master node can not be recovered

[Artem Bityutskiy]

On Wed, 2015-11-04 at 09:03 +0100, Richard Weinberger wrote:
> But if two or more pages are corrupted UBIFS will give up as this
> most not happen
> from UBIFS's point of view.

Right, and I hear that a lot of bug reports and frustration comes from
this. This worked with SLCs we were using when implementing UBIFS
(particularly, Samsung OneNAND was used, it was very high-quality
NAND). Nowadays, this needs to be changed.

UBIFS logic is this. If there is a corruption, then it must be in the
last used NAND page. Pages after this NAND page must contain empty
space.

A small complication, which is not important now, is that UBIFS may
operate with multiple NAND pages, this depends on what the driver tells
is the min. IO size.

No the logic behind this was that we always write data from the
beginning of the LEB, and continue to its end. In case of a power cut,
we can only get corruption in the last NAND page (or more strictly,
min. I/O unit) where we were writing to. The next NAND page and all the
NAND pages after it should be empty. The previous NAND page and all the
NAND pages before it should contain valid data (CRC OK).

Pretty simple. Worked well.

So what has to be changed in this logic? Obviously, the definition of
empty space should be changed, it seems, because obviously not every
driver wants/can ECC-protect the empty space.

What else?