg_dump_sleb(const struct ubifs_info *c,
++ const struct ubifs_scan_leb *sleb, int offs)
++{
++ struct ubifs_scan_node *snod;
++
++ printk(KERN_ERR "(pid %d) start dumping scanned data from LEB %d:%d\n",
++ current->pid, sleb->lnum, offs);
++
++ list_for_each_entry(snod, &sleb->nodes, list) {
++ cond_resched();
++ printk(KERN_ERR "Dumping node at LEB %d:%d len %d\n", sleb->lnum,
++ snod->offs, snod->len);
++ dbg_dump_node(c, snod->node);
++ }
++}
++
+ void dbg_dump_leb(const struct ubifs_info *c, int lnum)
+ {
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
++ void *buf;
+
+- if (dbg_failure_mode)
++ if (dbg_is_tst_rcvry(c))
+ return;
+
+- printk(KERN_DEBUG "(pid %d) start dumping LEB %d\n",
++ printk(KERN_ERR "(pid %d) start dumping LEB %d\n",
+ current->pid, lnum);
+- sleb = ubifs_scan(c, lnum, 0, c->dbg->buf, 0);
++
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory for dumping LEB %d", lnum);
++ return;
++ }
++
++ sleb = ubifs_scan(c, lnum, 0, buf, 0);
+ if (IS_ERR(sleb)) {
+ ubifs_err("scan error %d", (int)PTR_ERR(sleb));
+- return;
++ goto out;
+ }
+
+- printk(KERN_DEBUG "LEB %d has %d nodes ending at %d\n", lnum,
++ printk(KERN_ERR "LEB %d has %d nodes ending at %d\n", lnum,
+ sleb->nodes_cnt, sleb->endpt);
+
+ list_for_each_entry(snod, &sleb->nodes, list) {
+ cond_resched();
+- printk(KERN_DEBUG "Dumping node at LEB %d:%d len %d\n", lnum,
++ printk(KERN_ERR "Dumping node at LEB %d:%d len %d\n", lnum,
+ snod->offs, snod->len);
+ dbg_dump_node(c, snod->node);
+ }
+
+- printk(KERN_DEBUG "(pid %d) finish dumping LEB %d\n",
++ printk(KERN_ERR "(pid %d) finish dumping LEB %d\n",
+ current->pid, lnum);
+ ubifs_scan_destroy(sleb);
++
++out:
++ vfree(buf);
+ return;
+ }
+
+@@ -843,6 +926,7 @@ void dbg_dump_znode(const struct ubifs_info *c,
+ {
+ int n;
+ const struct ubifs_zbranch *zbr;
++ char key_buf[DBG_KEY_BUF_LEN];
+
+ spin_lock(&dbg_lock);
+ if (znode->parent)
+@@ -850,7 +934,7 @@ void dbg_dump_znode(const struct ubifs_info *c,
+ else
+ zbr = &c->zroot;
+
+- printk(KERN_DEBUG "znode %p, LEB %d:%d len %d parent %p iip %d level %d"
++ printk(KERN_ERR "znode %p, LEB %d:%d len %d parent %p iip %d level %d"
+ " child_cnt %d flags %lx\n", znode, zbr->lnum, zbr->offs,
+ zbr->len, znode->parent, znode->iip, znode->level,
+ znode->child_cnt, znode->flags);
+@@ -860,19 +944,23 @@ void dbg_dump_znode(const struct ubifs_info *c,
+ return;
+ }
+
+- printk(KERN_DEBUG "zbranches:\n");
++ printk(KERN_ERR "zbranches:\n");
+ for (n = 0; n < znode->child_cnt; n++) {
+ zbr = &znode->zbranch[n];
+ if (znode->level > 0)
+- printk(KERN_DEBUG "\t%d: znode %p LEB %d:%d len %d key "
++ printk(KERN_ERR "\t%d: znode %p LEB %d:%d len %d key "
+ "%s\n", n, zbr->znode, zbr->lnum,
+ zbr->offs, zbr->len,
+- DBGKEY(&zbr->key));
++ dbg_snprintf_key(c, &zbr->key,
++ key_buf,
++ DBG_KEY_BUF_LEN));
+ else
+- printk(KERN_DEBUG "\t%d: LNC %p LEB %d:%d len %d key "
++ printk(KERN_ERR "\t%d: LNC %p LEB %d:%d len %d key "
+ "%s\n", n, zbr->znode, zbr->lnum,
+ zbr->offs, zbr->len,
+- DBGKEY(&zbr->key));
++ dbg_snprintf_key(c, &zbr->key,
++ key_buf,
++ DBG_KEY_BUF_LEN));
+ }
+ spin_unlock(&dbg_lock);
+ }
+@@ -881,16 +969,16 @@ void dbg_dump_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat)
+ {
+ int i;
+
+- printk(KERN_DEBUG "(pid %d) start dumping heap cat %d (%d elements)\n",
++ printk(KERN_ERR "(pid %d) start dumping heap cat %d (%d elements)\n",
+ current->pid, cat, heap->cnt);
+ for (i = 0; i < heap->cnt; i++) {
+ struct ubifs_lprops *lprops = heap->arr[i];
+
+- printk(KERN_DEBUG "\t%d. LEB %d hpos %d free %d dirty %d "
++ printk(KERN_ERR "\t%d. LEB %d hpos %d free %d dirty %d "
+ "flags %d\n", i, lprops->lnum, lprops->hpos,
+ lprops->free, lprops->dirty, lprops->flags);
+ }
+- printk(KERN_DEBUG "(pid %d) finish dumping heap\n", current->pid);
++ printk(KERN_ERR "(pid %d) finish dumping heap\n", current->pid);
+ }
+
+ void dbg_dump_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
+@@ -898,15 +986,15 @@ void dbg_dump_pnode(struct ubifs_info *c, struct ubifs_pnode *pnode,
+ {
+ int i;
+
+- printk(KERN_DEBUG "(pid %d) dumping pnode:\n", current->pid);
+- printk(KERN_DEBUG "\taddress %zx parent %zx cnext %zx\n",
++ printk(KERN_ERR "(pid %d) dumping pnode:\n", current->pid);
++ printk(KERN_ERR "\taddress %zx parent %zx cnext %zx\n",
+ (size_t)pnode, (size_t)parent, (size_t)pnode->cnext);
+- printk(KERN_DEBUG "\tflags %lu iip %d level %d num %d\n",
++ printk(KERN_ERR "\tflags %lu iip %d level %d num %d\n",
+ pnode->flags, iip, pnode->level, pnode->num);
+ for (i = 0; i < UBIFS_LPT_FANOUT; i++) {
+ struct ubifs_lprops *lp = &pnode->lprops[i];
+
+- printk(KERN_DEBUG "\t%d: free %d dirty %d flags %d lnum %d\n",
++ printk(KERN_ERR "\t%d: free %d dirty %d flags %d lnum %d\n",
+ i, lp->free, lp->dirty, lp->flags, lp->lnum);
+ }
+ }
+@@ -916,20 +1004,20 @@ void dbg_dump_tnc(struct ubifs_info *c)
+ struct ubifs_znode *znode;
+ int level;
+
+- printk(KERN_DEBUG "\n");
+- printk(KERN_DEBUG "(pid %d) start dumping TNC tree\n", current->pid);
++ printk(KERN_ERR "\n");
++ printk(KERN_ERR "(pid %d) start dumping TNC tree\n", current->pid);
+ znode = ubifs_tnc_levelorder_next(c->zroot.znode, NULL);
+ level = znode->level;
+- printk(KERN_DEBUG "== Level %d ==\n", level);
++ printk(KERN_ERR "== Level %d ==\n", level);
+ while (znode) {
+ if (level != znode->level) {
+ level = znode->level;
+- printk(KERN_DEBUG "== Level %d ==\n", level);
++ printk(KERN_ERR "== Level %d ==\n", level);
+ }
+ dbg_dump_znode(c, znode);
+ znode = ubifs_tnc_levelorder_next(c->zroot.znode, znode);
+ }
+- printk(KERN_DEBUG "(pid %d) finish dumping TNC tree\n", current->pid);
++ printk(KERN_ERR "(pid %d) finish dumping TNC tree\n", current->pid);
+ }
+
+ static int dump_znode(struct ubifs_info *c, struct ubifs_znode *znode,
+@@ -961,11 +1049,41 @@ void dbg_dump_index(struct ubifs_info *c)
+ void dbg_save_space_info(struct ubifs_info *c)
+ {
+ struct ubifs_debug_info *d = c->dbg;
+-
+- ubifs_get_lp_stats(c, &d->saved_lst);
++ int freeable_cnt;
+
+ spin_lock(&c->space_lock);
++ memcpy(&d->saved_lst, &c->lst, sizeof(struct ubifs_lp_stats));
++ memcpy(&d->saved_bi, &c->bi, sizeof(struct ubifs_budg_info));
++ d->saved_idx_gc_cnt = c->idx_gc_cnt;
++
++ /*
++ * We use a dirty hack here and zero out @c->freeable_cnt, because it
++ * affects the free space calculations, and UBIFS might not know about
++ * all freeable eraseblocks. Indeed, we know about freeable eraseblocks
++ * only when we read their lprops, and we do this only lazily, upon the
++ * need. So at any given point of time @c->freeable_cnt might be not
++ * exactly accurate.
++ *
++ * Just one example about the issue we hit when we did not zero
++ * @c->freeable_cnt.
++ * 1. The file-system is mounted R/O, c->freeable_cnt is %0. We save the
++ * amount of free space in @d->saved_free
++ * 2. We re-mount R/W, which makes UBIFS to read the "lsave"
++ * information from flash, where we cache LEBs from various
++ * categories ('ubifs_remount_fs()' -> 'ubifs_lpt_init()'
++ * -> 'lpt_init_wr()' -> 'read_lsave()' -> 'ubifs_lpt_lookup()'
++ * -> 'ubifs_get_pnode()' -> 'update_cats()'
++ * -> 'ubifs_add_to_cat()').
++ * 3. Lsave contains a freeable eraseblock, and @c->freeable_cnt
++ * becomes %1.
++ * 4. We calculate the amount of free space when the re-mount is
++ * finished in 'dbg_check_space_info()' and it does not match
++ * @d->saved_free.
++ */
++ freeable_cnt = c->freeable_cnt;
++ c->freeable_cnt = 0;
+ d->saved_free = ubifs_get_free_space_nolock(c);
++ c->freeable_cnt = freeable_cnt;
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -982,12 +1100,15 @@ int dbg_check_space_info(struct ubifs_info *c)
+ {
+ struct ubifs_debug_info *d = c->dbg;
+ struct ubifs_lp_stats lst;
+- long long avail, free;
++ long long free;
++ int freeable_cnt;
+
+ spin_lock(&c->space_lock);
+- avail = ubifs_calc_available(c, c->min_idx_lebs);
++ freeable_cnt = c->freeable_cnt;
++ c->freeable_cnt = 0;
++ free = ubifs_get_free_space_nolock(c);
++ c->freeable_cnt = freeable_cnt;
+ spin_unlock(&c->space_lock);
+- free = ubifs_get_free_space(c);
+
+ if (free != d->saved_free) {
+ ubifs_err("free space changed from %lld to %lld",
+@@ -1000,20 +1121,21 @@ int dbg_check_space_info(struct ubifs_info *c)
+ out:
+ ubifs_msg("saved lprops statistics dump");
+ dbg_dump_lstats(&d->saved_lst);
+- ubifs_get_lp_stats(c, &lst);
+-
++ ubifs_msg("saved budgeting info dump");
++ dbg_dump_budg(c, &d->saved_bi);
++ ubifs_msg("saved idx_gc_cnt %d", d->saved_idx_gc_cnt);
+ ubifs_msg("current lprops statistics dump");
++ ubifs_get_lp_stats(c, &lst);
+ dbg_dump_lstats(&lst);
+-
+- spin_lock(&c->space_lock);
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
++ ubifs_msg("current budgeting info dump");
++ dbg_dump_budg(c, &c->bi);
+ dump_stack();
+ return -EINVAL;
+ }
+
+ /**
+ * dbg_check_synced_i_size - check synchronized inode size.
++ * @c: UBIFS file-system description object
+ * @inode: inode to check
+ *
+ * If inode is clean, synchronized inode size has to be equivalent to current
+@@ -1021,12 +1143,12 @@ out:
+ * has to be locked). Returns %0 if synchronized inode size if correct, and
+ * %-EINVAL if not.
+ */
+-int dbg_check_synced_i_size(struct inode *inode)
++int dbg_check_synced_i_size(const struct ubifs_info *c, struct inode *inode)
+ {
+ int err = 0;
+ struct ubifs_inode *ui = ubifs_inode(inode);
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+@@ -1059,7 +1181,7 @@ int dbg_check_synced_i_size(struct inode *inode)
+ * Note, it is good idea to make sure the @dir->i_mutex is locked before
+ * calling this function.
+ */
+-int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
++int dbg_check_dir(struct ubifs_info *c, const struct inode *dir)
+ {
+ unsigned int nlink = 2;
+ union ubifs_key key;
+@@ -1067,7 +1189,7 @@ int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
+ struct qstr nm = { .name = NULL };
+ loff_t size = UBIFS_INO_NODE_SZ;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ if (!S_ISDIR(dir->i_mode))
+@@ -1101,12 +1223,14 @@ int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir)
+ "but calculated size is %llu", dir->i_ino,
+ (unsigned long long)i_size_read(dir),
+ (unsigned long long)size);
++ dbg_dump_inode(c, dir);
+ dump_stack();
+ return -EINVAL;
+ }
+ if (dir->i_nlink != nlink) {
+ ubifs_err("directory inode %lu has nlink %u, but calculated "
+ "nlink is %u", dir->i_ino, dir->i_nlink, nlink);
++ dbg_dump_inode(c, dir);
+ dump_stack();
+ return -EINVAL;
+ }
+@@ -1133,6 +1257,7 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ int err, nlen1, nlen2, cmp;
+ struct ubifs_dent_node *dent1, *dent2;
+ union ubifs_key key;
++ char key_buf[DBG_KEY_BUF_LEN];
+
+ ubifs_assert(!keys_cmp(c, &zbr1->key, &zbr2->key));
+ dent1 = kmalloc(UBIFS_MAX_DENT_NODE_SZ, GFP_NOFS);
+@@ -1163,9 +1288,11 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ key_read(c, &dent1->key, &key);
+ if (keys_cmp(c, &zbr1->key, &key)) {
+ dbg_err("1st entry at %d:%d has key %s", zbr1->lnum,
+- zbr1->offs, DBGKEY(&key));
++ zbr1->offs, dbg_snprintf_key(c, &key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_err("but it should have key %s according to tnc",
+- DBGKEY(&zbr1->key));
++ dbg_snprintf_key(c, &zbr1->key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_dump_node(c, dent1);
+ goto out_free;
+ }
+@@ -1173,9 +1300,11 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ key_read(c, &dent2->key, &key);
+ if (keys_cmp(c, &zbr2->key, &key)) {
+ dbg_err("2nd entry at %d:%d has key %s", zbr1->lnum,
+- zbr1->offs, DBGKEY(&key));
++ zbr1->offs, dbg_snprintf_key(c, &key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_err("but it should have key %s according to tnc",
+- DBGKEY(&zbr2->key));
++ dbg_snprintf_key(c, &zbr2->key, key_buf,
++ DBG_KEY_BUF_LEN));
+ dbg_dump_node(c, dent2);
+ goto out_free;
+ }
+@@ -1192,7 +1321,7 @@ static int dbg_check_key_order(struct ubifs_info *c, struct ubifs_zbranch *zbr1,
+ dbg_err("2 xent/dent nodes with the same name");
+ else
+ dbg_err("bad order of colliding key %s",
+- DBGKEY(&key));
++ dbg_snprintf_key(c, &key, key_buf, DBG_KEY_BUF_LEN));
+
+ ubifs_msg("first node at %d:%d\n", zbr1->lnum, zbr1->offs);
+ dbg_dump_node(c, dent1);
+@@ -1423,7 +1552,7 @@ int dbg_check_tnc(struct ubifs_info *c, int extra)
+ long clean_cnt = 0, dirty_cnt = 0;
+ int err, last;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_TNC))
++ if (!dbg_is_chk_index(c))
+ return 0;
+
+ ubifs_assert(mutex_is_locked(&c->tnc_mutex));
+@@ -1670,7 +1799,7 @@ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size)
+ int err;
+ long long calc = 0;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_IDX_SZ))
++ if (!dbg_is_chk_index(c))
+ return 0;
+
+ err = dbg_walk_index(c, NULL, add_size, &calc);
+@@ -1751,6 +1880,8 @@ static struct fsck_inode *add_inode(struct ubifs_info *c,
+ struct rb_node **p, *parent = NULL;
+ struct fsck_inode *fscki;
+ ino_t inum = key_inum_flash(c, &ino->key);
++ struct inode *inode;
++ struct ubifs_inode *ui;
+
+ p = &fsckd->inodes.rb_node;
+ while (*p) {
+@@ -1774,19 +1905,46 @@ static struct fsck_inode *add_inode(struct ubifs_info *c,
+ if (!fscki)
+ return ERR_PTR(-ENOMEM);
+
++ inode = ilookup(c->vfs_sb, inum);
++
+ fscki->inum = inum;
+- fscki->nlink = le32_to_cpu(ino->nlink);
+- fscki->size = le64_to_cpu(ino->size);
+- fscki->xattr_cnt = le32_to_cpu(ino->xattr_cnt);
+- fscki->xattr_sz = le32_to_cpu(ino->xattr_size);
+- fscki->xattr_nms = le32_to_cpu(ino->xattr_names);
+- fscki->mode = le32_to_cpu(ino->mode);
++ /*
++ * If the inode is present in the VFS inode cache, use it instead of
++ * the on-flash inode which might be out-of-date. E.g., the size might
++ * be out-of-date. If we do not do this, the following may happen, for
++ * example:
++ * 1. A power cut happens
++ * 2. We mount the file-system R/O, the replay process fixes up the
++ * inode size in the VFS cache, but on on-flash.
++ * 3. 'check_leaf()' fails because it hits a data node beyond inode
++ * size.
++ */
++ if (!inode) {
++ fscki->nlink = le32_to_cpu(ino->nlink);
++ fscki->size = le64_to_cpu(ino->size);
++ fscki->xattr_cnt = le32_to_cpu(ino->xattr_cnt);
++ fscki->xattr_sz = le32_to_cpu(ino->xattr_size);
++ fscki->xattr_nms = le32_to_cpu(ino->xattr_names);
++ fscki->mode = le32_to_cpu(ino->mode);
++ } else {
++ ui = ubifs_inode(inode);
++ fscki->nlink = inode->i_nlink;
++ fscki->size = inode->i_size;
++ fscki->xattr_cnt = ui->xattr_cnt;
++ fscki->xattr_sz = ui->xattr_size;
++ fscki->xattr_nms = ui->xattr_names;
++ fscki->mode = inode->i_mode;
++ iput(inode);
++ }
++
+ if (S_ISDIR(fscki->mode)) {
+ fscki->calc_sz = UBIFS_INO_NODE_SZ;
+ fscki->calc_cnt = 2;
+ }
++
+ rb_link_node(&fscki->rb, parent, p);
+ rb_insert_color(&fscki->rb, &fsckd->inodes);
++
+ return fscki;
+ }
+
+@@ -2217,7 +2375,7 @@ int dbg_check_filesystem(struct ubifs_info *c)
+ int err;
+ struct fsck_data fsckd;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_FS))
++ if (!dbg_is_chk_fs(c))
+ return 0;
+
+ fsckd.inodes = RB_ROOT;
+@@ -2252,7 +2410,7 @@ int dbg_check_data_nodes_order(struct ubifs_info *c, struct list_head *head)
+ struct list_head *cur;
+ struct ubifs_scan_node *sa, *sb;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ for (cur = head->next; cur->next != head; cur = cur->next) {
+@@ -2319,7 +2477,7 @@ int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head)
+ struct list_head *cur;
+ struct ubifs_scan_node *sa, *sb;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ for (cur = head->next; cur->next != head; cur = cur->next) {
+@@ -2379,7 +2537,8 @@ int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head)
+ hashb = key_block(c, &sb->key);
+
+ if (hasha > hashb) {
+- ubifs_err("larger hash %u goes before %u", hasha, hashb);
++ ubifs_err("larger hash %u goes before %u",
++ hasha, hashb);
+ goto error_dump;
+ }
+ }
+@@ -2395,393 +2554,351 @@ error_dump:
+ return 0;
+ }
+
+-static int invocation_cnt;
+-
+-int dbg_force_in_the_gaps(void)
+-{
+- if (!dbg_force_in_the_gaps_enabled)
+- return 0;
+- /* Force in-the-gaps every 8th commit */
+- return !((invocation_cnt++) & 0x7);
+-}
+-
+-/* Failure mode for recovery testing */
+-
+-#define chance(n, d) (simple_rand() <= (n) * 32768LL / (d))
+-
+-struct failure_mode_info {
+- struct list_head list;
+- struct ubifs_info *c;
+-};
+-
+-static LIST_HEAD(fmi_list);
+-static DEFINE_SPINLOCK(fmi_lock);
+-
+-static unsigned int next;
+-
+-static int simple_rand(void)
+-{
+- if (next == 0)
+- next = current->pid;
+- next = next * 1103515245 + 12345;
+- return (next >> 16) & 32767;
+-}
+-
+-static void failure_mode_init(struct ubifs_info *c)
+-{
+- struct failure_mode_info *fmi;
+-
+- fmi = kmalloc(sizeof(struct failure_mode_info), GFP_NOFS);
+- if (!fmi) {
+- ubifs_err("Failed to register failure mode - no memory");
+- return;
+- }
+- fmi->c = c;
+- spin_lock(&fmi_lock);
+- list_add_tail(&fmi->list, &fmi_list);
+- spin_unlock(&fmi_lock);
+-}
+-
+-static void failure_mode_exit(struct ubifs_info *c)
+-{
+- struct failure_mode_info *fmi, *tmp;
+-
+- spin_lock(&fmi_lock);
+- list_for_each_entry_safe(fmi, tmp, &fmi_list, list)
+- if (fmi->c == c) {
+- list_del(&fmi->list);
+- kfree(fmi);
+- }
+- spin_unlock(&fmi_lock);
+-}
+-
+-static struct ubifs_info *dbg_find_info(struct ubi_volume_desc *desc)
++static inline int chance(unsigned int n, unsigned int out_of)
+ {
+- struct failure_mode_info *fmi;
+-
+- spin_lock(&fmi_lock);
+- list_for_each_entry(fmi, &fmi_list, list)
+- if (fmi->c->ubi == desc) {
+- struct ubifs_info *c = fmi->c;
++ return !!((random32() % out_of) + 1 <= n);
+
+- spin_unlock(&fmi_lock);
+- return c;
+- }
+- spin_unlock(&fmi_lock);
+- return NULL;
+ }
+
+-static int in_failure_mode(struct ubi_volume_desc *desc)
++static int power_cut_emulated(struct ubifs_info *c, int lnum, int write)
+ {
+- struct ubifs_info *c = dbg_find_info(desc);
+-
+- if (c && dbg_failure_mode)
+- return c->dbg->failure_mode;
+- return 0;
+-}
++ struct ubifs_debug_info *d = c->dbg;
+
+-static int do_fail(struct ubi_volume_desc *desc, int lnum, int write)
+-{
+- struct ubifs_info *c = dbg_find_info(desc);
+- struct ubifs_debug_info *d;
++ ubifs_assert(dbg_is_tst_rcvry(c));
+
+- if (!c || !dbg_failure_mode)
+- return 0;
+- d = c->dbg;
+- if (d->failure_mode)
+- return 1;
+- if (!d->fail_cnt) {
+- /* First call - decide delay to failure */
++ if (!d->pc_cnt) {
++ /* First call - decide delay to the power cut */
+ if (chance(1, 2)) {
+- unsigned int delay = 1 << (simple_rand() >> 11);
++ unsigned long delay;
+
+ if (chance(1, 2)) {
+- d->fail_delay = 1;
+- d->fail_timeout = jiffies +
+- msecs_to_jiffies(delay);
+- dbg_rcvry("failing after %ums", delay);
++ d->pc_delay = 1;
++ /* Fail withing 1 minute */
++ delay = random32() % 60000;
++ d->pc_timeout = jiffies;
++ d->pc_timeout += msecs_to_jiffies(delay);
++ ubifs_warn("failing after %lums", delay);
+ } else {
+- d->fail_delay = 2;
+- d->fail_cnt_max = delay;
+- dbg_rcvry("failing after %u calls", delay);
++ d->pc_delay = 2;
++ delay = random32() % 10000;
++ /* Fail within 10000 operations */
++ d->pc_cnt_max = delay;
++ ubifs_warn("failing after %lu calls", delay);
+ }
+ }
+- d->fail_cnt += 1;
++
++ d->pc_cnt += 1;
+ }
++
+ /* Determine if failure delay has expired */
+- if (d->fail_delay == 1) {
+- if (time_before(jiffies, d->fail_timeout))
++ if (d->pc_delay == 1 && time_before(jiffies, d->pc_timeout))
+ return 0;
+- } else if (d->fail_delay == 2)
+- if (d->fail_cnt++ < d->fail_cnt_max)
++ if (d->pc_delay == 2 && d->pc_cnt++ < d->pc_cnt_max)
+ return 0;
++
+ if (lnum == UBIFS_SB_LNUM) {
+- if (write) {
+- if (chance(1, 2))
+- return 0;
+- } else if (chance(19, 20))
++ if (write && chance(1, 2))
+ return 0;
+- dbg_rcvry("failing in super block LEB %d", lnum);
++ if (chance(19, 20))
++ return 0;
++ ubifs_warn("failing in super block LEB %d", lnum);
+ } else if (lnum == UBIFS_MST_LNUM || lnum == UBIFS_MST_LNUM + 1) {
+ if (chance(19, 20))
+ return 0;
+- dbg_rcvry("failing in master LEB %d", lnum);
++ ubifs_warn("failing in master LEB %d", lnum);
+ } else if (lnum >= UBIFS_LOG_LNUM && lnum <= c->log_last) {
+- if (write) {
+- if (chance(99, 100))
+- return 0;
+- } else if (chance(399, 400))
++ if (write && chance(99, 100))
++ return 0;
++ if (chance(399, 400))
+ return 0;
+- dbg_rcvry("failing in log LEB %d", lnum);
++ ubifs_warn("failing in log LEB %d", lnum);
+ } else if (lnum >= c->lpt_first && lnum <= c->lpt_last) {
+- if (write) {
+- if (chance(7, 8))
+- return 0;
+- } else if (chance(19, 20))
++ if (write && chance(7, 8))
+ return 0;
+- dbg_rcvry("failing in LPT LEB %d", lnum);
++ if (chance(19, 20))
++ return 0;
++ ubifs_warn("failing in LPT LEB %d", lnum);
+ } else if (lnum >= c->orph_first && lnum <= c->orph_last) {
+- if (write) {
+- if (chance(1, 2))
+- return 0;
+- } else if (chance(9, 10))
++ if (write && chance(1, 2))
+ return 0;
+- dbg_rcvry("failing in orphan LEB %d", lnum);
++ if (chance(9, 10))
++ return 0;
++ ubifs_warn("failing in orphan LEB %d", lnum);
+ } else if (lnum == c->ihead_lnum) {
+ if (chance(99, 100))
+ return 0;
+- dbg_rcvry("failing in index head LEB %d", lnum);
++ ubifs_warn("failing in index head LEB %d", lnum);
+ } else if (c->jheads && lnum == c->jheads[GCHD].wbuf.lnum) {
+ if (chance(9, 10))
+ return 0;
+- dbg_rcvry("failing in GC head LEB %d", lnum);
++ ubifs_warn("failing in GC head LEB %d", lnum);
+ } else if (write && !RB_EMPTY_ROOT(&c->buds) &&
+ !ubifs_search_bud(c, lnum)) {
+ if (chance(19, 20))
+ return 0;
+- dbg_rcvry("failing in non-bud LEB %d", lnum);
++ ubifs_warn("failing in non-bud LEB %d", lnum);
+ } else if (c->cmt_state == COMMIT_RUNNING_BACKGROUND ||
+ c->cmt_state == COMMIT_RUNNING_REQUIRED) {
+ if (chance(999, 1000))
+ return 0;
+- dbg_rcvry("failing in bud LEB %d commit running", lnum);
++ ubifs_warn("failing in bud LEB %d commit running", lnum);
+ } else {
+ if (chance(9999, 10000))
+ return 0;
+- dbg_rcvry("failing in bud LEB %d commit not running", lnum);
++ ubifs_warn("failing in bud LEB %d commit not running", lnum);
+ }
+- ubifs_err("*** SETTING FAILURE MODE ON (LEB %d) ***", lnum);
+- d->failure_mode = 1;
++
++ d->pc_happened = 1;
++ ubifs_warn("========== Power cut emulated ==========");
+ dump_stack();
+ return 1;
+ }
+
+-static void cut_data(const void *buf, int len)
++static void cut_data(const void *buf, unsigned int len)
+ {
+- int flen, i;
++ unsigned int from, to, i, ffs = chance(1, 2);
+ unsigned char *p = (void *)buf;
+
+- flen = (len * (long long)simple_rand()) >> 15;
+- for (i = flen; i < len; i++)
+- p[i] = 0xff;
+-}
++ from = random32() % (len + 1);
++ if (chance(1, 2))
++ to = random32() % (len - from + 1);
++ else
++ to = len;
+
+-int dbg_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
+- int len, int check)
+-{
+- if (in_failure_mode(desc))
+- return -EIO;
+- return ubi_leb_read(desc, lnum, buf, offset, len, check);
++ if (from < to)
++ ubifs_warn("filled bytes %u-%u with %s", from, to - 1,
++ ffs ? "0xFFs" : "random data");
++
++ if (ffs)
++ for (i = from; i < to; i++)
++ p[i] = 0xFF;
++ else
++ for (i = from; i < to; i++)
++ p[i] = random32() % 0x100;
+ }
+
+-int dbg_leb_write(struct ubi_volume_desc *desc, int lnum, const void *buf,
+- int offset, int len, int dtype)
++int dbg_leb_write(struct ubifs_info *c, int lnum, const void *buf,
++ int offs, int len, int dtype)
+ {
+ int err, failing;
+
+- if (in_failure_mode(desc))
+- return -EIO;
+- failing = do_fail(desc, lnum, 1);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++
++ failing = power_cut_emulated(c, lnum, 1);
+ if (failing)
+ cut_data(buf, len);
+- err = ubi_leb_write(desc, lnum, buf, offset, len, dtype);
++ err = ubi_leb_write(c->ubi, lnum, buf, offs, len, dtype);
+ if (err)
+ return err;
+ if (failing)
+- return -EIO;
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_leb_change(struct ubi_volume_desc *desc, int lnum, const void *buf,
++int dbg_leb_change(struct ubifs_info *c, int lnum, const void *buf,
+ int len, int dtype)
+ {
+ int err;
+
+- if (do_fail(desc, lnum, 1))
+- return -EIO;
+- err = ubi_leb_change(desc, lnum, buf, len, dtype);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++ if (power_cut_emulated(c, lnum, 1))
++ return -EROFS;
++ err = ubi_leb_change(c->ubi, lnum, buf, len, dtype);
+ if (err)
+ return err;
+- if (do_fail(desc, lnum, 1))
+- return -EIO;
++ if (power_cut_emulated(c, lnum, 1))
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_leb_erase(struct ubi_volume_desc *desc, int lnum)
++int dbg_leb_unmap(struct ubifs_info *c, int lnum)
+ {
+ int err;
+
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- err = ubi_leb_erase(desc, lnum);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
++ err = ubi_leb_unmap(c->ubi, lnum);
+ if (err)
+ return err;
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_leb_unmap(struct ubi_volume_desc *desc, int lnum)
++int dbg_leb_map(struct ubifs_info *c, int lnum, int dtype)
+ {
+ int err;
+
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- err = ubi_leb_unmap(desc, lnum);
++ if (c->dbg->pc_happened)
++ return -EROFS;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
++ err = ubi_leb_map(c->ubi, lnum, dtype);
+ if (err)
+ return err;
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
++ if (power_cut_emulated(c, lnum, 0))
++ return -EROFS;
+ return 0;
+ }
+
+-int dbg_is_mapped(struct ubi_volume_desc *desc, int lnum)
+-{
+- if (in_failure_mode(desc))
+- return -EIO;
+- return ubi_is_mapped(desc, lnum);
+-}
++/*
++ * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
++ * contain the stuff specific to particular file-system mounts.
++ */
++static struct dentry *dfs_rootdir;
+
+-int dbg_leb_map(struct ubi_volume_desc *desc, int lnum, int dtype)
++static int dfs_file_open(struct inode *inode, struct file *file)
+ {
+- int err;
+-
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- err = ubi_leb_map(desc, lnum, dtype);
+- if (err)
+- return err;
+- if (do_fail(desc, lnum, 0))
+- return -EIO;
+- return 0;
++ file->private_data = inode->i_private;
++ return nonseekable_open(inode, file);
+ }
+
+ /**
+- * ubifs_debugging_init - initialize UBIFS debugging.
+- * @c: UBIFS file-system description object
++ * provide_user_output - provide output to the user reading a debugfs file.
++ * @val: boolean value for the answer
++ * @u: the buffer to store the answer at
++ * @count: size of the buffer
++ * @ppos: position in the @u output buffer
+ *
+- * This function initializes debugging-related data for the file system.
+- * Returns zero in case of success and a negative error code in case of
++ * This is a simple helper function which stores @val boolean value in the user
++ * buffer when the user reads one of UBIFS debugfs files. Returns amount of
++ * bytes written to @u in case of success and a negative error code in case of
+ * failure.
+ */
+-int ubifs_debugging_init(struct ubifs_info *c)
++static int provide_user_output(int val, char __user *u, size_t count,
++ loff_t *ppos)
+ {
+- c->dbg = kzalloc(sizeof(struct ubifs_debug_info), GFP_KERNEL);
+- if (!c->dbg)
+- return -ENOMEM;
+-
+- c->dbg->buf = vmalloc(c->leb_size);
+- if (!c->dbg->buf)
+- goto out;
++ char buf[3];
+
+- failure_mode_init(c);
+- return 0;
++ if (val)
++ buf[0] = '1';
++ else
++ buf[0] = '0';
++ buf[1] = '\n';
++ buf[2] = 0x00;
+
+-out:
+- kfree(c->dbg);
+- return -ENOMEM;
++ return simple_read_from_buffer(u, count, ppos, buf, 2);
+ }
+
+-/**
+- * ubifs_debugging_exit - free debugging data.
+- * @c: UBIFS file-system description object
+- */
+-void ubifs_debugging_exit(struct ubifs_info *c)
++static ssize_t dfs_file_read(struct file *file, char __user *u, size_t count,
++ loff_t *ppos)
+ {
+- failure_mode_exit(c);
+- vfree(c->dbg->buf);
+- kfree(c->dbg);
+-}
++ struct dentry *dent = file->f_path.dentry;
++ struct ubifs_info *c = file->private_data;
++ struct ubifs_debug_info *d = c->dbg;
++ int val;
++
++ if (dent == d->dfs_chk_gen)
++ val = d->chk_gen;
++ else if (dent == d->dfs_chk_index)
++ val = d->chk_index;
++ else if (dent == d->dfs_chk_orph)
++ val = d->chk_orph;
++ else if (dent == d->dfs_chk_lprops)
++ val = d->chk_lprops;
++ else if (dent == d->dfs_chk_fs)
++ val = d->chk_fs;
++ else if (dent == d->dfs_tst_rcvry)
++ val = d->tst_rcvry;
++ else
++ return -EINVAL;
+
+-/*
+- * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
+- * contain the stuff specific to particular file-system mounts.
+- */
+-static struct dentry *dfs_rootdir;
++ return provide_user_output(val, u, count, ppos);
++}
+
+ /**
+- * dbg_debugfs_init - initialize debugfs file-system.
++ * interpret_user_input - interpret user debugfs file input.
++ * @u: user-provided buffer with the input
++ * @count: buffer size
+ *
+- * UBIFS uses debugfs file-system to expose various debugging knobs to
+- * user-space. This function creates "ubifs" directory in the debugfs
+- * file-system. Returns zero in case of success and a negative error code in
+- * case of failure.
++ * This is a helper function which interpret user input to a boolean UBIFS
++ * debugfs file. Returns %0 or %1 in case of success and a negative error code
++ * in case of failure.
+ */
+-int dbg_debugfs_init(void)
++static int interpret_user_input(const char __user *u, size_t count)
+ {
+- dfs_rootdir = debugfs_create_dir("ubifs", NULL);
+- if (IS_ERR(dfs_rootdir)) {
+- int err = PTR_ERR(dfs_rootdir);
+- ubifs_err("cannot create \"ubifs\" debugfs directory, "
+- "error %d\n", err);
+- return err;
+- }
++ size_t buf_size;
++ char buf[8];
+
+- return 0;
+-}
++ buf_size = min_t(size_t, count, (sizeof(buf) - 1));
++ if (copy_from_user(buf, u, buf_size))
++ return -EFAULT;
+
+-/**
+- * dbg_debugfs_exit - remove the "ubifs" directory from debugfs file-system.
+- */
+-void dbg_debugfs_exit(void)
+-{
+- debugfs_remove(dfs_rootdir);
+-}
++ if (buf[0] == '1')
++ return 1;
++ else if (buf[0] == '0')
++ return 0;
+
+-static int open_debugfs_file(struct inode *inode, struct file *file)
+-{
+- file->private_data = inode->i_private;
+- return 0;
++ return -EINVAL;
+ }
+
+-static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
+- size_t count, loff_t *ppos)
++static ssize_t dfs_file_write(struct file *file, const char __user *u,
++ size_t count, loff_t *ppos)
+ {
+ struct ubifs_info *c = file->private_data;
+ struct ubifs_debug_info *d = c->dbg;
++ struct dentry *dent = file->f_path.dentry;
++ int val;
+
+- if (file->f_path.dentry == d->dfs_dump_lprops)
++ /*
++ * TODO: this is racy - the file-system might have already been
++ * unmounted and we'd oops in this case. The plan is to fix it with
++ * help of 'iterate_supers_type()' which we should have in v3.0: when
++ * a debugfs opened, we rember FS's UUID in file->private_data. Then
++ * whenever we access the FS via a debugfs file, we iterate all UBIFS
++ * superblocks and fine the one with the same UUID, and take the
++ * locking right.
++ *
++ * The other way to go suggested by Al Viro is to create a separate
++ * 'ubifs-debug' file-system instead.
++ */
++ if (file->f_path.dentry == d->dfs_dump_lprops) {
+ dbg_dump_lprops(c);
+- else if (file->f_path.dentry == d->dfs_dump_budg) {
+- spin_lock(&c->space_lock);
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
+- } else if (file->f_path.dentry == d->dfs_dump_tnc) {
++ return count;
++ }
++ if (file->f_path.dentry == d->dfs_dump_budg) {
++ dbg_dump_budg(c, &c->bi);
++ return count;
++ }
++ if (file->f_path.dentry == d->dfs_dump_tnc) {
+ mutex_lock(&c->tnc_mutex);
+ dbg_dump_tnc(c);
+ mutex_unlock(&c->tnc_mutex);
+- } else
++ return count;
++ }
++
++ val = interpret_user_input(u, count);
++ if (val < 0)
++ return val;
++
++ if (dent == d->dfs_chk_gen)
++ d->chk_gen = val;
++ else if (dent == d->dfs_chk_index)
++ d->chk_index = val;
++ else if (dent == d->dfs_chk_orph)
++ d->chk_orph = val;
++ else if (dent == d->dfs_chk_lprops)
++ d->chk_lprops = val;
++ else if (dent == d->dfs_chk_fs)
++ d->chk_fs = val;
++ else if (dent == d->dfs_tst_rcvry)
++ d->tst_rcvry = val;
++ else
+ return -EINVAL;
+
+- *ppos += count;
+ return count;
+ }
+
+ static const struct file_operations dfs_fops = {
+- .open = open_debugfs_file,
+- .write = write_debugfs_file,
++ .open = dfs_file_open,
++ .read = dfs_file_read,
++ .write = dfs_file_write,
+ .owner = THIS_MODULE,
+- .llseek = default_llseek,
++ .llseek = no_llseek,
+ };
+
+ /**
+@@ -2798,46 +2915,94 @@ static const struct file_operations dfs_fops = {
+ */
+ int dbg_debugfs_init_fs(struct ubifs_info *c)
+ {
+- int err;
++ int err, n;
+ const char *fname;
+ struct dentry *dent;
+ struct ubifs_debug_info *d = c->dbg;
+
+- sprintf(d->dfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
+- d->dfs_dir = debugfs_create_dir(d->dfs_dir_name, dfs_rootdir);
+- if (IS_ERR(d->dfs_dir)) {
+- err = PTR_ERR(d->dfs_dir);
+- ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
+- d->dfs_dir_name, err);
++ n = snprintf(d->dfs_dir_name, UBIFS_DFS_DIR_LEN + 1, UBIFS_DFS_DIR_NAME,
++ c->vi.ubi_num, c->vi.vol_id);
++ if (n == UBIFS_DFS_DIR_LEN) {
++ /* The array size is too small */
++ fname = UBIFS_DFS_DIR_NAME;
++ dent = ERR_PTR(-EINVAL);
+ goto out;
+ }
+
++ fname = d->dfs_dir_name;
++ dent = debugfs_create_dir(fname, dfs_rootdir);
++ if (IS_ERR_OR_NULL(dent))
++ goto out;
++ d->dfs_dir = dent;
++
+ fname = "dump_lprops";
+- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+- if (IS_ERR(dent))
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
+ goto out_remove;
+ d->dfs_dump_lprops = dent;
+
+ fname = "dump_budg";
+- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+- if (IS_ERR(dent))
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
+ goto out_remove;
+ d->dfs_dump_budg = dent;
+
+ fname = "dump_tnc";
+- dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
+- if (IS_ERR(dent))
++ dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
+ goto out_remove;
+ d->dfs_dump_tnc = dent;
+
++ fname = "chk_general";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_gen = dent;
++
++ fname = "chk_index";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_index = dent;
++
++ fname = "chk_orphans";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_orph = dent;
++
++ fname = "chk_lprops";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_lprops = dent;
++
++ fname = "chk_fs";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_chk_fs = dent;
++
++ fname = "tst_recovery";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, d->dfs_dir, c,
++ &dfs_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ d->dfs_tst_rcvry = dent;
++
+ return 0;
+
+ out_remove:
+- err = PTR_ERR(dent);
+- ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
+- fname, err);
+ debugfs_remove_recursive(d->dfs_dir);
+ out:
++ err = dent ? PTR_ERR(dent) : -ENODEV;
++ ubifs_err("cannot create \"%s\" debugfs file or directory, error %d\n",
++ fname, err);
+ return err;
+ }
+
+@@ -2850,4 +3015,179 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c)
+ debugfs_remove_recursive(c->dbg->dfs_dir);
+ }
+
++struct ubifs_global_debug_info ubifs_dbg;
++
++static struct dentry *dfs_chk_gen;
++static struct dentry *dfs_chk_index;
++static struct dentry *dfs_chk_orph;
++static struct dentry *dfs_chk_lprops;
++static struct dentry *dfs_chk_fs;
++static struct dentry *dfs_tst_rcvry;
++
++static ssize_t dfs_global_file_read(struct file *file, char __user *u,
++ size_t count, loff_t *ppos)
++{
++ struct dentry *dent = file->f_path.dentry;
++ int val;
++
++ if (dent == dfs_chk_gen)
++ val = ubifs_dbg.chk_gen;
++ else if (dent == dfs_chk_index)
++ val = ubifs_dbg.chk_index;
++ else if (dent == dfs_chk_orph)
++ val = ubifs_dbg.chk_orph;
++ else if (dent == dfs_chk_lprops)
++ val = ubifs_dbg.chk_lprops;
++ else if (dent == dfs_chk_fs)
++ val = ubifs_dbg.chk_fs;
++ else if (dent == dfs_tst_rcvry)
++ val = ubifs_dbg.tst_rcvry;
++ else
++ return -EINVAL;
++
++ return provide_user_output(val, u, count, ppos);
++}
++
++static ssize_t dfs_global_file_write(struct file *file, const char __user *u,
++ size_t count, loff_t *ppos)
++{
++ struct dentry *dent = file->f_path.dentry;
++ int val;
++
++ val = interpret_user_input(u, count);
++ if (val < 0)
++ return val;
++
++ if (dent == dfs_chk_gen)
++ ubifs_dbg.chk_gen = val;
++ else if (dent == dfs_chk_index)
++ ubifs_dbg.chk_index = val;
++ else if (dent == dfs_chk_orph)
++ ubifs_dbg.chk_orph = val;
++ else if (dent == dfs_chk_lprops)
++ ubifs_dbg.chk_lprops = val;
++ else if (dent == dfs_chk_fs)
++ ubifs_dbg.chk_fs = val;
++ else if (dent == dfs_tst_rcvry)
++ ubifs_dbg.tst_rcvry = val;
++ else
++ return -EINVAL;
++
++ return count;
++}
++
++static const struct file_operations dfs_global_fops = {
++ .read = dfs_global_file_read,
++ .write = dfs_global_file_write,
++ .owner = THIS_MODULE,
++ .llseek = no_llseek,
++};
++
++/**
++ * dbg_debugfs_init - initialize debugfs file-system.
++ *
++ * UBIFS uses debugfs file-system to expose various debugging knobs to
++ * user-space. This function creates "ubifs" directory in the debugfs
++ * file-system. Returns zero in case of success and a negative error code in
++ * case of failure.
++ */
++int dbg_debugfs_init(void)
++{
++ int err;
++ const char *fname;
++ struct dentry *dent;
++
++ fname = "ubifs";
++ dent = debugfs_create_dir(fname, NULL);
++ if (IS_ERR_OR_NULL(dent))
++ goto out;
++ dfs_rootdir = dent;
++
++ fname = "chk_general";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_gen = dent;
++
++ fname = "chk_index";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_index = dent;
++
++ fname = "chk_orphans";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_orph = dent;
++
++ fname = "chk_lprops";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_lprops = dent;
++
++ fname = "chk_fs";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_chk_fs = dent;
++
++ fname = "tst_recovery";
++ dent = debugfs_create_file(fname, S_IRUSR | S_IWUSR, dfs_rootdir, NULL,
++ &dfs_global_fops);
++ if (IS_ERR_OR_NULL(dent))
++ goto out_remove;
++ dfs_tst_rcvry = dent;
++
++ return 0;
++
++out_remove:
++ debugfs_remove_recursive(dfs_rootdir);
++out:
++ err = dent ? PTR_ERR(dent) : -ENODEV;
++ ubifs_err("cannot create \"%s\" debugfs file or directory, error %d\n",
++ fname, err);
++ return err;
++}
++
++/**
++ * dbg_debugfs_exit - remove the "ubifs" directory from debugfs file-system.
++ */
++void dbg_debugfs_exit(void)
++{
++ debugfs_remove_recursive(dfs_rootdir);
++}
++
++/**
++ * ubifs_debugging_init - initialize UBIFS debugging.
++ * @c: UBIFS file-system description object
++ *
++ * This function initializes debugging-related data for the file system.
++ * Returns zero in case of success and a negative error code in case of
++ * failure.
++ */
++int ubifs_debugging_init(struct ubifs_info *c)
++{
++ c->dbg = kzalloc(sizeof(struct ubifs_debug_info), GFP_KERNEL);
++ if (!c->dbg)
++ return -ENOMEM;
++
++ return 0;
++}
++
++/**
++ * ubifs_debugging_exit - free debugging data.
++ * @c: UBIFS file-system description object
++ */
++void ubifs_debugging_exit(struct ubifs_info *c)
++{
++ kfree(c->dbg);
++}
++
+ #endif /* CONFIG_UBIFS_FS_DEBUG */
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index 555ba13..13917ce 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -31,17 +31,25 @@ typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+
++/*
++ * The UBIFS debugfs directory name pattern and maximum name length (3 for "ubi"
++ * + 1 for "_" and plus 2x2 for 2 UBI numbers and 1 for the trailing zero byte.
++ */
++#define UBIFS_DFS_DIR_NAME "ubi%d_%d"
++#define UBIFS_DFS_DIR_LEN (3 + 1 + 2*2 + 1)
++
+ /**
+ * ubifs_debug_info - per-FS debugging information.
+- * @buf: a buffer of LEB size, used for various purposes
+ * @old_zroot: old index root - used by 'dbg_check_old_index()'
+ * @old_zroot_level: old index root level - used by 'dbg_check_old_index()'
+ * @old_zroot_sqnum: old index root sqnum - used by 'dbg_check_old_index()'
+- * @failure_mode: failure mode for recovery testing
+- * @fail_delay: 0=>don't delay, 1=>delay a time, 2=>delay a number of calls
+- * @fail_timeout: time in jiffies when delay of failure mode expires
+- * @fail_cnt: current number of calls to failure mode I/O functions
+- * @fail_cnt_max: number of calls by which to delay failure mode
++ *
++ * @pc_happened: non-zero if an emulated power cut happened
++ * @pc_delay: 0=>don't delay, 1=>delay a time, 2=>delay a number of calls
++ * @pc_timeout: time in jiffies when delay of failure mode expires
++ * @pc_cnt: current number of calls to failure mode I/O functions
++ * @pc_cnt_max: number of calls by which to delay failure mode
++ *
+ * @chk_lpt_sz: used by LPT tree size checker
+ * @chk_lpt_sz2: used by LPT tree size checker
+ * @chk_lpt_wastage: used by LPT tree size checker
+@@ -51,24 +59,40 @@ typedef int (*dbg_znode_callback)(struct ubifs_info *c,
+ * @new_ihead_offs: used by debugging to check @c->ihead_offs
+ *
+ * @saved_lst: saved lprops statistics (used by 'dbg_save_space_info()')
+- * @saved_free: saved free space (used by 'dbg_save_space_info()')
++ * @saved_bi: saved budgeting information
++ * @saved_free: saved amount of free space
++ * @saved_idx_gc_cnt: saved value of @c->idx_gc_cnt
++ *
++ * @chk_gen: if general extra checks are enabled
++ * @chk_index: if index xtra checks are enabled
++ * @chk_orph: if orphans extra checks are enabled
++ * @chk_lprops: if lprops extra checks are enabled
++ * @chk_fs: if UBIFS contents extra checks are enabled
++ * @tst_rcvry: if UBIFS recovery testing mode enabled
+ *
+- * dfs_dir_name: name of debugfs directory containing this file-system's files
+- * dfs_dir: direntry object of the file-system debugfs directory
+- * dfs_dump_lprops: "dump lprops" debugfs knob
+- * dfs_dump_budg: "dump budgeting information" debugfs knob
+- * dfs_dump_tnc: "dump TNC" debugfs knob
++ * @dfs_dir_name: name of debugfs directory containing this file-system's files
++ * @dfs_dir: direntry object of the file-system debugfs directory
++ * @dfs_dump_lprops: "dump lprops" debugfs knob
++ * @dfs_dump_budg: "dump budgeting information" debugfs knob
++ * @dfs_dump_tnc: "dump TNC" debugfs knob
++ * @dfs_chk_gen: debugfs knob to enable UBIFS general extra checks
++ * @dfs_chk_index: debugfs knob to enable UBIFS index extra checks
++ * @dfs_chk_orph: debugfs knob to enable UBIFS orphans extra checks
++ * @dfs_chk_lprops: debugfs knob to enable UBIFS LEP properties extra checks
++ * @dfs_chk_fs: debugfs knob to enable UBIFS contents extra checks
++ * @dfs_tst_rcvry: debugfs knob to enable UBIFS recovery testing
+ */
+ struct ubifs_debug_info {
+- void *buf;
+ struct ubifs_zbranch old_zroot;
+ int old_zroot_level;
+ unsigned long long old_zroot_sqnum;
+- int failure_mode;
+- int fail_delay;
+- unsigned long fail_timeout;
+- unsigned int fail_cnt;
+- unsigned int fail_cnt_max;
++
++ int pc_happened;
++ int pc_delay;
++ unsigned long pc_timeout;
++ unsigned int pc_cnt;
++ unsigned int pc_cnt_max;
++
+ long long chk_lpt_sz;
+ long long chk_lpt_sz2;
+ long long chk_lpt_wastage;
+@@ -78,13 +102,47 @@ struct ubifs_debug_info {
+ int new_ihead_offs;
+
+ struct ubifs_lp_stats saved_lst;
++ struct ubifs_budg_info saved_bi;
+ long long saved_free;
++ int saved_idx_gc_cnt;
++
++ unsigned int chk_gen:1;
++ unsigned int chk_index:1;
++ unsigned int chk_orph:1;
++ unsigned int chk_lprops:1;
++ unsigned int chk_fs:1;
++ unsigned int tst_rcvry:1;
+
+- char dfs_dir_name[100];
++ char dfs_dir_name[UBIFS_DFS_DIR_LEN + 1];
+ struct dentry *dfs_dir;
+ struct dentry *dfs_dump_lprops;
+ struct dentry *dfs_dump_budg;
+ struct dentry *dfs_dump_tnc;
++ struct dentry *dfs_chk_gen;
++ struct dentry *dfs_chk_index;
++ struct dentry *dfs_chk_orph;
++ struct dentry *dfs_chk_lprops;
++ struct dentry *dfs_chk_fs;
++ struct dentry *dfs_tst_rcvry;
++};
++
++/**
++ * ubifs_global_debug_info - global (not per-FS) UBIFS debugging information.
++ *
++ * @chk_gen: if general extra checks are enabled
++ * @chk_index: if index xtra checks are enabled
++ * @chk_orph: if orphans extra checks are enabled
++ * @chk_lprops: if lprops extra checks are enabled
++ * @chk_fs: if UBIFS contents extra checks are enabled
++ * @tst_rcvry: if UBIFS recovery testing mode enabled
++ */
++struct ubifs_global_debug_info {
++ unsigned int chk_gen:1;
++ unsigned int chk_index:1;
++ unsigned int chk_orph:1;
++ unsigned int chk_lprops:1;
++ unsigned int chk_fs:1;
++ unsigned int tst_rcvry:1;
+ };
+
+ #define ubifs_assert(expr) do { \
+@@ -103,173 +161,90 @@ struct ubifs_debug_info {
+ } \
+ } while (0)
+
+-#define dbg_dump_stack() do { \
+- if (!dbg_failure_mode) \
+- dump_stack(); \
+-} while (0)
+-
+-/* Generic debugging messages */
+-#define dbg_msg(fmt, ...) do { \
+- spin_lock(&dbg_lock); \
+- printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid, \
+- __func__, ##__VA_ARGS__); \
+- spin_unlock(&dbg_lock); \
+-} while (0)
+-
+-#define dbg_do_msg(typ, fmt, ...) do { \
+- if (ubifs_msg_flags & typ) \
+- dbg_msg(fmt, ##__VA_ARGS__); \
+-} while (0)
++#define dbg_dump_stack() dump_stack()
+
+ #define dbg_err(fmt, ...) do { \
+- spin_lock(&dbg_lock); \
+ ubifs_err(fmt, ##__VA_ARGS__); \
+- spin_unlock(&dbg_lock); \
+ } while (0)
+
+-const char *dbg_key_str0(const struct ubifs_info *c,
+- const union ubifs_key *key);
+-const char *dbg_key_str1(const struct ubifs_info *c,
+- const union ubifs_key *key);
++#define ubifs_dbg_msg(type, fmt, ...) \
++ pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
+
+-/*
+- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
+- * macros.
+- */
+-#define DBGKEY(key) dbg_key_str0(c, (key))
+-#define DBGKEY1(key) dbg_key_str1(c, (key))
++#define DBG_KEY_BUF_LEN 32
++#define ubifs_dbg_msg_key(type, key, fmt, ...) do { \
++ char __tmp_key_buf[DBG_KEY_BUF_LEN]; \
++ pr_debug("UBIFS DBG " type ": " fmt "%s\n", ##__VA_ARGS__, \
++ dbg_snprintf_key(c, key, __tmp_key_buf, DBG_KEY_BUF_LEN)); \
++} while (0)
+
+-/* General messages */
+-#define dbg_gen(fmt, ...) dbg_do_msg(UBIFS_MSG_GEN, fmt, ##__VA_ARGS__)
++/* Just a debugging messages not related to any specific UBIFS subsystem */
++#define dbg_msg(fmt, ...) \
++ printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid, \
++ __func__, ##__VA_ARGS__)
+
++/* General messages */
++#define dbg_gen(fmt, ...) ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Additional journal messages */
+-#define dbg_jnl(fmt, ...) dbg_do_msg(UBIFS_MSG_JNL, fmt, ##__VA_ARGS__)
+-
++#define dbg_jnl(fmt, ...) ubifs_dbg_msg("jnl", fmt, ##__VA_ARGS__)
++#define dbg_jnlk(key, fmt, ...) \
++ ubifs_dbg_msg_key("jnl", key, fmt, ##__VA_ARGS__)
+ /* Additional TNC messages */
+-#define dbg_tnc(fmt, ...) dbg_do_msg(UBIFS_MSG_TNC, fmt, ##__VA_ARGS__)
+-
++#define dbg_tnc(fmt, ...) ubifs_dbg_msg("tnc", fmt, ##__VA_ARGS__)
++#define dbg_tnck(key, fmt, ...) \
++ ubifs_dbg_msg_key("tnc", key, fmt, ##__VA_ARGS__)
+ /* Additional lprops messages */
+-#define dbg_lp(fmt, ...) dbg_do_msg(UBIFS_MSG_LP, fmt, ##__VA_ARGS__)
+-
++#define dbg_lp(fmt, ...) ubifs_dbg_msg("lp", fmt, ##__VA_ARGS__)
+ /* Additional LEB find messages */
+-#define dbg_find(fmt, ...) dbg_do_msg(UBIFS_MSG_FIND, fmt, ##__VA_ARGS__)
+-
++#define dbg_find(fmt, ...) ubifs_dbg_msg("find", fmt, ##__VA_ARGS__)
+ /* Additional mount messages */
+-#define dbg_mnt(fmt, ...) dbg_do_msg(UBIFS_MSG_MNT, fmt, ##__VA_ARGS__)
+-
++#define dbg_mnt(fmt, ...) ubifs_dbg_msg("mnt", fmt, ##__VA_ARGS__)
++#define dbg_mntk(key, fmt, ...) \
++ ubifs_dbg_msg_key("mnt", key, fmt, ##__VA_ARGS__)
+ /* Additional I/O messages */
+-#define dbg_io(fmt, ...) dbg_do_msg(UBIFS_MSG_IO, fmt, ##__VA_ARGS__)
+-
++#define dbg_io(fmt, ...) ubifs_dbg_msg("io", fmt, ##__VA_ARGS__)
+ /* Additional commit messages */
+-#define dbg_cmt(fmt, ...) dbg_do_msg(UBIFS_MSG_CMT, fmt, ##__VA_ARGS__)
+-
++#define dbg_cmt(fmt, ...) ubifs_dbg_msg("cmt", fmt, ##__VA_ARGS__)
+ /* Additional budgeting messages */
+-#define dbg_budg(fmt, ...) dbg_do_msg(UBIFS_MSG_BUDG, fmt, ##__VA_ARGS__)
+-
++#define dbg_budg(fmt, ...) ubifs_dbg_msg("budg", fmt, ##__VA_ARGS__)
+ /* Additional log messages */
+-#define dbg_log(fmt, ...) dbg_do_msg(UBIFS_MSG_LOG, fmt, ##__VA_ARGS__)
+-
++#define dbg_log(fmt, ...) ubifs_dbg_msg("log", fmt, ##__VA_ARGS__)
+ /* Additional gc messages */
+-#define dbg_gc(fmt, ...) dbg_do_msg(UBIFS_MSG_GC, fmt, ##__VA_ARGS__)
+-
++#define dbg_gc(fmt, ...) ubifs_dbg_msg("gc", fmt, ##__VA_ARGS__)
+ /* Additional scan messages */
+-#define dbg_scan(fmt, ...) dbg_do_msg(UBIFS_MSG_SCAN, fmt, ##__VA_ARGS__)
+-
++#define dbg_scan(fmt, ...) ubifs_dbg_msg("scan", fmt, ##__VA_ARGS__)
+ /* Additional recovery messages */
+-#define dbg_rcvry(fmt, ...) dbg_do_msg(UBIFS_MSG_RCVRY, fmt, ##__VA_ARGS__)
++#define dbg_rcvry(fmt, ...) ubifs_dbg_msg("rcvry", fmt, ##__VA_ARGS__)
+
+-/*
+- * Debugging message type flags (must match msg_type_names in debug.c).
+- *
+- * UBIFS_MSG_GEN: general messages
+- * UBIFS_MSG_JNL: journal messages
+- * UBIFS_MSG_MNT: mount messages
+- * UBIFS_MSG_CMT: commit messages
+- * UBIFS_MSG_FIND: LEB find messages
+- * UBIFS_MSG_BUDG: budgeting messages
+- * UBIFS_MSG_GC: garbage collection messages
+- * UBIFS_MSG_TNC: TNC messages
+- * UBIFS_MSG_LP: lprops messages
+- * UBIFS_MSG_IO: I/O messages
+- * UBIFS_MSG_LOG: log messages
+- * UBIFS_MSG_SCAN: scan messages
+- * UBIFS_MSG_RCVRY: recovery messages
+- */
+-enum {
+- UBIFS_MSG_GEN = 0x1,
+- UBIFS_MSG_JNL = 0x2,
+- UBIFS_MSG_MNT = 0x4,
+- UBIFS_MSG_CMT = 0x8,
+- UBIFS_MSG_FIND = 0x10,
+- UBIFS_MSG_BUDG = 0x20,
+- UBIFS_MSG_GC = 0x40,
+- UBIFS_MSG_TNC = 0x80,
+- UBIFS_MSG_LP = 0x100,
+- UBIFS_MSG_IO = 0x200,
+- UBIFS_MSG_LOG = 0x400,
+- UBIFS_MSG_SCAN = 0x800,
+- UBIFS_MSG_RCVRY = 0x1000,
+-};
+-
+-/* Debugging message type flags for each default debug message level */
+-#define UBIFS_MSG_LVL_0 0
+-#define UBIFS_MSG_LVL_1 0x1
+-#define UBIFS_MSG_LVL_2 0x7f
+-#define UBIFS_MSG_LVL_3 0xffff
+-
+-/*
+- * Debugging check flags (must match chk_names in debug.c).
+- *
+- * UBIFS_CHK_GEN: general checks
+- * UBIFS_CHK_TNC: check TNC
+- * UBIFS_CHK_IDX_SZ: check index size
+- * UBIFS_CHK_ORPH: check orphans
+- * UBIFS_CHK_OLD_IDX: check the old index
+- * UBIFS_CHK_LPROPS: check lprops
+- * UBIFS_CHK_FS: check the file-system
+- */
+-enum {
+- UBIFS_CHK_GEN = 0x1,
+- UBIFS_CHK_TNC = 0x2,
+- UBIFS_CHK_IDX_SZ = 0x4,
+- UBIFS_CHK_ORPH = 0x8,
+- UBIFS_CHK_OLD_IDX = 0x10,
+- UBIFS_CHK_LPROPS = 0x20,
+- UBIFS_CHK_FS = 0x40,
+-};
++extern struct ubifs_global_debug_info ubifs_dbg;
+
+-/*
+- * Special testing flags (must match tst_names in debug.c).
+- *
+- * UBIFS_TST_FORCE_IN_THE_GAPS: force the use of in-the-gaps method
+- * UBIFS_TST_RCVRY: failure mode for recovery testing
+- */
+-enum {
+- UBIFS_TST_FORCE_IN_THE_GAPS = 0x2,
+- UBIFS_TST_RCVRY = 0x4,
+-};
+-
+-#if CONFIG_UBIFS_FS_DEBUG_MSG_LVL == 1
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_1
+-#elif CONFIG_UBIFS_FS_DEBUG_MSG_LVL == 2
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_2
+-#elif CONFIG_UBIFS_FS_DEBUG_MSG_LVL == 3
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_3
+-#else
+-#define UBIFS_MSG_FLAGS_DEFAULT UBIFS_MSG_LVL_0
+-#endif
+-
+-#ifdef CONFIG_UBIFS_FS_DEBUG_CHKS
+-#define UBIFS_CHK_FLAGS_DEFAULT 0xffffffff
+-#else
+-#define UBIFS_CHK_FLAGS_DEFAULT 0
+-#endif
+-
+-extern spinlock_t dbg_lock;
+-
+-extern unsigned int ubifs_msg_flags;
+-extern unsigned int ubifs_chk_flags;
+-extern unsigned int ubifs_tst_flags;
++static inline int dbg_is_chk_gen(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_gen || c->dbg->chk_gen);
++}
++static inline int dbg_is_chk_index(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_index || c->dbg->chk_index);
++}
++static inline int dbg_is_chk_orph(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_orph || c->dbg->chk_orph);
++}
++static inline int dbg_is_chk_lprops(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_lprops || c->dbg->chk_lprops);
++}
++static inline int dbg_is_chk_fs(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.chk_fs || c->dbg->chk_fs);
++}
++static inline int dbg_is_tst_rcvry(const struct ubifs_info *c)
++{
++ return !!(ubifs_dbg.tst_rcvry || c->dbg->tst_rcvry);
++}
++static inline int dbg_is_power_cut(const struct ubifs_info *c)
++{
++ return !!c->dbg->pc_happened;
++}
+
+ int ubifs_debugging_init(struct ubifs_info *c);
+ void ubifs_debugging_exit(struct ubifs_info *c);
+@@ -280,17 +255,21 @@ const char *dbg_cstate(int cmt_state);
+ const char *dbg_jhead(int jhead);
+ const char *dbg_get_key_dump(const struct ubifs_info *c,
+ const union ubifs_key *key);
+-void dbg_dump_inode(const struct ubifs_info *c, const struct inode *inode);
++const char *dbg_snprintf_key(const struct ubifs_info *c,
++ const union ubifs_key *key, char *buffer, int len);
++void dbg_dump_inode(struct ubifs_info *c, const struct inode *inode);
+ void dbg_dump_node(const struct ubifs_info *c, const void *node);
+ void dbg_dump_lpt_node(const struct ubifs_info *c, void *node, int lnum,
+ int offs);
+ void dbg_dump_budget_req(const struct ubifs_budget_req *req);
+ void dbg_dump_lstats(const struct ubifs_lp_stats *lst);
+-void dbg_dump_budg(struct ubifs_info *c);
++void dbg_dump_budg(struct ubifs_info *c, const struct ubifs_budg_info *bi);
+ void dbg_dump_lprop(const struct ubifs_info *c, const struct ubifs_lprops *lp);
+ void dbg_dump_lprops(struct ubifs_info *c);
+ void dbg_dump_lpt_info(struct ubifs_info *c);
+ void dbg_dump_leb(const struct ubifs_info *c, int lnum);
++void dbg_dump_sleb(const struct ubifs_info *c,
++ const struct ubifs_scan_leb *sleb, int offs);
+ void dbg_dump_znode(const struct ubifs_info *c,
+ const struct ubifs_znode *znode);
+ void dbg_dump_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat);
+@@ -313,14 +292,13 @@ int dbg_check_cats(struct ubifs_info *c);
+ int dbg_check_ltab(struct ubifs_info *c);
+ int dbg_chk_lpt_free_spc(struct ubifs_info *c);
+ int dbg_chk_lpt_sz(struct ubifs_info *c, int action, int len);
+-int dbg_check_synced_i_size(struct inode *inode);
+-int dbg_check_dir_size(struct ubifs_info *c, const struct inode *dir);
++int dbg_check_synced_i_size(const struct ubifs_info *c, struct inode *inode);
++int dbg_check_dir(struct ubifs_info *c, const struct inode *dir);
+ int dbg_check_tnc(struct ubifs_info *c, int extra);
+ int dbg_check_idx_size(struct ubifs_info *c, long long idx_size);
+ int dbg_check_filesystem(struct ubifs_info *c);
+ void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
+ int add_pos);
+-int dbg_check_lprops(struct ubifs_info *c);
+ int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
+ int row, int col);
+ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+@@ -328,57 +306,12 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+ int dbg_check_data_nodes_order(struct ubifs_info *c, struct list_head *head);
+ int dbg_check_nondata_nodes_order(struct ubifs_info *c, struct list_head *head);
+
+-/* Force the use of in-the-gaps method for testing */
+-
+-#define dbg_force_in_the_gaps_enabled \
+- (ubifs_tst_flags & UBIFS_TST_FORCE_IN_THE_GAPS)
+-
+-int dbg_force_in_the_gaps(void);
+-
+-/* Failure mode for recovery testing */
+-
+-#define dbg_failure_mode (ubifs_tst_flags & UBIFS_TST_RCVRY)
+-
+-#ifndef UBIFS_DBG_PRESERVE_UBI
+-
+-#define ubi_leb_read dbg_leb_read
+-#define ubi_leb_write dbg_leb_write
+-#define ubi_leb_change dbg_leb_change
+-#define ubi_leb_erase dbg_leb_erase
+-#define ubi_leb_unmap dbg_leb_unmap
+-#define ubi_is_mapped dbg_is_mapped
+-#define ubi_leb_map dbg_leb_map
+-
+-#endif
+-
+-int dbg_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
+- int len, int check);
+-int dbg_leb_write(struct ubi_volume_desc *desc, int lnum, const void *buf,
+- int offset, int len, int dtype);
+-int dbg_leb_change(struct ubi_volume_desc *desc, int lnum, const void *buf,
+- int len, int dtype);
+-int dbg_leb_erase(struct ubi_volume_desc *desc, int lnum);
+-int dbg_leb_unmap(struct ubi_volume_desc *desc, int lnum);
+-int dbg_is_mapped(struct ubi_volume_desc *desc, int lnum);
+-int dbg_leb_map(struct ubi_volume_desc *desc, int lnum, int dtype);
+-
+-static inline int dbg_read(struct ubi_volume_desc *desc, int lnum, char *buf,
+- int offset, int len)
+-{
+- return dbg_leb_read(desc, lnum, buf, offset, len, 0);
+-}
+-
+-static inline int dbg_write(struct ubi_volume_desc *desc, int lnum,
+- const void *buf, int offset, int len)
+-{
+- return dbg_leb_write(desc, lnum, buf, offset, len, UBI_UNKNOWN);
+-}
+-
+-static inline int dbg_change(struct ubi_volume_desc *desc, int lnum,
+- const void *buf, int len)
+-{
+- return dbg_leb_change(desc, lnum, buf, len, UBI_UNKNOWN);
+-}
++int dbg_leb_write(struct ubifs_info *c, int lnum, const void *buf, int offs,
++ int len, int dtype);
++int dbg_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len,
++ int dtype);
++int dbg_leb_unmap(struct ubifs_info *c, int lnum);
++int dbg_leb_map(struct ubifs_info *c, int lnum, int dtype);
+
+ /* Debugfs-related stuff */
+ int dbg_debugfs_init(void);
+@@ -390,116 +323,158 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
+
+ /* Use "if (0)" to make compiler check arguments even if debugging is off */
+ #define ubifs_assert(expr) do { \
+- if (0 && (expr)) \
++ if (0) \
+ printk(KERN_CRIT "UBIFS assert failed in %s at %u (pid %d)\n", \
+ __func__, __LINE__, current->pid); \
+ } while (0)
+
+-#define dbg_err(fmt, ...) do { \
+- if (0) \
+- ubifs_err(fmt, ##__VA_ARGS__); \
++#define dbg_err(fmt, ...) do { \
++ if (0) \
++ ubifs_err(fmt, ##__VA_ARGS__); \
+ } while (0)
+
+-#define dbg_msg(fmt, ...) do { \
+- if (0) \
+- printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", \
+- current->pid, __func__, ##__VA_ARGS__); \
++#define DBGKEY(key) ((char *)(key))
++#define DBGKEY1(key) ((char *)(key))
++
++#define ubifs_dbg_msg(fmt, ...) do { \
++ if (0) \
++ pr_debug(fmt "\n", ##__VA_ARGS__); \
+ } while (0)
+
+ #define dbg_dump_stack()
+ #define ubifs_assert_cmt_locked(c)
+
+-#define dbg_gen(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_jnl(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_tnc(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_lp(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_find(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_mnt(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_io(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_cmt(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_budg(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_log(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_gc(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_scan(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-#define dbg_rcvry(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+-
+-#define DBGKEY(key) ((char *)(key))
+-#define DBGKEY1(key) ((char *)(key))
+-
+-static inline int ubifs_debugging_init(struct ubifs_info *c) { return 0; }
+-static inline void ubifs_debugging_exit(struct ubifs_info *c) {}
+-static inline const char *dbg_ntype(int type) { return ""; }
+-static inline const char *dbg_cstate(int cmt_state) { return ""; }
+-static inline const char *dbg_jhead(int jhead) { return ""; }
+-static inline const char *dbg_get_key_dump(const struct ubifs_info *c,
+- const union ubifs_key *key) { return ""; }
+-static inline void dbg_dump_inode(const struct ubifs_info *c,
+- const struct inode *inode) {}
++#define dbg_msg(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_gen(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_jnl(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_jnlk(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_tnc(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_tnck(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_lp(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_find(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_mnt(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_mntk(key, fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_io(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_cmt(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_budg(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_log(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_gc(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_scan(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++#define dbg_rcvry(fmt, ...) ubifs_dbg_msg(fmt, ##__VA_ARGS__)
++
++static inline int ubifs_debugging_init(struct ubifs_info *c) { return 0; }
++static inline void ubifs_debugging_exit(struct ubifs_info *c) { return; }
++static inline const char *dbg_ntype(int type) { return ""; }
++static inline const char *dbg_cstate(int cmt_state) { return ""; }
++static inline const char *dbg_jhead(int jhead) { return ""; }
++static inline const char *
++dbg_get_key_dump(const struct ubifs_info *c,
++ const union ubifs_key *key) { return ""; }
++static inline const char *
++dbg_snprintf_key(const struct ubifs_info *c,
++ const union ubifs_key *key, char *buffer,
++ int len) { return ""; }
++static inline void dbg_dump_inode(struct ubifs_info *c,
++ const struct inode *inode) { return; }
+ static inline void dbg_dump_node(const struct ubifs_info *c,
+- const void *node) {}
++ const void *node) { return; }
+ static inline void dbg_dump_lpt_node(const struct ubifs_info *c,
+- void *node, int lnum, int offs) {}
+-static inline void dbg_dump_budget_req(const struct ubifs_budget_req *req) {}
+-static inline void dbg_dump_lstats(const struct ubifs_lp_stats *lst) {}
+-static inline void dbg_dump_budg(struct ubifs_info *c) {}
++ void *node, int lnum,
++ int offs) { return; }
++static inline void
++dbg_dump_budget_req(const struct ubifs_budget_req *req) { return; }
++static inline void
++dbg_dump_lstats(const struct ubifs_lp_stats *lst) { return; }
++static inline void
++dbg_dump_budg(struct ubifs_info *c,
++ const struct ubifs_budg_info *bi) { return; }
+ static inline void dbg_dump_lprop(const struct ubifs_info *c,
+- const struct ubifs_lprops *lp) {}
+-static inline void dbg_dump_lprops(struct ubifs_info *c) {}
+-static inline void dbg_dump_lpt_info(struct ubifs_info *c) {}
+-static inline void dbg_dump_leb(const struct ubifs_info *c, int lnum) {}
+-static inline void dbg_dump_znode(const struct ubifs_info *c,
+- const struct ubifs_znode *znode) {}
++ const struct ubifs_lprops *lp) { return; }
++static inline void dbg_dump_lprops(struct ubifs_info *c) { return; }
++static inline void dbg_dump_lpt_info(struct ubifs_info *c) { return; }
++static inline void dbg_dump_leb(const struct ubifs_info *c,
++ int lnum) { return; }
++static inline void
++dbg_dump_sleb(const struct ubifs_info *c,
++ const struct ubifs_scan_leb *sleb, int offs) { return; }
++static inline void
++dbg_dump_znode(const struct ubifs_info *c,
++ const struct ubifs_znode *znode) { return; }
+ static inline void dbg_dump_heap(struct ubifs_info *c,
+- struct ubifs_lpt_heap *heap, int cat) {}
++ struct ubifs_lpt_heap *heap,
++ int cat) { return; }
+ static inline void dbg_dump_pnode(struct ubifs_info *c,
+- struct ubifs_pnode *pnode, struct ubifs_nnode *parent, int iip) {}
+-static inline void dbg_dump_tnc(struct ubifs_info *c) {}
+-static inline void dbg_dump_index(struct ubifs_info *c) {}
+-static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c) {}
++ struct ubifs_pnode *pnode,
++ struct ubifs_nnode *parent,
++ int iip) { return; }
++static inline void dbg_dump_tnc(struct ubifs_info *c) { return; }
++static inline void dbg_dump_index(struct ubifs_info *c) { return; }
++static inline void dbg_dump_lpt_lebs(const struct ubifs_info *c) { return; }
+
+ static inline int dbg_walk_index(struct ubifs_info *c,
+- dbg_leaf_callback leaf_cb, dbg_znode_callback znode_cb, void *priv)
+- { return 0; }
+-
+-/* Checking functions */
+-static inline void dbg_save_space_info(struct ubifs_info *c) {}
+-static inline int dbg_check_space_info(struct ubifs_info *c) { return 0; }
+-static inline int dbg_check_lprops(struct ubifs_info *c) { return 0; }
+-static inline int dbg_old_index_check_init(struct ubifs_info *c,
+- struct ubifs_zbranch *zroot) { return 0; }
+-static inline int dbg_check_old_index(struct ubifs_info *c,
+- struct ubifs_zbranch *zroot) { return 0; }
+-static inline int dbg_check_cats(struct ubifs_info *c) { return 0; }
+-static inline int dbg_check_ltab(struct ubifs_info *c) { return 0; }
+-static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c) { return 0; }
++ dbg_leaf_callback leaf_cb,
++ dbg_znode_callback znode_cb,
++ void *priv) { return 0; }
++static inline void dbg_save_space_info(struct ubifs_info *c) { return; }
++static inline int dbg_check_space_info(struct ubifs_info *c) { return 0; }
++static inline int dbg_check_lprops(struct ubifs_info *c) { return 0; }
++static inline int
++dbg_old_index_check_init(struct ubifs_info *c,
++ struct ubifs_zbranch *zroot) { return 0; }
++static inline int
++dbg_check_old_index(struct ubifs_info *c,
++ struct ubifs_zbranch *zroot) { return 0; }
++static inline int dbg_check_cats(struct ubifs_info *c) { return 0; }
++static inline int dbg_check_ltab(struct ubifs_info *c) { return 0; }
++static inline int dbg_chk_lpt_free_spc(struct ubifs_info *c) { return 0; }
+ static inline int dbg_chk_lpt_sz(struct ubifs_info *c,
+- int action, int len) { return 0; }
+-static inline int dbg_check_synced_i_size(struct inode *inode) { return 0; }
+-static inline int dbg_check_dir_size(struct ubifs_info *c,
+- const struct inode *dir) { return 0; }
+-static inline int dbg_check_tnc(struct ubifs_info *c, int extra) { return 0; }
++ int action, int len) { return 0; }
++static inline int
++dbg_check_synced_i_size(const struct ubifs_info *c,
++ struct inode *inode) { return 0; }
++static inline int dbg_check_dir(struct ubifs_info *c,
++ const struct inode *dir) { return 0; }
++static inline int dbg_check_tnc(struct ubifs_info *c, int extra) { return 0; }
+ static inline int dbg_check_idx_size(struct ubifs_info *c,
+- long long idx_size) { return 0; }
+-static inline int dbg_check_filesystem(struct ubifs_info *c) { return 0; }
++ long long idx_size) { return 0; }
++static inline int dbg_check_filesystem(struct ubifs_info *c) { return 0; }
+ static inline void dbg_check_heap(struct ubifs_info *c,
+- struct ubifs_lpt_heap *heap, int cat, int add_pos) {}
++ struct ubifs_lpt_heap *heap,
++ int cat, int add_pos) { return; }
+ static inline int dbg_check_lpt_nodes(struct ubifs_info *c,
+- struct ubifs_cnode *cnode, int row, int col) { return 0; }
++ struct ubifs_cnode *cnode, int row, int col) { return 0; }
+ static inline int dbg_check_inode_size(struct ubifs_info *c,
+- const struct inode *inode, loff_t size) { return 0; }
+-static inline int dbg_check_data_nodes_order(struct ubifs_info *c,
+- struct list_head *head) { return 0; }
+-static inline int dbg_check_nondata_nodes_order(struct ubifs_info *c,
+- struct list_head *head) { return 0; }
+-
+-#define dbg_force_in_the_gaps_enabled 0
+-static inline int dbg_force_in_the_gaps(void) { return 0; }
+-#define dbg_failure_mode 0
+-
+-static inline int dbg_debugfs_init(void) { return 0; }
+-static inline void dbg_debugfs_exit(void) {}
+-static inline int dbg_debugfs_init_fs(struct ubifs_info *c) { return 0; }
+-static inline int dbg_debugfs_exit_fs(struct ubifs_info *c) { return 0; }
++ const struct inode *inode,
++ loff_t size) { return 0; }
++static inline int
++dbg_check_data_nodes_order(struct ubifs_info *c,
++ struct list_head *head) { return 0; }
++static inline int
++dbg_check_nondata_nodes_order(struct ubifs_info *c,
++ struct list_head *head) { return 0; }
++
++static inline int dbg_leb_write(struct ubifs_info *c, int lnum,
++ const void *buf, int offset,
++ int len, int dtype) { return 0; }
++static inline int dbg_leb_change(struct ubifs_info *c, int lnum,
++ const void *buf, int len,
++ int dtype) { return 0; }
++static inline int dbg_leb_unmap(struct ubifs_info *c, int lnum) { return 0; }
++static inline int dbg_leb_map(struct ubifs_info *c, int lnum,
++ int dtype) { return 0; }
++
++static inline int dbg_is_chk_gen(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_index(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_orph(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_lprops(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_chk_fs(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_tst_rcvry(const struct ubifs_info *c) { return 0; }
++static inline int dbg_is_power_cut(const struct ubifs_info *c) { return 0; }
++
++static inline int dbg_debugfs_init(void) { return 0; }
++static inline void dbg_debugfs_exit(void) { return; }
++static inline int dbg_debugfs_init_fs(struct ubifs_info *c) { return 0; }
++static inline int dbg_debugfs_exit_fs(struct ubifs_info *c) { return 0; }
+
+ #endif /* !CONFIG_UBIFS_FS_DEBUG */
+ #endif /* !__UBIFS_DEBUG_H__ */
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 14f64b6..9c5e3c5 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -102,7 +102,7 @@ struct inode *ubifs_new_inode(struct ubifs_info *c, const struct inode *dir,
+ * UBIFS has to fully control "clean <-> dirty" transitions of inodes
+ * to make budgeting work.
+ */
+- inode->i_flags |= (S_NOCMTIME);
++ inode->i_flags |= S_NOCMTIME;
+
+ inode_init_owner(inode, dir, mode);
+ inode->i_mtime = inode->i_atime = inode->i_ctime =
+@@ -172,9 +172,11 @@ struct inode *ubifs_new_inode(struct ubifs_info *c, const struct inode *dir,
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+
+-static int dbg_check_name(struct ubifs_dent_node *dent, struct qstr *nm)
++static int dbg_check_name(const struct ubifs_info *c,
++ const struct ubifs_dent_node *dent,
++ const struct qstr *nm)
+ {
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+ if (le16_to_cpu(dent->nlen) != nm->len)
+ return -EINVAL;
+@@ -185,7 +187,7 @@ static int dbg_check_name(struct ubifs_dent_node *dent, struct qstr *nm)
+
+ #else
+
+-#define dbg_check_name(dent, nm) 0
++#define dbg_check_name(c, dent, nm) 0
+
+ #endif
+
+@@ -219,7 +221,7 @@ static struct dentry *ubifs_lookup(struct inode *dir, struct dentry *dentry,
+ goto out;
+ }
+
+- if (dbg_check_name(dent, &dentry->d_name)) {
++ if (dbg_check_name(c, dent, &dentry->d_name)) {
+ err = -EINVAL;
+ goto out;
+ }
+@@ -540,7 +542,7 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
+ if (inode->i_nlink == 0)
+ return -ENOENT;
+
+- err = dbg_check_synced_i_size(inode);
++ err = dbg_check_synced_i_size(c, inode);
+ if (err)
+ return err;
+
+@@ -595,7 +597,7 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
+ inode->i_nlink, dir->i_ino);
+ ubifs_assert(mutex_is_locked(&dir->i_mutex));
+ ubifs_assert(mutex_is_locked(&inode->i_mutex));
+- err = dbg_check_synced_i_size(inode);
++ err = dbg_check_synced_i_size(c, inode);
+ if (err)
+ return err;
+
+@@ -621,7 +623,7 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
+ ubifs_release_budget(c, &req);
+ else {
+ /* We've deleted something - clean the "no space" flags */
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ return 0;
+@@ -711,7 +713,7 @@ static int ubifs_rmdir(struct inode *dir, struct dentry *dentry)
+ ubifs_release_budget(c, &req);
+ else {
+ /* We've deleted something - clean the "no space" flags */
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ return 0;
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index d77db7e..7cf738a 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -212,7 +212,7 @@ static void release_new_page_budget(struct ubifs_info *c)
+ */
+ static void release_existing_page_budget(struct ubifs_info *c)
+ {
+- struct ubifs_budget_req req = { .dd_growth = c->page_budget};
++ struct ubifs_budget_req req = { .dd_growth = c->bi.page_budget};
+
+ ubifs_release_budget(c, &req);
+ }
+@@ -448,10 +448,12 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
+ if (!(pos & ~PAGE_CACHE_MASK) && len == PAGE_CACHE_SIZE) {
+ /*
+ * We change whole page so no need to load it. But we
+- * have to set the @PG_checked flag to make the further
+- * code know that the page is new. This might be not
+- * true, but it is better to budget more than to read
+- * the page from the media.
++ * do not know whether this page exists on the media or
++ * not, so we assume the latter because it requires
++ * larger budget. The assumption is that it is better
++ * to budget a bit more than to read the page from the
++ * media. Thus, we are setting the @PG_checked flag
++ * here.
+ */
+ SetPageChecked(page);
+ skipped_read = 1;
+@@ -559,6 +561,7 @@ static int ubifs_write_end(struct file *file, struct address_space *mapping,
+ dbg_gen("copied %d instead of %d, read page and repeat",
+ copied, len);
+ cancel_budget(c, page, ui, appending);
++ ClearPageChecked(page);
+
+ /*
+ * Return 0 to force VFS to repeat the whole operation, or the
+@@ -968,11 +971,11 @@ static int do_writepage(struct page *page, int len)
+ * the page locked, and it locks @ui_mutex. However, write-back does take inode
+ * @i_mutex, which means other VFS operations may be run on this inode at the
+ * same time. And the problematic one is truncation to smaller size, from where
+- * we have to call 'truncate_setsize()', which first changes @inode->i_size, then
+- * drops the truncated pages. And while dropping the pages, it takes the page
+- * lock. This means that 'do_truncation()' cannot call 'truncate_setsize()' with
+- * @ui_mutex locked, because it would deadlock with 'ubifs_writepage()'. This
+- * means that @inode->i_size is changed while @ui_mutex is unlocked.
++ * we have to call 'truncate_setsize()', which first changes @inode->i_size,
++ * then drops the truncated pages. And while dropping the pages, it takes the
++ * page lock. This means that 'do_truncation()' cannot call 'truncate_setsize()'
++ * with @ui_mutex locked, because it would deadlock with 'ubifs_writepage()'.
++ * This means that @inode->i_size is changed while @ui_mutex is unlocked.
+ *
+ * XXX(truncate): with the new truncate sequence this is not true anymore,
+ * and the calls to truncate_setsize can be move around freely. They should
+@@ -1186,7 +1189,7 @@ out_budg:
+ if (budgeted)
+ ubifs_release_budget(c, &req);
+ else {
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ return err;
+@@ -1260,7 +1263,7 @@ int ubifs_setattr(struct dentry *dentry, struct iattr *attr)
+ if (err)
+ return err;
+
+- err = dbg_check_synced_i_size(inode);
++ err = dbg_check_synced_i_size(c, inode);
+ if (err)
+ return err;
+
+@@ -1309,6 +1312,13 @@ int ubifs_fsync(struct file *file, int datasync)
+
+ dbg_gen("syncing inode %lu", inode->i_ino);
+
++ if (c->ro_mount)
++ /*
++ * For some really strange reasons VFS does not filter out
++ * 'fsync()' for R/O mounted file-systems as per 2.6.39.
++ */
++ return 0;
++
+ /*
+ * VFS has already synchronized dirty pages for this inode. Synchronize
+ * the inode unless this is a 'datasync()' call.
+@@ -1426,10 +1436,11 @@ static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
+ }
+
+ /*
+- * mmap()d file has taken write protection fault and is being made
+- * writable. UBIFS must ensure page is budgeted for.
++ * mmap()d file has taken write protection fault and is being made writable.
++ * UBIFS must ensure page is budgeted for.
+ */
+-static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
++static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma,
++ struct vm_fault *vmf)
+ {
+ struct page *page = vmf->page;
+ struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
+@@ -1530,7 +1541,6 @@ static int ubifs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ int err;
+
+- /* 'generic_file_mmap()' takes care of NOMMU case */
+ err = generic_file_mmap(file, vma);
+ if (err)
+ return err;
+diff --git a/fs/ubifs/find.c b/fs/ubifs/find.c
+index 1d54383..2559d17 100644
+--- a/fs/ubifs/find.c
++++ b/fs/ubifs/find.c
+@@ -252,8 +252,8 @@ int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
+ * But if the index takes fewer LEBs than it is reserved for it,
+ * this function must avoid picking those reserved LEBs.
+ */
+- if (c->min_idx_lebs >= c->lst.idx_lebs) {
+- rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
++ if (c->bi.min_idx_lebs >= c->lst.idx_lebs) {
++ rsvd_idx_lebs = c->bi.min_idx_lebs - c->lst.idx_lebs;
+ exclude_index = 1;
+ }
+ spin_unlock(&c->space_lock);
+@@ -276,7 +276,7 @@ int ubifs_find_dirty_leb(struct ubifs_info *c, struct ubifs_lprops *ret_lp,
+ pick_free = 0;
+ } else {
+ spin_lock(&c->space_lock);
+- exclude_index = (c->min_idx_lebs >= c->lst.idx_lebs);
++ exclude_index = (c->bi.min_idx_lebs >= c->lst.idx_lebs);
+ spin_unlock(&c->space_lock);
+ }
+
+@@ -501,8 +501,8 @@ int ubifs_find_free_space(struct ubifs_info *c, int min_space, int *offs,
+
+ /* Check if there are enough empty LEBs for commit */
+ spin_lock(&c->space_lock);
+- if (c->min_idx_lebs > c->lst.idx_lebs)
+- rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
++ if (c->bi.min_idx_lebs > c->lst.idx_lebs)
++ rsvd_idx_lebs = c->bi.min_idx_lebs - c->lst.idx_lebs;
+ else
+ rsvd_idx_lebs = 0;
+ lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
+diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
+index 151f108..ded29f6 100644
+--- a/fs/ubifs/gc.c
++++ b/fs/ubifs/gc.c
+@@ -100,6 +100,10 @@ static int switch_gc_head(struct ubifs_info *c)
+ if (err)
+ return err;
+
++ err = ubifs_wbuf_sync_nolock(wbuf);
++ if (err)
++ return err;
++
+ err = ubifs_add_bud_to_log(c, GCHD, gc_lnum, 0);
+ if (err)
+ return err;
+@@ -118,7 +122,7 @@ static int switch_gc_head(struct ubifs_info *c)
+ * This function compares data nodes @a and @b. Returns %1 if @a has greater
+ * inode or block number, and %-1 otherwise.
+ */
+-int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
++static int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
+ {
+ ino_t inuma, inumb;
+ struct ubifs_info *c = priv;
+@@ -161,7 +165,8 @@ int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
+ * first and sorted by length in descending order. Directory entry nodes go
+ * after inode nodes and are sorted in ascending hash valuer order.
+ */
+-int nondata_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
++static int nondata_nodes_cmp(void *priv, struct list_head *a,
++ struct list_head *b)
+ {
+ ino_t inuma, inumb;
+ struct ubifs_info *c = priv;
+@@ -473,6 +478,37 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
+ ubifs_assert(c->gc_lnum != lnum);
+ ubifs_assert(wbuf->lnum != lnum);
+
++ if (lp->free + lp->dirty == c->leb_size) {
++ /* Special case - a free LEB */
++ dbg_gc("LEB %d is free, return it", lp->lnum);
++ ubifs_assert(!(lp->flags & LPROPS_INDEX));
++
++ if (lp->free != c->leb_size) {
++ /*
++ * Write buffers must be sync'd before unmapping
++ * freeable LEBs, because one of them may contain data
++ * which obsoletes something in 'lp->pnum'.
++ */
++ err = gc_sync_wbufs(c);
++ if (err)
++ return err;
++ err = ubifs_change_one_lp(c, lp->lnum, c->leb_size,
++ 0, 0, 0, 0);
++ if (err)
++ return err;
++ }
++ err = ubifs_leb_unmap(c, lp->lnum);
++ if (err)
++ return err;
++
++ if (c->gc_lnum == -1) {
++ c->gc_lnum = lnum;
++ return LEB_RETAINED;
++ }
++
++ return LEB_FREED;
++ }
++
+ /*
+ * We scan the entire LEB even though we only really need to scan up to
+ * (c->leb_size - lp->free).
+@@ -682,37 +718,6 @@ int ubifs_garbage_collect(struct ubifs_info *c, int anyway)
+ "(min. space %d)", lp.lnum, lp.free, lp.dirty,
+ lp.free + lp.dirty, min_space);
+
+- if (lp.free + lp.dirty == c->leb_size) {
+- /* An empty LEB was returned */
+- dbg_gc("LEB %d is free, return it", lp.lnum);
+- /*
+- * ubifs_find_dirty_leb() doesn't return freeable index
+- * LEBs.
+- */
+- ubifs_assert(!(lp.flags & LPROPS_INDEX));
+- if (lp.free != c->leb_size) {
+- /*
+- * Write buffers must be sync'd before
+- * unmapping freeable LEBs, because one of them
+- * may contain data which obsoletes something
+- * in 'lp.pnum'.
+- */
+- ret = gc_sync_wbufs(c);
+- if (ret)
+- goto out;
+- ret = ubifs_change_one_lp(c, lp.lnum,
+- c->leb_size, 0, 0, 0,
+- 0);
+- if (ret)
+- goto out;
+- }
+- ret = ubifs_leb_unmap(c, lp.lnum);
+- if (ret)
+- goto out;
+- ret = lp.lnum;
+- break;
+- }
+-
+ space_before = c->leb_size - wbuf->offs - wbuf->used;
+ if (wbuf->lnum == -1)
+ space_before = 0;
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index d821731..9228950 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -31,6 +31,26 @@
+ * buffer is full or when it is not used for some time (by timer). This is
+ * similar to the mechanism is used by JFFS2.
+ *
++ * UBIFS distinguishes between minimum write size (@c->min_io_size) and maximum
++ * write size (@c->max_write_size). The latter is the maximum amount of bytes
++ * the underlying flash is able to program at a time, and writing in
++ * @c->max_write_size units should presumably be faster. Obviously,
++ * @c->min_io_size <= @c->max_write_size. Write-buffers are of
++ * @c->max_write_size bytes in size for maximum performance. However, when a
++ * write-buffer is flushed, only the portion of it (aligned to @c->min_io_size
++ * boundary) which contains data is written, not the whole write-buffer,
++ * because this is more space-efficient.
++ *
++ * This optimization adds few complications to the code. Indeed, on the one
++ * hand, we want to write in optimal @c->max_write_size bytes chunks, which
++ * also means aligning writes at the @c->max_write_size bytes offsets. On the
++ * other hand, we do not want to waste space when synchronizing the write
++ * buffer, so during synchronization we writes in smaller chunks. And this makes
++ * the next write offset to be not aligned to @c->max_write_size bytes. So the
++ * have to make sure that the write-buffer offset (@wbuf->offs) becomes aligned
++ * to @c->max_write_size bytes again. We do this by temporarily shrinking
++ * write-buffer size (@wbuf->size).
++ *
+ * Write-buffers are defined by 'struct ubifs_wbuf' objects and protected by
+ * mutexes defined inside these objects. Since sometimes upper-level code
+ * has to lock the write-buffer (e.g. journal space reservation code), many
+@@ -46,8 +66,8 @@
+ * UBIFS uses padding when it pads to the next min. I/O unit. In this case it
+ * uses padding nodes or padding bytes, if the padding node does not fit.
+ *
+- * All UBIFS nodes are protected by CRC checksums and UBIFS checks all nodes
+- * every time they are read from the flash media.
++ * All UBIFS nodes are protected by CRC checksums and UBIFS checks CRC when
++ * they are read from the flash media.
+ */
+
+ #include <linux/crc32.h>
+@@ -66,8 +86,125 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
+ c->no_chk_data_crc = 0;
+ c->vfs_sb->s_flags |= MS_RDONLY;
+ ubifs_warn("switched to read-only mode, error %d", err);
++ dump_stack();
++ }
++}
++
++/*
++ * Below are simple wrappers over UBI I/O functions which include some
++ * additional checks and UBIFS debugging stuff. See corresponding UBI function
++ * for more information.
++ */
++
++int ubifs_leb_read(const struct ubifs_info *c, int lnum, void *buf, int offs,
++ int len, int even_ebadmsg)
++{
++ int err;
++
++ err = ubi_read(c->ubi, lnum, buf, offs, len);
++ /*
++ * In case of %-EBADMSG print the error message only if the
++ * @even_ebadmsg is true.
++ */
++ if (err && (err != -EBADMSG || even_ebadmsg)) {
++ ubifs_err("reading %d bytes from LEB %d:%d failed, error %d",
++ len, lnum, offs, err);
+ dbg_dump_stack();
+ }
++ return err;
++}
++
++int ubifs_leb_write(struct ubifs_info *c, int lnum, const void *buf, int offs,
++ int len, int dtype)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_write(c->ubi, lnum, buf, offs, len, dtype);
++ else
++ err = dbg_leb_write(c, lnum, buf, offs, len, dtype);
++ if (err) {
++ ubifs_err("writing %d bytes to LEB %d:%d failed, error %d",
++ len, lnum, offs, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len,
++ int dtype)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_change(c->ubi, lnum, buf, len, dtype);
++ else
++ err = dbg_leb_change(c, lnum, buf, len, dtype);
++ if (err) {
++ ubifs_err("changing %d bytes in LEB %d failed, error %d",
++ len, lnum, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_leb_unmap(struct ubifs_info *c, int lnum)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_unmap(c->ubi, lnum);
++ else
++ err = dbg_leb_unmap(c, lnum);
++ if (err) {
++ ubifs_err("unmap LEB %d failed, error %d", lnum, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_leb_map(struct ubifs_info *c, int lnum, int dtype)
++{
++ int err;
++
++ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->ro_error)
++ return -EROFS;
++ if (!dbg_is_tst_rcvry(c))
++ err = ubi_leb_map(c->ubi, lnum, dtype);
++ else
++ err = dbg_leb_map(c, lnum, dtype);
++ if (err) {
++ ubifs_err("mapping LEB %d failed, error %d", lnum, err);
++ ubifs_ro_mode(c, err);
++ dbg_dump_stack();
++ }
++ return err;
++}
++
++int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
++{
++ int err;
++
++ err = ubi_is_mapped(c->ubi, lnum);
++ if (err < 0) {
++ ubifs_err("ubi_is_mapped failed for LEB %d, error %d",
++ lnum, err);
++ dbg_dump_stack();
++ }
++ return err;
+ }
+
+ /**
+@@ -88,8 +225,12 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
+ * This function may skip data nodes CRC checking if @c->no_chk_data_crc is
+ * true, which is controlled by corresponding UBIFS mount option. However, if
+ * @must_chk_crc is true, then @c->no_chk_data_crc is ignored and CRC is
+- * checked. Similarly, if @c->always_chk_crc is true, @c->no_chk_data_crc is
+- * ignored and CRC is checked.
++ * checked. Similarly, if @c->mounting or @c->remounting_rw is true (we are
++ * mounting or re-mounting to R/W mode), @c->no_chk_data_crc is ignored and CRC
++ * is checked. This is because during mounting or re-mounting from R/O mode to
++ * R/W mode we may read journal nodes (when replying the journal or doing the
++ * recovery) and the journal nodes may potentially be corrupted, so checking is
++ * required.
+ *
+ * This function returns zero in case of success and %-EUCLEAN in case of bad
+ * CRC or magic.
+@@ -131,8 +272,8 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ node_len > c->ranges[type].max_len)
+ goto out_len;
+
+- if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc &&
+- c->no_chk_data_crc)
++ if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->mounting &&
++ !c->remounting_rw && c->no_chk_data_crc)
+ return 0;
+
+ crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
+@@ -343,11 +484,17 @@ static void cancel_wbuf_timer_nolock(struct ubifs_wbuf *wbuf)
+ *
+ * This function synchronizes write-buffer @buf and returns zero in case of
+ * success or a negative error code in case of failure.
++ *
++ * Note, although write-buffers are of @c->max_write_size, this function does
++ * not necessarily writes all @c->max_write_size bytes to the flash. Instead,
++ * if the write-buffer is only partially filled with data, only the used part
++ * of the write-buffer (aligned on @c->min_io_size boundary) is synchronized.
++ * This way we waste less space.
+ */
+ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
+ {
+ struct ubifs_info *c = wbuf->c;
+- int err, dirt;
++ int err, dirt, sync_len;
+
+ cancel_wbuf_timer_nolock(wbuf);
+ if (!wbuf->used || wbuf->lnum == -1)
+@@ -357,27 +504,49 @@ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
+ dbg_io("LEB %d:%d, %d bytes, jhead %s",
+ wbuf->lnum, wbuf->offs, wbuf->used, dbg_jhead(wbuf->jhead));
+ ubifs_assert(!(wbuf->avail & 7));
+- ubifs_assert(wbuf->offs + c->min_io_size <= c->leb_size);
++ ubifs_assert(wbuf->offs + wbuf->size <= c->leb_size);
++ ubifs_assert(wbuf->size >= c->min_io_size);
++ ubifs_assert(wbuf->size <= c->max_write_size);
++ ubifs_assert(wbuf->size % c->min_io_size == 0);
+ ubifs_assert(!c->ro_media && !c->ro_mount);
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ ubifs_assert(!((wbuf->offs + wbuf->size) % c->max_write_size));
+
+ if (c->ro_error)
+ return -EROFS;
+
+- ubifs_pad(c, wbuf->buf + wbuf->used, wbuf->avail);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf, wbuf->offs,
+- c->min_io_size, wbuf->dtype);
+- if (err) {
+- ubifs_err("cannot write %d bytes to LEB %d:%d",
+- c->min_io_size, wbuf->lnum, wbuf->offs);
+- dbg_dump_stack();
++ /*
++ * Do not write whole write buffer but write only the minimum necessary
++ * amount of min. I/O units.
++ */
++ sync_len = ALIGN(wbuf->used, c->min_io_size);
++ dirt = sync_len - wbuf->used;
++ if (dirt)
++ ubifs_pad(c, wbuf->buf + wbuf->used, dirt);
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, sync_len,
++ wbuf->dtype);
++ if (err)
+ return err;
+- }
+-
+- dirt = wbuf->avail;
+
+ spin_lock(&wbuf->lock);
+- wbuf->offs += c->min_io_size;
+- wbuf->avail = c->min_io_size;
++ wbuf->offs += sync_len;
++ /*
++ * Now @wbuf->offs is not necessarily aligned to @c->max_write_size.
++ * But our goal is to optimize writes and make sure we write in
++ * @c->max_write_size chunks and to @c->max_write_size-aligned offset.
++ * Thus, if @wbuf->offs is not aligned to @c->max_write_size now, make
++ * sure that @wbuf->offs + @wbuf->size is aligned to
++ * @c->max_write_size. This way we make sure that after next
++ * write-buffer flush we are again at the optimal offset (aligned to
++ * @c->max_write_size).
++ */
++ if (c->leb_size - wbuf->offs < c->max_write_size)
++ wbuf->size = c->leb_size - wbuf->offs;
++ else if (wbuf->offs & (c->max_write_size - 1))
++ wbuf->size = ALIGN(wbuf->offs, c->max_write_size) - wbuf->offs;
++ else
++ wbuf->size = c->max_write_size;
++ wbuf->avail = wbuf->size;
+ wbuf->used = 0;
+ wbuf->next_ino = 0;
+ spin_unlock(&wbuf->lock);
+@@ -396,8 +565,8 @@ int ubifs_wbuf_sync_nolock(struct ubifs_wbuf *wbuf)
+ * @dtype: data type
+ *
+ * This function targets the write-buffer to logical eraseblock @lnum:@offs.
+- * The write-buffer is synchronized if it is not empty. Returns zero in case of
+- * success and a negative error code in case of failure.
++ * The write-buffer has to be empty. Returns zero in case of success and a
++ * negative error code in case of failure.
+ */
+ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
+ int dtype)
+@@ -409,18 +578,18 @@ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
+ ubifs_assert(offs >= 0 && offs <= c->leb_size);
+ ubifs_assert(offs % c->min_io_size == 0 && !(offs & 7));
+ ubifs_assert(lnum != wbuf->lnum);
+-
+- if (wbuf->used > 0) {
+- int err = ubifs_wbuf_sync_nolock(wbuf);
+-
+- if (err)
+- return err;
+- }
++ ubifs_assert(wbuf->used == 0);
+
+ spin_lock(&wbuf->lock);
+ wbuf->lnum = lnum;
+ wbuf->offs = offs;
+- wbuf->avail = c->min_io_size;
++ if (c->leb_size - wbuf->offs < c->max_write_size)
++ wbuf->size = c->leb_size - wbuf->offs;
++ else if (wbuf->offs & (c->max_write_size - 1))
++ wbuf->size = ALIGN(wbuf->offs, c->max_write_size) - wbuf->offs;
++ else
++ wbuf->size = c->max_write_size;
++ wbuf->avail = wbuf->size;
+ wbuf->used = 0;
+ spin_unlock(&wbuf->lock);
+ wbuf->dtype = dtype;
+@@ -500,8 +669,9 @@ out_timers:
+ *
+ * This function writes data to flash via write-buffer @wbuf. This means that
+ * the last piece of the node won't reach the flash media immediately if it
+- * does not take whole minimal I/O unit. Instead, the node will sit in RAM
+- * until the write-buffer is synchronized (e.g., by timer).
++ * does not take whole max. write unit (@c->max_write_size). Instead, the node
++ * will sit in RAM until the write-buffer is synchronized (e.g., by timer, or
++ * because more data are appended to the write-buffer).
+ *
+ * This function returns zero in case of success and a negative error code in
+ * case of failure. If the node cannot be written because there is no more
+@@ -510,7 +680,7 @@ out_timers:
+ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ {
+ struct ubifs_info *c = wbuf->c;
+- int err, written, n, aligned_len = ALIGN(len, 8), offs;
++ int err, written, n, aligned_len = ALIGN(len, 8);
+
+ dbg_io("%d bytes (%s) to jhead %s wbuf at LEB %d:%d", len,
+ dbg_ntype(((struct ubifs_ch *)buf)->node_type),
+@@ -518,9 +688,15 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ ubifs_assert(len > 0 && wbuf->lnum >= 0 && wbuf->lnum < c->leb_cnt);
+ ubifs_assert(wbuf->offs >= 0 && wbuf->offs % c->min_io_size == 0);
+ ubifs_assert(!(wbuf->offs & 7) && wbuf->offs <= c->leb_size);
+- ubifs_assert(wbuf->avail > 0 && wbuf->avail <= c->min_io_size);
++ ubifs_assert(wbuf->avail > 0 && wbuf->avail <= wbuf->size);
++ ubifs_assert(wbuf->size >= c->min_io_size);
++ ubifs_assert(wbuf->size <= c->max_write_size);
++ ubifs_assert(wbuf->size % c->min_io_size == 0);
+ ubifs_assert(mutex_is_locked(&wbuf->io_mutex));
+ ubifs_assert(!c->ro_media && !c->ro_mount);
++ ubifs_assert(!c->space_fixup);
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ ubifs_assert(!((wbuf->offs + wbuf->size) % c->max_write_size));
+
+ if (c->leb_size - wbuf->offs - wbuf->used < aligned_len) {
+ err = -ENOSPC;
+@@ -542,15 +718,19 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ if (aligned_len == wbuf->avail) {
+ dbg_io("flush jhead %s wbuf to LEB %d:%d",
+ dbg_jhead(wbuf->jhead), wbuf->lnum, wbuf->offs);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf,
+- wbuf->offs, c->min_io_size,
+- wbuf->dtype);
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf,
++ wbuf->offs, wbuf->size,
++ wbuf->dtype);
+ if (err)
+ goto out;
+
+ spin_lock(&wbuf->lock);
+- wbuf->offs += c->min_io_size;
+- wbuf->avail = c->min_io_size;
++ wbuf->offs += wbuf->size;
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ wbuf->size = c->max_write_size;
++ else
++ wbuf->size = c->leb_size - wbuf->offs;
++ wbuf->avail = wbuf->size;
+ wbuf->used = 0;
+ wbuf->next_ino = 0;
+ spin_unlock(&wbuf->lock);
+@@ -564,39 +744,63 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ goto exit;
+ }
+
+- /*
+- * The node is large enough and does not fit entirely within current
+- * minimal I/O unit. We have to fill and flush write-buffer and switch
+- * to the next min. I/O unit.
+- */
+- dbg_io("flush jhead %s wbuf to LEB %d:%d",
+- dbg_jhead(wbuf->jhead), wbuf->lnum, wbuf->offs);
+- memcpy(wbuf->buf + wbuf->used, buf, wbuf->avail);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, wbuf->buf, wbuf->offs,
+- c->min_io_size, wbuf->dtype);
+- if (err)
+- goto out;
++ written = 0;
++
++ if (wbuf->used) {
++ /*
++ * The node is large enough and does not fit entirely within
++ * current available space. We have to fill and flush
++ * write-buffer and switch to the next max. write unit.
++ */
++ dbg_io("flush jhead %s wbuf to LEB %d:%d",
++ dbg_jhead(wbuf->jhead), wbuf->lnum, wbuf->offs);
++ memcpy(wbuf->buf + wbuf->used, buf, wbuf->avail);
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs,
++ wbuf->size, wbuf->dtype);
++ if (err)
++ goto out;
++
++ wbuf->offs += wbuf->size;
++ len -= wbuf->avail;
++ aligned_len -= wbuf->avail;
++ written += wbuf->avail;
++ } else if (wbuf->offs & (c->max_write_size - 1)) {
++ /*
++ * The write-buffer offset is not aligned to
++ * @c->max_write_size and @wbuf->size is less than
++ * @c->max_write_size. Write @wbuf->size bytes to make sure the
++ * following writes are done in optimal @c->max_write_size
++ * chunks.
++ */
++ dbg_io("write %d bytes to LEB %d:%d",
++ wbuf->size, wbuf->lnum, wbuf->offs);
++ err = ubifs_leb_write(c, wbuf->lnum, buf, wbuf->offs,
++ wbuf->size, wbuf->dtype);
++ if (err)
++ goto out;
+
+- offs = wbuf->offs + c->min_io_size;
+- len -= wbuf->avail;
+- aligned_len -= wbuf->avail;
+- written = wbuf->avail;
++ wbuf->offs += wbuf->size;
++ len -= wbuf->size;
++ aligned_len -= wbuf->size;
++ written += wbuf->size;
++ }
+
+ /*
+- * The remaining data may take more whole min. I/O units, so write the
+- * remains multiple to min. I/O unit size directly to the flash media.
++ * The remaining data may take more whole max. write units, so write the
++ * remains multiple to max. write unit size directly to the flash media.
+ * We align node length to 8-byte boundary because we anyway flash wbuf
+ * if the remaining space is less than 8 bytes.
+ */
+- n = aligned_len >> c->min_io_shift;
++ n = aligned_len >> c->max_write_shift;
+ if (n) {
+- n <<= c->min_io_shift;
+- dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum, offs);
+- err = ubi_leb_write(c->ubi, wbuf->lnum, buf + written, offs, n,
+- wbuf->dtype);
++ n <<= c->max_write_shift;
++ dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum,
++ wbuf->offs);
++ err = ubifs_leb_write(c, wbuf->lnum, buf + written,
++ wbuf->offs, n, wbuf->dtype);
+ if (err)
+ goto out;
+- offs += n;
++ wbuf->offs += n;
+ aligned_len -= n;
+ len -= n;
+ written += n;
+@@ -606,14 +810,17 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ if (aligned_len)
+ /*
+ * And now we have what's left and what does not take whole
+- * min. I/O unit, so write it to the write-buffer and we are
++ * max. write unit, so write it to the write-buffer and we are
+ * done.
+ */
+ memcpy(wbuf->buf, buf + written, len);
+
+- wbuf->offs = offs;
++ if (c->leb_size - wbuf->offs >= c->max_write_size)
++ wbuf->size = c->max_write_size;
++ else
++ wbuf->size = c->leb_size - wbuf->offs;
++ wbuf->avail = wbuf->size - aligned_len;
+ wbuf->used = aligned_len;
+- wbuf->avail = c->min_io_size - aligned_len;
+ wbuf->next_ino = 0;
+ spin_unlock(&wbuf->lock);
+
+@@ -666,18 +873,15 @@ int ubifs_write_node(struct ubifs_info *c, void *buf, int len, int lnum,
+ ubifs_assert(lnum >= 0 && lnum < c->leb_cnt && offs >= 0);
+ ubifs_assert(offs % c->min_io_size == 0 && offs < c->leb_size);
+ ubifs_assert(!c->ro_media && !c->ro_mount);
++ ubifs_assert(!c->space_fixup);
+
+ if (c->ro_error)
+ return -EROFS;
+
+ ubifs_prepare_node(c, buf, len, 1);
+- err = ubi_leb_write(c->ubi, lnum, buf, offs, buf_len, dtype);
+- if (err) {
+- ubifs_err("cannot write %d bytes to LEB %d:%d, error %d",
+- buf_len, lnum, offs, err);
++ err = ubifs_leb_write(c, lnum, buf, offs, buf_len, dtype);
++ if (err)
+ dbg_dump_node(c, buf);
+- dbg_dump_stack();
+- }
+
+ return err;
+ }
+@@ -729,13 +933,9 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
+
+ if (rlen > 0) {
+ /* Read everything that goes before write-buffer */
+- err = ubi_read(c->ubi, lnum, buf, offs, rlen);
+- if (err && err != -EBADMSG) {
+- ubifs_err("failed to read node %d from LEB %d:%d, "
+- "error %d", type, lnum, offs, err);
+- dbg_dump_stack();
++ err = ubifs_leb_read(c, lnum, buf, offs, rlen, 0);
++ if (err && err != -EBADMSG)
+ return err;
+- }
+ }
+
+ if (type != ch->node_type) {
+@@ -790,12 +990,9 @@ int ubifs_read_node(const struct ubifs_info *c, void *buf, int type, int len,
+ ubifs_assert(!(offs & 7) && offs < c->leb_size);
+ ubifs_assert(type >= 0 && type < UBIFS_NODE_TYPES_CNT);
+
+- err = ubi_read(c->ubi, lnum, buf, offs, len);
+- if (err && err != -EBADMSG) {
+- ubifs_err("cannot read node %d from LEB %d:%d, error %d",
+- type, lnum, offs, err);
++ err = ubifs_leb_read(c, lnum, buf, offs, len, 0);
++ if (err && err != -EBADMSG)
+ return err;
+- }
+
+ if (type != ch->node_type) {
+ ubifs_err("bad node type (%d but expected %d)",
+@@ -837,11 +1034,11 @@ int ubifs_wbuf_init(struct ubifs_info *c, struct ubifs_wbuf *wbuf)
+ {
+ size_t size;
+
+- wbuf->buf = kmalloc(c->min_io_size, GFP_KERNEL);
++ wbuf->buf = kmalloc(c->max_write_size, GFP_KERNEL);
+ if (!wbuf->buf)
+ return -ENOMEM;
+
+- size = (c->min_io_size / UBIFS_CH_SZ + 1) * sizeof(ino_t);
++ size = (c->max_write_size / UBIFS_CH_SZ + 1) * sizeof(ino_t);
+ wbuf->inodes = kmalloc(size, GFP_KERNEL);
+ if (!wbuf->inodes) {
+ kfree(wbuf->buf);
+@@ -851,7 +1048,14 @@ int ubifs_wbuf_init(struct ubifs_info *c, struct ubifs_wbuf *wbuf)
+
+ wbuf->used = 0;
+ wbuf->lnum = wbuf->offs = -1;
+- wbuf->avail = c->min_io_size;
++ /*
++ * If the LEB starts at the max. write size aligned address, then
++ * write-buffer size has to be set to @c->max_write_size. Otherwise,
++ * set it to something smaller so that it ends at the closest max.
++ * write size boundary.
++ */
++ size = c->max_write_size - (c->leb_start % c->max_write_size);
++ wbuf->avail = wbuf->size = size;
+ wbuf->dtype = UBI_UNKNOWN;
+ wbuf->sync_callback = NULL;
+ mutex_init(&wbuf->io_mutex);
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index 914f1bd..2f438ab 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -141,14 +141,8 @@ again:
+ * LEB with some empty space.
+ */
+ lnum = ubifs_find_free_space(c, len, &offs, squeeze);
+- if (lnum >= 0) {
+- /* Found an LEB, add it to the journal head */
+- err = ubifs_add_bud_to_log(c, jhead, lnum, offs);
+- if (err)
+- goto out_return;
+- /* A new bud was successfully allocated and added to the log */
++ if (lnum >= 0)
+ goto out;
+- }
+
+ err = lnum;
+ if (err != -ENOSPC)
+@@ -203,12 +197,23 @@ again:
+ return 0;
+ }
+
+- err = ubifs_add_bud_to_log(c, jhead, lnum, 0);
+- if (err)
+- goto out_return;
+ offs = 0;
+
+ out:
++ /*
++ * Make sure we synchronize the write-buffer before we add the new bud
++ * to the log. Otherwise we may have a power cut after the log
++ * reference node for the last bud (@lnum) is written but before the
++ * write-buffer data are written to the next-to-last bud
++ * (@wbuf->lnum). And the effect would be that the recovery would see
++ * that there is corruption in the next-to-last bud.
++ */
++ err = ubifs_wbuf_sync_nolock(wbuf);
++ if (err)
++ goto out_return;
++ err = ubifs_add_bud_to_log(c, jhead, lnum, offs);
++ if (err)
++ goto out_return;
+ err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, wbuf->dtype);
+ if (err)
+ goto out_unlock;
+@@ -380,10 +385,8 @@ out:
+ if (err == -ENOSPC) {
+ /* This are some budgeting problems, print useful information */
+ down_write(&c->commit_sem);
+- spin_lock(&c->space_lock);
+ dbg_dump_stack();
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
++ dbg_dump_budg(c, &c->bi);
+ dbg_dump_lprops(c);
+ cmt_retries = dbg_check_lprops(c);
+ up_write(&c->commit_sem);
+@@ -666,6 +669,7 @@ out_free:
+
+ out_release:
+ release_head(c, BASEHD);
++ kfree(dent);
+ out_ro:
+ ubifs_ro_mode(c, err);
+ if (last_reference)
+@@ -690,17 +694,26 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
+ {
+ struct ubifs_data_node *data;
+ int err, lnum, offs, compr_type, out_len;
+- int dlen = UBIFS_DATA_NODE_SZ + UBIFS_BLOCK_SIZE * WORST_COMPR_FACTOR;
++ int dlen = COMPRESSED_DATA_NODE_BUF_SZ, allocated = 1;
+ struct ubifs_inode *ui = ubifs_inode(inode);
+
+- dbg_jnl("ino %lu, blk %u, len %d, key %s",
+- (unsigned long)key_inum(c, key), key_block(c, key), len,
+- DBGKEY(key));
++ dbg_jnlk(key, "ino %lu, blk %u, len %d, key ",
++ (unsigned long)key_inum(c, key), key_block(c, key), len);
+ ubifs_assert(len <= UBIFS_BLOCK_SIZE);
+
+- data = kmalloc(dlen, GFP_NOFS);
+- if (!data)
+- return -ENOMEM;
++ data = kmalloc(dlen, GFP_NOFS | __GFP_NOWARN);
++ if (!data) {
++ /*
++ * Fall-back to the write reserve buffer. Note, we might be
++ * currently on the memory reclaim path, when the kernel is
++ * trying to free some memory by writing out dirty pages. The
++ * write reserve buffer helps us to guarantee that we are
++ * always able to write the data.
++ */
++ allocated = 0;
++ mutex_lock(&c->write_reserve_mutex);
++ data = c->write_reserve_buf;
++ }
+
+ data->ch.node_type = UBIFS_DATA_NODE;
+ key_write(c, key, &data->key);
+@@ -736,7 +749,10 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
+ goto out_ro;
+
+ finish_reservation(c);
+- kfree(data);
++ if (!allocated)
++ mutex_unlock(&c->write_reserve_mutex);
++ else
++ kfree(data);
+ return 0;
+
+ out_release:
+@@ -745,7 +761,10 @@ out_ro:
+ ubifs_ro_mode(c, err);
+ finish_reservation(c);
+ out_free:
+- kfree(data);
++ if (!allocated)
++ mutex_unlock(&c->write_reserve_mutex);
++ else
++ kfree(data);
+ return err;
+ }
+
+@@ -1157,7 +1176,7 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
+ dn = (void *)trun + UBIFS_TRUN_NODE_SZ;
+ blk = new_size >> UBIFS_BLOCK_SHIFT;
+ data_key_init(c, &key, inum, blk);
+- dbg_jnl("last block key %s", DBGKEY(&key));
++ dbg_jnlk(&key, "last block key ");
+ err = ubifs_tnc_lookup(c, &key, dn);
+ if (err == -ENOENT)
+ dlen = 0; /* Not found (so it is a hole) */
+diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
+index 4d0cb12..f9fd068 100644
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -100,20 +100,6 @@ struct ubifs_wbuf *ubifs_get_wbuf(struct ubifs_info *c, int lnum)
+ }
+
+ /**
+- * next_log_lnum - switch to the next log LEB.
+- * @c: UBIFS file-system description object
+- * @lnum: current log LEB
+- */
+-static inline int next_log_lnum(const struct ubifs_info *c, int lnum)
+-{
+- lnum += 1;
+- if (lnum > c->log_last)
+- lnum = UBIFS_LOG_LNUM;
+-
+- return lnum;
+-}
+-
+-/**
+ * empty_log_bytes - calculate amount of empty space in the log.
+ * @c: UBIFS file-system description object
+ */
+@@ -175,26 +161,6 @@ void ubifs_add_bud(struct ubifs_info *c, struct ubifs_bud *bud)
+ }
+
+ /**
+- * ubifs_create_buds_lists - create journal head buds lists for remount rw.
+- * @c: UBIFS file-system description object
+- */
+-void ubifs_create_buds_lists(struct ubifs_info *c)
+-{
+- struct rb_node *p;
+-
+- spin_lock(&c->buds_lock);
+- p = rb_first(&c->buds);
+- while (p) {
+- struct ubifs_bud *bud = rb_entry(p, struct ubifs_bud, rb);
+- struct ubifs_jhead *jhead = &c->jheads[bud->jhead];
+-
+- list_add_tail(&bud->list, &jhead->buds_list);
+- p = rb_next(p);
+- }
+- spin_unlock(&c->buds_lock);
+-}
+-
+-/**
+ * ubifs_add_bud_to_log - add a new bud to the log.
+ * @c: UBIFS file-system description object
+ * @jhead: journal head the bud belongs to
+@@ -277,7 +243,7 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
+ ref->jhead = cpu_to_le32(jhead);
+
+ if (c->lhead_offs > c->leb_size - c->ref_node_alsz) {
+- c->lhead_lnum = next_log_lnum(c, c->lhead_lnum);
++ c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+ c->lhead_offs = 0;
+ }
+
+@@ -296,7 +262,7 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
+ * an unclean reboot, because the target LEB might have been
+ * unmapped, but not yet physically erased.
+ */
+- err = ubi_leb_map(c->ubi, bud->lnum, UBI_SHORTTERM);
++ err = ubifs_leb_map(c, bud->lnum, UBI_SHORTTERM);
+ if (err)
+ goto out_unlock;
+ }
+@@ -317,8 +283,6 @@ int ubifs_add_bud_to_log(struct ubifs_info *c, int jhead, int lnum, int offs)
+ return 0;
+
+ out_unlock:
+- if (err != -EAGAIN)
+- ubifs_ro_mode(c, err);
+ mutex_unlock(&c->log_mutex);
+ kfree(ref);
+ kfree(bud);
+@@ -445,7 +409,7 @@ int ubifs_log_start_commit(struct ubifs_info *c, int *ltail_lnum)
+
+ /* Switch to the next log LEB */
+ if (c->lhead_offs) {
+- c->lhead_lnum = next_log_lnum(c, c->lhead_lnum);
++ c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+ c->lhead_offs = 0;
+ }
+
+@@ -466,7 +430,7 @@ int ubifs_log_start_commit(struct ubifs_info *c, int *ltail_lnum)
+
+ c->lhead_offs += len;
+ if (c->lhead_offs == c->leb_size) {
+- c->lhead_lnum = next_log_lnum(c, c->lhead_lnum);
++ c->lhead_lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
+ c->lhead_offs = 0;
+ }
+
+@@ -553,7 +517,7 @@ int ubifs_log_post_commit(struct ubifs_info *c, int old_ltail_lnum)
+ }
+ mutex_lock(&c->log_mutex);
+ for (lnum = old_ltail_lnum; lnum != c->ltail_lnum;
+- lnum = next_log_lnum(c, lnum)) {
++ lnum = ubifs_next_log_lnum(c, lnum)) {
+ dbg_log("unmap log LEB %d", lnum);
+ err = ubifs_leb_unmap(c, lnum);
+ if (err)
+@@ -662,7 +626,7 @@ static int add_node(struct ubifs_info *c, void *buf, int *lnum, int *offs,
+ err = ubifs_leb_change(c, *lnum, buf, sz, UBI_SHORTTERM);
+ if (err)
+ return err;
+- *lnum = next_log_lnum(c, *lnum);
++ *lnum = ubifs_next_log_lnum(c, *lnum);
+ *offs = 0;
+ }
+ memcpy(buf + *offs, node, len);
+@@ -732,7 +696,7 @@ int ubifs_consolidate_log(struct ubifs_info *c)
+ ubifs_scan_destroy(sleb);
+ if (lnum == c->lhead_lnum)
+ break;
+- lnum = next_log_lnum(c, lnum);
++ lnum = ubifs_next_log_lnum(c, lnum);
+ }
+ if (offs) {
+ int sz = ALIGN(offs, c->min_io_size);
+@@ -752,7 +716,7 @@ int ubifs_consolidate_log(struct ubifs_info *c)
+ /* Unmap remaining LEBs */
+ lnum = write_lnum;
+ do {
+- lnum = next_log_lnum(c, lnum);
++ lnum = ubifs_next_log_lnum(c, lnum);
+ err = ubifs_leb_unmap(c, lnum);
+ if (err)
+ return err;
+@@ -786,7 +750,7 @@ static int dbg_check_bud_bytes(struct ubifs_info *c)
+ struct ubifs_bud *bud;
+ long long bud_bytes = 0;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ spin_lock(&c->buds_lock);
+diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
+index 4d4ca38..f8a181e 100644
+--- a/fs/ubifs/lprops.c
++++ b/fs/ubifs/lprops.c
+@@ -504,7 +504,7 @@ static int is_lprops_dirty(struct ubifs_info *c, struct ubifs_lprops *lprops)
+ pnode = (struct ubifs_pnode *)container_of(lprops - pos,
+ struct ubifs_pnode,
+ lprops[0]);
+- return !test_bit(COW_ZNODE, &pnode->flags) &&
++ return !test_bit(COW_CNODE, &pnode->flags) &&
+ test_bit(DIRTY_CNODE, &pnode->flags);
+ }
+
+@@ -860,7 +860,7 @@ int dbg_check_cats(struct ubifs_info *c)
+ struct list_head *pos;
+ int i, cat;
+
+- if (!(ubifs_chk_flags & (UBIFS_CHK_GEN | UBIFS_CHK_LPROPS)))
++ if (!dbg_is_chk_gen(c) && !dbg_is_chk_lprops(c))
+ return 0;
+
+ list_for_each_entry(lprops, &c->empty_list, list) {
+@@ -958,7 +958,7 @@ void dbg_check_heap(struct ubifs_info *c, struct ubifs_lpt_heap *heap, int cat,
+ {
+ int i = 0, j, err = 0;
+
+- if (!(ubifs_chk_flags & (UBIFS_CHK_GEN | UBIFS_CHK_LPROPS)))
++ if (!dbg_is_chk_gen(c) && !dbg_is_chk_lprops(c))
+ return;
+
+ for (i = 0; i < heap->cnt; i++) {
+@@ -1007,21 +1007,11 @@ out:
+ }
+
+ /**
+- * struct scan_check_data - data provided to scan callback function.
+- * @lst: LEB properties statistics
+- * @err: error code
+- */
+-struct scan_check_data {
+- struct ubifs_lp_stats lst;
+- int err;
+-};
+-
+-/**
+ * scan_check_cb - scan callback.
+ * @c: the UBIFS file-system description object
+ * @lp: LEB properties to scan
+ * @in_tree: whether the LEB properties are in main memory
+- * @data: information passed to and from the caller of the scan
++ * @lst: lprops statistics to update
+ *
+ * This function returns a code that indicates whether the scan should continue
+ * (%LPT_SCAN_CONTINUE), whether the LEB properties should be added to the tree
+@@ -1030,12 +1020,12 @@ struct scan_check_data {
+ */
+ static int scan_check_cb(struct ubifs_info *c,
+ const struct ubifs_lprops *lp, int in_tree,
+- struct scan_check_data *data)
++ struct ubifs_lp_stats *lst)
+ {
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
+- struct ubifs_lp_stats *lst = &data->lst;
+- int cat, lnum = lp->lnum, is_idx = 0, used = 0, free, dirty;
++ int cat, lnum = lp->lnum, is_idx = 0, used = 0, free, dirty, ret;
++ void *buf = NULL;
+
+ cat = lp->flags & LPROPS_CAT_MASK;
+ if (cat != LPROPS_UNCAT) {
+@@ -1043,7 +1033,7 @@ static int scan_check_cb(struct ubifs_info *c,
+ if (cat != (lp->flags & LPROPS_CAT_MASK)) {
+ ubifs_err("bad LEB category %d expected %d",
+ (lp->flags & LPROPS_CAT_MASK), cat);
+- goto out;
++ return -EINVAL;
+ }
+ }
+
+@@ -1077,7 +1067,7 @@ static int scan_check_cb(struct ubifs_info *c,
+ }
+ if (!found) {
+ ubifs_err("bad LPT list (category %d)", cat);
+- goto out;
++ return -EINVAL;
+ }
+ }
+ }
+@@ -1089,36 +1079,40 @@ static int scan_check_cb(struct ubifs_info *c,
+ if ((lp->hpos != -1 && heap->arr[lp->hpos]->lnum != lnum) ||
+ lp != heap->arr[lp->hpos]) {
+ ubifs_err("bad LPT heap (category %d)", cat);
+- goto out;
++ return -EINVAL;
+ }
+ }
+
+- sleb = ubifs_scan(c, lnum, 0, c->dbg->buf, 0);
+- if (IS_ERR(sleb)) {
+- /*
+- * After an unclean unmount, empty and freeable LEBs
+- * may contain garbage.
+- */
+- if (lp->free == c->leb_size) {
+- ubifs_err("scan errors were in empty LEB "
+- "- continuing checking");
+- lst->empty_lebs += 1;
+- lst->total_free += c->leb_size;
+- lst->total_dark += ubifs_calc_dark(c, c->leb_size);
+- return LPT_SCAN_CONTINUE;
+- }
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+
+- if (lp->free + lp->dirty == c->leb_size &&
+- !(lp->flags & LPROPS_INDEX)) {
+- ubifs_err("scan errors were in freeable LEB "
+- "- continuing checking");
+- lst->total_free += lp->free;
+- lst->total_dirty += lp->dirty;
+- lst->total_dark += ubifs_calc_dark(c, c->leb_size);
+- return LPT_SCAN_CONTINUE;
++ /*
++ * After an unclean unmount, empty and freeable LEBs
++ * may contain garbage - do not scan them.
++ */
++ if (lp->free == c->leb_size) {
++ lst->empty_lebs += 1;
++ lst->total_free += c->leb_size;
++ lst->total_dark += ubifs_calc_dark(c, c->leb_size);
++ return LPT_SCAN_CONTINUE;
++ }
++ if (lp->free + lp->dirty == c->leb_size &&
++ !(lp->flags & LPROPS_INDEX)) {
++ lst->total_free += lp->free;
++ lst->total_dirty += lp->dirty;
++ lst->total_dark += ubifs_calc_dark(c, c->leb_size);
++ return LPT_SCAN_CONTINUE;
++ }
++
++ sleb = ubifs_scan(c, lnum, 0, buf, 0);
++ if (IS_ERR(sleb)) {
++ ret = PTR_ERR(sleb);
++ if (ret == -EUCLEAN) {
++ dbg_dump_lprops(c);
++ dbg_dump_budg(c, &c->bi);
+ }
+- data->err = PTR_ERR(sleb);
+- return LPT_SCAN_STOP;
++ goto out;
+ }
+
+ is_idx = -1;
+@@ -1236,6 +1230,7 @@ static int scan_check_cb(struct ubifs_info *c,
+ }
+
+ ubifs_scan_destroy(sleb);
++ vfree(buf);
+ return LPT_SCAN_CONTINUE;
+
+ out_print:
+@@ -1245,9 +1240,10 @@ out_print:
+ dbg_dump_leb(c, lnum);
+ out_destroy:
+ ubifs_scan_destroy(sleb);
++ ret = -EINVAL;
+ out:
+- data->err = -EINVAL;
+- return LPT_SCAN_STOP;
++ vfree(buf);
++ return ret;
+ }
+
+ /**
+@@ -1264,10 +1260,9 @@ out:
+ int dbg_check_lprops(struct ubifs_info *c)
+ {
+ int i, err;
+- struct scan_check_data data;
+- struct ubifs_lp_stats *lst = &data.lst;
++ struct ubifs_lp_stats lst;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ /*
+@@ -1280,29 +1275,23 @@ int dbg_check_lprops(struct ubifs_info *c)
+ return err;
+ }
+
+- memset(lst, 0, sizeof(struct ubifs_lp_stats));
+-
+- data.err = 0;
++ memset(&lst, 0, sizeof(struct ubifs_lp_stats));
+ err = ubifs_lpt_scan_nolock(c, c->main_first, c->leb_cnt - 1,
+ (ubifs_lpt_scan_callback)scan_check_cb,
+- &data);
++ &lst);
+ if (err && err != -ENOSPC)
+ goto out;
+- if (data.err) {
+- err = data.err;
+- goto out;
+- }
+
+- if (lst->empty_lebs != c->lst.empty_lebs ||
+- lst->idx_lebs != c->lst.idx_lebs ||
+- lst->total_free != c->lst.total_free ||
+- lst->total_dirty != c->lst.total_dirty ||
+- lst->total_used != c->lst.total_used) {
++ if (lst.empty_lebs != c->lst.empty_lebs ||
++ lst.idx_lebs != c->lst.idx_lebs ||
++ lst.total_free != c->lst.total_free ||
++ lst.total_dirty != c->lst.total_dirty ||
++ lst.total_used != c->lst.total_used) {
+ ubifs_err("bad overall accounting");
+ ubifs_err("calculated: empty_lebs %d, idx_lebs %d, "
+ "total_free %lld, total_dirty %lld, total_used %lld",
+- lst->empty_lebs, lst->idx_lebs, lst->total_free,
+- lst->total_dirty, lst->total_used);
++ lst.empty_lebs, lst.idx_lebs, lst.total_free,
++ lst.total_dirty, lst.total_used);
+ ubifs_err("read from lprops: empty_lebs %d, idx_lebs %d, "
+ "total_free %lld, total_dirty %lld, total_used %lld",
+ c->lst.empty_lebs, c->lst.idx_lebs, c->lst.total_free,
+@@ -1311,11 +1300,11 @@ int dbg_check_lprops(struct ubifs_info *c)
+ goto out;
+ }
+
+- if (lst->total_dead != c->lst.total_dead ||
+- lst->total_dark != c->lst.total_dark) {
++ if (lst.total_dead != c->lst.total_dead ||
++ lst.total_dark != c->lst.total_dark) {
+ ubifs_err("bad dead/dark space accounting");
+ ubifs_err("calculated: total_dead %lld, total_dark %lld",
+- lst->total_dead, lst->total_dark);
++ lst.total_dead, lst.total_dark);
+ ubifs_err("read from lprops: total_dead %lld, total_dark %lld",
+ c->lst.total_dead, c->lst.total_dark);
+ err = -EINVAL;
+diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
+index 72775d3..66d59d0 100644
+--- a/fs/ubifs/lpt.c
++++ b/fs/ubifs/lpt.c
+@@ -701,8 +701,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ alen = ALIGN(len, c->min_io_size);
+ set_ltab(c, lnum, c->leb_size - alen, alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen,
+- UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen,
++ UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -732,8 +732,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ set_ltab(c, lnum, c->leb_size - alen,
+ alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen,
+- UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen,
++ UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -780,8 +780,8 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ alen = ALIGN(len, c->min_io_size);
+ set_ltab(c, lnum, c->leb_size - alen, alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen,
+- UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen,
++ UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -806,7 +806,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+ alen = ALIGN(len, c->min_io_size);
+ set_ltab(c, lnum, c->leb_size - alen, alen - len);
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum++, buf, alen, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum++, buf, alen, UBI_SHORTTERM);
+ if (err)
+ goto out;
+ p = buf;
+@@ -826,7 +826,7 @@ int ubifs_create_dflt_lpt(struct ubifs_info *c, int *main_lebs, int lpt_first,
+
+ /* Write remaining buffer */
+ memset(p, 0xff, alen - len);
+- err = ubi_leb_change(c->ubi, lnum, buf, alen, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum, buf, alen, UBI_SHORTTERM);
+ if (err)
+ goto out;
+
+@@ -1222,7 +1222,7 @@ int ubifs_read_nnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ if (c->big_lpt)
+ nnode->num = calc_nnode_num_from_parent(c, parent, iip);
+ } else {
+- err = ubi_read(c->ubi, lnum, buf, offs, c->nnode_sz);
++ err = ubifs_leb_read(c, lnum, buf, offs, c->nnode_sz, 1);
+ if (err)
+ goto out;
+ err = ubifs_unpack_nnode(c, buf, nnode);
+@@ -1247,6 +1247,7 @@ int ubifs_read_nnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+
+ out:
+ ubifs_err("error %d reading nnode at %d:%d", err, lnum, offs);
++ dbg_dump_stack();
+ kfree(nnode);
+ return err;
+ }
+@@ -1270,10 +1271,9 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ lnum = branch->lnum;
+ offs = branch->offs;
+ pnode = kzalloc(sizeof(struct ubifs_pnode), GFP_NOFS);
+- if (!pnode) {
+- err = -ENOMEM;
+- goto out;
+- }
++ if (!pnode)
++ return -ENOMEM;
++
+ if (lnum == 0) {
+ /*
+ * This pnode was not written which just means that the LEB
+@@ -1291,7 +1291,7 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ lprops->flags = ubifs_categorize_lprops(c, lprops);
+ }
+ } else {
+- err = ubi_read(c->ubi, lnum, buf, offs, c->pnode_sz);
++ err = ubifs_leb_read(c, lnum, buf, offs, c->pnode_sz, 1);
+ if (err)
+ goto out;
+ err = unpack_pnode(c, buf, pnode);
+@@ -1313,6 +1313,7 @@ static int read_pnode(struct ubifs_info *c, struct ubifs_nnode *parent, int iip)
+ out:
+ ubifs_err("error %d reading pnode at %d:%d", err, lnum, offs);
+ dbg_dump_pnode(c, pnode, parent, iip);
++ dbg_dump_stack();
+ dbg_msg("calc num: %d", calc_pnode_num_from_parent(c, parent, iip));
+ kfree(pnode);
+ return err;
+@@ -1332,7 +1333,7 @@ static int read_ltab(struct ubifs_info *c)
+ buf = vmalloc(c->ltab_sz);
+ if (!buf)
+ return -ENOMEM;
+- err = ubi_read(c->ubi, c->ltab_lnum, buf, c->ltab_offs, c->ltab_sz);
++ err = ubifs_leb_read(c, c->ltab_lnum, buf, c->ltab_offs, c->ltab_sz, 1);
+ if (err)
+ goto out;
+ err = unpack_ltab(c, buf);
+@@ -1355,7 +1356,8 @@ static int read_lsave(struct ubifs_info *c)
+ buf = vmalloc(c->lsave_sz);
+ if (!buf)
+ return -ENOMEM;
+- err = ubi_read(c->ubi, c->lsave_lnum, buf, c->lsave_offs, c->lsave_sz);
++ err = ubifs_leb_read(c, c->lsave_lnum, buf, c->lsave_offs,
++ c->lsave_sz, 1);
+ if (err)
+ goto out;
+ err = unpack_lsave(c, buf);
+@@ -1815,8 +1817,8 @@ static struct ubifs_nnode *scan_get_nnode(struct ubifs_info *c,
+ if (c->big_lpt)
+ nnode->num = calc_nnode_num_from_parent(c, parent, iip);
+ } else {
+- err = ubi_read(c->ubi, branch->lnum, buf, branch->offs,
+- c->nnode_sz);
++ err = ubifs_leb_read(c, branch->lnum, buf, branch->offs,
++ c->nnode_sz, 1);
+ if (err)
+ return ERR_PTR(err);
+ err = ubifs_unpack_nnode(c, buf, nnode);
+@@ -1884,8 +1886,8 @@ static struct ubifs_pnode *scan_get_pnode(struct ubifs_info *c,
+ ubifs_assert(branch->lnum >= c->lpt_first &&
+ branch->lnum <= c->lpt_last);
+ ubifs_assert(branch->offs >= 0 && branch->offs < c->leb_size);
+- err = ubi_read(c->ubi, branch->lnum, buf, branch->offs,
+- c->pnode_sz);
++ err = ubifs_leb_read(c, branch->lnum, buf, branch->offs,
++ c->pnode_sz, 1);
+ if (err)
+ return ERR_PTR(err);
+ err = unpack_pnode(c, buf, pnode);
+@@ -1984,12 +1986,11 @@ again:
+
+ if (path[h].in_tree)
+ continue;
+- nnode = kmalloc(sz, GFP_NOFS);
++ nnode = kmemdup(&path[h].nnode, sz, GFP_NOFS);
+ if (!nnode) {
+ err = -ENOMEM;
+ goto out;
+ }
+- memcpy(nnode, &path[h].nnode, sz);
+ parent = nnode->parent;
+ parent->nbranch[nnode->iip].nnode = nnode;
+ path[h].ptr.nnode = nnode;
+@@ -2002,12 +2003,11 @@ again:
+ const size_t sz = sizeof(struct ubifs_pnode);
+ struct ubifs_nnode *parent;
+
+- pnode = kmalloc(sz, GFP_NOFS);
++ pnode = kmemdup(&path[h].pnode, sz, GFP_NOFS);
+ if (!pnode) {
+ err = -ENOMEM;
+ goto out;
+ }
+- memcpy(pnode, &path[h].pnode, sz);
+ parent = pnode->parent;
+ parent->nbranch[pnode->iip].pnode = pnode;
+ path[h].ptr.pnode = pnode;
+@@ -2225,7 +2225,7 @@ int dbg_check_lpt_nodes(struct ubifs_info *c, struct ubifs_cnode *cnode,
+ struct ubifs_cnode *cn;
+ int num, iip = 0, err;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ while (cnode) {
+diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
+index 5c90dec..cddd6bd 100644
+--- a/fs/ubifs/lpt_commit.c
++++ b/fs/ubifs/lpt_commit.c
+@@ -27,8 +27,15 @@
+
+ #include <linux/crc16.h>
+ #include <linux/slab.h>
++#include <linux/random.h>
+ #include "ubifs.h"
+
++#ifdef CONFIG_UBIFS_FS_DEBUG
++static int dbg_populate_lsave(struct ubifs_info *c);
++#else
++#define dbg_populate_lsave(c) 0
++#endif
++
+ /**
+ * first_dirty_cnode - find first dirty cnode.
+ * @c: UBIFS file-system description object
+@@ -110,8 +117,8 @@ static int get_cnodes_to_commit(struct ubifs_info *c)
+ return 0;
+ cnt += 1;
+ while (1) {
+- ubifs_assert(!test_bit(COW_ZNODE, &cnode->flags));
+- __set_bit(COW_ZNODE, &cnode->flags);
++ ubifs_assert(!test_bit(COW_CNODE, &cnode->flags));
++ __set_bit(COW_CNODE, &cnode->flags);
+ cnext = next_dirty_cnode(cnode);
+ if (!cnext) {
+ cnode->cnext = c->lpt_cnext;
+@@ -459,7 +466,7 @@ static int write_cnodes(struct ubifs_info *c)
+ */
+ clear_bit(DIRTY_CNODE, &cnode->flags);
+ smp_mb__before_clear_bit();
+- clear_bit(COW_ZNODE, &cnode->flags);
++ clear_bit(COW_CNODE, &cnode->flags);
+ smp_mb__after_clear_bit();
+ offs += len;
+ dbg_chk_lpt_sz(c, 1, len);
+@@ -586,7 +593,7 @@ static struct ubifs_pnode *next_pnode_to_dirty(struct ubifs_info *c,
+ if (nnode->nbranch[iip].lnum)
+ break;
+ }
+- } while (iip >= UBIFS_LPT_FANOUT);
++ } while (iip >= UBIFS_LPT_FANOUT);
+
+ /* Go right */
+ nnode = ubifs_get_nnode(c, nnode, iip);
+@@ -815,6 +822,10 @@ static void populate_lsave(struct ubifs_info *c)
+ c->lpt_drty_flgs |= LSAVE_DIRTY;
+ ubifs_add_lpt_dirt(c, c->lsave_lnum, c->lsave_sz);
+ }
++
++ if (dbg_populate_lsave(c))
++ return;
++
+ list_for_each_entry(lprops, &c->empty_list, list) {
+ c->lsave[cnt++] = lprops->lnum;
+ if (cnt >= c->lsave_cnt)
+@@ -1150,11 +1161,11 @@ static int lpt_gc_lnum(struct ubifs_info *c, int lnum)
+ void *buf = c->lpt_buf;
+
+ dbg_lp("LEB %d", lnum);
+- err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
+- if (err) {
+- ubifs_err("cannot read LEB %d, error %d", lnum, err);
++
++ err = ubifs_leb_read(c, lnum, buf, 0, c->leb_size, 1);
++ if (err)
+ return err;
+- }
++
+ while (1) {
+ if (!is_a_node(c, buf, len)) {
+ int pad_len;
+@@ -1628,29 +1639,35 @@ static int dbg_check_ltab_lnum(struct ubifs_info *c, int lnum)
+ {
+ int err, len = c->leb_size, dirty = 0, node_type, node_num, node_len;
+ int ret;
+- void *buf = c->dbg->buf;
++ void *buf, *p;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+- dbg_lp("LEB %d", lnum);
+- err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
+- if (err) {
+- dbg_msg("ubi_read failed, LEB %d, error %d", lnum, err);
+- return err;
++ buf = p = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory for ltab checking");
++ return 0;
+ }
++
++ dbg_lp("LEB %d", lnum);
++
++ err = ubifs_leb_read(c, lnum, buf, 0, c->leb_size, 1);
++ if (err)
++ goto out;
++
+ while (1) {
+- if (!is_a_node(c, buf, len)) {
++ if (!is_a_node(c, p, len)) {
+ int i, pad_len;
+
+- pad_len = get_pad_len(c, buf, len);
++ pad_len = get_pad_len(c, p, len);
+ if (pad_len) {
+- buf += pad_len;
++ p += pad_len;
+ len -= pad_len;
+ dirty += pad_len;
+ continue;
+ }
+- if (!dbg_is_all_ff(buf, len)) {
++ if (!dbg_is_all_ff(p, len)) {
+ dbg_msg("invalid empty space in LEB %d at %d",
+ lnum, c->leb_size - len);
+ err = -EINVAL;
+@@ -1668,16 +1685,21 @@ static int dbg_check_ltab_lnum(struct ubifs_info *c, int lnum)
+ lnum, dirty, c->ltab[i].dirty);
+ err = -EINVAL;
+ }
+- return err;
++ goto out;
+ }
+- node_type = get_lpt_node_type(c, buf, &node_num);
++ node_type = get_lpt_node_type(c, p, &node_num);
+ node_len = get_lpt_node_len(c, node_type);
+ ret = dbg_is_node_dirty(c, node_type, lnum, c->leb_size - len);
+ if (ret == 1)
+ dirty += node_len;
+- buf += node_len;
++ p += node_len;
+ len -= node_len;
+ }
++
++ err = 0;
++out:
++ vfree(buf);
++ return err;
+ }
+
+ /**
+@@ -1690,7 +1712,7 @@ int dbg_check_ltab(struct ubifs_info *c)
+ {
+ int lnum, err, i, cnt;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ /* Bring the entire tree into memory */
+@@ -1733,7 +1755,7 @@ int dbg_chk_lpt_free_spc(struct ubifs_info *c)
+ long long free = 0;
+ int i;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ for (i = 0; i < c->lpt_lebs; i++) {
+@@ -1775,7 +1797,7 @@ int dbg_chk_lpt_sz(struct ubifs_info *c, int action, int len)
+ long long chk_lpt_sz, lpt_sz;
+ int err = 0;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_LPROPS))
++ if (!dbg_is_chk_lprops(c))
+ return 0;
+
+ switch (action) {
+@@ -1870,25 +1892,30 @@ int dbg_chk_lpt_sz(struct ubifs_info *c, int action, int len)
+ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ {
+ int err, len = c->leb_size, node_type, node_num, node_len, offs;
+- void *buf = c->dbg->buf;
++ void *buf, *p;
+
+ printk(KERN_DEBUG "(pid %d) start dumping LEB %d\n",
+ current->pid, lnum);
+- err = ubi_read(c->ubi, lnum, buf, 0, c->leb_size);
+- if (err) {
+- ubifs_err("cannot read LEB %d, error %d", lnum, err);
++ buf = p = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory to dump LPT");
+ return;
+ }
++
++ err = ubifs_leb_read(c, lnum, buf, 0, c->leb_size, 1);
++ if (err)
++ goto out;
++
+ while (1) {
+ offs = c->leb_size - len;
+- if (!is_a_node(c, buf, len)) {
++ if (!is_a_node(c, p, len)) {
+ int pad_len;
+
+- pad_len = get_pad_len(c, buf, len);
++ pad_len = get_pad_len(c, p, len);
+ if (pad_len) {
+ printk(KERN_DEBUG "LEB %d:%d, pad %d bytes\n",
+ lnum, offs, pad_len);
+- buf += pad_len;
++ p += pad_len;
+ len -= pad_len;
+ continue;
+ }
+@@ -1898,7 +1925,7 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ break;
+ }
+
+- node_type = get_lpt_node_type(c, buf, &node_num);
++ node_type = get_lpt_node_type(c, p, &node_num);
+ switch (node_type) {
+ case UBIFS_LPT_PNODE:
+ {
+@@ -1923,7 +1950,7 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ else
+ printk(KERN_DEBUG "LEB %d:%d, nnode, ",
+ lnum, offs);
+- err = ubifs_unpack_nnode(c, buf, &nnode);
++ err = ubifs_unpack_nnode(c, p, &nnode);
+ for (i = 0; i < UBIFS_LPT_FANOUT; i++) {
+ printk(KERN_CONT "%d:%d", nnode.nbranch[i].lnum,
+ nnode.nbranch[i].offs);
+@@ -1944,15 +1971,18 @@ static void dump_lpt_leb(const struct ubifs_info *c, int lnum)
+ break;
+ default:
+ ubifs_err("LPT node type %d not recognized", node_type);
+- return;
++ goto out;
+ }
+
+- buf += node_len;
++ p += node_len;
+ len -= node_len;
+ }
+
+ printk(KERN_DEBUG "(pid %d) finish dumping LEB %d\n",
+ current->pid, lnum);
++out:
++ vfree(buf);
++ return;
+ }
+
+ /**
+@@ -1974,4 +2004,47 @@ void dbg_dump_lpt_lebs(const struct ubifs_info *c)
+ current->pid);
+ }
+
++/**
++ * dbg_populate_lsave - debugging version of 'populate_lsave()'
++ * @c: UBIFS file-system description object
++ *
++ * This is a debugging version for 'populate_lsave()' which populates lsave
++ * with random LEBs instead of useful LEBs, which is good for test coverage.
++ * Returns zero if lsave has not been populated (this debugging feature is
++ * disabled) an non-zero if lsave has been populated.
++ */
++static int dbg_populate_lsave(struct ubifs_info *c)
++{
++ struct ubifs_lprops *lprops;
++ struct ubifs_lpt_heap *heap;
++ int i;
++
++ if (!dbg_is_chk_gen(c))
++ return 0;
++ if (random32() & 3)
++ return 0;
++
++ for (i = 0; i < c->lsave_cnt; i++)
++ c->lsave[i] = c->main_first;
++
++ list_for_each_entry(lprops, &c->empty_list, list)
++ c->lsave[random32() % c->lsave_cnt] = lprops->lnum;
++ list_for_each_entry(lprops, &c->freeable_list, list)
++ c->lsave[random32() % c->lsave_cnt] = lprops->lnum;
++ list_for_each_entry(lprops, &c->frdi_idx_list, list)
++ c->lsave[random32() % c->lsave_cnt] = lprops->lnum;
++
++ heap = &c->lpt_heap[LPROPS_DIRTY_IDX - 1];
++ for (i = 0; i < heap->cnt; i++)
++ c->lsave[random32() % c->lsave_cnt] = heap->arr[i]->lnum;
++ heap = &c->lpt_heap[LPROPS_DIRTY - 1];
++ for (i = 0; i < heap->cnt; i++)
++ c->lsave[random32() % c->lsave_cnt] = heap->arr[i]->lnum;
++ heap = &c->lpt_heap[LPROPS_FREE - 1];
++ for (i = 0; i < heap->cnt; i++)
++ c->lsave[random32() % c->lsave_cnt] = heap->arr[i]->lnum;
++
++ return 1;
++}
++
+ #endif /* CONFIG_UBIFS_FS_DEBUG */
+diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
+index 21f47af..278c238 100644
+--- a/fs/ubifs/master.c
++++ b/fs/ubifs/master.c
+@@ -148,7 +148,7 @@ static int validate_master(const struct ubifs_info *c)
+ }
+
+ main_sz = (long long)c->main_lebs * c->leb_size;
+- if (c->old_idx_sz & 7 || c->old_idx_sz >= main_sz) {
++ if (c->bi.old_idx_sz & 7 || c->bi.old_idx_sz >= main_sz) {
+ err = 9;
+ goto out;
+ }
+@@ -218,7 +218,7 @@ static int validate_master(const struct ubifs_info *c)
+ }
+
+ if (c->lst.total_dead + c->lst.total_dark +
+- c->lst.total_used + c->old_idx_sz > main_sz) {
++ c->lst.total_used + c->bi.old_idx_sz > main_sz) {
+ err = 21;
+ goto out;
+ }
+@@ -286,7 +286,7 @@ int ubifs_read_master(struct ubifs_info *c)
+ c->gc_lnum = le32_to_cpu(c->mst_node->gc_lnum);
+ c->ihead_lnum = le32_to_cpu(c->mst_node->ihead_lnum);
+ c->ihead_offs = le32_to_cpu(c->mst_node->ihead_offs);
+- c->old_idx_sz = le64_to_cpu(c->mst_node->index_size);
++ c->bi.old_idx_sz = le64_to_cpu(c->mst_node->index_size);
+ c->lpt_lnum = le32_to_cpu(c->mst_node->lpt_lnum);
+ c->lpt_offs = le32_to_cpu(c->mst_node->lpt_offs);
+ c->nhead_lnum = le32_to_cpu(c->mst_node->nhead_lnum);
+@@ -305,7 +305,7 @@ int ubifs_read_master(struct ubifs_info *c)
+ c->lst.total_dead = le64_to_cpu(c->mst_node->total_dead);
+ c->lst.total_dark = le64_to_cpu(c->mst_node->total_dark);
+
+- c->calc_idx_sz = c->old_idx_sz;
++ c->calc_idx_sz = c->bi.old_idx_sz;
+
+ if (c->mst_node->flags & cpu_to_le32(UBIFS_MST_NO_ORPHS))
+ c->no_orphs = 1;
+diff --git a/fs/ubifs/misc.h b/fs/ubifs/misc.h
+index c3de04d..ee7cb5e 100644
+--- a/fs/ubifs/misc.h
++++ b/fs/ubifs/misc.h
+@@ -39,6 +39,29 @@ static inline int ubifs_zn_dirty(const struct ubifs_znode *znode)
+ }
+
+ /**
++ * ubifs_zn_obsolete - check if znode is obsolete.
++ * @znode: znode to check
++ *
++ * This helper function returns %1 if @znode is obsolete and %0 otherwise.
++ */
++static inline int ubifs_zn_obsolete(const struct ubifs_znode *znode)
++{
++ return !!test_bit(OBSOLETE_ZNODE, &znode->flags);
++}
++
++/**
++ * ubifs_zn_cow - check if znode has to be copied on write.
++ * @znode: znode to check
++ *
++ * This helper function returns %1 if @znode is has COW flag set and %0
++ * otherwise.
++ */
++static inline int ubifs_zn_cow(const struct ubifs_znode *znode)
++{
++ return !!test_bit(COW_ZNODE, &znode->flags);
++}
++
++/**
+ * ubifs_wake_up_bgt - wake up background thread.
+ * @c: UBIFS file-system description object
+ */
+@@ -122,86 +145,6 @@ static inline int ubifs_wbuf_sync(struct ubifs_wbuf *wbuf)
+ }
+
+ /**
+- * ubifs_leb_unmap - unmap an LEB.
+- * @c: UBIFS file-system description object
+- * @lnum: LEB number to unmap
+- *
+- * This function returns %0 on success and a negative error code on failure.
+- */
+-static inline int ubifs_leb_unmap(const struct ubifs_info *c, int lnum)
+-{
+- int err;
+-
+- ubifs_assert(!c->ro_media && !c->ro_mount);
+- if (c->ro_error)
+- return -EROFS;
+- err = ubi_leb_unmap(c->ubi, lnum);
+- if (err) {
+- ubifs_err("unmap LEB %d failed, error %d", lnum, err);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * ubifs_leb_write - write to a LEB.
+- * @c: UBIFS file-system description object
+- * @lnum: LEB number to write
+- * @buf: buffer to write from
+- * @offs: offset within LEB to write to
+- * @len: length to write
+- * @dtype: data type
+- *
+- * This function returns %0 on success and a negative error code on failure.
+- */
+-static inline int ubifs_leb_write(const struct ubifs_info *c, int lnum,
+- const void *buf, int offs, int len, int dtype)
+-{
+- int err;
+-
+- ubifs_assert(!c->ro_media && !c->ro_mount);
+- if (c->ro_error)
+- return -EROFS;
+- err = ubi_leb_write(c->ubi, lnum, buf, offs, len, dtype);
+- if (err) {
+- ubifs_err("writing %d bytes at %d:%d, error %d",
+- len, lnum, offs, err);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * ubifs_leb_change - atomic LEB change.
+- * @c: UBIFS file-system description object
+- * @lnum: LEB number to write
+- * @buf: buffer to write from
+- * @len: length to write
+- * @dtype: data type
+- *
+- * This function returns %0 on success and a negative error code on failure.
+- */
+-static inline int ubifs_leb_change(const struct ubifs_info *c, int lnum,
+- const void *buf, int len, int dtype)
+-{
+- int err;
+-
+- ubifs_assert(!c->ro_media && !c->ro_mount);
+- if (c->ro_error)
+- return -EROFS;
+- err = ubi_leb_change(c->ubi, lnum, buf, len, dtype);
+- if (err) {
+- ubifs_err("changing %d bytes in LEB %d, error %d",
+- len, lnum, err);
+- return err;
+- }
+-
+- return 0;
+-}
+-
+-/**
+ * ubifs_encode_dev - encode device node IDs.
+ * @dev: UBIFS device node information
+ * @rdev: device IDs to encode
+@@ -340,4 +283,21 @@ static inline void ubifs_release_lprops(struct ubifs_info *c)
+ mutex_unlock(&c->lp_mutex);
+ }
+
++/**
++ * ubifs_next_log_lnum - switch to the next log LEB.
++ * @c: UBIFS file-system description object
++ * @lnum: current log LEB
++ *
++ * This helper function returns the log LEB number which goes next after LEB
++ * 'lnum'.
++ */
++static inline int ubifs_next_log_lnum(const struct ubifs_info *c, int lnum)
++{
++ lnum += 1;
++ if (lnum > c->log_last)
++ lnum = UBIFS_LOG_LNUM;
++
++ return lnum;
++}
++
+ #endif /* __UBIFS_MISC_H__ */
+diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
+index 82009c7..c542c73 100644
+--- a/fs/ubifs/orphan.c
++++ b/fs/ubifs/orphan.c
+@@ -673,7 +673,8 @@ static int kill_orphans(struct ubifs_info *c)
+ sleb = ubifs_scan(c, lnum, 0, c->sbuf, 1);
+ if (IS_ERR(sleb)) {
+ if (PTR_ERR(sleb) == -EUCLEAN)
+- sleb = ubifs_recover_leb(c, lnum, 0, c->sbuf, 0);
++ sleb = ubifs_recover_leb(c, lnum, 0,
++ c->sbuf, -1);
+ if (IS_ERR(sleb)) {
+ err = PTR_ERR(sleb);
+ break;
+@@ -892,15 +893,22 @@ static int dbg_read_orphans(struct check_info *ci, struct ubifs_scan_leb *sleb)
+ static int dbg_scan_orphans(struct ubifs_info *c, struct check_info *ci)
+ {
+ int lnum, err = 0;
++ void *buf;
+
+ /* Check no-orphans flag and skip this if no orphans */
+ if (c->no_orphs)
+ return 0;
+
++ buf = __vmalloc(c->leb_size, GFP_NOFS, PAGE_KERNEL);
++ if (!buf) {
++ ubifs_err("cannot allocate memory to check orphans");
++ return 0;
++ }
++
+ for (lnum = c->orph_first; lnum <= c->orph_last; lnum++) {
+ struct ubifs_scan_leb *sleb;
+
+- sleb = ubifs_scan(c, lnum, 0, c->dbg->buf, 0);
++ sleb = ubifs_scan(c, lnum, 0, buf, 0);
+ if (IS_ERR(sleb)) {
+ err = PTR_ERR(sleb);
+ break;
+@@ -912,6 +920,7 @@ static int dbg_scan_orphans(struct ubifs_info *c, struct check_info *ci)
+ break;
+ }
+
++ vfree(buf);
+ return err;
+ }
+
+@@ -920,7 +929,7 @@ static int dbg_check_orphans(struct ubifs_info *c)
+ struct check_info ci;
+ int err;
+
+- if (!(ubifs_chk_flags & UBIFS_CHK_ORPH))
++ if (!dbg_is_chk_orph(c))
+ return 0;
+
+ ci.last_ino = 0;
+diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
+index 77e9b87..2a935b3 100644
+--- a/fs/ubifs/recovery.c
++++ b/fs/ubifs/recovery.c
+@@ -28,6 +28,23 @@
+ * UBIFS always cleans away all remnants of an unclean un-mount, so that
+ * errors do not accumulate. However UBIFS defers recovery if it is mounted
+ * read-only, and the flash is not modified in that case.
++ *
++ * The general UBIFS approach to the recovery is that it recovers from
++ * corruptions which could be caused by power cuts, but it refuses to recover
++ * from corruption caused by other reasons. And UBIFS tries to distinguish
++ * between these 2 reasons of corruptions and silently recover in the former
++ * case and loudly complain in the latter case.
++ *
++ * UBIFS writes only to erased LEBs, so it writes only to the flash space
++ * containing only 0xFFs. UBIFS also always writes strictly from the beginning
++ * of the LEB to the end. And UBIFS assumes that the underlying flash media
++ * writes in @c->max_write_size bytes at a time.
++ *
++ * Hence, if UBIFS finds a corrupted node at offset X, it expects only the min.
++ * I/O unit corresponding to offset X to contain corrupted data, all the
++ * following min. I/O units have to contain empty space (all 0xFFs). If this is
++ * not true, the corruption cannot be the result of a power cut, and UBIFS
++ * refuses to mount.
+ */
+
+ #include <linux/crc32.h>
+@@ -100,7 +117,7 @@ static int get_master_node(const struct ubifs_info *c, int lnum, void **pbuf,
+ if (!sbuf)
+ return -ENOMEM;
+
+- err = ubi_read(c->ubi, lnum, sbuf, 0, c->leb_size);
++ err = ubifs_leb_read(c, lnum, sbuf, 0, c->leb_size, 0);
+ if (err && err != -EBADMSG)
+ goto out_free;
+
+@@ -196,10 +213,10 @@ static int write_rcvrd_mst_node(struct ubifs_info *c,
+ mst->flags |= cpu_to_le32(UBIFS_MST_RCVRY);
+
+ ubifs_prepare_node(c, mst, UBIFS_MST_NODE_SZ, 1);
+- err = ubi_leb_change(c->ubi, lnum, mst, sz, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum, mst, sz, UBI_SHORTTERM);
+ if (err)
+ goto out;
+- err = ubi_leb_change(c->ubi, lnum + 1, mst, sz, UBI_SHORTTERM);
++ err = ubifs_leb_change(c, lnum + 1, mst, sz, UBI_SHORTTERM);
+ if (err)
+ goto out;
+ out:
+@@ -257,7 +274,8 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ if (cor1)
+ goto out_err;
+ mst = mst1;
+- } else if (offs1 == 0 && offs2 + sz >= c->leb_size) {
++ } else if (offs1 == 0 &&
++ c->leb_size - offs2 - sz < sz) {
+ /* 1st LEB was unmapped and written, 2nd not */
+ if (cor1)
+ goto out_err;
+@@ -300,6 +318,32 @@ int ubifs_recover_master_node(struct ubifs_info *c)
+ goto out_free;
+ }
+ memcpy(c->rcvrd_mst_node, c->mst_node, UBIFS_MST_NODE_SZ);
++
++ /*
++ * We had to recover the master node, which means there was an
++ * unclean reboot. However, it is possible that the master node
++ * is clean at this point, i.e., %UBIFS_MST_DIRTY is not set.
++ * E.g., consider the following chain of events:
++ *
++ * 1. UBIFS was cleanly unmounted, so the master node is clean
++ * 2. UBIFS is being mounted R/W and starts changing the master
++ * node in the first (%UBIFS_MST_LNUM). A power cut happens,
++ * so this LEB ends up with some amount of garbage at the
++ * end.
++ * 3. UBIFS is being mounted R/O. We reach this place and
++ * recover the master node from the second LEB
++ * (%UBIFS_MST_LNUM + 1). But we cannot update the media
++ * because we are being mounted R/O. We have to defer the
++ * operation.
++ * 4. However, this master node (@c->mst_node) is marked as
++ * clean (since the step 1). And if we just return, the
++ * mount code will be confused and won't recover the master
++ * node when it is re-mounter R/W later.
++ *
++ * Thus, to force the recovery by marking the master node as
++ * dirty.
++ */
++ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ } else {
+ /* Write the recovered master node */
+ c->max_sqnum = le64_to_cpu(mst->ch.sqnum) - 1;
+@@ -362,8 +406,9 @@ int ubifs_write_rcvrd_mst_node(struct ubifs_info *c)
+ * @offs: offset to check
+ *
+ * This function returns %1 if @offs was in the last write to the LEB whose data
+- * is in @buf, otherwise %0 is returned. The determination is made by checking
+- * for subsequent empty space starting from the next @c->min_io_size boundary.
++ * is in @buf, otherwise %0 is returned. The determination is made by checking
++ * for subsequent empty space starting from the next @c->max_write_size
++ * boundary.
+ */
+ static int is_last_write(const struct ubifs_info *c, void *buf, int offs)
+ {
+@@ -371,10 +416,10 @@ static int is_last_write(const struct ubifs_info *c, void *buf, int offs)
+ uint8_t *p;
+
+ /*
+- * Round up to the next @c->min_io_size boundary i.e. @offs is in the
+- * last wbuf written. After that should be empty space.
++ * Round up to the next @c->max_write_size boundary i.e. @offs is in
++ * the last wbuf written. After that should be empty space.
+ */
+- empty_offs = ALIGN(offs + 1, c->min_io_size);
++ empty_offs = ALIGN(offs + 1, c->max_write_size);
+ check_len = c->leb_size - empty_offs;
+ p = buf + empty_offs - offs;
+ return is_empty(p, check_len);
+@@ -429,7 +474,7 @@ static int no_more_nodes(const struct ubifs_info *c, void *buf, int len,
+ int skip, dlen = le32_to_cpu(ch->len);
+
+ /* Check for empty space after the corrupt node's common header */
+- skip = ALIGN(offs + UBIFS_CH_SZ, c->min_io_size) - offs;
++ skip = ALIGN(offs + UBIFS_CH_SZ, c->max_write_size) - offs;
+ if (is_empty(buf + skip, len - skip))
+ return 1;
+ /*
+@@ -441,7 +486,7 @@ static int no_more_nodes(const struct ubifs_info *c, void *buf, int len,
+ return 0;
+ }
+ /* Now we know the corrupt node's length we can skip over it */
+- skip = ALIGN(offs + dlen, c->min_io_size) - offs;
++ skip = ALIGN(offs + dlen, c->max_write_size) - offs;
+ /* After which there should be empty space */
+ if (is_empty(buf + skip, len - skip))
+ return 1;
+@@ -495,8 +540,8 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ int len = ALIGN(endpt, c->min_io_size);
+
+ if (start) {
+- err = ubi_read(c->ubi, lnum, sleb->buf, 0,
+- start);
++ err = ubifs_leb_read(c, lnum, sleb->buf, 0,
++ start, 1);
+ if (err)
+ return err;
+ }
+@@ -510,8 +555,8 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ ubifs_pad(c, buf, pad_len);
+ }
+ }
+- err = ubi_leb_change(c->ubi, lnum, sleb->buf, len,
+- UBI_UNKNOWN);
++ err = ubifs_leb_change(c, lnum, sleb->buf, len,
++ UBI_UNKNOWN);
+ if (err)
+ return err;
+ }
+@@ -520,16 +565,15 @@ static int fix_unclean_leb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ }
+
+ /**
+- * drop_incomplete_group - drop nodes from an incomplete group.
++ * drop_last_group - drop the last group of nodes.
+ * @sleb: scanned LEB information
+ * @offs: offset of dropped nodes is returned here
+ *
+- * This function returns %1 if nodes are dropped and %0 otherwise.
++ * This is a helper function for 'ubifs_recover_leb()' which drops the last
++ * group of nodes of the scanned LEB.
+ */
+-static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
++static void drop_last_group(struct ubifs_scan_leb *sleb, int *offs)
+ {
+- int dropped = 0;
+-
+ while (!list_empty(&sleb->nodes)) {
+ struct ubifs_scan_node *snod;
+ struct ubifs_ch *ch;
+@@ -538,15 +582,40 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
+ list);
+ ch = snod->node;
+ if (ch->group_type != UBIFS_IN_NODE_GROUP)
+- return dropped;
+- dbg_rcvry("dropping node at %d:%d", sleb->lnum, snod->offs);
++ break;
++
++ dbg_rcvry("dropping grouped node at %d:%d",
++ sleb->lnum, snod->offs);
++ *offs = snod->offs;
++ list_del(&snod->list);
++ kfree(snod);
++ sleb->nodes_cnt -= 1;
++ }
++}
++
++/**
++ * drop_last_node - drop the last node.
++ * @sleb: scanned LEB information
++ * @offs: offset of dropped nodes is returned here
++ * @grouped: non-zero if whole group of nodes have to be dropped
++ *
++ * This is a helper function for 'ubifs_recover_leb()' which drops the last
++ * node of the scanned LEB.
++ */
++static void drop_last_node(struct ubifs_scan_leb *sleb, int *offs)
++{
++ struct ubifs_scan_node *snod;
++
++ if (!list_empty(&sleb->nodes)) {
++ snod = list_entry(sleb->nodes.prev, struct ubifs_scan_node,
++ list);
++
++ dbg_rcvry("dropping last node at %d:%d", sleb->lnum, snod->offs);
+ *offs = snod->offs;
+ list_del(&snod->list);
+ kfree(snod);
+ sleb->nodes_cnt -= 1;
+- dropped = 1;
+ }
+- return dropped;
+ }
+
+ /**
+@@ -555,7 +624,8 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
+ * @lnum: LEB number
+ * @offs: offset
+ * @sbuf: LEB-sized buffer to use
+- * @grouped: nodes may be grouped for recovery
++ * @jhead: journal head number this LEB belongs to (%-1 if the LEB does not
++ * belong to any journal head)
+ *
+ * This function does a scan of a LEB, but caters for errors that might have
+ * been caused by the unclean unmount from which we are attempting to recover.
+@@ -563,25 +633,21 @@ static int drop_incomplete_group(struct ubifs_scan_leb *sleb, int *offs)
+ * found, and a negative error code in case of failure.
+ */
+ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+- int offs, void *sbuf, int grouped)
++ int offs, void *sbuf, int jhead)
+ {
+- int err, len = c->leb_size - offs, need_clean = 0, quiet = 1;
+- int empty_chkd = 0, start = offs;
++ int ret = 0, err, len = c->leb_size - offs, start = offs, min_io_unit;
++ int grouped = jhead == -1 ? 0 : c->jheads[jhead].grouped;
+ struct ubifs_scan_leb *sleb;
+ void *buf = sbuf + offs;
+
+- dbg_rcvry("%d:%d", lnum, offs);
++ dbg_rcvry("%d:%d, jhead %d, grouped %d", lnum, offs, jhead, grouped);
+
+ sleb = ubifs_start_scan(c, lnum, offs, sbuf);
+ if (IS_ERR(sleb))
+ return sleb;
+
+- if (sleb->ecc)
+- need_clean = 1;
+-
++ ubifs_assert(len >= 8);
+ while (len >= 8) {
+- int ret;
+-
+ dbg_scan("look at LEB %d:%d (%d bytes left)",
+ lnum, offs, len);
+
+@@ -591,8 +657,7 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+ * Scan quietly until there is an error from which we cannot
+ * recover
+ */
+- ret = ubifs_scan_a_node(c, buf, len, lnum, offs, quiet);
+-
++ ret = ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
+ if (ret == SCANNED_A_NODE) {
+ /* A valid node, and not a padding node */
+ struct ubifs_ch *ch = buf;
+@@ -605,104 +670,127 @@ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+ offs += node_len;
+ buf += node_len;
+ len -= node_len;
+- continue;
+- }
+-
+- if (ret > 0) {
++ } else if (ret > 0) {
+ /* Padding bytes or a valid padding node */
+ offs += ret;
+ buf += ret;
+ len -= ret;
+- continue;
+- }
+-
+- if (ret == SCANNED_EMPTY_SPACE) {
+- if (!is_empty(buf, len)) {
+- if (!is_last_write(c, buf, offs))
+- break;
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- }
+- empty_chkd = 1;
++ } else if (ret == SCANNED_EMPTY_SPACE ||
++ ret == SCANNED_GARBAGE ||
++ ret == SCANNED_A_BAD_PAD_NODE ||
++ ret == SCANNED_A_CORRUPT_NODE) {
++ dbg_rcvry("found corruption (%d) at %d:%d",
++ ret, lnum, offs);
+ break;
+- }
+-
+- if (ret == SCANNED_GARBAGE || ret == SCANNED_A_BAD_PAD_NODE)
+- if (is_last_write(c, buf, offs)) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- empty_chkd = 1;
+- break;
+- }
+-
+- if (ret == SCANNED_A_CORRUPT_NODE)
+- if (no_more_nodes(c, buf, len, lnum, offs)) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- empty_chkd = 1;
+- break;
+- }
+-
+- if (quiet) {
+- /* Redo the last scan but noisily */
+- quiet = 0;
+- continue;
+- }
+-
+- switch (ret) {
+- case SCANNED_GARBAGE:
+- dbg_err("garbage");
+- goto corrupted;
+- case SCANNED_A_CORRUPT_NODE:
+- case SCANNED_A_BAD_PAD_NODE:
+- dbg_err("bad node");
+- goto corrupted;
+- default:
+- dbg_err("unknown");
++ } else {
++ dbg_err("unexpected return value %d", ret);
+ err = -EINVAL;
+ goto error;
+ }
+ }
+
+- if (!empty_chkd && !is_empty(buf, len)) {
+- if (is_last_write(c, buf, offs)) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- } else {
++ if (ret == SCANNED_GARBAGE || ret == SCANNED_A_BAD_PAD_NODE) {
++ if (!is_last_write(c, buf, offs))
++ goto corrupted_rescan;
++ } else if (ret == SCANNED_A_CORRUPT_NODE) {
++ if (!no_more_nodes(c, buf, len, lnum, offs))
++ goto corrupted_rescan;
++ } else if (!is_empty(buf, len)) {
++ if (!is_last_write(c, buf, offs)) {
+ int corruption = first_non_ff(buf, len);
+
++ /*
++ * See header comment for this file for more
++ * explanations about the reasons we have this check.
++ */
+ ubifs_err("corrupt empty space LEB %d:%d, corruption "
+ "starts at %d", lnum, offs, corruption);
+ /* Make sure we dump interesting non-0xFF data */
+- offs = corruption;
++ offs += corruption;
+ buf += corruption;
+ goto corrupted;
+ }
+ }
+
+- /* Drop nodes from incomplete group */
+- if (grouped && drop_incomplete_group(sleb, &offs)) {
+- buf = sbuf + offs;
+- len = c->leb_size - offs;
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
+- }
++ min_io_unit = round_down(offs, c->min_io_size);
++ if (grouped)
++ /*
++ * If nodes are grouped, always drop the incomplete group at
++ * the end.
++ */
++ drop_last_group(sleb, &offs);
+
+- if (offs % c->min_io_size) {
+- clean_buf(c, &buf, lnum, &offs, &len);
+- need_clean = 1;
++ if (jhead == GCHD) {
++ /*
++ * If this LEB belongs to the GC head then while we are in the
++ * middle of the same min. I/O unit keep dropping nodes. So
++ * basically, what we want is to make sure that the last min.
++ * I/O unit where we saw the corruption is dropped completely
++ * with all the uncorrupted nodes which may possibly sit there.
++ *
++ * In other words, let's name the min. I/O unit where the
++ * corruption starts B, and the previous min. I/O unit A. The
++ * below code tries to deal with a situation when half of B
++ * contains valid nodes or the end of a valid node, and the
++ * second half of B contains corrupted data or garbage. This
++ * means that UBIFS had been writing to B just before the power
++ * cut happened. I do not know how realistic is this scenario
++ * that half of the min. I/O unit had been written successfully
++ * and the other half not, but this is possible in our 'failure
++ * mode emulation' infrastructure at least.
++ *
++ * So what is the problem, why we need to drop those nodes? Why
++ * can't we just clean-up the second half of B by putting a
++ * padding node there? We can, and this works fine with one
++ * exception which was reproduced with power cut emulation
++ * testing and happens extremely rarely.
++ *
++ * Imagine the file-system is full, we run GC which starts
++ * moving valid nodes from LEB X to LEB Y (obviously, LEB Y is
++ * the current GC head LEB). The @c->gc_lnum is -1, which means
++ * that GC will retain LEB X and will try to continue. Imagine
++ * that LEB X is currently the dirtiest LEB, and the amount of
++ * used space in LEB Y is exactly the same as amount of free
++ * space in LEB X.
++ *
++ * And a power cut happens when nodes are moved from LEB X to
++ * LEB Y. We are here trying to recover LEB Y which is the GC
++ * head LEB. We find the min. I/O unit B as described above.
++ * Then we clean-up LEB Y by padding min. I/O unit. And later
++ * 'ubifs_rcvry_gc_commit()' function fails, because it cannot
++ * find a dirty LEB which could be GC'd into LEB Y! Even LEB X
++ * does not match because the amount of valid nodes there does
++ * not fit the free space in LEB Y any more! And this is
++ * because of the padding node which we added to LEB Y. The
++ * user-visible effect of this which I once observed and
++ * analysed is that we cannot mount the file-system with
++ * -ENOSPC error.
++ *
++ * So obviously, to make sure that situation does not happen we
++ * should free min. I/O unit B in LEB Y completely and the last
++ * used min. I/O unit in LEB Y should be A. This is basically
++ * what the below code tries to do.
++ */
++ while (offs > min_io_unit)
++ drop_last_node(sleb, &offs);
+ }
+
++ buf = sbuf + offs;
++ len = c->leb_size - offs;
++
++ clean_buf(c, &buf, lnum, &offs, &len);
+ ubifs_end_scan(c, sleb, lnum, offs);
+
+- if (need_clean) {
+- err = fix_unclean_leb(c, sleb, start);
+- if (err)
+- goto error;
+- }
++ err = fix_unclean_leb(c, sleb, start);
++ if (err)
++ goto error;
+
+ return sleb;
+
++corrupted_rescan:
++ /* Re-scan the corrupted data with verbose messages */
++ dbg_err("corruptio %d", ret);
++ ubifs_scan_a_node(c, buf, len, lnum, offs, 1);
+ corrupted:
+ ubifs_scanned_corruption(c, lnum, offs, buf);
+ err = -EUCLEAN;
+@@ -733,7 +821,8 @@ static int get_cs_sqnum(struct ubifs_info *c, int lnum, int offs,
+ return -ENOMEM;
+ if (c->leb_size - offs < UBIFS_CS_NODE_SZ)
+ goto out_err;
+- err = ubi_read(c->ubi, lnum, (void *)cs_node, offs, UBIFS_CS_NODE_SZ);
++ err = ubifs_leb_read(c, lnum, (void *)cs_node, offs,
++ UBIFS_CS_NODE_SZ, 0);
+ if (err && err != -EBADMSG)
+ goto out_free;
+ ret = ubifs_scan_a_node(c, cs_node, UBIFS_CS_NODE_SZ, lnum, offs, 0);
+@@ -819,7 +908,7 @@ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
+ }
+ ubifs_scan_destroy(sleb);
+ }
+- return ubifs_recover_leb(c, lnum, offs, sbuf, 0);
++ return ubifs_recover_leb(c, lnum, offs, sbuf, -1);
+ }
+
+ /**
+@@ -833,15 +922,10 @@ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-static int recover_head(const struct ubifs_info *c, int lnum, int offs,
+- void *sbuf)
++static int recover_head(struct ubifs_info *c, int lnum, int offs, void *sbuf)
+ {
+- int len, err;
++ int len = c->max_write_size, err;
+
+- if (c->min_io_size > 1)
+- len = c->min_io_size;
+- else
+- len = 512;
+ if (offs + len > c->leb_size)
+ len = c->leb_size - offs;
+
+@@ -849,15 +933,15 @@ static int recover_head(const struct ubifs_info *c, int lnum, int offs,
+ return 0;
+
+ /* Read at the head location and check it is empty flash */
+- err = ubi_read(c->ubi, lnum, sbuf, offs, len);
++ err = ubifs_leb_read(c, lnum, sbuf, offs, len, 1);
+ if (err || !is_empty(sbuf, len)) {
+ dbg_rcvry("cleaning head at %d:%d", lnum, offs);
+ if (offs == 0)
+ return ubifs_leb_unmap(c, lnum);
+- err = ubi_read(c->ubi, lnum, sbuf, 0, offs);
++ err = ubifs_leb_read(c, lnum, sbuf, 0, offs, 1);
+ if (err)
+ return err;
+- return ubi_leb_change(c->ubi, lnum, sbuf, offs, UBI_UNKNOWN);
++ return ubifs_leb_change(c, lnum, sbuf, offs, UBI_UNKNOWN);
+ }
+
+ return 0;
+@@ -880,7 +964,7 @@ static int recover_head(const struct ubifs_info *c, int lnum, int offs,
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf)
++int ubifs_recover_inl_heads(struct ubifs_info *c, void *sbuf)
+ {
+ int err;
+
+@@ -900,7 +984,7 @@ int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf)
+ }
+
+ /**
+- * clean_an_unclean_leb - read and write a LEB to remove corruption.
++ * clean_an_unclean_leb - read and write a LEB to remove corruption.
+ * @c: UBIFS file-system description object
+ * @ucleb: unclean LEB information
+ * @sbuf: LEB-sized buffer to use
+@@ -911,7 +995,7 @@ int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf)
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-static int clean_an_unclean_leb(const struct ubifs_info *c,
++static int clean_an_unclean_leb(struct ubifs_info *c,
+ struct ubifs_unclean_leb *ucleb, void *sbuf)
+ {
+ int err, lnum = ucleb->lnum, offs = 0, len = ucleb->endpt, quiet = 1;
+@@ -927,7 +1011,7 @@ static int clean_an_unclean_leb(const struct ubifs_info *c,
+ return 0;
+ }
+
+- err = ubi_read(c->ubi, lnum, buf, offs, len);
++ err = ubifs_leb_read(c, lnum, buf, offs, len, 0);
+ if (err && err != -EBADMSG)
+ return err;
+
+@@ -987,7 +1071,7 @@ static int clean_an_unclean_leb(const struct ubifs_info *c,
+ }
+
+ /* Write back the LEB atomically */
+- err = ubi_leb_change(c->ubi, lnum, sbuf, len, UBI_UNKNOWN);
++ err = ubifs_leb_change(c, lnum, sbuf, len, UBI_UNKNOWN);
+ if (err)
+ return err;
+
+@@ -1007,7 +1091,7 @@ static int clean_an_unclean_leb(const struct ubifs_info *c,
+ *
+ * This function returns %0 on success and a negative error code on failure.
+ */
+-int ubifs_clean_lebs(const struct ubifs_info *c, void *sbuf)
++int ubifs_clean_lebs(struct ubifs_info *c, void *sbuf)
+ {
+ dbg_rcvry("recovery");
+ while (!list_empty(&c->unclean_leb_list)) {
+@@ -1026,6 +1110,53 @@ int ubifs_clean_lebs(const struct ubifs_info *c, void *sbuf)
+ }
+
+ /**
++ * grab_empty_leb - grab an empty LEB to use as GC LEB and run commit.
++ * @c: UBIFS file-system description object
++ *
++ * This is a helper function for 'ubifs_rcvry_gc_commit()' which grabs an empty
++ * LEB to be used as GC LEB (@c->gc_lnum), and then runs the commit. Returns
++ * zero in case of success and a negative error code in case of failure.
++ */
++static int grab_empty_leb(struct ubifs_info *c)
++{
++ int lnum, err;
++
++ /*
++ * Note, it is very important to first search for an empty LEB and then
++ * run the commit, not vice-versa. The reason is that there might be
++ * only one empty LEB at the moment, the one which has been the
++ * @c->gc_lnum just before the power cut happened. During the regular
++ * UBIFS operation (not now) @c->gc_lnum is marked as "taken", so no
++ * one but GC can grab it. But at this moment this single empty LEB is
++ * not marked as taken, so if we run commit - what happens? Right, the
++ * commit will grab it and write the index there. Remember that the
++ * index always expands as long as there is free space, and it only
++ * starts consolidating when we run out of space.
++ *
++ * IOW, if we run commit now, we might not be able to find a free LEB
++ * after this.
++ */
++ lnum = ubifs_find_free_leb_for_idx(c);
++ if (lnum < 0) {
++ dbg_err("could not find an empty LEB");
++ dbg_dump_lprops(c);
++ dbg_dump_budg(c, &c->bi);
++ return lnum;
++ }
++
++ /* Reset the index flag */
++ err = ubifs_change_one_lp(c, lnum, LPROPS_NC, LPROPS_NC, 0,
++ LPROPS_INDEX, 0);
++ if (err)
++ return err;
++
++ c->gc_lnum = lnum;
++ dbg_rcvry("found empty LEB %d, run commit", lnum);
++
++ return ubifs_run_commit(c);
++}
++
++/**
+ * ubifs_rcvry_gc_commit - recover the GC LEB number and run the commit.
+ * @c: UBIFS file-system description object
+ *
+@@ -1047,71 +1178,26 @@ int ubifs_rcvry_gc_commit(struct ubifs_info *c)
+ {
+ struct ubifs_wbuf *wbuf = &c->jheads[GCHD].wbuf;
+ struct ubifs_lprops lp;
+- int lnum, err;
++ int err;
++
++ dbg_rcvry("GC head LEB %d, offs %d", wbuf->lnum, wbuf->offs);
+
+ c->gc_lnum = -1;
+- if (wbuf->lnum == -1) {
+- dbg_rcvry("no GC head LEB");
+- goto find_free;
+- }
+- /*
+- * See whether the used space in the dirtiest LEB fits in the GC head
+- * LEB.
+- */
+- if (wbuf->offs == c->leb_size) {
+- dbg_rcvry("no room in GC head LEB");
+- goto find_free;
+- }
++ if (wbuf->lnum == -1 || wbuf->offs == c->leb_size)
++ return grab_empty_leb(c);
++
+ err = ubifs_find_dirty_leb(c, &lp, wbuf->offs, 2);
+ if (err) {
+- /*
+- * There are no dirty or empty LEBs subject to here being
+- * enough for the index. Try to use
+- * 'ubifs_find_free_leb_for_idx()', which will return any empty
+- * LEBs (ignoring index requirements). If the index then
+- * doesn't have enough LEBs the recovery commit will fail -
+- * which is the same result anyway i.e. recovery fails. So
+- * there is no problem ignoring index requirements and just
+- * grabbing a free LEB since we have already established there
+- * is not a dirty LEB we could have used instead.
+- */
+- if (err == -ENOSPC) {
+- dbg_rcvry("could not find a dirty LEB");
+- goto find_free;
+- }
+- return err;
+- }
+- ubifs_assert(!(lp.flags & LPROPS_INDEX));
+- lnum = lp.lnum;
+- if (lp.free + lp.dirty == c->leb_size) {
+- /* An empty LEB was returned */
+- if (lp.free != c->leb_size) {
+- err = ubifs_change_one_lp(c, lnum, c->leb_size,
+- 0, 0, 0, 0);
+- if (err)
+- return err;
+- }
+- err = ubifs_leb_unmap(c, lnum);
+- if (err)
+- return err;
+- c->gc_lnum = lnum;
+- dbg_rcvry("allocated LEB %d for GC", lnum);
+- /* Run the commit */
+- dbg_rcvry("committing");
+- return ubifs_run_commit(c);
+- }
+- /*
+- * There was no empty LEB so the used space in the dirtiest LEB must fit
+- * in the GC head LEB.
+- */
+- if (lp.free + lp.dirty < wbuf->offs) {
+- dbg_rcvry("LEB %d doesn't fit in GC head LEB %d:%d",
+- lnum, wbuf->lnum, wbuf->offs);
+- err = ubifs_return_leb(c, lnum);
+- if (err)
++ if (err != -ENOSPC)
+ return err;
+- goto find_free;
++
++ dbg_rcvry("could not find a dirty LEB");
++ return grab_empty_leb(c);
+ }
++
++ ubifs_assert(!(lp.flags & LPROPS_INDEX));
++ ubifs_assert(lp.free + lp.dirty >= wbuf->offs);
++
+ /*
+ * We run the commit before garbage collection otherwise subsequent
+ * mounts will see the GC and orphan deletion in a different order.
+@@ -1120,11 +1206,8 @@ int ubifs_rcvry_gc_commit(struct ubifs_info *c)
+ err = ubifs_run_commit(c);
+ if (err)
+ return err;
+- /*
+- * The data in the dirtiest LEB fits in the GC head LEB, so do the GC
+- * - use locking to keep 'ubifs_assert()' happy.
+- */
+- dbg_rcvry("GC'ing LEB %d", lnum);
++
++ dbg_rcvry("GC'ing LEB %d", lp.lnum);
+ mutex_lock_nested(&wbuf->io_mutex, wbuf->jhead);
+ err = ubifs_garbage_collect_leb(c, &lp);
+ if (err >= 0) {
+@@ -1140,37 +1223,17 @@ int ubifs_rcvry_gc_commit(struct ubifs_info *c)
+ err = -EINVAL;
+ return err;
+ }
+- if (err != LEB_RETAINED) {
+- dbg_err("GC returned %d", err);
++
++ ubifs_assert(err == LEB_RETAINED);
++ if (err != LEB_RETAINED)
+ return -EINVAL;
+- }
++
+ err = ubifs_leb_unmap(c, c->gc_lnum);
+ if (err)
+ return err;
+- dbg_rcvry("allocated LEB %d for GC", lnum);
+- return 0;
+
+-find_free:
+- /*
+- * There is no GC head LEB or the free space in the GC head LEB is too
+- * small, or there are not dirty LEBs. Allocate gc_lnum by calling
+- * 'ubifs_find_free_leb_for_idx()' so GC is not run.
+- */
+- lnum = ubifs_find_free_leb_for_idx(c);
+- if (lnum < 0) {
+- dbg_err("could not find an empty LEB");
+- return lnum;
+- }
+- /* And reset the index flag */
+- err = ubifs_change_one_lp(c, lnum, LPROPS_NC, LPROPS_NC, 0,
+- LPROPS_INDEX, 0);
+- if (err)
+- return err;
+- c->gc_lnum = lnum;
+- dbg_rcvry("allocated LEB %d for GC", lnum);
+- /* Run the commit */
+- dbg_rcvry("committing");
+- return ubifs_run_commit(c);
++ dbg_rcvry("allocated LEB %d for GC", lp.lnum);
++ return 0;
+ }
+
+ /**
+@@ -1393,7 +1456,7 @@ static int fix_size_in_place(struct ubifs_info *c, struct size_entry *e)
+ if (i_size >= e->d_size)
+ return 0;
+ /* Read the LEB */
+- err = ubi_read(c->ubi, lnum, c->sbuf, 0, c->leb_size);
++ err = ubifs_leb_read(c, lnum, c->sbuf, 0, c->leb_size, 1);
+ if (err)
+ goto out;
+ /* Change the size field and recalculate the CRC */
+@@ -1409,10 +1472,10 @@ static int fix_size_in_place(struct ubifs_info *c, struct size_entry *e)
+ len -= 1;
+ len = ALIGN(len + 1, c->min_io_size);
+ /* Atomically write the fixed LEB back again */
+- err = ubi_leb_change(c->ubi, lnum, c->sbuf, len, UBI_UNKNOWN);
++ err = ubifs_leb_change(c, lnum, c->sbuf, len, UBI_UNKNOWN);
+ if (err)
+ goto out;
+- dbg_rcvry("inode %lu at %d:%d size %lld -> %lld ",
++ dbg_rcvry("inode %lu at %d:%d size %lld -> %lld",
+ (unsigned long)e->inum, lnum, offs, i_size, e->d_size);
+ return 0;
+
+@@ -1461,20 +1524,27 @@ int ubifs_recover_size(struct ubifs_info *c)
+ e->i_size = le64_to_cpu(ino->size);
+ }
+ }
++
+ if (e->exists && e->i_size < e->d_size) {
+- if (!e->inode && c->ro_mount) {
++ if (c->ro_mount) {
+ /* Fix the inode size and pin it in memory */
+ struct inode *inode;
++ struct ubifs_inode *ui;
++
++ ubifs_assert(!e->inode);
+
+ inode = ubifs_iget(c->vfs_sb, e->inum);
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
++
++ ui = ubifs_inode(inode);
+ if (inode->i_size < e->d_size) {
+ dbg_rcvry("ino %lu size %lld -> %lld",
+ (unsigned long)e->inum,
+- e->d_size, inode->i_size);
++ inode->i_size, e->d_size);
+ inode->i_size = e->d_size;
+- ubifs_inode(inode)->ui_size = e->d_size;
++ ui->ui_size = e->d_size;
++ ui->synced_i_size = e->d_size;
+ e->inode = inode;
+ this = rb_next(this);
+ continue;
+@@ -1489,9 +1559,11 @@ int ubifs_recover_size(struct ubifs_info *c)
+ iput(e->inode);
+ }
+ }
++
+ this = rb_next(this);
+ rb_erase(&e->rb, &c->size_tree);
+ kfree(e);
+ }
++
+ return 0;
+ }
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index eed0fcf..b007637 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -33,43 +33,32 @@
+ */
+
+ #include "ubifs.h"
+-
+-/*
+- * Replay flags.
+- *
+- * REPLAY_DELETION: node was deleted
+- * REPLAY_REF: node is a reference node
+- */
+-enum {
+- REPLAY_DELETION = 1,
+- REPLAY_REF = 2,
+-};
++#include <linux/list_sort.h>
+
+ /**
+- * struct replay_entry - replay tree entry.
++ * struct replay_entry - replay list entry.
+ * @lnum: logical eraseblock number of the node
+ * @offs: node offset
+ * @len: node length
++ * @deletion: non-zero if this entry corresponds to a node deletion
+ * @sqnum: node sequence number
+- * @flags: replay flags
+- * @rb: links the replay tree
++ * @list: links the replay list
+ * @key: node key
+ * @nm: directory entry name
+ * @old_size: truncation old size
+ * @new_size: truncation new size
+- * @free: amount of free space in a bud
+- * @dirty: amount of dirty space in a bud from padding and deletion nodes
+ *
+- * UBIFS journal replay must compare node sequence numbers, which means it must
+- * build a tree of node information to insert into the TNC.
++ * The replay process first scans all buds and builds the replay list, then
++ * sorts the replay list in nodes sequence number order, and then inserts all
++ * the replay entries to the TNC.
+ */
+ struct replay_entry {
+ int lnum;
+ int offs;
+ int len;
++ unsigned int deletion:1;
+ unsigned long long sqnum;
+- int flags;
+- struct rb_node rb;
++ struct list_head list;
+ union ubifs_key key;
+ union {
+ struct qstr nm;
+@@ -77,10 +66,6 @@ struct replay_entry {
+ loff_t old_size;
+ loff_t new_size;
+ };
+- struct {
+- int free;
+- int dirty;
+- };
+ };
+ };
+
+@@ -88,57 +73,64 @@ struct replay_entry {
+ * struct bud_entry - entry in the list of buds to replay.
+ * @list: next bud in the list
+ * @bud: bud description object
+- * @free: free bytes in the bud
+ * @sqnum: reference node sequence number
++ * @free: free bytes in the bud
++ * @dirty: dirty bytes in the bud
+ */
+ struct bud_entry {
+ struct list_head list;
+ struct ubifs_bud *bud;
+- int free;
+ unsigned long long sqnum;
++ int free;
++ int dirty;
+ };
+
+ /**
+ * set_bud_lprops - set free and dirty space used by a bud.
+ * @c: UBIFS file-system description object
+- * @r: replay entry of bud
++ * @b: bud entry which describes the bud
++ *
++ * This function makes sure the LEB properties of bud @b are set correctly
++ * after the replay. Returns zero in case of success and a negative error code
++ * in case of failure.
+ */
+-static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
++static int set_bud_lprops(struct ubifs_info *c, struct bud_entry *b)
+ {
+ const struct ubifs_lprops *lp;
+ int err = 0, dirty;
+
+ ubifs_get_lprops(c);
+
+- lp = ubifs_lpt_lookup_dirty(c, r->lnum);
++ lp = ubifs_lpt_lookup_dirty(c, b->bud->lnum);
+ if (IS_ERR(lp)) {
+ err = PTR_ERR(lp);
+ goto out;
+ }
+
+ dirty = lp->dirty;
+- if (r->offs == 0 && (lp->free != c->leb_size || lp->dirty != 0)) {
++ if (b->bud->start == 0 && (lp->free != c->leb_size || lp->dirty != 0)) {
+ /*
+ * The LEB was added to the journal with a starting offset of
+ * zero which means the LEB must have been empty. The LEB
+- * property values should be lp->free == c->leb_size and
+- * lp->dirty == 0, but that is not the case. The reason is that
+- * the LEB was garbage collected. The garbage collector resets
+- * the free and dirty space without recording it anywhere except
+- * lprops, so if there is not a commit then lprops does not have
+- * that information next time the file system is mounted.
++ * property values should be @lp->free == @c->leb_size and
++ * @lp->dirty == 0, but that is not the case. The reason is that
++ * the LEB had been garbage collected before it became the bud,
++ * and there was not commit inbetween. The garbage collector
++ * resets the free and dirty space without recording it
++ * anywhere except lprops, so if there was no commit then
++ * lprops does not have that information.
+ *
+ * We do not need to adjust free space because the scan has told
+ * us the exact value which is recorded in the replay entry as
+- * r->free.
++ * @b->free.
+ *
+ * However we do need to subtract from the dirty space the
+ * amount of space that the garbage collector reclaimed, which
+ * is the whole LEB minus the amount of space that was free.
+ */
+- dbg_mnt("bud LEB %d was GC'd (%d free, %d dirty)", r->lnum,
++ dbg_mnt("bud LEB %d was GC'd (%d free, %d dirty)", b->bud->lnum,
+ lp->free, lp->dirty);
+- dbg_gc("bud LEB %d was GC'd (%d free, %d dirty)", r->lnum,
++ dbg_gc("bud LEB %d was GC'd (%d free, %d dirty)", b->bud->lnum,
+ lp->free, lp->dirty);
+ dirty -= c->leb_size - lp->free;
+ /*
+@@ -150,21 +142,48 @@ static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
+ */
+ if (dirty != 0)
+ dbg_msg("LEB %d lp: %d free %d dirty "
+- "replay: %d free %d dirty", r->lnum, lp->free,
+- lp->dirty, r->free, r->dirty);
++ "replay: %d free %d dirty", b->bud->lnum,
++ lp->free, lp->dirty, b->free, b->dirty);
+ }
+- lp = ubifs_change_lp(c, lp, r->free, dirty + r->dirty,
++ lp = ubifs_change_lp(c, lp, b->free, dirty + b->dirty,
+ lp->flags | LPROPS_TAKEN, 0);
+ if (IS_ERR(lp)) {
+ err = PTR_ERR(lp);
+ goto out;
+ }
++
++ /* Make sure the journal head points to the latest bud */
++ err = ubifs_wbuf_seek_nolock(&c->jheads[b->bud->jhead].wbuf,
++ b->bud->lnum, c->leb_size - b->free,
++ UBI_SHORTTERM);
++
+ out:
+ ubifs_release_lprops(c);
+ return err;
+ }
+
+ /**
++ * set_buds_lprops - set free and dirty space for all replayed buds.
++ * @c: UBIFS file-system description object
++ *
++ * This function sets LEB properties for all replayed buds. Returns zero in
++ * case of success and a negative error code in case of failure.
++ */
++static int set_buds_lprops(struct ubifs_info *c)
++{
++ struct bud_entry *b;
++ int err;
++
++ list_for_each_entry(b, &c->replay_buds, list) {
++ err = set_bud_lprops(c, b);
++ if (err)
++ return err;
++ }
++
++ return 0;
++}
++
++/**
+ * trun_remove_range - apply a replay entry for a truncation to the TNC.
+ * @c: UBIFS file-system description object
+ * @r: replay entry of truncation
+@@ -200,24 +219,22 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r)
+ */
+ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ {
+- int err, deletion = ((r->flags & REPLAY_DELETION) != 0);
++ int err;
+
+- dbg_mnt("LEB %d:%d len %d flgs %d sqnum %llu %s", r->lnum,
+- r->offs, r->len, r->flags, r->sqnum, DBGKEY(&r->key));
++ dbg_mntk(&r->key, "LEB %d:%d len %d deletion %d sqnum %llu key ",
++ r->lnum, r->offs, r->len, r->deletion, r->sqnum);
+
+ /* Set c->replay_sqnum to help deal with dangling branches. */
+ c->replay_sqnum = r->sqnum;
+
+- if (r->flags & REPLAY_REF)
+- err = set_bud_lprops(c, r);
+- else if (is_hash_key(c, &r->key)) {
+- if (deletion)
++ if (is_hash_key(c, &r->key)) {
++ if (r->deletion)
+ err = ubifs_tnc_remove_nm(c, &r->key, &r->nm);
+ else
+ err = ubifs_tnc_add_nm(c, &r->key, r->lnum, r->offs,
+ r->len, &r->nm);
+ } else {
+- if (deletion)
++ if (r->deletion)
+ switch (key_type(c, &r->key)) {
+ case UBIFS_INO_KEY:
+ {
+@@ -240,7 +257,7 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ return err;
+
+ if (c->need_recovery)
+- err = ubifs_recover_size_accum(c, &r->key, deletion,
++ err = ubifs_recover_size_accum(c, &r->key, r->deletion,
+ r->new_size);
+ }
+
+@@ -248,68 +265,77 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ }
+
+ /**
+- * destroy_replay_tree - destroy the replay.
+- * @c: UBIFS file-system description object
++ * replay_entries_cmp - compare 2 replay entries.
++ * @priv: UBIFS file-system description object
++ * @a: first replay entry
++ * @a: second replay entry
+ *
+- * Destroy the replay tree.
++ * This is a comparios function for 'list_sort()' which compares 2 replay
++ * entries @a and @b by comparing their sequence numer. Returns %1 if @a has
++ * greater sequence number and %-1 otherwise.
+ */
+-static void destroy_replay_tree(struct ubifs_info *c)
++static int replay_entries_cmp(void *priv, struct list_head *a,
++ struct list_head *b)
+ {
+- struct rb_node *this = c->replay_tree.rb_node;
+- struct replay_entry *r;
+-
+- while (this) {
+- if (this->rb_left) {
+- this = this->rb_left;
+- continue;
+- } else if (this->rb_right) {
+- this = this->rb_right;
+- continue;
+- }
+- r = rb_entry(this, struct replay_entry, rb);
+- this = rb_parent(this);
+- if (this) {
+- if (this->rb_left == &r->rb)
+- this->rb_left = NULL;
+- else
+- this->rb_right = NULL;
+- }
+- if (is_hash_key(c, &r->key))
+- kfree(r->nm.name);
+- kfree(r);
+- }
+- c->replay_tree = RB_ROOT;
++ struct replay_entry *ra, *rb;
++
++ cond_resched();
++ if (a == b)
++ return 0;
++
++ ra = list_entry(a, struct replay_entry, list);
++ rb = list_entry(b, struct replay_entry, list);
++ ubifs_assert(ra->sqnum != rb->sqnum);
++ if (ra->sqnum > rb->sqnum)
++ return 1;
++ return -1;
+ }
+
+ /**
+- * apply_replay_tree - apply the replay tree to the TNC.
++ * apply_replay_list - apply the replay list to the TNC.
+ * @c: UBIFS file-system description object
+ *
+- * Apply the replay tree.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
++ * Apply all entries in the replay list to the TNC. Returns zero in case of
++ * success and a negative error code in case of failure.
+ */
+-static int apply_replay_tree(struct ubifs_info *c)
++static int apply_replay_list(struct ubifs_info *c)
+ {
+- struct rb_node *this = rb_first(&c->replay_tree);
++ struct replay_entry *r;
++ int err;
+
+- while (this) {
+- struct replay_entry *r;
+- int err;
++ list_sort(c, &c->replay_list, &replay_entries_cmp);
+
++ list_for_each_entry(r, &c->replay_list, list) {
+ cond_resched();
+
+- r = rb_entry(this, struct replay_entry, rb);
+ err = apply_replay_entry(c, r);
+ if (err)
+ return err;
+- this = rb_next(this);
+ }
++
+ return 0;
+ }
+
+ /**
+- * insert_node - insert a node to the replay tree.
++ * destroy_replay_list - destroy the replay.
++ * @c: UBIFS file-system description object
++ *
++ * Destroy the replay list.
++ */
++static void destroy_replay_list(struct ubifs_info *c)
++{
++ struct replay_entry *r, *tmp;
++
++ list_for_each_entry_safe(r, tmp, &c->replay_list, list) {
++ if (is_hash_key(c, &r->key))
++ kfree(r->nm.name);
++ list_del(&r->list);
++ kfree(r);
++ }
++}
++
++/**
++ * insert_node - insert a node to the replay list
+ * @c: UBIFS file-system description object
+ * @lnum: node logical eraseblock number
+ * @offs: node offset
+@@ -321,39 +347,25 @@ static int apply_replay_tree(struct ubifs_info *c)
+ * @old_size: truncation old size
+ * @new_size: truncation new size
+ *
+- * This function inserts a scanned non-direntry node to the replay tree. The
+- * replay tree is an RB-tree containing @struct replay_entry elements which are
+- * indexed by the sequence number. The replay tree is applied at the very end
+- * of the replay process. Since the tree is sorted in sequence number order,
+- * the older modifications are applied first. This function returns zero in
+- * case of success and a negative error code in case of failure.
++ * This function inserts a scanned non-direntry node to the replay list. The
++ * replay list contains @struct replay_entry elements, and we sort this list in
++ * sequence number order before applying it. The replay list is applied at the
++ * very end of the replay process. Since the list is sorted in sequence number
++ * order, the older modifications are applied first. This function returns zero
++ * in case of success and a negative error code in case of failure.
+ */
+ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
+ union ubifs_key *key, unsigned long long sqnum,
+ int deletion, int *used, loff_t old_size,
+ loff_t new_size)
+ {
+- struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
+ struct replay_entry *r;
+
++ dbg_mntk(key, "add LEB %d:%d, key ", lnum, offs);
++
+ if (key_inum(c, key) >= c->highest_inum)
+ c->highest_inum = key_inum(c, key);
+
+- dbg_mnt("add LEB %d:%d, key %s", lnum, offs, DBGKEY(key));
+- while (*p) {
+- parent = *p;
+- r = rb_entry(parent, struct replay_entry, rb);
+- if (sqnum < r->sqnum) {
+- p = &(*p)->rb_left;
+- continue;
+- } else if (sqnum > r->sqnum) {
+- p = &(*p)->rb_right;
+- continue;
+- }
+- ubifs_err("duplicate sqnum in replay");
+- return -EINVAL;
+- }
+-
+ r = kzalloc(sizeof(struct replay_entry), GFP_KERNEL);
+ if (!r)
+ return -ENOMEM;
+@@ -363,19 +375,18 @@ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
+ r->lnum = lnum;
+ r->offs = offs;
+ r->len = len;
++ r->deletion = !!deletion;
+ r->sqnum = sqnum;
+- r->flags = (deletion ? REPLAY_DELETION : 0);
++ key_copy(c, key, &r->key);
+ r->old_size = old_size;
+ r->new_size = new_size;
+- key_copy(c, key, &r->key);
+
+- rb_link_node(&r->rb, parent, p);
+- rb_insert_color(&r->rb, &c->replay_tree);
++ list_add_tail(&r->list, &c->replay_list);
+ return 0;
+ }
+
+ /**
+- * insert_dent - insert a directory entry node into the replay tree.
++ * insert_dent - insert a directory entry node into the replay list.
+ * @c: UBIFS file-system description object
+ * @lnum: node logical eraseblock number
+ * @offs: node offset
+@@ -387,43 +398,25 @@ static int insert_node(struct ubifs_info *c, int lnum, int offs, int len,
+ * @deletion: non-zero if this is a deletion
+ * @used: number of bytes in use in a LEB
+ *
+- * This function inserts a scanned directory entry node to the replay tree.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
+- *
+- * This function is also used for extended attribute entries because they are
+- * implemented as directory entry nodes.
++ * This function inserts a scanned directory entry node or an extended
++ * attribute entry to the replay list. Returns zero in case of success and a
++ * negative error code in case of failure.
+ */
+ static int insert_dent(struct ubifs_info *c, int lnum, int offs, int len,
+ union ubifs_key *key, const char *name, int nlen,
+ unsigned long long sqnum, int deletion, int *used)
+ {
+- struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
+ struct replay_entry *r;
+ char *nbuf;
+
++ dbg_mntk(key, "add LEB %d:%d, key ", lnum, offs);
+ if (key_inum(c, key) >= c->highest_inum)
+ c->highest_inum = key_inum(c, key);
+
+- dbg_mnt("add LEB %d:%d, key %s", lnum, offs, DBGKEY(key));
+- while (*p) {
+- parent = *p;
+- r = rb_entry(parent, struct replay_entry, rb);
+- if (sqnum < r->sqnum) {
+- p = &(*p)->rb_left;
+- continue;
+- }
+- if (sqnum > r->sqnum) {
+- p = &(*p)->rb_right;
+- continue;
+- }
+- ubifs_err("duplicate sqnum in replay");
+- return -EINVAL;
+- }
+-
+ r = kzalloc(sizeof(struct replay_entry), GFP_KERNEL);
+ if (!r)
+ return -ENOMEM;
++
+ nbuf = kmalloc(nlen + 1, GFP_KERNEL);
+ if (!nbuf) {
+ kfree(r);
+@@ -435,17 +428,15 @@ static int insert_dent(struct ubifs_info *c, int lnum, int offs, int len,
+ r->lnum = lnum;
+ r->offs = offs;
+ r->len = len;
++ r->deletion = !!deletion;
+ r->sqnum = sqnum;
++ key_copy(c, key, &r->key);
+ r->nm.len = nlen;
+ memcpy(nbuf, name, nlen);
+ nbuf[nlen] = '\0';
+ r->nm.name = nbuf;
+- r->flags = (deletion ? REPLAY_DELETION : 0);
+- key_copy(c, key, &r->key);
+
+- ubifs_assert(!*p);
+- rb_link_node(&r->rb, parent, p);
+- rb_insert_color(&r->rb, &c->replay_tree);
++ list_add_tail(&r->list, &c->replay_list);
+ return 0;
+ }
+
+@@ -482,29 +473,90 @@ int ubifs_validate_entry(struct ubifs_info *c,
+ }
+
+ /**
++ * is_last_bud - check if the bud is the last in the journal head.
++ * @c: UBIFS file-system description object
++ * @bud: bud description object
++ *
++ * This function checks if bud @bud is the last bud in its journal head. This
++ * information is then used by 'replay_bud()' to decide whether the bud can
++ * have corruptions or not. Indeed, only last buds can be corrupted by power
++ * cuts. Returns %1 if this is the last bud, and %0 if not.
++ */
++static int is_last_bud(struct ubifs_info *c, struct ubifs_bud *bud)
++{
++ struct ubifs_jhead *jh = &c->jheads[bud->jhead];
++ struct ubifs_bud *next;
++ uint32_t data;
++ int err;
++
++ if (list_is_last(&bud->list, &jh->buds_list))
++ return 1;
++
++ /*
++ * The following is a quirk to make sure we work correctly with UBIFS
++ * images used with older UBIFS.
++ *
++ * Normally, the last bud will be the last in the journal head's list
++ * of bud. However, there is one exception if the UBIFS image belongs
++ * to older UBIFS. This is fairly unlikely: one would need to use old
++ * UBIFS, then have a power cut exactly at the right point, and then
++ * try to mount this image with new UBIFS.
++ *
++ * The exception is: it is possible to have 2 buds A and B, A goes
++ * before B, and B is the last, bud B is contains no data, and bud A is
++ * corrupted at the end. The reason is that in older versions when the
++ * journal code switched the next bud (from A to B), it first added a
++ * log reference node for the new bud (B), and only after this it
++ * synchronized the write-buffer of current bud (A). But later this was
++ * changed and UBIFS started to always synchronize the write-buffer of
++ * the bud (A) before writing the log reference for the new bud (B).
++ *
++ * But because older UBIFS always synchronized A's write-buffer before
++ * writing to B, we can recognize this exceptional situation but
++ * checking the contents of bud B - if it is empty, then A can be
++ * treated as the last and we can recover it.
++ *
++ * TODO: remove this piece of code in a couple of years (today it is
++ * 16.05.2011).
++ */
++ next = list_entry(bud->list.next, struct ubifs_bud, list);
++ if (!list_is_last(&next->list, &jh->buds_list))
++ return 0;
++
++ err = ubifs_leb_read(c, next->lnum, (char *)&data, next->start, 4, 1);
++ if (err)
++ return 0;
++
++ return data == 0xFFFFFFFF;
++}
++
++/**
+ * replay_bud - replay a bud logical eraseblock.
+ * @c: UBIFS file-system description object
+- * @lnum: bud logical eraseblock number to replay
+- * @offs: bud start offset
+- * @jhead: journal head to which this bud belongs
+- * @free: amount of free space in the bud is returned here
+- * @dirty: amount of dirty space from padding and deletion nodes is returned
+- * here
++ * @b: bud entry which describes the bud
+ *
+- * This function returns zero in case of success and a negative error code in
+- * case of failure.
++ * This function replays bud @bud, recovers it if needed, and adds all nodes
++ * from this bud to the replay list. Returns zero in case of success and a
++ * negative error code in case of failure.
+ */
+-static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
+- int *free, int *dirty)
++static int replay_bud(struct ubifs_info *c, struct bud_entry *b)
+ {
+- int err = 0, used = 0;
++ int is_last = is_last_bud(c, b->bud);
++ int err = 0, used = 0, lnum = b->bud->lnum, offs = b->bud->start;
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
+- struct ubifs_bud *bud;
+
+- dbg_mnt("replay bud LEB %d, head %d", lnum, jhead);
+- if (c->need_recovery)
+- sleb = ubifs_recover_leb(c, lnum, offs, c->sbuf, jhead != GCHD);
++ dbg_mnt("replay bud LEB %d, head %d, offs %d, is_last %d",
++ lnum, b->bud->jhead, offs, is_last);
++
++ if (c->need_recovery && is_last)
++ /*
++ * Recover only last LEBs in the journal heads, because power
++ * cuts may cause corruptions only in these LEBs, because only
++ * these LEBs could possibly be written to at the power cut
++ * time.
++ */
++ sleb = ubifs_recover_leb(c, lnum, offs, c->sbuf, b->bud->jhead);
+ else
+ sleb = ubifs_scan(c, lnum, offs, c->sbuf, 0);
+ if (IS_ERR(sleb))
+@@ -620,19 +672,13 @@ static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
+ goto out;
+ }
+
+- bud = ubifs_search_bud(c, lnum);
+- if (!bud)
+- BUG();
+-
++ ubifs_assert(ubifs_search_bud(c, lnum));
+ ubifs_assert(sleb->endpt - offs >= used);
+ ubifs_assert(sleb->endpt % c->min_io_size == 0);
+
+- if (sleb->endpt + c->min_io_size <= c->leb_size && !c->ro_mount)
+- err = ubifs_wbuf_seek_nolock(&c->jheads[jhead].wbuf, lnum,
+- sleb->endpt, UBI_SHORTTERM);
+-
+- *dirty = sleb->endpt - offs - used;
+- *free = c->leb_size - sleb->endpt;
++ b->dirty = sleb->endpt - offs - used;
++ b->free = c->leb_size - sleb->endpt;
++ dbg_mnt("bud LEB %d replied: dirty %d, free %d", lnum, b->dirty, b->free);
+
+ out:
+ ubifs_scan_destroy(sleb);
+@@ -646,55 +692,6 @@ out_dump:
+ }
+
+ /**
+- * insert_ref_node - insert a reference node to the replay tree.
+- * @c: UBIFS file-system description object
+- * @lnum: node logical eraseblock number
+- * @offs: node offset
+- * @sqnum: sequence number
+- * @free: amount of free space in bud
+- * @dirty: amount of dirty space from padding and deletion nodes
+- *
+- * This function inserts a reference node to the replay tree and returns zero
+- * in case of success or a negative error code in case of failure.
+- */
+-static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
+- unsigned long long sqnum, int free, int dirty)
+-{
+- struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
+- struct replay_entry *r;
+-
+- dbg_mnt("add ref LEB %d:%d", lnum, offs);
+- while (*p) {
+- parent = *p;
+- r = rb_entry(parent, struct replay_entry, rb);
+- if (sqnum < r->sqnum) {
+- p = &(*p)->rb_left;
+- continue;
+- } else if (sqnum > r->sqnum) {
+- p = &(*p)->rb_right;
+- continue;
+- }
+- ubifs_err("duplicate sqnum in replay tree");
+- return -EINVAL;
+- }
+-
+- r = kzalloc(sizeof(struct replay_entry), GFP_KERNEL);
+- if (!r)
+- return -ENOMEM;
+-
+- r->lnum = lnum;
+- r->offs = offs;
+- r->sqnum = sqnum;
+- r->flags = REPLAY_REF;
+- r->free = free;
+- r->dirty = dirty;
+-
+- rb_link_node(&r->rb, parent, p);
+- rb_insert_color(&r->rb, &c->replay_tree);
+- return 0;
+-}
+-
+-/**
+ * replay_buds - replay all buds.
+ * @c: UBIFS file-system description object
+ *
+@@ -704,17 +701,16 @@ static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
+ static int replay_buds(struct ubifs_info *c)
+ {
+ struct bud_entry *b;
+- int err, uninitialized_var(free), uninitialized_var(dirty);
++ int err;
++ unsigned long long prev_sqnum = 0;
+
+ list_for_each_entry(b, &c->replay_buds, list) {
+- err = replay_bud(c, b->bud->lnum, b->bud->start, b->bud->jhead,
+- &free, &dirty);
+- if (err)
+- return err;
+- err = insert_ref_node(c, b->bud->lnum, b->bud->start, b->sqnum,
+- free, dirty);
++ err = replay_bud(c, b);
+ if (err)
+ return err;
++
++ ubifs_assert(b->sqnum > prev_sqnum);
++ prev_sqnum = b->sqnum;
+ }
+
+ return 0;
+@@ -1054,25 +1050,29 @@ int ubifs_replay_journal(struct ubifs_info *c)
+ if (err)
+ goto out;
+
+- err = apply_replay_tree(c);
++ err = apply_replay_list(c);
++ if (err)
++ goto out;
++
++ err = set_buds_lprops(c);
+ if (err)
+ goto out;
+
+ /*
+- * UBIFS budgeting calculations use @c->budg_uncommitted_idx variable
+- * to roughly estimate index growth. Things like @c->min_idx_lebs
++ * UBIFS budgeting calculations use @c->bi.uncommitted_idx variable
++ * to roughly estimate index growth. Things like @c->bi.min_idx_lebs
+ * depend on it. This means we have to initialize it to make sure
+ * budgeting works properly.
+ */
+- c->budg_uncommitted_idx = atomic_long_read(&c->dirty_zn_cnt);
+- c->budg_uncommitted_idx *= c->max_idx_node_sz;
++ c->bi.uncommitted_idx = atomic_long_read(&c->dirty_zn_cnt);
++ c->bi.uncommitted_idx *= c->max_idx_node_sz;
+
+ ubifs_assert(c->bud_bytes <= c->max_bud_bytes || c->need_recovery);
+ dbg_mnt("finished, log head LEB %d:%d, max_sqnum %llu, "
+ "highest_inum %lu", c->lhead_lnum, c->lhead_offs, c->max_sqnum,
+ (unsigned long)c->highest_inum);
+ out:
+- destroy_replay_tree(c);
++ destroy_replay_list(c);
+ destroy_bud_list(c);
+ c->replaying = 0;
+ return err;
+diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
+index bf31b47..771f7fb 100644
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -247,7 +247,7 @@ static int create_default_filesystem(struct ubifs_info *c)
+ mst->total_dirty = cpu_to_le64(tmp64);
+
+ /* The indexing LEB does not contribute to dark space */
+- tmp64 = (c->main_lebs - 1) * c->dark_wm;
++ tmp64 = ((long long)(c->main_lebs - 1) * c->dark_wm);
+ mst->total_dark = cpu_to_le64(tmp64);
+
+ mst->total_used = cpu_to_le64(UBIFS_INO_NODE_SZ);
+@@ -410,13 +410,23 @@ static int validate_sb(struct ubifs_info *c, struct ubifs_sb_node *sup)
+ }
+
+ if (c->main_lebs < UBIFS_MIN_MAIN_LEBS) {
+- err = 7;
++ ubifs_err("too few main LEBs count %d, must be at least %d",
++ c->main_lebs, UBIFS_MIN_MAIN_LEBS);
+ goto failed;
+ }
+
+- if (c->max_bud_bytes < (long long)c->leb_size * UBIFS_MIN_BUD_LEBS ||
+- c->max_bud_bytes > (long long)c->leb_size * c->main_lebs) {
+- err = 8;
++ max_bytes = (long long)c->leb_size * UBIFS_MIN_BUD_LEBS;
++ if (c->max_bud_bytes < max_bytes) {
++ ubifs_err("too small journal (%lld bytes), must be at least "
++ "%lld bytes", c->max_bud_bytes, max_bytes);
++ goto failed;
++ }
++
++ max_bytes = (long long)c->leb_size * c->main_lebs;
++ if (c->max_bud_bytes > max_bytes) {
++ ubifs_err("too large journal size (%lld bytes), only %lld bytes"
++ "available in the main area",
++ c->max_bud_bytes, max_bytes);
+ goto failed;
+ }
+
+@@ -450,7 +460,6 @@ static int validate_sb(struct ubifs_info *c, struct ubifs_sb_node *sup)
+ goto failed;
+ }
+
+- max_bytes = c->main_lebs * (long long)c->leb_size;
+ if (c->rp_size < 0 || max_bytes < c->rp_size) {
+ err = 14;
+ goto failed;
+@@ -475,7 +484,8 @@ failed:
+ * @c: UBIFS file-system description object
+ *
+ * This function returns a pointer to the superblock node or a negative error
+- * code.
++ * code. Note, the user of this function is responsible of kfree()'ing the
++ * returned superblock buffer.
+ */
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c)
+ {
+@@ -616,6 +626,7 @@ int ubifs_read_superblock(struct ubifs_info *c)
+ c->vfs_sb->s_time_gran = le32_to_cpu(sup->time_gran);
+ memcpy(&c->uuid, &sup->uuid, 16);
+ c->big_lpt = !!(sup_flags & UBIFS_FLG_BIGLPT);
++ c->space_fixup = !!(sup_flags & UBIFS_FLG_SPACE_FIXUP);
+
+ /* Automatically increase file system size to the maximum size */
+ c->old_leb_cnt = c->leb_cnt;
+@@ -650,3 +661,152 @@ out:
+ kfree(sup);
+ return err;
+ }
++
++/**
++ * fixup_leb - fixup/unmap an LEB containing free space.
++ * @c: UBIFS file-system description object
++ * @lnum: the LEB number to fix up
++ * @len: number of used bytes in LEB (starting at offset 0)
++ *
++ * This function reads the contents of the given LEB number @lnum, then fixes
++ * it up, so that empty min. I/O units in the end of LEB are actually erased on
++ * flash (rather than being just all-0xff real data). If the LEB is completely
++ * empty, it is simply unmapped.
++ */
++static int fixup_leb(struct ubifs_info *c, int lnum, int len)
++{
++ int err;
++
++ ubifs_assert(len >= 0);
++ ubifs_assert(len % c->min_io_size == 0);
++ ubifs_assert(len < c->leb_size);
++
++ if (len == 0) {
++ dbg_mnt("unmap empty LEB %d", lnum);
++ return ubifs_leb_unmap(c, lnum);
++ }
++
++ dbg_mnt("fixup LEB %d, data len %d", lnum, len);
++ err = ubifs_leb_read(c, lnum, c->sbuf, 0, len, 1);
++ if (err)
++ return err;
++
++ return ubifs_leb_change(c, lnum, c->sbuf, len, UBI_UNKNOWN);
++}
++
++/**
++ * fixup_free_space - find & remap all LEBs containing free space.
++ * @c: UBIFS file-system description object
++ *
++ * This function walks through all LEBs in the filesystem and fiexes up those
++ * containing free/empty space.
++ */
++static int fixup_free_space(struct ubifs_info *c)
++{
++ int lnum, err = 0;
++ struct ubifs_lprops *lprops;
++
++ ubifs_get_lprops(c);
++
++ /* Fixup LEBs in the master area */
++ for (lnum = UBIFS_MST_LNUM; lnum < UBIFS_LOG_LNUM; lnum++) {
++ err = fixup_leb(c, lnum, c->mst_offs + c->mst_node_alsz);
++ if (err)
++ goto out;
++ }
++
++ /* Unmap unused log LEBs */
++ lnum = ubifs_next_log_lnum(c, c->lhead_lnum);
++ while (lnum != c->ltail_lnum) {
++ err = fixup_leb(c, lnum, 0);
++ if (err)
++ goto out;
++ lnum = ubifs_next_log_lnum(c, lnum);
++ }
++
++ /* Fixup the current log head */
++ err = fixup_leb(c, c->lhead_lnum, c->lhead_offs);
++ if (err)
++ goto out;
++
++ /* Fixup LEBs in the LPT area */
++ for (lnum = c->lpt_first; lnum <= c->lpt_last; lnum++) {
++ int free = c->ltab[lnum - c->lpt_first].free;
++
++ if (free > 0) {
++ err = fixup_leb(c, lnum, c->leb_size - free);
++ if (err)
++ goto out;
++ }
++ }
++
++ /* Unmap LEBs in the orphans area */
++ for (lnum = c->orph_first; lnum <= c->orph_last; lnum++) {
++ err = fixup_leb(c, lnum, 0);
++ if (err)
++ goto out;
++ }
++
++ /* Fixup LEBs in the main area */
++ for (lnum = c->main_first; lnum < c->leb_cnt; lnum++) {
++ lprops = ubifs_lpt_lookup(c, lnum);
++ if (IS_ERR(lprops)) {
++ err = PTR_ERR(lprops);
++ goto out;
++ }
++
++ if (lprops->free > 0) {
++ err = fixup_leb(c, lnum, c->leb_size - lprops->free);
++ if (err)
++ goto out;
++ }
++ }
++
++out:
++ ubifs_release_lprops(c);
++ return err;
++}
++
++/**
++ * ubifs_fixup_free_space - find & fix all LEBs with free space.
++ * @c: UBIFS file-system description object
++ *
++ * This function fixes up LEBs containing free space on first mount, if the
++ * appropriate flag was set when the FS was created. Each LEB with one or more
++ * empty min. I/O unit (i.e. free-space-count > 0) is re-written, to make sure
++ * the free space is actually erased. E.g., this is necessary for some NAND
++ * chips, since the free space may have been programmed like real "0xff" data
++ * (generating a non-0xff ECC), causing future writes to the not-really-erased
++ * NAND pages to behave badly. After the space is fixed up, the superblock flag
++ * is cleared, so that this is skipped for all future mounts.
++ */
++int ubifs_fixup_free_space(struct ubifs_info *c)
++{
++ int err;
++ struct ubifs_sb_node *sup;
++
++ ubifs_assert(c->space_fixup);
++ ubifs_assert(!c->ro_mount);
++
++ ubifs_msg("start fixing up free space");
++
++ err = fixup_free_space(c);
++ if (err)
++ return err;
++
++ sup = ubifs_read_sb_node(c);
++ if (IS_ERR(sup))
++ return PTR_ERR(sup);
++
++ /* Free-space fixup is no longer required */
++ c->space_fixup = 0;
++ sup->flags &= cpu_to_le32(~UBIFS_FLG_SPACE_FIXUP);
++
++ err = ubifs_write_sb_node(c, sup);
++ kfree(sup);
++ if (err)
++ return err;
++
++ ubifs_msg("free space fixup complete");
++ return err;
++}
+diff --git a/fs/ubifs/scan.c b/fs/ubifs/scan.c
+index 3e1ee57..37383e8 100644
+--- a/fs/ubifs/scan.c
++++ b/fs/ubifs/scan.c
+@@ -148,7 +148,7 @@ struct ubifs_scan_leb *ubifs_start_scan(const struct ubifs_info *c, int lnum,
+ INIT_LIST_HEAD(&sleb->nodes);
+ sleb->buf = sbuf;
+
+- err = ubi_read(c->ubi, lnum, sbuf + offs, offs, c->leb_size - offs);
++ err = ubifs_leb_read(c, lnum, sbuf + offs, offs, c->leb_size - offs, 0);
+ if (err && err != -EBADMSG) {
+ ubifs_err("cannot read %d bytes from LEB %d:%d,"
+ " error %d", c->leb_size - offs, lnum, offs, err);
+@@ -240,7 +240,7 @@ void ubifs_scanned_corruption(const struct ubifs_info *c, int lnum, int offs,
+ int len;
+
+ ubifs_err("corruption at LEB %d:%d", lnum, offs);
+- if (dbg_failure_mode)
++ if (dbg_is_tst_rcvry(c))
+ return;
+ len = c->leb_size - offs;
+ if (len > 8192)
+@@ -328,7 +328,7 @@ struct ubifs_scan_leb *ubifs_scan(const struct ubifs_info *c, int lnum,
+ if (!quiet)
+ ubifs_err("empty space starts at non-aligned offset %d",
+ offs);
+- goto corrupted;;
++ goto corrupted;
+ }
+
+ ubifs_end_scan(c, sleb, lnum, offs);
+diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
+index 46961c0..d8f5d0f 100644
+--- a/fs/ubifs/shrinker.c
++++ b/fs/ubifs/shrinker.c
+@@ -283,7 +283,11 @@ int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask)
+ long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
+
+ if (nr == 0)
+- return clean_zn_cnt;
++ /*
++ * Due to the way UBIFS updates the clean znode counter it may
++ * temporarily be negative.
++ */
++ return clean_zn_cnt >= 0 ? clean_zn_cnt : 1;
+
+ if (!clean_zn_cnt) {
+ /*
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 91fac54..83651cd 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -85,7 +85,7 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
+ if (ui->data_len < 0 || ui->data_len > UBIFS_MAX_INO_DATA)
+ return 4;
+
+- if (ui->xattr && (inode->i_mode & S_IFMT) != S_IFREG)
++ if (ui->xattr && !S_ISREG(inode->i_mode))
+ return 5;
+
+ if (!ubifs_compr_present(ui->compr_type)) {
+@@ -94,7 +94,7 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
+ ubifs_compr_name(ui->compr_type));
+ }
+
+- err = dbg_check_dir_size(c, inode);
++ err = dbg_check_dir(c, inode);
+ return err;
+ }
+
+@@ -367,7 +367,7 @@ out:
+ ubifs_release_dirty_inode_budget(c, ui);
+ else {
+ /* We've deleted something - clean the "no space" flags */
+- c->nospace = c->nospace_rp = 0;
++ c->bi.nospace = c->bi.nospace_rp = 0;
+ smp_wmb();
+ }
+ done:
+@@ -504,9 +504,12 @@ static int init_constants_early(struct ubifs_info *c)
+
+ c->leb_cnt = c->vi.size;
+ c->leb_size = c->vi.usable_leb_size;
++ c->leb_start = c->di.leb_start;
+ c->half_leb_size = c->leb_size / 2;
+ c->min_io_size = c->di.min_io_size;
+ c->min_io_shift = fls(c->min_io_size) - 1;
++ c->max_write_size = c->di.max_write_size;
++ c->max_write_shift = fls(c->max_write_size) - 1;
+
+ if (c->leb_size < UBIFS_MIN_LEB_SZ) {
+ ubifs_err("too small LEBs (%d bytes), min. is %d bytes",
+@@ -526,6 +529,18 @@ static int init_constants_early(struct ubifs_info *c)
+ }
+
+ /*
++ * Maximum write size has to be greater or equivalent to min. I/O
++ * size, and be multiple of min. I/O size.
++ */
++ if (c->max_write_size < c->min_io_size ||
++ c->max_write_size % c->min_io_size ||
++ !is_power_of_2(c->max_write_size)) {
++ ubifs_err("bad write buffer size %d for %d min. I/O unit",
++ c->max_write_size, c->min_io_size);
++ return -EINVAL;
++ }
++
++ /*
+ * UBIFS aligns all node to 8-byte boundary, so to make function in
+ * io.c simpler, assume minimum I/O unit size to be 8 bytes if it is
+ * less than 8.
+@@ -533,6 +548,10 @@ static int init_constants_early(struct ubifs_info *c)
+ if (c->min_io_size < 8) {
+ c->min_io_size = 8;
+ c->min_io_shift = 3;
++ if (c->max_write_size < c->min_io_size) {
++ c->max_write_size = c->min_io_size;
++ c->max_write_shift = c->min_io_shift;
++ }
+ }
+
+ c->ref_node_alsz = ALIGN(UBIFS_REF_NODE_SZ, c->min_io_size);
+@@ -667,11 +686,11 @@ static int init_constants_sb(struct ubifs_info *c)
+ * be compressed and direntries are of the maximum size.
+ *
+ * Note, data, which may be stored in inodes is budgeted separately, so
+- * it is not included into 'c->inode_budget'.
++ * it is not included into 'c->bi.inode_budget'.
+ */
+- c->page_budget = UBIFS_MAX_DATA_NODE_SZ * UBIFS_BLOCKS_PER_PAGE;
+- c->inode_budget = UBIFS_INO_NODE_SZ;
+- c->dent_budget = UBIFS_MAX_DENT_NODE_SZ;
++ c->bi.page_budget = UBIFS_MAX_DATA_NODE_SZ * UBIFS_BLOCKS_PER_PAGE;
++ c->bi.inode_budget = UBIFS_INO_NODE_SZ;
++ c->bi.dent_budget = UBIFS_MAX_DENT_NODE_SZ;
+
+ /*
+ * When the amount of flash space used by buds becomes
+@@ -715,7 +734,7 @@ static void init_constants_master(struct ubifs_info *c)
+ {
+ long long tmp64;
+
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+ c->report_rp_size = ubifs_reported_space(c, c->rp_size);
+
+ /*
+@@ -784,15 +803,18 @@ static int alloc_wbufs(struct ubifs_info *c)
+
+ c->jheads[i].wbuf.sync_callback = &bud_wbuf_callback;
+ c->jheads[i].wbuf.jhead = i;
++ c->jheads[i].grouped = 1;
+ }
+
+ c->jheads[BASEHD].wbuf.dtype = UBI_SHORTTERM;
+ /*
+ * Garbage Collector head likely contains long-term data and
+- * does not need to be synchronized by timer.
++ * does not need to be synchronized by timer. Also GC head nodes are
++ * not grouped.
+ */
+ c->jheads[GCHD].wbuf.dtype = UBI_LONGTERM;
+ c->jheads[GCHD].wbuf.no_timer = 1;
++ c->jheads[GCHD].grouped = 0;
+
+ return 0;
+ }
+@@ -884,7 +906,7 @@ static int check_volume_empty(struct ubifs_info *c)
+
+ c->empty = 1;
+ for (lnum = 0; lnum < c->leb_cnt; lnum++) {
+- err = ubi_is_mapped(c->ubi, lnum);
++ err = ubifs_is_mapped(c, lnum);
+ if (unlikely(err < 0))
+ return err;
+ if (err == 1) {
+@@ -1117,8 +1139,8 @@ static int check_free_space(struct ubifs_info *c)
+ {
+ ubifs_assert(c->dark_wm > 0);
+ if (c->lst.total_free + c->lst.total_dirty < c->dark_wm) {
+- ubifs_err("insufficient free space to mount in read/write mode");
+- dbg_dump_budg(c);
++ ubifs_err("insufficient free space to mount in R/W mode");
++ dbg_dump_budg(c, &c->bi);
+ dbg_dump_lprops(c);
+ return -ENOSPC;
+ }
+@@ -1194,11 +1216,14 @@ static int mount_ubifs(struct ubifs_info *c)
+ if (c->bulk_read == 1)
+ bu_init(c);
+
+- /*
+- * We have to check all CRCs, even for data nodes, when we mount the FS
+- * (specifically, when we are replaying).
+- */
+- c->always_chk_crc = 1;
++ if (!c->ro_mount) {
++ c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ,
++ GFP_KERNEL);
++ if (!c->write_reserve_buf)
++ goto out_free;
++ }
++
++ c->mounting = 1;
+
+ err = ubifs_read_superblock(c);
+ if (err)
+@@ -1227,12 +1252,12 @@ static int mount_ubifs(struct ubifs_info *c)
+ goto out_free;
+ }
+
++ err = alloc_wbufs(c);
++ if (err)
++ goto out_cbuf;
++
+ sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
+ if (!c->ro_mount) {
+- err = alloc_wbufs(c);
+- if (err)
+- goto out_cbuf;
+-
+ /* Create background thread */
+ c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
+ if (IS_ERR(c->bgt)) {
+@@ -1254,12 +1279,25 @@ static int mount_ubifs(struct ubifs_info *c)
+ if ((c->mst_node->flags & cpu_to_le32(UBIFS_MST_DIRTY)) != 0) {
+ ubifs_msg("recovery needed");
+ c->need_recovery = 1;
+- if (!c->ro_mount) {
+- err = ubifs_recover_inl_heads(c, c->sbuf);
+- if (err)
+- goto out_master;
+- }
+- } else if (!c->ro_mount) {
++ }
++
++ if (c->need_recovery && !c->ro_mount) {
++ err = ubifs_recover_inl_heads(c, c->sbuf);
++ if (err)
++ goto out_master;
++ }
++
++ err = ubifs_lpt_init(c, 1, !c->ro_mount);
++ if (err)
++ goto out_master;
++
++ if (!c->ro_mount && c->space_fixup) {
++ err = ubifs_fixup_free_space(c);
++ if (err)
++ goto out_master;
++ }
++
++ if (!c->ro_mount) {
+ /*
+ * Set the "dirty" flag so that if we reboot uncleanly we
+ * will notice this immediately on the next mount.
+@@ -1267,14 +1305,10 @@ static int mount_ubifs(struct ubifs_info *c)
+ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_DIRTY);
+ err = ubifs_write_master(c);
+ if (err)
+- goto out_master;
++ goto out_lpt;
+ }
+
+- err = ubifs_lpt_init(c, 1, !c->ro_mount);
+- if (err)
+- goto out_lpt;
+-
+- err = dbg_check_idx_size(c, c->old_idx_sz);
++ err = dbg_check_idx_size(c, c->bi.old_idx_sz);
+ if (err)
+ goto out_lpt;
+
+@@ -1283,7 +1317,7 @@ static int mount_ubifs(struct ubifs_info *c)
+ goto out_journal;
+
+ /* Calculate 'min_idx_lebs' after journal replay */
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+
+ err = ubifs_mount_orphans(c, c->need_recovery, c->ro_mount);
+ if (err)
+@@ -1374,7 +1408,7 @@ static int mount_ubifs(struct ubifs_info *c)
+ if (err)
+ goto out_infos;
+
+- c->always_chk_crc = 0;
++ c->mounting = 0;
+
+ ubifs_msg("mounted UBI device %d, volume %d, name \"%s\"",
+ c->vi.ubi_num, c->vi.vol_id, c->vi.name);
+@@ -1395,6 +1429,7 @@ static int mount_ubifs(struct ubifs_info *c)
+
+ dbg_msg("compiled on: " __DATE__ " at " __TIME__);
+ dbg_msg("min. I/O unit size: %d bytes", c->min_io_size);
++ dbg_msg("max. write size: %d bytes", c->max_write_size);
+ dbg_msg("LEB size: %d bytes (%d KiB)",
+ c->leb_size, c->leb_size >> 10);
+ dbg_msg("data journal heads: %d",
+@@ -1411,7 +1446,8 @@ static int mount_ubifs(struct ubifs_info *c)
+ c->main_lebs, c->main_first, c->leb_cnt - 1);
+ dbg_msg("index LEBs: %d", c->lst.idx_lebs);
+ dbg_msg("total index bytes: %lld (%lld KiB, %lld MiB)",
+- c->old_idx_sz, c->old_idx_sz >> 10, c->old_idx_sz >> 20);
++ c->bi.old_idx_sz, c->bi.old_idx_sz >> 10,
++ c->bi.old_idx_sz >> 20);
+ dbg_msg("key hash type: %d", c->key_hash_type);
+ dbg_msg("tree fanout: %d", c->fanout);
+ dbg_msg("reserved GC LEB: %d", c->gc_lnum);
+@@ -1424,9 +1460,9 @@ static int mount_ubifs(struct ubifs_info *c)
+ UBIFS_TRUN_NODE_SZ, UBIFS_SB_NODE_SZ, UBIFS_MST_NODE_SZ);
+ dbg_msg("node sizes: ref %zu, cmt. start %zu, orph %zu",
+ UBIFS_REF_NODE_SZ, UBIFS_CS_NODE_SZ, UBIFS_ORPH_NODE_SZ);
+- dbg_msg("max. node sizes: data %zu, inode %zu dentry %zu",
+- UBIFS_MAX_DATA_NODE_SZ, UBIFS_MAX_INO_NODE_SZ,
+- UBIFS_MAX_DENT_NODE_SZ);
++ dbg_msg("max. node sizes: data %zu, inode %zu dentry %zu, idx %d",
++ UBIFS_MAX_DATA_NODE_SZ, UBIFS_MAX_INO_NODE_SZ,
++ UBIFS_MAX_DENT_NODE_SZ, ubifs_idx_node_sz(c, c->fanout));
+ dbg_msg("dead watermark: %d", c->dead_wm);
+ dbg_msg("dark watermark: %d", c->dark_wm);
+ dbg_msg("LEB overhead: %d", c->leb_overhead);
+@@ -1466,6 +1502,7 @@ out_wbufs:
+ out_cbuf:
+ kfree(c->cbuf);
+ out_free:
++ kfree(c->write_reserve_buf);
+ kfree(c->bu.buf);
+ vfree(c->ileb_buf);
+ vfree(c->sbuf);
+@@ -1504,6 +1541,7 @@ static void ubifs_umount(struct ubifs_info *c)
+ kfree(c->cbuf);
+ kfree(c->rcvrd_mst_node);
+ kfree(c->mst_node);
++ kfree(c->write_reserve_buf);
+ kfree(c->bu.buf);
+ vfree(c->ileb_buf);
+ vfree(c->sbuf);
+@@ -1535,7 +1573,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ mutex_lock(&c->umount_mutex);
+ dbg_save_space_info(c);
+ c->remounting_rw = 1;
+- c->always_chk_crc = 1;
++ c->ro_mount = 0;
+
+ err = check_free_space(c);
+ if (err)
+@@ -1551,6 +1589,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ }
+ sup->leb_cnt = cpu_to_le32(c->leb_cnt);
+ err = ubifs_write_sb_node(c, sup);
++ kfree(sup);
+ if (err)
+ goto out;
+ }
+@@ -1590,16 +1629,14 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ goto out;
+ }
+
+- err = ubifs_lpt_init(c, 0, 1);
+- if (err)
++ c->write_reserve_buf = kmalloc(COMPRESSED_DATA_NODE_BUF_SZ, GFP_KERNEL);
++ if (!c->write_reserve_buf)
+ goto out;
+
+- err = alloc_wbufs(c);
++ err = ubifs_lpt_init(c, 0, 1);
+ if (err)
+ goto out;
+
+- ubifs_create_buds_lists(c);
+-
+ /* Create background thread */
+ c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
+ if (IS_ERR(c->bgt)) {
+@@ -1634,20 +1671,37 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ if (err)
+ goto out;
+
++ dbg_gen("re-mounted read-write");
++ c->remounting_rw = 0;
++
+ if (c->need_recovery) {
+ c->need_recovery = 0;
+ ubifs_msg("deferred recovery completed");
++ } else {
++ /*
++ * Do not run the debugging space check if the were doing
++ * recovery, because when we saved the information we had the
++ * file-system in a state where the TNC and lprops has been
++ * modified in memory, but all the I/O operations (including a
++ * commit) were deferred. So the file-system was in
++ * "non-committed" state. Now the file-system is in committed
++ * state, and of course the amount of free space will change
++ * because, for example, the old index size was imprecise.
++ */
++ err = dbg_check_space_info(c);
++ }
++
++ if (c->space_fixup) {
++ err = ubifs_fixup_free_space(c);
++ if (err)
++ goto out;
+ }
+
+- dbg_gen("re-mounted read-write");
+- c->ro_mount = 0;
+- c->remounting_rw = 0;
+- c->always_chk_crc = 0;
+- err = dbg_check_space_info(c);
+ mutex_unlock(&c->umount_mutex);
+ return err;
+
+ out:
++ c->ro_mount = 1;
+ vfree(c->orph_buf);
+ c->orph_buf = NULL;
+ if (c->bgt) {
+@@ -1655,11 +1709,12 @@ out:
+ c->bgt = NULL;
+ }
+ free_wbufs(c);
++ kfree(c->write_reserve_buf);
++ c->write_reserve_buf = NULL;
+ vfree(c->ileb_buf);
+ c->ileb_buf = NULL;
+ ubifs_lpt_free(c, 1);
+ c->remounting_rw = 0;
+- c->always_chk_crc = 0;
+ mutex_unlock(&c->umount_mutex);
+ return err;
+ }
+@@ -1696,9 +1751,10 @@ static void ubifs_remount_ro(struct ubifs_info *c)
+ if (err)
+ ubifs_ro_mode(c, err);
+
+- free_wbufs(c);
+ vfree(c->orph_buf);
+ c->orph_buf = NULL;
++ kfree(c->write_reserve_buf);
++ c->write_reserve_buf = NULL;
+ vfree(c->ileb_buf);
+ c->ileb_buf = NULL;
+ ubifs_lpt_free(c, 1);
+@@ -1722,10 +1778,11 @@ static void ubifs_put_super(struct super_block *sb)
+ * of the media. For example, there will be dirty inodes if we failed
+ * to write them back because of I/O errors.
+ */
+- ubifs_assert(atomic_long_read(&c->dirty_pg_cnt) == 0);
+- ubifs_assert(c->budg_idx_growth == 0);
+- ubifs_assert(c->budg_dd_growth == 0);
+- ubifs_assert(c->budg_data_growth == 0);
++ if (!c->ro_error) {
++ ubifs_assert(c->bi.idx_growth == 0);
++ ubifs_assert(c->bi.dd_growth == 0);
++ ubifs_assert(c->bi.data_growth == 0);
++ }
+
+ /*
+ * The 'c->umount_lock' prevents races between UBIFS memory shrinker
+@@ -1929,6 +1986,7 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
+ mutex_init(&c->mst_mutex);
+ mutex_init(&c->umount_mutex);
+ mutex_init(&c->bu_mutex);
++ mutex_init(&c->write_reserve_mutex);
+ init_waitqueue_head(&c->cmt_wq);
+ c->buds = RB_ROOT;
+ c->old_idx = RB_ROOT;
+@@ -1946,6 +2004,7 @@ static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
+ INIT_LIST_HEAD(&c->old_buds);
+ INIT_LIST_HEAD(&c->orph_list);
+ INIT_LIST_HEAD(&c->orph_new);
++ c->no_chk_data_crc = 1;
+
+ c->vfs_sb = sb;
+ c->highest_inum = UBIFS_FIRST_INO;
+diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
+index ad9cf01..16ad84d 100644
+--- a/fs/ubifs/tnc.c
++++ b/fs/ubifs/tnc.c
+@@ -223,7 +223,7 @@ static struct ubifs_znode *copy_znode(struct ubifs_info *c,
+ __set_bit(DIRTY_ZNODE, &zn->flags);
+ __clear_bit(COW_ZNODE, &zn->flags);
+
+- ubifs_assert(!test_bit(OBSOLETE_ZNODE, &znode->flags));
++ ubifs_assert(!ubifs_zn_obsolete(znode));
+ __set_bit(OBSOLETE_ZNODE, &znode->flags);
+
+ if (znode->level != 0) {
+@@ -271,7 +271,7 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
+ struct ubifs_znode *zn;
+ int err;
+
+- if (!test_bit(COW_ZNODE, &znode->flags)) {
++ if (!ubifs_zn_cow(znode)) {
+ /* znode is not being committed */
+ if (!test_and_set_bit(DIRTY_ZNODE, &znode->flags)) {
+ atomic_long_inc(&c->dirty_zn_cnt);
+@@ -344,12 +344,11 @@ static int lnc_add(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ return err;
+ }
+
+- lnc_node = kmalloc(zbr->len, GFP_NOFS);
++ lnc_node = kmemdup(node, zbr->len, GFP_NOFS);
+ if (!lnc_node)
+ /* We don't have to have the cache, so no error */
+ return 0;
+
+- memcpy(lnc_node, node, zbr->len);
+ zbr->leaf = lnc_node;
+ return 0;
+ }
+@@ -447,8 +446,11 @@ static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ *
+ * Note, this function does not check CRC of data nodes if @c->no_chk_data_crc
+ * is true (it is controlled by corresponding mount option). However, if
+- * @c->always_chk_crc is true, @c->no_chk_data_crc is ignored and CRC is always
+- * checked.
++ * @c->mounting or @c->remounting_rw is true (we are mounting or re-mounting to
++ * R/W mode), @c->no_chk_data_crc is ignored and CRC is checked. This is
++ * because during mounting or re-mounting from R/O mode to R/W mode we may read
++ * journal nodes (when replying the journal or doing the recovery) and the
++ * journal nodes may potentially be corrupted, so checking is required.
+ */
+ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+ int len, int lnum, int offs)
+@@ -459,7 +461,7 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+
+ dbg_io("LEB %d:%d, %s, length %d", lnum, offs, dbg_ntype(type), len);
+
+- err = ubi_read(c->ubi, lnum, buf, offs, len);
++ err = ubifs_leb_read(c, lnum, buf, offs, len, 1);
+ if (err) {
+ ubifs_err("cannot read node type %d from LEB %d:%d, error %d",
+ type, lnum, offs, err);
+@@ -476,7 +478,8 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
+ if (node_len != len)
+ return 0;
+
+- if (type == UBIFS_DATA_NODE && !c->always_chk_crc && c->no_chk_data_crc)
++ if (type == UBIFS_DATA_NODE && c->no_chk_data_crc && !c->mounting &&
++ !c->remounting_rw)
+ return 1;
+
+ crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
+@@ -502,7 +505,7 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
+ {
+ int ret;
+
+- dbg_tnc("LEB %d:%d, key %s", zbr->lnum, zbr->offs, DBGKEY(key));
++ dbg_tnck(key, "LEB %d:%d, key ", zbr->lnum, zbr->offs);
+
+ ret = try_read_node(c, node, key_type(c, key), zbr->len, zbr->lnum,
+ zbr->offs);
+@@ -516,8 +519,8 @@ static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
+ ret = 0;
+ }
+ if (ret == 0 && c->replaying)
+- dbg_mnt("dangling branch LEB %d:%d len %d, key %s",
+- zbr->lnum, zbr->offs, zbr->len, DBGKEY(key));
++ dbg_mntk(key, "dangling branch LEB %d:%d len %d, key ",
++ zbr->lnum, zbr->offs, zbr->len);
+ return ret;
+ }
+
+@@ -992,9 +995,9 @@ static int fallible_resolve_collision(struct ubifs_info *c,
+ if (adding || !o_znode)
+ return 0;
+
+- dbg_mnt("dangling match LEB %d:%d len %d %s",
++ dbg_mntk(key, "dangling match LEB %d:%d len %d key ",
+ o_znode->zbranch[o_n].lnum, o_znode->zbranch[o_n].offs,
+- o_znode->zbranch[o_n].len, DBGKEY(key));
++ o_znode->zbranch[o_n].len);
+ *zn = o_znode;
+ *n = o_n;
+ return 1;
+@@ -1176,7 +1179,7 @@ int ubifs_lookup_level0(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+ unsigned long time = get_seconds();
+
+- dbg_tnc("search key %s", DBGKEY(key));
++ dbg_tnck(key, "search key ");
+ ubifs_assert(key_type(c, key) < UBIFS_INVALID_KEY);
+
+ znode = c->zroot.znode;
+@@ -1312,7 +1315,7 @@ static int lookup_level0_dirty(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+ unsigned long time = get_seconds();
+
+- dbg_tnc("search and dirty key %s", DBGKEY(key));
++ dbg_tnck(key, "search and dirty key ");
+
+ znode = c->zroot.znode;
+ if (unlikely(!znode)) {
+@@ -1662,7 +1665,7 @@ static int read_wbuf(struct ubifs_wbuf *wbuf, void *buf, int len, int lnum,
+ if (!overlap) {
+ /* We may safely unlock the write-buffer and read the data */
+ spin_unlock(&wbuf->lock);
+- return ubi_read(c->ubi, lnum, buf, offs, len);
++ return ubifs_leb_read(c, lnum, buf, offs, len, 0);
+ }
+
+ /* Don't read under wbuf */
+@@ -1676,7 +1679,7 @@ static int read_wbuf(struct ubifs_wbuf *wbuf, void *buf, int len, int lnum,
+
+ if (rlen > 0)
+ /* Read everything that goes before write-buffer */
+- return ubi_read(c->ubi, lnum, buf, offs, rlen);
++ return ubifs_leb_read(c, lnum, buf, offs, rlen, 0);
+
+ return 0;
+ }
+@@ -1719,8 +1722,8 @@ static int validate_data_node(struct ubifs_info *c, void *buf,
+ if (!keys_eq(c, &zbr->key, &key1)) {
+ ubifs_err("bad key in node at LEB %d:%d",
+ zbr->lnum, zbr->offs);
+- dbg_tnc("looked for key %s found node's key %s",
+- DBGKEY(&zbr->key), DBGKEY1(&key1));
++ dbg_tnck(&zbr->key, "looked for key ");
++ dbg_tnck(&key1, "found node's key ");
+ goto out_err;
+ }
+
+@@ -1763,7 +1766,7 @@ int ubifs_tnc_bulk_read(struct ubifs_info *c, struct bu_info *bu)
+ if (wbuf)
+ err = read_wbuf(wbuf, bu->buf, len, lnum, offs);
+ else
+- err = ubi_read(c->ubi, lnum, bu->buf, offs, len);
++ err = ubifs_leb_read(c, lnum, bu->buf, offs, len, 0);
+
+ /* Check for a race with GC */
+ if (maybe_leb_gced(c, lnum, bu->gc_seq))
+@@ -1773,7 +1776,7 @@ int ubifs_tnc_bulk_read(struct ubifs_info *c, struct bu_info *bu)
+ ubifs_err("failed to read from LEB %d:%d, error %d",
+ lnum, offs, err);
+ dbg_dump_stack();
+- dbg_tnc("key %s", DBGKEY(&bu->key));
++ dbg_tnck(&bu->key, "key ");
+ return err;
+ }
+
+@@ -1808,7 +1811,7 @@ static int do_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
+ int found, n, err;
+ struct ubifs_znode *znode;
+
+- dbg_tnc("name '%.*s' key %s", nm->len, nm->name, DBGKEY(key));
++ dbg_tnck(key, "name '%.*s' key ", nm->len, nm->name);
+ mutex_lock(&c->tnc_mutex);
+ found = ubifs_lookup_level0(c, key, &znode, &n);
+ if (!found) {
+@@ -1982,8 +1985,7 @@ again:
+ zp = znode->parent;
+ if (znode->child_cnt < c->fanout) {
+ ubifs_assert(n != c->fanout);
+- dbg_tnc("inserted at %d level %d, key %s", n, znode->level,
+- DBGKEY(key));
++ dbg_tnck(key, "inserted at %d level %d, key ", n, znode->level);
+
+ insert_zbranch(znode, zbr, n);
+
+@@ -1998,7 +2000,7 @@ again:
+ * Unfortunately, @znode does not have more empty slots and we have to
+ * split it.
+ */
+- dbg_tnc("splitting level %d, key %s", znode->level, DBGKEY(key));
++ dbg_tnck(key, "splitting level %d, key ", znode->level);
+
+ if (znode->alt)
+ /*
+@@ -2092,7 +2094,7 @@ do_split:
+ }
+
+ /* Insert new key and branch */
+- dbg_tnc("inserting at %d level %d, key %s", n, zn->level, DBGKEY(key));
++ dbg_tnck(key, "inserting at %d level %d, key ", n, zn->level);
+
+ insert_zbranch(zi, zbr, n);
+
+@@ -2168,7 +2170,7 @@ int ubifs_tnc_add(struct ubifs_info *c, const union ubifs_key *key, int lnum,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("%d:%d, len %d, key %s", lnum, offs, len, DBGKEY(key));
++ dbg_tnck(key, "%d:%d, len %d, key ", lnum, offs, len);
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (!found) {
+ struct ubifs_zbranch zbr;
+@@ -2217,8 +2219,8 @@ int ubifs_tnc_replace(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("old LEB %d:%d, new LEB %d:%d, len %d, key %s", old_lnum,
+- old_offs, lnum, offs, len, DBGKEY(key));
++ dbg_tnck(key, "old LEB %d:%d, new LEB %d:%d, len %d, key ", old_lnum,
++ old_offs, lnum, offs, len);
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (found < 0) {
+ err = found;
+@@ -2300,8 +2302,8 @@ int ubifs_tnc_add_nm(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("LEB %d:%d, name '%.*s', key %s", lnum, offs, nm->len, nm->name,
+- DBGKEY(key));
++ dbg_tnck(key, "LEB %d:%d, name '%.*s', key ",
++ lnum, offs, nm->len, nm->name);
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (found < 0) {
+ err = found;
+@@ -2394,7 +2396,7 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
+ /* Delete without merge for now */
+ ubifs_assert(znode->level == 0);
+ ubifs_assert(n >= 0 && n < c->fanout);
+- dbg_tnc("deleting %s", DBGKEY(&znode->zbranch[n].key));
++ dbg_tnck(&znode->zbranch[n].key, "deleting key ");
+
+ zbr = &znode->zbranch[n];
+ lnc_free(zbr);
+@@ -2419,7 +2421,7 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
+ */
+
+ do {
+- ubifs_assert(!test_bit(OBSOLETE_ZNODE, &znode->flags));
++ ubifs_assert(!ubifs_zn_obsolete(znode));
+ ubifs_assert(ubifs_zn_dirty(znode));
+
+ zp = znode->parent;
+@@ -2475,9 +2477,8 @@ static int tnc_delete(struct ubifs_info *c, struct ubifs_znode *znode, int n)
+ c->zroot.offs = zbr->offs;
+ c->zroot.len = zbr->len;
+ c->zroot.znode = znode;
+- ubifs_assert(!test_bit(OBSOLETE_ZNODE,
+- &zp->flags));
+- ubifs_assert(test_bit(DIRTY_ZNODE, &zp->flags));
++ ubifs_assert(!ubifs_zn_obsolete(zp));
++ ubifs_assert(ubifs_zn_dirty(zp));
+ atomic_long_dec(&c->dirty_zn_cnt);
+
+ if (zp->cnext) {
+@@ -2505,7 +2506,7 @@ int ubifs_tnc_remove(struct ubifs_info *c, const union ubifs_key *key)
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("key %s", DBGKEY(key));
++ dbg_tnck(key, "key ");
+ found = lookup_level0_dirty(c, key, &znode, &n);
+ if (found < 0) {
+ err = found;
+@@ -2536,7 +2537,7 @@ int ubifs_tnc_remove_nm(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_znode *znode;
+
+ mutex_lock(&c->tnc_mutex);
+- dbg_tnc("%.*s, key %s", nm->len, nm->name, DBGKEY(key));
++ dbg_tnck(key, "%.*s, key ", nm->len, nm->name);
+ err = lookup_level0_dirty(c, key, &znode, &n);
+ if (err < 0)
+ goto out_unlock;
+@@ -2553,11 +2554,11 @@ int ubifs_tnc_remove_nm(struct ubifs_info *c, const union ubifs_key *key,
+ if (err) {
+ /* Ensure the znode is dirtied */
+ if (znode->cnext || !ubifs_zn_dirty(znode)) {
+- znode = dirty_cow_bottom_up(c, znode);
+- if (IS_ERR(znode)) {
+- err = PTR_ERR(znode);
+- goto out_unlock;
+- }
++ znode = dirty_cow_bottom_up(c, znode);
++ if (IS_ERR(znode)) {
++ err = PTR_ERR(znode);
++ goto out_unlock;
++ }
+ }
+ err = tnc_delete(c, znode, n);
+ }
+@@ -2651,7 +2652,7 @@ int ubifs_tnc_remove_range(struct ubifs_info *c, union ubifs_key *from_key,
+ dbg_dump_znode(c, znode);
+ goto out_unlock;
+ }
+- dbg_tnc("removing %s", DBGKEY(key));
++ dbg_tnck(key, "removing key ");
+ }
+ if (k) {
+ for (i = n + 1 + k; i < znode->child_cnt; i++)
+@@ -2771,7 +2772,7 @@ struct ubifs_dent_node *ubifs_tnc_next_ent(struct ubifs_info *c,
+ struct ubifs_zbranch *zbr;
+ union ubifs_key *dkey;
+
+- dbg_tnc("%s %s", nm->name ? (char *)nm->name : "(lowest)", DBGKEY(key));
++ dbg_tnck(key, "%s ", nm->name ? (char *)nm->name : "(lowest)");
+ ubifs_assert(is_hash_key(c, key));
+
+ mutex_lock(&c->tnc_mutex);
+@@ -2861,7 +2862,7 @@ static void tnc_destroy_cnext(struct ubifs_info *c)
+ struct ubifs_znode *znode = cnext;
+
+ cnext = cnext->cnext;
+- if (test_bit(OBSOLETE_ZNODE, &znode->flags))
++ if (ubifs_zn_obsolete(znode))
+ kfree(znode);
+ } while (cnext && cnext != c->cnext);
+ }
+@@ -2872,12 +2873,13 @@ static void tnc_destroy_cnext(struct ubifs_info *c)
+ */
+ void ubifs_tnc_close(struct ubifs_info *c)
+ {
+- long clean_freed;
+-
+ tnc_destroy_cnext(c);
+ if (c->zroot.znode) {
+- clean_freed = ubifs_destroy_tnc_subtree(c->zroot.znode);
+- atomic_long_sub(clean_freed, &ubifs_clean_zn_cnt);
++ long n;
++
++ ubifs_destroy_tnc_subtree(c->zroot.znode);
++ n = atomic_long_read(&c->clean_zn_cnt);
++ atomic_long_sub(n, &ubifs_clean_zn_cnt);
+ }
+ kfree(c->gap_lebs);
+ kfree(c->ilebs);
+@@ -3296,7 +3298,7 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+- if (!(ubifs_chk_flags & UBIFS_CHK_GEN))
++ if (!dbg_is_chk_gen(c))
+ return 0;
+
+ block = (size + UBIFS_BLOCK_SIZE - 1) >> UBIFS_BLOCK_SHIFT;
+@@ -3329,12 +3331,13 @@ int dbg_check_inode_size(struct ubifs_info *c, const struct inode *inode,
+
+ out_dump:
+ block = key_block(c, key);
+- ubifs_err("inode %lu has size %lld, but there are data at offset %lld "
+- "(data key %s)", (unsigned long)inode->i_ino, size,
+- ((loff_t)block) << UBIFS_BLOCK_SHIFT, DBGKEY(key));
++ ubifs_err("inode %lu has size %lld, but there are data at offset %lld",
++ (unsigned long)inode->i_ino, size,
++ ((loff_t)block) << UBIFS_BLOCK_SHIFT);
++ mutex_unlock(&c->tnc_mutex);
+ dbg_dump_inode(c, inode);
+ dbg_dump_stack();
+- err = -EINVAL;
++ return -EINVAL;
+
+ out_unlock:
+ mutex_unlock(&c->tnc_mutex);
+diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
+index 53288e5..4c15f07 100644
+--- a/fs/ubifs/tnc_commit.c
++++ b/fs/ubifs/tnc_commit.c
+@@ -22,6 +22,7 @@
+
+ /* This file implements TNC functions for committing */
+
++#include <linux/random.h>
+ #include "ubifs.h"
+
+ /**
+@@ -87,8 +88,12 @@ static int make_idx_node(struct ubifs_info *c, struct ubifs_idx_node *idx,
+ atomic_long_dec(&c->dirty_zn_cnt);
+
+ ubifs_assert(ubifs_zn_dirty(znode));
+- ubifs_assert(test_bit(COW_ZNODE, &znode->flags));
++ ubifs_assert(ubifs_zn_cow(znode));
+
++ /*
++ * Note, unlike 'write_index()' we do not add memory barriers here
++ * because this function is called with @c->tnc_mutex locked.
++ */
+ __clear_bit(DIRTY_ZNODE, &znode->flags);
+ __clear_bit(COW_ZNODE, &znode->flags);
+
+@@ -377,15 +382,13 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ c->gap_lebs = NULL;
+ return err;
+ }
+- if (!dbg_force_in_the_gaps_enabled) {
++ if (!dbg_is_chk_index(c)) {
+ /*
+ * Do not print scary warnings if the debugging
+ * option which forces in-the-gaps is enabled.
+ */
+- ubifs_err("out of space");
+- spin_lock(&c->space_lock);
+- dbg_dump_budg(c);
+- spin_unlock(&c->space_lock);
++ ubifs_warn("out of space");
++ dbg_dump_budg(c, &c->bi);
+ dbg_dump_lprops(c);
+ }
+ /* Try to commit anyway */
+@@ -493,25 +496,6 @@ static int layout_in_empty_space(struct ubifs_info *c)
+ else
+ next_len = ubifs_idx_node_sz(c, cnext->child_cnt);
+
+- if (c->min_io_size == 1) {
+- buf_offs += ALIGN(len, 8);
+- if (next_len) {
+- if (buf_offs + next_len <= c->leb_size)
+- continue;
+- err = ubifs_update_one_lp(c, lnum, 0,
+- c->leb_size - buf_offs, 0, 0);
+- if (err)
+- return err;
+- lnum = -1;
+- continue;
+- }
+- err = ubifs_update_one_lp(c, lnum,
+- c->leb_size - buf_offs, 0, 0, 0);
+- if (err)
+- return err;
+- break;
+- }
+-
+ /* Update buffer positions */
+ wlen = used + len;
+ used += ALIGN(len, 8);
+@@ -660,7 +644,7 @@ static int get_znodes_to_commit(struct ubifs_info *c)
+ }
+ cnt += 1;
+ while (1) {
+- ubifs_assert(!test_bit(COW_ZNODE, &znode->flags));
++ ubifs_assert(!ubifs_zn_cow(znode));
+ __set_bit(COW_ZNODE, &znode->flags);
+ znode->alt = 0;
+ cnext = find_next_dirty(znode);
+@@ -706,7 +690,7 @@ static int alloc_idx_lebs(struct ubifs_info *c, int cnt)
+ c->ilebs[c->ileb_cnt++] = lnum;
+ dbg_cmt("LEB %d", lnum);
+ }
+- if (dbg_force_in_the_gaps())
++ if (dbg_is_chk_index(c) && !(random32() & 7))
+ return -ENOSPC;
+ return 0;
+ }
+@@ -796,16 +780,16 @@ int ubifs_tnc_start_commit(struct ubifs_info *c, struct ubifs_zbranch *zroot)
+ spin_lock(&c->space_lock);
+ /*
+ * Although we have not finished committing yet, update size of the
+- * committed index ('c->old_idx_sz') and zero out the index growth
++ * committed index ('c->bi.old_idx_sz') and zero out the index growth
+ * budget. It is OK to do this now, because we've reserved all the
+ * space which is needed to commit the index, and it is save for the
+ * budgeting subsystem to assume the index is already committed,
+ * even though it is not.
+ */
+- ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
+- c->old_idx_sz = c->calc_idx_sz;
+- c->budg_uncommitted_idx = 0;
+- c->min_idx_lebs = ubifs_calc_min_idx_lebs(c);
++ ubifs_assert(c->bi.min_idx_lebs == ubifs_calc_min_idx_lebs(c));
++ c->bi.old_idx_sz = c->calc_idx_sz;
++ c->bi.uncommitted_idx = 0;
++ c->bi.min_idx_lebs = ubifs_calc_min_idx_lebs(c);
+ spin_unlock(&c->space_lock);
+ mutex_unlock(&c->tnc_mutex);
+
+@@ -832,7 +816,7 @@ static int write_index(struct ubifs_info *c)
+ struct ubifs_idx_node *idx;
+ struct ubifs_znode *znode, *cnext;
+ int i, lnum, offs, len, next_len, buf_len, buf_offs, used;
+- int avail, wlen, err, lnum_pos = 0;
++ int avail, wlen, err, lnum_pos = 0, blen, nxt_offs;
+
+ cnext = c->enext;
+ if (!cnext)
+@@ -909,7 +893,7 @@ static int write_index(struct ubifs_info *c)
+ cnext = znode->cnext;
+
+ ubifs_assert(ubifs_zn_dirty(znode));
+- ubifs_assert(test_bit(COW_ZNODE, &znode->flags));
++ ubifs_assert(ubifs_zn_cow(znode));
+
+ /*
+ * It is important that other threads should see %DIRTY_ZNODE
+@@ -924,6 +908,28 @@ static int write_index(struct ubifs_info *c)
+ clear_bit(COW_ZNODE, &znode->flags);
+ smp_mb__after_clear_bit();
+
++ /*
++ * We have marked the znode as clean but have not updated the
++ * @c->clean_zn_cnt counter. If this znode becomes dirty again
++ * before 'free_obsolete_znodes()' is called, then
++ * @c->clean_zn_cnt will be decremented before it gets
++ * incremented (resulting in 2 decrements for the same znode).
++ * This means that @c->clean_zn_cnt may become negative for a
++ * while.
++ *
++ * Q: why we cannot increment @c->clean_zn_cnt?
++ * A: because we do not have the @c->tnc_mutex locked, and the
++ * following code would be racy and buggy:
++ *
++ * if (!ubifs_zn_obsolete(znode)) {
++ * atomic_long_inc(&c->clean_zn_cnt);
++ * atomic_long_inc(&ubifs_clean_zn_cnt);
++ * }
++ *
++ * Thus, we just delay the @c->clean_zn_cnt update until we
++ * have the mutex locked.
++ */
++
+ /* Do not access znode from this point on */
+
+ /* Update buffer positions */
+@@ -940,65 +946,38 @@ static int write_index(struct ubifs_info *c)
+ else
+ next_len = ubifs_idx_node_sz(c, cnext->child_cnt);
+
+- if (c->min_io_size == 1) {
+- /*
+- * Write the prepared index node immediately if there is
+- * no minimum IO size
+- */
+- err = ubifs_leb_write(c, lnum, c->cbuf, buf_offs,
+- wlen, UBI_SHORTTERM);
+- if (err)
+- return err;
+- buf_offs += ALIGN(wlen, 8);
+- if (next_len) {
+- used = 0;
+- avail = buf_len;
+- if (buf_offs + next_len > c->leb_size) {
+- err = ubifs_update_one_lp(c, lnum,
+- LPROPS_NC, 0, 0, LPROPS_TAKEN);
+- if (err)
+- return err;
+- lnum = -1;
+- }
++ nxt_offs = buf_offs + used + next_len;
++ if (next_len && nxt_offs <= c->leb_size) {
++ if (avail > 0)
+ continue;
+- }
++ else
++ blen = buf_len;
+ } else {
+- int blen, nxt_offs = buf_offs + used + next_len;
+-
+- if (next_len && nxt_offs <= c->leb_size) {
+- if (avail > 0)
+- continue;
+- else
+- blen = buf_len;
+- } else {
+- wlen = ALIGN(wlen, 8);
+- blen = ALIGN(wlen, c->min_io_size);
+- ubifs_pad(c, c->cbuf + wlen, blen - wlen);
+- }
+- /*
+- * The buffer is full or there are no more znodes
+- * to do
+- */
+- err = ubifs_leb_write(c, lnum, c->cbuf, buf_offs,
+- blen, UBI_SHORTTERM);
+- if (err)
+- return err;
+- buf_offs += blen;
+- if (next_len) {
+- if (nxt_offs > c->leb_size) {
+- err = ubifs_update_one_lp(c, lnum,
+- LPROPS_NC, 0, 0, LPROPS_TAKEN);
+- if (err)
+- return err;
+- lnum = -1;
+- }
+- used -= blen;
+- if (used < 0)
+- used = 0;
+- avail = buf_len - used;
+- memmove(c->cbuf, c->cbuf + blen, used);
+- continue;
++ wlen = ALIGN(wlen, 8);
++ blen = ALIGN(wlen, c->min_io_size);
++ ubifs_pad(c, c->cbuf + wlen, blen - wlen);
++ }
++
++ /* The buffer is full or there are no more znodes to do */
++ err = ubifs_leb_write(c, lnum, c->cbuf, buf_offs, blen,
++ UBI_SHORTTERM);
++ if (err)
++ return err;
++ buf_offs += blen;
++ if (next_len) {
++ if (nxt_offs > c->leb_size) {
++ err = ubifs_update_one_lp(c, lnum, LPROPS_NC, 0,
++ 0, LPROPS_TAKEN);
++ if (err)
++ return err;
++ lnum = -1;
+ }
++ used -= blen;
++ if (used < 0)
++ used = 0;
++ avail = buf_len - used;
++ memmove(c->cbuf, c->cbuf + blen, used);
++ continue;
+ }
+ break;
+ }
+@@ -1031,7 +1010,7 @@ static void free_obsolete_znodes(struct ubifs_info *c)
+ do {
+ znode = cnext;
+ cnext = znode->cnext;
+- if (test_bit(OBSOLETE_ZNODE, &znode->flags))
++ if (ubifs_zn_obsolete(znode))
+ kfree(znode);
+ else {
+ znode->cnext = NULL;
+diff --git a/fs/ubifs/tnc_misc.c b/fs/ubifs/tnc_misc.c
+index b48db99..dc28fe6 100644
+--- a/fs/ubifs/tnc_misc.c
++++ b/fs/ubifs/tnc_misc.c
+@@ -328,8 +328,8 @@ static int read_znode(struct ubifs_info *c, int lnum, int offs, int len,
+ case UBIFS_XENT_KEY:
+ break;
+ default:
+- dbg_msg("bad key type at slot %d: %s", i,
+- DBGKEY(&zbr->key));
++ dbg_msg("bad key type at slot %d: %d",
++ i, key_type(c, &zbr->key));
+ err = 3;
+ goto out_dump;
+ }
+@@ -475,7 +475,7 @@ int ubifs_tnc_read_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ zbr->offs);
+
+ if (err) {
+- dbg_tnc("key %s", DBGKEY(key));
++ dbg_tnck(key, "key ");
+ return err;
+ }
+
+@@ -484,8 +484,8 @@ int ubifs_tnc_read_node(struct ubifs_info *c, struct ubifs_zbranch *zbr,
+ if (!keys_eq(c, key, &key1)) {
+ ubifs_err("bad key in node at LEB %d:%d",
+ zbr->lnum, zbr->offs);
+- dbg_tnc("looked for key %s found node's key %s",
+- DBGKEY(key), DBGKEY1(&key1));
++ dbg_tnck(key, "looked for key ");
++ dbg_tnck(&key1, "but found node's key ");
+ dbg_dump_node(c, node);
+ return -EINVAL;
+ }
+diff --git a/fs/ubifs/ubifs-media.h b/fs/ubifs/ubifs-media.h
+index 191ca78..e24380c 100644
+--- a/fs/ubifs/ubifs-media.h
++++ b/fs/ubifs/ubifs-media.h
+@@ -408,9 +408,11 @@ enum {
+ * Superblock flags.
+ *
+ * UBIFS_FLG_BIGLPT: if "big" LPT model is used if set
++ * UBIFS_FLG_SPACE_FIXUP: first-mount "fixup" of free space within LEBs needed
+ */
+ enum {
+ UBIFS_FLG_BIGLPT = 0x02,
++ UBIFS_FLG_SPACE_FIXUP = 0x04,
+ };
+
+ /**
+@@ -434,7 +436,7 @@ struct ubifs_ch {
+ __u8 node_type;
+ __u8 group_type;
+ __u8 padding[2];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * union ubifs_dev_desc - device node descriptor.
+@@ -448,7 +450,7 @@ struct ubifs_ch {
+ union ubifs_dev_desc {
+ __le32 new;
+ __le64 huge;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_ino_node - inode node.
+@@ -509,7 +511,7 @@ struct ubifs_ino_node {
+ __le16 compr_type;
+ __u8 padding2[26]; /* Watch 'zero_ino_node_unused()' if changing! */
+ __u8 data[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_dent_node - directory entry node.
+@@ -534,7 +536,7 @@ struct ubifs_dent_node {
+ __le16 nlen;
+ __u8 padding2[4]; /* Watch 'zero_dent_node_unused()' if changing! */
+ __u8 name[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_data_node - data node.
+@@ -555,7 +557,7 @@ struct ubifs_data_node {
+ __le16 compr_type;
+ __u8 padding[2]; /* Watch 'zero_data_node_unused()' if changing! */
+ __u8 data[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_trun_node - truncation node.
+@@ -575,7 +577,7 @@ struct ubifs_trun_node {
+ __u8 padding[12]; /* Watch 'zero_trun_node_unused()' if changing! */
+ __le64 old_size;
+ __le64 new_size;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_pad_node - padding node.
+@@ -586,7 +588,7 @@ struct ubifs_trun_node {
+ struct ubifs_pad_node {
+ struct ubifs_ch ch;
+ __le32 pad_len;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_sb_node - superblock node.
+@@ -644,7 +646,7 @@ struct ubifs_sb_node {
+ __u8 uuid[16];
+ __le32 ro_compat_version;
+ __u8 padding2[3968];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_mst_node - master node.
+@@ -711,7 +713,7 @@ struct ubifs_mst_node {
+ __le32 idx_lebs;
+ __le32 leb_cnt;
+ __u8 padding[344];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_ref_node - logical eraseblock reference node.
+@@ -727,7 +729,7 @@ struct ubifs_ref_node {
+ __le32 offs;
+ __le32 jhead;
+ __u8 padding[28];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_branch - key/reference/length branch
+@@ -741,7 +743,7 @@ struct ubifs_branch {
+ __le32 offs;
+ __le32 len;
+ __u8 key[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_idx_node - indexing node.
+@@ -755,7 +757,7 @@ struct ubifs_idx_node {
+ __le16 child_cnt;
+ __le16 level;
+ __u8 branches[];
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_cs_node - commit start node.
+@@ -765,7 +767,7 @@ struct ubifs_idx_node {
+ struct ubifs_cs_node {
+ struct ubifs_ch ch;
+ __le64 cmt_no;
+-} __attribute__ ((packed));
++} __packed;
+
+ /**
+ * struct ubifs_orph_node - orphan node.
+@@ -777,6 +779,6 @@ struct ubifs_orph_node {
+ struct ubifs_ch ch;
+ __le64 cmt_no;
+ __le64 inos[];
+-} __attribute__ ((packed));
++} __packed;
+
+ #endif /* __UBIFS_MEDIA_H__ */
+diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
+index 381d6b2..caf9e4b 100644
+--- a/fs/ubifs/ubifs.h
++++ b/fs/ubifs/ubifs.h
+@@ -84,9 +84,6 @@
+ #define INUM_WARN_WATERMARK 0xFFF00000
+ #define INUM_WATERMARK 0xFFFFFF00
+
+-/* Largest key size supported in this implementation */
+-#define CUR_MAX_KEY_LEN UBIFS_SK_LEN
+-
+ /* Maximum number of entries in each LPT (LEB category) heap */
+ #define LPT_HEAP_SZ 256
+
+@@ -151,6 +148,12 @@
+ */
+ #define WORST_COMPR_FACTOR 2
+
++/*
++ * How much memory is needed for a buffer where we comress a data node.
++ */
++#define COMPRESSED_DATA_NODE_BUF_SZ \
++ (UBIFS_DATA_NODE_SZ + UBIFS_BLOCK_SIZE * WORST_COMPR_FACTOR)
++
+ /* Maximum expected tree height for use by bottom_up_buf */
+ #define BOTTOM_UP_HEIGHT 64
+
+@@ -224,14 +227,14 @@ enum {
+ * LPT cnode flag bits.
+ *
+ * DIRTY_CNODE: cnode is dirty
+- * COW_CNODE: cnode is being committed and must be copied before writing
+ * OBSOLETE_CNODE: cnode is being committed and has been copied (or deleted),
+- * so it can (and must) be freed when the commit is finished
++ * so it can (and must) be freed when the commit is finished
++ * COW_CNODE: cnode is being committed and must be copied before writing
+ */
+ enum {
+ DIRTY_CNODE = 0,
+- COW_CNODE = 1,
+- OBSOLETE_CNODE = 2,
++ OBSOLETE_CNODE = 1,
++ COW_CNODE = 2,
+ };
+
+ /*
+@@ -271,10 +274,10 @@ struct ubifs_old_idx {
+
+ /* The below union makes it easier to deal with keys */
+ union ubifs_key {
+- uint8_t u8[CUR_MAX_KEY_LEN];
+- uint32_t u32[CUR_MAX_KEY_LEN/4];
+- uint64_t u64[CUR_MAX_KEY_LEN/8];
+- __le32 j32[CUR_MAX_KEY_LEN/4];
++ uint8_t u8[UBIFS_SK_LEN];
++ uint32_t u32[UBIFS_SK_LEN/4];
++ uint64_t u64[UBIFS_SK_LEN/8];
++ __le32 j32[UBIFS_SK_LEN/4];
+ };
+
+ /**
+@@ -383,9 +386,9 @@ struct ubifs_gced_idx_leb {
+ * The @ui_size is a "shadow" variable for @inode->i_size and UBIFS uses
+ * @ui_size instead of @inode->i_size. The reason for this is that UBIFS cannot
+ * make sure @inode->i_size is always changed under @ui_mutex, because it
+- * cannot call 'truncate_setsize()' with @ui_mutex locked, because it would deadlock
+- * with 'ubifs_writepage()' (see file.c). All the other inode fields are
+- * changed under @ui_mutex, so they do not need "shadow" fields. Note, one
++ * cannot call 'truncate_setsize()' with @ui_mutex locked, because it would
++ * deadlock with 'ubifs_writepage()' (see file.c). All the other inode fields
++ * are changed under @ui_mutex, so they do not need "shadow" fields. Note, one
+ * could consider to rework locking and base it on "shadow" fields.
+ */
+ struct ubifs_inode {
+@@ -646,6 +649,7 @@ typedef int (*ubifs_lpt_scan_callback)(struct ubifs_info *c,
+ * @offs: write-buffer offset in this logical eraseblock
+ * @avail: number of bytes available in the write-buffer
+ * @used: number of used bytes in the write-buffer
++ * @size: write-buffer size (in [@c->min_io_size, @c->max_write_size] range)
+ * @dtype: type of data stored in this LEB (%UBI_LONGTERM, %UBI_SHORTTERM,
+ * %UBI_UNKNOWN)
+ * @jhead: journal head the mutex belongs to (note, needed only to shut lockdep
+@@ -680,6 +684,7 @@ struct ubifs_wbuf {
+ int offs;
+ int avail;
+ int used;
++ int size;
+ int dtype;
+ int jhead;
+ int (*sync_callback)(struct ubifs_info *c, int lnum, int free, int pad);
+@@ -714,12 +719,14 @@ struct ubifs_bud {
+ * struct ubifs_jhead - journal head.
+ * @wbuf: head's write-buffer
+ * @buds_list: list of bud LEBs belonging to this journal head
++ * @grouped: non-zero if UBIFS groups nodes when writing to this journal head
+ *
+ * Note, the @buds list is protected by the @c->buds_lock.
+ */
+ struct ubifs_jhead {
+ struct ubifs_wbuf wbuf;
+ struct list_head buds_list;
++ unsigned int grouped:1;
+ };
+
+ /**
+@@ -929,6 +936,40 @@ struct ubifs_mount_opts {
+ unsigned int compr_type:2;
+ };
+
++/**
++ * struct ubifs_budg_info - UBIFS budgeting information.
++ * @idx_growth: amount of bytes budgeted for index growth
++ * @data_growth: amount of bytes budgeted for cached data
++ * @dd_growth: amount of bytes budgeted for cached data that will make
++ * other data dirty
++ * @uncommitted_idx: amount of bytes were budgeted for growth of the index, but
++ * which still have to be taken into account because the index
++ * has not been committed so far
++ * @old_idx_sz: size of index on flash
++ * @min_idx_lebs: minimum number of LEBs required for the index
++ * @nospace: non-zero if the file-system does not have flash space (used as
++ * optimization)
++ * @nospace_rp: the same as @nospace, but additionally means that even reserved
++ * pool is full
++ * @page_budget: budget for a page (constant, nenver changed after mount)
++ * @inode_budget: budget for an inode (constant, nenver changed after mount)
++ * @dent_budget: budget for a directory entry (constant, nenver changed after
++ * mount)
++ */
++struct ubifs_budg_info {
++ long long idx_growth;
++ long long data_growth;
++ long long dd_growth;
++ long long uncommitted_idx;
++ unsigned long long old_idx_sz;
++ int min_idx_lebs;
++ unsigned int nospace:1;
++ unsigned int nospace_rp:1;
++ int page_budget;
++ int inode_budget;
++ int dent_budget;
++};
++
+ struct ubifs_debug_info;
+
+ /**
+@@ -972,6 +1013,7 @@ struct ubifs_debug_info;
+ * @cmt_wq: wait queue to sleep on if the log is full and a commit is running
+ *
+ * @big_lpt: flag that LPT is too big to write whole during commit
++ * @space_fixup: flag indicating that free space in LEBs needs to be cleaned up
+ * @no_chk_data_crc: do not check CRCs when reading data nodes (except during
+ * recovery)
+ * @bulk_read: enable bulk-reads
+@@ -1003,6 +1045,11 @@ struct ubifs_debug_info;
+ * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu
+ * @bu: pre-allocated bulk-read information
+ *
++ * @write_reserve_mutex: protects @write_reserve_buf
++ * @write_reserve_buf: on the write path we allocate memory, which might
++ * sometimes be unavailable, in which case we use this
++ * write reserve buffer
++ *
+ * @log_lebs: number of logical eraseblocks in the log
+ * @log_bytes: log size in bytes
+ * @log_last: last LEB of the log
+@@ -1024,7 +1071,12 @@ struct ubifs_debug_info;
+ *
+ * @min_io_size: minimal input/output unit size
+ * @min_io_shift: number of bits in @min_io_size minus one
++ * @max_write_size: maximum amount of bytes the underlying flash can write at a
++ * time (MTD write buffer size)
++ * @max_write_shift: number of bits in @max_write_size minus one
+ * @leb_size: logical eraseblock size in bytes
++ * @leb_start: starting offset of logical eraseblocks within physical
++ * eraseblocks
+ * @half_leb_size: half LEB size
+ * @idx_leb_size: how many bytes of an LEB are effectively available when it is
+ * used to store indexing nodes (@leb_size - @max_idx_node_sz)
+@@ -1039,32 +1091,14 @@ struct ubifs_debug_info;
+ * @dirty_zn_cnt: number of dirty znodes
+ * @clean_zn_cnt: number of clean znodes
+ *
+- * @budg_idx_growth: amount of bytes budgeted for index growth
+- * @budg_data_growth: amount of bytes budgeted for cached data
+- * @budg_dd_growth: amount of bytes budgeted for cached data that will make
+- * other data dirty
+- * @budg_uncommitted_idx: amount of bytes were budgeted for growth of the index,
+- * but which still have to be taken into account because
+- * the index has not been committed so far
+- * @space_lock: protects @budg_idx_growth, @budg_data_growth, @budg_dd_growth,
+- * @budg_uncommited_idx, @min_idx_lebs, @old_idx_sz, @lst,
+- * @nospace, and @nospace_rp;
+- * @min_idx_lebs: minimum number of LEBs required for the index
+- * @old_idx_sz: size of index on flash
++ * @space_lock: protects @bi and @lst
++ * @lst: lprops statistics
++ * @bi: budgeting information
+ * @calc_idx_sz: temporary variable which is used to calculate new index size
+ * (contains accurate new index size at end of TNC commit start)
+- * @lst: lprops statistics
+- * @nospace: non-zero if the file-system does not have flash space (used as
+- * optimization)
+- * @nospace_rp: the same as @nospace, but additionally means that even reserved
+- * pool is full
+- *
+- * @page_budget: budget for a page
+- * @inode_budget: budget for an inode
+- * @dent_budget: budget for a directory entry
+ *
+ * @ref_node_alsz: size of the LEB reference node aligned to the min. flash
+- * I/O unit
++ * I/O unit
+ * @mst_node_alsz: master node aligned size
+ * @min_idx_node_sz: minimum indexing node aligned on 8-bytes boundary
+ * @max_idx_node_sz: maximum indexing node aligned on 8-bytes boundary
+@@ -1166,22 +1200,20 @@ struct ubifs_debug_info;
+ * @rp_uid: reserved pool user ID
+ * @rp_gid: reserved pool group ID
+ *
+- * @empty: if the UBI device is empty
+- * @replay_tree: temporary tree used during journal replay
++ * @empty: %1 if the UBI device is empty
++ * @need_recovery: %1 if the file-system needs recovery
++ * @replaying: %1 during journal replay
++ * @mounting: %1 while mounting
++ * @remounting_rw: %1 while re-mounting from R/O mode to R/W mode
+ * @replay_list: temporary list used during journal replay
+ * @replay_buds: list of buds to replay
+ * @cs_sqnum: sequence number of first node in the log (commit start node)
+ * @replay_sqnum: sequence number of node currently being replayed
+- * @need_recovery: file-system needs recovery
+- * @replaying: set to %1 during journal replay
+ * @unclean_leb_list: LEBs to recover when re-mounting R/O mounted FS to R/W
+ * mode
+ * @rcvrd_mst_node: recovered master node to write when re-mounting R/O mounted
+ * FS to R/W mode
+ * @size_tree: inode size information for recovery
+- * @remounting_rw: set while re-mounting from R/O mode to R/W mode
+- * @always_chk_crc: always check CRCs (while mounting and remounting to R/W
+- * mode)
+ * @mount_opts: UBIFS-specific mount options
+ *
+ * @dbg: debugging-related information
+@@ -1221,6 +1253,7 @@ struct ubifs_info {
+ wait_queue_head_t cmt_wq;
+
+ unsigned int big_lpt:1;
++ unsigned int space_fixup:1;
+ unsigned int no_chk_data_crc:1;
+ unsigned int bulk_read:1;
+ unsigned int default_compr:2;
+@@ -1250,6 +1283,9 @@ struct ubifs_info {
+ struct mutex bu_mutex;
+ struct bu_info bu;
+
++ struct mutex write_reserve_mutex;
++ void *write_reserve_buf;
++
+ int log_lebs;
+ long long log_bytes;
+ int log_last;
+@@ -1271,7 +1307,10 @@ struct ubifs_info {
+
+ int min_io_size;
+ int min_io_shift;
++ int max_write_size;
++ int max_write_shift;
+ int leb_size;
++ int leb_start;
+ int half_leb_size;
+ int idx_leb_size;
+ int leb_cnt;
+@@ -1285,21 +1324,10 @@ struct ubifs_info {
+ atomic_long_t dirty_zn_cnt;
+ atomic_long_t clean_zn_cnt;
+
+- long long budg_idx_growth;
+- long long budg_data_growth;
+- long long budg_dd_growth;
+- long long budg_uncommitted_idx;
+ spinlock_t space_lock;
+- int min_idx_lebs;
+- unsigned long long old_idx_sz;
+- unsigned long long calc_idx_sz;
+ struct ubifs_lp_stats lst;
+- unsigned int nospace:1;
+- unsigned int nospace_rp:1;
+-
+- int page_budget;
+- int inode_budget;
+- int dent_budget;
++ struct ubifs_budg_info bi;
++ unsigned long long calc_idx_sz;
+
+ int ref_node_alsz;
+ int mst_node_alsz;
+@@ -1402,19 +1430,18 @@ struct ubifs_info {
+ gid_t rp_gid;
+
+ /* The below fields are used only during mounting and re-mounting */
+- int empty;
+- struct rb_root replay_tree;
++ unsigned int empty:1;
++ unsigned int need_recovery:1;
++ unsigned int replaying:1;
++ unsigned int mounting:1;
++ unsigned int remounting_rw:1;
+ struct list_head replay_list;
+ struct list_head replay_buds;
+ unsigned long long cs_sqnum;
+ unsigned long long replay_sqnum;
+- int need_recovery;
+- int replaying;
+ struct list_head unclean_leb_list;
+ struct ubifs_mst_node *rcvrd_mst_node;
+ struct rb_root size_tree;
+- int remounting_rw;
+- int always_chk_crc;
+ struct ubifs_mount_opts mount_opts;
+
+ #ifdef CONFIG_UBIFS_FS_DEBUG
+@@ -1438,6 +1465,15 @@ extern struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
+
+ /* io.c */
+ void ubifs_ro_mode(struct ubifs_info *c, int err);
++int ubifs_leb_read(const struct ubifs_info *c, int lnum, void *buf, int offs,
++ int len, int even_ebadmsg);
++int ubifs_leb_write(struct ubifs_info *c, int lnum, const void *buf, int offs,
++ int len, int dtype);
++int ubifs_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len,
++ int dtype);
++int ubifs_leb_unmap(struct ubifs_info *c, int lnum);
++int ubifs_leb_map(struct ubifs_info *c, int lnum, int dtype);
++int ubifs_is_mapped(const struct ubifs_info *c, int lnum);
+ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len);
+ int ubifs_wbuf_seek_nolock(struct ubifs_wbuf *wbuf, int lnum, int offs,
+ int dtype);
+@@ -1605,6 +1641,7 @@ int ubifs_write_master(struct ubifs_info *c);
+ int ubifs_read_superblock(struct ubifs_info *c);
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c);
+ int ubifs_write_sb_node(struct ubifs_info *c, struct ubifs_sb_node *sup);
++int ubifs_fixup_free_space(struct ubifs_info *c);
+
+ /* replay.c */
+ int ubifs_validate_entry(struct ubifs_info *c,
+@@ -1713,11 +1750,11 @@ struct inode *ubifs_iget(struct super_block *sb, unsigned long inum);
+ int ubifs_recover_master_node(struct ubifs_info *c);
+ int ubifs_write_rcvrd_mst_node(struct ubifs_info *c);
+ struct ubifs_scan_leb *ubifs_recover_leb(struct ubifs_info *c, int lnum,
+- int offs, void *sbuf, int grouped);
++ int offs, void *sbuf, int jhead);
+ struct ubifs_scan_leb *ubifs_recover_log_leb(struct ubifs_info *c, int lnum,
+ int offs, void *sbuf);
+-int ubifs_recover_inl_heads(const struct ubifs_info *c, void *sbuf);
+-int ubifs_clean_lebs(const struct ubifs_info *c, void *sbuf);
++int ubifs_recover_inl_heads(struct ubifs_info *c, void *sbuf);
++int ubifs_clean_lebs(struct ubifs_info *c, void *sbuf);
+ int ubifs_rcvry_gc_commit(struct ubifs_info *c);
+ int ubifs_recover_size_accum(struct ubifs_info *c, union ubifs_key *key,
+ int deletion, loff_t new_size);
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index c74400f..2fdc4fa 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -79,9 +79,9 @@ enum {
+ SECURITY_XATTR,
+ };
+
+-static const struct inode_operations none_inode_operations;
+-static const struct address_space_operations none_address_operations;
+-static const struct file_operations none_file_operations;
++static const struct inode_operations empty_iops;
++static const struct file_operations empty_fops;
++static struct address_space_operations empty_aops;
+
+ /**
+ * create_xattr - create an extended attribute.
+@@ -130,20 +130,19 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
+ }
+
+ /* Re-define all operations to be "nothing" */
+- inode->i_mapping->a_ops = &none_address_operations;
+- inode->i_op = &none_inode_operations;
+- inode->i_fop = &none_file_operations;
++ inode->i_mapping->a_ops = &empty_aops;
++ inode->i_op = &empty_iops;
++ inode->i_fop = &empty_fops;
+
+ inode->i_flags |= S_SYNC | S_NOATIME | S_NOCMTIME | S_NOQUOTA;
+ ui = ubifs_inode(inode);
+ ui->xattr = 1;
+ ui->flags |= UBIFS_XATTR_FL;
+- ui->data = kmalloc(size, GFP_NOFS);
++ ui->data = kmemdup(value, size, GFP_NOFS);
+ if (!ui->data) {
+ err = -ENOMEM;
+ goto out_free;
+ }
+- memcpy(ui->data, value, size);
+ inode->i_size = ui->ui_size = size;
+ ui->data_len = size;
+
+@@ -204,12 +203,11 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ return err;
+
+ kfree(ui->data);
+- ui->data = kmalloc(size, GFP_NOFS);
++ ui->data = kmemdup(value, size, GFP_NOFS);
+ if (!ui->data) {
+ err = -ENOMEM;
+ goto out_free;
+ }
+- memcpy(ui->data, value, size);
+ inode->i_size = ui->ui_size = size;
+ ui->data_len = size;
+
+diff --git a/include/linux/mtd/ubi.h b/include/linux/mtd/ubi.h
+index b31bd9e..db4836b 100644
+--- a/include/linux/mtd/ubi.h
++++ b/include/linux/mtd/ubi.h
+@@ -21,7 +21,7 @@
+ #ifndef __LINUX_UBI_H__
+ #define __LINUX_UBI_H__
+
+-#include <asm/ioctl.h>
++#include <linux/ioctl.h>
+ #include <linux/types.h>
+ #include <mtd/ubi-user.h>
+
+@@ -87,7 +87,7 @@ enum {
+ * physical eraseblock size and on how much bytes UBI headers consume. But
+ * because of the volume alignment (@alignment), the usable size of logical
+ * eraseblocks if a volume may be less. The following equation is true:
+- * @usable_leb_size = LEB size - (LEB size mod @alignment),
++ * @usable_leb_size = LEB size - (LEB size mod @alignment),
+ * where LEB size is the logical eraseblock size defined by the UBI device.
+ *
+ * The alignment is multiple to the minimal flash input/output unit size or %1
+@@ -116,29 +116,53 @@ struct ubi_volume_info {
+ * struct ubi_device_info - UBI device description data structure.
+ * @ubi_num: ubi device number
+ * @leb_size: logical eraseblock size on this UBI device
++ * @leb_start: starting offset of logical eraseblocks within physical
++ * eraseblocks
+ * @min_io_size: minimal I/O unit size
++ * @max_write_size: maximum amount of bytes the underlying flash can write at a
++ * time (MTD write buffer size)
+ * @ro_mode: if this device is in read-only mode
+ * @cdev: UBI character device major and minor numbers
+ *
+ * Note, @leb_size is the logical eraseblock size offered by the UBI device.
+ * Volumes of this UBI device may have smaller logical eraseblock size if their
+ * alignment is not equivalent to %1.
++ *
++ * The @max_write_size field describes flash write maximum write unit. For
++ * example, NOR flash allows for changing individual bytes, so @min_io_size is
++ * %1. However, it does not mean than NOR flash has to write data byte-by-byte.
++ * Instead, CFI NOR flashes have a write-buffer of, e.g., 64 bytes, and when
++ * writing large chunks of data, they write 64-bytes at a time. Obviously, this
++ * improves write throughput.
++ *
++ * Also, the MTD device may have N interleaved (striped) flash chips
++ * underneath, in which case @min_io_size can be physical min. I/O size of
++ * single flash chip, while @max_write_size can be N * @min_io_size.
++ *
++ * The @max_write_size field is always greater or equivalent to @min_io_size.
++ * E.g., some NOR flashes may have (@min_io_size = 1, @max_write_size = 64). In
++ * contrast, NAND flashes usually have @min_io_size = @max_write_size = NAND
++ * page size.
+ */
+ struct ubi_device_info {
+ int ubi_num;
+ int leb_size;
++ int leb_start;
+ int min_io_size;
++ int max_write_size;
+ int ro_mode;
+ dev_t cdev;
+ };
+
+ /*
+- * enum - volume notification types.
+- * @UBI_VOLUME_ADDED: volume has been added
+- * @UBI_VOLUME_REMOVED: start volume volume
+- * @UBI_VOLUME_RESIZED: volume size has been re-sized
+- * @UBI_VOLUME_RENAMED: volume name has been re-named
+- * @UBI_VOLUME_UPDATED: volume name has been updated
++ * Volume notification types.
++ * @UBI_VOLUME_ADDED: a volume has been added (an UBI device was attached or a
++ * volume was created)
++ * @UBI_VOLUME_REMOVED: a volume has been removed (an UBI device was detached
++ * or a volume was removed)
++ * @UBI_VOLUME_RESIZED: a volume has been re-sized
++ * @UBI_VOLUME_RENAMED: a volume has been re-named
++ * @UBI_VOLUME_UPDATED: data has been written to a volume
+ *
+ * These constants define which type of event has happened when a volume
+ * notification function is invoked.
projects / vuplus_openembedded / commitdiff