fslog.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 *
   4 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved.
   5 *
   6 */
   7
   8#include <linux/blkdev.h>
   9#include <linux/fs.h>
  10#include <linux/random.h>
  11#include <linux/slab.h>
  12
  13#include "debug.h"
  14#include "ntfs.h"
  15#include "ntfs_fs.h"
  16
  17/*
  18 * LOG FILE structs
  19 */
  20
  21// clang-format off
  22
  23#define MaxLogFileSize     0x100000000ull
  24#define DefaultLogPageSize 4096
  25#define MinLogRecordPages  0x30
  26
  27struct RESTART_HDR {
  28	struct NTFS_RECORD_HEADER rhdr; // 'RSTR'
  29	__le32 sys_page_size; // 0x10: Page size of the system which initialized the log.
  30	__le32 page_size;     // 0x14: Log page size used for this log file.
  31	__le16 ra_off;        // 0x18:
  32	__le16 minor_ver;     // 0x1A:
  33	__le16 major_ver;     // 0x1C:
  34	__le16 fixups[];
  35};
  36
  37#define LFS_NO_CLIENT 0xffff
  38#define LFS_NO_CLIENT_LE cpu_to_le16(0xffff)
  39
  40struct CLIENT_REC {
  41	__le64 oldest_lsn;
  42	__le64 restart_lsn; // 0x08:
  43	__le16 prev_client; // 0x10:
  44	__le16 next_client; // 0x12:
  45	__le16 seq_num;     // 0x14:
  46	u8 align[6];        // 0x16:
  47	__le32 name_bytes;  // 0x1C: In bytes.
  48	__le16 name[32];    // 0x20: Name of client.
  49};
  50
  51static_assert(sizeof(struct CLIENT_REC) == 0x60);
  52
  53/* Two copies of these will exist at the beginning of the log file */
  54struct RESTART_AREA {
  55	__le64 current_lsn;    // 0x00: Current logical end of log file.
  56	__le16 log_clients;    // 0x08: Maximum number of clients.
  57	__le16 client_idx[2];  // 0x0A: Free/use index into the client record arrays.
  58	__le16 flags;          // 0x0E: See RESTART_SINGLE_PAGE_IO.
  59	__le32 seq_num_bits;   // 0x10: The number of bits in sequence number.
  60	__le16 ra_len;         // 0x14:
  61	__le16 client_off;     // 0x16:
  62	__le64 l_size;         // 0x18: Usable log file size.
  63	__le32 last_lsn_data_len; // 0x20:
  64	__le16 rec_hdr_len;    // 0x24: Log page data offset.
  65	__le16 data_off;       // 0x26: Log page data length.
  66	__le32 open_log_count; // 0x28:
  67	__le32 align[5];       // 0x2C:
  68	struct CLIENT_REC clients[]; // 0x40:
  69};
  70
  71struct LOG_REC_HDR {
  72	__le16 redo_op;      // 0x00:  NTFS_LOG_OPERATION
  73	__le16 undo_op;      // 0x02:  NTFS_LOG_OPERATION
  74	__le16 redo_off;     // 0x04:  Offset to Redo record.
  75	__le16 redo_len;     // 0x06:  Redo length.
  76	__le16 undo_off;     // 0x08:  Offset to Undo record.
  77	__le16 undo_len;     // 0x0A:  Undo length.
  78	__le16 target_attr;  // 0x0C:
  79	__le16 lcns_follow;  // 0x0E:
  80	__le16 record_off;   // 0x10:
  81	__le16 attr_off;     // 0x12:
  82	__le16 cluster_off;  // 0x14:
  83	__le16 reserved;     // 0x16:
  84	__le64 target_vcn;   // 0x18:
  85	__le64 page_lcns[];  // 0x20:
  86};
  87
  88static_assert(sizeof(struct LOG_REC_HDR) == 0x20);
  89
  90#define RESTART_ENTRY_ALLOCATED    0xFFFFFFFF
  91#define RESTART_ENTRY_ALLOCATED_LE cpu_to_le32(0xFFFFFFFF)
  92
  93struct RESTART_TABLE {
  94	__le16 size;       // 0x00: In bytes
  95	__le16 used;       // 0x02: Entries
  96	__le16 total;      // 0x04: Entries
  97	__le16 res[3];     // 0x06:
  98	__le32 free_goal;  // 0x0C:
  99	__le32 first_free; // 0x10:
 100	__le32 last_free;  // 0x14:
 101
 102};
 103
 104static_assert(sizeof(struct RESTART_TABLE) == 0x18);
 105
 106struct ATTR_NAME_ENTRY {
 107	__le16 off; // Offset in the Open attribute Table.
 108	__le16 name_bytes;
 109	__le16 name[];
 110};
 111
 112struct OPEN_ATTR_ENRTY {
 113	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 114	__le32 bytes_per_index; // 0x04:
 115	enum ATTR_TYPE type;    // 0x08:
 116	u8 is_dirty_pages;      // 0x0C:
 117	u8 is_attr_name;        // 0x0B: Faked field to manage 'ptr'
 118	u8 name_len;            // 0x0C: Faked field to manage 'ptr'
 119	u8 res;
 120	struct MFT_REF ref;     // 0x10: File Reference of file containing attribute
 121	__le64 open_record_lsn; // 0x18:
 122	void *ptr;              // 0x20:
 123};
 124
 125/* 32 bit version of 'struct OPEN_ATTR_ENRTY' */
 126struct OPEN_ATTR_ENRTY_32 {
 127	__le32 next;            // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 128	__le32 ptr;             // 0x04:
 129	struct MFT_REF ref;     // 0x08:
 130	__le64 open_record_lsn; // 0x10:
 131	u8 is_dirty_pages;      // 0x18:
 132	u8 is_attr_name;        // 0x19:
 133	u8 res1[2];
 134	enum ATTR_TYPE type;    // 0x1C:
 135	u8 name_len;            // 0x20: In wchar
 136	u8 res2[3];
 137	__le32 AttributeName;   // 0x24:
 138	__le32 bytes_per_index; // 0x28:
 139};
 140
 141#define SIZEOF_OPENATTRIBUTEENTRY0 0x2c
 142// static_assert( 0x2C == sizeof(struct OPEN_ATTR_ENRTY_32) );
 143static_assert(sizeof(struct OPEN_ATTR_ENRTY) < SIZEOF_OPENATTRIBUTEENTRY0);
 144
 145/*
 146 * One entry exists in the Dirty Pages Table for each page which is dirty at
 147 * the time the Restart Area is written.
 148 */
 149struct DIR_PAGE_ENTRY {
 150	__le32 next;         // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 151	__le32 target_attr;  // 0x04: Index into the Open attribute Table
 152	__le32 transfer_len; // 0x08:
 153	__le32 lcns_follow;  // 0x0C:
 154	__le64 vcn;          // 0x10: Vcn of dirty page
 155	__le64 oldest_lsn;   // 0x18:
 156	__le64 page_lcns[];  // 0x20:
 157};
 158
 159static_assert(sizeof(struct DIR_PAGE_ENTRY) == 0x20);
 160
 161/* 32 bit version of 'struct DIR_PAGE_ENTRY' */
 162struct DIR_PAGE_ENTRY_32 {
 163	__le32 next;		// 0x00: RESTART_ENTRY_ALLOCATED if allocated
 164	__le32 target_attr;	// 0x04: Index into the Open attribute Table
 165	__le32 transfer_len;	// 0x08:
 166	__le32 lcns_follow;	// 0x0C:
 167	__le32 reserved;	// 0x10:
 168	__le32 vcn_low;		// 0x14: Vcn of dirty page
 169	__le32 vcn_hi;		// 0x18: Vcn of dirty page
 170	__le32 oldest_lsn_low;	// 0x1C:
 171	__le32 oldest_lsn_hi;	// 0x1C:
 172	__le32 page_lcns_low;	// 0x24:
 173	__le32 page_lcns_hi;	// 0x24:
 174};
 175
 176static_assert(offsetof(struct DIR_PAGE_ENTRY_32, vcn_low) == 0x14);
 177static_assert(sizeof(struct DIR_PAGE_ENTRY_32) == 0x2c);
 178
 179enum transact_state {
 180	TransactionUninitialized = 0,
 181	TransactionActive,
 182	TransactionPrepared,
 183	TransactionCommitted
 184};
 185
 186struct TRANSACTION_ENTRY {
 187	__le32 next;          // 0x00: RESTART_ENTRY_ALLOCATED if allocated
 188	u8 transact_state;    // 0x04:
 189	u8 reserved[3];       // 0x05:
 190	__le64 first_lsn;     // 0x08:
 191	__le64 prev_lsn;      // 0x10:
 192	__le64 undo_next_lsn; // 0x18:
 193	__le32 undo_records;  // 0x20: Number of undo log records pending abort
 194	__le32 undo_len;      // 0x24: Total undo size
 195};
 196
 197static_assert(sizeof(struct TRANSACTION_ENTRY) == 0x28);
 198
 199struct NTFS_RESTART {
 200	__le32 major_ver;             // 0x00:
 201	__le32 minor_ver;             // 0x04:
 202	__le64 check_point_start;     // 0x08:
 203	__le64 open_attr_table_lsn;   // 0x10:
 204	__le64 attr_names_lsn;        // 0x18:
 205	__le64 dirty_pages_table_lsn; // 0x20:
 206	__le64 transact_table_lsn;    // 0x28:
 207	__le32 open_attr_len;         // 0x30: In bytes
 208	__le32 attr_names_len;        // 0x34: In bytes
 209	__le32 dirty_pages_len;       // 0x38: In bytes
 210	__le32 transact_table_len;    // 0x3C: In bytes
 211};
 212
 213static_assert(sizeof(struct NTFS_RESTART) == 0x40);
 214
 215struct NEW_ATTRIBUTE_SIZES {
 216	__le64 alloc_size;
 217	__le64 valid_size;
 218	__le64 data_size;
 219	__le64 total_size;
 220};
 221
 222struct BITMAP_RANGE {
 223	__le32 bitmap_off;
 224	__le32 bits;
 225};
 226
 227struct LCN_RANGE {
 228	__le64 lcn;
 229	__le64 len;
 230};
 231
 232/* The following type defines the different log record types. */
 233#define LfsClientRecord  cpu_to_le32(1)
 234#define LfsClientRestart cpu_to_le32(2)
 235
 236/* This is used to uniquely identify a client for a particular log file. */
 237struct CLIENT_ID {
 238	__le16 seq_num;
 239	__le16 client_idx;
 240};
 241
 242/* This is the header that begins every Log Record in the log file. */
 243struct LFS_RECORD_HDR {
 244	__le64 this_lsn;		// 0x00:
 245	__le64 client_prev_lsn;		// 0x08:
 246	__le64 client_undo_next_lsn;	// 0x10:
 247	__le32 client_data_len;		// 0x18:
 248	struct CLIENT_ID client;	// 0x1C: Owner of this log record.
 249	__le32 record_type;		// 0x20: LfsClientRecord or LfsClientRestart.
 250	__le32 transact_id;		// 0x24:
 251	__le16 flags;			// 0x28: LOG_RECORD_MULTI_PAGE
 252	u8 align[6];			// 0x2A:
 253};
 254
 255#define LOG_RECORD_MULTI_PAGE cpu_to_le16(1)
 256
 257static_assert(sizeof(struct LFS_RECORD_HDR) == 0x30);
 258
 259struct LFS_RECORD {
 260	__le16 next_record_off;	// 0x00: Offset of the free space in the page,
 261	u8 align[6];		// 0x02:
 262	__le64 last_end_lsn;	// 0x08: lsn for the last log record which ends on the page,
 263};
 264
 265static_assert(sizeof(struct LFS_RECORD) == 0x10);
 266
 267struct RECORD_PAGE_HDR {
 268	struct NTFS_RECORD_HEADER rhdr;	// 'RCRD'
 269	__le32 rflags;			// 0x10: See LOG_PAGE_LOG_RECORD_END
 270	__le16 page_count;		// 0x14:
 271	__le16 page_pos;		// 0x16:
 272	struct LFS_RECORD record_hdr;	// 0x18:
 273	__le16 fixups[10];		// 0x28:
 274	__le32 file_off;		// 0x3c: Used when major version >= 2
 275};
 276
 277// clang-format on
 278
 279// Page contains the end of a log record.
 280#define LOG_PAGE_LOG_RECORD_END cpu_to_le32(0x00000001)
 281
 282static inline bool is_log_record_end(const struct RECORD_PAGE_HDR *hdr)
 283{
 284	return hdr->rflags & LOG_PAGE_LOG_RECORD_END;
 285}
 286
 287static_assert(offsetof(struct RECORD_PAGE_HDR, file_off) == 0x3c);
 288
 289/*
 290 * END of NTFS LOG structures
 291 */
 292
 293/* Define some tuning parameters to keep the restart tables a reasonable size. */
 294#define INITIAL_NUMBER_TRANSACTIONS 5
 295
 296enum NTFS_LOG_OPERATION {
 297
 298	Noop = 0x00,
 299	CompensationLogRecord = 0x01,
 300	InitializeFileRecordSegment = 0x02,
 301	DeallocateFileRecordSegment = 0x03,
 302	WriteEndOfFileRecordSegment = 0x04,
 303	CreateAttribute = 0x05,
 304	DeleteAttribute = 0x06,
 305	UpdateResidentValue = 0x07,
 306	UpdateNonresidentValue = 0x08,
 307	UpdateMappingPairs = 0x09,
 308	DeleteDirtyClusters = 0x0A,
 309	SetNewAttributeSizes = 0x0B,
 310	AddIndexEntryRoot = 0x0C,
 311	DeleteIndexEntryRoot = 0x0D,
 312	AddIndexEntryAllocation = 0x0E,
 313	DeleteIndexEntryAllocation = 0x0F,
 314	WriteEndOfIndexBuffer = 0x10,
 315	SetIndexEntryVcnRoot = 0x11,
 316	SetIndexEntryVcnAllocation = 0x12,
 317	UpdateFileNameRoot = 0x13,
 318	UpdateFileNameAllocation = 0x14,
 319	SetBitsInNonresidentBitMap = 0x15,
 320	ClearBitsInNonresidentBitMap = 0x16,
 321	HotFix = 0x17,
 322	EndTopLevelAction = 0x18,
 323	PrepareTransaction = 0x19,
 324	CommitTransaction = 0x1A,
 325	ForgetTransaction = 0x1B,
 326	OpenNonresidentAttribute = 0x1C,
 327	OpenAttributeTableDump = 0x1D,
 328	AttributeNamesDump = 0x1E,
 329	DirtyPageTableDump = 0x1F,
 330	TransactionTableDump = 0x20,
 331	UpdateRecordDataRoot = 0x21,
 332	UpdateRecordDataAllocation = 0x22,
 333
 334	UpdateRelativeDataInIndex =
 335		0x23, // NtOfsRestartUpdateRelativeDataInIndex
 336	UpdateRelativeDataInIndex2 = 0x24,
 337	ZeroEndOfFileRecord = 0x25,
 338};
 339
 340/*
 341 * Array for log records which require a target attribute.
 342 * A true indicates that the corresponding restart operation
 343 * requires a target attribute.
 344 */
 345static const u8 AttributeRequired[] = {
 346	0xFC, 0xFB, 0xFF, 0x10, 0x06,
 347};
 348
 349static inline bool is_target_required(u16 op)
 350{
 351	bool ret = op <= UpdateRecordDataAllocation &&
 352		   (AttributeRequired[op >> 3] >> (op & 7) & 1);
 353	return ret;
 354}
 355
 356static inline bool can_skip_action(enum NTFS_LOG_OPERATION op)
 357{
 358	switch (op) {
 359	case Noop:
 360	case DeleteDirtyClusters:
 361	case HotFix:
 362	case EndTopLevelAction:
 363	case PrepareTransaction:
 364	case CommitTransaction:
 365	case ForgetTransaction:
 366	case CompensationLogRecord:
 367	case OpenNonresidentAttribute:
 368	case OpenAttributeTableDump:
 369	case AttributeNamesDump:
 370	case DirtyPageTableDump:
 371	case TransactionTableDump:
 372		return true;
 373	default:
 374		return false;
 375	}
 376}
 377
 378enum { lcb_ctx_undo_next, lcb_ctx_prev, lcb_ctx_next };
 379
 380/* Bytes per restart table. */
 381static inline u32 bytes_per_rt(const struct RESTART_TABLE *rt)
 382{
 383	return le16_to_cpu(rt->used) * le16_to_cpu(rt->size) +
 384	       sizeof(struct RESTART_TABLE);
 385}
 386
 387/* Log record length. */
 388static inline u32 lrh_length(const struct LOG_REC_HDR *lr)
 389{
 390	u16 t16 = le16_to_cpu(lr->lcns_follow);
 391
 392	return struct_size(lr, page_lcns, max_t(u16, 1, t16));
 393}
 394
 395struct lcb {
 396	struct LFS_RECORD_HDR *lrh; // Log record header of the current lsn.
 397	struct LOG_REC_HDR *log_rec;
 398	u32 ctx_mode; // lcb_ctx_undo_next/lcb_ctx_prev/lcb_ctx_next
 399	struct CLIENT_ID client;
 400	bool alloc; // If true the we should deallocate 'log_rec'.
 401};
 402
 403static void lcb_put(struct lcb *lcb)
 404{
 405	if (lcb->alloc)
 406		kfree(lcb->log_rec);
 407	kfree(lcb->lrh);
 408	kfree(lcb);
 409}
 410
 411/* Find the oldest lsn from active clients. */
 412static inline void oldest_client_lsn(const struct CLIENT_REC *ca,
 413				     __le16 next_client, u64 *oldest_lsn)
 414{
 415	while (next_client != LFS_NO_CLIENT_LE) {
 416		const struct CLIENT_REC *cr = ca + le16_to_cpu(next_client);
 417		u64 lsn = le64_to_cpu(cr->oldest_lsn);
 418
 419		/* Ignore this block if it's oldest lsn is 0. */
 420		if (lsn && lsn < *oldest_lsn)
 421			*oldest_lsn = lsn;
 422
 423		next_client = cr->next_client;
 424	}
 425}
 426
 427static inline bool is_rst_page_hdr_valid(u32 file_off,
 428					 const struct RESTART_HDR *rhdr)
 429{
 430	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
 431	u32 page_size = le32_to_cpu(rhdr->page_size);
 432	u32 end_usa;
 433	u16 ro;
 434
 435	if (sys_page < SECTOR_SIZE || page_size < SECTOR_SIZE ||
 436	    sys_page & (sys_page - 1) || page_size & (page_size - 1)) {
 437		return false;
 438	}
 439
 440	/* Check that if the file offset isn't 0, it is the system page size. */
 441	if (file_off && file_off != sys_page)
 442		return false;
 443
 444	/* Check support version 1.1+. */
 445	if (le16_to_cpu(rhdr->major_ver) <= 1 && !rhdr->minor_ver)
 446		return false;
 447
 448	if (le16_to_cpu(rhdr->major_ver) > 2)
 449		return false;
 450
 451	ro = le16_to_cpu(rhdr->ra_off);
 452	if (!IS_ALIGNED(ro, 8) || ro > sys_page)
 453		return false;
 454
 455	end_usa = ((sys_page >> SECTOR_SHIFT) + 1) * sizeof(short);
 456	end_usa += le16_to_cpu(rhdr->rhdr.fix_off);
 457
 458	if (ro < end_usa)
 459		return false;
 460
 461	return true;
 462}
 463
 464static inline bool is_rst_area_valid(const struct RESTART_HDR *rhdr)
 465{
 466	const struct RESTART_AREA *ra;
 467	u16 cl, fl, ul;
 468	u32 off, l_size, seq_bits;
 469	u16 ro = le16_to_cpu(rhdr->ra_off);
 470	u32 sys_page = le32_to_cpu(rhdr->sys_page_size);
 471
 472	if (ro + offsetof(struct RESTART_AREA, l_size) >
 473	    SECTOR_SIZE - sizeof(short))
 474		return false;
 475
 476	ra = Add2Ptr(rhdr, ro);
 477	cl = le16_to_cpu(ra->log_clients);
 478
 479	if (cl > 1)
 480		return false;
 481
 482	off = le16_to_cpu(ra->client_off);
 483
 484	if (!IS_ALIGNED(off, 8) || ro + off > SECTOR_SIZE - sizeof(short))
 485		return false;
 486
 487	off += cl * sizeof(struct CLIENT_REC);
 488
 489	if (off > sys_page)
 490		return false;
 491
 492	/*
 493	 * Check the restart length field and whether the entire
 494	 * restart area is contained that length.
 495	 */
 496	if (le16_to_cpu(rhdr->ra_off) + le16_to_cpu(ra->ra_len) > sys_page ||
 497	    off > le16_to_cpu(ra->ra_len)) {
 498		return false;
 499	}
 500
 501	/*
 502	 * As a final check make sure that the use list and the free list
 503	 * are either empty or point to a valid client.
 504	 */
 505	fl = le16_to_cpu(ra->client_idx[0]);
 506	ul = le16_to_cpu(ra->client_idx[1]);
 507	if ((fl != LFS_NO_CLIENT && fl >= cl) ||
 508	    (ul != LFS_NO_CLIENT && ul >= cl))
 509		return false;
 510
 511	/* Make sure the sequence number bits match the log file size. */
 512	l_size = le64_to_cpu(ra->l_size);
 513
 514	seq_bits = sizeof(u64) * 8 + 3;
 515	while (l_size) {
 516		l_size >>= 1;
 517		seq_bits -= 1;
 518	}
 519
 520	if (seq_bits != le32_to_cpu(ra->seq_num_bits))
 521		return false;
 522
 523	/* The log page data offset and record header length must be quad-aligned. */
 524	if (!IS_ALIGNED(le16_to_cpu(ra->data_off), 8) ||
 525	    !IS_ALIGNED(le16_to_cpu(ra->rec_hdr_len), 8))
 526		return false;
 527
 528	return true;
 529}
 530
 531static inline bool is_client_area_valid(const struct RESTART_HDR *rhdr,
 532					bool usa_error)
 533{
 534	u16 ro = le16_to_cpu(rhdr->ra_off);
 535	const struct RESTART_AREA *ra = Add2Ptr(rhdr, ro);
 536	u16 ra_len = le16_to_cpu(ra->ra_len);
 537	const struct CLIENT_REC *ca;
 538	u32 i;
 539
 540	if (usa_error && ra_len + ro > SECTOR_SIZE - sizeof(short))
 541		return false;
 542
 543	/* Find the start of the client array. */
 544	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
 545
 546	/*
 547	 * Start with the free list.
 548	 * Check that all the clients are valid and that there isn't a cycle.
 549	 * Do the in-use list on the second pass.
 550	 */
 551	for (i = 0; i < 2; i++) {
 552		u16 client_idx = le16_to_cpu(ra->client_idx[i]);
 553		bool first_client = true;
 554		u16 clients = le16_to_cpu(ra->log_clients);
 555
 556		while (client_idx != LFS_NO_CLIENT) {
 557			const struct CLIENT_REC *cr;
 558
 559			if (!clients ||
 560			    client_idx >= le16_to_cpu(ra->log_clients))
 561				return false;
 562
 563			clients -= 1;
 564			cr = ca + client_idx;
 565
 566			client_idx = le16_to_cpu(cr->next_client);
 567
 568			if (first_client) {
 569				first_client = false;
 570				if (cr->prev_client != LFS_NO_CLIENT_LE)
 571					return false;
 572			}
 573		}
 574	}
 575
 576	return true;
 577}
 578
 579/*
 580 * remove_client
 581 *
 582 * Remove a client record from a client record list an restart area.
 583 */
 584static inline void remove_client(struct CLIENT_REC *ca,
 585				 const struct CLIENT_REC *cr, __le16 *head)
 586{
 587	if (cr->prev_client == LFS_NO_CLIENT_LE)
 588		*head = cr->next_client;
 589	else
 590		ca[le16_to_cpu(cr->prev_client)].next_client = cr->next_client;
 591
 592	if (cr->next_client != LFS_NO_CLIENT_LE)
 593		ca[le16_to_cpu(cr->next_client)].prev_client = cr->prev_client;
 594}
 595
 596/*
 597 * add_client - Add a client record to the start of a list.
 598 */
 599static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head)
 600{
 601	struct CLIENT_REC *cr = ca + index;
 602
 603	cr->prev_client = LFS_NO_CLIENT_LE;
 604	cr->next_client = *head;
 605
 606	if (*head != LFS_NO_CLIENT_LE)
 607		ca[le16_to_cpu(*head)].prev_client = cpu_to_le16(index);
 608
 609	*head = cpu_to_le16(index);
 610}
 611
 612/*
 613 * Enumerate restart table.
 614 *
 615 * @t - table to enumerate.
 616 * @c - current enumerated element.
 617 *
 618 * enumeration starts with @c == NULL
 619 * returns next element or NULL
 620 */
 621static inline void *enum_rstbl(struct RESTART_TABLE *t, void *c)
 622{
 623	__le32 *e;
 624	u32 bprt;
 625	u16 rsize;
 626
 627	if (!t)
 628		return NULL;
 629
 630	rsize = le16_to_cpu(t->size);
 631
 632	if (!c) {
 633		/* start enumeration. */
 634		if (!t->total)
 635			return NULL;
 636		e = Add2Ptr(t, sizeof(struct RESTART_TABLE));
 637	} else {
 638		e = Add2Ptr(c, rsize);
 639	}
 640
 641	/* Loop until we hit the first one allocated, or the end of the list. */
 642	for (bprt = bytes_per_rt(t); PtrOffset(t, e) < bprt;
 643	     e = Add2Ptr(e, rsize)) {
 644		if (*e == RESTART_ENTRY_ALLOCATED_LE)
 645			return e;
 646	}
 647	return NULL;
 648}
 649
 650/*
 651 * find_dp - Search for a @vcn in Dirty Page Table.
 652 */
 653static inline struct DIR_PAGE_ENTRY *find_dp(struct RESTART_TABLE *dptbl,
 654					     u32 target_attr, u64 vcn)
 655{
 656	__le32 ta = cpu_to_le32(target_attr);
 657	struct DIR_PAGE_ENTRY *dp = NULL;
 658
 659	while ((dp = enum_rstbl(dptbl, dp))) {
 660		u64 dp_vcn = le64_to_cpu(dp->vcn);
 661
 662		if (dp->target_attr == ta && vcn >= dp_vcn &&
 663		    vcn < dp_vcn + le32_to_cpu(dp->lcns_follow)) {
 664			return dp;
 665		}
 666	}
 667	return NULL;
 668}
 669
 670static inline u32 norm_file_page(u32 page_size, u32 *l_size, bool use_default)
 671{
 672	if (use_default)
 673		page_size = DefaultLogPageSize;
 674
 675	/* Round the file size down to a system page boundary. */
 676	*l_size &= ~(page_size - 1);
 677
 678	/* File should contain at least 2 restart pages and MinLogRecordPages pages. */
 679	if (*l_size < (MinLogRecordPages + 2) * page_size)
 680		return 0;
 681
 682	return page_size;
 683}
 684
 685static bool check_log_rec(const struct LOG_REC_HDR *lr, u32 bytes, u32 tr,
 686			  u32 bytes_per_attr_entry)
 687{
 688	u16 t16;
 689
 690	if (bytes < sizeof(struct LOG_REC_HDR))
 691		return false;
 692	if (!tr)
 693		return false;
 694
 695	if ((tr - sizeof(struct RESTART_TABLE)) %
 696	    sizeof(struct TRANSACTION_ENTRY))
 697		return false;
 698
 699	if (le16_to_cpu(lr->redo_off) & 7)
 700		return false;
 701
 702	if (le16_to_cpu(lr->undo_off) & 7)
 703		return false;
 704
 705	if (lr->target_attr)
 706		goto check_lcns;
 707
 708	if (is_target_required(le16_to_cpu(lr->redo_op)))
 709		return false;
 710
 711	if (is_target_required(le16_to_cpu(lr->undo_op)))
 712		return false;
 713
 714check_lcns:
 715	if (!lr->lcns_follow)
 716		goto check_length;
 717
 718	t16 = le16_to_cpu(lr->target_attr);
 719	if ((t16 - sizeof(struct RESTART_TABLE)) % bytes_per_attr_entry)
 720		return false;
 721
 722check_length:
 723	if (bytes < lrh_length(lr))
 724		return false;
 725
 726	return true;
 727}
 728
 729static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
 730{
 731	u32 ts;
 732	u32 i, off;
 733	u16 rsize = le16_to_cpu(rt->size);
 734	u16 ne = le16_to_cpu(rt->used);
 735	u32 ff = le32_to_cpu(rt->first_free);
 736	u32 lf = le32_to_cpu(rt->last_free);
 737
 738	ts = rsize * ne + sizeof(struct RESTART_TABLE);
 739
 740	if (!rsize || rsize > bytes ||
 741	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||
 742	    le16_to_cpu(rt->total) > ne || ff > ts - sizeof(__le32) ||
 743	    lf > ts - sizeof(__le32) ||
 744	    (ff && ff < sizeof(struct RESTART_TABLE)) ||
 745	    (lf && lf < sizeof(struct RESTART_TABLE))) {
 746		return false;
 747	}
 748
 749	/*
 750	 * Verify each entry is either allocated or points
 751	 * to a valid offset the table.
 752	 */
 753	for (i = 0; i < ne; i++) {
 754		off = le32_to_cpu(*(__le32 *)Add2Ptr(
 755			rt, i * rsize + sizeof(struct RESTART_TABLE)));
 756
 757		if (off != RESTART_ENTRY_ALLOCATED && off &&
 758		    (off < sizeof(struct RESTART_TABLE) ||
 759		     ((off - sizeof(struct RESTART_TABLE)) % rsize))) {
 760			return false;
 761		}
 762	}
 763
 764	/*
 765	 * Walk through the list headed by the first entry to make
 766	 * sure none of the entries are currently being used.
 767	 */
 768	for (off = ff; off;) {
 769		if (off == RESTART_ENTRY_ALLOCATED)
 770			return false;
 771
 772		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
 773
 774		if (off > ts - sizeof(__le32))
 775			return false;
 776	}
 777
 778	return true;
 779}
 780
 781/*
 782 * free_rsttbl_idx - Free a previously allocated index a Restart Table.
 783 */
 784static inline void free_rsttbl_idx(struct RESTART_TABLE *rt, u32 off)
 785{
 786	__le32 *e;
 787	u32 lf = le32_to_cpu(rt->last_free);
 788	__le32 off_le = cpu_to_le32(off);
 789
 790	e = Add2Ptr(rt, off);
 791
 792	if (off < le32_to_cpu(rt->free_goal)) {
 793		*e = rt->first_free;
 794		rt->first_free = off_le;
 795		if (!lf)
 796			rt->last_free = off_le;
 797	} else {
 798		if (lf)
 799			*(__le32 *)Add2Ptr(rt, lf) = off_le;
 800		else
 801			rt->first_free = off_le;
 802
 803		rt->last_free = off_le;
 804		*e = 0;
 805	}
 806
 807	le16_sub_cpu(&rt->total, 1);
 808}
 809
 810static inline struct RESTART_TABLE *init_rsttbl(u16 esize, u16 used)
 811{
 812	__le32 *e, *last_free;
 813	u32 off;
 814	u32 bytes = esize * used + sizeof(struct RESTART_TABLE);
 815	u32 lf = sizeof(struct RESTART_TABLE) + (used - 1) * esize;
 816	struct RESTART_TABLE *t = kzalloc(bytes, GFP_NOFS);
 817
 818	if (!t)
 819		return NULL;
 820
 821	t->size = cpu_to_le16(esize);
 822	t->used = cpu_to_le16(used);
 823	t->free_goal = cpu_to_le32(~0u);
 824	t->first_free = cpu_to_le32(sizeof(struct RESTART_TABLE));
 825	t->last_free = cpu_to_le32(lf);
 826
 827	e = (__le32 *)(t + 1);
 828	last_free = Add2Ptr(t, lf);
 829
 830	for (off = sizeof(struct RESTART_TABLE) + esize; e < last_free;
 831	     e = Add2Ptr(e, esize), off += esize) {
 832		*e = cpu_to_le32(off);
 833	}
 834	return t;
 835}
 836
 837static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl,
 838						  u32 add, u32 free_goal)
 839{
 840	u16 esize = le16_to_cpu(tbl->size);
 841	__le32 osize = cpu_to_le32(bytes_per_rt(tbl));
 842	u32 used = le16_to_cpu(tbl->used);
 843	struct RESTART_TABLE *rt;
 844
 845	rt = init_rsttbl(esize, used + add);
 846	if (!rt)
 847		return NULL;
 848
 849	memcpy(rt + 1, tbl + 1, esize * used);
 850
 851	rt->free_goal = free_goal == ~0u ?
 852				cpu_to_le32(~0u) :
 853				cpu_to_le32(sizeof(struct RESTART_TABLE) +
 854					    free_goal * esize);
 855
 856	if (tbl->first_free) {
 857		rt->first_free = tbl->first_free;
 858		*(__le32 *)Add2Ptr(rt, le32_to_cpu(tbl->last_free)) = osize;
 859	} else {
 860		rt->first_free = osize;
 861	}
 862
 863	rt->total = tbl->total;
 864
 865	kfree(tbl);
 866	return rt;
 867}
 868
 869/*
 870 * alloc_rsttbl_idx
 871 *
 872 * Allocate an index from within a previously initialized Restart Table.
 873 */
 874static inline void *alloc_rsttbl_idx(struct RESTART_TABLE **tbl)
 875{
 876	u32 off;
 877	__le32 *e;
 878	struct RESTART_TABLE *t = *tbl;
 879
 880	if (!t->first_free) {
 881		*tbl = t = extend_rsttbl(t, 16, ~0u);
 882		if (!t)
 883			return NULL;
 884	}
 885
 886	off = le32_to_cpu(t->first_free);
 887
 888	/* Dequeue this entry and zero it. */
 889	e = Add2Ptr(t, off);
 890
 891	t->first_free = *e;
 892
 893	memset(e, 0, le16_to_cpu(t->size));
 894
 895	*e = RESTART_ENTRY_ALLOCATED_LE;
 896
 897	/* If list is going empty, then we fix the last_free as well. */
 898	if (!t->first_free)
 899		t->last_free = 0;
 900
 901	le16_add_cpu(&t->total, 1);
 902
 903	return Add2Ptr(t, off);
 904}
 905
 906/*
 907 * alloc_rsttbl_from_idx
 908 *
 909 * Allocate a specific index from within a previously initialized Restart Table.
 910 */
 911static inline void *alloc_rsttbl_from_idx(struct RESTART_TABLE **tbl, u32 vbo)
 912{
 913	u32 off;
 914	__le32 *e;
 915	struct RESTART_TABLE *rt = *tbl;
 916	u32 bytes = bytes_per_rt(rt);
 917	u16 esize = le16_to_cpu(rt->size);
 918
 919	/* If the entry is not the table, we will have to extend the table. */
 920	if (vbo >= bytes) {
 921		/*
 922		 * Extend the size by computing the number of entries between
 923		 * the existing size and the desired index and adding 1 to that.
 924		 */
 925		u32 bytes2idx = vbo - bytes;
 926
 927		/*
 928		 * There should always be an integral number of entries
 929		 * being added. Now extend the table.
 930		 */
 931		*tbl = rt = extend_rsttbl(rt, bytes2idx / esize + 1, bytes);
 932		if (!rt)
 933			return NULL;
 934	}
 935
 936	/* See if the entry is already allocated, and just return if it is. */
 937	e = Add2Ptr(rt, vbo);
 938
 939	if (*e == RESTART_ENTRY_ALLOCATED_LE)
 940		return e;
 941
 942	/*
 943	 * Walk through the table, looking for the entry we're
 944	 * interested and the previous entry.
 945	 */
 946	off = le32_to_cpu(rt->first_free);
 947	e = Add2Ptr(rt, off);
 948
 949	if (off == vbo) {
 950		/* this is a match */
 951		rt->first_free = *e;
 952		goto skip_looking;
 953	}
 954
 955	/*
 956	 * Need to walk through the list looking for the predecessor
 957	 * of our entry.
 958	 */
 959	for (;;) {
 960		/* Remember the entry just found */
 961		u32 last_off = off;
 962		__le32 *last_e = e;
 963
 964		/* Should never run of entries. */
 965
 966		/* Lookup up the next entry the list. */
 967		off = le32_to_cpu(*last_e);
 968		e = Add2Ptr(rt, off);
 969
 970		/* If this is our match we are done. */
 971		if (off == vbo) {
 972			*last_e = *e;
 973
 974			/*
 975			 * If this was the last entry, we update that
 976			 * table as well.
 977			 */
 978			if (le32_to_cpu(rt->last_free) == off)
 979				rt->last_free = cpu_to_le32(last_off);
 980			break;
 981		}
 982	}
 983
 984skip_looking:
 985	/* If the list is now empty, we fix the last_free as well. */
 986	if (!rt->first_free)
 987		rt->last_free = 0;
 988
 989	/* Zero this entry. */
 990	memset(e, 0, esize);
 991	*e = RESTART_ENTRY_ALLOCATED_LE;
 992
 993	le16_add_cpu(&rt->total, 1);
 994
 995	return e;
 996}
 997
 998struct restart_info {
 999	u64 last_lsn;
1000	struct RESTART_HDR *r_page;
1001	u32 vbo;
1002	bool chkdsk_was_run;
1003	bool valid_page;
1004	bool initialized;
1005	bool restart;
1006};
1007
1008#define RESTART_SINGLE_PAGE_IO cpu_to_le16(0x0001)
1009
1010#define NTFSLOG_WRAPPED 0x00000001
1011#define NTFSLOG_MULTIPLE_PAGE_IO 0x00000002
1012#define NTFSLOG_NO_LAST_LSN 0x00000004
1013#define NTFSLOG_REUSE_TAIL 0x00000010
1014#define NTFSLOG_NO_OLDEST_LSN 0x00000020
1015
1016/* Helper struct to work with NTFS $LogFile. */
1017struct ntfs_log {
1018	struct ntfs_inode *ni;
1019
1020	u32 l_size;
1021	u32 orig_file_size;
1022	u32 sys_page_size;
1023	u32 sys_page_mask;
1024	u32 page_size;
1025	u32 page_mask; // page_size - 1
1026	u8 page_bits;
1027	struct RECORD_PAGE_HDR *one_page_buf;
1028
1029	struct RESTART_TABLE *open_attr_tbl;
1030	u32 transaction_id;
1031	u32 clst_per_page;
1032
1033	u32 first_page;
1034	u32 next_page;
1035	u32 ra_off;
1036	u32 data_off;
1037	u32 restart_size;
1038	u32 data_size;
1039	u16 record_header_len;
1040	u64 seq_num;
1041	u32 seq_num_bits;
1042	u32 file_data_bits;
1043	u32 seq_num_mask; /* (1 << file_data_bits) - 1 */
1044
1045	struct RESTART_AREA *ra; /* In-memory image of the next restart area. */
1046	u32 ra_size; /* The usable size of the restart area. */
1047
1048	/*
1049	 * If true, then the in-memory restart area is to be written
1050	 * to the first position on the disk.
1051	 */
1052	bool init_ra;
1053	bool set_dirty; /* True if we need to set dirty flag. */
1054
1055	u64 oldest_lsn;
1056
1057	u32 oldest_lsn_off;
1058	u64 last_lsn;
1059
1060	u32 total_avail;
1061	u32 total_avail_pages;
1062	u32 total_undo_commit;
1063	u32 max_current_avail;
1064	u32 current_avail;
1065	u32 reserved;
1066
1067	short major_ver;
1068	short minor_ver;
1069
1070	u32 l_flags; /* See NTFSLOG_XXX */
1071	u32 current_openlog_count; /* On-disk value for open_log_count. */
1072
1073	struct CLIENT_ID client_id;
1074	u32 client_undo_commit;
1075
1076	struct restart_info rst_info, rst_info2;
1077};
1078
1079static inline u32 lsn_to_vbo(struct ntfs_log *log, const u64 lsn)
1080{
1081	u32 vbo = (lsn << log->seq_num_bits) >> (log->seq_num_bits - 3);
1082
1083	return vbo;
1084}
1085
1086/* Compute the offset in the log file of the next log page. */
1087static inline u32 next_page_off(struct ntfs_log *log, u32 off)
1088{
1089	off = (off & ~log->sys_page_mask) + log->page_size;
1090	return off >= log->l_size ? log->first_page : off;
1091}
1092
1093static inline u32 lsn_to_page_off(struct ntfs_log *log, u64 lsn)
1094{
1095	return (((u32)lsn) << 3) & log->page_mask;
1096}
1097
1098static inline u64 vbo_to_lsn(struct ntfs_log *log, u32 off, u64 Seq)
1099{
1100	return (off >> 3) + (Seq << log->file_data_bits);
1101}
1102
1103static inline bool is_lsn_in_file(struct ntfs_log *log, u64 lsn)
1104{
1105	return lsn >= log->oldest_lsn &&
1106	       lsn <= le64_to_cpu(log->ra->current_lsn);
1107}
1108
1109static inline u32 hdr_file_off(struct ntfs_log *log,
1110			       struct RECORD_PAGE_HDR *hdr)
1111{
1112	if (log->major_ver < 2)
1113		return le64_to_cpu(hdr->rhdr.lsn);
1114
1115	return le32_to_cpu(hdr->file_off);
1116}
1117
1118static inline u64 base_lsn(struct ntfs_log *log,
1119			   const struct RECORD_PAGE_HDR *hdr, u64 lsn)
1120{
1121	u64 h_lsn = le64_to_cpu(hdr->rhdr.lsn);
1122	u64 ret = (((h_lsn >> log->file_data_bits) +
1123		    (lsn < (lsn_to_vbo(log, h_lsn) & ~log->page_mask) ? 1 : 0))
1124		   << log->file_data_bits) +
1125		  ((((is_log_record_end(hdr) &&
1126		      h_lsn <= le64_to_cpu(hdr->record_hdr.last_end_lsn)) ?
1127			     le16_to_cpu(hdr->record_hdr.next_record_off) :
1128			     log->page_size) +
1129		    lsn) >>
1130		   3);
1131
1132	return ret;
1133}
1134
1135static inline bool verify_client_lsn(struct ntfs_log *log,
1136				     const struct CLIENT_REC *client, u64 lsn)
1137{
1138	return lsn >= le64_to_cpu(client->oldest_lsn) &&
1139	       lsn <= le64_to_cpu(log->ra->current_lsn) && lsn;
1140}
1141
1142static int read_log_page(struct ntfs_log *log, u32 vbo,
1143			 struct RECORD_PAGE_HDR **buffer, bool *usa_error)
1144{
1145	int err = 0;
1146	u32 page_idx = vbo >> log->page_bits;
1147	u32 page_off = vbo & log->page_mask;
1148	u32 bytes = log->page_size - page_off;
1149	void *to_free = NULL;
1150	u32 page_vbo = page_idx << log->page_bits;
1151	struct RECORD_PAGE_HDR *page_buf;
1152	struct ntfs_inode *ni = log->ni;
1153	bool bBAAD;
1154
1155	if (vbo >= log->l_size)
1156		return -EINVAL;
1157
1158	if (!*buffer) {
1159		to_free = kmalloc(log->page_size, GFP_NOFS);
1160		if (!to_free)
1161			return -ENOMEM;
1162		*buffer = to_free;
1163	}
1164
1165	page_buf = page_off ? log->one_page_buf : *buffer;
1166
1167	err = ntfs_read_run_nb(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,
1168			       log->page_size, NULL);
1169	if (err)
1170		goto out;
1171
1172	if (page_buf->rhdr.sign != NTFS_FFFF_SIGNATURE)
1173		ntfs_fix_post_read(&page_buf->rhdr, PAGE_SIZE, false);
1174
1175	if (page_buf != *buffer)
1176		memcpy(*buffer, Add2Ptr(page_buf, page_off), bytes);
1177
1178	bBAAD = page_buf->rhdr.sign == NTFS_BAAD_SIGNATURE;
1179
1180	if (usa_error)
1181		*usa_error = bBAAD;
1182	/* Check that the update sequence array for this page is valid */
1183	/* If we don't allow errors, raise an error status */
1184	else if (bBAAD)
1185		err = -EINVAL;
1186
1187out:
1188	if (err && to_free) {
1189		kfree(to_free);
1190		*buffer = NULL;
1191	}
1192
1193	return err;
1194}
1195
1196/*
1197 * log_read_rst
1198 *
1199 * It walks through 512 blocks of the file looking for a valid
1200 * restart page header. It will stop the first time we find a
1201 * valid page header.
1202 */
1203static int log_read_rst(struct ntfs_log *log, bool first,
1204			struct restart_info *info)
1205{
1206	u32 skip;
1207	u64 vbo;
1208	struct RESTART_HDR *r_page = NULL;
1209
1210	/* Determine which restart area we are looking for. */
1211	if (first) {
1212		vbo = 0;
1213		skip = 512;
1214	} else {
1215		vbo = 512;
1216		skip = 0;
1217	}
1218
1219	/* Loop continuously until we succeed. */
1220	for (; vbo < log->l_size; vbo = 2 * vbo + skip, skip = 0) {
1221		bool usa_error;
1222		bool brst, bchk;
1223		struct RESTART_AREA *ra;
1224
1225		/* Read a page header at the current offset. */
1226		if (read_log_page(log, vbo, (struct RECORD_PAGE_HDR **)&r_page,
1227				  &usa_error)) {
1228			/* Ignore any errors. */
1229			continue;
1230		}
1231
1232		/* Exit if the signature is a log record page. */
1233		if (r_page->rhdr.sign == NTFS_RCRD_SIGNATURE) {
1234			info->initialized = true;
1235			break;
1236		}
1237
1238		brst = r_page->rhdr.sign == NTFS_RSTR_SIGNATURE;
1239		bchk = r_page->rhdr.sign == NTFS_CHKD_SIGNATURE;
1240
1241		if (!bchk && !brst) {
1242			if (r_page->rhdr.sign != NTFS_FFFF_SIGNATURE) {
1243				/*
1244				 * Remember if the signature does not
1245				 * indicate uninitialized file.
1246				 */
1247				info->initialized = true;
1248			}
1249			continue;
1250		}
1251
1252		ra = NULL;
1253		info->valid_page = false;
1254		info->initialized = true;
1255		info->vbo = vbo;
1256
1257		/* Let's check the restart area if this is a valid page. */
1258		if (!is_rst_page_hdr_valid(vbo, r_page))
1259			goto check_result;
1260		ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1261
1262		if (!is_rst_area_valid(r_page))
1263			goto check_result;
1264
1265		/*
1266		 * We have a valid restart page header and restart area.
1267		 * If chkdsk was run or we have no clients then we have
1268		 * no more checking to do.
1269		 */
1270		if (bchk || ra->client_idx[1] == LFS_NO_CLIENT_LE) {
1271			info->valid_page = true;
1272			goto check_result;
1273		}
1274
1275		if (is_client_area_valid(r_page, usa_error)) {
1276			info->valid_page = true;
1277			ra = Add2Ptr(r_page, le16_to_cpu(r_page->ra_off));
1278		}
1279
1280check_result:
1281		/*
1282		 * If chkdsk was run then update the caller's
1283		 * values and return.
1284		 */
1285		if (r_page->rhdr.sign == NTFS_CHKD_SIGNATURE) {
1286			info->chkdsk_was_run = true;
1287			info->last_lsn = le64_to_cpu(r_page->rhdr.lsn);
1288			info->restart = true;
1289			info->r_page = r_page;
1290			return 0;
1291		}
1292
1293		/*
1294		 * If we have a valid page then copy the values
1295		 * we need from it.
1296		 */
1297		if (info->valid_page) {
1298			info->last_lsn = le64_to_cpu(ra->current_lsn);
1299			info->restart = true;
1300			info->r_page = r_page;
1301			return 0;
1302		}
1303	}
1304
1305	kfree(r_page);
1306
1307	return 0;
1308}
1309
1310/*
1311 * Ilog_init_pg_hdr - Init @log from restart page header.
1312 */
1313static void log_init_pg_hdr(struct ntfs_log *log, u16 major_ver, u16 minor_ver)
1314{
1315	log->sys_page_size = log->page_size;
1316	log->sys_page_mask = log->page_mask;
1317
1318	log->clst_per_page = log->page_size >> log->ni->mi.sbi->cluster_bits;
1319	if (!log->clst_per_page)
1320		log->clst_per_page = 1;
1321
1322	log->first_page = major_ver >= 2 ? 0x22 * log->page_size :
1323					   4 * log->page_size;
1324	log->major_ver = major_ver;
1325	log->minor_ver = minor_ver;
1326}
1327
1328/*
1329 * log_create - Init @log in cases when we don't have a restart area to use.
1330 */
1331static void log_create(struct ntfs_log *log, const u64 last_lsn,
1332		       u32 open_log_count, bool wrapped, bool use_multi_page)
1333{
1334	/* All file offsets must be quadword aligned. */
1335	log->file_data_bits = blksize_bits(log->l_size) - 3;
1336	log->seq_num_mask = (8 << log->file_data_bits) - 1;
1337	log->seq_num_bits = sizeof(u64) * 8 - log->file_data_bits;
1338	log->seq_num = (last_lsn >> log->file_data_bits) + 2;
1339	log->next_page = log->first_page;
1340	log->oldest_lsn = log->seq_num << log->file_data_bits;
1341	log->oldest_lsn_off = 0;
1342	log->last_lsn = log->oldest_lsn;
1343
1344	log->l_flags |= NTFSLOG_NO_LAST_LSN | NTFSLOG_NO_OLDEST_LSN;
1345
1346	/* Set the correct flags for the I/O and indicate if we have wrapped. */
1347	if (wrapped)
1348		log->l_flags |= NTFSLOG_WRAPPED;
1349
1350	if (use_multi_page)
1351		log->l_flags |= NTFSLOG_MULTIPLE_PAGE_IO;
1352
1353	/* Compute the log page values. */
1354	log->data_off = ALIGN(
1355		offsetof(struct RECORD_PAGE_HDR, fixups) +
1356			sizeof(short) * ((log->page_size >> SECTOR_SHIFT) + 1),
1357		8);
1358	log->data_size = log->page_size - log->data_off;
1359	log->record_header_len = sizeof(struct LFS_RECORD_HDR);
1360
1361	/* Remember the different page sizes for reservation. */
1362	log->reserved = log->data_size - log->record_header_len;
1363
1364	/* Compute the restart page values. */
1365	log->ra_off = ALIGN(
1366		offsetof(struct RESTART_HDR, fixups) +
1367			sizeof(short) *
1368				((log->sys_page_size >> SECTOR_SHIFT) + 1),
1369		8);
1370	log->restart_size = log->sys_page_size - log->ra_off;
1371	log->ra_size = struct_size(log->ra, clients, 1);
1372	log->current_openlog_count = open_log_count;
1373
1374	/*
1375	 * The total available log file space is the number of
1376	 * log file pages times the space available on each page.
1377	 */
1378	log->total_avail_pages = log->l_size - log->first_page;
1379	log->total_avail = log->total_avail_pages >> log->page_bits;
1380
1381	/*
1382	 * We assume that we can't use the end of the page less than
1383	 * the file record size.
1384	 * Then we won't need to reserve more than the caller asks for.
1385	 */
1386	log->max_current_avail = log->total_avail * log->reserved;
1387	log->total_avail = log->total_avail * log->data_size;
1388	log->current_avail = log->max_current_avail;
1389}
1390
1391/*
1392 * log_create_ra - Fill a restart area from the values stored in @log.
1393 */
1394static struct RESTART_AREA *log_create_ra(struct ntfs_log *log)
1395{
1396	struct CLIENT_REC *cr;
1397	struct RESTART_AREA *ra = kzalloc(log->restart_size, GFP_NOFS);
1398
1399	if (!ra)
1400		return NULL;
1401
1402	ra->current_lsn = cpu_to_le64(log->last_lsn);
1403	ra->log_clients = cpu_to_le16(1);
1404	ra->client_idx[1] = LFS_NO_CLIENT_LE;
1405	if (log->l_flags & NTFSLOG_MULTIPLE_PAGE_IO)
1406		ra->flags = RESTART_SINGLE_PAGE_IO;
1407	ra->seq_num_bits = cpu_to_le32(log->seq_num_bits);
1408	ra->ra_len = cpu_to_le16(log->ra_size);
1409	ra->client_off = cpu_to_le16(offsetof(struct RESTART_AREA, clients));
1410	ra->l_size = cpu_to_le64(log->l_size);
1411	ra->rec_hdr_len = cpu_to_le16(log->record_header_len);
1412	ra->data_off = cpu_to_le16(log->data_off);
1413	ra->open_log_count = cpu_to_le32(log->current_openlog_count + 1);
1414
1415	cr = ra->clients;
1416
1417	cr->prev_client = LFS_NO_CLIENT_LE;
1418	cr->next_client = LFS_NO_CLIENT_LE;
1419
1420	return ra;
1421}
1422
1423static u32 final_log_off(struct ntfs_log *log, u64 lsn, u32 data_len)
1424{
1425	u32 base_vbo = lsn << 3;
1426	u32 final_log_off = (base_vbo & log->seq_num_mask) & ~log->page_mask;
1427	u32 page_off = base_vbo & log->page_mask;
1428	u32 tail = log->page_size - page_off;
1429
1430	page_off -= 1;
1431
1432	/* Add the length of the header. */
1433	data_len += log->record_header_len;
1434
1435	/*
1436	 * If this lsn is contained this log page we are done.
1437	 * Otherwise we need to walk through several log pages.
1438	 */
1439	if (data_len > tail) {
1440		data_len -= tail;
1441		tail = log->data_size;
1442		page_off = log->data_off - 1;
1443
1444		for (;;) {
1445			final_log_off = next_page_off(log, final_log_off);
1446
1447			/*
1448			 * We are done if the remaining bytes
1449			 * fit on this page.
1450			 */
1451			if (data_len <= tail)
1452				break;
1453			data_len -= tail;
1454		}
1455	}
1456
1457	/*
1458	 * We add the remaining bytes to our starting position on this page
1459	 * and then add that value to the file offset of this log page.
1460	 */
1461	return final_log_off + data_len + page_off;
1462}
1463
1464static int next_log_lsn(struct ntfs_log *log, const struct LFS_RECORD_HDR *rh,
1465			u64 *lsn)
1466{
1467	int err;
1468	u64 this_lsn = le64_to_cpu(rh->this_lsn);
1469	u32 vbo = lsn_to_vbo(log, this_lsn);
1470	u32 end =
1471		final_log_off(log, this_lsn, le32_to_cpu(rh->client_data_len));
1472	u32 hdr_off = end & ~log->sys_page_mask;
1473	u64 seq = this_lsn >> log->file_data_bits;
1474	struct RECORD_PAGE_HDR *page = NULL;
1475
1476	/* Remember if we wrapped. */
1477	if (end <= vbo)
1478		seq += 1;
1479
1480	/* Log page header for this page. */
1481	err = read_log_page(log, hdr_off, &page, NULL);
1482	if (err)
1483		return err;
1484
1485	/*
1486	 * If the lsn we were given was not the last lsn on this page,
1487	 * then the starting offset for the next lsn is on a quad word
1488	 * boundary following the last file offset for the current lsn.
1489	 * Otherwise the file offset is the start of the data on the next page.
1490	 */
1491	if (this_lsn == le64_to_cpu(page->rhdr.lsn)) {
1492		/* If we wrapped, we need to increment the sequence number. */
1493		hdr_off = next_page_off(log, hdr_off);
1494		if (hdr_off == log->first_page)
1495			seq += 1;
1496
1497		vbo = hdr_off + log->data_off;
1498	} else {
1499		vbo = ALIGN(end, 8);
1500	}
1501
1502	/* Compute the lsn based on the file offset and the sequence count. */
1503	*lsn = vbo_to_lsn(log, vbo, seq);
1504
1505	/*
1506	 * If this lsn is within the legal range for the file, we return true.
1507	 * Otherwise false indicates that there are no more lsn's.
1508	 */
1509	if (!is_lsn_in_file(log, *lsn))
1510		*lsn = 0;
1511
1512	kfree(page);
1513
1514	return 0;
1515}
1516
1517/*
1518 * current_log_avail - Calculate the number of bytes available for log records.
1519 */
1520static u32 current_log_avail(struct ntfs_log *log)
1521{
1522	u32 oldest_off, next_free_off, free_bytes;
1523
1524	if (log->l_flags & NTFSLOG_NO_LAST_LSN) {
1525		/* The entire file is available. */
1526		return log->max_current_avail;
1527	}
1528
1529	/*
1530	 * If there is a last lsn the restart area then we know that we will
1531	 * have to compute the free range.
1532	 * If there is no oldest lsn then start at the first page of the file.
1533	 */
1534	oldest_off = (log->l_flags & NTFSLOG_NO_OLDEST_LSN) ?
1535			     log->first_page :
1536			     (log->oldest_lsn_off & ~log->sys_page_mask);
1537
1538	/*
1539	 * We will use the next log page offset to compute the next free page.
1540	 * If we are going to reuse this page go to the next page.
1541	 * If we are at the first page then use the end of the file.
1542	 */
1543	next_free_off = (log->l_flags & NTFSLOG_REUSE_TAIL) ?
1544				log->next_page + log->page_size :
1545			log->next_page == log->first_page ? log->l_size :
1546							    log->next_page;
1547
1548	/* If the two offsets are the same then there is no available space. */
1549	if (oldest_off == next_free_off)
1550		return 0;
1551	/*
1552	 * If the free offset follows the oldest offset then subtract
1553	 * this range from the total available pages.
1554	 */
1555	free_bytes =
1556		oldest_off < next_free_off ?
1557			log->total_avail_pages - (next_free_off - oldest_off) :
1558			oldest_off - next_free_off;
1559
1560	free_bytes >>= log->page_bits;
1561	return free_bytes * log->reserved;
1562}
1563
1564static bool check_subseq_log_page(struct ntfs_log *log,
1565				  const struct RECORD_PAGE_HDR *rp, u32 vbo,
1566				  u64 seq)
1567{
1568	u64 lsn_seq;
1569	const struct NTFS_RECORD_HEADER *rhdr = &rp->rhdr;
1570	u64 lsn = le64_to_cpu(rhdr->lsn);
1571
1572	if (rhdr->sign == NTFS_FFFF_SIGNATURE || !rhdr->sign)
1573		return false;
1574
1575	/*
1576	 * If the last lsn on the page occurs was written after the page
1577	 * that caused the original error then we have a fatal error.
1578	 */
1579	lsn_seq = lsn >> log->file_data_bits;
1580
1581	/*
1582	 * If the sequence number for the lsn the page is equal or greater
1583	 * than lsn we expect, then this is a subsequent write.
1584	 */
1585	return lsn_seq >= seq ||
1586	       (lsn_seq == seq - 1 && log->first_page == vbo &&
1587		vbo != (lsn_to_vbo(log, lsn) & ~log->page_mask));
1588}
1589
1590/*
1591 * last_log_lsn
1592 *
1593 * Walks through the log pages for a file, searching for the
1594 * last log page written to the file.
1595 */
1596static int last_log_lsn(struct ntfs_log *log)
1597{
1598	int err;
1599	bool usa_error = false;
1600	bool replace_page = false;
1601	bool reuse_page = log->l_flags & NTFSLOG_REUSE_TAIL;
1602	bool wrapped_file, wrapped;
1603
1604	u32 page_cnt = 1, page_pos = 1;
1605	u32 page_off = 0, page_off1 = 0, saved_off = 0;
1606	u32 final_off, second_off, final_off_prev = 0, second_off_prev = 0;
1607	u32 first_file_off = 0, second_file_off = 0;
1608	u32 part_io_count = 0;
1609	u32 tails = 0;
1610	u32 this_off, curpage_off, nextpage_off, remain_pages;
1611
1612	u64 expected_seq, seq_base = 0, lsn_base = 0;
1613	u64 best_lsn, best_lsn1, best_lsn2;
1614	u64 lsn_cur, lsn1, lsn2;
1615	u64 last_ok_lsn = reuse_page ? log->last_lsn : 0;
1616
1617	u16 cur_pos, best_page_pos;
1618
1619	struct RECORD_PAGE_HDR *page = NULL;
1620	struct RECORD_PAGE_HDR *tst_page = NULL;
1621	struct RECORD_PAGE_HDR *first_tail = NULL;
1622	struct RECORD_PAGE_HDR *second_tail = NULL;
1623	struct RECORD_PAGE_HDR *tail_page = NULL;
1624	struct RECORD_PAGE_HDR *second_tail_prev = NULL;
1625	struct RECORD_PAGE_HDR *first_tail_prev = NULL;
1626	struct RECORD_PAGE_HDR *page_bufs = NULL;
1627	struct RECORD_PAGE_HDR *best_page;
1628
1629	if (log->major_ver >= 2) {
1630		final_off = 0x02 * log->page_size;
1631		second_off = 0x12 * log->page_size;
1632
1633		// 0x10 == 0x12 - 0x2
1634		page_bufs = kmalloc(log->page_size * 0x10, GFP_NOFS);
1635		if (!page_bufs)
1636			return -ENOMEM;
1637	} else {
1638		second_off = log->first_page - log->page_size;
1639		final_off = second_off - log->page_size;
1640	}
1641
1642next_tail:
1643	/* Read second tail page (at pos 3/0x12000). */
1644	if (read_log_page(log, second_off, &second_tail, &usa_error) ||
1645	    usa_error || second_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1646		kfree(second_tail);
1647		second_tail = NULL;
1648		second_file_off = 0;
1649		lsn2 = 0;
1650	} else {
1651		second_file_off = hdr_file_off(log, second_tail);
1652		lsn2 = le64_to_cpu(second_tail->record_hdr.last_end_lsn);
1653	}
1654
1655	/* Read first tail page (at pos 2/0x2000). */
1656	if (read_log_page(log, final_off, &first_tail, &usa_error) ||
1657	    usa_error || first_tail->rhdr.sign != NTFS_RCRD_SIGNATURE) {
1658		kfree(first_tail);
1659		first_tail = NULL;
1660		first_file_off = 0;
1661		lsn1 = 0;
1662	} else {
1663		first_file_off = hdr_file_off(log, first_tail);
1664		lsn1 = le64_to_cpu(first_tail->record_hdr.last_end_lsn);
1665	}
1666
1667	if (log->major_ver < 2) {
1668		int best_page;
1669
1670		first_tail_prev = first_tail;
1671		final_off_prev = first_file_off;
1672		second_tail_prev = second_tail;
1673		second_off_prev = second_file_off;
1674		tails = 1;
1675
1676		if (!first_tail && !second_tail)
1677			goto tail_read;
1678
1679		if (first_tail && second_tail)
1680			best_page = lsn1 < lsn2 ? 1 : 0;
1681		else if (first_tail)
1682			best_page = 0;
1683		else
1684			best_page = 1;
1685
1686		page_off = best_page ? second_file_off : first_file_off;
1687		seq_base = (best_page ? lsn2 : lsn1) >> log->file_data_bits;
1688		goto tail_read;
1689	}
1690
1691	best_lsn1 = first_tail ? base_lsn(log, first_tail, first_file_off) : 0;
1692	best_lsn2 = second_tail ? base_lsn(log, second_tail, second_file_off) :
1693				  0;
1694
1695	if (first_tail && second_tail) {
1696		if (best_lsn1 > best_lsn2) {
1697			best_lsn = best_lsn1;
1698			best_page = first_tail;
1699			this_off = first_file_off;
1700		} else {
1701			best_lsn = best_lsn2;
1702			best_page = second_tail;
1703			this_off = second_file_off;
1704		}
1705	} else if (first_tail) {
1706		best_lsn = best_lsn1;
1707		best_page = first_tail;
1708		this_off = first_file_off;
1709	} else if (second_tail) {
1710		best_lsn = best_lsn2;
1711		best_page = second_tail;
1712		this_off = second_file_off;
1713	} else {
1714		goto tail_read;
1715	}
1716
1717	best_page_pos = le16_to_cpu(best_page->page_pos);
1718
1719	if (!tails) {
1720		if (best_page_pos == page_pos) {
1721			seq_base = best_lsn >> log->file_data_bits;
1722			saved_off = page_off = le32_to_cpu(best_page->file_off);
1723			lsn_base = best_lsn;
1724
1725			memmove(page_bufs, best_page, log->page_size);
1726
1727			page_cnt = le16_to_cpu(best_page->page_count);
1728			if (page_cnt > 1)
1729				page_pos += 1;
1730
1731			tails = 1;
1732		}
1733	} else if (seq_base == (best_lsn >> log->file_data_bits) &&
1734		   saved_off + log->page_size == this_off &&
1735		   lsn_base < best_lsn &&
1736		   (page_pos != page_cnt || best_page_pos == page_pos ||
1737		    best_page_pos == 1) &&
1738		   (page_pos >= page_cnt || best_page_pos == page_pos)) {
1739		u16 bppc = le16_to_cpu(best_page->page_count);
1740
1741		saved_off += log->page_size;
1742		lsn_base = best_lsn;
1743
1744		memmove(Add2Ptr(page_bufs, tails * log->page_size), best_page,
1745			log->page_size);
1746
1747		tails += 1;
1748
1749		if (best_page_pos != bppc) {
1750			page_cnt = bppc;
1751			page_pos = best_page_pos;
1752
1753			if (page_cnt > 1)
1754				page_pos += 1;
1755		} else {
1756			page_pos = page_cnt = 1;
1757		}
1758	} else {
1759		kfree(first_tail);
1760		kfree(second_tail);
1761		goto tail_read;
1762	}
1763
1764	kfree(first_tail_prev);
1765	first_tail_prev = first_tail;
1766	final_off_prev = first_file_off;
1767	first_tail = NULL;
1768
1769	kfree(second_tail_prev);
1770	second_tail_prev = second_tail;
1771	second_off_prev = second_file_off;
1772	second_tail = NULL;
1773
1774	final_off += log->page_size;
1775	second_off += log->page_size;
1776
1777	if (tails < 0x10)
1778		goto next_tail;
1779tail_read:
1780	first_tail = first_tail_prev;
1781	final_off = final_off_prev;
1782
1783	second_tail = second_tail_prev;
1784	second_off = second_off_prev;
1785
1786	page_cnt = page_pos = 1;
1787
1788	curpage_off = seq_base == log->seq_num ? min(log->next_page, page_off) :
1789						 log->next_page;
1790
1791	wrapped_file =
1792		curpage_off == log->first_page &&
1793		!(log->l_flags & (NTFSLOG_NO_LAST_LSN | NTFSLOG_REUSE_TAIL));
1794
1795	expected_seq = wrapped_file ? (log->seq_num + 1) : log->seq_num;
1796
1797	nextpage_off = curpage_off;
1798
1799next_page:
1800	tail_page = NULL;
1801	/* Read the next log page. */
1802	err = read_log_page(log, curpage_off, &page, &usa_error);
1803
1804	/* Compute the next log page offset the file. */
1805	nextpage_off = next_page_off(log, curpage_off);
1806	wrapped = nextpage_off == log->first_page;
1807
1808	if (tails > 1) {
1809		struct RECORD_PAGE_HDR *cur_page =
1810			Add2Ptr(page_bufs, curpage_off - page_off);
1811
1812		if (curpage_off == saved_off) {
1813			tail_page = cur_page;
1814			goto use_tail_page;
1815		}
1816
1817		if (page_off > curpage_off || curpage_off >= saved_off)
1818			goto use_tail_page;
1819
1820		if (page_off1)
1821			goto use_cur_page;
1822
1823		if (!err && !usa_error &&
1824		    page->rhdr.sign == NTFS_RCRD_SIGNATURE &&
1825		    cur_page->rhdr.lsn == page->rhdr.lsn &&
1826		    cur_page->record_hdr.next_record_off ==
1827			    page->record_hdr.next_record_off &&
1828		    ((page_pos == page_cnt &&
1829		      le16_to_cpu(page->page_pos) == 1) ||
1830		     (page_pos != page_cnt &&
1831		      le16_to_cpu(page->page_pos) == page_pos + 1 &&
1832		      le16_to_cpu(page->page_count) == page_cnt))) {
1833			cur_page = NULL;
1834			goto use_tail_page;
1835		}
1836
1837		page_off1 = page_off;
1838
1839use_cur_page:
1840
1841		lsn_cur = le64_to_cpu(cur_page->rhdr.lsn);
1842
1843		if (last_ok_lsn !=
1844			    le64_to_cpu(cur_page->record_hdr.last_end_lsn) &&
1845		    ((lsn_cur >> log->file_data_bits) +
1846		     ((curpage_off <
1847		       (lsn_to_vbo(log, lsn_cur) & ~log->page_mask)) ?
1848			      1 :
1849			      0)) != expected_seq) {
1850			goto check_tail;
1851		}
1852
1853		if (!is_log_record_end(cur_page)) {
1854			tail_page = NULL;
1855			last_ok_lsn = lsn_cur;
1856			goto next_page_1;
1857		}
1858
1859		log->seq_num = expected_seq;
1860		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1861		log->last_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1862		log->ra->current_lsn = cur_page->record_hdr.last_end_lsn;
1863
1864		if (log->record_header_len <=
1865		    log->page_size -
1866			    le16_to_cpu(cur_page->record_hdr.next_record_off)) {
1867			log->l_flags |= NTFSLOG_REUSE_TAIL;
1868			log->next_page = curpage_off;
1869		} else {
1870			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
1871			log->next_page = nextpage_off;
1872		}
1873
1874		if (wrapped_file)
1875			log->l_flags |= NTFSLOG_WRAPPED;
1876
1877		last_ok_lsn = le64_to_cpu(cur_page->record_hdr.last_end_lsn);
1878		goto next_page_1;
1879	}
1880
1881	/*
1882	 * If we are at the expected first page of a transfer check to see
1883	 * if either tail copy is at this offset.
1884	 * If this page is the last page of a transfer, check if we wrote
1885	 * a subsequent tail copy.
1886	 */
1887	if (page_cnt == page_pos || page_cnt == page_pos + 1) {
1888		/*
1889		 * Check if the offset matches either the first or second
1890		 * tail copy. It is possible it will match both.
1891		 */
1892		if (curpage_off == final_off)
1893			tail_page = first_tail;
1894
1895		/*
1896		 * If we already matched on the first page then
1897		 * check the ending lsn's.
1898		 */
1899		if (curpage_off == second_off) {
1900			if (!tail_page ||
1901			    (second_tail &&
1902			     le64_to_cpu(second_tail->record_hdr.last_end_lsn) >
1903				     le64_to_cpu(first_tail->record_hdr
1904							 .last_end_lsn))) {
1905				tail_page = second_tail;
1906			}
1907		}
1908	}
1909
1910use_tail_page:
1911	if (tail_page) {
1912		/* We have a candidate for a tail copy. */
1913		lsn_cur = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
1914
1915		if (last_ok_lsn < lsn_cur) {
1916			/*
1917			 * If the sequence number is not expected,
1918			 * then don't use the tail copy.
1919			 */
1920			if (expected_seq != (lsn_cur >> log->file_data_bits))
1921				tail_page = NULL;
1922		} else if (last_ok_lsn > lsn_cur) {
1923			/*
1924			 * If the last lsn is greater than the one on
1925			 * this page then forget this tail.
1926			 */
1927			tail_page = NULL;
1928		}
1929	}
1930
1931	/*
1932	 *If we have an error on the current page,
1933	 * we will break of this loop.
1934	 */
1935	if (err || usa_error)
1936		goto check_tail;
1937
1938	/*
1939	 * Done if the last lsn on this page doesn't match the previous known
1940	 * last lsn or the sequence number is not expected.
1941	 */
1942	lsn_cur = le64_to_cpu(page->rhdr.lsn);
1943	if (last_ok_lsn != lsn_cur &&
1944	    expected_seq != (lsn_cur >> log->file_data_bits)) {
1945		goto check_tail;
1946	}
1947
1948	/*
1949	 * Check that the page position and page count values are correct.
1950	 * If this is the first page of a transfer the position must be 1
1951	 * and the count will be unknown.
1952	 */
1953	if (page_cnt == page_pos) {
1954		if (page->page_pos != cpu_to_le16(1) &&
1955		    (!reuse_page || page->page_pos != page->page_count)) {
1956			/*
1957			 * If the current page is the first page we are
1958			 * looking at and we are reusing this page then
1959			 * it can be either the first or last page of a
1960			 * transfer. Otherwise it can only be the first.
1961			 */
1962			goto check_tail;
1963		}
1964	} else if (le16_to_cpu(page->page_count) != page_cnt ||
1965		   le16_to_cpu(page->page_pos) != page_pos + 1) {
1966		/*
1967		 * The page position better be 1 more than the last page
1968		 * position and the page count better match.
1969		 */
1970		goto check_tail;
1971	}
1972
1973	/*
1974	 * We have a valid page the file and may have a valid page
1975	 * the tail copy area.
1976	 * If the tail page was written after the page the file then
1977	 * break of the loop.
1978	 */
1979	if (tail_page &&
1980	    le64_to_cpu(tail_page->record_hdr.last_end_lsn) > lsn_cur) {
1981		/* Remember if we will replace the page. */
1982		replace_page = true;
1983		goto check_tail;
1984	}
1985
1986	tail_page = NULL;
1987
1988	if (is_log_record_end(page)) {
1989		/*
1990		 * Since we have read this page we know the sequence number
1991		 * is the same as our expected value.
1992		 */
1993		log->seq_num = expected_seq;
1994		log->last_lsn = le64_to_cpu(page->record_hdr.last_end_lsn);
1995		log->ra->current_lsn = page->record_hdr.last_end_lsn;
1996		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
1997
1998		/*
1999		 * If there is room on this page for another header then
2000		 * remember we want to reuse the page.
2001		 */
2002		if (log->record_header_len <=
2003		    log->page_size -
2004			    le16_to_cpu(page->record_hdr.next_record_off)) {
2005			log->l_flags |= NTFSLOG_REUSE_TAIL;
2006			log->next_page = curpage_off;
2007		} else {
2008			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2009			log->next_page = nextpage_off;
2010		}
2011
2012		/* Remember if we wrapped the log file. */
2013		if (wrapped_file)
2014			log->l_flags |= NTFSLOG_WRAPPED;
2015	}
2016
2017	/*
2018	 * Remember the last page count and position.
2019	 * Also remember the last known lsn.
2020	 */
2021	page_cnt = le16_to_cpu(page->page_count);
2022	page_pos = le16_to_cpu(page->page_pos);
2023	last_ok_lsn = le64_to_cpu(page->rhdr.lsn);
2024
2025next_page_1:
2026
2027	if (wrapped) {
2028		expected_seq += 1;
2029		wrapped_file = 1;
2030	}
2031
2032	curpage_off = nextpage_off;
2033	kfree(page);
2034	page = NULL;
2035	reuse_page = 0;
2036	goto next_page;
2037
2038check_tail:
2039	if (tail_page) {
2040		log->seq_num = expected_seq;
2041		log->last_lsn = le64_to_cpu(tail_page->record_hdr.last_end_lsn);
2042		log->ra->current_lsn = tail_page->record_hdr.last_end_lsn;
2043		log->l_flags &= ~NTFSLOG_NO_LAST_LSN;
2044
2045		if (log->page_size -
2046			    le16_to_cpu(
2047				    tail_page->record_hdr.next_record_off) >=
2048		    log->record_header_len) {
2049			log->l_flags |= NTFSLOG_REUSE_TAIL;
2050			log->next_page = curpage_off;
2051		} else {
2052			log->l_flags &= ~NTFSLOG_REUSE_TAIL;
2053			log->next_page = nextpage_off;
2054		}
2055
2056		if (wrapped)
2057			log->l_flags |= NTFSLOG_WRAPPED;
2058	}
2059
2060	/* Remember that the partial IO will start at the next page. */
2061	second_off = nextpage_off;
2062
2063	/*
2064	 * If the next page is the first page of the file then update
2065	 * the sequence number for log records which begon the next page.
2066	 */
2067	if (wrapped)
2068		expected_seq += 1;
2069
2070	/*
2071	 * If we have a tail copy or are performing single page I/O we can
2072	 * immediately look at the next page.
2073	 */
2074	if (replace_page || (log->ra->flags & RESTART_SINGLE_PAGE_IO)) {
2075		page_cnt = 2;
2076		page_pos = 1;
2077		goto check_valid;
2078	}
2079
2080	if (page_pos != page_cnt)
2081		goto check_valid;
2082	/*
2083	 * If the next page causes us to wrap to the beginning of the log
2084	 * file then we know which page to check next.
2085	 */
2086	if (wrapped) {
2087		page_cnt = 2;
2088		page_pos = 1;
2089		goto check_valid;
2090	}
2091
2092	cur_pos = 2;
2093
2094next_test_page:
2095	kfree(tst_page);
2096	tst_page = NULL;
2097
2098	/* Walk through the file, reading log pages. */
2099	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2100
2101	/*
2102	 * If we get a USA error then assume that we correctly found
2103	 * the end of the original transfer.
2104	 */
2105	if (usa_error)
2106		goto file_is_valid;
2107
2108	/*
2109	 * If we were able to read the page, we examine it to see if it
2110	 * is the same or different Io block.
2111	 */
2112	if (err)
2113		goto next_test_page_1;
2114
2115	if (le16_to_cpu(tst_page->page_pos) == cur_pos &&
2116	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2117		page_cnt = le16_to_cpu(tst_page->page_count) + 1;
2118		page_pos = le16_to_cpu(tst_page->page_pos);
2119		goto check_valid;
2120	} else {
2121		goto file_is_valid;
2122	}
2123
2124next_test_page_1:
2125
2126	nextpage_off = next_page_off(log, curpage_off);
2127	wrapped = nextpage_off == log->first_page;
2128
2129	if (wrapped) {
2130		expected_seq += 1;
2131		page_cnt = 2;
2132		page_pos = 1;
2133	}
2134
2135	cur_pos += 1;
2136	part_io_count += 1;
2137	if (!wrapped)
2138		goto next_test_page;
2139
2140check_valid:
2141	/* Skip over the remaining pages this transfer. */
2142	remain_pages = page_cnt - page_pos - 1;
2143	part_io_count += remain_pages;
2144
2145	while (remain_pages--) {
2146		nextpage_off = next_page_off(log, curpage_off);
2147		wrapped = nextpage_off == log->first_page;
2148
2149		if (wrapped)
2150			expected_seq += 1;
2151	}
2152
2153	/* Call our routine to check this log page. */
2154	kfree(tst_page);
2155	tst_page = NULL;
2156
2157	err = read_log_page(log, nextpage_off, &tst_page, &usa_error);
2158	if (!err && !usa_error &&
2159	    check_subseq_log_page(log, tst_page, nextpage_off, expected_seq)) {
2160		err = -EINVAL;
2161		goto out;
2162	}
2163
2164file_is_valid:
2165
2166	/* We have a valid file. */
2167	if (page_off1 || tail_page) {
2168		struct RECORD_PAGE_HDR *tmp_page;
2169
2170		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2171			err = -EROFS;
2172			goto out;
2173		}
2174
2175		if (page_off1) {
2176			tmp_page = Add2Ptr(page_bufs, page_off1 - page_off);
2177			tails -= (page_off1 - page_off) / log->page_size;
2178			if (!tail_page)
2179				tails -= 1;
2180		} else {
2181			tmp_page = tail_page;
2182			tails = 1;
2183		}
2184
2185		while (tails--) {
2186			u64 off = hdr_file_off(log, tmp_page);
2187
2188			if (!page) {
2189				page = kmalloc(log->page_size, GFP_NOFS);
2190				if (!page) {
2191					err = -ENOMEM;
2192					goto out;
2193				}
2194			}
2195
2196			/*
2197			 * Correct page and copy the data from this page
2198			 * into it and flush it to disk.
2199			 */
2200			memcpy(page, tmp_page, log->page_size);
2201
2202			/* Fill last flushed lsn value flush the page. */
2203			if (log->major_ver < 2)
2204				page->rhdr.lsn = page->record_hdr.last_end_lsn;
2205			else
2206				page->file_off = 0;
2207
2208			page->page_pos = page->page_count = cpu_to_le16(1);
2209
2210			ntfs_fix_pre_write(&page->rhdr, log->page_size);
2211
2212			err = ntfs_sb_write_run(log->ni->mi.sbi,
2213						&log->ni->file.run, off, page,
2214						log->page_size, 0);
2215
2216			if (err)
2217				goto out;
2218
2219			if (part_io_count && second_off == off) {
2220				second_off += log->page_size;
2221				part_io_count -= 1;
2222			}
2223
2224			tmp_page = Add2Ptr(tmp_page, log->page_size);
2225		}
2226	}
2227
2228	if (part_io_count) {
2229		if (sb_rdonly(log->ni->mi.sbi->sb)) {
2230			err = -EROFS;
2231			goto out;
2232		}
2233	}
2234
2235out:
2236	kfree(second_tail);
2237	kfree(first_tail);
2238	kfree(page);
2239	kfree(tst_page);
2240	kfree(page_bufs);
2241
2242	return err;
2243}
2244
2245/*
2246 * read_log_rec_buf - Copy a log record from the file to a buffer.
2247 *
2248 * The log record may span several log pages and may even wrap the file.
2249 */
2250static int read_log_rec_buf(struct ntfs_log *log,
2251			    const struct LFS_RECORD_HDR *rh, void *buffer)
2252{
2253	int err;
2254	struct RECORD_PAGE_HDR *ph = NULL;
2255	u64 lsn = le64_to_cpu(rh->this_lsn);
2256	u32 vbo = lsn_to_vbo(log, lsn) & ~log->page_mask;
2257	u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
2258	u32 data_len = le32_to_cpu(rh->client_data_len);
2259
2260	/*
2261	 * While there are more bytes to transfer,
2262	 * we continue to attempt to perform the read.
2263	 */
2264	for (;;) {
2265		bool usa_error;
2266		u32 tail = log->page_size - off;
2267
2268		if (tail >= data_len)
2269			tail = data_len;
2270
2271		data_len -= tail;
2272
2273		err = read_log_page(log, vbo, &ph, &usa_error);
2274		if (err)
2275			goto out;
2276
2277		/*
2278		 * The last lsn on this page better be greater or equal
2279		 * to the lsn we are copying.
2280		 */
2281		if (lsn > le64_to_cpu(ph->rhdr.lsn)) {
2282			err = -EINVAL;
2283			goto out;
2284		}
2285
2286		memcpy(buffer, Add2Ptr(ph, off), tail);
2287
2288		/* If there are no more bytes to transfer, we exit the loop. */
2289		if (!data_len) {
2290			if (!is_log_record_end(ph) ||
2291			    lsn > le64_to_cpu(ph->record_hdr.last_end_lsn)) {
2292				err = -EINVAL;
2293				goto out;
2294			}
2295			break;
2296		}
2297
2298		if (ph->rhdr.lsn == ph->record_hdr.last_end_lsn ||
2299		    lsn > le64_to_cpu(ph->rhdr.lsn)) {
2300			err = -EINVAL;
2301			goto out;
2302		}
2303
2304		vbo = next_page_off(log, vbo);
2305		off = log->data_off;
2306
2307		/*
2308		 * Adjust our pointer the user's buffer to transfer
2309		 * the next block to.
2310		 */
2311		buffer = Add2Ptr(buffer, tail);
2312	}
2313
2314out:
2315	kfree(ph);
2316	return err;
2317}
2318
2319static int read_rst_area(struct ntfs_log *log, struct NTFS_RESTART **rst_,
2320			 u64 *lsn)
2321{
2322	int err;
2323	struct LFS_RECORD_HDR *rh = NULL;
2324	const struct CLIENT_REC *cr =
2325		Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2326	u64 lsnr, lsnc = le64_to_cpu(cr->restart_lsn);
2327	u32 len;
2328	struct NTFS_RESTART *rst;
2329
2330	*lsn = 0;
2331	*rst_ = NULL;
2332
2333	/* If the client doesn't have a restart area, go ahead and exit now. */
2334	if (!lsnc)
2335		return 0;
2336
2337	err = read_log_page(log, lsn_to_vbo(log, lsnc),
2338			    (struct RECORD_PAGE_HDR **)&rh, NULL);
2339	if (err)
2340		return err;
2341
2342	rst = NULL;
2343	lsnr = le64_to_cpu(rh->this_lsn);
2344
2345	if (lsnc != lsnr) {
2346		/* If the lsn values don't match, then the disk is corrupt. */
2347		err = -EINVAL;
2348		goto out;
2349	}
2350
2351	*lsn = lsnr;
2352	len = le32_to_cpu(rh->client_data_len);
2353
2354	if (!len) {
2355		err = 0;
2356		goto out;
2357	}
2358
2359	if (len < sizeof(struct NTFS_RESTART)) {
2360		err = -EINVAL;
2361		goto out;
2362	}
2363
2364	rst = kmalloc(len, GFP_NOFS);
2365	if (!rst) {
2366		err = -ENOMEM;
2367		goto out;
2368	}
2369
2370	/* Copy the data into the 'rst' buffer. */
2371	err = read_log_rec_buf(log, rh, rst);
2372	if (err)
2373		goto out;
2374
2375	*rst_ = rst;
2376	rst = NULL;
2377
2378out:
2379	kfree(rh);
2380	kfree(rst);
2381
2382	return err;
2383}
2384
2385static int find_log_rec(struct ntfs_log *log, u64 lsn, struct lcb *lcb)
2386{
2387	int err;
2388	struct LFS_RECORD_HDR *rh = lcb->lrh;
2389	u32 rec_len, len;
2390
2391	/* Read the record header for this lsn. */
2392	if (!rh) {
2393		err = read_log_page(log, lsn_to_vbo(log, lsn),
2394				    (struct RECORD_PAGE_HDR **)&rh, NULL);
2395
2396		lcb->lrh = rh;
2397		if (err)
2398			return err;
2399	}
2400
2401	/*
2402	 * If the lsn the log record doesn't match the desired
2403	 * lsn then the disk is corrupt.
2404	 */
2405	if (lsn != le64_to_cpu(rh->this_lsn))
2406		return -EINVAL;
2407
2408	len = le32_to_cpu(rh->client_data_len);
2409
2410	/*
2411	 * Check that the length field isn't greater than the total
2412	 * available space the log file.
2413	 */
2414	rec_len = len + log->record_header_len;
2415	if (rec_len >= log->total_avail)
2416		return -EINVAL;
2417
2418	/*
2419	 * If the entire log record is on this log page,
2420	 * put a pointer to the log record the context block.
2421	 */
2422	if (rh->flags & LOG_RECORD_MULTI_PAGE) {
2423		void *lr = kmalloc(len, GFP_NOFS);
2424
2425		if (!lr)
2426			return -ENOMEM;
2427
2428		lcb->log_rec = lr;
2429		lcb->alloc = true;
2430
2431		/* Copy the data into the buffer returned. */
2432		err = read_log_rec_buf(log, rh, lr);
2433		if (err)
2434			return err;
2435	} else {
2436		/* If beyond the end of the current page -> an error. */
2437		u32 page_off = lsn_to_page_off(log, lsn);
2438
2439		if (page_off + len + log->record_header_len > log->page_size)
2440			return -EINVAL;
2441
2442		lcb->log_rec = Add2Ptr(rh, sizeof(struct LFS_RECORD_HDR));
2443		lcb->alloc = false;
2444	}
2445
2446	return 0;
2447}
2448
2449/*
2450 * read_log_rec_lcb - Init the query operation.
2451 */
2452static int read_log_rec_lcb(struct ntfs_log *log, u64 lsn, u32 ctx_mode,
2453			    struct lcb **lcb_)
2454{
2455	int err;
2456	const struct CLIENT_REC *cr;
2457	struct lcb *lcb;
2458
2459	switch (ctx_mode) {
2460	case lcb_ctx_undo_next:
2461	case lcb_ctx_prev:
2462	case lcb_ctx_next:
2463		break;
2464	default:
2465		return -EINVAL;
2466	}
2467
2468	/* Check that the given lsn is the legal range for this client. */
2469	cr = Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off));
2470
2471	if (!verify_client_lsn(log, cr, lsn))
2472		return -EINVAL;
2473
2474	lcb = kzalloc(sizeof(struct lcb), GFP_NOFS);
2475	if (!lcb)
2476		return -ENOMEM;
2477	lcb->client = log->client_id;
2478	lcb->ctx_mode = ctx_mode;
2479
2480	/* Find the log record indicated by the given lsn. */
2481	err = find_log_rec(log, lsn, lcb);
2482	if (err)
2483		goto out;
2484
2485	*lcb_ = lcb;
2486	return 0;
2487
2488out:
2489	lcb_put(lcb);
2490	*lcb_ = NULL;
2491	return err;
2492}
2493
2494/*
2495 * find_client_next_lsn
2496 *
2497 * Attempt to find the next lsn to return to a client based on the context mode.
2498 */
2499static int find_client_next_lsn(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2500{
2501	int err;
2502	u64 next_lsn;
2503	struct LFS_RECORD_HDR *hdr;
2504
2505	hdr = lcb->lrh;
2506	*lsn = 0;
2507
2508	if (lcb_ctx_next != lcb->ctx_mode)
2509		goto check_undo_next;
2510
2511	/* Loop as long as another lsn can be found. */
2512	for (;;) {
2513		u64 current_lsn;
2514
2515		err = next_log_lsn(log, hdr, &current_lsn);
2516		if (err)
2517			goto out;
2518
2519		if (!current_lsn)
2520			break;
2521
2522		if (hdr != lcb->lrh)
2523			kfree(hdr);
2524
2525		hdr = NULL;
2526		err = read_log_page(log, lsn_to_vbo(log, current_lsn),
2527				    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2528		if (err)
2529			goto out;
2530
2531		if (memcmp(&hdr->client, &lcb->client,
2532			   sizeof(struct CLIENT_ID))) {
2533			/*err = -EINVAL; */
2534		} else if (LfsClientRecord == hdr->record_type) {
2535			kfree(lcb->lrh);
2536			lcb->lrh = hdr;
2537			*lsn = current_lsn;
2538			return 0;
2539		}
2540	}
2541
2542out:
2543	if (hdr != lcb->lrh)
2544		kfree(hdr);
2545	return err;
2546
2547check_undo_next:
2548	if (lcb_ctx_undo_next == lcb->ctx_mode)
2549		next_lsn = le64_to_cpu(hdr->client_undo_next_lsn);
2550	else if (lcb_ctx_prev == lcb->ctx_mode)
2551		next_lsn = le64_to_cpu(hdr->client_prev_lsn);
2552	else
2553		return 0;
2554
2555	if (!next_lsn)
2556		return 0;
2557
2558	if (!verify_client_lsn(
2559		    log, Add2Ptr(log->ra, le16_to_cpu(log->ra->client_off)),
2560		    next_lsn))
2561		return 0;
2562
2563	hdr = NULL;
2564	err = read_log_page(log, lsn_to_vbo(log, next_lsn),
2565			    (struct RECORD_PAGE_HDR **)&hdr, NULL);
2566	if (err)
2567		return err;
2568	kfree(lcb->lrh);
2569	lcb->lrh = hdr;
2570
2571	*lsn = next_lsn;
2572
2573	return 0;
2574}
2575
2576static int read_next_log_rec(struct ntfs_log *log, struct lcb *lcb, u64 *lsn)
2577{
2578	int err;
2579
2580	err = find_client_next_lsn(log, lcb, lsn);
2581	if (err)
2582		return err;
2583
2584	if (!*lsn)
2585		return 0;
2586
2587	if (lcb->alloc)
2588		kfree(lcb->log_rec);
2589
2590	lcb->log_rec = NULL;
2591	lcb->alloc = false;
2592	kfree(lcb->lrh);
2593	lcb->lrh = NULL;
2594
2595	return find_log_rec(log, *lsn, lcb);
2596}
2597
2598bool check_index_header(const struct INDEX_HDR *hdr, size_t bytes)
2599{
2600	__le16 mask;
2601	u32 min_de, de_off, used, total;
2602	const struct NTFS_DE *e;
2603
2604	if (hdr_has_subnode(hdr)) {
2605		min_de = sizeof(struct NTFS_DE) + sizeof(u64);
2606		mask = NTFS_IE_HAS_SUBNODES;
2607	} else {
2608		min_de = sizeof(struct NTFS_DE);
2609		mask = 0;
2610	}
2611
2612	de_off = le32_to_cpu(hdr->de_off);
2613	used = le32_to_cpu(hdr->used);
2614	total = le32_to_cpu(hdr->total);
2615
2616	if (de_off > bytes - min_de || used > bytes || total > bytes ||
2617	    de_off + min_de > used || used > total) {
2618		return false;
2619	}
2620
2621	e = Add2Ptr(hdr, de_off);
2622	for (;;) {
2623		u16 esize = le16_to_cpu(e->size);
2624		struct NTFS_DE *next = Add2Ptr(e, esize);
2625
2626		if (esize < min_de || PtrOffset(hdr, next) > used ||
2627		    (e->flags & NTFS_IE_HAS_SUBNODES) != mask) {
2628			return false;
2629		}
2630
2631		if (de_is_last(e))
2632			break;
2633
2634		e = next;
2635	}
2636
2637	return true;
2638}
2639
2640static inline bool check_index_buffer(const struct INDEX_BUFFER *ib, u32 bytes)
2641{
2642	u16 fo;
2643	const struct NTFS_RECORD_HEADER *r = &ib->rhdr;
2644
2645	if (r->sign != NTFS_INDX_SIGNATURE)
2646		return false;
2647
2648	fo = (SECTOR_SIZE - ((bytes >> SECTOR_SHIFT) + 1) * sizeof(short));
2649
2650	if (le16_to_cpu(r->fix_off) > fo)
2651		return false;
2652
2653	if ((le16_to_cpu(r->fix_num) - 1) * SECTOR_SIZE != bytes)
2654		return false;
2655
2656	return check_index_header(&ib->ihdr,
2657				  bytes - offsetof(struct INDEX_BUFFER, ihdr));
2658}
2659
2660static inline bool check_index_root(const struct ATTRIB *attr,
2661				    struct ntfs_sb_info *sbi)
2662{
2663	bool ret;
2664	const struct INDEX_ROOT *root = resident_data(attr);
2665	u8 index_bits = le32_to_cpu(root->index_block_size) >=
2666					sbi->cluster_size ?
2667				sbi->cluster_bits :
2668				SECTOR_SHIFT;
2669	u8 block_clst = root->index_block_clst;
2670
2671	if (le32_to_cpu(attr->res.data_size) < sizeof(struct INDEX_ROOT) ||
2672	    (root->type != ATTR_NAME && root->type != ATTR_ZERO) ||
2673	    (root->type == ATTR_NAME &&
2674	     root->rule != NTFS_COLLATION_TYPE_FILENAME) ||
2675	    (le32_to_cpu(root->index_block_size) !=
2676	     (block_clst << index_bits)) ||
2677	    (block_clst != 1 && block_clst != 2 && block_clst != 4 &&
2678	     block_clst != 8 && block_clst != 0x10 && block_clst != 0x20 &&
2679	     block_clst != 0x40 && block_clst != 0x80)) {
2680		return false;
2681	}
2682
2683	ret = check_index_header(&root->ihdr,
2684				 le32_to_cpu(attr->res.data_size) -
2685					 offsetof(struct INDEX_ROOT, ihdr));
2686	return ret;
2687}
2688
2689static inline bool check_attr(const struct MFT_REC *rec,
2690			      const struct ATTRIB *attr,
2691			      struct ntfs_sb_info *sbi)
2692{
2693	u32 asize = le32_to_cpu(attr->size);
2694	u32 rsize = 0;
2695	u64 dsize, svcn, evcn;
2696	u16 run_off;
2697
2698	/* Check the fixed part of the attribute record header. */
2699	if (asize >= sbi->record_size ||
2700	    asize + PtrOffset(rec, attr) >= sbi->record_size ||
2701	    (attr->name_len &&
2702	     le16_to_cpu(attr->name_off) + attr->name_len * sizeof(short) >
2703		     asize)) {
2704		return false;
2705	}
2706
2707	/* Check the attribute fields. */
2708	switch (attr->non_res) {
2709	case 0:
2710		rsize = le32_to_cpu(attr->res.data_size);
2711		if (rsize >= asize ||
2712		    le16_to_cpu(attr->res.data_off) + rsize > asize) {
2713			return false;
2714		}
2715		break;
2716
2717	case 1:
2718		dsize = le64_to_cpu(attr->nres.data_size);
2719		svcn = le64_to_cpu(attr->nres.svcn);
2720		evcn = le64_to_cpu(attr->nres.evcn);
2721		run_off = le16_to_cpu(attr->nres.run_off);
2722
2723		if (svcn > evcn + 1 || run_off >= asize ||
2724		    le64_to_cpu(attr->nres.valid_size) > dsize ||
2725		    dsize > le64_to_cpu(attr->nres.alloc_size)) {
2726			return false;
2727		}
2728
2729		if (run_off > asize)
2730			return false;
2731
2732		if (run_unpack(NULL, sbi, 0, svcn, evcn, svcn,
2733			       Add2Ptr(attr, run_off), asize - run_off) < 0) {
2734			return false;
2735		}
2736
2737		return true;
2738
2739	default:
2740		return false;
2741	}
2742
2743	switch (attr->type) {
2744	case ATTR_NAME:
2745		if (fname_full_size(Add2Ptr(
2746			    attr, le16_to_cpu(attr->res.data_off))) > asize) {
2747			return false;
2748		}
2749		break;
2750
2751	case ATTR_ROOT:
2752		return check_index_root(attr, sbi);
2753
2754	case ATTR_STD:
2755		if (rsize < sizeof(struct ATTR_STD_INFO5) &&
2756		    rsize != sizeof(struct ATTR_STD_INFO)) {
2757			return false;
2758		}
2759		break;
2760
2761	case ATTR_LIST:
2762	case ATTR_ID:
2763	case ATTR_SECURE:
2764	case ATTR_LABEL:
2765	case ATTR_VOL_INFO:
2766	case ATTR_DATA:
2767	case ATTR_ALLOC:
2768	case ATTR_BITMAP:
2769	case ATTR_REPARSE:
2770	case ATTR_EA_INFO:
2771	case ATTR_EA:
2772	case ATTR_PROPERTYSET:
2773	case ATTR_LOGGED_UTILITY_STREAM:
2774		break;
2775
2776	default:
2777		return false;
2778	}
2779
2780	return true;
2781}
2782
2783static inline bool check_file_record(const struct MFT_REC *rec,
2784				     const struct MFT_REC *rec2,
2785				     struct ntfs_sb_info *sbi)
2786{
2787	const struct ATTRIB *attr;
2788	u16 fo = le16_to_cpu(rec->rhdr.fix_off);
2789	u16 fn = le16_to_cpu(rec->rhdr.fix_num);
2790	u16 ao = le16_to_cpu(rec->attr_off);
2791	u32 rs = sbi->record_size;
2792
2793	/* Check the file record header for consistency. */
2794	if (rec->rhdr.sign != NTFS_FILE_SIGNATURE ||
2795	    fo > (SECTOR_SIZE - ((rs >> SECTOR_SHIFT) + 1) * sizeof(short)) ||
2796	    (fn - 1) * SECTOR_SIZE != rs || ao < MFTRECORD_FIXUP_OFFSET_1 ||
2797	    ao > sbi->record_size - SIZEOF_RESIDENT || !is_rec_inuse(rec) ||
2798	    le32_to_cpu(rec->total) != rs) {
2799		return false;
2800	}
2801
2802	/* Loop to check all of the attributes. */
2803	for (attr = Add2Ptr(rec, ao); attr->type != ATTR_END;
2804	     attr = Add2Ptr(attr, le32_to_cpu(attr->size))) {
2805		if (check_attr(rec, attr, sbi))
2806			continue;
2807		return false;
2808	}
2809
2810	return true;
2811}
2812
2813static inline int check_lsn(const struct NTFS_RECORD_HEADER *hdr,
2814			    const u64 *rlsn)
2815{
2816	u64 lsn;
2817
2818	if (!rlsn)
2819		return true;
2820
2821	lsn = le64_to_cpu(hdr->lsn);
2822
2823	if (hdr->sign == NTFS_HOLE_SIGNATURE)
2824		return false;
2825
2826	if (*rlsn > lsn)
2827		return true;
2828
2829	return false;
2830}
2831
2832static inline bool check_if_attr(const struct MFT_REC *rec,
2833				 const struct LOG_REC_HDR *lrh)
2834{
2835	u16 ro = le16_to_cpu(lrh->record_off);
2836	u16 o = le16_to_cpu(rec->attr_off);
2837	const struct ATTRIB *attr = Add2Ptr(rec, o);
2838
2839	while (o < ro) {
2840		u32 asize;
2841
2842		if (attr->type == ATTR_END)
2843			break;
2844
2845		asize = le32_to_cpu(attr->size);
2846		if (!asize)
2847			break;
2848
2849		o += asize;
2850		attr = Add2Ptr(attr, asize);
2851	}
2852
2853	return o == ro;
2854}
2855
2856static inline bool check_if_index_root(const struct MFT_REC *rec,
2857				       const struct LOG_REC_HDR *lrh)
2858{
2859	u16 ro = le16_to_cpu(lrh->record_off);
2860	u16 o = le16_to_cpu(rec->attr_off);
2861	const struct ATTRIB *attr = Add2Ptr(rec, o);
2862
2863	while (o < ro) {
2864		u32 asize;
2865
2866		if (attr->type == ATTR_END)
2867			break;
2868
2869		asize = le32_to_cpu(attr->size);
2870		if (!asize)
2871			break;
2872
2873		o += asize;
2874		attr = Add2Ptr(attr, asize);
2875	}
2876
2877	return o == ro && attr->type == ATTR_ROOT;
2878}
2879
2880static inline bool check_if_root_index(const struct ATTRIB *attr,
2881				       const struct INDEX_HDR *hdr,
2882				       const struct LOG_REC_HDR *lrh)
2883{
2884	u16 ao = le16_to_cpu(lrh->attr_off);
2885	u32 de_off = le32_to_cpu(hdr->de_off);
2886	u32 o = PtrOffset(attr, hdr) + de_off;
2887	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2888	u32 asize = le32_to_cpu(attr->size);
2889
2890	while (o < ao) {
2891		u16 esize;
2892
2893		if (o >= asize)
2894			break;
2895
2896		esize = le16_to_cpu(e->size);
2897		if (!esize)
2898			break;
2899
2900		o += esize;
2901		e = Add2Ptr(e, esize);
2902	}
2903
2904	return o == ao;
2905}
2906
2907static inline bool check_if_alloc_index(const struct INDEX_HDR *hdr,
2908					u32 attr_off)
2909{
2910	u32 de_off = le32_to_cpu(hdr->de_off);
2911	u32 o = offsetof(struct INDEX_BUFFER, ihdr) + de_off;
2912	const struct NTFS_DE *e = Add2Ptr(hdr, de_off);
2913	u32 used = le32_to_cpu(hdr->used);
2914
2915	while (o < attr_off) {
2916		u16 esize;
2917
2918		if (de_off >= used)
2919			break;
2920
2921		esize = le16_to_cpu(e->size);
2922		if (!esize)
2923			break;
2924
2925		o += esize;
2926		de_off += esize;
2927		e = Add2Ptr(e, esize);
2928	}
2929
2930	return o == attr_off;
2931}
2932
2933static inline void change_attr_size(struct MFT_REC *rec, struct ATTRIB *attr,
2934				    u32 nsize)
2935{
2936	u32 asize = le32_to_cpu(attr->size);
2937	int dsize = nsize - asize;
2938	u8 *next = Add2Ptr(attr, asize);
2939	u32 used = le32_to_cpu(rec->used);
2940
2941	memmove(Add2Ptr(attr, nsize), next, used - PtrOffset(rec, next));
2942
2943	rec->used = cpu_to_le32(used + dsize);
2944	attr->size = cpu_to_le32(nsize);
2945}
2946
2947struct OpenAttr {
2948	struct ATTRIB *attr;
2949	struct runs_tree *run1;
2950	struct runs_tree run0;
2951	struct ntfs_inode *ni;
2952	// CLST rno;
2953};
2954
2955/*
2956 * cmp_type_and_name
2957 *
2958 * Return: 0 if 'attr' has the same type and name.
2959 */
2960static inline int cmp_type_and_name(const struct ATTRIB *a1,
2961				    const struct ATTRIB *a2)
2962{
2963	return a1->type != a2->type || a1->name_len != a2->name_len ||
2964	       (a1->name_len && memcmp(attr_name(a1), attr_name(a2),
2965				       a1->name_len * sizeof(short)));
2966}
2967
2968static struct OpenAttr *find_loaded_attr(struct ntfs_log *log,
2969					 const struct ATTRIB *attr, CLST rno)
2970{
2971	struct OPEN_ATTR_ENRTY *oe = NULL;
2972
2973	while ((oe = enum_rstbl(log->open_attr_tbl, oe))) {
2974		struct OpenAttr *op_attr;
2975
2976		if (ino_get(&oe->ref) != rno)
2977			continue;
2978
2979		op_attr = (struct OpenAttr *)oe->ptr;
2980		if (!cmp_type_and_name(op_attr->attr, attr))
2981			return op_attr;
2982	}
2983	return NULL;
2984}
2985
2986static struct ATTRIB *attr_create_nonres_log(struct ntfs_sb_info *sbi,
2987					     enum ATTR_TYPE type, u64 size,
2988					     const u16 *name, size_t name_len,
2989					     __le16 flags)
2990{
2991	struct ATTRIB *attr;
2992	u32 name_size = ALIGN(name_len * sizeof(short), 8);
2993	bool is_ext = flags & (ATTR_FLAG_COMPRESSED | ATTR_FLAG_SPARSED);
2994	u32 asize = name_size +
2995		    (is_ext ? SIZEOF_NONRESIDENT_EX : SIZEOF_NONRESIDENT);
2996
2997	attr = kzalloc(asize, GFP_NOFS);
2998	if (!attr)
2999		return NULL;
3000
3001	attr->type = type;
3002	attr->size = cpu_to_le32(asize);
3003	attr->flags = flags;
3004	attr->non_res = 1;
3005	attr->name_len = name_len;
3006
3007	attr->nres.evcn = cpu_to_le64((u64)bytes_to_cluster(sbi, size) - 1);
3008	attr->nres.alloc_size = cpu_to_le64(ntfs_up_cluster(sbi, size));
3009	attr->nres.data_size = cpu_to_le64(size);
3010	attr->nres.valid_size = attr->nres.data_size;
3011	if (is_ext) {
3012		attr->name_off = SIZEOF_NONRESIDENT_EX_LE;
3013		if (is_attr_compressed(attr))
3014			attr->nres.c_unit = NTFS_LZNT_CUNIT;
3015
3016		attr->nres.run_off =
3017			cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size);
3018		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT_EX), name,
3019		       name_len * sizeof(short));
3020	} else {
3021		attr->name_off = SIZEOF_NONRESIDENT_LE;
3022		attr->nres.run_off =
3023			cpu_to_le16(SIZEOF_NONRESIDENT + name_size);
3024		memcpy(Add2Ptr(attr, SIZEOF_NONRESIDENT), name,
3025		       name_len * sizeof(short));
3026	}
3027
3028	return attr;
3029}
3030
3031/*
3032 * do_action - Common routine for the Redo and Undo Passes.
3033 * @rlsn: If it is NULL then undo.
3034 */
3035static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
3036		     const struct LOG_REC_HDR *lrh, u32 op, void *data,
3037		     u32 dlen, u32 rec_len, const u64 *rlsn)
3038{
3039	int err = 0;
3040	struct ntfs_sb_info *sbi = log->ni->mi.sbi;
3041	struct inode *inode = NULL, *inode_parent;
3042	struct mft_inode *mi = NULL, *mi2_child = NULL;
3043	CLST rno = 0, rno_base = 0;
3044	struct INDEX_BUFFER *ib = NULL;
3045	struct MFT_REC *rec = NULL;
3046	struct ATTRIB *attr = NULL, *attr2;
3047	struct INDEX_HDR *hdr;
3048	struct INDEX_ROOT *root;
3049	struct NTFS_DE *e, *e1, *e2;
3050	struct NEW_ATTRIBUTE_SIZES *new_sz;
3051	struct ATTR_FILE_NAME *fname;
3052	struct OpenAttr *oa, *oa2;
3053	u32 nsize, t32, asize, used, esize, off, bits;
3054	u16 id, id2;
3055	u32 record_size = sbi->record_size;
3056	u64 t64;
3057	u16 roff = le16_to_cpu(lrh->record_off);
3058	u16 aoff = le16_to_cpu(lrh->attr_off);
3059	u64 lco = 0;
3060	u64 cbo = (u64)le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
3061	u64 tvo = le64_to_cpu(lrh->target_vcn) << sbi->cluster_bits;
3062	u64 vbo = cbo + tvo;
3063	void *buffer_le = NULL;
3064	u32 bytes = 0;
3065	bool a_dirty = false;
3066	u16 data_off;
3067
3068	oa = oe->ptr;
3069
3070	/* Big switch to prepare. */
3071	switch (op) {
3072	/* ============================================================
3073	 * Process MFT records, as described by the current log record.
3074	 * ============================================================
3075	 */
3076	case InitializeFileRecordSegment:
3077	case DeallocateFileRecordSegment:
3078	case WriteEndOfFileRecordSegment:
3079	case CreateAttribute:
3080	case DeleteAttribute:
3081	case UpdateResidentValue:
3082	case UpdateMappingPairs:
3083	case SetNewAttributeSizes:
3084	case AddIndexEntryRoot:
3085	case DeleteIndexEntryRoot:
3086	case SetIndexEntryVcnRoot:
3087	case UpdateFileNameRoot:
3088	case UpdateRecordDataRoot:
3089	case ZeroEndOfFileRecord:
3090		rno = vbo >> sbi->record_bits;
3091		inode = ilookup(sbi->sb, rno);
3092		if (inode) {
3093			mi = &ntfs_i(inode)->mi;
3094		} else {
3095			/* Read from disk. */
3096			err = mi_get(sbi, rno, &mi);
3097			if (err && op == InitializeFileRecordSegment) {
3098				mi = kzalloc(sizeof(struct mft_inode),
3099					     GFP_NOFS);
3100				if (!mi)
3101					return -ENOMEM;
3102				err = mi_format_new(mi, sbi, rno, 0, false);
3103			}
3104			if (err)
3105				return err;
3106		}
3107		rec = mi->mrec;
3108
3109		if (op == DeallocateFileRecordSegment)
3110			goto skip_load_parent;
3111
3112		if (rec->rhdr.sign == NTFS_BAAD_SIGNATURE)
3113			goto dirty_vol;
3114		if (!check_lsn(&rec->rhdr, rlsn))
3115			goto out;
3116		if (!check_file_record(rec, NULL, sbi))
3117			goto dirty_vol;
3118		attr = Add2Ptr(rec, roff);
3119
3120		if (is_rec_base(rec) || InitializeFileRecordSegment == op) {
3121			rno_base = rno;
3122			goto skip_load_parent;
3123		}
3124
3125		rno_base = ino_get(&rec->parent_ref);
3126		inode_parent = ntfs_iget5(sbi->sb, &rec->parent_ref, NULL);
3127		if (IS_ERR(inode_parent))
3128			goto skip_load_parent;
3129
3130		if (is_bad_inode(inode_parent)) {
3131			iput(inode_parent);
3132			goto skip_load_parent;
3133		}
3134
3135		if (ni_load_mi_ex(ntfs_i(inode_parent), rno, &mi2_child)) {
3136			iput(inode_parent);
3137		} else {
3138			if (mi2_child->mrec != mi->mrec)
3139				memcpy(mi2_child->mrec, mi->mrec,
3140				       sbi->record_size);
3141
3142			if (inode)
3143				iput(inode);
3144			else
3145				mi_put(mi);
3146
3147			inode = inode_parent;
3148			mi = mi2_child;
3149			rec = mi2_child->mrec;
3150			attr = Add2Ptr(rec, roff);
3151		}
3152
3153skip_load_parent:
3154		inode_parent = NULL;
3155		break;
3156
3157	/*
3158	 * Process attributes, as described by the current log record.
3159	 */
3160	case UpdateNonresidentValue:
3161	case AddIndexEntryAllocation:
3162	case DeleteIndexEntryAllocation:
3163	case WriteEndOfIndexBuffer:
3164	case SetIndexEntryVcnAllocation:
3165	case UpdateFileNameAllocation:
3166	case SetBitsInNonresidentBitMap:
3167	case ClearBitsInNonresidentBitMap:
3168	case UpdateRecordDataAllocation:
3169		attr = oa->attr;
3170		bytes = UpdateNonresidentValue == op ? dlen : 0;
3171		lco = (u64)le16_to_cpu(lrh->lcns_follow) << sbi->cluster_bits;
3172
3173		if (attr->type == ATTR_ALLOC) {
3174			t32 = le32_to_cpu(oe->bytes_per_index);
3175			if (bytes < t32)
3176				bytes = t32;
3177		}
3178
3179		if (!bytes)
3180			bytes = lco - cbo;
3181
3182		bytes += roff;
3183		if (attr->type == ATTR_ALLOC)
3184			bytes = (bytes + 511) & ~511; // align
3185
3186		buffer_le = kmalloc(bytes, GFP_NOFS);
3187		if (!buffer_le)
3188			return -ENOMEM;
3189
3190		err = ntfs_read_run_nb(sbi, oa->run1, vbo, buffer_le, bytes,
3191				       NULL);
3192		if (err)
3193			goto out;
3194
3195		if (attr->type == ATTR_ALLOC && *(int *)buffer_le)
3196			ntfs_fix_post_read(buffer_le, bytes, false);
3197		break;
3198
3199	default:
3200		WARN_ON(1);
3201	}
3202
3203	/* Big switch to do operation. */
3204	switch (op) {
3205	case InitializeFileRecordSegment:
3206		if (roff + dlen > record_size)
3207			goto dirty_vol;
3208
3209		memcpy(Add2Ptr(rec, roff), data, dlen);
3210		mi->dirty = true;
3211		break;
3212
3213	case DeallocateFileRecordSegment:
3214		clear_rec_inuse(rec);
3215		le16_add_cpu(&rec->seq, 1);
3216		mi->dirty = true;
3217		break;
3218
3219	case WriteEndOfFileRecordSegment:
3220		attr2 = (struct ATTRIB *)data;
3221		if (!check_if_attr(rec, lrh) || roff + dlen > record_size)
3222			goto dirty_vol;
3223
3224		memmove(attr, attr2, dlen);
3225		rec->used = cpu_to_le32(ALIGN(roff + dlen, 8));
3226
3227		mi->dirty = true;
3228		break;
3229
3230	case CreateAttribute:
3231		attr2 = (struct ATTRIB *)data;
3232		asize = le32_to_cpu(attr2->size);
3233		used = le32_to_cpu(rec->used);
3234
3235		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
3236		    !IS_ALIGNED(asize, 8) ||
3237		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
3238		    dlen > record_size - used) {
3239			goto dirty_vol;
3240		}
3241
3242		memmove(Add2Ptr(attr, asize), attr, used - roff);
3243		memcpy(attr, attr2, asize);
3244
3245		rec->used = cpu_to_le32(used + asize);
3246		id = le16_to_cpu(rec->next_attr_id);
3247		id2 = le16_to_cpu(attr2->id);
3248		if (id <= id2)
3249			rec->next_attr_id = cpu_to_le16(id2 + 1);
3250		if (is_attr_indexed(attr))
3251			le16_add_cpu(&rec->hard_links, 1);
3252
3253		oa2 = find_loaded_attr(log, attr, rno_base);
3254		if (oa2) {
3255			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3256					   GFP_NOFS);
3257			if (p2) {
3258				// run_close(oa2->run1);
3259				kfree(oa2->attr);
3260				oa2->attr = p2;
3261			}
3262		}
3263
3264		mi->dirty = true;
3265		break;
3266
3267	case DeleteAttribute:
3268		asize = le32_to_cpu(attr->size);
3269		used = le32_to_cpu(rec->used);
3270
3271		if (!check_if_attr(rec, lrh))
3272			goto dirty_vol;
3273
3274		rec->used = cpu_to_le32(used - asize);
3275		if (is_attr_indexed(attr))
3276			le16_add_cpu(&rec->hard_links, -1);
3277
3278		memmove(attr, Add2Ptr(attr, asize), used - asize - roff);
3279
3280		mi->dirty = true;
3281		break;
3282
3283	case UpdateResidentValue:
3284		nsize = aoff + dlen;
3285
3286		if (!check_if_attr(rec, lrh))
3287			goto dirty_vol;
3288
3289		asize = le32_to_cpu(attr->size);
3290		used = le32_to_cpu(rec->used);
3291
3292		if (lrh->redo_len == lrh->undo_len) {
3293			if (nsize > asize)
3294				goto dirty_vol;
3295			goto move_data;
3296		}
3297
3298		if (nsize > asize && nsize - asize > record_size - used)
3299			goto dirty_vol;
3300
3301		nsize = ALIGN(nsize, 8);
3302		data_off = le16_to_cpu(attr->res.data_off);
3303
3304		if (nsize < asize) {
3305			memmove(Add2Ptr(attr, aoff), data, dlen);
3306			data = NULL; // To skip below memmove().
3307		}
3308
3309		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3310			used - le16_to_cpu(lrh->record_off) - asize);
3311
3312		rec->used = cpu_to_le32(used + nsize - asize);
3313		attr->size = cpu_to_le32(nsize);
3314		attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);
3315
3316move_data:
3317		if (data)
3318			memmove(Add2Ptr(attr, aoff), data, dlen);
3319
3320		oa2 = find_loaded_attr(log, attr, rno_base);
3321		if (oa2) {
3322			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3323					   GFP_NOFS);
3324			if (p2) {
3325				// run_close(&oa2->run0);
3326				oa2->run1 = &oa2->run0;
3327				kfree(oa2->attr);
3328				oa2->attr = p2;
3329			}
3330		}
3331
3332		mi->dirty = true;
3333		break;
3334
3335	case UpdateMappingPairs:
3336		nsize = aoff + dlen;
3337		asize = le32_to_cpu(attr->size);
3338		used = le32_to_cpu(rec->used);
3339
3340		if (!check_if_attr(rec, lrh) || !attr->non_res ||
3341		    aoff < le16_to_cpu(attr->nres.run_off) || aoff > asize ||
3342		    (nsize > asize && nsize - asize > record_size - used)) {
3343			goto dirty_vol;
3344		}
3345
3346		nsize = ALIGN(nsize, 8);
3347
3348		memmove(Add2Ptr(attr, nsize), Add2Ptr(attr, asize),
3349			used - le16_to_cpu(lrh->record_off) - asize);
3350		rec->used = cpu_to_le32(used + nsize - asize);
3351		attr->size = cpu_to_le32(nsize);
3352		memmove(Add2Ptr(attr, aoff), data, dlen);
3353
3354		if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
3355					attr_run(attr), &t64)) {
3356			goto dirty_vol;
3357		}
3358
3359		attr->nres.evcn = cpu_to_le64(t64);
3360		oa2 = find_loaded_attr(log, attr, rno_base);
3361		if (oa2 && oa2->attr->non_res)
3362			oa2->attr->nres.evcn = attr->nres.evcn;
3363
3364		mi->dirty = true;
3365		break;
3366
3367	case SetNewAttributeSizes:
3368		new_sz = data;
3369		if (!check_if_attr(rec, lrh) || !attr->non_res)
3370			goto dirty_vol;
3371
3372		attr->nres.alloc_size = new_sz->alloc_size;
3373		attr->nres.data_size = new_sz->data_size;
3374		attr->nres.valid_size = new_sz->valid_size;
3375
3376		if (dlen >= sizeof(struct NEW_ATTRIBUTE_SIZES))
3377			attr->nres.total_size = new_sz->total_size;
3378
3379		oa2 = find_loaded_attr(log, attr, rno_base);
3380		if (oa2) {
3381			void *p2 = kmemdup(attr, le32_to_cpu(attr->size),
3382					   GFP_NOFS);
3383			if (p2) {
3384				kfree(oa2->attr);
3385				oa2->attr = p2;
3386			}
3387		}
3388		mi->dirty = true;
3389		break;
3390
3391	case AddIndexEntryRoot:
3392		e = (struct NTFS_DE *)data;
3393		esize = le16_to_cpu(e->size);
3394		root = resident_data(attr);
3395		hdr = &root->ihdr;
3396		used = le32_to_cpu(hdr->used);
3397
3398		if (!check_if_index_root(rec, lrh) ||
3399		    !check_if_root_index(attr, hdr, lrh) ||
3400		    Add2Ptr(data, esize) > Add2Ptr(lrh, rec_len) ||
3401		    esize > le32_to_cpu(rec->total) - le32_to_cpu(rec->used)) {
3402			goto dirty_vol;
3403		}
3404
3405		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3406
3407		change_attr_size(rec, attr, le32_to_cpu(attr->size) + esize);
3408
3409		memmove(Add2Ptr(e1, esize), e1,
3410			PtrOffset(e1, Add2Ptr(hdr, used)));
3411		memmove(e1, e, esize);
3412
3413		le32_add_cpu(&attr->res.data_size, esize);
3414		hdr->used = cpu_to_le32(used + esize);
3415		le32_add_cpu(&hdr->total, esize);
3416
3417		mi->dirty = true;
3418		break;
3419
3420	case DeleteIndexEntryRoot:
3421		root = resident_data(attr);
3422		hdr = &root->ihdr;
3423		used = le32_to_cpu(hdr->used);
3424
3425		if (!check_if_index_root(rec, lrh) ||
3426		    !check_if_root_index(attr, hdr, lrh)) {
3427			goto dirty_vol;
3428		}
3429
3430		e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3431		esize = le16_to_cpu(e1->size);
3432		if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize)
3433			goto dirty_vol;
3434
3435		e2 = Add2Ptr(e1, esize);
3436
3437		memmove(e1, e2, PtrOffset(e2, Add2Ptr(hdr, used)));
3438
3439		le32_sub_cpu(&attr->res.data_size, esize);
3440		hdr->used = cpu_to_le32(used - esize);
3441		le32_sub_cpu(&hdr->total, esize);
3442
3443		change_attr_size(rec, attr, le32_to_cpu(attr->size) - esize);
3444
3445		mi->dirty = true;
3446		break;
3447
3448	case SetIndexEntryVcnRoot:
3449		root = resident_data(attr);
3450		hdr = &root->ihdr;
3451
3452		if (!check_if_index_root(rec, lrh) ||
3453		    !check_if_root_index(attr, hdr, lrh)) {
3454			goto dirty_vol;
3455		}
3456
3457		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3458
3459		de_set_vbn_le(e, *(__le64 *)data);
3460		mi->dirty = true;
3461		break;
3462
3463	case UpdateFileNameRoot:
3464		root = resident_data(attr);
3465		hdr = &root->ihdr;
3466
3467		if (!check_if_index_root(rec, lrh) ||
3468		    !check_if_root_index(attr, hdr, lrh)) {
3469			goto dirty_vol;
3470		}
3471
3472		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3473		fname = (struct ATTR_FILE_NAME *)(e + 1);
3474		memmove(&fname->dup, data, sizeof(fname->dup)); //
3475		mi->dirty = true;
3476		break;
3477
3478	case UpdateRecordDataRoot:
3479		root = resident_data(attr);
3480		hdr = &root->ihdr;
3481
3482		if (!check_if_index_root(rec, lrh) ||
3483		    !check_if_root_index(attr, hdr, lrh)) {
3484			goto dirty_vol;
3485		}
3486
3487		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
3488
3489		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3490
3491		mi->dirty = true;
3492		break;
3493
3494	case ZeroEndOfFileRecord:
3495		if (roff + dlen > record_size)
3496			goto dirty_vol;
3497
3498		memset(attr, 0, dlen);
3499		mi->dirty = true;
3500		break;
3501
3502	case UpdateNonresidentValue:
3503		if (lco < cbo + roff + dlen)
3504			goto dirty_vol;
3505
3506		memcpy(Add2Ptr(buffer_le, roff), data, dlen);
3507
3508		a_dirty = true;
3509		if (attr->type == ATTR_ALLOC)
3510			ntfs_fix_pre_write(buffer_le, bytes);
3511		break;
3512
3513	case AddIndexEntryAllocation:
3514		ib = Add2Ptr(buffer_le, roff);
3515		hdr = &ib->ihdr;
3516		e = data;
3517		esize = le16_to_cpu(e->size);
3518		e1 = Add2Ptr(ib, aoff);
3519
3520		if (is_baad(&ib->rhdr))
3521			goto dirty_vol;
3522		if (!check_lsn(&ib->rhdr, rlsn))
3523			goto out;
3524
3525		used = le32_to_cpu(hdr->used);
3526
3527		if (!check_index_buffer(ib, bytes) ||
3528		    !check_if_alloc_index(hdr, aoff) ||
3529		    Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
3530		    used + esize > le32_to_cpu(hdr->total)) {
3531			goto dirty_vol;
3532		}
3533
3534		memmove(Add2Ptr(e1, esize), e1,
3535			PtrOffset(e1, Add2Ptr(hdr, used)));
3536		memcpy(e1, e, esize);
3537
3538		hdr->used = cpu_to_le32(used + esize);
3539
3540		a_dirty = true;
3541
3542		ntfs_fix_pre_write(&ib->rhdr, bytes);
3543		break;
3544
3545	case DeleteIndexEntryAllocation:
3546		ib = Add2Ptr(buffer_le, roff);
3547		hdr = &ib->ihdr;
3548		e = Add2Ptr(ib, aoff);
3549		esize = le16_to_cpu(e->size);
3550
3551		if (is_baad(&ib->rhdr))
3552			goto dirty_vol;
3553		if (!check_lsn(&ib->rhdr, rlsn))
3554			goto out;
3555
3556		if (!check_index_buffer(ib, bytes) ||
3557		    !check_if_alloc_index(hdr, aoff)) {
3558			goto dirty_vol;
3559		}
3560
3561		e1 = Add2Ptr(e, esize);
3562		nsize = esize;
3563		used = le32_to_cpu(hdr->used);
3564
3565		memmove(e, e1, PtrOffset(e1, Add2Ptr(hdr, used)));
3566
3567		hdr->used = cpu_to_le32(used - nsize);
3568
3569		a_dirty = true;
3570
3571		ntfs_fix_pre_write(&ib->rhdr, bytes);
3572		break;
3573
3574	case WriteEndOfIndexBuffer:
3575		ib = Add2Ptr(buffer_le, roff);
3576		hdr = &ib->ihdr;
3577		e = Add2Ptr(ib, aoff);
3578
3579		if (is_baad(&ib->rhdr))
3580			goto dirty_vol;
3581		if (!check_lsn(&ib->rhdr, rlsn))
3582			goto out;
3583		if (!check_index_buffer(ib, bytes) ||
3584		    !check_if_alloc_index(hdr, aoff) ||
3585		    aoff + dlen > offsetof(struct INDEX_BUFFER, ihdr) +
3586					  le32_to_cpu(hdr->total)) {
3587			goto dirty_vol;
3588		}
3589
3590		hdr->used = cpu_to_le32(dlen + PtrOffset(hdr, e));
3591		memmove(e, data, dlen);
3592
3593		a_dirty = true;
3594		ntfs_fix_pre_write(&ib->rhdr, bytes);
3595		break;
3596
3597	case SetIndexEntryVcnAllocation:
3598		ib = Add2Ptr(buffer_le, roff);
3599		hdr = &ib->ihdr;
3600		e = Add2Ptr(ib, aoff);
3601
3602		if (is_baad(&ib->rhdr))
3603			goto dirty_vol;
3604
3605		if (!check_lsn(&ib->rhdr, rlsn))
3606			goto out;
3607		if (!check_index_buffer(ib, bytes) ||
3608		    !check_if_alloc_index(hdr, aoff)) {
3609			goto dirty_vol;
3610		}
3611
3612		de_set_vbn_le(e, *(__le64 *)data);
3613
3614		a_dirty = true;
3615		ntfs_fix_pre_write(&ib->rhdr, bytes);
3616		break;
3617
3618	case UpdateFileNameAllocation:
3619		ib = Add2Ptr(buffer_le, roff);
3620		hdr = &ib->ihdr;
3621		e = Add2Ptr(ib, aoff);
3622
3623		if (is_baad(&ib->rhdr))
3624			goto dirty_vol;
3625
3626		if (!check_lsn(&ib->rhdr, rlsn))
3627			goto out;
3628		if (!check_index_buffer(ib, bytes) ||
3629		    !check_if_alloc_index(hdr, aoff)) {
3630			goto dirty_vol;
3631		}
3632
3633		fname = (struct ATTR_FILE_NAME *)(e + 1);
3634		memmove(&fname->dup, data, sizeof(fname->dup));
3635
3636		a_dirty = true;
3637		ntfs_fix_pre_write(&ib->rhdr, bytes);
3638		break;
3639
3640	case SetBitsInNonresidentBitMap:
3641		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3642		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3643
3644		if (cbo + (off + 7) / 8 > lco ||
3645		    cbo + ((off + bits + 7) / 8) > lco) {
3646			goto dirty_vol;
3647		}
3648
3649		ntfs_bitmap_set_le(Add2Ptr(buffer_le, roff), off, bits);
3650		a_dirty = true;
3651		break;
3652
3653	case ClearBitsInNonresidentBitMap:
3654		off = le32_to_cpu(((struct BITMAP_RANGE *)data)->bitmap_off);
3655		bits = le32_to_cpu(((struct BITMAP_RANGE *)data)->bits);
3656
3657		if (cbo + (off + 7) / 8 > lco ||
3658		    cbo + ((off + bits + 7) / 8) > lco) {
3659			goto dirty_vol;
3660		}
3661
3662		ntfs_bitmap_clear_le(Add2Ptr(buffer_le, roff), off, bits);
3663		a_dirty = true;
3664		break;
3665
3666	case UpdateRecordDataAllocation:
3667		ib = Add2Ptr(buffer_le, roff);
3668		hdr = &ib->ihdr;
3669		e = Add2Ptr(ib, aoff);
3670
3671		if (is_baad(&ib->rhdr))
3672			goto dirty_vol;
3673
3674		if (!check_lsn(&ib->rhdr, rlsn))
3675			goto out;
3676		if (!check_index_buffer(ib, bytes) ||
3677		    !check_if_alloc_index(hdr, aoff)) {
3678			goto dirty_vol;
3679		}
3680
3681		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
3682
3683		a_dirty = true;
3684		ntfs_fix_pre_write(&ib->rhdr, bytes);
3685		break;
3686
3687	default:
3688		WARN_ON(1);
3689	}
3690
3691	if (rlsn) {
3692		__le64 t64 = cpu_to_le64(*rlsn);
3693
3694		if (rec)
3695			rec->rhdr.lsn = t64;
3696		if (ib)
3697			ib->rhdr.lsn = t64;
3698	}
3699
3700	if (mi && mi->dirty) {
3701		err = mi_write(mi, 0);
3702		if (err)
3703			goto out;
3704	}
3705
3706	if (a_dirty) {
3707		attr = oa->attr;
3708		err = ntfs_sb_write_run(sbi, oa->run1, vbo, buffer_le, bytes,
3709					0);
3710		if (err)
3711			goto out;
3712	}
3713
3714out:
3715
3716	if (inode)
3717		iput(inode);
3718	else if (mi != mi2_child)
3719		mi_put(mi);
3720
3721	kfree(buffer_le);
3722
3723	return err;
3724
3725dirty_vol:
3726	log->set_dirty = true;
3727	goto out;
3728}
3729
3730/*
3731 * log_replay - Replays log and empties it.
3732 *
3733 * This function is called during mount operation.
3734 * It replays log and empties it.
3735 * Initialized is set false if logfile contains '-1'.
3736 */
3737int log_replay(struct ntfs_inode *ni, bool *initialized)
3738{
3739	int err;
3740	struct ntfs_sb_info *sbi = ni->mi.sbi;
3741	struct ntfs_log *log;
3742
3743	u64 rec_lsn, checkpt_lsn = 0, rlsn = 0;
3744	struct ATTR_NAME_ENTRY *attr_names = NULL;
3745	u32 attr_names_bytes = 0;
3746	u32 oatbl_bytes = 0;
3747	struct RESTART_TABLE *dptbl = NULL;
3748	struct RESTART_TABLE *trtbl = NULL;
3749	const struct RESTART_TABLE *rt;
3750	struct RESTART_TABLE *oatbl = NULL;
3751	struct inode *inode;
3752	struct OpenAttr *oa;
3753	struct ntfs_inode *ni_oe;
3754	struct ATTRIB *attr = NULL;
3755	u64 size, vcn, undo_next_lsn;
3756	CLST rno, lcn, lcn0, len0, clen;
3757	void *data;
3758	struct NTFS_RESTART *rst = NULL;
3759	struct lcb *lcb = NULL;
3760	struct OPEN_ATTR_ENRTY *oe;
3761	struct ATTR_NAME_ENTRY *ane;
3762	struct TRANSACTION_ENTRY *tr;
3763	struct DIR_PAGE_ENTRY *dp;
3764	u32 i, bytes_per_attr_entry;
3765	u32 vbo, tail, off, dlen;
3766	u32 saved_len, rec_len, transact_id;
3767	bool use_second_page;
3768	struct RESTART_AREA *ra2, *ra = NULL;
3769	struct CLIENT_REC *ca, *cr;
3770	__le16 client;
3771	struct RESTART_HDR *rh;
3772	const struct LFS_RECORD_HDR *frh;
3773	const struct LOG_REC_HDR *lrh;
3774	bool is_mapped;
3775	bool is_ro = sb_rdonly(sbi->sb);
3776	u64 t64;
3777	u16 t16;
3778	u32 t32;
3779
3780	log = kzalloc(sizeof(struct ntfs_log), GFP_NOFS);
3781	if (!log)
3782		return -ENOMEM;
3783
3784	log->ni = ni;
3785	log->l_size = log->orig_file_size = ni->vfs_inode.i_size;
3786
3787	/* Get the size of page. NOTE: To replay we can use default page. */
3788#if PAGE_SIZE >= DefaultLogPageSize && PAGE_SIZE <= DefaultLogPageSize * 2
3789	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, true);
3790#else
3791	log->page_size = norm_file_page(PAGE_SIZE, &log->l_size, false);
3792#endif
3793	if (!log->page_size) {
3794		err = -EINVAL;
3795		goto out;
3796	}
3797
3798	log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);
3799	if (!log->one_page_buf) {
3800		err = -ENOMEM;
3801		goto out;
3802	}
3803
3804	log->page_mask = log->page_size - 1;
3805	log->page_bits = blksize_bits(log->page_size);
3806
3807	/* Look for a restart area on the disk. */
3808	err = log_read_rst(log, true, &log->rst_info);
3809	if (err)
3810		goto out;
3811
3812	/* remember 'initialized' */
3813	*initialized = log->rst_info.initialized;
3814
3815	if (!log->rst_info.restart) {
3816		if (log->rst_info.initialized) {
3817			/* No restart area but the file is not initialized. */
3818			err = -EINVAL;
3819			goto out;
3820		}
3821
3822		log_init_pg_hdr(log, 1, 1);
3823		log_create(log, 0, get_random_u32(), false, false);
3824
3825		ra = log_create_ra(log);
3826		if (!ra) {
3827			err = -ENOMEM;
3828			goto out;
3829		}
3830		log->ra = ra;
3831		log->init_ra = true;
3832
3833		goto process_log;
3834	}
3835
3836	/*
3837	 * If the restart offset above wasn't zero then we won't
3838	 * look for a second restart.
3839	 */
3840	if (log->rst_info.vbo)
3841		goto check_restart_area;
3842
3843	err = log_read_rst(log, false, &log->rst_info2);
3844	if (err)
3845		goto out;
3846
3847	/* Determine which restart area to use. */
3848	if (!log->rst_info2.restart ||
3849	    log->rst_info2.last_lsn <= log->rst_info.last_lsn)
3850		goto use_first_page;
3851
3852	use_second_page = true;
3853
3854	if (log->rst_info.chkdsk_was_run &&
3855	    log->page_size != log->rst_info.vbo) {
3856		struct RECORD_PAGE_HDR *sp = NULL;
3857		bool usa_error;
3858
3859		if (!read_log_page(log, log->page_size, &sp, &usa_error) &&
3860		    sp->rhdr.sign == NTFS_CHKD_SIGNATURE) {
3861			use_second_page = false;
3862		}
3863		kfree(sp);
3864	}
3865
3866	if (use_second_page) {
3867		kfree(log->rst_info.r_page);
3868		memcpy(&log->rst_info, &log->rst_info2,
3869		       sizeof(struct restart_info));
3870		log->rst_info2.r_page = NULL;
3871	}
3872
3873use_first_page:
3874	kfree(log->rst_info2.r_page);
3875
3876check_restart_area:
3877	/*
3878	 * If the restart area is at offset 0, we want
3879	 * to write the second restart area first.
3880	 */
3881	log->init_ra = !!log->rst_info.vbo;
3882
3883	/* If we have a valid page then grab a pointer to the restart area. */
3884	ra2 = log->rst_info.valid_page ?
3885		      Add2Ptr(log->rst_info.r_page,
3886			      le16_to_cpu(log->rst_info.r_page->ra_off)) :
3887		      NULL;
3888
3889	if (log->rst_info.chkdsk_was_run ||
3890	    (ra2 && ra2->client_idx[1] == LFS_NO_CLIENT_LE)) {
3891		bool wrapped = false;
3892		bool use_multi_page = false;
3893		u32 open_log_count;
3894
3895		/* Do some checks based on whether we have a valid log page. */
3896		open_log_count = log->rst_info.valid_page ?
3897					 le32_to_cpu(ra2->open_log_count) :
3898					 get_random_u32();
3899
3900		log_init_pg_hdr(log, 1, 1);
3901
3902		log_create(log, log->rst_info.last_lsn, open_log_count, wrapped,
3903			   use_multi_page);
3904
3905		ra = log_create_ra(log);
3906		if (!ra) {
3907			err = -ENOMEM;
3908			goto out;
3909		}
3910		log->ra = ra;
3911
3912		/* Put the restart areas and initialize
3913		 * the log file as required.
3914		 */
3915		goto process_log;
3916	}
3917
3918	if (!ra2) {
3919		err = -EINVAL;
3920		goto out;
3921	}
3922
3923	/*
3924	 * If the log page or the system page sizes have changed, we can't
3925	 * use the log file. We must use the system page size instead of the
3926	 * default size if there is not a clean shutdown.
3927	 */
3928	t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
3929	if (log->page_size != t32) {
3930		log->l_size = log->orig_file_size;
3931		log->page_size = norm_file_page(t32, &log->l_size,
3932						t32 == DefaultLogPageSize);
3933	}
3934
3935	if (log->page_size != t32 ||
3936	    log->page_size != le32_to_cpu(log->rst_info.r_page->page_size)) {
3937		err = -EINVAL;
3938		goto out;
3939	}
3940
3941	log->page_mask = log->page_size - 1;
3942	log->page_bits = blksize_bits(log->page_size);
3943
3944	/* If the file size has shrunk then we won't mount it. */
3945	if (log->l_size < le64_to_cpu(ra2->l_size)) {
3946		err = -EINVAL;
3947		goto out;
3948	}
3949
3950	log_init_pg_hdr(log, le16_to_cpu(log->rst_info.r_page->major_ver),
3951			le16_to_cpu(log->rst_info.r_page->minor_ver));
3952
3953	log->l_size = le64_to_cpu(ra2->l_size);
3954	log->seq_num_bits = le32_to_cpu(ra2->seq_num_bits);
3955	log->file_data_bits = sizeof(u64) * 8 - log->seq_num_bits;
3956	log->seq_num_mask = (8 << log->file_data_bits) - 1;
3957	log->last_lsn = le64_to_cpu(ra2->current_lsn);
3958	log->seq_num = log->last_lsn >> log->file_data_bits;
3959	log->ra_off = le16_to_cpu(log->rst_info.r_page->ra_off);
3960	log->restart_size = log->sys_page_size - log->ra_off;
3961	log->record_header_len = le16_to_cpu(ra2->rec_hdr_len);
3962	log->ra_size = le16_to_cpu(ra2->ra_len);
3963	log->data_off = le16_to_cpu(ra2->data_off);
3964	log->data_size = log->page_size - log->data_off;
3965	log->reserved = log->data_size - log->record_header_len;
3966
3967	vbo = lsn_to_vbo(log, log->last_lsn);
3968
3969	if (vbo < log->first_page) {
3970		/* This is a pseudo lsn. */
3971		log->l_flags |= NTFSLOG_NO_LAST_LSN;
3972		log->next_page = log->first_page;
3973		goto find_oldest;
3974	}
3975
3976	/* Find the end of this log record. */
3977	off = final_log_off(log, log->last_lsn,
3978			    le32_to_cpu(ra2->last_lsn_data_len));
3979
3980	/* If we wrapped the file then increment the sequence number. */
3981	if (off <= vbo) {
3982		log->seq_num += 1;
3983		log->l_flags |= NTFSLOG_WRAPPED;
3984	}
3985
3986	/* Now compute the next log page to use. */
3987	vbo &= ~log->sys_page_mask;
3988	tail = log->page_size - (off & log->page_mask) - 1;
3989
3990	/*
3991	 *If we can fit another log record on the page,
3992	 * move back a page the log file.
3993	 */
3994	if (tail >= log->record_header_len) {
3995		log->l_flags |= NTFSLOG_REUSE_TAIL;
3996		log->next_page = vbo;
3997	} else {
3998		log->next_page = next_page_off(log, vbo);
3999	}
4000
4001find_oldest:
4002	/*
4003	 * Find the oldest client lsn. Use the last
4004	 * flushed lsn as a starting point.
4005	 */
4006	log->oldest_lsn = log->last_lsn;
4007	oldest_client_lsn(Add2Ptr(ra2, le16_to_cpu(ra2->client_off)),
4008			  ra2->client_idx[1], &log->oldest_lsn);
4009	log->oldest_lsn_off = lsn_to_vbo(log, log->oldest_lsn);
4010
4011	if (log->oldest_lsn_off < log->first_page)
4012		log->l_flags |= NTFSLOG_NO_OLDEST_LSN;
4013
4014	if (!(ra2->flags & RESTART_SINGLE_PAGE_IO))
4015		log->l_flags |= NTFSLOG_WRAPPED | NTFSLOG_MULTIPLE_PAGE_IO;
4016
4017	log->current_openlog_count = le32_to_cpu(ra2->open_log_count);
4018	log->total_avail_pages = log->l_size - log->first_page;
4019	log->total_avail = log->total_avail_pages >> log->page_bits;
4020	log->max_current_avail = log->total_avail * log->reserved;
4021	log->total_avail = log->total_avail * log->data_size;
4022
4023	log->current_avail = current_log_avail(log);
4024
4025	ra = kzalloc(log->restart_size, GFP_NOFS);
4026	if (!ra) {
4027		err = -ENOMEM;
4028		goto out;
4029	}
4030	log->ra = ra;
4031
4032	t16 = le16_to_cpu(ra2->client_off);
4033	if (t16 == offsetof(struct RESTART_AREA, clients)) {
4034		memcpy(ra, ra2, log->ra_size);
4035	} else {
4036		memcpy(ra, ra2, offsetof(struct RESTART_AREA, clients));
4037		memcpy(ra->clients, Add2Ptr(ra2, t16),
4038		       le16_to_cpu(ra2->ra_len) - t16);
4039
4040		log->current_openlog_count = get_random_u32();
4041		ra->open_log_count = cpu_to_le32(log->current_openlog_count);
4042		log->ra_size = offsetof(struct RESTART_AREA, clients) +
4043			       sizeof(struct CLIENT_REC);
4044		ra->client_off =
4045			cpu_to_le16(offsetof(struct RESTART_AREA, clients));
4046		ra->ra_len = cpu_to_le16(log->ra_size);
4047	}
4048
4049	le32_add_cpu(&ra->open_log_count, 1);
4050
4051	/* Now we need to walk through looking for the last lsn. */
4052	err = last_log_lsn(log);
4053	if (err)
4054		goto out;
4055
4056	log->current_avail = current_log_avail(log);
4057
4058	/* Remember which restart area to write first. */
4059	log->init_ra = log->rst_info.vbo;
4060
4061process_log:
4062	/* 1.0, 1.1, 2.0 log->major_ver/minor_ver - short values. */
4063	switch ((log->major_ver << 16) + log->minor_ver) {
4064	case 0x10000:
4065	case 0x10001:
4066	case 0x20000:
4067		break;
4068	default:
4069		ntfs_warn(sbi->sb, "\x24LogFile version %d.%d is not supported",
4070			  log->major_ver, log->minor_ver);
4071		err = -EOPNOTSUPP;
4072		log->set_dirty = true;
4073		goto out;
4074	}
4075
4076	/* One client "NTFS" per logfile. */
4077	ca = Add2Ptr(ra, le16_to_cpu(ra->client_off));
4078
4079	for (client = ra->client_idx[1];; client = cr->next_client) {
4080		if (client == LFS_NO_CLIENT_LE) {
4081			/* Insert "NTFS" client LogFile. */
4082			client = ra->client_idx[0];
4083			if (client == LFS_NO_CLIENT_LE) {
4084				err = -EINVAL;
4085				goto out;
4086			}
4087
4088			t16 = le16_to_cpu(client);
4089			cr = ca + t16;
4090
4091			remove_client(ca, cr, &ra->client_idx[0]);
4092
4093			cr->restart_lsn = 0;
4094			cr->oldest_lsn = cpu_to_le64(log->oldest_lsn);
4095			cr->name_bytes = cpu_to_le32(8);
4096			cr->name[0] = cpu_to_le16('N');
4097			cr->name[1] = cpu_to_le16('T');
4098			cr->name[2] = cpu_to_le16('F');
4099			cr->name[3] = cpu_to_le16('S');
4100
4101			add_client(ca, t16, &ra->client_idx[1]);
4102			break;
4103		}
4104
4105		cr = ca + le16_to_cpu(client);
4106
4107		if (cpu_to_le32(8) == cr->name_bytes &&
4108		    cpu_to_le16('N') == cr->name[0] &&
4109		    cpu_to_le16('T') == cr->name[1] &&
4110		    cpu_to_le16('F') == cr->name[2] &&
4111		    cpu_to_le16('S') == cr->name[3])
4112			break;
4113	}
4114
4115	/* Update the client handle with the client block information. */
4116	log->client_id.seq_num = cr->seq_num;
4117	log->client_id.client_idx = client;
4118
4119	err = read_rst_area(log, &rst, &checkpt_lsn);
4120	if (err)
4121		goto out;
4122
4123	if (!rst)
4124		goto out;
4125
4126	bytes_per_attr_entry = !rst->major_ver ? 0x2C : 0x28;
4127
4128	if (rst->check_point_start)
4129		checkpt_lsn = le64_to_cpu(rst->check_point_start);
4130
4131	/* Allocate and Read the Transaction Table. */
4132	if (!rst->transact_table_len)
4133		goto check_dirty_page_table; /* reduce tab pressure. */
4134
4135	t64 = le64_to_cpu(rst->transact_table_lsn);
4136	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4137	if (err)
4138		goto out;
4139
4140	lrh = lcb->log_rec;
4141	frh = lcb->lrh;
4142	rec_len = le32_to_cpu(frh->client_data_len);
4143
4144	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4145			   bytes_per_attr_entry)) {
4146		err = -EINVAL;
4147		goto out;
4148	}
4149
4150	t16 = le16_to_cpu(lrh->redo_off);
4151
4152	rt = Add2Ptr(lrh, t16);
4153	t32 = rec_len - t16;
4154
4155	/* Now check that this is a valid restart table. */
4156	if (!check_rstbl(rt, t32)) {
4157		err = -EINVAL;
4158		goto out;
4159	}
4160
4161	trtbl = kmemdup(rt, t32, GFP_NOFS);
4162	if (!trtbl) {
4163		err = -ENOMEM;
4164		goto out;
4165	}
4166
4167	lcb_put(lcb);
4168	lcb = NULL;
4169
4170check_dirty_page_table:
4171	/* The next record back should be the Dirty Pages Table. */
4172	if (!rst->dirty_pages_len)
4173		goto check_attribute_names; /* reduce tab pressure. */
4174
4175	t64 = le64_to_cpu(rst->dirty_pages_table_lsn);
4176	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4177	if (err)
4178		goto out;
4179
4180	lrh = lcb->log_rec;
4181	frh = lcb->lrh;
4182	rec_len = le32_to_cpu(frh->client_data_len);
4183
4184	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4185			   bytes_per_attr_entry)) {
4186		err = -EINVAL;
4187		goto out;
4188	}
4189
4190	t16 = le16_to_cpu(lrh->redo_off);
4191
4192	rt = Add2Ptr(lrh, t16);
4193	t32 = rec_len - t16;
4194
4195	/* Now check that this is a valid restart table. */
4196	if (!check_rstbl(rt, t32)) {
4197		err = -EINVAL;
4198		goto out;
4199	}
4200
4201	dptbl = kmemdup(rt, t32, GFP_NOFS);
4202	if (!dptbl) {
4203		err = -ENOMEM;
4204		goto out;
4205	}
4206
4207	/* Convert Ra version '0' into version '1'. */
4208	if (rst->major_ver)
4209		goto end_conv_1; /* reduce tab pressure. */
4210
4211	dp = NULL;
4212	while ((dp = enum_rstbl(dptbl, dp))) {
4213		struct DIR_PAGE_ENTRY_32 *dp0 = (struct DIR_PAGE_ENTRY_32 *)dp;
4214		// NOTE: Danger. Check for of boundary.
4215		memmove(&dp->vcn, &dp0->vcn_low,
4216			2 * sizeof(u64) +
4217				le32_to_cpu(dp->lcns_follow) * sizeof(u64));
4218	}
4219
4220end_conv_1:
4221	lcb_put(lcb);
4222	lcb = NULL;
4223
4224	/*
4225	 * Go through the table and remove the duplicates,
4226	 * remembering the oldest lsn values.
4227	 */
4228	if (sbi->cluster_size <= log->page_size)
4229		goto trace_dp_table; /* reduce tab pressure. */
4230	dp = NULL;
4231	while ((dp = enum_rstbl(dptbl, dp))) {
4232		struct DIR_PAGE_ENTRY *next = dp;
4233
4234		while ((next = enum_rstbl(dptbl, next))) {
4235			if (next->target_attr == dp->target_attr &&
4236			    next->vcn == dp->vcn) {
4237				if (le64_to_cpu(next->oldest_lsn) <
4238				    le64_to_cpu(dp->oldest_lsn)) {
4239					dp->oldest_lsn = next->oldest_lsn;
4240				}
4241
4242				free_rsttbl_idx(dptbl, PtrOffset(dptbl, next));
4243			}
4244		}
4245	}
4246trace_dp_table:
4247check_attribute_names:
4248	/* The next record should be the Attribute Names. */
4249	if (!rst->attr_names_len)
4250		goto check_attr_table; /* reduce tab pressure. */
4251
4252	t64 = le64_to_cpu(rst->attr_names_lsn);
4253	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4254	if (err)
4255		goto out;
4256
4257	lrh = lcb->log_rec;
4258	frh = lcb->lrh;
4259	rec_len = le32_to_cpu(frh->client_data_len);
4260
4261	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4262			   bytes_per_attr_entry)) {
4263		err = -EINVAL;
4264		goto out;
4265	}
4266
4267	t32 = lrh_length(lrh);
4268	attr_names_bytes = rec_len - t32;
4269
4270	attr_names = kmemdup(Add2Ptr(lrh, t32), attr_names_bytes, GFP_NOFS);
4271	if (!attr_names) {
4272		err = -ENOMEM;
4273		goto out;
4274	}
4275
4276	lcb_put(lcb);
4277	lcb = NULL;
4278
4279check_attr_table:
4280	/* The next record should be the attribute Table. */
4281	if (!rst->open_attr_len)
4282		goto check_attribute_names2; /* reduce tab pressure. */
4283
4284	t64 = le64_to_cpu(rst->open_attr_table_lsn);
4285	err = read_log_rec_lcb(log, t64, lcb_ctx_prev, &lcb);
4286	if (err)
4287		goto out;
4288
4289	lrh = lcb->log_rec;
4290	frh = lcb->lrh;
4291	rec_len = le32_to_cpu(frh->client_data_len);
4292
4293	if (!check_log_rec(lrh, rec_len, le32_to_cpu(frh->transact_id),
4294			   bytes_per_attr_entry)) {
4295		err = -EINVAL;
4296		goto out;
4297	}
4298
4299	t16 = le16_to_cpu(lrh->redo_off);
4300
4301	rt = Add2Ptr(lrh, t16);
4302	oatbl_bytes = rec_len - t16;
4303
4304	if (!check_rstbl(rt, oatbl_bytes)) {
4305		err = -EINVAL;
4306		goto out;
4307	}
4308
4309	oatbl = kmemdup(rt, oatbl_bytes, GFP_NOFS);
4310	if (!oatbl) {
4311		err = -ENOMEM;
4312		goto out;
4313	}
4314
4315	log->open_attr_tbl = oatbl;
4316
4317	/* Clear all of the Attr pointers. */
4318	oe = NULL;
4319	while ((oe = enum_rstbl(oatbl, oe))) {
4320		if (!rst->major_ver) {
4321			struct OPEN_ATTR_ENRTY_32 oe0;
4322
4323			/* Really 'oe' points to OPEN_ATTR_ENRTY_32. */
4324			memcpy(&oe0, oe, SIZEOF_OPENATTRIBUTEENTRY0);
4325
4326			oe->bytes_per_index = oe0.bytes_per_index;
4327			oe->type = oe0.type;
4328			oe->is_dirty_pages = oe0.is_dirty_pages;
4329			oe->name_len = 0;
4330			oe->ref = oe0.ref;
4331			oe->open_record_lsn = oe0.open_record_lsn;
4332		}
4333
4334		oe->is_attr_name = 0;
4335		oe->ptr = NULL;
4336	}
4337
4338	lcb_put(lcb);
4339	lcb = NULL;
4340
4341check_attribute_names2:
4342	if (attr_names && oatbl) {
4343		off = 0;
4344		for (;;) {
4345			/* Check we can use attribute name entry 'ane'. */
4346			static_assert(sizeof(*ane) == 4);
4347			if (off + sizeof(*ane) > attr_names_bytes) {
4348				/* just ignore the rest. */
4349				break;
4350			}
4351
4352			ane = Add2Ptr(attr_names, off);
4353			t16 = le16_to_cpu(ane->off);
4354			if (!t16) {
4355				/* this is the only valid exit. */
4356				break;
4357			}
4358
4359			/* Check we can use open attribute entry 'oe'. */
4360			if (t16 + sizeof(*oe) > oatbl_bytes) {
4361				/* just ignore the rest. */
4362				break;
4363			}
4364
4365			/* TODO: Clear table on exit! */
4366			oe = Add2Ptr(oatbl, t16);
4367			t16 = le16_to_cpu(ane->name_bytes);
4368			off += t16 + sizeof(*ane);
4369			if (off > attr_names_bytes) {
4370				/* just ignore the rest. */
4371				break;
4372			}
4373			oe->name_len = t16 / sizeof(short);
4374			oe->ptr = ane->name;
4375			oe->is_attr_name = 2;
4376		}
4377	}
4378
4379	/*
4380	 * If the checkpt_lsn is zero, then this is a freshly
4381	 * formatted disk and we have no work to do.
4382	 */
4383	if (!checkpt_lsn) {
4384		err = 0;
4385		goto out;
4386	}
4387
4388	if (!oatbl) {
4389		oatbl = init_rsttbl(bytes_per_attr_entry, 8);
4390		if (!oatbl) {
4391			err = -ENOMEM;
4392			goto out;
4393		}
4394	}
4395
4396	log->open_attr_tbl = oatbl;
4397
4398	/* Start the analysis pass from the Checkpoint lsn. */
4399	rec_lsn = checkpt_lsn;
4400
4401	/* Read the first lsn. */
4402	err = read_log_rec_lcb(log, checkpt_lsn, lcb_ctx_next, &lcb);
4403	if (err)
4404		goto out;
4405
4406	/* Loop to read all subsequent records to the end of the log file. */
4407next_log_record_analyze:
4408	err = read_next_log_rec(log, lcb, &rec_lsn);
4409	if (err)
4410		goto out;
4411
4412	if (!rec_lsn)
4413		goto end_log_records_enumerate;
4414
4415	frh = lcb->lrh;
4416	transact_id = le32_to_cpu(frh->transact_id);
4417	rec_len = le32_to_cpu(frh->client_data_len);
4418	lrh = lcb->log_rec;
4419
4420	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4421		err = -EINVAL;
4422		goto out;
4423	}
4424
4425	/*
4426	 * The first lsn after the previous lsn remembered
4427	 * the checkpoint is the first candidate for the rlsn.
4428	 */
4429	if (!rlsn)
4430		rlsn = rec_lsn;
4431
4432	if (LfsClientRecord != frh->record_type)
4433		goto next_log_record_analyze;
4434
4435	/*
4436	 * Now update the Transaction Table for this transaction. If there
4437	 * is no entry present or it is unallocated we allocate the entry.
4438	 */
4439	if (!trtbl) {
4440		trtbl = init_rsttbl(sizeof(struct TRANSACTION_ENTRY),
4441				    INITIAL_NUMBER_TRANSACTIONS);
4442		if (!trtbl) {
4443			err = -ENOMEM;
4444			goto out;
4445		}
4446	}
4447
4448	tr = Add2Ptr(trtbl, transact_id);
4449
4450	if (transact_id >= bytes_per_rt(trtbl) ||
4451	    tr->next != RESTART_ENTRY_ALLOCATED_LE) {
4452		tr = alloc_rsttbl_from_idx(&trtbl, transact_id);
4453		if (!tr) {
4454			err = -ENOMEM;
4455			goto out;
4456		}
4457		tr->transact_state = TransactionActive;
4458		tr->first_lsn = cpu_to_le64(rec_lsn);
4459	}
4460
4461	tr->prev_lsn = tr->undo_next_lsn = cpu_to_le64(rec_lsn);
4462
4463	/*
4464	 * If this is a compensation log record, then change
4465	 * the undo_next_lsn to be the undo_next_lsn of this record.
4466	 */
4467	if (lrh->undo_op == cpu_to_le16(CompensationLogRecord))
4468		tr->undo_next_lsn = frh->client_undo_next_lsn;
4469
4470	/* Dispatch to handle log record depending on type. */
4471	switch (le16_to_cpu(lrh->redo_op)) {
4472	case InitializeFileRecordSegment:
4473	case DeallocateFileRecordSegment:
4474	case WriteEndOfFileRecordSegment:
4475	case CreateAttribute:
4476	case DeleteAttribute:
4477	case UpdateResidentValue:
4478	case UpdateNonresidentValue:
4479	case UpdateMappingPairs:
4480	case SetNewAttributeSizes:
4481	case AddIndexEntryRoot:
4482	case DeleteIndexEntryRoot:
4483	case AddIndexEntryAllocation:
4484	case DeleteIndexEntryAllocation:
4485	case WriteEndOfIndexBuffer:
4486	case SetIndexEntryVcnRoot:
4487	case SetIndexEntryVcnAllocation:
4488	case UpdateFileNameRoot:
4489	case UpdateFileNameAllocation:
4490	case SetBitsInNonresidentBitMap:
4491	case ClearBitsInNonresidentBitMap:
4492	case UpdateRecordDataRoot:
4493	case UpdateRecordDataAllocation:
4494	case ZeroEndOfFileRecord:
4495		t16 = le16_to_cpu(lrh->target_attr);
4496		t64 = le64_to_cpu(lrh->target_vcn);
4497		dp = find_dp(dptbl, t16, t64);
4498
4499		if (dp)
4500			goto copy_lcns;
4501
4502		/*
4503		 * Calculate the number of clusters per page the system
4504		 * which wrote the checkpoint, possibly creating the table.
4505		 */
4506		if (dptbl) {
4507			t32 = (le16_to_cpu(dptbl->size) -
4508			       sizeof(struct DIR_PAGE_ENTRY)) /
4509			      sizeof(u64);
4510		} else {
4511			t32 = log->clst_per_page;
4512			kfree(dptbl);
4513			dptbl = init_rsttbl(struct_size(dp, page_lcns, t32),
4514					    32);
4515			if (!dptbl) {
4516				err = -ENOMEM;
4517				goto out;
4518			}
4519		}
4520
4521		dp = alloc_rsttbl_idx(&dptbl);
4522		if (!dp) {
4523			err = -ENOMEM;
4524			goto out;
4525		}
4526		dp->target_attr = cpu_to_le32(t16);
4527		dp->transfer_len = cpu_to_le32(t32 << sbi->cluster_bits);
4528		dp->lcns_follow = cpu_to_le32(t32);
4529		dp->vcn = cpu_to_le64(t64 & ~((u64)t32 - 1));
4530		dp->oldest_lsn = cpu_to_le64(rec_lsn);
4531
4532copy_lcns:
4533		/*
4534		 * Copy the Lcns from the log record into the Dirty Page Entry.
4535		 * TODO: For different page size support, must somehow make
4536		 * whole routine a loop, case Lcns do not fit below.
4537		 */
4538		t16 = le16_to_cpu(lrh->lcns_follow);
4539		for (i = 0; i < t16; i++) {
4540			size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
4541					    le64_to_cpu(dp->vcn));
4542			dp->page_lcns[j + i] = lrh->page_lcns[i];
4543		}
4544
4545		goto next_log_record_analyze;
4546
4547	case DeleteDirtyClusters: {
4548		u32 range_count =
4549			le16_to_cpu(lrh->redo_len) / sizeof(struct LCN_RANGE);
4550		const struct LCN_RANGE *r =
4551			Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4552
4553		/* Loop through all of the Lcn ranges this log record. */
4554		for (i = 0; i < range_count; i++, r++) {
4555			u64 lcn0 = le64_to_cpu(r->lcn);
4556			u64 lcn_e = lcn0 + le64_to_cpu(r->len) - 1;
4557
4558			dp = NULL;
4559			while ((dp = enum_rstbl(dptbl, dp))) {
4560				u32 j;
4561
4562				t32 = le32_to_cpu(dp->lcns_follow);
4563				for (j = 0; j < t32; j++) {
4564					t64 = le64_to_cpu(dp->page_lcns[j]);
4565					if (t64 >= lcn0 && t64 <= lcn_e)
4566						dp->page_lcns[j] = 0;
4567				}
4568			}
4569		}
4570		goto next_log_record_analyze;
4571	}
4572
4573	case OpenNonresidentAttribute:
4574		t16 = le16_to_cpu(lrh->target_attr);
4575		if (t16 >= bytes_per_rt(oatbl)) {
4576			/*
4577			 * Compute how big the table needs to be.
4578			 * Add 10 extra entries for some cushion.
4579			 */
4580			u32 new_e = t16 / le16_to_cpu(oatbl->size);
4581
4582			new_e += 10 - le16_to_cpu(oatbl->used);
4583
4584			oatbl = extend_rsttbl(oatbl, new_e, ~0u);
4585			log->open_attr_tbl = oatbl;
4586			if (!oatbl) {
4587				err = -ENOMEM;
4588				goto out;
4589			}
4590		}
4591
4592		/* Point to the entry being opened. */
4593		oe = alloc_rsttbl_from_idx(&oatbl, t16);
4594		log->open_attr_tbl = oatbl;
4595		if (!oe) {
4596			err = -ENOMEM;
4597			goto out;
4598		}
4599
4600		/* Initialize this entry from the log record. */
4601		t16 = le16_to_cpu(lrh->redo_off);
4602		if (!rst->major_ver) {
4603			/* Convert version '0' into version '1'. */
4604			struct OPEN_ATTR_ENRTY_32 *oe0 = Add2Ptr(lrh, t16);
4605
4606			oe->bytes_per_index = oe0->bytes_per_index;
4607			oe->type = oe0->type;
4608			oe->is_dirty_pages = oe0->is_dirty_pages;
4609			oe->name_len = 0; //oe0.name_len;
4610			oe->ref = oe0->ref;
4611			oe->open_record_lsn = oe0->open_record_lsn;
4612		} else {
4613			memcpy(oe, Add2Ptr(lrh, t16), bytes_per_attr_entry);
4614		}
4615
4616		t16 = le16_to_cpu(lrh->undo_len);
4617		if (t16) {
4618			oe->ptr = kmalloc(t16, GFP_NOFS);
4619			if (!oe->ptr) {
4620				err = -ENOMEM;
4621				goto out;
4622			}
4623			oe->name_len = t16 / sizeof(short);
4624			memcpy(oe->ptr,
4625			       Add2Ptr(lrh, le16_to_cpu(lrh->undo_off)), t16);
4626			oe->is_attr_name = 1;
4627		} else {
4628			oe->ptr = NULL;
4629			oe->is_attr_name = 0;
4630		}
4631
4632		goto next_log_record_analyze;
4633
4634	case HotFix:
4635		t16 = le16_to_cpu(lrh->target_attr);
4636		t64 = le64_to_cpu(lrh->target_vcn);
4637		dp = find_dp(dptbl, t16, t64);
4638		if (dp) {
4639			size_t j = le64_to_cpu(lrh->target_vcn) -
4640				   le64_to_cpu(dp->vcn);
4641			if (dp->page_lcns[j])
4642				dp->page_lcns[j] = lrh->page_lcns[0];
4643		}
4644		goto next_log_record_analyze;
4645
4646	case EndTopLevelAction:
4647		tr = Add2Ptr(trtbl, transact_id);
4648		tr->prev_lsn = cpu_to_le64(rec_lsn);
4649		tr->undo_next_lsn = frh->client_undo_next_lsn;
4650		goto next_log_record_analyze;
4651
4652	case PrepareTransaction:
4653		tr = Add2Ptr(trtbl, transact_id);
4654		tr->transact_state = TransactionPrepared;
4655		goto next_log_record_analyze;
4656
4657	case CommitTransaction:
4658		tr = Add2Ptr(trtbl, transact_id);
4659		tr->transact_state = TransactionCommitted;
4660		goto next_log_record_analyze;
4661
4662	case ForgetTransaction:
4663		free_rsttbl_idx(trtbl, transact_id);
4664		goto next_log_record_analyze;
4665
4666	case Noop:
4667	case OpenAttributeTableDump:
4668	case AttributeNamesDump:
4669	case DirtyPageTableDump:
4670	case TransactionTableDump:
4671		/* The following cases require no action the Analysis Pass. */
4672		goto next_log_record_analyze;
4673
4674	default:
4675		/*
4676		 * All codes will be explicitly handled.
4677		 * If we see a code we do not expect, then we are trouble.
4678		 */
4679		goto next_log_record_analyze;
4680	}
4681
4682end_log_records_enumerate:
4683	lcb_put(lcb);
4684	lcb = NULL;
4685
4686	/*
4687	 * Scan the Dirty Page Table and Transaction Table for
4688	 * the lowest lsn, and return it as the Redo lsn.
4689	 */
4690	dp = NULL;
4691	while ((dp = enum_rstbl(dptbl, dp))) {
4692		t64 = le64_to_cpu(dp->oldest_lsn);
4693		if (t64 && t64 < rlsn)
4694			rlsn = t64;
4695	}
4696
4697	tr = NULL;
4698	while ((tr = enum_rstbl(trtbl, tr))) {
4699		t64 = le64_to_cpu(tr->first_lsn);
4700		if (t64 && t64 < rlsn)
4701			rlsn = t64;
4702	}
4703
4704	/*
4705	 * Only proceed if the Dirty Page Table or Transaction
4706	 * table are not empty.
4707	 */
4708	if ((!dptbl || !dptbl->total) && (!trtbl || !trtbl->total))
4709		goto end_replay;
4710
4711	sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
4712	if (is_ro)
4713		goto out;
4714
4715	/* Reopen all of the attributes with dirty pages. */
4716	oe = NULL;
4717next_open_attribute:
4718
4719	oe = enum_rstbl(oatbl, oe);
4720	if (!oe) {
4721		err = 0;
4722		dp = NULL;
4723		goto next_dirty_page;
4724	}
4725
4726	oa = kzalloc(sizeof(struct OpenAttr), GFP_NOFS);
4727	if (!oa) {
4728		err = -ENOMEM;
4729		goto out;
4730	}
4731
4732	inode = ntfs_iget5(sbi->sb, &oe->ref, NULL);
4733	if (IS_ERR(inode))
4734		goto fake_attr;
4735
4736	if (is_bad_inode(inode)) {
4737		iput(inode);
4738fake_attr:
4739		if (oa->ni) {
4740			iput(&oa->ni->vfs_inode);
4741			oa->ni = NULL;
4742		}
4743
4744		attr = attr_create_nonres_log(sbi, oe->type, 0, oe->ptr,
4745					      oe->name_len, 0);
4746		if (!attr) {
4747			kfree(oa);
4748			err = -ENOMEM;
4749			goto out;
4750		}
4751		oa->attr = attr;
4752		oa->run1 = &oa->run0;
4753		goto final_oe;
4754	}
4755
4756	ni_oe = ntfs_i(inode);
4757	oa->ni = ni_oe;
4758
4759	attr = ni_find_attr(ni_oe, NULL, NULL, oe->type, oe->ptr, oe->name_len,
4760			    NULL, NULL);
4761
4762	if (!attr)
4763		goto fake_attr;
4764
4765	t32 = le32_to_cpu(attr->size);
4766	oa->attr = kmemdup(attr, t32, GFP_NOFS);
4767	if (!oa->attr)
4768		goto fake_attr;
4769
4770	if (!S_ISDIR(inode->i_mode)) {
4771		if (attr->type == ATTR_DATA && !attr->name_len) {
4772			oa->run1 = &ni_oe->file.run;
4773			goto final_oe;
4774		}
4775	} else {
4776		if (attr->type == ATTR_ALLOC &&
4777		    attr->name_len == ARRAY_SIZE(I30_NAME) &&
4778		    !memcmp(attr_name(attr), I30_NAME, sizeof(I30_NAME))) {
4779			oa->run1 = &ni_oe->dir.alloc_run;
4780			goto final_oe;
4781		}
4782	}
4783
4784	if (attr->non_res) {
4785		u16 roff = le16_to_cpu(attr->nres.run_off);
4786		CLST svcn = le64_to_cpu(attr->nres.svcn);
4787
4788		if (roff > t32) {
4789			kfree(oa->attr);
4790			oa->attr = NULL;
4791			goto fake_attr;
4792		}
4793
4794		err = run_unpack(&oa->run0, sbi, inode->i_ino, svcn,
4795				 le64_to_cpu(attr->nres.evcn), svcn,
4796				 Add2Ptr(attr, roff), t32 - roff);
4797		if (err < 0) {
4798			kfree(oa->attr);
4799			oa->attr = NULL;
4800			goto fake_attr;
4801		}
4802		err = 0;
4803	}
4804	oa->run1 = &oa->run0;
4805	attr = oa->attr;
4806
4807final_oe:
4808	if (oe->is_attr_name == 1)
4809		kfree(oe->ptr);
4810	oe->is_attr_name = 0;
4811	oe->ptr = oa;
4812	oe->name_len = attr->name_len;
4813
4814	goto next_open_attribute;
4815
4816	/*
4817	 * Now loop through the dirty page table to extract all of the Vcn/Lcn.
4818	 * Mapping that we have, and insert it into the appropriate run.
4819	 */
4820next_dirty_page:
4821	dp = enum_rstbl(dptbl, dp);
4822	if (!dp)
4823		goto do_redo_1;
4824
4825	oe = Add2Ptr(oatbl, le32_to_cpu(dp->target_attr));
4826
4827	if (oe->next != RESTART_ENTRY_ALLOCATED_LE)
4828		goto next_dirty_page;
4829
4830	oa = oe->ptr;
4831	if (!oa)
4832		goto next_dirty_page;
4833
4834	i = -1;
4835next_dirty_page_vcn:
4836	i += 1;
4837	if (i >= le32_to_cpu(dp->lcns_follow))
4838		goto next_dirty_page;
4839
4840	vcn = le64_to_cpu(dp->vcn) + i;
4841	size = (vcn + 1) << sbi->cluster_bits;
4842
4843	if (!dp->page_lcns[i])
4844		goto next_dirty_page_vcn;
4845
4846	rno = ino_get(&oe->ref);
4847	if (rno <= MFT_REC_MIRR &&
4848	    size < (MFT_REC_VOL + 1) * sbi->record_size &&
4849	    oe->type == ATTR_DATA) {
4850		goto next_dirty_page_vcn;
4851	}
4852
4853	lcn = le64_to_cpu(dp->page_lcns[i]);
4854
4855	if ((!run_lookup_entry(oa->run1, vcn, &lcn0, &len0, NULL) ||
4856	     lcn0 != lcn) &&
4857	    !run_add_entry(oa->run1, vcn, lcn, 1, false)) {
4858		err = -ENOMEM;
4859		goto out;
4860	}
4861	attr = oa->attr;
4862	if (size > le64_to_cpu(attr->nres.alloc_size)) {
4863		attr->nres.valid_size = attr->nres.data_size =
4864			attr->nres.alloc_size = cpu_to_le64(size);
4865	}
4866	goto next_dirty_page_vcn;
4867
4868do_redo_1:
4869	/*
4870	 * Perform the Redo Pass, to restore all of the dirty pages to the same
4871	 * contents that they had immediately before the crash. If the dirty
4872	 * page table is empty, then we can skip the entire Redo Pass.
4873	 */
4874	if (!dptbl || !dptbl->total)
4875		goto do_undo_action;
4876
4877	rec_lsn = rlsn;
4878
4879	/*
4880	 * Read the record at the Redo lsn, before falling
4881	 * into common code to handle each record.
4882	 */
4883	err = read_log_rec_lcb(log, rlsn, lcb_ctx_next, &lcb);
4884	if (err)
4885		goto out;
4886
4887	/*
4888	 * Now loop to read all of our log records forwards, until
4889	 * we hit the end of the file, cleaning up at the end.
4890	 */
4891do_action_next:
4892	frh = lcb->lrh;
4893
4894	if (LfsClientRecord != frh->record_type)
4895		goto read_next_log_do_action;
4896
4897	transact_id = le32_to_cpu(frh->transact_id);
4898	rec_len = le32_to_cpu(frh->client_data_len);
4899	lrh = lcb->log_rec;
4900
4901	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
4902		err = -EINVAL;
4903		goto out;
4904	}
4905
4906	/* Ignore log records that do not update pages. */
4907	if (lrh->lcns_follow)
4908		goto find_dirty_page;
4909
4910	goto read_next_log_do_action;
4911
4912find_dirty_page:
4913	t16 = le16_to_cpu(lrh->target_attr);
4914	t64 = le64_to_cpu(lrh->target_vcn);
4915	dp = find_dp(dptbl, t16, t64);
4916
4917	if (!dp)
4918		goto read_next_log_do_action;
4919
4920	if (rec_lsn < le64_to_cpu(dp->oldest_lsn))
4921		goto read_next_log_do_action;
4922
4923	t16 = le16_to_cpu(lrh->target_attr);
4924	if (t16 >= bytes_per_rt(oatbl)) {
4925		err = -EINVAL;
4926		goto out;
4927	}
4928
4929	oe = Add2Ptr(oatbl, t16);
4930
4931	if (oe->next != RESTART_ENTRY_ALLOCATED_LE) {
4932		err = -EINVAL;
4933		goto out;
4934	}
4935
4936	oa = oe->ptr;
4937
4938	if (!oa) {
4939		err = -EINVAL;
4940		goto out;
4941	}
4942	attr = oa->attr;
4943
4944	vcn = le64_to_cpu(lrh->target_vcn);
4945
4946	if (!run_lookup_entry(oa->run1, vcn, &lcn, NULL, NULL) ||
4947	    lcn == SPARSE_LCN) {
4948		goto read_next_log_do_action;
4949	}
4950
4951	/* Point to the Redo data and get its length. */
4952	data = Add2Ptr(lrh, le16_to_cpu(lrh->redo_off));
4953	dlen = le16_to_cpu(lrh->redo_len);
4954
4955	/* Shorten length by any Lcns which were deleted. */
4956	saved_len = dlen;
4957
4958	for (i = le16_to_cpu(lrh->lcns_follow); i; i--) {
4959		size_t j;
4960		u32 alen, voff;
4961
4962		voff = le16_to_cpu(lrh->record_off) +
4963		       le16_to_cpu(lrh->attr_off);
4964		voff += le16_to_cpu(lrh->cluster_off) << SECTOR_SHIFT;
4965
4966		/* If the Vcn question is allocated, we can just get out. */
4967		j = le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn);
4968		if (dp->page_lcns[j + i - 1])
4969			break;
4970
4971		if (!saved_len)
4972			saved_len = 1;
4973
4974		/*
4975		 * Calculate the allocated space left relative to the
4976		 * log record Vcn, after removing this unallocated Vcn.
4977		 */
4978		alen = (i - 1) << sbi->cluster_bits;
4979
4980		/*
4981		 * If the update described this log record goes beyond
4982		 * the allocated space, then we will have to reduce the length.
4983		 */
4984		if (voff >= alen)
4985			dlen = 0;
4986		else if (voff + dlen > alen)
4987			dlen = alen - voff;
4988	}
4989
4990	/*
4991	 * If the resulting dlen from above is now zero,
4992	 * we can skip this log record.
4993	 */
4994	if (!dlen && saved_len)
4995		goto read_next_log_do_action;
4996
4997	t16 = le16_to_cpu(lrh->redo_op);
4998	if (can_skip_action(t16))
4999		goto read_next_log_do_action;
5000
5001	/* Apply the Redo operation a common routine. */
5002	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, &rec_lsn);
5003	if (err)
5004		goto out;
5005
5006	/* Keep reading and looping back until end of file. */
5007read_next_log_do_action:
5008	err = read_next_log_rec(log, lcb, &rec_lsn);
5009	if (!err && rec_lsn)
5010		goto do_action_next;
5011
5012	lcb_put(lcb);
5013	lcb = NULL;
5014
5015do_undo_action:
5016	/* Scan Transaction Table. */
5017	tr = NULL;
5018transaction_table_next:
5019	tr = enum_rstbl(trtbl, tr);
5020	if (!tr)
5021		goto undo_action_done;
5022
5023	if (TransactionActive != tr->transact_state || !tr->undo_next_lsn) {
5024		free_rsttbl_idx(trtbl, PtrOffset(trtbl, tr));
5025		goto transaction_table_next;
5026	}
5027
5028	log->transaction_id = PtrOffset(trtbl, tr);
5029	undo_next_lsn = le64_to_cpu(tr->undo_next_lsn);
5030
5031	/*
5032	 * We only have to do anything if the transaction has
5033	 * something its undo_next_lsn field.
5034	 */
5035	if (!undo_next_lsn)
5036		goto commit_undo;
5037
5038	/* Read the first record to be undone by this transaction. */
5039	err = read_log_rec_lcb(log, undo_next_lsn, lcb_ctx_undo_next, &lcb);
5040	if (err)
5041		goto out;
5042
5043	/*
5044	 * Now loop to read all of our log records forwards,
5045	 * until we hit the end of the file, cleaning up at the end.
5046	 */
5047undo_action_next:
5048
5049	lrh = lcb->log_rec;
5050	frh = lcb->lrh;
5051	transact_id = le32_to_cpu(frh->transact_id);
5052	rec_len = le32_to_cpu(frh->client_data_len);
5053
5054	if (!check_log_rec(lrh, rec_len, transact_id, bytes_per_attr_entry)) {
5055		err = -EINVAL;
5056		goto out;
5057	}
5058
5059	if (lrh->undo_op == cpu_to_le16(Noop))
5060		goto read_next_log_undo_action;
5061
5062	oe = Add2Ptr(oatbl, le16_to_cpu(lrh->target_attr));
5063	oa = oe->ptr;
5064
5065	t16 = le16_to_cpu(lrh->lcns_follow);
5066	if (!t16)
5067		goto add_allocated_vcns;
5068
5069	is_mapped = run_lookup_entry(oa->run1, le64_to_cpu(lrh->target_vcn),
5070				     &lcn, &clen, NULL);
5071
5072	/*
5073	 * If the mapping isn't already the table or the  mapping
5074	 * corresponds to a hole the mapping, we need to make sure
5075	 * there is no partial page already memory.
5076	 */
5077	if (is_mapped && lcn != SPARSE_LCN && clen >= t16)
5078		goto add_allocated_vcns;
5079
5080	vcn = le64_to_cpu(lrh->target_vcn);
5081	vcn &= ~(u64)(log->clst_per_page - 1);
5082
5083add_allocated_vcns:
5084	for (i = 0, vcn = le64_to_cpu(lrh->target_vcn),
5085	    size = (vcn + 1) << sbi->cluster_bits;
5086	     i < t16; i++, vcn += 1, size += sbi->cluster_size) {
5087		attr = oa->attr;
5088		if (!attr->non_res) {
5089			if (size > le32_to_cpu(attr->res.data_size))
5090				attr->res.data_size = cpu_to_le32(size);
5091		} else {
5092			if (size > le64_to_cpu(attr->nres.data_size))
5093				attr->nres.valid_size = attr->nres.data_size =
5094					attr->nres.alloc_size =
5095						cpu_to_le64(size);
5096		}
5097	}
5098
5099	t16 = le16_to_cpu(lrh->undo_op);
5100	if (can_skip_action(t16))
5101		goto read_next_log_undo_action;
5102
5103	/* Point to the Redo data and get its length. */
5104	data = Add2Ptr(lrh, le16_to_cpu(lrh->undo_off));
5105	dlen = le16_to_cpu(lrh->undo_len);
5106
5107	/* It is time to apply the undo action. */
5108	err = do_action(log, oe, lrh, t16, data, dlen, rec_len, NULL);
5109
5110read_next_log_undo_action:
5111	/*
5112	 * Keep reading and looping back until we have read the
5113	 * last record for this transaction.
5114	 */
5115	err = read_next_log_rec(log, lcb, &rec_lsn);
5116	if (err)
5117		goto out;
5118
5119	if (rec_lsn)
5120		goto undo_action_next;
5121
5122	lcb_put(lcb);
5123	lcb = NULL;
5124
5125commit_undo:
5126	free_rsttbl_idx(trtbl, log->transaction_id);
5127
5128	log->transaction_id = 0;
5129
5130	goto transaction_table_next;
5131
5132undo_action_done:
5133
5134	ntfs_update_mftmirr(sbi, 0);
5135
5136	sbi->flags &= ~NTFS_FLAGS_NEED_REPLAY;
5137
5138end_replay:
5139
5140	err = 0;
5141	if (is_ro)
5142		goto out;
5143
5144	rh = kzalloc(log->page_size, GFP_NOFS);
5145	if (!rh) {
5146		err = -ENOMEM;
5147		goto out;
5148	}
5149
5150	rh->rhdr.sign = NTFS_RSTR_SIGNATURE;
5151	rh->rhdr.fix_off = cpu_to_le16(offsetof(struct RESTART_HDR, fixups));
5152	t16 = (log->page_size >> SECTOR_SHIFT) + 1;
5153	rh->rhdr.fix_num = cpu_to_le16(t16);
5154	rh->sys_page_size = cpu_to_le32(log->page_size);
5155	rh->page_size = cpu_to_le32(log->page_size);
5156
5157	t16 = ALIGN(offsetof(struct RESTART_HDR, fixups) + sizeof(short) * t16,
5158		    8);
5159	rh->ra_off = cpu_to_le16(t16);
5160	rh->minor_ver = cpu_to_le16(1); // 0x1A:
5161	rh->major_ver = cpu_to_le16(1); // 0x1C:
5162
5163	ra2 = Add2Ptr(rh, t16);
5164	memcpy(ra2, ra, sizeof(struct RESTART_AREA));
5165
5166	ra2->client_idx[0] = 0;
5167	ra2->client_idx[1] = LFS_NO_CLIENT_LE;
5168	ra2->flags = cpu_to_le16(2);
5169
5170	le32_add_cpu(&ra2->open_log_count, 1);
5171
5172	ntfs_fix_pre_write(&rh->rhdr, log->page_size);
5173
5174	err = ntfs_sb_write_run(sbi, &ni->file.run, 0, rh, log->page_size, 0);
5175	if (!err)
5176		err = ntfs_sb_write_run(sbi, &log->ni->file.run, log->page_size,
5177					rh, log->page_size, 0);
5178
5179	kfree(rh);
5180	if (err)
5181		goto out;
5182
5183out:
5184	kfree(rst);
5185	if (lcb)
5186		lcb_put(lcb);
5187
5188	/*
5189	 * Scan the Open Attribute Table to close all of
5190	 * the open attributes.
5191	 */
5192	oe = NULL;
5193	while ((oe = enum_rstbl(oatbl, oe))) {
5194		rno = ino_get(&oe->ref);
5195
5196		if (oe->is_attr_name == 1) {
5197			kfree(oe->ptr);
5198			oe->ptr = NULL;
5199			continue;
5200		}
5201
5202		if (oe->is_attr_name)
5203			continue;
5204
5205		oa = oe->ptr;
5206		if (!oa)
5207			continue;
5208
5209		run_close(&oa->run0);
5210		kfree(oa->attr);
5211		if (oa->ni)
5212			iput(&oa->ni->vfs_inode);
5213		kfree(oa);
5214	}
5215
5216	kfree(trtbl);
5217	kfree(oatbl);
5218	kfree(dptbl);
5219	kfree(attr_names);
5220	kfree(log->rst_info.r_page);
5221
5222	kfree(ra);
5223	kfree(log->one_page_buf);
5224
5225	if (err)
5226		sbi->flags |= NTFS_FLAGS_NEED_REPLAY;
5227
5228	if (err == -EROFS)
5229		err = 0;
5230	else if (log->set_dirty)
5231		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
5232
5233	kfree(log);
5234
5235	return err;
5236}