[PATCH 0/4] nilfs2 mount/recovery updates for 2.6.33

[PATCH 0/4] nilfs2 mount/recovery updates for 2.6.33

[Ryusuke Konishi]

This is another series for the next merge window.

The first patch improves recovery time after unclean unmount, and the
remaining is a revision of the patch I posted in the thread titled
("[NILFS users] urgent help need! disk partition info lost"); the last
one adds `norepair' mount option, which allows users to avoid temporal
write access in a read-only mount or snapshots at mount/recovery.
And, the middle two are the cleanup for it.

This series is made against the latest for-next branch of

 git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2.git

But, possibly applicable to the mainline.

Thanks,
Ryusuke Konishi
--
Ryusuke Konishi (4):
      nilfs2: apply readahead for recovery on mount
      nilfs2: move recovery completion into load_nilfs function
      nilfs2: add helper to get if volume is in a valid state
      nilfs2: add norepair mount option

 Documentation/filesystems/nilfs2.txt |    4 ++
 fs/nilfs2/recovery.c                 |   26 +++++++---
 fs/nilfs2/super.c                    |   53 +++++++-------------
 fs/nilfs2/the_nilfs.c                |   92 ++++++++++++++++++++++++----------
 fs/nilfs2/the_nilfs.h                |   10 ++++
 include/linux/nilfs2_fs.h            |    2 +
 6 files changed, 118 insertions(+), 69 deletions(-)

[PATCH 1/4] nilfs2: apply readahead for recovery on mount

[Ryusuke Konishi]

This inserts readahead in the recovery code.  The readahead request is
issued per segment while searching the latest super root block.

This will shorten mount time after unclean unmount.  A measurement
shows the recovery time was reduced by more than 60 percent:

 e.g. real  0m11.586s -> 0m3.918s  (x 2.96)

Signed-off-by: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
---
 fs/nilfs2/recovery.c |   26 +++++++++++++++++++-------
 1 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index bcd386d..6d5412e 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -798,6 +798,7 @@ int nilfs_search_super_root(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi,
 	struct nilfs_segsum_info ssi;
 	sector_t pseg_start, pseg_end, sr_pseg_start = 0;
 	sector_t seg_start, seg_end; /* range of full segment (block number) */
+	sector_t b, end;
 	u64 seg_seq;
 	__u64 segnum, nextnum = 0;
 	__u64 cno;
@@ -813,6 +814,11 @@ int nilfs_search_super_root(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi,
 	/* Calculate range of segment */
 	nilfs_get_segment_range(nilfs, segnum, &seg_start, &seg_end);
 
+	/* Read ahead segment */
+	b = seg_start;
+	while (b <= seg_end)
+		sb_breadahead(sbi->s_super, b++);
+
 	for (;;) {
 		/* Load segment summary */
 		ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi, 1);
@@ -835,14 +841,20 @@ int nilfs_search_super_root(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi,
 		ri->ri_nextnum = nextnum;
 		empty_seg = 0;
 
+		if (!NILFS_SEG_HAS_SR(&ssi) && !scan_newer) {
+			/* This will never happen because a superblock
+			   (last_segment) always points to a pseg
+			   having a super root. */
+			ret = NILFS_SEG_FAIL_CONSISTENCY;
+			goto failed;
+		}
+
+		if (pseg_start == seg_start) {
+			nilfs_get_segment_range(nilfs, nextnum, &b, &end);
+			while (b <= end)
+				sb_breadahead(sbi->s_super, b++);
+		}
 		if (!NILFS_SEG_HAS_SR(&ssi)) {
-			if (!scan_newer) {
-				/* This will never happen because a superblock
-				   (last_segment) always points to a pseg
-				   having a super root. */
-				ret = NILFS_SEG_FAIL_CONSISTENCY;
-				goto failed;
-			}
 			if (!ri->ri_lsegs_start && NILFS_SEG_LOGBGN(&ssi)) {
 				ri->ri_lsegs_start = pseg_start;
 				ri->ri_lsegs_start_seq = seg_seq;
-- 
1.6.3.4

[PATCH 2/4] nilfs2: move recovery completion into load_nilfs function

[Ryusuke Konishi]

Although mount recovery of nilfs is integrated in load_nilfs()
procedure, the completion of recovery was isolated from the procedure
and performed at the end of the fill_super routine.

This was somewhat confusing since the recovery is needed for the nilfs
object, not for a super block instance.

To resolve the inconsistency, this will integrate the recovery
completion into load_nilfs().

Signed-off-by: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
---
 fs/nilfs2/super.c     |   39 +++-----------------------
 fs/nilfs2/the_nilfs.c |   70 +++++++++++++++++++++++++++++++++---------------
 2 files changed, 53 insertions(+), 56 deletions(-)

diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index f526169..990ead4 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -414,22 +414,6 @@ void nilfs_detach_checkpoint(struct nilfs_sb_info *sbi)
 	up_write(&nilfs->ns_super_sem);
 }
 
-static int nilfs_mark_recovery_complete(struct nilfs_sb_info *sbi)
-{
-	struct the_nilfs *nilfs = sbi->s_nilfs;
-	int err = 0;
-
-	down_write(&nilfs->ns_sem);
-	if (!(nilfs->ns_mount_state & NILFS_VALID_FS)) {
-		nilfs->ns_mount_state |= NILFS_VALID_FS;
-		err = nilfs_commit_super(sbi, 1);
-		if (likely(!err))
-			printk(KERN_INFO "NILFS: recovery complete.\n");
-	}
-	up_write(&nilfs->ns_sem);
-	return err;
-}
-
 static int nilfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	struct super_block *sb = dentry->d_sb;
@@ -649,9 +633,7 @@ static int nilfs_setup_super(struct nilfs_sb_info *sbi)
 	int mnt_count = le16_to_cpu(sbp->s_mnt_count);
 
 	/* nilfs->sem must be locked by the caller. */
-	if (!(nilfs->ns_mount_state & NILFS_VALID_FS)) {
-		printk(KERN_WARNING "NILFS warning: mounting unchecked fs\n");
-	} else if (nilfs->ns_mount_state & NILFS_ERROR_FS) {
+	if (nilfs->ns_mount_state & NILFS_ERROR_FS) {
 		printk(KERN_WARNING
 		       "NILFS warning: mounting fs with errors\n");
 #if 0
@@ -759,11 +741,10 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent,
 	sb->s_root = NULL;
 	sb->s_time_gran = 1;
 
-	if (!nilfs_loaded(nilfs)) {
-		err = load_nilfs(nilfs, sbi);
-		if (err)
-			goto failed_sbi;
-	}
+	err = load_nilfs(nilfs, sbi);
+	if (err)
+		goto failed_sbi;
+
 	cno = nilfs_last_cno(nilfs);
 
 	if (sb->s_flags & MS_RDONLY) {
@@ -831,12 +812,6 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent,
 		up_write(&nilfs->ns_sem);
 	}
 
-	err = nilfs_mark_recovery_complete(sbi);
-	if (unlikely(err)) {
-		printk(KERN_ERR "NILFS: recovery failed.\n");
-		goto failed_root;
-	}
-
 	down_write(&nilfs->ns_super_sem);
 	if (!nilfs_test_opt(sbi, SNAPSHOT))
 		nilfs->ns_current = sbi;
@@ -844,10 +819,6 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent,
 
 	return 0;
 
- failed_root:
-	dput(sb->s_root);
-	sb->s_root = NULL;
-
  failed_segctor:
 	nilfs_detach_segment_constructor(sbi);
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 4d4d35c..aea2b58 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -262,28 +262,27 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 	unsigned int s_flags = sbi->s_super->s_flags;
 	int really_read_only = bdev_read_only(nilfs->ns_bdev);
 	unsigned valid_fs;
-	int err = 0;
+	int err;
 
-	nilfs_init_recovery_info(&ri);
+	if (nilfs_loaded(nilfs))
+		return 0;
 
 	down_write(&nilfs->ns_sem);
 	valid_fs = (nilfs->ns_mount_state & NILFS_VALID_FS);
 	up_write(&nilfs->ns_sem);
 
-	if (!valid_fs && (s_flags & MS_RDONLY)) {
-		printk(KERN_INFO "NILFS: INFO: recovery "
-		       "required for readonly filesystem.\n");
-		if (really_read_only) {
-			printk(KERN_ERR "NILFS: write access "
-			       "unavailable, cannot proceed.\n");
-			err = -EROFS;
-			goto failed;
+	if (!valid_fs) {
+		printk(KERN_WARNING "NILFS warning: mounting unchecked fs\n");
+		if (s_flags & MS_RDONLY) {
+			printk(KERN_INFO "NILFS: INFO: recovery "
+			       "required for readonly filesystem.\n");
+			printk(KERN_INFO "NILFS: write access will "
+			       "be enabled during recovery.\n");
 		}
-		printk(KERN_INFO "NILFS: write access will "
-		       "be enabled during recovery.\n");
-		sbi->s_super->s_flags &= ~MS_RDONLY;
 	}
 
+	nilfs_init_recovery_info(&ri);
+
 	err = nilfs_search_super_root(nilfs, sbi, &ri);
 	if (unlikely(err)) {
 		printk(KERN_ERR "NILFS: error searching super root.\n");
@@ -296,19 +295,46 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 		goto failed;
 	}
 
-	if (!valid_fs) {
-		err = nilfs_recover_logical_segments(nilfs, sbi, &ri);
-		if (unlikely(err)) {
-			nilfs_mdt_destroy(nilfs->ns_cpfile);
-			nilfs_mdt_destroy(nilfs->ns_sufile);
-			nilfs_mdt_destroy(nilfs->ns_dat);
-			goto failed;
+	if (valid_fs)
+		goto skip_recovery;
+
+	if (s_flags & MS_RDONLY) {
+		if (really_read_only) {
+			printk(KERN_ERR "NILFS: write access "
+			       "unavailable, cannot proceed.\n");
+			err = -EROFS;
+			goto failed_unload;
 		}
-		if (ri.ri_need_recovery == NILFS_RECOVERY_SR_UPDATED)
-			sbi->s_super->s_dirt = 1;
+		sbi->s_super->s_flags &= ~MS_RDONLY;
+	}
+
+	err = nilfs_recover_logical_segments(nilfs, sbi, &ri);
+	if (err)
+		goto failed_unload;
+
+	down_write(&nilfs->ns_sem);
+	nilfs->ns_mount_state |= NILFS_VALID_FS;
+	nilfs->ns_sbp[0]->s_state = cpu_to_le16(nilfs->ns_mount_state);
+	err = nilfs_commit_super(sbi, 1);
+	up_write(&nilfs->ns_sem);
+
+	if (err) {
+		printk(KERN_ERR "NILFS: failed to update super block. "
+		       "recovery unfinished.\n");
+		goto failed_unload;
 	}
+	printk(KERN_INFO "NILFS: recovery complete.\n");
 
+ skip_recovery:
 	set_nilfs_loaded(nilfs);
+	nilfs_clear_recovery_info(&ri);
+	sbi->s_super->s_flags = s_flags;
+	return 0;
+
+ failed_unload:
+	nilfs_mdt_destroy(nilfs->ns_cpfile);
+	nilfs_mdt_destroy(nilfs->ns_sufile);
+	nilfs_mdt_destroy(nilfs->ns_dat);
 
  failed:
 	nilfs_clear_recovery_info(&ri);
-- 
1.6.3.4

[PATCH 3/4] nilfs2: add helper to get if volume is in a valid state

[Ryusuke Konishi]

This adds a helper function, nilfs_valid_fs() which returns if nilfs
is in a valid state or not.  This is a preparation for the successive
patch to add norepair mount option.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
---
 fs/nilfs2/the_nilfs.c |    6 +-----
 fs/nilfs2/the_nilfs.h |   10 ++++++++++
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index aea2b58..890a8d3 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -261,16 +261,12 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 	struct nilfs_recovery_info ri;
 	unsigned int s_flags = sbi->s_super->s_flags;
 	int really_read_only = bdev_read_only(nilfs->ns_bdev);
-	unsigned valid_fs;
+	int valid_fs = nilfs_valid_fs(nilfs);
 	int err;
 
 	if (nilfs_loaded(nilfs))
 		return 0;
 
-	down_write(&nilfs->ns_sem);
-	valid_fs = (nilfs->ns_mount_state & NILFS_VALID_FS);
-	up_write(&nilfs->ns_sem);
-
 	if (!valid_fs) {
 		printk(KERN_WARNING "NILFS warning: mounting unchecked fs\n");
 		if (s_flags & MS_RDONLY) {
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 20abd55..589786e 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -258,6 +258,16 @@ static inline void nilfs_put_sbinfo(struct nilfs_sb_info *sbi)
 		kfree(sbi);
 }
 
+static inline int nilfs_valid_fs(struct the_nilfs *nilfs)
+{
+	unsigned valid_fs;
+
+	down_read(&nilfs->ns_sem);
+	valid_fs = (nilfs->ns_mount_state & NILFS_VALID_FS);
+	up_read(&nilfs->ns_sem);
+	return valid_fs;
+}
+
 static inline void
 nilfs_get_segment_range(struct the_nilfs *nilfs, __u64 segnum,
 			sector_t *seg_start, sector_t *seg_end)
-- 
1.6.3.4

[PATCH 4/4] nilfs2: add norepair mount option

[Ryusuke Konishi]

This adds norepair mount option that allows users to avoid temporal
write access to a read-only mount or snapshots during mount/recovery.
Without this option, write access will be even performed for those
types of mounts; the temporal write access is needed to mount root
file system read-only after an unclean shutdown.

This option is useful for users to avoid any write access on the
device.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
---
 Documentation/filesystems/nilfs2.txt |    4 ++++
 fs/nilfs2/super.c                    |   14 +++++++++++++-
 fs/nilfs2/the_nilfs.c                |   20 ++++++++++++++++++--
 include/linux/nilfs2_fs.h            |    2 ++
 4 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/Documentation/filesystems/nilfs2.txt b/Documentation/filesystems/nilfs2.txt
index cbd8779..77b2c25 100644
--- a/Documentation/filesystems/nilfs2.txt
+++ b/Documentation/filesystems/nilfs2.txt
@@ -70,6 +70,10 @@ order=strict		Apply strict in-order semantics that preserves sequence
 			blocks.  That means, it is guaranteed that no
 			overtaking of events occurs in the recovered file
 			system after a crash.
+norepair		Disable repair action of filesystem on mount.
+			This disables every write access on the device for
+			read-only mount or snapshots.  This option will fail
+			for r/w mounts on an unclean volume.
 
 NILFS2 usage
 ============
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 990ead4..d516316 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -547,7 +547,7 @@ static const struct export_operations nilfs_export_ops = {
 
 enum {
 	Opt_err_cont, Opt_err_panic, Opt_err_ro,
-	Opt_nobarrier, Opt_snapshot, Opt_order,
+	Opt_nobarrier, Opt_snapshot, Opt_order, Opt_norepair,
 	Opt_err,
 };
 
@@ -558,6 +558,7 @@ static match_table_t tokens = {
 	{Opt_nobarrier, "nobarrier"},
 	{Opt_snapshot, "cp=%u"},
 	{Opt_order, "order=%s"},
+	{Opt_norepair, "norepair"},
 	{Opt_err, NULL}
 };
 
@@ -608,6 +609,9 @@ static int parse_options(char *options, struct super_block *sb)
 			sbi->s_snapshot_cno = option;
 			nilfs_set_opt(sbi, SNAPSHOT);
 			break;
+		case Opt_norepair:
+			nilfs_set_opt(sbi, NOREPAIR);
+			break;
 		default:
 			printk(KERN_ERR
 			       "NILFS: Unrecognized mount option \"%s\"\n", p);
@@ -863,6 +867,14 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
 		goto restore_opts;
 	}
 
+	if (!nilfs_valid_fs(nilfs)) {
+		printk(KERN_WARNING "NILFS (device %s): couldn't "
+		       "remount because the filesystem is in an "
+		       "incomplete recovery state.\n", sb->s_id);
+		err = -EINVAL;
+		goto restore_opts;
+	}
+
 	if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
 		goto out;
 	if (*flags & MS_RDONLY) {
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 890a8d3..352fed9 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -264,8 +264,14 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 	int valid_fs = nilfs_valid_fs(nilfs);
 	int err;
 
-	if (nilfs_loaded(nilfs))
-		return 0;
+	if (nilfs_loaded(nilfs)) {
+		if (valid_fs ||
+		    ((s_flags & MS_RDONLY) && nilfs_test_opt(sbi, NOREPAIR)))
+			return 0;
+		printk(KERN_ERR "NILFS: the filesystem is in an incomplete "
+		       "recovery state.\n");
+		return -EINVAL;
+	}
 
 	if (!valid_fs) {
 		printk(KERN_WARNING "NILFS warning: mounting unchecked fs\n");
@@ -295,6 +301,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 		goto skip_recovery;
 
 	if (s_flags & MS_RDONLY) {
+		if (nilfs_test_opt(sbi, NOREPAIR)) {
+			printk(KERN_INFO "NILFS: norepair option specified. "
+			       "skipping roll-forward recovery\n");
+			goto skip_recovery;
+		}
 		if (really_read_only) {
 			printk(KERN_ERR "NILFS: write access "
 			       "unavailable, cannot proceed.\n");
@@ -302,6 +313,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 			goto failed_unload;
 		}
 		sbi->s_super->s_flags &= ~MS_RDONLY;
+	} else if (nilfs_test_opt(sbi, NOREPAIR)) {
+		printk(KERN_ERR "NILFS: recovery cancelled because norepair "
+		       "option was specified for a read/write mount\n");
+		err = -EINVAL;
+		goto failed_unload;
 	}
 
 	err = nilfs_recover_logical_segments(nilfs, sbi, &ri);
diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
index 72289d2..8376fcb 100644
--- a/include/linux/nilfs2_fs.h
+++ b/include/linux/nilfs2_fs.h
@@ -151,6 +151,8 @@ struct nilfs_super_root {
 #define NILFS_MOUNT_BARRIER		0x1000  /* Use block barriers */
 #define NILFS_MOUNT_STRICT_ORDER	0x2000  /* Apply strict in-order
 						   semantics also for data */
+#define NILFS_MOUNT_NOREPAIR		0x4000  /* Disable write access during
+						   mount-time recovery */
 
 
 /**
-- 
1.6.3.4

Re: [PATCH 4/4] nilfs2: add norepair mount option

[Eric Sandeen]

Ryusuke Konishi wrote:
> This adds norepair mount option that allows users to avoid temporal
> write access to a read-only mount or snapshots during mount/recovery.
> Without this option, write access will be even performed for those
> types of mounts; the temporal write access is needed to mount root
> file system read-only after an unclean shutdown.
> 
> This option is useful for users to avoid any write access on the
> device.

For what it's worth, ext3 & ext4 just added a "norecovery" option as
an alias to "noload" which skips journal replay; xfs already has
"norecovery" - so if you wish to be consistent with ext3/ext4/xfs,
"norecovery" may be a good choice for the option?

Thanks,
-Eric

> Signed-off-by: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
> ---
>  Documentation/filesystems/nilfs2.txt |    4 ++++
>  fs/nilfs2/super.c                    |   14 +++++++++++++-
>  fs/nilfs2/the_nilfs.c                |   20 ++++++++++++++++++--
>  include/linux/nilfs2_fs.h            |    2 ++
>  4 files changed, 37 insertions(+), 3 deletions(-)
> 
> diff --git a/Documentation/filesystems/nilfs2.txt b/Documentation/filesystems/nilfs2.txt
> index cbd8779..77b2c25 100644
> --- a/Documentation/filesystems/nilfs2.txt
> +++ b/Documentation/filesystems/nilfs2.txt
> @@ -70,6 +70,10 @@ order=strict		Apply strict in-order semantics that preserves sequence
>  			blocks.  That means, it is guaranteed that no
>  			overtaking of events occurs in the recovered file
>  			system after a crash.
> +norepair		Disable repair action of filesystem on mount.
> +			This disables every write access on the device for
> +			read-only mount or snapshots.  This option will fail
> +			for r/w mounts on an unclean volume.
>  
>  NILFS2 usage
>  ============
> diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
> index 990ead4..d516316 100644
> --- a/fs/nilfs2/super.c
> +++ b/fs/nilfs2/super.c
> @@ -547,7 +547,7 @@ static const struct export_operations nilfs_export_ops = {
>  
>  enum {
>  	Opt_err_cont, Opt_err_panic, Opt_err_ro,
> -	Opt_nobarrier, Opt_snapshot, Opt_order,
> +	Opt_nobarrier, Opt_snapshot, Opt_order, Opt_norepair,
>  	Opt_err,
>  };
>  
> @@ -558,6 +558,7 @@ static match_table_t tokens = {
>  	{Opt_nobarrier, "nobarrier"},
>  	{Opt_snapshot, "cp=%u"},
>  	{Opt_order, "order=%s"},
> +	{Opt_norepair, "norepair"},
>  	{Opt_err, NULL}
>  };
>  
> @@ -608,6 +609,9 @@ static int parse_options(char *options, struct super_block *sb)
>  			sbi->s_snapshot_cno = option;
>  			nilfs_set_opt(sbi, SNAPSHOT);
>  			break;
> +		case Opt_norepair:
> +			nilfs_set_opt(sbi, NOREPAIR);
> +			break;
>  		default:
>  			printk(KERN_ERR
>  			       "NILFS: Unrecognized mount option \"%s\"\n", p);
> @@ -863,6 +867,14 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
>  		goto restore_opts;
>  	}
>  
> +	if (!nilfs_valid_fs(nilfs)) {
> +		printk(KERN_WARNING "NILFS (device %s): couldn't "
> +		       "remount because the filesystem is in an "
> +		       "incomplete recovery state.\n", sb->s_id);
> +		err = -EINVAL;
> +		goto restore_opts;
> +	}
> +
>  	if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
>  		goto out;
>  	if (*flags & MS_RDONLY) {
> diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
> index 890a8d3..352fed9 100644
> --- a/fs/nilfs2/the_nilfs.c
> +++ b/fs/nilfs2/the_nilfs.c
> @@ -264,8 +264,14 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
>  	int valid_fs = nilfs_valid_fs(nilfs);
>  	int err;
>  
> -	if (nilfs_loaded(nilfs))
> -		return 0;
> +	if (nilfs_loaded(nilfs)) {
> +		if (valid_fs ||
> +		    ((s_flags & MS_RDONLY) && nilfs_test_opt(sbi, NOREPAIR)))
> +			return 0;
> +		printk(KERN_ERR "NILFS: the filesystem is in an incomplete "
> +		       "recovery state.\n");
> +		return -EINVAL;
> +	}
>  
>  	if (!valid_fs) {
>  		printk(KERN_WARNING "NILFS warning: mounting unchecked fs\n");
> @@ -295,6 +301,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
>  		goto skip_recovery;
>  
>  	if (s_flags & MS_RDONLY) {
> +		if (nilfs_test_opt(sbi, NOREPAIR)) {
> +			printk(KERN_INFO "NILFS: norepair option specified. "
> +			       "skipping roll-forward recovery\n");
> +			goto skip_recovery;
> +		}
>  		if (really_read_only) {
>  			printk(KERN_ERR "NILFS: write access "
>  			       "unavailable, cannot proceed.\n");
> @@ -302,6 +313,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
>  			goto failed_unload;
>  		}
>  		sbi->s_super->s_flags &= ~MS_RDONLY;
> +	} else if (nilfs_test_opt(sbi, NOREPAIR)) {
> +		printk(KERN_ERR "NILFS: recovery cancelled because norepair "
> +		       "option was specified for a read/write mount\n");
> +		err = -EINVAL;
> +		goto failed_unload;
>  	}
>  
>  	err = nilfs_recover_logical_segments(nilfs, sbi, &ri);
> diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
> index 72289d2..8376fcb 100644
> --- a/include/linux/nilfs2_fs.h
> +++ b/include/linux/nilfs2_fs.h
> @@ -151,6 +151,8 @@ struct nilfs_super_root {
>  #define NILFS_MOUNT_BARRIER		0x1000  /* Use block barriers */
>  #define NILFS_MOUNT_STRICT_ORDER	0x2000  /* Apply strict in-order
>  						   semantics also for data */
> +#define NILFS_MOUNT_NOREPAIR		0x4000  /* Disable write access during
> +						   mount-time recovery */
>  
>  
>  /**

Re: [PATCH 4/4] nilfs2: add norepair mount option

[Ryusuke Konishi]

Hi,
On Thu, 19 Nov 2009 11:36:28 -0600, Eric Sandeen <sandeen-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> Ryusuke Konishi wrote:
> > This adds norepair mount option that allows users to avoid temporal
> > write access to a read-only mount or snapshots during mount/recovery.
> > Without this option, write access will be even performed for those
> > types of mounts; the temporal write access is needed to mount root
> > file system read-only after an unclean shutdown.
> > 
> > This option is useful for users to avoid any write access on the
> > device.
> 
> For what it's worth, ext3 & ext4 just added a "norecovery" option as
> an alias to "noload" which skips journal replay; xfs already has
> "norecovery" - so if you wish to be consistent with ext3/ext4/xfs,
> "norecovery" may be a good choice for the option?
> 
> Thanks,
> -Eric

Thank you! OK, I'll take your advice.

Ryusuke

Re: [PATCH 4/4] nilfs2: add norepair mount option

[Ryusuke Konishi]

On Fri, 20 Nov 2009 03:10:15 +0900 (JST), Ryusuke Konishi <ryusuke-sG5X7nlA6pw@public.gmane.org> wrote:
> Hi,
> On Thu, 19 Nov 2009 11:36:28 -0600, Eric Sandeen <sandeen-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> > Ryusuke Konishi wrote:
> > > This adds norepair mount option that allows users to avoid temporal
> > > write access to a read-only mount or snapshots during mount/recovery.
> > > Without this option, write access will be even performed for those
> > > types of mounts; the temporal write access is needed to mount root
> > > file system read-only after an unclean shutdown.
> > > 
> > > This option is useful for users to avoid any write access on the
> > > device.
> > 
> > For what it's worth, ext3 & ext4 just added a "norecovery" option as
> > an alias to "noload" which skips journal replay; xfs already has
> > "norecovery" - so if you wish to be consistent with ext3/ext4/xfs,
> > "norecovery" may be a good choice for the option?
> > 
> > Thanks,
> > -Eric
> 
> Thank you! OK, I'll take your advice.
> 
> Ryusuke

Here is a revised version.  I also fixed that the previous patch did
not support "show option" interface.

Thanks,
Ryusuke Konishi
--
Author: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
Date:   Fri Nov 20 03:28:01 2009 +0900

    nilfs2: add norecovery mount option
    
    This adds "norecovery" mount option which disables temporal write
    access to read-only mounts or snapshots during mount/recovery.
    Without this option, write access will be even performed for those
    types of mounts; the temporal write access is needed to mount root
    file system read-only after an unclean shutdown.
    
    This option will be helpful when user wants to prevent any write
    access to the device.
    
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke-Zyj7fXuS5i5L9jVzuh4AOg@public.gmane.org>
    Cc: Eric Sandeen <sandeen-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

diff --git a/Documentation/filesystems/nilfs2.txt b/Documentation/filesystems/nilfs2.txt
index cbd8779..4949fca 100644
--- a/Documentation/filesystems/nilfs2.txt
+++ b/Documentation/filesystems/nilfs2.txt
@@ -70,6 +70,10 @@ order=strict		Apply strict in-order semantics that preserves sequence
 			blocks.  That means, it is guaranteed that no
 			overtaking of events occurs in the recovered file
 			system after a crash.
+norecovery		Disable recovery of the filesystem on mount.
+			This disables every write access on the device for
+			read-only mounts or snapshots.  This option will fail
+			for r/w mounts on an unclean volume.
 
 NILFS2 usage
 ============
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 990ead4..5403b3e 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -479,6 +479,8 @@ static int nilfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
 		seq_printf(seq, ",errors=panic");
 	if (nilfs_test_opt(sbi, STRICT_ORDER))
 		seq_printf(seq, ",order=strict");
+	if (nilfs_test_opt(sbi, NORECOVERY))
+		seq_printf(seq, ",norecovery");
 
 	return 0;
 }
@@ -547,7 +549,7 @@ static const struct export_operations nilfs_export_ops = {
 
 enum {
 	Opt_err_cont, Opt_err_panic, Opt_err_ro,
-	Opt_nobarrier, Opt_snapshot, Opt_order,
+	Opt_nobarrier, Opt_snapshot, Opt_order, Opt_norecovery,
 	Opt_err,
 };
 
@@ -558,6 +560,7 @@ static match_table_t tokens = {
 	{Opt_nobarrier, "nobarrier"},
 	{Opt_snapshot, "cp=%u"},
 	{Opt_order, "order=%s"},
+	{Opt_norecovery, "norecovery"},
 	{Opt_err, NULL}
 };
 
@@ -608,6 +611,9 @@ static int parse_options(char *options, struct super_block *sb)
 			sbi->s_snapshot_cno = option;
 			nilfs_set_opt(sbi, SNAPSHOT);
 			break;
+		case Opt_norecovery:
+			nilfs_set_opt(sbi, NORECOVERY);
+			break;
 		default:
 			printk(KERN_ERR
 			       "NILFS: Unrecognized mount option \"%s\"\n", p);
@@ -863,6 +869,14 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
 		goto restore_opts;
 	}
 
+	if (!nilfs_valid_fs(nilfs)) {
+		printk(KERN_WARNING "NILFS (device %s): couldn't "
+		       "remount because the filesystem is in an "
+		       "incomplete recovery state.\n", sb->s_id);
+		err = -EINVAL;
+		goto restore_opts;
+	}
+
 	if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
 		goto out;
 	if (*flags & MS_RDONLY) {
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 890a8d3..6241e17 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -264,8 +264,14 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 	int valid_fs = nilfs_valid_fs(nilfs);
 	int err;
 
-	if (nilfs_loaded(nilfs))
-		return 0;
+	if (nilfs_loaded(nilfs)) {
+		if (valid_fs ||
+		    ((s_flags & MS_RDONLY) && nilfs_test_opt(sbi, NORECOVERY)))
+			return 0;
+		printk(KERN_ERR "NILFS: the filesystem is in an incomplete "
+		       "recovery state.\n");
+		return -EINVAL;
+	}
 
 	if (!valid_fs) {
 		printk(KERN_WARNING "NILFS warning: mounting unchecked fs\n");
@@ -295,6 +301,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 		goto skip_recovery;
 
 	if (s_flags & MS_RDONLY) {
+		if (nilfs_test_opt(sbi, NORECOVERY)) {
+			printk(KERN_INFO "NILFS: norecovery option specified. "
+			       "skipping roll-forward recovery\n");
+			goto skip_recovery;
+		}
 		if (really_read_only) {
 			printk(KERN_ERR "NILFS: write access "
 			       "unavailable, cannot proceed.\n");
@@ -302,6 +313,11 @@ int load_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 			goto failed_unload;
 		}
 		sbi->s_super->s_flags &= ~MS_RDONLY;
+	} else if (nilfs_test_opt(sbi, NORECOVERY)) {
+		printk(KERN_ERR "NILFS: recovery cancelled because norecovery "
+		       "option was specified for a read/write mount\n");
+		err = -EINVAL;
+		goto failed_unload;
 	}
 
 	err = nilfs_recover_logical_segments(nilfs, sbi, &ri);
diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
index 72289d2..3fe02cf 100644
--- a/include/linux/nilfs2_fs.h
+++ b/include/linux/nilfs2_fs.h
@@ -151,6 +151,8 @@ struct nilfs_super_root {
 #define NILFS_MOUNT_BARRIER		0x1000  /* Use block barriers */
 #define NILFS_MOUNT_STRICT_ORDER	0x2000  /* Apply strict in-order
 						   semantics also for data */
+#define NILFS_MOUNT_NORECOVERY		0x4000  /* Disable write access during
+						   mount-time recovery */
 
 
 /**