Commit 5d026c72 authored by Kai Bankett's avatar Kai Bankett Committed by Al Viro

fs: initial qnx6fs addition

Adds support for qnx6fs readonly support to the linux kernel.

* Mount option
  The option mmi_fs can be used to mount Harman Becker/Audi MMI 3G
  HDD qnx6fs filesystems.

* Documentation
  A high level filesystem stucture description can be found in the
  Documentation/filesystems directory. (qnx6.txt)

* Additional features
  - Active (stable) superblock selection
  - Superblock checksum check (enforced)
  - Supports mount of qnx6 filesystems with to host different endianess
  - Automatic endianess detection
  - Longfilename support (with non-enfocing crc check)
  - All blocksizes (512, 1024, 2048 and 4096 supported)
Signed-off-by: default avatarKai Bankett <>
Signed-off-by: default avatarAl Viro <>
parent 516cdb68
The QNX6 Filesystem
The qnx6fs is used by newer QNX operating system versions. (e.g. Neutrino)
It got introduced in QNX 6.4.0 and is used default since 6.4.1.
mmi_fs Mount filesystem as used for example by Audi MMI 3G system
qnx6fs shares many properties with traditional Unix filesystems. It has the
concepts of blocks, inodes and directories.
On QNX it is possible to create little endian and big endian qnx6 filesystems.
This feature makes it possible to create and use a different endianness fs
for the target (QNX is used on quite a range of embedded systems) plattform
running on a different endianess.
The Linux driver handles endianness transparently. (LE and BE)
The space in the device or file is split up into blocks. These are a fixed
size of 512, 1024, 2048 or 4096, which is decided when the filesystem is
Blockpointers are 32bit, so the maximum space that can be adressed is
2^32 * 4096 bytes or 16TB
The superblocks
The superblock contains all global information about the filesystem.
Each qnx6fs got two superblocks, each one having a 64bit serial number.
That serial number is used to identify the "active" superblock.
In write mode with reach new snapshot (after each synchronous write), the
serial of the new master superblock is increased (old superblock serial + 1)
So basically the snapshot functionality is realized by an atomic final
update of the serial number. Before updating that serial, all modifications
are done by copying all modified blocks during that specific write request
(or period) and building up a new (stable) filesystem structure under the
inactive superblock.
Each superblock holds a set of root inodes for the different filesystem
parts. (Inode, Bitmap and Longfilenames)
Each of these root nodes holds information like total size of the stored
data and the adressing levels in that specific tree.
If the level value is 0, up to 16 direct blocks can be adressed by each
Level 1 adds an additional indirect adressing level where each indirect
adressing block holds up to blocksize / 4 bytes pointers to data blocks.
Level 2 adds an additional indirect adressig block level (so, already up
to 16 * 256 * 256 = 1048576 blocks that can be adressed by such a tree)a
Unused block pointers are always set to ~0 - regardless of root node,
indirect adressing blocks or inodes.
Data leaves are always on the lowest level. So no data is stored on upper
tree levels.
The first Superblock is located at 0x2000. (0x2000 is the bootblock size)
The Audi MMI 3G first superblock directly starts at byte 0.
Second superblock position can either be calculated from the superblock
information (total number of filesystem blocks) or by taking the highest
device address, zeroing the last 3 bytes and then substracting 0x1000 from
that address.
0x1000 is the size reserved for each superblock - regardless of the
blocksize of the filesystem.
Each object in the filesystem is represented by an inode. (index node)
The inode structure contains pointers to the filesystem blocks which contain
the data held in the object and all of the metadata about an object except
its longname. (filenames longer than 27 characters)
The metadata about an object includes the permissions, owner, group, flags,
size, number of blocks used, access time, change time and modification time.
Object mode field is POSIX format. (which makes things easier)
There are also pointers to the first 16 blocks, if the object data can be
adressed with 16 direct blocks.
For more than 16 blocks an indirect adressing in form of another tree is
used. (scheme is the same as the one used for the superblock root nodes)
The filesize is stored 64bit. Inode counting starts with 1. (whilst long
filename inodes start with 0)
A directory is a filesystem object and has an inode just like a file.
It is a specially formatted file containing records which associate each
name with an inode number.
'.' inode number points to the directory inode
'..' inode number points to the parent directory inode
Eeach filename record additionally got a filename length field.
One special case are long filenames or subdirectory names.
These got set a filename length field of 0xff in the corresponding directory
record plus the longfile inode number also stored in that record.
With that longfilename inode number, the longfilename tree can be walked
starting with the superblock longfilename root node pointers.
Special files
Symbolic links are also filesystem objects with inodes. They got a specific
bit in the inode mode field identifying them as symbolic link.
The directory entry file inode pointer points to the target file inode.
Hard links got an inode, a directory entry, but a specific mode bit set,
no block pointers and the directory file record pointing to the target file
Character and block special devices do not exist in QNX as those files
are handled by the QNX kernel/drivers and created in /dev independant of the
underlaying filesystem.
Long filenames
Long filenames are stored in a seperate adressing tree. The staring point
is the longfilename root node in the active superblock.
Each data block (tree leaves) holds one long filename. That filename is
limited to 510 bytes. The first two starting bytes are used as length field
for the actual filename.
If that structure shall fit for all allowed blocksizes, it is clear why there
is a limit of 510 bytes for the actual filename stored.
The qnx6fs filesystem allocation bitmap is stored in a tree under bitmap
root node in the superblock and each bit in the bitmap represents one
filesystem block.
The first block is block 0, which starts 0x1000 after superblock start.
So for a normal qnx6fs 0x3000 (bootblock + superblock) is the physical
address at which block 0 is located.
Bits at the end of the last bitmap block are set to 1, if the device is
smaller than addressing space in the bitmap.
Bitmap system area
The bitmap itself is devided into three parts.
First the system area, that is split into two halfs.
Then userspace.
The requirement for a static, fixed preallocated system area comes from how
qnx6fs deals with writes.
Each superblock got it's own half of the system area. So superblock #1
always uses blocks from the lower half whilst superblock #2 just writes to
blocks represented by the upper half bitmap system area bits.
Bitmap blocks, Inode blocks and indirect addressing blocks for those two
tree structures are treated as system blocks.
The rational behind that is that a write request can work on a new snapshot
(system area of the inactive - resp. lower serial numbered superblock) while
at the same time there is still a complete stable filesystem structer in the
other half of the system area.
When finished with writing (a sync write is completed, the maximum sync leap
time or a filesystem sync is requested), serial of the previously inactive
superblock atomically is increased and the fs switches over to that - then
stable declared - superblock.
For all data outside the system area, blocks are just copied while writing.
......@@ -210,6 +210,7 @@ source "fs/minix/Kconfig"
source "fs/omfs/Kconfig"
source "fs/hpfs/Kconfig"
source "fs/qnx4/Kconfig"
source "fs/qnx6/Kconfig"
source "fs/romfs/Kconfig"
source "fs/pstore/Kconfig"
source "fs/sysv/Kconfig"
......@@ -102,6 +102,7 @@ obj-$(CONFIG_UBIFS_FS) += ubifs/
obj-$(CONFIG_AFFS_FS) += affs/
obj-$(CONFIG_ROMFS_FS) += romfs/
obj-$(CONFIG_QNX4FS_FS) += qnx4/
obj-$(CONFIG_QNX6FS_FS) += qnx6/
obj-$(CONFIG_AUTOFS4_FS) += autofs4/
obj-$(CONFIG_ADFS_FS) += adfs/
obj-$(CONFIG_FUSE_FS) += fuse/
config QNX6FS_FS
tristate "QNX6 file system support (read only)"
depends on BLOCK && CRC32
This is the file system used by the real-time operating systems
QNX 6 (also called QNX RTP).
Further information is available at <>.
Say Y if you intend to mount QNX hard disks or floppies formatted
with a mkqnx6fs.
However, keep in mind that this currently is a readonly driver!
To compile this file system support as a module, choose M here: the
module will be called qnx6.
If you don't know whether you need it, then you don't need it:
answer N.
bool "QNX6 debugging information"
depends on QNX6FS_FS
Turns on extended debugging output.
If you are not a developer working on the QNX6FS, you probably don't
want this:
answer N.
# Makefile for the linux qnx4-filesystem routines.
obj-$(CONFIG_QNX6FS_FS) += qnx6.o
qnx6-objs := inode.o dir.o namei.o super_mmi.o
This is a snapshot of the QNX6 filesystem for Linux.
Please send diffs and remarks to <> .
Credits :
Al Viro <> (endless patience with me & support ;))
Kai Bankett <> (Maintainer)
* QNX6 file system, Linux implementation.
* Version : 1.0.0
* History :
* 01-02-2012 by Kai Bankett ( : first release.
* 16-02-2012 pagemap extension by Al Viro
#include "qnx6.h"
static unsigned qnx6_lfile_checksum(char *name, unsigned size)
unsigned crc = 0;
char *end = name + size;
while (name < end) {
crc = ((crc >> 1) + *(name++)) ^
((crc & 0x00000001) ? 0x80000000 : 0);
return crc;
static struct page *qnx6_get_page(struct inode *dir, unsigned long n)
struct address_space *mapping = dir->i_mapping;
struct page *page = read_mapping_page(mapping, n, NULL);
if (!IS_ERR(page))
return page;
static inline unsigned long dir_pages(struct inode *inode)
return (inode->i_size+PAGE_CACHE_SIZE-1)>>PAGE_CACHE_SHIFT;
static unsigned last_entry(struct inode *inode, unsigned long page_nr)
unsigned long last_byte = inode->i_size;
last_byte -= page_nr << PAGE_CACHE_SHIFT;
if (last_byte > PAGE_CACHE_SIZE)
last_byte = PAGE_CACHE_SIZE;
return last_byte / QNX6_DIR_ENTRY_SIZE;
static struct qnx6_long_filename *qnx6_longname(struct super_block *sb,
struct qnx6_long_dir_entry *de,
struct page **p)
struct qnx6_sb_info *sbi = QNX6_SB(sb);
u32 s = fs32_to_cpu(sbi, de->de_long_inode); /* in block units */
u32 n = s >> (PAGE_CACHE_SHIFT - sb->s_blocksize_bits); /* in pages */
/* within page */
u32 offs = (s << sb->s_blocksize_bits) & ~PAGE_CACHE_MASK;
struct address_space *mapping = sbi->longfile->i_mapping;
struct page *page = read_mapping_page(mapping, n, NULL);
if (IS_ERR(page))
return ERR_CAST(page);
kmap(*p = page);
return (struct qnx6_long_filename *)(page_address(page) + offs);
static int qnx6_dir_longfilename(struct inode *inode,
struct qnx6_long_dir_entry *de,
void *dirent, loff_t pos,
unsigned de_inode, filldir_t filldir)
struct qnx6_long_filename *lf;
struct super_block *s = inode->i_sb;
struct qnx6_sb_info *sbi = QNX6_SB(s);
struct page *page;
int lf_size;
if (de->de_size != 0xff) {
/* error - long filename entries always have size 0xff
in direntry */
printk(KERN_ERR "qnx6: invalid direntry size (%i).\n",
return 0;
lf = qnx6_longname(s, de, &page);
if (IS_ERR(lf)) {
printk(KERN_ERR "qnx6:Error reading longname\n");
return 0;
lf_size = fs16_to_cpu(sbi, lf->lf_size);
if (lf_size > QNX6_LONG_NAME_MAX) {
QNX6DEBUG((KERN_INFO "file %s\n", lf->lf_fname));
printk(KERN_ERR "qnx6:Filename too long (%i)\n", lf_size);
return 0;
/* calc & validate longfilename checksum
mmi 3g filesystem does not have that checksum */
if (!test_opt(s, MMI_FS) && fs32_to_cpu(sbi, de->de_checksum) !=
qnx6_lfile_checksum(lf->lf_fname, lf_size))
printk(KERN_INFO "qnx6: long filename checksum error.\n");
QNX6DEBUG((KERN_INFO "qnx6_readdir:%.*s inode:%u\n",
lf_size, lf->lf_fname, de_inode));
if (filldir(dirent, lf->lf_fname, lf_size, pos, de_inode,
DT_UNKNOWN) < 0) {
return 0;
/* success */
return 1;
static int qnx6_readdir(struct file *filp, void *dirent, filldir_t filldir)
struct inode *inode = filp->f_path.dentry->d_inode;
struct super_block *s = inode->i_sb;
struct qnx6_sb_info *sbi = QNX6_SB(s);
loff_t pos = filp->f_pos & (QNX6_DIR_ENTRY_SIZE - 1);
unsigned long npages = dir_pages(inode);
unsigned long n = pos >> PAGE_CACHE_SHIFT;
unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE;
bool done = false;
if (filp->f_pos >= inode->i_size)
return 0;
for ( ; !done && n < npages; n++, start = 0) {
struct page *page = qnx6_get_page(inode, n);
int limit = last_entry(inode, n);
struct qnx6_dir_entry *de;
int i = start;
if (IS_ERR(page)) {
printk(KERN_ERR "qnx6_readdir: read failed\n");
filp->f_pos = (n + 1) << PAGE_CACHE_SHIFT;
return PTR_ERR(page);
de = ((struct qnx6_dir_entry *)page_address(page)) + start;
for (; i < limit; i++, de++, pos += QNX6_DIR_ENTRY_SIZE) {
int size = de->de_size;
u32 no_inode = fs32_to_cpu(sbi, de->de_inode);
if (!no_inode || !size)
if (size > QNX6_SHORT_NAME_MAX) {
/* long filename detected
get the filename from long filename
structure / block */
if (!qnx6_dir_longfilename(inode,
(struct qnx6_long_dir_entry *)de,
dirent, pos, no_inode,
filldir)) {
done = true;
} else {
QNX6DEBUG((KERN_INFO "qnx6_readdir:%.*s"
" inode:%u\n", size, de->de_fname,
if (filldir(dirent, de->de_fname, size,
pos, no_inode, DT_UNKNOWN)
< 0) {
done = true;
filp->f_pos = pos;
return 0;
* check if the long filename is correct.
static unsigned qnx6_long_match(int len, const char *name,
struct qnx6_long_dir_entry *de, struct inode *dir)
struct super_block *s = dir->i_sb;
struct qnx6_sb_info *sbi = QNX6_SB(s);
struct page *page;
int thislen;
struct qnx6_long_filename *lf = qnx6_longname(s, de, &page);
if (IS_ERR(lf))
return 0;
thislen = fs16_to_cpu(sbi, lf->lf_size);
if (len != thislen) {
return 0;
if (memcmp(name, lf->lf_fname, len) == 0) {
return fs32_to_cpu(sbi, de->de_inode);
return 0;
* check if the filename is correct.
static unsigned qnx6_match(struct super_block *s, int len, const char *name,
struct qnx6_dir_entry *de)
struct qnx6_sb_info *sbi = QNX6_SB(s);
if (memcmp(name, de->de_fname, len) == 0)
return fs32_to_cpu(sbi, de->de_inode);
return 0;
unsigned qnx6_find_entry(int len, struct inode *dir, const char *name,
struct page **res_page)
struct super_block *s = dir->i_sb;
struct qnx6_inode_info *ei = QNX6_I(dir);
struct page *page = NULL;
unsigned long start, n;
unsigned long npages = dir_pages(dir);
unsigned ino;
struct qnx6_dir_entry *de;
struct qnx6_long_dir_entry *lde;
*res_page = NULL;
if (npages == 0)
return 0;
start = ei->i_dir_start_lookup;
if (start >= npages)
start = 0;
n = start;
do {
page = qnx6_get_page(dir, n);
if (!IS_ERR(page)) {
int limit = last_entry(dir, n);
int i;
de = (struct qnx6_dir_entry *)page_address(page);
for (i = 0; i < limit; i++, de++) {
if (len <= QNX6_SHORT_NAME_MAX) {
/* short filename */
if (len != de->de_size)
ino = qnx6_match(s, len, name, de);
if (ino)
goto found;
} else if (de->de_size == 0xff) {
/* deal with long filename */
lde = (struct qnx6_long_dir_entry *)de;
ino = qnx6_long_match(len,
name, lde, dir);
if (ino)
goto found;
} else
printk(KERN_ERR "qnx6: undefined "
"filename size in inode.\n");
if (++n >= npages)
n = 0;
} while (n != start);
return 0;
*res_page = page;
ei->i_dir_start_lookup = n;
return ino;
const struct file_operations qnx6_dir_operations = {
.llseek = generic_file_llseek,
.read = generic_read_dir,
.readdir = qnx6_readdir,
.fsync = generic_file_fsync,
const struct inode_operations qnx6_dir_inode_operations = {
.lookup = qnx6_lookup,
This diff is collapsed.
* QNX6 file system, Linux implementation.
* Version : 1.0.0
* History :
* 01-02-2012 by Kai Bankett ( : first release.
* 16-02-2012 pagemap extension by Al Viro
#include "qnx6.h"
struct dentry *qnx6_lookup(struct inode *dir, struct dentry *dentry,
struct nameidata *nd)
unsigned ino;
struct page *page;
struct inode *foundinode = NULL;
const char *name = dentry->;
int len = dentry->d_name.len;
if (len > QNX6_LONG_NAME_MAX)
ino = qnx6_find_entry(len, dir, name, &page);
if (ino) {
foundinode = qnx6_iget(dir->i_sb, ino);
if (IS_ERR(foundinode)) {
QNX6DEBUG((KERN_ERR "qnx6: lookup->iget -> "
" error %ld\n", PTR_ERR(foundinode)));
return ERR_CAST(foundinode);
} else {
QNX6DEBUG((KERN_INFO "qnx6_lookup: not found %s\n", name));
return NULL;
d_add(dentry, foundinode);
return NULL;
* QNX6 file system, Linux implementation.
* Version : 1.0.0
* History :
* 01-02-2012 by Kai Bankett ( : first release.
* 16-02-2012 page map extension by Al Viro
#include <linux/fs.h>
#include <linux/pagemap.h>
typedef __u16 __bitwise __fs16;
typedef __u32 __bitwise __fs32;
typedef __u64 __bitwise __fs64;
#include <linux/qnx6_fs.h>
#define QNX6DEBUG(X) printk X
#define QNX6DEBUG(X) (void) 0
struct qnx6_sb_info {
struct buffer_head *sb_buf; /* superblock buffer */
struct qnx6_super_block *sb; /* our superblock */
int s_blks_off; /* blkoffset fs-startpoint */
int s_ptrbits; /* indirect pointer bitfield */
unsigned long s_mount_opt; /* all mount options */
int s_bytesex; /* holds endianess info */
struct inode * inodes;
struct inode * longfile;
struct qnx6_inode_info {
__fs32 di_block_ptr[QNX6_NO_DIRECT_POINTERS];
__u8 di_filelevels;
__u32 i_dir_start_lookup;
struct inode vfs_inode;
extern struct inode *qnx6_iget(struct super_block *sb, unsigned ino);
extern struct dentry *qnx6_lookup(struct inode *dir, struct dentry *dentry,
struct nameidata *nd);
extern void qnx6_superblock_debug(struct qnx6_super_block *,
struct super_block *);
extern const struct inode_operations qnx6_dir_inode_operations;
extern const struct file_operations qnx6_dir_operations;
static inline struct qnx6_sb_info *QNX6_SB(struct super_block *sb)
return sb->s_fs_info;
static inline struct qnx6_inode_info *QNX6_I(struct inode *inode)
return container_of(inode, struct qnx6_inode_info, vfs_inode);
#define clear_opt(o, opt) (o &= ~(QNX6_MOUNT_##opt))
#define set_opt(o, opt) (o |= (QNX6_MOUNT_##opt))
#define test_opt(sb, opt) (QNX6_SB(sb)->s_mount_opt & \
enum {
static inline __u64 fs64_to_cpu(struct qnx6_sb_info *sbi, __fs64 n)
if (sbi->s_bytesex == BYTESEX_LE)
return le64_to_cpu((__force __le64)n);
return be64_to_cpu((__force __be64)n);
static inline __fs64 cpu_to_fs64(struct qnx6_sb_info *sbi, __u64 n)
if (sbi->s_bytesex == BYTESEX_LE)